commit 36b6dcb2b7463b290d63c83d82bec8065a1a93de Author: Ian Bridges Date: Wed Jul 29 09:46:17 2026 -0500 scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions In preparation for removing the strlcat() API[1], replace its uses in lpfc_cmf_info_show(), lpfc_nvme_info_show() and lpfc_scsi_stat_show(). The three functions build sysfs attribute output, and sysfs_emit_at() is the designated helper for that. The single write paths become sysfs_emit(), the offset zero form of the same helper. Each intermediate tmp buffer and its per fragment overflow check become unnecessary. Once the page is full, sysfs_emit_at() writes nothing more, so dropping the early exits does not change the produced bytes. Each loop that appends keeps one exit, so a full page stops the iteration. In lpfc_nvme_info_show() the exit also releases the fc_nodes_list_lock as it did before. The unlock_buf_done label loses its last user and is removed. The old code capped every fragment at LPFC_MAX_INFO_TMP_LEN or LPFC_MAX_SCSI_INFO_TMP_LEN bytes before appending it. The replacement formats each fragment directly into the page, so a fragment longer than its old tmp buffer is no longer truncated when the page has room for it. Both macros lose their last user and are removed. The running length that sysfs_emit_at() maintains equals the length that the removed strnlen() calls computed, so the "Could be more info" overflow markers keep their trigger condition. Link: https://github.com/KSPP/linux/issues/370 [1] Signed-off-by: Ian Bridges Link: https://patch.msgid.link/20260729144617.1388646-6-icb@fastmail.org Reviewed-by: Nigel Kirkland Signed-off-by: Martin K. Petersen (Oracle) commit 4832a60e0a7818400afffa392b74776d084ddf4a Author: Ian Bridges Date: Wed Jul 29 09:46:16 2026 -0500 scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers In preparation for removing the strlcat() API[1], replace its uses in lpfc_debugfs_multixripools_data(), lpfc_debugfs_scsistat_data() and lpfc_debugfs_hdwqstat_data(). Each helper accumulates a variable number of lines into the debugfs buffer, which is what seq_buf is for. The intermediate tmp buffers and the per fragment overflow checks become unnecessary. Once a seq_buf overflows, later writes to it do nothing, so dropping the early exits does not change the produced bytes. Each loop that appends keeps one seq_buf_has_overflowed() exit, so a full buffer stops the iteration. lpfc_debugfs_multixripools_data() and lpfc_debugfs_hdwqstat_data() append to whatever the buffer already holds, so their seq_buf is anchored at the current end of the string. All three helpers keep returning strnlen() because seq_buf_used() reports the full buffer size after an overflow. Link: https://github.com/KSPP/linux/issues/370 [1] Signed-off-by: Ian Bridges Link: https://patch.msgid.link/20260729144617.1388646-5-icb@fastmail.org Reviewed-by: Nigel Kirkland Signed-off-by: Martin K. Petersen (Oracle) commit 22d4cbf6f7509f0aab58d60d488a0082916a2fb0 Author: Ian Bridges Date: Wed Jul 29 09:46:15 2026 -0500 scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report() In preparation for removing the strlcat() API[1], replace its use in lpfc_rx_monitor_report(). The function accumulates one line per ring entry, which is what seq_buf is for. seq_buf tracks the write position, so the per entry strlen() rescans of the destination are gone. Each record is still formatted into the tmp buffer. seq_buf_puts() appends it only when it fits whole, so the output keeps ending at the last complete record. The loop still stops on overflow without consuming the current entry, and the returned count and the ring head keep their old meaning. The produced bytes are unchanged. Link: https://github.com/KSPP/linux/issues/370 [1] Signed-off-by: Ian Bridges Link: https://patch.msgid.link/20260729144617.1388646-4-icb@fastmail.org Reviewed-by: Nigel Kirkland Signed-off-by: Martin K. Petersen (Oracle) commit 07f46a9f8964b91d56951ef7f74c551af0eddeac Author: Ian Bridges Date: Wed Jul 29 09:46:14 2026 -0500 scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name() In preparation for removing the strlcat() API[1], replace its uses in lpfc_vport_symbolic_node_name(). The function builds five unconditional fragments, so one scnprintf() call composes the whole string. The intermediate tmp buffer and the per fragment overflow checks become unnecessary. scnprintf() truncates at the buffer size and returns the number of bytes it wrote, which equals the length that the removed strnlen() call computed. The old code capped every fragment at MAXHOSTNAMELEN bytes before appending it, independently of the room left in the destination. The replacement formats each fragment directly into the destination, so a fragment longer than MAXHOSTNAMELEN is no longer truncated when the destination has room for it. Link: https://github.com/KSPP/linux/issues/370 [1] Signed-off-by: Ian Bridges Link: https://patch.msgid.link/20260729144617.1388646-3-icb@fastmail.org Reviewed-by: Nigel Kirkland Signed-off-by: Martin K. Petersen (Oracle) commit 5a03dbfd670092a6960de433005aae1734c18f1f Author: Ian Bridges Date: Wed Jul 29 09:46:13 2026 -0500 scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info() In preparation for removing the strlcat() API[1], replace its uses in lpfc_info(). The function accumulates a variable number of optional fragments, which is what seq_buf is for. The intermediate tmp buffer and the per fragment overflow checks become unnecessary. seq_buf is memory safe by construction and silently truncates in the same way as the replaced pattern. The old code passed phba->ModelDesc as the format string of the first scnprintf() call. The model description comes from adapter VPD data. seq_buf_printf() takes a format string, so the replacement prints it through "%s". A model description containing conversion specifiers is no longer interpreted. Link: https://github.com/KSPP/linux/issues/370 [1] Signed-off-by: Ian Bridges Link: https://patch.msgid.link/20260729144617.1388646-2-icb@fastmail.org Reviewed-by: Nigel Kirkland Signed-off-by: Martin K. Petersen (Oracle) commit fb0fc67db96292a65539e63f536c6f586490c78b Author: Bart Van Assche Date: Fri Aug 7 15:49:51 2026 -0700 scsi: core: Enable context analysis Enable context analysis for those SCSI core files that build without triggering any context analysis warnings. Signed-off-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/2576d2f7e3530b721b5050ac6d25c413037d7e7e.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 4c461ee2b2a5a7c327fe092b41de1fcc002adc01 Author: Bart Van Assche Date: Fri Aug 7 15:49:50 2026 -0700 scsi: core: Protect host state changes with the host lock Some but not all SCSI host state changes are protected with the SCSI host lock. Annotate the SCSI host state with __guarded_by(host_lock) and protect all SCSI host state changes with the SCSI host lock. This patch prevents that KCSAN complains about data races when accessing the SCSI host state. Reported-by: Jianzhou Zhao Closes: https://lore.kernel.org/all/36d59d0e.6db0.19cdbeee01b.Coremail.luckd0g@163.com/ Signed-off-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/681e4a5260c182feb5fc1d96f0d43c62c21dc6c9.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 09982efcc07e739c7e4ac6089e3e521132388b53 Author: Bart Van Assche Date: Fri Aug 7 15:49:49 2026 -0700 scsi: core: Add lock context annotations Document which functions expect that shost->scan_mutex is held. Reviewed-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/ad5ca37acf8c933a12830c0811c293af54c87573.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit e70647b25a641b9f5602558839182d036b512de5 Author: Bart Van Assche Date: Fri Aug 7 15:49:48 2026 -0700 scsi: core: Pass the SCSI host pointer directly to scanning functions In the functions scsi_probe_and_add_lun(), scsi_sequential_lun_scan(), scsi_report_lun_scan() and __scsi_scan_target() the SCSI host pointer is derived from the SCSI target pointer. Pass the SCSI host pointer directly. This patch prepares for enabling context analysis. With this patch applied, context annotations can refer to the SCSI host pointer directly, e.g. __must_hold(&shost->scan_mutex). Without this patch, the following annotation would have to be used: __must_hold(&dev_to_shost(starget->dev.parent)->scan_mutex) Additionally, in code that locks shost->scan_mutex, the following would have to be added to help the compiler understand that shost == dev_to_shost(starget->dev.parent): __assume_ctx_lock(&dev_to_shost(starget->dev.parent)->scan_mutex); __assume_ctx_lock() statements should be avoided if there is a good alternative. Hence this patch. No functionality has been changed. Reviewed-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/49d2fc5fae5cb5dca2536818155581c73f39c883.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit ff5d552022b35f7475bdc538173b3ceb95d55d85 Author: Bart Van Assche Date: Fri Aug 7 15:49:47 2026 -0700 scsi: ufs: core: Enable context analysis Annotate functions that modify the state of a synchronization object. Remove the struct semaphore annotations because lock context annotations are not supported for semaphores. Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/3c975386a5bcb939f8a2a0d47fd621f234321a9e.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 720d8b2f2457f4962ca353dd90395e2660d9a10d Author: Bart Van Assche Date: Fri Aug 7 15:49:46 2026 -0700 scsi: ufs: core: Set task state before io_schedule_timeout() Set the task state to TASK_UNINTERRUPTIBLE before calling io_schedule_timeout() in ufshcd_wait_for_pending_cmds(). Without setting the task state, io_schedule_timeout() returns immediately because the task state remains TASK_RUNNING. This results in a busy loop that wastes CPU cycles. Fixes: 2000bc309703 ("scsi: ufs: core: Reduce the clock scaling latency") Reviewed-by: Peter Wang Reported-by: Sashiko Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/8fe4526ce272811b28e99048b42358dd8f7c48af.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit db441dcb8c1452279956b7ea4e394b5ce8ce77f1 Author: Xingui Yang Date: Tue Aug 11 12:03:34 2026 +0800 scsi: libsas: Add linkrate and sas_addr change detection in rediscover Introduce sas_dev_is_flutter() and sas_rediscover_ex_phy() to improve flutter and device replace detection during rediscovery. sas_dev_is_flutter() calls sas_ex_phy_discover() before looking up the child device via sas_ex_phy_to_dev(), ensuring the PHY state is always updated and avoiding use-after-free since the child device pointer is obtained after the sleeping SMP request completes. Add validation for linkrate and sas_addr changes. When the SAS address changes, phy->attached_sas_addr is restored to the original address before returning false, so sas_unregister_devs_sas_addr() can properly match and unregister the old device. The sas_addr check is ordered before the linkrate check to avoid skipping the restoration when both change simultaneously. sas_rediscover_ex_phy() uses the async discovery pattern (sas_discover_event) instead of the synchronous sas_discover_new() to ensure proper ordering between device unregistration and rediscovery, avoiding sysfs_warn_dup() errors. Signed-off-by: Xingui Yang Suggested-by: John Garry Link: https://patch.msgid.link/20260811040334.4184911-3-yangxingui@huawei.com Signed-off-by: Martin K. Petersen (Oracle) commit 4c2128c1a399318859d9eea0b74613d90f4bcb66 Author: Xingui Yang Date: Tue Aug 11 12:03:33 2026 +0800 scsi: libsas: Add sas_ex_phy_to_dev() helper Add sas_ex_phy_to_dev() to return any device type attached to an expander phy, and refactor sas_ex_to_ata() to use it. No functional changes intended. Signed-off-by: Xingui Yang Reviewed-by: John Garry Link: https://patch.msgid.link/20260811040334.4184911-2-yangxingui@huawei.com Signed-off-by: Martin K. Petersen (Oracle) commit b9f679dfe629004b593f018df33b330d799bcee4 Author: Chandrakanth Patil Date: Sat Aug 8 20:40:10 2026 +0530 scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers _base_release_memory_pools() unconditionally frees every ioc->pcie_sg_lookup[] entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warning on debug kernels or a NULL pointer dereference otherwise. Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Reported-by: Laurence Oberman Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260808151010.185603-1-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 431e735e9bb6b7fd8e2ea9d83f0627bb5c5687ee Author: Nathan Chancellor Date: Tue Aug 11 14:39:51 2026 -0700 scsi: qla2xxx: Fix size_t format specifier in qla29xx_process_rd_image() After commit c3930ec119cb ("scsi: qla2xxx: Add FC operational firmware load for 29xx"), there is a warning due to an incorrect format specifier for a 'size_t' variable when building for 32-bit platforms, for which 'size_t' is 'unsigned int': drivers/scsi/qla2xxx/qla_init.c: In function 'qla29xx_process_rd_image': drivers/scsi/qla2xxx/qla_init.c:9272:74: error: format '%lx' expects argument of type 'long unsigned int', but argument 6 has type 'size_t' {aka 'unsigned int'} [-Werror=format=] 9272 | "TIM section too large (0x%x bytes, ring 0x%lx bytes).\n", | ~~^ | | | long unsigned int | %x 9273 | section_size, 9274 | req->length * qla_req_entry_size(ha)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | size_t {aka unsigned int} cc1: all warnings being treated as errors Use '%zx', the proper 'size_t' format specifier, to clear up the warning. Fixes: c3930ec119cb ("scsi: qla2xxx: Add FC operational firmware load for 29xx") Signed-off-by: Nathan Chancellor Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260811-scsi-qla2xxxx-qla_init-wformat-v1-1-50760021914f@kernel.org Signed-off-by: Martin K. Petersen (Oracle)