Merge tag 'for-linus-20180727' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe:
 "Bigger than usual at this time, mostly due to the O_DIRECT corruption
  issue and the fact that I was on vacation last week. This contains:

   - NVMe pull request with two fixes for the FC code, and two target
     fixes (Christoph)

   - a DIF bio reset iteration fix (Greg Edwards)

   - two nbd reply and requeue fixes (Josef)

   - SCSI timeout fixup (Keith)

   - a small series that fixes an issue with bio_iov_iter_get_pages(),
     which ended up causing corruption for larger sized O_DIRECT writes
     that ended up racing with buffered writes (Martin Wilck)"

* tag 'for-linus-20180727' of git://git.kernel.dk/linux-block:
  block: reset bi_iter.bi_done after splitting bio
  block: bio_iov_iter_get_pages: pin more pages for multi-segment IOs
  blkdev: __blkdev_direct_IO_simple: fix leak in error case
  block: bio_iov_iter_get_pages: fix size of last iovec
  nvmet: only check for filebacking on -ENOTBLK
  nvmet: fixup crash on NULL device path
  scsi: set timed out out mq requests to complete
  blk-mq: export setting request completion state
  nvme: if_ready checks to fail io to deleting controller
  nvmet-fc: fix target sgl list on large transfers
  nbd: handle unexpected replies better
  nbd: don't requeue the same request twice.

diff --combined block/bio.c
index 67eff5e,05d8191..047c5dc
--- 1/block/bio.c
--- 2/block/bio.c
+++ b/block/bio.c
@@@ -903,25 -903,27 +903,27 @@@ int bio_add_page(struct bio *bio, struc
  EXPORT_SYMBOL(bio_add_page);
  
  /**
-  * bio_iov_iter_get_pages - pin user or kernel pages and add them to a bio
+  * __bio_iov_iter_get_pages - pin user or kernel pages and add them to a bio
   * @bio: bio to add pages to
   * @iter: iov iterator describing the region to be mapped
   *
-  * Pins as many pages from *iter and appends them to @bio's bvec array. The
+  * Pins pages from *iter and appends them to @bio's bvec array. The
   * pages will have to be released using put_page() when done.
+  * For multi-segment *iter, this function only adds pages from the
+  * the next non-empty segment of the iov iterator.
   */
- int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
+ static int __bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
  {
-       unsigned short nr_pages = bio->bi_max_vecs - bio->bi_vcnt;
+       unsigned short nr_pages = bio->bi_max_vecs - bio->bi_vcnt, idx;
        struct bio_vec *bv = bio->bi_io_vec + bio->bi_vcnt;
        struct page **pages = (struct page **)bv;
-       size_t offset, diff;
+       size_t offset;
        ssize_t size;
  
        size = iov_iter_get_pages(iter, pages, LONG_MAX, nr_pages, &offset);
        if (unlikely(size <= 0))
                return size ? size : -EFAULT;
-       nr_pages = (size + offset + PAGE_SIZE - 1) / PAGE_SIZE;
+       idx = nr_pages = (size + offset + PAGE_SIZE - 1) / PAGE_SIZE;
  
        /*
         * Deep magic below:  We need to walk the pinned pages backwards
@@@ -934,21 -936,46 +936,46 @@@
        bio->bi_iter.bi_size += size;
        bio->bi_vcnt += nr_pages;
  
-       diff = (nr_pages * PAGE_SIZE - offset) - size;
-       while (nr_pages--) {
-               bv[nr_pages].bv_page = pages[nr_pages];
-               bv[nr_pages].bv_len = PAGE_SIZE;
-               bv[nr_pages].bv_offset = 0;
+       while (idx--) {
+               bv[idx].bv_page = pages[idx];
+               bv[idx].bv_len = PAGE_SIZE;
+               bv[idx].bv_offset = 0;
        }
  
        bv[0].bv_offset += offset;
        bv[0].bv_len -= offset;
-       if (diff)
-               bv[bio->bi_vcnt - 1].bv_len -= diff;
+       bv[nr_pages - 1].bv_len -= nr_pages * PAGE_SIZE - offset - size;
  
        iov_iter_advance(iter, size);
        return 0;
  }
+ 
+ /**
+  * bio_iov_iter_get_pages - pin user or kernel pages and add them to a bio
+  * @bio: bio to add pages to
+  * @iter: iov iterator describing the region to be mapped
+  *
+  * Pins pages from *iter and appends them to @bio's bvec array. The
+  * pages will have to be released using put_page() when done.
+  * The function tries, but does not guarantee, to pin as many pages as
+  * fit into the bio, or are requested in *iter, whatever is smaller.
+  * If MM encounters an error pinning the requested pages, it stops.
+  * Error is returned only if 0 pages could be pinned.
+  */
+ int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
+ {
+       unsigned short orig_vcnt = bio->bi_vcnt;
+ 
+       do {
+               int ret = __bio_iov_iter_get_pages(bio, iter);
+ 
+               if (unlikely(ret))
+                       return bio->bi_vcnt > orig_vcnt ? 0 : ret;
+ 
+       } while (iov_iter_count(iter) && !bio_full(bio));
+ 
+       return 0;
+ }
  EXPORT_SYMBOL_GPL(bio_iov_iter_get_pages);
  
  static void submit_bio_wait_endio(struct bio *bio)
@@@ -1866,6 -1893,7 +1893,7 @@@ struct bio *bio_split(struct bio *bio, 
                bio_integrity_trim(split);
  
        bio_advance(bio, split->bi_iter.bi_size);
+       bio->bi_iter.bi_done = 0;
  
        if (bio_flagged(bio, BIO_TRACE_COMPLETION))
                bio_set_flag(split, BIO_TRACE_COMPLETION);
@@@ -2088,8 -2116,7 +2116,8 @@@ static int __init init_bio(void
  {
        bio_slab_max = 2;
        bio_slab_nr = 0;
 -      bio_slabs = kzalloc(bio_slab_max * sizeof(struct bio_slab), GFP_KERNEL);
 +      bio_slabs = kcalloc(bio_slab_max, sizeof(struct bio_slab),
 +                          GFP_KERNEL);
        if (!bio_slabs)
                panic("bio: can't allocate bios\n");
  

diff --combined block/blk-mq.c
index 9591926,5291a95..654b0dc
--- 1/block/blk-mq.c
--- 2/block/blk-mq.c
+++ b/block/blk-mq.c
@@@ -558,10 -558,8 +558,8 @@@ static void __blk_mq_complete_request(s
        bool shared = false;
        int cpu;
  
-       if (cmpxchg(&rq->state, MQ_RQ_IN_FLIGHT, MQ_RQ_COMPLETE) !=
-                       MQ_RQ_IN_FLIGHT)
+       if (!blk_mq_mark_complete(rq))
                return;
- 
        if (rq->internal_tag != -1)
                blk_mq_sched_completed_request(rq);
  
@@@ -1919,7 -1917,7 +1917,7 @@@ struct blk_mq_tags *blk_mq_alloc_rq_map
        if (!tags)
                return NULL;
  
 -      tags->rqs = kzalloc_node(nr_tags * sizeof(struct request *),
 +      tags->rqs = kcalloc_node(nr_tags, sizeof(struct request *),
                                 GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY,
                                 node);
        if (!tags->rqs) {
@@@ -1927,9 -1925,9 +1925,9 @@@
                return NULL;
        }
  
 -      tags->static_rqs = kzalloc_node(nr_tags * sizeof(struct request *),
 -                               GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY,
 -                               node);
 +      tags->static_rqs = kcalloc_node(nr_tags, sizeof(struct request *),
 +                                      GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY,
 +                                      node);
        if (!tags->static_rqs) {
                kfree(tags->rqs);
                blk_mq_free_tags(tags);
@@@ -2537,7 -2535,7 +2535,7 @@@ struct request_queue *blk_mq_init_alloc
        /* init q->mq_kobj and sw queues' kobjects */
        blk_mq_sysfs_init(q);
  
 -      q->queue_hw_ctx = kzalloc_node(nr_cpu_ids * sizeof(*(q->queue_hw_ctx)),
 +      q->queue_hw_ctx = kcalloc_node(nr_cpu_ids, sizeof(*(q->queue_hw_ctx)),
                                                GFP_KERNEL, set->numa_node);
        if (!q->queue_hw_ctx)
                goto err_percpu;
@@@ -2756,14 -2754,14 +2754,14 @@@ int blk_mq_alloc_tag_set(struct blk_mq_
        if (set->nr_hw_queues > nr_cpu_ids)
                set->nr_hw_queues = nr_cpu_ids;
  
 -      set->tags = kzalloc_node(nr_cpu_ids * sizeof(struct blk_mq_tags *),
 +      set->tags = kcalloc_node(nr_cpu_ids, sizeof(struct blk_mq_tags *),
                                 GFP_KERNEL, set->numa_node);
        if (!set->tags)
                return -ENOMEM;
  
        ret = -ENOMEM;
 -      set->mq_map = kzalloc_node(sizeof(*set->mq_map) * nr_cpu_ids,
 -                      GFP_KERNEL, set->numa_node);
 +      set->mq_map = kcalloc_node(nr_cpu_ids, sizeof(*set->mq_map),
 +                                 GFP_KERNEL, set->numa_node);
        if (!set->mq_map)
                goto out_free_tags;
  

diff --combined fs/block_dev.c
index 0dd87aa,1920053..aba2541
--- 1/fs/block_dev.c
--- 2/fs/block_dev.c
+++ b/fs/block_dev.c
@@@ -205,8 -205,7 +205,8 @@@ __blkdev_direct_IO_simple(struct kiocb 
        if (nr_pages <= DIO_INLINE_BIO_VECS)
                vecs = inline_vecs;
        else {
 -              vecs = kmalloc(nr_pages * sizeof(struct bio_vec), GFP_KERNEL);
 +              vecs = kmalloc_array(nr_pages, sizeof(struct bio_vec),
 +                                   GFP_KERNEL);
                if (!vecs)
                        return -ENOMEM;
        }
@@@ -221,7 -220,7 +221,7 @@@
  
        ret = bio_iov_iter_get_pages(&bio, iter);
        if (unlikely(ret))
-               return ret;
+               goto out;
        ret = bio.bi_iter.bi_size;
  
        if (iov_iter_rw(iter) == READ) {
@@@ -250,12 -249,13 +250,13 @@@
                put_page(bvec->bv_page);
        }
  
-       if (vecs != inline_vecs)
-               kfree(vecs);
- 
        if (unlikely(bio.bi_status))
                ret = blk_status_to_errno(bio.bi_status);
  
+ out:
+       if (vecs != inline_vecs)
+               kfree(vecs);
+ 
        bio_uninit(&bio);
  
        return ret;