linux.git/drivers/scsi, branch v7.2-rc6

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2026-08-02T16:32:07+00:00

Pull SCSI fixes from James Bottomley"
 "No core changes. The largest driver fix is the reversion of threaded
  interrupt handlers in UFS and the next is the resume deadlock fix in
  hisi_sas which extends into libsas"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
  scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
  scsi: target: Clear cmd_cnt when initial counter enrollment fails
  scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
  scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"
  scsi: ufs: core: Cancel RTC work in active-active suspend
  scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
  scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
  scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
  scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
  scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
  scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

Merge tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

2026-08-01T00:05:13+00:00

Pull ata fixes from Damien Le Moal:

 - Fix PCI resource initialization in the sata_mv driver to keep legacy
   Marvell boards functional (Rosen)

 - Fix ahci_ceva driver initialization error path (Radhey)

 - Fix libata header file to remove a kernel doc compilation warning
   (Randy)

 - Increase the timeout for the STANDBY IMMEDIATE command to avoid
   suspend failures with drives that are slow to respond to this command
   (Matt)

 - Fixes for the handling of timed out commands in the presence of
   deferred non-NCQ commands, to avoid excessive delays in executing the
   error handler (me)

 - Disable link power management for a couple of WD drives that have
   been identified as not functioning properly when power management is
   used (Niklas)

 - Fix the device iteration loop when checking for link power management
   support to correctly handle port multiplier setups (Niklas)

* tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: libata-sata: fix ata_scsi_lpm_supported() iteration
  ata: libata-core: Disable LPM on WD Green 2.5 480GB
  ata: libata-core: Disable LPM on some WD drives
  scsi: libsas: terminate deferred commands on time out
  ata: libata-scsi: schedule deferred atapi command
  ata: libata-scsi: terminate deferred commands on time out
  ata: libata-eh: Increase STANDBY IMMEDIATE timeout
  ata: libata: avoid kernel-doc warnings
  ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
  ata: sata_mv: accept 1 or 2 resources in platform probe

scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit

2026-07-29T02:05:42+00:00

mpi3mr_fault_uevent_emit() runs from the fault watchdog and reset paths
where host I/O may already be blocked. GFP_KERNEL allocations here, both
the local kzalloc_obj() and the ones inside kobject_uevent_env() itself,
can trigger reclaim that waits on that blocked I/O and deadlock.

Use memalloc_noio_save()/restore() to cover the whole call instead of
just the local allocation.

Fixes: ec54b348f274 ("scsi: mpi3mr: Record and report controller firmware faults")
Reported-by: sashiko-bot 
Closes: https://sashiko.dev/#/patchset/20260724164630.924288-1-chandrakanth.patil%40broadcom.com
Signed-off-by: Chandrakanth Patil 
Link: https://patch.msgid.link/20260724175231.935192-1-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen

scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

2026-07-29T01:52:08+00:00

resp_report_zones() sizes the reply buffer from the CDB allocation
length. The v3 fix rounds alloc_len up with ALIGN() before deriving the
descriptor count:

	rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) -
			 RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD);
	arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);

For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to
0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit
and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which
passes the !arr check, and desc = arr + 64 is then dereferenced in the
loop -> out-of-bounds write / panic.

Clamp rep_max_zones to devip->nr_zones. The loop already stops at
sdebug_capacity (after nr_zones zones), so a report can never hold more
than nr_zones descriptors; the clamp does not change the report, it only
bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device
property that can never reach 0x100000000.

Fixes: 7db0e0c8190a ("scsi: scsi_debug: Fix buffer size of REPORT ZONES command")
Suggested-by: Damien Le Moal 
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov 
Assisted-by: AuditCode-AI:2026.07
Reviewed-by: Damien Le Moal 
Reviewed-by: Bart Van Assche 
Link: https://patch.msgid.link/20260712183739.83915-1-security@auditcode.ai
Signed-off-by: Martin K. Petersen

scsi: libsas: terminate deferred commands on time out

2026-07-29T01:52:04+00:00

If a command times out while we have deferred non-NCQ commands waiting to
be issued, the SCSI EH task is not immediately woken up as the waiting
deferred commands are never issued nor completed, thus leaving the SCSI
host in a busy state (shost->host_failed != scsi_host_busy(shost)) which
prevents the SCSI EH task from being woken up. Eventually, when the
deferred commands also time out, the SCSI EH task is woken up and the
timeout processing occurs.

Avoid this unnecessary additional SCSI EH wake up time with the same
method as implemented in libata-scsi, using the eh_timed_out SCSI host
template operation. The function sas_eh_timed_out() implements this
operation and executes the function ata_scsi_retry_deferred_qc()
for SATA devices.

Co-developed-by: Igor Pylypiv 
Signed-off-by: Igor Pylypiv 
Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal 
Reviewed-by: John Garry 
Reviewed-by: Hannes Reinecke 
Tested-by: Igor Pylypiv 
Reviewed-by: Niklas Cassel 
Reviewed-by: Martin K. Petersen

scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race

2026-07-26T19:34:03+00:00

Commit fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue
for HA resume") introduced sas_resume_ha_no_sync() to avoid a deadlock:
the PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue,
calls sas_deform_port() -> sas_destruct_devices(), which removes SCSI
devices and waits for the host to become runtime-active. But the host
cannot resume until sas_resume_ha() -> sas_drain_work() returns, and the
drain is blocked on that very handler.

However skipping the drain reintroduces a race: hisi_sas returns from
resume before all PHY UP work and libsas discovery work finish. The
controller may then autosuspend while disks are still waking up. The
disks issue IO to a suspended controller, the IO fails, and the disks
get disabled.

Fix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT
notification to after sas_drain_work(). By then the host resume is about
to complete, so device removal through device_link no longer blocks on
the resume and the cycle is broken.

With the deadlock gone, restore sas_resume_ha() (the draining variant)
in hisi_sas and remove sas_resume_ha_no_sync().

The reorder is safe for the other libsas consumers (isci, pm8001,
aic94xx, mvsas). During suspend, sas_suspend_devices() calls
sas_notify_lldd_dev_gone() for each device, which sets dev->lldd_dev to
NULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a
timed-out phy's disk is immediately rejected by the LLDD before reaching
hardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET),
and pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both
complete directly via scsi_done() without entering SCSI EH. This is
identical in both the old and new ordering since lldd_dev_gone runs
during suspend, before resume. The reorder only affects when the
PHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work()
vs. asynchronous after resume returns), not whether I/O can reach the
device. aic94xx and mvsas do not register any PM ops and never reach
this code path.

Fixes: fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue for HA resume")
Signed-off-by: Xingui Yang 
Reviewed-by: John Garry 
Link: https://patch.msgid.link/20260716081145.3950172-1-yangxingui@huawei.com
Signed-off-by: Martin K. Petersen

scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

2026-07-26T19:31:33+00:00

iscsi_tcp_hdr_dissect() receives the data segment of several PDU types
into the fixed-size conn->data buffer, which is allocated for
ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes.  For the LOGIN_RSP, TEXT_RSP,
REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU
whose DataSegmentLength exceeds that buffer.

The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its
data segment (sense/response data) into conn->data via
iscsi_tcp_data_recv_prep(), but it does so without the same check.  The
only upstream bound on in.datalen is conn->max_recv_dlength, the
initiator's advertised MaxRecvDataSegmentLength, which is commonly
negotiated well above 8192 (open-iscsi defaults to 262144).  A target
that returns a SCSI Response with a DataSegmentLength between 8193 and
max_recv_dlength therefore overflows the 8192-byte conn->data buffer.

Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly
like those responses: bound the data segment, receive it into conn->data
when present, and otherwise complete the PDU with no data.  Fold the
opcode into that case group rather than duplicating the check.

Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld")
Suggested-by: Chris Leech 
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An 
Acked-by: Chris Leech 
Link: https://patch.msgid.link/20260716065848.1653431-1-sammiee5311@gmail.com
Signed-off-by: Martin K. Petersen

scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

2026-07-26T19:21:39+00:00

iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the
target-supplied data segment.  The segment carries a 2-byte sense length
followed by the sense bytes, so it must hold 2 + senselen bytes, but the
bounds check only requires datalen >= senselen:

	senselen = get_unaligned_be16(data);
	if (datalen < senselen)
		goto invalid_datalen;
	memcpy(sc->sense_buffer, data + 2,
	       min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));

A target that returns a SCSI Response whose datalen equals senselen
(with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +
2 read up to two bytes past the received data.  Those bytes are stale
conn->data contents and end up in the command's sense buffer, which is
returned to userspace.

Account for the 2-byte sense length prefix in the check.

Fixes: 7996a778ff8c ("[SCSI] iscsi: add libiscsi")
Suggested-by: Sashiko AI 
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An 
Acked-by: Chris Leech 
Link: https://patch.msgid.link/20260714104934.1404423-1-sammiee5311@gmail.com
Signed-off-by: Martin K. Petersen

scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path

2026-07-13T02:21:22+00:00

If phys_disk->in_reset is set, the function returns directly without
undoing the resources acquired for the command. Add the missing error
cleanup by unmapping the IOACCEL2 SG chain block when needed, unmapping
the SCSI command, and dropping the outstanding IOACCEL command count
before returning.

Fixes: c5dfd106414f ("scsi: hpsa: correct device resets")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li 
Acked-by: Don Brace 
Link: https://patch.msgid.link/20260622160028.1240496-1-haoxiang_li2024@163.com
Signed-off-by: Martin K. Petersen

scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()

2026-07-13T02:21:22+00:00

When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path
returns -ENOSPC without releasing the reference obtained via
kref_get_unless_zero() earlier in the function. All other error paths
correctly drop the reference. This causes a permanent reference leak on the
io_to_abort object.

Additionally, the abort_in_progress flag is left set to true on this path,
which means future abort attempts for the same I/O will immediately return
-EINPROGRESS even though the abort was never submitted, effectively
blocking recovery.

Fix this by adding the missing kref_put() call and reset abort_in_progress
to false, matching the cleanup done in the efct_hw_wq_write() failure path
below.

Cc: stable@vger.kernel.org
Fixes: 63de51327a64 ("scsi: elx: efct: Hardware I/O and SGL initialization")
Signed-off-by: WenTao Liang 
Reviewed-by: Daniel Wagner 
Link: https://patch.msgid.link/20260611053037.63756-1-vulab@iscas.ac.cn
Signed-off-by: Martin K. Petersen