nvme fixes for Linux 6.19

- TCP target completion race condition fix (Ming)
  - DMA descriptor cleanup fix (Roger)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE3Fbyvv+648XNRdHTPe3zGtjzRgkFAml6LIYACgkQPe3zGtjz
 Rgnoxg/9HbFYDNcBvOs4nbfV3zyKrPuv2eB4QVc5hj8JFVbaRZ5TfMqQOVVAwrV8
 xKoWcGVDXwjtGHoqpFn7QsNYyJTXZWt+J0GJCySK/h4T7xSMh91y7Rw0EKIBUSQm
 q+As1dKS46sAdY+pagxRpnmsDRJ6d3q35lV+JEq9PLiJtzM9ZZXE+j3gbmHTyS79
 TNLj5JKsNFjPWf/qnwVQA+z0WWaudUMoJMU9X6ip6MZdRihPEqLQNABYuGeM/NMP
 hIN7QV303yjhNJsgY8KXPZYef12o+qs+1lwQ65isY3uGwh5WHVhykwceFFugUVuT
 RChdQjvAPf/8hrBrSIEPOGZ+beizncCZ2KturH6+K050sIMM8XuXbozUn665KWgh
 FqVqqqF3HqYJsXAOp5t43wd4lGo2acSFeJvdCKoqEb+9Fa6O3rFVpXdGfOXktdlH
 N845BB83KzOBmOqhP1jO93fFuWvqz6Bmc5J2JlTQ5lpNJp8yJYSuutdAdIRsJgo0
 Y66pRYkgst65Ek9F44dF9OQE7KjgLYCVF643A1pSezVIlqh54znufdnOX/i4eWDG
 SDYzmPn06sHEha93Day15t4+61mbFg3d9eWpuenfT7CRd0gFTQOL+Lcy0j49Dcf1
 wcxYbc3EGUhXyWdBj/FQC//7cUC6Rcx6SLUivDhvE0xQt5JSkmg=
 =Ik7L
 -----END PGP SIGNATURE-----

Merge tag 'nvme-6.19-2026-01-28' of git://git.infradead.org/nvme into block-6.19

Pull NVMe fixes from Keith:

"- TCP target completion race condition fix (Ming)
 - DMA descriptor cleanup fix (Roger)"

* tag 'nvme-6.19-2026-01-28' of git://git.infradead.org/nvme:
  nvme-pci: DMA unmap the correct regions in nvme_free_sgls
  nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
This commit is contained in:
Jens Axboe 2026-01-28 11:59:09 -07:00
commit 45614d8cd1
2 changed files with 4 additions and 3 deletions

View File

@ -806,8 +806,8 @@ static void nvme_unmap_data(struct request *req)
if (!blk_rq_dma_unmap(req, dma_dev, &iod->dma_state, iod->total_len,
map)) {
if (nvme_pci_cmd_use_sgl(&iod->cmd))
nvme_free_sgls(req, iod->descriptors[0],
&iod->cmd.common.dptr.sgl, attrs);
nvme_free_sgls(req, &iod->cmd.common.dptr.sgl,
iod->descriptors[0], attrs);
else
nvme_free_prps(req, attrs);
}

View File

@ -180,9 +180,10 @@ u16 blk_to_nvme_status(struct nvmet_req *req, blk_status_t blk_sts)
static void nvmet_bio_done(struct bio *bio)
{
struct nvmet_req *req = bio->bi_private;
blk_status_t blk_status = bio->bi_status;
nvmet_req_complete(req, blk_to_nvme_status(req, bio->bi_status));
nvmet_req_bio_put(req, bio);
nvmet_req_complete(req, blk_to_nvme_status(req, blk_status));
}
#ifdef CONFIG_BLK_DEV_INTEGRITY