So now when the OP code's data transfer field says there is no data and this is a "user command" (all the instances of nvme_ctrlr_linux_passthru_cmd() appear to set this to true), the driver is going to allocate npc->data_len worth of memory? Any concerns about the value of data_len potentially being set for a command that wouldn't normally transfer data?

Given that Linux would not have these, and most of the passthru code is written for Linux and Linux behaves this way, I'd think any errors like this would be caught.
And if not, there'd be an error completion code for this sort of opcode.
Also, the drive would fail with NVME_SC_DATA_TRANSFER_ERROR if we didn't read data tthat should be there, or tried to read data that wasn't.
So I think we'd fail safe.