commit eb2c4847a1cb2f426cfc702364df7a38ebbf730b Author: Stanley Jhu Date: Thu Oct 22 11:44:43 2026 +0800 scsi: ufs: core: Do not release a reserved request in ufshcd_abort() In SDB mode, aborting a timed-out device management request drops a clock hold that the request never took: 1. ufshcd_dev_man_lock() takes one ufshcd_hold() for the whole device management command. ufshcd_queue_reserved_command() submits the request without taking a hold of its own. 2. The request times out and ufshcd_abort() clears its slot with ufshcd_clear_cmd(). 3. ufshcd_abort() claims BIT(tag) in hba->outstanding_reqs and calls ufshcd_release_scsi_cmd(), which calls ufshcd_release() for a hold the request never took. 4. When ufshcd_dev_man_unlock() drops the hold from step 1, hba->clk_gating.active_reqs goes below zero. Release the command only if it is a SCSI command. Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/2060a8da-581b-46d1-a510-779f4df716cd@acm.org Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Signed-off-by: Stanley Jhu Reviewed-by: Bean Huo Link: https://patch.msgid.link/20261022034443.3034432-7-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 7cfdfdd6557906fd09cf0a9a564a07012e7fb0c1 Author: Stanley Jhu Date: Thu Oct 22 11:44:42 2026 +0800 scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort() In SDB mode, a command that times out right as the controller finishes it can be completed twice: 1. The command times out and scsi_timeout() schedules ufshcd_abort(). 2. The controller finishes the command and clears its doorbell bit in REG_UTP_TRANSFER_REQ_DOOR_BELL, while the completion handler has not yet cleared BIT(tag) in hba->outstanding_reqs. 3. ufshcd_abort() sees the doorbell bit clear and calls __ufshcd_transfer_req_compl() without clearing BIT(tag) in hba->outstanding_reqs. 4. The normal completion handler or the logical unit reset that follows sees BIT(tag) still set in hba->outstanding_reqs and completes the same command a second time. This branch only exists for a rare corner case, a completion interrupt that is lost or arrives late. Remove it to simplify the abort path and leave such a command to the SCSI error handler, like any other command that cannot be aborted. The cost is a slower recovery in this corner case, which is acceptable since it only happens after a timeout. Fixes: 169f5eb28869 ("scsi: ufs: Optimize SCSI command processing") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/fdb5c391-01ef-4a23-94c2-4f3853909348@acm.org Signed-off-by: Stanley Jhu Reviewed-by: Peter Wang Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261022034443.3034432-6-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 3a7e551ae4bcc53f271fc15ab8e930598e28dad8 Author: Stanley Jhu Date: Thu Oct 22 11:44:41 2026 +0800 scsi: ufs: core: Fix double release in ufshcd_eh_timed_out() In SDB mode, a command that times out during a power management operation can be released twice: 1. The command times out while its normal completion is running. 2. The completion path clears BIT(rq->tag) in hba->outstanding_reqs and releases the command. It has not called scsi_done() yet, so SCMD_STATE_COMPLETE is still clear. 3. ufshcd_eh_timed_out() recovers the link, sees SCMD_STATE_COMPLETE clear, clears BIT(rq->tag) in hba->outstanding_reqs without checking whether it was still set, and releases the same command a second time. Return SCSI_EH_DONE when ufshcd_clear_outstanding_reqs() returns 0, as another path has already claimed the command. Fixes: 01d5e237b339 ("scsi: ufs: core: Handle PM commands timeout before SCSI EH") Cc: stable@vger.kernel.org Reviewed-by: Peter Wang Signed-off-by: Stanley Jhu Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261022034443.3034432-5-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 6b9c1f49971e4dfe8b8916f0527d30e97c15f234 Author: Stanley Jhu Date: Thu Oct 22 11:44:40 2026 +0800 scsi: ufs: core: Fix double completion in ufshcd_clear_lu_cmds() In SDB mode, ufshcd_clear_lu_cmds() clears the request slot in the controller and completes the request, but leaves its bit set in hba->outstanding_reqs. ufshcd_poll() treats a request whose bit is set in hba->outstanding_reqs and clear in the doorbell register as finished, so the next ufshcd_poll() completes the same request again and unmaps its DMA buffers twice. Clear the bit with ufshcd_clear_outstanding_reqs() before completing the request, and complete it only if the bit was still set. If ufshcd_poll() has already completed the request, the bit is already clear and ufshcd_clear_lu_cmds() skips it. Fixes: f18fac1e2b72 ("scsi: ufs: core: Rework ufshcd_eh_device_reset_handler()") Cc: stable@vger.kernel.org Reviewed-by: Bean Huo Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Signed-off-by: Stanley Jhu Link: https://patch.msgid.link/20261022034443.3034432-4-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 22d14117ec1845a81acb3a5c4be325f7e8332f70 Author: Stanley Jhu Date: Thu Oct 22 11:44:39 2026 +0800 scsi: ufs: core: Add a helper for clearing hba->outstanding_reqs ufshcd_poll() and ufshcd_abort() each have their own copy of the code that clears bits in hba->outstanding_reqs under hba->outstanding_lock. Move that code into ufshcd_clear_outstanding_reqs() and its locked variant __ufshcd_clear_outstanding_reqs(), and use them in both functions. No functional change. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/3779e125-9acc-42c8-9489-51b9e3c6716d@acm.org Suggested-by: Bart Van Assche Reviewed-by: Bean Huo Reviewed-by: Peter Wang Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261022034443.3034432-3-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit cd37a69c367b6a5f685db0ac7d01f08545081a30 Author: Stanley Jhu Date: Thu Oct 22 11:44:38 2026 +0800 scsi: ufs: core: Remove an always-false WARN_ONCE() The WARN_ONCE() in ufshcd_poll() can never fire. completed_reqs is set to ~tr_doorbell & hba->outstanding_reqs on the line above, and hba->outstanding_reqs cannot change in between because ufshcd_poll() holds hba->outstanding_lock. So completed_reqs & ~hba->outstanding_reqs is always zero. Remove it. No functional change. Cc: stable@vger.kernel.org Reviewed-by: Bean Huo Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Signed-off-by: Stanley Jhu Link: https://patch.msgid.link/20261022034443.3034432-2-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit c2c645243dba2cb16d001715cb3a1085def376e5 Author: Karan Tilak Kumar Date: Tue Oct 20 14:00:43 2026 -0700 scsi: fnic: Update module authors Update the FNIC module author list and bump the driver version to 1.9.0.2. Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Arun Easi Signed-off-by: Karan Tilak Kumar Link: https://patch.msgid.link/20261020210043.5279-1-kartilak@cisco.com Signed-off-by: Martin K. Petersen (Oracle) commit fb2a238f15f0fc2dacd12f8847b0ec0a1cf7ccac Author: Alexander Koskovich Date: Mon Oct 5 17:02:06 2026 +0000 scsi: ufs: qcom: Power down UFS during system suspend on Milos On Milos the UFS PHY GDSC is turned off on every system suspend and the PHY loses its register state, so exiting hibern8 on resume fails: ufshcd-qcom 1d84000.ufshc: pwr ctrl cmd 0x18 with (MIBattribute 0x0, mode 0x0) failed, host upmcrs:0x5 ufshcd-qcom 1d84000.ufshc: ufshcd_uic_hibern8_exit: hibern8 exit failed. ret = 5 ufshcd-qcom 1d84000.ufshc: __ufshcd_wl_resume: hibern8 exit failed 5 Set no_phy_retention so the controller and device are powered down during system suspend and the link is brought up again on resume. Fixes: 04bb37433330 ("arm64: dts: qcom: milos: Add UFS nodes") Signed-off-by: Alexander Koskovich Tested-by: Jorijn van der Graaf Link: https://patch.msgid.link/20261005-milos-ufs-suspend-v1-1-a6f8b89d5b63@pm.me Signed-off-by: Martin K. Petersen (Oracle) commit 192cb22c59ecf9acbba20979c10004608d1092c8 Author: Nilesh Javali Date: Fri Oct 23 14:21:12 2026 +0530 scsi: MAINTAINERS: Update Marvell Ethernet storage maintainers Add Nilesh Javali and Manish Rangankar as co-maintainers for bnx2fc and qedf. Also update email alias for bnx2fc, bnx2i, qedf and qedi. Signed-off-by: Nilesh Javali Signed-off-by: Manish Rangankar Link: https://patch.msgid.link/20261023085112.1378540-1-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) commit 9a6cb1da4f3bc4633bf6669faed25a361834b1b9 Author: Yingjie Wang Date: Thu Oct 22 02:55:11 2026 +0000 scsi: handle out-of-range SG_SET_TIMEOUT values SG_SET_TIMEOUT accepts a signed int in USER_HZ units. The sg character device rejects negative values and limits positive values so the converted timeout fits its destination field. The block SCSI and BSG paths instead pass the value to clock_t_to_jiffies(), which accepts an unsigned long, and store the result in an unsigned int. Negative values are converted into large unsigned timeouts. On 64-bit systems, large positive values can also exceed UINT_MAX after conversion and are truncated on assignment. With HZ=1000 and USER_HZ=100, for example, 429496730 clock ticks become 4294967300 jiffies and are stored as 4 jiffies. On 32-bit systems, an overflowing conversion becomes ULONG_MAX, which is an unsafe relative interval for the block timer comparisons. Reject negative values with -EIO, matching drivers/scsi/sg.c. Saturate the converted value at the smaller of the destination field limit and MAX_JIFFY_OFFSET. This preserves successful ioctl behavior while avoiding both narrowing wraparound and an unsafe 32-bit timer interval. The block SCSI behavior predates Git history. BSG has exposed the same behavior since it was introduced. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 3d6392cfbd7d ("bsg: support for full generic block layer SG v3") Cc: stable@vger.kernel.org Reported-by: Bart Van Assche Link: https://lore.kernel.org/r/9321a59c-c560-4742-8b71-5b0ec1f30c2f@acm.org Signed-off-by: Yingjie Wang Link: https://patch.msgid.link/20261022025508.294713-1-x-professor@outlook.com Signed-off-by: Martin K. Petersen (Oracle) commit 5b0d568e183e2ddfc5801a70d8d7305ca1c2f50f Author: Randy Dunlap Date: Tue Oct 20 10:06:03 2026 -0700 scsi: core: Update cdrom.h coments Update the location and ending value of the cdrom ioctls. [mkp: adjusted ioctl range] Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20261020170603.3692218-1-rdunlap@infradead.org Signed-off-by: Martin K. Petersen (Oracle) commit 2ff2d1b892dc8b086d5db515759ae80f517324e2 Author: Laurence Oberman Date: Tue Oct 20 08:50:59 2026 -0400 scsi: st: MAINTAINERS: Add Laurence Oberman and John Meneghini The SCSI tape driver (st) is currently marked as orphaned. Add Laurence Oberman and John Meneghini as co-maintainers and change the status to Maintained. Also add a link to the tape_tests repository, which contains the test suite used to validate the st driver. Kai Mäkisara, the previous maintainer, has agreed to this change. Cc: Kai Mäkisara Signed-off-by: Laurence Oberman Signed-off-by: John Meneghini Link: https://patch.msgid.link/20261020125059.1797559-1-loberman@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit 085bb18a0b91007f04ddca13af30277c78040157 Author: Bart Van Assche Date: Mon Oct 19 14:55:32 2026 -0700 scsi: sd: Mark the disk dead if runtime resume fails in sd_remove() If a SCSI disk is unplugged while runtime suspended, its request queue is still in the pm-only state when sd_remove() is called. The runtime resume attempted by scsi_autopm_get_device() fails because the parent device, e.g. a USB device in the USB_STATE_NOTATTACHED state, cannot be resumed. Hence, sdev_runtime_resume() is not called and the pm-only state is not cleared. Next, del_gendisk() calls blk_report_disk_dead(disk, false), which calls sync_filesystem(). Any bio submitted by the filesystem waits forever in __bio_queue_enter() because the queue will never leave the pm-only state and because GD_DEAD has not yet been set: __bio_queue_enter+0xb8/0x174 blk_mq_submit_bio+0x640/0x7e4 [ ... ] exfat_sync_fs+0xa4/0xe0 sync_filesystem+0xa8/0xdc fs_bdev_mark_dead+0x30/0x88 bdev_mark_dead+0x54/0xc4 blk_report_disk_dead+0x8c/0xd4 del_gendisk+0xa0/0x2f8 sd_remove+0x30/0x60 [ ... ] scsi_remove_host+0x88/0x18c usb_stor_disconnect+0x68/0xf4 Fix this hang by calling blk_mark_disk_dead() if runtime resume fails. This sets GD_DEAD, tells the filesystem that the disk has been removed without attempting to sync it, and wakes up any bios that are waiting in __bio_queue_enter(). Syncing the filesystem is not possible anyway if runtime resume failed, so no data is lost that could otherwise have been written. If runtime resume succeeds, behavior is not changed. Please note that this patch converts temporary runtime resume failures into permanent failures. Before this patch, if runtime resume fails temporarily, a filesytem sync would be postponed until a later resume succeeds. Cc: Christoph Hellwig Tested-by: Lianqin Hu Reported-by: Lianqin Hu Closes: https://lore.kernel.org/all/TYUPR06MB6217DD31B1B3CD09E431CC12D2922@TYUPR06MB6217.apcprd06.prod.outlook.com/ Fixes: 6f8191fdf41d ("block: simplify disk shutdown") Cc: stable@vger.kernel.org Signed-off-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/2c0c76d70f0fe197932836b9bcf8496095135d1b.1792446921.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit eb7aa7fd673fdc1582223cd133bcc5f54e7af19f Author: Ratnaker Gautam Date: Mon Oct 19 21:30:33 2026 +0000 scsi: libiscsi_tcp: Prevent R2T range check overflow An iSCSI target controls the R2T data offset and length as 32-bit values. Adding them before comparing the result with the SCSI data buffer length can wrap. An R2T with offset 1 and length U32_MAX then passes the check for a 4096-byte write. The transmit path treats the wrapped range as valid, exhausts the command scatterlist, and dereferences the NULL next entry in iscsi_tcp_segment_done(). Check the offset first, then compare the length with the remaining bytes in the data buffer. Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld") Cc: stable@vger.kernel.org Signed-off-by: Ratnaker Gautam Acked-by: Chris Leech Link: https://patch.msgid.link/DB5PR08MB100629CD3750FBF71475B5224FD982@DB5PR08MB10062.eurprd08.prod.outlook.com Signed-off-by: Martin K. Petersen (Oracle) commit a7ac98eb6c39be4cff3ffe06ce240f7a331aa1ee Author: Shawn Lin Date: Mon Oct 19 08:34:22 2026 +0800 scsi: ufs: core: Fix stale comment in ufshcd_mcq_config_nr_queues() The comment refers to "hba->dev_cmd_queue", but struct ufs_hba no longer has such a member (it was removed when the dedicated hwq for device commands was dropped). Reword it to describe the actual requirement: the queue is a host controller capability and it serves both non-polled SCSI commands and UFS device management commands. Signed-off-by: Shawn Lin Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/1792370062-23050-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Martin K. Petersen (Oracle) commit cd02f87668a8e8d8ff4e130f18990c3a9e7bb22a Author: Bart Van Assche Date: Sat Oct 17 17:40:51 2026 -0700 scsi: fnic: Annotate fnic_nvme functions with __must_hold() Add __must_hold() annotations for fnic_lock to nvfnic_process_ls_abts_rsp(), nvfnic_ls_rsp_recv(), nvfnic_delete_tport(), and nvfnic_add_tport() in drivers/scsi/fnic/fnic_nvme.c. Document that callers must hold fnic_lock on entry and exit because these functions temporarily release and reacquire fnic_lock, and suppress context imbalance warnings reported by lock context analysis and sparse. Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/all/20261016023120.GA2863622@ax162/ Signed-off-by: Bart Van Assche Tested-by: Nathan Chancellor # build Link: https://patch.msgid.link/3c41b84d7d832dd767b30bc04cf875f800ce748d.1792283587.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 2327df6d2a290af62a6da21b2ad301848bb86002 Author: Joonhoe Kim <26rote@gmail.com> Date: Fri Oct 16 21:46:08 2026 +0900 scsi: ufs: core: Fix a deadlock between clock scaling and device commands Since commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()"), device management commands go through blk_execute_rq() on the pseudo SCSI device, which shares the tagset with the logical units, while ufshcd_dev_man_lock() holds clk_scaling_lock for reading. ufshcd_clock_scaling_prepare() and ufshcd_pause_command_processing() quiesce the tagset before taking clk_scaling_lock for writing. A device management command holding the lock for reading at that point is never dispatched and never times out, so the writer waits forever with all logical units quiesced. On a Lenovo Legion Tab Y700 Gen 5 this ended in a hung task panic. Take clk_scaling_lock before quiescing the tagset, and in ufshcd_clock_scaling_prepare() also wb_mutex, which is always taken before clk_scaling_lock. Release them in the reverse order. Commit b52d695d0620 ("scsi: ufs: core: Keep internal commands dispatchable during error handling") fixed the same problem in the error handler. Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Fixes: dc5dcac53278 ("scsi: ufs: core: Add helpers to pause and resume command processing") Cc: stable@vger.kernel.org Signed-off-by: Joonhoe Kim <26rote@gmail.com> Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261016124608.46-1-26rote@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit e4a9b7640914b248eb7537d4507aa42db080586a Author: Stanley Jhu Date: Thu Oct 15 08:18:55 2026 +0800 scsi: ufs: core: Clear stale UIC result byte before peer DME retries Peer DME get and set retry a failed attempt with the same struct uic_command. UIC completion ORs the ConfigResultCode into argument2[7:0], and nothing clears it before the next attempt. Once an attempt fails, every retry keeps reporting that error code, even when the device returns success, so a transient failure becomes a hard failure after three retries. Each such retry also triggers the WARN_ON_ONCE() in ufshcd_dispatch_uic_cmd(). In ufshcd_dme_set_attr(), ufshcd_uic_cmd_compl() also overwrites argument3 with the register readback before the next attempt. Clear the result byte and restore argument3 in ufshcd_dme_set_attr() when an attempt fails. Fixes: 64238fbd15ea ("scsi: ufs: add retries to dme_peer get and set attribute") Cc: stable@vger.kernel.org Reviewed-by: Bean Huo Signed-off-by: Stanley Jhu Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261015001855.3450573-6-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 1ae42513205a38b811afedb6797f9f9c4de37b90 Author: Stanley Jhu Date: Thu Oct 15 08:18:54 2026 +0800 scsi: ufs: bsg: Reject UIC commands with a non-zero result byte ufs_bsg_request() passes the user-supplied UIC argument2 unchanged, including the result byte (bits 7:0) that only the host controller writes. A non-zero value triggers the WARN_ON_ONCE() in ufshcd_dispatch_uic_cmd() and corrupts the reported result. Found by syzkaller. Reject UIC commands that have the result byte set with -EINVAL. Fixes: e77044c5a842 ("scsi: ufs-bsg: Add support for uic commands in ufs_bsg_request()") Fixes: 9fb4c793223b ("scsi: ufs: core: Complain if UIC argument 2 is invalid") Cc: stable@vger.kernel.org Signed-off-by: Stanley Jhu Reviewed-by: Bean Huo Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261015001855.3450573-5-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 42aa443718104d10dbdb6f258810b425eb2451f8 Author: Stanley Jhu Date: Thu Oct 15 08:18:53 2026 +0800 scsi: ufs: bsg: Validate request_len before accessing request ufs_bsg_request() and ufs_bsg_exec_advanced_rpmb_req() read the request buffer without checking job->request_len, which userspace controls. A short request causes an out-of-bounds read. Found by syzkaller. Reject requests shorter than the structure each path reads. Fixes: 64d4864714c2 ("scsi: ufs: bsg: Remove unnecessary length checkup") Fixes: 6ff265fc5ef6 ("scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg") Cc: stable@vger.kernel.org Reviewed-by: Bean Huo Signed-off-by: Stanley Jhu Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261015001855.3450573-4-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 2e63ac76cc08ea376ba61fef52f7b7849e35024d Author: Stanley Jhu Date: Thu Oct 15 08:18:52 2026 +0800 scsi: ufs: bsg: Clear the reply buffer before use The reply buffer is allocated once per tag and reused. Requests that complete with a positive status do not fill all of it, so user space receives bytes from an earlier request on the same tag. Clear the whole reply buffer on entry to ufs_bsg_request(). Fixes: 95e34bf930ea ("scsi: ufs-bsg: Add support for raw upiu in ufs_bsg_request()") Cc: stable@vger.kernel.org Signed-off-by: Stanley Jhu Reviewed-by: Bean Huo Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261015001855.3450573-3-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit cc0ce3fe8fac073ecded4f32c8ee5b89da1397e8 Author: Stanley Jhu Date: Thu Oct 15 08:18:51 2026 +0800 scsi: ufs: bsg: Complete the job on error When ufs_bsg_request() fails, it returns a non-zero status without calling bsg_job_done(). bsg_queue_rq() then ends the request with BLK_STS_IOERR without running bsg_complete(), leaking the job's device reference and mapped scatterlists. Always complete the job via bsg_job_done() and return 0, matching other BSG transports. Requests failing with a negative errno now return it from SG_IO with the 4-byte result in the reply, while positive status codes still return 0 from SG_IO with the reply header. Fixes: b13a3539eb2a ("scsi: ufs-bsg: complete ufs-bsg job only if no error") Cc: stable@vger.kernel.org Signed-off-by: Stanley Jhu Reviewed-by: Bean Huo Reviewed-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261015001855.3450573-2-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 537bba32a37519e47c64084b85f058fa56140510 Author: Bart Van Assche Date: Thu Oct 15 16:30:04 2026 -0700 scsi: ipr: Fix two kernel-doc comments Commit e2bb4cd08080 added the SCSI host as function argument to multiple functions but not all kernel-doc comments were updated. Fix this. Fixes: e2bb4cd08080 ("scsi: ipr: Pass the host pointer directly to several functions") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/64f80584ea0f557accbdc28c0c35d0d4c1db35ae.1792106985.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit cfb7224381c90a50b36807bf3bfcfca730ed4fe2 Author: Bart Van Assche Date: Wed Oct 14 17:05:10 2026 -0700 scsi: core: Document the role of scsi_done() Document the role of scsi_done() and also how it deals with commands owned by the SCSI error handler. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/6edb00749da7a5ce9b7752d389ad2ed5a38776e4.1792022610.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 7cd44f40fe196df01afd93aba2f84a8a184a3baf Author: Pradeep P V K Date: Fri Oct 9 16:05:54 2026 +0530 scsi: ufs: qcom: dt-bindings: Document Glymur UFS controller Document UFS Host Controller on Glymur SoC. Glymur UFSHC has a multi-queue command (MCQ) register range in addition to the standard one. So, both reg entries are required. Acked-by: Martin K. Petersen Acked-by: Rob Herring (Arm) Signed-off-by: Pradeep P V K Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20261009-glymur_ufs_qcb_enablement-v4-2-9a6ce83195b7@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit e6c68aac2f7a35556792f96fb6be1eb7a725791d Author: Pradeep P V K Date: Fri Oct 9 16:05:53 2026 +0530 scsi: dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: Document Glymur QMP UFS PHY Document the QMP UFS PHY on Glymur SoC. Glymur does not have UFS PHY gdsc power domain. So, document this in the binding. Acked-by: Rob Herring (Arm) Signed-off-by: Pradeep P V K Link: https://patch.msgid.link/20261009-glymur_ufs_qcb_enablement-v4-1-9a6ce83195b7@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit b4bd078b78c248d4263a1da7033cbe7a74ce0e12 Author: Haotian Zhang Date: Fri Oct 9 02:54:03 2026 +0800 scsi: elx: libefc: Fix resource leak in efcport_init() error path efcport_init() creates efc->node_pool and efc->node_dma_pool before allocating efc->els_io_pool. When the latter allocation fails it returns -ENOMEM without releasing the node dma pool or the node pool, leaking both. The caller efct_efclib_config() only logs the error and efct_device_attach() failure path never calls efcport_destroy(), so the resources are never freed. Destroy node_dma_pool and node_pool before returning from the els_io_pool allocation failure path. Fixes: d7b71fd2195e ("scsi: elx: libefc: Emulex FC discovery library APIs and definitions") Assisted-by: DeepSeek-V4.1-Flash Signed-off-by: Haotian Zhang Reviewed-by: Daniel Wagner Link: https://patch.msgid.link/20261008185403.2791781-1-vulab@iscas.ac.cn Signed-off-by: Martin K. Petersen (Oracle) commit 782a516e8f432f5ded4adab206bb809e29593c54 Author: Bart Van Assche Date: Fri Sep 25 11:26:32 2026 -0700 scsi: drivers: Enable lock context analysis Enable lock context analysis for all drivers in the drivers/scsi/ directory except for the scsi_debug driver. The scsi_debug driver is excluded because of a locking bug in that driver. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/91ec026386fea160bc7080de977ce4e076eeb510.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 659dec2ce32e79e9f438ea32d82cd3fa19fc20c1 Author: Bart Van Assche Date: Fri Sep 25 11:26:31 2026 -0700 scsi: sym53c8xx_2: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/385ccf5f15b469a4909249e60ae7332b733e943d.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit e24eedc81ec4fe16f943a02b3617e2175c961c84 Author: Bart Van Assche Date: Fri Sep 25 11:26:30 2026 -0700 scsi: snic: Enable lock context analysis Set the CONTEXT_ANALYSIS variable in the Makefile. Acked-by: Narsimhulu Musini Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/23db7563bf154f505bdda5f05f7cfd574abc8b87.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 78b27248f7210c2bdb73de319c52489fd2d64b5d Author: Bart Van Assche Date: Fri Sep 25 11:26:29 2026 -0700 scsi: smartpqi: Enable lock context analysis Document locking requirements with __acquires(), __releases() and __cond_releases(). Suppress context analysis complaints with __acquire() annotations. This approach has been chosen because this driver uses the mutex API incorrectly. Fixing this driver falls outside the scope of this patch series. Cc: Tomas Henzl Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/4fd694d95bafa1b09d4e3ff997b10dcd04bc8f8e.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit d5f024412d239ce7fa49e387af19b28caeac097c Author: Bart Van Assche Date: Fri Sep 25 11:26:28 2026 -0700 scsi: iSCSI transport: Prepare for enabling lock context analysis Document locking requirements with __must_hold(). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/72bd8921b4ed0a58bd83beed2981ec48372b56fd.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 20026b0b55ec0db6a18b84f4c1252165d5a19449 Author: Bart Van Assche Date: Fri Sep 25 11:26:27 2026 -0700 scsi: qla4xxx: Enable lock context analysis Annotate the functions that perform conditional locking with __context_unsafe(). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/1136d8587d266c50935680d246161def1c760f05.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 5ed1a2dd293ac3ae1ea2ab15b906f21e8dcb7193 Author: Bart Van Assche Date: Fri Sep 25 11:26:26 2026 -0700 scsi: qla2xxx: Enable lock context analysis Make several code blocks with conditional locking compatible with thread-safety analysis. Annotate functions that perform conditional locking with __context_unsafe(). No functionality has been changed. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/7ce5e2ceb5c479190c9c44b2bf4339c91a8e6c55.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 23d5f939d99fd3e4c62e97d896578abfc32fe768 Author: Bart Van Assche Date: Fri Sep 25 11:26:25 2026 -0700 scsi: qla1280: Prepare for enabling lock context analysis Document locking requirements with __must_hold(). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/ddbb3ac055d757d5113096ebda77dfa122606239.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 5bb1688785a5314cea4eaf91b8fa5e3609501727 Author: Bart Van Assche Date: Fri Sep 25 11:26:24 2026 -0700 scsi: qla1280: Pass the host pointer directly to several functions Pass the struct Scsi_Host pointer directly to _qla1280_wait_for_single_command(), qla1280_wait_for_single_command(), qla1280_wait_for_pending_commands(), and qla1280_error_action(). Introduce the local variable 'host' in error handling functions to avoid repetitive dereferencing of cmd->device->host. This patch prepares for enabling lock context analysis. No functionality has been changed. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/4c2a8952fd8d3c8742af5685d0bb3a1677ba92b5.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 6210d20f7fe48c76b0ca8ee2584ef93b0bac2364 Author: Bart Van Assche Date: Fri Sep 25 11:26:23 2026 -0700 scsi: qedi: Enable lock context analysis Annotate qedi_cleanup_all_io() with __context_unsafe() since it performs conditional locking. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/670af9856e17f9c86ef2119aa7b3b266645e86da.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit cdc1694e333b95e238b2c3a59d5053561990495e Author: Bart Van Assche Date: Fri Sep 25 11:26:22 2026 -0700 scsi: qedf: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/a85d74900f96562d7ecc34cd6b16dd4b2f642d57.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 74688075dd07ada7c2a7e46ab7bd37d7630b44da Author: Bart Van Assche Date: Fri Sep 25 11:26:21 2026 -0700 scsi: pm8001: Enable lock context analysis Document locking requirements with __must_hold(). Acked-by: Jack Wang Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/e51355852d4a14478545bc9bb5fd9af9fd947bf4.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 202aeb5af5e21bb603e0669f0633fb7e2563d468 Author: Bart Van Assche Date: Fri Sep 25 11:26:20 2026 -0700 scsi: pcmcia: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/a6c7c5f042af4d8504c29e7fc0c6f84be2c0f153.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 53812028f864ffb3cbc2176ca42d069b2e6e5b8f Author: Bart Van Assche Date: Fri Sep 25 11:26:19 2026 -0700 scsi: mvsas: Enable lock context analysis Document locking requirements with __must_hold(). Annotate functions that perform conditional locking with __context_unsafe(). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/208203a820c27927c13b906fd69620de0f136502.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 8d3d0e8d26a65055b93e1a54243f12bfd2223951 Author: Bart Van Assche Date: Fri Sep 25 11:26:18 2026 -0700 scsi: mpt3sas: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/91450f15b421be527cb9831e3f9a762d7f56536f.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit b6ac5193c69266a3873044c947e214d5d12144bc Author: Bart Van Assche Date: Fri Sep 25 11:26:17 2026 -0700 scsi: lpfc: Prepare for enabling lock context analysis Annotate the functions that perform conditional locking with __context_unsafe(). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/9ace40e6af0b7623c61d9e3caad997856455dbef.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 554a002f96f3dcbe2aad0f23fb0c2b9c73cacf73 Author: Bart Van Assche Date: Fri Sep 25 11:26:16 2026 -0700 scsi: libsas: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20e64720347207239130312c7a7c6ef530ebce38.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 4901e49c5c609c2919badea87f8a9ed379fe5cf1 Author: Bart Van Assche Date: Fri Sep 25 11:26:15 2026 -0700 scsi: libsas: Prepare for enabling lock context analysis Since Clang requires that lock context annotations only refer to variables that are visible, modify a __must_hold() annotation. Signed-off-by: Bart Van Assche Reviewed-by: Jason Yan Link: https://patch.msgid.link/15aea1d6d04eed87a84c23a6f3eaa487378f0bda.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 3a6d7333e3f2b5ccd730e0b5ba7a7f2c52a7da49 Author: Bart Van Assche Date: Fri Sep 25 11:26:14 2026 -0700 scsi: libfc: Enable lock context analysis Document locking requirements with __must_hold(). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/21a39d6277c0f296d0d5188bcdcb0ffcfda7a192.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 10385e735e8a7b28686769f8904844dd82d18b89 Author: Bart Van Assche Date: Fri Sep 25 11:26:13 2026 -0700 scsi: isci: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/bf1003a84db3f1f15e67a2f02ccfc2f0b156ef20.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 68ce6d43f4ff0ff974dca38c677efb001ec971d8 Author: Bart Van Assche Date: Fri Sep 25 11:26:12 2026 -0700 scsi: ips: Prepare for enabling lock context analysis Annotate ips_next() with __context_unsafe() because it performs conditional locking. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/f55b7075d5703ab7d95c1f063e2f78377a7250a8.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 9c176edb892ce47aef4514297a5346185e21a6da Author: Bart Van Assche Date: Fri Sep 25 11:26:11 2026 -0700 scsi: ipr: Prepare for enabling lock context analysis Document locking requirements with __must_hold(). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/3e6e59930da8c522c95d598aeb04bb30dbc11e75.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit e2bb4cd0808037adcc9ee06738ac6b27bd8b91b0 Author: Bart Van Assche Date: Fri Sep 25 11:26:10 2026 -0700 scsi: ipr: Pass the host pointer directly to several functions Pass the struct Scsi_Host pointer directly to ipr_send_blocking_cmd(), ipr_device_reset(), and __ipr_eh_dev_reset(). Introduce the local variable 'host' in error handling functions to avoid repetitive dereferencing of cmd->device->host. This patch prepares for enabling lock context analysis. No functionality has been changed. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/3b255296f86ae38f349f92e14736adaa18c9d8ec.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 2a0cb1a2423d88bb1ec95fb7f3e4625e561ea983 Author: Bart Van Assche Date: Fri Sep 25 11:26:09 2026 -0700 scsi: ipr: Simplify ipr_eh_abort() Derive the SCSI host pointer once instead of three times. This was detected by Sashiko. No functionality has been changed. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/8427eb7fc8e7c97cf115b9bfff27ed84c35c8bf4.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit fc4f84fdc528be95e05ca77b253b6428333eb6e3 Author: Bart Van Assche Date: Fri Sep 25 11:26:08 2026 -0700 scsi: ibmvscsi_tgt: Enable lock context analysis Document locking requirements with __must_hold() and enable lock context analysis. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/c39eb31704284bf0f902b96a4307b43b076b0b0d.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 256962ec2846b6e964c5fccb44a00ab17e2a0b16 Author: Bart Van Assche Date: Fri Sep 25 11:26:07 2026 -0700 scsi: ibmvscsi: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/9651d7f88d22a9ebce8a8198f53338ad14164b88.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 107115c393ea2bc092ab94c5d72bf10cf641f495 Author: Bart Van Assche Date: Fri Sep 25 11:26:06 2026 -0700 scsi: hpsa: Prepare for enabling lock context analysis mutex_lock_interruptible() returns a negative value upon failure or zero upon success. Since the Clang thread-safety analyzer only supports == 0 and != 0 tests for functions that perform conditional locking, change the == -EINTR test into != 0. This change does not modify the behavior of hpsa_do_reset(). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/4e3a71e82eb2deac956ac51f9019c410037526b4.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 11c345d6dbd8ba3724206c6683f2d7a0ca1cb3eb Author: Bart Van Assche Date: Fri Sep 25 11:26:05 2026 -0700 scsi: hisi_sas: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/5582ac312fea8c9315e3e87541eb0ea77524f685.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 70d2304ae575c0432251f36231d32e6ff0eb4f7f Author: Bart Van Assche Date: Fri Sep 25 11:26:04 2026 -0700 scsi: fnic: Enable lock context analysis Document locking requirements with __must_hold(). Suppress complaints about conditional locking in fnic_device_reset() with __acquire() and __release(). Cc: Karan Tilak Kumar Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/e8ac2000b7ed23cec78f5be360a21d741f50a73e.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit ac063a30e80d8c19f196838257c182f33601f5c2 Author: Bart Van Assche Date: Fri Sep 25 11:26:03 2026 -0700 scsi: fnic: Pass pointers directly to several functions In fdls_target_restart_nexus(), pass the struct fnic_iport_s pointer directly from callers instead of deriving it from tport->iport. In fnic_fdls_add_tport() and fnic_fdls_remove_tport(), pass the struct fnic pointer directly instead of the struct fnic_iport_s pointer. This patch prepares for enabling lock context analysis. No functionality has been changed. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/8351d2f8c89a02fe537238d70d25d443375dca94.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit f9581845d99234db8933600e3a01259327f391c6 Author: Bart Van Assche Date: Fri Sep 25 11:26:02 2026 -0700 scsi: fcoe: Enable lock context analysis Pass the FCoE controller pointer to all functions that are called with one or more locks held. Document locking requirements by adding __must_hold() annotations. Enable lock context analysis in the Makefile. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/61dba0e839bc3522ff74224278159dcfe4e6488c.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 5ba6b666f701df02412e50acd2061de3ab754190 Author: Bart Van Assche Date: Fri Sep 25 11:26:01 2026 -0700 scsi: esas2r: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/fb1299e4a889b89e9e47b4aff913393a266d0198.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 8281912eda174de2ffa6fd3fb4e01bc42552d688 Author: Bart Van Assche Date: Fri Sep 25 11:26:00 2026 -0700 scsi: elx: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/5514a1e6c77a2143f52b74747ad8de568b04e2f4.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 7a6d3b98469d7891a86fc9a70741be5d77548292 Author: Bart Van Assche Date: Fri Sep 25 11:25:59 2026 -0700 scsi: csiostor: Enable lock context analysis Document locking requirements across the csiostor driver by annotating functions in csio_hw.c, csio_lnode.c, csio_rnode.c, and csio_scsi.c with __must_hold(). Enable lock context analysis by setting CONTEXT_ANALYSIS in the Makefile. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/214dee25ec4dab987380b8bd9d296303f9399691.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 640361f6a9446dbd995cd2f12433f1ec73159b70 Author: Bart Van Assche Date: Fri Sep 25 11:25:58 2026 -0700 scsi: csiostor: Pass the hw pointer directly to several functions Pass the struct csio_hw pointer directly to csio_scsi_cleanup_io_q(), csio_scsi_abort_io_q(), csio_scsim_cleanup_io(), and csio_scsim_cleanup_io_lnode() instead of passing the struct csio_scsim pointer. Update all callers and header declarations accordingly. Prepare the csiostor driver for enabling compiler-based lock context analysis. No functionality has been changed. Signed-off-by: Bart Van Assche Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/f6e8b86640799a70cfb161210048ca4570bad03d.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 89cb9bbfcb6cf172b1db57b5f1d76be9da9f0393 Author: Bart Van Assche Date: Fri Sep 25 11:25:57 2026 -0700 scsi: bnx2i: Enable lock context analysis Document locking requirements with __must_hold(). Add an __assume_ctx_lock() annotation where locking is missing. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/4cafc1018d9a072df3952488ca0bf4ffb7410be7.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 9495fadabea94cef4595938accfc48273eb955c7 Author: Bart Van Assche Date: Fri Sep 25 11:25:56 2026 -0700 scsi: bnx2fc: Enable lock context analysis Document the locking requirements with __must_hold(). Make the argument names in the definition and the declaration of bnx2fc_process_seq_cleanup_compl() consistent. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/224219367c2af9fc4d193d0568bb8a6e8d22f97d.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 32f9cdb45bdbf37b2536e320f46e536acd3eed66 Author: Bart Van Assche Date: Fri Sep 25 11:25:55 2026 -0700 scsi: bnx2fc: Pass tgt directly to several functions Pass the tgt pointer directly to several functions. This patch prepares for enabling lock context annotation. No functionality has been changed. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/e0073d5095f58569c8c16217f9b2fabd44762ad9.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit d9a376f43c1b4e13e8a1bfbe9610ccb3d1bac7ea Author: Bart Van Assche Date: Fri Sep 25 11:25:54 2026 -0700 scsi: bfa: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/a109c89c781c7623a7a1f4aa3b4bd4bbfe32d7b8.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit f3e83f6587514271a1706b5b56be32153d779f74 Author: Bart Van Assche Date: Fri Sep 25 11:25:53 2026 -0700 scsi: cxgbi: Enable lock context analysis Enable compile-time lock context analysis in the Makefile. Document where locking is missing by adding an __assume_ctx_lock() annotation. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/e663e2d47afc8727991838bbfa29bb5ab21b38b8.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 901ade3fa13cb0597dc5a4a605ff8ede896d6e4f Author: Bart Van Assche Date: Fri Sep 25 11:25:52 2026 -0700 scsi: be2iscsi: Enable lock context analysis Document locking requirements by annotating locking requirements with __must_hold(). Enable lock context analysis for the be2iscsi driver by setting CONTEXT_ANALYSIS in the Makefile. Cc: Ketan Mukadam Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/e50dc59c2e48c84442e959e17989fb436eac6810.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit bbee7e5b4fd93a9faf2c811ef9822ce55368d1c1 Author: Bart Van Assche Date: Fri Sep 25 11:25:51 2026 -0700 scsi: libiscsi: Prepare for enabling lock context analysis Document locking requirements with __must_hold(). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/7097a65b503cbf8d3a49c26f87293dd871080ea6.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit ae1c0d65bc71148891052ef8eb2e7de96c169594 Author: Bart Van Assche Date: Fri Sep 25 11:25:50 2026 -0700 scsi: libiscsi: Pass the session pointer directly to several functions Pass the struct iscsi_session pointer directly to all functions that must be called with an iscsi_session synchronization object held. Update the callers of the modified functions in the iSER, be2iscsi, bnx2i, cxgbi, libiscsi, qedi and qla4xxx drivers. This patch prepares for enabling compile-time lock context analysis in libiscsi. No functionality has been changed. Cc: Lee Duncan Cc: Chris Leech Cc: Mike Christie Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/f717adbc1d64a4ddb457d4878d704999922bf1d0.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 5a08252a78e1cf400e7e20f486f7b6e4f0fc38c4 Author: Bart Van Assche Date: Fri Sep 25 11:25:49 2026 -0700 scsi: arcmsr: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/98a213b9a65dab8bdd73eb1f9317844f35502498.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 678dd8c98ef551f8d1ff55ef51b4351e16a9381f Author: Bart Van Assche Date: Fri Sep 25 11:25:48 2026 -0700 scsi: aic94xx: Enable lock context analysis Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/ad452cff7f934476d9bdadd22d2ff6c73eedb0f7.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 22d469241b6ba17d3264c48529fba63433d9a99c Author: Bart Van Assche Date: Fri Sep 25 11:25:47 2026 -0700 scsi: aic7xxx: Enable lock context analysis Annotate ahd_lock() and ahc_lock() with __acquires() and ahd_unlock() and ahc_unlock() with __releases(). Enable lock context analysis for the aic7xxx driver by setting CONTEXT_ANALYSIS in the Makefile. Cc: Hannes Reinecke Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/a4d826939ec5c251dc8fac03a824ed3ebd218eed.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 825b26b342eb85d86f08785e541ecb747d1c6c50 Author: Bart Van Assche Date: Fri Sep 25 11:25:46 2026 -0700 scsi: aha152x: Prepare for enabling lock context analysis Annotate aha152x_error() with __noreturn. This suppresses a lock context analysis compiler warning if lock context analysis is enabled. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/b7dc3add84f4224a90a095d9996b0744cb04c1cc.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 44bb77a1afafcab3bc954a2585c849c0549c71bd Author: Bart Van Assche Date: Fri Sep 25 11:25:45 2026 -0700 scsi: aacraid: Enable lock context analysis Document the aac_send_reset_adapter() locking requirements with __must_hold(). Annotate functions that perform conditional locking with __context_unsafe(). Enable lock context analysis. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/09b6a1659d968bdc94c01f8215bbb4e41af5ebdc.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit a51e9948d16815d900d994732e1d348106814ad0 Author: Bart Van Assche Date: Fri Sep 25 11:25:44 2026 -0700 scsi: NCR5380: Prepare for enabling lock context analysis Pass the struct NCR5380_hostdata pointer directly to NCR5380_select() and NCR5380_information_transfer() instead of the struct Scsi_Host pointer. This ensures that the lock context annotations (__releases(&hostdata->lock) and __acquires(&hostdata->lock)) refer to a function argument. Update callers and function prototypes accordingly. Cc: Finn Thain Cc: Michael Schmitz Signed-off-by: Bart Van Assche Acked-by: Finn Thain Link: https://patch.msgid.link/a9d1b960868ac4dae9c5a9b98aea5dcf6713fb97.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit d69fcaa34b67c08c636af4c6e1dc3a127f7e3fca Author: Bart Van Assche Date: Fri Sep 25 11:25:41 2026 -0700 scsi: st: Prepare for enabling lock context analysis Document what mutex is released by st_common_ioctl(). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/fd9ee36abab86feb7b4a8e8c0cc7e84ba72fd764.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit c5b5b5786ae135b66f25b44ea4b40984b56399a3 Author: Bart Van Assche Date: Fri Sep 25 11:25:40 2026 -0700 scsi: sg: Prepare for enabling lock context analysis Annotate open_wait() with __must_hold() since it unlocks and locks a mutex. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/e522b403882f67edd0c6b2865de71c032aaa6dfa.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit e46ce4e8ef2eaa8271fa79ce7de2633a65643dc7 Author: Bart Van Assche Date: Fri Sep 25 11:25:39 2026 -0700 scsi: PCI: Convert to_pci_dev() into an inline function Clang's context analysis checker performs alias analysis on expressions passed to annotations like __acquires(). Clang's alias analysis does not support container_of(). Convert to_pci_dev() from a macro into an inline function such that Clang recognizes multiple to_pci_dev() expressions as identical if the 'dev' argument is the same. It is on purpose that to_pci_dev() accepts a const pointer and returns a pointer that is not const. Any other choice, e.g. accepting a non-const pointer or returning a const pointer, triggers compiler errors in code that uses the to_pci_dev() macro. While _Generic() could be used to support const and non-const struct device pointers in a more elegant way, Clang's alias analysis does not support _Generic(). Acked-by: Bjorn Helgaas Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/f147ad227b85439d56183e60e0332547b84441bc.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 92821c2358c78345909889793918af8763808bd4 Author: Xingui Yang Date: Fri Oct 9 11:32:38 2026 +0800 scsi: hisi_sas: Fix spinup failure for SAS SSP devices in Active_Wait state SAS HDDs powered up with RNOT=1 wait in Active_Wait state for a NOTIFY(ENABLE SPINUP) primitive and keep returning NOT_READY with ASC/ASCQ 0x04/0x11, causing endless mid-layer retries and spinup failure. Parse the sense data in the slot completion path and, when LU_NOT_READY_NOTIFY_REQUIRED is returned by a directly-attached SSP device, queue work that sends the primitive from process context (sl_notify_ssp() contains msleep()). The work takes a runtime PM reference with pm_runtime_get_if_active(), pairing with pm_runtime_put_sync() in the work, so the controller stays resumed until the primitive is sent. Fixes: 60b4a5ee9034 ("scsi: hisi_sas: add v3 cq interrupt handler") Signed-off-by: Xingui Yang Link: https://patch.msgid.link/20261009033238.1076098-5-yangxingui@huawei.com Signed-off-by: Martin K. Petersen (Oracle) commit 7991f33110d21a9403338dbfe599472e3e1ceb32 Author: Xingui Yang Date: Fri Oct 9 11:32:37 2026 +0800 scsi: hisi_sas: Clear PHY error counts on phyup Some disks generate link errors during link establishment but still phy up successfully. These intermediate error counts are not cleared after phyup, leaving stale data for error detection. Clear them on phyup. Signed-off-by: Xingui Yang Link: https://patch.msgid.link/20261009033238.1076098-4-yangxingui@huawei.com Signed-off-by: Martin K. Petersen (Oracle) commit 7307109c92f702434669bfcd29fb8058ccc07b45 Author: Xingui Yang Date: Fri Oct 9 11:32:36 2026 +0800 scsi: hisi_sas: Fix incorrect delay values from magic-number cleanup Commit 4ca7fe99fc84 ("scsi: hisi_sas: Use macro instead of magic number") replaced several delay constants with a single macro of value 100. However, three sites originally used different values: - reset_hw_v3_hw: udelay(50) -> udelay(100) [doubled] - disable_phy_v3_hw: mdelay(50) -> mdelay(100) [doubled] - disable_host_v3_hw: mdelay(10) -> mdelay(100) [10x longer] The overly long delays on the PHY disable and host shutdown paths increase boot and shutdown time for all local PHYs. Add separate macros for each delay to restore the original values while still avoiding magic numbers. Fixes: 4ca7fe99fc84 ("scsi: hisi_sas: Use macro instead of magic number") Signed-off-by: Xingui Yang Link: https://patch.msgid.link/20261009033238.1076098-3-yangxingui@huawei.com Signed-off-by: Martin K. Petersen (Oracle) commit 4d7f9c3fdce773f6c69d17c1d4a05bd5e17f4b99 Author: Xingui Yang Date: Fri Oct 9 11:32:35 2026 +0800 scsi: libsas: Fix out-of-bounds memcpy() in sas_ssp_task_response() The min_t(int, ...) clamp of the device-provided sense_data_len turns negative for values >= 0x80000000 and is then used as the memcpy() length, reading and writing out of bounds. Compare as u32 instead. Well-formed responses are unaffected. Fixes: 366ca51f30de ("[SCSI] libsas: abstract STP task status into a function") Signed-off-by: Xingui Yang Link: https://patch.msgid.link/20261009033238.1076098-2-yangxingui@huawei.com Signed-off-by: Martin K. Petersen (Oracle) commit ec6b083915e8146e147314a5f4f1285d07b57bfc Author: Stanley Jhu Date: Tue Oct 13 21:27:08 2026 +0800 scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies bsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per job, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct ufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command returns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after the 40-byte header and writes 8 bytes past the end of the buffer. Let each BSG transport pass its reply buffer size to bsg_setup_queue() and have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full reply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE. Fixes: 6ff265fc5ef6 ("scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg") Cc: stable@vger.kernel.org Signed-off-by: Stanley Jhu Link: https://patch.msgid.link/20261013132708.1669415-1-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 81e097a064b28b4a1f6ca1a8b433e659c1bd64c0 Author: Xingui Yang Date: Mon Sep 28 12:02:34 2026 +0800 scsi: libsas: Fix SMP IO deadlock during HA resume smp_execute_task_sg() calls pm_runtime_get_sync() on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the get_sync() deadlocks: it waits for the ongoing resume (the device is RPM_RESUMING), while the resume is blocked in sas_drain_work() waiting for that same SMP IO to complete. The deadlock needs an expander-attached SATA disk. During sas_resume_ha() -> sas_drain_work(), DISCE_RESUME -> sas_resume_sata() -> ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset for such a disk is done via SMP PHY CONTROL (sas_ata_hard_reset() -> sas_phy_reset() -> sas_smp_phy_control() -> smp_execute_task_sg()). Direct-attached SATA resets through lldd_control_phy() and SSP devices use TMFs, so neither hits this. Replace the get_sync()/put_sync() pair with pm_runtime_get_noresume()/pm_runtime_put(). smp_execute_task_sg() only needs to hold off autosuspend while the SMP is in flight, and it must not try to resume the host: a sync resume issued from the HA resume path itself is what deadlocks, and by the time sas_resume_ha() runs, hw_init has already reinitialized the hardware, so the device is accessible without one. The usage reference is still required. Discovery work normally runs inside an event worker's PM reference, taken at sas_notify_port_event() notify time and held until the handler has flushed the disco queue. sas_rediscover_ex_phy() however requeues DISCE_REVALIDATE_DOMAIN from within the revalidation worker itself, and flush_workqueue() does not wait for work items queued during execution, so that chained revalidation runs with no outer PM reference - without the get_noresume(), its SMP could race autosuspend. For the BSG path, sas_smp_handler() is the only caller which may find the host autosuspended: expander SMP requests do not go through any SCSI device request queue, so nothing else in that path holds the host awake. Resume it there with pm_runtime_resume_and_get() and check the result. Fixes: 3dbbbf656b850 ("scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race") Signed-off-by: Xingui Yang Reviewed-by: John Garry Link: https://patch.msgid.link/20260928040234.992912-1-yangxingui@huawei.com Signed-off-by: Martin K. Petersen (Oracle) commit b633249f58832e6aeefa606d6d5aec76abfe6d89 Author: Eric Biggers Date: Wed Sep 30 21:48:57 2026 -0700 scsi: target: iscsi: Use crypto library API Make iscsi_target_auth.c call into the crypto library directly instead of going through crypto_shash. This is simpler and much more efficient, as it avoids overhead of the crypto_shash layer. The hash computation itself also no longer has error codes that need to be checked. For simplicity, still do a memory allocation per operation to buffer the data (which is typically less than 50 bytes here) so that the one-shot digest functions can be used. It's still much more efficient than doing the super slow crypto_alloc_shash(). Signed-off-by: Eric Biggers Reviewed-by: David Disseldorp Link: https://patch.msgid.link/20261001044857.169487-1-ebiggers@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 3aeac6a2c2efb253bfa0d1ad8eba01d46a89d479 Author: Nigel Kirkland Date: Mon Oct 12 17:16:48 2026 -0700 scsi: lpfc: Update lpfc version to 15.0.0.1 Update lpfc version to 15.0.0.1 Signed-off-by: Nigel Kirkland Tested-by: Ewan D. Milne Link: https://patch.msgid.link/20261013001648.62289-9-nkirkland2304@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 8dbdaf88f4b991cb5b0e178fa18deefcb1380207 Author: Nigel Kirkland Date: Mon Oct 12 17:16:47 2026 -0700 scsi: lpfc: Update correct ndlp refcnt when rejecting an unsolicited PLOGI The domain controller FC_ID can change whenever a fabric switch with an ISL link is replaced or the admin reconfigures the fabric switch with active links. In such situations, reference count updates should be applied to the correct nodelist structure. Signed-off-by: Nigel Kirkland Link: https://patch.msgid.link/20261013001648.62289-8-nkirkland2304@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 75ae9d50b8430246871af493f02bfff38257ee7b Author: Nigel Kirkland Date: Mon Oct 12 17:16:46 2026 -0700 scsi: lpfc: Refactor calls on fc_disctmo to lpfc_set_disctmo in RSCN handler The lpfc_set_disctmo() routine is not used for all cases when the driver needs to restart discovery on the fc_disctmo timer. Not doing so, makes discovery timer actions invisible in some cases as they do not get logged. This patch substitutes calls on fc_disctmo to use lpfc_set_disctmo() in lpfc_els_rcv_rscn(). Signed-off-by: Nigel Kirkland Tested-by: Ewan D. Milne Link: https://patch.msgid.link/20261013001648.62289-7-nkirkland2304@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 5750b941ac75ad03570923d0f17331b6d832c69e Author: Nigel Kirkland Date: Mon Oct 12 17:16:45 2026 -0700 scsi: lpfc: Rework I/O flush ordering when unloading driver The lpfc_els_abort() routine has a code path that cancels outstanding I/Os on the ELS ring when attempted aborts fail. The failed aborts are queued to a drv_cmpl_list and then cancelled after the ELS pring->txcmplq is fully traversed. However if the abort failure returns IOCB_ABORTING, then the driver should not have cancelled it. Doing so starts two threads working on the same iocb and ndlp, leading to unintended race conditions. Fix by capturing the IOCB_ABORTING return value in lpfc_els_abort() and not adding it to the list of IOCBs for cancelling. We should allow the IOCB scheduled for abort to complete naturally. This avoids simultaneous threads acting on the same IOCB and ndlp objects. The lpfc_free_iocb_list() is moved to execute after lpfc_sli4_hba_unset() allowing the routine to flush I/O before freeing it. And, in lpfc_pci_remove_one_s4() a call to flush the phba->wq is added. This makes the unload logic consistent with offline handling logic. Signed-off-by: Nigel Kirkland Tested-by: Ewan D. Milne Link: https://patch.msgid.link/20261013001648.62289-6-nkirkland2304@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 57b0a51937ef4a94cb6c86d42136d122be841694 Author: Nigel Kirkland Date: Mon Oct 12 17:16:44 2026 -0700 scsi: lpfc: Check fc4_xpt_flags before decrementing ndlp kref on FDISC error The current initial kref count drop logic for an ndlp that fails FDISC assumes that the ndlp has never registered with transport layer and thus the lpfc_dev_loss_tmo_callbk never called. However, a failed FDISC can occur after a successful transport layer registration too. So, lpfc_dev_loss_tmo_callbk can occur and there is a potential use-after-free on the ndlp. Check ndlp->fc4_xpt_flags if previously registered with an upper layer transport and check ndlp->nlp_flags if there is a LPFC_EVT_DEV_LOSS work pending. If not previously registered nor LPFC_EVT_DEV_LOSS work pending, then set the NLP_DROPPED flag as before and decrement the initial kref on FDISC error. However, if ndlp has been previously registered, then let the pre-existing logic for each transport's respective dev_loss_tmo_callbk perform the initial kref decrement. Signed-off-by: Nigel Kirkland Link: https://patch.msgid.link/20261013001648.62289-5-nkirkland2304@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit e7e065ec672af054c50eb270b5a6b178fd46b291 Author: Nigel Kirkland Date: Mon Oct 12 17:16:43 2026 -0700 scsi: lpfc: Fix kernel oops when unmapping SCSI DMA buffers for an aborted cmd A kernel oops at dma_unmap_sg_attrs() may occur due to a race between an aborted SCSI I/O completion and a SCSI error handler issued TUR using the same repurposed scsi_cmnd structure. The LPFC_DRIVER_ABORTED cmd_flag is set when inflight I/Os are aborted via lpfc_sli_abort_taskmgmt(), and this flag is not cleared until after scsi_done() is called. The inflight I/O test is changed to check SCSI I/O for either LFPC_IO_ON_TXCMPLQ or LPFC_DRIVER_ABORTED. If either cmd_flag is set, then the I/O should still be counted. Signed-off-by: Nigel Kirkland Tested-by: Ewan D. Milne Link: https://patch.msgid.link/20261013001648.62289-4-nkirkland2304@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 86866706d0a9bf0dc4261b6b05b7ec42459e5931 Author: Nigel Kirkland Date: Mon Oct 12 17:16:42 2026 -0700 scsi: lpfc: Early return out of lpfc_els_abort() when HBA_SETUP flag is not set It is possible that a dev_loss_tmo callback fires during an HBA reset. The ELS pring structure is cleared by the HBA reset path and the dev_loss_tmo callback executing lpfc_els_abort() could be using a stale ELS pring pointer. To significantly reduce exposure, check if HBA_SETUP flag is set before proceeding to use the ELS pring pointer in lpfc_els_abort(). There is no point to issue aborts when the SLI port is not setup anyways. Signed-off-by: Nigel Kirkland Reveiwed-by: Ewan D. Milne Tested-by: Ewan D. Milne Link: https://patch.msgid.link/20261013001648.62289-3-nkirkland2304@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit aef36d2e16f49e48e3569c547fe60edf5c2145a3 Author: Nigel Kirkland Date: Mon Oct 12 17:16:41 2026 -0700 scsi: lpfc: Fix use-after-free in lpfc_cmpl_ct_cmd_vmid() In lpfc_cmpl_ct_cmd_vmid(), there is an early call to lpfc_ct_free_iocb() when cmd is SLI_CTAS_DALLAPP_ID. Within lpfc_ct_free_iocb() the cmdiocb->rsp_dmabuf will be freed. This means any ctrsp ptr dereference for SLI_CT_RESPONSE_FS_RJT or even ctrsp->ReasonCode and ctrsp->Explanation when handling a CT LS_RJT response is a use-after-free. Remove the early lpfc_ct_free_iocb call for SLI_CTAS_DALLAPP_ID. There already is a free_res label that calls lpfc_ct_free_iocb so there doesn't need to be an early lpfc_ct_free_iocb at the start of lpfc_cmpl_ct_cmd_vmid. Signed-off-by: Nigel Kirkland Tested-by: Ewan D. Milne Link: https://patch.msgid.link/20261013001648.62289-2-nkirkland2304@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit aea9bae78b4070ea981af45f75e65f275cf85533 Author: Bart Van Assche Date: Tue Oct 13 15:10:09 2026 -0700 scsi: core: Enable lock context analysis for the scsi_debug driver Enable lock context analysis now that all lock context analysis warnings have been fixed. Reviewed-by: Christoph Hellwig Reviewed-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/46613e281866679cff455c3cbab842e48ad2a3d3.1791924924.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 0f81d5ea524d1706e0eedbbaaa34bd80a95e2b1d Author: Bart Van Assche Date: Tue Oct 13 15:10:08 2026 -0700 scsi: scsi_debug: Improve lock context annotations Prepare the scsi_debug driver for enabling compiler-based lock context analysis: - Annotate the lock and unlock helper functions with __acquires, __releases, __acquires_shared, and __releases_shared. - Add __acquire() and __release() calls in the paths that do not match the __acquires() / __releases() annotations. - Annotate sdeb_meta_{read,write}_{,un}lock() with __context_unsafe() because adding __acquire() and __release() calls in these functions is not possible without triggering undefined behavior (taking the address of a member of a structure with a NULL pointer as base address). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/1775809e31b535cc42f3f79e75f28666e74a98f7.1791924924.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 20a26ca89e7175b9dc1f9e1454585a4a5b6aac95 Author: Bart Van Assche Date: Tue Oct 13 15:10:07 2026 -0700 scsi: scsi_debug: Split resp_atomic_write() Prepare for enabling lock context analysis by eliminating conditional locking. Reviewed-by: Christoph Hellwig Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/bd623851c07c80b3f1bff493e66dc268656e9883.1791924924.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 6544f731e470028b3832986ed13eeac332b823f8 Author: Bart Van Assche Date: Tue Oct 13 15:10:06 2026 -0700 scsi: scsi_debug: Split resp_write_dt0() Prepare for enabling lock context analysis by eliminating conditional locking. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/ef20891477dd7eac3874945660caec278893a619.1791924924.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 06c3166f2566a3f5407077fff046d1ad3ed9fcfe Author: Bart Van Assche Date: Tue Oct 13 15:10:05 2026 -0700 scsi: scsi_debug: Split resp_read_dt0() Split this function to remove conditional locking. This patch prepares for enabling context analysis. Reviewed-by: Christoph Hellwig Reviewed-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/eea4ce8d6ddc86a401570f09a559a3b3c50e78ff.1791924924.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 06bce26589f430b620c9a6041a4e04b378586def Author: Bart Van Assche Date: Tue Oct 13 15:10:04 2026 -0700 scsi: scsi_debug: Split corrupt_lbas() Move the inner logic of corrupt_lbas() into a new helper function __corrupt_lbas() and call it from separate locked and unlocked branches in corrupt_lbas(). This patch prepares for enabling context analysis. Reviewed-by: Christoph Hellwig Reviewed-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/fe8629d9d7d0a54e8c5c14539953b40c09a6855a.1791924924.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 2bc11c1d4571c7a2fd302dc26e984c2079798c75 Author: Bart Van Assche Date: Tue Oct 13 15:10:03 2026 -0700 scsi: scsi_debug: Split resp_write_same() Since the Clang thread-safety analyzer does not support conditional locking, split the function resp_write_same() such that all locking statements end up in the same branch of an if-statement. Reviewed-by: Christoph Hellwig Reviewed-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/1127ce1be450f0c4503845b41eaa24c27aba373a.1791924924.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 2f50ca3d46b4d5916874ba19612498c0a9c1f5f9 Author: Bart Van Assche Date: Tue Oct 13 15:10:02 2026 -0700 scsi: scsi_debug: Fix a locking bug in resp_write_same() If fetch_to_dev_buffer() fails in resp_write_same(), the function jumps to 'out' without releasing the data write lock acquired earlier via sdeb_data_write_lock(). Jump to 'unlock' instead so that sdeb_data_write_unlock() is called on the error path. This bug has been discovered by building the scsi_debug driver with Clang and modified lock context annotations. The modified lock context annotations are available in patch "scsi: scsi_debug: Improve lock context annotations". Fixes: 84f3a3c01d70 ("scsi: scsi_debug: Atomic write support") Reviewed-by: Christoph Hellwig Reviewed-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/271ea11d3bc147d950a89419181f0c3f5a1ebf3b.1791924924.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 11bffcd9cb346732eab2914ef44fe777a3f0b585 Author: Yehyeong Lee Date: Wed Oct 7 10:58:42 2026 +0900 scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case ISCSI_OP_LOGOUT_RSP: case ISCSI_OP_LOGIN_RSP: case ISCSI_OP_TEXT_RSP: case ISCSI_OP_SCSI_TMFUNC_RSP: case ISCSI_OP_NOOP_IN: task = iscsi_itt_to_task(conn, hdr->itt); if (!task) return ISCSI_ERR_BAD_ITT; iscsi_itt_to_task() bounds the index against cmds_max and looks at nothing else, so a target can name any slot in the pool, including one that has never been used. task->conn is then NULL, and both iscsi_nop_out_rsp() and iscsi_complete_task() dereference it. One unsolicited NOP-In is enough; a Text Response carrying the same ITT crashes in iscsi_complete_task() instead. Require the task to be in flight and not a SCSI command, the way iscsi_itt_to_ctask() does for the command opcodes. [ 6.298634] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.298642] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.298652] CPU: 1 UID: 0 PID: 111 Comm: iscsistart Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.298654] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.298656] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.298691] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.298698] RSP: 0018:ffff88806c907be8 EFLAGS: 00010206 [ 6.298701] RAX: dffffc0000000000 RBX: ffff888006116800 RCX: 0000000000000020 [ 6.298702] RDX: 000000000000000c RSI: ffff88800525d578 RDI: 0000000000000060 [ 6.298703] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 6.298706] R10: 0000000000000020 R11: 0000000000000000 R12: 0000000000000000 [ 6.298706] R13: 000000000000002e R14: ffff8880056eb440 R15: ffff888006116800 [ 6.298707] FS: 00007fc02d1c2740(0000) GS:ffff8880b29bc000(0000) knlGS:0000000000000000 [ 6.298710] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.298711] CR2: 000055fe3b56ddf8 CR3: 00000000053b9004 CR4: 0000000000770ef0 [ 6.298712] PKRU: 55555554 [ 6.298713] Call Trace: [ 6.298714] [ 6.298714] __iscsi_complete_pdu+0x13a8/0x22a0 [ 6.298758] iscsi_complete_pdu+0x54/0xa0 [ 6.298759] iscsi_tcp_hdr_recv_done+0x870/0x2c80 [ 6.298778] iscsi_tcp_recv_skb+0x31e/0xec0 [ 6.298800] iscsi_sw_tcp_recv+0x12f/0x390 [ 6.298804] __tcp_read_sock+0x1ab/0x810 [ 6.298812] iscsi_sw_tcp_data_ready+0x18b/0x510 [ 6.298814] tcp_rcv_established+0x1f56/0x3a00 [ 6.298842] tcp_v4_do_rcv+0x449/0x960 [ 6.298847] tcp_v4_rcv+0x2245/0x3bc0 Fixes: 7996a778ff8c ("[SCSI] iscsi: add libiscsi") Cc: stable@vger.kernel.org Reviewed-by: Mike Christie Signed-off-by: Yehyeong Lee Link: https://patch.msgid.link/20261007015842.634893-4-yhlee@isslab.korea.ac.kr Signed-off-by: Martin K. Petersen (Oracle) commit c5958c770b2a0ee492414e26b07da9164a0d1f5d Author: Yehyeong Lee Date: Wed Oct 7 10:58:41 2026 +0900 scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr)); ... task = iscsi_itt_to_task(conn, rejected_pdu.itt); That value is whatever the target put there. iscsi_itt_to_task() bounds the index against cmds_max and checks nothing else, so any task in the pool can be named, and iscsi_nop_out_rsp() then completes it. An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsi_complete_task() hits its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning. Validate the reflected ITT the way iscsi_itt_to_ctask() validates a command ITT, and require the task to be in flight and not a SCSI command. [ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 [ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060 [ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504 [ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000 [ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000 [ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000 [ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0 [ 6.255439] PKRU: 55555554 [ 6.255564] Call Trace: [ 6.255674] [ 6.255768] __iscsi_complete_pdu+0x18bf/0x22a0 [ 6.256733] iscsi_complete_pdu+0x54/0xa0 [ 6.256905] iscsi_tcp_data_recv_done+0xf4/0x250 [ 6.257103] iscsi_tcp_recv_skb+0x31e/0xec0 [ 6.257680] iscsi_sw_tcp_recv+0x12f/0x390 [ 6.258061] __tcp_read_sock+0x1ab/0x810 [ 6.258853] iscsi_sw_tcp_data_ready+0x18b/0x510 [ 6.259808] tcp_data_queue+0x1f13/0x4cd0 [ 6.260567] tcp_rcv_established+0x8a5/0x3a00 [ 6.261931] tcp_v4_do_rcv+0x449/0x960 [ 6.262269] tcp_v4_rcv+0x2245/0x3bc0 Fixes: 8afa1439fcff ("[SCSI] libiscsi: handle immediate command rejections") Cc: stable@vger.kernel.org Reviewed-by: Mike Christie Signed-off-by: Yehyeong Lee Link: https://patch.msgid.link/20261007015842.634893-3-yhlee@isslab.korea.ac.kr Signed-off-by: Martin K. Petersen (Oracle) commit 8ee2a09a1dbb257c9e828ad2497f8e4832dfb142 Author: Yehyeong Lee Date: Wed Oct 7 10:58:40 2026 +0900 scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if (i >= session->cmds_max) i and cmds_max are both int, so a negative index passes and session->cmds[i] is read from before the array. be2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag, *index = (int)itt; and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the hardware async ring without replacing its ITT, so the value is the target's. It also reports the session's own age rather than the one in the tag, which leaves the age comparison in iscsi_verify_itt() with nothing to reject. Bound the index from below in both lookups. Fixes: bfead3b2cb46 ("[SCSI] be2iscsi: Adding msix and mcc_rings V3") Cc: stable@vger.kernel.org Reviewed-by: Mike Christie Signed-off-by: Yehyeong Lee Link: https://patch.msgid.link/20261007015842.634893-2-yhlee@isslab.korea.ac.kr Signed-off-by: Martin K. Petersen (Oracle) commit e15b81f602edbdee39c335546f25486a1747f3f0 Author: Linfeng Sun Date: Tue Aug 11 20:48:43 2026 +0800 scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi_update_param_value(), causing a double-free. Protect the lookup and replacement with the discovery TPG access lock, as used by the other TPG configfs parameter updates. Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1") Signed-off-by: Linfeng Sun Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260811124843.6817-1-linfeng.sun.dev@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 04a67a8b1a4460345d22fe75d93430cbf7e651d7 Author: Yu Zhang Date: Sun Sep 27 19:13:29 2026 +1000 scsi: target: Disable interrupts while holding delayed_cmd_lock target_do_delayed_work() takes dev->delayed_cmd_lock with a plain spin_lock(). It runs from system_percpu_wq, so interrupts stay enabled while the lock is held. Every other acquisition of that lock uses spin_lock_irqsave(): target_handle_task_attr() and transport_complete_ordered_sync() in target_core_transport.c, and target_non_ordered_release() in target_core_device.c. That was safe while every caller of transport_complete_task_attr() ran in process context: target_complete_ok_work() from target_completion_wq, transport_complete_qf() from dev->qf_work_queue, and transport_generic_request_failure() from the submit and execute paths. Since commit 06933066d88a ("scsi: target: Add support for completing commands from backend context") that is no longer true. With complete_type=1 on a fabric that sets direct_compl_supp, target_complete() runs target_complete_ok_work() inline in the backend's completion context, which target_complete_cmd_with_sense() documents as "May be called from interrupt context". For iblock that is the bio end_io. target_complete_ok_work() starts with transport_complete_task_attr(), which takes delayed_cmd_lock in two ways: - Every ORDERED command is put on dev->delayed_cmd_list by target_handle_task_attr() and dispatched from there by target_do_delayed_work(), which marks it SCF_TASK_ORDERED_SYNC. Its completion therefore goes through transport_complete_ordered_sync(). - A SIMPLE command that completes while an ORDERED command is pending drops the last reference to the killed dev->non_ordered, and percpu_ref_put() then runs target_non_ordered_release() in the completing context. Both take the lock and, if commands are waiting, call schedule_work(&dev->delayed_cmd_work), which queues on system_percpu_wq, i.e. on the CPU that took the completion. Further completions for the same queue are typically delivered there too, so one arriving while the work holds the lock spins on it forever. Reaching this needs complete_type=1, which is not the default (vhost-scsi, the only fabric with direct_compl_supp, defaults to TARGET_QUEUE_COMPL), a backend whose I/O completes from interrupt context, and ORDERED commands from the initiator. Linux virtio_scsi guests send only VIRTIO_SCSI_S_SIMPLE and never take the ordered path; any guest that uses the ORDERED task attribute, which vhost-scsi accepts, does. target_do_delayed_work() is a work item and always runs in process context, so spin_lock_irq() is sufficient. Found by inspection; no runtime report. A single ORDERED command goes through both acquisitions, so with CONFIG_PROVE_LOCKING the first one completed through direct completion should produce an inconsistent lock state report on delayed_cmd_lock (hardirq or softirq, depending on where the backend completes). Fixes: 06933066d88a ("scsi: target: Add support for completing commands from backend context") Signed-off-by: Yu Zhang Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260927091329.13482-1-yuz08559@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit beba4caa4550288dd617f428bd5037b51527e32c Author: Stanley Jhu Date: Mon Oct 12 20:00:59 2026 +0800 scsi: ufs: docs: Describe how to test with QEMU QEMU emulates a UFS host controller and logical units, but the kernel tree does not mention it, so developers without UFS hardware have no documented way to exercise the UFS core. Add a short section with the required kernel options, an example QEMU command line, and what the emulation does not cover. Signed-off-by: Stanley Jhu Reviewed-by: Bean Huo Link: https://patch.msgid.link/20261012120059.1371653-1-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 71caf7f84bd62a4bf91cc95abd2de690afb8d15f Author: Laurence Oberman Date: Tue Oct 13 16:25:48 2026 -0400 scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_idr. If that was the last reference, scsi_tape_release() frees the structure while it is still published in the idr. scsi_tape_get(), called from st_open(), looks up the tape in st_index_idr and takes a reference under st_ref_mutex and st_index_lock. remove_cdevs() does not wait for opens that are already past chrdev_open(), so an open that is blocked on st_ref_mutex while st_remove() holds it can take the mutex as soon as st_remove() drops it, find the freed tpnt in the idr and call kref_get() on it: BUG: KASAN: slab-use-after-free in st_open Write of size 4 ... st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291) chrdev_open ... Freed by task ...: kfree st_remove (drivers/scsi/st.c:4512) Remove the index from the idr before dropping the reference, all under st_ref_mutex. A concurrent scsi_tape_get() now either runs first and holds a valid reference that keeps the tape alive, or runs afterwards and finds nothing, so st_open() fails with -ENXIO. This restores the ordering st_remove() had before the conversion to st_index_idr, where the tape was unpublished from scsi_tapes[] before the final kref_put(). Fixes: 6c648d95a6af ("[SCSI] st: get rid of scsi_tapes array") Cc: stable@vger.kernel.org Reported-by: Dingisoul Closes: https://lore.kernel.org/linux-scsi/20261007211520.1428497-1-dingiso.kernel@gmail.com/ Tested-by: Dingisoul Signed-off-by: Laurence Oberman Link: https://patch.msgid.link/20261013202548.249628-1-loberman@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit fb20fe062b008eba371c5265440b6bbad5690405 Author: Andy Shevchenko Date: Tue Oct 13 11:59:24 2026 +0200 scsi: ufs: ufs-qcom: Don't define variable in the middle of the code While the C11 allows us to define variables in the code, we do not do this style (see more at [1]). Move the declaration to the top of the function. Link: https://lore.kernel.org/lkml/58fd478f408a34b578ee8d949c5c4b4da4d4f41d.camel@HansenPartnership.com/ [1] Signed-off-by: Andy Shevchenko Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20261013095924.959455-1-andriy.shevchenko@linux.intel.com Signed-off-by: Martin K. Petersen (Oracle) commit c9e9f024dd4f61f0f6636c9f2ed0830f87060e11 Author: Laurence Oberman Date: Tue Oct 6 12:42:50 2026 -0400 scsi: st: Save the visited block for the partition the drive is in set_location() saves the current tape location before switching partitions, so that switch_partition() can return to it later. It reads the location with READ POSITION but stores it in the st_partstat of STp->partition, ignoring the partition the drive reports. The two differ after a device reset. When the reset is recovered with MTREW, MTSEEK or MTEOM, st_ioctl() sets STp->partition = 0 and calls switch_partition() to return to STp->new_partition. A drive that was in partition 1 is still there, so set_location() files the partition 1 position under partition 0. The next switch to partition 0 locates to that block: if partition 0 holds less data, MTSETPART fails with EIO (BLANK CHECK), otherwise the tape is silently positioned at the wrong block. IBM ULTRIUM-TD5 (LTO-5), LU reset in partition 1 at block 1025: st 12:0:0:0: [st0] Visited block 1025 for partition 0 saved. ... st 12:0:0:0: [st0] Setting block to 1025 and partition to 0. st 12:0:0:0: [st0] Error: 402, cmd: 2b 2 0 0 0 4 st 12:0:0:0: [st0] Sense Key : Blank Check [current] st 12:0:0:0: [st0] Add. Sense: End-of-data detected Store the location in the st_partstat of the partition reported by READ POSITION. With the fix: st 12:0:0:0: [st0] Visited block 1025 for partition 1 saved. This is a pre-existing issue. It was not caught when testing the recent st reset series because the partition test was only run on scsi_debug: on the LTO drive it was skipped, since can-partitions is off in the test harness's stinit.conf, as is normal for LTO. scsi_debug hides the problem because its emulated tape returns to the beginning of partition 0 on an LU reset. It was found while validating a backport of that series to RHEL 9.8, when the partition tests were run on real hardware with can-partitions enabled. The same failure then reproduced on unmodified RHEL 9.8 and on upstream, and the fix makes the test pass on v7.3-rc3 and RHEL 9.8 with an LTO-5. The harness (https://gitlab.com/loberman/tapetest, test X03) now refuses to silently skip the partition tests on hardware. Fixes: 7081dc75df79 ("scsi: st: Restore some drive settings after reset") Assisted-by: Claude Signed-off-by: Laurence Oberman Link: https://patch.msgid.link/20261006164250.773840-1-loberman@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit e7d41f493e736fdf6d1fba40f0f24e9f4bfe6337 Author: Bean Huo Date: Tue Oct 6 10:29:07 2026 +0200 scsi: MAINTAINERS: Add Bean Huo and Stanley Jhu as UFS reviewers Bean Huo and Stanley Jhu have been contributing to and reviewing changes in the UFS subsystem for a number of years, and would like to help share the review load going forward. Add both as reviewers (R:) for the UFS subsystem. Signed-off-by: Bean Huo Acked-by: Stanley Jhu Link: https://patch.msgid.link/20261006082907.3405554-1-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen (Oracle) commit 8c8222c255772713eb36cde695777a1fce224917 Author: Yehyeong Lee Date: Mon Oct 5 21:35:54 2026 +0900 scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifront_do_response() validates the rqid in a backend response against VSCSIIF_MAX_REQS before using it to index info->shadow[], but then dereferences the entry to test ->inflight without checking that the slot is populated. Shadow slots are NULL before a command is submitted (the host private area is zeroed at allocation) and are reset to NULL in _scsifront_put_rqid() once a request completes, so an in-range rqid that does not correspond to an outstanding request makes the frontend dereference a NULL pointer. A malicious or buggy backend can thus crash the guest by returning a response whose rqid is in range but not in flight -- for example a spurious response before any command has been issued, or a duplicate of one already completed. The ring has only VSCSIIF_MAX_REQS (16) slots, so before the first command every in-range rqid selects a NULL slot. Reject a response whose shadow slot is not populated. Fixes: 6d1c2f48f3fc ("xen/scsifront: harden driver against malicious backend") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee Reviewed-by: Juergen Gross Link: https://patch.msgid.link/20261005123555.253995-1-yhlee@isslab.korea.ac.kr Signed-off-by: Martin K. Petersen (Oracle) commit 469fa055664bfd8717b087a80d59c03055789c17 Author: Stanley Jhu Date: Mon Sep 28 11:58:16 2026 +0800 scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ In MCQ mode, ufshcd_mcq_compl_pending_transfer() uses blk_mq_tagset_busy_iter() to iterate over busy requests during error recovery and host reset. However, both iterator callbacks perform whole-queue operations redundantly for each visited request: - force_compl == true: ufshcd_mcq_force_compl_one() calls ufshcd_mcq_compl_all_cqes_lock() on every busy request, sweeping the entire completion ring (hwq->max_entries slots) once per active request under spin_lock_irqsave even though the first sweep already cleared all completion entries. - force_compl == false: ufshcd_mcq_compl_one() acquires cq_lock and polls CQTPy over MMIO via ufshcd_mcq_poll_cqe_lock() for every busy request without doing any per-request work. Sweep or poll each hardware queue (hba->uhq[i]) once at the start of ufshcd_mcq_compl_pending_transfer(). When force_compl is true, run blk_mq_tagset_busy_iter() afterward to complete residual in-flight requests with DID_REQUEUE, and remove the now-unused ufshcd_mcq_compl_one() callback. Fixes: ab248643d3d6 ("scsi: ufs: core: Add error handling for MCQ mode") Cc: stable@vger.kernel.org Reviewed-by: Bart Van Assche Signed-off-by: Stanley Jhu Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260928035816.1294326-3-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 375f3a5691dd46b5d05b90a8968872ec8b2248c5 Author: Stanley Jhu Date: Mon Sep 28 11:58:15 2026 +0800 scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() During MCQ host reset, ufshcd_host_reset_and_restore() stops the host controller via ufshcd_hba_stop() (HCE = 0) before calling ufshcd_complete_requests(hba, true) -> ufshcd_mcq_compl_pending_transfer(hba, true) -> ufshcd_mcq_force_compl_one() -> ufshcd_mcq_compl_all_cqes_lock(). Because ufshcd_mcq_force_compl_one() is its sole caller, ufshcd_mcq_compl_all_cqes_lock() always runs with HCE = 0. Despite the comment above ufshcd_mcq_compl_all_cqes_lock() stating that reading CQTPy may not be safe with the controller disabled, the function still calls ufshcd_mcq_update_cq_tail_slot() at the end of its sweep: 1. Unsafe CQTPy MMIO read: Calling ufshcd_mcq_update_cq_tail_slot() at the end of the sweep reads CQTPy over MMIO while HCE = 0, directly contradicting the function's documented contract (commit 1373df88d535 ("scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()")) that reading CQTPy may not be safe with the controller disabled. 2. Spurious error logs on empty slots: Sweeping all max_entries slots visits empty entries where command_desc_base_addr is 0, causing ufshcd_mcq_process_cqe() to log unguarded dev_err(hba->dev, "Abnormal CQ entry!\n") messages. Fix both issues in ufshcd_mcq_compl_all_cqes_lock(): - Remove the ufshcd_mcq_update_cq_tail_slot() call and the redundant hwq->cq_head_slot = hwq->cq_tail_slot assignment without replacement. The two indices are already equal after the sweep: they are equal when the sweep starts, since ufshcd_mcq_poll_cqe_lock() consumes entries until cq_head_slot reaches cq_tail_slot, and the sweep advances cq_head_slot by exactly one full ring. Both indices are also reinitialized before the queue is reused. - Extract ufshcd_mcq_compl_cqe() and invoke it only on non-empty slots during full-ring sweeps, keeping "Abnormal CQ entry!" logging strictly for unexpected empty entries in ufshcd_mcq_poll_cqe_lock(). Fixes: ab248643d3d6 ("scsi: ufs: core: Add error handling for MCQ mode") Cc: stable@vger.kernel.org Reviewed-by: Peter Wang Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260928035816.1294326-2-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 27c0f718d3b3c99e6d315308e95d987d0382a8a8 Author: Ahmed Abdelhaleem Ahmed Date: Tue Sep 22 15:46:46 2026 +0000 scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch->dt[]. scsi_device_lookup() takes a reference, and nothing ever drops it: ch_destroy() frees the array with kfree(). ch->dt[] is read nowhere else - it only supplies the vendor, model and revision printed in the same loop. Once such a drive is removed, its scsi_device can never be released. It stays on the host's device list at its address, so a new device there is refused by anything that walks the list - target_core_pscsi reports "scsi_device_get() failed for H:C:T:L" - and the low-level driver's module can no longer be unloaded. Only a reboot recovers. It shows with any changer that reports its drives' ids; with the mhvtl virtual library (IBM 3573-TL personality), each create and remove of a library with four drives leaves four references behind, counted by the module's use count in lsmod. With ch not bound the count is unchanged, and with this patch applied it is unchanged too. Drop the reference as soon as the name has been printed, and remove the now unused dt[] array. That also removes the array leaked when ch_probe() fails after ch_readconfig(). The same leak was reported with an RFC patch in 2022, which was not merged. Fixes: daa6eda65a53 ("[SCSI] add scsi changer driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-scsi/20220719075442.6215-1-yanghao_ht@163.com/ Signed-off-by: Ahmed Abdelhaleem Ahmed Reviewed-by: Laurence Oberman Fixes: daa6eda65a53 ("[SCSI] add scsi changer driver") Link: https://patch.msgid.link/20260929-ch-dt-leak-v2-1-ddda8d635dca@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 78e04810542da416d3bead707b60cec773f1524d Author: Pengpeng Hou Date: Sun Sep 20 11:49:53 2026 +0800 scsi: ufs: mediatek: Handle mPHY power-on failures The MediaTek helper enables VA09 before powering on the mPHY, but ignores the PHY result. A failure can leave VA09 enabled and publish mphy_powered_on as true, so a later power-on attempt is skipped. Check phy_power_on(), attempt to unwind VA09 on failure, and leave the state flag unchanged. Propagate the helper result from host initialization as well as its existing resume caller. Keep the original PHY error if the supply rollback also fails, and report that rollback separately. The issue was found by our static-analysis tool. Fixes: 561e3a8726b2 ("scsi: ufs-mediatek: Fix unbalanced clock on/off") Fixes: cf137b3ea49a ("scsi: ufs-mediatek: Support VA09 regulator operations") Assisted-by: gpt 5 Signed-off-by: Pengpeng Hou Reviewed-by: Peter Wang Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260920034953.19535-1-hppiscas@163.com Signed-off-by: Martin K. Petersen (Oracle) commit 85de8b3a5eaa23d153aff4c7c83dddbc949064c9 Author: Runyu Xiao Date: Thu Sep 10 17:24:05 2026 +0800 scsi: qedi: Initialize callback state before registration qedi_get_protocol_tlv_data() can be called asynchronously by QED after qedi_ops->register_ops(). It takes stats_lock and reads ll2_mtu, but __qedi_probe() currently registers the callback before initializing the mutex and assigning the default MTU on the normal probe path. Initialize the callback-visible state before registering qedi_cb_ops. Keep the recovery path from reinitializing state because it reuses the existing qedi context. Fixes: 3cc5746e5ad7 ("scsi: qedi: Initialize the stats mutex lock") Cc: stable@vger.kernel.org Assisted-by: LLM Codex Signed-off-by: Runyu Xiao Link: https://patch.msgid.link/20260910092405.1300129-1-runyu.xiao@seu.edu.cn Signed-off-by: Martin K. Petersen (Oracle) commit 02a3178319639f650428164d4d003de4dc03e326 Author: Naomi Chu Date: Wed Sep 9 17:10:45 2026 +0800 scsi: ufs: core: Hold a clock reference across the probe Clock gating becomes possible as soon as ufshcd_init_clk_gating() has run, and from that point on the probe keeps accessing host registers without ever taking a clock reference. This has been safe only because of the state check in __ufshcd_release(): gate_work is not queued unless hba->ufshcd_state is UFSHCD_STATE_OPERATIONAL, and the promotion to that state used to happen after the last register access of the probe, at the end of ufshcd_probe_hba(). That is fragile: it only works while the promotion happens after the register accesses. Commit a390e6677f41 ("scsi: ufs: core: Expand the ufshcd_device_init(hba, true) call") changed that ordering by moving the promotion into ufshcd_init(), which schedules ufshcd_async_scan() afterwards. ufshcd_probe_hba() therefore now runs with the state already promoted, and it accesses host registers without holding a clock reference: - On hosts with UFSHCD_QUIRK_REINIT_AFTER_MAX_GEAR_SWITCH it calls ufshcd_hba_stop() and ufshcd_hba_enable() before ufshcd_device_init() sets the state back to UFSHCD_STATE_RESET, and both read REG_CONTROLLER_ENABLE, so gated clocks stall there instead of just losing a write. - It ends with an ufshcd_configure_auto_hibern8() write, which its other callers do take a clock reference for. Take a clock reference as soon as clock gating has been initialised and keep it until the probe is over. It then does not matter who drops a clock reference while the probe is running, and the register accesses of the probe no longer depend on hba->ufshcd_state. The reference is dropped by ufshcd_async_scan() once the scan has finished, or by the new out_release label if the probe fails after it was taken. Fixes: a390e6677f41 ("scsi: ufs: core: Expand the ufshcd_device_init(hba, true) call") Signed-off-by: Naomi Chu Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260909091045.1134956-1-naomi.chu@mediatek.com Signed-off-by: Martin K. Petersen (Oracle) commit 42d1221d321e55afc7bba9109a77aaf5a817c8a3 Author: Bart Van Assche Date: Mon Aug 31 12:27:20 2026 -0700 scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() Protect the megasas_get_ctrl_info() call in megasas_resume() with instance->reset_mutex using scoped_guard(). megasas_get_ctrl_info() may release and reacquire instance->reset_mutex. Hence, calling this function without holding instance->reset_mutex is not safe. Fixes: c3b10a55abc9 ("scsi: megaraid_sas: Update controller info during resume") Cc: Kashyap Desai Cc: Sumit Saxena Cc: Shivasharan S Cc: Chandrakanth patil Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/f06b5ee432b21cf293f0663e15b64f75a84b9fd5.1788204406.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit b6ec0f79745967c751c85df373062c8d15e45fc4 Author: ZHOU Jiaxiang Date: Wed Sep 16 21:58:22 2026 +0800 scsi: sd_zbc: Reject disks with too many zones sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts that exceed 32 bits. The truncated count is later used to size per-zone resources, while the device may still report more zones than fit. Moreover, sd_zbc_report_zones() counts the reported zones with a signed int zone_idx, which overflows past INT_MAX. Reject devices reporting more than INT_MAX zones at scan time; such a device is not realistic for any medium that exists today, and accepting it produces inconsistent zone bookkeeping. Fixes: 89d947561077 ("sd: Implement support for ZBC devices") Signed-off-by: ZHOU Jiaxiang Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/C41798AB5AA6BF2B+20260916135822.32584-3-me@fxti.xyz Signed-off-by: Martin K. Petersen (Oracle) commit 7c431d61b69a3fd0784c20aa4cd0b8fb501b5653 Author: ZHOU Jiaxiang Date: Wed Sep 16 21:58:21 2026 +0800 scsi: block: Fix zones_cond out-of-bounds write on zone report blk_revalidate_disk_zones() sizes the zones_cond array from the disk capacity and zone size, but the index used by blk_revalidate_zone_cond() comes from the device-driven report_zones() walk and is never checked against the array size. A device reporting more zones than fit the array makes blk_zone_set_cond() write out of bounds. One way to reach this is a zone count exceeding 32 bits: both blk_revalidate_zone_args.nr_zones and struct zoned_disk_info.nr_zones are unsigned int, so a disk advertising more than UINT_MAX zones (e.g. 2^32 + 1024 zones of one 512-byte logical block) gets its zone count truncated to a small value, undersizing the array while the report walk keeps counting upward. Check the index against the array size before storing the zone condition, and refuse to revalidate when the zone count does not fit 32 bits. Fixes: 6e945ffb6555 ("block: use zone condition to determine conventional zones") Signed-off-by: ZHOU Jiaxiang Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/7815D1B293A8F55E+20260916135822.32584-2-me@fxti.xyz Signed-off-by: Martin K. Petersen (Oracle) commit 278210c60c6f6958bd2eeaa2120c862683b83d09 Author: Arnd Bergmann Date: Tue Sep 15 22:20:59 2026 +0200 scsi: leapraid: Avoid -Wformat-security warning When extra warnings are enabled, the alloc_ordered_workqueue() function cannot be called with a variable name for the format string: drivers/scsi/leapraid/leapraid_os.c: In function 'leapraid_probe': drivers/scsi/leapraid/leapraid_os.c:2062:58: error: format not a string literal and no format arguments [-Werror=format-security] 2062 | alloc_ordered_workqueue(adapter->fw_evt_s.fw_evt_name, 0); | ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~ As the string is only assembled before the call and not used anywhere else, just fold the earlier snprintf() into the alloc_ordered_workqueue() call. Fixes: 5597088c9e79 ("scsi: leapraid: Add new SCSI driver") Signed-off-by: Arnd Bergmann Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260915202134.3534708-1-arnd@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f06a44e235ef188689ba23ffc72e9e89b10951a9 Author: Ewan D. Milne Date: Tue Sep 15 13:38:00 2026 -0400 scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC Symmetrix EMC Symmetrix returns an error on MODE SENSE for page 0Ah subpage 05h because it does not implement the SBC-5 I/O hints. These commands began to be sent as a result of commit 4f53138fffc2 ("scsi: sd: Translate data lifetime information"). Add BLIST_SKIP_IO_HINTS to avoid sending these commands because in large configurations the failed commands are displacing other useful information in internal error logs. Signed-off-by: Ewan D. Milne Link: https://patch.msgid.link/20260915173800.39117-1-emilne@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit bce07e2f37b5e4a427d36fd6b1c14067b27591db Author: Yehyeong Lee Date: Sat Aug 1 22:36:35 2026 +0900 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command was reading. iscsi_tcp_r2t_rsp() in the same file does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE. A target that answers a WRITE command's ITT with a Data-In therefore has the initiator write target-supplied bytes into the pages that write was about to send. Those are the caller's own pinned pages for an O_DIRECT write, and page cache pages for a buffered one. Observed against a test target that emits one 512-byte Data-In naming a 128 KB write's ITT, after the R2T for that write. With O_DIRECT the caller's buffer ends up holding 512 bytes of the target's data while pwrite() returns 131072. Buffered is quieter: pwrite() and fsync() both succeed, nothing is logged, and reading those blocks back returns the target's bytes out of the page cache without a command going on the wire. Check the direction before using the scatterlist, the way the R2T path already does. Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260801133635.1986706-1-yhlee@isslab.korea.ac.kr Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld") Signed-off-by: Martin K. Petersen (Oracle) commit c9ee6511332687ea714ad8ab86a53cb837d86eea Author: Geert Uytterhoeven Date: Mon Sep 14 16:00:01 2026 +0200 scsi: ufs: pltfrm: Add quirk for R-Car S4 lacking lanes-per-direction Since commit e72323f3b09f ("scsi: ufs: core: Configure only active lanes during link"), the following error is observed on R-Car S4: ufshcd-renesas e6860000.ufs: Tx lane mismatch [config,reported] [2,1] ufshcd-renesas e6860000.ufs: link startup failed -67 ufshcd-renesas e6860000.ufs: error -ENOLINK: Initialization failed with error -67 ufshcd-renesas e6860000.ufs: probe with driver ufshcd-renesas failed with error -67 R-Car S4 has one UFS lane per direction, as described in section 152.1 of its hardware manual. Without lanes-per-direction, the UFS platform driver defaults to two lanes. Previously, the core used PA_CONNECTEDRXDATALANES and PA_CONNECTEDTXDATALANES to configure the link without checking them against lanes-per-direction, so the missing property did not prevent initialization. While fixing the R-Car S4 DTS is the proper solution, doing only that would still break backwards compatibility with existing DTBs. Hence add a quirk to let lanes-per-direction default to one on R-Car S4. Fixes: e72323f3b09f9c89 ("scsi: ufs: core: Configure only active lanes during link") Reported-by: Koichiro Den Closes: https://lore.kernel.org/20260911073058.253000-1-den@valinux.co.jp Cc: stable@vger.kernel.org # 7.2+ Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/ae0cc2bd764e6dfffce99db3d8b44a55887c508c.1789394185.git.geert+renesas@glider.be Signed-off-by: Martin K. Petersen (Oracle) commit b52d695d062095327b944acf7daabbc816ab319b Author: Stanley Jhu Date: Sat Sep 12 21:16:25 2026 +0800 scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") switched UFS internal commands to allocate requests on hba->host->pseudo_sdev->request_queue, which shares the host tagset with regular LUNs. During error recovery, ufshcd_err_handling_prepare() calls blk_mq_quiesce_tagset(&hba->host->tag_set), marking all queues in the tagset as quiesced, including pseudo_sdev->request_queue. When ufshcd_verify_dev_init() subsequently issues internal commands (e.g. NOP OUT UPIU) via blk_execute_rq(), blk_mq_run_hw_queue() skips running the quiesced queue, resulting in an unrecoverable circular wait deadlock. Keep quiescing the tagset and unquiesce the pseudo SCSI device on top of that, so internal commands stay dispatchable while the logical units remain quiesced. Re-quiesce the pseudo device before unquiescing the tagset so that quiesce_depth stays balanced. Clock scaling and ufshcd_pause_command_processing() are unaffected: they keep quiescing the whole tagset, internal commands included. Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/6f78c4bd-a70b-402d-abfd-599091b67674@acm.org/ Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260912131625.2301486-1-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 3d676e458fe0c566f5a62753dc696b6a862fc412 Author: Alberto Carboneri Date: Fri Sep 4 13:54:37 2026 +0000 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its mode header and block descriptors. The unsigned subtraction used for the MODE SELECT length can wrap, and the separately computed buf_data can point beyond buf. During automatic scan, enable is false, so the read-modify-write of buf_data[4] can clear the low two bits of a target-selected out-of-bounds stack byte. scsi_mode_select() can then copy up to 64 bytes from outside the buffer into the outgoing MODE SELECT payload, disclosing stack contents to the target. This is reachable while scanning a USB storage device that identifies as an ATA device and advertises CDL support. No filesystem mount or userspace access to the block device is required. On upstream commit cee9395acd80 ("Linux 7.3-rc1"), a build-specific, one-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator sampling executed a fixed proof command inside the guest and created a UID-0-owned marker during automatic enumeration, with KASLR and NX enabled. The issue was independently found during security research at Drivesec S.r.l. Cap the available length to the buffer size. Validate and consume the mode header and block descriptor lengths before using the page, and require the five bytes needed to access the CDL field. Fixes: 1b22cfb14142 ("scsi: core: Allow enabling and disabling command duration limits") Reported-by: Sashiko AI Review Closes: https://lore.kernel.org/linux-scsi/20260717192313.93D791F000E9@smtp.kernel.org/ Link: https://lore.kernel.org/linux-scsi/20260717222931.AC4EE1F000E9@smtp.kernel.org/ Link: https://lore.kernel.org/linux-scsi/df13ec87ac9b28e3b0a2d9eb26477e276ff0278a.camel@HansenPartnership.com/ Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Pimen Flavian Dei (Drivesec S.r.l.) Signed-off-by: Pimen Flavian Dei (Drivesec S.r.l.) Signed-off-by: Alberto Carboneri (Drivesec S.r.l.) Link: https://lore.kernel.org/linux-scsi/20260717192313.93D791F000E9@smtp.kernel.org/ Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260904135410.360314-1-acarboneri@drivesec.com Signed-off-by: Martin K. Petersen (Oracle) commit 0cb1fd924126f1f581621a5e804df98a02be9dff Author: Arun Easi Date: Thu Sep 3 10:55:47 2026 -0700 scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU When CPU Hyper Threading is disabled, sibling CPUs remain present but are reported offline. Managed MSI-X IRQs can still receive affinity masks that include those offline CPUs. If a driver-critical vector is managed, it can be parked on an offline CPU and the driver may miss critical events such as link-up. Keep driver-critical vectors unmanaged so they can be migrated by the IRQ core when their target CPU is offlined. Since HWQ-0 is unmanaged now, in some queue combinations there can be no mappings to it in mq_map. So without the blk-mq fix mentioned below, system may crash during cpu offline/online tests. Fixes: 8a8449ca5e33 ("scsi: fnic: Modify ISRs to support multiqueue (MQ)") Cc: stable@vger.kernel.org Depends-on: commit 10845a105bbc ("blk-mq: skip CPU offline notify on unmapped hctx") Reviewed-by: Sesidhar Baddela Reviewed-by: Arulprabhu Ponnusamy Reviewed-by: Gian Carlo Boffa Reviewed-by: Karan Tilak Kumar Signed-off-by: Arun Easi Reviewed-by: Laurence Oberman Link: https://patch.msgid.link/20260903175547.57971-1-aeasi@cisco.com Signed-off-by: Martin K. Petersen (Oracle) commit 1274045b0eda1df5a5cdd3e63ed48cf013b3b4ea Author: Venkat Rao Bagalkote Date: Thu Sep 3 13:13:29 2026 +0530 scsi: ibmvfc: Add Kconfig dependency to fix link failure when NVME_FC=m Building with CONFIG_SCSI_IBMVFC=y and CONFIG_NVME_FC=m results in a link failure: ibmvfc-nvme.o: undefined reference to `nvme_fc_register_localport' ibmvfc-nvme.o: undefined reference to `nvme_fc_register_remoteport' ibmvfc-nvme.o: undefined reference to `nvme_fc_unregister_localport' ibmvfc-nvme.o: undefined reference to `nvme_fc_unregister_remoteport' ibmvfc-core.o: undefined reference to `nvme_fc_rescan_remoteport' IS_ENABLED() evaluates to 1 for both =y and =m, so the nvme_fc_* call sites are kept in the object file. When SCSI_IBMVFC=y (built-in) but NVME_FC=m (loadable module), the linker cannot resolve these symbols at vmlinux link time. Add the same "depends on NVME_FC || NVME_FC=n" constraint already used by SCSI_LPFC to prevent this configuration. Reported-by: Pavithra Closes: https://lore.kernel.org/all/327877a29337aa526cc50ac88fbddb86@linux.ibm.com/ Signed-off-by: Venkat Rao Bagalkote Tested-by: Pavithra Acked-by: Tyrel Datwyler Link: https://patch.msgid.link/20260903074329.6705-1-venkat88@linux.ibm.com Signed-off-by: Martin K. Petersen (Oracle) commit 779f202a92ef10a426efc07d0f4267918cb07ca3 Author: Karl Mehltretter Date: Sun Sep 6 19:10:09 2026 +0200 scsi: qla2xxx: Fix the ql2xfc2target parameter description The module parameter is ql2xfc2target, but its MODULE_PARM_DESC() names qla2xfc2target, so modinfo describes a parameter that does not exist and shows no description for the real one. Use the parameter name in the description. Fixes: 877b03795fcf ("scsi: qla2xxx: Add option to disable FC2 Target support") Assisted-by: LLM Signed-off-by: Karl Mehltretter Link: https://patch.msgid.link/20260906171009.2560-1-kmehltretter@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 264bf9655c3d067d775a46f05eb8c871c488a864 Author: Karl Mehltretter Date: Sun Sep 6 19:09:25 2026 +0200 scsi: pm80xx: Fix the use_msix, use_tasklet and read_wwn parameter descriptions The MODULE_PARM_DESC() lines of use_msix, use_tasklet and read_wwn all name a parameter zoned, which does not exist, and the use_tasklet one repeats the use_msix text. modinfo shows three "zoned" entries and no description for the real parameters. Name the right parameters and describe use_tasklet. Fixes: efa1fca45082 ("scsi: pm8001: Remove PM8001_USE_MSIX") Fixes: 205430290ad0 ("scsi: pm8001: Remove PM8001_USE_TASKLET") Fixes: 80975adc79dd ("scsi: pm8001: Remove PM8001_READ_VPD") Assisted-by: LLM Signed-off-by: Karl Mehltretter Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20260906170925.2524-1-kmehltretter@gmail.com Signed-off-by: Martin K. Petersen (Oracle)