)]}'
{"pci-sim/fake_pci_sriov_nvme.c":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"22745ccac311a53673616b393a5a2b29bdf2df45","unresolved":false,"context_lines":[{"line_number":936,"context_line":"{"},{"line_number":937,"context_line":"\tu64 slba \u003d ((u64)le32_to_cpu(cmd-\u003ecdw11) \u003c\u003c 32) |"},{"line_number":938,"context_line":"\t\t   le32_to_cpu(cmd-\u003ecdw10);"},{"line_number":939,"context_line":"\tu16 nlb \u003d (le32_to_cpu(cmd-\u003ecdw12) \u0026 0xFFFF) + 1;"},{"line_number":940,"context_line":"\tsize_t len \u003d (size_t)nlb * nvme-\u003elba_size;"},{"line_number":941,"context_line":"\tvoid *buf;"},{"line_number":942,"context_line":"\tu16 status;"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"a4bec47f_c9bbaec9","line":939,"updated":"2026-07-29 15:40:50.000000000","message":"The NVMe I/O command handlers compute nlb as a u16 value: `u16 nlb \u003d (cdw12 \u0026 0xFFFF) + 1`. When the raw NLB field is 0xFFFF (NVMe 0-based encoding for 65536 blocks), adding 1 wraps the u16 to 0. The subsequent MDTS length check uses the overflowed length (0), which always passes, so the oversize...\n\n**Severity**: WARNING | **Confidence**: 0.9\n\n**Impact**: An NVMe I/O Read or Write command with NLB\u003d0xFFFF bypasses the MDTS transfer-size limit and silently completes with zero bytes transferred, returning success. While the stock nvme Linux driver respects MDTS and would never send such a command, a test tool or fuzzer could trigger this, producing i...\n\n**Suggestion**:\nChange the nlb variable type from u16 to u32 in all four locations: `u32 nlb \u003d (le32_to_cpu(cmd-\u003ecdw12) \u0026 0xFFFF) + 1;`. This ensures the +1 conversion does not wrap, and the MDTS check then correctly rejects the oversized transfer with NVME_SC_INVALID_FIELD.","commit_id":"86e4eaabed0928aa4b4e38c765f55b969a7cfa2d"}],"pci-sim/fake_pci_sriov_nvme_host.c":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"f0e3c70e1bc2aa46da820f7685f25d8e7084fbe4","unresolved":false,"context_lines":[{"line_number":309,"context_line":"\tif (PCI_FUNC(pdev-\u003edevfn) \u003d\u003d 0)"},{"line_number":310,"context_line":"\t\treturn -ENODEV;"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"\thost \u003d fake_pci_host_from_domain(pci_domain_nr(pdev-\u003ebus));"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"\t/*"},{"line_number":315,"context_line":"\t * When bar0_mapped is set (memmap mode), the poll kthread handles"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"26133c27_88039794","line":312,"updated":"2026-07-29 14:22:55.000000000","message":"pci_sim_nvme_host_probe calls fake_pci_host_from_domain() without acquiring fake_hosts_lock, violating the lockdep_assert_held contract declared in that function. The existing helper fake_pci_host_from_pdev in the same codebase correctly acquires the lock before calling the same function.\n\n**Severity**: WARNING | **Confidence**: 0.9\n\n**Impact**: When lockdep is enabled (common in CI/debug kernels), this triggers a splat on every NVMe VF probe. Without lockdep, the unsynchronized list traversal could race with host list modification during module load/unload, potentially causing a use-after-free on the fake_hosts list.\n\n**Suggestion**:\nWrap the call in mutex_lock(\u0026fake_hosts_lock) / mutex_unlock(\u0026fake_hosts_lock), or make fake_pci_host_from_pdev non-static and use it instead. Example fix: mutex_lock(\u0026fake_hosts_lock); host \u003d fake_pci_host_from_domain(pci_domain_nr(pdev-\u003ebus)); mutex_unlock(\u0026fake_hosts_lock);","commit_id":"6417360bc21a276a2535f569ca139ecdd9e2ad8d"}]}