From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3BBE92EBB84
	for <linux-kernel@vger.kernel.org>; Tue,  2 Jun 2026 12:19:22 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1780402763; cv=none; b=XpKjBkCNFBTDh/1PrJY8Ws1lyuI8UZebL8vRHEBiJksXaMN9QpJ0RmB0DMEFGXAM0r5E3BTUchgUGiMtabXCQtLaAQVisJLsHX7GZIcGsnt1UT3j063KVZb58eLc0BxMNJJbBSwhWUbsXgyv25DlnZd24ngFwQwk/6BML++WwQQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1780402763; c=relaxed/simple;
	bh=/N4Evf6clyMdx6Nrus2bf60jswInHxAJVWpv+0vs9i4=;
	h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:
	 Content-Type:Content-Disposition:In-Reply-To; b=IX06el4X+HibA4az/dZNectN7YcT1oDVO9He3Wuep7nbBUeK29TjHtXKVtGZTO/2qqq/7gsmAI/y665cZcStarPTyQWNaoohkcXwsKSWTIcGrQs/BMOagOAs3TZo/VJj41gpw/yd5NdRw24HQdYPcWWCtLhz/2WMk4sio2H/e1M=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=U1GMJVae; arc=none smtp.client-ip=100.103.45.18
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="U1GMJVae"
Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF72C1F00893;
	Tue,  2 Jun 2026 12:19:20 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org;
	s=k20260515; t=1780402762;
	bh=gZM4EZBIz25FgIdBjHrmrU2mVdWII7hTPyIkOvvWKDE=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To;
	b=U1GMJVaexr4MMrCm+8WR+SRGsTscD2h1gGHeK+hutWrgDGvH1jZdIBCCU0VDY/Auo
	 Pd9I/GRV1kGXqcmJB83QsXwJ1a/J3Be5JV5Q3yf7BmbdS5aUVyAUX1N41fWjC3qwET
	 VXOXHqoaPhAsIWbtBibirqRgU9JJ+7w882toYLnsq8QDDNzqJhxNZUyIEf643vSAio
	 DI+EY4wKwGKAU0tJSXI/rmHM/XKevvOePVXM78L1/hdkFPGxYDpbcifm5mQHxFn1dq
	 tMQ03C20JbRoQy02DuvmiNaQ18hWo47aDeuaZch7poPoCbKb4HTPCNCr1bQbulTFjA
	 qIIrUOIk+qKkw==
Date: Tue, 2 Jun 2026 13:19:16 +0100
From: Keith Busch <kbusch@kernel.org>
To: liuxixin <gliuxen@gmail.com>
Cc: linux-nvme@lists.infradead.org, axboe@kernel.dk, hch@lst.de,
	sagi@grimberg.me, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v4 2/2] nvme: validate FDP configuration descriptor sizes
Message-ID: <ah7KRIl3LNsbWLO4@kbusch-mbp>
References: <20260527133205.GA12042@lst.de>
 <cover.1779930057.git.gliuxen@gmail.com>
 <20260528083016.GB7073@lst.de>
 <20260528083043.GC7073@lst.de>
 <cover.1748418000.git.gliuxen@gmail.com>
 <b2f3e4d5c6b7a8901bcdef2345678901bcdef234.1748418000.git.gliuxen@gmail.com>
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <b2f3e4d5c6b7a8901bcdef2345678901bcdef234.1748418000.git.gliuxen@gmail.com>

On Thu, May 28, 2026 at 06:00:02PM +0800, liuxixin wrote:
> @@ -2275,7 +2275,15 @@ static int nvme_query_fdp_granularity(struct nvme_ctrl *ctrl,
>  	desc = log;
>  	end = log + size - sizeof(*h);
>  	for (i = 0; i < fdp_idx; i++) {
> -		log += le16_to_cpu(desc->dsze);
> +		u16 dsze = le16_to_cpu(desc->dsze);
> +
> +		if (!dsze || log + dsze > end) {
> +			dev_warn(ctrl->device,
> +				 "FDP invalid config descriptor at index %d\n", i);
> +			ret = 0;
> +			goto out;
> +		}
> +		log += dsze;
>  		desc = log;
>  		if (log >= end) {
>  			dev_warn(ctrl->device,

I think you can delete this "log >= end" check now that you added the
same check right above.