[GIT PULL] SCSI fixes for 7.3-rc4+

[GIT PULL] SCSI fixes for 7.3-rc4+

[James Bottomley]

The following changes since commit 3d676e458fe0c566f5a62753dc696b6a862fc412:

  scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() (2026-09-09 22:23:00 -0400)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git/ tags/scsi-fixes

for you to fetch changes up to 42d1221d321e55afc7bba9109a77aaf5a817c8a3:

  scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() (2026-09-16 21:33:30 -0400)

----------------------------------------------------------------
Mostly small driver fixes.  The biggest fix is the one to the block zone
handling which might trip for real or virtual hardware if the number of
zones is > 2^32.

----------------------------------------------------------------
Arnd Bergmann (1):
      scsi: leapraid: Avoid -Wformat-security warning

Bart Van Assche (1):
      scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()

Ewan D. Milne (1):
      scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC Symmetrix

Geert Uytterhoeven (1):
      scsi: ufs: pltfrm: Add quirk for R-Car S4 lacking lanes-per-direction

Stanley Jhu (1):
      scsi: ufs: core: Keep internal commands dispatchable during error handling

Yehyeong Lee (1):
      scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

ZHOU Jiaxiang (2):
      scsi: block: Fix zones_cond out-of-bounds write on zone report
      scsi: sd_zbc: Reject disks with too many zones

 block/blk-zoned.c                         | 15 +++++++++++++--
 drivers/scsi/leapraid/leapraid_func.h     |  2 --
 drivers/scsi/leapraid/leapraid_os.c       |  8 +++-----
 drivers/scsi/libiscsi_tcp.c               |  3 +++
 drivers/scsi/megaraid/megaraid_sas_base.c |  4 +++-
 drivers/scsi/scsi_devinfo.c               |  2 +-
 drivers/scsi/sd_zbc.c                     |  8 +++++++-
 drivers/ufs/core/ufshcd.c                 |  6 ++++++
 drivers/ufs/host/ufshcd-pltfrm.c          |  6 +++++-
 9 files changed, 41 insertions(+), 13 deletions(-)

---
diff --git a/block/blk-zoned.c b/block/blk-zoned.c
index a5afb842bf35..475aa16bc41a 100644
--- a/block/blk-zoned.c
+++ b/block/blk-zoned.c
@@ -2018,12 +2018,17 @@ static int disk_revalidate_zone_resources(struct gendisk *disk,
 				struct blk_revalidate_zone_args *args)
 {
 	struct queue_limits *lim = &disk->queue->limits;
+	unsigned long long nr_zones;
 	unsigned int pool_size;
 	int ret = 0;
 
 	args->disk = disk;
-	args->nr_zones =
-		DIV_ROUND_UP_ULL(get_capacity(disk), lim->chunk_sectors);
+	nr_zones = DIV_ROUND_UP_ULL(get_capacity(disk), lim->chunk_sectors);
+	if (nr_zones > UINT_MAX) {
+		pr_warn("%s: Too many zones (%llu)\n", disk->disk_name, nr_zones);
+		return -EINVAL;
+	}
+	args->nr_zones = nr_zones;
 
 	/* Cached zone conditions: 1 byte per zone */
 	args->zones_cond = kzalloc(args->nr_zones, GFP_NOIO);
@@ -2131,6 +2136,12 @@ static int blk_revalidate_zone_cond(struct blk_zone *zone, unsigned int idx,
 {
 	enum blk_zone_cond cond = zone->cond;
 
+	if (idx >= args->nr_zones) {
+		pr_warn("%s: Zone report index %u exceeds zone count %u\n",
+			args->disk->disk_name, idx, args->nr_zones);
+		return -EINVAL;
+	}
+
 	/* Check that the zone condition is consistent with the zone type. */
 	switch (cond) {
 	case BLK_ZONE_COND_NOT_WP:
diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h
index 4c0b9ca728d8..e8a0815bf95f 100644
--- a/drivers/scsi/leapraid/leapraid_func.h
+++ b/drivers/scsi/leapraid/leapraid_func.h
@@ -554,7 +554,6 @@ struct leapraid_fw_evt_work {
 /**
  * struct leapraid_fw_evt_struct - Firmware event handling structure
  *
- * @fw_evt_name: Name of the firmware event.
  * @fw_evt_thread: Workqueue used for processing firmware events.
  * @fw_evt_lock: Spinlock protecting access to the firmware event list.
  * @fw_evt_list: Linked list of pending firmware events.
@@ -565,7 +564,6 @@ struct leapraid_fw_evt_work {
  */
 struct leapraid_fw_evt_struct {
 	u32 leapraid_evt_masks[4];
-	char fw_evt_name[48];
 	struct workqueue_struct *fw_evt_thread;
 	spinlock_t fw_evt_lock; /* protects firmware event */
 	struct list_head fw_evt_list;
diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c
index ee3242779dfd..507f11862276 100644
--- a/drivers/scsi/leapraid/leapraid_os.c
+++ b/drivers/scsi/leapraid/leapraid_os.c
@@ -2054,12 +2054,10 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	shost->transportt = leapraid_transport_template;
 	shost->unique_id = adapter->adapter_attr.id;
 
-	snprintf(adapter->fw_evt_s.fw_evt_name,
-		 sizeof(adapter->fw_evt_s.fw_evt_name),
-		 "fw_event_%s%d", LEAPRAID_DRIVER_NAME,
-		 adapter->adapter_attr.id);
 	adapter->fw_evt_s.fw_evt_thread =
-		alloc_ordered_workqueue(adapter->fw_evt_s.fw_evt_name, 0);
+		alloc_ordered_workqueue("fw_event_%s%d", 0,
+					LEAPRAID_DRIVER_NAME,
+					adapter->adapter_attr.id);
 	if (!adapter->fw_evt_s.fw_evt_thread) {
 		dev_err(&adapter->pdev->dev,
 			"%s: Failed to create fw event workqueue\n", __func__);
diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index 7223bb18b048..d35f93451ee9 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -480,6 +480,9 @@ static int iscsi_tcp_data_in(struct iscsi_conn *conn, struct iscsi_task *task)
 	int datasn = be32_to_cpu(rhdr->datasn);
 	unsigned total_in_length = task->sc->sdb.length;
 
+	if (task->sc->sc_data_direction != DMA_FROM_DEVICE)
+		return ISCSI_ERR_PROTO;
+
 	/*
 	 * lib iscsi will update this in the completion handling if there
 	 * is status.
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index b95f187297ae..4f9a53769966 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -7886,7 +7886,9 @@ megasas_resume(struct device *dev)
 			goto fail_init_mfi;
 	}
 
-	if (megasas_get_ctrl_info(instance) != DCMD_SUCCESS)
+	scoped_guard(mutex, &instance->reset_mutex)
+		rval = megasas_get_ctrl_info(instance);
+	if (rval != DCMD_SUCCESS)
 		goto fail_init_mfi;
 
 	tasklet_init(&instance->isr_tasklet, instance->instancet->tasklet,
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 15ffbe93ac72..88a911b35c94 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -161,7 +161,7 @@ static struct {
 	{"DGC", "DISK", NULL, BLIST_SPARSELUN},	/* EMC CLARiiON, no storage on LUN 0 */
 	{"EMC",  "Invista", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
 	{"EMC", "SYMMETRIX", NULL, BLIST_SPARSELUN | BLIST_LARGELUN |
-	 BLIST_REPORTLUN2 | BLIST_RETRY_ITF},
+	 BLIST_REPORTLUN2 | BLIST_RETRY_ITF | BLIST_SKIP_IO_HINTS},
 	{"EMULEX", "MD21/S2     ESDI", NULL, BLIST_SINGLELUN},
 	{"easyRAID", "16P", NULL, BLIST_NOREPORTLUN},
 	{"easyRAID", "X6P", NULL, BLIST_NOREPORTLUN},
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 56e455fb5add..456beaf2e769 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -589,7 +589,7 @@ int sd_zbc_revalidate_zones(struct scsi_disk *sdkp)
 int sd_zbc_read_zones(struct scsi_disk *sdkp, struct queue_limits *lim,
 		u8 buf[SD_BUF_SIZE])
 {
-	unsigned int nr_zones;
+	u64 nr_zones;
 	u32 zone_blocks = 0;
 	int ret;
 
@@ -621,6 +621,12 @@ int sd_zbc_read_zones(struct scsi_disk *sdkp, struct queue_limits *lim,
 		goto err;
 
 	nr_zones = round_up(sdkp->capacity, zone_blocks) >> ilog2(zone_blocks);
+	if (nr_zones > INT_MAX) {
+		sd_printk(KERN_ERR, sdkp, "Too many zones (%llu)\n",
+			  nr_zones);
+		ret = -EINVAL;
+		goto err;
+	}
 	sdkp->early_zone_info.nr_zones = nr_zones;
 	sdkp->early_zone_info.zone_blocks = zone_blocks;
 
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 2ba244cf40ac..54f4e7d7de02 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -6817,11 +6817,17 @@ static void ufshcd_err_handling_prepare(struct ufs_hba *hba)
 	}
 	/* Wait for ongoing ufshcd_queuecommand() calls to finish. */
 	blk_mq_quiesce_tagset(&hba->host->tag_set);
+	/*
+	 * Internal commands are submitted on the pseudo SCSI device. Let them
+	 * through so that the error handler can recover the link.
+	 */
+	blk_mq_unquiesce_queue(hba->host->pseudo_sdev->request_queue);
 	cancel_work_sync(&hba->eeh_work);
 }
 
 static void ufshcd_err_handling_unprepare(struct ufs_hba *hba)
 {
+	blk_mq_quiesce_queue_nowait(hba->host->pseudo_sdev->request_queue);
 	blk_mq_unquiesce_tagset(&hba->host->tag_set);
 	ufshcd_release(hba);
 	if (ufshcd_is_clkscaling_supported(hba))
diff --git a/drivers/ufs/host/ufshcd-pltfrm.c b/drivers/ufs/host/ufshcd-pltfrm.c
index 5ac7afe75934..169dbc1a75fe 100644
--- a/drivers/ufs/host/ufshcd-pltfrm.c
+++ b/drivers/ufs/host/ufshcd-pltfrm.c
@@ -206,7 +206,11 @@ static void ufshcd_init_lanes_per_dir(struct ufs_hba *hba)
 		dev_dbg(hba->dev,
 			"%s: failed to read lanes-per-direction, ret=%d\n",
 			__func__, ret);
-		hba->lanes_per_direction = UFSHCD_DEFAULT_LANES_PER_DIRECTION;
+		/* Old R-Car S4 DTBs lack "lanes-per-direction = <1>" */
+		if (of_device_is_compatible(dev->of_node, "renesas,r8a779f0-ufs"))
+			hba->lanes_per_direction = 1;
+		else
+			hba->lanes_per_direction = UFSHCD_DEFAULT_LANES_PER_DIRECTION;
 	}
 }
 

Re: [GIT PULL] SCSI fixes for 7.3-rc4+

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] scsi: ufs: Use-After-Free on pseudo_sdev in ufshcd_err_handling_prepare()
- [Low] scsi: megaraid: mixing goto-based error handling and scoped_guard in megasas_resume
--

commit 779f0b1927d5f926d874e86dcf935da1578ca2f4
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Fri Sep 25 21:22:51 2026 +0000

SCSI fixes for 7.3-rc4+

Mostly small driver fixes. The biggest fix is the one to the block zone
handling which might trip for real or virtual hardware if the number of
zones is > 2^32.

> diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
> index b95f187297aed..4f9a53769966f 100644
> --- a/drivers/scsi/megaraid/megaraid_sas_base.c
> +++ b/drivers/scsi/megaraid/megaraid_sas_base.c
[ ... ]
> @@ -7886,7 +7886,9 @@ megasas_resume(struct device *dev)
>  			goto fail_init_mfi;
>  	}
>  
> -	if (megasas_get_ctrl_info(instance) != DCMD_SUCCESS)
> +	scoped_guard(mutex, &instance->reset_mutex)
> +		rval = megasas_get_ctrl_info(instance);
> +	if (rval != DCMD_SUCCESS)

[Severity: Low]
This isn't a bug, but this function relies heavily on goto-based error
handling.

Does the introduction of a scope-based cleanup helper (scoped_guard) here
violate the cleanup subsystem guidelines?

The kernel cleanup guidelines state that scope-based cleanup helpers and
goto should not be mixed in the same function, as it can create confusing
ownership semantics.

>  		goto fail_init_mfi;
>  
>  	tasklet_init(&instance->isr_tasklet, instance->instancet->tasklet,
[ ... ]
> diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
> index 2ba244cf40ac7..54f4e7d7de02e 100644
> --- a/drivers/ufs/core/ufshcd.c
> +++ b/drivers/ufs/core/ufshcd.c
> @@ -6817,11 +6817,17 @@ static void ufshcd_err_handling_prepare(struct ufs_hba *hba)
>  	}
>  	/* Wait for ongoing ufshcd_queuecommand() calls to finish. */
>  	blk_mq_quiesce_tagset(&hba->host->tag_set);
> +	/*
> +	 * Internal commands are submitted on the pseudo SCSI device. Let them
> +	 * through so that the error handler can recover the link.
> +	 */
> +	blk_mq_unquiesce_queue(hba->host->pseudo_sdev->request_queue);

[Severity: High]
Can this sequence lead to a use-after-free on hba->host->pseudo_sdev?

If a device error triggers ufshcd_intr(), it schedules hba->eh_work.
Concurrently, the driver could be unbound, invoking ufshcd_remove().

ufshcd_remove() calls scsi_remove_host(), which destroys and frees the SCSI
devices, including hba->host->pseudo_sdev.

Because ufshcd_remove() does not cancel hba->eh_work until later in
ufshcd_hba_exit(), the error handler might execute
ufshcd_err_handling_prepare() while teardown is in progress.

Is it possible for the code to dereference hba->host->pseudo_sdev here
after it has already been freed?

>  	cancel_work_sync(&hba->eeh_work);
>  }
>  
>  static void ufshcd_err_handling_unprepare(struct ufs_hba *hba)
>  {
> +	blk_mq_quiesce_queue_nowait(hba->host->pseudo_sdev->request_queue);
>  	blk_mq_unquiesce_tagset(&hba->host->tag_set);
>  	ufshcd_release(hba);
>  	if (ufshcd_is_clkscaling_supported(hba))

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/ea8f769b49f7d1185f588cf5b9202f300c280af7.camel@HansenPartnership.com?part=1

Re: [GIT PULL] SCSI fixes for 7.3-rc4+

[Bart Van Assche]

On 9/25/26 2:46 PM, sashiko-bot@kernel.org wrote:
>> diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
>> index b95f187297aed..4f9a53769966f 100644
>> --- a/drivers/scsi/megaraid/megaraid_sas_base.c
>> +++ b/drivers/scsi/megaraid/megaraid_sas_base.c
> [ ... ]
>> @@ -7886,7 +7886,9 @@ megasas_resume(struct device *dev)
>>   			goto fail_init_mfi;
>>   	}
>>   
>> -	if (megasas_get_ctrl_info(instance) != DCMD_SUCCESS)
>> +	scoped_guard(mutex, &instance->reset_mutex)
>> +		rval = megasas_get_ctrl_info(instance);
>> +	if (rval != DCMD_SUCCESS)
> 
> [Severity: Low]
> This isn't a bug, but this function relies heavily on goto-based error
> handling.
> 
> Does the introduction of a scope-based cleanup helper (scoped_guard) here
> violate the cleanup subsystem guidelines?
> 
> The kernel cleanup guidelines state that scope-based cleanup helpers and
> goto should not be mixed in the same function, as it can create confusing
> ownership semantics.

I assume the above refers to the rules in include/linux/cleanup.h?
In that header file I found the following:

  * Lastly, given that the benefit of cleanup helpers is removal of
  * "goto", and that the "goto" statement can jump between scopes, the
  * expectation is that usage of "goto" and cleanup helpers is never
  * mixed in the same function. I.e. for a given routine, convert all
  * resources that need a "goto" cleanup to scope-based cleanup, or
  * convert none of them.

I think these rules are too strict and should be relaxed.

>> diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
>> index 2ba244cf40ac7..54f4e7d7de02e 100644
>> --- a/drivers/ufs/core/ufshcd.c
>> +++ b/drivers/ufs/core/ufshcd.c
>> @@ -6817,11 +6817,17 @@ static void ufshcd_err_handling_prepare(struct ufs_hba *hba)
>>   	}
>>   	/* Wait for ongoing ufshcd_queuecommand() calls to finish. */
>>   	blk_mq_quiesce_tagset(&hba->host->tag_set);
>> +	/*
>> +	 * Internal commands are submitted on the pseudo SCSI device. Let them
>> +	 * through so that the error handler can recover the link.
>> +	 */
>> +	blk_mq_unquiesce_queue(hba->host->pseudo_sdev->request_queue);
> 
> [Severity: High]
> Can this sequence lead to a use-after-free on hba->host->pseudo_sdev?
> 
> If a device error triggers ufshcd_intr(), it schedules hba->eh_work.
> Concurrently, the driver could be unbound, invoking ufshcd_remove().
> 
> ufshcd_remove() calls scsi_remove_host(), which destroys and frees the SCSI
> devices, including hba->host->pseudo_sdev.
> 
> Because ufshcd_remove() does not cancel hba->eh_work until later in
> ufshcd_hba_exit(), the error handler might execute
> ufshcd_err_handling_prepare() while teardown is in progress.
> 
> Is it possible for the code to dereference hba->host->pseudo_sdev here
> after it has already been freed?

This is an existing issue in the UFS driver that predates the UFS driver
changes shown above. Additionally, in a typical setup the UFS device is
not removable and hence ufshcd_remove() will never be called.

Thanks,

Bart.

Re: [GIT PULL] SCSI fixes for 7.3-rc4+

[pr-tracker-bot]

The pull request you sent on Fri, 25 Sep 2026 17:22:51 -0400:

> https://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git/ tags/scsi-fixes

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/049380360ca6f4cc22ac2f67fe95b98967c887f0

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html