Commit 4141f46d authored by Jens Axboe's avatar Jens Axboe
Browse files

Merge tag 'nvme-7.1-2026-05-14' of git://git.infradead.org/nvme into block-7.1 

Pull NVMe fixes from Keith:

"- Fix memory leak on a passthrough integrity mapping failure (Keith)
 - Hide secrets behind debug option (Hannes)
 - Fix pci use-after-free for host memory buffer (Chia-Lin Kao)
 - Fix tcp taregt use-after-free for data digest  (Sagi)
 - Revert a mistaken quirk (Alan Cui)
 - Fix uevent and controller state race condition (Maurizio)
 - Fix apple submission queue re-initialization (Nick Chan)"

* tag 'nvme-7.1-2026-05-14' of git://git.infradead.org/nvme:
  nvme-apple: Reset q->sq_tail during queue init
  nvme: fix race condition between connected uevent and STARTED_ONCE flag
  Revert "nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808"
  nvmet-tcp: Fix potential UAF when ddgst mismatch
  nvme-pci: fix use-after-free in nvme_free_host_mem()
  nvmet-auth: Do not print DH-HMAC-CHAP secrets
  nvme: fix bio leak on mapping failure
  nvme: make prp passthrough usage less scary
parents e7b8b3c5 a6ab7563

drivers/nvme/host/apple.c

+1 −0
Original line number Diff line number Diff line
@@ -1009,6 +1009,7 @@ static void apple_nvme_init_queue(struct apple_nvme_queue *q) 
	unsigned int depth = apple_nvme_queue_depth(q);

	struct apple_nvme *anv = queue_to_apple_nvme(q);



	q->sq_tail = 0;

	q->cq_head = 0;

	q->cq_phase = 1;

	if (anv->hw->has_lsq_nvmmu)

drivers/nvme/host/core.c

+5 −1
Original line number Diff line number Diff line
@@ -3749,6 +3749,10 @@ int nvme_init_ctrl_finish(struct nvme_ctrl *ctrl, bool was_suspended) 
		ret = nvme_hwmon_init(ctrl);

		if (ret == -EINTR)

			return ret;



		if (!nvme_ctrl_sgl_supported(ctrl))

			dev_info(ctrl->device,

				"passthrough uses implicit buffer lengths\n");

	}



	clear_bit(NVME_CTRL_DIRTY_CAPABILITY, &ctrl->flags);
@@ -5041,8 +5045,8 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl) 
		nvme_mpath_update(ctrl);

	}



	nvme_change_uevent(ctrl, "NVME_EVENT=connected");

	set_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags);

	nvme_change_uevent(ctrl, "NVME_EVENT=connected");

}

EXPORT_SYMBOL_GPL(nvme_start_ctrl);

drivers/nvme/host/ioctl.c

+4 −14
Original line number Diff line number Diff line
@@ -120,22 +120,12 @@ static int nvme_map_user_request(struct request *req, u64 ubuffer, 
	struct nvme_ns *ns = q->queuedata;

	struct block_device *bdev = ns ? ns->disk->part0 : NULL;

	bool supports_metadata = bdev && blk_get_integrity(bdev->bd_disk);

	struct nvme_ctrl *ctrl = nvme_req(req)->ctrl;

	bool has_metadata = meta_buffer && meta_len;

	struct bio *bio = NULL;

	int ret;



	if (!nvme_ctrl_sgl_supported(ctrl))

		dev_warn_once(ctrl->device, "using unchecked data buffer\n");

	if (has_metadata) {

		if (!supports_metadata)

	if (has_metadata && !supports_metadata)

		return -EINVAL;



		if (!nvme_ctrl_meta_sgl_supported(ctrl))

			dev_warn_once(ctrl->device,

				      "using unchecked metadata buffer\n");

	}



	if (iter)

		ret = blk_rq_map_user_iov(q, req, NULL, iter, GFP_KERNEL);

	else
@@ -154,8 +144,8 @@ static int nvme_map_user_request(struct request *req, u64 ubuffer, 
	return ret;



out_unmap:

	if (bio)

		blk_rq_unmap_user(bio);

	if (req->bio)

		blk_rq_unmap_user(req->bio);

	return ret;

}

drivers/nvme/host/pci.c

+4 −4
Original line number Diff line number Diff line
@@ -2533,11 +2533,13 @@ static void nvme_free_host_mem_multi(struct nvme_dev *dev) 


static void nvme_free_host_mem(struct nvme_dev *dev)

{

	if (dev->hmb_sgt)

	if (dev->hmb_sgt) {

		dma_free_noncontiguous(dev->dev, dev->host_mem_size,

				dev->hmb_sgt, DMA_BIDIRECTIONAL);

	else

		dev->hmb_sgt = NULL;

	} else {

		nvme_free_host_mem_multi(dev);

	}



	dma_free_coherent(dev->dev, dev->host_mem_descs_size,

			dev->host_mem_descs, dev->host_mem_descs_dma);
@@ -4107,8 +4109,6 @@ static const struct pci_device_id nvme_id_table[] = { 
		.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },

	{ PCI_DEVICE(0x1c5f, 0x0555),	/* Memblaze Pblaze5 adapter */

		.driver_data = NVME_QUIRK_NO_NS_DESC_LIST, },

	{ PCI_DEVICE(0x144d, 0xa808),	/* Samsung PM981/983 */

		.driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },

	{ PCI_DEVICE(0x144d, 0xa821),   /* Samsung PM1725 */

		.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },

	{ PCI_DEVICE(0x144d, 0xa822),   /* Samsung PM1725a */

drivers/nvme/target/Kconfig

+9 −0
Original line number Diff line number Diff line
@@ -117,6 +117,15 @@ config NVME_TARGET_AUTH 


	  If unsure, say N.



config NVME_TARGET_AUTH_DEBUG

	bool "NVMe over Fabrics In-band Authentication debug messages"

	depends on NVME_TARGET_AUTH

	help

	  This enables additional debug messages including the generated

	  DH-HMAC-CHAP secrets to help debugging authentication failures.



	  If unsure, say N.



config NVME_TARGET_PCI_EPF

	tristate "NVMe PCI Endpoint Function target support"

	depends on NVME_TARGET && PCI_ENDPOINT