Pull device mapper updates from Mikulas Patocka:

 - small cleanups in dm-vdo, dm-raid, dm-cache, dm-zoned-metadata

 - rework of dm-ima

 - introduce dm-inlinecrypt

 - fix wrong return value in dm-ioctl

 - fix rcu stall when polling

* tag 'for-7.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm-zoned-metadata: Use strscpy() to copy device name
  dm cache: make smq background work limit configurable
  dm-inlinecrypt: add support for hardware-wrapped keys
  dm: limit target bio polling to one shot
  dm-ioctl: report an error if a device has no table
  dm: add documentation for dm-inlinecrypt target
  dm-inlinecrypt: add target for inline block device encryption
  block: export blk-crypto symbols required by dm-inlinecrypt
  dm-ima: use active table's size if available
  dm-ima: Fail more gracefully in dm_ima_measure_on_*
  dm-ima: Handle race between rename and table swap
  dm-ima: Fix issues with dm_ima_measure_on_device_rename
  dm-ima: remove new_map from dm_ima_measure_on_device_clear
  dm-ima: Fix UAF errors and measuring incorrect context
  dm-ima: don't copy the active table to the inactive table
  dm-ima: Remove status_flags from dm_ima_measure_on_table_load()
  dm-ima: remove broken last_target_measured logic
  dm-ima: remove dm_ima_reset_data()
  dm-raid: only requeue bios when dm is suspending
  dm vdo: use get_random_u32() where appropriate

Pull block updates from Jens Axboe:

 - NVMe pull request via Keith:
     - Per-controller admin and IO timeout sysfs attributes, and
       letting the block layer set request timeouts (Maurizio,
       Maximilian)
     - Multipath passthrough iostats, and PCI P2PDMA enablement for
       multipath devices (Keith, Kiran)
     - A new diag sysfs attribute group exporting per-controller
       counters (retries, multipath failover, error counters, requeue
       and failure counts, reset and reconnect events) (Nilay)
     - FDP configuration validation and bounds check fixes (liuxixin)
     - Various nvmet fixes, including a pre-auth out-of-bounds read in
       the Discovery Get Log Page handler, auth payload bounds
       validation, and tcp error-path leak fixes (Bryam, Tianchu,
       Geliang)
     - nvme-tcp lockdep and workqueue fixes (Shin'ichiro, Kuniyuki,
       Eric)
     - Assorted other fixes and cleanups (John, Yao, Chao, Mateusz,
       Achkinazi, Wentao)

 - MD pull request via Yu Kuai:
     - raid1/raid10 fixes for a deadlock in the read error recovery
       path, error-path detection and bio accounting with cloned bios,
       and an nr_pending leak in the REQ_ATOMIC bad-block error path
       (Abd-Alrhman)
     - PCI P2PDMA propagation from member devices to the RAID device
       (Kiran)
     - dm-raid bio requeue fix, and various smaller fixes and cleanups
       (Benjamin, Chen, Li, Thorsten)

 - Enable Clang lock context analysis for the block layer, with the
   accompanying annotations across queue limits, the blk_holder_ops
   callbacks, crypto, cgroup, iocost, kyber and mq-deadline (Bart)

 - Block status code infrastructure work: a tagged status table, a
   str_to_blk_op() helper, a bio_endio_status() helper, and on top of
   that a new configurable block-layer error injection facility
   (Christoph)

 - DRBD netlink rework, replacing the genl_magic machinery with explicit
   netlink serialization and moving the DRBD UAPI headers to
   include/uapi/linux/ (Christoph Böhmwalder)

 - bvec improvements: a bvec_folio() helper and making the bvec_iter
   helpers proper inline functions (Willy, Christoph)

 - ublk cleanups and a canceling-flag fix for the disk-not-allocated
   case (Caleb, Ming)

 - Partition handling fixes: bound the AIX pp_count scan, fix an of_node
   refcount leak, and replace __get_free_page() with kmalloc() (Bryam,
   Wentao, Mike)

 - Convert numa_node to int in blk_mq_hw_ctx and ->init_request, and add
   WQ_PERCPU to the block workqueue users (Mateusz, Marco)

 - Block statistics and tracing: propagate in-flight to the whole disk
   on partition IO, export passthrough stats, and a new
   block_rq_tag_wait tracepoint (Tang, Keith, Aaron)

 - A round of removals, unexports and cleanups across bio, direct-io and
   the bvec helpers (Christoph)

 - Various driver fixes (mtip32xx use-after-free, rbd snap_count
   validation and strscpy conversion, nbd socket lockdep reclassify,
   virtio-blk zone report clamp, floppy) and a batch of MAINTAINERS
   email/list updates (Coly, Li, Yu, Christoph Böhmwalder)

 - Other little fixes and cleanups all over

* tag 'for-7.2/block-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (117 commits)
  MAINTAINERS: Update Coly Li's email address
  block: check bio split for unaligned bvec
  nbd: Reclassify sockets to avoid lockdep circular dependency
  block: add configurable error injection
  block: add a str_to_blk_op helper
  block: add a "tag" for block status codes
  block: add a macro to initialize the status table
  floppy: Drop unused pnp driver data
  block: propagate in_flight to whole disk on partition I/O
  virtio-blk: clamp zone report to the report buffer capacity
  block: optimize I/O merge hot path with unlikely() hints
  drivers/block/rbd: Use strscpy() to copy strings into arrays
  partitions: aix: bound the pp_count scan to the ppe array
  block: Enable lock context analysis
  block/mq-deadline: Make the lock context annotations compatible with Clang
  block/Kyber: Make the lock context annotations compatible with Clang
  block/blk-mq-debugfs: Improve lock context annotations
  block/blk-iocost: Inline iocg_lock() and iocg_unlock()
  block/blk-iocost: Split ioc_rqos_throttle()
  block/crypto: Annotate the crypto functions
  ...

Pull buffer_head updates from Christian Brauner:
 "This removes b_end_io from struct buffer_head.

  Instead of setting bio->bi_end_io to end_bio_bh_io_sync() which then
  calls bh->b_end_io(), the new bh_submit() and __bh_submit() interfaces
  set bio->bi_end_io to the appropriate completion handler directly,
  replacing two indirect function calls in the completion path with one.
  It is also one fewer function pointer in the middle of a writable data
  structure that can be corrupted, it shrinks struct buffer_head from
  104 to 96 bytes allowing roughly 7% more buffer_heads to be cached in
  the same amount of memory, and it removes some atomic operations as
  the buffer refcount is no longer incremented before calling the end_io
  handler.

  All in-tree users (fs/buffer.c itself, ext4, jbd2, ocfs2, gfs2,
  nilfs2, and md-bitmap) are converted, and submit_bh(),
  mark_buffer_async_write(), and end_buffer_write_sync() are removed"

* tag 'vfs-7.2-rc1.bh' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (34 commits)
  buffer: Remove end_buffer_write_sync()
  buffer: Change calling convention for end_buffer_read_sync()
  buffer: Remove b_end_io
  buffer: Remove submit_bh()
  md-bitmap: Convert read_file_page and write_file_page to bh_submit()
  nilfs2: Convert nilfs_mdt_submit_block to bh_submit()
  nilfs2: Convert nilfs_gccache_submit_read_data to bh_submit()
  nilfs2: Convert nilfs_btnode_submit_block to bh_submit()
  buffer: Remove mark_buffer_async_write()
  gfs2: Convert gfs2_aspace_write_folio to bh_submit()
  gfs2: Remove use of b_end_io in gfs2_meta_read_endio()
  gfs2: Convert gfs2_dir_readahead to bh_submit()
  gfs2: Convert gfs2_metapath_ra to bh_submit()
  ocfs2: Convert ocfs2_write_super_or_backup to bh_submit()
  ocfs2: Convert ocfs2_read_blocks to bh_submit()
  ocfs2: Convert ocfs2_read_block to bh_submit()
  ocfs2: Convert ocfs2_write_block to bh_submit()
  jbd2: Convert jbd2_write_superblock() to bh_submit()
  jbd2: Convert journal commit to bh_submit()
  ext4: Convert ext4_commit_super() to bh_submit()
  ...

Replace strcpy with strscpy in drivers/md/dm-zoned-metadata.c.

Signed-off-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

This shrinks buffer_head by 8 bytes, letting us pack more buffer heads
per slab.  With a Debian config, it shrinks from 104 bytes to 96 bytes
which is 42 objects per 4KiB page rather than 39, a 7% reduction in the
amount of memory used.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Link: https://patch.msgid.link/20260528173150.1093780-33-willy@infradead.org
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Avoid an extra indirect function call by using bh_submit() instead of
submit_bh().

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Link: https://patch.msgid.link/20260528173150.1093780-31-willy@infradead.org
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: linux-raid@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Pull device mapper fix from Mikulas Patocka:

 - fix race condition in dm-cache-policy-smq

* tag 'for-7.1/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm cache policy smq: check allocation under invalidate lock

Pull MD updates and fixes from Yu Kuai:

"Bug Fixes:
 - Only requeue dm-raid bios when dm is suspending. (Benjamin Marzinski)
 - Reset raid10 read_slot when reusing r10bio for discard. (Chen Cheng)
 - Fix raid1/raid10 deadlock in read error recovery path.
   (Abd-Alrhman Masalkhi)
 - Fix raid1/raid10 error-path detection with md_cloned_bio().
   (Abd-Alrhman Masalkhi)
 - Fix raid1/raid10 bio accounting for split md cloned bios.
   (Abd-Alrhman Masalkhi)
 - Fix raid1 nr_pending leak in REQ_ATOMIC bad-block path.
   (Abd-Alrhman Masalkhi)

 Improvements:
 - Skip redundant raid_disks updates when the value is unchanged.
   (Abd-Alrhman Masalkhi)

 Cleanups:
 - Update MAINTAINERS email addresses. (Yu Kuai, Li Nan)
 - Clean up raid1 read error handling. (Christoph Hellwig)
 - Move the exceed_read_errors condition out of fix_read_error().
   (Christoph Hellwig)
 - Use str_plural() in raid0 dump_zones(). (Thorsten Blum)"

* tag 'md-7.2-20260531' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux:
  md/raid0: use str_plural helper in dump_zones
  raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path
  md/raid1: move the exceed_read_errors condition out of fix_read_error
  md/raid1: cleanup handle_read_error
  md/raid1,raid10: fix bio accounting for split md cloned bios
  md/raid1,raid10: fix error-path detection with md_cloned_bio()
  md/raid1,raid10: fix deadlock in read error recovery path
  md/raid10: reset read_slot when reusing r10bio for discard
  md: skip redundant raid_disks update when value is unchanged
  dm-raid: only requeue bios when dm is suspending
  MAINTAINERS: Update Li Nan's E-mail address
  MAINTAINERS: update Yu Kuai's email address

The maximum number of concurrent background work items (promotions,
demotions, writebacks) in the SMQ policy was hardcoded to 4096, with
a FIXME comment noting it should be made configurable.

This value was originally tuned down from 10240 to balance memory
overhead (~128 bytes per entry, ~512KB at 4096 entries) against I/O
parallelism. However, different workloads and cache sizes may benefit
from different limits:

- Write-heavy workloads may need more writeback concurrency
- Very large caches (10+ TB) may need more promotion slots
- Memory-constrained systems may want a lower limit

Make this configurable via the module parameter "smq_max_background_work"
(defaulting to 4096 to preserve existing behaviour). Clamp the value to
at least 1 to prevent setting 0, which would block all background work.
The parameter only affects newly created cache devices; existing caches
retain their value from creation time.

Signed-off-by: Cao Guanghui <caoguanghui@kylinos.cn>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

commit 2d1f7b65f5de ("dm cache policy smq: fix missing locks in
invalidating cache blocks") added mq->lock around the destructive part of
smq_invalidate_mapping(), but left the e->allocated check outside the
critical section.

That leaves a check-then-act race. Two concurrent invalidators can both
observe e->allocated as true before either of them takes mq->lock. The
first invalidator that acquires the lock removes the entry from the
queues and hash table and then calls free_entry(), which clears
e->allocated and puts the entry back on the free list. The second
invalidator can then acquire mq->lock and continue with the stale result
of the unlocked check.

This can corrupt the SMQ queues or hash table by deleting an entry that
is no longer on those structures. It can also hit the allocation check in
free_entry() when the same entry is freed again.

Move the allocation check under mq->lock so the predicate and the
destructive operations are serialized by the same lock.

Fixes: 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>