commit e6687d574bbe142751bcfa6dd0f42d5abd1c2756 Author: Ranjan Kumar Date: Wed Sep 16 13:57:05 2026 +0530 scsi: mpi3mr: Driver version update to 8.18.0.8.50 Update driver version to 8.18.0.8.50 Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-11-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit c90693e02d10e9318f2f7cc480e9b05430628738 Author: Ranjan Kumar Date: Wed Sep 16 13:57:04 2026 +0530 scsi: mpi3mr: Fix SAS PHY cleanup in host addition error paths When adding a SAS host, the driver allocates a PHY array and subsequently creates individual SAS PHYs. If a later step fails, the error path exits without cleaning up previously allocated resources, resulting in leaks of both the PHY array and any registered SAS PHYs. Additionally, the return value of mpi3mr_add_host_phy() was being ignored. If it failed, mr_sas_phy->phy would be left as NULL, which could later lead to a NULL pointer dereference in mpi3mr_sas_port_add() when the attached device triggers a device addition event. Add a dedicated cleanup path that deletes any successfully created SAS PHYs and frees the PHY array before returning from initialization failure paths. Also, check the return value of mpi3mr_add_host_phy() and jump to the cleanup path on failure. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=9 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-10-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 29e3f0856e8544ca185be3403518a102e0ca29fc Author: Ranjan Kumar Date: Wed Sep 16 13:57:03 2026 +0530 scsi: mpi3mr: Fix SAS port allocation and registration error handling During SAS port creation, the driver does not verify successful port allocation before attempting registration, which can lead to a NULL pointer dereference. Additionally, if registration fails, the allocated port is not freed, resulting in a memory leak. Fix this by adding a NULL check after allocation and freeing the port when registration fails. Additional fixes in the error handling path include: 1. Fixing similar missing NULL checks for rphy allocations. 2. Cleaning up after a failed rphy registration tried to remove a device that was never added, causing a crash. The rphy is now freed directly instead. 3. A failed rphy registration left the target device with a dangling pointer and a stuck pending flag. Both are now cleared. 4. Phys removed on error kept an internal flag set, permanently blocking them from being added to a port again. Now cleared alongside the list removal. 5. Could block in the SCSI mid-layer after a stop or reset had already begun, the same ABBA deadlock class fixed elsewhere. The port allocation path now stops before that call once that is detected. 6. The same reset check on the port removal path caused a memory leak and a kernel BUG() on rediscovery. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=8 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=8 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=8 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=8 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-9-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 59f8c361872df3df9c47ad612a4562cd08441cc5 Author: Ranjan Kumar Date: Wed Sep 16 13:57:02 2026 +0530 scsi: mpi3mr: Fix firmware event reference leak during cleanup During firmware event cleanup, when an event is currently executing or pending at the SCSI mid-layer, the driver sets a discard flag and exits the cleanup routine early. This early exit skips the normal cancel path, resulting in the firmware event reference count not being decremented, leading to a reference leak. Additionally, resolve the following concurrency issues in the firmware event handling paths: 1. mpi3mr_cleanup_fwevt_list() read current_event locklessly. It is now acquired under fwevt_lock. 2. mpi3mr_dequeue_fwevt() dropped the reference before returning it, risking a use-after-free. The drop is now moved into mpi3mr_cancel_work(). 3. mpi3mr_fwevt_bh() dropped fwevt_lock mid-move, racing with unload. The move is now inlined under one continuous lock hold. 4. pending_at_sml was read/written without a lock, risking an ABBA deadlock. It is now protected by fwevt_lock throughout. 5. mpi3mr_suspend() could unmap PCI resources before the event worker finished. It now flushes the workqueue first. 6. mpi3mr_report_tgtdev_to_host() and mpi3mr_remove_tgtdev_from_host() could still set pending_at_sml and block in the SCSI mid-layer after a stop or reset had already begun, deadlocking against the thread waiting on that flag. Both now bail out beforehand once stop_drv_processing or reset_in_progress is set. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=7 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=7 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=7 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-8-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit ea8dfd05a0fcabe3ea8bb8a3b9e45b5170a210a2 Author: Ranjan Kumar Date: Wed Sep 16 13:57:01 2026 +0530 scsi: mpi3mr: Fix memory leak on operational queue creation failure When operational queue creation fails after one or more queues have been created, the error path frees the queue information arrays but does not release the DMA memory segments associated with the created queues, resulting in a memory leak. Fix this by ensuring that partially allocated segments are freed immediately if a queue fails to create. Additionally, resolve the following issues in the queue segment free/alloc paths: 1. Clear mrioc->intr_info[].op_reply_q with WRITE_ONCE() and follow it with synchronize_irq() before freeing segments, and have the ISR paths read it once via READ_ONCE() into a local, to close a race where the ISR could use the pointer while it is being freed. 2. Free q_segment_list before checking q_segments in both free functions, since a kzalloc_objs() failure on q_segments left q_segment_list leaked via the early return. 3. The threaded poll handler returned without re-enabling the interrupt when the reply queue was already gone, leaving that interrupt line permanently masked. It now re-enables it before returning. 4. Two other callers read the same pointer without a NULL check, which could now be reached with a NULL value. Add the check at the single point they both call through, and read the pointer consistently with the writer above. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=6 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=6 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=6 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=6 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-7-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 7342b9f0e3065c086605f075a204972d270b267b Author: Ranjan Kumar Date: Wed Sep 16 13:57:00 2026 +0530 scsi: mpi3mr: Fix performance regression caused by extended IRQ poll sleep Commit 24d7071d9645 ("scsi: mpi3mr: A performance fix") increased the threaded IRQ poll sleep range from 2-20 us to 20-21 us to work around a timer slack issue. On kernels unaffected by the timer slack issue, the longer sleep interval reduces reply queue processing efficiency and causes an approximately 7% throughput regression on NVMe direct-attached RAID10 configurations. Restore the IRQ poll sleep base to 2 us (widening the usleep_range() upper bound to 10x the base instead of a fixed +1 us) to recover the lost throughput, and skip the sleep entirely once pend_ios reaches 0 so the poll loop exits immediately at the tail of a completion burst. Additionally, resolve the following issues in the reply queue processing and polling logic: 1. Add missing dma_rmb() memory barriers in the admin and operational reply queue processing loops. This ensures that the descriptor payload is only read after the phase bit check is complete, preventing weakly ordered architectures from speculatively processing stale data. 2. Add bounds checking for `request_queue_id` in mpi3mr_process_op_reply_q(). An out-of-range id is now logged and the descriptor is retired (consumer index advanced, phase toggled on wraparound) rather than aborting the loop in place, which previously left the same corrupted descriptor at the head of the ring forever and stalled polling indefinitely. It is not counted toward pend_ios, since no real completion was processed for it. 3. Recheck for a late-arriving descriptor via dma_rmb() while still holding op_reply_q->in_use, instead of releasing it and reclaiming it afterward, which could race and reprocess a descriptor with stale indices or double-decrement in_use. 4. Replace a direct panic() call with a safe ioc_err() log and abort in mpi3mr_process_op_reply_desc() when mpi3mr_get_reply_virt_addr() returns NULL. This prevents a single malformed DMA reply address from crashing the entire host OS. The reply_dma output parameter is also cleared before returning, since it was already populated with the unvalidated address before the NULL check. Leaving it set would make the caller repost that unvalidated address back to the hardware. Note: The unbounded busy-wait loop (usleep_range) in mpi3mr_isr_poll() flagged by automated review is intentionally retained. This short sleep polling mechanism is critical for batching completions and achieving the target throughput on high-performance NVMe configurations. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=5 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=5 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=5 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=5 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-6-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit fb8b6139770a5dee8ace9e605b5c3d11861506c8 Author: Ranjan Kumar Date: Wed Sep 16 13:56:59 2026 +0530 scsi: mpi3mr: Fix NVMe page size caching for non-operational devices For NVMe devices in an error state, the cached PCIe page size remains unset. This causes management IOCTL validation to fail, preventing requests from reaching firmware and returning incorrect errors to userspace. Populate the page size attribute irrespective of device access status so firmware can process IOCTLs and report appropriate errors. Additionally, harden the device initialization path against invalid firmware data for non-operational devices: 1. Add bounds checking for page_size, falling back to 4096 bytes (shift exponent 12) to prevent undefined shift behavior and kernel panics. The minimum valid NVMe page size shift is 12 and maximum is 27. 2. Initialize reset_to and abort_to timeouts with default values to prevent IOCTLs from failing instantly. To avoid race conditions where concurrent readers might observe these default timeouts before they are updated with firmware values, use local variables to compute the final values before writing them to the device structure. 3. Read the firmware-provided page size once into a local variable before validating and using it, since it lives in memory the device can also write to. Using it directly in both the check and the assignment allowed the two to observe different values. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=4 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=4 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=4 Closes: https://sashiko.dev/#/patchset/20260805110634.346670-1-ranjan.kumar@broadcom.com?part=4 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-5-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 48c666139acfef3bce5cc337b7d2cc2e089f87b5 Author: Ranjan Kumar Date: Wed Sep 16 13:56:58 2026 +0530 scsi: mpi3mr: Add early timestamp synchronization after driver load When the driver is loaded from initramfs, the controller timestamp may be initialized before the system clock has been synchronized. As a result, the controller can operate with a stale timestamp until the first periodic synchronization occurs. Currently, the first controller timestamp synchronization occurs only after the configured ts_update_interval expires (15 minutes by default). Add an early timestamp synchronization 60 seconds after driver load, followed by the existing periodic synchronization interval. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-4-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 1567cd497fa98a078c60224766021556085bc662 Author: Ranjan Kumar Date: Wed Sep 16 13:56:57 2026 +0530 scsi: mpi3mr: Update MPI Headers to revision 41 Update MPI Headers to revision 41 Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-3-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit ab21857b2715ec3c7f53d16c9449370fbdebfc37 Author: Ranjan Kumar Date: Wed Sep 16 13:56:56 2026 +0530 scsi: mpi3mr: Skip device shutdown during unload per controller configuration The controller may be configured through Driver Page 1 to suppress device shutdown requests during driver unload. Cache this setting and skip the device shutdown request during IOC shutdown when unloading the driver. Additionally, ensure the driver_pg1 fields are properly converted from little-endian to CPU endianness using le32_to_cpu() and le16_to_cpu() before evaluating the shutdown disable flag and allocating diag buffers. This prevents failures and massive memory allocation errors on big-endian architectures. Also harden the diagnostic buffer allocation retry loops against invalid firmware-provided decrement sizes. The trace buffer loop already guarded against a zero or oversized decrement size (infinite loop or unsigned underflow). The firmware buffer loop had the same gap and now carries the same guard. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=1 Closes: https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=1 Closes: https://sashiko.dev/#/patchset/20260724102505.115136-1-ranjan.kumar@broadcom.com?part=1 Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20260916082705.44712-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit cdc97921de02a0c1a8324afa03e8b3e30a72bbe6 Author: Bart Van Assche Date: Mon Aug 31 10:48:21 2026 -0700 scsi: pm8001: Fix SATA FIS offset in struct hw_event_resp In struct hw_event_resp, sas_identify was defined using struct sas_identify_frame, which is 32 bytes long because it includes a 4-byte CRC field. However, PM8001 and PM80xx hardware does not send the CRC in the event response frame, providing only the 28-byte identify payload. Because sas_identify had a size of 32 bytes, the following sata_fis member was located at byte offset 44 instead of the actual hardware offset 40. In hw_event_sata_phy_up(), this discrepancy was worked around with negative pointer arithmetic: ((u8 *)&pPayload->sata_fis - 4). This triggers a compiler error under Clang with -Wstringop-overread: error: 'memcpy' reading 20 bytes from a region of size 0 [-Werror,-Wstringop-overread] memcpy(phy->frame_rcvd, ((u8 *)&pPayload->sata_fis - 4), Move struct sas_identify_frame_local (28 bytes) into pm8001_defs.h, and update struct hw_event_resp in both pm8001_hwi.h and pm80xx_hwi.h to use struct sas_identify_frame_local followed by sata_fis and a 4-byte padding word. This correctly aligns sata_fis at byte offset 40 while maintaining the 64-byte total payload size. Update hw_event_sata_phy_up() in pm8001_hwi.c and pm80xx_hwi.c to copy directly from &pPayload->sata_fis. Compile-tested only. Both the patch and its description have been generated by Gemini. Fixes: dbf9bfe61571 ("[SCSI] pm8001: add SAS/SATA HBA driver") Fixes: f5860992db55 ("[SCSI] pm80xx: Added SPCv/ve specific hardware functionalities and relevant changes in common files") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/31963d53810f42970447e78ef46030ab13d2e91f.1788198434.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 42d1221d321e55afc7bba9109a77aaf5a817c8a3 Author: Bart Van Assche Date: Mon Aug 31 12:27:20 2026 -0700 scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() Protect the megasas_get_ctrl_info() call in megasas_resume() with instance->reset_mutex using scoped_guard(). megasas_get_ctrl_info() may release and reacquire instance->reset_mutex. Hence, calling this function without holding instance->reset_mutex is not safe. Fixes: c3b10a55abc9 ("scsi: megaraid_sas: Update controller info during resume") Cc: Kashyap Desai Cc: Sumit Saxena Cc: Shivasharan S Cc: Chandrakanth patil Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/f06b5ee432b21cf293f0663e15b64f75a84b9fd5.1788204406.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 15de2788c91cc407f7e6fc6a07be27b10048cbce Author: Damien Le Moal Date: Tue Sep 8 18:03:08 2026 +0900 scsi: core: Remove scsi_build_sense() and scsi_build_sense_buffer() Now that all code has been converted to use 16-bit sense codes and to initialize sense with scsi_set_sense() and scsi_set_sense_buffer(), remove the inline definitions of these new functions, change scsi_build_sense() and scsi_build_sense_buffer() to use a single 16-bit sense code as argument (instead of separate arguments for the ASC and ASCQ), and rename them to scsi_set_sense() and scsi_set_sense_buffer(). Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-41-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit ddfb3e0257b27f14847fd8a76159d7e43ce5fee8 Author: Damien Le Moal Date: Tue Sep 8 18:03:07 2026 +0900 scsi: core: Clean up scsi_proto.h Now that all users of SCSI sense codes have been modified to use macro definitions and the 16-bit sense code instead of separate 8-bit ASC and ASCQ, remove the now unused asc and ascq fields of struct scsi_failure and struct scsi_sense_hdr, and the old (and incomplete) definitions of SCSI additional sense codes and sense code qualifiers in scsi_proto.h. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-40-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 3f37a1a804fc02d43695fdfe290c0077c1ffaba8 Author: Damien Le Moal Date: Tue Sep 8 18:03:06 2026 +0900 scsi: s390: Use combined sense codes Use the 16-bit sense codes and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-39-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit c44f095a9d1768d9be6cf0c1b12e95619d6af9b4 Author: Damien Le Moal Date: Tue Sep 8 18:03:05 2026 +0900 scsi: ata: libata: Use combined sense codes Refactor libata core code to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Acked-by: Niklas Cassel Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-38-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 4152825a15d5f5d7a810e19a1e77a8561525b020 Author: Damien Le Moal Date: Tue Sep 8 18:03:04 2026 +0900 scsi: cdrom: Use combined sense codes Refactor the cdrom driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-37-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 134875ed31d4d866dbe3cd1a3461e76f08d030b4 Author: Damien Le Moal Date: Tue Sep 8 18:03:03 2026 +0900 scsi: usb: storage: Use combined sense codes Refactor the USB mass storage driver to replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-36-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9dd9bcb293f0fa575f497dd58172fcdcd2978113 Author: Damien Le Moal Date: Tue Sep 8 18:03:02 2026 +0900 scsi: target: Use combined sense codes Refactor the target core code to use the 16-bit sense codes for building sense and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-35-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 3f7abb6b35305a7da0575091ad5f7c9af0f37480 Author: Damien Le Moal Date: Tue Sep 8 18:03:01 2026 +0900 scsi: storvsc: Use combined sense codes Refactor the storvsc driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-34-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 3f94a6f129bf5bf2e634049d438b8794e019c17f Author: Damien Le Moal Date: Tue Sep 8 18:03:00 2026 +0900 scsi: hpsa: Use combined sense codes Refactor the hpsa driver to replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. The function decode_sense_data() is also modified to take a pointer to a 16-bit sense_code variable in place of the two pointers to the additional sense code and its code qualifier. The local definitions of ASCs and ASCQs are deleted too. No functional change intended, but the function hpsa_volume_offline() was checking only the addditional sense code qualifier with checking the additional sense code. This change assumes that the intended additional sense code to check is ASC_LU_NOT_READY. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Acked-by: Don Brace Link: https://patch.msgid.link/20260908090308.1085097-33-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 1b7ea7bb198e73a5237d3799187e46fe2b818ef5 Author: Damien Le Moal Date: Tue Sep 8 18:02:59 2026 +0900 scsi: scsi_debug: Use combined sense codes Refactor the scsi_debug driver to replace hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. The functions mk_sense_buffer() and mk_sense_info_tape() are modified to take a 16-bit sense code as argument. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-32-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 01526b511d8879dd3c2baa2cb09377d25524a8fe Author: Damien Le Moal Date: Tue Sep 8 18:02:58 2026 +0900 scsi: ibmvscsi_tgt: Use combined sense codes Refactor the IBM virtual SCSI target driver to use scsi_set_sense_buffer() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-31-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 077aa184ebb4dc3cc52c2dcb1b5ab3e5d4c8d4cc Author: Damien Le Moal Date: Tue Sep 8 18:02:57 2026 +0900 scsi: libiscsi: Use combined sense codes Refactor libiscsi to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-30-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit d6dba463d867120abad1ff6923e0c1c6cf3e896a Author: Damien Le Moal Date: Tue Sep 8 18:02:56 2026 +0900 scsi: mvumi: Use combined sense codes Refactor the Marvell UMI driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-29-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f1ba68cc9baf6619b7fbcbc13e35a0ce1a4ac6ee Author: Damien Le Moal Date: Tue Sep 8 18:02:55 2026 +0900 scsi: stex: Use combined sense codes Refactor the stex driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-28-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 6af632bcf0ac525b1237b2e5053f7bb2d41d939d Author: Damien Le Moal Date: Tue Sep 8 18:02:54 2026 +0900 scsi: lpfc: Use combined sense codes Refactor the lpfc driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-27-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit fd09d129d9f64b0abd346d20afd533ef96bb465b Author: Damien Le Moal Date: Tue Sep 8 18:02:53 2026 +0900 scsi: ps3rom: Use combined sense codes Refactor the PS3 DVD driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-26-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 374219068a9a69f94f56195969fe1d1a2a832bbf Author: Damien Le Moal Date: Tue Sep 8 18:02:52 2026 +0900 scsi: qla2xxx: Use combined sense codes Refactor the qla2xxx driver to use scsi_set_sense() and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. While at it, the declaration function qlt_send_resp_ctio(), which is modified to take a single 16-bit sense code argument, is changed to a static function declaration since that function is used only in the file where it is defined. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-25-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit aa5d14a035c5cca63a910c7ff183fbb0da9bbce5 Author: Damien Le Moal Date: Tue Sep 8 18:02:51 2026 +0900 scsi: smartpqi: Use combined sense codes Refactor the smartpqi driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Acked-by: Don Brace Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-24-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 6e9db936a1676c71dc9ab47560768b5e03429daf Author: Damien Le Moal Date: Tue Sep 8 18:02:50 2026 +0900 scsi: myrb: myrs: Use combined sense codes Refactor the Mylex RAID controller driver to use scsi_set_sense() and the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-23-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 0c4d570067fdb2db6238b48e03ace739797f94d0 Author: Damien Le Moal Date: Tue Sep 8 18:02:49 2026 +0900 scsi: megaraid: Use combined sense codes Refactor the megaraid driver to use the scsi_set_sense() function and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-22-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9141a92896e24e90b1254261470ef63df7c12dd7 Author: Damien Le Moal Date: Tue Sep 8 18:02:48 2026 +0900 scsi: leapraid: Use combined sense codes Refactor the leapraid driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. With this change, the locally defined macros for ASC and ASCQ values are deleted. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-21-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f2a39d466867e34c51dad4ef1a514b1c00d5ca19 Author: Damien Le Moal Date: Tue Sep 8 18:02:47 2026 +0900 scsi: 3w-xxxx: Use combined sense codes Modify the function tw_scsi_queue_lck() of the 3w-xxxx driver to use scsi_set_sense() and replace the hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-20-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit c9852524e91bc53c3f22d0a75e011f96d7fdb669 Author: Damien Le Moal Date: Tue Sep 8 18:02:46 2026 +0900 scsi: mpi3mr: Use combined sense codes Refactor the mpi3mr driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-19-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f2e04ffb273e60aba6d39fc0c591bd1d8f4d9018 Author: Damien Le Moal Date: Tue Sep 8 18:02:45 2026 +0900 scsi: mpt3sas: Use combined sense codes Refactor the mpt3sas driver to replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-18-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 8c88a8614870903ea2a454cac0851a3198bc93ce Author: Damien Le Moal Date: Tue Sep 8 18:02:44 2026 +0900 scsi: device_handlers: alua: Use combined sense codes Refactor the SCSI ALUA devie handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-17-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9f543ed64b1ea0f02af797cc1a88137651aa41fe Author: Damien Le Moal Date: Tue Sep 8 18:02:43 2026 +0900 scsi: device_handlers: emc: Use combined sense codes Refactor the EMC SCSI device handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-16-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 5c0ae0bcee35b9864702cd7866d2acf618ff9fb3 Author: Damien Le Moal Date: Tue Sep 8 18:02:42 2026 +0900 scsi: device_handlers: rdac: Use combined sense codes Refactor the NetApp E-Series RDAC SCSI device handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-15-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 700ab5e27925f883888501e9e2630ad8b8da49f7 Author: Damien Le Moal Date: Tue Sep 8 18:02:41 2026 +0900 scsi: device_handlers: hp_sw: Use combined sense codes Refactor the HP sw device handler driver to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-14-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9a21d5e12153f13b95213e0bf0c65b4a381b0ca9 Author: Damien Le Moal Date: Tue Sep 8 18:02:40 2026 +0900 scsi: st: Use combined sense codes Refactor the SCSI tape driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-13-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit fdec4b3a173570d5304ea78e690375acfd8a722e Author: Damien Le Moal Date: Tue Sep 8 18:02:39 2026 +0900 scsi: ch: Use combined sense codes Refactor the SCSI media changer driver to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-12-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 28e463a7be2d5f6a9abffeeb6e232b000d40e10c Author: Damien Le Moal Date: Tue Sep 8 18:02:38 2026 +0900 scsi: ses: Use combined sense codes Refactor the SCSI stroage enclosure driver to use the 16-bit sense_code field of struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-11-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b1d3523f87d6e42c55a9d640afe7e1b34caa5ecf Author: Damien Le Moal Date: Tue Sep 8 18:02:37 2026 +0900 scsi: sr: Use combined sense codes Refactor the SCSI CDROM driver to use the 16-bit sense_code field of struct scsi_sense_hdr and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-10-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b9d5da78ffda56be2c421ad064dbd777ffc42269 Author: Damien Le Moal Date: Tue Sep 8 18:02:36 2026 +0900 scsi: sd: Use combined sense codes Refactor the SCSI disk driver to use as much as possible the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-9-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 85952eaa682a4ea3dd4ce3875013e2aaf8000f88 Author: Damien Le Moal Date: Tue Sep 8 18:02:35 2026 +0900 scsi: core: Use combined sense codes Refactor the SCSI core code to use the 16-bit sense_code field of struct scsi_sense_hdr and struct scsi_failure and replace all hard-coded additional sense codes and additional sense code qualifiers with the enum values defined in include/scsi/scsi_sense.h. This helps with code clarity as the sense codes being processed are easier to test and self-documented. No functional change intended, with the exception of a correction of the array any_sense_failure_defs in scsi_lib_test_any_sense() which erroenously sets result to SCMD_FAILURE_RESULT_ANY instead of SAM_STAT_CHECK_CONDITION and does not sets sense_key to SCMD_FAILURE_SENSE_KEY_ANY. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-8-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 319c440e4e4599a0d521479c883e09481946d26b Author: Damien Le Moal Date: Tue Sep 8 18:02:34 2026 +0900 scsi: core: Use struct scsi_sense_hdr to log sense keys and codes Instead of passing the sense key, additional sense code and additional sense code qualifier as separate parameters, change the functions scsi_extd_sense_format(), scsi_format_extd_sense(), and usb_stor_show_sense() to take a pointer to a struct scsi_sense_hdr to access the sense key and sense code with a single argument. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-7-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit ec5562d3ea803ec45831477129c626b2a22d2e2c Author: Damien Le Moal Date: Tue Sep 8 18:02:33 2026 +0900 scsi: core: Prepare for using combined sense codes In preparation for handling sense codes and their qualifers as a single 16-bit sense code field, with the values defined as macros in include/scsi/scsi_sense.h, modify the definition of the structures scsi_failure and scsi_sense_hdr to introduce a 16-bit sense_code field as a union with the existing 8-bit asc and ascq fields. This temporary modification allows accessing either the asc and ascq fields individually, or their combination as the 16-bit sense_code field. The helper functions scsi_sense_asc(), scsi_sense_ascq() are defined to allow accessing the 8-bit ASC and ASCQ values from the sense_code filed of struct scsi_sense_hdr. The helper functions scsi_failure_asc() and scsi_failure_ascq() provide the same for the sense code field of struct scsi_failure. The helper functions scsi_set_sense_buffer() and scsi_set_sense() are also added to wrap calls to scsi_build_sense_buffer() and scsi_build_sense() using a 16-bit sense code argument instead of the 8-bit ASC and ASCQ arguments. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-6-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 45cdf8164237277e52af5d8aa4218c3cb6199bf2 Author: Damien Le Moal Date: Tue Sep 8 18:02:32 2026 +0900 scsi: core: Rename sense field of struct scsi_failure Rename the sense field of struct scsi_failure to sense_key. This makes it clear that this field stores the sense key, and also unifies this structure field names with the names used in struct scsi_sense_hdr. To be consistent with this change, the macro SCMD_FAILURE_SENSE_ANY is renamed SCMD_FAILURE_SENSE_KEY_ANY. Of note is that the definition of the array any_sense_failure_defs in scsi_lib_test_any_sense() is modified to change the initialization of the result field to use SCMD_FAILURE_RESULT_ANY and add the .sense_key field initialization to SCMD_FAILURE_SENSE_KEY_ANY to match the test target case. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-5-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit c5c4382c2a1cf059248ab05a0c49a8935c0b89a3 Author: Damien Le Moal Date: Tue Sep 8 18:02:31 2026 +0900 scsi: core: constants: Rename internal struct field names To make the code more clear, rename the code12 field of struct error_info to the more natural name "code" and the fields code1, code2_min and code2_max of struct error_info2 to the more explicit asc, ascq_min and ascq_max. No functional change intended. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-4-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 84517868c12dd4e06c1a08793f5687ec43961dd4 Author: Damien Le Moal Date: Tue Sep 8 18:02:30 2026 +0900 scsi: core: constants: Use defined sense codes The SENSE_CODE() macro is used for defining the array of struct error_info which associates a string description to an additional sense code and its combinations with additional sense code qualifiers. These are however hardcoded values. Now that all 16-bit sense codes are defined as macros in include/scsi/scsi_sense.h, modify sense_codes.h to use the defined sense code macros. While doing this, 2 missing entries are added for the codes OVERLAPPING_ATOMIC_COMMAND_IN_PROGRESS and DEPOPULATION_RESTORATION_INTERRUPTED. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-3-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 72c54bd0cbb2e0c35f4acd056e91c596469edc5f Author: Damien Le Moal Date: Tue Sep 8 18:02:29 2026 +0900 scsi: core: Define all additional sense codes and their qualifiers Introduce the file include/scsi/scsi_sense.h to define all existing additional sense codes and their combinations with additional sense code qualifiers, according to the most current T10 list available at https://www.t10.org/lists/asc-num.txt. Additional sense codes (ASCs) are individually defined as an 8-bit value with the ASC_ name prefix. The combination of all ASCs with T10 defined possible code qualifiers are defined as 16-bit values without any name prefix. The 16-bit value for ASCs with a zero ASCQ are defined together with the ASC 8-code using the ASC() macro. For names that may potentially create conflicts with other subsystems (e.g. WARNING or WRITE_ERROR), the SSC_ prefix is added to the sense code name. The sense key macro definitions in include/scsi/scsi_proto.h are also moved into this new file and scsi_sense.h is included in scsi_proto.h. The helper function scsi_sense_code() is defined to facilitate generating a 16-bit sense code from the 8-bit ASC and ASCQ. The accessors scsi_sense_code_asc() and scsi_sense_code_ascq() are defined for the reverse operations, that is, to respectively extract an ASC and an ASCQ from a 16-bit sense code. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260908090308.1085097-2-dlemoal@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b6ec0f79745967c751c85df373062c8d15e45fc4 Author: ZHOU Jiaxiang Date: Wed Sep 16 21:58:22 2026 +0800 scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit. Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_idx, which overflows past INT_MAX. Reject devices reporting more than INT_MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping. Fixes: 89d947561077 ("sd: Implement support for ZBC devices") Signed-off-by: ZHOU Jiaxiang Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/C41798AB5AA6BF2B+20260916135822.32584-3-me@fxti.xyz Signed-off-by: Martin K. Petersen (Oracle) commit 7c431d61b69a3fd0784c20aa4cd0b8fb501b5653 Author: ZHOU Jiaxiang Date: Wed Sep 16 21:58:21 2026 +0800 scsi: block: Fix zones_cond out-of-bounds write on zone report blk_revalidate_disk_zones() sizes the zones_cond array from the disk capacity and zone size, but the index used by blk_revalidate_zone_cond() comes from the device-driven report_zones() walk and is never checked against the array size. A device reporting more zones than fit the array makes blk_zone_set_cond() write out of bounds. One way to reach this is a zone count exceeding 32 bits: both blk_revalidate_zone_args.nr_zones and struct zoned_disk_info.nr_zones are unsigned int, so a disk advertising more than UINT_MAX zones (e.g. 2^32 + 1024 zones of one 512-byte logical block) gets its zone count truncated to a small value, undersizing the array while the report walk keeps counting upward. Check the index against the array size before storing the zone condition, and refuse to revalidate when the zone count does not fit 32 bits. Fixes: 6e945ffb6555 ("block: use zone condition to determine conventional zones") Signed-off-by: ZHOU Jiaxiang Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/7815D1B293A8F55E+20260916135822.32584-2-me@fxti.xyz Signed-off-by: Martin K. Petersen (Oracle) commit 278210c60c6f6958bd2eeaa2120c862683b83d09 Author: Arnd Bergmann Date: Tue Sep 15 22:20:59 2026 +0200 scsi: leapraid: Avoid -Wformat-security warning When extra warnings are enabled, the alloc_ordered_workqueue() function cannot be called with a variable name for the format string: drivers/scsi/leapraid/leapraid_os.c: In function 'leapraid_probe': drivers/scsi/leapraid/leapraid_os.c:2062:58: error: format not a string literal and no format arguments [-Werror=format-security] 2062 | alloc_ordered_workqueue(adapter->fw_evt_s.fw_evt_name, 0); | ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~ As the string is only assembled before the call and not used anywhere else, just fold the earlier snprintf() into the alloc_ordered_workqueue() call. Fixes: 5597088c9e79 ("scsi: leapraid: Add new SCSI driver") Signed-off-by: Arnd Bergmann Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260915202134.3534708-1-arnd@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f06a44e235ef188689ba23ffc72e9e89b10951a9 Author: Ewan D. Milne Date: Tue Sep 15 13:38:00 2026 -0400 scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC Symmetrix EMC Symmetrix returns an error on MODE SENSE for page 0Ah subpage 05h because it does not implement the SBC-5 I/O hints. These commands began to be sent as a result of commit 4f53138fffc2 ("scsi: sd: Translate data lifetime information"). Add BLIST_SKIP_IO_HINTS to avoid sending these commands because in large configurations the failed commands are displacing other useful information in internal error logs. Signed-off-by: Ewan D. Milne Link: https://patch.msgid.link/20260915173800.39117-1-emilne@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit bce07e2f37b5e4a427d36fd6b1c14067b27591db Author: Yehyeong Lee Date: Sat Aug 1 22:36:35 2026 +0900 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE. A target that answers a WRITE command's ITT with a Data-In therefore has the initiator write target-supplied bytes into the pages that write was about to send. Those are the caller's own pinned pages for an O_DIRECT write, and page cache pages for a buffered one. Observed against a test target that emits one 512-byte Data-In naming a 128 KB write's ITT, after the R2T for that write. With O_DIRECT the caller's buffer ends up holding 512 bytes of the target's data while pwrite() returns 131072. Buffered is quieter: pwrite() and fsync() both succeed, nothing is logged, and reading those blocks back returns the target's bytes out of the page cache without a command going on the wire. Check the direction before using the scatterlist, the way the R2T path already does. Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260801133635.1986706-1-yhlee@isslab.korea.ac.kr Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld") Signed-off-by: Martin K. Petersen (Oracle) commit c9ee6511332687ea714ad8ab86a53cb837d86eea Author: Geert Uytterhoeven Date: Mon Sep 14 16:00:01 2026 +0200 scsi: ufs: pltfrm: Add quirk for R-Car S4 lacking lanes-per-direction Since commit e72323f3b09f ("scsi: ufs: core: Configure only active lanes during link"), the following error is observed on R-Car S4: ufshcd-renesas e6860000.ufs: Tx lane mismatch [config,reported] [2,1] ufshcd-renesas e6860000.ufs: link startup failed -67 ufshcd-renesas e6860000.ufs: error -ENOLINK: Initialization failed with error -67 ufshcd-renesas e6860000.ufs: probe with driver ufshcd-renesas failed with error -67 R-Car S4 has one UFS lane per direction, as described in section 152.1 of its hardware manual. Without lanes-per-direction, the UFS platform driver defaults to two lanes. Previously, the core used PA_CONNECTEDRXDATALANES and PA_CONNECTEDTXDATALANES to configure the link without checking them against lanes-per-direction, so the missing property did not prevent initialization. While fixing the R-Car S4 DTS is the proper solution, doing only that would still break backwards compatibility with existing DTBs. Hence add a quirk to let lanes-per-direction default to one on R-Car S4. Fixes: e72323f3b09f9c89 ("scsi: ufs: core: Configure only active lanes during link") Reported-by: Koichiro Den Closes: https://lore.kernel.org/20260911073058.253000-1-den@valinux.co.jp Cc: stable@vger.kernel.org # 7.2+ Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/ae0cc2bd764e6dfffce99db3d8b44a55887c508c.1789394185.git.geert+renesas@glider.be Signed-off-by: Martin K. Petersen (Oracle) commit b52d695d062095327b944acf7daabbc816ab319b Author: Stanley Jhu Date: Sat Sep 12 21:16:25 2026 +0800 scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") switched UFS internal commands to allocate requests on hba->host->pseudo_sdev->request_queue, which shares the host tagset with regular LUNs. During error recovery, ufshcd_err_handling_prepare() calls blk_mq_quiesce_tagset(&hba->host->tag_set), marking all queues in the tagset as quiesced, including pseudo_sdev->request_queue. When ufshcd_verify_dev_init() subsequently issues internal commands (e.g. NOP OUT UPIU) via blk_execute_rq(), blk_mq_run_hw_queue() skips running the quiesced queue, resulting in an unrecoverable circular wait deadlock. Keep quiescing the tagset and unquiesce the pseudo SCSI device on top of that, so internal commands stay dispatchable while the logical units remain quiesced. Re-quiesce the pseudo device before unquiescing the tagset so that quiesce_depth stays balanced. Clock scaling and ufshcd_pause_command_processing() are unaffected: they keep quiescing the whole tagset, internal commands included. Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/6f78c4bd-a70b-402d-abfd-599091b67674@acm.org/ Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260912131625.2301486-1-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit f07317a8d57f382ec505597816271dd72ffa20c7 Author: Nitin Rawat Date: Wed Sep 9 11:09:44 2026 +0530 scsi: ufs: ufs-qcom: Enable only lane clocks in lane clock APIs ufs_qcom_enable_lane_clks() and ufs_qcom_disable_lane_clks() currently use clk_bulk_prepare_enable()/clk_bulk_disable_unprepare() on the entire host->clks array obtained from devm_clk_bulk_get_all(). This array contains all device clocks, not just lane symbol clocks. Since the UFS core framework already manages the non-lane clocks via the setup_clocks callback, the bulk enable/disable in the lane clock APIs resulted in duplicate reference count increments on those shared clocks. The extra enable counts were never balanced by a corresponding disable from the framework's clock gating path, preventing the clock reference counts from reaching zero and ultimately blocking CXO shutdown during low-power states. Fix this by restricting the lane clock APIs to only prepare/enable and disable/unprepare the three lane symbol clocks (tx_lane0_sync_clk, rx_lane0_sync_clk, rx_lane1_sync_clk), leaving the handling of all other clocks to the UFS core framework. The lane clocks are now acquired individually via devm_clk_get() instead of being looked up in the bulk clock array. Signed-off-by: Nitin Rawat Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260909053944.2827968-1-nitin.rawat@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit 55ad5deeea922ea854086b70e41415f50e2987ea Author: Bean Huo Date: Mon Sep 7 21:21:40 2026 +0200 scsi: ufs: core: Report the current clock frequency to devfreq When a driver does not provide a ->get_cur_freq() callback, the cur_freq sysfs attribute shows devfreq->previous_freq, which only tracks the scaling that the governor itself did. The UFS controller is also scaled outside the governor. The clearest example is writing 0 to clkscale_enable: ufshcd_clkscale_enable_store() sets the clocks to max_freq through ufshcd_devfreq_scale() and suspends the governor, so devfreq_set_target() is never called. After that, cur_freq keeps showing the last frequency the governor chose instead of the one the controller runs at, and it does so as long as clock scaling stays disabled. Add ufshcd_devfreq_get_cur_freq(). It reports clk_scaling.target_freq when OPPs are used and the first clock's curr_freq otherwise, the same values that ufshcd_devfreq_get_dev_status() reports. Signed-off-by: Bean Huo Reviewed-by: Avri Altman Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260907192140.2701755-5-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen (Oracle) commit 20ae446921e78e4e0182cea7559d34d839550e66 Author: Bean Huo Date: Mon Sep 7 21:21:39 2026 +0200 scsi: ufs: core: Record the frequency the controller starts at ufshcd_init_clocks() puts the controller at its highest frequency, but nothing writes that down. clk_scaling.target_freq stays 0, and devfreq_dev_profile.initial_freq is never set, so devfreq->previous_freq is 0 as well. With use_pm_opp this shows up in a few places. The target_freq attribute reads 0 until the governor scales for the first time. ufshcd_devfreq_get_dev_status() reports 0 Hz, which makes the ondemand governor ask for the maximum frequency. ufshcd_devfreq_target() then sees 0 != max and runs a full ufshcd_devfreq_scale(), which holds up the queue for up to a second only to set the same OPP and the same gear again. Without OPPs the frequency is not reported as 0, but previous_freq is, and devfreq_update_status() then drops the first time_in_state update. Record the maximum frequency in ufshcd_devfreq_init() instead. ufshcd_add_lus() runs after ufshcd_probe_hba() has geared up to hba->max_pwr_info.info, so the clocks and the gear are both at their maximum by the time we get here. The only difference is that the first governor poll no longer redoes work that is already done. From the second poll on nothing changes, because target_freq held the maximum frequency there anyway. That first scale also re-applied the gear that ufshcd_vops_freq_to_gear_speed() maps the maximum frequency to, so it quietly corrected the link if the OPP table and the gear negotiated at probe disagreed. That does not happen any more. On ufs-qcom the two cannot disagree, because ufs_qcom_negotiate_pwr_mode() clamps the gear through ufshcd_negotiate_pwr_params() against the same controller capability the OPP table is written from. clki->max_freq is the right value in both modes. ufshcd_parse_clock_min_max_freq() fills it from the highest OPP, and ufshcd_clkscale_enable_store() already uses it the same way. Suggested-by: Stanley Jhu Signed-off-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260907192140.2701755-4-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen (Oracle) commit 3d676e458fe0c566f5a62753dc696b6a862fc412 Author: Alberto Carboneri Date: Fri Sep 4 13:54:37 2026 +0000 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its mode header and block descriptors. The unsigned subtraction used for the MODE SELECT length can wrap, and the separately computed buf_data can point beyond buf. During automatic scan, enable is false, so the read-modify-write of buf_data[4] can clear the low two bits of a target-selected out-of-bounds stack byte. scsi_mode_select() can then copy up to 64 bytes from outside the buffer into the outgoing MODE SELECT payload, disclosing stack contents to the target. This is reachable while scanning a USB storage device that identifies as an ATA device and advertises CDL support. No filesystem mount or userspace access to the block device is required. On upstream commit cee9395acd80 ("Linux 7.3-rc1"), a build-specific, one-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator sampling executed a fixed proof command inside the guest and created a UID-0-owned marker during automatic enumeration, with KASLR and NX enabled. The issue was independently found during security research at Drivesec S.r.l. Cap the available length to the buffer size. Validate and consume the mode header and block descriptor lengths before using the page, and require the five bytes needed to access the CDL field. Fixes: 1b22cfb14142 ("scsi: core: Allow enabling and disabling command duration limits") Reported-by: Sashiko AI Review Closes: https://lore.kernel.org/linux-scsi/20260717192313.93D791F000E9@smtp.kernel.org/ Link: https://lore.kernel.org/linux-scsi/20260717222931.AC4EE1F000E9@smtp.kernel.org/ Link: https://lore.kernel.org/linux-scsi/df13ec87ac9b28e3b0a2d9eb26477e276ff0278a.camel@HansenPartnership.com/ Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Pimen Flavian Dei (Drivesec S.r.l.) Signed-off-by: Pimen Flavian Dei (Drivesec S.r.l.) Signed-off-by: Alberto Carboneri (Drivesec S.r.l.) Link: https://lore.kernel.org/linux-scsi/20260717192313.93D791F000E9@smtp.kernel.org/ Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260904135410.360314-1-acarboneri@drivesec.com Signed-off-by: Martin K. Petersen (Oracle) commit a09d77bcbe22db1a0b89f18d0a70074bb2453bc4 Author: Christoph Hellwig Date: Mon Aug 31 09:44:57 2026 +0300 scsi: scsi_debug: Add support to corrupt data and/or reftag Add a new debugfs file to inject corruptions of the data and/or reftag. This will be used to detect that protection information and/or file system checksumming can detect random bit errors or misplaced writes. To use this echo the start LBA, number of logical blocks and type of corruption into the new "corrupt" debugfs file for each scsi_debug device. For example: echo lba=42,num=1,bit_errors=2 > /sys/kernel/debug/scsi_debug/1:0:0:0/corrupt or echo lba=2,num=4,reftag_adjust=8 > /sys/kernel/debug/scsi_debug/1:0:0:0/corrupt The injection will be used by new xfstests test cases. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260831064500.2576832-2-hch@lst.de Signed-off-by: Martin K. Petersen (Oracle) commit 2ba1d12b2629827fdb1116eb3c9f8566911f2034 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:11 2026 +0530 scsi: mpi3mr: Fix NULL pointer dereference on PCI error recovery On a frozen PCI channel the driver unmaps the register window and frees the interrupts, but leaves the firmware event workqueue running. An event handler that is already in flight can still reach the register window after it has been unmapped. Stop event processing and drain the queue first, and start it again when the channel resumes. Fixes: 30bafe1774f0 ("scsi: mpi3mr: Support PCI Error Recovery callback handlers") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-18-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit c94c746e6c80439a4a9a0e1e20f2dae62a4d57ef Author: Chandrakanth Patil Date: Wed Aug 26 02:34:10 2026 +0530 scsi: mpi3mr: Fix use-after-free of the firmware event workqueue The enqueue path reads the workqueue pointer before taking the event lock, while the remove path clears that pointer and destroys the workqueue while holding it. The enqueue can therefore reach queue_work() after the workqueue is gone. Move the check inside the lock. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-17-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 052aea807cfbcefaf5b6ed8202f65da1fc65f4a0 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:09 2026 +0530 scsi: mpi3mr: zero out diagnostic buffer status memory Memory allocated for the BSG diagnostic buffer status is not zeroed before it is copied back to user space. Several fields in this structure are reserved and never written by the driver. Use kzalloc() instead of kmalloc() to zero out the allocated memory. Fixes: 78b506984ebe ("scsi: mpi3mr: Add ioctl support for HDB") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-16-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 7d572b4dc4ed0494e67097d4b7368666655f5c99 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:08 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read in PCIe topology change events The number of entries in a PCIe topology change event is used to walk the entry array without being compared against the amount of event data that was received. Bound the entry count to the received event data before use. Fixes: 8e653455547a ("scsi: mpi3mr: Add support for PCIe device event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-15-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 203b3072e7aa10d98b3f2b766693ea925cfc571d Author: Chandrakanth Patil Date: Wed Aug 26 02:34:07 2026 +0530 scsi: mpi3mr: Fix buffer overflow in the BSG target device map The size of the target device map buffer is held in a u16 while the number of devices it is derived from is not bounded to fit. With enough devices the size wraps, a short buffer is allocated, and the loop that fills it writes past the end. Do the calculation in size_t. Fixes: fb428a2005fc ("scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-14-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit f67caaa2521a3c8f931d1e679d831ba5ca654794 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:06 2026 +0530 scsi: mpi3mr: Fix out-of-bounds phy array access on link change The phy number that comes with a link change is used to index the node's phy array without being compared against the number of phys allocated for that node. Check it first. Fixes: 42fc9fee116f ("scsi: mpi3mr: Add helper functions to manage device's port") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-13-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 77554f01187d91c20f04d2a8e28270943ed64cca Author: Chandrakanth Patil Date: Wed Aug 26 02:34:05 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read of event data The event data length from the reply is used as is, both when caching log data and when sizing the buffer handed to the bottom half. A length larger than the frame makes both of them read past the end of it. Clamp the length to what the frame can hold. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Fixes: d0d19250ed81 ("scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-12-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9e220ce4bd0468e47cc9eea07e40799ebae6eda8 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:04 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read in SAS topology change events The number of entries in a SAS topology change event is used to walk the entry array without being compared against the amount of event data that was received, so the walk can run past the end of the buffer. Work out how many entries the payload can hold and skip the event if it claims more. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-11-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit a04b0f3a17e32aa449fd896163a7b40efc29c4f5 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:03 2026 +0530 scsi: mpi3mr: Fix target device reference leak in device removal handshake The device removal handshake looks up the target device to update its state but never drops the reference that the lookup takes. Drop it once the state has been updated. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-10-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 5dade59551d344d0308256edfef6bc3fb4202eb3 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:02 2026 +0530 scsi: mpi3mr: Fix out-of-bounds bitmap access during device removal Device handles reported by the controller are used to index the remove pending bitmap and to build a task management request without being compared against the maximum handle the controller reported. Check the handle before using it. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-9-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 7fea128f6b829ad834f21834d2605d28a45b903d Author: Chandrakanth Patil Date: Wed Aug 26 02:34:01 2026 +0530 scsi: mpi3mr: Fix out-of-bounds sense buffer access The sense buffer address reported on completion is turned into a virtual address with no range check, so an address outside the pool resolves to memory that does not belong to it. Check that it lies within the pool and is correctly aligned. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-8-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit bcf0a5bed59acd5ae19d80e1f617c1a5b355af0b Author: Chandrakanth Patil Date: Wed Aug 26 02:34:00 2026 +0530 scsi: mpi3mr: Fix out-of-bounds reply frame access The reply frame address reported on completion is only checked against the start and the end of the pool. An address near the top can pass the check while leaving less than a full frame, and an unaligned one resolves into the middle of a frame instead of the start of one. Require a whole frame to fit and the address to be frame aligned. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-7-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9ff1af19c488efad66f2b803eefa0abd5fdac8f4 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:59 2026 +0530 scsi: mpi3mr: Fix buffer overflow when caching log data Each log data slot holds a header followed by the payload, but the copy was sized against the whole slot and so wrote one header length past the end of it. Subtracting the header on its own is not enough either, because the entry size is derived from the controller reply size and can be smaller than the header. Work out the payload room first and clamp the copy to it. Fixes: 43ca11005098 ("scsi: mpi3mr: Add support for PEL commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-6-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit f0ec04bdf6156ed2ae7d86a8819dafdd9383b705 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:58 2026 +0530 scsi: mpi3mr: Fix target device reference leak in BSG task management The target device lookup takes a reference, but it is only dropped inside a branch that also requires the SCSI target data to be set up. When it is not, the reference is leaked. Drop the reference whenever the lookup succeeded. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-5-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 37e7d274272bc5e545e2d5f9261afa7f33f1cf49 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:57 2026 +0530 scsi: mpi3mr: Fix I/O block counter leak on admin request post failure The per device I/O block counter is raised before a task management request is posted and only lowered once the request completes. If the post itself fails the counter stays raised and I/O to that device remains blocked. Lower it on the failure path as well. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-4-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9fac4cbd66d852958e8a8d0952eb57f8554ce83b Author: Chandrakanth Patil Date: Wed Aug 26 02:33:56 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read when copying BSG MPI requests The MPI request is copied out of the caller supplied payload without first checking that the requested amount is actually present, so the copy can read past the end of the payload buffer. Check the range before copying. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-3-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 896abdd4d81f40575b05d593f7fe004935a6cf97 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:55 2026 +0530 scsi: mpi3mr: Fix buffer overflow in BSG passthrough request copy The size of an incoming BSG request is checked using a variable that is narrower than the field it is read from, so large values wrap and pass the check. The copy that follows then uses the full value and writes past the request buffer. Widen the variable and copy only the amount that was checked. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-2-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 2cf34575b6498e909193222c3c2c940a2e3fbd8f Author: John Garry Date: Wed Sep 2 10:28:44 2026 +0100 scsi: scsi_debug: Default to a higher throughput config Currently the default config goes not give as high a throughput as some would like. Give a higher default throughput by modifying the following: - Set completion response delay as 0 - Increase shost can_queue to 4096, which aligns better with modern high-speed HBAs - Turn on clustering Signed-off-by: John Garry Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260902092844.1741533-1-john.garry@linux.dev Signed-off-by: Martin K. Petersen (Oracle) commit 657eff806d38abd73e0002cda070c4cf14eb9882 Author: Jorge Ramirez-Ortiz Date: Mon Aug 31 17:48:01 2026 +0200 scsi: ufs: rpmb: Use a fixed-length RPMB dev_id The RPMB authentication key is derived from the dev_id handed to the RPMB subsystem. OP-TEE implements the eMMC RPMB flow, where the dev_id is the eMMC CID: a fixed 16-byte value the key derivation depends on. The UFS RPMB id is "-R", which is variable length and longer than 16 bytes. Handing it to the RPMB subsystem as-is would tie the derived key to a length OP-TEE does not expect and diverge from the fixed-CID eMMC ABI, forcing OP-TEE to be taught about variable-length UFS ids. A fixed 16-byte dev_id is needed so the derived key stays stable and unique per region while matching the eMMC CID layout OP-TEE relies on, keeping the key-derivation ABI identical with no OP-TEE change. The reduction to a fixed 16 bytes must also be reproducible by the bootloaders (such as U-Boot) that derive the same dev_id. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260831154804.719528-3-jorge.ramirez@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit a8a34238e5e65609a434fc13aa1d64fcf2df1d23 Author: Jorge Ramirez-Ortiz Date: Mon Aug 31 17:48:00 2026 +0200 scsi: ufs: rpmb: Retry power-on UNIT ATTENTION on the RPMB WLUN After a power cycle, the first command sent to any UFS logical unit completes with CHECK CONDITION reporting a power-on UNIT ATTENTION. The SCSI core surfaces this condition to the caller rather than retrying it. For the RPMB well-known LU the first command after boot is the first RPMB frame, and RPMB has no earlier, guaranteed access that could clear the condition beforehand. The power-on UNIT ATTENTION therefore reaches RPMB and fails that first frame, breaking RPMB on every cold boot. The RPMB WLUN needs the power-on UNIT ATTENTION to be retried so that RPMB works from the very first access after a power cycle. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260831154804.719528-2-jorge.ramirez@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit 6b0f8a689ef3e84a9b2fc1a5753466dfbd566306 Author: Geert Uytterhoeven Date: Mon Aug 31 11:49:20 2026 +0200 scsi: zorro7xx: Use individual zorro_driver_data structures Using an array of zorro_driver_data objects and referring to its elements by index obfuscates the code and is error-prone. Improve readability and reduce code size by replacing the array (which includes an unneeded sentinel) by individual zorro_driver_data objects. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/7deafe83754415c5beb280f3c1808e153029e890.1788169600.git.geert@linux-m68k.org Signed-off-by: Martin K. Petersen (Oracle) commit 0cb1fd924126f1f581621a5e804df98a02be9dff Author: Arun Easi Date: Thu Sep 3 10:55:47 2026 -0700 scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU When CPU Hyper Threading is disabled, sibling CPUs remain present but are reported offline. Managed MSI-X IRQs can still receive affinity masks that include those offline CPUs. If a driver-critical vector is managed, it can be parked on an offline CPU and the driver may miss critical events such as link-up. Keep driver-critical vectors unmanaged so they can be migrated by the IRQ core when their target CPU is offlined. Since HWQ-0 is unmanaged now, in some queue combinations there can be no mappings to it in mq_map. So without the blk-mq fix mentioned below, system may crash during cpu offline/online tests. Fixes: 8a8449ca5e33 ("scsi: fnic: Modify ISRs to support multiqueue (MQ)") Cc: stable@vger.kernel.org Depends-on: commit 10845a105bbc ("blk-mq: skip CPU offline notify on unmapped hctx") Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Karan Tilak Kumar Signed-off-by: Arun Easi Reviewed-by: Laurence Oberman Link: https://patch.msgid.link/20260903175547.57971-1-aeasi@cisco.com Signed-off-by: Martin K. Petersen (Oracle) commit 1274045b0eda1df5a5cdd3e63ed48cf013b3b4ea Author: Venkat Rao Bagalkote Date: Thu Sep 3 13:13:29 2026 +0530 scsi: ibmvfc: Add Kconfig dependency to fix link failure when NVME_FC=m Building with CONFIG_SCSI_IBMVFC=y and CONFIG_NVME_FC=m results in a link failure: ibmvfc-nvme.o: undefined reference to `nvme_fc_register_localport' ibmvfc-nvme.o: undefined reference to `nvme_fc_register_remoteport' ibmvfc-nvme.o: undefined reference to `nvme_fc_unregister_localport' ibmvfc-nvme.o: undefined reference to `nvme_fc_unregister_remoteport' ibmvfc-core.o: undefined reference to `nvme_fc_rescan_remoteport' IS_ENABLED() evaluates to 1 for both =y and =m, so the nvme_fc_* call sites are kept in the object file. When SCSI_IBMVFC=y (built-in) but NVME_FC=m (loadable module), the linker cannot resolve these symbols at vmlinux link time. Add the same "depends on NVME_FC || NVME_FC=n" constraint already used by SCSI_LPFC to prevent this configuration. Reported-by: Pavithra Closes: https://lore.kernel.org/all/327877a29337aa526cc50ac88fbddb86@linux.ibm.com/ Signed-off-by: Venkat Rao Bagalkote Tested-by: Pavithra Acked-by: Tyrel Datwyler Link: https://patch.msgid.link/20260903074329.6705-1-venkat88@linux.ibm.com Signed-off-by: Martin K. Petersen (Oracle) commit 779f202a92ef10a426efc07d0f4267918cb07ca3 Author: Karl Mehltretter Date: Sun Sep 6 19:10:09 2026 +0200 scsi: qla2xxx: Fix the ql2xfc2target parameter description The module parameter is ql2xfc2target, but its MODULE_PARM_DESC() names qla2xfc2target, so modinfo describes a parameter that does not exist and shows no description for the real one. Use the parameter name in the description. Fixes: 877b03795fcf ("scsi: qla2xxx: Add option to disable FC2 Target support") Assisted-by: LLM Signed-off-by: Karl Mehltretter Link: https://patch.msgid.link/20260906171009.2560-1-kmehltretter@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 264bf9655c3d067d775a46f05eb8c871c488a864 Author: Karl Mehltretter Date: Sun Sep 6 19:09:25 2026 +0200 scsi: pm80xx: Fix the use_msix, use_tasklet and read_wwn parameter descriptions The MODULE_PARM_DESC() lines of use_msix, use_tasklet and read_wwn all name a parameter zoned, which does not exist, and the use_tasklet one repeats the use_msix text. modinfo shows three "zoned" entries and no description for the real parameters. Name the right parameters and describe use_tasklet. Fixes: efa1fca45082 ("scsi: pm8001: Remove PM8001_USE_MSIX") Fixes: 205430290ad0 ("scsi: pm8001: Remove PM8001_USE_TASKLET") Fixes: 80975adc79dd ("scsi: pm8001: Remove PM8001_READ_VPD") Assisted-by: LLM Signed-off-by: Karl Mehltretter Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260906170925.2524-1-kmehltretter@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit af8c27375733fb6a6df9fa484cda77cc3dd0cb80 Author: Thomas Lamprecht Date: Thu Aug 27 19:24:24 2026 +0200 scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame, a DMA pool buffer of instance->max_chain_frame_sz bytes, spending one entry per NVMe page of the transfer plus one per page of the buffer for the chain pointer. The loop runs until the transfer is described and never checks the buffer bound. max_hw_sectors comes straight from the MDTS the firmware reports for the drive. On drives with a large MDTS the only thing keeping the list inside the buffer was the block layer default of 1280 KiB, which needs 320 entries, which fit into a 4 KiB frame as that holds 512. But since commit 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") that default is 4 MiB, and such a transfer needs 1025 entries, so the list runs a full page past the end of the frame: sd 1:0:1:0: [sdb] tag#630 page boundary ptr_sgl: 0x00000000ba62d13f BUG: unable to handle page fault for address: ff663bcb81e7c000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page RIP: 0010:megasas_build_and_issue_cmd_fusion+0xeaa/0x1870 [megaraid_sas] If the page after the frame happens to be mapped, the overrun does not fault but silently corrupts the neighbouring pool entry, which is another in-flight command's PRP list. Cap max_hw_sectors at what the chain frame can describe, less one page for transfers that do not start on a page boundary and so need one entry more. This is the megaraid_sas counterpart of commit 04631f55afc5 ("scsi: mpt3sas: Limit NVMe request size to 2 MiB"), but derives the limit from max_chain_frame_sz rather than hardcoding it. Cc: stable@vger.kernel.org Fixes: 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") Reported-by: Lukasz Magiera Closes: https://lore.kernel.org/all/GPhsSM0vkgyIrs0DIZ62qeUZX7X4RxwQXVKiuvMx-lHQVSPDxpztUyQOGS0xikqvJ-Z94hMV-dW_5KN_0CX2hsfV7kTf_t0MTf6vdAAaSEc=@magik.net/ Reported-by: Mira Limbeck Closes: https://lore.kernel.org/all/d171cc76-bf25-48ce-b482-d344669dfc24@proxmox.com/ Suggested-by: Martin K. Petersen Link: https://lore.kernel.org/all/yq17bmzd5jr.fsf@ca-mkp.ca.oracle.com/ Signed-off-by: Thomas Lamprecht Closes: https://lore.kernel.org/linux-scsi/20260827182106.535D61F000E9@smtp.kernel.org Link: https://patch.msgid.link/20260827175743.734593-1-t.lamprecht@proxmox.com Signed-off-by: Martin K. Petersen (Oracle) commit 4b3c5965fca99f62d31c963294bd5b23cc488e97 Author: Rahul Chandelkar Date: Mon Aug 17 16:07:29 2026 +0800 scsi: bsg: Fix TOCTOU in io_uring passthrough command setup scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. request_len is the sharp case: it can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user(). READ_ONCE() the SQE fields we check or use into locals before use. Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260527105931.3950913-1-rc@rexion.ai Signed-off-by: Rahul Chandelkar Co-developed-by: Yang Xiuwei Signed-off-by: Yang Xiuwei Link: https://patch.msgid.link/20260817080730.967879-3-yangxiuwei@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) commit ece06de726737e887dc0225c8283477624f8ae21 Author: Yang Xiuwei Date: Mon Aug 17 16:07:28 2026 +0800 scsi: bsg: Cap io_uring sense copy to max_response_len Completion copied scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller user buffer was overrun. Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Cc: stable@vger.kernel.org Signed-off-by: Yang Xiuwei Link: https://patch.msgid.link/20260817080730.967879-2-yangxiuwei@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) commit e83b47309f73313e75c3888d7839666aba5b2b2a Author: John Garry Date: Mon Aug 31 09:58:21 2026 +0000 scsi: core: Drop Scsi_Host.default_lock Back in the 2.6.xx days, it was possible to for low-level drivers to set the shost lock pointer. That is why there is a default lock and a pointer to the shost lock. However, support for this has long been removed, so drop Scsi_Host.default_lock and make Scsi_Host.host_lock as the actual lock. Getting the address of embedded host_lock structure just requires adding a fixed offset value to the shost pointer. However, getting the value of the host_lock pointer requires loading from a fixed offset to the shost pointer. The latter should be very slightly slower, which is relevant as this lock is used a lot throughout the core code and drivers. Signed-off-by: John Garry Acked-by: Damien Le Moal # ata parts Reviewed-by: Hannes Reinecke Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260831095821.3486994-1-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen (Oracle) commit e64b8f3224add21f02c5d64e11371830e631cdba Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:37 2026 +0300 scsi: sym53c8xx_2: Replace __get_free_pages() with kmalloc() sym53c8xx_2 driver has an internal memory allocator for small allocations of the driver structures. The backing memory for that allocator is allocated with __get_free_pages(). This memory can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Performance difference between kmalloc() and __get_free_pages() is not measurable as both allocators take an object/page from a per-CPU list for fast path allocations. For the slow path the performance is anyway determined by the amount of reclaim involved rather than by what allocator is used. Replace use of __get_free_pages() with kmalloc() and free_pages() with kfree(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-4-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 0abe3fb1c5056b7f2f99178b23db8aa95dd03f85 Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:36 2026 +0300 scsi: ipr: Use kmalloc() to allocate IPR dump buffer memory IPR dump machinery allocates memory to save adapter's crash dump using __get_free_page(). This memory can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). While on it, relax GFP_ATOMIC to GFP_NOIO for allocation of dump buffers. The allocations happen in a workqueue context, but with storage adapter being in a state where it can't handle I/O. Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Tested-by: Wen Xiong Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-3-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b4fe0d7d41eacf3c2ffa54eef3e5e93ac8777518 Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:35 2026 +0300 scsi: proc: Use kmalloc() in proc writers proc_scsi_host_write(), proc_scsi_write() and proc_scsi_devinfo_write() allocate temporary buffers for /proc writes using __get_free_page(). These buffers can be allocated with kmalloc() as there's nothing special about them to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Reviewed-by: John Garry Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-2-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f07ed527235c44e0aae53100133bb547f5ee448f Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:34 2026 +0300 scsi: target: file: Use kmalloc() to allocate temporary protection buffer fd_do_prot_unmap() uses __get_free_page() to allocate a temporary buffer that is used to invalidate protection info for the unmapped region by filling with 0xff pattern. This buffer can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-1-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit e0d26fe176a8db6ccad4ab38c5bab29391c1946b Author: Ivy Lopez Date: Tue Aug 25 13:03:13 2026 -0600 scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() dev_to_node() can return NUMA_NO_NODE (-1) on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose device-to-node affinity. Passing -1 directly into cpumask_of_node() indexes node_to_cpumask_map[-1], an out-of-bounds array read caught by UBSAN: UBSAN: array-index-out-of-bounds in arch/x86/include/asm/topology.h:72:28 index -1 is out of range for type 'cpumask *[1024]' Fall back to cpu_online_mask when no NUMA node is available, rather than assuming dev_to_node() always returns a valid node index. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221294 Suggested-by: Johannes Thumshirn Fixes: 728bbc6cbff7 ("scsi: mpt3sas: Affinity high iops queues IRQs to local node") Signed-off-by: Ivy Lopez Reviewed-by: John Garry Link: https://patch.msgid.link/20260825190313.24013-1-skunkolee@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 139f57343b3d6b26d9f01580123b2ba2d2150337 Author: Laurence Oberman Date: Mon Aug 31 07:59:17 2026 -0400 scsi: mpi3mr: Fix use-after-free on tgt_dev->starget during target device refresh/update mpi3mr_refresh_tgtdevs() and mpi3mr_devinfochg_evt_bh() read tgt_dev->starget and immediately pass it to starget_for_each_device() without holding mrioc->tgtdev_lock. Every writer of this field -- mpi3mr_target_alloc(), mpi3mr_target_destroy(), mpi3mr_slave_destroy() and mpi3mr_sdev_init() -- correctly serializes access under tgtdev_lock, but these two read sites do not, which leaves a check-then-use window against the SCSI core's target teardown path (scsi_remove_target(), invoked e.g. via a concurrent host reset, sysfs "delete", or SCSI EH device offlining running independently of the fwevt workqueue). Sequence observed on production hardware, triggered on the mpi3mr0_fwevt_wrkr workqueue during a SAS topology change shortly after a controller reset: BUG: kernel NULL pointer dereference, address: 0000000000000058 RIP: scsi_is_host_device+0x7/0x20 Call Trace: starget_for_each_device+0x34/0x100 mpi3mr_refresh_tgtdevs+0x152/0x1d0 [mpi3mr] mpi3mr_fwevt_bh+0x514/0x6c0 [mpi3mr] mpi3mr_fwevt_worker+0x1a/0x50 [mpi3mr] process_one_work+0x194/0x380 worker_thread+0x2fe/0x410 mpi3mr_refresh_tgtdevs() reads tgt_dev->starget as non-NULL, but by the time starget_for_each_device() dereferences it, a concurrent mpi3mr_target_destroy() has already cleared tgt_dev->starget under tgtdev_lock and the SCSI/device core has freed the underlying scsi_target (and its embedded struct device). The stale pointer is then walked by dev_to_shost() -> scsi_is_host_device(), producing the NULL/garbage dereference above. Fix this by taking mrioc->tgtdev_lock around every read of tgt_dev->starget, matching the existing writer-side discipline. Since starget_for_each_device() and mpi3mr_update_sdev() can end up doing non-atomic work (e.g. queue_limits_commit_update()), the lock cannot be held across the whole call, so instead pin the target's device with get_device() while holding the lock, drop the lock, then run starget_for_each_device() against the pinned reference and put_device() afterwards. This closes the TOCTOU window instead of merely narrowing it. The same unlocked read-and-dereference pattern also exists earlier in mpi3mr_refresh_tgtdevs()'s first removal-scan loop (tgt_dev->starget->hostdata); fix it the same way by holding tgtdev_lock across that check, which is cheap since it only touches plain struct fields. Assisted-by: Claude:Sonnet5 [Claude Code] Signed-off-by: Laurence Oberman Acked-by: Chandrakanth Patil Link: https://patch.msgid.link/20260831120047.14690-1-loberman@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit f4825922d2fb371e2b969697d792077f1b62b62c Author: Sujal Tuladhar Date: Sat Aug 1 21:30:00 2026 +0545 scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding bytes, where padding = ((-payload_length) & 3); any payload_length from 8189 to 8192 fills the whole 8192 byte buffer. The write stays in bounds, but no byte is left for a NUL terminator. The buffer is subsequently consumed as a C string. In the CHAP path chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls strstr(in_buf, pattern) followed by strlen_semi(), none of which take a length. convert_null_to_semi() additionally rewrites every embedded NUL to ';', so even a payload made of well formed NUL separated key=value records is left without a terminator. These walk past the end of the object into adjacent slab memory. It is reachable by an unauthenticated initiator against a portal configured for CHAP; when authentication is not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and the CHAP path is never entered. Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS bytes, so the buffer is always terminated. Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1") Assisted-by: Claude Opus5 (custom harness) Cc: stable@vger.kernel.org Signed-off-by: Sujal Tuladhar Signed-off-by: Martin K. Petersen (Oracle) commit d5869dae5080e976d4b03cc33eb7ceb527f242bf Author: Maurizio Lombardi Date: Fri Jul 17 16:38:28 2026 +0200 scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands When a LUN_RESET aborts a WRITE command that is in the TRANSPORT_WRITE_PENDING state, the target core sets CMD_T_ABORTED and waits for the frontend to finish processing. If the initiator subsequently sends the remaining dataout PDUs, __iscsit_check_dataout_hdr() catches the payload, stops the dataout timer if the sequence is final and finally dumps the data. However, the iSCSI target doesn't trigger the completion process for these aborted commands. Because of this, the abort path hangs indefinitely in target_put_cmd_and_wait(), leading to a deadlocked target worker thread. Fix this by explicitly calling target_complete_cmd() when the final dataout PDU is received for an aborted WRITE command. target_complete_cmd() detects the CMD_T_ABORTED flag and cleanly routes the command into target_abort_work, allowing the abort completion to successfully unblock. Signed-off-by: Maurizio Lombardi Reviewed-by: Laurence Oberman Link: https://patch.msgid.link/20260717143828.76291-2-mlombard@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit c46cc9cee39bd6f395ab9ac98b1794705df13d7c Author: sangram kumar yerra Date: Tue Aug 18 16:58:30 2026 +0530 scsi: ufs: ufs-pci: Add MCQ support for Intel UFS 4.0 controllers The Intel UFS 4.0 PCI variant (PCI ID 8086:D335) advertises MCQ support in its capability register. However, ufshcd_alloc_mcq() also requires an .op_runtime_config hook to locate the per-queue operation and runtime (OPR) register blocks, which was not provided by this variant operations table. As a result, MCQ initialization fails and ufshcd_add_scsi_host() prints "MCQ mode is disabled, err=%d\n" before falling back to legacy single-doorbell (SDB) mode. Add ufs_intel_mcq_config_resource() to initialize the MCQ configuration base and add ufs_intel_op_runtime_config() to set up the OPR register offsets and stride. Wire both hooks into the variant operations table so MCQ is enabled when supported by the hardware. Fixes: 096cd6b7adf2 ("scsi: ufs: ufs-pci: Add support for Intel Nova Lake") Signed-off-by: sangram kumar yerra Reviewed-by: Adrian Hunter Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260818112830.453402-3-sangram.k.y@intel.com Signed-off-by: Martin K. Petersen (Oracle) commit ef675ea168453a9b3e635b8ac543f92938bdd03b Author: sangram kumar yerra Date: Tue Aug 18 16:58:29 2026 +0530 scsi: ufs: ufs-pci: Add support for Intel UFS 4.0 HS-Gear5 Reliable HS-Gear5 operation on Intel UFS 4.0 controllers requires configuring PA_INITIAL_ADAPT before changing the power mode. Without this setting, the link fails to train reliably at Gear5. Add a pwr_change_notify() hook to configure the adaptation mode before the power mode transition. Enable this only for UFS 4.0 and later controllers by checking hba->ufs_version. Wire the hook into the existing Meteor Lake family variant operations table (ufs_intel_mtl_hba_vops) instead of introducing a separate table, since the Intel UFS 4.0 PCI variant (PCI ID 8086:D335) already uses this vops table and the hook is internally gated on UFS version >= 4.0. Use PA_INITIAL_ADAPT when the negotiated TX power mode is FAST_MODE or FASTAUTO_MODE. Otherwise, reset the adaptation mode to PA_NO_ADAPT, which is the default setting. Fixes: 096cd6b7adf2 ("scsi: ufs: ufs-pci: Add support for Intel Nova Lake") Signed-off-by: sangram kumar yerra Reviewed-by: Adrian Hunter Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260818112830.453402-2-sangram.k.y@intel.com Signed-off-by: Martin K. Petersen (Oracle) commit 11300f8ddee301dca9914561f24bea4168de076d Author: Xu Rao Date: Mon Jul 6 16:44:43 2026 +0800 scsi: sg: Report request-table problems when any status is set SG_GET_REQUEST_TABLE reports per-request diagnostic state through sg_req_info::problem. The field is meant to indicate whether there is an error to report for a completed request. sg_fill_request_table() currently combines masked_status, host_status and driver_status with bitwise AND. This only reports a problem when all three status fields are non-zero at the same time. A normal target check condition, for example, has masked_status set while host_status and driver_status may both be zero, so the request is incorrectly reported as clean. Use the same condition as sg_new_read(), which sets SG_INFO_CHECK when any of the three status fields is non-zero. Signed-off-by: Xu Rao Reviewed-by: Bart Van Assche Cc: stable@vger.kernel.org Link: https://patch.msgid.link/26BF67F369E2123E+20260706084443.805598-1-raoxu@uniontech.com Signed-off-by: Martin K. Petersen (Oracle) commit 419d129f970aaa6567dbac366b0c93784bf9ec97 Author: Milan P. Gandhi Date: Wed Aug 12 16:03:44 2026 +0530 scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() mpi3mr_get_tgtdev_by_addr() increments the target device kref when it returns a device. If a subsequent error triggers a goto out_fail after the tgtdev reference is acquired, the reference is never released because the out_fail path does not call mpi3mr_tgtdev_put(). This prevents the target device structure from ever being freed. Add a tgtdev put in the out_fail path, guarded by a NULL check since tgtdev is only acquired for SAS_END_DEVICE types and the same cleanup path is shared by earlier error cases where tgtdev is still NULL. Fixes: e22bae30667a ("scsi: mpi3mr: Add expander devices to STL") Signed-off-by: Milan P. Gandhi Reviewed-by: Laurence Oberman Link: https://patch.msgid.link/20260812103344.174247-3-mgandhi@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit dba9e2181ca5e875f98b8b9b4535cdaab87dcb0d Author: Milan P. Gandhi Date: Wed Aug 12 16:03:43 2026 +0530 scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() sas_port_alloc_num() can return NULL on memory allocation failure. The return value is passed directly to sas_port_add() without a NULL check, which causes a NULL pointer dereference. Additionally, if sas_port_add() fails, the allocated port is not freed before jumping to out_fail, leaking the sas_port structure. Call sas_port_free() to properly release it. Fixes: e22bae30667a ("scsi: mpi3mr: Add expander devices to STL") Signed-off-by: Milan P. Gandhi Reviewed-by: Laurence Oberman Link: https://patch.msgid.link/20260812103344.174247-2-mgandhi@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit b2ededcb271b37510366cbf6853be193d681ba5c Author: Nitin Rawat Date: Tue Aug 25 20:22:03 2026 +0530 scsi: ufs: ufs-qcom: Fix sequential read variance The current devfreq downdifferential threshold of 5% causes overly aggressive frequency downscaling, leading to performance degradation sometimes during sequential read workloads. Update the UFS devfreq downdifferential threshold to 65. This widens the hysteresis window and prevents overly aggressive downscaling, ensuring that frequency is maintained for loads above 5% and scaling down occurs only when utilization falls below this level, while scale-up still triggers above the 70% threshold. Reviewed-by: Konrad Dybcio Signed-off-by: Nitin Rawat Link: https://patch.msgid.link/20260825145203.265579-3-nitin.rawat@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit a3756f53baf1830c65149cfcb81cb96360976cf3 Author: Nitin Rawat Date: Tue Aug 25 20:22:02 2026 +0530 scsi: ufs: ufs-qcom: Restore HS/LS link startup mode for Qualcomm UFS controller v6.2+ The link startup mode (HS LSS - high-speed link startup, or LS LSS - low-speed link startup) is decided in the boot stage based on the bootconfig GPIO. This selection is carried forward through the secondary stage bootloaders and finally to HLOS via the spare configuration register (REG_UFS_DEBUG_SPARE_CFG). On Qualcomm UFS controller v6.2 and later, bit 31 in the spare configuration register indicates the high-speed link startup mode selection, as per the Hardware Programming Guide (HPG). The spare register value is read during host driver initialization but gets cleared after UFS reset. Preserve the spare register value during initialization and restore it during link startup to maintain the bootloader-configured link startup mode. Signed-off-by: Nitin Rawat Tested-by: Mukesh Ojha Link: https://patch.msgid.link/20260825145203.265579-2-nitin.rawat@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit 9a69cc5f192f356c1c7b4fa2821da4a8cf684829 Author: Muhammad Falak R Wani Date: Thu Aug 27 16:50:38 2026 +0530 scsi: ibmvfc: Document protocol parameter of ibmvfc_alloc_target() Commit 249313b3f7b5 ("scsi: ibmvfc: allocate targets based on protocol") added a protocol parameter to ibmvfc_alloc_target() but did not describe it in the function's kernel-doc comment, so a W=1 build warns: drivers/scsi/ibmvscsi/ibmvfc-core.c:4996: warning: Function parameter or struct member 'protocol' not described in 'ibmvfc_alloc_target' Add the missing parameter description. Fixes: 249313b3f7b5 ("scsi: ibmvfc: allocate targets based on protocol") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202608270829.lHI1FAdO-lkp@intel.com/ Signed-off-by: Muhammad Falak R Wani Reviewed-by: Dave Marquardt Acked-by: Tyrel Datwyler Link: https://patch.msgid.link/b073968ae020b6ae0240e91341a92f428587ebd9.1787828961.git.falakreyaz@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 9a0716348dafe9c6d3529991a50b96c6d18abb51 Author: Muhammad Falak R Wani Date: Thu Aug 27 16:50:37 2026 +0530 scsi: ibmvfc: Fix kernel-doc name for ibmvfc_scsi_relogin() Commit e0fca728a89f ("scsi: ibmvfc: delete NVMe/FC targets as well as SCSI") renamed ibmvfc_relogin() to ibmvfc_scsi_relogin() but left the kernel-doc comment referring to the old name, so a W=1 build warns: drivers/scsi/ibmvscsi/ibmvfc-core.c:1901: warning: expecting prototype for ibmvfc_relogin(). Prototype was for ibmvfc_scsi_relogin() instead Update the kernel-doc comment to use the current function name. Fixes: e0fca728a89f ("scsi: ibmvfc: delete NVMe/FC targets as well as SCSI") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202608271026.iMLmrwz4-lkp@intel.com/ Signed-off-by: Muhammad Falak R Wani Reviewed-by: Dave Marquardt Acked-by: Tyrel Datwyler Link: https://patch.msgid.link/dd866cf2321381694af027fbd726bcbd63ac3751.1787828961.git.falakreyaz@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 3f92a64545165bdbb36dee8fa35626b295463313 Author: Runyu Xiao Date: Mon Aug 24 19:36:18 2026 +0800 scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001_request_msix() unwinds previously registered handlers with free_irq() when request_irq() fails. The rollback loop uses the failing index i for every iteration instead of the already registered vector index j. That passes the wrong IRQ/dev_id pair to free_irq() and leaves the earlier handlers installed. Use j for both pci_irq_vector() and the matching irq_vector entry in the rollback loop. Fixes: a76037ff3479 ("scsi: pm8001: switch to pci_irq_alloc_vectors") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Runyu Xiao Acked-by: Jack Wang Link: https://patch.msgid.link/20260824113618.2239100-1-runyu.xiao@seu.edu.cn Signed-off-by: Martin K. Petersen (Oracle) commit 98f0a1422e285f6132a73932ebd4fe5c6f513261 Author: Linmao Li Date: Wed Aug 19 19:42:41 2026 +0800 scsi: fnic: Initialize the NVMe local port info before registering nvfnic_add_lport() declares struct nvme_fc_port_info on the stack and fills in four of its five members, leaving dev_loss_tmo holding whatever the stack happened to contain before the call. The structure is then handed to nvme_fc_register_localport(). nvfnic_add_tport(), which registers the remote port a few lines further down, memsets its own struct nvme_fc_port_info first, so only the local port path passes uninitialized data across the transport interface. The NVMe/FC transport documents dev_loss_tmo as "Used only on a remoteport" and does not read it in nvme_fc_register_localport(), so there is no behavioural change today. Initialize the structure anyway: the driver must not depend on which members the transport happens to consume, and any member added to struct nvme_fc_port_info later would silently start out as stack garbage. Signed-off-by: Linmao Li Tested-by: Karan Tilak Kumar Reviewed-by: Karan Tilak Kumar Link: https://patch.msgid.link/20260819114242.3598034-2-lilinmao@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle)