commit b8d0bb6a8ba0d3878940a914a19336844101867b Author: Shao Mingyin Date: Mon Oct 26 19:52:45 2026 +0800 scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store tcmu_set_data_pages_per_blk() only validates the upper bound of the value parsed from data_pages_per_blk=. Zero passes that check and is then used as the divisor when computing udev->max_blocks: divide error: 0000 [#1] SMP ... tcmu_set_data_pages_per_blk tcmu_configure_device Reject non-positive values, as the neighbouring max_data_area_mb and cmd_ring_size setters already do. Fixes: 08976cb548d6 ("scsi: target: tcmu: Make data_pages_per_blk changeable via configfs") Signed-off-by: Shao Mingyin Cc: stable@vger.kernel.org Reviewed-by: Bodo Stroesser Link: https://patch.msgid.link/20261026195245337ktSXy9G17VCcXyw760g9s@zte.com.cn Signed-off-by: Martin K. Petersen (Oracle) commit cdf4b87a18cb6a0ee26865cb1b7b5660a491d302 Author: Yuanhe Shu Date: Mon Oct 26 20:41:38 2026 +0800 scsi: target: Verify the iSCSI ISID is null-terminated iscsi_parse_pr_out_transport_id() returns the ISID of a FORMAT CODE 01b TransportID as a pointer into the PERSISTENT RESERVE OUT parameter list, lowercased in place and never null-terminated. spc4r37 Table 508 requires the field to be null-terminated, but a non-conforming initiator can omit the NULL; when the ISID ends at the end of the received buffer, the pointer is not a C string. The registration code still consumes it as one: strcmp() in __core_scsi3_locate_pr_reg() and in the REGISTER AND MOVE path, and snprintf("%s") in __core_scsi3_do_alloc_registration(), which also reads its first 8 bytes unconditionally with get_unaligned_be64() - a NUL check does not bound that read. When the parameter list spans more than one page, transport_kmap_data_sg() maps it with vmap(), and the over-read walks off the end of the mapping into the vmalloc() guard page and oopses. Reproduced with a PR OUT REGISTER + SPEC_I_PT parameter list of exactly 8192 bytes whose final TransportID carries a 12-byte ISID without a terminating NUL: BUG: unable to handle page fault for address: ffffc9000138c000 RIP: 0010:strcmp+0xc/0x30 Call Trace: __core_scsi3_locate_pr_reg+0xd3/0x120 [target_core_mod] core_scsi3_decode_spec_i_port+0x8fc/0x13a0 [target_core_mod] core_scsi3_emulate_pro_register+0x73c/0x900 [target_core_mod] ... iscsi_target_rx_thread+0xef/0x1d0 [iscsi_target_mod] With a single-page parameter list the buffer is a kmap() direct mapping, so the over-read continues into the physically adjacent page instead of faulting. snprintf("%s") then copies whatever follows the ISID in memory into pr_reg_isid, and PR IN READ FULL STATUS reports the registration back to any initiator, turning the over-read into an info leak of kernel heap contents. Reproduced with a 4096-byte parameter list whose last TransportID ends at the end of the buffer with a 4-byte ISID and no NUL, interleaved with I/O to populate adjacent pages: the READ FULL STATUS response returned the ISID as "0xleak" followed by raw bytes that were not part of the parameter list. The snprintf() into pr_reg_isid[PR_REG_ISID_LEN] caps the echoed ISID at 15 characters, so at most 11 bytes past the buffer are leaked per command, but the PR OUT command is not rate limited. Any initiator that can send PR OUT to an iSCSI-exported LUN can trigger either variant, including a guest via vhost-scsi. Require 8 bytes to remain after the ",i,0x" separator, and a NUL inside the rest of the descriptor, before the ISID pointer is returned. REGISTER AND MOVE fails with TCM_INVALID_PARAMETER_LIST; on SPEC_I_PT no target port claims the malformed TransportID, and the command fails the same way. Fixes: d04a179085c2 ("scsi: target: Bound PR-OUT TransportID parsing to the received buffer") Reported-by: kitta Reported-by: sashiko AI review Link: https://lore.kernel.org/r/sashiko-outbox-184760@kernel.org/ Cc: stable@vger.kernel.org Cc: Bryam Vargas Cc: John Garry Assisted-by: LLM Signed-off-by: Yuanhe Shu Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Link: https://patch.msgid.link/20261026124138.2708365-1-xiangzao@linux.alibaba.com Signed-off-by: Martin K. Petersen (Oracle) commit ffb7b533a47906b96166eec4b7eaa4199b7a7462 Author: Yingjie Wang Date: Fri Oct 23 16:23:06 2026 +0000 scsi: bsg: Report io_uring data copyback failures scsi_bsg_uring_task_cb() discards the result of blk_rq_unmap_user(). For a data-in command that uses a bounce buffer, the task work can therefore post a CQE with res == 0 despite a copyback failure. Use the unmap result as the CQE status. A later sense-buffer copy failure continues to take precedence. On x86_64, a raw BSG INQUIRY into an unaligned anonymous PROT_NONE mapping posted a CQE with res == 0 in 20/20 runs before this change and res == -EFAULT in 20/20 runs afterward. Writable controls succeeded in 20/20 runs on both kernels. Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Cc: stable@vger.kernel.org Signed-off-by: Yingjie Wang Reviewed-by: Yang Xiuwei Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/0b35d2d46bf8ff9f2dbba83ae093d17351e950e9.1792772194.git.x-professor@outlook.com Signed-off-by: Martin K. Petersen (Oracle) commit a52f2ad45726d788755b525adcf51f65a6b836ff Author: Yingjie Wang Date: Fri Oct 23 16:23:04 2026 +0000 scsi: bsg: Report synchronous data copyback failures scsi_bsg_sg_io_fn() ignores the result of blk_rq_unmap_user(). For a data-in command that uses a bounce buffer, unmapping copies the completed data to userspace. If that copy fails, SG_IO can report success despite the copyback failure. Capture the unmap status. Preserve an earlier sense-buffer copy error and otherwise return the data copyback error. This matches the error precedence used by scsi_complete_sghdr_rq(). On x86_64, a virtio-scsi INQUIRY with an unaligned PROT_NONE destination made ioctl() return 0 in 20/20 runs before this change and return -1 with errno EFAULT in 20/20 runs afterward. Writable controls succeeded in 20/20 runs on both kernels. Fixes: 10e8855b9451 ("bsg: add SG_IO to SG v4") Cc: stable@vger.kernel.org Signed-off-by: Yingjie Wang Reviewed-by: Yang Xiuwei Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/2561d633cc8cef513d75eb1df260046a4971e783.1792772194.git.x-professor@outlook.com Signed-off-by: Martin K. Petersen (Oracle) commit 5d5913710c81eed6fa275b6a24773059d9dbfdfa Author: Jia Jia Date: Wed Oct 21 17:43:34 2026 +0800 scsi: target: Validate REGISTER AND MOVE TransportID length REGISTER AND MOVE has a 24-byte parameter-list header followed by a TransportID. A 24-byte parameter list with a zero TransportID length passes the existing tid_len + 24 check, then the handler reads buf[24] for the TransportID protocol identifier, one byte past the received parameter list. A TransportID is at least 24 bytes. Reject shorter TransportIDs and compare the declared length with the bytes following the header before reading buf[24]. A malformed PR OUT sent through vhost-scsi triggered this read on a KASAN kernel. The command is now rejected with INVALID PARAMETER LIST before buf[24] is accessed. Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6") Signed-off-by: Jia Jia Link: https://patch.msgid.link/20261021094334.198599-1-physicalmtea@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit d58e6d962e5b59297be24d908f41af93f20ec11f Author: Vincent YUE Date: Wed Oct 21 07:08:56 2026 +1000 scsi: mpt3sas: Register devices during SANITIZE A SAS disk being sanitized responds to TEST UNIT READY with NOT READY, ASC 0x04, ASCQ 0x1b. mpt3sas discovery maps this sense to DEVICE_START_UNIT and issues START UNIT repeatedly. The drive stays NOT READY until the sanitize operation completes, causing discovery to exhaust its retry budget and decline SCSI device registration. Allow registration only for the SANITIZE IN PROGRESS sense, so sd/sg can expose the target while retaining its actual NOT READY state. All other sense dispositions are unchanged. On an LSI SAS3008 with an HGST HUH728080AL4200, unpatched Linux 7.2.11 retried discovery 145 times without registering the device. Linux 6.18.55 registered the same sanitizing drive. With the equivalent 7.2.11 fix the disk registered as /dev/sda (0 B) and /dev/sg0 while TEST UNIT READY still reported 02/04/1b and 47.32% SANITIZE progress. Another SAS drive continued to enumerate. This updated variant uses the named 0x041b sense constant introduced in newer kernels. It passed static review on the current SCSI for-next branch but has not been independently boot-tested there. Fixes: aee682fad6cd ("scsi: mpt3sas: Improve device discovery and readiness handling for slow devices") Assisted-by: LLM Signed-off-by: Vincent YUE Link: https://patch.msgid.link/20261020210856.42835-1-vince@palmit.com.au Reviewed-by: Laurence Oberman Signed-off-by: Martin K. Petersen (Oracle) commit 503e6172fa74da6b4944ece458f5534681e51d21 Author: Adrián García Casado Date: Tue Oct 20 21:59:34 2026 +0200 scsi: libsas: Add __printf attribute to sas_ata_printk() sas_ata_printk() formats its variadic arguments via struct va_format and %pV before passing them to printk(). Because %pV hides the format string from the compiler, GCC does not suggest the format attribute under -Wsuggest-attribute=format, and callers do not get compile-time format string validation. Add the __printf(3, 4) attribute to sas_ata_printk() to enable compile-time format string checking for its callers. Signed-off-by: Adrián García Casado Reviewed-by: John Garry Link: https://patch.msgid.link/20261020195934.250768-1-adriangarciacasado42@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 6a6e7d7230cd4e0a6c003bae5b85bf37a1e77b94 Author: Yu Zhang Date: Wed Oct 14 11:37:46 2026 +1000 scsi: target: Fix demo-mode dynamic ACL dev-entry UAF vs LUN teardown A demo-mode (generate_node_acls=1) login that allocates a dynamic NodeACL populates that ACL's per-LUN dev entries in core_tpg_add_node_to_devs() *before* the ACL is linked onto tpg->acl_node_list by target_add_node_acl(): core_tpg_check_initiator_node_acl(): ... core_tpg_add_node_to_devs(acl, tpg, NULL); /* builds deves */ target_add_node_acl(acl); /* only now listed */ The LUN teardown sweep, core_clear_lun_from_tpg(), enumerates only tpg->acl_node_list, so a dev entry whose ACL is still in the window above is invisible to the sweep and is never disabled. It is left on the se_lun->lun_deve_list after core_tpg_remove_lun() frees the se_lun; when the same unpacked_lun is later re-added and the se_lun is reallocated at the same address, the stale dev entry is rediscovered by target_nacl_find_deve() and core_enable_device_list_for_node() corrupts lun_deve_list: BUG: KASAN: slab-use-after-free ... core_enable_device_list_for_node+0x5ce/0x880 core_tpg_add_node_to_devs+0x169/0x190 core_dev_add_lun+0x146/0x190 target_fabric_port_link+0xe9/0x1b0 configfs_symlink+0x381/0xae0 __x64_sys_symlink+0x55/0x80 The demo-mode login path that drives the ACL/dev-entry creation is reachable by an unauthenticated initiator; the colliding LUN add/remove is a local configfs operation. Commit 49cb77e297dc ("target: Avoid mappedlun symlink creation during lun shutdown") introduced se_lun->lun_shutdown and guarded the *explicit* ACL MappedLUN path (target_fabric_mappedlun_link()), but the demo-mode automatic path, core_tpg_add_node_to_devs() -> core_enable_device_list_for_node(), was never given the equivalent guard, and the publish-after-populate ordering in core_tpg_check_initiator_node_acl() was left unchanged. Fix it in three cooperating parts: 1) Publish the dynamic NodeACL onto acl_node_list *before* creating its dev entries, so the teardown sweep can observe them. 2) Refuse to attach a dev entry to an se_lun that is shutting down, checked under nacl->lun_entry_mutex -- the same lock the sweep takes -- so once the sweep has passed an ACL any later enable for that LUN observes lun_shutdown and skips it. 3) In core_enable_device_list_for_node(), insert the new dev entry onto lun->lun_deve_list while still holding nacl->lun_entry_mutex, in both the replace and the new-entry branch. Previously the entry was added to nacl->lun_entry_hlist under the mutex but to lun->lun_deve_list only after dropping it; with the ACL now published early, the sweep could take the mutex in that gap, find the entry on the hlist, core_disable_device_list_for_node() it (list_del() on the not-yet- linked lun_link succeeds and the entry is freed), and then the enable would list_add_tail() the freed entry back onto lun_deve_list. Linking both lists under the mutex makes enable and the sweep mutually exclusive, closing that window. core_tpg_add_node_to_devs() already ignores the return value of core_enable_device_list_for_node(), so a shutting-down LUN is simply skipped. Cc: stable@vger.kernel.org Fixes: 49cb77e297dc ("target: Avoid mappedlun symlink creation during lun shutdown") Signed-off-by: Yu Zhang Tested-by: Yu Zhang Link: https://patch.msgid.link/20261014013746.46705-1-yuz08559@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 9ec6671b137de06f0345962fb8091466b7d56a96 Author: Matthew Whitehead Date: Tue Sep 29 10:45:28 2026 -0400 scsi: aha1542: Remove unneeded scsi_dma_unmap() call aha1542 never DMA maps the command's scatterlist. Data is bounced through a per-command buffer allocated with dma_alloc_coherent() in aha1542_init_cmd_priv(), the adapter is programmed with acmd->data_buffer_handle, and the payload is copied to and from the request segments in aha1542_queuecommand() and aha1542_free_cmd(). The scsi_dma_unmap() call left in aha1542_free_cmd() therefore unmaps a scatterlist that was never mapped. With CONFIG_DMA_API_DEBUG enabled this results in: device driver tries to free DMA memory it has not allocated [device address=0x0000000000000000] [size=0 bytes] Remove the call. Verified by testing on real hardware. Fixes: 2f2fef022c3e ("aha1542: use a local bounce buffer") Suggested-by: Laurence Oberman Assisted-by: LLM Signed-off-by: Matthew Whitehead Reviewed-by: Laurence Oberman Link: https://patch.msgid.link/20260929144528.7061-1-tedheadster@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit ba80a742b3e184b1af8f1ce636105e67f7cedb14 Author: Bart Van Assche Date: Fri Sep 25 11:25:43 2026 -0700 scsi: BusLogic: Prepare for enabling lock context analysis Document locking requirements with __must_hold() annotations to prepare the BusLogic driver for enabling compiler-based lock context analysis. Cc: Khalid Aziz Signed-off-by: Bart Van Assche Acked-by: Khalid Aziz Link: https://patch.msgid.link/abe0bc09b63eb55f278a883b65b881b94ce1c31b.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit b54bd8da110dd9efb058d68b04b50d9341f9f090 Author: Bart Van Assche Date: Fri Sep 25 11:25:42 2026 -0700 scsi: BusLogic: Pass the host pointer directly to several functions Pass the struct Scsi_Host pointer directly to multiple functions. This prepares the BusLogic driver for enabling compiler-based lock context analysis. No functionality has been changed. Cc: Khalid Aziz Signed-off-by: Bart Van Assche Acked-by: Khalid Aziz Link: https://patch.msgid.link/09e99ec9c6fa24ee5fe3c47110c88a1be076e01a.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 6b2ff2b3eafa381db9b4c8a6ed98b353b2a09f39 Author: HOYOUNG SEO Date: Tue Oct 27 20:03:57 2026 +0900 scsi: ufs: core: Change the error check sequence for auto hibern8 Auto-hibern8 enter and exit are performed by the host controller without a UIC command, and the auto-hibern8 idle timer only runs while no UIC command is outstanding. An auto-hibern8 error (IS.UHES or IS.UHXS) is therefore usually reported while hba->active_uic_cmd is NULL. Since commit fcd8b0450a9a ("scsi: ufs: core: Make ufshcd_uic_cmd_compl() easier to analyze"), ufshcd_uic_cmd_compl() returns early when hba->active_uic_cmd is NULL, before ufshcd_is_auto_hibern8_error() is called. Such auto-hibern8 errors are no longer recorded in hba->errors, so ufshcd_check_errors() is not called for them and the error handler is not scheduled. Check for auto-hibern8 errors before checking for an active UIC command, as was done before that commit, but keep returning early when there is no active UIC command so that a NULL cmd is never dereferenced. Only report the missing UIC command if no auto-hibern8 error was found. Fixes: fcd8b0450a9a ("scsi: ufs: core: Make ufshcd_uic_cmd_compl() easier to analyze") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: HOYOUNG SEO Reviewed-by: Stanley Jhu Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261027110357.3649301-1-hy50.seo@samsung.com Signed-off-by: Martin K. Petersen (Oracle) commit 8a832fb632da303cdf0704e0d56722ec47799f19 Author: Giuseppe Piscitelli Date: Tue Oct 27 11:08:50 2026 +0100 scsi: core: Balance the pseudo target reap reference With memory allocation profiling enabled, unloading scsi_debug reports allocations left at module unload. A stock Linux 7.2.11 VM without OpenZFS emitted the following on each of three load/unload cycles: [ 1.644665] drivers/scsi/scsi_debug.c:8863 module scsi_debug func:sdebug_add_host_helper has 1024 allocated at module unload [ 1.656260] drivers/scsi/scsi_debug.c:1261 module scsi_debug func:sdebug_target_alloc has 16 allocated at module unload scsi_alloc_target() supplies a reap reference for its caller. The SCSI device initializer takes another reference, which device removal drops. scsi_get_pseudo_sdev() drops its caller reference only when device allocation fails. On success the target cannot be destroyed, retaining its driver-private data and its parent host and adapter. Drop the caller reference in the common cleanup path, as the other scsi_alloc_target() callers do. Fixes: d630fbf6fc8c ("scsi: core: Support allocating a pseudo SCSI device") Signed-off-by: Giuseppe Piscitelli Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20261027100859.1031135-1-ooonea@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 34c99ce2993971712d89010a948d2f650687b796 Author: Giuseppe Piscitelli Date: Mon Oct 26 21:23:41 2026 +0100 scsi: scsi_debug: Drain target cleanup before module exit Target destruction queues cleanup in an exclusive async domain. The module loader's async_synchronize_full() does not wait for exclusive domains. Wait for target cleanup after removing the hosts and before removing the debugfs root and returning from module exit. Fixes: b402a0dce64a ("scsi: scsi_debug: Fix create target debugfs failure") Signed-off-by: Giuseppe Piscitelli Link: https://patch.msgid.link/20261026202342.668361-1-ooonea@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit f057a8bfeb6ff89c65e95540b8700a53c66d4a31 Author: Andrew Luebke Date: Mon Oct 26 10:20:32 2026 -0700 scsi: aic79xx: Fix NULL pointer dereference in device reset Since commit c67e63800446 ("scsi: aic79xx: Do not reference SCSI command when resetting device") the device reset SCB has no SCSI command, but ahd_linux_dev_reset() still sets its residual, and ahd_abort_scbs(), which completes it, sets its status. Seen on an AIC-7902 when a failing disk triggered a device reset, which killed the SCSI error handler: BUG: kernel NULL pointer dereference, address: 0000009c EIP: ahd_linux_dev_reset.cold+0xee/0x26e Add NULL command checks to the accessors in aic79xx_osm.h. Also skip autosense for an SCB without a command and complete it with ahd_done() right away: the REQUEST SENSE path can clear SCB_DEVICE_RESET, after which ahd_done() would dereference the missing command. Fixes: c67e63800446 ("scsi: aic79xx: Do not reference SCSI command when resetting device") Cc: stable@vger.kernel.org Reviewed-by: Hannes Reinecke Signed-off-by: Andrew Luebke Assisted-by: LLM Link: https://patch.msgid.link/20261026172032.749756-1-andrew.luebke@gmail.com Signed-off-by: Martin K. Petersen (Oracle) commit 696bdfc58975fbc70d2e2347a74e0b562e7e2494 Author: Imre Kaloz Date: Mon Oct 26 14:14:32 2026 +0100 scsi: aic7xxx: Use default settings on the SGI O2 onboard controllers The SGI O2 firmware runs its onboard aic7880s without the Adaptec BIOS, so scratch RAM holds no settings. The left over BIOS path reads uninitialised bytes, and bad parity panics the boot. Use the defaults there with host ID 0. ahc_init() keeps the default host ID ahc_pci_config() chose, 7 on other PCI controllers, so only the O2 changes. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Imre Kaloz Link: https://patch.msgid.link/20261026131432.26065-1-kaloz@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 9a2690eb4bbea8d7fbc3dfe478fca75fe956abb4 Author: Imre Kaloz Date: Tue Oct 13 11:42:53 2026 +0200 scsi: aic7xxx: Fix REQUEST SENSE allocation length on big-endian hosts The REQUEST SENSE length was taken from sg->len after the AHC_DMA_LAST_SEG flag was or-ed in and the value converted to little-endian, so the 8-bit field is 0x80 on big-endian hosts and the target is asked for 128 bytes into a 32-byte buffer. Use the buffer size, as aic79xx does. On an SGI O2 with a Fujitsu MAX3147NC, the sense data of its CHECK CONDITIONs during probe was lost. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Imre Kaloz Link: https://patch.msgid.link/20261013094253.2956-1-kaloz@kernel.org Signed-off-by: Martin K. Petersen (Oracle)