Merge tag 'block-6.16-20250704' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:

- NVMe fixes via Christoph:
- fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- fix memory leak of bio integrity in nvmet (Dmitry Bogdanov)
- refresh visible attrs after being checked (Eugen Hristev)
- fix suspicious RCU usage warning in the multipath code (Geliang Tang)
- correctly account for namespace head reference counter (Nilay Shroff)

- Fix for a regression introduced in ublk in this cycle, where it would
attempt to queue a canceled request.

- brd RCU sleeping fix, also introduced in this cycle. Bare bones fix,
should be improved upon for the next release.

* tag 'block-6.16-20250704' of git://git.kernel.dk/linux:
brd: fix sleeping function called from invalid context in brd_insert_page()
ublk: don't queue request if the associated uring_cmd is canceled
nvme-multipath: fix suspicious RCU usage warning
nvme-pci: refresh visible attrs after being checked
nvmet: fix memory leak of bio integrity
nvme: correctly account for namespace head reference counter
nvme: Fix incorrect cdw15 value in passthru error logging

Linus Torvalds 11 months ago 1880df2c 482deed9

+38 -13

6 changed files

expand all

drivers

block

brd.c

ublk_drv.c

nvme

host

core.c

multipath.c

pci.c

target

nvmet.h

+4 -2

drivers/block/brd.c

··· 64 64 65 65 rcu_read_unlock(); 66 66 page = alloc_page(gfp | __GFP_ZERO | __GFP_HIGHMEM); 67 - rcu_read_lock(); 68 - if (!page) 67 + if (!page) { 68 + rcu_read_lock(); 69 69 return ERR_PTR(-ENOMEM); 70 + } 70 71 71 72 xa_lock(&brd->brd_pages); 72 73 ret = __xa_cmpxchg(&brd->brd_pages, sector >> PAGE_SECTORS_SHIFT, NULL, 73 74 page, gfp); 75 + rcu_read_lock(); 74 76 if (ret) { 75 77 xa_unlock(&brd->brd_pages); 76 78 __free_page(page);

+6 -5

drivers/block/ublk_drv.c

··· 1442 1442 struct ublk_queue *this_q = req->mq_hctx->driver_data; 1443 1443 struct ublk_io *this_io = &this_q->ios[req->tag]; 1444 1444 1445 + if (ublk_prep_req(this_q, req, true) != BLK_STS_OK) { 1446 + rq_list_add_tail(&requeue_list, req); 1447 + continue; 1448 + } 1449 + 1445 1450 if (io && !ublk_belong_to_same_batch(io, this_io) && 1446 1451 !rq_list_empty(&submit_list)) 1447 1452 ublk_queue_cmd_list(io, &submit_list); 1448 1453 io = this_io; 1449 - 1450 - if (ublk_prep_req(this_q, req, true) == BLK_STS_OK) 1451 - rq_list_add_tail(&submit_list, req); 1452 - else 1453 - rq_list_add_tail(&requeue_list, req); 1454 + rq_list_add_tail(&submit_list, req); 1454 1455 } 1455 1456 1456 1457 if (!rq_list_empty(&submit_list))

+16 -2

drivers/nvme/host/core.c

··· 386 386 nr->cmd->common.cdw12, 387 387 nr->cmd->common.cdw13, 388 388 nr->cmd->common.cdw14, 389 - nr->cmd->common.cdw14); 389 + nr->cmd->common.cdw15); 390 390 } 391 391 392 392 enum nvme_disposition { ··· 4086 4086 struct nvme_ns *ns; 4087 4087 struct gendisk *disk; 4088 4088 int node = ctrl->numa_node; 4089 + bool last_path = false; 4089 4090 4090 4091 ns = kzalloc_node(sizeof(*ns), GFP_KERNEL, node); 4091 4092 if (!ns) ··· 4179 4178 out_unlink_ns: 4180 4179 mutex_lock(&ctrl->subsys->lock); 4181 4180 list_del_rcu(&ns->siblings); 4182 - if (list_empty(&ns->head->list)) 4181 + if (list_empty(&ns->head->list)) { 4183 4182 list_del_init(&ns->head->entry); 4183 + /* 4184 + * If multipath is not configured, we still create a namespace 4185 + * head (nshead), but head->disk is not initialized in that 4186 + * case. As a result, only a single reference to nshead is held 4187 + * (via kref_init()) when it is created. Therefore, ensure that 4188 + * we do not release the reference to nshead twice if head->disk 4189 + * is not present. 4190 + */ 4191 + if (ns->head->disk) 4192 + last_path = true; 4193 + } 4184 4194 mutex_unlock(&ctrl->subsys->lock); 4195 + if (last_path) 4196 + nvme_put_ns_head(ns->head); 4185 4197 nvme_put_ns_head(ns->head); 4186 4198 out_cleanup_disk: 4187 4199 put_disk(disk);

+6 -2

drivers/nvme/host/multipath.c

··· 690 690 nvme_cdev_del(&head->cdev, &head->cdev_device); 691 691 synchronize_srcu(&head->srcu); 692 692 del_gendisk(head->disk); 693 - nvme_put_ns_head(head); 694 693 } 694 + nvme_put_ns_head(head); 695 695 } 696 696 697 697 static void nvme_remove_head_work(struct work_struct *work) ··· 1200 1200 */ 1201 1201 srcu_idx = srcu_read_lock(&head->srcu); 1202 1202 1203 - list_for_each_entry_rcu(ns, &head->list, siblings) { 1203 + list_for_each_entry_srcu(ns, &head->list, siblings, 1204 + srcu_read_lock_held(&head->srcu)) { 1204 1205 /* 1205 1206 * Ensure that ns path disk node is already added otherwise we 1206 1207 * may get invalid kobj name for target ··· 1291 1290 void nvme_mpath_remove_disk(struct nvme_ns_head *head) 1292 1291 { 1293 1292 bool remove = false; 1293 + 1294 + if (!head->disk) 1295 + return; 1294 1296 1295 1297 mutex_lock(&head->subsys->lock); 1296 1298 /*

+4 -2

drivers/nvme/host/pci.c

··· 2101 2101 if ((dev->cmbsz & (NVME_CMBSZ_WDS | NVME_CMBSZ_RDS)) == 2102 2102 (NVME_CMBSZ_WDS | NVME_CMBSZ_RDS)) 2103 2103 pci_p2pmem_publish(pdev, true); 2104 - 2105 - nvme_update_attrs(dev); 2106 2104 } 2107 2105 2108 2106 static int nvme_set_host_mem(struct nvme_dev *dev, u32 bits) ··· 3008 3010 if (result < 0) 3009 3011 goto out; 3010 3012 3013 + nvme_update_attrs(dev); 3014 + 3011 3015 result = nvme_setup_io_queues(dev); 3012 3016 if (result) 3013 3017 goto out; ··· 3342 3342 result = nvme_setup_host_mem(dev); 3343 3343 if (result < 0) 3344 3344 goto out_disable; 3345 + 3346 + nvme_update_attrs(dev); 3345 3347 3346 3348 result = nvme_setup_io_queues(dev); 3347 3349 if (result)

drivers/nvme/target/nvmet.h

··· 867 867 { 868 868 if (bio != &req->b.inline_bio) 869 869 bio_put(bio); 870 + else 871 + bio_uninit(bio); 870 872 } 871 873 872 874 #ifdef CONFIG_NVME_TARGET_TCP_TLS

Configure Feed

Configure Feed