Commit ff885625 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'block-6.15-20250411' of git://git.kernel.dk/linux 

Pull more block fixes from Jens Axboe:
 "Apparently my internal clock was off, or perhaps it was just wishful
  thinking, but I sent out block fixes yesterday as my brain assumed it
  was Friday. Subsequently, that missed the NVMe fixes that should go
  into this weeks release as well. Hence, here's a followup with those,
  and another simple fix.

   - NVMe pull request via Christoph:
       - nvmet fc/fcloop refcounting fixes (Daniel Wagner)
       - fix missed namespace/ANA scans (Hannes Reinecke)
       - fix a use after free in the new TCP netns support (Kuniyuki
         Iwashima)
       - fix a NULL instead of false review in multipath (Uday Shankar)

   - Use strscpy() for null_blk disk name copy"

* tag 'block-6.15-20250411' of git://git.kernel.dk/linux:
  null_blk: Use strscpy() instead of strscpy_pad() in null_add_dev()
  nvmet-fc: put ref when assoc->del_work is already scheduled
  nvmet-fc: take tgtport reference only once
  nvmet-fc: update tgtport ref per assoc
  nvmet-fc: inline nvmet_fc_free_hostport
  nvmet-fc: inline nvmet_fc_delete_assoc
  nvmet-fcloop: add ref counting to lport
  nvmet-fcloop: replace kref with refcount
  nvmet-fcloop: swap list_add_tail arguments
  nvme-tcp: fix use-after-free of netns by kernel TCP socket.
  nvme: multipath: fix return value of nvme_available_path
  nvme: re-read ANA log page after ns scan completes
  nvme: requeue namespace scan on missed AENs
parents 023e62ce 3b607b75

drivers/block/null_blk/main.c

+1 −1
Original line number Diff line number Diff line
@@ -2031,7 +2031,7 @@ static int null_add_dev(struct nullb_device *dev) 
	nullb->disk->minors = 1;

	nullb->disk->fops = &null_ops;

	nullb->disk->private_data = nullb;

	strscpy_pad(nullb->disk->disk_name, nullb->disk_name, DISK_NAME_LEN);

	strscpy(nullb->disk->disk_name, nullb->disk_name);



	if (nullb->dev->zoned) {

		rv = null_register_zoned_dev(nullb);

drivers/nvme/host/core.c

+9 −0
Original line number Diff line number Diff line
@@ -4295,6 +4295,15 @@ static void nvme_scan_work(struct work_struct *work) 
			nvme_scan_ns_sequential(ctrl);

	}

	mutex_unlock(&ctrl->scan_lock);



	/* Requeue if we have missed AENs */

	if (test_bit(NVME_AER_NOTICE_NS_CHANGED, &ctrl->events))

		nvme_queue_scan(ctrl);

#ifdef CONFIG_NVME_MULTIPATH

	else

		/* Re-read the ANA log page to not miss updates */

		queue_work(nvme_wq, &ctrl->ana_work);

#endif

}



/*

drivers/nvme/host/multipath.c

+1 −1
Original line number Diff line number Diff line
@@ -427,7 +427,7 @@ static bool nvme_available_path(struct nvme_ns_head *head) 
	struct nvme_ns *ns;



	if (!test_bit(NVME_NSHEAD_DISK_LIVE, &head->flags))

		return NULL;

		return false;



	list_for_each_entry_srcu(ns, &head->list, siblings,

				 srcu_read_lock_held(&head->srcu)) {

drivers/nvme/host/tcp.c

+2 −0
Original line number Diff line number Diff line
@@ -1803,6 +1803,8 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, int qid, 
		ret = PTR_ERR(sock_file);

		goto err_destroy_mutex;

	}



	sk_net_refcnt_upgrade(queue->sock->sk);

	nvme_tcp_reclassify_socket(queue->sock);



	/* Single syn retry */

drivers/nvme/target/fc.c

+20 −40
Original line number Diff line number Diff line
@@ -995,16 +995,6 @@ nvmet_fc_hostport_get(struct nvmet_fc_hostport *hostport) 
	return kref_get_unless_zero(&hostport->ref);

}



static void

nvmet_fc_free_hostport(struct nvmet_fc_hostport *hostport)

{

	/* if LLDD not implemented, leave as NULL */

	if (!hostport || !hostport->hosthandle)

		return;



	nvmet_fc_hostport_put(hostport);

}



static struct nvmet_fc_hostport *

nvmet_fc_match_hostport(struct nvmet_fc_tgtport *tgtport, void *hosthandle)

{
@@ -1028,33 +1018,24 @@ nvmet_fc_alloc_hostport(struct nvmet_fc_tgtport *tgtport, void *hosthandle) 
	struct nvmet_fc_hostport *newhost, *match = NULL;

	unsigned long flags;



	/*

	 * Caller holds a reference on tgtport.

	 */



	/* if LLDD not implemented, leave as NULL */

	if (!hosthandle)

		return NULL;



	/*

	 * take reference for what will be the newly allocated hostport if

	 * we end up using a new allocation

	 */

	if (!nvmet_fc_tgtport_get(tgtport))

		return ERR_PTR(-EINVAL);



	spin_lock_irqsave(&tgtport->lock, flags);

	match = nvmet_fc_match_hostport(tgtport, hosthandle);

	spin_unlock_irqrestore(&tgtport->lock, flags);



	if (match) {

		/* no new allocation - release reference */

		nvmet_fc_tgtport_put(tgtport);

	if (match)

		return match;

	}



	newhost = kzalloc(sizeof(*newhost), GFP_KERNEL);

	if (!newhost) {

		/* no new allocation - release reference */

		nvmet_fc_tgtport_put(tgtport);

	if (!newhost)

		return ERR_PTR(-ENOMEM);

	}



	spin_lock_irqsave(&tgtport->lock, flags);

	match = nvmet_fc_match_hostport(tgtport, hosthandle);
@@ -1063,6 +1044,7 @@ nvmet_fc_alloc_hostport(struct nvmet_fc_tgtport *tgtport, void *hosthandle) 
		kfree(newhost);

		newhost = match;

	} else {

		nvmet_fc_tgtport_get(tgtport);

		newhost->tgtport = tgtport;

		newhost->hosthandle = hosthandle;

		INIT_LIST_HEAD(&newhost->host_list);
@@ -1075,13 +1057,6 @@ nvmet_fc_alloc_hostport(struct nvmet_fc_tgtport *tgtport, void *hosthandle) 
	return newhost;

}



static void

nvmet_fc_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)

{

	nvmet_fc_delete_target_assoc(assoc);

	nvmet_fc_tgt_a_put(assoc);

}



static void

nvmet_fc_delete_assoc_work(struct work_struct *work)

{
@@ -1089,7 +1064,8 @@ nvmet_fc_delete_assoc_work(struct work_struct *work) 
		container_of(work, struct nvmet_fc_tgt_assoc, del_work);

	struct nvmet_fc_tgtport *tgtport = assoc->tgtport;



	nvmet_fc_delete_assoc(assoc);

	nvmet_fc_delete_target_assoc(assoc);

	nvmet_fc_tgt_a_put(assoc);

	nvmet_fc_tgtport_put(tgtport);

}
@@ -1097,7 +1073,8 @@ static void 
nvmet_fc_schedule_delete_assoc(struct nvmet_fc_tgt_assoc *assoc)

{

	nvmet_fc_tgtport_get(assoc->tgtport);

	queue_work(nvmet_wq, &assoc->del_work);

	if (!queue_work(nvmet_wq, &assoc->del_work))

		nvmet_fc_tgtport_put(assoc->tgtport);

}



static bool
@@ -1143,6 +1120,7 @@ nvmet_fc_alloc_target_assoc(struct nvmet_fc_tgtport *tgtport, void *hosthandle) 
		goto out_ida;



	assoc->tgtport = tgtport;

	nvmet_fc_tgtport_get(tgtport);

	assoc->a_id = idx;

	INIT_LIST_HEAD(&assoc->a_list);

	kref_init(&assoc->ref);
@@ -1190,7 +1168,7 @@ nvmet_fc_target_assoc_free(struct kref *ref) 
	/* Send Disconnect now that all i/o has completed */

	nvmet_fc_xmt_disconnect_assoc(assoc);



	nvmet_fc_free_hostport(assoc->hostport);

	nvmet_fc_hostport_put(assoc->hostport);

	spin_lock_irqsave(&tgtport->lock, flags);

	oldls = assoc->rcv_disconn;

	spin_unlock_irqrestore(&tgtport->lock, flags);
@@ -1244,6 +1222,8 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc) 
	dev_info(tgtport->dev,

		"{%d:%d} Association deleted\n",

		tgtport->fc_target_port.port_num, assoc->a_id);



	nvmet_fc_tgtport_put(tgtport);

}



static struct nvmet_fc_tgt_assoc *
@@ -1455,11 +1435,6 @@ nvmet_fc_free_tgtport(struct kref *ref) 
	struct nvmet_fc_tgtport *tgtport =

		container_of(ref, struct nvmet_fc_tgtport, ref);

	struct device *dev = tgtport->dev;

	unsigned long flags;



	spin_lock_irqsave(&nvmet_fc_tgtlock, flags);

	list_del(&tgtport->tgt_list);

	spin_unlock_irqrestore(&nvmet_fc_tgtlock, flags);



	nvmet_fc_free_ls_iodlist(tgtport);
@@ -1620,6 +1595,11 @@ int 
nvmet_fc_unregister_targetport(struct nvmet_fc_target_port *target_port)

{

	struct nvmet_fc_tgtport *tgtport = targetport_to_tgtport(target_port);

	unsigned long flags;



	spin_lock_irqsave(&nvmet_fc_tgtlock, flags);

	list_del(&tgtport->tgt_list);

	spin_unlock_irqrestore(&nvmet_fc_tgtlock, flags);



	nvmet_fc_portentry_unbind_tgt(tgtport);