Commit a4165ffc authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'block-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 

Pull block fixes from Jens Axboe:
 "NVMe pull request via Keith:

   - Admin queue use-after-free fix (Keith)

   - Target authentication fix (Alistar)

   - Multipath lockdeup fix (Shin'ichiro)

   - FC transport teardown fixes (Ewan)"

* tag 'block-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
  nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
  nvme-multipath: fix lockdep WARN due to partition scan work
  nvmet-auth: update sc_c in target host hash calculation
  nvme: fix admin request_queue lifetime
parents 317c4d8a 49c2d594

drivers/nvme/host/core.c

+2 −1
Original line number Diff line number Diff line
@@ -4901,7 +4901,6 @@ void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl) 
	 */

	nvme_stop_keep_alive(ctrl);

	blk_mq_destroy_queue(ctrl->admin_q);

	blk_put_queue(ctrl->admin_q);

	if (ctrl->ops->flags & NVME_F_FABRICS) {

		blk_mq_destroy_queue(ctrl->fabrics_q);

		blk_put_queue(ctrl->fabrics_q);
@@ -5045,6 +5044,8 @@ static void nvme_free_ctrl(struct device *dev) 
		container_of(dev, struct nvme_ctrl, ctrl_device);

	struct nvme_subsystem *subsys = ctrl->subsys;



	if (ctrl->admin_q)

		blk_put_queue(ctrl->admin_q);

	if (!subsys || ctrl->instance != subsys->instance)

		ida_free(&nvme_instance_ida, ctrl->instance);

	nvme_free_cels(ctrl);

drivers/nvme/host/fc.c

+8 −7
Original line number Diff line number Diff line
@@ -2355,17 +2355,11 @@ nvme_fc_ctrl_free(struct kref *ref) 
		container_of(ref, struct nvme_fc_ctrl, ref);

	unsigned long flags;



	if (ctrl->ctrl.tagset)

		nvme_remove_io_tag_set(&ctrl->ctrl);



	/* remove from rport list */

	spin_lock_irqsave(&ctrl->rport->lock, flags);

	list_del(&ctrl->ctrl_list);

	spin_unlock_irqrestore(&ctrl->rport->lock, flags);



	nvme_unquiesce_admin_queue(&ctrl->ctrl);

	nvme_remove_admin_tag_set(&ctrl->ctrl);



	kfree(ctrl->queues);



	put_device(ctrl->dev);
@@ -3259,13 +3253,20 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl) 
{

	struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);



	cancel_work_sync(&ctrl->ioerr_work);

	cancel_delayed_work_sync(&ctrl->connect_work);



	/*

	 * kill the association on the link side.  this will block

	 * waiting for io to terminate

	 */

	nvme_fc_delete_association(ctrl);

	cancel_work_sync(&ctrl->ioerr_work);



	if (ctrl->ctrl.tagset)

		nvme_remove_io_tag_set(&ctrl->ctrl);



	nvme_unquiesce_admin_queue(&ctrl->ctrl);

	nvme_remove_admin_tag_set(&ctrl->ctrl);

}



static void

drivers/nvme/host/multipath.c

+1 −1
Original line number Diff line number Diff line
@@ -793,7 +793,7 @@ static void nvme_mpath_set_live(struct nvme_ns *ns) 
			return;

		}

		nvme_add_ns_head_cdev(head);

		kblockd_schedule_work(&head->partition_scan_work);

		queue_work(nvme_wq, &head->partition_scan_work);

	}



	nvme_mpath_add_sysfs_link(ns->head);

drivers/nvme/target/auth.c

+2 −2
Original line number Diff line number Diff line
@@ -298,7 +298,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, 
	const char *hash_name;

	u8 *challenge = req->sq->dhchap_c1;

	struct nvme_dhchap_key *transformed_key;

	u8 buf[4], sc_c = ctrl->concat ? 1 : 0;

	u8 buf[4];

	int ret;



	hash_name = nvme_auth_hmac_name(ctrl->shash_id);
@@ -367,7 +367,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, 
	ret = crypto_shash_update(shash, buf, 2);

	if (ret)

		goto out;

	*buf = sc_c;

	*buf = req->sq->sc_c;

	ret = crypto_shash_update(shash, buf, 1);

	if (ret)

		goto out;

drivers/nvme/target/fabrics-cmd-auth.c

+1 −0
Original line number Diff line number Diff line
@@ -43,6 +43,7 @@ static u8 nvmet_auth_negotiate(struct nvmet_req *req, void *d) 
		 data->auth_protocol[0].dhchap.halen,

		 data->auth_protocol[0].dhchap.dhlen);

	req->sq->dhchap_tid = le16_to_cpu(data->t_id);

	req->sq->sc_c = data->sc_c;

	if (data->sc_c != NVME_AUTH_SECP_NOSC) {

		if (!IS_ENABLED(CONFIG_NVME_TARGET_TCP_TLS))

			return NVME_AUTH_DHCHAP_FAILURE_CONCAT_MISMATCH;