From: Shao Mingyin nvme_submit_user_cmd() skips mapping when the user address is zero, even if a nonzero data length was supplied. Passthrough ioctls and NVME_IOCTL_SUBMIT_IO can therefore submit a data-transfer command without a mapped payload. For example, the loop target returns a Data SGL Length Invalid status instead of rejecting the user buffer. Map whenever a length is given and let the mapping helper validate the address. This also permits address zero if the process has valid memory mapped there, matching the io_uring passthrough behavior from commit 99fde895ff56 ("nvme: map uring_cmd data even if address is 0"). Fixes: d29ec8241c10 ("nvme: submit internal commands through the block layer") Cc: stable@vger.kernel.org Signed-off-by: Shao Mingyin --- Tested on 7.3.0-next-20261030 (QEMU/TCG guest) with the loop transport and a file-backed namespace. NVME_IOCTL_IO_CMD with addr=0 and a nonzero data_len skips the mapping on the unpatched kernel and submits the command with an empty data pointer, so the target rejects it with "Data SGL Length Invalid" (status 0x600f). With the patch the mapping helper rejects the null user address with -EFAULT before the command is submitted: unpatched patched control read (valid addr) ret 0 control read (valid addr) ret 0 read addr=0 len=4096 ret 0x600f read addr=0 len=4096 -EFAULT write addr=0 len=4096 ret 0x600f write addr=0 len=4096 -EFAULT drivers/nvme/host/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c index a87c9ca9d06c..22efc5412416 100644 --- a/drivers/nvme/host/ioctl.c +++ b/drivers/nvme/host/ioctl.c @@ -207,7 +207,7 @@ static int nvme_submit_user_cmd(struct request_queue *q, return PTR_ERR(req); req->timeout = timeout; - if (ubuffer && bufflen) { + if (bufflen) { ret = nvme_map_user_request(req, ubuffer, bufflen, meta_buffer, meta_len, NULL, flags); if (ret) -- 2.43.0