[PATCH 0/2] nvmet: pci-epf: fix a configfs overflow and a failed-read hang

[<shao.mingyin@zte.com.cn>]

This series fixes two independent bugs in the NVMe PCI endpoint function
target driver.

Patch 1 fixes a heap overflow in the subsysnqn configfs attribute.  The
store callback passed the length of the configfs write buffer to
strscpy() as the destination size; an NQN longer than NVMF_NQN_SIZE
therefore wrote past subsysnqn into the following fields of the
nvmet_pci_epf object.

Patch 2 fixes a hang on failed read commands.  queue_response() completed
a command with a non-zero status directly, without waking
exec_iod_work(), which is waiting for the transfer of a DMA_TO_DEVICE
command.  The completion queue work could then free the iod while the
work item was still waiting on iod->done.  The work item now waits based
only on the data direction and length, and completes the command after
the wait even when it failed.  This is a follow-up to the recent fix for
the use-after-free in the same function (c9e9bb757971), which moved the
wait decision earlier but left the failed-command case from
746d0ac5a07d in place.

The two patches are independent, have no inter-patch dependencies and can
be applied in any order or as a subset.  Both carry Fixes: and
Cc: stable.

Testing: both apply to next-20261030, pass checkpatch.pl --strict with
0 errors/0 warnings/0 checks, and drivers/nvme/target/pci-epf.c builds
with CONFIG_NVME_TARGET_PCI_EPF=m and W=1 without new warnings.

Patch 1 was also reproduced and re-tested in QEMU (7.3.0-next-20261030,
configfs pci_ep framework, no endpoint controller needed): writing a
230-byte value through the subsysnqn attribute stored it and clobbered
mdts_kb (512 -> 4276545) before the fix, and is rejected with -EINVAL
after it.  Patch 2 was not runtime-tested: this setup has no PCI
endpoint controller.

Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
base-commit: 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c