Commit 015c2246 authored by Jens Axboe's avatar Jens Axboe
Browse files

Merge tag 'nvme-6.19-2026-01-14' of git://git.infradead.org/nvme into block-6.19 

Pull NVMe fixes from Keith:

"- Device quirk to disable faulty temperature (Ilikara)
 - TCP target null pointer fix from bad host protocol usage (Shivam)
 - Add compatible apple controller (Janne)
 - FC tagset leak fix (Chaitanya)
 - TCP socket deadlock fix (Hannes)
 - Target name buffer overrun fix (Shin'ichiro)"

* tag 'nvme-6.19-2026-01-14' of git://git.infradead.org/nvme:
  nvme: fix PCIe subsystem reset controller state transition
  nvmet: do not copy beyond sybsysnqn string length
  nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  nvme-fc: release admin tagset if init fails
  nvme-apple: add "apple,t8103-nvme-ans2" as compatible
  nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
  nvme-pci: disable secondary temp for Wodposit WPBSNM8
parents 40b94ec7 0edb475a

drivers/nvme/host/apple.c

+1 −0
Original line number Diff line number Diff line
@@ -1704,6 +1704,7 @@ static const struct apple_nvme_hw apple_nvme_t8103_hw = { 


static const struct of_device_id apple_nvme_of_match[] = {

	{ .compatible = "apple,t8015-nvme-ans2", .data = &apple_nvme_t8015_hw },

	{ .compatible = "apple,t8103-nvme-ans2", .data = &apple_nvme_t8103_hw },

	{ .compatible = "apple,nvme-ans2", .data = &apple_nvme_t8103_hw },

	{},

};

drivers/nvme/host/fc.c

+2 −0
Original line number Diff line number Diff line
@@ -3587,6 +3587,8 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, 


	ctrl->ctrl.opts = NULL;



	if (ctrl->ctrl.admin_tagset)

		nvme_remove_admin_tag_set(&ctrl->ctrl);

	/* initiate nvme ctrl ref counting teardown */

	nvme_uninit_ctrl(&ctrl->ctrl);

drivers/nvme/host/pci.c

+6 −1
Original line number Diff line number Diff line
@@ -1532,7 +1532,10 @@ static int nvme_pci_subsystem_reset(struct nvme_ctrl *ctrl) 
	}



	writel(NVME_SUBSYS_RESET, dev->bar + NVME_REG_NSSR);

	nvme_change_ctrl_state(ctrl, NVME_CTRL_LIVE);



	if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_CONNECTING) ||

	    !nvme_change_ctrl_state(ctrl, NVME_CTRL_LIVE))

		goto unlock;



	/*

	 * Read controller status to flush the previous write and trigger a
@@ -3999,6 +4002,8 @@ static const struct pci_device_id nvme_id_table[] = { 
		.driver_data = NVME_QUIRK_NO_DEEPEST_PS, },

	{ PCI_DEVICE(0x1e49, 0x0041),   /* ZHITAI TiPro7000 NVMe SSD */

		.driver_data = NVME_QUIRK_NO_DEEPEST_PS, },

	{ PCI_DEVICE(0x1fa0, 0x2283),   /* Wodposit WPBSNM8-256GTP */

		.driver_data = NVME_QUIRK_NO_SECONDARY_TEMP_THRESH, },

	{ PCI_DEVICE(0x025e, 0xf1ac),   /* SOLIDIGM  P44 pro SSDPFKKW020X7  */

		.driver_data = NVME_QUIRK_NO_DEEPEST_PS, },

	{ PCI_DEVICE(0xc0a9, 0x540a),   /* Crucial P2 */

drivers/nvme/target/passthru.c

+1 −1
Original line number Diff line number Diff line
@@ -150,7 +150,7 @@ static u16 nvmet_passthru_override_id_ctrl(struct nvmet_req *req) 
	 * code path with duplicate ctrl subsysnqn. In order to prevent that we

	 * mask the passthru-ctrl subsysnqn with the target ctrl subsysnqn.

	 */

	memcpy(id->subnqn, ctrl->subsys->subsysnqn, sizeof(id->subnqn));

	strscpy(id->subnqn, ctrl->subsys->subsysnqn, sizeof(id->subnqn));



	/* use fabric id-ctrl values */

	id->ioccsz = cpu_to_le32((sizeof(struct nvme_command) +

drivers/nvme/target/tcp.c

+16 −5
Original line number Diff line number Diff line
@@ -982,6 +982,18 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) 
		pr_err("H2CData PDU len %u is invalid\n", cmd->pdu_len);

		goto err_proto;

	}

       /*

	* Ensure command data structures are initialized. We must check both

	* cmd->req.sg and cmd->iov because they can have different NULL states:

	* - Uninitialized commands: both NULL

	* - READ commands: cmd->req.sg allocated, cmd->iov NULL

	* - WRITE commands: both allocated

	*/

	if (unlikely(!cmd->req.sg || !cmd->iov)) {

		pr_err("queue %d: H2CData PDU received for invalid command state (ttag %u)\n",

			queue->idx, data->ttag);

		goto err_proto;

	}

	cmd->pdu_recv = 0;

	nvmet_tcp_build_pdu_iovec(cmd);

	queue->cmd = cmd;
@@ -1992,14 +2004,13 @@ static void nvmet_tcp_listen_data_ready(struct sock *sk) 


	trace_sk_data_ready(sk);



	if (sk->sk_state != TCP_LISTEN)

		return;



	read_lock_bh(&sk->sk_callback_lock);

	port = sk->sk_user_data;

	if (!port)

		goto out;



	if (sk->sk_state == TCP_LISTEN)

	if (port)

		queue_work(nvmet_wq, &port->accept_work);

out:

	read_unlock_bh(&sk->sk_callback_lock);

}