commit e550f2b2b4aab4c5f12db89d04d8978ce4ed7b4e Author: Milan P. Gandhi Date: Thu Nov 5 17:54:01 2026 +0530 scsi: mpi3mr: Validate reply frame size bounds Firmware provides reply_frame_size in dwords, which the driver multiplies by 4 to compute facts.reply_sz (u16). If the reported size exceeds U16_MAX / 4, the multiplication overflows u16 before assignment, causing under-allocated DMA reply buffers. Furthermore, several paths assume a minimal reply frame size: - logdata_entry_sz calculations underflow or hit zero when reply_sz <= 20 bytes, leading to zero-size allocations and divide-by-zero crashes. - Unsolicited status descriptors and fixed replies (such as struct mpi3_iounit_control_reply, 64 bytes) require at least 16 dwords. Validate reply_frame_size in mpi3mr_issue_iocfacts() to ensure it is within [16, U16_MAX / 4] dwords before processing facts data. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Cc: stable@vger.kernel.org Signed-off-by: Milan P. Gandhi Link: https://patch.msgid.link/20261105122401.266559-1-mgandhi@redhat.com Signed-off-by: Martin K. Petersen (Oracle) commit 08f08a6d49efc422258edba802faa4fc7677309e Author: Ciro Iriarte Date: Sat Oct 31 22:21:39 2026 -0300 scsi: target: core: Parse APTPL res_type and res_scope as hex core_scsi3_update_aptpl_buf() saves the reservation holder's type and scope to the APTPL metadata file as zero-padded hex ("res_type=%02x", "res_scope=%02x"), but target_pr_res_aptpl_metadata_store() reads them back with "%d" tokens and match_int(), which parse with base 0. A leading zero selects octal, so match_token() parses only the "0" of "res_type=08", the trailing "8" makes the token not match, and the field is ignored as unknown. An Exclusive Access - All Registrants holder (type 0x8) is left with type 0 and the write fails with -EINVAL and Illegal PR type: 0x00 for reservation holder Userspace that restores APTPL state by writing the saved records back to pr/res_aptpl_metadata (rtslib-fb does this when it recreates a storage object) therefore loses every type 8 reservation across a target restart, and with rtslib the storage object creation fails. The other valid types (1, 3, 5, 6, 7) and scope 0 only work because their octal and decimal values coincide. Keep the on-disk format and parse both fields as hex. The valid type and scope values have the same hex and decimal representation, so records written in decimal by hand keep working. Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Cc: stable@vger.kernel.org Signed-off-by: Ciro Iriarte Link: https://patch.msgid.link/ea903e6c-09b5-4a11-80e8-6e1387f39ef5@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 48d3b732e5ad3fffe74e033d9a3cf47ebaa314b0 Author: Praneeth Balasubramanian Date: Thu Oct 29 13:54:56 2026 -0700 scsi: target: iscsi: Check for existing sessions only after authentication In the operational-negotiation path (CSG=1), iscsi_target_handle_csg_one() calls iscsi_target_check_for_existing_instances() before iscsi_conn_authenticated(). An initiator can therefore send a first Login PDU with CSG=1, TSIH=0 and no CHAP exchange, carrying the InitiatorName and ISID of an existing session. The target reinstates that session, which tears down the legitimate initiator's connection. Only afterwards does it reject the login with AUTH_FAILED. iscsi_check_for_session_reinstatement() matches on ISID, InitiatorName and SessionType only. The InitiatorName is not secret, and open-iscsi ISIDs are a fixed OUI followed by a small session counter. A remote peer with no credentials can thus repeatedly disconnect a CHAP-authenticated session and keep its I/O failing. The comment above iscsi_target_check_for_existing_instances() already states the intended invariant: NOTE: We check for existing sessions or connections AFTER the initiator has been successfully authenticated in order to protect against faked ISID/TSIH combinations. The security-negotiation path (CSG=0) honours this, calling the check only once authentication completes. Move the CSG=1 call below the authentication check so both paths behave the same. When authentication is not required, iscsi_conn_authenticated() returns true and behaviour is unchanged. Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1") Cc: stable@vger.kernel.org Signed-off-by: Praneeth Balasubramanian Link: https://patch.msgid.link/20261029205456.1211532-1-praneethb2002@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 612293fb469c81408829e6325bae25725968986f Author: Boyan Liu Date: Wed Oct 28 14:16:51 2026 +0800 scsi: sd_zbc: Cap zone report count by buffer size sd_zbc_report_zones() limits descriptor parsing to the requested zone count and the device-reported ZONE LIST LENGTH, but not to the number of descriptors that fit in the allocated report buffer. A malicious or malfunctioning device can report an oversized length and cause out-of-bounds reads while the descriptors are parsed: BUG: KASAN: slab-out-of-bounds in sd_zbc_report_zones (drivers/scsi/sd_zbc.c:256) Read of size 8 at addr ffff88802c8d2610 by task kworker/u8:2/37 Call Trace: sd_zbc_report_zones (drivers/scsi/sd_zbc.c:256) blk_revalidate_disk_zones (block/blk-zoned.c:2354) sd_zbc_revalidate_zones (drivers/scsi/sd_zbc.c:566) sd_revalidate_disk (drivers/scsi/sd.c:3898) sd_probe (drivers/scsi/sd.c:4101) Cap the descriptor count with min3() over the remaining requested zones, the device-reported count, and max_in_buf derived from buflen. This matches nvme_ns_report_zones() and preserves iteration over reports that require multiple commands. Use shared constants for the REPORT ZONES header and zone descriptor sizes. [mkp: define constants] Fixes: d41003513e61 ("block: rework zone reporting") Cc: stable@vger.kernel.org Reported-by: co+4a4f9998e2b4b490@bugs.sh Signed-off-by: Boyan Liu Link: https://patch.msgid.link/20261028061651.110435-1-yymhvert@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 46846939d5f33c9333612662c52475f92e753407 Author: Shao Mingyin Date: Mon Oct 26 19:54:09 2026 +0800 scsi: rdac: Keep the error status when controller lookup fails initialize_controller() records SCSI_DH_RES_TEMP_UNAVAIL when get_controller() fails, but then overwrites it with SCSI_DH_OK unconditionally. It therefore reports success with h->ctlr == NULL and rdac_bus_attach() continues with check_ownership(), which dereferences h->ctlr: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... check_ownership rdac_bus_attach get_controller() only fails when its GFP_ATOMIC allocation fails, so the crash happens exactly when memory is already scarce. Only report success after the controller was found and the device was added to its list. Fixes: 327825574132 ("scsi_dh_rdac: switch to scsi_execute_req_flags()") Signed-off-by: Shao Mingyin Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261026195409354OWEI2b6HO7swSphvv1FOc@zte.com.cn Signed-off-by: Martin K. Petersen (Oracle) commit c0bb6614132c64205a3c40c32dc1494c1bfeffe1 Author: Shao Mingyin Date: Mon Oct 26 19:51:33 2026 +0800 scsi: target: Fix NULL pointer dereference in core_alua_do_port_transition() core_alua_do_port_transition() assumes that the device has an ALUA LU group member and that the member is associated with an LU group. Neither is guaranteed: internal-use HBAs never allocate dev_alua_lu_gp_mem, and the association with an LU group is dropped when "NULL" is written to the device's alua_lu_gp attribute. The configfs path can reach the second case. After clearing the LU group association, writing the implicit ALUA access state of a target port group calls core_alua_do_port_transition(), which dereferences the NULL lu_gp in atomic_inc(&lu_gp->lu_gp_ref_cnt). Return -ENODEV when the device has no LU group association instead. Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Signed-off-by: Shao Mingyin Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261026195133237y2UxJLoV1FK6aD1zrFbIU@zte.com.cn Signed-off-by: Martin K. Petersen (Oracle) commit fe5988e8708e1d42cb844bd9ac8f0a51388061fc Author: Shao Mingyin Date: Mon Oct 26 19:49:55 2026 +0800 scsi: target: Fix NULL pointer dereference in target_dev_alua_lu_gp_store() Writing "NULL" to the alua_lu_gp attribute clears the ALUA LU group association of a device. The attribute can be written again after the association has already been cleared. In that case lu_gp_mem->lu_gp and lu_gp_new are both NULL, but the code still calls __core_alua_attach_lu_gp_mem(), which dereferences the NULL lu_gp pointer: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... __core_alua_attach_lu_gp_mem target_dev_alua_lu_gp_store Clearing an already cleared association is a no-op, so return early when there is no association left to clear. Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Signed-off-by: Shao Mingyin Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261026194955694FnXGoQ352dstLk5HPBqCG@zte.com.cn Signed-off-by: Martin K. Petersen (Oracle) commit b3da73f09499b34faf5c43c50e1d09e4286226de Author: Joonhoe Kim <26rote@gmail.com> Date: Fri Oct 23 01:50:06 2026 +0900 scsi: ufs: qcom: Reprogram ESI after a host controller reset ufs_qcom_config_esi() returns early once the ESI interrupts are set up. ufshcd_config_mcq() also calls it after every host controller reset, which clears the ESI base address, the vector mask and ESI enable. After the error handler has reset the controller, the completions then arrive only on the legacy interrupt while mcq_esi_enabled stays set. Allocate the MSIs and request their interrupts only once, but program the ESI registers on every call. The MSI message is not cached for platform MSIs, so keep the one written at allocation. Fixes: 519b6274a777 ("scsi: ufs: qcom: Add MCQ ESI config vendor specific ops") Signed-off-by: Joonhoe Kim <26rote@gmail.com> Link: https://patch.msgid.link/20261022165006.1275-1-26rote@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit e510b597d8afca2e790e2b5429bc5e01e3386f65 Author: Kiwoong Kim Date: Fri Nov 6 13:12:47 2026 +0900 scsi: ufs: mcq: Poll OCS after sq cleanup for device management commands Extend ufshcd_mcq_sq_cleanup() to poll the OCS field in the UTRD of a device management command after a successful SQ_CUS poll. UFSHCI does not specify the order between the OCS update and the SQ_CUS update, so OCS may still be stale when cleanup returns. Without this poll, a late response to a timed-out query can arrive while a retry is already in flight, leaving the host controller with two query contexts and raising IS.UTPES. Here is the timeline of an actual case I found with kernel 6.18: 1. The driver sent a query but the device didn't respond to it for a long time. [ 7384.156142] [4: kworker/u40:5:10671] exynos-ufs 38300000.ufs: ufshcd_mcq_sq_cleanup, hwq 0: cleanup return code (RTC) 0 [ 7384.156154] [4: kworker/u40:5:10671] exynos-ufs 38300000.ufs: ufshcd_query_flag: Sending flag query for idn 14 failed, err = -11 2. So after the query timed out, the driver did SQ cleanup. Then the host controller updated the CQ tail and raised IS.CQES. Unfortunately, complete() was called by the driver's ISR afterward. 3. The driver started to retry the query. In the meantime, it set OCS to 0xF. Then the driver didn't wait for completion due to the previous complete() call, and just checked OCS. [ 7384.156163] [4: kworker/u40:5:10671] exynos-ufs 38300000.ufs: ufshcd_query_flag: Sending flag query for idn 14 failed, err = 15 4. The driver retried the query again, but the device didn't return anything, so the query also timed out. [ 7385.660108] [3: kworker/u40:5:10671] exynos-ufs 38300000.ufs: ufshcd_query_flag: Sending flag query for idn 14 failed, err = -11 5. A few seconds later, the device returned the response of the first query, but since the host controller was holding two query contexts and couldn't handle it, it raised IS.UTPES. The same problem exists in the current code. If the query times out, the SCSI error handler calls ufshcd_abort() -> ufshcd_mcq_abort() -> ufshcd_mcq_sq_cleanup(), the request is finished, and the retry reuses the same reserved tag, struct scsi_cmnd and devman UCD. A late CQE for the first query then maps to the same tag and completes the retry by calling scsi_done() too early. The retry then returns the OCS of the first query and, if that OCS is OCS_SUCCESS, its response as well. Hence ufshcd_mcq_sq_cleanup() must not return until the CQE of the cleaned-up request has been processed. The poll is limited to device management commands because ufshcd_compl_one_cqe() copies the OCS from the CQE into the UTRD only for them. For SCSI commands, the OCS in the UTRD stays OCS_INVALID_COMMAND_STATUS, so polling it would always time out. The poll waits until OCS is no longer OCS_INVALID_COMMAND_STATUS or MCQ_POLL_US elapses. -ETIMEDOUT is returned only if OCS is still OCS_INVALID_COMMAND_STATUS after the poll. Any other value, such as OCS_ABORTED reported by the host controller for the cleaned-up request, means the cleanup has completed. The UFSHCI specification says "The host controller shall free up any resources associated to the nexus, and shall post a Completion Queue entry with OCS = ABORTED if clean up successful." Each poll iteration reaps the CQ with ufshcd_mcq_poll_cqe_lock() before reading the OCS, as ufshcd_clear_lu_cmds() does after ufshcd_clear_cmd(). This removes the dependency on interrupt delivery. Otherwise the OCS is only updated once the interrupt handler processes the CQE, and a delayed or lost interrupt would make the poll time out and escalate to a host reset although the request has already been cleaned up. The OCS is still read under hwq->cq_lock because the interrupt handler may reap the CQE between the reap and the read. ufshcd_compl_one_cqe() updates the OCS under that lock before it sets cmd->result and calls scsi_done(). Without the lock, cleanup could observe the new OCS and return while the completion is still running. The abort could then finish the command and a retry could reuse the same reserved request before the pending scsi_done() call, which would then complete the retry prematurely. Fixes: 8d7290348992 ("scsi: ufs: mcq: Add supporting functions for MCQ abort") Signed-off-by: Kiwoong Kim Reviewed-by: Bart Van Assche Reviewed-by: Bean Huo Link: https://patch.msgid.link/a1af44cd90dca0dd8a9a06d09a254a4e7e0861b2.1793938245.git.kwmad.kim@samsung.com Signed-off-by: Martin K. Petersen (Oracle) commit 30bdadc9aa3a684cd634c7fa49740b1151e7b2e5 Author: Kiwoong Kim Date: Fri Nov 6 13:12:46 2026 +0900 scsi: ufs: core: Skip ABORT TASK for device management commands In MCQ mode, ufshcd_mcq_abort() falls through to ufshcd_try_to_abort_task() for all timed-out commands. However, device management commands (query, NOP) use reserved requests and are not SCSI I/O commands. The ABORT TASK task management function is designed for SCSI I/O UPIUs and is not applicable to device management UPIUs. This is only reachable since device management commands were converted to scsi_get_internal_cmd(); before that, a timed-out query was handled by ufshcd_wait_for_dev_cmd() -> ufshcd_clear_cmd() and never reached ufshcd_try_to_abort_task(). Fix this by checking ufshcd_is_scsi_cmd() in ufshcd_try_to_abort_task(). For a reserved (device management) command, skip the TM path and call ufshcd_clear_cmd() directly. ufshcd_abort() now calls ufshcd_try_to_abort_task() for every request, so its separate reserved-request branch is removed. Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Reported-by: Bart Van Assche Signed-off-by: Kiwoong Kim Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/ab14d2f1414fa1a0a396f160abf8c27c404b4ec4.1793938245.git.kwmad.kim@samsung.com Signed-off-by: Martin K. Petersen (Oracle) commit 04feb5fd2c23894ebc2cdaf4a4cc38b8667b17ac Author: Dongdong Hao Date: Wed Nov 4 17:28:08 2026 +0800 scsi: leapraid: Fix init_cmd_priv error handling leapraid_init_cmd_priv() ignores the return value of leapraid_internal_init_cmd_priv() and always returns success. If dma_pool_alloc() fails, io_tracker->chain remains NULL, but the SCSI midlayer considers the command successfully initialized. A subsequent I/O requiring more than LEAPRAID_SGL_INLINE_THRESHOLD DMA-mapped scatter-gather entries dereferences the NULL chain buffer while building the chained SGL, causing a kernel crash. Return the result of leapraid_internal_init_cmd_priv() so that allocation failures propagate to the SCSI midlayer and abort initialization of the affected request. Reviewed-by: Damien Le Moal Signed-off-by: Dongdong Hao Link: https://patch.msgid.link/20261104092808.206067-1-doubled@leap-io-kernel.com Fixes: 5597088c9e79 ("scsi: leapraid: Add new SCSI driver") Signed-off-by: Martin K. Petersen (Oracle) commit c84374cf4d2cb0c6efff91f7a37e85656cbbd593 Author: Shawn Lin Date: Thu Oct 29 15:24:55 2026 +0800 scsi: ufs: rockchip: Improve RX noise immunity Program VND_RX_SAVE_DET_CTRL for each RX lane to raise the receiver's tolerance against short transients on the incoming signal, as recommended by the Rockchip PHY team. Signed-off-by: Shawn Lin Link: https://patch.msgid.link/20261029151030.1.I61cd43e660b146e49d4380a754e936270e5fb6a1@changeid Signed-off-by: Martin K. Petersen (Oracle) commit 9eb89611d95914e47cec62826e4000396df0f953 Author: Stanley Jhu Date: Thu Oct 29 15:08:40 2026 +0800 scsi: ufs: hwmon, debugfs: Propagate runtime PM resume errors ufs_hwmon_read(), ufs_hwmon_write(), and ufs_debugfs_get_user_access() resume the UFS device W-LUN with ufshcd_rpm_get_sync() and ignore its return value. For example, for a hwmon temperature read: 1. The W-LUN is runtime suspended. 2. User space reads temp1_input of the UFS hwmon device. 3. ufs_hwmon_read() calls ufshcd_rpm_get_sync(). 4. The W-LUN runtime resume fails and the W-LUN stays suspended. 5. ufshcd_rpm_get_sync() returns a negative errno, which is ignored. 6. ufs_hwmon_read() sends an attribute query UPIU while the W-LUN is still suspended. ufs_hwmon_write() and the debugfs writers that use ufs_debugfs_get_user_access() (exception_event_mask and tx_eq_ctrl) follow the same sequence. Convert all three call sites to ufshcd_rpm_resume_and_get() and release hba->host_sem before returning the error, ahead of __acquire(ufs_debugfs) in ufs_debugfs_get_user_access(). Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun") Fixes: e88e2d32200a ("scsi: ufs: core: Probe for temperature notification support") Fixes: adbabdcf0db0 ("scsi: ufs: core: Add support to retrain TX Equalization via debugfs") Cc: stable@vger.kernel.org # needs "scsi: ufs: core: Introduce ufshcd_rpm_resume_and_get() helper" Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040003.2100003-6-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 2b8541edf7c43f0294c45d2e687bbc1288292f4e Author: Stanley Jhu Date: Thu Oct 29 15:08:39 2026 +0800 scsi: ufs: bsg: Abort ufs_bsg_request() when runtime resume fails ufs_bsg_request() resumes the UFS device W-LUN with ufshcd_rpm_get_sync() and ignores its return value: 1. The W-LUN is runtime suspended. 2. User space submits a BSG request. 3. ufs_bsg_request() calls ufshcd_rpm_get_sync(). 4. The W-LUN runtime resume fails and the W-LUN stays suspended. 5. ufshcd_rpm_get_sync() returns a negative errno, which is ignored. 6. ufs_bsg_request() dispatches the BSG command while the W-LUN is still suspended. Use ufshcd_rpm_resume_and_get() and jump to out_complete on error so the BSG job is completed via bsg_job_done() with the failure code without dropping an unacquired runtime PM reference. Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun") Cc: stable@vger.kernel.org # needs "scsi: ufs: core: Introduce ufshcd_rpm_resume_and_get() helper" Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040003.2100003-5-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 93891d1c486efcef2267c32e6e73ca2fd243704e Author: Stanley Jhu Date: Thu Oct 29 15:08:38 2026 +0800 scsi: ufs: sysfs: Propagate runtime PM resume errors All 14 ufshcd_rpm_get_sync() callers in ufs-sysfs.c resume the UFS device W-LUN and ignore the return value. For example, for a UFS descriptor read: 1. The W-LUN is runtime suspended. 2. User space reads a UFS descriptor attribute in sysfs. 3. ufs_sysfs_read_desc_param() calls ufshcd_rpm_get_sync(). 4. The W-LUN runtime resume fails and the W-LUN stays suspended. 5. ufshcd_rpm_get_sync() returns a negative errno, which is ignored. 6. ufs_sysfs_read_desc_param() sends a query UPIU while the W-LUN is still suspended. The other sysfs callers follow the same sequence. They send other query UPIUs, or read a host register in ufshcd_read_hci_reg(). Switch all 14 sysfs callers to ufshcd_rpm_resume_and_get() and return the error after releasing any held buffer and hba->host_sem. Fixes: aef80fd1da32 ("scsi: ufs: sysfs: Resume the proper SCSI device") Fixes: b9d104465a6c ("scsi: ufs: Prepare to add HCI capabilities sysfs") Fixes: 600edc6620a4 ("scsi: ufs: sysfs: Make max_number_of_rtt read-write") Fixes: 6c4148ce7cc1 ("scsi: ufs: wb: Add explicit flush sysfs attribute") Fixes: 500d4b742e0c ("scsi: ufs: core: Add WB buffer resize support") Fixes: ae7795a8c258 ("scsi: ufs: core: Add HID support") Fixes: 1fd2e77b8897 ("scsi: ufs: core: Add device level exception support") Cc: stable@vger.kernel.org # needs "scsi: ufs: core: Introduce ufshcd_rpm_resume_and_get() helper" Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040003.2100003-4-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit cbab12e5b4a7f49d5add4301de275351269cd431 Author: Stanley Jhu Date: Thu Oct 29 15:08:37 2026 +0800 scsi: ufs: core: Introduce ufshcd_rpm_resume_and_get() helper ufshcd_clkscale_enable_store() and ufshcd_auto_hibern8_update() resume the UFS device W-LUN with ufshcd_rpm_get_sync() and ignore its return value. For clkscale_enable: 1. The W-LUN is runtime suspended and clock scaling is disabled. 2. User space writes 1 to clkscale_enable. 3. ufshcd_clkscale_enable_store() calls ufshcd_rpm_get_sync(). 4. The W-LUN runtime resume fails and the W-LUN stays suspended. 5. ufshcd_rpm_get_sync() returns a negative errno, which is ignored. 6. ufshcd_clkscale_enable_store() enables clock scaling and resumes devfreq while the W-LUN is still suspended. For auto_hibern8: 1. The W-LUN starts a runtime suspend. 2. User space writes a new value to auto_hibern8. 3. ufshcd_auto_hibern8_update() sees that the W-LUN is not yet suspended and calls ufshcd_rpm_get_sync(). 4. ufshcd_rpm_get_sync() waits for the runtime suspend to finish and then runs the W-LUN runtime resume. 5. The W-LUN runtime resume fails and the W-LUN stays suspended. 6. ufshcd_rpm_get_sync() returns a negative errno, which is ignored. 7. ufshcd_auto_hibern8_update() writes REG_AUTO_HIBERNATE_IDLE_TIMER while the W-LUN is still suspended. Add ufshcd_rpm_resume_and_get() wrapping pm_runtime_resume_and_get() so failed resumes drop the usage reference automatically, and return early in ufshcd_clkscale_enable_store() and ufshcd_auto_hibern8_update() when it fails. Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun") Cc: stable@vger.kernel.org Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040003.2100003-3-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit ebf5cab0dd223a36a09742a91be4fea97e46c816 Author: Stanley Jhu Date: Thu Oct 29 15:08:36 2026 +0800 scsi: ufs: core: Restore jiffies conversion of device management timeouts Before commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()"), ufshcd_wait_for_dev_cmd() converted the millisecond timeout with msecs_to_jiffies() before waiting for the command. That commit moved the timeout to the block layer and assigns the millisecond value to rq->timeout as is, but rq->timeout is in jiffies. A 1500 ms query timeout (QUERY_REQ_TIMEOUT_DEFAULT) becomes 6 s with CONFIG_HZ=250 and 15 s with CONFIG_HZ=100, and NOP_OUT_TIMEOUT and ADVANCED_RPMB_REQ_TIMEOUT grow the same way. Restore the conversion with msecs_to_jiffies(). Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Cc: stable@vger.kernel.org # v6.19+ Signed-off-by: Stanley Jhu Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040003.2100003-2-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit cae8db99f3956e6446827ae4a9605a1ed815772b Author: Dmitry Bogdanov Date: Tue Oct 27 21:01:23 2026 +0300 scsi: target: iscsi: Fix hanging WRITE_PENDING commands When Data comes for an aborted WRITE command in WRITE_PENDING state it is silently received and the command does not pass to the target. That leads to hanging of other session with LUN_RESET aborting that command. Pass the aborted WRITE commands when all Data has been gathered. Signed-off-by: Dmitry Bogdanov Reviewed-by: Laurence Oberman Tested-by: Laurence Oberman Link: https://patch.msgid.link/20261027180123.13163-3-d.bogdanov@yadro.com Signed-off-by: Martin K. Petersen (Oracle) commit 94196cd3413fba6cf6d1f71d6de401e56caaf29b Author: Dmitry Bogdanov Date: Tue Oct 27 21:01:22 2026 +0300 scsi: Revert "scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands" This reverts commit d5869dae5080e976d4b03cc33eb7ceb527f242bf as it introduces double completion of the command and other issues. Signed-off-by: Dmitry Bogdanov Reviewed-by: Laurence Oberman Tested-by: Laurence Oberman Link: https://patch.msgid.link/20261027180123.13163-2-d.bogdanov@yadro.com Signed-off-by: Martin K. Petersen (Oracle) commit 6da1bc55c060bec3163b0e6077f3ac9641f8100c Author: Stanley Jhu Date: Thu Oct 29 15:08:30 2026 +0800 scsi: ufs: core: Keep clock-gating hold on failed W-LUN runtime resume 1. __ufshcd_wl_suspend() takes one ufshcd_hold() reference and sets hba->clk_gating.is_suspended while the UFS device W-LUN enters RPM_SUSPENDED. 2. Since commit eef1d74bf88f ("PM: runtime: Only set runtime_error on suspend callback failures"), a failed runtime resume (for example START STOP UNIT completing with an error) leaves the W-LUN in RPM_SUSPENDED with power.runtime_error == 0, while __ufshcd_wl_resume() already clears hba->clk_gating.is_suspended and calls ufshcd_release(). 3. The next W-LUN runtime resume runs __ufshcd_wl_resume() again without an intervening suspend and calls ufshcd_release() a second time, dropping a reference it does not own and underflowing hba->clk_gating.active_reqs on UFSHCD_CAP_CLK_GATING hosts. Keep hba->clk_gating.is_suspended and the suspend hold across a failed W-LUN runtime resume, so the hold stays paired with the W-LUN RPM_SUSPENDED state and the next successful resume releases it. Fixes: eef1d74bf88f ("PM: runtime: Only set runtime_error on suspend callback failures") Cc: stable@vger.kernel.org # v7.3+ Signed-off-by: Stanley Jhu Reviewed-by: Brian Norris Reviewed-by: Peter Wang Link: https://patch.msgid.link/20261029040002.2100002-1-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) commit 2b2bb55990cf1d9dbd59ee326d545798061fce97 Author: James Houghton Date: Mon Oct 26 21:52:17 2026 +0000 scsi: bsg: Don't copy sense data to user memory when canceled scsi_bsg_uring_task_cb() copies the sense data to the submitter's response_addr with copy_to_user(). It runs as io_uring task work, but io_uring may also run it with tw.cancel set from other contexts when the submitting task can't run it: from a kworker when the submitting task has exited (io_tctx_fallback_work()), or from io_cancel_local_task_work() when a DEFER_TASKRUN ring is torn down. In a kworker, current->mm is NULL, and the copy does not reliably fail: the user half of the address space belongs to whatever mm happens to be lazily loaded, if any, so up to max_response_len bytes of sense data may be written into an unrelated process. Don't copy the sense data when the task work is canceled, and complete the command with -ECANCELED. Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Signed-off-by: James Houghton Reviewed-by: Jens Axboe Link: https://patch.msgid.link/20261026215226.3713941-2-jthoughton@google.com Signed-off-by: Martin K. Petersen (Oracle)