kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity

Merge patch series "scsi: qla2xxx: Bug fixes and hardening"

Browse source 
Nilesh Javali <njavali@marvell.com> says:

This series collects bug fixes, hardening, and small cleanups for the
qla2xxx driver that are independent of the QLA29xx adapter enablement.
Most were uncovered by static analysis and fuzzing of the driver's
interrupt, mailbox, NVMe, and BSG paths; 30 of the 33 patches carry a
Fixes: tag and are marked for stable.

The series is organised as follows:

Queue pairs, MSI-X, and interrupt setup/teardown
  Clamp MSI-X derived queue counts to avoid truncation, fix a
  use-after-free of qpair work on queue teardown, and quiesce the
  response IRQ before freeing the request queue.

Firmware dump, FCE trace, and flash/version paths
  Improve firmware dump data capture, serialize the flash version read in
  the reset handler, clarify the MPI optrom address/length units, fix FCE
  trace enable parsing in debugfs, and fix a use-after-free of the FCE
  trace during a firmware dump.

Probe and mailbox paths
  Fix the cs84xx use-after-free on host teardown, don't query firmware
  state while the chip is down, zero the mailbox struct in
  qla2x00_get_firmware_state(), and null out freed pointers in the
  qla2x00_mem_alloc() error path.

Response/status IOCB path
  Use memset_io() to clear the QLAFX00 request ring slot, fix response
  queue over-consumption in __qla_consume_iocb(), fix a soft lockup in
  the polling continuation IOCB signature, bound rsp_info_len to avoid an
  out-of-bounds sense-data read, avoid a req_q_map double-read in
  qla2x00_error_entry(), and reject non-SCSI SRBs on the status IOCB fast
  path.

NPIV and report-ID acquisition
  Clamp max_npiv_vports to the VP_CTRL bitmap capacity, avoid a double
  completion on async IOCB timeout, and correct vport
  handling in report ID acquisition (skip a vport under deletion, drop
  the vport reference under lock, and hold vport_slock for the host map
  update).

NVMe LS and abort handling
  Fix an abort reference leak on repeated abort, skip the NVMe LS reject
  IOCB when firmware is not started, unlink the unsolicited context
  before freeing on the LS reject error path, and serialize the
  unsolicited context list with a per-fcport lock.

BSG passthrough hardening
  Use a coherent DMA buffer for D_Port diagnostics, zero-init bsg stack
  buffers and the SFP DMA buffer to avoid information leaks, validate the
  BSG request_len before reading vendor_cmd[], and bound i2c->length in
  the I2C bsg handlers.

The final patch bumps the driver version to 12.00.00.2607b2.

The series applies on top of the qla2xxx QLA29xx series (v6, 56 patches)
on Linux 7.2-rc1.

Link: https://patch.msgid.link/20260730155838.2119230-1-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
This commit is contained in:
Martin K. Petersen (Oracle) 2026-08-07 10:33:34 -04:00
commit fe4464b706
17 changed files with 415 additions and 139 deletions
Download patch file Download diff file Expand all files Collapse all files