From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51EED21CA03 for ; Mon, 25 May 2026 15:34:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779723248; cv=none; b=ZO/trpx2dTcJT2rw5ViClf8PahbWkibhIdp74JiGN/a/mcCc9R0KkuGibEnna1WY8z7MP58z3MMW27xKx9Gbm8qMXySmxILIuygMnmtyGKtv5gSVGeHZ0ltDekt1CvuXH1e6YZl0Yjl5BM53Jm1TziatnYxC1ue/w/Gwy+sxrb8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779723248; c=relaxed/simple; bh=rdnFBHKbBBPplcZ6MXPXTA26DUIpB9jtCdPQFuuCKuc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=WdY6YTVcFb5WVGqX3Z+cJ0qKpYvgLrArLRt1NmjTNESAXDaktDBVzi4hG+mLKQeW2LtqaJ+S7x3WEiGCj5qpR6f77ZdltpvFgYHf8waiK8D7bJqjlAF9URVuNM6a89n0nmzSu/bqwiljKmBMtwQFe83IGjkObkPSJil5Y0ci/6g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qxYC2Tac; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qxYC2Tac" Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-36974217d4eso6335799a91.2 for ; Mon, 25 May 2026 08:34:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779723247; x=1780328047; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=e8t7kLbAK9p7SxyrSTzXXj82MYs+abLkLgms996DrS8=; b=qxYC2Tac35m349WHUliJWuThxWGKQhtRrERRJV6RW0VZJncvIvlMNV1u8XNGEQmbta 6gLiJUd3qvEgdi4pW5Tua/6Z1NCaZVnBWABWo8pE4VNAEVGuCf+ISAqOkno1EXaULmQI XTuAbjJNIpiIQhuKSppkw/s1Z+klVeJ9SvYAbuuln97WzcWxMOISibpi3IYKNgp7Xdhk hGl8aSpcxx3+3LRqToc/LZHFgmx/FgFJv8nXEr5RbRBKrSlSFvfmB0PtDM9+auspiby/ t7LBJ49p3NJzexOfeMEkhojgCTa9wVoNbPFuYfk1AzUB5jKQoFPvuSGWEA4OYyNJDQL5 nUSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779723247; x=1780328047; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=e8t7kLbAK9p7SxyrSTzXXj82MYs+abLkLgms996DrS8=; b=A5aaFXVAnreMGGATNyTpz+kO6ayM8bUNb4SIL1KlqOvzrG6Y9tGJbFHTVgT5G8/D9p O5tRsOK6xVU8XqN1b9QPyzN6AvIoYqHx1o9/Y5JVQpyWrs8lB+TmsdFxR9n2V5ZToTG6 aey2TEbW0g3SjrUVRDNNS9PXTM19jRFdDY3k1PZc2fXFVng7s3Pr3P33Q97MRgbEp9PB VMerqivvEvTMfSVHJsGaR40BUOKSTALnVl1h2jGSGrEKMYz249j4lCckHoMo4t03fyd/ zMGFYFPJQgIgFfVjN4s7KpEbF2bHYHNwhUHMquOUvtoA9OH7SguWlCTbyAog6bi4SWeX xgyA== X-Forwarded-Encrypted: i=1; AFNElJ9KMetRWVI3YJ+pdrwSstnVFMw3ycerJ2K0FklbsBrDsIOvON64ycgAkR+rk4/D/5Qrln4NOSJ89zzz9mY=@vger.kernel.org X-Gm-Message-State: AOJu0YzgiFliROnf7HG9+E3crW1iIZu0sFYPOVOgsgSdm6VS3wM9Q+o1 nAPt6n9YvrtJx8bfj47JP4uaTalP7vUxjdxed1wE2YBRdmI8Rt2/OHEd X-Gm-Gg: Acq92OFUXKyFjnMJA3WhYVQEuDp0GMEWfX+pZf8UIGx+mnRwLwOopzKIwhydIV3DfQH 1ag93qKUPOalHTOx/xv1AcEk54tRDkx15vvOY6aJjGwGhyZhCLGVTMKP4UWax2zR+n2ycsxTSS4 KbLmSNz/YJAtbRmcis5OmwpwlX4o1CqWF5rnVPdkkn/wOheL8O1Ey5OylMUPx46oqQ4nj+pqwk+ 1aj72BG8OjVFk1YPlphwAkJmtv1KWSpMntSSie7npJrvwBOxaHhg9DvK5zuc3Ajmeh1dJz/lO6x eZgRqABePKeshuLRFHCNd19d+lAqSJdFRzibRNEhAAZ31x+AZ79kiV/V0oVUJTMqq0chSgAHNYr 9/zd/Wd51hVyfp5NhvGGQllPdMFNVr+Ht46gW7pLmmkAcrtm20s0xt6wz+8sLMzI27uqoY7KJfc ZTXL2U3P+012w3zLJhAa8FVNkOqPRkg2qKwxKYJ5uzZpRHdT72BjX5mzzj7efPBTgsdsvu X-Received: by 2002:a17:903:1a70:b0:2b9:ec37:2977 with SMTP id d9443c01a7336-2beb06bf9d7mr162432535ad.38.1779723246644; Mon, 25 May 2026 08:34:06 -0700 (PDT) Received: from ?IPV6:240b:10:2720:5500:34c9:7e9c:7c33:58d6? ([240b:10:2720:5500:34c9:7e9c:7c33:58d6]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2beb5695f54sm102466845ad.10.2026.05.25.08.34.03 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 25 May 2026 08:34:05 -0700 (PDT) Message-ID: Date: Tue, 26 May 2026 00:34:03 +0900 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v5] nvme: reject passthrough of driver-managed Set Features To: Chao Shi , linux-nvme@lists.infradead.org, Keith Busch Cc: Christoph Hellwig , Sagi Grimberg , Jens Axboe , Tatsuya Sasaki , Maurizio Lombardi , linux-kernel@vger.kernel.org, Sungwoo Kim , Dave Tian , Weidong Zhu References: <20260523225629.3964037-1-coshi036@gmail.com> Content-Language: en-US From: Tokunori Ikegami In-Reply-To: <20260523225629.3964037-1-coshi036@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit On 2026/05/24 7:56, Chao Shi wrote: > Since commit b58da2d270db ("nvme: update keep alive interval when kato > is modified"), userspace can start keep-alive on any transport via a > Set Features (KATO) passthrough command. nvme_keep_alive_work() then > allocates with BLK_MQ_REQ_RESERVED, but nvme_alloc_admin_tag_set() > only reserves admin tags for fabrics, so the allocation trips > WARN_ON_ONCE() in blk_mq_get_tag() and fails: > > nvme nvme0: keep-alive failed: -11 > > More generally, several Set Features change controller state that the > driver manages itself and cannot react to correctly when set behind > its back from userspace. Reject these in nvme_cmd_allowed(): > > - KATO on non-fabrics (keep-alive is only armed for fabrics; on PCIe > it has no reserved tag and an active keep-alive harms idle power > states) > - Host Behavior Support, Host Memory Buffer, Number of Queues, and > Autonomous Power State Transition (all driver-managed) > > Keep Alive on fabrics is unchanged. I/O commands are unaffected as the > check is confined to the admin path (ns == NULL). > > Link: https://lore.kernel.org/linux-nvme/20260522162639.395802-1-coshi036@gmail.com/ > > Fixes: b58da2d270db ("nvme: update keep alive interval when kato is modified") > > Found by FuzzNvme(Syzkaller with FEMU fuzzing framework). > > Acked-by: Sungwoo Kim > Acked-by: Dave Tian > Acked-by: Weidong Zhu > Signed-off-by: Chao Shi > --- > > Reproducer for the keep-alive case (run as root on a PCIe NVMe device): > > #include > #include > #include > #include > #include > > int main(void) > { > struct nvme_admin_cmd cmd = {0}; > int fd = open("/dev/nvme0", O_RDWR); > if (fd < 0) { perror("open"); return 1; } > cmd.opcode = 0x09; /* SET_FEATURES */ > cmd.cdw10 = 0x0f; /* Feature ID: KATO */ > cmd.cdw11 = 5; /* KATO = 5 seconds */ > if (ioctl(fd, NVME_IOCTL_ADMIN_CMD, &cmd) < 0) { > perror("ioctl"); > return 1; > } > return 0; > } > > On an unpatched kernel, within ~kato/2 seconds after the program exits, > dmesg shows: > > nvme nvme0: keep alive interval updated from 0 ms to 5000 ms > WARNING: CPU: 0 PID: ... at block/blk-mq-tag.c:148 blk_mq_get_tag+... > nvme nvme0: keep-alive failed: -11 > > With this patch the ioctl fails with EACCES on non-fabrics. > > Changes since v4: > - Fold the check into the existing nvme_cmd_allowed() instead of a > separate helper, and reject additional driver-managed Set Features > (Host Behavior, Host Memory Buffer, Number of Queues, Autonomous > Power State Transition) in the same switch (Keith Busch). The admin > vs I/O distinction is now structural: the switch lives in the > ns == NULL branch, so I/O commands (e.g. Dataset Management, which > shares opcode 0x09 with Set Features) are never inspected. > > Changes since v3: > - Only inspect admin commands so a DSM I/O command is not wrongly > rejected (Keith Busch). > > Changes since v2: > - Reject the KATO passthrough on non-fabrics instead of reserving an > admin tag for all transports (Keith Busch, Christoph Hellwig). > > Changes since v1: > - v2 added a spec citation and quirk discussion, superseded by the > reject approach. > > drivers/nvme/host/ioctl.c | 33 +++++++++++++++++++++++++++------ > 1 file changed, 27 insertions(+), 6 deletions(-) > > diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c > index a9c097dacad6..31784506e845 100644 > --- a/drivers/nvme/host/ioctl.c > +++ b/drivers/nvme/host/ioctl.c > @@ -14,8 +14,9 @@ enum { > NVME_IOCTL_PARTITION = (1 << 1), > }; > > -static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c, > - unsigned int flags, bool open_for_write) > +static bool nvme_cmd_allowed(struct nvme_ctrl *ctrl, struct nvme_ns *ns, > + struct nvme_command *c, unsigned int flags, > + bool open_for_write) The struct nvme_ns does already have the struct nvme_ctrl *ctrl as a member variable as below so seems not necessary to add the function argument struct nvme_ctrl *ctrl. struct nvme_ns {     struct list_head list;     struct nvme_ctrl *ctrl;