kernel/git/stable/linux.git/drivers/nvme, branch linux-6.1.y

nvmet-rdma: fix queue leak when connect backlog is exceeded

2026-09-14T11:26:01+00:00

commit fb1ed67788e21832b614c23767a088c08cfdd2f2 upstream. When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources. Fixes: badc53620fe8 ("nvme: target: rdma: fix ndev refcount leak on queue connect") Reviewed-by: Christoph Hellwig Signed-off-by: Xixin Liu Signed-off-by: Keith Busch Signed-off-by: Greg Kroah-Hartman

nvme-apple: Reset q->sq_tail during queue init

2026-09-14T11:25:59+00:00

[ Upstream commit a6ab75639e23169a741b0b2e12191fd8acb32c73 ] Fixes a "duplicate tag error for tag 0" firmware crash during controller reset while setting up a queue on Apple A11 / T8015 caused by stale entries in the submission queue due to an invalid sq_tail offset after reset. Fixes: 04d8ecf37b5e ("nvme: apple: Add Apple A11 support") Cc: stable@vger.kernel.org Suggested-by: Yuriy Havrylyuk Reviewed-by: Sven Peter Signed-off-by: Nick Chan Signed-off-by: Keith Busch Signed-off-by: Sasha Levin

nvme-apple: Prevent shared tags across queues on Apple A11

2026-09-14T11:25:59+00:00

[ Upstream commit 6fe0687245e8406bf26143bd45eb16441bbe5280 ] On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag. Apply the existing workaround for M1 of reserving two tags for the admin queue to A11. Cc: stable@vger.kernel.org Fixes: 04d8ecf37b5e ("nvme: apple: Add Apple A11 support") Reviewed-by: Sven Peter Signed-off-by: Nick Chan Signed-off-by: Keith Busch Signed-off-by: Sasha Levin

nvme: target: rdma: fix ndev refcount leak on queue connect

2026-09-14T11:25:54+00:00

[ Upstream commit badc53620fe813b3a9f727ef9526f98567c2c898 ] nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() which acquires a reference on the returned ndev via kref_get(). On the path where the host queue backlog is exceeded and the function returns NVME_SC_CONNECT_CTRL_BUSY, reference of ndev is not released, leaking the kref. Fix this by adding a goto to the existing put_device label before the early return. Fixes: 31deaeb11ba7 ("nvmet-rdma: avoid circular locking dependency on install_queue()") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig Signed-off-by: Wentao Liang Signed-off-by: Keith Busch Signed-off-by: Sasha Levin

nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

2026-09-14T11:25:30+00:00

[ Upstream commit f594863967d87b7fcbff6e724d51135fd701a13d ] When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing. The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed. Reject the command with Invalid Field when the namespace is not backed by a block device. Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support") Reviewed-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Guixin Liu Signed-off-by: Keith Busch Signed-off-by: Sasha Levin

nvme-apple: Drop the PRP null check chicken bit

2026-09-14T11:25:30+00:00

[ Upstream commit 8ce883fd068b7ba9ab493cd3ecca3a7ea868c375 ] Now that we program the DMA direction correctly the NULL check that used to make commands fail passes. Another side effect of this bit was that non-align buffers on the admin queue were silently allowed and that's been fixed now as well and we this don't need this chicken bit anymore. More importantly, starting with the firmware installed with macOS 15, which is required for M4 but can also be installed on the previous SoCs, the controller no longer exposes this control register and any access SErrors instead. Just drop the write entirely. Fixes: 5bd2927aceba ("nvme-apple: Add initial Apple SoC NVMe driver") Tested-by: Joshua Peisach Tested-by: Janne Grunau Tested-by: Nick Chan Signed-off-by: Sven Peter Signed-off-by: Sasha Levin

nvme: apple: Add Apple A11 support

2026-09-14T11:25:29+00:00

[ Upstream commit 04d8ecf37b5e06d16228a4d37d8548c17cf70461 ] Add support for ANS2 NVMe on Apple A11 SoC. This version of ANS2 is less quirky than the one in M1, and does not have NVMMU or Linear SQ. However, it still requires a non-standard 128-byte SQE. Acked-by: Christoph Hellwig Signed-off-by: Nick Chan Reviewed-by: Sven Peter Link: https://lore.kernel.org/r/20250826-t8015-nvme-v5-2-caee6ab00144@gmail.com Signed-off-by: Sven Peter Stable-dep-of: 8ce883fd068b ("nvme-apple: Drop the PRP null check chicken bit") Signed-off-by: Sasha Levin

nvme-apple: return directly instead of else

2026-09-14T11:25:29+00:00

[ Upstream commit 2ce525d40aa61c87884b100995e59ba68b4ea059 ] There is no need for the else when direct return is used at the end of the function. Signed-off-by: Chaitanya Kulkarni Reviewed-by: Eric Curtin Signed-off-by: Christoph Hellwig Stable-dep-of: 8ce883fd068b ("nvme-apple: Drop the PRP null check chicken bit") Signed-off-by: Sasha Levin

nvme: introduce nvme_start_request

2026-09-14T11:25:29+00:00

[ Upstream commit 6887fc6495f2dfd55e088c982e983815278ee453 ] In preparation for nvme-multipath IO stats accounting, we want the accounting to happen in a centralized place. The request completion is already centralized, but we need a common helper to request I/O start. Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Hannes Reinecke Stable-dep-of: 8ce883fd068b ("nvme-apple: Drop the PRP null check chicken bit") Signed-off-by: Sasha Levin

nvme-apple: Never set the opcode in the NVMMU TCB

2026-09-14T11:25:29+00:00

[ Upstream commit cc0fec9b42cfbc69d70cb4c4b616408a7037b445 ] macOS always sets this to zero and the firmware starting with macOS 15 has started to complain about what we're doing here. Fixes: 5bd2927aceba ("nvme-apple: Add initial Apple SoC NVMe driver") Tested-by: Joshua Peisach Tested-by: Janne Grunau Tested-by: Nick Chan Signed-off-by: Sven Peter Signed-off-by: Sasha Levin