Merge tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull more block updates from Jens Axboe:
 "Bigger than usual for an end-of-merge-window pull request, main reason
  being that the MD side I had missed a pull on, and both NVMe and block
  got a good pile of LLM driven fixes where some of them may as well
  just go in now rather than wait a full cycle. This contains:

   - NVMe fixes via Keith:
      - nvme-tcp fallout from the parallel queue allocation: initialize
        pf_cache_lock and the header digest before requests are set up,
        and don't dereference a NULL queue->ctrl on reconnect
      - nvme-fabrics queue mapping fixes: reset io_queues on reconnect,
        limit each queue type to the online CPUs, and clear a poll map
        with no poll queues
      - nvme-tcp io_work priority inversion with send_mutex held
        (Seiji), error recovery on read_sock failure and skipping TLS
        control records while waiting for the ICResp (Martin B), TLS
        handshake timeout validation, and an address attribute race
      - nvme-rdma NULL metadata_sgl dereference with T10-PI
      - nvme-pci early boot hang with the quirks parameter
      - nvme-multipath ANA log bounds underflow, and an nvme-fc
        discovery reference leak
      - nvmet hardening: rdma inline SGL out-of-bounds write and short
        connect requests, fc use-after-free in LS create connection and
        teardown on admin queue failure, pci-epf transport error
        reporting and SGL length checks, zns NUMD wrap, fc stale read
        data, auth state and status fixes, ports list and qid_max
        locking, rdma double puts and irq-safe locking, and a double
        free on metadata SGL allocation failure
      - nvmet fixes from Josef: big discard length truncation, NULL
        derefs for PCI endpoint targets and debugfs host_traddr, stop
        listening when a tcp port is removed, and don't BUG() in
        nvme-loop when a scan runs beside a reset

   - MD fixes via Yu Kuai:
      - raid5 validation: reject too few disks, invalid reshape disks, a
        per-device size below one chunk, and an inconsistent reshape
        state from the superblock instead of BUG(), plus journal payload
        size checks
      - raid5 error path and lifetime fixes: extra_page leak and NULL
        derefs in free_conf/setup_conf, draining released_stripes before
        destroying the cache, RCU for the big_stripe_tree lookup, and
        per-array io_unit slab names
      - md core: reject v0.90 arrays with too many devices, validate
        bblog_size, take reconfig_mutex when enabling PPL, fix the
        mddev->private NULL deref when stopping an array under IO, and
        don't hand out the array before mddev->kobj is added
      - raid10 missing barrier wakeup, raid0 device count validation, a
        bogus mddev_unlock() in lbs_store(), and shared helpers

   - blk-mq fixes from Josef:
      - don't trust the bio cookie in blk_mq_poll()
      - keep tag sharing fair after a queue update
      - don't bring back flags of a completed request from the timeout
        handler
      - honor a restarted timer
      - initialize the dma state for P2P
      - quiesce a queue joining a quiesced tag set
      - set up and exit hctxs under tag_list_lock
      - free the tag bitmaps in the SRCU callback

   - blk-cgroup and friends from Josef:
      - keep the old blkg while reassociating a bio
      - free struct ioc after a grace period
      - don't truncate v1 iops limits
      - fix root io.stat on 32-bit
      - don't free a blkg with its punt work queued
      - flush iolatency enable_work after going offline
      - pass dead group I/O counts on and make reset_stats reset them
      - don't enter reclaim under rq_qos_mutex

   - Other core fixes from Josef:
      - a disk use-after-free in sync_bdevs()
      - don't losing the status of a failed flush request
      - 64-bit sector math for mac partitions
      - apply the segment size to the integrity buffer

   - blk-iocost: abort a weight transfer on invalid donation weights,
     and publish hweights as one atomic value

   - Fix a NULL deref and use-after-free in __blk_crypto_evict_key(),
     reachable via dm-inlinecrypt

   - Fix recursive i_rwsem locking in blkdev_write_iter(), from two
     fixes for the same race landing in the window

   - Advance the iterator after copy-in for SG_DXFER_TO_FROM_DEV, fixing
     an infinite loop in blk_rq_map_user_iov()

   - Check the open mode for LOOP_SET_STATUS in the compat ioctl

   - rnbd-srv use-after-free and kobject fixes

   - drbd timer and req_lock fixes

   - zloop cleanups and error path fixes

   - cdrom header and kernel-doc cleanups"

* tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (109 commits)
  blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
  zloop: check that the zone backing file support ->{read,write}_iter
  zloop: fput file after failed zone init
  zloop: share more code for opening a zone backing file
  zloop: remove a duplicate call to zloop_get_block_size
  block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c
  blk-iocost: publish hweights as one atomic value
  blk-iocost: abort weight transfer on invalid donation weights
  rnbd-srv: publish the sess_dev at the end of OPEN
  rnbd-srv: fix use-after-free on two CLOSE messages
  block/rnbd-srv: drop the sess_dev kobject unlocked
  block/rnbd-srv: don't free the device on a sysfs error
  drbd: take req_lock to skip the initial sync as peer
  drbd: stop the start_resync timer of a dying device
  block: apply the segment size to the integrity buffer
  blk-mq: free the bitmaps of tags in the SRCU callback
  block: partitions/mac: compute the sectors in 64 bits
  blk-mq: set up a queue under tag_list_lock
  blk-mq: exit the hctxs of a queue under tag_list_lock
  blk-mq: quiesce a queue that joins a quiesced tag set
  ...

0 files changed, 0 insertions, 0 deletions