Merge tag 'for-linus-20180623' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe:

 - Further timeout fixes. We aren't quite there yet, so expect another
   round of fixes for that to completely close some of the IRQ vs
   completion races. (Christoph/Bart)

 - Set of NVMe fixes from the usual suspects, mostly error handling

 - Two off-by-one fixes (Dan)

 - Another bdi race fix (Jan)

 - Fix nbd reconfigure with NBD_DISCONNECT_ON_CLOSE (Doron)

* tag 'for-linus-20180623' of git://git.kernel.dk/linux-block:
  blk-mq: Fix timeout handling in case the timeout handler returns BLK_EH_DONE
  bdi: Fix another oops in wb_workfn()
  lightnvm: Remove depends on HAS_DMA in case of platform dependency
  nvme-pci: limit max IO size and segments to avoid high order allocations
  nvme-pci: move nvme_kill_queues to nvme_remove_dead_ctrl
  nvme-fc: release io queues to allow fast fail
  nbd: Add the nbd NBD_DISCONNECT_ON_CLOSE config flag.
  block: sed-opal: Fix a couple off by one bugs
  blk-mq-debugfs: Off by one in blk_mq_rq_state_name()
  nvmet: reset keep alive timer in controller enable
  nvme-rdma: don't override opts->queue_size
  nvme-rdma: Fix command completion race at error recovery
  nvme-rdma: fix possible free of a non-allocated async event buffer
  nvme-rdma: fix possible double free condition when failing to create a controller
  Revert "block: Add warning for bi_next not NULL in bio_endio()"
  block: fix timeout changes for legacy request drivers

20 files changed, 142 insertions, 84 deletions

diff --git a/block/bio.c b/block/bio.c
index 9710e275f230..67eff5eddc49 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1807,9 +1807,6 @@ again:
         if (!bio_integrity_endio(bio))
                 return;
 
-        if (WARN_ONCE(bio->bi_next, "driver left bi_next not NULL"))
-                bio->bi_next = NULL;
-
         /*
          * Need to have a real endio function for chained bios, otherwise
          * various corner cases will break (like stacking block devices that
diff --git a/block/blk-core.c b/block/blk-core.c
index cf0ee764b908..afd2596ea3d3 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -273,10 +273,6 @@ static void req_bio_endio(struct request *rq, struct bio *bio,
         bio_advance(bio, nbytes);
 
         /* don't actually finish bio if it's part of flush sequence */
-        /*
-         * XXX this code looks suspicious - it's not consistent with advancing
-         * req->bio in caller
-         */
         if (bio->bi_iter.bi_size == 0 && !(rq->rq_flags & RQF_FLUSH_SEQ))
                 bio_endio(bio);
 }
@@ -3081,10 +3077,8 @@ bool blk_update_request(struct request *req, blk_status_t error,
                 struct bio *bio = req->bio;
                 unsigned bio_bytes = min(bio->bi_iter.bi_size, nr_bytes);
 
-                if (bio_bytes == bio->bi_iter.bi_size) {
+                if (bio_bytes == bio->bi_iter.bi_size)
                         req->bio = bio->bi_next;
-                        bio->bi_next = NULL;
-                }
 
                 /* Completion has already been traced */
                 bio_clear_flag(bio, BIO_TRACE_COMPLETION);
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index ffa622366922..1c4532e92938 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -356,7 +356,7 @@ static const char *const blk_mq_rq_state_name_array[] = {
 
 static const char *blk_mq_rq_state_name(enum mq_rq_state rq_state)
 {
-        if (WARN_ON_ONCE((unsigned int)rq_state >
+        if (WARN_ON_ONCE((unsigned int)rq_state >=
                          ARRAY_SIZE(blk_mq_rq_state_name_array)))
                 return "(?)";
         return blk_mq_rq_state_name_array[rq_state];
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 70c65bb6c013..b429d515b568 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -781,7 +781,6 @@ static void blk_mq_rq_timed_out(struct request *req, bool reserved)
                 WARN_ON_ONCE(ret != BLK_EH_RESET_TIMER);
         }
 
-        req->rq_flags &= ~RQF_TIMED_OUT;
         blk_add_timer(req);
 }
 
diff --git a/block/blk-softirq.c b/block/blk-softirq.c
index 01e2b353a2b9..15c1f5e12eb8 100644
--- a/block/blk-softirq.c
+++ b/block/blk-softirq.c
@@ -144,6 +144,7 @@ do_local:
 
         local_irq_restore(flags);
 }
+EXPORT_SYMBOL(__blk_complete_request);
 
 /**
  * blk_complete_request - end I/O on a request
diff --git a/block/blk-timeout.c b/block/blk-timeout.c
index 4b8a48d48ba1..f2cfd56e1606 100644
--- a/block/blk-timeout.c
+++ b/block/blk-timeout.c
@@ -210,6 +210,7 @@ void blk_add_timer(struct request *req)
         if (!req->timeout)
                 req->timeout = q->rq_timeout;
 
+        req->rq_flags &= ~RQF_TIMED_OUT;
         blk_rq_set_deadline(req, jiffies + req->timeout);
 
         /*
diff --git a/block/sed-opal.c b/block/sed-opal.c
index 945f4b8610e0..e0de4dd448b3 100644
--- a/block/sed-opal.c
+++ b/block/sed-opal.c
@@ -877,7 +877,7 @@ static size_t response_get_string(const struct parsed_resp *resp, int n,
                 return 0;
         }
 
-        if (n > resp->num) {
+        if (n >= resp->num) {
                 pr_debug("Response has %d tokens. Can't access %d\n",
                          resp->num, n);
                 return 0;
@@ -916,7 +916,7 @@ static u64 response_get_u64(const struct parsed_resp *resp, int n)
                 return 0;
         }
 
-        if (n > resp->num) {
+        if (n >= resp->num) {
                 pr_debug("Response has %d tokens. Can't access %d\n",
                          resp->num, n);
                 return 0;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 3b7083b8ecbb..74a05561b620 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -76,6 +76,7 @@ struct link_dead_args {
 #define NBD_HAS_CONFIG_REF              4
 #define NBD_BOUND                       5
 #define NBD_DESTROY_ON_DISCONNECT       6
+#define NBD_DISCONNECT_ON_CLOSE         7
 
 struct nbd_config {
         u32 flags;
@@ -138,6 +139,7 @@ static void nbd_config_put(struct nbd_device *nbd);
 static void nbd_connect_reply(struct genl_info *info, int index);
 static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info);
 static void nbd_dead_link_work(struct work_struct *work);
+static void nbd_disconnect_and_put(struct nbd_device *nbd);
 
 static inline struct device *nbd_to_dev(struct nbd_device *nbd)
 {
@@ -1305,6 +1307,12 @@ out:
 static void nbd_release(struct gendisk *disk, fmode_t mode)
 {
         struct nbd_device *nbd = disk->private_data;
+        struct block_device *bdev = bdget_disk(disk, 0);
+
+        if (test_bit(NBD_DISCONNECT_ON_CLOSE, &nbd->config->runtime_flags) &&
+                        bdev->bd_openers == 0)
+                nbd_disconnect_and_put(nbd);
+
         nbd_config_put(nbd);
         nbd_put(nbd);
 }
@@ -1705,6 +1713,10 @@ again:
                                 &config->runtime_flags);
                         put_dev = true;
                 }
+                if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
+                        set_bit(NBD_DISCONNECT_ON_CLOSE,
+                                &config->runtime_flags);
+                }
         }
 
         if (info->attrs[NBD_ATTR_SOCKETS]) {
@@ -1749,6 +1761,17 @@ out:
         return ret;
 }
 
+static void nbd_disconnect_and_put(struct nbd_device *nbd)
+{