summaryrefslogtreecommitdiff
path: root/drivers/scsi
AgeCommit message (Collapse)Author
2025-09-24scsi: mpt3sas: Update driver version to 54.100.00.00Ranjan Kumar
Updated driver version to 54.100.00.00. Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Message-Id: <20250922095113.281484-5-ranjan.kumar@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-24scsi: mpt3sas: Add support for 22.5 Gbps SAS link rateRanjan Kumar
Add handling for MPI26_SAS_NEG_LINK_RATE_22_5 in _transport_convert_phy_link_rate(). This maps the new 22.5 Gbps negotiated rate to SAS_LINK_RATE_22_5_GBPS, to get correct PHY link speeds. Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Message-Id: <20250922095113.281484-4-ranjan.kumar@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-24scsi: mpt3sas: Suppress unnecessary IOCLogInfo on CONFIG_INVALID_PAGERanjan Kumar
Avoid unconditional IOCLogInfo prints for CONFIG_INVALID_PAGE. Log only if MPT_DEBUG_REPLY is enabled or when loginfo represents other errors. This reduces uncessary logging without losing useful error reporting. Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-24scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()Ranjan Kumar
During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this point the SAS transport device may already be partially unregistered or freed, leading to a crash when accessing its struct device. Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), guaranteed to remain valid until driver removal. [83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI [83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) [83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 [83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 [83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff [83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 [83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 [83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 [83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 [83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 [83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 [83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 [83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 [83428.295844] PKRU: 55555554 [83428.295846] Call Trace: [83428.295848] <TASK> [83428.295850] _dev_printk+0x5c/0x80 [83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] [83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] [83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] [83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] [83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] [83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] [83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] [83428.295957] pci_device_remove+0x3b/0xb0 [83428.295962] device_release_driver_internal+0x193/0x200 [83428.295968] driver_detach+0x44/0x90 [83428.295971] bus_remove_driver+0x69/0xf0 [83428.295975] pci_unregister_driver+0x2a/0xb0 [83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] [83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 [83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296000] ? __x64_sys_getdents64+0x9a/0x110 [83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296009] ? syscall_trace_enter+0xf6/0x1b0 [83428.296014] do_syscall_64+0x7b/0x2c0 [83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-24scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()Alok Tiwari
The fc_ct_ms_fill() helper currently formats the OS name and version into entry->value using "%s v%s". Since init_utsname()->sysname and ->release are unbounded strings, snprintf() may attempt to write more than FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN bytes, triggering a -Wformat-truncation warning with W=1. In file included from drivers/scsi/libfc/fc_elsct.c:18: drivers/scsi/libfc/fc_encode.h: In function ‘fc_ct_ms_fill.constprop’: drivers/scsi/libfc/fc_encode.h:359:30: error: ‘%s’ directive output may be truncated writing up to 64 bytes into a region of size between 62 and 126 [-Werror=format-truncation=] 359 | "%s v%s", | ^~ 360 | init_utsname()->sysname, 361 | init_utsname()->release); | ~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/libfc/fc_encode.h:357:17: note: ‘snprintf’ output between 3 and 131 bytes into a destination of size 128 357 | snprintf((char *)&entry->value, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 358 | FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 359 | "%s v%s", | ~~~~~~~~~ 360 | init_utsname()->sysname, | ~~~~~~~~~~~~~~~~~~~~~~~~ 361 | init_utsname()->release); | ~~~~~~~~~~~~~~~~~~~~~~~~ Fix this by using "%.62s v%.62s", which ensures sysname and release are truncated to fit within the 128-byte field defined by FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN. [mkp: clarified commit description] Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-24scsi: storvsc: Remove redundant ternary operatorsLiao Yuanhong
Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-24scsi: smartpqi: Replace kmalloc() + copy_from_user() with memdup_user()Thorsten Blum
Replace kmalloc() followed by copy_from_user() with memdup_user() to simplify and improve pqi_passthru_ioctl(). Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'kernel_buffer' using memset(0). Return early if an error occurs. No functional changes intended. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Acked-by: Don Brace <don.brace@microchip.com> Message-Id: <20250922201832.1697874-2-thorsten.blum@linux.dev> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-24scsi: hpsa: Replace kmalloc() + copy_from_user() with memdup_user()Thorsten Blum
Replace kmalloc() followed by copy_from_user() with memdup_user() to improve and simplify hpsa_passthru_ioctl(). Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'buff' using memset(0). Return early if an error occurs and remove the 'out_kfree' label. No functional changes intended. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Acked-by: Don Brace <don.brace@microchip.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-24scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()Thorsten Blum
Replace kmalloc() followed by copy_from_user() with memdup_user() to fix a memory leak that occurs when copy_from_user(buff[sg_used],,) fails and the 'cleanup1:' path does not free the memory for 'buff[sg_used]'. Using memdup_user() avoids this by freeing the memory internally. Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'buff[sg_used]' using memset(0). Cc: stable@vger.kernel.org Fixes: edd163687ea5 ("[SCSI] hpsa: add driver for HP Smart Array controllers.") Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Acked-by: Don Brace <don.brace@microchip.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-24Merge patch series "Add generated modalias to modules.builtin.modinfo"Nathan Chancellor
Alexey Gladkov says: The modules.builtin.modinfo file is used by userspace (kmod to be specific) to get information about builtin modules. Among other information about the module, information about module aliases is stored. This is very important to determine that a particular modalias will be handled by a module that is inside the kernel. There are several mechanisms for creating modalias for modules: The first is to explicitly specify the MODULE_ALIAS of the macro. In this case, the aliases go into the '.modinfo' section of the module if it is compiled separately or into vmlinux.o if it is builtin into the kernel. The second is the use of MODULE_DEVICE_TABLE followed by the use of the modpost utility. In this case, vmlinux.o no longer has this information and does not get it into modules.builtin.modinfo. For example: $ modinfo pci:v00008086d0000A36Dsv00001043sd00008694bc0Csc03i30 modinfo: ERROR: Module pci:v00008086d0000A36Dsv00001043sd00008694bc0Csc03i30 not found. $ modinfo xhci_pci name: xhci_pci filename: (builtin) license: GPL file: drivers/usb/host/xhci-pci description: xHCI PCI Host Controller Driver The builtin module is missing alias "pci:v*d*sv*sd*bc0Csc03i30*" which will be generated by modpost if the module is built separately. To fix this it is necessary to add the generated by modpost modalias to modules.builtin.modinfo. Fortunately modpost already generates .vmlinux.export.c for exported symbols. It is possible to add `.modinfo` for builtin modules and modify the build system so that `.modinfo` section is extracted from the intermediate vmlinux after modpost is executed. Link: https://patch.msgid.link/cover.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2025-09-24scsi: Always define blogic_pci_tbl structureAlexey Gladkov
The blogic_pci_tbl structure is used by the MODULE_DEVICE_TABLE macro. There is no longer a need to protect it with the MODULE condition, since this no longer causes the compiler to warn about an unused variable. To avoid warnings when -Wunused-const-variable option is used, mark it as __maybe_unused for such configuration. Cc: Khalid Aziz <khalid@gonehiking.org> Cc: Martin K. Petersen <martin.petersen@oracle.com> Cc: linux-scsi@vger.kernel.org Suggested-by: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by: Alexey Gladkov <legion@kernel.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Acked-by: Martin K. Petersen <martin.petersen@oracle.com> Link: https://patch.msgid.link/fd8e30de07de79a4923ae967eaee5ba2f2fcef00.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2025-09-21scsi: sg: drop nth_page() usage within SG entryDavid Hildenbrand
It's no longer required to use nth_page() when iterating pages within a single SG entry, so let's drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-32-david@redhat.com Signed-off-by: David Hildenbrand <david@redhat.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Cc: Doug Gilbert <dgilbert@interlog.com> Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-09-21scsi: scsi_lib: drop nth_page() usage within SG entryDavid Hildenbrand
It's no longer required to use nth_page() when iterating pages within a single SG entry, so let's drop the nth_page() usage. Link: https://lkml.kernel.org/r/20250901150359.867252-31-david@redhat.com Signed-off-by: David Hildenbrand <david@redhat.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-09-16Merge patch series "Update lpfc to revision 14.4.0.11"Martin K. Petersen
Justin Tee <justintee8345@gmail.com> says: Update lpfc to revision 14.4.0.11 This patch set contains clean up of unused members in various structs, bug fixes related to discovery and resource allocation, and updates to handling of debugfs entries. The patches were cut against Martin's 6.18/scsi-queue tree. Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Copyright updates for 14.4.0.11 patchesJustin Tee
Update copyrights to 2025 for files modified in the 14.4.0.11 patch set. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-15-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Update lpfc version to 14.4.0.11Justin Tee
Update lpfc version to 14.4.0.11 Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-14-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Convert debugfs directory counts from atomic to unsigned intJustin Tee
Atomicity is not necessary for debugfs directory accounting because vport deletion and creation is already serialized. Creation has always been serialized through sysfs. Deletion is serialized via walking the lpfc_create_vport_work_array and calling fc_vport_terminate one-by-one for each NPIV port. Reported-by: Al Viro <viro@zeniv.linux.org.uk> Closes: https://lore.kernel.org/linux-fsdevel/20250702212917.GK3406663@ZenIV/ Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-13-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Clean up extraneous phba dentriesJustin Tee
Because debugfs_remove recursively removes debugfs entries, the lpfc_debugfs_terminate routine is updated to remove only the parent/root debugfs directories. As such, there no longer is a need to keep track of each individual debugfs entry so clean up the unused phba dentries. Reported-by: Al Viro <viro@zeniv.linux.org.uk> Closes: https://lore.kernel.org/linux-fsdevel/20250702212917.GK3406663@ZenIV/ Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-12-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Use switch case statements in DIF debugfs handlersJustin Tee
With the introduction of aux numbers for debugfs entries, there's no need to use the if-else-if clause based on debugfs entry pointers. Update both the lpfc_debugfs_dif_err_read and lpfc_debugfs_dif_err_write routines to use switch case based on aux instead. Reported-by: Al Viro <viro@zeniv.linux.org.uk> Closes: https://lore.kernel.org/linux-fsdevel/20250702212917.GK3406663@ZenIV/ Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-11-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is usedJustin Tee
Right after phba->nvmeio_trc is kzalloc'ed, phba->nvmeio_trc is set to NULL and the memory reference to free the kzalloc'ed memory is lost. Remove the phba->nvmeio_trc NULL ptr assignment after kzalloc. phba->nvmeio_trc is freed in lpfc_debugfs_terminate. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-10-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Define size of debugfs entry for xri rebalancingJustin Tee
To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs entry is used. The debugfs file operations for xri rebalancing have been previously implemented, but lack definition for its information buffer size. Similar to other pre-existing debugfs entry buffers, define LPFC_HDWQINFO_SIZE as 8192 bytes. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-9-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topologyJustin Tee
There is a timing race condition when a PRLI may be sent on the wire before PLOGI_ACC in Point to Point topology. Fix by deferring REG_RPI mbox completion handling to after PLOGI_ACC's CQE completion. Because the discovery state machine only sends PRLI after REG_RPI mbox completion, PRLI is now guaranteed to be sent after PLOGI_ACC. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-8-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESETJustin Tee
If lpfc_reset_flush_io_context fails to execute, then the wrong return status code may be passed back to upper layers when issuing a target reset TMF command. Fix by checking the return status from lpfc_reset_flush_io_context() first in order to properly return FAILED or FAST_IO_FAIL. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-7-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Decrement ndlp kref after FDISC retries exhaustedJustin Tee
The kref for Fabric_DID ndlps is not decremented after repeated FDISC failures and exhausting maximum allowed retries. This can leave the ndlp lingering unnecessarily. Add a test and set bit operation for the NLP_DROPPED flag. If not previously set, then a kref is decremented. The ndlp is freed when the remaining reference for the completing ELS is put. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-6-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanupJustin Tee
In lpfc_cleanup, there is an extraneous nlp_put for NPIV ports on the F_Port_Ctrl ndlp object. In cases when an ABTS is issued, the outstanding kref is needed for when a second XRI_ABORTED CQE is received. The final kref for the ndlp is designed to be decremented in lpfc_sli4_els_xri_aborted instead. Also, add a new log message to allow for future diagnostics when debugging related issues. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-5-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Clean up allocated queues when queue setup mbox commands failJustin Tee
lpfc_sli4_queue_setup() does not allocate memory and is used for submitting CREATE_QUEUE mailbox commands. Thus, if such mailbox commands fail we should clean up by also freeing the memory allocated for the queues with lpfc_sli4_queue_destroy(). Change the intended clean up label for the lpfc_sli4_queue_setup() error case to out_destroy_queue. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-4-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progressJustin Tee
Driver rmmod may take a long time when in a very large SAN environment. This is because outstanding ELS WQEs may end up taking E_D_TOV seconds to complete causing long delays. Speed this up by issuing aborts with the ia bit set so that outstanding ELS WQEs complete faster. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-3-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vportJustin Tee
There are variables defined in struct lpfc_hba and lpfc_vport that are not used anywhere. Delete the unused variables from struct lpfc_hba and lpfc_vport. Signed-off-by: Justin Tee <justin.tee@broadcom.com> Message-ID: <20250915180811.137530-2-justintee8345@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16Merge patch series "scsi: qla2xxx: Fix incorrect sign of error code"Martin K. Petersen
Qianfeng Rong <rongqianfeng@vivo.com> says: qla2x00_start_sp() returns only negative error codes or QLA_SUCCESS. Therefore, comparing its return value with positive error codes (e.g., if (_rval == EAGAIN)) causes logical errors. Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()Qianfeng Rong
Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to align with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, preventing logical errors. Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com> Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()Qianfeng Rong
Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, preventing logical errors. Additionally, the '_rval' variable should store negative error codes to conform to Linux kernel error code conventions. Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure") Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com> Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-16scsi: qla2xxx: edif: Fix incorrect sign of error codeQianfeng Rong
Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and qla_edif_process_els() to align with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, preventing logical errors. Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough") Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com> Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-09scsi: bfa: Remove self-assignment codeQiang Liu
The variable num_cqs is of type u8 and does not require be16_to_cpu conversion, so the redundant code is removed. Signed-off-by: Qiang Liu <liuqiang@kylinos.cn> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-09scsi: pm80xx: Avoid -Wflex-array-member-not-at-end warningsGustavo A. R. Silva
Comment out unused field 'residual_count' in a couple of structures, and with this, fix the following -Wflex-array-member-not-at-end warnings: drivers/scsi/pm8001/pm8001_hwi.h:342:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/scsi/pm8001/pm80xx_hwi.h:561:32: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Reviewed-by: Jack Wang <jinpu.wang@ionos.com> Reviewed-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-09scsi: scsi_debug: Replace kzalloc() + copy_from_user() with memdup_user_nul()Thorsten Blum
Replace kzalloc() followed by copy_from_user() with memdup_user_nul() to improve and simplify sdebug_error_write(). No functional changes intended. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-09scsi: lpfc: Use int type to store negative error codesQianfeng Rong
Change the 'ret' variable in lpfc_sli4_issue_wqe() from uint32_t to int, as it needs to store either negative error codes or zero returned by lpfc_sli4_wq_put(). Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com> Reviewed-by: Justin Tee <justin.tee@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-09-03Merge tag 'pull-getgeo' of ↵Jens Axboe
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs into for-6.18/block Pull struct block_device getgeo changes from Al. "switching ->getgeo() from struct block_device to struct gendisk Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>" * tag 'pull-getgeo' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: block: switch ->getgeo() to struct gendisk scsi: switch ->bios_param() to passing gendisk scsi: switch scsi_bios_ptable() and scsi_partsize() to gendisk
2025-08-30scsi: qla2xxx: Use secs_to_jiffies() instead of msecs_to_jiffies()Thorsten Blum
Use secs_to_jiffies() instead of msecs_to_jiffies() and avoid scaling 'ratov_j' to milliseconds. No functional changes intended. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://lore.kernel.org/r/20250828161153.3676-2-thorsten.blum@linux.dev Reviewed-by: Himanshu Madhani <hmadhani2024@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-30scsi: csiostor: Fix some spelling errorsXichao Zhao
Fix spelling errors in some comments. Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com> Link: https://lore.kernel.org/r/20250827121611.497547-1-zhao.xichao@vivo.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-30scsi: sr: Reinstate rotational media flagMing Lei
Reinstate the rotational media flag for the CD-ROM driver. The flag has been cleared since commit bd4a633b6f7c ("block: move the nonrot flag to queue_limits") and this breaks some applications. Move queue limit configuration from get_sectorsize() to sr_revalidate_disk() and set the rotational flag. Cc: Christoph Hellwig <hch@lst.de> Fixes: bd4a633b6f7c ("block: move the nonrot flag to queue_limits") Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://lore.kernel.org/r/20250827113550.2614535-1-ming.lei@redhat.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-30scsi: fc: Avoid -Wflex-array-member-not-at-end warningsGustavo A. R. Silva
-Wflex-array-member-not-at-end has been introduced in GCC-14, and we are getting ready to enable it, globally. So, in order to avoid ending up with a flexible-array member in the middle of multiple other structs, we use the '__struct_group()' helper to create a new tagged 'struct fc_df_desc_fpin_reg_hdr'. This structure groups together all the members of the flexible 'struct fc_df_desc_fpin_reg' except the flexible array. As a result, the array is effectively separated from the rest of the members without modifying the memory layout of the flexible structure. We then change the type of the middle struct members currently causing trouble from 'struct fc_df_desc_fpin_reg' to 'struct fc_df_desc_fpin_reg_hdr'. We also want to ensure that in case new members need to be added to the flexible structure, they are always included within the newly created tagged struct. For this, we use '_Static_assert()'. This ensures that the memory layout for both the flexible structure and the new tagged struct is the same after any changes. This approach avoids having to implement 'struct fc_df_desc_fpin_reg_hdr' as a completely separate structure, thus preventing having to maintain two independent but basically identical structures, closing the door to potential bugs in the future. The above is also done for flexible structures 'struct fc_els_rdf' and 'struct fc_els_rdf_resp' So, with these changes, fix the following warnings: drivers/scsi/lpfc/lpfc_hw4.h:4936:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/scsi/lpfc/lpfc_hw4.h:4942:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/scsi/lpfc/lpfc_hw4.h:4947:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://lore.kernel.org/r/aK6hbQLyQlvlySf8@kspp Reviewed-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Justin Tee <justin.tee@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-30scsi: pm8001: Use int instead of u32 to store error codesQianfeng Rong
Use int instead of u32 for 'ret' variable to store negative error codes returned by PM8001_CHIP_DISP->set_nvmd_req(). Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com> Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-30scsi: sd: Make sd_revalidate_disk() return voidAbinash Singh
The sd_revalidate_disk() function currently returns 0 for both success and memory allocation failure. Since none of its callers use the return value, this return code is both unnecessary and potentially misleading. Change the return type of sd_revalidate_disk() from int to void and remove all return value handling. This makes the function semantics clearer and avoids confusion about unused return codes. Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Abinash Singh <abinashsinghlalotra@gmail.com> Link: https://lore.kernel.org/r/20250825183940.13211-4-abinashsinghlalotra@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-30scsi: sd: Remove redundant printk() after kmalloc() failureAbinash Singh
The SCSI disk driver prints a warning when kmalloc() fails in sd_revalidate_disk(). This is redundant because the page allocator already reports failures unless __GFP_NOWARN is used. Keeping the extra message only adds noise to the kernel log. Remove the unnecessary sd_printk() call. Control flow is unchanged. Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Abinash Singh <abinashsinghlalotra@gmail.com> Link: https://lore.kernel.org/r/20250825183940.13211-3-abinashsinghlalotra@gmail.com Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-30scsi: sd: Fix build warning in sd_revalidate_disk()Abinash Singh
A build warning was triggered due to excessive stack usage in sd_revalidate_disk(): drivers/scsi/sd.c: In function ‘sd_revalidate_disk.isra’: drivers/scsi/sd.c:3824:1: warning: the frame size of 1160 bytes is larger than 1024 bytes [-Wframe-larger-than=] This is caused by a large local struct queue_limits (~400B) allocated on the stack. Replacing it with a heap allocation using kmalloc() significantly reduces frame usage. Kernel stack is limited (~8 KB), and allocating large structs on the stack is discouraged. As the function already performs heap allocations (e.g. for buffer), this change fits well. Fixes: 804e498e0496 ("sd: convert to the atomic queue limits API") Cc: stable@vger.kernel.org Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Abinash Singh <abinashsinghlalotra@gmail.com> Link: https://lore.kernel.org/r/20250825183940.13211-2-abinashsinghlalotra@gmail.com Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-30scsi: lpfc: Fix buffer free/clear order in deferred receive pathJohn Evans
Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same. Fixes: 472e146d1cf3 ("scsi: lpfc: Correct upcalling nvmet_fc transport during io done downcall") Cc: stable@vger.kernel.org Signed-off-by: John Evans <evans1210144@gmail.com> Link: https://lore.kernel.org/r/20250828044008.743-1-evans1210144@gmail.com Reviewed-by: Justin Tee <justin.tee@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-25scsi: pm80xx: Fix race condition caused by static variablesFrancisco Gutierrez
Eliminate the use of static variables within the log pull implementation to resolve a race condition and prevent data gaps when pulling logs from multiple controllers in parallel, ensuring each operation is properly isolated. Signed-off-by: Francisco Gutierrez <frankramirez@google.com> Link: https://lore.kernel.org/r/20250723183543.1443301-1-frankramirez@google.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-25Merge patch series "mpi3mr: bug fixes and minor updates"Martin K. Petersen
Chandrakanth Patil <chandrakanth.patil@broadcom.com> says: This series contains mpi3mr driver fixes and minor updates. Link: https://lore.kernel.org/r/20250820084138.228471-1-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-25scsi: mpi3mr: Update driver version to 8.15.0.5.50Chandrakanth Patil
Bump driver version to 8.15.0.5.50 to match the latest release. Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com> Link: https://lore.kernel.org/r/20250820084138.228471-7-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2025-08-25scsi: mpi3mr: Fix premature TM timeouts on virtual drivesChandrakanth Patil
Task Management to virtual drives may timeout prematurely when using a static default timeout. Read Abort and Reset timeouts from Device Page 0 and apply the maximum of the firmware value and the default. This fixes premature TM failures on virtual drives. Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com> Link: https://lore.kernel.org/r/20250820084138.228471-6-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>