commit 11bffcd9cb346732eab2914ef44fe777a3f0b585 Author: Yehyeong Lee Date: Wed Oct 7 10:58:42 2026 +0900 scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case ISCSI_OP_LOGOUT_RSP: case ISCSI_OP_LOGIN_RSP: case ISCSI_OP_TEXT_RSP: case ISCSI_OP_SCSI_TMFUNC_RSP: case ISCSI_OP_NOOP_IN: task = iscsi_itt_to_task(conn, hdr->itt); if (!task) return ISCSI_ERR_BAD_ITT; iscsi_itt_to_task() bounds the index against cmds_max and looks at nothing else, so a target can name any slot in the pool, including one that has never been used. task->conn is then NULL, and both iscsi_nop_out_rsp() and iscsi_complete_task() dereference it. One unsolicited NOP-In is enough; a Text Response carrying the same ITT crashes in iscsi_complete_task() instead. Require the task to be in flight and not a SCSI command, the way iscsi_itt_to_ctask() does for the command opcodes. [ 6.298634] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.298642] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.298652] CPU: 1 UID: 0 PID: 111 Comm: iscsistart Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.298654] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.298656] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.298691] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.298698] RSP: 0018:ffff88806c907be8 EFLAGS: 00010206 [ 6.298701] RAX: dffffc0000000000 RBX: ffff888006116800 RCX: 0000000000000020 [ 6.298702] RDX: 000000000000000c RSI: ffff88800525d578 RDI: 0000000000000060 [ 6.298703] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 6.298706] R10: 0000000000000020 R11: 0000000000000000 R12: 0000000000000000 [ 6.298706] R13: 000000000000002e R14: ffff8880056eb440 R15: ffff888006116800 [ 6.298707] FS: 00007fc02d1c2740(0000) GS:ffff8880b29bc000(0000) knlGS:0000000000000000 [ 6.298710] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.298711] CR2: 000055fe3b56ddf8 CR3: 00000000053b9004 CR4: 0000000000770ef0 [ 6.298712] PKRU: 55555554 [ 6.298713] Call Trace: [ 6.298714] [ 6.298714] __iscsi_complete_pdu+0x13a8/0x22a0 [ 6.298758] iscsi_complete_pdu+0x54/0xa0 [ 6.298759] iscsi_tcp_hdr_recv_done+0x870/0x2c80 [ 6.298778] iscsi_tcp_recv_skb+0x31e/0xec0 [ 6.298800] iscsi_sw_tcp_recv+0x12f/0x390 [ 6.298804] __tcp_read_sock+0x1ab/0x810 [ 6.298812] iscsi_sw_tcp_data_ready+0x18b/0x510 [ 6.298814] tcp_rcv_established+0x1f56/0x3a00 [ 6.298842] tcp_v4_do_rcv+0x449/0x960 [ 6.298847] tcp_v4_rcv+0x2245/0x3bc0 Fixes: 7996a778ff8c ("[SCSI] iscsi: add libiscsi") Cc: stable@vger.kernel.org Reviewed-by: Mike Christie Signed-off-by: Yehyeong Lee Link: https://patch.msgid.link/20261007015842.634893-4-yhlee@isslab.korea.ac.kr Signed-off-by: Martin K. Petersen (Oracle) commit c5958c770b2a0ee492414e26b07da9164a0d1f5d Author: Yehyeong Lee Date: Wed Oct 7 10:58:41 2026 +0900 scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr)); ... task = iscsi_itt_to_task(conn, rejected_pdu.itt); That value is whatever the target put there. iscsi_itt_to_task() bounds the index against cmds_max and checks nothing else, so any task in the pool can be named, and iscsi_nop_out_rsp() then completes it. An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsi_complete_task() hits its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning. Validate the reflected ITT the way iscsi_itt_to_ctask() validates a command ITT, and require the task to be in flight and not a SCSI command. [ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 [ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060 [ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504 [ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000 [ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000 [ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000 [ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0 [ 6.255439] PKRU: 55555554 [ 6.255564] Call Trace: [ 6.255674] [ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0 [ 6.256733] iscsi_complete_pdu+0x54/0xa0 [ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250 [ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0 [ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390 [ 6.258061] __tcp_read_sock+0x1ab/0x810 [ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510 [ 6.259808] tcp_data_queue+0x1f13/0x4cd0 [ 6.260567] tcp_rcv_established+0x8a5/0x3a00 [ 6.261931] tcp_v4_do_rcv+0x449/0x960 [ 6.262269] tcp_v4_rcv+0x2245/0x3bc0 Fixes: 8afa1439fcff ("[SCSI] libiscsi: handle immediate command rejections") Cc: stable@vger.kernel.org Reviewed-by: Mike Christie Signed-off-by: Yehyeong Lee Link: https://patch.msgid.link/20261007015842.634893-3-yhlee@isslab.korea.ac.kr Signed-off-by: Martin K. Petersen (Oracle) commit 8ee2a09a1dbb257c9e828ad2497f8e4832dfb142 Author: Yehyeong Lee Date: Wed Oct 7 10:58:40 2026 +0900 scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if (i >= session->cmds_max) i and cmds_max are both int, so a negative index passes and session->cmds[i] is read from before the array. be2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag, *index = (int)itt; and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the hardware async ring without replacing its ITT, so the value is the target's. It also reports the session's own age rather than the one in the tag, which leaves the age comparison in iscsi_verify_itt() with nothing to reject. Bound the index from below in both lookups. Fixes: bfead3b2cb46 ("[SCSI] be2iscsi: Adding msix and mcc_rings V3") Cc: stable@vger.kernel.org Reviewed-by: Mike Christie Signed-off-by: Yehyeong Lee Link: https://patch.msgid.link/20261007015842.634893-2-yhlee@isslab.korea.ac.kr Signed-off-by: Martin K. Petersen (Oracle) commit e15b81f602edbdee39c335546f25486a1747f3f0 Author: Linfeng Sun Date: Tue Aug 11 20:48:43 2026 +0800 scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi_update_param_value(), causing a double-free. Protect the lookup and replacement with the discovery TPG access lock, as used by the other TPG configfs parameter updates. Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1") Signed-off-by: Linfeng Sun Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260811124843.6817-1-linfeng.sun.dev@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 04a67a8b1a4460345d22fe75d93430cbf7e651d7 Author: Yu Zhang Date: Sun Sep 27 19:13:29 2026 +1000 scsi: target: Disable interrupts while holding delayed_cmd_lock target_do_delayed_work() takes dev->delayed_cmd_lock with a plain spin_lock(). It runs from system_percpu_wq, so interrupts stay enabled while the lock is held. Every other acquisition of that lock uses spin_lock_irqsave(): target_handle_task_attr() and transport_complete_ordered_sync() in target_core_transport.c, and target_non_ordered_release() in target_core_device.c. That was safe while every caller of transport_complete_task_attr() ran in process context: target_complete_ok_work() from target_completion_wq, transport_complete_qf() from dev->qf_work_queue, and transport_generic_request_failure() from the submit and execute paths. Since commit 06933066d88a ("scsi: target: Add support for completing commands from backend context") that is no longer true. With complete_type=1 on a fabric that sets direct_compl_supp, target_complete() runs target_complete_ok_work() inline in the backend's completion context, which target_complete_cmd_with_sense() documents as "May be called from interrupt context". For iblock that is the bio end_io. target_complete_ok_work() starts with transport_complete_task_attr(), which takes delayed_cmd_lock in two ways: - Every ORDERED command is put on dev->delayed_cmd_list by target_handle_task_attr() and dispatched from there by target_do_delayed_work(), which marks it SCF_TASK_ORDERED_SYNC. Its completion therefore goes through transport_complete_ordered_sync(). - A SIMPLE command that completes while an ORDERED command is pending drops the last reference to the killed dev->non_ordered, and percpu_ref_put() then runs target_non_ordered_release() in the completing context. Both take the lock and, if commands are waiting, call schedule_work(&dev->delayed_cmd_work), which queues on system_percpu_wq, i.e. on the CPU that took the completion. Further completions for the same queue are typically delivered there too, so one arriving while the work holds the lock spins on it forever. Reaching this needs complete_type=1, which is not the default (vhost-scsi, the only fabric with direct_compl_supp, defaults to TARGET_QUEUE_COMPL), a backend whose I/O completes from interrupt context, and ORDERED commands from the initiator. Linux virtio_scsi guests send only VIRTIO_SCSI_S_SIMPLE and never take the ordered path; any guest that uses the ORDERED task attribute, which vhost-scsi accepts, does. target_do_delayed_work() is a work item and always runs in process context, so spin_lock_irq() is sufficient. Found by inspection; no runtime report. A single ORDERED command goes through both acquisitions, so with CONFIG_PROVE_LOCKING the first one completed through direct completion should produce an inconsistent lock state report on delayed_cmd_lock (hardirq or softirq, depending on where the backend completes). Fixes: 06933066d88a ("scsi: target: Add support for completing commands from backend context") Signed-off-by: Yu Zhang Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260927091329.13482-1-yuz08559@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 71caf7f84bd62a4bf91cc95abd2de690afb8d15f Author: Laurence Oberman Date: Tue Oct 13 16:25:48 2026 -0400 scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_idr. If that was the last reference, scsi_tape_release() frees the structure while it is still published in the idr. scsi_tape_get(), called from st_open(), looks up the tape in st_index_idr and takes a reference under st_ref_mutex and st_index_lock. remove_cdevs() does not wait for opens that are already past chrdev_open(), so an open that is blocked on st_ref_mutex while st_remove() holds it can take the mutex as soon as st_remove() drops it, find the freed tpnt in the idr and call kref_get() on it: BUG: KASAN: slab-use-after-free in st_open Write of size 4 ... st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291) chrdev_open ... Freed by task ...: kfree st_remove (drivers/scsi/st.c:4512) Remove the index from the idr before dropping the reference, all under st_ref_mutex. A concurrent scsi_tape_get() now either runs first and holds a valid reference that keeps the tape alive, or runs afterwards and finds nothing, so st_open() fails with -ENXIO. This restores the ordering st_remove() had before the conversion to st_index_idr, where the tape was unpublished from scsi_tapes[] before the final kref_put(). Fixes: 6c648d95a6af ("[SCSI] st: get rid of scsi_tapes array") Cc: stable@vger.kernel.org Reported-by: Dingisoul Closes: https://lore.kernel.org/linux-scsi/20261007211520.1428497-1-dingiso.kernel@gmail.com/ Tested-by: Dingisoul Signed-off-by: Laurence Oberman Link: https://patch.msgid.link/20261013202548.249628-1-loberman@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit c9e9f024dd4f61f0f6636c9f2ed0830f87060e11 Author: Laurence Oberman Date: Tue Oct 6 12:42:50 2026 -0400 scsi: st: Save the visited block for the partition the drive is in set_location() saves the current tape location before switching partitions, so that switch_partition() can return to it later. It reads the location with READ POSITION but stores it in the st_partstat of STp->partition, ignoring the partition the drive reports. The two differ after a device reset. When the reset is recovered with MTREW, MTSEEK or MTEOM, st_ioctl() sets STp->partition = 0 and calls switch_partition() to return to STp->new_partition. A drive that was in partition 1 is still there, so set_location() files the partition 1 position under partition 0. The next switch to partition 0 locates to that block: if partition 0 holds less data, MTSETPART fails with EIO (BLANK CHECK), otherwise the tape is silently positioned at the wrong block. IBM ULTRIUM-TD5 (LTO-5), LU reset in partition 1 at block 1025: st 12:0:0:0: [st0] Visited block 1025 for partition 0 saved. ... st 12:0:0:0: [st0] Setting block to 1025 and partition to 0. st 12:0:0:0: [st0] Error: 402, cmd: 2b 2 0 0 0 4 st 12:0:0:0: [st0] Sense Key : Blank Check [current] st 12:0:0:0: [st0] Add. Sense: End-of-data detected Store the location in the st_partstat of the partition reported by READ POSITION. With the fix: st 12:0:0:0: [st0] Visited block 1025 for partition 1 saved. This is a pre-existing issue. It was not caught when testing the recent st reset series because the partition test was only run on scsi_debug: on the LTO drive it was skipped, since can-partitions is off in the test harness's stinit.conf, as is normal for LTO. scsi_debug hides the problem because its emulated tape returns to the beginning of partition 0 on an LU reset. It was found while validating a backport of that series to RHEL 9.8, when the partition tests were run on real hardware with can-partitions enabled. The same failure then reproduced on unmodified RHEL 9.8 and on upstream, and the fix makes the test pass on v7.3-rc3 and RHEL 9.8 with an LTO-5. The harness (https://gitlab.com/loberman/tapetest, test X03) now refuses to silently skip the partition tests on hardware. Fixes: 7081dc75df79 ("scsi: st: Restore some drive settings after reset") Assisted-by: Claude Signed-off-by: Laurence Oberman Link: https://patch.msgid.link/20261006164250.773840-1-loberman@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit 8c8222c255772713eb36cde695777a1fce224917 Author: Yehyeong Lee Date: Mon Oct 5 21:35:54 2026 +0900 scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifront_do_response() validates the rqid in a backend response against VSCSIIF_MAX_REQS before using it to index info->shadow[], but then dereferences the entry to test ->inflight without checking that the slot is populated. Shadow slots are NULL before a command is submitted (the host private area is zeroed at allocation) and are reset to NULL in _scsifront_put_rqid() once a request completes, so an in-range rqid that does not correspond to an outstanding request makes the frontend dereference a NULL pointer. A malicious or buggy backend can thus crash the guest by returning a response whose rqid is in range but not in flight -- for example a spurious response before any command has been issued, or a duplicate of one already completed. The ring has only VSCSIIF_MAX_REQS (16) slots, so before the first command every in-range rqid selects a NULL slot. Reject a response whose shadow slot is not populated. Fixes: 6d1c2f48f3fc ("xen/scsifront: harden driver against malicious backend") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee Reviewed-by: Juergen Gross Link: https://patch.msgid.link/20261005123555.253995-1-yhlee@isslab.korea.ac.kr Signed-off-by: Martin K. Petersen (Oracle) commit 2f4880c22e838d54eae9ab153b0f8dce60531bf1 Author: Stanley Jhu Date: Tue Sep 29 22:08:06 2026 +0800 scsi: ufs: rpmb: Fix power-on UNIT ATTENTION retry A merge conflict resolution dropped SCMD_FAILURE_ASCQ_ANY from the retry added by commit a8a34238e5e6 ("scsi: ufs: rpmb: Retry power-on UNIT ATTENTION on the RPMB WLUN"), so only 29h/00h is retried, not the other 29h ASCQs. Link: https://lore.kernel.org/linux-scsi/yq1jyo4onqe.fsf@mail.kernel.org/ Signed-off-by: Stanley Jhu Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260929140806.2859367-1-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 6697e9f202c1cfca257f3cc173551547181c3d4b Author: Bill Wendling Date: Mon Sep 28 02:00:30 2026 -0700 scsi: bfa: Use snprintf() in bfa_fcs_fabric_psymb_init() Similar to bfa_fcs_fabric_nsymb_init(), bfa_fcs_fabric_psymb_init() builds the port symbolic name using strscpy() and a chain of seven or eight strlcat() calls. In preparation for removing the deprecated strlcat() API[1], replace the chained strscpy() and strlcat() calls with a single snprintf() call. An empty host_os_patch naturally contributes no characters through %s, allowing both cases to be handled by the same snprintf() call. Since snprintf() also NUL-terminates the destination, the explicit final NUL assignment can be dropped. Link: https://github.com/KSPP/linux/issues/370 [1] Cc: codemender-patching+linux@google.com Assisted-by: LLM Signed-off-by: Bill Wendling Signed-off-by: Mariia Nikitash Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260928090031.712418-3-nikitash.mariiaw@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 0a5b53c1e7276ffacf5153d06d442c4d7ab0c41d Author: Bill Wendling Date: Mon Sep 28 02:00:29 2026 -0700 scsi: bfa: Use snprintf() in bfa_fcs_fabric_nsymb_init() bfa_fcs_fabric_nsymb_init() constructs the node symbolic name using strscpy() followed by five strlcat() calls and explicit NUL-termination. In preparation for removing the deprecated strlcat() API[1], replace the chained string copies with a single snprintf() call. Link: https://github.com/KSPP/linux/issues/370 [1] Cc: codemender-patching+linux@google.com Assisted-by: LLM Signed-off-by: Bill Wendling Signed-off-by: Mariia Nikitash Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260928090031.712418-2-nikitash.mariiaw@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 469fa055664bfd8717b087a80d59c03055789c17 Author: Stanley Jhu Date: Mon Sep 28 11:58:16 2026 +0800 scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ In MCQ mode, ufshcd_mcq_compl_pending_transfer() uses blk_mq_tagset_busy_iter() to iterate over busy requests during error recovery and host reset. However, both iterator callbacks perform whole-queue operations redundantly for each visited request: - force_compl == true: ufshcd_mcq_force_compl_one() calls ufshcd_mcq_compl_all_cqes_lock() on every busy request, sweeping the entire completion ring (hwq->max_entries slots) once per active request under spin_lock_irqsave even though the first sweep already cleared all completion entries. - force_compl == false: ufshcd_mcq_compl_one() acquires cq_lock and polls CQTPy over MMIO via ufshcd_mcq_poll_cqe_lock() for every busy request without doing any per-request work. Sweep or poll each hardware queue (hba->uhq[i]) once at the start of ufshcd_mcq_compl_pending_transfer(). When force_compl is true, run blk_mq_tagset_busy_iter() afterward to complete residual in-flight requests with DID_REQUEUE, and remove the now-unused ufshcd_mcq_compl_one() callback. Fixes: ab248643d3d6 ("scsi: ufs: core: Add error handling for MCQ mode") Cc: stable@vger.kernel.org Reviewed-by: Bart Van Assche Signed-off-by: Stanley Jhu Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260928035816.1294326-3-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 375f3a5691dd46b5d05b90a8968872ec8b2248c5 Author: Stanley Jhu Date: Mon Sep 28 11:58:15 2026 +0800 scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() During MCQ host reset, ufshcd_host_reset_and_restore() stops the host controller via ufshcd_hba_stop() (HCE = 0) before calling ufshcd_complete_requests(hba, true) -> ufshcd_mcq_compl_pending_transfer(hba, true) -> ufshcd_mcq_force_compl_one() -> ufshcd_mcq_compl_all_cqes_lock(). Because ufshcd_mcq_force_compl_one() is its sole caller, ufshcd_mcq_compl_all_cqes_lock() always runs with HCE = 0. Despite the comment above ufshcd_mcq_compl_all_cqes_lock() stating that reading CQTPy may not be safe with the controller disabled, the function still calls ufshcd_mcq_update_cq_tail_slot() at the end of its sweep: 1. Unsafe CQTPy MMIO read: Calling ufshcd_mcq_update_cq_tail_slot() at the end of the sweep reads CQTPy over MMIO while HCE = 0, directly contradicting the function's documented contract (commit 1373df88d535 ("scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()")) that reading CQTPy may not be safe with the controller disabled. 2. Spurious error logs on empty slots: Sweeping all max_entries slots visits empty entries where command_desc_base_addr is 0, causing ufshcd_mcq_process_cqe() to log unguarded dev_err(hba->dev, "Abnormal CQ entry!\n") messages. Fix both issues in ufshcd_mcq_compl_all_cqes_lock(): - Remove the ufshcd_mcq_update_cq_tail_slot() call and the redundant hwq->cq_head_slot = hwq->cq_tail_slot assignment without replacement. The two indices are already equal after the sweep: they are equal when the sweep starts, since ufshcd_mcq_poll_cqe_lock() consumes entries until cq_head_slot reaches cq_tail_slot, and the sweep advances cq_head_slot by exactly one full ring. Both indices are also reinitialized before the queue is reused. - Extract ufshcd_mcq_compl_cqe() and invoke it only on non-empty slots during full-ring sweeps, keeping "Abnormal CQ entry!" logging strictly for unexpected empty entries in ufshcd_mcq_poll_cqe_lock(). Fixes: ab248643d3d6 ("scsi: ufs: core: Add error handling for MCQ mode") Cc: stable@vger.kernel.org Reviewed-by: Peter Wang Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260928035816.1294326-2-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 27c0f718d3b3c99e6d315308e95d987d0382a8a8 Author: Ahmed Abdelhaleem Ahmed Date: Tue Sep 22 15:46:46 2026 +0000 scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch->dt[]. scsi_device_lookup() takes a reference, and nothing ever drops it: ch_destroy() frees the array with kfree(). ch->dt[] is read nowhere else - it only supplies the vendor, model and revision printed in the same loop. Once such a drive is removed, its scsi_device can never be released. It stays on the host's device list at its address, so a new device there is refused by anything that walks the list - target_core_pscsi reports "scsi_device_get() failed for H:C:T:L" - and the low-level driver's module can no longer be unloaded. Only a reboot recovers. It shows with any changer that reports its drives' ids; with the mhvtl virtual library (IBM 3573-TL personality), each create and remove of a library with four drives leaves four references behind, counted by the module's use count in lsmod. With ch not bound the count is unchanged, and with this patch applied it is unchanged too. Drop the reference as soon as the name has been printed, and remove the now unused dt[] array. That also removes the array leaked when ch_probe() fails after ch_readconfig(). The same leak was reported with an RFC patch in 2022, which was not merged. Fixes: daa6eda65a53 ("[SCSI] add scsi changer driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-scsi/20220719075442.6215-1-yanghao_ht@163.com/ Signed-off-by: Ahmed Abdelhaleem Ahmed Reviewed-by: Laurence Oberman Fixes: daa6eda65a53 ("[SCSI] add scsi changer driver") Link: https://patch.msgid.link/20260929-ch-dt-leak-v2-1-ddda8d635dca@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 78e04810542da416d3bead707b60cec773f1524d Author: Pengpeng Hou Date: Sun Sep 20 11:49:53 2026 +0800 scsi: ufs: mediatek: Handle mPHY power-on failures The MediaTek helper enables VA09 before powering on the mPHY, but ignores the PHY result. A failure can leave VA09 enabled and publish mphy_powered_on as true, so a later power-on attempt is skipped. Check phy_power_on(), attempt to unwind VA09 on failure, and leave the state flag unchanged. Propagate the helper result from host initialization as well as its existing resume caller. Keep the original PHY error if the supply rollback also fails, and report that rollback separately. The issue was found by our static-analysis tool. Fixes: 561e3a8726b2 ("scsi: ufs-mediatek: Fix unbalanced clock on/off") Fixes: cf137b3ea49a ("scsi: ufs-mediatek: Support VA09 regulator operations") Assisted-by: gpt 5 Signed-off-by: Pengpeng Hou Reviewed-by: Peter Wang Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260920034953.19535-1-hppiscas@163.com Signed-off-by: Martin K. Petersen (Oracle) commit 80f75e32786a63fd650500f26dbfdb51e9158846 Author: Stanley Jhu Date: Wed Sep 30 21:59:47 2026 +0800 scsi: MAINTAINERS: Remove Avri Altman as UFS reviewer At Avri's request, remove him as a reviewer of the UFS host controller driver. The listed wdc.com address also bounces. Signed-off-by: Stanley Jhu Acked-by: Bean Huo Acked-by: Avri Altman Link: https://patch.msgid.link/20260930135947.2339918-1-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 5ba8c6e5ae6556f8e282e7a84dc8d9eb3fb432de Author: Laurence Oberman Date: Tue Sep 29 15:28:21 2026 -0400 scsi: st: Relock the door after a reset With auto-lock enabled, st locks the door at the first read or write and records ST_LOCKED_AUTO. A device reset clears the drive's medium removal prevention, but st keeps its state, so it never locks the door again and the medium can be removed from the drive while it is in use. Set the lock state to ST_UNLOCKED when a reset is recognized. The door is then locked again at the next read or write. Suggested-by: Kai Mäkisara Assisted-by: Claude sashiko Signed-off-by: Laurence Oberman Reviewed-by: Kai Mäkisara Link: https://patch.msgid.link/20260929192821.997675-5-loberman@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit 614f374472127b8e279fc14bb6c45a23319f6b96 Author: Laurence Oberman Date: Tue Sep 29 15:28:20 2026 -0400 scsi: st: Restore the drive buffering mode after reset A device reset also returns the drive's buffered mode to its default. check_tape() reads the buffered mode with MODE SENSE on every open, so st follows the drive and a mode set by the user with MTSETDRVBUFFER is lost without any indication. The value is also written back by every later MODE SELECT, including the one that restores a changed block size. Unlike density and block size, the buffered mode has no "changed" state that could be used to restore it. Record the value set with MTSETDRVBUFFER and restore it after a reset together with density and block size: when MTREW, MTSEEK or MTEOM clear the reset condition, and after MTLOAD and MTRETEN. It is restored first, so that the MODE SELECTs for density and block size carry the right value. The buffered mode is a drive setting, not a property of the medium, so it is not cleared when a new session starts. Suggested-by: Kai Mäkisara Assisted-by: Claude sashiko Signed-off-by: Laurence Oberman Reviewed-by: Kai Mäkisara Link: https://patch.msgid.link/20260929192821.997675-4-loberman@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit 54ee0ee9bdeb7e9d3b70cc5c2bdf7e58c4423e8d Author: Laurence Oberman Date: Tue Sep 29 15:28:19 2026 -0400 scsi: st: Record the tape position after a successful MTLOAD Commit 0b120edb37dc ("scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset") allows MTLOAD to clear the reset condition because the tape location is known after MTLOAD. But the driver does not record it: reset_state() sets the file and block numbers to -1, and do_load_unload() leaves them there. check_tape() sets them to 0 only for a new session, which requires a new-medium unit attention. Drives that do not report one when the medium was already loaded (seen with IBM LTO drives) keep reporting file/block -1 in MTIOCGET and no BOT, although the tape is at the beginning. After a successful load, reset the partition and the state of all partitions, as the new-session path in check_tape() does: partition 0, position at BOT, EOF state cleared and no pending write. Otherwise the driver may still record the previous partition, so that a later MTSETPART to that partition is not performed; a read after loading at EOD fails with EIO; and a partition left in the ST_WRITING state by a partition switch in read() or write() makes st_flush() write a filemark at the beginning of partition 0 when the device is closed. Fixes: 0b120edb37dc ("scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset") Suggested-by: Kai Mäkisara Assisted-by: Claude sashiko Signed-off-by: Laurence Oberman Reviewed-by: Kai Mäkisara Link: https://patch.msgid.link/20260929192821.997675-3-loberman@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit 8d1cc285194dbcba88c136e1ff7c25cb10e38a5b Author: Laurence Oberman Date: Tue Sep 29 15:28:18 2026 -0400 scsi: st: Restore changed drive settings after reset also for MTLOAD and MTRETEN A device reset returns the drive's density and block size to their defaults. Commit 7081dc75df79 ("scsi: st: Restore some drive settings after reset") re-applies values changed by the user when the position is recovered with MTREW, MTSEEK or MTEOM. MTLOAD and MTRETEN are also allowed to clear the reset condition and also leave the same medium at BOT, but they restore nothing. Because check_tape() reads the drive's block size with MODE SENSE on every open, the driver silently switches to the drive default after the reset. An application that set fixed-block mode with MTSETBLK and recovers with MTLOAD or MTRETEN keeps writing, but variable-length blocks, without any error. Restore the changed density and block size for MTLOAD and MTRETEN as well. Both operations may make the drive report a new medium, and the new session started by check_tape() clears the "changed" flags and applies the mode defaults. So save the values before the operation, let check_tape() run first (do_load_unload() already calls it for MTLOAD; call it after MTRETEN), and then re-apply them. Retry the restore once in case a unit attention is still pending. Only restore when the drive is ready after the operation: with an immediate-mode load and O_NONBLOCK, check_tape() does not wait and the drive may still be loading. In immediate mode (MT_ST_NOWAIT) MTRETEN may return before the retension has finished; do not wait for it there. MTOFFL is not changed: the medium is unloaded and a different one may be loaded next, for which the mode defaults apply. Reproduced with scsi_debug (which reports a new medium after MTRETEN and MTLOAD) and with IBM LTO drives on FC (which do not). Fixes: 7081dc75df79 ("scsi: st: Restore some drive settings after reset") Assisted-by: Claude sashiko Signed-off-by: Laurence Oberman Reviewed-by: Kai Mäkisara Link: https://patch.msgid.link/20260929192821.997675-2-loberman@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit a6c339feb830daa097ccc4c50c339c1733c12d42 Author: Niklas Cassel Date: Tue Sep 29 10:25:10 2026 +0200 scsi: scsi_debug: Validate the access parameters of WRITE ATOMIC (16) resp_atomic_write() validates the fields that are specific to an atomic write, but never the range that the command addresses. Every other command that writes user data calls check_device_access_params() first, which rejects a transfer that ends beyond the capacity of the device, one whose length exceeds the size of the store, and any write to a write protected device. Call check_device_access_params(). The zone checks that it ends with are unreachable, as atomic writes and ZBC emulation are mutually exclusive. Assisted-by: LLM Fixes: 84f3a3c01d70 ("scsi: scsi_debug: Atomic write support") Reviewed-by: Damien Le Moal Reviewed-by: John Garry Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20260929082456.857423-28-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 491bd55c35cbb1ce059f22e7f3c6284551970fef Author: Niklas Cassel Date: Tue Sep 29 10:25:09 2026 +0200 scsi: scsi_debug: Map the region written by WRITE ATOMIC (16) When logical block provisioning is enabled, every command that writes user data calls map_region() so that GET LBA STATUS reports the region as mapped. resp_atomic_write() does not, so GET LBA STATUS keeps reporting a region as deallocated after a WRITE ATOMIC (16) has written it. Call map_region() the way resp_write_dt0() does, holding the zone metadata write lock across the access. That lock is what serialises the map against resp_unmap(), which does nothing unless logical block provisioning is enabled. Assisted-by: LLM Reviewed-by: Damien Le Moal Reviewed-by: John Garry Fixes: 84f3a3c01d70 ("scsi: scsi_debug: Atomic write support") Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20260929082456.857423-27-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b81608b17c5d04c797e6fc1cfb95182c842a4db9 Author: Niklas Cassel Date: Tue Sep 29 10:25:08 2026 +0200 scsi: scsi_debug: Refuse a short WRITE ATOMIC (16) before writing it A write whose data-out buffer is shorter than its transfer length is short. An ordinary write transfers what the buffer holds and reports the rest as a residual, but an atomic write cannot be short: SBC-6 r02 (T10/BSR INCITS 587), 4.28.1, requires each atomic write operation to write either all of its data or none of it, and 4.28.2 requires one that cannot complete to leave the LBAs that it specifies unaltered. resp_atomic_write() does fail a short WRITE ATOMIC (16) with DID_ERROR, but only after do_device_access() has returned, and do_device_access() copies one logical block at a time, so by then the blocks that the buffer did hold have been written. An eight block WRITE ATOMIC (16) with a buffer of four fails having overwritten the first four. Check the length of the buffer before writing anything, and fail the command with the same DID_ERROR as before. Assisted-by: LLM Reviewed-by: Damien Le Moal Reviewed-by: John Garry Fixes: 84f3a3c01d70 ("scsi: scsi_debug: Atomic write support") Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20260929082456.857423-26-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit cb2d2a7c80c62d1e5e476609706f29dd9584d0e0 Author: Niklas Cassel Date: Tue Sep 29 10:25:07 2026 +0200 scsi: scsi_debug: Advance the write pointer over the data written resp_write_dt0() and resp_write_scat() advance the write pointer of a sequential write required zone by the transfer length of the command without looking at what do_device_access() returned, which is -1 when the data direction of the command does not match the operation, and a short byte count when the data-out buffer is smaller than the transfer length. An initiator can produce both with SG_IO. The zone then describes more data than is on the medium, and a write at the position where the data really ends is terminated with UNALIGNED WRITE COMMAND, so the zone has to be reset before it can be written to again. Advance the write pointer over the data that was written instead. As do_device_access() does not write a partial physical block to such a zone, that leaves the write pointer where a write can end. Assisted-by: LLM Reviewed-by: Damien Le Moal Fixes: f0d1cf9378bd ("scsi: scsi_debug: Add ZBC zone commands") Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20260929082456.857423-25-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b8fad9f02485f179e35bc4677386b6608d8cefb0 Author: Niklas Cassel Date: Tue Sep 29 10:25:06 2026 +0200 scsi: scsi_debug: Do not write a partial physical block to a zoned device do_device_access() copies one logical block at a time and stops at the first short copy, so a data-out buffer smaller than the transfer length of the command can leave part of a physical block written. An initiator can arrange that with SG_IO. That is acceptable everywhere but a sequential write required zone, where ZBC-3 r06 (T10/BSR INCITS 579), 4.5.3.3.2, requires a write to end on a physical block boundary. For such a zone, stop at the last whole physical block that the buffer holds. The bytes left over are not written, and are reported to the initiator as part of the residual. Assisted-by: LLM Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20260929082456.857423-24-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 63cb3900be261fccc05cadcf3402058418a5fada Author: Niklas Cassel Date: Tue Sep 29 10:25:05 2026 +0200 scsi: scsi_debug: Enforce physical block alignment of zoned writes ZBC-3 r06 (T10/BSR INCITS 579), 4.5.3.3.2, requires a write to a sequential write required zone to be terminated with ILLEGAL REQUEST / UNALIGNED WRITE COMMAND both when it does not start at the write pointer and when it does not end on a physical block boundary. That is why sd_zbc_read_zones() sets the zone_write_granularity queue limit to the physical block size of a host-managed device. check_zbc_access_params() implements the first condition but not the second. So with zbc=managed sector_size=512 physblk_exp=3, a write of a single logical block at the write pointer is accepted and advances the write pointer by one logical block, leaving it off the granularity that was advertised: nothing can write at it any more, and the zone can only be used again after being reset. Check the ending LBA as well, with the same sense data, as the standard gives both conditions the same. An entire medium write same command, which the standard excludes, needs no special case: the preceding check already terminates it with WRITE BOUNDARY VIOLATION. Sequential write preferred zones are left alone, as writes to them need not be sequential, and with the default physblk_exp=0 the check is a no-op. Assisted-by: LLM Fixes: f0d1cf9378bd ("scsi: scsi_debug: Add ZBC zone commands") Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20260929082456.857423-23-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 7c000c4ad2c0a7b2da06ffe28f5a7489fc52ca2d Author: Niklas Cassel Date: Tue Sep 29 10:25:04 2026 +0200 scsi: scsi_debug: Report the residual of a write Documentation/scsi/scsi_mid_low_api.rst defines the residual as the length of the data buffer less the number of bytes actually transferred, so a write whose data buffer is larger than its transfer length leaves one. resp_read_dt0() and resp_write_tape() report it, but the write paths for a disk do not, so such a write completes with GOOD status and a residual of zero while a READ of the same length into the same buffer reports it correctly. Report it in resp_write_dt0(), resp_write_scat() and resp_atomic_write(). resp_write_scat() differs twice over. Its data-out buffer also holds the parameter list header and the LBA range descriptors, so what the command consumed is sg_off rather than the bytes that the last range transferred; and sg_off counts what was asked for rather than what was transferred, so it can exceed the buffer and needs a guard. A command with no LBA range descriptors or a buffer transfer length of zero transfers nothing, so the whole buffer is residual. An error, real or injected, can end the command after some ranges have been written, so the residual is reported on every exit once the parameter list has been fetched. Assisted-by: LLM Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20260929082456.857423-22-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 92feb036a2d33c7b78b8daa2384f5c70d6679a91 Author: Niklas Cassel Date: Tue Sep 29 10:25:03 2026 +0200 scsi: scsi_debug: Avoid 32-bit overflow in WRITE SCATTERED offsets resp_write_scat() computes the length of an LBA range in bytes as a 32-bit product, num_by = num * lb_size, and adds it to sg_off, the 32-bit offset of the next range in the data-out buffer. The product wraps for a range of 4 GiB or more, which check_device_access_params() allows once the store is that large, and sg_off wraps once the ranges add up to 4 GiB, which neither their number nor their overlap prevents. The ranges that follow are then written from the wrong offset in the buffer. Make num_by and sg_off 64-bit, and pass do_device_access() sg_off capped at the length of the buffer. An offset at the end of the buffer copies nothing, and sg_copy_buffer(), which takes it as an off_t, is never given one larger than the buffer that it copies. Assisted-by: LLM Fixes: 481b5e5c7949 ("scsi: scsi_debug: add resp_write_scat function") Signed-off-by: Niklas Cassel Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260929082456.857423-21-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 1809f9bf3da24d513613e3bfbb97db91fd4928b4 Author: Niklas Cassel Date: Tue Sep 29 10:25:02 2026 +0200 scsi: scsi_debug: Evaluate scsi_debug_lbp() only once corrupt_lbas(), resp_write_dt0() and resp_write_same() call scsi_debug_lbp() to decide whether to take the zone metadata lock, and call it again to decide whether to touch the provisioning map that the lock protects. The result is not constant: scsi_debug_lbp() is false while fake_rw is set, and fake_rw is writable at runtime, both as a module parameter and through its driver attribute. The second call can therefore touch the map after the first decided not to take the lock. Call it once and use the result throughout. Assisted-by: LLM Reviewed-by: Damien Le Moal Reviewed-by: John Garry Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20260929082456.857423-20-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit c9aedbcbff0fe31fabdea09600609eb30e05441d Author: Niklas Cassel Date: Tue Sep 29 10:25:01 2026 +0200 scsi: scsi_debug: Take the zone metadata lock before the data lock resp_comp_write() takes the data lock and then the zone metadata lock, while every other command that takes both takes the metadata lock first and reaches the data lock through do_device_access(). A COMPARE AND WRITE and any other write to the same store can therefore deadlock each other. Take the locks in the same order as everywhere else. Correct the comment above map_region() while here: the provisioning map is covered by the metadata lock rather than the data lock, which is why resp_unmap() takes only the metadata lock. Assisted-by: LLM Fixes: 84f3a3c01d70 ("scsi: scsi_debug: Atomic write support") Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20260929082456.857423-19-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit a349876633f7a583429367daf16f9a4282118255 Author: Niklas Cassel Date: Tue Sep 29 10:25:00 2026 +0200 scsi: scsi_debug: Refuse a negative physblk_exp sdebug_init() refuses a physblk_exp above 15, but the parameter is a signed int, so a negative value is accepted. The driver then shifts by it when it builds the Block Limits VPD page, which is undefined behaviour, and READ CAPACITY (16) reports an exponent of 15 for -1. Refuse a negative value as well, and print it as a signed value. Assisted-by: LLM Fixes: ea61fca58c13 ("scsi_debug: Add support for physical block exponent and alignment") Signed-off-by: Niklas Cassel Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260929082456.857423-18-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit e5ebe632be40c60ca8d96c8265c9c8c8136aff4a Author: Niklas Cassel Date: Tue Sep 29 10:24:59 2026 +0200 scsi: scsi_debug: Make atomic writes and ZBC emulation mutually exclusive There are no SMR drives that support atomic writes, so emulating a device with both emulates something a user cannot encounter, and means maintaining the zone handling of a command that no zoned device implements. Nothing in the standards forbids the combination, and for a host managed drive whose logical block size equals its physical block size there is no problem in it either: the vendor only has to give atomic writes an alignment that makes sense with regards to ZBC. This is a choice not to complicate scsi_debug. Refuse the combination at initialisation. It can be changed back if such drives ever appear. Suggested-by: Damien Le Moal Assisted-by: LLM Reviewed-by: Damien Le Moal Reviewed-by: John Garry Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20260929082456.857423-17-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 45ce384be0cd83116f8440378beef138b9e92a2b Author: Niklas Cassel Date: Tue Sep 29 10:24:58 2026 +0200 scsi: scsi_debug: Refuse a zoned device with a non-zero lowest aligned LBA scsi_debug reports the lowest_aligned module parameter in the LOWEST ALIGNED LOGICAL BLOCK ADDRESS field, see SBC-6 r02 (T10/BSR INCITS 587), 5.20.2, but nothing else in the driver acts on it. On a zoned device a non-zero value puts the start of every zone in the middle of a physical block. ZBC requires a write to a sequential write required zone to end on a physical block boundary, so a host writing in units of the reported zone write granularity could never write such a zone at all. Refuse the combination rather than emulate a device that cannot be used. Assisted-by: LLM Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel Link: https://patch.msgid.link/20260929082456.857423-16-cassel@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit d2398f2e2e5d3ad3ff0542fb12009b709045dbd8 Author: Bart Van Assche Date: Fri Sep 25 11:09:45 2026 -0700 scsi: core: Micro-optimize the hot path Every code path that inserts scmd->eh_entry into a list uses list_add_tail() (see also scsi_abort_command() and scsi_eh_scmd_add()). list_add_tail() overwrites the next and prev pointers. Hence, the only code that depends on the initialization of scmd->eh_entry is the BUG_ON(!list_empty(&scmd->eh_entry)) statement in scsi_abort_command(). Remove this statement because scsi_timeout() already prevents scsi_abort_command() from being called twice for the same command by setting SCMD_STATE_COMPLETE. Remove the scmd->eh_entry initialization because the only statement that relied on this initialization has been removed. Cc: John Garry Cc: Hannes Reinecke Signed-off-by: Bart Van Assche Reviewed-by: John Garry Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/1ac0d4d0c06e55943e188d0dee9b6f2475715f21.1790359761.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 931a0649b9a8da36d63b108262ba82a41cd5ded3 Author: Bart Van Assche Date: Fri Sep 25 11:08:59 2026 -0700 scsi: core: Fix scsi_done() documentation Commit 11b68e36b167 ("scsi: core: Call scsi_done directly") changed scsi_done from a function pointer member into a regular function. Replace all references to the scsi_done function pointer member with references to the scsi_done() function. Cc: John Garry Cc: Hannes Reinecke Cc: Damien Le Moal Cc: Jonathan Corbet Signed-off-by: Bart Van Assche Reviewed-by: Damien Le Moal Reviewed-by: John Garry Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/9d10e1068d75c1a708b3a56e85782d651411fe06.1790359673.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 698577ef1a023b7c894b9728d57f43d89de3c821 Author: Martin K. Petersen (Oracle) Date: Sat Oct 3 09:36:07 2026 -0400 scsi: mpi3mr: Fix merge error Fix a double put introduced while resolving a merge conflict between v7.3-rc2 and v7.4/scsi-staging. Reported-by: Mark Brown Reported-by: Geert Uytterhoeven Suggested-by: Ranjan Kumar Fixes: 0b5b2fb484f3 "Merge tag 'v7.3-rc2' into 7.4/scsi-staging" Signed-off-by: Martin K. Petersen (Oracle) commit 55b6593276c8aeeb7dff2507028166337c13a30e Author: Shawn Guo Date: Tue Jul 28 13:11:04 2026 +0800 scsi: ufs: qcom: Enable MCQ support for sa8255p The sa8255p vops (fw-managed variant) was missing the MCQ hooks, causing the driver to silently fall back to SDB mode even when MCQ resource is available. Wire up the same MCQ ops used by the standard qcom vops, so that MCQ mode works on sa8255p. Signed-off-by: Shawn Guo Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260728051104.675088-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit d0105247ca7e281aac61216d8a641576200f262f Author: Kees Cook Date: Thu Sep 17 14:11:38 2026 -0700 scsi: hpsa: Make buff allocation type unsigned In preparation for converting the kmalloc family of allocators to the type-aware kmalloc_obj family, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (The kmalloc family returns "void *", which can be implicitly cast to any pointer type.) The assigned type is "unsigned char **", but the converted allocation type would be "char **", whose elements point to a character type of a different signedness, so the two pointer types are not compatible. Take the size from the assignment target instead. No change in allocation size results. Build tested ARCH=x86_64 allmodconfig with GCC 16.2.0: drivers/scsi/hpsa.o Assisted-by: LLM coccinelle Signed-off-by: Kees Cook Link: https://patch.msgid.link/20260917211137.i.357-kees@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 7dec5cedf7b248036da606c16f9f3f9aa350b417 Author: Peter Wang Date: Mon Sep 14 16:49:25 2026 +0800 scsi: ufs: core: Serialize AHIT register access between sysfs and host driver A race exists between ufshcd_auto_hibern8_update() and ufs_mtk_pwr_change_notify() when both paths concurrently access REG_AUTO_HIBERNATE_IDLE_TIMER. Additionally, the static local variable used to save/restore AHIT in the power change path is not re-entrant and may hold a stale value if a sysfs write races with a gear change. Introduce ahit_mutex and ahit_disable_depth in struct ufs_hba to serialize AHIT register access. The depth counter tracks how many host-driver paths have forced AHIT off; sysfs writes are suppressed while it is non-zero and the register is restored from hba->ahit only when the last disabler drops it to zero. Fixes: f5ca8d0c7a63 ("scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes") Signed-off-by: Peter Wang Reviewed-by: Chun-Hung Wu Link: https://patch.msgid.link/20260914085148.136429-3-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen (Oracle) commit 6efee14ca0aed33103ea17f4367da173f893442f Author: Peter Wang Date: Mon Sep 14 16:49:24 2026 +0800 scsi: ufs: core: Always notify POST_CHANGE even on gear switch failure Previously, POST_CHANGE was only notified on a successful gear switch. This could leave the host in an inconsistent state if resources were acquired in PRE_CHANGE (e.g. disabling auto-hibern8) but never released due to a missing POST_CHANGE. Fix this by always calling POST_CHANGE regardless of the gear switch result. On failure, pass dev_req_params = NULL to signal that there is nothing to apply; hosts that receive NULL simply skip their post work. Update the affected drivers (ufs-exynos and ufshcd-pci) to guard their POST_CHANGE logic with a NULL check so they correctly handle the failure case. Fixes: f5ca8d0c7a63 ("scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes") Signed-off-by: Peter Wang Reviewed-by: Chun-Hung Wu Link: https://patch.msgid.link/20260914085148.136429-2-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen (Oracle) commit 00eec343c7306be7f1103f5002abd77496937ff9 Author: Stanley Jhu Date: Fri Sep 11 10:43:19 2026 +0800 scsi: ufs: core: Dynamically disable timestamp on unsupported devices JEDEC JESD220F specifies that the Timestamp attribute (qTimestamp) is an optional feature for UFS devices. Some compliant UFS 4.0 devices do not implement it and return QUERY_RESULT_INVALID_IDN (0xFD). ufshcd_set_timestamp_attr() gates the write on wspecversion >= 0x400 and the absence of UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT. Neither covers a device that advertises UFS 4.0 but declines the attribute, so the write is reissued on every boot and every resume. Record the capability in struct ufs_dev_info and clear it when the device answers -EOPNOTSUPP, so the write is not retried. -ETIMEDOUT and -EIO still reach dev_err(); they are transient and must not disable the attribute. Signed-off-by: Stanley Jhu Tested-by: Xilin Wu Link: https://patch.msgid.link/20260911024319.1346706-3-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit d1fa5cea5dcd72a9ec21b835c572a28c0c3f4fbf Author: Stanley Jhu Date: Fri Sep 11 10:43:18 2026 +0800 scsi: ufs: core: Fast-abort unsupported Query IDNs JEDEC JESD220F specifies that devices not supporting an optional Query IDN return QUERY_RESULT_INVALID_IDN (0xFD) in the Query Response UPIU. ufshcd_dev_cmd_completion() maps all non-zero Query responses to -EINVAL and logs dev_err(). A device declining an optional IDN is spec-compliant, so this reports an error that did not occur and leaves the retry loops resending a request the device will never accept. Decode 0xFD as -EOPNOTSUPP, terminate the query retry loops on it, and drop the dev_err() in the query wrappers and descriptor readers for that case. Other errors are logged and retried as before. The suppressed dev_err() calls carried the opcode and IDN; log them with dev_dbg() where the response is decoded. Signed-off-by: Stanley Jhu Tested-by: Xilin Wu Link: https://patch.msgid.link/20260911024319.1346706-2-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 0b1a79f2791a06f139dce5450e487307cf0e241f Author: Fan Wu Date: Fri Sep 11 02:05:44 2026 +0000 scsi: dc395x: sync the waiting_timer before freeing the host The waiting_timer callback re-arms itself and takes the host lock. adapter_uninit() currently stops it with timer_delete(), which does not wait for a callback already running on another CPU. The final scsi_host_put() that frees the host (and the host lock the callback dereferences) runs right after adapter_uninit(), so a concurrent or just re-armed callback can fire after the free, leaving a potential use-after-free window. Replace timer_delete() with timer_shutdown_sync() at the top of adapter_uninit(), before the host-lock section: the timer is dequeued, a running callback is waited for and rearming is blocked before the chip is halted, so it cannot fire at all once the adapter has ceased to function. Waiting outside the lock avoids the self-deadlock that would result from syncing a callback blocked on the lock we still hold. No shutdown is needed for selto_timer because it has no reachable armer or callback. This issue was found by an in-house static analysis tool. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Cc: Jamie Lenehan Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu Link: https://patch.msgid.link/20260911020544.42966-1-fanwu01@zju.edu.cn Signed-off-by: Martin K. Petersen (Oracle) commit 85de8b3a5eaa23d153aff4c7c83dddbc949064c9 Author: Runyu Xiao Date: Thu Sep 10 17:24:05 2026 +0800 scsi: qedi: Initialize callback state before registration qedi_get_protocol_tlv_data() can be called asynchronously by QED after qedi_ops->register_ops(). It takes stats_lock and reads ll2_mtu, but __qedi_probe() currently registers the callback before initializing the mutex and assigning the default MTU on the normal probe path. Initialize the callback-visible state before registering qedi_cb_ops. Keep the recovery path from reinitializing state because it reuses the existing qedi context. Fixes: 3cc5746e5ad7 ("scsi: qedi: Initialize the stats mutex lock") Cc: stable@vger.kernel.org Assisted-by: LLM Codex Signed-off-by: Runyu Xiao Link: https://patch.msgid.link/20260910092405.1300129-1-runyu.xiao@seu.edu.cn Signed-off-by: Martin K. Petersen (Oracle) commit 02a3178319639f650428164d4d003de4dc03e326 Author: Naomi Chu Date: Wed Sep 9 17:10:45 2026 +0800 scsi: ufs: core: Hold a clock reference across the probe Clock gating becomes possible as soon as ufshcd_init_clk_gating() has run, and from that point on the probe keeps accessing host registers without ever taking a clock reference. This has been safe only because of the state check in __ufshcd_release(): gate_work is not queued unless hba->ufshcd_state is UFSHCD_STATE_OPERATIONAL, and the promotion to that state used to happen after the last register access of the probe, at the end of ufshcd_probe_hba(). That is fragile: it only works while the promotion happens after the register accesses. Commit a390e6677f41 ("scsi: ufs: core: Expand the ufshcd_device_init(hba, true) call") changed that ordering by moving the promotion into ufshcd_init(), which schedules ufshcd_async_scan() afterwards. ufshcd_probe_hba() therefore now runs with the state already promoted, and it accesses host registers without holding a clock reference: - On hosts with UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH it calls ufshcd_hba_stop() and ufshcd_hba_enable() before ufshcd_device_init() sets the state back to UFSHCD_STATE_RESET, and both read REG_CONTROLLER_ENABLE, so gated clocks stall there instead of just losing a write. - It ends with an ufshcd_configure_auto_hibern8() write, which its other callers do take a clock reference for. Take a clock reference as soon as clock gating has been initialised and keep it until the probe is over. It then does not matter who drops a clock reference while the probe is running, and the register accesses of the probe no longer depend on hba->ufshcd_state. The reference is dropped by ufshcd_async_scan() once the scan has finished, or by the new out_release label if the probe fails after it was taken. Fixes: a390e6677f41 ("scsi: ufs: core: Expand the ufshcd_device_init(hba, true) call") Signed-off-by: Naomi Chu Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260909091045.1134956-1-naomi.chu@mediatek.com Signed-off-by: Martin K. Petersen (Oracle) commit f09d2c7485b32adb82336d0d748935c8237a649e Author: Peng Fan Date: Sat Sep 19 21:08:52 2026 +0800 scsi: target: core: Use assign_bit() where applicable Convert open-coded if/else with set_bit/clear_bit to the assign_bit API. Signed-off-by: Peng Fan Reviewed-by: Bodo Stroesser Link: https://patch.msgid.link/20260919130853.3041614-1-peng.fan@oss.nxp.com Signed-off-by: Martin K. Petersen (Oracle) commit 3b7ccba37858dd3d7d3780eb42ab943152e5b7ec Author: Damien Le Moal Date: Fri Sep 18 15:29:59 2026 +0900 scsi: core: Fix additional sense code definition The ASC() macro used to define an additional sense code with no additional sense code qualifier conflicts with the ASC macro definition of the file arch/sparc/include/asm/ns87303.h, leading to compilation errors. Avoid this conflict by renaming the macro as SCSI_ASC() and the ASC_DEF() macro to SCSI_ASC_DEF() to be consistent. Reported-by: kernel test robot Fixes: 72c54bd0cbb2 ("scsi: core: Define all additional sense codes and their qualifiers") Closes: https://lore.kernel.org/oe-kbuild-all/202609180743.kyprDg18-lkp@intel.com/ Signed-off-by: Damien Le Moal Link: https://patch.msgid.link/20260918062959.2245533-1-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit e6687d574bbe142751bcfa6dd0f42d5abd1c2756 Author: Ranjan Kumar Date: Wed Sep 16 13:57:05 2026 +0530 scsi: mpi3mr: Driver version update to 8.18.0.8.50 Update driver version to 8.18.0.8.50 Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-11-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit c90693e02d10e9318f2f7cc480e9b05430628738 Author: Ranjan Kumar Date: Wed Sep 16 13:57:04 2026 +0530 scsi: mpi3mr: Fix SAS PHY cleanup in host addition error paths When adding a SAS host, the driver allocates a PHY array and subsequently creates individual SAS PHYs. If a later step fails, the error path exits without cleaning up previously allocated resources, resulting in leaks of both the PHY array and any registered SAS PHYs. Additionally, the return value of mpi3mr_add_host_phy() was being ignored. If it failed, mr_sas_phy->phy would be left as NULL, which could later lead to a NULL pointer dereference in mpi3mr_sas_port_add() when the attached device triggers a device addition event. Add a dedicated cleanup path that deletes any successfully created SAS PHYs and frees the PHY array before returning from initialization failure paths. Also, check the return value of mpi3mr_add_host_phy() and jump to the cleanup path on failure. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=9 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-10-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 29e3f0856e8544ca185be3403518a102e0ca29fc Author: Ranjan Kumar Date: Wed Sep 16 13:57:03 2026 +0530 scsi: mpi3mr: Fix SAS port allocation and registration error handling During SAS port creation, the driver does not verify successful port allocation before attempting registration, which can lead to a NULL pointer dereference. Additionally, if registration fails, the allocated port is not freed, resulting in a memory leak. Fix this by adding a NULL check after allocation and freeing the port when registration fails. Additional fixes in the error handling path include: 1. Fixing similar missing NULL checks for rphy allocations. 2. Cleaning up after a failed rphy registration tried to remove a device that was never added, causing a crash. The rphy is now freed directly instead. 3. A failed rphy registration left the target device with a dangling pointer and a stuck pending flag. Both are now cleared. 4. Phys removed on error kept an internal flag set, permanently blocking them from being added to a port again. Now cleared alongside the list removal. 5. Could block in the SCSI mid-layer after a stop or reset had already begun, the same ABBA deadlock class fixed elsewhere. The port allocation path now stops before that call once that is detected. 6. The same reset check on the port removal path caused a memory leak and a kernel BUG() on rediscovery. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=8 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=8 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=8 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=8 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-9-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 59f8c361872df3df9c47ad612a4562cd08441cc5 Author: Ranjan Kumar Date: Wed Sep 16 13:57:02 2026 +0530 scsi: mpi3mr: Fix firmware event reference leak during cleanup During firmware event cleanup, when an event is currently executing or pending at the SCSI mid-layer, the driver sets a discard flag and exits the cleanup routine early. This early exit skips the normal cancel path, resulting in the firmware event reference count not being decremented, leading to a reference leak. Additionally, resolve the following concurrency issues in the firmware event handling paths: 1. mpi3mr_cleanup_fwevt_list() read current_event locklessly. It is now acquired under fwevt_lock. 2. mpi3mr_dequeue_fwevt() dropped the reference before returning it, risking a use-after-free. The drop is now moved into mpi3mr_cancel_work(). 3. mpi3mr_fwevt_bh() dropped fwevt_lock mid-move, racing with unload. The move is now inlined under one continuous lock hold. 4. pending_at_sml was read/written without a lock, risking an ABBA deadlock. It is now protected by fwevt_lock throughout. 5. mpi3mr_suspend() could unmap PCI resources before the event worker finished. It now flushes the workqueue first. 6. mpi3mr_report_tgtdev_to_host() and mpi3mr_remove_tgtdev_from_host() could still set pending_at_sml and block in the SCSI mid-layer after a stop or reset had already begun, deadlocking against the thread waiting on that flag. Both now bail out beforehand once stop_drv_processing or reset_in_progress is set. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=7 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=7 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=7 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-8-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit ea8dfd05a0fcabe3ea8bb8a3b9e45b5170a210a2 Author: Ranjan Kumar Date: Wed Sep 16 13:57:01 2026 +0530 scsi: mpi3mr: Fix memory leak on operational queue creation failure When operational queue creation fails after one or more queues have been created, the error path frees the queue information arrays but does not release the DMA memory segments associated with the created queues, resulting in a memory leak. Fix this by ensuring that partially allocated segments are freed immediately if a queue fails to create. Additionally, resolve the following issues in the queue segment free/alloc paths: 1. Clear mrioc->intr_info[].op_reply_q with WRITE_ONCE() and follow it with synchronize_irq() before freeing segments, and have the ISR paths read it once via READ_ONCE() into a local, to close a race where the ISR could use the pointer while it is being freed. 2. Free q_segment_list before checking q_segments in both free functions, since a kzalloc_objs() failure on q_segments left q_segment_list leaked via the early return. 3. The threaded poll handler returned without re-enabling the interrupt when the reply queue was already gone, leaving that interrupt line permanently masked. It now re-enables it before returning. 4. Two other callers read the same pointer without a NULL check, which could now be reached with a NULL value. Add the check at the single point they both call through, and read the pointer consistently with the writer above. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=6 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=6 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=6 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=6 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-7-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 7342b9f0e3065c086605f075a204972d270b267b Author: Ranjan Kumar Date: Wed Sep 16 13:57:00 2026 +0530 scsi: mpi3mr: Fix performance regression caused by extended IRQ poll sleep Commit 24d7071d9645 ("scsi: mpi3mr: A performance fix") increased the threaded IRQ poll sleep range from 2-20 us to 20-21 us to work around a timer slack issue. On kernels unaffected by the timer slack issue, the longer sleep interval reduces reply queue processing efficiency and causes an approximately 7% throughput regression on NVMe direct-attached RAID10 configurations. Restore the IRQ poll sleep base to 2 us (widening the usleep_range() upper bound to 10x the base instead of a fixed +1 us) to recover the lost throughput, and skip the sleep entirely once pend_ios reaches 0 so the poll loop exits immediately at the tail of a completion burst. Additionally, resolve the following issues in the reply queue processing and polling logic: 1. Add missing dma_rmb() memory barriers in the admin and operational reply queue processing loops. This ensures that the descriptor payload is only read after the phase bit check is complete, preventing weakly ordered architectures from speculatively processing stale data. 2. Add bounds checking for `request_queue_id` in mpi3mr_process_op_reply_q(). An out-of-range id is now logged and the descriptor is retired (consumer index advanced, phase toggled on wraparound) rather than aborting the loop in place, which previously left the same corrupted descriptor at the head of the ring forever and stalled polling indefinitely. It is not counted toward pend_ios, since no real completion was processed for it. 3. Recheck for a late-arriving descriptor via dma_rmb() while still holding op_reply_q->in_use, instead of releasing it and reclaiming it afterward, which could race and reprocess a descriptor with stale indices or double-decrement in_use. 4. Replace a direct panic() call with a safe ioc_err() log and abort in mpi3mr_process_op_reply_desc() when mpi3mr_get_reply_virt_addr() returns NULL. This prevents a single malformed DMA reply address from crashing the entire host OS. The reply_dma output parameter is also cleared before returning, since it was already populated with the unvalidated address before the NULL check. Leaving it set would make the caller repost that unvalidated address back to the hardware. Note: The unbounded busy-wait loop (usleep_range) in mpi3mr_isr_poll() flagged by automated review is intentionally retained. This short sleep polling mechanism is critical for batching completions and achieving the target throughput on high-performance NVMe configurations. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=5 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=5 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=5 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=5 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-6-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit fb8b6139770a5dee8ace9e605b5c3d11861506c8 Author: Ranjan Kumar Date: Wed Sep 16 13:56:59 2026 +0530 scsi: mpi3mr: Fix NVMe page size caching for non-operational devices For NVMe devices in an error state, the cached PCIe page size remains unset. This causes management IOCTL validation to fail, preventing requests from reaching firmware and returning incorrect errors to userspace. Populate the page size attribute irrespective of device access status so firmware can process IOCTLs and report appropriate errors. Additionally, harden the device initialization path against invalid firmware data for non-operational devices: 1. Add bounds checking for page_size, falling back to 4096 bytes (shift exponent 12) to prevent undefined shift behavior and kernel panics. The minimum valid NVMe page size shift is 12 and maximum is 27. 2. Initialize reset_to and abort_to timeouts with default values to prevent IOCTLs from failing instantly. To avoid race conditions where concurrent readers might observe these default timeouts before they are updated with firmware values, use local variables to compute the final values before writing them to the device structure. 3. Read the firmware-provided page size once into a local variable before validating and using it, since it lives in memory the device can also write to. Using it directly in both the check and the assignment allowed the two to observe different values. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=4 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=4 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=4 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=4 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-5-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 48c666139acfef3bce5cc337b7d2cc2e089f87b5 Author: Ranjan Kumar Date: Wed Sep 16 13:56:58 2026 +0530 scsi: mpi3mr: Add early timestamp synchronization after driver load When the driver is loaded from initramfs, the controller timestamp may be initialized before the system clock has been synchronized. As a result, the controller can operate with a stale timestamp until the first periodic synchronization occurs. Currently, the first controller timestamp synchronization occurs only after the configured ts_update_interval expires (15 minutes by default). Add an early timestamp synchronization 60 seconds after driver load, followed by the existing periodic synchronization interval. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-4-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 1567cd497fa98a078c60224766021556085bc662 Author: Ranjan Kumar Date: Wed Sep 16 13:56:57 2026 +0530 scsi: mpi3mr: Update MPI Headers to revision 41 Update MPI Headers to revision 41 Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-3-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit ab21857b2715ec3c7f53d16c9449370fbdebfc37 Author: Ranjan Kumar Date: Wed Sep 16 13:56:56 2026 +0530 scsi: mpi3mr: Skip device shutdown during unload per controller configuration The controller may be configured through Driver Page 1 to suppress device shutdown requests during driver unload. Cache this setting and skip the device shutdown request during IOC shutdown when unloading the driver. Additionally, ensure the driver_pg1 fields are properly converted from little-endian to CPU endianness using le32_to_cpu() and le16_to_cpu() before evaluating the shutdown disable flag and allocating diag buffers. This prevents failures and massive memory allocation errors on big-endian architectures. Also harden the diagnostic buffer allocation retry loops against invalid firmware-provided decrement sizes. The trace buffer loop already guarded against a zero or oversized decrement size (infinite loop or unsigned underflow). The firmware buffer loop had the same gap and now carries the same guard. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=1 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=1 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=1 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit cdc97921de02a0c1a8324afa03e8b3e30a72bbe6 Author: Bart Van Assche Date: Mon Aug 31 10:48:21 2026 -0700 scsi: pm8001: Fix SATA FIS offset in struct hw_event_resp In struct hw_event_resp, sas_identify was defined using struct sas_identify_frame, which is 32 bytes long because it includes a 4-byte CRC field. However, PM8001 and PM80xx hardware does not send the CRC in the event response frame, providing only the 28-byte identify payload. Because sas_identify had a size of 32 bytes, the following sata_fis member was located at byte offset 44 instead of the actual hardware offset 40. In hw_event_sata_phy_up(), this discrepancy was worked around with negative pointer arithmetic: ((u8 *)&pPayload->sata_fis - 4). This triggers a compiler error under Clang with -Wstringop-overread: error: 'memcpy' reading 20 bytes from a region of size 0 [-Werror,-Wstringop-overread] memcpy(phy->frame_rcvd, ((u8 *)&pPayload->sata_fis - 4), Move struct sas_identify_frame_local (28 bytes) into pm8001_defs.h, and update struct hw_event_resp in both pm8001_hwi.h and pm80xx_hwi.h to use struct sas_identify_frame_local followed by sata_fis and a 4-byte padding word. This correctly aligns sata_fis at byte offset 40 while maintaining the 64-byte total payload size. Update hw_event_sata_phy_up() in pm8001_hwi.c and pm80xx_hwi.c to copy directly from &pPayload->sata_fis. Compile-tested only. Both the patch and its description have been generated by Gemini. Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver") Fixes: f5860992db55 ("[SCSI] pm80xx: Added SPCv/ve specific hardware functionalities and relevant changes in common files") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/31963d53810f42970447e78ef46030ab13d2e91f.1788198434.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 42d1221d321e55afc7bba9109a77aaf5a817c8a3 Author: Bart Van Assche Date: Mon Aug 31 12:27:20 2026 -0700 scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() Protect the megasas_get_ctrl_info() call in megasas_resume() with instance->reset_mutex using scoped_guard(). megasas_get_ctrl_info() may release and reacquire instance->reset_mutex. Hence, calling this function without holding instance->reset_mutex is not safe. Fixes: c3b10a55abc9 ("scsi: megaraid_sas: Update controller info during resume") Cc: Kashyap Desai Cc: Sumit Saxena Cc: Shivasharan S Cc: Chandrakanth patil Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/f06b5ee432b21cf293f0663e15b64f75a84b9fd5.1788204406.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 15de2788c91cc407f7e6fc6a07be27b10048cbce Author: Damien Le Moal Date: Tue Sep 8 18:03:08 2026 +0900 scsi: core: Remove scsi_build_sense() and scsi_build_sense_buffer() Now that all code has been converted to use 16-bit sense codes and to initialize sense with scsi_set_sense() and scsi_set_sense_buffer(), remove the inline definitions of these new functions, change scsi_build_sense() and scsi_build_sense_buffer() to use a single 16-bit sense code as argument (instead of separate arguments for the ASC and ASCQ), and rename them to scsi_set_sense() and scsi_set_sense_buffer(). Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-41-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit ddfb3e0257b27f14847fd8a76159d7e43ce5fee8 Author: Damien Le Moal Date: Tue Sep 8 18:03:07 2026 +0900 scsi: core: Clean up scsi_proto.h Now that all users of SCSI sense codes have been modified to use macro definitions and the 16-bit sense code instead of separate 8-bit ASC and ASCQ, remove the now unused asc and ascq fields of struct scsi_failure and struct scsi_sense_hdr, and the old (and incomplete) definitions of SCSI additional sense codes and sense code qualifiers in scsi_proto.h. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-40-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 3f37a1a804fc02d43695fdfe290c0077c1ffaba8 Author: Damien Le Moal Date: Tue Sep 8 18:03:06 2026 +0900 scsi: s390: Use combined sense codes Use the 16-bit sense codes and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-39-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit c44f095a9d1768d9be6cf0c1b12e95619d6af9b4 Author: Damien Le Moal Date: Tue Sep 8 18:03:05 2026 +0900 scsi: ata: libata: Use combined sense codes Refactor libata core code to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Acked-by: Niklas Cassel Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-38-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 4152825a15d5f5d7a810e19a1e77a8561525b020 Author: Damien Le Moal Date: Tue Sep 8 18:03:04 2026 +0900 scsi: cdrom: Use combined sense codes Refactor the cdrom driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-37-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 134875ed31d4d866dbe3cd1a3461e76f08d030b4 Author: Damien Le Moal Date: Tue Sep 8 18:03:03 2026 +0900 scsi: usb: storage: Use combined sense codes Refactor the USB mass storage driver to replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-36-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9dd9bcb293f0fa575f497dd58172fcdcd2978113 Author: Damien Le Moal Date: Tue Sep 8 18:03:02 2026 +0900 scsi: target: Use combined sense codes Refactor the target core code to use the 16-bit sense codes for building sense and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-35-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 3f7abb6b35305a7da0575091ad5f7c9af0f37480 Author: Damien Le Moal Date: Tue Sep 8 18:03:01 2026 +0900 scsi: storvsc: Use combined sense codes Refactor the storvsc driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-34-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 3f94a6f129bf5bf2e634049d438b8794e019c17f Author: Damien Le Moal Date: Tue Sep 8 18:03:00 2026 +0900 scsi: hpsa: Use combined sense codes Refactor the hpsa driver to replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. The function decode_sense_data() is also modified to take a pointer to a 16-bit sense_code variable in place of the two pointers to the additional sense code and its code qualifier. The local definitions of ASCs and ASCQs are deleted too. No functional change intended, but the function hpsa_volume_offline() was checking only the addditional sense code qualifier with checking the additional sense code. This change assumes that the intended additional sense code to check is ASC_LU_NOT_READY. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Acked-by: Don Brace Link: https://patch.msgid.link/20260908090308.1085097-33-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 1b7ea7bb198e73a5237d3799187e46fe2b818ef5 Author: Damien Le Moal Date: Tue Sep 8 18:02:59 2026 +0900 scsi: scsi_debug: Use combined sense codes Refactor the scsi_debug driver to replace hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. The functions mk_sense_buffer() and mk_sense_info_tape() are modified to take a 16-bit sense code as argument. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-32-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 01526b511d8879dd3c2baa2cb09377d25524a8fe Author: Damien Le Moal Date: Tue Sep 8 18:02:58 2026 +0900 scsi: ibmvscsi_tgt: Use combined sense codes Refactor the IBM virtual SCSI target driver to use scsi_set_sense_buffer() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-31-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 077aa184ebb4dc3cc52c2dcb1b5ab3e5d4c8d4cc Author: Damien Le Moal Date: Tue Sep 8 18:02:57 2026 +0900 scsi: libiscsi: Use combined sense codes Refactor libiscsi to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-30-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit d6dba463d867120abad1ff6923e0c1c6cf3e896a Author: Damien Le Moal Date: Tue Sep 8 18:02:56 2026 +0900 scsi: mvumi: Use combined sense codes Refactor the Marvell UMI driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-29-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f1ba68cc9baf6619b7fbcbc13e35a0ce1a4ac6ee Author: Damien Le Moal Date: Tue Sep 8 18:02:55 2026 +0900 scsi: stex: Use combined sense codes Refactor the stex driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-28-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 6af632bcf0ac525b1237b2e5053f7bb2d41d939d Author: Damien Le Moal Date: Tue Sep 8 18:02:54 2026 +0900 scsi: lpfc: Use combined sense codes Refactor the lpfc driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-27-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit fd09d129d9f64b0abd346d20afd533ef96bb465b Author: Damien Le Moal Date: Tue Sep 8 18:02:53 2026 +0900 scsi: ps3rom: Use combined sense codes Refactor the PS3 DVD driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-26-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 374219068a9a69f94f56195969fe1d1a2a832bbf Author: Damien Le Moal Date: Tue Sep 8 18:02:52 2026 +0900 scsi: qla2xxx: Use combined sense codes Refactor the qla2xxx driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. While at it, the declaration function qlt_send_resp_ctio(), which is modified to take a single 16-bit sense code argument, is changed to a static function declaration since that function is used only in the file where it is defined. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-25-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit aa5d14a035c5cca63a910c7ff183fbb0da9bbce5 Author: Damien Le Moal Date: Tue Sep 8 18:02:51 2026 +0900 scsi: smartpqi: Use combined sense codes Refactor the smartpqi driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Acked-by: Don Brace Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-24-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 6e9db936a1676c71dc9ab47560768b5e03429daf Author: Damien Le Moal Date: Tue Sep 8 18:02:50 2026 +0900 scsi: myrb: myrs: Use combined sense codes Refactor the Mylex RAID controller driver to use scsi_set_sense() and the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-23-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 0c4d570067fdb2db6238b48e03ace739797f94d0 Author: Damien Le Moal Date: Tue Sep 8 18:02:49 2026 +0900 scsi: megaraid: Use combined sense codes Refactor the megaraid driver to use the scsi_set_sense() function and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-22-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9141a92896e24e90b1254261470ef63df7c12dd7 Author: Damien Le Moal Date: Tue Sep 8 18:02:48 2026 +0900 scsi: leapraid: Use combined sense codes Refactor the leapraid driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. With this change, the locally defined macros for ASC and ASCQ values are deleted. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-21-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f2a39d466867e34c51dad4ef1a514b1c00d5ca19 Author: Damien Le Moal Date: Tue Sep 8 18:02:47 2026 +0900 scsi: 3w-xxxx: Use combined sense codes Modify the function tw_scsi_queue_lck() of the 3w-xxxx driver to use scsi_set_sense() and replace the hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-20-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit c9852524e91bc53c3f22d0a75e011f96d7fdb669 Author: Damien Le Moal Date: Tue Sep 8 18:02:46 2026 +0900 scsi: mpi3mr: Use combined sense codes Refactor the mpi3mr driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-19-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f2e04ffb273e60aba6d39fc0c591bd1d8f4d9018 Author: Damien Le Moal Date: Tue Sep 8 18:02:45 2026 +0900 scsi: mpt3sas: Use combined sense codes Refactor the mpt3sas driver to replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-18-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 8c88a8614870903ea2a454cac0851a3198bc93ce Author: Damien Le Moal Date: Tue Sep 8 18:02:44 2026 +0900 scsi: device_handlers: alua: Use combined sense codes Refactor the SCSI ALUA devie handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-17-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9f543ed64b1ea0f02af797cc1a88137651aa41fe Author: Damien Le Moal Date: Tue Sep 8 18:02:43 2026 +0900 scsi: device_handlers: emc: Use combined sense codes Refactor the EMC SCSI device handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-16-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 5c0ae0bcee35b9864702cd7866d2acf618ff9fb3 Author: Damien Le Moal Date: Tue Sep 8 18:02:42 2026 +0900 scsi: device_handlers: rdac: Use combined sense codes Refactor the NetApp E-Series RDAC SCSI device handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-15-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 700ab5e27925f883888501e9e2630ad8b8da49f7 Author: Damien Le Moal Date: Tue Sep 8 18:02:41 2026 +0900 scsi: device_handlers: hp_sw: Use combined sense codes Refactor the HP sw device handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-14-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9a21d5e12153f13b95213e0bf0c65b4a381b0ca9 Author: Damien Le Moal Date: Tue Sep 8 18:02:40 2026 +0900 scsi: st: Use combined sense codes Refactor the SCSI tape driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-13-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit fdec4b3a173570d5304ea78e690375acfd8a722e Author: Damien Le Moal Date: Tue Sep 8 18:02:39 2026 +0900 scsi: ch: Use combined sense codes Refactor the SCSI media changer driver to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-12-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 28e463a7be2d5f6a9abffeeb6e232b000d40e10c Author: Damien Le Moal Date: Tue Sep 8 18:02:38 2026 +0900 scsi: ses: Use combined sense codes Refactor the SCSI stroage enclosure driver to use the 16-bit sense_code field of struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-11-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b1d3523f87d6e42c55a9d640afe7e1b34caa5ecf Author: Damien Le Moal Date: Tue Sep 8 18:02:37 2026 +0900 scsi: sr: Use combined sense codes Refactor the SCSI CDROM driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-10-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b9d5da78ffda56be2c421ad064dbd777ffc42269 Author: Damien Le Moal Date: Tue Sep 8 18:02:36 2026 +0900 scsi: sd: Use combined sense codes Refactor the SCSI disk driver to use as much as possible the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-9-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 85952eaa682a4ea3dd4ce3875013e2aaf8000f88 Author: Damien Le Moal Date: Tue Sep 8 18:02:35 2026 +0900 scsi: core: Use combined sense codes Refactor the SCSI core code to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended, with the exception of a correction of the array any_sense_failure_defs in scsi_lib_test_any_sense() which erroenously sets result to SCMD_FAILURE_RESULT_ANY instead of SAM_STAT_CHECK_CONDITION and does not sets sense_key to SCMD_FAILURE_SENSE_KEY_ANY. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-8-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 319c440e4e4599a0d521479c883e09481946d26b Author: Damien Le Moal Date: Tue Sep 8 18:02:34 2026 +0900 scsi: core: Use struct scsi_sense_hdr to log sense keys and codes Instead of passing the sense key, additional sense code and additional sense code qualifier as separate parameters, change the functions scsi_extd_sense_format(), scsi_format_extd_sense(), and usb_stor_show_sense() to take a pointer to a struct scsi_sense_hdr to access the sense key and sense code with a single argument. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-7-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit ec5562d3ea803ec45831477129c626b2a22d2e2c Author: Damien Le Moal Date: Tue Sep 8 18:02:33 2026 +0900 scsi: core: Prepare for using combined sense codes In preparation for handling sense codes and their qualifers as a single 16-bit sense code field, with the values defined as macros in include/scsi/scsi_sense.h, modify the definition of the structures scsi_failure and scsi_sense_hdr to introduce a 16-bit sense_code field as a union with the existing 8-bit asc and ascq fields. This temporary modification allows accessing either the asc and ascq fields individually, or their combination as the 16-bit sense_code field. The helper functions scsi_sense_asc(), scsi_sense_ascq() are defined to allow accessing the 8-bit ASC and ASCQ values from the sense_code filed of struct scsi_sense_hdr. The helper functions scsi_failure_asc() and scsi_failure_ascq() provide the same for the sense code field of struct scsi_failure. The helper functions scsi_set_sense_buffer() and scsi_set_sense() are also added to wrap calls to scsi_build_sense_buffer() and scsi_build_sense() using a 16-bit sense code argument instead of the 8-bit ASC and ASCQ arguments. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-6-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 45cdf8164237277e52af5d8aa4218c3cb6199bf2 Author: Damien Le Moal Date: Tue Sep 8 18:02:32 2026 +0900 scsi: core: Rename sense field of struct scsi_failure Rename the sense field of struct scsi_failure to sense_key. This makes it clear that this field stores the sense key, and also unifies this structure field names with the names used in struct scsi_sense_hdr. To be consistent with this change, the macro SCMD_FAILURE_SENSE_ANY is renamed SCMD_FAILURE_SENSE_KEY_ANY. Of note is that the definition of the array any_sense_failure_defs in scsi_lib_test_any_sense() is modified to change the initialization of the result field to use SCMD_FAILURE_RESULT_ANY and add the .sense_key field initialization to SCMD_FAILURE_SENSE_KEY_ANY to match the test target case. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-5-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit c5c4382c2a1cf059248ab05a0c49a8935c0b89a3 Author: Damien Le Moal Date: Tue Sep 8 18:02:31 2026 +0900 scsi: core: constants: Rename internal struct field names To make the code more clear, rename the code12 field of struct error_info to the more natural name "code" and the fields code1, code2_min and code2_max of struct error_info2 to the more explicit asc, ascq_min and ascq_max. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-4-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 84517868c12dd4e06c1a08793f5687ec43961dd4 Author: Damien Le Moal Date: Tue Sep 8 18:02:30 2026 +0900 scsi: core: constants: Use defined sense codes The SENSE_CODE() macro is used for defining the array of struct error_info which associates a string description to an additional sense code and its combinations with additional sense code qualifiers. These are however hardcoded values. Now that all 16-bit sense codes are defined as macros in include/scsi/scsi_sense.h, modify sense_codes.h to use the defined sense code macros. While doing this, 2 missing entries are added for the codes OVERLAPPING_ATOMIC_COMMAND_IN_PROGRESS and DEPOPULATION_RESTORATION_INTERRUPTED. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-3-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 72c54bd0cbb2e0c35f4acd056e91c596469edc5f Author: Damien Le Moal Date: Tue Sep 8 18:02:29 2026 +0900 scsi: core: Define all additional sense codes and their qualifiers Introduce the file include/scsi/scsi_sense.h to define all existing additional sense codes and their combinations with additional sense code qualifiers, according to the most current T10 list available at https://www.t10.org/lists/asc-num.txt. Additional sense codes (ASCs) are individually defined as an 8-bit value with the ASC_ name prefix. The combination of all ASCs with T10 defined possible code qualifiers are defined as 16-bit values without any name prefix. The 16-bit value for ASCs with a zero ASCQ are defined together with the ASC 8-code using the ASC() macro. For names that may potentially create conflicts with other subsystems (e.g. WARNING or WRITE_ERROR), the SSC_ prefix is added to the sense code name. The sense key macro definitions in include/scsi/scsi_proto.h are also moved into this new file and scsi_sense.h is included in scsi_proto.h. The helper function scsi_sense_code() is defined to facilitate generating a 16-bit sense code from the 8-bit ASC and ASCQ. The accessors scsi_sense_code_asc() and scsi_sense_code_ascq() are defined for the reverse operations, that is, to respectively extract an ASC and an ASCQ from a 16-bit sense code. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-2-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b6ec0f79745967c751c85df373062c8d15e45fc4 Author: ZHOU Jiaxiang Date: Wed Sep 16 21:58:22 2026 +0800 scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit. Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_idx, which overflows past INT_MAX. Reject devices reporting more than INT_MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping. Fixes: 89d947561077 ("sd: Implement support for ZBC devices") Signed-off-by: ZHOU Jiaxiang Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/C41798AB5AA6BF2B+20260916135822.32584-3-me@fxti.xyz Signed-off-by: Martin K. Petersen (Oracle) commit 7c431d61b69a3fd0784c20aa4cd0b8fb501b5653 Author: ZHOU Jiaxiang Date: Wed Sep 16 21:58:21 2026 +0800 scsi: block: Fix zones_cond out-of-bounds write on zone report blk_revalidate_disk_zones() sizes the zones_cond array from the disk capacity and zone size, but the index used by blk_revalidate_zone_cond() comes from the device-driven report_zones() walk and is never checked against the array size. A device reporting more zones than fit the array makes blk_zone_set_cond() write out of bounds. One way to reach this is a zone count exceeding 32 bits: both blk_revalidate_zone_args.nr_zones and struct zoned_disk_info.nr_zones are unsigned int, so a disk advertising more than UINT_MAX zones (e.g. 2^32 + 1024 zones of one 512-byte logical block) gets its zone count truncated to a small value, undersizing the array while the report walk keeps counting upward. Check the index against the array size before storing the zone condition, and refuse to revalidate when the zone count does not fit 32 bits. Fixes: 6e945ffb6555 ("block: use zone condition to determine conventional zones") Signed-off-by: ZHOU Jiaxiang Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/7815D1B293A8F55E+20260916135822.32584-2-me@fxti.xyz Signed-off-by: Martin K. Petersen (Oracle) commit 278210c60c6f6958bd2eeaa2120c862683b83d09 Author: Arnd Bergmann Date: Tue Sep 15 22:20:59 2026 +0200 scsi: leapraid: Avoid -Wformat-security warning When extra warnings are enabled, the alloc_ordered_workqueue() function cannot be called with a variable name for the format string: drivers/scsi/leapraid/leapraid_os.c: In function 'leapraid_probe': drivers/scsi/leapraid/leapraid_os.c:2062:58: error: format not a string literal and no format arguments [-Werror=format-security] 2062 | alloc_ordered_workqueue(adapter->fw_evt_s.fw_evt_name, 0); | ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~ As the string is only assembled before the call and not used anywhere else, just fold the earlier snprintf() into the alloc_ordered_workqueue() call. Fixes: 5597088c9e79 ("scsi: leapraid: Add new SCSI driver") Signed-off-by: Arnd Bergmann Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260915202134.3534708-1-arnd@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f06a44e235ef188689ba23ffc72e9e89b10951a9 Author: Ewan D. Milne Date: Tue Sep 15 13:38:00 2026 -0400 scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC Symmetrix EMC Symmetrix returns an error on MODE SENSE for page 0Ah subpage 05h because it does not implement the SBC-5 I/O hints. These commands began to be sent as a result of commit 4f53138fffc2 ("scsi: sd: Translate data lifetime information"). Add BLIST_SKIP_IO_HINTS to avoid sending these commands because in large configurations the failed commands are displacing other useful information in internal error logs. Signed-off-by: Ewan D. Milne Link: https://patch.msgid.link/20260915173800.39117-1-emilne@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit bce07e2f37b5e4a427d36fd6b1c14067b27591db Author: Yehyeong Lee Date: Sat Aug 1 22:36:35 2026 +0900 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE. A target that answers a WRITE command's ITT with a Data-In therefore has the initiator write target-supplied bytes into the pages that write was about to send. Those are the caller's own pinned pages for an O_DIRECT write, and page cache pages for a buffered one. Observed against a test target that emits one 512-byte Data-In naming a 128 KB write's ITT, after the R2T for that write. With O_DIRECT the caller's buffer ends up holding 512 bytes of the target's data while pwrite() returns 131072. Buffered is quieter: pwrite() and fsync() both succeed, nothing is logged, and reading those blocks back returns the target's bytes out of the page cache without a command going on the wire. Check the direction before using the scatterlist, the way the R2T path already does. Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260801133635.1986706-1-yhlee@isslab.korea.ac.kr Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld") Signed-off-by: Martin K. Petersen (Oracle) commit c9ee6511332687ea714ad8ab86a53cb837d86eea Author: Geert Uytterhoeven Date: Mon Sep 14 16:00:01 2026 +0200 scsi: ufs: pltfrm: Add quirk for R-Car S4 lacking lanes-per-direction Since commit e72323f3b09f ("scsi: ufs: core: Configure only active lanes during link"), the following error is observed on R-Car S4: ufshcd-renesas e6860000.ufs: Tx lane mismatch [config,reported] [2,1] ufshcd-renesas e6860000.ufs: link startup failed -67 ufshcd-renesas e6860000.ufs: error -ENOLINK: Initialization failed with error -67 ufshcd-renesas e6860000.ufs: probe with driver ufshcd-renesas failed with error -67 R-Car S4 has one UFS lane per direction, as described in section 152.1 of its hardware manual. Without lanes-per-direction, the UFS platform driver defaults to two lanes. Previously, the core used PA_CONNECTEDRXDATALANES and PA_CONNECTEDTXDATALANES to configure the link without checking them against lanes-per-direction, so the missing property did not prevent initialization. While fixing the R-Car S4 DTS is the proper solution, doing only that would still break backwards compatibility with existing DTBs. Hence add a quirk to let lanes-per-direction default to one on R-Car S4. Fixes: e72323f3b09f9c89 ("scsi: ufs: core: Configure only active lanes during link") Reported-by: Koichiro Den Closes: https://lore.kernel.org/20260911073058.253000-1-den@valinux.co.jp Cc: stable@vger.kernel.org # 7.2+ Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/ae0cc2bd764e6dfffce99db3d8b44a55887c508c.1789394185.git.geert+renesas@glider.be Signed-off-by: Martin K. Petersen (Oracle) commit b52d695d062095327b944acf7daabbc816ab319b Author: Stanley Jhu Date: Sat Sep 12 21:16:25 2026 +0800 scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") switched UFS internal commands to allocate requests on hba->host->pseudo_sdev->request_queue, which shares the host tagset with regular LUNs. During error recovery, ufshcd_err_handling_prepare() calls blk_mq_quiesce_tagset(&hba->host->tag_set), marking all queues in the tagset as quiesced, including pseudo_sdev->request_queue. When ufshcd_verify_dev_init() subsequently issues internal commands (e.g. NOP OUT UPIU) via blk_execute_rq(), blk_mq_run_hw_queue() skips running the quiesced queue, resulting in an unrecoverable circular wait deadlock. Keep quiescing the tagset and unquiesce the pseudo SCSI device on top of that, so internal commands stay dispatchable while the logical units remain quiesced. Re-quiesce the pseudo device before unquiescing the tagset so that quiesce_depth stays balanced. Clock scaling and ufshcd_pause_command_processing() are unaffected: they keep quiescing the whole tagset, internal commands included. Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/6f78c4bd-a70b-402d-abfd-599091b67674@acm.org/ Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260912131625.2301486-1-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit f07317a8d57f382ec505597816271dd72ffa20c7 Author: Nitin Rawat Date: Wed Sep 9 11:09:44 2026 +0530 scsi: ufs: ufs-qcom: Enable only lane clocks in lane clock APIs ufs_qcom_enable_lane_clks() and ufs_qcom_disable_lane_clks() currently use clk_bulk_prepare_enable()/clk_bulk_disable_unprepare() on the entire host->clks array obtained from devm_clk_bulk_get_all(). This array contains all device clocks, not just lane symbol clocks. Since the UFS core framework already manages the non-lane clocks via the setup_clocks callback, the bulk enable/disable in the lane clock APIs resulted in duplicate reference count increments on those shared clocks. The extra enable counts were never balanced by a corresponding disable from the framework's clock gating path, preventing the clock reference counts from reaching zero and ultimately blocking CXO shutdown during low-power states. Fix this by restricting the lane clock APIs to only prepare/enable and disable/unprepare the three lane symbol clocks (tx_lane0_sync_clk, rx_lane0_sync_clk, rx_lane1_sync_clk), leaving the handling of all other clocks to the UFS core framework. The lane clocks are now acquired individually via devm_clk_get() instead of being looked up in the bulk clock array. Signed-off-by: Nitin Rawat Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260909053944.2827968-1-nitin.rawat@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit 55ad5deeea922ea854086b70e41415f50e2987ea Author: Bean Huo Date: Mon Sep 7 21:21:40 2026 +0200 scsi: ufs: core: Report the current clock frequency to devfreq When a driver does not provide a ->get_cur_freq() callback, the cur_freq sysfs attribute shows devfreq->previous_freq, which only tracks the scaling that the governor itself did. The UFS controller is also scaled outside the governor. The clearest example is writing 0 to clkscale_enable: ufshcd_clkscale_enable_store() sets the clocks to max_freq through ufshcd_devfreq_scale() and suspends the governor, so devfreq_set_target() is never called. After that, cur_freq keeps showing the last frequency the governor chose instead of the one the controller runs at, and it does so as long as clock scaling stays disabled. Add ufshcd_devfreq_get_cur_freq(). It reports clk_scaling.target_freq when OPPs are used and the first clock's curr_freq otherwise, the same values that ufshcd_devfreq_get_dev_status() reports. Signed-off-by: Bean Huo Reviewed-by: Avri Altman Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260907192140.2701755-5-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen (Oracle) commit 20ae446921e78e4e0182cea7559d34d839550e66 Author: Bean Huo Date: Mon Sep 7 21:21:39 2026 +0200 scsi: ufs: core: Record the frequency the controller starts at ufshcd_init_clocks() puts the controller at its highest frequency, but nothing writes that down. clk_scaling.target_freq stays 0, and devfreq_dev_profile.initial_freq is never set, so devfreq->previous_freq is 0 as well. With use_pm_opp this shows up in a few places. The target_freq attribute reads 0 until the governor scales for the first time. ufshcd_devfreq_get_dev_status() reports 0 Hz, which makes the ondemand governor ask for the maximum frequency. ufshcd_devfreq_target() then sees 0 != max and runs a full ufshcd_devfreq_scale(), which holds up the queue for up to a second only to set the same OPP and the same gear again. Without OPPs the frequency is not reported as 0, but previous_freq is, and devfreq_update_status() then drops the first time_in_state update. Record the maximum frequency in ufshcd_devfreq_init() instead. ufshcd_add_lus() runs after ufshcd_probe_hba() has geared up to hba->max_pwr_info.info, so the clocks and the gear are both at their maximum by the time we get here. The only difference is that the first governor poll no longer redoes work that is already done. From the second poll on nothing changes, because target_freq held the maximum frequency there anyway. That first scale also re-applied the gear that ufshcd_vops_freq_to_gear_speed() maps the maximum frequency to, so it quietly corrected the link if the OPP table and the gear negotiated at probe disagreed. That does not happen any more. On ufs-qcom the two cannot disagree, because ufs_qcom_negotiate_pwr_mode() clamps the gear through ufshcd_negotiate_pwr_params() against the same controller capability the OPP table is written from. clki->max_freq is the right value in both modes. ufshcd_parse_clock_min_max_freq() fills it from the highest OPP, and ufshcd_clkscale_enable_store() already uses it the same way. Suggested-by: Stanley Jhu Signed-off-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260907192140.2701755-4-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen (Oracle) commit 3d676e458fe0c566f5a62753dc696b6a862fc412 Author: Alberto Carboneri Date: Fri Sep 4 13:54:37 2026 +0000 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its mode header and block descriptors. The unsigned subtraction used for the MODE SELECT length can wrap, and the separately computed buf_data can point beyond buf. During automatic scan, enable is false, so the read-modify-write of buf_data[4] can clear the low two bits of a target-selected out-of-bounds stack byte. scsi_mode_select() can then copy up to 64 bytes from outside the buffer into the outgoing MODE SELECT payload, disclosing stack contents to the target. This is reachable while scanning a USB storage device that identifies as an ATA device and advertises CDL support. No filesystem mount or userspace access to the block device is required. On upstream commit cee9395acd80 ("Linux 7.3-rc1"), a build-specific, one-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator sampling executed a fixed proof command inside the guest and created a UID-0-owned marker during automatic enumeration, with KASLR and NX enabled. The issue was independently found during security research at Drivesec S.r.l. Cap the available length to the buffer size. Validate and consume the mode header and block descriptor lengths before using the page, and require the five bytes needed to access the CDL field. Fixes: 1b22cfb14142 ("scsi: core: Allow enabling and disabling command duration limits") Reported-by: Sashiko AI Review Closes: https://lore.kernel.org/linux-scsi/20260717192313.93D791F000E9@smtp.kernel.org/ Link: https://lore.kernel.org/linux-scsi/20260717222931.AC4EE1F000E9@smtp.kernel.org/ Link: https://lore.kernel.org/linux-scsi/df13ec87ac9b28e3b0a2d9eb26477e276ff0278a.camel@HansenPartnership.com/ Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Pimen Flavian Dei (Drivesec S.r.l.) Signed-off-by: Pimen Flavian Dei (Drivesec S.r.l.) Signed-off-by: Alberto Carboneri (Drivesec S.r.l.) Link: https://lore.kernel.org/linux-scsi/20260717192313.93D791F000E9@smtp.kernel.org/ Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260904135410.360314-1-acarboneri@drivesec.com Signed-off-by: Martin K. Petersen (Oracle) commit a09d77bcbe22db1a0b89f18d0a70074bb2453bc4 Author: Christoph Hellwig Date: Mon Aug 31 09:44:57 2026 +0300 scsi: scsi_debug: Add support to corrupt data and/or reftag Add a new debugfs file to inject corruptions of the data and/or reftag. This will be used to detect that protection information and/or file system checksumming can detect random bit errors or misplaced writes. To use this echo the start LBA, number of logical blocks and type of corruption into the new "corrupt" debugfs file for each scsi_debug device. For example: echo lba=42,num=1,bit_errors=2 > /sys/kernel/debug/scsi_debug/1:0:0:0/corrupt or echo lba=2,num=4,reftag_adjust=8 > /sys/kernel/debug/scsi_debug/1:0:0:0/corrupt The injection will be used by new xfstests test cases. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260831064500.2576832-2-hch@lst.de Signed-off-by: Martin K. Petersen (Oracle) commit 2ba1d12b2629827fdb1116eb3c9f8566911f2034 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:11 2026 +0530 scsi: mpi3mr: Fix NULL pointer dereference on PCI error recovery On a frozen PCI channel the driver unmaps the register window and frees the interrupts, but leaves the firmware event workqueue running. An event handler that is already in flight can still reach the register window after it has been unmapped. Stop event processing and drain the queue first, and start it again when the channel resumes. Fixes: 30bafe1774f0 ("scsi: mpi3mr: Support PCI Error Recovery callback handlers") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-18-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit c94c746e6c80439a4a9a0e1e20f2dae62a4d57ef Author: Chandrakanth Patil Date: Wed Aug 26 02:34:10 2026 +0530 scsi: mpi3mr: Fix use-after-free of the firmware event workqueue The enqueue path reads the workqueue pointer before taking the event lock, while the remove path clears that pointer and destroys the workqueue while holding it. The enqueue can therefore reach queue_work() after the workqueue is gone. Move the check inside the lock. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-17-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 052aea807cfbcefaf5b6ed8202f65da1fc65f4a0 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:09 2026 +0530 scsi: mpi3mr: zero out diagnostic buffer status memory Memory allocated for the BSG diagnostic buffer status is not zeroed before it is copied back to user space. Several fields in this structure are reserved and never written by the driver. Use kzalloc() instead of kmalloc() to zero out the allocated memory. Fixes: 78b506984ebe ("scsi: mpi3mr: Add ioctl support for HDB") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-16-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 7d572b4dc4ed0494e67097d4b7368666655f5c99 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:08 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read in PCIe topology change events The number of entries in a PCIe topology change event is used to walk the entry array without being compared against the amount of event data that was received. Bound the entry count to the received event data before use. Fixes: 8e653455547a ("scsi: mpi3mr: Add support for PCIe device event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-15-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 203b3072e7aa10d98b3f2b766693ea925cfc571d Author: Chandrakanth Patil Date: Wed Aug 26 02:34:07 2026 +0530 scsi: mpi3mr: Fix buffer overflow in the BSG target device map The size of the target device map buffer is held in a u16 while the number of devices it is derived from is not bounded to fit. With enough devices the size wraps, a short buffer is allocated, and the loop that fills it writes past the end. Do the calculation in size_t. Fixes: fb428a2005fc ("scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-14-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit f67caaa2521a3c8f931d1e679d831ba5ca654794 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:06 2026 +0530 scsi: mpi3mr: Fix out-of-bounds phy array access on link change The phy number that comes with a link change is used to index the node's phy array without being compared against the number of phys allocated for that node. Check it first. Fixes: 42fc9fee116f ("scsi: mpi3mr: Add helper functions to manage device's port") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-13-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 77554f01187d91c20f04d2a8e28270943ed64cca Author: Chandrakanth Patil Date: Wed Aug 26 02:34:05 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read of event data The event data length from the reply is used as is, both when caching log data and when sizing the buffer handed to the bottom half. A length larger than the frame makes both of them read past the end of it. Clamp the length to what the frame can hold. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Fixes: d0d19250ed81 ("scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-12-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9e220ce4bd0468e47cc9eea07e40799ebae6eda8 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:04 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read in SAS topology change events The number of entries in a SAS topology change event is used to walk the entry array without being compared against the amount of event data that was received, so the walk can run past the end of the buffer. Work out how many entries the payload can hold and skip the event if it claims more. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-11-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit a04b0f3a17e32aa449fd896163a7b40efc29c4f5 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:03 2026 +0530 scsi: mpi3mr: Fix target device reference leak in device removal handshake The device removal handshake looks up the target device to update its state but never drops the reference that the lookup takes. Drop it once the state has been updated. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-10-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 5dade59551d344d0308256edfef6bc3fb4202eb3 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:02 2026 +0530 scsi: mpi3mr: Fix out-of-bounds bitmap access during device removal Device handles reported by the controller are used to index the remove pending bitmap and to build a task management request without being compared against the maximum handle the controller reported. Check the handle before using it. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-9-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 7fea128f6b829ad834f21834d2605d28a45b903d Author: Chandrakanth Patil Date: Wed Aug 26 02:34:01 2026 +0530 scsi: mpi3mr: Fix out-of-bounds sense buffer access The sense buffer address reported on completion is turned into a virtual address with no range check, so an address outside the pool resolves to memory that does not belong to it. Check that it lies within the pool and is correctly aligned. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-8-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit bcf0a5bed59acd5ae19d80e1f617c1a5b355af0b Author: Chandrakanth Patil Date: Wed Aug 26 02:34:00 2026 +0530 scsi: mpi3mr: Fix out-of-bounds reply frame access The reply frame address reported on completion is only checked against the start and the end of the pool. An address near the top can pass the check while leaving less than a full frame, and an unaligned one resolves into the middle of a frame instead of the start of one. Require a whole frame to fit and the address to be frame aligned. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-7-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9ff1af19c488efad66f2b803eefa0abd5fdac8f4 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:59 2026 +0530 scsi: mpi3mr: Fix buffer overflow when caching log data Each log data slot holds a header followed by the payload, but the copy was sized against the whole slot and so wrote one header length past the end of it. Subtracting the header on its own is not enough either, because the entry size is derived from the controller reply size and can be smaller than the header. Work out the payload room first and clamp the copy to it. Fixes: 43ca11005098 ("scsi: mpi3mr: Add support for PEL commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-6-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit f0ec04bdf6156ed2ae7d86a8819dafdd9383b705 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:58 2026 +0530 scsi: mpi3mr: Fix target device reference leak in BSG task management The target device lookup takes a reference, but it is only dropped inside a branch that also requires the SCSI target data to be set up. When it is not, the reference is leaked. Drop the reference whenever the lookup succeeded. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-5-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 37e7d274272bc5e545e2d5f9261afa7f33f1cf49 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:57 2026 +0530 scsi: mpi3mr: Fix I/O block counter leak on admin request post failure The per device I/O block counter is raised before a task management request is posted and only lowered once the request completes. If the post itself fails the counter stays raised and I/O to that device remains blocked. Lower it on the failure path as well. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-4-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9fac4cbd66d852958e8a8d0952eb57f8554ce83b Author: Chandrakanth Patil Date: Wed Aug 26 02:33:56 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read when copying BSG MPI requests The MPI request is copied out of the caller supplied payload without first checking that the requested amount is actually present, so the copy can read past the end of the payload buffer. Check the range before copying. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-3-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 896abdd4d81f40575b05d593f7fe004935a6cf97 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:55 2026 +0530 scsi: mpi3mr: Fix buffer overflow in BSG passthrough request copy The size of an incoming BSG request is checked using a variable that is narrower than the field it is read from, so large values wrap and pass the check. The copy that follows then uses the full value and writes past the request buffer. Widen the variable and copy only the amount that was checked. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-2-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 2cf34575b6498e909193222c3c2c940a2e3fbd8f Author: John Garry Date: Wed Sep 2 10:28:44 2026 +0100 scsi: scsi_debug: Default to a higher throughput config Currently the default config goes not give as high a throughput as some would like. Give a higher default throughput by modifying the following: - Set completion response delay as 0 - Increase shost can_queue to 4096, which aligns better with modern high-speed HBAs - Turn on clustering Signed-off-by: John Garry Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260902092844.1741533-1-john.garry@linux.dev Signed-off-by: Martin K. Petersen (Oracle) commit 657eff806d38abd73e0002cda070c4cf14eb9882 Author: Jorge Ramirez-Ortiz Date: Mon Aug 31 17:48:01 2026 +0200 scsi: ufs: rpmb: Use a fixed-length RPMB dev_id The RPMB authentication key is derived from the dev_id handed to the RPMB subsystem. OP-TEE implements the eMMC RPMB flow, where the dev_id is the eMMC CID: a fixed 16-byte value the key derivation depends on. The UFS RPMB id is "-R", which is variable length and longer than 16 bytes. Handing it to the RPMB subsystem as-is would tie the derived key to a length OP-TEE does not expect and diverge from the fixed-CID eMMC ABI, forcing OP-TEE to be taught about variable-length UFS ids. A fixed 16-byte dev_id is needed so the derived key stays stable and unique per region while matching the eMMC CID layout OP-TEE relies on, keeping the key-derivation ABI identical with no OP-TEE change. The reduction to a fixed 16 bytes must also be reproducible by the bootloaders (such as U-Boot) that derive the same dev_id. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260831154804.719528-3-jorge.ramirez@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit a8a34238e5e65609a434fc13aa1d64fcf2df1d23 Author: Jorge Ramirez-Ortiz Date: Mon Aug 31 17:48:00 2026 +0200 scsi: ufs: rpmb: Retry power-on UNIT ATTENTION on the RPMB WLUN After a power cycle, the first command sent to any UFS logical unit completes with CHECK CONDITION reporting a power-on UNIT ATTENTION. The SCSI core surfaces this condition to the caller rather than retrying it. For the RPMB well-known LU the first command after boot is the first RPMB frame, and RPMB has no earlier, guaranteed access that could clear the condition beforehand. The power-on UNIT ATTENTION therefore reaches RPMB and fails that first frame, breaking RPMB on every cold boot. The RPMB WLUN needs the power-on UNIT ATTENTION to be retried so that RPMB works from the very first access after a power cycle. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260831154804.719528-2-jorge.ramirez@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit 6b0f8a689ef3e84a9b2fc1a5753466dfbd566306 Author: Geert Uytterhoeven Date: Mon Aug 31 11:49:20 2026 +0200 scsi: zorro7xx: Use individual zorro_driver_data structures Using an array of zorro_driver_data objects and referring to its elements by index obfuscates the code and is error-prone. Improve readability and reduce code size by replacing the array (which includes an unneeded sentinel) by individual zorro_driver_data objects. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/7deafe83754415c5beb280f3c1808e153029e890.1788169600.git.geert@linux-m68k.org Signed-off-by: Martin K. Petersen (Oracle) commit 0cb1fd924126f1f581621a5e804df98a02be9dff Author: Arun Easi Date: Thu Sep 3 10:55:47 2026 -0700 scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU When CPU Hyper Threading is disabled, sibling CPUs remain present but are reported offline. Managed MSI-X IRQs can still receive affinity masks that include those offline CPUs. If a driver-critical vector is managed, it can be parked on an offline CPU and the driver may miss critical events such as link-up. Keep driver-critical vectors unmanaged so they can be migrated by the IRQ core when their target CPU is offlined. Since HWQ-0 is unmanaged now, in some queue combinations there can be no mappings to it in mq_map. So without the blk-mq fix mentioned below, system may crash during cpu offline/online tests. Fixes: 8a8449ca5e33 ("scsi: fnic: Modify ISRs to support multiqueue (MQ)") Cc: stable@vger.kernel.org Depends-on: commit 10845a105bbc ("blk-mq: skip CPU offline notify on unmapped hctx") Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Karan Tilak Kumar Signed-off-by: Arun Easi Reviewed-by: Laurence Oberman Link: https://patch.msgid.link/20260903175547.57971-1-aeasi@cisco.com Signed-off-by: Martin K. Petersen (Oracle) commit 1274045b0eda1df5a5cdd3e63ed48cf013b3b4ea Author: Venkat Rao Bagalkote Date: Thu Sep 3 13:13:29 2026 +0530 scsi: ibmvfc: Add Kconfig dependency to fix link failure when NVME_FC=m Building with CONFIG_SCSI_IBMVFC=y and CONFIG_NVME_FC=m results in a link failure: ibmvfc-nvme.o: undefined reference to `nvme_fc_register_localport' ibmvfc-nvme.o: undefined reference to `nvme_fc_register_remoteport' ibmvfc-nvme.o: undefined reference to `nvme_fc_unregister_localport' ibmvfc-nvme.o: undefined reference to `nvme_fc_unregister_remoteport' ibmvfc-core.o: undefined reference to `nvme_fc_rescan_remoteport' IS_ENABLED() evaluates to 1 for both =y and =m, so the nvme_fc_* call sites are kept in the object file. When SCSI_IBMVFC=y (built-in) but NVME_FC=m (loadable module), the linker cannot resolve these symbols at vmlinux link time. Add the same "depends on NVME_FC || NVME_FC=n" constraint already used by SCSI_LPFC to prevent this configuration. Reported-by: Pavithra Closes: https://lore.kernel.org/all/327877a29337aa526cc50ac88fbddb86@linux.ibm.com/ Signed-off-by: Venkat Rao Bagalkote Tested-by: Pavithra Acked-by: Tyrel Datwyler Link: https://patch.msgid.link/20260903074329.6705-1-venkat88@linux.ibm.com Signed-off-by: Martin K. Petersen (Oracle) commit 779f202a92ef10a426efc07d0f4267918cb07ca3 Author: Karl Mehltretter Date: Sun Sep 6 19:10:09 2026 +0200 scsi: qla2xxx: Fix the ql2xfc2target parameter description The module parameter is ql2xfc2target, but its MODULE_PARM_DESC() names qla2xfc2target, so modinfo describes a parameter that does not exist and shows no description for the real one. Use the parameter name in the description. Fixes: 877b03795fcf ("scsi: qla2xxx: Add option to disable FC2 Target support") Assisted-by: LLM Signed-off-by: Karl Mehltretter Link: https://patch.msgid.link/20260906171009.2560-1-kmehltretter@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 264bf9655c3d067d775a46f05eb8c871c488a864 Author: Karl Mehltretter Date: Sun Sep 6 19:09:25 2026 +0200 scsi: pm80xx: Fix the use_msix, use_tasklet and read_wwn parameter descriptions The MODULE_PARM_DESC() lines of use_msix, use_tasklet and read_wwn all name a parameter zoned, which does not exist, and the use_tasklet one repeats the use_msix text. modinfo shows three "zoned" entries and no description for the real parameters. Name the right parameters and describe use_tasklet. Fixes: efa1fca45082 ("scsi: pm8001: Remove PM8001_USE_MSIX") Fixes: 205430290ad0 ("scsi: pm8001: Remove PM8001_USE_TASKLET") Fixes: 80975adc79dd ("scsi: pm8001: Remove PM8001_READ_VPD") Assisted-by: LLM Signed-off-by: Karl Mehltretter Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260906170925.2524-1-kmehltretter@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit e83b47309f73313e75c3888d7839666aba5b2b2a Author: John Garry Date: Mon Aug 31 09:58:21 2026 +0000 scsi: core: Drop Scsi_Host.default_lock Back in the 2.6.xx days, it was possible to for low-level drivers to set the shost lock pointer. That is why there is a default lock and a pointer to the shost lock. However, support for this has long been removed, so drop Scsi_Host.default_lock and make Scsi_Host.host_lock as the actual lock. Getting the address of embedded host_lock structure just requires adding a fixed offset value to the shost pointer. However, getting the value of the host_lock pointer requires loading from a fixed offset to the shost pointer. The latter should be very slightly slower, which is relevant as this lock is used a lot throughout the core code and drivers. Signed-off-by: John Garry Acked-by: Damien Le Moal # ata parts Reviewed-by: Hannes Reinecke Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260831095821.3486994-1-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen (Oracle) commit e64b8f3224add21f02c5d64e11371830e631cdba Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:37 2026 +0300 scsi: sym53c8xx_2: Replace __get_free_pages() with kmalloc() sym53c8xx_2 driver has an internal memory allocator for small allocations of the driver structures. The backing memory for that allocator is allocated with __get_free_pages(). This memory can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Performance difference between kmalloc() and __get_free_pages() is not measurable as both allocators take an object/page from a per-CPU list for fast path allocations. For the slow path the performance is anyway determined by the amount of reclaim involved rather than by what allocator is used. Replace use of __get_free_pages() with kmalloc() and free_pages() with kfree(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-4-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 0abe3fb1c5056b7f2f99178b23db8aa95dd03f85 Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:36 2026 +0300 scsi: ipr: Use kmalloc() to allocate IPR dump buffer memory IPR dump machinery allocates memory to save adapter's crash dump using __get_free_page(). This memory can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). While on it, relax GFP_ATOMIC to GFP_NOIO for allocation of dump buffers. The allocations happen in a workqueue context, but with storage adapter being in a state where it can't handle I/O. Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Tested-by: Wen Xiong Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-3-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b4fe0d7d41eacf3c2ffa54eef3e5e93ac8777518 Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:35 2026 +0300 scsi: proc: Use kmalloc() in proc writers proc_scsi_host_write(), proc_scsi_write() and proc_scsi_devinfo_write() allocate temporary buffers for /proc writes using __get_free_page(). These buffers can be allocated with kmalloc() as there's nothing special about them to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Reviewed-by: John Garry Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-2-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f07ed527235c44e0aae53100133bb547f5ee448f Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:34 2026 +0300 scsi: target: file: Use kmalloc() to allocate temporary protection buffer fd_do_prot_unmap() uses __get_free_page() to allocate a temporary buffer that is used to invalidate protection info for the unmapped region by filling with 0xff pattern. This buffer can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-1-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle)