commit 469fa055664bfd8717b087a80d59c03055789c17 Author: Stanley Jhu Date: Mon Sep 28 11:58:16 2026 +0800 scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ In MCQ mode, ufshcd_mcq_compl_pending_transfer() uses blk_mq_tagset_busy_iter() to iterate over busy requests during error recovery and host reset. However, both iterator callbacks perform whole-queue operations redundantly for each visited request: - force_compl == true: ufshcd_mcq_force_compl_one() calls ufshcd_mcq_compl_all_cqes_lock() on every busy request, sweeping the entire completion ring (hwq->max_entries slots) once per active request under spin_lock_irqsave even though the first sweep already cleared all completion entries. - force_compl == false: ufshcd_mcq_compl_one() acquires cq_lock and polls CQTPy over MMIO via ufshcd_mcq_poll_cqe_lock() for every busy request without doing any per-request work. Sweep or poll each hardware queue (hba->uhq[i]) once at the start of ufshcd_mcq_compl_pending_transfer(). When force_compl is true, run blk_mq_tagset_busy_iter() afterward to complete residual in-flight requests with DID_REQUEUE, and remove the now-unused ufshcd_mcq_compl_one() callback. Fixes: ab248643d3d6 ("scsi: ufs: core: Add error handling for MCQ mode") Cc: stable@vger.kernel.org Reviewed-by: Bart Van Assche Signed-off-by: Stanley Jhu Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260928035816.1294326-3-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 375f3a5691dd46b5d05b90a8968872ec8b2248c5 Author: Stanley Jhu Date: Mon Sep 28 11:58:15 2026 +0800 scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() During MCQ host reset, ufshcd_host_reset_and_restore() stops the host controller via ufshcd_hba_stop() (HCE = 0) before calling ufshcd_complete_requests(hba, true) -> ufshcd_mcq_compl_pending_transfer(hba, true) -> ufshcd_mcq_force_compl_one() -> ufshcd_mcq_compl_all_cqes_lock(). Because ufshcd_mcq_force_compl_one() is its sole caller, ufshcd_mcq_compl_all_cqes_lock() always runs with HCE = 0. Despite the comment above ufshcd_mcq_compl_all_cqes_lock() stating that reading CQTPy may not be safe with the controller disabled, the function still calls ufshcd_mcq_update_cq_tail_slot() at the end of its sweep: 1. Unsafe CQTPy MMIO read: Calling ufshcd_mcq_update_cq_tail_slot() at the end of the sweep reads CQTPy over MMIO while HCE = 0, directly contradicting the function's documented contract (commit 1373df88d535 ("scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()")) that reading CQTPy may not be safe with the controller disabled. 2. Spurious error logs on empty slots: Sweeping all max_entries slots visits empty entries where command_desc_base_addr is 0, causing ufshcd_mcq_process_cqe() to log unguarded dev_err(hba->dev, "Abnormal CQ entry!\n") messages. Fix both issues in ufshcd_mcq_compl_all_cqes_lock(): - Remove the ufshcd_mcq_update_cq_tail_slot() call and the redundant hwq->cq_head_slot = hwq->cq_tail_slot assignment without replacement. The two indices are already equal after the sweep: they are equal when the sweep starts, since ufshcd_mcq_poll_cqe_lock() consumes entries until cq_head_slot reaches cq_tail_slot, and the sweep advances cq_head_slot by exactly one full ring. Both indices are also reinitialized before the queue is reused. - Extract ufshcd_mcq_compl_cqe() and invoke it only on non-empty slots during full-ring sweeps, keeping "Abnormal CQ entry!" logging strictly for unexpected empty entries in ufshcd_mcq_poll_cqe_lock(). Fixes: ab248643d3d6 ("scsi: ufs: core: Add error handling for MCQ mode") Cc: stable@vger.kernel.org Reviewed-by: Peter Wang Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260928035816.1294326-2-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 27c0f718d3b3c99e6d315308e95d987d0382a8a8 Author: Ahmed Abdelhaleem Ahmed Date: Tue Sep 22 15:46:46 2026 +0000 scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch->dt[]. scsi_device_lookup() takes a reference, and nothing ever drops it: ch_destroy() frees the array with kfree(). ch->dt[] is read nowhere else - it only supplies the vendor, model and revision printed in the same loop. Once such a drive is removed, its scsi_device can never be released. It stays on the host's device list at its address, so a new device there is refused by anything that walks the list - target_core_pscsi reports "scsi_device_get() failed for H:C:T:L" - and the low-level driver's module can no longer be unloaded. Only a reboot recovers. It shows with any changer that reports its drives' ids; with the mhvtl virtual library (IBM 3573-TL personality), each create and remove of a library with four drives leaves four references behind, counted by the module's use count in lsmod. With ch not bound the count is unchanged, and with this patch applied it is unchanged too. Drop the reference as soon as the name has been printed, and remove the now unused dt[] array. That also removes the array leaked when ch_probe() fails after ch_readconfig(). The same leak was reported with an RFC patch in 2022, which was not merged. Fixes: daa6eda65a53 ("[SCSI] add scsi changer driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-scsi/20220719075442.6215-1-yanghao_ht@163.com/ Signed-off-by: Ahmed Abdelhaleem Ahmed Reviewed-by: Laurence Oberman Fixes: daa6eda65a53 ("[SCSI] add scsi changer driver") Link: https://patch.msgid.link/20260929-ch-dt-leak-v2-1-ddda8d635dca@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 78e04810542da416d3bead707b60cec773f1524d Author: Pengpeng Hou Date: Sun Sep 20 11:49:53 2026 +0800 scsi: ufs: mediatek: Handle mPHY power-on failures The MediaTek helper enables VA09 before powering on the mPHY, but ignores the PHY result. A failure can leave VA09 enabled and publish mphy_powered_on as true, so a later power-on attempt is skipped. Check phy_power_on(), attempt to unwind VA09 on failure, and leave the state flag unchanged. Propagate the helper result from host initialization as well as its existing resume caller. Keep the original PHY error if the supply rollback also fails, and report that rollback separately. The issue was found by our static-analysis tool. Fixes: 561e3a8726b2 ("scsi: ufs-mediatek: Fix unbalanced clock on/off") Fixes: cf137b3ea49a ("scsi: ufs-mediatek: Support VA09 regulator operations") Assisted-by: gpt 5 Signed-off-by: Pengpeng Hou Reviewed-by: Peter Wang Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260920034953.19535-1-hppiscas@163.com Signed-off-by: Martin K. Petersen (Oracle) commit 698577ef1a023b7c894b9728d57f43d89de3c821 Author: Martin K. Petersen (Oracle) Date: Sat Oct 3 09:36:07 2026 -0400 scsi: mpi3mr: Fix merge error Fix a double put introduced while resolving a merge conflict between v7.3-rc2 and v7.4/scsi-staging. Reported-by: Mark Brown Reported-by: Geert Uytterhoeven Suggested-by: Ranjan Kumar Fixes: 0b5b2fb484f3 "Merge tag 'v7.3-rc2' into 7.4/scsi-staging" Signed-off-by: Martin K. Petersen (Oracle) commit 55b6593276c8aeeb7dff2507028166337c13a30e Author: Shawn Guo Date: Tue Jul 28 13:11:04 2026 +0800 scsi: ufs: qcom: Enable MCQ support for sa8255p The sa8255p vops (fw-managed variant) was missing the MCQ hooks, causing the driver to silently fall back to SDB mode even when MCQ resource is available. Wire up the same MCQ ops used by the standard qcom vops, so that MCQ mode works on sa8255p. Signed-off-by: Shawn Guo Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260728051104.675088-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit d0105247ca7e281aac61216d8a641576200f262f Author: Kees Cook Date: Thu Sep 17 14:11:38 2026 -0700 scsi: hpsa: Make buff allocation type unsigned In preparation for converting the kmalloc family of allocators to the type-aware kmalloc_obj family, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (The kmalloc family returns "void *", which can be implicitly cast to any pointer type.) The assigned type is "unsigned char **", but the converted allocation type would be "char **", whose elements point to a character type of a different signedness, so the two pointer types are not compatible. Take the size from the assignment target instead. No change in allocation size results. Build tested ARCH=x86_64 allmodconfig with GCC 16.2.0: drivers/scsi/hpsa.o Assisted-by: LLM coccinelle Signed-off-by: Kees Cook Link: https://patch.msgid.link/20260917211137.i.357-kees@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 7dec5cedf7b248036da606c16f9f3f9aa350b417 Author: Peter Wang Date: Mon Sep 14 16:49:25 2026 +0800 scsi: ufs: core: Serialize AHIT register access between sysfs and host driver A race exists between ufshcd_auto_hibern8_update() and ufs_mtk_pwr_change_notify() when both paths concurrently access REG_AUTO_HIBERNATE_IDLE_TIMER. Additionally, the static local variable used to save/restore AHIT in the power change path is not re-entrant and may hold a stale value if a sysfs write races with a gear change. Introduce ahit_mutex and ahit_disable_depth in struct ufs_hba to serialize AHIT register access. The depth counter tracks how many host-driver paths have forced AHIT off; sysfs writes are suppressed while it is non-zero and the register is restored from hba->ahit only when the last disabler drops it to zero. Fixes: f5ca8d0c7a63 ("scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes") Signed-off-by: Peter Wang Reviewed-by: Chun-Hung Wu Link: https://patch.msgid.link/20260914085148.136429-3-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen (Oracle) commit 6efee14ca0aed33103ea17f4367da173f893442f Author: Peter Wang Date: Mon Sep 14 16:49:24 2026 +0800 scsi: ufs: core: Always notify POST_CHANGE even on gear switch failure Previously, POST_CHANGE was only notified on a successful gear switch. This could leave the host in an inconsistent state if resources were acquired in PRE_CHANGE (e.g. disabling auto-hibern8) but never released due to a missing POST_CHANGE. Fix this by always calling POST_CHANGE regardless of the gear switch result. On failure, pass dev_req_params = NULL to signal that there is nothing to apply; hosts that receive NULL simply skip their post work. Update the affected drivers (ufs-exynos and ufshcd-pci) to guard their POST_CHANGE logic with a NULL check so they correctly handle the failure case. Fixes: f5ca8d0c7a63 ("scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes") Signed-off-by: Peter Wang Reviewed-by: Chun-Hung Wu Link: https://patch.msgid.link/20260914085148.136429-2-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen (Oracle) commit 00eec343c7306be7f1103f5002abd77496937ff9 Author: Stanley Jhu Date: Fri Sep 11 10:43:19 2026 +0800 scsi: ufs: core: Dynamically disable timestamp on unsupported devices JEDEC JESD220F specifies that the Timestamp attribute (qTimestamp) is an optional feature for UFS devices. Some compliant UFS 4.0 devices do not implement it and return QUERY_RESULT_INVALID_IDN (0xFD). ufshcd_set_timestamp_attr() gates the write on wspecversion >= 0x400 and the absence of UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT. Neither covers a device that advertises UFS 4.0 but declines the attribute, so the write is reissued on every boot and every resume. Record the capability in struct ufs_dev_info and clear it when the device answers -EOPNOTSUPP, so the write is not retried. -ETIMEDOUT and -EIO still reach dev_err(); they are transient and must not disable the attribute. Signed-off-by: Stanley Jhu Tested-by: Xilin Wu Link: https://patch.msgid.link/20260911024319.1346706-3-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit d1fa5cea5dcd72a9ec21b835c572a28c0c3f4fbf Author: Stanley Jhu Date: Fri Sep 11 10:43:18 2026 +0800 scsi: ufs: core: Fast-abort unsupported Query IDNs JEDEC JESD220F specifies that devices not supporting an optional Query IDN return QUERY_RESULT_INVALID_IDN (0xFD) in the Query Response UPIU. ufshcd_dev_cmd_completion() maps all non-zero Query responses to -EINVAL and logs dev_err(). A device declining an optional IDN is spec-compliant, so this reports an error that did not occur and leaves the retry loops resending a request the device will never accept. Decode 0xFD as -EOPNOTSUPP, terminate the query retry loops on it, and drop the dev_err() in the query wrappers and descriptor readers for that case. Other errors are logged and retried as before. The suppressed dev_err() calls carried the opcode and IDN; log them with dev_dbg() where the response is decoded. Signed-off-by: Stanley Jhu Tested-by: Xilin Wu Link: https://patch.msgid.link/20260911024319.1346706-2-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 0b1a79f2791a06f139dce5450e487307cf0e241f Author: Fan Wu Date: Fri Sep 11 02:05:44 2026 +0000 scsi: dc395x: sync the waiting_timer before freeing the host The waiting_timer callback re-arms itself and takes the host lock. adapter_uninit() currently stops it with timer_delete(), which does not wait for a callback already running on another CPU. The final scsi_host_put() that frees the host (and the host lock the callback dereferences) runs right after adapter_uninit(), so a concurrent or just re-armed callback can fire after the free, leaving a potential use-after-free window. Replace timer_delete() with timer_shutdown_sync() at the top of adapter_uninit(), before the host-lock section: the timer is dequeued, a running callback is waited for and rearming is blocked before the chip is halted, so it cannot fire at all once the adapter has ceased to function. Waiting outside the lock avoids the self-deadlock that would result from syncing a callback blocked on the lock we still hold. No shutdown is needed for selto_timer because it has no reachable armer or callback. This issue was found by an in-house static analysis tool. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Cc: Jamie Lenehan Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu Link: https://patch.msgid.link/20260911020544.42966-1-fanwu01@zju.edu.cn Signed-off-by: Martin K. Petersen (Oracle) commit 85de8b3a5eaa23d153aff4c7c83dddbc949064c9 Author: Runyu Xiao Date: Thu Sep 10 17:24:05 2026 +0800 scsi: qedi: Initialize callback state before registration qedi_get_protocol_tlv_data() can be called asynchronously by QED after qedi_ops->register_ops(). It takes stats_lock and reads ll2_mtu, but __qedi_probe() currently registers the callback before initializing the mutex and assigning the default MTU on the normal probe path. Initialize the callback-visible state before registering qedi_cb_ops. Keep the recovery path from reinitializing state because it reuses the existing qedi context. Fixes: 3cc5746e5ad7 ("scsi: qedi: Initialize the stats mutex lock") Cc: stable@vger.kernel.org Assisted-by: LLM Codex Signed-off-by: Runyu Xiao Link: https://patch.msgid.link/20260910092405.1300129-1-runyu.xiao@seu.edu.cn Signed-off-by: Martin K. Petersen (Oracle) commit 02a3178319639f650428164d4d003de4dc03e326 Author: Naomi Chu Date: Wed Sep 9 17:10:45 2026 +0800 scsi: ufs: core: Hold a clock reference across the probe Clock gating becomes possible as soon as ufshcd_init_clk_gating() has run, and from that point on the probe keeps accessing host registers without ever taking a clock reference. This has been safe only because of the state check in __ufshcd_release(): gate_work is not queued unless hba->ufshcd_state is UFSHCD_STATE_OPERATIONAL, and the promotion to that state used to happen after the last register access of the probe, at the end of ufshcd_probe_hba(). That is fragile: it only works while the promotion happens after the register accesses. Commit a390e6677f41 ("scsi: ufs: core: Expand the ufshcd_device_init(hba, true) call") changed that ordering by moving the promotion into ufshcd_init(), which schedules ufshcd_async_scan() afterwards. ufshcd_probe_hba() therefore now runs with the state already promoted, and it accesses host registers without holding a clock reference: - On hosts with UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH it calls ufshcd_hba_stop() and ufshcd_hba_enable() before ufshcd_device_init() sets the state back to UFSHCD_STATE_RESET, and both read REG_CONTROLLER_ENABLE, so gated clocks stall there instead of just losing a write. - It ends with an ufshcd_configure_auto_hibern8() write, which its other callers do take a clock reference for. Take a clock reference as soon as clock gating has been initialised and keep it until the probe is over. It then does not matter who drops a clock reference while the probe is running, and the register accesses of the probe no longer depend on hba->ufshcd_state. The reference is dropped by ufshcd_async_scan() once the scan has finished, or by the new out_release label if the probe fails after it was taken. Fixes: a390e6677f41 ("scsi: ufs: core: Expand the ufshcd_device_init(hba, true) call") Signed-off-by: Naomi Chu Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260909091045.1134956-1-naomi.chu@mediatek.com Signed-off-by: Martin K. Petersen (Oracle) commit f09d2c7485b32adb82336d0d748935c8237a649e Author: Peng Fan Date: Sat Sep 19 21:08:52 2026 +0800 scsi: target: core: Use assign_bit() where applicable Convert open-coded if/else with set_bit/clear_bit to the assign_bit API. Signed-off-by: Peng Fan Reviewed-by: Bodo Stroesser Link: https://patch.msgid.link/20260919130853.3041614-1-peng.fan@oss.nxp.com Signed-off-by: Martin K. Petersen (Oracle) commit 3b7ccba37858dd3d7d3780eb42ab943152e5b7ec Author: Damien Le Moal Date: Fri Sep 18 15:29:59 2026 +0900 scsi: core: Fix additional sense code definition The ASC() macro used to define an additional sense code with no additional sense code qualifier conflicts with the ASC macro definition of the file arch/sparc/include/asm/ns87303.h, leading to compilation errors. Avoid this conflict by renaming the macro as SCSI_ASC() and the ASC_DEF() macro to SCSI_ASC_DEF() to be consistent. Reported-by: kernel test robot Fixes: 72c54bd0cbb2 ("scsi: core: Define all additional sense codes and their qualifiers") Closes: https://lore.kernel.org/oe-kbuild-all/202609180743.kyprDg18-lkp@intel.com/ Signed-off-by: Damien Le Moal Link: https://patch.msgid.link/20260918062959.2245533-1-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit e6687d574bbe142751bcfa6dd0f42d5abd1c2756 Author: Ranjan Kumar Date: Wed Sep 16 13:57:05 2026 +0530 scsi: mpi3mr: Driver version update to 8.18.0.8.50 Update driver version to 8.18.0.8.50 Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-11-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit c90693e02d10e9318f2f7cc480e9b05430628738 Author: Ranjan Kumar Date: Wed Sep 16 13:57:04 2026 +0530 scsi: mpi3mr: Fix SAS PHY cleanup in host addition error paths When adding a SAS host, the driver allocates a PHY array and subsequently creates individual SAS PHYs. If a later step fails, the error path exits without cleaning up previously allocated resources, resulting in leaks of both the PHY array and any registered SAS PHYs. Additionally, the return value of mpi3mr_add_host_phy() was being ignored. If it failed, mr_sas_phy->phy would be left as NULL, which could later lead to a NULL pointer dereference in mpi3mr_sas_port_add() when the attached device triggers a device addition event. Add a dedicated cleanup path that deletes any successfully created SAS PHYs and frees the PHY array before returning from initialization failure paths. Also, check the return value of mpi3mr_add_host_phy() and jump to the cleanup path on failure. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=9 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-10-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 29e3f0856e8544ca185be3403518a102e0ca29fc Author: Ranjan Kumar Date: Wed Sep 16 13:57:03 2026 +0530 scsi: mpi3mr: Fix SAS port allocation and registration error handling During SAS port creation, the driver does not verify successful port allocation before attempting registration, which can lead to a NULL pointer dereference. Additionally, if registration fails, the allocated port is not freed, resulting in a memory leak. Fix this by adding a NULL check after allocation and freeing the port when registration fails. Additional fixes in the error handling path include: 1. Fixing similar missing NULL checks for rphy allocations. 2. Cleaning up after a failed rphy registration tried to remove a device that was never added, causing a crash. The rphy is now freed directly instead. 3. A failed rphy registration left the target device with a dangling pointer and a stuck pending flag. Both are now cleared. 4. Phys removed on error kept an internal flag set, permanently blocking them from being added to a port again. Now cleared alongside the list removal. 5. Could block in the SCSI mid-layer after a stop or reset had already begun, the same ABBA deadlock class fixed elsewhere. The port allocation path now stops before that call once that is detected. 6. The same reset check on the port removal path caused a memory leak and a kernel BUG() on rediscovery. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=8 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=8 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=8 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=8 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-9-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 59f8c361872df3df9c47ad612a4562cd08441cc5 Author: Ranjan Kumar Date: Wed Sep 16 13:57:02 2026 +0530 scsi: mpi3mr: Fix firmware event reference leak during cleanup During firmware event cleanup, when an event is currently executing or pending at the SCSI mid-layer, the driver sets a discard flag and exits the cleanup routine early. This early exit skips the normal cancel path, resulting in the firmware event reference count not being decremented, leading to a reference leak. Additionally, resolve the following concurrency issues in the firmware event handling paths: 1. mpi3mr_cleanup_fwevt_list() read current_event locklessly. It is now acquired under fwevt_lock. 2. mpi3mr_dequeue_fwevt() dropped the reference before returning it, risking a use-after-free. The drop is now moved into mpi3mr_cancel_work(). 3. mpi3mr_fwevt_bh() dropped fwevt_lock mid-move, racing with unload. The move is now inlined under one continuous lock hold. 4. pending_at_sml was read/written without a lock, risking an ABBA deadlock. It is now protected by fwevt_lock throughout. 5. mpi3mr_suspend() could unmap PCI resources before the event worker finished. It now flushes the workqueue first. 6. mpi3mr_report_tgtdev_to_host() and mpi3mr_remove_tgtdev_from_host() could still set pending_at_sml and block in the SCSI mid-layer after a stop or reset had already begun, deadlocking against the thread waiting on that flag. Both now bail out beforehand once stop_drv_processing or reset_in_progress is set. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=7 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=7 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=7 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-8-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit ea8dfd05a0fcabe3ea8bb8a3b9e45b5170a210a2 Author: Ranjan Kumar Date: Wed Sep 16 13:57:01 2026 +0530 scsi: mpi3mr: Fix memory leak on operational queue creation failure When operational queue creation fails after one or more queues have been created, the error path frees the queue information arrays but does not release the DMA memory segments associated with the created queues, resulting in a memory leak. Fix this by ensuring that partially allocated segments are freed immediately if a queue fails to create. Additionally, resolve the following issues in the queue segment free/alloc paths: 1. Clear mrioc->intr_info[].op_reply_q with WRITE_ONCE() and follow it with synchronize_irq() before freeing segments, and have the ISR paths read it once via READ_ONCE() into a local, to close a race where the ISR could use the pointer while it is being freed. 2. Free q_segment_list before checking q_segments in both free functions, since a kzalloc_objs() failure on q_segments left q_segment_list leaked via the early return. 3. The threaded poll handler returned without re-enabling the interrupt when the reply queue was already gone, leaving that interrupt line permanently masked. It now re-enables it before returning. 4. Two other callers read the same pointer without a NULL check, which could now be reached with a NULL value. Add the check at the single point they both call through, and read the pointer consistently with the writer above. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=6 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=6 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=6 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=6 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-7-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 7342b9f0e3065c086605f075a204972d270b267b Author: Ranjan Kumar Date: Wed Sep 16 13:57:00 2026 +0530 scsi: mpi3mr: Fix performance regression caused by extended IRQ poll sleep Commit 24d7071d9645 ("scsi: mpi3mr: A performance fix") increased the threaded IRQ poll sleep range from 2-20 us to 20-21 us to work around a timer slack issue. On kernels unaffected by the timer slack issue, the longer sleep interval reduces reply queue processing efficiency and causes an approximately 7% throughput regression on NVMe direct-attached RAID10 configurations. Restore the IRQ poll sleep base to 2 us (widening the usleep_range() upper bound to 10x the base instead of a fixed +1 us) to recover the lost throughput, and skip the sleep entirely once pend_ios reaches 0 so the poll loop exits immediately at the tail of a completion burst. Additionally, resolve the following issues in the reply queue processing and polling logic: 1. Add missing dma_rmb() memory barriers in the admin and operational reply queue processing loops. This ensures that the descriptor payload is only read after the phase bit check is complete, preventing weakly ordered architectures from speculatively processing stale data. 2. Add bounds checking for `request_queue_id` in mpi3mr_process_op_reply_q(). An out-of-range id is now logged and the descriptor is retired (consumer index advanced, phase toggled on wraparound) rather than aborting the loop in place, which previously left the same corrupted descriptor at the head of the ring forever and stalled polling indefinitely. It is not counted toward pend_ios, since no real completion was processed for it. 3. Recheck for a late-arriving descriptor via dma_rmb() while still holding op_reply_q->in_use, instead of releasing it and reclaiming it afterward, which could race and reprocess a descriptor with stale indices or double-decrement in_use. 4. Replace a direct panic() call with a safe ioc_err() log and abort in mpi3mr_process_op_reply_desc() when mpi3mr_get_reply_virt_addr() returns NULL. This prevents a single malformed DMA reply address from crashing the entire host OS. The reply_dma output parameter is also cleared before returning, since it was already populated with the unvalidated address before the NULL check. Leaving it set would make the caller repost that unvalidated address back to the hardware. Note: The unbounded busy-wait loop (usleep_range) in mpi3mr_isr_poll() flagged by automated review is intentionally retained. This short sleep polling mechanism is critical for batching completions and achieving the target throughput on high-performance NVMe configurations. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=5 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=5 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=5 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=5 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-6-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit fb8b6139770a5dee8ace9e605b5c3d11861506c8 Author: Ranjan Kumar Date: Wed Sep 16 13:56:59 2026 +0530 scsi: mpi3mr: Fix NVMe page size caching for non-operational devices For NVMe devices in an error state, the cached PCIe page size remains unset. This causes management IOCTL validation to fail, preventing requests from reaching firmware and returning incorrect errors to userspace. Populate the page size attribute irrespective of device access status so firmware can process IOCTLs and report appropriate errors. Additionally, harden the device initialization path against invalid firmware data for non-operational devices: 1. Add bounds checking for page_size, falling back to 4096 bytes (shift exponent 12) to prevent undefined shift behavior and kernel panics. The minimum valid NVMe page size shift is 12 and maximum is 27. 2. Initialize reset_to and abort_to timeouts with default values to prevent IOCTLs from failing instantly. To avoid race conditions where concurrent readers might observe these default timeouts before they are updated with firmware values, use local variables to compute the final values before writing them to the device structure. 3. Read the firmware-provided page size once into a local variable before validating and using it, since it lives in memory the device can also write to. Using it directly in both the check and the assignment allowed the two to observe different values. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=4 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=4 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=4 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=4 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-5-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 48c666139acfef3bce5cc337b7d2cc2e089f87b5 Author: Ranjan Kumar Date: Wed Sep 16 13:56:58 2026 +0530 scsi: mpi3mr: Add early timestamp synchronization after driver load When the driver is loaded from initramfs, the controller timestamp may be initialized before the system clock has been synchronized. As a result, the controller can operate with a stale timestamp until the first periodic synchronization occurs. Currently, the first controller timestamp synchronization occurs only after the configured ts_update_interval expires (15 minutes by default). Add an early timestamp synchronization 60 seconds after driver load, followed by the existing periodic synchronization interval. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-4-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 1567cd497fa98a078c60224766021556085bc662 Author: Ranjan Kumar Date: Wed Sep 16 13:56:57 2026 +0530 scsi: mpi3mr: Update MPI Headers to revision 41 Update MPI Headers to revision 41 Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-3-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit ab21857b2715ec3c7f53d16c9449370fbdebfc37 Author: Ranjan Kumar Date: Wed Sep 16 13:56:56 2026 +0530 scsi: mpi3mr: Skip device shutdown during unload per controller configuration The controller may be configured through Driver Page 1 to suppress device shutdown requests during driver unload. Cache this setting and skip the device shutdown request during IOC shutdown when unloading the driver. Additionally, ensure the driver_pg1 fields are properly converted from little-endian to CPU endianness using le32_to_cpu() and le16_to_cpu() before evaluating the shutdown disable flag and allocating diag buffers. This prevents failures and massive memory allocation errors on big-endian architectures. Also harden the diagnostic buffer allocation retry loops against invalid firmware-provided decrement sizes. The trace buffer loop already guarded against a zero or oversized decrement size (infinite loop or unsigned underflow). The firmware buffer loop had the same gap and now carries the same guard. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=1 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=1 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=1 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit cdc97921de02a0c1a8324afa03e8b3e30a72bbe6 Author: Bart Van Assche Date: Mon Aug 31 10:48:21 2026 -0700 scsi: pm8001: Fix SATA FIS offset in struct hw_event_resp In struct hw_event_resp, sas_identify was defined using struct sas_identify_frame, which is 32 bytes long because it includes a 4-byte CRC field. However, PM8001 and PM80xx hardware does not send the CRC in the event response frame, providing only the 28-byte identify payload. Because sas_identify had a size of 32 bytes, the following sata_fis member was located at byte offset 44 instead of the actual hardware offset 40. In hw_event_sata_phy_up(), this discrepancy was worked around with negative pointer arithmetic: ((u8 *)&pPayload->sata_fis - 4). This triggers a compiler error under Clang with -Wstringop-overread: error: 'memcpy' reading 20 bytes from a region of size 0 [-Werror,-Wstringop-overread] memcpy(phy->frame_rcvd, ((u8 *)&pPayload->sata_fis - 4), Move struct sas_identify_frame_local (28 bytes) into pm8001_defs.h, and update struct hw_event_resp in both pm8001_hwi.h and pm80xx_hwi.h to use struct sas_identify_frame_local followed by sata_fis and a 4-byte padding word. This correctly aligns sata_fis at byte offset 40 while maintaining the 64-byte total payload size. Update hw_event_sata_phy_up() in pm8001_hwi.c and pm80xx_hwi.c to copy directly from &pPayload->sata_fis. Compile-tested only. Both the patch and its description have been generated by Gemini. Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver") Fixes: f5860992db55 ("[SCSI] pm80xx: Added SPCv/ve specific hardware functionalities and relevant changes in common files") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/31963d53810f42970447e78ef46030ab13d2e91f.1788198434.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 42d1221d321e55afc7bba9109a77aaf5a817c8a3 Author: Bart Van Assche Date: Mon Aug 31 12:27:20 2026 -0700 scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() Protect the megasas_get_ctrl_info() call in megasas_resume() with instance->reset_mutex using scoped_guard(). megasas_get_ctrl_info() may release and reacquire instance->reset_mutex. Hence, calling this function without holding instance->reset_mutex is not safe. Fixes: c3b10a55abc9 ("scsi: megaraid_sas: Update controller info during resume") Cc: Kashyap Desai Cc: Sumit Saxena Cc: Shivasharan S Cc: Chandrakanth patil Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/f06b5ee432b21cf293f0663e15b64f75a84b9fd5.1788204406.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 15de2788c91cc407f7e6fc6a07be27b10048cbce Author: Damien Le Moal Date: Tue Sep 8 18:03:08 2026 +0900 scsi: core: Remove scsi_build_sense() and scsi_build_sense_buffer() Now that all code has been converted to use 16-bit sense codes and to initialize sense with scsi_set_sense() and scsi_set_sense_buffer(), remove the inline definitions of these new functions, change scsi_build_sense() and scsi_build_sense_buffer() to use a single 16-bit sense code as argument (instead of separate arguments for the ASC and ASCQ), and rename them to scsi_set_sense() and scsi_set_sense_buffer(). Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-41-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit ddfb3e0257b27f14847fd8a76159d7e43ce5fee8 Author: Damien Le Moal Date: Tue Sep 8 18:03:07 2026 +0900 scsi: core: Clean up scsi_proto.h Now that all users of SCSI sense codes have been modified to use macro definitions and the 16-bit sense code instead of separate 8-bit ASC and ASCQ, remove the now unused asc and ascq fields of struct scsi_failure and struct scsi_sense_hdr, and the old (and incomplete) definitions of SCSI additional sense codes and sense code qualifiers in scsi_proto.h. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-40-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 3f37a1a804fc02d43695fdfe290c0077c1ffaba8 Author: Damien Le Moal Date: Tue Sep 8 18:03:06 2026 +0900 scsi: s390: Use combined sense codes Use the 16-bit sense codes and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-39-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit c44f095a9d1768d9be6cf0c1b12e95619d6af9b4 Author: Damien Le Moal Date: Tue Sep 8 18:03:05 2026 +0900 scsi: ata: libata: Use combined sense codes Refactor libata core code to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Acked-by: Niklas Cassel Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-38-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 4152825a15d5f5d7a810e19a1e77a8561525b020 Author: Damien Le Moal Date: Tue Sep 8 18:03:04 2026 +0900 scsi: cdrom: Use combined sense codes Refactor the cdrom driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-37-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 134875ed31d4d866dbe3cd1a3461e76f08d030b4 Author: Damien Le Moal Date: Tue Sep 8 18:03:03 2026 +0900 scsi: usb: storage: Use combined sense codes Refactor the USB mass storage driver to replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-36-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9dd9bcb293f0fa575f497dd58172fcdcd2978113 Author: Damien Le Moal Date: Tue Sep 8 18:03:02 2026 +0900 scsi: target: Use combined sense codes Refactor the target core code to use the 16-bit sense codes for building sense and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-35-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 3f7abb6b35305a7da0575091ad5f7c9af0f37480 Author: Damien Le Moal Date: Tue Sep 8 18:03:01 2026 +0900 scsi: storvsc: Use combined sense codes Refactor the storvsc driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-34-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 3f94a6f129bf5bf2e634049d438b8794e019c17f Author: Damien Le Moal Date: Tue Sep 8 18:03:00 2026 +0900 scsi: hpsa: Use combined sense codes Refactor the hpsa driver to replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. The function decode_sense_data() is also modified to take a pointer to a 16-bit sense_code variable in place of the two pointers to the additional sense code and its code qualifier. The local definitions of ASCs and ASCQs are deleted too. No functional change intended, but the function hpsa_volume_offline() was checking only the addditional sense code qualifier with checking the additional sense code. This change assumes that the intended additional sense code to check is ASC_LU_NOT_READY. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Acked-by: Don Brace Link: https://patch.msgid.link/20260908090308.1085097-33-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 1b7ea7bb198e73a5237d3799187e46fe2b818ef5 Author: Damien Le Moal Date: Tue Sep 8 18:02:59 2026 +0900 scsi: scsi_debug: Use combined sense codes Refactor the scsi_debug driver to replace hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. The functions mk_sense_buffer() and mk_sense_info_tape() are modified to take a 16-bit sense code as argument. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-32-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 01526b511d8879dd3c2baa2cb09377d25524a8fe Author: Damien Le Moal Date: Tue Sep 8 18:02:58 2026 +0900 scsi: ibmvscsi_tgt: Use combined sense codes Refactor the IBM virtual SCSI target driver to use scsi_set_sense_buffer() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-31-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 077aa184ebb4dc3cc52c2dcb1b5ab3e5d4c8d4cc Author: Damien Le Moal Date: Tue Sep 8 18:02:57 2026 +0900 scsi: libiscsi: Use combined sense codes Refactor libiscsi to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-30-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit d6dba463d867120abad1ff6923e0c1c6cf3e896a Author: Damien Le Moal Date: Tue Sep 8 18:02:56 2026 +0900 scsi: mvumi: Use combined sense codes Refactor the Marvell UMI driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-29-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f1ba68cc9baf6619b7fbcbc13e35a0ce1a4ac6ee Author: Damien Le Moal Date: Tue Sep 8 18:02:55 2026 +0900 scsi: stex: Use combined sense codes Refactor the stex driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-28-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 6af632bcf0ac525b1237b2e5053f7bb2d41d939d Author: Damien Le Moal Date: Tue Sep 8 18:02:54 2026 +0900 scsi: lpfc: Use combined sense codes Refactor the lpfc driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-27-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit fd09d129d9f64b0abd346d20afd533ef96bb465b Author: Damien Le Moal Date: Tue Sep 8 18:02:53 2026 +0900 scsi: ps3rom: Use combined sense codes Refactor the PS3 DVD driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-26-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 374219068a9a69f94f56195969fe1d1a2a832bbf Author: Damien Le Moal Date: Tue Sep 8 18:02:52 2026 +0900 scsi: qla2xxx: Use combined sense codes Refactor the qla2xxx driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. While at it, the declaration function qlt_send_resp_ctio(), which is modified to take a single 16-bit sense code argument, is changed to a static function declaration since that function is used only in the file where it is defined. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-25-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit aa5d14a035c5cca63a910c7ff183fbb0da9bbce5 Author: Damien Le Moal Date: Tue Sep 8 18:02:51 2026 +0900 scsi: smartpqi: Use combined sense codes Refactor the smartpqi driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Acked-by: Don Brace Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-24-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 6e9db936a1676c71dc9ab47560768b5e03429daf Author: Damien Le Moal Date: Tue Sep 8 18:02:50 2026 +0900 scsi: myrb: myrs: Use combined sense codes Refactor the Mylex RAID controller driver to use scsi_set_sense() and the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-23-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 0c4d570067fdb2db6238b48e03ace739797f94d0 Author: Damien Le Moal Date: Tue Sep 8 18:02:49 2026 +0900 scsi: megaraid: Use combined sense codes Refactor the megaraid driver to use the scsi_set_sense() function and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-22-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9141a92896e24e90b1254261470ef63df7c12dd7 Author: Damien Le Moal Date: Tue Sep 8 18:02:48 2026 +0900 scsi: leapraid: Use combined sense codes Refactor the leapraid driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. With this change, the locally defined macros for ASC and ASCQ values are deleted. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-21-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f2a39d466867e34c51dad4ef1a514b1c00d5ca19 Author: Damien Le Moal Date: Tue Sep 8 18:02:47 2026 +0900 scsi: 3w-xxxx: Use combined sense codes Modify the function tw_scsi_queue_lck() of the 3w-xxxx driver to use scsi_set_sense() and replace the hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-20-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit c9852524e91bc53c3f22d0a75e011f96d7fdb669 Author: Damien Le Moal Date: Tue Sep 8 18:02:46 2026 +0900 scsi: mpi3mr: Use combined sense codes Refactor the mpi3mr driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-19-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f2e04ffb273e60aba6d39fc0c591bd1d8f4d9018 Author: Damien Le Moal Date: Tue Sep 8 18:02:45 2026 +0900 scsi: mpt3sas: Use combined sense codes Refactor the mpt3sas driver to replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-18-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 8c88a8614870903ea2a454cac0851a3198bc93ce Author: Damien Le Moal Date: Tue Sep 8 18:02:44 2026 +0900 scsi: device_handlers: alua: Use combined sense codes Refactor the SCSI ALUA devie handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-17-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9f543ed64b1ea0f02af797cc1a88137651aa41fe Author: Damien Le Moal Date: Tue Sep 8 18:02:43 2026 +0900 scsi: device_handlers: emc: Use combined sense codes Refactor the EMC SCSI device handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-16-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 5c0ae0bcee35b9864702cd7866d2acf618ff9fb3 Author: Damien Le Moal Date: Tue Sep 8 18:02:42 2026 +0900 scsi: device_handlers: rdac: Use combined sense codes Refactor the NetApp E-Series RDAC SCSI device handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-15-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 700ab5e27925f883888501e9e2630ad8b8da49f7 Author: Damien Le Moal Date: Tue Sep 8 18:02:41 2026 +0900 scsi: device_handlers: hp_sw: Use combined sense codes Refactor the HP sw device handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-14-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9a21d5e12153f13b95213e0bf0c65b4a381b0ca9 Author: Damien Le Moal Date: Tue Sep 8 18:02:40 2026 +0900 scsi: st: Use combined sense codes Refactor the SCSI tape driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-13-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit fdec4b3a173570d5304ea78e690375acfd8a722e Author: Damien Le Moal Date: Tue Sep 8 18:02:39 2026 +0900 scsi: ch: Use combined sense codes Refactor the SCSI media changer driver to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-12-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 28e463a7be2d5f6a9abffeeb6e232b000d40e10c Author: Damien Le Moal Date: Tue Sep 8 18:02:38 2026 +0900 scsi: ses: Use combined sense codes Refactor the SCSI stroage enclosure driver to use the 16-bit sense_code field of struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-11-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b1d3523f87d6e42c55a9d640afe7e1b34caa5ecf Author: Damien Le Moal Date: Tue Sep 8 18:02:37 2026 +0900 scsi: sr: Use combined sense codes Refactor the SCSI CDROM driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-10-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b9d5da78ffda56be2c421ad064dbd777ffc42269 Author: Damien Le Moal Date: Tue Sep 8 18:02:36 2026 +0900 scsi: sd: Use combined sense codes Refactor the SCSI disk driver to use as much as possible the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-9-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 85952eaa682a4ea3dd4ce3875013e2aaf8000f88 Author: Damien Le Moal Date: Tue Sep 8 18:02:35 2026 +0900 scsi: core: Use combined sense codes Refactor the SCSI core code to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended, with the exception of a correction of the array any_sense_failure_defs in scsi_lib_test_any_sense() which erroenously sets result to SCMD_FAILURE_RESULT_ANY instead of SAM_STAT_CHECK_CONDITION and does not sets sense_key to SCMD_FAILURE_SENSE_KEY_ANY. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-8-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 319c440e4e4599a0d521479c883e09481946d26b Author: Damien Le Moal Date: Tue Sep 8 18:02:34 2026 +0900 scsi: core: Use struct scsi_sense_hdr to log sense keys and codes Instead of passing the sense key, additional sense code and additional sense code qualifier as separate parameters, change the functions scsi_extd_sense_format(), scsi_format_extd_sense(), and usb_stor_show_sense() to take a pointer to a struct scsi_sense_hdr to access the sense key and sense code with a single argument. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-7-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit ec5562d3ea803ec45831477129c626b2a22d2e2c Author: Damien Le Moal Date: Tue Sep 8 18:02:33 2026 +0900 scsi: core: Prepare for using combined sense codes In preparation for handling sense codes and their qualifers as a single 16-bit sense code field, with the values defined as macros in include/scsi/scsi_sense.h, modify the definition of the structures scsi_failure and scsi_sense_hdr to introduce a 16-bit sense_code field as a union with the existing 8-bit asc and ascq fields. This temporary modification allows accessing either the asc and ascq fields individually, or their combination as the 16-bit sense_code field. The helper functions scsi_sense_asc(), scsi_sense_ascq() are defined to allow accessing the 8-bit ASC and ASCQ values from the sense_code filed of struct scsi_sense_hdr. The helper functions scsi_failure_asc() and scsi_failure_ascq() provide the same for the sense code field of struct scsi_failure. The helper functions scsi_set_sense_buffer() and scsi_set_sense() are also added to wrap calls to scsi_build_sense_buffer() and scsi_build_sense() using a 16-bit sense code argument instead of the 8-bit ASC and ASCQ arguments. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-6-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 45cdf8164237277e52af5d8aa4218c3cb6199bf2 Author: Damien Le Moal Date: Tue Sep 8 18:02:32 2026 +0900 scsi: core: Rename sense field of struct scsi_failure Rename the sense field of struct scsi_failure to sense_key. This makes it clear that this field stores the sense key, and also unifies this structure field names with the names used in struct scsi_sense_hdr. To be consistent with this change, the macro SCMD_FAILURE_SENSE_ANY is renamed SCMD_FAILURE_SENSE_KEY_ANY. Of note is that the definition of the array any_sense_failure_defs in scsi_lib_test_any_sense() is modified to change the initialization of the result field to use SCMD_FAILURE_RESULT_ANY and add the .sense_key field initialization to SCMD_FAILURE_SENSE_KEY_ANY to match the test target case. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-5-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit c5c4382c2a1cf059248ab05a0c49a8935c0b89a3 Author: Damien Le Moal Date: Tue Sep 8 18:02:31 2026 +0900 scsi: core: constants: Rename internal struct field names To make the code more clear, rename the code12 field of struct error_info to the more natural name "code" and the fields code1, code2_min and code2_max of struct error_info2 to the more explicit asc, ascq_min and ascq_max. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-4-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 84517868c12dd4e06c1a08793f5687ec43961dd4 Author: Damien Le Moal Date: Tue Sep 8 18:02:30 2026 +0900 scsi: core: constants: Use defined sense codes The SENSE_CODE() macro is used for defining the array of struct error_info which associates a string description to an additional sense code and its combinations with additional sense code qualifiers. These are however hardcoded values. Now that all 16-bit sense codes are defined as macros in include/scsi/scsi_sense.h, modify sense_codes.h to use the defined sense code macros. While doing this, 2 missing entries are added for the codes OVERLAPPING_ATOMIC_COMMAND_IN_PROGRESS and DEPOPULATION_RESTORATION_INTERRUPTED. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-3-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 72c54bd0cbb2e0c35f4acd056e91c596469edc5f Author: Damien Le Moal Date: Tue Sep 8 18:02:29 2026 +0900 scsi: core: Define all additional sense codes and their qualifiers Introduce the file include/scsi/scsi_sense.h to define all existing additional sense codes and their combinations with additional sense code qualifiers, according to the most current T10 list available at https://www.t10.org/lists/asc-num.txt. Additional sense codes (ASCs) are individually defined as an 8-bit value with the ASC_ name prefix. The combination of all ASCs with T10 defined possible code qualifiers are defined as 16-bit values without any name prefix. The 16-bit value for ASCs with a zero ASCQ are defined together with the ASC 8-code using the ASC() macro. For names that may potentially create conflicts with other subsystems (e.g. WARNING or WRITE_ERROR), the SSC_ prefix is added to the sense code name. The sense key macro definitions in include/scsi/scsi_proto.h are also moved into this new file and scsi_sense.h is included in scsi_proto.h. The helper function scsi_sense_code() is defined to facilitate generating a 16-bit sense code from the 8-bit ASC and ASCQ. The accessors scsi_sense_code_asc() and scsi_sense_code_ascq() are defined for the reverse operations, that is, to respectively extract an ASC and an ASCQ from a 16-bit sense code. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-2-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b6ec0f79745967c751c85df373062c8d15e45fc4 Author: ZHOU Jiaxiang Date: Wed Sep 16 21:58:22 2026 +0800 scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit. Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_idx, which overflows past INT_MAX. Reject devices reporting more than INT_MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping. Fixes: 89d947561077 ("sd: Implement support for ZBC devices") Signed-off-by: ZHOU Jiaxiang Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/C41798AB5AA6BF2B+20260916135822.32584-3-me@fxti.xyz Signed-off-by: Martin K. Petersen (Oracle) commit 7c431d61b69a3fd0784c20aa4cd0b8fb501b5653 Author: ZHOU Jiaxiang Date: Wed Sep 16 21:58:21 2026 +0800 scsi: block: Fix zones_cond out-of-bounds write on zone report blk_revalidate_disk_zones() sizes the zones_cond array from the disk capacity and zone size, but the index used by blk_revalidate_zone_cond() comes from the device-driven report_zones() walk and is never checked against the array size. A device reporting more zones than fit the array makes blk_zone_set_cond() write out of bounds. One way to reach this is a zone count exceeding 32 bits: both blk_revalidate_zone_args.nr_zones and struct zoned_disk_info.nr_zones are unsigned int, so a disk advertising more than UINT_MAX zones (e.g. 2^32 + 1024 zones of one 512-byte logical block) gets its zone count truncated to a small value, undersizing the array while the report walk keeps counting upward. Check the index against the array size before storing the zone condition, and refuse to revalidate when the zone count does not fit 32 bits. Fixes: 6e945ffb6555 ("block: use zone condition to determine conventional zones") Signed-off-by: ZHOU Jiaxiang Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/7815D1B293A8F55E+20260916135822.32584-2-me@fxti.xyz Signed-off-by: Martin K. Petersen (Oracle) commit 278210c60c6f6958bd2eeaa2120c862683b83d09 Author: Arnd Bergmann Date: Tue Sep 15 22:20:59 2026 +0200 scsi: leapraid: Avoid -Wformat-security warning When extra warnings are enabled, the alloc_ordered_workqueue() function cannot be called with a variable name for the format string: drivers/scsi/leapraid/leapraid_os.c: In function 'leapraid_probe': drivers/scsi/leapraid/leapraid_os.c:2062:58: error: format not a string literal and no format arguments [-Werror=format-security] 2062 | alloc_ordered_workqueue(adapter->fw_evt_s.fw_evt_name, 0); | ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~ As the string is only assembled before the call and not used anywhere else, just fold the earlier snprintf() into the alloc_ordered_workqueue() call. Fixes: 5597088c9e79 ("scsi: leapraid: Add new SCSI driver") Signed-off-by: Arnd Bergmann Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260915202134.3534708-1-arnd@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f06a44e235ef188689ba23ffc72e9e89b10951a9 Author: Ewan D. Milne Date: Tue Sep 15 13:38:00 2026 -0400 scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC Symmetrix EMC Symmetrix returns an error on MODE SENSE for page 0Ah subpage 05h because it does not implement the SBC-5 I/O hints. These commands began to be sent as a result of commit 4f53138fffc2 ("scsi: sd: Translate data lifetime information"). Add BLIST_SKIP_IO_HINTS to avoid sending these commands because in large configurations the failed commands are displacing other useful information in internal error logs. Signed-off-by: Ewan D. Milne Link: https://patch.msgid.link/20260915173800.39117-1-emilne@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit bce07e2f37b5e4a427d36fd6b1c14067b27591db Author: Yehyeong Lee Date: Sat Aug 1 22:36:35 2026 +0900 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE. A target that answers a WRITE command's ITT with a Data-In therefore has the initiator write target-supplied bytes into the pages that write was about to send. Those are the caller's own pinned pages for an O_DIRECT write, and page cache pages for a buffered one. Observed against a test target that emits one 512-byte Data-In naming a 128 KB write's ITT, after the R2T for that write. With O_DIRECT the caller's buffer ends up holding 512 bytes of the target's data while pwrite() returns 131072. Buffered is quieter: pwrite() and fsync() both succeed, nothing is logged, and reading those blocks back returns the target's bytes out of the page cache without a command going on the wire. Check the direction before using the scatterlist, the way the R2T path already does. Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260801133635.1986706-1-yhlee@isslab.korea.ac.kr Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld") Signed-off-by: Martin K. Petersen (Oracle) commit c9ee6511332687ea714ad8ab86a53cb837d86eea Author: Geert Uytterhoeven Date: Mon Sep 14 16:00:01 2026 +0200 scsi: ufs: pltfrm: Add quirk for R-Car S4 lacking lanes-per-direction Since commit e72323f3b09f ("scsi: ufs: core: Configure only active lanes during link"), the following error is observed on R-Car S4: ufshcd-renesas e6860000.ufs: Tx lane mismatch [config,reported] [2,1] ufshcd-renesas e6860000.ufs: link startup failed -67 ufshcd-renesas e6860000.ufs: error -ENOLINK: Initialization failed with error -67 ufshcd-renesas e6860000.ufs: probe with driver ufshcd-renesas failed with error -67 R-Car S4 has one UFS lane per direction, as described in section 152.1 of its hardware manual. Without lanes-per-direction, the UFS platform driver defaults to two lanes. Previously, the core used PA_CONNECTEDRXDATALANES and PA_CONNECTEDTXDATALANES to configure the link without checking them against lanes-per-direction, so the missing property did not prevent initialization. While fixing the R-Car S4 DTS is the proper solution, doing only that would still break backwards compatibility with existing DTBs. Hence add a quirk to let lanes-per-direction default to one on R-Car S4. Fixes: e72323f3b09f9c89 ("scsi: ufs: core: Configure only active lanes during link") Reported-by: Koichiro Den Closes: https://lore.kernel.org/20260911073058.253000-1-den@valinux.co.jp Cc: stable@vger.kernel.org # 7.2+ Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/ae0cc2bd764e6dfffce99db3d8b44a55887c508c.1789394185.git.geert+renesas@glider.be Signed-off-by: Martin K. Petersen (Oracle) commit b52d695d062095327b944acf7daabbc816ab319b Author: Stanley Jhu Date: Sat Sep 12 21:16:25 2026 +0800 scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") switched UFS internal commands to allocate requests on hba->host->pseudo_sdev->request_queue, which shares the host tagset with regular LUNs. During error recovery, ufshcd_err_handling_prepare() calls blk_mq_quiesce_tagset(&hba->host->tag_set), marking all queues in the tagset as quiesced, including pseudo_sdev->request_queue. When ufshcd_verify_dev_init() subsequently issues internal commands (e.g. NOP OUT UPIU) via blk_execute_rq(), blk_mq_run_hw_queue() skips running the quiesced queue, resulting in an unrecoverable circular wait deadlock. Keep quiescing the tagset and unquiesce the pseudo SCSI device on top of that, so internal commands stay dispatchable while the logical units remain quiesced. Re-quiesce the pseudo device before unquiescing the tagset so that quiesce_depth stays balanced. Clock scaling and ufshcd_pause_command_processing() are unaffected: they keep quiescing the whole tagset, internal commands included. Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/6f78c4bd-a70b-402d-abfd-599091b67674@acm.org/ Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260912131625.2301486-1-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit f07317a8d57f382ec505597816271dd72ffa20c7 Author: Nitin Rawat Date: Wed Sep 9 11:09:44 2026 +0530 scsi: ufs: ufs-qcom: Enable only lane clocks in lane clock APIs ufs_qcom_enable_lane_clks() and ufs_qcom_disable_lane_clks() currently use clk_bulk_prepare_enable()/clk_bulk_disable_unprepare() on the entire host->clks array obtained from devm_clk_bulk_get_all(). This array contains all device clocks, not just lane symbol clocks. Since the UFS core framework already manages the non-lane clocks via the setup_clocks callback, the bulk enable/disable in the lane clock APIs resulted in duplicate reference count increments on those shared clocks. The extra enable counts were never balanced by a corresponding disable from the framework's clock gating path, preventing the clock reference counts from reaching zero and ultimately blocking CXO shutdown during low-power states. Fix this by restricting the lane clock APIs to only prepare/enable and disable/unprepare the three lane symbol clocks (tx_lane0_sync_clk, rx_lane0_sync_clk, rx_lane1_sync_clk), leaving the handling of all other clocks to the UFS core framework. The lane clocks are now acquired individually via devm_clk_get() instead of being looked up in the bulk clock array. Signed-off-by: Nitin Rawat Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260909053944.2827968-1-nitin.rawat@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit 55ad5deeea922ea854086b70e41415f50e2987ea Author: Bean Huo Date: Mon Sep 7 21:21:40 2026 +0200 scsi: ufs: core: Report the current clock frequency to devfreq When a driver does not provide a ->get_cur_freq() callback, the cur_freq sysfs attribute shows devfreq->previous_freq, which only tracks the scaling that the governor itself did. The UFS controller is also scaled outside the governor. The clearest example is writing 0 to clkscale_enable: ufshcd_clkscale_enable_store() sets the clocks to max_freq through ufshcd_devfreq_scale() and suspends the governor, so devfreq_set_target() is never called. After that, cur_freq keeps showing the last frequency the governor chose instead of the one the controller runs at, and it does so as long as clock scaling stays disabled. Add ufshcd_devfreq_get_cur_freq(). It reports clk_scaling.target_freq when OPPs are used and the first clock's curr_freq otherwise, the same values that ufshcd_devfreq_get_dev_status() reports. Signed-off-by: Bean Huo Reviewed-by: Avri Altman Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260907192140.2701755-5-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen (Oracle) commit 20ae446921e78e4e0182cea7559d34d839550e66 Author: Bean Huo Date: Mon Sep 7 21:21:39 2026 +0200 scsi: ufs: core: Record the frequency the controller starts at ufshcd_init_clocks() puts the controller at its highest frequency, but nothing writes that down. clk_scaling.target_freq stays 0, and devfreq_dev_profile.initial_freq is never set, so devfreq->previous_freq is 0 as well. With use_pm_opp this shows up in a few places. The target_freq attribute reads 0 until the governor scales for the first time. ufshcd_devfreq_get_dev_status() reports 0 Hz, which makes the ondemand governor ask for the maximum frequency. ufshcd_devfreq_target() then sees 0 != max and runs a full ufshcd_devfreq_scale(), which holds up the queue for up to a second only to set the same OPP and the same gear again. Without OPPs the frequency is not reported as 0, but previous_freq is, and devfreq_update_status() then drops the first time_in_state update. Record the maximum frequency in ufshcd_devfreq_init() instead. ufshcd_add_lus() runs after ufshcd_probe_hba() has geared up to hba->max_pwr_info.info, so the clocks and the gear are both at their maximum by the time we get here. The only difference is that the first governor poll no longer redoes work that is already done. From the second poll on nothing changes, because target_freq held the maximum frequency there anyway. That first scale also re-applied the gear that ufshcd_vops_freq_to_gear_speed() maps the maximum frequency to, so it quietly corrected the link if the OPP table and the gear negotiated at probe disagreed. That does not happen any more. On ufs-qcom the two cannot disagree, because ufs_qcom_negotiate_pwr_mode() clamps the gear through ufshcd_negotiate_pwr_params() against the same controller capability the OPP table is written from. clki->max_freq is the right value in both modes. ufshcd_parse_clock_min_max_freq() fills it from the highest OPP, and ufshcd_clkscale_enable_store() already uses it the same way. Suggested-by: Stanley Jhu Signed-off-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260907192140.2701755-4-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen (Oracle) commit 3d676e458fe0c566f5a62753dc696b6a862fc412 Author: Alberto Carboneri Date: Fri Sep 4 13:54:37 2026 +0000 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its mode header and block descriptors. The unsigned subtraction used for the MODE SELECT length can wrap, and the separately computed buf_data can point beyond buf. During automatic scan, enable is false, so the read-modify-write of buf_data[4] can clear the low two bits of a target-selected out-of-bounds stack byte. scsi_mode_select() can then copy up to 64 bytes from outside the buffer into the outgoing MODE SELECT payload, disclosing stack contents to the target. This is reachable while scanning a USB storage device that identifies as an ATA device and advertises CDL support. No filesystem mount or userspace access to the block device is required. On upstream commit cee9395acd80 ("Linux 7.3-rc1"), a build-specific, one-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator sampling executed a fixed proof command inside the guest and created a UID-0-owned marker during automatic enumeration, with KASLR and NX enabled. The issue was independently found during security research at Drivesec S.r.l. Cap the available length to the buffer size. Validate and consume the mode header and block descriptor lengths before using the page, and require the five bytes needed to access the CDL field. Fixes: 1b22cfb14142 ("scsi: core: Allow enabling and disabling command duration limits") Reported-by: Sashiko AI Review Closes: https://lore.kernel.org/linux-scsi/20260717192313.93D791F000E9@smtp.kernel.org/ Link: https://lore.kernel.org/linux-scsi/20260717222931.AC4EE1F000E9@smtp.kernel.org/ Link: https://lore.kernel.org/linux-scsi/df13ec87ac9b28e3b0a2d9eb26477e276ff0278a.camel@HansenPartnership.com/ Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Pimen Flavian Dei (Drivesec S.r.l.) Signed-off-by: Pimen Flavian Dei (Drivesec S.r.l.) Signed-off-by: Alberto Carboneri (Drivesec S.r.l.) Link: https://lore.kernel.org/linux-scsi/20260717192313.93D791F000E9@smtp.kernel.org/ Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260904135410.360314-1-acarboneri@drivesec.com Signed-off-by: Martin K. Petersen (Oracle) commit a09d77bcbe22db1a0b89f18d0a70074bb2453bc4 Author: Christoph Hellwig Date: Mon Aug 31 09:44:57 2026 +0300 scsi: scsi_debug: Add support to corrupt data and/or reftag Add a new debugfs file to inject corruptions of the data and/or reftag. This will be used to detect that protection information and/or file system checksumming can detect random bit errors or misplaced writes. To use this echo the start LBA, number of logical blocks and type of corruption into the new "corrupt" debugfs file for each scsi_debug device. For example: echo lba=42,num=1,bit_errors=2 > /sys/kernel/debug/scsi_debug/1:0:0:0/corrupt or echo lba=2,num=4,reftag_adjust=8 > /sys/kernel/debug/scsi_debug/1:0:0:0/corrupt The injection will be used by new xfstests test cases. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260831064500.2576832-2-hch@lst.de Signed-off-by: Martin K. Petersen (Oracle) commit 2ba1d12b2629827fdb1116eb3c9f8566911f2034 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:11 2026 +0530 scsi: mpi3mr: Fix NULL pointer dereference on PCI error recovery On a frozen PCI channel the driver unmaps the register window and frees the interrupts, but leaves the firmware event workqueue running. An event handler that is already in flight can still reach the register window after it has been unmapped. Stop event processing and drain the queue first, and start it again when the channel resumes. Fixes: 30bafe1774f0 ("scsi: mpi3mr: Support PCI Error Recovery callback handlers") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-18-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit c94c746e6c80439a4a9a0e1e20f2dae62a4d57ef Author: Chandrakanth Patil Date: Wed Aug 26 02:34:10 2026 +0530 scsi: mpi3mr: Fix use-after-free of the firmware event workqueue The enqueue path reads the workqueue pointer before taking the event lock, while the remove path clears that pointer and destroys the workqueue while holding it. The enqueue can therefore reach queue_work() after the workqueue is gone. Move the check inside the lock. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-17-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 052aea807cfbcefaf5b6ed8202f65da1fc65f4a0 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:09 2026 +0530 scsi: mpi3mr: zero out diagnostic buffer status memory Memory allocated for the BSG diagnostic buffer status is not zeroed before it is copied back to user space. Several fields in this structure are reserved and never written by the driver. Use kzalloc() instead of kmalloc() to zero out the allocated memory. Fixes: 78b506984ebe ("scsi: mpi3mr: Add ioctl support for HDB") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-16-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 7d572b4dc4ed0494e67097d4b7368666655f5c99 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:08 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read in PCIe topology change events The number of entries in a PCIe topology change event is used to walk the entry array without being compared against the amount of event data that was received. Bound the entry count to the received event data before use. Fixes: 8e653455547a ("scsi: mpi3mr: Add support for PCIe device event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-15-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 203b3072e7aa10d98b3f2b766693ea925cfc571d Author: Chandrakanth Patil Date: Wed Aug 26 02:34:07 2026 +0530 scsi: mpi3mr: Fix buffer overflow in the BSG target device map The size of the target device map buffer is held in a u16 while the number of devices it is derived from is not bounded to fit. With enough devices the size wraps, a short buffer is allocated, and the loop that fills it writes past the end. Do the calculation in size_t. Fixes: fb428a2005fc ("scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-14-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit f67caaa2521a3c8f931d1e679d831ba5ca654794 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:06 2026 +0530 scsi: mpi3mr: Fix out-of-bounds phy array access on link change The phy number that comes with a link change is used to index the node's phy array without being compared against the number of phys allocated for that node. Check it first. Fixes: 42fc9fee116f ("scsi: mpi3mr: Add helper functions to manage device's port") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-13-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 77554f01187d91c20f04d2a8e28270943ed64cca Author: Chandrakanth Patil Date: Wed Aug 26 02:34:05 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read of event data The event data length from the reply is used as is, both when caching log data and when sizing the buffer handed to the bottom half. A length larger than the frame makes both of them read past the end of it. Clamp the length to what the frame can hold. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Fixes: d0d19250ed81 ("scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-12-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9e220ce4bd0468e47cc9eea07e40799ebae6eda8 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:04 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read in SAS topology change events The number of entries in a SAS topology change event is used to walk the entry array without being compared against the amount of event data that was received, so the walk can run past the end of the buffer. Work out how many entries the payload can hold and skip the event if it claims more. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-11-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit a04b0f3a17e32aa449fd896163a7b40efc29c4f5 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:03 2026 +0530 scsi: mpi3mr: Fix target device reference leak in device removal handshake The device removal handshake looks up the target device to update its state but never drops the reference that the lookup takes. Drop it once the state has been updated. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-10-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 5dade59551d344d0308256edfef6bc3fb4202eb3 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:02 2026 +0530 scsi: mpi3mr: Fix out-of-bounds bitmap access during device removal Device handles reported by the controller are used to index the remove pending bitmap and to build a task management request without being compared against the maximum handle the controller reported. Check the handle before using it. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-9-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 7fea128f6b829ad834f21834d2605d28a45b903d Author: Chandrakanth Patil Date: Wed Aug 26 02:34:01 2026 +0530 scsi: mpi3mr: Fix out-of-bounds sense buffer access The sense buffer address reported on completion is turned into a virtual address with no range check, so an address outside the pool resolves to memory that does not belong to it. Check that it lies within the pool and is correctly aligned. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-8-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit bcf0a5bed59acd5ae19d80e1f617c1a5b355af0b Author: Chandrakanth Patil Date: Wed Aug 26 02:34:00 2026 +0530 scsi: mpi3mr: Fix out-of-bounds reply frame access The reply frame address reported on completion is only checked against the start and the end of the pool. An address near the top can pass the check while leaving less than a full frame, and an unaligned one resolves into the middle of a frame instead of the start of one. Require a whole frame to fit and the address to be frame aligned. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-7-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9ff1af19c488efad66f2b803eefa0abd5fdac8f4 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:59 2026 +0530 scsi: mpi3mr: Fix buffer overflow when caching log data Each log data slot holds a header followed by the payload, but the copy was sized against the whole slot and so wrote one header length past the end of it. Subtracting the header on its own is not enough either, because the entry size is derived from the controller reply size and can be smaller than the header. Work out the payload room first and clamp the copy to it. Fixes: 43ca11005098 ("scsi: mpi3mr: Add support for PEL commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-6-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit f0ec04bdf6156ed2ae7d86a8819dafdd9383b705 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:58 2026 +0530 scsi: mpi3mr: Fix target device reference leak in BSG task management The target device lookup takes a reference, but it is only dropped inside a branch that also requires the SCSI target data to be set up. When it is not, the reference is leaked. Drop the reference whenever the lookup succeeded. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-5-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 37e7d274272bc5e545e2d5f9261afa7f33f1cf49 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:57 2026 +0530 scsi: mpi3mr: Fix I/O block counter leak on admin request post failure The per device I/O block counter is raised before a task management request is posted and only lowered once the request completes. If the post itself fails the counter stays raised and I/O to that device remains blocked. Lower it on the failure path as well. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-4-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9fac4cbd66d852958e8a8d0952eb57f8554ce83b Author: Chandrakanth Patil Date: Wed Aug 26 02:33:56 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read when copying BSG MPI requests The MPI request is copied out of the caller supplied payload without first checking that the requested amount is actually present, so the copy can read past the end of the payload buffer. Check the range before copying. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-3-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 896abdd4d81f40575b05d593f7fe004935a6cf97 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:55 2026 +0530 scsi: mpi3mr: Fix buffer overflow in BSG passthrough request copy The size of an incoming BSG request is checked using a variable that is narrower than the field it is read from, so large values wrap and pass the check. The copy that follows then uses the full value and writes past the request buffer. Widen the variable and copy only the amount that was checked. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-2-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 2cf34575b6498e909193222c3c2c940a2e3fbd8f Author: John Garry Date: Wed Sep 2 10:28:44 2026 +0100 scsi: scsi_debug: Default to a higher throughput config Currently the default config goes not give as high a throughput as some would like. Give a higher default throughput by modifying the following: - Set completion response delay as 0 - Increase shost can_queue to 4096, which aligns better with modern high-speed HBAs - Turn on clustering Signed-off-by: John Garry Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260902092844.1741533-1-john.garry@linux.dev Signed-off-by: Martin K. Petersen (Oracle) commit 657eff806d38abd73e0002cda070c4cf14eb9882 Author: Jorge Ramirez-Ortiz Date: Mon Aug 31 17:48:01 2026 +0200 scsi: ufs: rpmb: Use a fixed-length RPMB dev_id The RPMB authentication key is derived from the dev_id handed to the RPMB subsystem. OP-TEE implements the eMMC RPMB flow, where the dev_id is the eMMC CID: a fixed 16-byte value the key derivation depends on. The UFS RPMB id is "-R", which is variable length and longer than 16 bytes. Handing it to the RPMB subsystem as-is would tie the derived key to a length OP-TEE does not expect and diverge from the fixed-CID eMMC ABI, forcing OP-TEE to be taught about variable-length UFS ids. A fixed 16-byte dev_id is needed so the derived key stays stable and unique per region while matching the eMMC CID layout OP-TEE relies on, keeping the key-derivation ABI identical with no OP-TEE change. The reduction to a fixed 16 bytes must also be reproducible by the bootloaders (such as U-Boot) that derive the same dev_id. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260831154804.719528-3-jorge.ramirez@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit a8a34238e5e65609a434fc13aa1d64fcf2df1d23 Author: Jorge Ramirez-Ortiz Date: Mon Aug 31 17:48:00 2026 +0200 scsi: ufs: rpmb: Retry power-on UNIT ATTENTION on the RPMB WLUN After a power cycle, the first command sent to any UFS logical unit completes with CHECK CONDITION reporting a power-on UNIT ATTENTION. The SCSI core surfaces this condition to the caller rather than retrying it. For the RPMB well-known LU the first command after boot is the first RPMB frame, and RPMB has no earlier, guaranteed access that could clear the condition beforehand. The power-on UNIT ATTENTION therefore reaches RPMB and fails that first frame, breaking RPMB on every cold boot. The RPMB WLUN needs the power-on UNIT ATTENTION to be retried so that RPMB works from the very first access after a power cycle. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260831154804.719528-2-jorge.ramirez@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit 6b0f8a689ef3e84a9b2fc1a5753466dfbd566306 Author: Geert Uytterhoeven Date: Mon Aug 31 11:49:20 2026 +0200 scsi: zorro7xx: Use individual zorro_driver_data structures Using an array of zorro_driver_data objects and referring to its elements by index obfuscates the code and is error-prone. Improve readability and reduce code size by replacing the array (which includes an unneeded sentinel) by individual zorro_driver_data objects. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/7deafe83754415c5beb280f3c1808e153029e890.1788169600.git.geert@linux-m68k.org Signed-off-by: Martin K. Petersen (Oracle) commit 0cb1fd924126f1f581621a5e804df98a02be9dff Author: Arun Easi Date: Thu Sep 3 10:55:47 2026 -0700 scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU When CPU Hyper Threading is disabled, sibling CPUs remain present but are reported offline. Managed MSI-X IRQs can still receive affinity masks that include those offline CPUs. If a driver-critical vector is managed, it can be parked on an offline CPU and the driver may miss critical events such as link-up. Keep driver-critical vectors unmanaged so they can be migrated by the IRQ core when their target CPU is offlined. Since HWQ-0 is unmanaged now, in some queue combinations there can be no mappings to it in mq_map. So without the blk-mq fix mentioned below, system may crash during cpu offline/online tests. Fixes: 8a8449ca5e33 ("scsi: fnic: Modify ISRs to support multiqueue (MQ)") Cc: stable@vger.kernel.org Depends-on: commit 10845a105bbc ("blk-mq: skip CPU offline notify on unmapped hctx") Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Karan Tilak Kumar Signed-off-by: Arun Easi Reviewed-by: Laurence Oberman Link: https://patch.msgid.link/20260903175547.57971-1-aeasi@cisco.com Signed-off-by: Martin K. Petersen (Oracle) commit 1274045b0eda1df5a5cdd3e63ed48cf013b3b4ea Author: Venkat Rao Bagalkote Date: Thu Sep 3 13:13:29 2026 +0530 scsi: ibmvfc: Add Kconfig dependency to fix link failure when NVME_FC=m Building with CONFIG_SCSI_IBMVFC=y and CONFIG_NVME_FC=m results in a link failure: ibmvfc-nvme.o: undefined reference to `nvme_fc_register_localport' ibmvfc-nvme.o: undefined reference to `nvme_fc_register_remoteport' ibmvfc-nvme.o: undefined reference to `nvme_fc_unregister_localport' ibmvfc-nvme.o: undefined reference to `nvme_fc_unregister_remoteport' ibmvfc-core.o: undefined reference to `nvme_fc_rescan_remoteport' IS_ENABLED() evaluates to 1 for both =y and =m, so the nvme_fc_* call sites are kept in the object file. When SCSI_IBMVFC=y (built-in) but NVME_FC=m (loadable module), the linker cannot resolve these symbols at vmlinux link time. Add the same "depends on NVME_FC || NVME_FC=n" constraint already used by SCSI_LPFC to prevent this configuration. Reported-by: Pavithra Closes: https://lore.kernel.org/all/327877a29337aa526cc50ac88fbddb86@linux.ibm.com/ Signed-off-by: Venkat Rao Bagalkote Tested-by: Pavithra Acked-by: Tyrel Datwyler Link: https://patch.msgid.link/20260903074329.6705-1-venkat88@linux.ibm.com Signed-off-by: Martin K. Petersen (Oracle) commit 779f202a92ef10a426efc07d0f4267918cb07ca3 Author: Karl Mehltretter Date: Sun Sep 6 19:10:09 2026 +0200 scsi: qla2xxx: Fix the ql2xfc2target parameter description The module parameter is ql2xfc2target, but its MODULE_PARM_DESC() names qla2xfc2target, so modinfo describes a parameter that does not exist and shows no description for the real one. Use the parameter name in the description. Fixes: 877b03795fcf ("scsi: qla2xxx: Add option to disable FC2 Target support") Assisted-by: LLM Signed-off-by: Karl Mehltretter Link: https://patch.msgid.link/20260906171009.2560-1-kmehltretter@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 264bf9655c3d067d775a46f05eb8c871c488a864 Author: Karl Mehltretter Date: Sun Sep 6 19:09:25 2026 +0200 scsi: pm80xx: Fix the use_msix, use_tasklet and read_wwn parameter descriptions The MODULE_PARM_DESC() lines of use_msix, use_tasklet and read_wwn all name a parameter zoned, which does not exist, and the use_tasklet one repeats the use_msix text. modinfo shows three "zoned" entries and no description for the real parameters. Name the right parameters and describe use_tasklet. Fixes: efa1fca45082 ("scsi: pm8001: Remove PM8001_USE_MSIX") Fixes: 205430290ad0 ("scsi: pm8001: Remove PM8001_USE_TASKLET") Fixes: 80975adc79dd ("scsi: pm8001: Remove PM8001_READ_VPD") Assisted-by: LLM Signed-off-by: Karl Mehltretter Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260906170925.2524-1-kmehltretter@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit e83b47309f73313e75c3888d7839666aba5b2b2a Author: John Garry Date: Mon Aug 31 09:58:21 2026 +0000 scsi: core: Drop Scsi_Host.default_lock Back in the 2.6.xx days, it was possible to for low-level drivers to set the shost lock pointer. That is why there is a default lock and a pointer to the shost lock. However, support for this has long been removed, so drop Scsi_Host.default_lock and make Scsi_Host.host_lock as the actual lock. Getting the address of embedded host_lock structure just requires adding a fixed offset value to the shost pointer. However, getting the value of the host_lock pointer requires loading from a fixed offset to the shost pointer. The latter should be very slightly slower, which is relevant as this lock is used a lot throughout the core code and drivers. Signed-off-by: John Garry Acked-by: Damien Le Moal # ata parts Reviewed-by: Hannes Reinecke Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260831095821.3486994-1-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen (Oracle) commit e64b8f3224add21f02c5d64e11371830e631cdba Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:37 2026 +0300 scsi: sym53c8xx_2: Replace __get_free_pages() with kmalloc() sym53c8xx_2 driver has an internal memory allocator for small allocations of the driver structures. The backing memory for that allocator is allocated with __get_free_pages(). This memory can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Performance difference between kmalloc() and __get_free_pages() is not measurable as both allocators take an object/page from a per-CPU list for fast path allocations. For the slow path the performance is anyway determined by the amount of reclaim involved rather than by what allocator is used. Replace use of __get_free_pages() with kmalloc() and free_pages() with kfree(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-4-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 0abe3fb1c5056b7f2f99178b23db8aa95dd03f85 Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:36 2026 +0300 scsi: ipr: Use kmalloc() to allocate IPR dump buffer memory IPR dump machinery allocates memory to save adapter's crash dump using __get_free_page(). This memory can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). While on it, relax GFP_ATOMIC to GFP_NOIO for allocation of dump buffers. The allocations happen in a workqueue context, but with storage adapter being in a state where it can't handle I/O. Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Tested-by: Wen Xiong Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-3-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b4fe0d7d41eacf3c2ffa54eef3e5e93ac8777518 Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:35 2026 +0300 scsi: proc: Use kmalloc() in proc writers proc_scsi_host_write(), proc_scsi_write() and proc_scsi_devinfo_write() allocate temporary buffers for /proc writes using __get_free_page(). These buffers can be allocated with kmalloc() as there's nothing special about them to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Reviewed-by: John Garry Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-2-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f07ed527235c44e0aae53100133bb547f5ee448f Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:34 2026 +0300 scsi: target: file: Use kmalloc() to allocate temporary protection buffer fd_do_prot_unmap() uses __get_free_page() to allocate a temporary buffer that is used to invalidate protection info for the unmapped region by filling with 0xff pattern. This buffer can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-1-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle)