* FAILED: patch "[PATCH] scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap" failed to apply to 5.10-stable tree
@ 2026-09-09 11:19 gregkh
2026-09-11 21:15 ` [PATCH 5.10.y 1/3] scsi: qla2xxx: Update VP control IOCB handling for 29xx series Sasha Levin
0 siblings, 1 reply; 4+ messages in thread
From: gregkh @ 2026-09-09 11:19 UTC (permalink / raw)
To: njavali, mkp, sashiko-dev; +Cc: stable
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 2ac6a829843cf3df522d19e091276109b94c4c7a
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026090904-grout-chitchat-b447@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 2ac6a829843cf3df522d19e091276109b94c4c7a Mon Sep 17 00:00:00 2001
From: Nilesh Javali <njavali@marvell.com>
Date: Thu, 30 Jul 2026 21:28:24 +0530
Subject: [PATCH] scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap
capacity
ha->max_npiv_vports is taken from firmware (mcp->mb[11]) and only
constrained so that (max_npiv_vports + 1) is a multiple of
MIN_MULTI_ID_FABRIC, which permits values of 63, 127, 191 and 255.
NPIV vports are then allocated up to that count.
VP enable uses the VP_CONFIG IOCB, which addresses a vport through a
plain vp_index byte, so a vp_index beyond 128 is enabled without issue.
VP disable, however, uses the VP_CTRL IOCB, which selects target vports
through the fixed 128-bit vp_idx_map bitmap. qla24xx_control_vp()
rejects a vp_index past that bitmap and the IOCB builder cannot set a bit
beyond 127, yet qla24xx_vport_delete() frees the local state regardless.
A vport with vp_index > 128 can therefore be created and enabled but
never disabled, leaving it permanently active in firmware: a resource
leak.
Cap ha->max_npiv_vports at init to the vp_idx_map capacity so such
vports are never created. This collapses 191/255 to 127 (still
modulo-valid) and leaves the real-world 63/127 cases unaffected.
Fixes: 4d0ea24769c8 ("[SCSI] qla2xxx: Retrieve max-NPIV support capabilities from FW.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-20-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
diff --git a/drivers/scsi/qla2xxx/qla_fw.h b/drivers/scsi/qla2xxx/qla_fw.h
index b29abcc7f74f..98bc4a57b59b 100644
--- a/drivers/scsi/qla2xxx/qla_fw.h
+++ b/drivers/scsi/qla2xxx/qla_fw.h
@@ -1442,6 +1442,10 @@ struct vp_ctrl_entry_24xx {
uint8_t reserved_5[24];
};
+/* vp_idx_map is a 128-bit (16-byte) bitmap selecting target VPs. */
+#define VP_CTRL_IDX_MAP_BITS \
+ (sizeof_field(struct vp_ctrl_entry_24xx, vp_idx_map) * 8)
+
/*
* Modify Virtual Port Configuration IOCB
*/
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index e6b499245794..5788c7e53d8f 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -4412,6 +4412,19 @@ qla2x00_setup_chip(scsi_qla_host_t *vha)
MIN_MULTI_ID_FABRIC))
ha->max_npiv_vports =
MIN_MULTI_ID_FABRIC - 1;
+
+ /*
+ * The VP_CTRL IOCB selects target VPs
+ * through the fixed vp_idx_map bitmap,
+ * so a vp_index beyond it can be enabled
+ * via VP_CONFIG but never disabled via
+ * VP_CTRL, leaking the VP. Cap the count
+ * to the bitmap capacity.
+ */
+ if (ha->max_npiv_vports >=
+ VP_CTRL_IDX_MAP_BITS)
+ ha->max_npiv_vports =
+ VP_CTRL_IDX_MAP_BITS - 1;
}
qlt_config_nvram_with_fw_version(vha);
qla2x00_get_resource_cnts(vha);
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index 33bfc61d8165..4ad23d206add 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -996,7 +996,7 @@ int qla24xx_control_vp(scsi_qla_host_t *vha, int cmd)
* (16-byte) vp_idx_map bitmap, so vp_index must fit within it even
* if firmware advertises more NPIV vports.
*/
- if (vp_index > sizeof_field(struct vp_ctrl_entry_24xx, vp_idx_map) * 8)
+ if (vp_index > VP_CTRL_IDX_MAP_BITS)
return QLA_PARAMETER_ERROR;
/* ref: INIT */
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH 5.10.y 1/3] scsi: qla2xxx: Update VP control IOCB handling for 29xx series 2026-09-09 11:19 FAILED: patch "[PATCH] scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap" failed to apply to 5.10-stable tree gregkh @ 2026-09-11 21:15 ` Sasha Levin 2026-09-11 21:15 ` [PATCH 5.10.y 2/3] scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size Sasha Levin 2026-09-11 21:15 ` [PATCH 5.10.y 3/3] scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity Sasha Levin 0 siblings, 2 replies; 4+ messages in thread From: Sasha Levin @ 2026-09-11 21:15 UTC (permalink / raw) To: stable Cc: Nilesh Javali, Hannes Reinecke, Martin K. Petersen (Oracle), Sasha Levin From: Nilesh Javali <njavali@marvell.com> [ Upstream commit d681a3315dffe87513ed87e11456b33e21dcfd65 ] Update VP control IOCB command and response handling to support the 29xx series adapters, which use the 128-byte vp_ctrl_entry_24xx_ext layout. Change the qla25xx_ctrlvp_iocb() and qla_ctrlvp_completed() function signatures from typed struct pointers to void *, since callers already pass a generic ring-slot pointer. Both the standard 64-byte vp_ctrl_entry_24xx and the 128-byte vp_ctrl_entry_24xx_ext are layout-identical for every field touched in these helpers (entry_type, handle, entry_count, command, vp_count, vp_idx_map, entry_status, comp_status, vp_idx_failed), so a single struct vp_ctrl_entry_24xx * view handles both adapter families without an IS_QLA29XX() branch. Add a BUILD_BUG_ON size check for the extended structure. Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-36-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org> Stable-dep-of: 2ac6a829843c ("scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity") Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/scsi/qla2xxx/qla_iocb.c | 23 ++++++++++++++++------- drivers/scsi/qla2xxx/qla_isr.c | 13 +++++++++---- drivers/scsi/qla2xxx/qla_os.c | 1 + 3 files changed, 26 insertions(+), 11 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c index 1752a62031710..54ff66d6f6508 100644 --- a/drivers/scsi/qla2xxx/qla_iocb.c +++ b/drivers/scsi/qla2xxx/qla_iocb.c @@ -3698,22 +3698,31 @@ qla_nvme_ls(srb_t *sp, struct pt_ls4_request *cmd_pkt) } static void -qla25xx_ctrlvp_iocb(srb_t *sp, struct vp_ctrl_entry_24xx *vce) +qla25xx_ctrlvp_iocb(srb_t *sp, void *pkt) { + /* + * vp_ctrl_entry_24xx_ext is layout-identical to vp_ctrl_entry_24xx + * for all fields touched here (entry_type, handle, entry_count, + * command, vp_count, vp_idx_map) -- they all sit at the same + * offsets and types in both structs, and the ext layout merely + * tacks on flags/id/hopct/reserved at offset 32+. So no + * IS_QLA29XX(ha) dispatch is needed on the issue path. + */ + struct vp_ctrl_entry_24xx *vce = pkt; int map, pos; - vce->entry_type = VP_CTRL_IOCB_TYPE; - vce->handle = sp->handle; - vce->entry_count = 1; - vce->command = cpu_to_le16(sp->u.iocb_cmd.u.ctrlvp.cmd); - vce->vp_count = cpu_to_le16(1); - /* * index map in firmware starts with 1; decrement index * this is ok as we never use index 0 */ map = (sp->u.iocb_cmd.u.ctrlvp.vp_index - 1) / 8; pos = (sp->u.iocb_cmd.u.ctrlvp.vp_index - 1) & 7; + + vce->entry_type = VP_CTRL_IOCB_TYPE; + vce->handle = sp->handle; + vce->entry_count = 1; + vce->command = cpu_to_le16(sp->u.iocb_cmd.u.ctrlvp.cmd); + vce->vp_count = cpu_to_le16(1); vce->vp_idx_map[map] |= 1 << pos; } diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c index 0efc9ba98104e..1bea78808324e 100644 --- a/drivers/scsi/qla2xxx/qla_isr.c +++ b/drivers/scsi/qla2xxx/qla_isr.c @@ -2408,13 +2408,19 @@ static void qla24xx_nvme_iocb_entry(scsi_qla_host_t *vha, struct req_que *req, } static void qla_ctrlvp_completed(scsi_qla_host_t *vha, struct req_que *req, - struct vp_ctrl_entry_24xx *vce) + void *pkt) { const char func[] = "CTRLVP-IOCB"; + /* + * vp_ctrl_entry_24xx_ext overlays vp_ctrl_entry_24xx for all + * fields read here (entry_status, comp_status, vp_idx_failed), + * so the read goes through one struct vp_ctrl_entry_24xx * view. + */ + struct vp_ctrl_entry_24xx *vce = pkt; srb_t *sp; int rval = QLA_SUCCESS; - sp = qla2x00_get_sp_from_handle(vha, func, req, vce); + sp = qla2x00_get_sp_from_handle(vha, func, req, pkt); if (!sp) return; @@ -3535,8 +3541,7 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha, (struct mbx_24xx_entry *)pkt); break; case VP_CTRL_IOCB_TYPE: - qla_ctrlvp_completed(vha, rsp->req, - (struct vp_ctrl_entry_24xx *)pkt); + qla_ctrlvp_completed(vha, rsp->req, pkt); break; case PUREX_IOCB_TYPE: purex_entry = (void *)pkt; diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index 552227a65855e..6882b34bf5848 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -7869,6 +7869,7 @@ qla2x00_module_init(void) BUILD_BUG_ON(sizeof(struct vf_evfp_entry_24xx) != 56); BUILD_BUG_ON(sizeof(struct vp_config_entry_24xx) != 64); BUILD_BUG_ON(sizeof(struct vp_ctrl_entry_24xx) != 64); + BUILD_BUG_ON(sizeof(struct vp_ctrl_entry_24xx_ext) != 128); BUILD_BUG_ON(sizeof(struct vp_rpt_id_entry_24xx) != 64); BUILD_BUG_ON(sizeof(sts21_entry_t) != 64); BUILD_BUG_ON(sizeof(sts22_entry_t) != 64); -- 2.53.0 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 5.10.y 2/3] scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size 2026-09-11 21:15 ` [PATCH 5.10.y 1/3] scsi: qla2xxx: Update VP control IOCB handling for 29xx series Sasha Levin @ 2026-09-11 21:15 ` Sasha Levin 2026-09-11 21:15 ` [PATCH 5.10.y 3/3] scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity Sasha Levin 1 sibling, 0 replies; 4+ messages in thread From: Sasha Levin @ 2026-09-11 21:15 UTC (permalink / raw) To: stable Cc: Nilesh Javali, Hannes Reinecke, Martin K. Petersen (Oracle), Sasha Levin From: Nilesh Javali <njavali@marvell.com> [ Upstream commit 878613ecb5a36db26859c4fd83daf9283a334fa2 ] The VP control IOCB selects its target virtual port by setting one bit in vp_idx_map, a fixed 16-byte (128-bit) array in both vp_ctrl_entry_24xx and vp_ctrl_entry_24xx_ext. qla25xx_ctrlvp_iocb() computes map = (vp_index - 1) / 8 and writes vce->vp_idx_map[map] without checking that map stays within the array. max_npiv_vports is taken from firmware and only sanitized to a MIN_MULTI_ID_FABRIC-aligned boundary, so it can legitimately be 191 or 255, and qla24xx_control_vp() only rejects vp_index >= max_npiv_vports. A vp_index above 128 therefore yields map >= 16 and an out-of-bounds write of up to 16 bytes past vp_idx_map, corrupting the trailing IOCB fields (or the adjacent request-ring slot on the 64-byte layout). Reject a vp_index that cannot be represented in the IOCB bitmap in qla24xx_control_vp(), and add a defensive ARRAY_SIZE() guard in qla25xx_ctrlvp_iocb() before the write. Adapters that report the usual 63 or 127 NPIV vports are unaffected. Fixes: 2853192e154b ("scsi: qla2xxx: Use IOCB path to submit Control VP MBX command") Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali <njavali@marvell.com> Reviewed-by: Hannes Reinecke <hare@kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-49-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org> Backport notes for 5.10: Retain both VP_CTRL bitmap bounds checks. Resolve the qla_mid.c context conflict by adding the upstream ref: INIT comment before the existing SRB allocation; the stable branch predates that comment. This also keeps the context required by 2ac6a829843c without importing the newer SRB lifetime changes or adding any functions. Also remove the extended-IOCB size assertion inherited from the preceding backport: 5.10 does not define struct vp_ctrl_entry_24xx_ext, so applying sizeof to it prevents qla_os.c from building. The existing 64-byte IOCB size assertion remains, and both bounds checks use that defined layout. Stable-dep-of: 2ac6a829843c ("scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity") Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/scsi/qla2xxx/qla_iocb.c | 6 ++++++ drivers/scsi/qla2xxx/qla_mid.c | 9 +++++++++ drivers/scsi/qla2xxx/qla_os.c | 1 - 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c index 54ff66d6f6508..65a808199bf55 100644 --- a/drivers/scsi/qla2xxx/qla_iocb.c +++ b/drivers/scsi/qla2xxx/qla_iocb.c @@ -3723,6 +3723,12 @@ qla25xx_ctrlvp_iocb(srb_t *sp, void *pkt) vce->entry_count = 1; vce->command = cpu_to_le16(sp->u.iocb_cmd.u.ctrlvp.cmd); vce->vp_count = cpu_to_le16(1); + if (map >= ARRAY_SIZE(vce->vp_idx_map)) { + ql_log(ql_log_warn, sp->vha, 0x307c, + "ctrlvp: vp_index %u exceeds vp_idx_map capacity\n", + sp->u.iocb_cmd.u.ctrlvp.vp_index); + return; + } vce->vp_idx_map[map] |= 1 << pos; } diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c index 1a4a740e118a0..5bde2414b1cd8 100644 --- a/drivers/scsi/qla2xxx/qla_mid.c +++ b/drivers/scsi/qla2xxx/qla_mid.c @@ -953,6 +953,15 @@ int qla24xx_control_vp(scsi_qla_host_t *vha, int cmd) if (vp_index == 0 || vp_index >= ha->max_npiv_vports) return QLA_PARAMETER_ERROR; + /* + * The VP_CTRL IOCB selects the target VP through a fixed 128-bit + * (16-byte) vp_idx_map bitmap, so vp_index must fit within it even + * if firmware advertises more NPIV vports. + */ + if (vp_index > sizeof_field(struct vp_ctrl_entry_24xx, vp_idx_map) * 8) + return QLA_PARAMETER_ERROR; + + /* ref: INIT */ sp = qla2x00_get_sp(base_vha, NULL, GFP_KERNEL); if (!sp) return rval; diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index 6882b34bf5848..552227a65855e 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -7869,7 +7869,6 @@ qla2x00_module_init(void) BUILD_BUG_ON(sizeof(struct vf_evfp_entry_24xx) != 56); BUILD_BUG_ON(sizeof(struct vp_config_entry_24xx) != 64); BUILD_BUG_ON(sizeof(struct vp_ctrl_entry_24xx) != 64); - BUILD_BUG_ON(sizeof(struct vp_ctrl_entry_24xx_ext) != 128); BUILD_BUG_ON(sizeof(struct vp_rpt_id_entry_24xx) != 64); BUILD_BUG_ON(sizeof(sts21_entry_t) != 64); BUILD_BUG_ON(sizeof(sts22_entry_t) != 64); -- 2.53.0 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 5.10.y 3/3] scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity 2026-09-11 21:15 ` [PATCH 5.10.y 1/3] scsi: qla2xxx: Update VP control IOCB handling for 29xx series Sasha Levin 2026-09-11 21:15 ` [PATCH 5.10.y 2/3] scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size Sasha Levin @ 2026-09-11 21:15 ` Sasha Levin 1 sibling, 0 replies; 4+ messages in thread From: Sasha Levin @ 2026-09-11 21:15 UTC (permalink / raw) To: stable; +Cc: Nilesh Javali, Sashiko, Martin K. Petersen (Oracle), Sasha Levin From: Nilesh Javali <njavali@marvell.com> [ Upstream commit 2ac6a829843cf3df522d19e091276109b94c4c7a ] ha->max_npiv_vports is taken from firmware (mcp->mb[11]) and only constrained so that (max_npiv_vports + 1) is a multiple of MIN_MULTI_ID_FABRIC, which permits values of 63, 127, 191 and 255. NPIV vports are then allocated up to that count. VP enable uses the VP_CONFIG IOCB, which addresses a vport through a plain vp_index byte, so a vp_index beyond 128 is enabled without issue. VP disable, however, uses the VP_CTRL IOCB, which selects target vports through the fixed 128-bit vp_idx_map bitmap. qla24xx_control_vp() rejects a vp_index past that bitmap and the IOCB builder cannot set a bit beyond 127, yet qla24xx_vport_delete() frees the local state regardless. A vport with vp_index > 128 can therefore be created and enabled but never disabled, leaving it permanently active in firmware: a resource leak. Cap ha->max_npiv_vports at init to the vp_idx_map capacity so such vports are never created. This collapses 191/255 to 127 (still modulo-valid) and leaves the real-world 63/127 cases unaffected. Fixes: 4d0ea24769c8 ("[SCSI] qla2xxx: Retrieve max-NPIV support capabilities from FW.") Cc: stable@vger.kernel.org Reported-by: Sashiko <sashiko-dev@google.com> Signed-off-by: Nilesh Javali <njavali@marvell.com> Link: https://patch.msgid.link/20260730155838.2119230-20-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/scsi/qla2xxx/qla_fw.h | 4 ++++ drivers/scsi/qla2xxx/qla_init.c | 13 +++++++++++++ drivers/scsi/qla2xxx/qla_mid.c | 2 +- 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_fw.h b/drivers/scsi/qla2xxx/qla_fw.h index 12b689e328834..a03dee211e4c9 100644 --- a/drivers/scsi/qla2xxx/qla_fw.h +++ b/drivers/scsi/qla2xxx/qla_fw.h @@ -1414,6 +1414,10 @@ struct vp_ctrl_entry_24xx { uint8_t reserved_5[24]; }; +/* vp_idx_map is a 128-bit (16-byte) bitmap selecting target VPs. */ +#define VP_CTRL_IDX_MAP_BITS \ + (sizeof_field(struct vp_ctrl_entry_24xx, vp_idx_map) * 8) + /* * Modify Virtual Port Configuration IOCB */ diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c index 4a057748ba175..69ca9a2a17b48 100644 --- a/drivers/scsi/qla2xxx/qla_init.c +++ b/drivers/scsi/qla2xxx/qla_init.c @@ -3910,6 +3910,19 @@ qla2x00_setup_chip(scsi_qla_host_t *vha) MIN_MULTI_ID_FABRIC)) ha->max_npiv_vports = MIN_MULTI_ID_FABRIC - 1; + + /* + * The VP_CTRL IOCB selects target VPs + * through the fixed vp_idx_map bitmap, + * so a vp_index beyond it can be enabled + * via VP_CONFIG but never disabled via + * VP_CTRL, leaking the VP. Cap the count + * to the bitmap capacity. + */ + if (ha->max_npiv_vports >= + VP_CTRL_IDX_MAP_BITS) + ha->max_npiv_vports = + VP_CTRL_IDX_MAP_BITS - 1; } qla2x00_get_resource_cnts(vha); qla_init_iocb_limit(vha); diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c index 5bde2414b1cd8..1b2c3d3470fe4 100644 --- a/drivers/scsi/qla2xxx/qla_mid.c +++ b/drivers/scsi/qla2xxx/qla_mid.c @@ -958,7 +958,7 @@ int qla24xx_control_vp(scsi_qla_host_t *vha, int cmd) * (16-byte) vp_idx_map bitmap, so vp_index must fit within it even * if firmware advertises more NPIV vports. */ - if (vp_index > sizeof_field(struct vp_ctrl_entry_24xx, vp_idx_map) * 8) + if (vp_index > VP_CTRL_IDX_MAP_BITS) return QLA_PARAMETER_ERROR; /* ref: INIT */ -- 2.53.0 ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-11 21:15 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-09-09 11:19 FAILED: patch "[PATCH] scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap" failed to apply to 5.10-stable tree gregkh 2026-09-11 21:15 ` [PATCH 5.10.y 1/3] scsi: qla2xxx: Update VP control IOCB handling for 29xx series Sasha Levin 2026-09-11 21:15 ` [PATCH 5.10.y 2/3] scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size Sasha Levin 2026-09-11 21:15 ` [PATCH 5.10.y 3/3] scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity Sasha Levin
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.