kernel/git/stable/linux-stable.git/drivers/scsi, branch master

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi

2026-08-29T18:55:36+00:00

Pull more SCSI updates from Martin Petersen: "Remaining updates for the 7.3 merge window. The only core change is enabling context analysis for the SCSI layer and UFS. The remaining changes are either bug fixes or hardening" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi: (26 commits) scsi: snic: Fix SCSI host leak on workqueue allocation failure scsi: MAINTAINERS: Update my email address scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers scsi: leapraid: Standardize NCQ priority sysfs attributes scsi: leapraid: Serialize firmware log mmap with teardown scsi: leapraid: Balance host references for firmware log VMAs scsi: lpfc: Remove unnnecessary NULL check scsi: qla2xxx: Fix an loop timeout test scsi: qla2xxx: Fix an error code in qla_get_tmf() scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work() scsi: core: Enable context analysis for hosts.o scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report() scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name() scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info() scsi: core: Enable context analysis scsi: core: Protect host state changes with the host lock scsi: core: Add lock context annotations scsi: core: Pass the SCSI host pointer directly to scanning functions ...

Merge tag 'hyperv-next-signed-20260826' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

2026-08-26T23:47:40+00:00

Pull hyperv updates from Wei Liu: - Decrypt netvsc buffer on contiguous direct-map addresses (Kameron Carr) - Drop WS2012/2012R2 & Win8/8.1 Hyper-V support (Michael Kelley) - Use more meaningful errnos for hypercall status code (Hardik Garg) - Fix lost interrupts on CPU hot-unplug for Hyper-V PCI/MSI (Naman Jain) - Reserve more MSHV vectors for Linux root partition (Wei Liu) * tag 'hyperv-next-signed-20260826' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: clocksource: hyper-v: Remove support for stimer interrupts in message mode scsi: storvsc: Remove support for storvsc protocol of old Hyper-V hosts hv_netvsc: Remove GPADL teardown special case for old Hyper-V hosts hv_sock: Remove check for old Hyper-V hosts Drivers: hv: Remove support for WS2012/2012R2 & Win8/8.1 version of Hyper-V hv_netvsc: Allocate send/receive buffers using vmbus_alloc_buffer() Drivers: hv: vmbus: Add vmbus_alloc_buffer()/vmbus_free_buffer() for CoCo VMs Drivers: hv: vmbus: add vmbus_establish_gpadl_caller_decrypted() Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition x86/hyperv: reserve more vectors PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip Drivers: hv: Use meaningful errnos for hypercall status codes

scsi: snic: Fix SCSI host leak on workqueue allocation failure

2026-08-24T02:34:58+00:00

In snic_add_host(), if scsi_add_host() succeeds but alloc_ordered_workqueue() fails, the function returns -ENOMEM with shost->work_q left as NULL. The caller's error path then calls snic_del_host(), which returns early when !shost->work_q without calling scsi_remove_host(). The Scsi_Host remains registered in sysfs as a zombie device even after the probe has failed. This causes: - The leaked host remains visible in /sys/class/scsi_host/ after probe failure, with state "running". - Subsequent SCSI host numbering is permanently shifted (the leaked host ID from ida_alloc() is never reclaimed). - Memory leak: the Scsi_Host allocation can never be freed because device_add() took a reference that can only be released by device_del() inside scsi_remove_host(). Fix by adding scsi_remove_host() in the workqueue allocation failure path inside snic_add_host(), undoing the successful scsi_add_host() before returning the error. This is cleaner than modifying snic_del_host() because snic_del_host() is called from a shared error label that also serves paths where snic_add_host() was never invoked. Reproducer (requires no real SNIC hardware): - Build CONFIG_SCSI_SNIC=y (built-in) - Add snic.test_mode=1 snic.inject_wq_fail=1 to kernel cmdline - Boot with a PCI device matching the snic driver (e.g. QEMU edu device, PCI ID 0x1234:0x11e8, temporarily added to the driver's PCI ID table) Before the fix: # /sys/class/scsi_host/ contains a zombie host0: $ cat /sys/class/scsi_host/host0/proc_name snic_scsi $ cat /sys/class/scsi_host/host0/state running # ata_piix gets host1, host2 (host0 stuck): scsi host1: ata_piix scsi host2: ata_piix After the fix: # host0 is properly freed and reused by ata_piix: scsi host0: ata_piix scsi host1: ata_piix # No zombie host in /sys/class/scsi_host/ Signed-off-by: Chen Changcheng Acked-by: Narsimhulu Musini Link: https://patch.msgid.link/20260727073438.209673-1-chenchangcheng@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle)

scsi: leapraid: Standardize NCQ priority sysfs attributes

2026-08-24T01:57:41+00:00

Replace the earlier LeapRAID ncq_cmd_prio_enable attribute with the standard sas_ncq_prio_supported and sas_ncq_prio_enable names documented in Documentation/ABI/testing/sysfs-block-device, and rename the per-device NCQ priority state to match. The earlier ncq_cmd_prio_enable name has not yet been established as part of a released userspace ABI, so no compatibility alias is needed. For LeapRAID, sas_ncq_prio_enable is backed by the driver's per-device NCQ priority state and controls whether RT-class I/O requests are issued with command priority on supported SATA devices. Update leapraid.rst to describe the standard attribute names and paths, and clean up the surrounding RST text for consistency with kernel documentation style. Also switch the capability check from open-coded VPD page 0x89 parsing to sas_ata_ncq_prio_supported(), use kstrtobool() for the enable path, and expose the NCQ priority attributes only for SATA devices using LeapRAID's target-private SAS device state. Reviewed-by: Damien Le Moal Signed-off-by: Dongdong Hao Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260814090526.395704-1-doubled@leap-io-kernel.com Signed-off-by: Martin K. Petersen (Oracle)

scsi: leapraid: Serialize firmware log mmap with teardown

2026-08-24T01:51:43+00:00

leapraid_fw_log_exit() waits for mmap_refcnt to reach zero before it frees the firmware log buffer. leapraid_fw_mmap() checks host_removing, but it does not increment mmap_refcnt until after dma_mmap_coherent() succeeds and the VMA open callback runs. Removal can set host_removing and observe a zero mmap_refcnt between the check and the VMA open. It can then free the coherent buffer while the mmap path is still establishing a userspace mapping of it. Claim a temporary mmap reference while looking up the adapter under leapraid_adapter_lock. Removal deletes the adapter from the same locked list after setting host_removing, so a mapping is either rejected or included in the count that removal waits for. Drop the temporary reference on the common exit path, after a successful VMA open has acquired the reference covering the VMA lifetime. Fixes: 5597088c9e79 ("scsi: leapraid: Add new SCSI driver") Signed-off-by: Linmao Li Reviewed-by: Dongdong Hao Link: https://patch.msgid.link/20260814033845.2971706-3-lilinmao@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle)

scsi: leapraid: Balance host references for firmware log VMAs

2026-08-24T01:51:43+00:00

leapraid_fw_mmap() keeps the Scsi_Host reference obtained while looking up the adapter for the lifetime of the initial VMA. The VMA close callback drops that reference. The open callback is also invoked when a VMA is duplicated or split, but it only increments mmap_refcnt. Since every corresponding close callback drops a host reference, cloning the mapping can release the host while another VMA still refers to the adapter. Take a host device reference for every VMA open and release the lookup reference once the initial mapping has acquired its own reference. Use get_device() because a VMA can be cloned after the host enters SHOST_DEL; an existing VMA still pins the host at that point and open cannot fail. Fixes: 5597088c9e79 ("scsi: leapraid: Add new SCSI driver") Signed-off-by: Linmao Li Reviewed-by: Dongdong Hao Link: https://patch.msgid.link/20260814033845.2971706-2-lilinmao@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle)

scsi: lpfc: Remove unnnecessary NULL check

2026-08-24T01:48:53+00:00

The "evt_dat" variale is non-NULL at this point so there is no need to check. Delete the check and pull the code in a tab. Signed-off-by: Dan Carpenter Reviewed-by: Paul Ely Link: https://patch.msgid.link/an1trOAUeQmYEus_@stanley.mountain Signed-off-by: Martin K. Petersen (Oracle)

scsi: qla2xxx: Fix an loop timeout test

2026-08-24T01:48:03+00:00

This loop timeout with "retries" set to -1, not 0. Fix the test for failure. Fixes: 7ec0effd30bb ("[SCSI] qla2xxx: Add support for ISP8044.") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/an1twcxTYSFkkUTA@stanley.mountain Signed-off-by: Martin K. Petersen (Oracle)

scsi: qla2xxx: Fix an error code in qla_get_tmf()

2026-08-24T01:45:44+00:00

Negative -EIO was intended instead of positive EIO. The caller, doesn't care so this doesn't affect runtime. It's just a cleanup. Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/an1taxANE_4_vzJT@stanley.mountain Signed-off-by: Martin K. Petersen (Oracle)

scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work()

2026-08-24T01:37:21+00:00

After commit 696d1cc2aaa2 ("scsi: ibmvfc: process NVMe/FC rports in work thread"), clang warns (or errors with CONFIG_WERROR=y / W=e): drivers/scsi/ibmvscsi/ibmvfc-core.c:6154:15: error: variable 'rport' is uninitialized when used here [-Werror,-Wuninitialized] 6154 | } else if (rport && tgt->action == IBMVFC_TGT_ACTION_DEL_AND_LOGOUT_RPORT) { | ^~~~~ The check for rport is unnecessary in this block, it was accidentally included from copying and pasting. Remove it to clear up the warning. Fixes: 696d1cc2aaa2 ("scsi: ibmvfc: process NVMe/FC rports in work thread") Suggested-by: Tyrel Datwyler Link: https://lore.kernel.org/6ccbe8c5-beb6-483f-bfa4-c2d3819ad5f2@linux.ibm.com/ Signed-off-by: Nathan Chancellor Acked-by: Tyrel Datwyler Link: https://patch.msgid.link/20260817-ibmvscsi-rport-wuninitialized-v1-1-0fdfb27a5f01@kernel.org Signed-off-by: Martin K. Petersen (Oracle)