Merge tag 'nvme-6.19-2026-01-28' of git://git.infradead.org/nvme into block-6.19

Pull NVMe fixes from Keith:

"- TCP target completion race condition fix (Ming)
 - DMA descriptor cleanup fix (Roger)"

* tag 'nvme-6.19-2026-01-28' of git://git.infradead.org/nvme:
  nvme-pci: DMA unmap the correct regions in nvme_free_sgls
  nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference

Author: axboe

drivers/nvme/host/pci.c

@@ -806,8 +806,8 @@ static void nvme_unmap_data(struct request *req)
 	if (!blk_rq_dma_unmap(req, dma_dev, &iod->dma_state, iod->total_len,
 			      map)) {
 		if (nvme_pci_cmd_use_sgl(&iod->cmd))
-			nvme_free_sgls(req, iod->descriptors[0],
-				       &iod->cmd.common.dptr.sgl, attrs);
+			nvme_free_sgls(req, &iod->cmd.common.dptr.sgl,
+			               iod->descriptors[0], attrs);
 		else
 			nvme_free_prps(req, attrs);
 	}

drivers/nvme/target/io-cmd-bdev.c

@@ -180,9 +180,10 @@ u16 blk_to_nvme_status(struct nvmet_req *req, blk_status_t blk_sts)
 static void nvmet_bio_done(struct bio *bio)
 {
 	struct nvmet_req *req = bio->bi_private;
+	blk_status_t blk_status = bio->bi_status;
 
-	nvmet_req_complete(req, blk_to_nvme_status(req, bio->bi_status));
 	nvmet_req_bio_put(req, bio);
+	nvmet_req_complete(req, blk_to_nvme_status(req, blk_status));
 }
 
 #ifdef CONFIG_BLK_DEV_INTEGRITY