kernel/git/stable/linux.git/drivers/scsi/scsi_debug.c, branch master

Merge tag 'ata-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

2026-08-19T19:31:50+00:00

Pull ata updates from Damien Le Moal: - Some code cleanups to rename the function used to identify ZAC devices and declare some local functions static (me) - Refactoring and improvement of the translation of the SCSI REPORT SUPPORTED OPCODES command to allow users access to the entire list of supported commands (me) - Fix the translation of the WRITE SAME command with UNMAP bit set (DSM TRIM) for devices with a sector size larger than 2K and devices that support multiple TRIM segments (Niklas) - Add support detecting support for and translating the SCSI commands related to the storage elements depopulation feature (GET PHYSICAL ELEMENT STATUS, REMOVE ELEMENT AND TRUCATE, REMOVE ELEMENT AND MODIFY ZONES and RESTORE ELEMENTS AND REBUILD) (me) - Improvements to the sata_mv driver probe code (clocks and IRQ initialization) (Rosen) - Improve resource initialization in the pata_rb532_cf, pata_pxa, sata_highbank and ahci_da850 drivers (Rosen) - Improve PIO data-in command completions to better hndle slow devices, e.g. CF cards (Richard) - Improve the DMA channel management using device resources in the pata_pxa driver (Rosen) - Fix the pata_ep93xx driver to correctly fallback to PIO mode if DMA initialization fails (Rosen) - Use named initializers to define the match tables of the ahci_xgene, ahci_qoriq and ahci_platform drivers (Pawel) * tag 'ata-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: (28 commits) ata: use named initializers for acpi_device_id ata: pata_ep93xx: fix PIO fallback when DMA init fails ata: pata_pxa: use devres for DMA channel management ata: libata-sff: don't busy-wait for PIO data-in command completion ata: ahci_da850: use devm_platform_ioremap_resource() ata: sata_highbank: use devm_platform_ioremap_resource ata: pata_pxa: use devm_platform_ioremap_resource ata: pata_rb532_cf: use devm_platform_ioremap_resource() ata: sata_mv: use devm clock helpers ata: sata_mv: Use platform_get_irq() to get interrupt ata: pata_mpc52xx: Remove redundant dev_err() ata: libata-eh: make ata_eh_qc_complete() and ata_eh_qc_retry() static ata: libata-scsi: add support for the REMOVE ELEMENT AND MODIFY ZONES command ata: libata-scsi: add support for the RESTORE ELEMENTS AND REBUILD command ata: libata-scsi: add support for the REMOVE ELEMENT AND TRUNCATE command ata: libata-scsi: add support for the GET PHYSICAL ELEMENT STATUS command ata: libata-core: detect support for depopulation capabilities ata: libata-scsi: improve ata_get_xlat_func ata: libata: improve the definition of device flags scsi: define depopulation capabilities related service actions ...

scsi: scsi_debug: Negate wrapped memcmp() result

2026-08-07T16:14:19+00:00

comp_write_worker() returns true when the compared data matches. memcmp() returns zero for equal data and non-zero for different data, so its result must be negated before it is stored in a bool. The first segment already uses !memcmp(), but the wrapped segment uses memcmp() directly, reversing the match result. Use !memcmp() there as well. Fixes: 38d5c8336e60 ("scsi_debug: add Report supported opcodes+tmfs; Compare and write") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao Reviewed-by: John Garry Link: https://patch.msgid.link/E5AD42E9C0E18633+20260803095328.3445311-1-raoxu@uniontech.com Signed-off-by: Martin K. Petersen (Oracle)

scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

2026-07-29T01:52:08+00:00

resp_report_zones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc_len up with ALIGN() before deriving the descriptor count: rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD); arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1); For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to 0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which passes the !arr check, and desc = arr + 64 is then dereferenced in the loop -> out-of-bounds write / panic. Clamp rep_max_zones to devip->nr_zones. The loop already stops at sdebug_capacity (after nr_zones zones), so a report can never hold more than nr_zones descriptors; the clamp does not change the report, it only bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device property that can never reach 0x100000000. Fixes: 7db0e0c8190a ("scsi: scsi_debug: Fix buffer size of REPORT ZONES command") Suggested-by: Damien Le Moal Cc: stable@vger.kernel.org Signed-off-by: Ibrahim Hashimov Assisted-by: AuditCode-AI:2026.07 Reviewed-by: Damien Le Moal Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260712183739.83915-1-security@auditcode.ai Signed-off-by: Martin K. Petersen

scsi: scsi_debug: move ASC and ASCQ definitions to scsi_proto.h

2026-07-13T04:58:51+00:00

The scsi_debug driver internally defines lots of SCSI additional sense codes (ASC) and additional sense code qualifiers (ASCQ). Move these definitions to include/scsi/scsi_proto.h so that they can be reused elsewhere in the SCSI and ATA code. This also makes the scsi_debug.c file a little smaller. Signed-off-by: Damien Le Moal Reviewed-by: Martin K. Petersen

Merge branch 7.1/scsi-fixes into 7.2/scsi-staging

2026-06-16T01:01:30+00:00

Pull in outstanding commits from 7.1 branch. Signed-off-by: Martin K. Petersen

scsi: scsi_debug: Fix one-partition tape setup bounds

2026-06-08T20:37:42+00:00

The tape setup path uses one tape_block entry as the end-of-data marker after the usable tape blocks. For the one-partition layout, partition 0 uses all TAPE_UNITS data slots and partition 1's marker is written at tape_blocks[0] + TAPE_UNITS. Only TAPE_UNITS entries are allocated, so that marker write is one element past the allocation during device initialization before any command is issued. Allocate one extra tape_block entry for the marker. This keeps the existing partitioning paths unchanged while providing backing storage for the sentinel. Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius Reviewed-by: Kai Mäkisara Link: https://patch.msgid.link/20260604234724.1936118-1-sam.moelius@trailofbits.com Signed-off-by: Martin K. Petersen

scsi: scsi_debug: Remove unused variable sdebug_any_injecting_opt

2026-05-23T01:31:41+00:00

The static variable sdebug_any_injecting_opt is no longer read. Commit 3a90a63d02b8 ("scsi: scsi_debug: every_nth triggered error injection") removed all code that reads this variable. Hence, also remove this variable itself. Remove SDEBUG_OPT_ALL_INJECTING because there is no code left that uses this constant if sdebug_any_injecting_opt is removed. This has been detected by building the scsi_debug driver with the git HEAD version of Clang and with W=1. Signed-off-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/20260520171454.4035623-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen

scsi: scsi_debug: Add missing newline in scsi_debug_device_reset()

2026-05-23T01:29:35+00:00

A "\n" at the end of the sdev_printk() string appears to have been inadvertently removed. Add it back for correct log message formatting. Fixes: a743b120227a ("scsi: scsi_debug: Stop printing extra function name in debug logs") Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Ewan D. Milne Reviewed-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/20260519205356.1040855-1-emilne@redhat.com Signed-off-by: Martin K. Petersen

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-22T04:03:00+00:00

This converts some of the visually simpler cases that have been split over multiple lines. I only did the ones that are easy to verify the resulting diff by having just that final GFP_KERNEL argument on the next line. Somebody should probably do a proper coccinelle script for this, but for me the trivial script actually resulted in an assertion failure in the middle of the script. I probably had made it a bit _too_ trivial. So after fighting that far a while I decided to just do some of the syntactically simpler cases with variations of the previous 'sed' scripts. The more syntactically complex multi-line cases would mostly really want whitespace cleanup anyway. Signed-off-by: Linus Torvalds

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\