Linux kernel (nvme-tcp) vulnerabilities

In the Linux kernel, the nvme-tcp driver accepted C2HData based solely on blk_rq_payload_bytes() without also checking req->data_len. For REQ_OP_WRITE_ZEROES, which has no physical segments but a non-zero blk_rq_bytes(), this causes data to be copied into an uninitialized iterator, triggering a KASAN wild-memory-access in _copy_to_iter().

In the Linux kernel, the nvme-tcp driver's nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it, sending the READ destination buffer (containing stale kernel data) to the controller. This leaks host memory, including struct page pointers.

In the Linux kernel, the nvme-tcp driver's nvme_tcp_recv_data() completes a request once the current C2HData PDU is consumed, without comparing total bytes received against the length the command asked for. A malicious controller can answer a 4096-byte read with 512 bytes and have it reported as complete, exposing 3584 bytes of stale page data to user space. The fix counts received bytes and refuses to complete an incomplete read.