From: Shao Mingyin nvmet_passthru_override_id_ns() clears the metadata size of every LBA format reported by the backing controller: for (i = 0; i < (id->nlbaf + 1); i++) if (id->lbaf[i].ms) memset(&id->lbaf[i], 0, sizeof(id->lbaf[i])); The Identify Namespace data comes from the backing controller and nlbaf is a u8 in that structure, while the LBA format table has only 64 entries. A broken or malicious backing controller can report nlbaf = 0xff, which makes the loop clear the vendor specific fields that follow the LBA format table and return an inconsistent identify structure to the host, e.g. a format count that does not match the table. Reject such an identify data structure and return an internal error instead of rewriting unrelated fields. Fixes: c1fef73f793b ("nvmet: add passthru code to process commands") Cc: stable@vger.kernel.org Signed-off-by: Shao Mingyin --- Tested on 7.3.0-next-20261030 (QEMU/TCG guest) with the loop transport. A passthru subsystem is backed by a file-backed loop namespace, so the host driver and the target run in the same guest. A TEST-ONLY hook makes the backing Identify Namespace report nlbaf = 0xff; only the nvmet fix differs between the two runs. Sending Identify Namespace (CNS = 0) to the passthru controller, the unpatched loop runs (nlbaf + 1) = 256 times against the 64-entry LBA format table and clears the 768 vendor bytes right after it: unpatched patched identify accepted (ret = 0) identify rejected (ret = 6, nlbaf = 0xff NVME_SC_INTERNAL) vs[0..767] cleared to 0 no data returned vs[768] still 0xaa drivers/nvme/target/passthru.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/nvme/target/passthru.c b/drivers/nvme/target/passthru.c index 6b67880c7bb2..30c06bf0e5f1 100644 --- a/drivers/nvme/target/passthru.c +++ b/drivers/nvme/target/passthru.c @@ -195,6 +195,11 @@ static u16 nvmet_passthru_override_id_ns(struct nvmet_req *req) if (status) goto out_free; + if (id->nlbaf >= ARRAY_SIZE(id->lbaf)) { + status = NVME_SC_INTERNAL; + goto out_free; + } + for (i = 0; i < (id->nlbaf + 1); i++) if (id->lbaf[i].ms) memset(&id->lbaf[i], 0, sizeof(id->lbaf[i])); -- 2.43.0