commit 5233e3235dec3065ccc632729675575dbe3c6b8a
Author: Magnus Lindholm <linmag7@gmail.com>
Date:   Sat Jan 25 10:49:22 2025 +0100

    scsi: qla1280: Fix kernel oops when debug level > 2
    
    A null dereference or oops exception will eventually occur when qla1280.c
    driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2.  I
    think its clear from the code that the intention here is sg_dma_len(s) not
    length of sg_next(s) when printing the debug info.
    
    Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
    Link: https://lore.kernel.org/r/20250125095033.26188-1-linmag7@gmail.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit 1a78a56ea65252bb089e0daace989167227f2d31
Author: Seunghui Lee <sh043.lee@samsung.com>
Date:   Sat Jan 18 11:38:08 2025 +0900

    scsi: ufs: core: Fix error return with query response
    
    There is currently no mechanism to return error from query responses.
    Return the error and print the corresponding error message with it.
    
    Signed-off-by: Seunghui Lee <sh043.lee@samsung.com>
    Link: https://lore.kernel.org/r/20250118023808.24726-1-sh043.lee@samsung.com
    Reviewed-by: Bean Huo <beanhuo@micron.com>
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit 87c4b5e8a6b65189abd9ea5010ab308941f964a4
Author: Long Li <longli@microsoft.com>
Date:   Wed Jan 22 19:07:22 2025 -0800

    scsi: storvsc: Set correct data length for sending SCSI command without payload
    
    In StorVSC, payload->range.len is used to indicate if this SCSI command
    carries payload. This data is allocated as part of the private driver data
    by the upper layer and may get passed to lower driver uninitialized.
    
    For example, the SCSI error handling mid layer may send TEST_UNIT_READY or
    REQUEST_SENSE while reusing the buffer from a failed command. The private
    data section may have stale data from the previous command.
    
    If the SCSI command doesn't carry payload, the driver may use this value as
    is for communicating with host, resulting in possible corruption.
    
    Fix this by always initializing this value.
    
    Fixes: be0cf6ca301c ("scsi: storvsc: Set the tablesize based on the information given by the host")
    Cc: stable@kernel.org
    Tested-by: Roman Kisel <romank@linux.microsoft.com>
    Reviewed-by: Roman Kisel <romank@linux.microsoft.com>
    Reviewed-by: Michael Kelley <mhklinux@outlook.com>
    Signed-off-by: Long Li <longli@microsoft.com>
    Link: https://lore.kernel.org/r/1737601642-7759-1-git-send-email-longli@linuxonhyperv.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit f8fb2403ddebb5eea0033d90d9daae4c88749ada
Author: André Draszik <andre.draszik@linaro.org>
Date:   Fri Jan 24 15:09:00 2025 +0000

    scsi: ufs: core: Fix use-after free in init error and remove paths
    
    devm_blk_crypto_profile_init() registers a cleanup handler to run when
    the associated (platform-) device is being released. For UFS, the
    crypto private data and pointers are stored as part of the ufs_hba's
    data structure 'struct ufs_hba::crypto_profile'. This structure is
    allocated as part of the underlying ufshcd and therefore Scsi_host
    allocation.
    
    During driver release or during error handling in ufshcd_pltfrm_init(),
    this structure is released as part of ufshcd_dealloc_host() before the
    (platform-) device associated with the crypto call above is released.
    Once this device is released, the crypto cleanup code will run, using
    the just-released 'struct ufs_hba::crypto_profile'. This causes a
    use-after-free situation:
    
      Call trace:
       kfree+0x60/0x2d8 (P)
       kvfree+0x44/0x60
       blk_crypto_profile_destroy_callback+0x28/0x70
       devm_action_release+0x1c/0x30
       release_nodes+0x6c/0x108
       devres_release_all+0x98/0x100
       device_unbind_cleanup+0x20/0x70
       really_probe+0x218/0x2d0
    
    In other words, the initialisation code flow is:
    
      platform-device probe
        ufshcd_pltfrm_init()
          ufshcd_alloc_host()
            scsi_host_alloc()
              allocation of struct ufs_hba
              creation of scsi-host devices
        devm_blk_crypto_profile_init()
          devm registration of cleanup handler using platform-device
    
    and during error handling of ufshcd_pltfrm_init() or during driver
    removal:
    
      ufshcd_dealloc_host()
        scsi_host_put()
          put_device(scsi-host)
            release of struct ufs_hba
      put_device(platform-device)
        crypto cleanup handler
    
    To fix this use-after free, change ufshcd_alloc_host() to register a
    devres action to automatically cleanup the underlying SCSI device on
    ufshcd destruction, without requiring explicit calls to
    ufshcd_dealloc_host(). This way:
    
        * the crypto profile and all other ufs_hba-owned resources are
          destroyed before SCSI (as they've been registered after)
        * a memleak is plugged in tc-dwc-g210-pci.c remove() as a
          side-effect
        * EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as
          it's not needed anymore
        * no future drivers using ufshcd_alloc_host() could ever forget
          adding the cleanup
    
    Fixes: cb77cb5abe1f ("blk-crypto: rename blk_keyslot_manager to blk_crypto_profile")
    Fixes: d76d9d7d1009 ("scsi: ufs: use devm_blk_ksm_init()")
    Cc: stable@vger.kernel.org
    Signed-off-by: André Draszik <andre.draszik@linaro.org>
    Link: https://lore.kernel.org/r/20250124-ufshcd-fix-v4-1-c5d0144aae59@linaro.org
    Reviewed-by: Bean Huo <beanhuo@micron.com>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Acked-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit 9ff7c383b8ac0c482a1da7989f703406d78445c6
Author: Igor Pylypiv <ipylypiv@google.com>
Date:   Fri Jan 31 10:44:07 2025 -0800

    scsi: core: Do not retry I/Os during depopulation
    
    Fail I/Os instead of retry to prevent user space processes from being
    blocked on the I/O completion for several minutes.
    
    Retrying I/Os during "depopulation in progress" or "depopulation restore in
    progress" results in a continuous retry loop until the depopulation
    completes or until the I/O retry loop is aborted due to a timeout by the
    scsi_cmd_runtime_exceeced().
    
    Depopulation is slow and can take 24+ hours to complete on 20+ TB HDDs.
    Most I/Os in the depopulation retry loop end up taking several minutes
    before returning the failure to user space.
    
    Cc: stable@vger.kernel.org # 4.18.x: 2bbeb8d scsi: core: Handle depopulation and restoration in progress
    Cc: stable@vger.kernel.org # 4.18.x
    Fixes: e37c7d9a0341 ("scsi: core: sanitize++ in progress")
    Signed-off-by: Igor Pylypiv <ipylypiv@google.com>
    Link: https://lore.kernel.org/r/20250131184408.859579-1-ipylypiv@google.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit 5363ee9d110e139584c2d92a0b640bc210588506
Author: Rik van Riel <riel@surriel.com>
Date:   Tue Jan 28 16:35:39 2025 -0500

    scsi: core: Use GFP_NOIO to avoid circular locking dependency
    
    Filesystems can write to disk from page reclaim with __GFP_FS
    set. Marc found a case where scsi_realloc_sdev_budget_map() ends up in
    page reclaim with GFP_KERNEL, where it could try to take filesystem
    locks again, leading to a deadlock.
    
    WARNING: possible circular locking dependency detected
    6.13.0 #1 Not tainted
    ------------------------------------------------------
    kswapd0/70 is trying to acquire lock:
    ffff8881025d5d78 (&q->q_usage_counter(io)){++++}-{0:0}, at: blk_mq_submit_bio+0x461/0x6e0
    
    but task is already holding lock:
    ffffffff81ef5f40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x9f/0x760
    
    The full lockdep splat can be found in Marc's report:
    
    https://lkml.org/lkml/2025/1/24/1101
    
    Avoid the potential deadlock by doing the allocation with GFP_NOIO, which
    prevents both filesystem and block layer recursion.
    
    Reported-by: Marc Aurèle La France <tsi@tuyoix.net>
    Signed-off-by: Rik van Riel <riel@surriel.com>
    Link: https://lore.kernel.org/r/20250129104525.0ae8421e@fangorn
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit 839a74b5649c9f41d939a05059b5ca6b17156d03
Author: Avri Altman <avri.altman@wdc.com>
Date:   Tue Jan 28 09:12:07 2025 +0200

    scsi: ufs: Fix toggling of clk_gating.state when clock gating is not allowed
    
    This commit addresses an issue where clk_gating.state is being toggled in
    ufshcd_setup_clocks() even if clock gating is not allowed.
    
    The fix is to add a check for hba->clk_gating.is_initialized before toggling
    clk_gating.state in ufshcd_setup_clocks().
    
    Since clk_gating.lock is now initialized unconditionally, it can no longer
    lead to the spinlock being used before it is properly initialized, but
    instead it is mostly for documentation purposes.
    
    Fixes: 1ab27c9cf8b6 ("ufs: Add support for clock gating")
    Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: Avri Altman <avri.altman@wdc.com>
    Link: https://lore.kernel.org/r/20250128071207.75494-3-avri.altman@wdc.com
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit 3d4114a1d34413dfffa0094c2eb7b95e61087abd
Author: Avri Altman <avri.altman@wdc.com>
Date:   Tue Jan 28 09:12:06 2025 +0200

    scsi: ufs: core: Ensure clk_gating.lock is used only after initialization
    
    Address a lockdep warning triggered by the use of the clk_gating.lock before
    it is properly initialized. The warning is as follows:
    
    [    4.388838] INFO: trying to register non-static key.
    [    4.395673] The code is fine but needs lockdep annotation, or maybe
    [    4.402118] you didn't initialize this object before use?
    [    4.407673] turning off the locking correctness validator.
    [    4.413334] CPU: 5 UID: 0 PID: 58 Comm: kworker/u32:1 Not tainted 6.12-rc1 #185
    [    4.413343] Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
    [    4.413362] Call trace:
    [    4.413364]  show_stack+0x18/0x24 (C)
    [    4.413374]  dump_stack_lvl+0x90/0xd0
    [    4.413384]  dump_stack+0x18/0x24
    [    4.413392]  register_lock_class+0x498/0x4a8
    [    4.413400]  __lock_acquire+0xb4/0x1b90
    [    4.413406]  lock_acquire+0x114/0x310
    [    4.413413]  _raw_spin_lock_irqsave+0x60/0x88
    [    4.413423]  ufshcd_setup_clocks+0x2c0/0x490
    [    4.413433]  ufshcd_init+0x198/0x10ec
    [    4.413437]  ufshcd_pltfrm_init+0x600/0x7c0
    [    4.413444]  ufs_qcom_probe+0x20/0x58
    [    4.413449]  platform_probe+0x68/0xd8
    [    4.413459]  really_probe+0xbc/0x268
    [    4.413466]  __driver_probe_device+0x78/0x12c
    [    4.413473]  driver_probe_device+0x40/0x11c
    [    4.413481]  __device_attach_driver+0xb8/0xf8
    [    4.413489]  bus_for_each_drv+0x84/0xe4
    [    4.413495]  __device_attach+0xfc/0x18c
    [    4.413502]  device_initial_probe+0x14/0x20
    [    4.413510]  bus_probe_device+0xb0/0xb4
    [    4.413517]  deferred_probe_work_func+0x8c/0xc8
    [    4.413524]  process_scheduled_works+0x250/0x658
    [    4.413534]  worker_thread+0x15c/0x2c8
    [    4.413542]  kthread+0x134/0x200
    [    4.413550]  ret_from_fork+0x10/0x20
    
    To fix this issue, ensure that the spinlock is only used after it has been
    properly initialized before using it in ufshcd_setup_clocks().  Do that
    unconditionally as initializing a spinlock is a fast operation.
    
    Fixes: 209f4e43b806 ("scsi: ufs: core: Introduce a new clock_gating lock")
    Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: Avri Altman <avri.altman@wdc.com>
    Link: https://lore.kernel.org/r/20250128071207.75494-2-avri.altman@wdc.com
    Reviewed-by: Bean Huo <beanhuo@micron.com>
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit 8c09f612b2937da109ed0df583ace3a29fc95a93
Author: Avri Altman <avri.altman@wdc.com>
Date:   Tue Jan 14 20:12:05 2025 +0200

    scsi: ufs: core: Simplify temperature exception event handling
    
    This commit simplifies the temperature exception event handling by removing
    the ufshcd_temp_exception_event_handler() function and directly calling
    ufs_hwmon_notify_event() in ufshcd_exception_event_handler().
    
    The ufshcd_temp_exception_event_handler() function contained a placeholder
    comment for platform vendors to add additional steps if required. However,
    since its introduction a few years ago, no vendor has added any additional
    steps. Therefore, the placeholder function is removed to streamline the
    code.
    
    Signed-off-by: Avri Altman <avri.altman@wdc.com>
    Link: https://lore.kernel.org/r/20250114181205.153760-1-avri.altman@wdc.com
    Reviewed-by: Bean Huo <beanhuo@micron.com>
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit c9d2782988df354b5a2db00be93920b4ecdde7a2
Author: Guixin Liu <kanie@linux.alibaba.com>
Date:   Tue Jan 14 10:50:41 2025 +0800

    scsi: target: core: Add line break to status show
    
    To ensure the output is not tangled with the shell prompt, add a line break
    to clearly display the status.
    
    Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
    Link: https://lore.kernel.org/r/20250114025041.97301-1-kanie@linux.alibaba.com
    Reviewed-by: Mike Christie <michael.christie@oracle.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit 1b3e2d4ec0c5848776cc56d2624998aa5b2f0d27
Author: Bao D. Nguyen <quic_nguyenb@quicinc.com>
Date:   Mon Jan 13 10:32:07 2025 -0800

    scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
    
    According to the UFS Device Specification, the dExtendedUFSFeaturesSupport
    defines the support for TOO_HIGH_TEMPERATURE as bit[4] and the
    TOO_LOW_TEMPERATURE as bit[5]. Correct the code to match with
    the UFS device specification definition.
    
    Cc: stable@vger.kernel.org
    Fixes: e88e2d32200a ("scsi: ufs: core: Probe for temperature notification support")
    Signed-off-by: Bao D. Nguyen <quic_nguyenb@quicinc.com>
    Link: https://lore.kernel.org/r/69992b3e3e3434a5c7643be5a64de48be892ca46.1736793068.git.quic_nguyenb@quicinc.com
    Reviewed-by: Avri Altman <Avri.Altman@wdc.com>
    Reviewed-by: Peter Wang <peter.wang@mediatek.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit b893d7ff853e27aa6000fc4ca12e0ffda3318bfc
Author: Mike Christie <michael.christie@oracle.com>
Date:   Mon Jan 13 12:07:57 2025 -0600

    scsi: core: Add passthrough tests for success and no failure definitions
    
    This patch adds scsi_check_passthrough() tests for the cases where a
    command completes successfully and when the command failed but the caller
    did not pass in a list of failures.
    
    Signed-off-by: Mike Christie <michael.christie@oracle.com>
    Link: https://lore.kernel.org/r/20250113180757.16691-1-michael.christie@oracle.com
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>