Merge tag 'nvme-7.2-2026-06-23' of git://git.infradead.org/nvme into block-7.2

Pull NVMe fixes from Keith: "- Apple A11 quirk for sharing tags across admin and IO queues (Nick) - Target fix for short AUTH_RECEIVE buffers (Michael) - Target fix for SQ refcount leak (Wentao) - Target RDMA handling inline data with nonzero offset (Bryam) - Target TCP fix handling the TCP_CLOSING state (Maurizio) - FC abort fixes in early initialization (Mohamed) - Controller device teardown fixes (Maurizio, John) - Allocate the target ana_state with the port (Rosen) - Quieten sparse and sysfs symbol warnings (John)" * tag 'nvme-7.2-2026-06-23' of git://git.infradead.org/nvme: nvmet-tcp: handle TCP_CLOSING state in nvmet_tcp_state_change nvmet-auth: reject short AUTH_RECEIVE buffers nvme-fc: Do not cancel requests in io target before it is initialized nvme: make nvme_add_ns{_head}_cdev return void nvme: make some sysfs diagnostic structures static nvmet-rdma: handle inline data with a nonzero offset nvme: target: allocate ana_state with port nvme: fix crash and memory leak during invalid cdev teardown nvmet: fix refcount leak in nvmet_sq_create() nvme: quieten sparse warning in valid LBA size check nvme-apple: Prevent shared tags across queues on Apple A11

Jens Axboe committed 4 months ago

Commit 29264402 parents 3ed9b47 7d953c712 files · +100 −57Browse files

Unified · Split

12 files

drivers/nvme/host/apple.c +4 −8
drivers/nvme/host/core.c +30 −15
drivers/nvme/host/fc.c +6 −1
drivers/nvme/host/multipath.c +14 −10
drivers/nvme/host/nvme.h +4 −1
drivers/nvme/host/sysfs.c +3 −3
drivers/nvme/target/configfs.c +1 −8
drivers/nvme/target/core.c +1 −1
drivers/nvme/target/fabrics-cmd-auth.c +25 −1
drivers/nvme/target/nvmet.h +1 −1
drivers/nvme/target/rdma.c +10 −8
drivers/nvme/target/tcp.c +1 −0

drivers/nvme/host/apple.c+4−8

@@ -225,7 +225,7 @@ static unsigned int apple_nvme_queue_depth(struct apple_nvme_queue *q) · 224 unmodified lines
225	225	{
226	226	struct apple_nvme *anv = queue_to_apple_nvme(q);
227	227
228		− if (q->is_adminq && anv->hw->has_lsq_nvmmu)
	228	+ if (q->is_adminq)
229	229	return APPLE_NVME_AQ_DEPTH;
230	230
231	231	return anv->hw->max_queue_depth;
@@ -303,7 +303,7 @@ static void apple_nvme_submit_cmd_t8015(struct apple_nvme_queue *q, · 71 unmodified lines
303	303	memcpy((void *)q->sqes + (q->sq_tail << APPLE_NVME_IOSQES),
304	304	cmd, sizeof(*cmd));
305	305
306		− if (++q->sq_tail == anv->hw->max_queue_depth)
	306	+ if (++q->sq_tail == apple_nvme_queue_depth(q))
307	307	q->sq_tail = 0;
308	308
309	309	writel(q->sq_tail, q->sq_db);
@@ -1139,10 +1139,7 @@ static void apple_nvme_reset_work(struct work_struct *work) · 829 unmodified lines
1139	1139	}
1140	1140
1141	1141	/* Setup the admin queue */
1142		− if (anv->hw->has_lsq_nvmmu)
1143		− aqa = APPLE_NVME_AQ_DEPTH - 1;
1144		− else
1145		− aqa = anv->hw->max_queue_depth - 1;
	1142	+ aqa = APPLE_NVME_AQ_DEPTH - 1;
1146	1143	aqa \|= aqa << 16;
1147	1144	writel(aqa, anv->mmio_nvme + NVME_REG_AQA);
1148	1145	writeq(anv->adminq.sq_dma_addr, anv->mmio_nvme + NVME_REG_ASQ);
@@ -1325,8 +1322,7 @@ static int apple_nvme_alloc_tagsets(struct apple_nvme *anv) · 176 unmodified lines
1325	1322	* both queues. The admin queue gets the first APPLE_NVME_AQ_DEPTH which
1326	1323	* must be marked as reserved in the IO queue.
1327	1324	*/
1328		− if (anv->hw->has_lsq_nvmmu)
1329		− anv->tagset.reserved_tags = APPLE_NVME_AQ_DEPTH;
	1325	+ anv->tagset.reserved_tags = APPLE_NVME_AQ_DEPTH;
1330	1326	anv->tagset.queue_depth = anv->hw->max_queue_depth - 1;
1331	1327	anv->tagset.timeout = NVME_IO_TIMEOUT;
1332	1328	anv->tagset.numa_node = NUMA_NO_NODE;

drivers/nvme/host/core.c+30−15

@@ -2379,6 +2379,11 @@ free: · 2378 unmodified lines
2379	2379	return ret;
2380	2380	}
2381	2381
	2382	+static bool nvme_invalid_lba_sz(u64 nsze, signed int shift, sector_t *capacity)
	2383	+{
	2384	+ return check_shl_overflow(nsze, shift, capacity);
	2385	+}
	2386	+
2382	2387	static int nvme_update_ns_info_block(struct nvme_ns *ns,
2383	2388	struct nvme_ns_info *info)
2384	2389	{
@@ -2422,10 +2427,8 @@ static int nvme_update_ns_info_block(struct nvme_ns *ns, · 37 unmodified lines
2422	2427	goto out;
2423	2428	}
2424	2429
2425		− if (id->lbaf[lbaf].ds < SECTOR_SHIFT \|\|
2426		− check_shl_overflow(le64_to_cpu(id->nsze),
2427		− id->lbaf[lbaf].ds - SECTOR_SHIFT,
2428		− &capacity)) {
	2430	+ if (nvme_invalid_lba_sz(le64_to_cpu(id->nsze),
	2431	+ id->lbaf[lbaf].ds - SECTOR_SHIFT, &capacity)) {
2429	2432	dev_warn_once(ns->ctrl->device,
2430	2433	"invalid LBA data size %u, skipping namespace\n",
2431	2434	id->lbaf[lbaf].ds);
@@ -3895,7 +3898,8 @@ void nvme_cdev_del(struct cdev cdev, struct device cdev_device) · 1463 unmodified lines
3895	3898	put_device(cdev_device);
3896	3899	}
3897	3900
3898		−int nvme_cdev_add(struct cdev cdev, struct device cdev_device,
	3901	+int nvme_cdev_add(const char name, struct cdev cdev,
	3902	+ struct device *cdev_device,
3899	3903	const struct file_operations fops, struct module owner)
3900	3904	{
3901	3905	int minor, ret;
@@ -3903,6 +3907,12 @@ int nvme_cdev_add(struct cdev cdev, struct device cdev_device, · 1 unmodified line
3903	3907	minor = ida_alloc(&nvme_ns_chr_minor_ida, GFP_KERNEL);
3904	3908	if (minor < 0)
3905	3909	return minor;
	3910	+
	3911	+ ret = dev_set_name(cdev_device, name);
	3912	+ if (ret) {
	3913	+ ida_free(&nvme_ns_chr_minor_ida, minor);
	3914	+ return ret;
	3915	+ }
3906	3916	cdev_device->devt = MKDEV(MAJOR(nvme_ns_chr_devt), minor);
3907	3917	cdev_device->class = &nvme_ns_chr_class;
3908	3918	cdev_device->release = nvme_cdev_rel;
@@ -3937,18 +3947,21 @@ static const struct file_operations nvme_ns_chr_fops = { · 28 unmodified lines
3937	3947	.uring_cmd_iopoll = nvme_ns_chr_uring_cmd_iopoll,
3938	3948	};
3939	3949
3940		−static int nvme_add_ns_cdev(struct nvme_ns *ns)
	3950	+static void nvme_add_ns_cdev(struct nvme_ns *ns)
3941	3951	{
3942		− int ret;
	3952	+ char name[32];
3943	3953
3944	3954	ns->cdev_device.parent = ns->ctrl->device;
3945		− ret = dev_set_name(&ns->cdev_device, "ng%dn%d",
3946		− ns->ctrl->instance, ns->head->instance);
3947		− if (ret)
3948		− return ret;
	3955	+ snprintf(name, sizeof(name), "ng%dn%d", ns->ctrl->instance,
	3956	+ ns->head->instance);
3949	3957
3950		− return nvme_cdev_add(&ns->cdev, &ns->cdev_device, &nvme_ns_chr_fops,
3951		− ns->ctrl->ops->module);
	3958	+ if (nvme_cdev_add(name, &ns->cdev, &ns->cdev_device,
	3959	+ &nvme_ns_chr_fops, ns->ctrl->ops->module)) {
	3960	+ dev_err(ns->ctrl->device, "Unable to create the %s device\n",
	3961	+ name);
	3962	+ return;
	3963	+ }
	3964	+ set_bit(NVME_NS_CDEV_LIVE, &ns->flags);
3952	3965	}
3953	3966
3954	3967	static struct nvme_ns_head nvme_alloc_ns_head(struct nvme_ctrl ctrl,
@@ -4324,8 +4337,10 @@ static void nvme_ns_remove(struct nvme_ns *ns) · 369 unmodified lines
4324	4337	/* guarantee not available in head->list */
4325	4338	synchronize_srcu(&ns->head->srcu);
4326	4339
4327		− if (!nvme_ns_head_multipath(ns->head))
4328		− nvme_cdev_del(&ns->cdev, &ns->cdev_device);
	4340	+ if (!nvme_ns_head_multipath(ns->head)) {
	4341	+ if (test_and_clear_bit(NVME_NS_CDEV_LIVE, &ns->flags))
	4342	+ nvme_cdev_del(&ns->cdev, &ns->cdev_device);
	4343	+ }
4329	4344
4330	4345	nvme_mpath_remove_sysfs_link(ns);
4331	4346

drivers/nvme/host/fc.c+6−1

@@ -2461,7 +2461,7 @@ __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl *ctrl, bool start_queues) · 2460 unmodified lines
2461	2461	* io requests back to the block layer as part of normal completions
2462	2462	* (but with error status).
2463	2463	*/
2464		− if (ctrl->ctrl.queue_count > 1) {
	2464	+ if (ctrl->ctrl.queue_count > 1 && ctrl->ctrl.tagset) {
2465	2465	nvme_quiesce_io_queues(&ctrl->ctrl);
2466	2466	nvme_sync_io_queues(&ctrl->ctrl);
2467	2467	blk_mq_tagset_busy_iter(&ctrl->tag_set,
@@ -2900,6 +2900,11 @@ nvme_fc_create_io_queues(struct nvme_fc_ctrl *ctrl) · 432 unmodified lines
2900	2900	out_delete_hw_queues:
2901	2901	nvme_fc_delete_hw_io_queues(ctrl);
2902	2902	out_cleanup_tagset:
	2903	+ /*
	2904	+ * In CONNECTING state ctrl->ioerr_work will abort both admin
	2905	+ * and io tagsets. Cancel it first before removing io tagset.
	2906	+ */
	2907	+ cancel_work_sync(&ctrl->ioerr_work);
2903	2908	nvme_remove_io_tag_set(&ctrl->ctrl);
2904	2909	nvme_fc_free_io_queues(ctrl);
2905	2910

drivers/nvme/host/multipath.c+14−10

@@ -639,18 +639,21 @@ static const struct file_operations nvme_ns_head_chr_fops = { · 638 unmodified lines
639	639	.uring_cmd_iopoll = nvme_ns_chr_uring_cmd_iopoll,
640	640	};
641	641
642		−static int nvme_add_ns_head_cdev(struct nvme_ns_head *head)
	642	+static void nvme_add_ns_head_cdev(struct nvme_ns_head *head)
643	643	{
644		− int ret;
	644	+ char name[32];
645	645
646	646	head->cdev_device.parent = &head->subsys->dev;
647		− ret = dev_set_name(&head->cdev_device, "ng%dn%d",
648		− head->subsys->instance, head->instance);
649		− if (ret)
650		− return ret;
651		− ret = nvme_cdev_add(&head->cdev, &head->cdev_device,
652		− &nvme_ns_head_chr_fops, THIS_MODULE);
653		− return ret;
	647	+ snprintf(name, sizeof(name), "ng%dn%d", head->subsys->instance,
	648	+ head->instance);
	649	+
	650	+ if (nvme_cdev_add(name, &head->cdev, &head->cdev_device,
	651	+ &nvme_ns_head_chr_fops, THIS_MODULE)) {
	652	+ dev_err(disk_to_dev(head->disk),
	653	+ "Unable to create the %s device\n", name);
	654	+ return;
	655	+ }
	656	+ set_bit(NVME_NSHEAD_CDEV_LIVE, &head->flags);
654	657	}
655	658
656	659	static void nvme_partition_scan_work(struct work_struct *work)
@@ -694,7 +697,8 @@ static void nvme_remove_head(struct nvme_ns_head *head) · 37 unmodified lines
694	697	*/
695	698	kblockd_schedule_work(&head->requeue_work);
696	699
697		− nvme_cdev_del(&head->cdev, &head->cdev_device);
	700	+ if (test_and_clear_bit(NVME_NSHEAD_CDEV_LIVE, &head->flags))
	701	+ nvme_cdev_del(&head->cdev, &head->cdev_device);
698	702	synchronize_srcu(&head->srcu);
699	703	del_gendisk(head->disk);
700	704	}

drivers/nvme/host/nvme.h+4−1

@@ -573,6 +573,7 @@ struct nvme_ns_head { · 572 unmodified lines
573	573	atomic_long_t io_fail_no_available_path_count;
574	574	#define NVME_NSHEAD_DISK_LIVE 0
575	575	#define NVME_NSHEAD_QUEUE_IF_NO_PATH 1
	576	+#define NVME_NSHEAD_CDEV_LIVE 2
576	577	struct nvme_ns __rcu *current_path[];
577	578	#endif
578	579	};
@@ -611,6 +612,7 @@ struct nvme_ns { · 32 unmodified lines
611	612	#define NVME_NS_FORCE_RO 3
612	613	#define NVME_NS_READY 4
613	614	#define NVME_NS_SYSFS_ATTR_LINK 5
	615	+#define NVME_NS_CDEV_LIVE 6
614	616
615	617	struct cdev cdev;
616	618	struct device cdev_device;
@@ -995,7 +997,8 @@ int nvme_get_log(struct nvme_ctrl *ctrl, u32 nsid, u8 log_page, u8 lsp, u8 csi, · 378 unmodified lines
995	997	void *log, size_t size, u64 offset);
996	998	bool nvme_tryget_ns_head(struct nvme_ns_head *head);
997	999	void nvme_put_ns_head(struct nvme_ns_head *head);
998		−int nvme_cdev_add(struct cdev cdev, struct device cdev_device,
	1000	+int nvme_cdev_add(const char name, struct cdev cdev,
	1001	+ struct device *cdev_device,
999	1002	const struct file_operations fops, struct module owner);
1000	1003	void nvme_cdev_del(struct cdev cdev, struct device cdev_device);
1001	1004	int nvme_ioctl(struct block_device *bdev, blk_mode_t mode,

drivers/nvme/host/sysfs.c+3−3

@@ -394,7 +394,7 @@ static ssize_t nvme_io_errors_store(struct device *dev, · 393 unmodified lines
394	394	return count;
395	395	}
396	396
397		−struct device_attribute dev_attr_io_errors =
	397	+static struct device_attribute dev_attr_io_errors =
398	398	__ATTR(command_error_count, 0644,
399	399	nvme_io_errors_show, nvme_io_errors_store);
400	400
@@ -441,7 +441,7 @@ static umode_t nvme_ns_diag_attrs_are_visible(struct kobject *kobj, · 40 unmodified lines
441	441	return a->mode;
442	442	}
443	443
444		−const struct attribute_group nvme_ns_diag_attr_group = {
	444	+static const struct attribute_group nvme_ns_diag_attr_group = {
445	445	.name = "diag",
446	446	.attrs = nvme_ns_diag_attrs,
447	447	.is_visible = nvme_ns_diag_attrs_are_visible,
@@ -1147,7 +1147,7 @@ static ssize_t nvme_adm_errors_store(struct device *dev, · 699 unmodified lines
1147	1147	return count;
1148	1148	}
1149	1149
1150		−struct device_attribute dev_attr_adm_errors =
	1150	+static struct device_attribute dev_attr_adm_errors =
1151	1151	__ATTR(command_error_count, 0644,
1152	1152	nvme_adm_errors_show, nvme_adm_errors_store);
1153	1153

drivers/nvme/target/configfs.c+1−8

@@ -2007,7 +2007,6 @@ static void nvmet_port_release(struct config_item *item) · 2006 unmodified lines
2007	2007	list_del(&port->global_entry);
2008	2008
2009	2009	key_put(port->keyring);
2010		− kfree(port->ana_state);
2011	2010	kfree(port);
2012	2011	}
2013	2012
@@ -2047,16 +2046,10 @@ static struct config_group nvmet_ports_make(struct config_group group, · 33 unmodified lines
2047	2046	if (kstrtou16(name, 0, &portid))
2048	2047	return ERR_PTR(-EINVAL);
2049	2048
2050		− port = kzalloc_obj(*port);
	2049	+ port = kzalloc_flex(*port, ana_state, NVMET_MAX_ANAGRPS + 1);
2051	2050	if (!port)
2052	2051	return ERR_PTR(-ENOMEM);
2053	2052
2054		− port->ana_state = kzalloc_objs(*port->ana_state, NVMET_MAX_ANAGRPS + 1);
2055		− if (!port->ana_state) {
2056		− kfree(port);
2057		− return ERR_PTR(-ENOMEM);
2058		− }
2059		−
2060	2053	if (IS_ENABLED(CONFIG_NVME_TARGET_TCP_TLS) && nvme_keyring_id()) {
2061	2054	port->keyring = key_lookup(nvme_keyring_id());
2062	2055	if (IS_ERR(port->keyring)) {

drivers/nvme/target/core.c+1−1

@@ -944,7 +944,7 @@ u16 nvmet_sq_create(struct nvmet_ctrl ctrl, struct nvmet_sq sq, · 943 unmodified lines
944	944
945	945	status = nvmet_check_sqid(ctrl, sqid, true);
946	946	if (status != NVME_SC_SUCCESS)
947		− return status;
	947	+ goto ctrl_put;
948	948
949	949	ret = nvmet_sq_init(sq, cq);
950	950	if (ret) {

drivers/nvme/target/fabrics-cmd-auth.c+25−1

@@ -493,7 +493,31 @@ static void nvmet_auth_failure1(struct nvmet_req req, void d, int al) · 492 unmodified lines
493	493
494	494	u32 nvmet_auth_receive_data_len(struct nvmet_req *req)
495	495	{
496		− return le32_to_cpu(req->cmd->auth_receive.al);
	496	+ struct nvmet_ctrl *ctrl = req->sq->ctrl;
	497	+ u32 al = le32_to_cpu(req->cmd->auth_receive.al);
	498	+ u32 min_len;
	499	+
	500	+ /*
	501	+ * Reject too-short al before kmalloc(al), since the SUCCESS1 and
	502	+ * FAILURE1/default builders write fixed response headers into it.
	503	+ */
	504	+ switch (req->sq->dhchap_step) {
	505	+ case NVME_AUTH_DHCHAP_MESSAGE_CHALLENGE:
	506	+ return al;
	507	+ case NVME_AUTH_DHCHAP_MESSAGE_SUCCESS1:
	508	+ min_len = sizeof(struct nvmf_auth_dhchap_success1_data);
	509	+ if (req->sq->dhchap_c2)
	510	+ min_len += nvme_auth_hmac_hash_len(ctrl->shash_id);
	511	+ break;
	512	+ default:
	513	+ min_len = sizeof(struct nvmf_auth_dhchap_failure_data);
	514	+ break;
	515	+ }
	516	+
	517	+ if (al < min_len)
	518	+ return 0;
	519	+
	520	+ return al;
497	521	}
498	522
499	523	void nvmet_execute_auth_receive(struct nvmet_req *req)

drivers/nvme/target/nvmet.h+1−1

@@ -208,7 +208,6 @@ struct nvmet_port { · 207 unmodified lines
208	208	struct list_head global_entry;
209	209	struct config_group ana_groups_group;
210	210	struct nvmet_ana_group ana_default_group;
211		− enum nvme_ana_state *ana_state;
212	211	struct key *keyring;
213	212	void *priv;
214	213	bool enabled;
@@ -217,6 +216,7 @@ struct nvmet_port { · 2 unmodified lines
217	216	int mdts;
218	217	const struct nvmet_fabrics_ops *tr_ops;
219	218	bool pi_enable;
	219	+ enum nvme_ana_state ana_state[];
220	220	};
221	221
222	222	static inline struct nvmet_port to_nvmet_port(struct config_item item)

drivers/nvme/target/rdma.c+10−8

@@ -666,7 +666,8 @@ static void nvmet_rdma_release_rsp(struct nvmet_rdma_rsp *rsp) · 665 unmodified lines
666	666	if (rsp->n_rdma)
667	667	nvmet_rdma_rw_ctx_destroy(rsp);
668	668
669		− if (rsp->req.sg != rsp->cmd->inline_sg)
	669	+ if (rsp->req.sg < rsp->cmd->inline_sg \|\|
	670	+ rsp->req.sg >= rsp->cmd->inline_sg + queue->dev->inline_page_count)
670	671	nvmet_req_free_sgls(&rsp->req);
671	672
672	673	if (unlikely(!list_empty_careful(&queue->rsp_wr_wait_list)))
@@ -821,24 +822,25 @@ static void nvmet_rdma_write_data_done(struct ib_cq cq, struct ib_wc wc) · 148 unmodified lines
821	822	static void nvmet_rdma_use_inline_sg(struct nvmet_rdma_rsp *rsp, u32 len,
822	823	u64 off)
823	824	{
824		− int sg_count = num_pages(len);
	825	+ u64 page_off = off % PAGE_SIZE;
	826	+ u64 page_idx = off / PAGE_SIZE;
	827	+ int sg_count = num_pages(page_off + len);
825	828	struct scatterlist *sg;
826	829	int i;
827	830
828		− sg = rsp->cmd->inline_sg;
	831	+ sg = &rsp->cmd->inline_sg[page_idx];
829	832	for (i = 0; i < sg_count; i++, sg++) {
830	833	if (i < sg_count - 1)
831	834	sg_unmark_end(sg);
832	835	else
833	836	sg_mark_end(sg);
834		− sg->offset = off;
835		− sg->length = min_t(int, len, PAGE_SIZE - off);
	837	+ sg->offset = page_off;
	838	+ sg->length = min_t(u64, len, PAGE_SIZE - page_off);
836	839	len -= sg->length;
837		− if (!i)
838		− off = 0;
	840	+ page_off = 0;
839	841	}
840	842
841		− rsp->req.sg = rsp->cmd->inline_sg;
	843	+ rsp->req.sg = &rsp->cmd->inline_sg[page_idx];
842	844	rsp->req.sg_cnt = sg_count;
843	845	}
844	846

drivers/nvme/target/tcp.c+1−0

@@ -1680,6 +1680,7 @@ static void nvmet_tcp_state_change(struct sock *sk) · 1679 unmodified lines
1680	1680	switch (sk->sk_state) {
1681	1681	case TCP_FIN_WAIT2:
1682	1682	case TCP_LAST_ACK:
	1683	+ case TCP_CLOSING:
1683	1684	break;
1684	1685	case TCP_FIN_WAIT1:
1685	1686	case TCP_CLOSE_WAIT:

Merge tag 'nvme-7.2-2026-06-23' of git://git.infradead.org/nvme into block-7.2

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code