[GIT PULL] nvme fixes for 6.19, final

[GIT PULL] nvme fixes for 6.19, final

[Keith Busch]

Hi Jens,

Some late fixes for nvme that should go in this release. One for a pci
regression that causes a kernel panic during certain dma conditions. The
other fixes a vulnerability in the tcp target.

The following changes since commit 4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f:

  bcache: fix I/O accounting leak in detached_dev_do_request (2026-01-28 19:06:55 -0700)

are available in the Git repository at:

  git://git.infradead.org/nvme.git tags/nvme-6.19-2026-02-05

for you to fetch changes up to 52a0a98549344ca20ad81a4176d68d28e3c05a5c:

  nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (2026-02-05 07:29:10 -0800)

----------------------------------------------------------------
nvme fixes for Linux 6.19

 - Fix NULL pointer access setting up dma mappings (Keith)
 - Fix invalid memory access from malformed TCP PDU (YunJe)

----------------------------------------------------------------
Keith Busch (1):
      nvme-pci: handle changing device dma map requirements

YunJe Shin (1):
      nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

 drivers/nvme/host/pci.c   | 45 ++++++++++++++++++++++++++++++---------------
 drivers/nvme/target/tcp.c | 17 +++++++++++++++++
 2 files changed, 47 insertions(+), 15 deletions(-)

Re: [GIT PULL] nvme fixes for 6.19, final

[Jens Axboe]

On 2/5/26 8:38 AM, Keith Busch wrote:
> Hi Jens,
> 
> Some late fixes for nvme that should go in this release. One for a pci
> regression that causes a kernel panic during certain dma conditions. The
> other fixes a vulnerability in the tcp target.
> 
> The following changes since commit 4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f:
> 
>   bcache: fix I/O accounting leak in detached_dev_do_request (2026-01-28 19:06:55 -0700)
> 
> are available in the Git repository at:
> 
>   git://git.infradead.org/nvme.git tags/nvme-6.19-2026-02-05
> 
> for you to fetch changes up to 52a0a98549344ca20ad81a4176d68d28e3c05a5c:
> 
>   nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (2026-02-05 07:29:10 -0800)
> 
> ----------------------------------------------------------------
> nvme fixes for Linux 6.19
> 
>  - Fix NULL pointer access setting up dma mappings (Keith)
>  - Fix invalid memory access from malformed TCP PDU (YunJe)
> 
> ----------------------------------------------------------------
> Keith Busch (1):
>       nvme-pci: handle changing device dma map requirements

After this one, iod in nvme_pci_prp_iter_next() is now unused, which
will trigger a compiler warning...

-- 
Jens Axboe

Re: [GIT PULL] nvme fixes for 6.19, final

[Christoph Hellwig]

On Thu, Feb 05, 2026 at 08:47:48AM -0700, Jens Axboe wrote:
> After this one, iod in nvme_pci_prp_iter_next() is now unused, which
> will trigger a compiler warning...

Must be compiler dependent, because it does not for me.  But yeah,
it should go away.

Re: [GIT PULL] nvme fixes for 6.19, final

[Jens Axboe]

On 2/5/26 8:49 AM, Christoph Hellwig wrote:
> On Thu, Feb 05, 2026 at 08:47:48AM -0700, Jens Axboe wrote:
>> After this one, iod in nvme_pci_prp_iter_next() is now unused, which
>> will trigger a compiler warning...
> 
> Must be compiler dependent, because it does not for me.  But yeah,
> it should go away.

Probably gcc vs clang, gcc often lets these slip by.

-- 
Jens Axboe

Re: [GIT PULL] nvme fixes for 6.19, final

[Jens Axboe]

On 2/5/26 8:47 AM, Jens Axboe wrote:
> On 2/5/26 8:38 AM, Keith Busch wrote:
>> Hi Jens,
>>
>> Some late fixes for nvme that should go in this release. One for a pci
>> regression that causes a kernel panic during certain dma conditions. The
>> other fixes a vulnerability in the tcp target.
>>
>> The following changes since commit 4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f:
>>
>>   bcache: fix I/O accounting leak in detached_dev_do_request (2026-01-28 19:06:55 -0700)
>>
>> are available in the Git repository at:
>>
>>   git://git.infradead.org/nvme.git tags/nvme-6.19-2026-02-05
>>
>> for you to fetch changes up to 52a0a98549344ca20ad81a4176d68d28e3c05a5c:
>>
>>   nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (2026-02-05 07:29:10 -0800)
>>
>> ----------------------------------------------------------------
>> nvme fixes for Linux 6.19
>>
>>  - Fix NULL pointer access setting up dma mappings (Keith)
>>  - Fix invalid memory access from malformed TCP PDU (YunJe)
>>
>> ----------------------------------------------------------------
>> Keith Busch (1):
>>       nvme-pci: handle changing device dma map requirements
> 
> After this one, iod in nvme_pci_prp_iter_next() is now unused, which
> will trigger a compiler warning...

Actually this is only true in the 7.0 based branches. Should be fine
for 6.19, I'll add a commit for the 7.0 merge.

-- 
Jens Axboe

Re: [GIT PULL] nvme fixes for 6.19, final

[Keith Busch]

On Thu, Feb 05, 2026 at 08:49:35AM -0700, Jens Axboe wrote:
> On 2/5/26 8:47 AM, Jens Axboe wrote:
> > On 2/5/26 8:38 AM, Keith Busch wrote:
> >> Hi Jens,
> >>
> >> Some late fixes for nvme that should go in this release. One for a pci
> >> regression that causes a kernel panic during certain dma conditions. The
> >> other fixes a vulnerability in the tcp target.
> >>
> >> The following changes since commit 4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f:
> >>
> >>   bcache: fix I/O accounting leak in detached_dev_do_request (2026-01-28 19:06:55 -0700)
> >>
> >> are available in the Git repository at:
> >>
> >>   git://git.infradead.org/nvme.git tags/nvme-6.19-2026-02-05
> >>
> >> for you to fetch changes up to 52a0a98549344ca20ad81a4176d68d28e3c05a5c:
> >>
> >>   nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (2026-02-05 07:29:10 -0800)
> >>
> >> ----------------------------------------------------------------
> >> nvme fixes for Linux 6.19
> >>
> >>  - Fix NULL pointer access setting up dma mappings (Keith)
> >>  - Fix invalid memory access from malformed TCP PDU (YunJe)
> >>
> >> ----------------------------------------------------------------
> >> Keith Busch (1):
> >>       nvme-pci: handle changing device dma map requirements
> > 
> > After this one, iod in nvme_pci_prp_iter_next() is now unused, which
> > will trigger a compiler warning...
> 
> Actually this is only true in the 7.0 based branches. Should be fine
> for 6.19, I'll add a commit for the 7.0 merge.

Yeah, I initially applied this to 7.0 with it removed, but we decided
this was a nasty and easy to hit bug that 6.19 is better of having fixed
on release. I had to leave the 'iod' in for the 6.19 port, so looks like
we'll have a merge conflict for the next cycle.

Re: [GIT PULL] nvme fixes for 6.19, final

[Jens Axboe]

On 2/5/26 8:54 AM, Keith Busch wrote:
> On Thu, Feb 05, 2026 at 08:49:35AM -0700, Jens Axboe wrote:
>> On 2/5/26 8:47 AM, Jens Axboe wrote:
>>> On 2/5/26 8:38 AM, Keith Busch wrote:
>>>> Hi Jens,
>>>>
>>>> Some late fixes for nvme that should go in this release. One for a pci
>>>> regression that causes a kernel panic during certain dma conditions. The
>>>> other fixes a vulnerability in the tcp target.
>>>>
>>>> The following changes since commit 4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f:
>>>>
>>>>   bcache: fix I/O accounting leak in detached_dev_do_request (2026-01-28 19:06:55 -0700)
>>>>
>>>> are available in the Git repository at:
>>>>
>>>>   git://git.infradead.org/nvme.git tags/nvme-6.19-2026-02-05
>>>>
>>>> for you to fetch changes up to 52a0a98549344ca20ad81a4176d68d28e3c05a5c:
>>>>
>>>>   nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (2026-02-05 07:29:10 -0800)
>>>>
>>>> ----------------------------------------------------------------
>>>> nvme fixes for Linux 6.19
>>>>
>>>>  - Fix NULL pointer access setting up dma mappings (Keith)
>>>>  - Fix invalid memory access from malformed TCP PDU (YunJe)
>>>>
>>>> ----------------------------------------------------------------
>>>> Keith Busch (1):
>>>>       nvme-pci: handle changing device dma map requirements
>>>
>>> After this one, iod in nvme_pci_prp_iter_next() is now unused, which
>>> will trigger a compiler warning...
>>
>> Actually this is only true in the 7.0 based branches. Should be fine
>> for 6.19, I'll add a commit for the 7.0 merge.
> 
> Yeah, I initially applied this to 7.0 with it removed, but we decided
> this was a nasty and easy to hit bug that 6.19 is better of having fixed
> on release. I had to leave the 'iod' in for the 6.19 port, so looks like
> we'll have a merge conflict for the next cycle.

It actually merges cleanly, but you then end up with that leftover
iod. If it hadn't merged cleanly, I would've seen it before building
it :-)

-- 
Jens Axboe