Merge tag 'nvme-7.4-2026-11-05' of git://git.infradead.org/nvme into block-7.4

Pull NVMe fixes from Keith:

"- Fix a passthru reference leak that hangs disabling a target passthru
   controller (7.4-rc1 regression)
 - Fix namespace removal race with SRCU readers of the namespace list
 - Fix use-after-free in nvme-tcp controller teardown after a failed
   connect
 - Fix NULL dereference in nvme-rdma when a reconnect adds queues
 - nvmet-rdma device removal and disconnect fixes
 - nvmet-tcp TLS record type handling and bounded connection accept work
 - Don't leak stale memory in the nvmet ANA log page
 - Harden nvmet against invalid input: keep-alive timeout overflow,
   incomplete DHCHAP messages, configfs address bounds, arbitration
   burst mask, and locking for traffic based keep alive updates
 - Keep the old nvmet auth keys if setting new ones fails
 - Delete nvme-loop controller on failed reset
 - Fix extra cdev reference put and unregister on a zero pr_register key
 - Fix a TLS key reference leak in the nvme keyring
 - Quirks for ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d
 - Speed up nvmet namespace disable
 - Misc cleanups"

* tag 'nvme-7.4-2026-11-05' of git://git.infradead.org/nvme: (29 commits)
  nvmet: cache passthru reference in __nvmet_req_complete()
  nvmet: drop the redundant auth check in nvmet_parse_io_cmd()
  nvmet: bound the traddr and trsvcid configfs writes
  nvmet: take subsys->lock when forcing reconnects for tbkas
  nvme: wait for SRCU readers before splicing the namespace list
  srcu: Add list_splice_init_srcu()
  nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d
  nvmet: don't return memory contents beyond valid data when reading ANA log page
  nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE
  nvmet: drop the extra RCU grace period in nvmet_ns_disable()
  nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()
  nvmet-rdma: disconnect a queue on device removal
  nvmet-rdma: queue the release work under the mutex
  nvmet-rdma: take a device off the list last
  nvmet-tcp: limit the connections accepted per work run
  nvmet-rdma: disconnect only established queues
  nvmet-auth: keep the old keys if the new ones fail
  nvmet-tcp: ask for the TLS record type on every receive
  nvme-loop: delete the controller if a reset fails
  nvmet-rdma: remove dead allocated field in nvmet_rdma_rsp
  ...

1 files changed, 36 insertions, 0 deletions

diff --git a/include/linux/srcu.h b/include/linux/srcu.h
index 1a8a465a5650..d4dcaeb83e2b 100644
--- a/include/linux/srcu.h
+++ b/include/linux/srcu.h
@@ -18,6 +18,7 @@
 
 #include <linux/mutex.h>
 #include <linux/rcupdate.h>
+#include <linux/rculist.h>
 #include <linux/workqueue.h>
 #include <linux/rcu_segcblist.h>
 
@@ -118,6 +119,41 @@ void cleanup_srcu_struct(struct srcu_struct *ssp);
 void synchronize_srcu(struct srcu_struct *ssp);
 void synchronize_srcu_atomic(struct srcu_struct *ssp);
 
+/**
+ * list_splice_init_srcu - splice an SRCU-protected list into an existing list
+ * @list:	the SRCU-protected list to splice
+ * @head:	the place in the existing list to splice the first list into
+ * @ssp:	the srcu_struct that readers of @list use
+ *
+ * Like list_splice_init_rcu(), but wait for the SRCU readers of @list
+ * instead of RCU ones, so that none of them can follow a next pointer
+ * onto @head.
+ *
+ * Note that this function blocks, and that the caller must prevent any
+ * other updates to @list.
+ */
+static inline void list_splice_init_srcu(struct list_head *list,
+					 struct list_head *head,
+					 struct srcu_struct *ssp)
+{
+	struct list_head *first = list->next;
+	struct list_head *last = list->prev;
+	struct list_head *next = head->next;
+
+	if (list_empty(list))
+		return;
+
+	INIT_LIST_HEAD_RCU(list);
+	synchronize_srcu(ssp);
+	ASSERT_EXCLUSIVE_ACCESS(*first);
+	ASSERT_EXCLUSIVE_ACCESS(*last);
+
+	last->next = next;
+	rcu_assign_pointer(list_next_rcu(head), first);
+	first->prev = head;
+	next->prev = last;
+}
+
 #define SRCU_GET_STATE_COMPLETED 0x1
 
 /**