Daily update · Aug 29–30, 2026
SCSI update: UFS busy-loop fix, mpt3sas NULL deref, libsas rediscover improvements, and compile-time lock checking for SCSI core
Today's mainline SCSI pull fixes a UFS core CPU-wasting busy loop, a mpt3sas crash on partial allocation failure, and several LeapRAID mmap races, while also introducing device-flutter detection in libsas and enabling compiler-based lock context analysis across SCSI core.
In brief
The SCSI subsystem received a mix of real bug fixes and infrastructure hardening. Notable fixes address a UFS core busy loop that wasted CPU, a mpt3sas NULL pointer dereference or bad-DMA warning on partial allocation failure, and multiple LeapRAID firmware-log mmap races that could free buffers still mapped by userspace. On the infrastructure side, a series of commits enables compile-time lock context analysis for SCSI core files, and libsas gains improved detection of device flutter and replacement during rediscovery.
Bug fixes
UFS core: fix busy loop in ufshcd_wait_for_pending_cmds()
io_schedule_timeout() requires the task state to be set to TASK_UNINTERRUPTIBLE first; without it, the task remains TASK_RUNNING and the function returns immediately, causing a busy loop that wastes CPU cycles while waiting for pending commands.
Why it matters: Fixes a CPU-wasting busy loop in the UFS host controller driver's command-wait path.
mpt3sas: avoid freeing unallocated PCIe SGL buffers
_base_release_memory_pools() unconditionally freed every ioc->pcie_sg_lookup[] entry, including ones never allocated after a partial setup failure. This caused a 'bad dma' warning on debug kernels or a NULL pointer dereference otherwise.
Why it matters: Prevents a crash or DMA warning on Broadcom mpt3sas controllers when memory pool setup partially fails.
LeapRAID: serialize firmware-log mmap with teardown and balance host references
Two related fixes address races in LeapRAID's firmware-log mmap path. One ensures a temporary mmap reference is claimed before the VMA open callback runs, preventing removal from freeing the coherent buffer while a mapping is still being established. The other balances Scsi_Host references across VMA open/close so that cloning a mapping cannot prematurely release the host while another VMA still refers to the adapter.
Why it matters: Fixes use-after-free and premature host-release races in LeapRAID's userspace firmware-log mapping path.
ibmvfc: fix use of uninitialized rport in ibmvfc_do_work()
A copy-paste accidentally included an unnecessary check for 'rport' in a code block where the variable was uninitialized, triggering a clang warning or error with CONFIG_WERROR=y. The check was removed.
Why it matters: Clears a compiler warning/error; no runtime impact since the check was unreachable in context.
snic: fix SCSI host leak on workqueue allocation failure
If scsi_add_host() succeeded but alloc_ordered_workqueue() failed, snic_add_host() returned -ENOMEM with shost->work_q NULL. The error path then skipped scsi_remove_host(), leaving a zombie host in sysfs, permanently shifting host numbering and leaking memory.
Why it matters: Prevents a Scsi_Host leak and host-number shift when snic probe fails at workqueue allocation.
qla2xxx: fix loop timeout test, format specifier, and error code
Three small fixes: a loop timeout test checked for retries == 0 instead of -1; a size_t format specifier used %lx instead of the correct %zx on 32-bit builds; and qla_get_tmf() returned positive EIO instead of negative -EIO (no runtime impact, cleanup only).
Why it matters: Fixes a real timeout-test bug and a 32-bit build error in the qla2xxx Fibre Channel driver.
libsas: improve flutter and device-replace detection during rediscovery
Introduces sas_dev_is_flutter() and sas_rediscover_ex_phy() to better detect device flutter and replacement during SAS expander rediscovery. The new sas_ex_phy_to_dev() helper returns any device type attached to an expander PHY. Validation for linkrate and SAS-address changes is added, with SAS-address checked before linkrate so the old device can be properly unregistered when its address changes.
Why it matters: Improves hot-swap and device-replacement reliability for SAS expander topologies.
Infrastructure and hardening
SCSI core: enable compile-time lock context analysis
A series of commits annotates SCSI core functions with lock context requirements (e.g., __must_hold(&shost->scan_mutex)), protects all SCSI host state changes with the host lock to silence KCSAN data-race reports, passes the SCSI host pointer directly to scanning functions to simplify annotations, and enables context analysis in the build system for files that pass cleanly.
Why it matters: Catches locking bugs at compile time rather than runtime; fixes KCSAN-reported data races on SCSI host state.
e70647b25a6409982efcc07e4c461ee2b2a5fb0fc67db962d34a88f53a7aff5d552022b3
lpfc: replace deprecated strlcat() with seq_buf and sysfs_emit_at()
Multiple commits replace strlcat() usage across lpfc's info strings, debugfs helpers, and sysfs show functions with seq_buf, scnprintf, and sysfs_emit_at() as appropriate, in preparation for removing the strlcat() API entirely.
Why it matters: No functional change to output; modernizes buffer handling and closes a format-string injection vector from adapter VPD data.
5a03dbfd670007f46a9f896422d4cbf6f7504832a60e0a7836b6dcb2b746
LeapRAID: standardize NCQ priority sysfs attributes
Replaces the earlier ncq_cmd_prio_enable attribute with the standard sas_ncq_prio_supported and sas_ncq_prio_enable names documented in sysfs-block-device, since the old name was never part of a released userspace ABI.
Why it matters: Aligns LeapRAID with standard SAS NCQ priority sysfs interface; no compatibility break since the old name was unreleased.
Source commits26 entries +
scsi: snic: Fix SCSI host leak on workqueue allocation failure
Chen Changcheng · Jul 27, 2026 · 1 files
scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info()
Ian Bridges · Jul 29, 2026 · 1 files
scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name()
Ian Bridges · Jul 29, 2026 · 1 files
scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report()
Ian Bridges · Jul 29, 2026 · 1 files
scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers
Ian Bridges · Jul 29, 2026 · 1 files
scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions
Ian Bridges · Jul 29, 2026 · 2 files
scsi: ufs: core: Set task state before io_schedule_timeout()
Bart Van Assche · Aug 7, 2026 · 1 files
scsi: ufs: core: Enable context analysis
Bart Van Assche · Aug 7, 2026 · 4 files
scsi: core: Pass the SCSI host pointer directly to scanning functions
Bart Van Assche · Aug 7, 2026 · 1 files
scsi: core: Add lock context annotations
Bart Van Assche · Aug 7, 2026 · 1 files
scsi: core: Protect host state changes with the host lock
Bart Van Assche · Aug 7, 2026 · 10 files
scsi: core: Enable context analysis
Bart Van Assche · Aug 7, 2026 · 2 files
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
Chandrakanth Patil · Aug 8, 2026 · 1 files
scsi: libsas: Add sas_ex_phy_to_dev() helper
Xingui Yang · Aug 11, 2026 · 2 files
scsi: libsas: Add linkrate and sas_addr change detection in rediscover
Xingui Yang · Aug 11, 2026 · 1 files
scsi: qla2xxx: Fix size_t format specifier in qla29xx_process_rd_image()
Nathan Chancellor · Aug 11, 2026 · 1 files
scsi: qla2xxx: Fix an error code in qla_get_tmf()
Dan Carpenter · Aug 13, 2026 · 1 files
scsi: lpfc: Remove unnnecessary NULL check
Dan Carpenter · Aug 13, 2026 · 1 files
scsi: qla2xxx: Fix an loop timeout test
Dan Carpenter · Aug 13, 2026 · 1 files
scsi: leapraid: Balance host references for firmware log VMAs
Linmao Li · Aug 14, 2026 · 1 files
scsi: leapraid: Serialize firmware log mmap with teardown
Linmao Li · Aug 14, 2026 · 1 files
scsi: leapraid: Standardize NCQ priority sysfs attributes
Dongdong Hao · Aug 14, 2026 · 3 files
scsi: core: Enable context analysis for hosts.o
Bart Van Assche · Aug 14, 2026 · 1 files
scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work()
Nathan Chancellor · Aug 17, 2026 · 1 files
scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers
Finn Thain · Aug 18, 2026 · 1 files
scsi: MAINTAINERS: Update my email address
Martin K. Petersen (Oracle) · Aug 24, 2026 · 2 files