Merge tag 'block-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - NVMe fixes via Keith:
    - nvme-tcp use-after-free in nvme_tcp_free_ctrl() on a failed
      connect, and the nvme-rdma counterpart of the NULL queue->ctrl on
      reconnect
    - nvmet-rdma iWARP disconnect and device removal fixes
    - nvmet-tcp: ask for the TLS record type on every receive, and bound
      the connections accepted per work run so a connect flood can't
      hold up port removal; nvmet-auth keep the old keys if the new ones
      fail to decode; nvme-loop delete the controller if a reset fails
    - nvmet-auth reject incomplete DHCHAP messages, and a keep-alive
      timeout overflow
    - nvmet locking and bounds fixes for tbkas reconnects and the
      traddr/trsvcid configfs writes, don't leak stale memory in the ANA
      log page, and cache the passthru reference across queue_response
    - Wait for SRCU readers before splicing the namespace list, with a
      new list_splice_init_srcu() helper, and drop an extra grace period
      in nvmet_ns_disable()
    - Unregister when pr_register() is given a zero new key, and don't
      drop the cdev reference twice on cdev_device_add() failure
    - Quirks for the ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d
    - Various smaller fixes and cleanups

 - blk-mq: end the request if getting a keyslot fails, which left the
   in-flight count and zone write plug stuck, reset the queue state on
   scheduler teardown so requests don't stall in software queues, and
   fix an out-of-bounds read in blk_mq_free_rqs() after a failed
   nr_hw_queues update

 - Only serialize elevator switches of the same queue

 - dma-buf bio fixes: don't use the bvec fast path for them, and only
   fail the ones that need block layer PI

 - Reject GPT entries with starting_lba > ending_lba

 - Return the soft block size for compat BLKBSZGET, report the correct
   discard alignment in sysfs, and account the flush sequence latency
   only once in iocost

 - virtio_blk fixes: synchronous quiesce in freeze, freeze the virtqueue
   layout at probe time, clamp max_segments to the ring size, and fix
   zone append sector reporting in batched completion

 - null_blk zone fixes and a cache state reset

 - zloop fixes

 - ublk DEL_DEV_ASYNC permission check, and 32-bit selftest build

* tag 'block-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (52 commits)
  nvmet: cache passthru reference in __nvmet_req_complete()
  nvmet: drop the redundant auth check in nvmet_parse_io_cmd()
  nvmet: bound the traddr and trsvcid configfs writes
  nvmet: take subsys->lock when forcing reconnects for tbkas
  nvme: wait for SRCU readers before splicing the namespace list
  srcu: Add list_splice_init_srcu()
  nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d
  nvmet: don't return memory contents beyond valid data when reading ANA log page
  nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE
  nvmet: drop the extra RCU grace period in nvmet_ns_disable()
  nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()
  ublk: add missing DEL_DEV_ASYNC to unprivileged permission check
  selftests: ublk: fix the build and file offsets on 32-bit
  nvmet-rdma: disconnect a queue on device removal
  nvmet-rdma: queue the release work under the mutex
  nvmet-rdma: take a device off the list last
  nvmet-tcp: limit the connections accepted per work run
  nvmet-rdma: disconnect only established queues
  nvmet-auth: keep the old keys if the new ones fail
  nvmet-tcp: ask for the TLS record type on every receive
  ...

2 files changed, 37 insertions, 3 deletions

diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 0c2010230632..215753171cef 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -678,7 +678,7 @@ enum {
 	QUEUE_FLAG_HCTX_ACTIVE,		/* at least one blk-mq hctx is active */
 	QUEUE_FLAG_SQ_SCHED,		/* single queue style io dispatch */
 	QUEUE_FLAG_DISABLE_WBT_DEF,	/* for sched to disable/enable wbt */
-	QUEUE_FLAG_NO_ELV_SWITCH,	/* can't switch elevator any more */
+	QUEUE_FLAG_NO_ELV_SWITCH,	/* a switch is running or disk is going away */
 	QUEUE_FLAG_QOS_ENABLED,		/* qos is enabled */
 	QUEUE_FLAG_BIO_ISSUE_TIME,	/* record bio->issue_time_ns */
 	QUEUE_FLAG_ZONED_QD1_WRITES,	/* Limit zoned devices writes to QD=1 */
@@ -719,8 +719,6 @@ void blk_queue_flag_clear(unsigned int flag, struct request_queue *q);
 	((q)->limits.features & BLK_FEAT_SKIP_TAGSET_QUIESCE)
 #define blk_queue_disable_wbt(q)	\
 	test_bit(QUEUE_FLAG_DISABLE_WBT_DEF, &(q)->queue_flags)
-#define blk_queue_no_elv_switch(q)	\
-	test_bit(QUEUE_FLAG_NO_ELV_SWITCH, &(q)->queue_flags)
 #define blk_queue_zoned_qd1_writes(q)	\
 	test_bit(QUEUE_FLAG_ZONED_QD1_WRITES, &(q)->queue_flags)
 
diff --git a/include/linux/srcu.h b/include/linux/srcu.h
index 1a8a465a5650..d4dcaeb83e2b 100644
--- a/include/linux/srcu.h
+++ b/include/linux/srcu.h
@@ -18,6 +18,7 @@
 
 #include <linux/mutex.h>
 #include <linux/rcupdate.h>
+#include <linux/rculist.h>
 #include <linux/workqueue.h>
 #include <linux/rcu_segcblist.h>
 
@@ -118,6 +119,41 @@ void cleanup_srcu_struct(struct srcu_struct *ssp);
 void synchronize_srcu(struct srcu_struct *ssp);
 void synchronize_srcu_atomic(struct srcu_struct *ssp);
 
+/**
+ * list_splice_init_srcu - splice an SRCU-protected list into an existing list
+ * @list:	the SRCU-protected list to splice
+ * @head:	the place in the existing list to splice the first list into
+ * @ssp:	the srcu_struct that readers of @list use
+ *
+ * Like list_splice_init_rcu(), but wait for the SRCU readers of @list
+ * instead of RCU ones, so that none of them can follow a next pointer
+ * onto @head.
+ *
+ * Note that this function blocks, and that the caller must prevent any
+ * other updates to @list.
+ */
+static inline void list_splice_init_srcu(struct list_head *list,
+					 struct list_head *head,
+					 struct srcu_struct *ssp)
+{
+	struct list_head *first = list->next;
+	struct list_head *last = list->prev;
+	struct list_head *next = head->next;
+
+	if (list_empty(list))
+		return;
+
+	INIT_LIST_HEAD_RCU(list);
+	synchronize_srcu(ssp);
+	ASSERT_EXCLUSIVE_ACCESS(*first);
+	ASSERT_EXCLUSIVE_ACCESS(*last);
+
+	last->next = next;
+	rcu_assign_pointer(list_next_rcu(head), first);
+	first->prev = head;
+	next->prev = last;
+}
+
 #define SRCU_GET_STATE_COMPLETED 0x1
 
 /**