linux-toradex.git/drivers/nvme, branch master

Merge tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

2026-10-30T16:33:23+00:00

Pull more block updates from Jens Axboe:
 "Bigger than usual for an end-of-merge-window pull request, main reason
  being that the MD side I had missed a pull on, and both NVMe and block
  got a good pile of LLM driven fixes where some of them may as well
  just go in now rather than wait a full cycle. This contains:

   - NVMe fixes via Keith:
      - nvme-tcp fallout from the parallel queue allocation: initialize
        pf_cache_lock and the header digest before requests are set up,
        and don't dereference a NULL queue->ctrl on reconnect
      - nvme-fabrics queue mapping fixes: reset io_queues on reconnect,
        limit each queue type to the online CPUs, and clear a poll map
        with no poll queues
      - nvme-tcp io_work priority inversion with send_mutex held
        (Seiji), error recovery on read_sock failure and skipping TLS
        control records while waiting for the ICResp (Martin B), TLS
        handshake timeout validation, and an address attribute race
      - nvme-rdma NULL metadata_sgl dereference with T10-PI
      - nvme-pci early boot hang with the quirks parameter
      - nvme-multipath ANA log bounds underflow, and an nvme-fc
        discovery reference leak
      - nvmet hardening: rdma inline SGL out-of-bounds write and short
        connect requests, fc use-after-free in LS create connection and
        teardown on admin queue failure, pci-epf transport error
        reporting and SGL length checks, zns NUMD wrap, fc stale read
        data, auth state and status fixes, ports list and qid_max
        locking, rdma double puts and irq-safe locking, and a double
        free on metadata SGL allocation failure
      - nvmet fixes from Josef: big discard length truncation, NULL
        derefs for PCI endpoint targets and debugfs host_traddr, stop
        listening when a tcp port is removed, and don't BUG() in
        nvme-loop when a scan runs beside a reset

   - MD fixes via Yu Kuai:
      - raid5 validation: reject too few disks, invalid reshape disks, a
        per-device size below one chunk, and an inconsistent reshape
        state from the superblock instead of BUG(), plus journal payload
        size checks
      - raid5 error path and lifetime fixes: extra_page leak and NULL
        derefs in free_conf/setup_conf, draining released_stripes before
        destroying the cache, RCU for the big_stripe_tree lookup, and
        per-array io_unit slab names
      - md core: reject v0.90 arrays with too many devices, validate
        bblog_size, take reconfig_mutex when enabling PPL, fix the
        mddev->private NULL deref when stopping an array under IO, and
        don't hand out the array before mddev->kobj is added
      - raid10 missing barrier wakeup, raid0 device count validation, a
        bogus mddev_unlock() in lbs_store(), and shared helpers

   - blk-mq fixes from Josef:
      - don't trust the bio cookie in blk_mq_poll()
      - keep tag sharing fair after a queue update
      - don't bring back flags of a completed request from the timeout
        handler
      - honor a restarted timer
      - initialize the dma state for P2P
      - quiesce a queue joining a quiesced tag set
      - set up and exit hctxs under tag_list_lock
      - free the tag bitmaps in the SRCU callback

   - blk-cgroup and friends from Josef:
      - keep the old blkg while reassociating a bio
      - free struct ioc after a grace period
      - don't truncate v1 iops limits
      - fix root io.stat on 32-bit
      - don't free a blkg with its punt work queued
      - flush iolatency enable_work after going offline
      - pass dead group I/O counts on and make reset_stats reset them
      - don't enter reclaim under rq_qos_mutex

   - Other core fixes from Josef:
      - a disk use-after-free in sync_bdevs()
      - don't losing the status of a failed flush request
      - 64-bit sector math for mac partitions
      - apply the segment size to the integrity buffer

   - blk-iocost: abort a weight transfer on invalid donation weights,
     and publish hweights as one atomic value

   - Fix a NULL deref and use-after-free in __blk_crypto_evict_key(),
     reachable via dm-inlinecrypt

   - Fix recursive i_rwsem locking in blkdev_write_iter(), from two
     fixes for the same race landing in the window

   - Advance the iterator after copy-in for SG_DXFER_TO_FROM_DEV, fixing
     an infinite loop in blk_rq_map_user_iov()

   - Check the open mode for LOOP_SET_STATUS in the compat ioctl

   - rnbd-srv use-after-free and kobject fixes

   - drbd timer and req_lock fixes

   - zloop cleanups and error path fixes

   - cdrom header and kernel-doc cleanups"

* tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (109 commits)
  blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
  zloop: check that the zone backing file support ->{read,write}_iter
  zloop: fput file after failed zone init
  zloop: share more code for opening a zone backing file
  zloop: remove a duplicate call to zloop_get_block_size
  block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c
  blk-iocost: publish hweights as one atomic value
  blk-iocost: abort weight transfer on invalid donation weights
  rnbd-srv: publish the sess_dev at the end of OPEN
  rnbd-srv: fix use-after-free on two CLOSE messages
  block/rnbd-srv: drop the sess_dev kobject unlocked
  block/rnbd-srv: don't free the device on a sysfs error
  drbd: take req_lock to skip the initial sync as peer
  drbd: stop the start_resync timer of a dying device
  block: apply the segment size to the integrity buffer
  blk-mq: free the bitmaps of tags in the SRCU callback
  block: partitions/mac: compute the sectors in 64 bits
  blk-mq: set up a queue under tag_list_lock
  blk-mq: exit the hctxs of a queue under tag_list_lock
  blk-mq: quiesce a queue that joins a quiesced tag set
  ...

Merge tag 'nvme-7.4-2026-10-28' of git://git.infradead.org/nvme into block-7.4

2026-10-29T15:28:15+00:00

nvme updates for Linux 7.4

 - Fix regressions from the parallel nvme-tcp I/O queue setup: request
   PDU sizing with header digest, a NULL controller dereference when
   reconnecting with more queues, and early lock initialization
 - Handle TLS control records in nvme-tcp: skip records arriving ahead
   of the ICResp, and start error recovery when the socket read fails
 - Fix an nvme-tcp io_work priority inversion stalling I/O
 - Fix nvme-tcp address attribute race with queue teardown
 - Validate the TLS handshake timeout parameters for host and target
 - Fix fabrics connects with isolated CPUs and queue mapping bugs
 - Fix early boot hang and buffer size for the nvme.quirks parameter
 - Fix nvme-rdma NULL metadata SGL dereference with T10-PI
 - Fix ANA underflow check and an nvme-fc discovery reference leak
 - Fix nvme-loop BUG() when a namespace scan races a reset
 - Target port and configfs locking fixes, and port removal races
 - Target auth fixes for CHALLENGE failure and negotiation handling
 - Target fc fixes for a connection use-after-free, read data on failed
   commands, and admin queue allocation failure teardown
 - Target rdma fix for short connection requests
 - Target rdma fix for inline SGL out-of-bounds write
 - Target rdma refcount, locking, and module unload fixes
 - Target pci-epf SGL length and error status fixes
 - Target NULL dereference fixes for pci-epf and debugfs
 - Target ZNS NUMD overflow check
 - Target Connect fix for a controller leak with a zero queue size
 - Target fixes for a metadata SGL double-free and a leaked blk plug
 - Target fix for truncated large discards
 - Misc cleanups

* tag 'nvme-7.4-2026-10-28' of git://git.infradead.org/nvme: (44 commits)
  nvmet: don't clear sq->ctrl for a Connect with sqsize 0
  nvmet-rdma: fix double puts after a failed RDMA WRITE
  nvmet-rdma: disable interrupts under rsp_wr_wait_lock
  nvmet-rdma: flush nvmet-wq on module exit
  nvme-loop: don't BUG() if a scan runs beside a reset
  nvmet-tcp: don't read a removed port at Connect time
  nvmet: fix NULL dereference in debugfs host_traddr
  nvmet-tcp: stop listening when a port is removed
  nvmet: fix NULL dereference of PCI endpoint targets
  nvmet-auth: take only AUTH_Negotiate for a negotiation
  nvmet: don't truncate the length of big discards
  nvme-tcp: validate the TLS handshake timeout
  nvmet-tcp: validate the TLS handshake timeout
  nvmet: Free the old negotiation state when restarting authentication
  nvmet: Finish the blk plug when integrity allocation fails
  nvme-tcp: fix NULL queue->ctrl dereference on reconnect
  nvme-tcp: Validate the queue state under the queue lock in the address attribute
  nvme-tcp: fix io_work priority inversion when send_mutex is held
  nvme-tcp: fix request PDU size when header digest is enabled
  nvme-tcp: skip TLS control records while waiting for the ICResp
  ...

nvmet: don't clear sq->ctrl for a Connect with sqsize 0

2026-10-28T18:41:43+00:00

nvmet_install_queue() checks sqsize first and jumps to err on zero,
where sq->ctrl is set to NULL. Since commit b71df12605ca the cmpxchg()
that sets sq->ctrl comes after the checks, so err now undoes a bind
that this call never made. Over RDMA a host can send two Connects
together and the second is parsed before the first executes, so a
second Connect with sqsize 0 clears the sq->ctrl the first one set.
The reference it held is never dropped and the controller leaks, with
its cntlid, until reboot. The discovery subsystem lets any host do
that, 20 connections leak around 10 controllers. A pending AER on such
a queue hangs nvmet_sq_destroy() forever, and a queue can keep its
"authenticated" mark across a rebind.

Return the status directly, as the two checks after it do, so err is
only reached after this call's cmpxchg() succeeded.

Fixes: b71df12605ca ("nvmet: avoid duplicate qid in connect cmd")
Cc: Christoph Hellwig 
Cc: Sagi Grimberg 
Cc: Chaitanya Kulkarni 
Signed-off-by: Chris Mason 
Signed-off-by: Jens Axboe 
Signed-off-by: Keith Busch

nvmet-rdma: fix double puts after a failed RDMA WRITE

2026-10-28T18:41:43+00:00

For a read with T10-PI the RDMA WRITE is posted alone and
nvmet_rdma_write_data_done() posts the SEND once the metadata check
result is known. By then the request has been completed and its
references put: __nvmet_req_complete() put ns->ref and the pc_ref, and
nvmet_req_complete() sq->ref, right after queuing the response. The
error branch of nvmet_rdma_write_data_done() copies the one from
nvmet_rdma_read_data_done() and calls nvmet_req_uninit(), which puts
all three again. A WRITE fails whenever the connection ends with reads
in flight, which is up to the host. Depending on timing the sq->ref
count goes to zero early and the queue is freed under the remaining
completions, or never reaches zero and nvmet_sq_destroy() sleeps
forever, or percpu_ref_put() dereferences NULL after percpu_ref_exit().
ns->ref stays too low for good, so disabling the namespace hangs too.
Reproduced with KASAN over rxe with a test patch forcing the PI path.

Drop the nvmet_req_uninit(). The branch still releases the RDMA context
and the response, which is all the request owns at that point.

Fixes: b09160c3996c ("nvmet-rdma: add metadata/T10-PI support")
Cc: Christoph Hellwig 
Cc: Sagi Grimberg 
Cc: Chaitanya Kulkarni 
Signed-off-by: Chris Mason 
Signed-off-by: Jens Axboe 
Signed-off-by: Keith Busch

nvmet-rdma: disable interrupts under rsp_wr_wait_lock

2026-10-28T18:41:43+00:00

rsp_wr_wait_lock protects the list of commands waiting for room in the
send queue, and it's taken with plain spin_lock(). But
nvmet_rdma_queue_response() calls nvmet_rdma_release_rsp() directly if
ib_post_send() fails, and that processes the wait list. The call chain
starts in nvmet_req_complete(), which for a block device namespace runs
from the bio end_io callback, which can be in hard interrupt context.
An interrupt that completes a command on a CPU holding the lock for the
same queue spins forever. Lockdep over siw with a null_blk namespace:

  inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage

Use spin_lock_irqsave() for both takers. The processing loop still
drops the lock, and restores the caller's interrupt state, around
nvmet_rdma_execute_command().

Fixes: 8f000cac6e7a ("nvmet-rdma: add a NVMe over Fabrics RDMA target driver")
Cc: Christoph Hellwig 
Cc: Sagi Grimberg 
Cc: Chaitanya Kulkarni 
Signed-off-by: Chris Mason 
Signed-off-by: Jens Axboe 
Signed-off-by: Keith Busch

nvmet-rdma: flush nvmet-wq on module exit

2026-10-28T18:41:42+00:00

nvmet_rdma_exit() relies on ib_unregister_client() to flush nvmet-wq
through nvmet_rdma_remove_one(), but since commit a3dd7d0022c3 that
returns at once for a device no longer on device_list. The release work
of the last queue takes the device off the list in nvmet_rdma_free_dev()
and still has to drop the mutex, free the struct and return through
nvmet_rdma_release_queue_work(), so an rmmod in that window frees the
module code it's running.

Flush nvmet-wq after ib_unregister_client(). No release work can be
queued after that point.

Fixes: a3dd7d0022c3 ("nvmet-rdma: Don't flush system_wq by default during remove_one")
Cc: Christoph Hellwig 
Cc: Sagi Grimberg 
Cc: Chaitanya Kulkarni 
Signed-off-by: Chris Mason 
Signed-off-by: Jens Axboe 
Signed-off-by: Keith Busch

nvme-loop: don't BUG() if a scan runs beside a reset

2026-10-28T18:41:42+00:00

A reset sets queue_count to 1 while it destroys the I/O queues and
counts it back up when the new ones are made, and it doesn't stop the
scan work. A new namespace found in that window trips the check in
nvme_loop_init_hctx() for every hctx but the first:

  kernel BUG at drivers/nvme/target/loop.c:224!
   nvme_loop_init_hctx+0x7d/0x80
   __blk_mq_realloc_hw_ctxs+0x3af/0xa80
   nvme_alloc_ns+0x1a2/0x22f0

The check protects nothing. ctrl->queues has nr_io_queues + 1 entries
for the life of the controller, the tag set never has more hardware
queues than that, and nvme_loop_queue_rq() rejects requests until the
controller is live again.

Remove it.

Fixes: 3a85a5de29ea ("nvme-loop: add a NVMe loopback host driver")
Cc: Christoph Hellwig 
Cc: Sagi Grimberg 
Cc: Chaitanya Kulkarni 
Signed-off-by: Josef Bacik 
Signed-off-by: Jens Axboe 
Signed-off-by: Keith Busch

nvmet-tcp: don't read a removed port at Connect time

2026-10-28T18:41:42+00:00

nvmet_tcp_alloc_cmd() takes the nvmet port of a command from
queue->port, and the commands of a queue are allocated from the io work
when the Connect arrives. nvmet_tcp_remove_port() shuts down the queues
that have no controller yet and frees the port without waiting for
them, they're released later from a work. An io work handling a Connect
at that moment reads the freed port for every command of the queue and
hands the result to the core.

Note the nvmet port in the queue at allocation. It outlives the
transport port.

Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
Cc: Christoph Hellwig 
Cc: Sagi Grimberg 
Cc: Chaitanya Kulkarni 
Signed-off-by: Josef Bacik 
Signed-off-by: Jens Axboe 
Signed-off-by: Keith Busch

nvmet: fix NULL dereference in debugfs host_traddr

2026-10-28T18:41:41+00:00

The host_traddr callbacks of tcp, rdma and fc take the host address from
the transport queue around ctrl->sqs[0], which nvmet_sq_destroy() clears
when the admin queue goes away while the controller lives on with its
I/O queues. A host that closes the admin connection and keeps an I/O
queue leaves such a controller behind, and reading its host_traddr in
debugfs dereferences a near-NULL pointer:

  BUG: kernel NULL pointer dereference, address: 00000000000002e0
  RIP: 0010:nvmet_tcp_host_port_addr+0x19/0x50 [nvmet_tcp]

Don't ask the transport if there's no admin queue. Nothing holds the
queue for debugfs, so a reader that's past the check when the queue
goes away is still on its own.

Fixes: 7e5c3de3f2f2 ("nvmet: add 'host_traddr' callback for debugfs")
Cc: Christoph Hellwig 
Cc: Sagi Grimberg 
Cc: Chaitanya Kulkarni 
Signed-off-by: Josef Bacik 
Signed-off-by: Jens Axboe 
Signed-off-by: Keith Busch

nvmet-tcp: stop listening when a port is removed

2026-10-28T18:41:41+00:00

nvmet_tcp_accept_work() accepts until there's nothing left. A
connection that is already dead when accepted is torn down right there,
which takes a few ms, and more can arrive meanwhile.
nvmet_tcp_remove_port() waits for the work with cancel_work_sync(), so
someone opening and closing connections in a loop keeps the removal from
finishing. It holds nvmet_config_sem for writing, so nothing can be
configured and no port answers a Connect until the flood stops. No
secret needed, just an admin removing the port at the wrong time.

Shut the listening socket down first. Pending connections are dropped,
as they were on release, and the next kernel_accept() fails and ends the
work.

Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
Cc: Christoph Hellwig 
Cc: Sagi Grimberg 
Cc: Chaitanya Kulkarni 
Signed-off-by: Josef Bacik 
Signed-off-by: Jens Axboe 
Signed-off-by: Keith Busch