stable backport request: [PATCH v2] ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands

[Niklas Cassel <cassel@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 1394 bytes --]

On Sat, May 16, 2026 at 10:53:02AM +0000, Christoph Wiese wrote:
> (my orginal email was html formated, sorry about that)
> 
> Hi Niklas,
> 
> I notice you already flagged this for backporting to 7.0 stable. Please also include 6.12.y - the buggy parent commit 0ea84089dbf6 was backported to 6.12.77 as 5d61a38a60e6, and the bug reproduces there.
> 
> Symptom: parallel sedutil-cli --setLockingRange against multiple ATA OPAL SEDs causes one random drive per invocation to receive a zero-length TRUSTED RECEIVE response ("One or more header fields have 0 length / Session start failed rc = 136"). The OPAL session is opened on the drive by the TRUSTED SEND but the matching TRUSTED RECEIVE is failed at the SCSI mid-layer (scmd->allowed == 0 for SG_IO), leaving an orphan session that only a cold power cycle clears.
> 
> Bisect on Debian's 6.12.y kernel (which carries 5d61a38a60e6 unmodified): 6.12.74 works, 6.12.86 broken. I've been running 8ebf408 locally as a cherry-pick on 6.12.88 for ~24h; six OPAL SEDs unlock cleanly on every boot.
> 
> Thanks for the fix.

Dear stable maintainers,

Could you please help with backporting commit 8ebf408e7d46 ("ata:
libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands")

to the relevant stable kernels?

It gets a conflict when cherry-picking, so I have attached a version
that can be applied without conflicts.


Kind regards,
Niklas

[-- Attachment #2: 0001-ata-libata-scsi-fix-requeue-of-deferred-ATA-PASS-THR.patch --]
[-- Type: text/plain, Size: 2136 bytes --]

From b80ea77afafdc0205abd9026a6ced59f618dbd62 Mon Sep 17 00:00:00 2001
From: Igor Pylypiv <ipylypiv@google.com>
Date: Sun, 12 Apr 2026 08:36:37 -0700
Subject: [PATCH] ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH
 commands

Commit 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation")
introduced ata_scsi_requeue_deferred_qc() to handle commands deferred
during resets or NCQ failures. This deferral logic completed commands
with DID_SOFT_ERROR to trigger a retry in the SCSI mid-layer.

However, DID_SOFT_ERROR is subject to scsi_cmd_retry_allowed() checks.
ATA PASS-THROUGH commands sent via SG_IO ioctl have scmd->allowed set
to zero. This causes the mid-layer to fail the command immediately
instead of retrying, even though the command was never actually issued
to the hardware.

Switch to DID_REQUEUE to ensure these commands are inserted back into
the request queue regardless of retry limits.

Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation")
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Igor Pylypiv <ipylypiv@google.com>
(cherry picked from commit 8ebf408e7d463eee02c348a3c8277b95587b710d)
Signed-off-by: Niklas Cassel <cassel@kernel.org>
---
 drivers/ata/libata-scsi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 3b65df914ebb..cd607911d724 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1692,7 +1692,7 @@ void ata_scsi_requeue_deferred_qc(struct ata_port *ap)
 	/*
 	 * If we have a deferred qc when a reset occurs or NCQ commands fail,
 	 * do not try to be smart about what to do with this deferred command
-	 * and simply retry it by completing it with DID_SOFT_ERROR.
+	 * and simply requeue it by completing it with DID_REQUEUE.
 	 */
 	if (!qc)
 		return;
@@ -1701,7 +1701,7 @@ void ata_scsi_requeue_deferred_qc(struct ata_port *ap)
 	ap->deferred_qc = NULL;
 	cancel_work(&ap->deferred_qc_work);
 	ata_qc_free(qc);
-	scmd->result = (DID_SOFT_ERROR << 16);
+	scmd->result = (DID_REQUEUE << 16);
 	scsi_done(scmd);
 }
 
-- 
2.54.0