Merge tag 'nvme-7.2-2026-06-23' of git://git.infradead.org/nvme into block-7.2

Pull NVMe fixes from Keith: "- Apple A11 quirk for sharing tags across admin and IO queues (Nick) - Target fix for short AUTH_RECEIVE buffers (Michael) - Target fix for SQ refcount leak (Wentao) - Target RDMA handling inline data with nonzero offset (Bryam) - Target TCP fix handling the TCP_CLOSING state (Maurizio) - FC abort fixes in early initialization (Mohamed) - Controller device teardown fixes (Maurizio, John) - Allocate the target ana_state with the port (Rosen) - Quieten sparse and sysfs symbol warnings (John)" * tag 'nvme-7.2-2026-06-23' of git://git.infradead.org/nvme: nvmet-tcp: handle TCP_CLOSING state in nvmet_tcp_state_change nvmet-auth: reject short AUTH_RECEIVE buffers nvme-fc: Do not cancel requests in io target before it is initialized nvme: make nvme_add_ns{_head}_cdev return void nvme: make some sysfs diagnostic structures static nvmet-rdma: handle inline data with a nonzero offset nvme: target: allocate ana_state with port nvme: fix crash and memory leak during invalid cdev teardown nvmet: fix refcount leak in nvmet_sq_create() nvme: quieten sparse warning in valid LBA size check nvme-apple: Prevent shared tags across queues on Apple A11

Jens Axboe committed 4 months ago

Commit 29264402 parents 3ed9b47 7d953c712 files · +100 −57Browse files

Unified · Split

12 files

drivers/nvme/host/apple.c +4 −8
drivers/nvme/host/core.c +30 −15
drivers/nvme/host/fc.c +6 −1
drivers/nvme/host/multipath.c +14 −10
drivers/nvme/host/nvme.h +4 −1
drivers/nvme/host/sysfs.c +3 −3
drivers/nvme/target/configfs.c +1 −8
drivers/nvme/target/core.c +1 −1
drivers/nvme/target/fabrics-cmd-auth.c +25 −1
drivers/nvme/target/nvmet.h +1 −1
drivers/nvme/target/rdma.c +10 −8
drivers/nvme/target/tcp.c +1 −0

drivers/nvme/host/apple.c+4−8

 {
 	struct apple_nvme *anv = queue_to_apple_nvme(q);
-	if (q->is_adminq && anv->hw->has_lsq_nvmmu)
+	if (q->is_adminq)
 		return APPLE_NVME_AQ_DEPTH;
 	return anv->hw->max_queue_depth;
 		memcpy((void *)q->sqes + (q->sq_tail << APPLE_NVME_IOSQES),
 			cmd, sizeof(*cmd));
-	if (++q->sq_tail == anv->hw->max_queue_depth)
+	if (++q->sq_tail == apple_nvme_queue_depth(q))
 		q->sq_tail = 0;
 	writel(q->sq_tail, q->sq_db);
 	}
 	/* Setup the admin queue */
-	if (anv->hw->has_lsq_nvmmu)
+	aqa = APPLE_NVME_AQ_DEPTH - 1;
-		aqa = APPLE_NVME_AQ_DEPTH - 1;
-	else
-		aqa = anv->hw->max_queue_depth - 1;
 	aqa |= aqa << 16;
 	writel(aqa, anv->mmio_nvme + NVME_REG_AQA);
 	writeq(anv->adminq.sq_dma_addr, anv->mmio_nvme + NVME_REG_ASQ);
 	 * both queues. The admin queue gets the first APPLE_NVME_AQ_DEPTH which
 	 * must be marked as reserved in the IO queue.
 	 */
-	if (anv->hw->has_lsq_nvmmu)
+	anv->tagset.reserved_tags = APPLE_NVME_AQ_DEPTH;
-		anv->tagset.reserved_tags = APPLE_NVME_AQ_DEPTH;
 	anv->tagset.queue_depth = anv->hw->max_queue_depth - 1;
 	anv->tagset.timeout = NVME_IO_TIMEOUT;
 	anv->tagset.numa_node = NUMA_NO_NODE;

drivers/nvme/host/core.c+30−15

 	return ret;
 }
+static bool nvme_invalid_lba_sz(u64 nsze, signed int shift, sector_t *capacity)
+{
+	return check_shl_overflow(nsze, shift, capacity);
+}
 static int nvme_update_ns_info_block(struct nvme_ns *ns,
 		struct nvme_ns_info *info)
 {
 			goto out;
 	}
-	if (id->lbaf[lbaf].ds < SECTOR_SHIFT ||
+	if (nvme_invalid_lba_sz(le64_to_cpu(id->nsze),
-	    check_shl_overflow(le64_to_cpu(id->nsze),
+			id->lbaf[lbaf].ds - SECTOR_SHIFT, &capacity)) {
-			       id->lbaf[lbaf].ds - SECTOR_SHIFT,
-			       &capacity)) {
 		dev_warn_once(ns->ctrl->device,
 			"invalid LBA data size %u, skipping namespace\n",
 			id->lbaf[lbaf].ds);
 	put_device(cdev_device);
 }
-int nvme_cdev_add(struct cdev *cdev, struct device *cdev_device,
+int nvme_cdev_add(const char *name, struct cdev *cdev,
+		struct device *cdev_device,
 		const struct file_operations *fops, struct module *owner)
 {
 	int minor, ret;
 	minor = ida_alloc(&nvme_ns_chr_minor_ida, GFP_KERNEL);
 	if (minor < 0)
 		return minor;
+	ret = dev_set_name(cdev_device, name);
+	if (ret) {
+		ida_free(&nvme_ns_chr_minor_ida, minor);
+		return ret;
+	}
 	cdev_device->devt = MKDEV(MAJOR(nvme_ns_chr_devt), minor);
 	cdev_device->class = &nvme_ns_chr_class;
 	cdev_device->release = nvme_cdev_rel;
 	.uring_cmd_iopoll = nvme_ns_chr_uring_cmd_iopoll,
 };
-static int nvme_add_ns_cdev(struct nvme_ns *ns)
+static void nvme_add_ns_cdev(struct nvme_ns *ns)
 {
-	int ret;
+	char name[32];
 	ns->cdev_device.parent = ns->ctrl->device;
-	ret = dev_set_name(&ns->cdev_device, "ng%dn%d",
+	snprintf(name, sizeof(name), "ng%dn%d", ns->ctrl->instance,
-			   ns->ctrl->instance, ns->head->instance);
+		 ns->head->instance);
-	if (ret)
-		return ret;
-	return nvme_cdev_add(&ns->cdev, &ns->cdev_device, &nvme_ns_chr_fops,
+	if (nvme_cdev_add(name, &ns->cdev, &ns->cdev_device,
-			     ns->ctrl->ops->module);
+			&nvme_ns_chr_fops, ns->ctrl->ops->module)) {
+		dev_err(ns->ctrl->device, "Unable to create the %s device\n",
+			name);
+		return;
+	}
+	set_bit(NVME_NS_CDEV_LIVE, &ns->flags);
 }
 static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl,
 	/* guarantee not available in head->list */
 	synchronize_srcu(&ns->head->srcu);
-	if (!nvme_ns_head_multipath(ns->head))
+	if (!nvme_ns_head_multipath(ns->head)) {
-		nvme_cdev_del(&ns->cdev, &ns->cdev_device);
+		if (test_and_clear_bit(NVME_NS_CDEV_LIVE, &ns->flags))
+			nvme_cdev_del(&ns->cdev, &ns->cdev_device);
+	}
 	nvme_mpath_remove_sysfs_link(ns);

drivers/nvme/host/fc.c+6−1

 	 * io requests back to the block layer as part of normal completions
 	 * (but with error status).
 	 */
-	if (ctrl->ctrl.queue_count > 1) {
+	if (ctrl->ctrl.queue_count > 1 && ctrl->ctrl.tagset) {
 		nvme_quiesce_io_queues(&ctrl->ctrl);
 		nvme_sync_io_queues(&ctrl->ctrl);
 		blk_mq_tagset_busy_iter(&ctrl->tag_set,
 out_delete_hw_queues:
 	nvme_fc_delete_hw_io_queues(ctrl);
 out_cleanup_tagset:
+	/*
+	 * In CONNECTING state ctrl->ioerr_work will abort both admin
+	 * and io tagsets. Cancel it first before removing io tagset.
+	 */
+	cancel_work_sync(&ctrl->ioerr_work);
 	nvme_remove_io_tag_set(&ctrl->ctrl);
 	nvme_fc_free_io_queues(ctrl);

drivers/nvme/host/multipath.c+14−10

@@ -639,18 +639,21 @@ static const struct file_operations nvme_ns_head_chr_fops = { · 638 unmodified lines
639	.uring_cmd_iopoll = nvme_ns_chr_uring_cmd_iopoll,	639	.uring_cmd_iopoll = nvme_ns_chr_uring_cmd_iopoll,
640	};	640	};
641		641
642	static int nvme_add_ns_head_cdev(struct nvme_ns_head *head)	642	static void nvme_add_ns_head_cdev(struct nvme_ns_head *head)
643	{	643	{
644	int ret;	644	char name[32];
645		645
646	head->cdev_device.parent = &head->subsys->dev;	646	head->cdev_device.parent = &head->subsys->dev;
647	ret = dev_set_name(&head->cdev_device, "ng%dn%d",	647	snprintf(name, sizeof(name), "ng%dn%d", head->subsys->instance,
648	head->subsys->instance, head->instance);	648	head->instance);
649	if (ret)	649
650	return ret;	650	if (nvme_cdev_add(name, &head->cdev, &head->cdev_device,
651	ret = nvme_cdev_add(&head->cdev, &head->cdev_device,	651	&nvme_ns_head_chr_fops, THIS_MODULE)) {
652	&nvme_ns_head_chr_fops, THIS_MODULE);	652	dev_err(disk_to_dev(head->disk),
653	return ret;	653	"Unable to create the %s device\n", name);
		654	return;
		655	}
		656	set_bit(NVME_NSHEAD_CDEV_LIVE, &head->flags);
654	}	657	}
655		658
656	static void nvme_partition_scan_work(struct work_struct *work)	659	static void nvme_partition_scan_work(struct work_struct *work)
@@ -694,7 +697,8 @@ static void nvme_remove_head(struct nvme_ns_head *head) · 37 unmodified lines
694	*/	697	*/
695	kblockd_schedule_work(&head->requeue_work);	698	kblockd_schedule_work(&head->requeue_work);
696		699
697	nvme_cdev_del(&head->cdev, &head->cdev_device);	700	if (test_and_clear_bit(NVME_NSHEAD_CDEV_LIVE, &head->flags))
		701	nvme_cdev_del(&head->cdev, &head->cdev_device);
698	synchronize_srcu(&head->srcu);	702	synchronize_srcu(&head->srcu);
699	del_gendisk(head->disk);	703	del_gendisk(head->disk);
700	}	704	}

drivers/nvme/host/nvme.h+4−1

 	atomic_long_t		io_fail_no_available_path_count;
 #define NVME_NSHEAD_DISK_LIVE		0
 #define NVME_NSHEAD_QUEUE_IF_NO_PATH	1
+#define NVME_NSHEAD_CDEV_LIVE		2
 	struct nvme_ns __rcu	*current_path[];
 #endif
 };
 #define NVME_NS_FORCE_RO		3
 #define NVME_NS_READY			4
 #define NVME_NS_SYSFS_ATTR_LINK	5
+#define NVME_NS_CDEV_LIVE		6
 	struct cdev		cdev;
 	struct device		cdev_device;
 		void *log, size_t size, u64 offset);
 bool nvme_tryget_ns_head(struct nvme_ns_head *head);
 void nvme_put_ns_head(struct nvme_ns_head *head);
-int nvme_cdev_add(struct cdev *cdev, struct device *cdev_device,
+int nvme_cdev_add(const char *name, struct cdev *cdev,
+		struct device *cdev_device,
 		const struct file_operations *fops, struct module *owner);
 void nvme_cdev_del(struct cdev *cdev, struct device *cdev_device);
 int nvme_ioctl(struct block_device *bdev, blk_mode_t mode,

drivers/nvme/host/sysfs.c+3−3

@@ -394,7 +394,7 @@ static ssize_t nvme_io_errors_store(struct device *dev, · 393 unmodified lines
394	return count;	394	return count;
395	}	395	}
396		396
397	struct device_attribute dev_attr_io_errors =	397	static struct device_attribute dev_attr_io_errors =
398	__ATTR(command_error_count, 0644,	398	__ATTR(command_error_count, 0644,
399	nvme_io_errors_show, nvme_io_errors_store);	399	nvme_io_errors_show, nvme_io_errors_store);
400		400
@@ -441,7 +441,7 @@ static umode_t nvme_ns_diag_attrs_are_visible(struct kobject *kobj, · 40 unmodified lines
441	return a->mode;	441	return a->mode;
442	}	442	}
443		443
444	const struct attribute_group nvme_ns_diag_attr_group = {	444	static const struct attribute_group nvme_ns_diag_attr_group = {
445	.name = "diag",	445	.name = "diag",
446	.attrs = nvme_ns_diag_attrs,	446	.attrs = nvme_ns_diag_attrs,
447	.is_visible = nvme_ns_diag_attrs_are_visible,	447	.is_visible = nvme_ns_diag_attrs_are_visible,
@@ -1147,7 +1147,7 @@ static ssize_t nvme_adm_errors_store(struct device *dev, · 699 unmodified lines
1147	return count;	1147	return count;
1148	}	1148	}
1149		1149
1150	struct device_attribute dev_attr_adm_errors =	1150	static struct device_attribute dev_attr_adm_errors =
1151	__ATTR(command_error_count, 0644,	1151	__ATTR(command_error_count, 0644,
1152	nvme_adm_errors_show, nvme_adm_errors_store);	1152	nvme_adm_errors_show, nvme_adm_errors_store);
1153		1153

drivers/nvme/target/configfs.c+1−8

 	list_del(&port->global_entry);
 	key_put(port->keyring);
-	kfree(port->ana_state);
 	kfree(port);
 }
 	if (kstrtou16(name, 0, &portid))
 		return ERR_PTR(-EINVAL);
-	port = kzalloc_obj(*port);
+	port = kzalloc_flex(*port, ana_state, NVMET_MAX_ANAGRPS + 1);
 	if (!port)
 		return ERR_PTR(-ENOMEM);
-	port->ana_state = kzalloc_objs(*port->ana_state, NVMET_MAX_ANAGRPS + 1);
-	if (!port->ana_state) {
-		kfree(port);
-		return ERR_PTR(-ENOMEM);
-	}
 	if (IS_ENABLED(CONFIG_NVME_TARGET_TCP_TLS) && nvme_keyring_id()) {
 		port->keyring = key_lookup(nvme_keyring_id());
 		if (IS_ERR(port->keyring)) {

drivers/nvme/target/core.c+1−1

@@ -944,7 +944,7 @@ u16 nvmet_sq_create(struct nvmet_ctrl ctrl, struct nvmet_sq sq, · 943 unmodified lines
944		944
945	status = nvmet_check_sqid(ctrl, sqid, true);	945	status = nvmet_check_sqid(ctrl, sqid, true);
946	if (status != NVME_SC_SUCCESS)	946	if (status != NVME_SC_SUCCESS)
947	return status;	947	goto ctrl_put;
948		948
949	ret = nvmet_sq_init(sq, cq);	949	ret = nvmet_sq_init(sq, cq);
950	if (ret) {	950	if (ret) {

drivers/nvme/target/fabrics-cmd-auth.c+25−1

@@ -493,7 +493,31 @@ static void nvmet_auth_failure1(struct nvmet_req req, void d, int al) · 492 unmodified lines
493		493
494	u32 nvmet_auth_receive_data_len(struct nvmet_req *req)	494	u32 nvmet_auth_receive_data_len(struct nvmet_req *req)
495	{	495	{
496	return le32_to_cpu(req->cmd->auth_receive.al);	496	struct nvmet_ctrl *ctrl = req->sq->ctrl;
		497	u32 al = le32_to_cpu(req->cmd->auth_receive.al);
		498	u32 min_len;
		499
		500	/*
		501	* Reject too-short al before kmalloc(al), since the SUCCESS1 and
		502	* FAILURE1/default builders write fixed response headers into it.
		503	*/
		504	switch (req->sq->dhchap_step) {
		505	case NVME_AUTH_DHCHAP_MESSAGE_CHALLENGE:
		506	return al;
		507	case NVME_AUTH_DHCHAP_MESSAGE_SUCCESS1:
		508	min_len = sizeof(struct nvmf_auth_dhchap_success1_data);
		509	if (req->sq->dhchap_c2)
		510	min_len += nvme_auth_hmac_hash_len(ctrl->shash_id);
		511	break;
		512	default:
		513	min_len = sizeof(struct nvmf_auth_dhchap_failure_data);
		514	break;
		515	}
		516
		517	if (al < min_len)
		518	return 0;
		519
		520	return al;
497	}	521	}
498		522
499	void nvmet_execute_auth_receive(struct nvmet_req *req)	523	void nvmet_execute_auth_receive(struct nvmet_req *req)

drivers/nvme/target/nvmet.h+1−1

 	struct list_head		global_entry;
 	struct config_group		ana_groups_group;
 	struct nvmet_ana_group		ana_default_group;
-	enum nvme_ana_state		*ana_state;
 	struct key			*keyring;
 	void				*priv;
 	bool				enabled;
 	int				mdts;
 	const struct nvmet_fabrics_ops	*tr_ops;
 	bool				pi_enable;
+	enum nvme_ana_state		ana_state[];
 };
 static inline struct nvmet_port *to_nvmet_port(struct config_item *item)

drivers/nvme/target/rdma.c+10−8

 	if (rsp->n_rdma)
 		nvmet_rdma_rw_ctx_destroy(rsp);
-	if (rsp->req.sg != rsp->cmd->inline_sg)
+	if (rsp->req.sg < rsp->cmd->inline_sg ||
+	    rsp->req.sg >= rsp->cmd->inline_sg + queue->dev->inline_page_count)
 		nvmet_req_free_sgls(&rsp->req);
 	if (unlikely(!list_empty_careful(&queue->rsp_wr_wait_list)))
 static void nvmet_rdma_use_inline_sg(struct nvmet_rdma_rsp *rsp, u32 len,
 		u64 off)
 {
-	int sg_count = num_pages(len);
+	u64 page_off = off % PAGE_SIZE;
+	u64 page_idx = off / PAGE_SIZE;
+	int sg_count = num_pages(page_off + len);
 	struct scatterlist *sg;
 	int i;
-	sg = rsp->cmd->inline_sg;
+	sg = &rsp->cmd->inline_sg[page_idx];
 	for (i = 0; i < sg_count; i++, sg++) {
 		if (i < sg_count - 1)
 			sg_unmark_end(sg);
 		else
 			sg_mark_end(sg);
-		sg->offset = off;
+		sg->offset = page_off;
-		sg->length = min_t(int, len, PAGE_SIZE - off);
+		sg->length = min_t(u64, len, PAGE_SIZE - page_off);
 		len -= sg->length;
-		if (!i)
+		page_off = 0;
-			off = 0;
 	}
-	rsp->req.sg = rsp->cmd->inline_sg;
+	rsp->req.sg = &rsp->cmd->inline_sg[page_idx];
 	rsp->req.sg_cnt = sg_count;
 }

drivers/nvme/target/tcp.c+1−0

@@ -1680,6 +1680,7 @@ static void nvmet_tcp_state_change(struct sock *sk) · 1679 unmodified lines
1680	switch (sk->sk_state) {	1680	switch (sk->sk_state) {
1681	case TCP_FIN_WAIT2:	1681	case TCP_FIN_WAIT2:
1682	case TCP_LAST_ACK:	1682	case TCP_LAST_ACK:
		1683	case TCP_CLOSING:
1683	break;	1684	break;
1684	case TCP_FIN_WAIT1:	1685	case TCP_FIN_WAIT1:
1685	case TCP_CLOSE_WAIT:	1686	case TCP_CLOSE_WAIT:

Merge tag 'nvme-7.2-2026-06-23' of git://git.infradead.org/nvme into block-7.2

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code