Merge tag 'nvme-7.3-2026-08-13' of git://git.infradead.org/nvme into for-7.3/block

Pull NVMe updates from Keith:

"- Enable context analysis for the nvme host driver, annotating the
   subsystem's locks, along with the LIST_HEAD_GUARDED support it needs
   (Nilay, Marco)
 - Harden the tcp host and target against malformed PDUs and out of
   range SGL lengths (Yehyeong, Ibrahim, Greg)
 - Fix unserialized page_frag_cache use in nvme-tcp request setup
   (Dmitry)
 - Bound identify, FDP and passthrough descriptor parsing to the
   allocated buffers (Hari, Guixin)
 - Zoned namespace fixes for host and the target (Xixin, Guixin, Yao)
 - Apple controller fixes: page aligned admin queue buffers, NVMMU TCB
   setup, DMA direction and admin queue teardown (Sven, Gui-Dong)
 - Add a namespace level debugfs directory exposing reservation state,
   and ABI documentation for the host sysfs and target configfs
   interfaces (Guixin)
 - Fix cdev and namespace lifetimes (John)
 - Parallelize nvme-rdma I/O queue allocation and startup (Surabhi)
 - Fix nvmet-rdma response resource leak on queue teardown (Shin'ichiro)
 - Authentication fixes: AUTH_RECEIVE buffer and an out of bounds read
   in negotiate (Xixin, Bryam, Guixin, Eric)
 - Fix pci-epf use-after-free and CQ reference leak (Shin'ichiro, Yifei)
 - Reject passthrough of driver managed Set Features (Chao)
 - Various error path and teardown fixes across the host and target
   addressing issues with use-after-free and leaking resources (Guixin,
   Maurizio, Ewan, Zhengrong, Jiang HongHui, Myeonghun, Yang, Geliang,
   Yehyeong)
 - Various cleanups and typo fixes (Nilay, Guixin, Pan Chuang)"

* tag 'nvme-7.3-2026-08-13' of git://git.infradead.org/nvme: (81 commits)
  nvmet: fix max_qid race between configfs and controller allocation
  nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
  nvme: ratelimit the completion-path messages driven by device data
  nvme-tcp: fix host memory disclosure on R2T for a read command
  nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
  nvme-tcp: reject a read that transferred too few bytes
  nvmet: zns: reject full zone report when buffer is too small
  nvme-tcp: fix usage of page_frag_cache
  nvme: reject passthrough of driver-managed Set Features
  nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
  nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
  nvmet: pci-epf: put CQ ref on create_cq mapping failure
  nvme-apple: Drop the PRP null check chicken bit
  nvme-apple: Require page aligned buffers on the admin queue
  nvme: Add a quirk for page aligned admin queue buffers
  nvme-apple: Never set the opcode in the NVMMU TCB
  nvme-apple: Don't set a DMA direction for commands without a data transfer
  nvme-apple: Destroy the admin queue on removal
  nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
  nvme: raise FDP placement handle cap to U8_MAX and warn on overflow
  ...

2 files changed, 11 insertions, 2 deletions

diff --git a/include/linux/list.h b/include/linux/list.h
index 09d979976b3b..19212bfc3f6d 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -34,6 +34,14 @@
 	struct list_head name = LIST_HEAD_INIT(name)
 
 /**
+ * LIST_HEAD_GUARDED - define a &struct list_head annotated with __guarded_by()
+ * @name: name of the list_head
+ * @lock: lock protecting the list
+ */
+#define LIST_HEAD_GUARDED(name, lock) \
+	__guarded_by(&(lock)) LIST_HEAD(name)
+
+/**
  * INIT_LIST_HEAD - Initialize a list_head structure
  * @list: list_head structure to be initialized.
  *
@@ -436,6 +444,7 @@ static inline void list_del_init_careful(struct list_head *entry)
  * if another CPU could re-list_add() it.
  */
 static inline int list_empty_careful(const struct list_head *head)
+	__context_unsafe(/* intentional lockless access to @head */)
 {
 	struct list_head *next = smp_load_acquire(&head->next);
 	return list_is_head(next, head) && (next == READ_ONCE(head->prev));
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index 041f30931a90..91ce434a7e8d 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -2272,14 +2272,14 @@ struct nvme_completion {
 #define NVME_TERTIARY(ver)	((ver) & 0xff)
 
 enum {
-	NVME_AEN_RESV_LOG_PAGE_AVALIABLE	= 0x00,
+	NVME_AEN_RESV_LOG_PAGE_AVAILABLE	= 0x00,
 };
 
 enum {
 	NVME_PR_LOG_EMPTY_LOG_PAGE			= 0x00,
 	NVME_PR_LOG_REGISTRATION_PREEMPTED		= 0x01,
 	NVME_PR_LOG_RESERVATION_RELEASED		= 0x02,
-	NVME_PR_LOG_RESERVATOIN_PREEMPTED		= 0x03,
+	NVME_PR_LOG_RESERVATION_PREEMPTED		= 0x03,
 };
 
 enum {