[GIT PULL] nvme updates for Linux 7.4

[GIT PULL] nvme updates for Linux 7.4

[Keith Busch]

The following changes since commit 85bffad4d2fea373a72d68bed8012e8cbccb8ee7:

  block: simplify disk_zone_set_cond() (2026-09-15 06:53:06 -0600)

are available in the Git repository at:

  git://git.infradead.org/nvme.git tags/nvme-7.4-2026-10-15

for you to fetch changes up to 2e8e30b3cf9f165e1a1d079331543cb7f2ad0e0c:

  Revert "nvme-pci: clamp max_hw_sectors based on DMA optimized limitation" (2026-10-15 07:20:49 -0700)

----------------------------------------------------------------
nvme updates for Linux 7.4

 - Parallelize nvme-tcp I/O queue setup and use the caller's network
   namespace
 - New multipath sysfs attributes for path state, available
   iopolicies, and fail on controller loss
 - Multipath fixes for failfast/ANA path evaluation and discovery
   subsystem iopolicy reporting
 - Apple M4 ANS2 NVMe support
 - Traffic based keep alive support for the target
 - DH-HMAC-CHAP hardening for host and target: enforce bidirectional
   auth, require auth before property set, fix state UAF, reject short
   payloads, restrict secret visibility
 - Target reservation preempt fixes
 - Target passthru I/O use-after-free fix
 - Fix out-of-bounds reads and memory leaks from device and host
   supplied data: FDP config log, ZNS zone reports, file namespace
   range errors
 - Enforce partition checks for unprivileged passthrough
 - nvme-rdma fix for bogus remote invalidation
 - nvmet-fc fix for recursive locking hang on port unlink
 - Revert DMA opt max_hw_sectors clamp due to performance regressions
 - Misc cleanups

----------------------------------------------------------------
Andrea Parri (1):
      nvmet: zns: don't leak stale memory in zone management receive

Christoph Hellwig (1):
      Revert "nvme-pci: clamp max_hw_sectors based on DMA optimized limitation"

Daejun Park (2):
      nvmet: fix use-after-free of the old registrant in nvmet_pr_preempt()
      nvmet: fix preempt of another registrant by the reservation holder

Guixin Liu (1):
      nvme-multipath: expose path_state via sysfs

Jesse Taube (1):
      nvmet: Add traffic based keep alive support to configfs

Jérémy Jean (2):
      nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF
      nvmet: free the bvec on file namespace range errors

Krishna Iyer (2):
      nvme-multipath: fix path state evaluation for failfast and ANA
      nvme-multipath: add fail_on_ctrl_loss sysfs attribute

Laurence Oberman (1):
      nvme-multipath: add iopolicies sysfs attribute

Martin Belanger (1):
      nvme: make the DH-HMAC-CHAP secret attributes readable by root only

Martin George (1):
      nvme-multipath: report "none" iopolicy for discovery subsystems

Nilay Shroff (2):
      nvmet: introduce struct nvmet_passthru
      nvmet: fix use-after-free in passthru I/O hotpath

Palla Raghunath (1):
      nvmet-fc: don't drop the last assoc reference in nvmet_fc_delete_ctrl()

Peng Fan (1):
      nvme: use assign_bit() where applicable

Sung Byeongchan (2):
      nvmet: require authentication before property set
      nvmet-auth: reject undersized AUTH_SEND payloads

Surabhi Gogte (3):
      nvme-tcp: store and use the caller's network namespace
      nvme-tcp: refactor I/O queue setup path
      nvme-tcp: parallelize I/O queue allocation and startup

Yao Sang (1):
      nvme: pass partition flags to passthrough checks

Yehyeong Lee (3):
      nvme-rdma: don't complete a request after a bogus remote invalidation
      nvme-auth: fail when the controller does not authenticate itself
      nvme: bound FDP config log reads to the received buffer

Yureka Lilian (2):
      dt-bindings: nvme: Add apple,t8132-nvme-ans2 compatible
      nvme: apple: add t8132 (M4) ANS2 NVMe support

 Documentation/ABI/stable/sysfs-nvme                |  52 +++++++
 .../devicetree/bindings/nvme/apple,nvme-ans.yaml   |   1 +
 drivers/nvme/host/apple.c                          |  39 +++++-
 drivers/nvme/host/auth.c                           |  15 +-
 drivers/nvme/host/core.c                           |  15 +-
 drivers/nvme/host/ioctl.c                          |   2 +-
 drivers/nvme/host/multipath.c                      | 153 ++++++++++++++++++---
 drivers/nvme/host/nvme.h                           |   4 +
 drivers/nvme/host/pci.c                            |   2 +-
 drivers/nvme/host/rdma.c                           |   1 +
 drivers/nvme/host/sysfs.c                          |  23 ++--
 drivers/nvme/host/tcp.c                            | 139 +++++++++++++------
 drivers/nvme/target/admin-cmd.c                    |   4 +-
 drivers/nvme/target/auth.c                         |   1 +
 drivers/nvme/target/configfs.c                     | 119 ++++++++++++++--
 drivers/nvme/target/core.c                         |  19 ++-
 drivers/nvme/target/fabrics-cmd-auth.c             |  38 ++++-
 drivers/nvme/target/fabrics-cmd.c                  |   4 +
 drivers/nvme/target/fc.c                           |  15 +-
 drivers/nvme/target/io-cmd-file.c                  |   4 +-
 drivers/nvme/target/nvmet.h                        |  70 +++++++++-
 drivers/nvme/target/passthru.c                     | 103 +++++++++++---
 drivers/nvme/target/pr.c                           |   4 +-
 drivers/nvme/target/zns.c                          |  10 ++
 24 files changed, 696 insertions(+), 141 deletions(-)

Re: [GIT PULL] nvme updates for Linux 7.4

[Jens Axboe]

On 10/15/26 2:51 PM, Keith Busch wrote:
> The following changes since commit 85bffad4d2fea373a72d68bed8012e8cbccb8ee7:
> 
>   block: simplify disk_zone_set_cond() (2026-09-15 06:53:06 -0600)
> 
> are available in the Git repository at:
> 
>   git://git.infradead.org/nvme.git tags/nvme-7.4-2026-10-15
> 
> for you to fetch changes up to 2e8e30b3cf9f165e1a1d079331543cb7f2ad0e0c:
> 
>   Revert "nvme-pci: clamp max_hw_sectors based on DMA optimized limitation" (2026-10-15 07:20:49 -0700)
> 
> ----------------------------------------------------------------
> nvme updates for Linux 7.4
> 
>  - Parallelize nvme-tcp I/O queue setup and use the caller's network
>    namespace
>  - New multipath sysfs attributes for path state, available
>    iopolicies, and fail on controller loss
>  - Multipath fixes for failfast/ANA path evaluation and discovery
>    subsystem iopolicy reporting
>  - Apple M4 ANS2 NVMe support
>  - Traffic based keep alive support for the target
>  - DH-HMAC-CHAP hardening for host and target: enforce bidirectional
>    auth, require auth before property set, fix state UAF, reject short
>    payloads, restrict secret visibility
>  - Target reservation preempt fixes
>  - Target passthru I/O use-after-free fix
>  - Fix out-of-bounds reads and memory leaks from device and host
>    supplied data: FDP config log, ZNS zone reports, file namespace
>    range errors
>  - Enforce partition checks for unprivileged passthrough
>  - nvme-rdma fix for bogus remote invalidation
>  - nvmet-fc fix for recursive locking hang on port unlink
>  - Revert DMA opt max_hw_sectors clamp due to performance regressions
>  - Misc cleanups

Pulled, thanks.

-- 
Jens Axboe

[GIT PULL] nvme updates for Linux 7.4

[Keith Busch]

The following changes since commit 40d070cbb1906896d6fd65c39722d2411830ed9f:

  block: restore the iterator when rejecting a misaligned bio (2026-10-20 11:11:45 -0600)

are available in the Git repository at:

  git://git.infradead.org/nvme.git tags/nvme-7.4-2026-10-28

for you to fetch changes up to 89480d137bf0d943a82c64f86ae2407a15276b5e:

  nvmet: don't clear sq->ctrl for a Connect with sqsize 0 (2026-10-28 11:41:43 -0700)

----------------------------------------------------------------
nvme updates for Linux 7.4

 - Fix regressions from the parallel nvme-tcp I/O queue setup: request
   PDU sizing with header digest, a NULL controller dereference when
   reconnecting with more queues, and early lock initialization
 - Handle TLS control records in nvme-tcp: skip records arriving ahead
   of the ICResp, and start error recovery when the socket read fails
 - Fix an nvme-tcp io_work priority inversion stalling I/O
 - Fix nvme-tcp address attribute race with queue teardown
 - Validate the TLS handshake timeout parameters for host and target
 - Fix fabrics connects with isolated CPUs and queue mapping bugs
 - Fix early boot hang and buffer size for the nvme.quirks parameter
 - Fix nvme-rdma NULL metadata SGL dereference with T10-PI
 - Fix ANA underflow check and an nvme-fc discovery reference leak
 - Fix nvme-loop BUG() when a namespace scan races a reset
 - Target port and configfs locking fixes, and port removal races
 - Target auth fixes for CHALLENGE failure and negotiation handling
 - Target fc fixes for a connection use-after-free, read data on failed
   commands, and admin queue allocation failure teardown
 - Target rdma fix for short connection requests
 - Target rdma fix for inline SGL out-of-bounds write
 - Target rdma refcount, locking, and module unload fixes
 - Target pci-epf SGL length and error status fixes
 - Target NULL dereference fixes for pci-epf and debugfs
 - Target ZNS NUMD overflow check
 - Target Connect fix for a controller leak with a zero queue size
 - Target fixes for a metadata SGL double-free and a leaked blk plug
 - Target fix for truncated large discards
 - Misc cleanups

----------------------------------------------------------------
Andrea Parri (4):
      nvmet-fc: only send read data for successful commands
      nvmet: zns: reject a NUMD whose byte count wraps
      nvmet: pci-epf: report transport errors in command completions
      nvmet: pci-epf: require SGLs to match the command data length

Andrew Stellman (1):
      nvmet-rdma: fix out-of-bounds write in nvmet_rdma_map_sgl_inline()

Avi Weiss (1):
      nvmet: prevent double-free after metadata SGL allocation failure

Chris Mason (4):
      nvmet-rdma: flush nvmet-wq on module exit
      nvmet-rdma: disable interrupts under rsp_wr_wait_lock
      nvmet-rdma: fix double puts after a failed RDMA WRITE
      nvmet: don't clear sq->ctrl for a Connect with sqsize 0

Christian Aurich Zanettini Martins (3):
      nvme-rdma: fix NULL metadata_sgl dereference with T10-PI
      nvme-tcp: fix request PDU size when header digest is enabled
      nvme-tcp: fix NULL queue->ctrl dereference on reconnect

Daniel Wagner (4):
      nvme-tcp: initialize pf_cache_lock when allocating the controller
      nvme-fabrics: reset io_queues before computing the queue mapping
      nvme-fabrics: limit each queue type to the number of online CPUs
      nvme-fabrics: clear the poll map if no poll queues are mapped

Guixin Liu (4):
      nvmet-fc: Tear down the association when the admin queue allocation fails
      nvme-tcp: Validate the queue state under the queue lock in the address attribute
      nvmet: Finish the blk plug when integrity allocation fails
      nvmet: Free the old negotiation state when restarting authentication

Josef Bacik (7):
      nvmet: don't truncate the length of big discards
      nvmet-auth: take only AUTH_Negotiate for a negotiation
      nvmet: fix NULL dereference of PCI endpoint targets
      nvmet-tcp: stop listening when a port is removed
      nvmet: fix NULL dereference in debugfs host_traddr
      nvmet-tcp: don't read a removed port at Connect time
      nvme-loop: don't BUG() if a scan runs beside a reset

Martin Belanger (2):
      nvme-tcp: start error recovery when read_sock fails
      nvme-tcp: skip TLS control records while waiting for the ICResp

Martin George (3):
      nvme-auth: update error log in nvme_auth_submit()
      nvme-multipath: avoid size_t underflow in ANA log bounds checks
      nvme-fc: fix reference leak in nvme_fc_nvme_discovery_store()

Maurizio Lombardi (2):
      nvme-pci: fix early boot hang with nvme.quirks parameter
      nvme-pci: increase quirks_param buffer size to 256 bytes

Qing Zhang (1):
      nvmet: protect nvmet_ports_list with nvmet_config_sem

Rongzheng Wang (1):
      nvmet: use the enabled transport when disabling a port

Seiji Nishikawa (1):
      nvme-tcp: fix io_work priority inversion when send_mutex is held

Shao Mingyin (1):
      nvmet-auth: fix error handling on CHALLENGE failure

Weiming Shi (1):
      nvmet-rdma: reject short connection requests

Yehyeong Lee (1):
      nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection()

Yingjie Wang (2):
      nvmet-tcp: validate the TLS handshake timeout
      nvme-tcp: validate the TLS handshake timeout

Yu Zhang (1):
      nvmet: take subsys->lock while force-reconnecting in nvmet_subsys_attr_qid_max_store()

 Documentation/admin-guide/kernel-parameters.txt |  10 +
 drivers/nvme/host/auth.c                        |   6 +-
 drivers/nvme/host/fabrics.c                     |  30 ++-
 drivers/nvme/host/fc.c                          |   7 +-
 drivers/nvme/host/multipath.c                   |   4 +-
 drivers/nvme/host/pci.c                         |   4 +-
 drivers/nvme/host/rdma.c                        |   2 +-
 drivers/nvme/host/tcp.c                         | 309 +++++++++++++++++++-----
 drivers/nvme/target/auth.c                      |   1 +
 drivers/nvme/target/configfs.c                  |  26 +-
 drivers/nvme/target/core.c                      |  16 +-
 drivers/nvme/target/fabrics-cmd-auth.c          |  11 +-
 drivers/nvme/target/fabrics-cmd.c               |   3 +-
 drivers/nvme/target/fc.c                        |  18 +-
 drivers/nvme/target/io-cmd-bdev.c               |   8 +-
 drivers/nvme/target/loop.c                      |   2 -
 drivers/nvme/target/nvmet.h                     |   3 +-
 drivers/nvme/target/pci-epf.c                   |  30 ++-
 drivers/nvme/target/rdma.c                      |  31 ++-
 drivers/nvme/target/tcp.c                       |  33 ++-
 drivers/nvme/target/zns.c                       |  12 +-
 21 files changed, 436 insertions(+), 130 deletions(-)

Re: [GIT PULL] nvme updates for Linux 7.4

[Keith Busch]

On Thu, Oct 29, 2026 at 08:34:29AM -0600, Keith Busch wrote:
> The following changes since commit 40d070cbb1906896d6fd65c39722d2411830ed9f:
> 
>   block: restore the iterator when rejecting a misaligned bio (2026-10-20 11:11:45 -0600)
> 
> are available in the Git repository at:
> 
>   git://git.infradead.org/nvme.git tags/nvme-7.4-2026-10-28
> 
> for you to fetch changes up to 89480d137bf0d943a82c64f86ae2407a15276b5e:
> 
>   nvmet: don't clear sq->ctrl for a Connect with sqsize 0 (2026-10-28 11:41:43 -0700)

Oh, just fyi, there were some late fixes in nvme-7.3 that are causing a
conflict. Here is my remerge-diff resolution:

---
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
remerge CONFLICT (content): Merge conflict in drivers/nvme/host/multipath.c
index 97e5c41e5e2a4..9e0a0fd77c56e 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -874,12 +874,8 @@ static int nvme_parse_ana_log(struct nvme_ctrl *ctrl, void *data,
 		u32 nr_nsids;
 		size_t nsid_buf_size;
 
-<<<<<<< aa977f5d96745 (block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c)
 		if (WARN_ON_ONCE(offset > ctrl->ana_log_size ||
 				 sizeof(*desc) > ctrl->ana_log_size - offset))
-=======
-		if (WARN_ON_ONCE(ctrl->ana_log_size - offset < sizeof(*desc)))
->>>>>>> 89480d137bf0d (nvmet: don't clear sq->ctrl for a Connect with sqsize 0)
 			return -EINVAL;
 
 		nr_nsids = le32_to_cpu(desc->nnsids);
@@ -895,11 +891,7 @@ static int nvme_parse_ana_log(struct nvme_ctrl *ctrl, void *data,
 			return -EINVAL;
 
 		offset += sizeof(*desc);
-<<<<<<< aa977f5d96745 (block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c)
 		if (WARN_ON_ONCE(nsid_buf_size > ctrl->ana_log_size - offset))
-=======
-		if (WARN_ON_ONCE(ctrl->ana_log_size - offset < nsid_buf_size))
->>>>>>> 89480d137bf0d (nvmet: don't clear sq->ctrl for a Connect with sqsize 0)
 			return -EINVAL;
 
 		error = cb(ctrl, desc, data);
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
remerge CONFLICT (content): Merge conflict in drivers/nvme/host/tcp.c
index 4874d6c5b32e5..bc46e5f3eaa79 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1582,17 +1582,6 @@ static void nvme_tcp_free_queue(struct nvme_ctrl *nctrl, int qid)
 	memalloc_noio_restore(noio_flag);
 
 	kfree(queue->pdu);
-<<<<<<< aa977f5d96745 (block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c)
-	mutex_destroy(&queue->send_mutex);
-	mutex_destroy(&queue->queue_lock);
-	mutex_destroy(&queue->pf_cache_lock);
-=======
-
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
-	lockdep_unregister_key(&queue->nvme_tcp_sk_key);
-	lockdep_unregister_key(&queue->nvme_tcp_slock_key);
-#endif
->>>>>>> 89480d137bf0d (nvmet: don't clear sq->ctrl for a Connect with sqsize 0)
 }
 
 static int nvme_tcp_recv_tls_alert(struct nvme_tcp_queue *queue,
@@ -2173,17 +2162,6 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, int qid,
 	/* Use sync variant - see nvme_tcp_free_queue() for explanation */
 	__fput_sync(queue->sock->file);
 	queue->sock = NULL;
-<<<<<<< aa977f5d96745 (block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c)
-err_destroy_mutex:
-	mutex_destroy(&queue->send_mutex);
-	mutex_destroy(&queue->queue_lock);
-	mutex_destroy(&queue->pf_cache_lock);
-=======
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
-	lockdep_unregister_key(&queue->nvme_tcp_sk_key);
-	lockdep_unregister_key(&queue->nvme_tcp_slock_key);
-#endif
->>>>>>> 89480d137bf0d (nvmet: don't clear sq->ctrl for a Connect with sqsize 0)
 	return ret;
 }
 
--

Re: [GIT PULL] nvme updates for Linux 7.4

[Jens Axboe]

On 10/29/26 8:34 AM, Keith Busch wrote:
> ----------------------------------------------------------------
> nvme updates for Linux 7.4
> 
>  - Fix regressions from the parallel nvme-tcp I/O queue setup: request
>    PDU sizing with header digest, a NULL controller dereference when
>    reconnecting with more queues, and early lock initialization
>  - Handle TLS control records in nvme-tcp: skip records arriving ahead
>    of the ICResp, and start error recovery when the socket read fails
>  - Fix an nvme-tcp io_work priority inversion stalling I/O
>  - Fix nvme-tcp address attribute race with queue teardown
>  - Validate the TLS handshake timeout parameters for host and target
>  - Fix fabrics connects with isolated CPUs and queue mapping bugs
>  - Fix early boot hang and buffer size for the nvme.quirks parameter
>  - Fix nvme-rdma NULL metadata SGL dereference with T10-PI
>  - Fix ANA underflow check and an nvme-fc discovery reference leak
>  - Fix nvme-loop BUG() when a namespace scan races a reset
>  - Target port and configfs locking fixes, and port removal races
>  - Target auth fixes for CHALLENGE failure and negotiation handling
>  - Target fc fixes for a connection use-after-free, read data on failed
>    commands, and admin queue allocation failure teardown
>  - Target rdma fix for short connection requests
>  - Target rdma fix for inline SGL out-of-bounds write
>  - Target rdma refcount, locking, and module unload fixes
>  - Target pci-epf SGL length and error status fixes
>  - Target NULL dereference fixes for pci-epf and debugfs
>  - Target ZNS NUMD overflow check
>  - Target Connect fix for a controller leak with a zero queue size
>  - Target fixes for a metadata SGL double-free and a leaked blk plug
>  - Target fix for truncated large discards
>  - Misc cleanups

Pulled, thanks.

-- 
Jens Axboe