Re: [PATCHSET 0/98] Various block related fixes

[Bart Van Assche <bvanassche@acm.org>]

[-- Attachment #1: Type: text/plain, Size: 574 bytes --]

On 10/28/26 9:41 AM, Jens Axboe wrote:
> Got a giant pile of stuff dumped on me, and went through and did some
> vetting and, particularly, commit message rewriting to get it to a
> somewhat comprehensible shape. If you're CC'ed on a patch, please
> review it. Feel free to queue it up, or reply back why the particular
> patch is garbage, if it is garbage.

Hi Jens,

Reviewing 98 patches at once is too much for a human. So I asked an LLM
to take a look. That LLM identified 9 must fix issues and 15 minor
issues. Please take a look at the attached report.

Thanks,

Bart.

[-- Attachment #2: block_fixes_98_review.md --]
[-- Type: text/markdown, Size: 62962 bytes --]

# Review of `[PATCHSET 0/98] Various block related fixes`

- **Series**: https://lore.kernel.org/linux-block/20261028164415.1262013-1-axboe@kernel.dk/
- **Poster**: Jens Axboe `<axboe@kernel.dk>` (77 patches from Josef Bacik, 20 from Chris Mason, 1 from Andrea Parri)
- **Baseline Verified Against**: `origin/master` (`d135ab453a74`) — all 98/98 patches apply cleanly in sequence across 45 files; all `Fixes:` commit SHAs and titles resolve accurately in git history (with 1 minor root-cause SHA note on Patch 06).

> [!IMPORTANT]
> **High-Level Assessment ("Valid Fixes vs. Garbage")**: **0 of the 98 patches target imaginary or unreachable bugs.** Every patch in this batch diagnoses a real upstream defect — including numerous remotely triggerable use-after-frees, out-of-bounds memory accesses, authentication/TLS bypasses, and lockups across `blk-mq`, `blk-cgroup`, `blk-zoned`, `rnbd-srv`, `nvme-tcp`, `nvmet-auth`, `nvmet-tcp`, `nvmet-rdma`, and `nvmet` persistent reservations.
>
> However, **9 patches have substantive bugs, regressions, or incomplete fixes** in their proposed implementation (most critically **Patches 28, 41, 48, 90, and 97**), and **15 patches have minor edge cases or cleanups** worth raising on `linux-block`.

## Verdict Breakdown

| Verdict | Count | Patches |
| :--- | ---: | :--- |
| **Needs Changes / Incomplete (`NEEDS WORK`)** | **9** | `18, 20, 22, 28, 41, 48, 76, 90, 97` |
| **Valid Fix w/ Minor Note (`MINOR`)** | **15** | `06, 10, 11, 17, 21, 23, 29, 39, 49, 53, 55, 61, 71, 78, 84` |
| **Clean & Ready (`LGTM`)** | **74** | All remaining 74 patches (see Section 5) |

---

## 1. Patches Requiring Changes (`NEEDS WORK`)

### 1.1 Patch 28/98 — `blk-iocost: check again that the disk is alive` (Buggy Unwind -> `request_queue` UAF)
- **Patch**: [28/98](https://lore.kernel.org/linux-block/20261028164415.1262013-29-axboe@kernel.dk/) (Josef Bacik) — [`ioc_qos_write()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/block/blk-iocost.c#L3293-L3448) in [blk-iocost.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/block/blk-iocost.c#L3317-L3442)
- **Root-Cause Diagnosis**: Valid. `ioc_qos_write()` drops `rq_qos_mutex` before `blk_mq_freeze_queue()`, allowing `del_gendisk()` + `blk_mq_free_tag_set()` to run in between so `disk->queue->tag_set` is freed before `blk_mq_quiesce_queue()`.
- **Bug in Patch**: When `!disk_live(disk)` is true (meaning `del_gendisk()` has run and the driver may already have called `put_disk()`), jumping to `close_bdev:` executes:
  ```c
  close_bdev:
  	q = ctx.bdev->bd_queue;
  	blkg_conf_close_bdev(&ctx);
  	blk_mq_unfreeze_queue(q, memflags);
  ```
  [`blkg_conf_close_bdev()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/block/blk-cgroup.c#L956-L963) unlocks `rq_qos_mutex` and calls `blkdev_put_no_open(ctx.bdev)`. When `ctx.bdev` holds the final reference to `bdev`/`disk`, `blkdev_put_no_open()` synchronously triggers `disk_release()` -> `blk_put_queue(q)`, **freeing `q` while it is still frozen**, and the very next line `blk_mq_unfreeze_queue(q, memflags)` **dereferences the freed `struct request_queue` (`q->mq_freeze_lock`, `q->q_usage_counter`, `q->io_lockdep_map`)**.
- **Suggested Fix**: Unlock `q->rq_qos_mutex` and call `blk_mq_unfreeze_queue(q, memflags)` *before* `blkdev_put_no_open(ctx.bdev)` so `ctx.bdev` pins `disk` and `q` across the unfreeze:
  ```c
  close_bdev:
  	q = ctx.bdev->bd_queue;
  	mutex_unlock(&q->rq_qos_mutex);
  	blk_mq_unfreeze_queue(q, memflags);
  	blkdev_put_no_open(ctx.bdev);
  	return ret ?: nbytes;
  ```

### 1.2 Patch 41/98 — `zram: check a bio's range against the device size` (NULL Deref on Empty Bio + 4 KiB Page Overrun / Infoleak)
- **Patch**: [41/98](https://lore.kernel.org/linux-block/20261028164415.1262013-42-axboe@kernel.dk/) (Chris Mason) — [`zram_submit_bio()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/zram/zram_drv.c#L2800-L2819) in [zram_drv.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/zram/zram_drv.c#L212-L223)
- **Root-Cause Diagnosis**: Valid. Commit `9fe95babc742 ("zram: remove valid_io_request")` relied on `bio_check_eod()`, which truncates `bi_size` to whole 512-byte sectors (`bio_sectors(bio)`), letting sub-sector bios or sub-sector tails step past `zram->table` (or dereference `zram->table == NULL` on an uninitialized zram disk).
- **Two Bugs in `zram_bio_in_range()`**:
  1. **Empty `REQ_OP_READ` / `REQ_OP_WRITE` bios crash immediately**: The new comment states *"An empty bio has to start inside the device as well: the loops for reads and writes run once before their test"*, and `zram_bio_in_range()` returns `true` when `bi_size == 0` and `start < nr_sectors` (`len == 0 <= nr_sectors - start`). Entering [`zram_bio_read()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/zram/zram_drv.c#L2736-L2765) or [`zram_bio_write()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/zram/zram_drv.c#L2767-L2795) with `bi_size == 0` (`bi_io_vec == NULL`) immediately executes `bio_iter_iovec(bio, iter)`, **dereferencing `NULL` `bio->bi_io_vec`**.
  2. **Sub-4K / unaligned bios corrupt or leak 4 KiB pages on `PAGE_SIZE == 4096` kernels**: On `PAGE_SIZE == 4096` (x86\_64, arm64-4K), `ZRAM_LOGICAL_BLOCK_SIZE` is `4096` and [`is_partial_io()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/zram/zram_drv.c#L212-L223) is hardcoded to `return false;`. If an in-kernel bio builder (e.g., `rnbd-srv`, the exact threat model in the commit message) submits a 512-byte or sub-sector bio inside the device range, `zram_bio_in_range()` allows it through:
     - [`zram_bvec_read()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/zram/zram_drv.c#L2229-L2235) calls `zram_read_page(zram, bvec->bv_page, index, bio)`, ignoring `bv_offset` and `bv_len` and overwriting all 4096 bytes of `bv_page` from offset 0.
     - `zram_bvec_write()` calls `zram_write_page(zram, bvec->bv_page, index)`, compressing all 4096 bytes of `bv_page` into the zram slot — corrupting the rest of the 4 KiB block and **leaking up to 4095 bytes of adjacent kernel page memory** on a subsequent read.
- **Suggested Fix**: Reinstate the `ZRAM_LOGICAL_BLOCK_SIZE` (`4096`) alignment check on both `bi_sector` and `bi_size` (just as `valid_io_request()` originally did) and reject `bi_size == 0` before entering `zram_bio_read()` / `zram_bio_write()`.

### 1.3 Patch 48/98 — `nvmet-tcp: rewind the iterator after non-data records` (`TLS_RECORD_TYPE_ALERT` Corrupts / Misreads `ITER_BVEC` & Short Alerts)
- **Patch**: [48/98](https://lore.kernel.org/linux-block/20261028164415.1262013-49-axboe@kernel.dk/) (Josef Bacik) — [`nvmet_tcp_tls_record_ok()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/tcp.c#L1176-L1208) in [tcp.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/tcp.c#L1176-L1305)
- **Root-Cause Diagnosis**: Valid. Rewinding `&msg->msg_iter` by `len` prevents non-data TLS records from advancing the destination iterator and causing KASAN OOB / command data corruption.
- **Two Remaining Bugs on `TLS_RECORD_TYPE_ALERT`**:
  1. **Type confusion (`ITER_BVEC` cast to `struct kvec *`) in `nvmet_tcp_try_recv_data()`**: [`nvmet_tcp_try_recv_data()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/tcp.c#L1281-L1310) initializes `cmd->recv_msg.msg_iter` via `iov_iter_bvec(&cmd->recv_msg.msg_iter, ITER_DEST, cmd->req.sg, ...)` (`ITER_BVEC`). When a TLS Alert arrives during `NVMET_TCP_RECV_DATA`, `nvmet_tcp_tls_record_ok()` calls [`tls_alert_recv()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/net/handshake/alert.c#L97-L110), which blindly reads union member `msg->msg_iter.kvec->iov_base`! For an `ITER_BVEC`, `iov->iov_base` aliases `bvec->bv_page` (`struct page *` in `vmemmap`), so `tls_alert_recv()` reads `((u8 *)bv_page)[0..1]` (`page->flags`!) instead of the received alert payload — silently ignoring fatal TLS alerts (`level != 2`) and returning `-EAGAIN`! (Plus the alert payload overwrote up to 2 bytes of the command's SG page before `iov_iter_revert()`, which matters if a warning alert is ignored and not followed by full command data.)
  2. **1-byte OOB / stale byte read on `len < 2`**: If `queue->left == 1` when a 2-byte TLS Alert arrives, `sock_recvmsg()` receives `len == 1` byte (with `MSG_EOR` cleared), and `tls_alert_recv()` unconditionally reads `data[0]` and `data[1]` without checking `len >= 2` — reading 1 byte past a 1-byte buffer or reading stale stack memory.
- **Suggested Fix**: Fix `tls_alert_recv()` (or avoid calling it on `ITER_BVEC` / when `len < 2`; note that under TLS 1.3, RFC 8446 §6 treats all alerts other than `close_notify` and `user_canceled` as fatal anyway, so any alert during NVMe/TCP PDU/data transfer can tear down the connection without inspecting `ITER_BVEC` memory).

### 1.4 Patch 90/98 — `nvmet-rdma: disable interrupts under rsp_wr_wait_lock` (Executes `req.execute()` & `mutex_lock()` in HardIRQ/SoftIRQ Context)
- **Patch**: [90/98](https://lore.kernel.org/linux-block/20261028164415.1262013-91-axboe@kernel.dk/) (Chris Mason) — [`nvmet_rdma_process_wr_wait_list()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/rdma.c#L514-L537) in [rdma.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/rdma.c#L514-L537)
- **Root-Cause Diagnosis**: Valid. `nvmet_bio_done()` -> `nvmet_req_complete()` -> [`nvmet_rdma_queue_response()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/rdma.c#L717-L752) can run in hardirq or softirq context; when `ib_post_send()` fails, `nvmet_rdma_release_rsp()` calls `nvmet_rdma_process_wr_wait_list()`, which previously took `rsp_wr_wait_lock` with plain `spin_lock()`.
- **Why the Fix Is Incomplete**: As the commit message itself notes, `nvmet_rdma_process_wr_wait_list()` drops `rsp_wr_wait_lock` (restoring the caller's hardirq/softirq state) and calls `nvmet_rdma_execute_command(rsp)` -> `rsp->req.execute(&rsp->req)` **directly in hardirq/softirq context**! Almost every `nvmet` `req.execute` handler assumes process context:
  - `nvmet_bdev_execute_rw()` calls `bio_alloc(..., GFP_KERNEL)` and `submit_bio()` -> `submit_bio_noacct()`, which hits `might_sleep()` and manipulates `current->bio_list` without interrupt protection (corrupting any interrupted task's `current->bio_list`!).
  - Admin/fabrics/auth/PR handlers (`nvmet_execute_identify_*`, `nvmet_execute_admin_connect`, `nvmet_execute_auth_*`, `nvmet_execute_pr_*`) call `kzalloc(..., GFP_KERNEL)`, `mutex_lock()`, and `down_read()`.
  - Furthermore, if **Patch 69** is applied and `ib_post_send()` fails on a dying queue in hardirq/softirq context (`nvmet_rdma_queue_response()` doesn't currently call `nvmet_rdma_error_comp()`, though `nvmet_rdma_Disconnect` paths take `mutex_lock(&nvmet_rdma_queue_mutex)`), any fatal error path assuming process context will sleep in atomic.
- **Suggested Fix**: Offload `nvmet_rdma_process_wr_wait_list()` to a `work_struct` on `nvmet_wq` (or queue the work whenever `!in_task()`) instead of calling `nvmet_rdma_execute_command()` in interrupt context.

### 1.5 Patch 97/98 (and Patch 96/98 note) — `nvmet-rdma: hold sq->ref to post a T10-PI Read's SEND` (`percpu_ref_tryget_live()` Concurrent With / After `percpu_ref_exit()`)
- **Patches**: [97/98](https://lore.kernel.org/linux-block/20261028164415.1262013-98-axboe@kernel.dk/) and [96/98](https://lore.kernel.org/linux-block/20261028164415.1262013-97-axboe@kernel.dk/) (Chris Mason) — [`nvmet_rdma_write_data_done()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/rdma.c#L787-L828) in [rdma.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/rdma.c#L1361-L1395) and [`nvmet_sq_destroy()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/core.c#L985-L1023) in [core.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/core.c#L985-L1023)
- **Root-Cause Diagnosis**: Valid. For a T10-PI Read, `nvmet_req_complete()` drops `sq->ref` right after posting the `RDMA WRITE`, so `nvmet_sq_destroy()` doesn't wait for `nvmet_rdma_write_data_done()` to post `&rsp->send_wr`, allowing `&rsp->send_wr` to be posted *behind* `ib_drain_qp()`'s `sdrain` WR.
- **API Contract Violation & KCSAN Race**:
  - In [`nvmet_rdma_free_queue()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/rdma.c#L1379-L1395), `nvmet_sq_destroy(&queue->nvme_sq)` (which calls [`percpu_ref_exit(&sq->ref)`](file:///usr/local/google/home/bvanassche/software/linux-kernel/lib/percpu-refcount.c#L130-L148)) runs **before** `nvmet_rdma_destroy_queue_ib(queue)` -> `ib_drain_qp(queue->qp)`.
  - While Patch 96's commit message notes that `percpu_ref_tryget_live()` happens not to dereference `ref->data` (`NULL`) after `percpu_ref_exit()` because `__PERCPU_REF_ATOMIC_DEAD` remains set in `ref->percpu_count_ptr`, [`percpu_ref_tryget_live()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/include/linux/percpu-refcount.h#L276-L315) explicitly documents *"This function is safe to call as long as @ref is between init and exit"*, and [`__percpu_ref_exit()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/lib/percpu-refcount.c#L108-L147) / `percpu_ref_exit()` perform unmarked plain writes to `ref->percpu_count_ptr` while `percpu_ref_tryget_live_rcu()` performs an unmarked read (`!(ref->percpu_count_ptr & __PERCPU_REF_DEAD)`), which is a **KCSAN data race**.
  - Specifically in **Patch 97**, calling `percpu_ref_tryget_live()` after `sq->ref` was dropped is completely avoidable: [`nvmet_rdma_queue_response()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/rdma.c#L717-L752) runs while the request's own `sq->ref` is still held! Simply calling `percpu_ref_get(&rsp->queue->nvme_sq.ref)` before posting `&rsp->write_cqe` (putting it on synchronous `ib_post_send` failure and at the end of `nvmet_rdma_write_data_done()`) keeps `sq->ref` genuinely live across the entire T10-PI `RDMA WRITE` -> `SEND` handoff so `nvmet_sq_destroy()` waits cleanly before `percpu_ref_exit()`.

### 1.6 Patches 20/98 & 22/98 — `mtip32xx` Surprise-Removal Ordering Deadlock (`blk_mark_disk_dead` / `kthread_stop` Before Aborting In-Flight Commands)
- **Patches**: [20/98](https://lore.kernel.org/linux-block/20261028164415.1262013-21-axboe@kernel.dk/) and [22/98](https://lore.kernel.org/linux-block/20261028164415.1262013-23-axboe@kernel.dk/) (Josef Bacik) — [`mtip_service_thread()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/mtip32xx/mtip32xx.c#L2465-L2535) and [`mtip_pci_remove()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/mtip32xx/mtip32xx.c#L3874-L3955) in [mtip32xx.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/mtip32xx/mtip32xx.c#L133-L150)
- **Root-Cause Diagnosis**: Valid. Calling `blk_mark_disk_dead()` from `mtip_handle_irq()` sleeps in hardirq (`mutex_lock(&disk->part0->bd_holder_lock)`), and `del_gendisk()` hangs on surprise removal if in-flight NCQ commands are never aborted.
- **Remaining Deadlock & Race**:
  1. When a filesystem is mounted on `/dev/rssd*`, `blk_mark_disk_dead()` invokes `fs_bdev_mark_dead()` -> `bdev_super_lock(bdev, ...)` (`down_write(&sb->s_umount)`) and `sync_filesystem()`. In **Patch 20**, `mtip_service_thread()` calls `blk_mark_disk_dead(dd->disk)` *before* aborting in-flight NCQ commands; if another task holds `s_umount` waiting on an uncompleted NCQ command on the dead PCIe device, `mtip_service_thread` blocks on `s_umount` and **Patch 22**'s `mtip_stop_service_thread()` (`kthread_stop()`) blocks waiting for `mtip_service_thread` *before* reaching `blk_mq_tagset_busy_iter(&dd->tags, mtip_abort_cmd, dd)`!
  2. Conversely, if PCIe link loss (`dd->sr = true`) occurs *after* `mtip_pci_remove()` has already passed `if (dd->sr)` and entered `del_gendisk(dd->disk)`, `MTIP_DDF_REMOVE_PENDING_BIT` causes `mtip_service_thread()` to exit immediately without aborting in-flight commands, hanging `del_gendisk()` anyway.
- **Suggested Fix**: In `mtip_service_thread()`, quiesce `dd->queue` and abort in-flight commands (`blk_mq_tagset_busy_iter(&dd->tags, mtip_abort_cmd, dd)`) *before* calling `blk_mark_disk_dead(dd->disk)`, and do not let `MTIP_DDF_REMOVE_PENDING_BIT` skip surprise-removal command abortion while `del_gendisk()` is still draining I/O.

### 1.7 Patch 18/98 — `aoe: don't free a device with its work queued` (`DEVFL_TKILL` Set Too Late After `aoedev_downdev()`)
- **Patch**: [18/98](https://lore.kernel.org/linux-block/20261028164415.1262013-19-axboe@kernel.dk/) (Josef Bacik) — [`ataid_complete()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/aoe/aoecmd.c#L930-L950) in [aoecmd.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/aoe/aoecmd.c#L898-L950) and [`flush()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/aoe/aoedev.c#L315-L370) in [aoedev.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/aoe/aoedev.c#L272-L370)
- **Root-Cause Diagnosis**: Valid. Commit `430380b4637a` dropped `d->lock` across `aoedev_downdev(d)` without preventing `ataid_complete()` from scheduling `d->work`, leading to UAF on `d->work` when `freedev(d)` freed `d`.
- **Remaining Race**: Patch 18 sets `d->flags |= DEVFL_TKILL` *after* `aoedev_downdev(d)` returns rather than *before* dropping `d->lock` at line 356. During the unlocked `aoedev_downdev(d)` window, an incoming ATA IDENTIFY reply still sees `!(d->flags & DEVFL_TKILL)` in `ataid_complete()`, schedules [`aoecmd_sleepwork()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/block/aoe/aoecmd.c#L898-L928) (which runs `aoedisk_add_disk(d)` and sets `d->flags |= DEVFL_UP` without checking `DEVFL_TKILL`!), re-bringing the device UP *after* `aoedev_downdev(d)` finished so `freedev()` can receive new bios without anyone failing them during `del_gendisk()`. (Or if `aoecmd_sleepwork` hasn't run yet when `flush()` restarts, `flush()` hits `WARN_ON(d->flags & DEVFL_TKILL)` when skipping `DEVFL_GDALLOC | DEVFL_NEWSIZE`.)
- **Suggested Fix**: Set `d->flags |= DEVFL_TKILL` *before* dropping `d->lock` prior to `aoedev_downdev(d)` in `flush()` (and remove the then-unreachable `WARN_ON(d->flags & DEVFL_TKILL)` on the `restart1` loop).

### 1.8 Patch 76/98 — `nvmet: fix NULL dereference in debugfs host_traddr` (Unlocked TOCTOU NULL-Deref & UAF Remains)
- **Patch**: [76/98](https://lore.kernel.org/linux-block/20261028164415.1262013-77-axboe@kernel.dk/) (Josef Bacik) — [`nvmet_ctrl_host_traddr()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/core.c#L1822-L1830) in [core.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/core.c#L1822-L1830)
- **Root-Cause Diagnosis**: Valid. When the admin queue (`ctrl->sqs[0]`) disconnects while I/O queues remain open, `nvmet_sq_destroy()` sets `ctrl->sqs[0] = NULL`, so reading `host_traddr` in debugfs crashes with a near-NULL dereference (`container_of(ctrl->sqs[0], ...)`).
- **Incomplete Synchronization**: As the commit message candidly admits (*"Nothing holds the queue for debugfs, so a reader that's past the check when the queue goes away is still on its own"*), `if (!ctrl->sqs[0])` is a plain unlocked load, and `nvmet_tcp_host_port_addr()` / `nvmet_rdma_host_port_addr()` / `nvmet_fc_host_traddr()` immediately perform a second unlocked load of `ctrl->sqs[0]` and dereference the transport queue (`queue->sockaddr_peer`, `nvme_rdma_cm_id`, `assoc->hostport`) concurrently with `nvmet_sq_destroy()` freeing the queue (`kfree(queue)` -> **TOCTOU NULL deref and KASAN UAF**).
- **Suggested Fix**: Snapshot the formatted `host_traddr` string into a small `char host_traddr[NVMF_TRADDR_SIZE]` buffer in `struct nvmet_ctrl` during admin queue `Connect` (`nvmet_alloc_ctrl()` / `install_queue`), and have `nvmet_ctrl_host_traddr()` copy that immutable buffer. That eliminates all transport queue lifetime races with ~4 lines of code.

---

## 2. Valid Fixes With Minor Issues or Follow-up Notes (`MINOR`)

1. **Patch 06/98** ([06/98](https://lore.kernel.org/linux-block/20261028164415.1262013-7-axboe@kernel.dk/) — `blk-mq: don't batch allocate tags from an inactive hctx`):
   - Code is spot-on. `Fixes:` points to `47c122e35d7e` (when `blk_mq_is_sbitmap_shared()` renamed the check), whereas the actual bug originated in `349302da8352 ("blk-mq: support batching dispatch in case of io scheduler")` which omitted `blk_mq_hctx_stopped(hctx)` from the batch path.
2. **Patch 10/98** ([10/98](https://lore.kernel.org/linux-block/20261028164415.1262013-11-axboe@kernel.dk/) — `block: don't unplug a zone under a failed write`):
   - Valid fix. Note that moving `zwplug->flags &= ~BLK_ZONE_WPLUG_PLUGGED` under `if (blk_queue_zoned_qd1_writes(disk->queue))` inside `disk_zone_wplug_abort()` itself would achieve the same invariant with a smaller diff while also protecting future callers of `disk_zone_wplug_abort()`. **Dependency**: relies on Patches 07, 08, and 09.
3. **Patch 11/98** ([11/98](https://lore.kernel.org/linux-block/20261028164415.1262013-12-axboe@kernel.dk/) — `block: check dma alignment of bvec iters in async dio`):
   - Valid fix (`iov_iter_alignment()` checked length alignment on `ITER_BVEC` but missed `bv_offset` address alignment). Note a pre-existing quirk in `bio_iov_bvec_aligned()`: `bvec_iter_is_aligned()` short-circuits to `true` when `!IS_ENABLED(CONFIG_DEBUG_KERNEL)` (`/* assume all kernel users know what they are doing */`), even though `IORING_OP_READV_FIXED` / `WRITEV_FIXED` creates `ITER_BVEC` slices from arbitrary user-supplied offsets inside registered buffers.
4. **Patches 17/98 & 39/98** ([17/98](https://lore.kernel.org/linux-block/20261028164415.1262013-18-axboe@kernel.dk/) & [39/98](https://lore.kernel.org/linux-block/20261028164415.1262013-40-axboe@kernel.dk/) — `rnbd-srv` `sess_dev` kobject teardown):
   - Valid fixes for `xa_lock` under `srv_sess->lock` sleep-in-atomic/UAF and double-`CLOSE` UAF. Worth noting that if `CONFIG_DEBUG_KOBJECT_RELEASE=y` is enabled, `kobject_put(&sess_dev->kobj)` delays `.release` (`xa_erase(&srv_sess->index_idr, ...)`) by up to 1–4 seconds after `srv_sess->lock` is dropped; moving `xa_erase()` out of `rnbd_srv_dev_release()` into explicit teardown (once final ref drops or at `CLOSE`) would decouple XArray visibility from `CONFIG_DEBUG_KOBJECT_RELEASE`.
5. **Patch 21/98** ([21/98](https://lore.kernel.org/linux-block/20261028164415.1262013-22-axboe@kernel.dk/) — `mtip32xx: abort timed out commands of a removed device`):
   - Valid fix; note `mtip_timeout_function()` returns `BLK_EH_RESET_TIMER` after calling `mtip_abort_cmd()` -> `blk_mq_complete_request()`, which works safely because `blk_mq_complete_request_remote()` clears `REQ_ATOM_STARTED`, though `BLK_EH_DONE` when all commands are aborted is cleaner.
6. **Patch 23/98** ([23/98](https://lore.kernel.org/linux-block/20261028164415.1262013-24-axboe@kernel.dk/) — `blk-iolatency: flush enable_work after going offline`):
   - Valid fix for `enable_work` UAF. Using `disable_work_sync(&blkiolat->enable_work)` *before* `blkcg_deactivate_policy()` (instead of `cancel_work_sync()` after it) would also prevent re-arming while avoiding a theoretical lockdep cycle (`disable_work_sync` -> `freeze_lock` vs `freeze_lock` -> `blkcg_mutex`) on `!GD_OWNS_QUEUE` drivers.
7. **Patch 29/98** ([29/98](https://lore.kernel.org/linux-block/20261028164415.1262013-30-axboe@kernel.dk/) — `blk-mq: keep sharing tags fairly after a queue update`):
   - Valid fix for adding queues when `BLK_MQ_F_TAG_QUEUE_SHARED` is set. Asymmetric edge case: if a tagset transitions `2 -> 1 -> 2` queues while shrinking/growing `nr_hw_queues`, an `hctx` recycled from `q->unused_hctx_list` retains `BLK_MQ_F_TAG_QUEUE_SHARED` during the `1`-queue phase because [`blk_mq_update_tag_set_shared()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/block/blk-mq.c#L4312-L4330) doesn't touch `unused_hctx_list`. Calling `queue_set_hctx_shared(q, set->flags & BLK_MQ_F_TAG_QUEUE_SHARED)` unconditionally (instead of under `if (set->flags & BLK_MQ_F_TAG_QUEUE_SHARED)`) handles both directions cleanly in 1 line.
8. **Patch 49/98** ([49/98](https://lore.kernel.org/linux-block/20261028164415.1262013-50-axboe@kernel.dk/) — `nvmet-tcp: ask for the TLS record type on every receive`):
   - Valid fix (`put_cmsg()` overwrites `msg_controllen = 17` on the first receive, causing subsequent `recvmsg()` calls on the persistent `cmd->recv_msg` to hit `MSG_CTRUNC` with stale `cbuf`). Leaves a now-redundant `if (queue->state == NVMET_TCP_Q_TLS_HANDSHAKE)` `msg_control` setup block in [`nvmet_tcp_alloc_cmd()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/tcp.c#L1492-L1525) (`tcp.c:1508-1511`) that can be deleted.
9. **Patch 53/98** ([53/98](https://lore.kernel.org/linux-block/20261028164415.1262013-54-axboe@kernel.dk/) — `nvme-tcp: don't get stuck on a TLS control record`):
   - Valid fix for kTLS `-EIO` soft-lockup on post-handshake `NewSessionTicket` / `Alert`. Minor cleanups in [`nvme_tcp_recv_pdu()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/host/tcp.c#L886-L915): `char cbuf[CMSG_SPACE(sizeof(char))]` lacks `__aligned(__alignof__(struct cmsghdr))` before casting to `(struct cmsghdr *)cbuf`, and `tls_alert_recv()` is called before checking `ret >= 2` (same 1-byte alert caveat as Patch 48).
10. **Patch 55/98** ([55/98](https://lore.kernel.org/linux-block/20261028164415.1262013-56-axboe@kernel.dk/) — `nvme-tcp: don't act on PDUs for a command being sent`):
    - Great catch for malicious target early C2HData/R2T/CapsuleResp race while the host is still sending the command! One KCSAN buglet: [`nvme_tcp_try_send()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/host/tcp.c#L1371-L1405) writes `queue->request = nvme_tcp_fetch_request(queue);`, performing a redundant **plain unmarked store** to `queue->request` right *after* `nvme_tcp_fetch_request()` already published it via `smp_store_release(&queue->request, req)`! Change `nvme_tcp_fetch_request()` to `void` (or assign only on `NULL`) so `smp_load_acquire(&queue->request)` on the RX CPU only ever pairs with `smp_store_release()`.
11. **Patch 61/98** ([61/98](https://lore.kernel.org/linux-block/20261028164415.1262013-62-axboe@kernel.dk/) — `nvmet-auth: authenticate the I/O queues again`):
    - Code is completely right (critical auth-bypass fix after commit `be86843fd640`). Commit message nit: the sentence *"On the admin queue, Property Set runs before the check and lets the host enable or shut down the controller"* describes an older bug already fixed upstream by commit `44512543ff04 ("nvmet: move fabrics command authentication check before command execution")`.
12. **Patch 71/98** ([71/98](https://lore.kernel.org/linux-block/20261028164415.1262013-72-axboe@kernel.dk/) — `nvmet: check the host NQN against the TLS PSK identity`):
    - Valid fix preventing PSK host-NQN spoofing across hosts. Note that deliberately skipping `<subsysnqn>` comparison in `NVMe0R01 <hostnqn> <subsysnqn>` allows a host with a valid PSK for subsystem `A` on a multi-subsystem TLS port to connect to subsystem `B` if `B` also permits `<hostnqn>` (acceptable for Discovery, worth documenting or restricting to `nvmet_is_disc_subsys()`).
13. **Patch 78/98** ([78/98](https://lore.kernel.org/linux-block/20261028164415.1262013-79-axboe@kernel.dk/) — `nvmet-tcp: don't read a removed port at Connect time`):
    - Valid UAF fix (`nvmet_tcp_install_queue` reading `queue->port->priv` after `nvmet_tcp_remove_port` freed `port`). Note a sibling UAF exists in [`nvmet_tcp_disc_port_addr()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/nvme/target/tcp.c#L2227-L2240) (`struct nvmet_tcp_port *port = nport->priv;` on Discovery Log Page reads racing with `nvmet_tcp_remove_port()`), and `queue->port` in `struct nvmet_tcp_queue` now has zero remaining readers and can be removed.
14. **Patch 84/98** ([84/98](https://lore.kernel.org/linux-block/20261028164415.1262013-85-axboe@kernel.dk/) — `nvmet-rdma: disconnect only established queues`):
    - Valid `nvmet-rdma` fix (and prerequisite for Patch 86). Commit message nit: when a silent MPAv2 peer-to-peer initiator triggers the path over `siw`, `siw` itself still hits a separate driver `BUG()` in `cm_close_handler()` (`drivers/infiniband/sw/siw/iwcm.c:966`) when `ib_drain_qp()` transitions the QP out of `SIW_EPSTATE_RDMA_MODE` before `IW_CM_EVENT_ESTABLISHED`.

---

## 3. Intra-Series Dependencies (Important for Partial Cherry-Picking / Backports)

If subsets of this 98-patch series are applied selectively or backported to stable trees, keep these dependencies together:

- **`blk-zoned` / `blk-mq` (`07 -> 08 -> 09 -> 10`)**: Patch 10 relies on Patches 07, 08, and 09 so failed/keyslot-aborted zoned writes clean up `zwplug` without leaking references or unplugging active zones.
- **`blk-mq` `tag_list_lock` (`36 -> 37 -> 38`)**: Patches 36, 37, and 38 stack directly on `blk_mq_add_queue_tag_set()` / `blk_mq_del_queue_tag_set()` / `blk_mq_init_allocated_queue()`.
- **`rnbd-srv` (`16 -> 17 -> 39 -> 40`)**: Sequential fixes to `sess_dev` lifecycle and `srv_sess->index_idr` publication/removal.
- **`mtip32xx` (`20 -> 21 -> 22`)**: Stack on `dd->sr` and `mtip_service_thread()`.
- **`nvme-tcp` (`52 -> 74`, `53 -> 54`, `55 -> 56`)**: Patch 74 modifies `nvme_tcp_free_queue()` touched by Patch 52; Patch 54 extends the TLS recv switch added in Patch 53; Patch 56 uses `nvme_tcp_Req_cmd_sent` concepts adjacent to Patch 55.
- **`nvmet` fatal error (`69 + 96`)**: **Patch 96 fixes a UAF/NULL-deref introduced by Patch 69** (`nvmet_sq_fatal_error()` reading `sq->ctrl` without `sq->ref`). **Squash Patch 96 into Patch 69** before merging so commits `69..95` are bisection-safe!
- **`nvmet` PR (`81 -> 82 -> 94`)**: Stack on `nvmet_pr_preempt_and_abort()`.
- **`nvmet-rdma` (`83 -> 84 -> 85 -> 86 -> 87 -> 88 -> 89 -> 90 -> 91 -> 92 -> 95 -> 97`)**:
  - Patch 86 **semantically requires** Patch 84 (calling `rdma_disconnect()` under `nvmet_rdma_queue_mutex` on an unestablished `siw` `cm_id` would synchronously re-enter `nvmet_rdma_cm_handler()` on the same thread and self-deadlock on `nvmet_rdma_queue_mutex` without Patch 84!).
  - Patch 92 builds directly on Patch 91's `nvmet_rdma_process_wr_wait_list(queue, rsp)` signature.

---

## 4. `scripts/checkpatch.pl` Audit

Running `scripts/checkpatch.pl` across all 98 patches produced **zero C coding-style errors** and only commit-citation format complaints (`GIT_COMMIT_ID`: 12-char inline commit SHA in commit message body without `("commit title")`) on **15 patches**:

- Patches `01, 02, 07, 10, 25, 34, 36, 41, 43, 61, 62, 85, 87, 88, 98`.

All 98 `Fixes:` tags have valid 12-char SHAs and exact matching commit subjects in `origin/master`.

---

## 5. Complete 98-Patch Subsystem Review Table

### 5.1 Block Cgroup, QoS (`iocost`, `iolatency`, `blk-throttle`)
| # | Subject | Author | Verdict | Technical Summary |
| :-: | :--- | :--- | :-: | :--- |
| [01](https://lore.kernel.org/linux-block/20261028164415.1262013-2-axboe@kernel.dk/) | `blk-cgroup: keep the old blkg while reassociating a bio` | Josef Bacik | **LGTM** | Fixes `blkg` UAF in `blk_throtl_assoc_bio()` when `bio_associate_blkg_from_css()` drops the old `bi_blkg` ref before `.bio_associate` runs. |
| [02](https://lore.kernel.org/linux-block/20261028164415.1262013-3-axboe@kernel.dk/) | `blk-iocost: free struct ioc after a grace period` | Josef Bacik | **LGTM** | Fixes `struct ioc` UAF by RCU-freeing `ioc` (`kfree_rcu`) for RCU readers in `ioc_Comm`/`blkg` paths. |
| [03](https://lore.kernel.org/linux-block/20261028164415.1262013-4-axboe@kernel.dk/) | `blk-throttle: don't truncate the cgroup v1 iops limits` | Josef Bacik | **LGTM** | Fixes `unsigned int` truncation of `u64` cgroup v1 IOPS limits (`U64_MAX` truncated to `UINT_MAX`). |
| [13](https://lore.kernel.org/linux-block/20261028164415.1262013-14-axboe@kernel.dk/) | `blk-cgroup: fix root io.stat byte counts on 32-bit` | Josef Bacik | **LGTM** | Casts `sector_t` / `unsigned long` sector count to `u64` before `<< SECTOR_SHIFT` in `blkcg_print_one_stat()`. |
| [19](https://lore.kernel.org/linux-block/20261028164415.1262013-20-axboe@kernel.dk/) | `blk-cgroup: don't free a blkg with its punt work queued` | Josef Bacik | **LGTM** | Flushes `async_bio_work` before freeing `blkg` in `blkg_free_workfn()` instead of freeing with queued work. |
| [23](https://lore.kernel.org/linux-block/20261028164415.1262013-24-axboe@kernel.dk/) | `blk-iolatency: flush enable_work after going offline` | Josef Bacik | **MINOR** | Fixes `enable_work` UAF on teardown; `disable_work_sync()` before `blkcg_deactivate_policy()` is slightly cleaner (see §2.6). |
| [25](https://lore.kernel.org/linux-block/20261028164415.1262013-26-axboe@kernel.dk/) | `blk-throttle: pass the I/O counts of a dead group on` | Josef Bacik | **LGTM** | Propagates local `stat_bytes`/`stat_ios` to parent `tg` on `throtl_pd_offline()` before freeing child `tg`. |
| [26](https://lore.kernel.org/linux-block/20261028164415.1262013-27-axboe@kernel.dk/) | `blk-throttle: make blkio.reset_stats reset I/O counts` | Josef Bacik | **LGTM** | Resets `tg`'s per-CPU `stat_bytes`/`stat_ios` counters alongside `blkg` stats on `blkio.reset_stats`. |
| [28](https://lore.kernel.org/linux-block/20261028164415.1262013-29-axboe@kernel.dk/) | `blk-iocost: check again that the disk is alive` | Josef Bacik | **NEEDS WORK** | Valid `del_gendisk()` race, **but `goto close_bdev` puts `ctx.bdev` (freeing `q`) before `blk_mq_unfreeze_queue(q)`** (see §1.1). |
| [34](https://lore.kernel.org/linux-block/20261028164415.1262013-35-axboe@kernel.dk/) | `block: don't enter reclaim under rq_qos_mutex` | Josef Bacik | **LGTM** | Wraps `rq_qos_mutex` scopes in `memalloc_noio_save()` where allocations run under `rq_qos_mutex`, fixing `rq_qos_mutex -> fs_reclaim` lockdep deadlock. |

### 5.2 Block Core, Zoned, Integrity, Partitions, Blktrace & `blk-mq`
| # | Subject | Author | Verdict | Technical Summary |
| :-: | :--- | :--- | :-: | :--- |
| [04](https://lore.kernel.org/linux-block/20261028164415.1262013-5-axboe@kernel.dk/) | `block: fix use-after-free of the disk in sync_bdevs()` | Josef Bacik | **LGTM** | Holds an extra `bdev`/`inode` reference across dropping `blockdev_superblock->s_inode_list_lock` so `bdev->bd_disk` isn't freed before `put_disk()`. |
| [05](https://lore.kernel.org/linux-block/20261028164415.1262013-6-axboe@kernel.dk/) | `block: don't lose the status of a failed flush request` | Josef Bacik | **LGTM** | Preserves non-zero `error` in `blk_flush_complete_seq()` instead of overwriting with `BLK_STS_OK` on `REQ_FSEQ_DATA` completion. |
| [06](https://lore.kernel.org/linux-block/20261028164415.1262013-7-axboe@kernel.dk/) | `blk-mq: don't batch allocate tags from an inactive hctx` | Josef Bacik | **MINOR** | Checks `blk_mq_hctx_stopped(hctx)` in `blk_mq_get_driver_tag()` batch path; `Fixes:` SHA could be `349302da8352` (see §2.1). |
| [07](https://lore.kernel.org/linux-block/20261028164415.1262013-8-axboe@kernel.dk/) | `block: keep zone write plugs with plugged BIOs alive` | Josef Bacik | **LGTM** | Keeps `zwplug` reference elevated while `bio_list` is non-empty so `disk_put_zone_wplug()` can't free an active plug. |
| [08](https://lore.kernel.org/linux-block/20261028164415.1262013-9-axboe@kernel.dk/) | `block: keep the zone write plug of a failed write` | Josef Bacik | **LGTM** | Prevents double-put / premature free of `zwplug` when a zoned write fails before reaching normal completion. |
| [09](https://lore.kernel.org/linux-block/20261028164415.1262013-10-axboe@kernel.dk/) | `blk-mq: end the request if getting a keyslot fails` | Josef Bacik | **LGTM** | Calls `blk_mq_end_request()` instead of `bio_endio()` when `blk_crypto_rq_get_keyslot()` fails so `rq` & zoned state aren't leaked. |
| [10](https://lore.kernel.org/linux-block/20261028164415.1262013-11-axboe@kernel.dk/) | `block: don't unplug a zone under a failed write` | Josef Bacik | **MINOR** | Avoids clearing `BLK_ZONE_WPLUG_PLUGGED` while another write is still in flight on `qd > 1` zoned queues (see §2.2). |
| [11](https://lore.kernel.org/linux-block/20261028164415.1262013-12-axboe@kernel.dk/) | `block: check dma alignment of bvec iters in async dio` | Josef Bacik | **MINOR** | Adds `bio_iov_bvec_aligned()` check in `blkdev_bio_iter_aligned()` for async DIO `ITER_BVEC` (see §2.3). |
| [27](https://lore.kernel.org/linux-block/20261028164415.1262013-28-axboe@kernel.dk/) | `blk-mq: don't trust the cookie in blk_mq_poll()` | Josef Bacik | **LGTM** | Bounds-checks `qc` queue index against `q->nr_hw_queues` and NULL/poll state in `blk_mq_poll()`, fixing OOB crash after `nr_hw_queues` shrink. |
| [29](https://lore.kernel.org/linux-block/20261028164415.1262013-30-axboe@kernel.dk/) | `blk-mq: keep sharing tags fairly after a queue update` | Josef Bacik | **MINOR** | Restores `BLK_MQ_F_TAG_QUEUE_SHARED` on reallocated `hctx`s; unconditional `queue_set_hctx_shared()` also covers `unused_hctx_list` reuse (see §2.7). |
| [30](https://lore.kernel.org/linux-block/20261028164415.1262013-31-axboe@kernel.dk/) | `blk-mq: don't bring back flags of a completed request` | Josef Bacik | **LGTM** | Fixes non-atomic RMW on `rq->rq_flags` racing with remote request completion (`RQF_MQ_INFLIGHT` clobber / accounting leak). |
| [31](https://lore.kernel.org/linux-block/20261028164415.1262013-32-axboe@kernel.dk/) | `blk-mq: don't forget a timer the driver has restarted` | Josef Bacik | **LGTM** | Re-arms `q->timeout` if a timeout handler returns `BLK_EH_RESET_TIMER` (or `blk_add_timer` runs concurrently) instead of stranding requests forever. |
| [32](https://lore.kernel.org/linux-block/20261028164415.1262013-33-axboe@kernel.dk/) | `blk-mq-dma: initialize the dma state for P2P, too` | Josef Bacik | **LGTM** | Zero-initializes `iter->iod` fields on the PCI P2PDMA mapping path in `blk_rq_dma_map_iova()`. |
| [33](https://lore.kernel.org/linux-block/20261028164415.1262013-34-axboe@kernel.dk/) | `blk-mq-dma: map the metadata a passthrough request has` | Josef Bacik | **LGTM** | Checks `blk_rq_integrity_map_user` / `rq->nr_integrity_segments` rather than `BLK_INTEGRITY_DEVICE_CAPABLE` so passthrough metadata is mapped. |
| [35](https://lore.kernel.org/linux-block/20261028164415.1262013-36-axboe@kernel.dk/) | `blktrace: remove the debugfs files before the channel` | Josef Bacik | **LGTM** | Calls `debugfs_remove()` on `msg_file`/`dropped_file` before `relay_close(bt->rchan)` to prevent debugfs UAF on `bt->rchan`. |
| [36](https://lore.kernel.org/linux-block/20261028164415.1262013-37-axboe@kernel.dk/) | `blk-mq: quiesce a queue that joins a quiesced tag set` | Josef Bacik | **LGTM** | Tracks `set->quiesce_depth` under `set->quiesce_lock` so newly added queues inherit tagset quiesce state (e.g., `nvme_scan_work` vs `nvme_reset_work`). |
| [37](https://lore.kernel.org/linux-block/20261028164415.1262013-38-axboe@kernel.dk/) | `blk-mq: exit the hctxs of a queue under tag_list_lock` | Josef Bacik | **LGTM** | Serializes `blk_mq_exit_hw_queues()` + `blk_mq_del_queue_tag_set()` under `set->tag_list_lock` against `blk_mq_update_nr_hw_queues()` (`hctx->fq` NULL deref). |
| [38](https://lore.kernel.org/linux-block/20261028164415.1262013-39-axboe@kernel.dk/) | `blk-mq: set up a queue under tag_list_lock` | Josef Bacik | **LGTM** | Holds `set->tag_list_lock` (with `memalloc_noio_save()`) across `blk_mq_init_allocated_queue()`, preventing `set->tags` UAF during `nr_hw_queues` updates. |
| [42](https://lore.kernel.org/linux-block/20261028164415.1262013-43-axboe@kernel.dk/) | `block: partitions/mac: compute the sectors in 64 bits` | Josef Bacik | **LGTM** | Widens `secsize / 512` multiplication to `u64`/`sector_t` in Mac partition parser to prevent 32-bit overflow on >2 TiB disks. |
| [43](https://lore.kernel.org/linux-block/20261028164415.1262013-44-axboe@kernel.dk/) | `blk-mq: free the bitmaps of tags in the SRCU callback` | Josef Bacik | **LGTM** | Moves `sbitmap_queue_free()` into `blk_mq_free_tags_callback()`, fixing `sb->map` NULL/UAF in concurrent `blk_mq_tagset_busy_iter()` SRCU readers. |
| [44](https://lore.kernel.org/linux-block/20261028164415.1262013-45-axboe@kernel.dk/) | `block: apply the segment size to the integrity buffer` | Josef Bacik | **LGTM** | Enforces `queue_max_segment_size(q)` when coalescing contiguous integrity `bio_vec`s in `blk_rq_map_integrity_sg()` / DMA iterators. |

### 5.3 Block Drivers (`drbd`, `zloop`, `rnbd-srv`, `aoe`, `mtip32xx`, `zram`)
| # | Subject | Author | Verdict | Technical Summary |
| :-: | :--- | :--- | :-: | :--- |
| [12](https://lore.kernel.org/linux-block/20261028164415.1262013-13-axboe@kernel.dk/) | `drbd: stop the start_resync timer of a dying device` | Josef Bacik | **LGTM** | Calls `timer_delete_sync(&device->start_resync_timer)` in `drbd_destroy_device()` before freeing `device`. |
| [14](https://lore.kernel.org/linux-block/20261028164415.1262013-15-axboe@kernel.dk/) | `drbd: take req_lock to skip the initial sync as peer` | Josef Bacik | **LGTM** | Acquires `resource->req_lock` (`spin_lock_irq`) around `__change_cstate()` in `receive_uuids()`. |
| [15](https://lore.kernel.org/linux-block/20261028164415.1262013-16-axboe@kernel.dk/) | `zloop: refuse zone files without read/write_iter` | Josef Bacik | **LGTM** | Rejects backing zone files missing `f_op->read_iter` / `write_iter` on open instead of NULL-dereferencing in I/O worker. |
| [16](https://lore.kernel.org/linux-block/20261028164415.1262013-17-axboe@kernel.dk/) | `block/rnbd-srv: don't free the device on a sysfs error` | Josef Bacik | **LGTM** | Fixes double-free of `sess_dev` when `rnbd_srv_create_dev_session_sysfs()` fails after `kobject_init_and_add()`. |
| [17](https://lore.kernel.org/linux-block/20261028164415.1262013-18-axboe@kernel.dk/) | `block/rnbd-srv: drop the sess_dev kobject unlocked` | Josef Bacik | **MINOR** | Drops `sess_dev->kobj` outside `xa_lock` / `srv_sess->lock` to avoid sleeping in atomic (see `CONFIG_DEBUG_KOBJECT_RELEASE` note in §2.4). |
| [18](https://lore.kernel.org/linux-block/20261028164415.1262013-19-axboe@kernel.dk/) | `aoe: don't free a device with its work queued` | Josef Bacik | **NEEDS WORK** | Cancels `d->work`, **but sets `DEVFL_TKILL` *after* `aoedev_downdev(d)` instead of before dropping `d->lock`** (see §1.7). |
| [20](https://lore.kernel.org/linux-block/20261028164415.1262013-21-axboe@kernel.dk/) | `mtip32xx: don't mark the disk dead in the irq handler` | Josef Bacik | **NEEDS WORK** | Defers `blk_mark_disk_dead()` out of hardirq to `mtip_service_thread()`, **but calling it before aborting NCQ commands can deadlock on `s_umount`** (see §1.6). |
| [21](https://lore.kernel.org/linux-block/20261028164415.1262013-22-axboe@kernel.dk/) | `mtip32xx: abort timed out commands of a removed device` | Josef Bacik | **MINOR** | Aborts timed-out commands directly when `mtip_device_removed(dd)` is true (see §2.5). |
| [22](https://lore.kernel.org/linux-block/20261028164415.1262013-23-axboe@kernel.dk/) | `mtip32xx: abort commands in flight on surprise removal` | Josef Bacik | **NEEDS WORK** | Aborts commands before `del_gendisk()`, **but `mtip_stop_service_thread()` before `mtip_abort_cmd` can deadlock with Patch 20, and misses `sr` during `del_gendisk()`** (see §1.6). |
| [24](https://lore.kernel.org/linux-block/20261028164415.1262013-25-axboe@kernel.dk/) | `zram: accept lz4 dictionaries of more than 64 KiB` | Josef Bacik | **LGTM** | Clamps LZ4 dictionary view to the last 64 KiB (matching LZ4 spec) instead of failing stream init on `dict_size > 64 KiB`. |
| [39](https://lore.kernel.org/linux-block/20261028164415.1262013-40-axboe@kernel.dk/) | `rnbd-srv: fix use-after-free on two CLOSE messages` | Chris Mason | **MINOR** | Serializes `CLOSE` with `open_write_lock` / `sess_dev->closed` flag to prevent double `rnbd_srv_destroy_dev_session_sysfs()` (see §2.4). |
| [40](https://lore.kernel.org/linux-block/20261028164415.1262013-41-axboe@kernel.dk/) | `rnbd-srv: publish the sess_dev at the end of OPEN` | Chris Mason | **LGTM** | Inserts `sess_dev` into `srv_sess->index_idr` only after full initialization so early I/O/CLOSE messages cannot see half-built `sess_dev`. |
| [41](https://lore.kernel.org/linux-block/20261028164415.1262013-42-axboe@kernel.dk/) | `zram: check a bio's range against the device size` | Chris Mason | **NEEDS WORK** | **Allows empty bios (`bi_io_vec` NULL deref) and sub-4K bios on 4K-page kernels (4 KiB page buffer overrun / kernel memory infoleak)** (see §1.2). |

### 5.4 NVMe Host (`core`, `fabrics`, `loop`, `tcp`)
| # | Subject | Author | Verdict | Technical Summary |
| :-: | :--- | :--- | :-: | :--- |
| [46](https://lore.kernel.org/linux-block/20261028164415.1262013-47-axboe@kernel.dk/) | `nvme-loop: delete the controller if a reset fails` | Josef Bacik | **LGTM** | Calls `nvme_delete_ctrl(&ctrl->ctrl)` on `nvme_loop_reset_ctrl_work()` failure (matching rdma/tcp/fc) instead of stranding a dead controller. |
| [47](https://lore.kernel.org/linux-block/20261028164415.1262013-48-axboe@kernel.dk/) | `nvme: refuse metadata sizes above 255 bytes` | Josef Bacik | **LGTM** | Rejects namespaces whose `ms > U8_MAX` before assigning to `u8 tuple_size` (`blk_integrity`), preventing integer wraparound / OOB DMA. |
| [50](https://lore.kernel.org/linux-block/20261028164415.1262013-51-axboe@kernel.dk/) | `nvme-tcp: wait for an in-flight TLS handshake callback` | Josef Bacik | **LGTM** | Uses `tls_handshake_cancel()` + `wait_for_completion()` on timeout so `nvme_tcp_tls_done()` cannot UAF the stack `Handshake` context or `queue`. |
| [52](https://lore.kernel.org/linux-block/20261028164415.1262013-53-axboe@kernel.dk/) | `nvme-tcp: keep the socket while the queue is polled` | Josef Bacik | **LGTM** | Defers `sock_release(queue->sock)` until `nvme_tcp_free_queue()` (after tagset/queue teardown) so `nvme_tcp_poll()` cannot UAF `queue->sock`. |
| [53](https://lore.kernel.org/linux-block/20261028164415.1262013-54-axboe@kernel.dk/) | `nvme-tcp: don't get stuck on a TLS control record` | Josef Bacik | **MINOR** | Consumes non-data TLS records via `sock_recvmsg()` with cmsg when `tcp_read_sock()` returns `-EIO`; minor `cbuf` alignment & `ret < 2` alert notes (see §2.9). |
| [54](https://lore.kernel.org/linux-block/20261028164415.1262013-55-axboe@kernel.dk/) | `nvme-tcp: start error recovery after a TLS KeyUpdate` | Josef Bacik | **LGTM** | Triggers `nvme_tcp_error_recovery()` on `TLS_RECORD_TYPE_HANDSHAKE` (`KeyUpdate` unsupported in kTLS without userspace rekeying). |
| [55](https://lore.kernel.org/linux-block/20261028164415.1262013-56-axboe@kernel.dk/) | `nvme-tcp: don't act on PDUs for a command being sent` | Josef Bacik | **MINOR** | Rejects unsolicited C2H/R2T/CapsuleResp PDUs while `req` is still on the TX path (`UAF`/double-complete fix); minor KCSAN plain store on `queue->request` (see §2.10). |
| [56](https://lore.kernel.org/linux-block/20261028164415.1262013-57-axboe@kernel.dk/) | `nvme-tcp: don't queue the AER while it is being sent` | Josef Bacik | **LGTM** | Tracks AER TX completion before re-queuing `async_event_work` so an immediate CQE cannot re-submit `&ctrl->async_req` while TX still reads it. |
| [57](https://lore.kernel.org/linux-block/20261028164415.1262013-58-axboe@kernel.dk/) | `nvme-tcp: don't send SIGPIPE to whoever submits I/O` | Josef Bacik | **LGTM** | Passes `MSG_NOSIGNAL` on synchronous `nvme_tcp_try_send_*()` `sock_sendmsg()` paths so broken sockets don't deliver `SIGPIPE` to user tasks. |
| [58](https://lore.kernel.org/linux-block/20261028164415.1262013-59-axboe@kernel.dk/) | `nvme-fabrics: reconnect if the association is gone` | Josef Bacik | **LGTM** | Triggers controller reset/reconnect on `NVME_SC_FABRICS_ASSOC_LOST` / invalid association errors instead of failing forever. |
| [74](https://lore.kernel.org/linux-block/20261028164415.1262013-75-axboe@kernel.dk/) | `nvme-tcp: keep the page frag cache with the controller` | Josef Bacik | **LGTM** | Drains `page_frag_cache` in `nvme_tcp_free_queue()` instead of `nvme_tcp_stop_queue()` so TX pages still referenced by skbs aren't freed early. |
| [79](https://lore.kernel.org/linux-block/20261028164415.1262013-80-axboe@kernel.dk/) | `nvme-tcp: start error recovery when a send fails` | Josef Bacik | **LGTM** | Starts `nvme_tcp_error_recovery()` when `nvme_tcp_try_send()` fails with a fatal socket error instead of waiting up to 30s for I/O timeout. |
| [80](https://lore.kernel.org/linux-block/20261028164415.1262013-81-axboe@kernel.dk/) | `nvme-loop: don't BUG() if a scan runs beside a reset` | Josef Bacik | **LGTM** | Returns `BLK_STS_IOERR` in `nvme_loop_queue_rq()` when `queue` isn't `LIVE` instead of `BUG_ON(!test_bit(NVME_LOOP_Q_LIVE, ...))`. |

### 5.5 NVMe Target — Auth, Core, PR & FC (`nvmet`, `nvmet-auth`, `nvmet-fc`)
| # | Subject | Author | Verdict | Technical Summary |
| :-: | :--- | :--- | :-: | :--- |
| [45](https://lore.kernel.org/linux-block/20261028164415.1262013-46-axboe@kernel.dk/) | `nvmet: don't truncate the length of big discards` | Josef Bacik | **LGTM** | Accumulates discard range sector lengths in `u64` / `sector_t` instead of `u32`, fixing 2 TiB truncation on multi-range Dataset Management discards. |
| [59](https://lore.kernel.org/linux-block/20261028164415.1262013-60-axboe@kernel.dk/) | `nvmet-auth: serialize the commands of a controller` | Josef Bacik | **LGTM** | Adds `ctrl->auth_lock` inside `sq->auth_lock` to serialize concurrent `AUTH_Send`/`AUTH_Receive` mutations of shared `ctrl` DH-HMAC-CHAP fields (`UAF` fix). |
| [60](https://lore.kernel.org/linux-block/20261028164415.1262013-61-axboe@kernel.dk/) | `nvmet-auth: keep the negotiated hash per queue` | Josef Bacik | **LGTM** | Moves `shash_id` from `nvmet_ctrl` to `nvmet_sq` so an unauthenticated I/O queue cannot clobber another queue's negotiated HMAC hash. |
| [61](https://lore.kernel.org/linux-block/20261028164415.1262013-62-axboe@kernel.dk/) | `nvmet-auth: authenticate the I/O queues again` | Josef Bacik | **MINOR** | Fixes complete I/O queue DH-HMAC-CHAP authentication bypass introduced in `be86843fd640`; minor commit-message nit on `Property Set` (see §2.11). |
| [62](https://lore.kernel.org/linux-block/20261028164415.1262013-63-axboe@kernel.dk/) | `nvmet: don't mix queues with and without TLS` | Josef Bacik | **LGTM** | Enforces uniform TLS usage across admin and I/O queues of a controller (`!!ctrl->tls_key == !!nvmet_queue_tls_keyid(sq)`), preventing plaintext I/O queue injection. |
| [63](https://lore.kernel.org/linux-block/20261028164415.1262013-64-axboe@kernel.dk/) | `nvmet-auth: refuse a reply without a DH value` | Josef Bacik | **LGTM** | Rejects `DH-HMAC-CHAP_Reply` with `hl == 0` when a DH group was negotiated, preventing downgrade to static-PSK-only authentication. |
| [64](https://lore.kernel.org/linux-block/20261028164415.1262013-65-axboe@kernel.dk/) | `nvmet-auth: keep the old keys if the new ones fail` | Josef Bacik | **LGTM** | Stages updated configfs host/ctrl DHCHAP keys before replacing live `ctrl->host_key`/`ctrl_key` so invalid key strings don't wipe active auth (`!ctrl->host_key` bypass!). |
| [65](https://lore.kernel.org/linux-block/20261028164415.1262013-66-axboe@kernel.dk/) | `nvmet-auth: take only AUTH_Negotiate for a negotiation` | Josef Bacik | **LGTM** | Requires `auth_id == NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE` when `dhchap_step == NEGOTIATE`, closing state-machine skip. |
| [66](https://lore.kernel.org/linux-block/20261028164415.1262013-67-axboe@kernel.dk/) | `nvmet-auth: free the old data on a new AUTH_Negotiate` | Josef Bacik | **LGTM** | Frees prior `sq->dhchap_s1/s2/c1/c2` buffers on repeated `AUTH_Negotiate` commands, fixing remote kmemleak. |
| [67](https://lore.kernel.org/linux-block/20261028164415.1262013-68-axboe@kernel.dk/) | `nvmet-auth: fix the check of the offered DH groups` | Josef Bacik | **LGTM** | Validates bounds and exact `dhl` length of `auth_protocol[0].dhchap` DH group list in `AUTH_Negotiate` (OOB read fix). |
| [68](https://lore.kernel.org/linux-block/20261028164415.1262013-69-axboe@kernel.dk/) | `nvmet: accept I/O queues on the controller's port only` | Josef Bacik | **LGTM** | Verifies `req->port == ctrl->port` on I/O queue `Connect` so an I/O queue on an unencrypted/unrestricted port cannot attach to a restricted port's `ctrl`. |
| [69](https://lore.kernel.org/linux-block/20261028164415.1262013-70-axboe@kernel.dk/) | `nvmet: confine fatal errors of unauthenticated queues` | Josef Bacik | **LGTM** | Disconnects only the unauthenticated I/O queue instead of killing the authenticated host's `ctrl` (**must be squashed/paired with Patch 96**, see §3). |
| [71](https://lore.kernel.org/linux-block/20261028164415.1262013-72-axboe@kernel.dk/) | `nvmet: check the host NQN against the TLS PSK identity` | Josef Bacik | **MINOR** | Verifies `Connect` `hostnqn` matches the negotiated TLS PSK identity (`NVMe0R01 <hostnqn> ...`); see cross-subsys note in §2.12. |
| [72](https://lore.kernel.org/linux-block/20261028164415.1262013-73-axboe@kernel.dk/) | `nvmet: fix NULL dereference of PCI endpoint targets` | Josef Bacik | **LGTM** | Guards `req->port` dereferences for `nvmet-pci-epf` controllers where `req->port` / `ctrl->port` is legitimately `NULL` or lacks fabric addr ops. |
| [76](https://lore.kernel.org/linux-block/20261028164415.1262013-77-axboe@kernel.dk/) | `nvmet: fix NULL dereference in debugfs host_traddr` | Josef Bacik | **NEEDS WORK** | Fixes steady-state `ctrl->sqs[0] == NULL`, **but leaves unlocked TOCTOU NULL deref & queue UAF against `nvmet_sq_destroy()`** (see §1.8). |
| [81](https://lore.kernel.org/linux-block/20261028164415.1262013-82-axboe@kernel.dk/) | `nvmet: fix pc_ref use-after-free in preempt and abort` | Chris Mason | **LGTM** | Completes `pc_ref` barrier and calls `percpu_ref_exit()` safely before freeing preempted `nvmet_pr_per_ctrl_ref` entries. |
| [82](https://lore.kernel.org/linux-block/20261028164415.1262013-83-axboe@kernel.dk/) | `nvmet: move preempt and abort work off nvmet-wq` | Chris Mason | **LGTM** | Moves `preempt_and_abort` work off `nvmet_wq` so waiting for I/O / controller teardown on `nvmet_wq` cannot deadlock workqueue workers. |
| [93](https://lore.kernel.org/linux-block/20261028164415.1262013-94-axboe@kernel.dk/) | `nvmet-fc: only send read data for successful commands` | Andrea Parri | **LGTM** | Skips `FCP_IUI_DATA_IN` DMA transfer when a read command failed (`req->cqe->status != 0`), preventing uninitialized kernel memory leak to host. |
| [94](https://lore.kernel.org/linux-block/20261028164415.1262013-95-axboe@kernel.dk/) | `nvmet: wait only for executing I/O in preempt and abort` | Chris Mason | **LGTM** | Drops `pc_ref` before queuing response (or scopes `pc_ref` to command execution) so stalled TX responses don't hang `Preempt and Abort`. |
| [96](https://lore.kernel.org/linux-block/20261028164415.1262013-97-axboe@kernel.dk/) | `nvmet: take sq->ref in nvmet_sq_fatal_error()` | Chris Mason | **LGTM** | Fixes `sq->ctrl` NULL/UAF in Patch 69's `nvmet_sq_fatal_error()` (**squash into Patch 69**; see also `percpu_ref_exit` note in §1.5). |
| [98](https://lore.kernel.org/linux-block/20261028164415.1262013-99-axboe@kernel.dk/) | `nvmet: don't clear sq->ctrl for a Connect with sqsize 0` | Chris Mason | **LGTM** | Checks `sqsize == 0` before checking/mutating `sq->ctrl` or fails cleanly without orphaning an already-installed `sq->ctrl` reference. |

### 5.6 NVMe Target — TCP (`nvmet-tcp`)
| # | Subject | Author | Verdict | Technical Summary |
| :-: | :--- | :--- | :-: | :--- |
| [48](https://lore.kernel.org/linux-block/20261028164415.1262013-49-axboe@kernel.dk/) | `nvmet-tcp: rewind the iterator after non-data records` | Josef Bacik | **NEEDS WORK** | Rewinds `msg_iter`, **but `tls_alert_recv()` casts `ITER_BVEC` `bv_page` to `struct kvec *` in `try_recv_data()` and reads 2 bytes when `len == 1`** (see §1.3). |
| [49](https://lore.kernel.org/linux-block/20261028164415.1262013-50-axboe@kernel.dk/) | `nvmet-tcp: ask for the TLS record type on every receive` | Josef Bacik | **MINOR** | Resets `msg_control` / `msg_controllen` before every `sock_recvmsg()` in `nvmet_tcp_try_recv_data()`; leaves dead init in `nvmet_tcp_alloc_cmd()` (see §2.8). |
| [51](https://lore.kernel.org/linux-block/20261028164415.1262013-52-axboe@kernel.dk/) | `nvmet-tcp: look again after a short read with TLS` | Josef Bacik | **LGTM** | Loops on short kTLS record reads instead of breaking out of `io_work` when decrypted bytes from the next record are already queued (`sk_data_ready` already fired). |
| [70](https://lore.kernel.org/linux-block/20261028164415.1262013-71-axboe@kernel.dk/) | `nvmet-tcp: don't wait for the host in the accept work` | Josef Bacik | **LGTM** | Moves TLS `tls_server_hello_psk()` initiation / handshake kickoff out of synchronous `accept_work` so one stalled client cannot DoS the listener port. |
| [73](https://lore.kernel.org/linux-block/20261028164415.1262013-74-axboe@kernel.dk/) | `nvmet-tcp: stop listening when a port is removed` | Josef Bacik | **LGTM** | Shuts down the listening socket before draining queues in `nvmet_tcp_remove_port()`, preventing new connections from spawning queues after teardown. |
| [75](https://lore.kernel.org/linux-block/20261028164415.1262013-76-axboe@kernel.dk/) | `nvmet-tcp: hold the queue while the TLS timer is armed` | Josef Bacik | **LGTM** | Cancels `tls_handshake_tmo_work` synchronously in `nvmet_tcp_release_queue_work()` before `kfree(queue)` (`UAF` fix). |
| [77](https://lore.kernel.org/linux-block/20261028164415.1262013-78-axboe@kernel.dk/) | `nvmet-tcp: let the accept work come to an end` | Josef Bacik | **LGTM** | Caps per-invocation `kernel_accept()` iterations and reschedules `accept_work` so connection floods cannot starve `cancel_work_sync(&port->accept_work)`. |
| [78](https://lore.kernel.org/linux-block/20261028164415.1262013-79-axboe@kernel.dk/) | `nvmet-tcp: don't read a removed port at Connect time` | Josef Bacik | **MINOR** | Snapshots `pi_enable` onto `nvmet_tcp_queue` at accept time instead of reading freed `queue->port->priv` at Connect; sibling `disc_port_addr` UAF remains (see §2.13). |

### 5.7 NVMe Target — RDMA (`nvmet-rdma`)
| # | Subject | Author | Verdict | Technical Summary |
| :-: | :--- | :--- | :-: | :--- |
| [83](https://lore.kernel.org/linux-block/20261028164415.1262013-84-axboe@kernel.dk/) | `nvmet-rdma: treat a failed connect as a disconnect` | Chris Mason | **LGTM** | Handles `RDMA_CM_EVENT_CONNECT_ERROR` / `UNREACHABLE` / `REJECTED` after `RDMA_CM_EVENT_CONNECT_REQUEST` by disconnecting/releasing the allocated `queue` (leak/hang fix). |
| [84](https://lore.kernel.org/linux-block/20261028164415.1262013-85-axboe@kernel.dk/) | `nvmet-rdma: disconnect only established queues` | Chris Mason | **MINOR** | Calls `rdma_disconnect()` only when the CM connection was accepted/established (`NVMET_RDMA_Q_LIVE` / connecting state); see `siw` note in §2.14. |
| [85](https://lore.kernel.org/linux-block/20261028164415.1262013-86-axboe@kernel.dk/) | `nvmet-rdma: take a device off the list last` | Chris Mason | **LGTM** | Removes `ndev` from `device_list` under `device_list_mutex` properly relative to `kref` teardown, preventing duplicate `ndev` / SRQ collisions during device churn. |
| [86](https://lore.kernel.org/linux-block/20261028164415.1262013-87-axboe@kernel.dk/) | `nvmet-rdma: queue the release work under the mutex` | Chris Mason | **LGTM** | Serializes `list_del_init(&queue->queue_list)` + `queue_work(nvmet_wq, &queue->release_work)` under `nvmet_rdma_queue_mutex` (requires Patch 84). |
| [87](https://lore.kernel.org/linux-block/20261028164415.1262013-88-axboe@kernel.dk/) | `nvmet-rdma: disconnect a queue on device removal` | Chris Mason | **LGTM** | Properly disconnects and flushes queues using `ndev` in `nvmet_rdma_remove_one()`, fixing UAF on `ib_device` / PD / CQ removal. |
| [88](https://lore.kernel.org/linux-block/20261028164415.1262013-89-axboe@kernel.dk/) | `nvmet-rdma: flush nvmet-wq on module exit` | Chris Mason | **LGTM** | Calls `flush_workqueue(nvmet_wq)` in `nvmet_rdma_exit()` so queued `release_work` callbacks finish before module text unmaps. |
| [89](https://lore.kernel.org/linux-block/20261028164415.1262013-90-axboe@kernel.dk/) | `nvmet-rdma: reject queues larger than max_cqe` | Chris Mason | **LGTM** | Validates `recv_queue_size + 2 * send_queue_size + 1 <= max_cqe` (with overflow-safe arithmetic) before `ib_cq_pool_get()`. |
| [90](https://lore.kernel.org/linux-block/20261028164415.1262013-91-axboe@kernel.dk/) | `nvmet-rdma: disable interrupts under rsp_wr_wait_lock` | Chris Mason | **NEEDS WORK** | Fixes `rsp_wr_wait_lock` IRQ deadlock, **but still invokes `nvmet_rdma_execute_command()` -> `req.execute()` (`GFP_KERNEL`, `mutex_lock`, `submit_bio`) in hardirq/softirq** (see §1.4). |
| [91](https://lore.kernel.org/linux-block/20261028164415.1262013-92-axboe@kernel.dk/) | `nvmet-rdma: don't run the wait list recursively` | Chris Mason | **LGTM** | Prevents unbounded kernel stack recursion when synchronous completions inside `nvmet_rdma_execute_command()` re-enter `nvmet_rdma_process_wr_wait_list()`. |
| [92](https://lore.kernel.org/linux-block/20261028164415.1262013-93-axboe@kernel.dk/) | `nvmet-rdma: fix a lost run of the wait list` | Chris Mason | **LGTM** | Adds paired `smp_mb()` / `smp_mb__after_atomic()` + recheck between `sq_wr_avail` updates and `rsp_wr_wait_list` insertion so commands cannot stall forever. |
| [95](https://lore.kernel.org/linux-block/20261028164415.1262013-96-axboe@kernel.dk/) | `nvmet-rdma: fix double puts after a failed RDMA WRITE` | Chris Mason | **LGTM** | Removes erroneous `nvmet_req_uninit(&rsp->req)` in `nvmet_rdma_write_data_done()` error path (`nvmet_req_complete()` already dropped `ns`, `pc_ref`, and `sq->ref`). |
| [97](https://lore.kernel.org/linux-block/20261028164415.1262013-98-axboe@kernel.dk/) | `nvmet-rdma: hold sq->ref to post a T10-PI Read's SEND` | Chris Mason | **NEEDS WORK** | Valid `ib_drain_qp()` race, **but calls `percpu_ref_tryget_live(&sq->ref)` concurrently with / after `percpu_ref_exit()` instead of holding `sq->ref` across `write_cqe`** (see §1.5). |