[PATCH] nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

[PATCH] nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

[Greg Kroah-Hartman]

When fuzzing the nvme target code, I tripped a kernel warning in
nvmet_tcp_map_data() because the length passed into the allocator is
controlled by the remote initiator.

A remote initiator that sends a command with an SGL claiming a huge
number, can create a scatterlist and iovec allocation of over 1 million
entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER
and then the page allocator will trip on a WARN_ON_ONCE_GFP() message:

  WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof
  Workqueue: nvmet_tcp_wq nvmet_tcp_io_work
  ...
  sgl_alloc_order
  nvmet_tcp_map_data
  nvmet_tcp_try_recv_pdu

As it's never good to trip a kernel warning remotely due to many systems
having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to
the allocation flags.

Assisted-by: gkh_clanker_2000
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/target/tcp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 75a276d73be3..d61622ed8dd8 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -433,13 +433,14 @@ static int nvmet_tcp_map_data(struct nvmet_tcp_cmd *cmd)
 	}
 	cmd->req.transfer_len += len;
 
-	cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt);
+	cmd->req.sg = sgl_alloc(len, GFP_KERNEL | __GFP_NOWARN, &cmd->req.sg_cnt);
 	if (!cmd->req.sg)
 		return NVME_SC_INTERNAL;
 	cmd->cur_sg = cmd->req.sg;
 
 	if (nvmet_tcp_has_data_in(cmd)) {
-		cmd->iov = kmalloc_objs(*cmd->iov, cmd->req.sg_cnt);
+		cmd->iov = kmalloc_objs(*cmd->iov, cmd->req.sg_cnt,
+					GFP_KERNEL | __GFP_NOWARN);
 		if (!cmd->iov)
 			goto err;
 	}

---
base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
change-id: 20260727-nvme-tcp-5cce0f73b0cc

Best regards,
--  
Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Re: [PATCH] nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

[Keith Busch]

On Mon, Jul 27, 2026 at 10:03:31PM +0200, Greg Kroah-Hartman wrote:
> When fuzzing the nvme target code, I tripped a kernel warning in
> nvmet_tcp_map_data() because the length passed into the allocator is
> controlled by the remote initiator.

Thanks, applied to nvme-7.3 with a minor fix for an overly long line.

Re: [PATCH] nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

[Greg Kroah-Hartman]

On Tue, Jul 28, 2026 at 11:14:46AM -0600, Keith Busch wrote:
> On Mon, Jul 27, 2026 at 10:03:31PM +0200, Greg Kroah-Hartman wrote:
> > When fuzzing the nvme target code, I tripped a kernel warning in
> > nvmet_tcp_map_data() because the length passed into the allocator is
> > controlled by the remote initiator.
> 
> Thanks, applied to nvme-7.3 with a minor fix for an overly long line.

Thanks, I thought you all would allow stuff longer than 80 columns like
the rest of the kernel does in places :)

greg k-h

Re: [PATCH] nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations

[Keith Busch]

On Wed, Jul 29, 2026 at 07:39:09AM +0200, Greg Kroah-Hartman wrote:
> Thanks, I thought you all would allow stuff longer than 80 columns like
> the rest of the kernel does in places :)

The rest of the kernel on the wrong side of the 80 column limit is
wrong. :)