Linux block layer
 help / color / mirror / Atom feed
* [GIT PULL] block fixes for 7.4-rc1
@ 2026-10-30 13:50 Jens Axboe
  2026-10-30 18:00 ` pr-tracker-bot
  2026-10-31 15:28 ` [PATCH] rust: bindings: derive Zeroable for bindgen's opaque array wrappers Sasha Levin
  0 siblings, 2 replies; 8+ messages in thread
From: Jens Axboe @ 2026-10-30 13:50 UTC (permalink / raw)
  To: Linus Torvalds; +Cc: linux-block@vger.kernel.org

Hi Linus,

Bigger than usual for an end-of-merge-window pull request, main reason
being that the MD side I had missed a pull on, and both NVMe and block
got a good pile of LLM driven fixes where some of them may as well just
go in now rather than wait a full cycle. This pull request contains:

- NVMe fixes via Keith:
  - nvme-tcp fallout from the parallel queue allocation: initialize
    pf_cache_lock and the header digest before requests are set up,
    and don't dereference a NULL queue->ctrl on reconnect
  - nvme-fabrics queue mapping fixes: reset io_queues on reconnect,
    limit each queue type to the online CPUs, and clear a poll map
    with no poll queues
  - nvme-tcp io_work priority inversion with send_mutex held (Seiji),
    error recovery on read_sock failure and skipping TLS control
    records while waiting for the ICResp (Martin B), TLS handshake
    timeout validation, and an address attribute race
  - nvme-rdma NULL metadata_sgl dereference with T10-PI
  - nvme-pci early boot hang with the quirks parameter
  - nvme-multipath ANA log bounds underflow, and an nvme-fc discovery
    reference leak
  - nvmet hardening: rdma inline SGL out-of-bounds write and short
    connect requests, fc use-after-free in LS create connection and
    teardown on admin queue failure, pci-epf transport error reporting
    and SGL length checks, zns NUMD wrap, fc stale read data, auth
    state and status fixes, ports list and qid_max locking, rdma
    double puts and irq-safe locking, and a double free on metadata
    SGL allocation failure
  - nvmet fixes from Josef: big discard length truncation, NULL derefs
    for PCI endpoint targets and debugfs host_traddr, stop listening
    when a tcp port is removed, and don't BUG() in nvme-loop when a
    scan runs beside a reset

- MD fixes via Yu Kuai:
  - raid5 validation: reject too few disks, invalid reshape disks, a
    per-device size below one chunk, and an inconsistent reshape state
    from the superblock instead of BUG(), plus journal payload size
    checks
  - raid5 error path and lifetime fixes: extra_page leak and NULL
    derefs in free_conf/setup_conf, draining released_stripes before
    destroying the cache, RCU for the big_stripe_tree lookup, and
    per-array io_unit slab names
  - md core: reject v0.90 arrays with too many devices, validate
    bblog_size, take reconfig_mutex when enabling PPL, fix the
    mddev->private NULL deref when stopping an array under IO, and
    don't hand out the array before mddev->kobj is added
  - raid10 missing barrier wakeup, raid0 device count validation, a
    bogus mddev_unlock() in lbs_store(), and shared helpers

- blk-mq fixes from Josef: don't trust the bio cookie in blk_mq_poll(),
  keep tag sharing fair after a queue update, don't bring back flags of
  a completed request from the timeout handler, honor a restarted
  timer, initialize the dma state for P2P, quiesce a queue joining a
  quiesced tag set, set up and exit hctxs under tag_list_lock, and free
  the tag bitmaps in the SRCU callback

- blk-cgroup and friends from Josef: keep the old blkg while
  reassociating a bio, free struct ioc after a grace period, don't
  truncate v1 iops limits, fix root io.stat on 32-bit, don't free a
  blkg with its punt work queued, flush iolatency enable_work after
  going offline, pass dead group I/O counts on and make reset_stats
  reset them, and don't enter reclaim under rq_qos_mutex

- Other core fixes from Josef: a disk use-after-free in sync_bdevs(),
  not losing the status of a failed flush request, 64-bit sector math
  for mac partitions, and applying the segment size to the integrity
  buffer

- blk-iocost: abort a weight transfer on invalid donation weights, and
  publish hweights as one atomic value

- Fix a NULL deref and use-after-free in __blk_crypto_evict_key(),
  reachable via dm-inlinecrypt

- Fix recursive i_rwsem locking in blkdev_write_iter(), from two fixes
  for the same race landing in the window

- Advance the iterator after copy-in for SG_DXFER_TO_FROM_DEV, fixing
  an infinite loop in blk_rq_map_user_iov()

- Check the open mode for LOOP_SET_STATUS in the compat ioctl

- rnbd-srv use-after-free and kobject fixes

- drbd timer and req_lock fixes

- zloop cleanups and error path fixes

- cdrom header and kernel-doc cleanups

Please pull!


The following changes since commit 330517c63aa9b48227b6ab45f01003effac77ae4:

  Merge tag 'char-misc-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc (2026-10-24 15:44:26 -1000)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux tags/block-7.4-20261029

for you to fetch changes up to c8c53d669d4e45b3a804013251a34387d7e11bfb:

  blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key() (2026-10-29 11:10:05 -0600)

----------------------------------------------------------------
block-7.4-20261029

----------------------------------------------------------------
Andrea Parri (4):
      nvmet-fc: only send read data for successful commands
      nvmet: zns: reject a NUMD whose byte count wraps
      nvmet: pci-epf: report transport errors in command completions
      nvmet: pci-epf: require SGLs to match the command data length

Andrew Stellman (1):
      nvmet-rdma: fix out-of-bounds write in nvmet_rdma_map_sgl_inline()

Avi Weiss (1):
      nvmet: prevent double-free after metadata SGL allocation failure

Baokun Li (1):
      blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()

Cao Guanghui (2):
      md/raid5: track disks array size to fix extra_page leak on error paths
      md/raid5: fix NULL pointer dereference in raid5_free_percpu

Chandradhar Kumar (1):
      md/raid0: validate device count before allocating devlist

Chen Cheng (3):
      md/raid5: reject raid4/5 arrays with too few disks
      md/raid5: extract min_raid_disks()
      md/raid5: reject invalid reshape disks in raid5_run()

Chris Mason (6):
      nvmet-rdma: flush nvmet-wq on module exit
      nvmet-rdma: disable interrupts under rsp_wr_wait_lock
      nvmet-rdma: fix double puts after a failed RDMA WRITE
      nvmet: don't clear sq->ctrl for a Connect with sqsize 0
      rnbd-srv: fix use-after-free on two CLOSE messages
      rnbd-srv: publish the sess_dev at the end of OPEN

Christian Aurich Zanettini Martins (3):
      nvme-rdma: fix NULL metadata_sgl dereference with T10-PI
      nvme-tcp: fix request PDU size when header digest is enabled
      nvme-tcp: fix NULL queue->ctrl dereference on reconnect

Christoph Hellwig (4):
      zloop: remove a duplicate call to zloop_get_block_size
      zloop: share more code for opening a zone backing file
      zloop: fput file after failed zone init
      zloop: check that the zone backing file support ->{read,write}_iter

Daniel Wagner (4):
      nvme-tcp: initialize pf_cache_lock when allocating the controller
      nvme-fabrics: reset io_queues before computing the queue mapping
      nvme-fabrics: limit each queue type to the number of online CPUs
      nvme-fabrics: clear the poll map if no poll queues are mapped

Dominik Maier (1):
      loop: check for read-write open mode on LOOP_SET_STATUS in lo_compat_ioctl()

Guixin Liu (4):
      nvmet-fc: Tear down the association when the admin queue allocation fails
      nvme-tcp: Validate the queue state under the queue lock in the address attribute
      nvmet: Finish the blk plug when integrity allocation fails
      nvmet: Free the old negotiation state when restarting authentication

Jack Wang (1):
      md: fix mddev_unlock() called without holding lock in lbs_store()

Jens Axboe (2):
      Merge tag 'md-7.4-20261013' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into block-7.4
      Merge tag 'nvme-7.4-2026-10-28' of git://git.infradead.org/nvme into block-7.4

Josef Bacik (33):
      nvmet: don't truncate the length of big discards
      nvmet-auth: take only AUTH_Negotiate for a negotiation
      nvmet: fix NULL dereference of PCI endpoint targets
      nvmet-tcp: stop listening when a port is removed
      nvmet: fix NULL dereference in debugfs host_traddr
      nvmet-tcp: don't read a removed port at Connect time
      nvme-loop: don't BUG() if a scan runs beside a reset
      blk-cgroup: keep the old blkg while reassociating a bio
      blk-iocost: free struct ioc after a grace period
      blk-throttle: don't truncate the cgroup v1 iops limits
      blk-cgroup: fix root io.stat byte counts on 32-bit
      blk-cgroup: don't free a blkg with its punt work queued
      blk-iolatency: flush enable_work after going offline
      blk-throttle: pass the I/O counts of a dead group on
      blk-throttle: make blkio.reset_stats reset I/O counts
      block: don't enter reclaim under rq_qos_mutex
      block: fix use-after-free of the disk in sync_bdevs()
      block: don't lose the status of a failed flush request
      blk-mq: don't trust the cookie in blk_mq_poll()
      blk-mq: keep sharing tags fairly after a queue update
      blk-mq: don't bring back flags of a completed request
      blk-mq: don't forget a timer the driver has restarted
      blk-mq-dma: initialize the dma state for P2P, too
      blk-mq: quiesce a queue that joins a quiesced tag set
      blk-mq: exit the hctxs of a queue under tag_list_lock
      blk-mq: set up a queue under tag_list_lock
      block: partitions/mac: compute the sectors in 64 bits
      blk-mq: free the bitmaps of tags in the SRCU callback
      block: apply the segment size to the integrity buffer
      drbd: stop the start_resync timer of a dying device
      drbd: take req_lock to skip the initial sync as peer
      block/rnbd-srv: don't free the device on a sysfs error
      block/rnbd-srv: drop the sess_dev kobject unlocked

J?r?my Jean (1):
      md: reject v0.90 arrays with too many devices

Kunhai Dai (2):
      blk-iocost: abort weight transfer on invalid donation weights
      blk-iocost: publish hweights as one atomic value

Li Youhong (4):
      md: add rdev_record_write_error() helper
      md/raid1-10: add rdev_bb_block_sectors() helper
      md/raid1-10: share flush_bio_list between raid1 and raid10
      md/raid5: drain released_stripes before destroying the cache

Martin Belanger (2):
      nvme-tcp: start error recovery when read_sock fails
      nvme-tcp: skip TLS control records while waiting for the ICResp

Martin George (3):
      nvme-auth: update error log in nvme_auth_submit()
      nvme-multipath: avoid size_t underflow in ANA log bounds checks
      nvme-fc: fix reference leak in nvme_fc_nvme_discovery_store()

Martin Wilck (1):
      md/raid5: validate payload size before calculating payload_len

Maurizio Lombardi (2):
      nvme-pci: fix early boot hang with nvme.quirks parameter
      nvme-pci: increase quirks_param buffer size to 256 bytes

Nguyen Ngoc Thang (1):
      md: take reconfig_mutex when enabling PPL on an inactive array

Peng Fan (1):
      md/raid: use assign_bit() where applicable

Qing Zhang (1):
      nvmet: protect nvmet_ports_list with nvmet_config_sem

Randy Dunlap (1):
      cdrom: drop linux/fs.h from cdrom.h

Rongzheng Wang (1):
      nvmet: use the enabled transport when disabling a port

Sang-Hoon Choi (1):
      md/raid5: protect big_stripe_tree lookup with RCU

Seiji Nishikawa (1):
      nvme-tcp: fix io_work priority inversion when send_mutex is held

Shao Mingyin (1):
      nvmet-auth: fix error handling on CHALLENGE failure

TJ Adams (1):
      block: advance iterator after copy-in for SG_DXFER_TO_FROM_DEV

Weiming Shi (1):
      nvmet-rdma: reject short connection requests

Yehyeong Lee (1):
      nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection()

Yingjie Wang (2):
      nvmet-tcp: validate the TLS handshake timeout
      nvme-tcp: validate the TLS handshake timeout

Yogesh Gaur (3):
      md/raid5: don't BUG() on an inconsistent reshape state from the superblock
      md/raid5: give the io_unit slab caches per-array names
      md: don't hand out the array before md_alloc() has added mddev->kobj

Yu Zhang (1):
      nvmet: take subsys->lock while force-reconnecting in nvmet_subsys_attr_qid_max_store()

Yuchao Zhang (1):
      md: validate bblog_size when loading v1.x badblocks metadata

Yuehong Wu (1):
      block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c

Zhenxian Ma (1):
      block: fix recursive i_rwsem locking in blkdev_write_iter()

Zhihao Cheng (2):
      md/raid5: setup_conf: Fix null-ptr-def in error handling path
      md: Fix the null-ptr-deref of 'mddev->private' while submitting IO

Zizhi Wo (3):
      md/raid10: annotate lockless access to array_freeze_pending
      md/raid10: fix missing wakeup in wait_barrier_nolock
      md/raid5: reject a per-device size smaller than one chunk

 .../admin-guide/kernel-parameters.txt         |  10 +
 block/bdev.c                                  |  10 +
 block/blk-cgroup.c                            |  39 ++-
 block/blk-cgroup.h                            |   6 +-
 block/blk-crypto-fallback.c                   |   6 +
 block/blk-flush.c                             |   8 +-
 block/blk-iocost.c                            | 119 +++++--
 block/blk-iolatency.c                         |   6 +-
 block/blk-map.c                               |   2 +-
 block/blk-mq-dma.c                            |   7 +-
 block/blk-mq-tag.c                            |   8 +-
 block/blk-mq.c                                |  78 ++++-
 block/blk-throttle.c                          |  28 +-
 block/blk-timeout.c                           |   3 +-
 block/blk.h                                   |  14 +
 block/fops.c                                  |   2 -
 block/partitions/mac.c                        |   4 +-
 drivers/block/drbd/drbd_main.c                |   1 +
 drivers/block/drbd/drbd_receiver.c            |   2 +
 drivers/block/loop.c                          |   6 +-
 drivers/block/rnbd/rnbd-srv-sysfs.c           |  28 +-
 drivers/block/rnbd/rnbd-srv.c                 |  36 +-
 drivers/block/zloop.c                         |  80 +++--
 drivers/md/md.c                               |  72 ++--
 drivers/md/md.h                               |   7 +
 drivers/md/raid0.c                            |  16 +-
 drivers/md/raid1-10.c                         |  27 ++
 drivers/md/raid1.c                            |  42 +--
 drivers/md/raid10.c                           |  59 +---
 drivers/md/raid5-cache.c                      |  54 ++-
 drivers/md/raid5-ppl.c                        |  12 +-
 drivers/md/raid5.c                            | 106 ++++--
 drivers/md/raid5.h                            |   1 +
 drivers/nvme/host/auth.c                      |   6 +-
 drivers/nvme/host/fabrics.c                   |  30 +-
 drivers/nvme/host/fc.c                        |   7 +-
 drivers/nvme/host/pci.c                       |   4 +-
 drivers/nvme/host/rdma.c                      |   2 +-
 drivers/nvme/host/tcp.c                       | 309 ++++++++++++++----
 drivers/nvme/target/auth.c                    |   1 +
 drivers/nvme/target/configfs.c                |  26 +-
 drivers/nvme/target/core.c                    |  16 +-
 drivers/nvme/target/fabrics-cmd-auth.c        |  11 +-
 drivers/nvme/target/fabrics-cmd.c             |   3 +-
 drivers/nvme/target/fc.c                      |  18 +-
 drivers/nvme/target/io-cmd-bdev.c             |   8 +-
 drivers/nvme/target/loop.c                    |   2 -
 drivers/nvme/target/nvmet.h                   |   3 +-
 drivers/nvme/target/pci-epf.c                 |  30 +-
 drivers/nvme/target/rdma.c                    |  31 +-
 drivers/nvme/target/tcp.c                     |  33 +-
 drivers/nvme/target/zns.c                     |  12 +-
 include/linux/blk-mq.h                        |   6 +
 include/linux/blkdev.h                        |   9 +-
 include/linux/cdrom.h                         |   1 -
 include/trace/events/iocost.h                 |   7 +-
 tools/cgroup/iocost_monitor.py                |   7 +-
 57 files changed, 1062 insertions(+), 419 deletions(-)

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-11-01 15:34 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-30 13:50 [GIT PULL] block fixes for 7.4-rc1 Jens Axboe
2026-10-30 18:00 ` pr-tracker-bot
2026-10-31 15:28 ` [PATCH] rust: bindings: derive Zeroable for bindgen's opaque array wrappers Sasha Levin
2026-10-31 16:17   ` Alice Ryhl
2026-10-31 16:29     ` Sasha Levin
2026-10-31 16:37       ` Alice Ryhl
2026-11-01  0:48   ` Alexandre Courbot
2026-11-01 15:34   ` Miguel Ojeda

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox