Commit 45614d8c authored Jan 28, 2026 by Jens Axboe

Merge tag 'nvme-6.19-2026-01-28' of git://git.infradead.org/nvme into block-6.19

Pull NVMe fixes from Keith:

"- TCP target completion race condition fix (Ming)
 - DMA descriptor cleanup fix (Roger)"

* tag 'nvme-6.19-2026-01-28' of git://git.infradead.org/nvme:
  nvme-pci: DMA unmap the correct regions in nvme_free_sgls
  nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference

parents c87f15ef a54afbc8

drivers/nvme/host/pci.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -806,8 +806,8 @@ static void nvme_unmap_data(struct request *req)
		if (!blk_rq_dma_unmap(req, dma_dev, &iod->dma_state, iod->total_len,
		map)) {
		if (nvme_pci_cmd_use_sgl(&iod->cmd))
		nvme_free_sgls(req, iod->descriptors[0],
		&iod->cmd.common.dptr.sgl, attrs);
		nvme_free_sgls(req, &iod->cmd.common.dptr.sgl,
		iod->descriptors[0], attrs);
		else
		nvme_free_prps(req, attrs);
		}

drivers/nvme/target/io-cmd-bdev.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -180,9 +180,10 @@ u16 blk_to_nvme_status(struct nvmet_req *req, blk_status_t blk_sts)
		static void nvmet_bio_done(struct bio *bio)
		{
		struct nvmet_req *req = bio->bi_private;
		blk_status_t blk_status = bio->bi_status;

		nvmet_req_complete(req, blk_to_nvme_status(req, bio->bi_status));
		nvmet_req_bio_put(req, bio);
		nvmet_req_complete(req, blk_to_nvme_status(req, blk_status));
		}

		#ifdef CONFIG_BLK_DEV_INTEGRITY