nvmet-tcp PDUiovec UninitRead

Vulnerability analysis

The root cause is that nvmet_tcp_build_pdu_iovec() was declared void and, upon detecting an out-of-bounds PDU length or offset, called nvmet_tcp_fatal_error() and returned early without initializing cmd->recv_msg.msg_iter. Because the function returned void, callers such as nvmet_tcp_handle_h2c_data_pdu() and nvmet_tcp_done_recv_pdu() had no way to detect the error and proceeded to set queue->rcv_state = NVMET_TCP_RECV_DATA. The socket receive loop then used the uninitialized iterator as a destination for incoming network data, causing writes to garbage kernel addresses. The fix changes nvmet_tcp_build_pdu_iovec() to return an int error code (-EPROTO) and updates all callers to check the return value and abort the command, ensuring the uninitialized iterator is never used. The attack surface is the NVMe-oF TCP target listener socket, reachable from the network without authentication at the PDU parsing layer.