Merge tag 'nvme-6.10-2024-06-13' of git://git.infradead.org/nvme into block-6.10

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

Pull NVMe fixes from Keith:

"nvme fixes for Linux 6.10

- Discard double free on error conditions (Chunguang)
- Target Fixes (Daniel)
- Namespace detachment regression fix (Keith)"

* tag 'nvme-6.10-2024-06-13' of git://git.infradead.org/nvme:
nvme: fix namespace removal list
nvmet: always initialize cqe.result
nvmet-passthru: propagate status from id override functions
nvme: avoid double free special payload

Jens Axboe 2 years ago e3e53683 957df9af

+10 -16

5 changed files

expand all

drivers

nvme

host

core.c

target

core.c

fabrics-cmd-auth.c

fabrics-cmd.c

passthru.c

+6 -4

drivers/nvme/host/core.c

··· 998 998 clear_bit_unlock(0, &ctrl->discard_page_busy); 999 999 else 1000 1000 kfree(bvec_virt(&req->special_vec)); 1001 + req->rq_flags &= ~RQF_SPECIAL_PAYLOAD; 1001 1002 } 1002 1003 } 1003 1004 EXPORT_SYMBOL_GPL(nvme_cleanup_cmd); ··· 3960 3959 3961 3960 mutex_lock(&ctrl->namespaces_lock); 3962 3961 list_for_each_entry_safe(ns, next, &ctrl->namespaces, list) { 3963 - if (ns->head->ns_id > nsid) 3964 - list_splice_init_rcu(&ns->list, &rm_list, 3965 - synchronize_rcu); 3962 + if (ns->head->ns_id > nsid) { 3963 + list_del_rcu(&ns->list); 3964 + synchronize_srcu(&ctrl->srcu); 3965 + list_add_tail_rcu(&ns->list, &rm_list); 3966 + } 3966 3967 } 3967 3968 mutex_unlock(&ctrl->namespaces_lock); 3968 - synchronize_srcu(&ctrl->srcu); 3969 3969 3970 3970 list_for_each_entry_safe(ns, next, &rm_list, list) 3971 3971 nvme_ns_remove(ns);

drivers/nvme/target/core.c

··· 957 957 req->metadata_sg_cnt = 0; 958 958 req->transfer_len = 0; 959 959 req->metadata_len = 0; 960 + req->cqe->result.u64 = 0; 960 961 req->cqe->status = 0; 961 962 req->cqe->sq_head = 0; 962 963 req->ns = NULL;

-3

drivers/nvme/target/fabrics-cmd-auth.c

··· 333 333 pr_debug("%s: ctrl %d qid %d nvme status %x error loc %d\n", 334 334 __func__, ctrl->cntlid, req->sq->qid, 335 335 status, req->error_loc); 336 - req->cqe->result.u64 = 0; 337 336 if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 && 338 337 req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) { 339 338 unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120; ··· 515 516 status = nvmet_copy_to_sgl(req, 0, d, al); 516 517 kfree(d); 517 518 done: 518 - req->cqe->result.u64 = 0; 519 - 520 519 if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2) 521 520 nvmet_auth_sq_free(req->sq); 522 521 else if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE1) {

-6

drivers/nvme/target/fabrics-cmd.c

··· 226 226 if (status) 227 227 goto out; 228 228 229 - /* zero out initial completion result, assign values as needed */ 230 - req->cqe->result.u32 = 0; 231 - 232 229 if (c->recfmt != 0) { 233 230 pr_warn("invalid connect version (%d).\n", 234 231 le16_to_cpu(c->recfmt)); ··· 301 304 status = nvmet_copy_from_sgl(req, 0, d, sizeof(*d)); 302 305 if (status) 303 306 goto out; 304 - 305 - /* zero out initial completion result, assign values as needed */ 306 - req->cqe->result.u32 = 0; 307 307 308 308 if (c->recfmt != 0) { 309 309 pr_warn("invalid connect version (%d).\n",

+3 -3

drivers/nvme/target/passthru.c

··· 226 226 req->cmd->common.opcode == nvme_admin_identify) { 227 227 switch (req->cmd->identify.cns) { 228 228 case NVME_ID_CNS_CTRL: 229 - nvmet_passthru_override_id_ctrl(req); 229 + status = nvmet_passthru_override_id_ctrl(req); 230 230 break; 231 231 case NVME_ID_CNS_NS: 232 - nvmet_passthru_override_id_ns(req); 232 + status = nvmet_passthru_override_id_ns(req); 233 233 break; 234 234 case NVME_ID_CNS_NS_DESC_LIST: 235 - nvmet_passthru_override_id_descs(req); 235 + status = nvmet_passthru_override_id_descs(req); 236 236 break; 237 237 } 238 238 } else if (status < 0)