Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
36 commits
Select commit Hold shift + click to select a range
16da547
scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
PlaidCat Jan 30, 2026
30955c6
scsi: lpfc: Fill in missing ndlp kref puts in error paths
PlaidCat Jan 30, 2026
c0ae399
scsi: lpfc: Move scsi_host_template outside dynamically allocated/fre…
PlaidCat Jan 30, 2026
d0563f1
scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused by lpf…
PlaidCat Jan 30, 2026
af46398
scsi: lpfc: Revise NPIV ELS unsol rcv cmpl logic to drop ndlp based o…
PlaidCat Jan 30, 2026
89130af
scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop t…
PlaidCat Jan 30, 2026
d830aed
scsi: lpfc: Validate ELS LS_ACC completion payload
PlaidCat Jan 30, 2026
de25704
scsi: lpfc: Fix possible file string name overflow when updating firm…
PlaidCat Jan 30, 2026
552862d
scsi: lpfc: Fix list_entry null check warning in lpfc_cmpl_els_plogi()
PlaidCat Jan 30, 2026
b5aba3b
scsi: lpfc: Allow lpfc_plogi_confirm_nport() logic to execute for Fab…
PlaidCat Jan 30, 2026
d6ccc1b
scsi: lpfc: Remove NLP_RCV_PLOGI early return during RSCN processing …
PlaidCat Jan 30, 2026
cb2dfce
scsi: lpfc: Add condition to delete ndlp object after sending BLS_RJT…
PlaidCat Jan 30, 2026
904e096
scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss c…
PlaidCat Jan 30, 2026
bb41411
scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attac…
PlaidCat Jan 30, 2026
c4136c4
scsi: lpfc: Update PRLO handling in direct attached topology
PlaidCat Jan 30, 2026
1dc2927
scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler
PlaidCat Jan 30, 2026
24f7ce2
scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV …
PlaidCat Jan 30, 2026
5d32dd3
scsi: lpfc: Check devloss callbk done flag for potential stale NDLP ptrs
PlaidCat Jan 30, 2026
4a313a8
scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo ca…
PlaidCat Jan 30, 2026
8bccea8
scsi: lpfc: Delete NLP_TARGET_REMOVE flag due to obsolete usage
PlaidCat Jan 30, 2026
0c5bf21
scsi: lpfc: Modify handling of ADISC based on ndlp state and RPI regi…
PlaidCat Jan 30, 2026
c2d6e54
scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk
PlaidCat Jan 30, 2026
817cdca
scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
PlaidCat Jan 30, 2026
a47fcd8
scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 comm…
PlaidCat Jan 30, 2026
dcf8041
scsi: lpfc: Prevent failure to reregister with NVMe transport after P…
PlaidCat Jan 30, 2026
9f3d066
scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk
PlaidCat Jan 30, 2026
f94d0ec
scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI
PlaidCat Jan 30, 2026
baf2060
vsock: Ignore signal/timeout on connect() if already established
PlaidCat Jan 30, 2026
0b71d77
NFSv4: Check for delegation validity in nfs_start_delegation_return_l…
PlaidCat Jan 30, 2026
24fe6ab
x86/xen/time: Output xen sched_clock time from 0
PlaidCat Jan 30, 2026
6937f56
xen: Fix x86 sched_clock() interface for xen
PlaidCat Jan 30, 2026
2bcf8e3
xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32
PlaidCat Jan 30, 2026
16d6e3b
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
PlaidCat Jan 30, 2026
1d33b86
Bluetooth: hci_event: call disconnect callback before deleting conn
PlaidCat Jan 30, 2026
b4217a1
ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
PlaidCat Jan 30, 2026
2c03cea
Rebuild rocky8_10 with kernel-4.18.0-553.97.1.el8_10
PlaidCat Jan 30, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile.rhelver
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ RHEL_MINOR = 10
#
# Use this spot to avoid future merge conflicts.
# Do not trim this comment.
RHEL_RELEASE = 553.94.1
RHEL_RELEASE = 553.97.1

#
# ZSTREAM
Expand Down
6 changes: 6 additions & 0 deletions arch/x86/xen/smp_hvm.c
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,12 @@ static void __init xen_hvm_smp_prepare_boot_cpu(void)
*/
xen_vcpu_setup(0);

/*
* Called again in case the kernel boots on vcpu >= MAX_VIRT_CPUS.
* Refer to comments in xen_hvm_init_time_ops().
*/
xen_hvm_init_time_ops();

/*
* The alternative logic (which patches the unlock/lock) runs before
* the smp bootup up code is activated. Hence we need to set this up
Expand Down
48 changes: 42 additions & 6 deletions arch/x86/xen/time.c
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@
/* Xen may fire a timer up to this many ns early */
#define TIMER_SLOP 100000

static u64 xen_sched_clock_offset __read_mostly;

/* Get the TSC speed from Xen */
static unsigned long xen_tsc_khz(void)
{
Expand All @@ -57,6 +59,11 @@ static u64 xen_clocksource_get_cycles(struct clocksource *cs)
return xen_clocksource_read();
}

static u64 xen_sched_clock(void)
{
return xen_clocksource_read() - xen_sched_clock_offset;
}

static void xen_read_wallclock(struct timespec64 *ts)
{
struct shared_info *s = HYPERVISOR_shared_info;
Expand Down Expand Up @@ -361,8 +368,6 @@ void xen_timer_resume(void)
{
int cpu;

pvclock_resume();

if (xen_clockevent != &xen_vcpuop_clockevent)
return;

Expand All @@ -374,17 +379,20 @@ void xen_timer_resume(void)
}

static const struct pv_time_ops xen_time_ops __initconst = {
.sched_clock = xen_clocksource_read,
.sched_clock = xen_sched_clock,
.steal_clock = xen_steal_clock,
};

static struct pvclock_vsyscall_time_info *xen_clock __read_mostly;
static u64 xen_clock_value_saved;

void xen_save_time_memory_area(void)
{
struct vcpu_register_time_memory_area t;
int ret;

xen_clock_value_saved = xen_clocksource_read() - xen_sched_clock_offset;

if (!xen_clock)
return;

Expand All @@ -404,7 +412,7 @@ void xen_restore_time_memory_area(void)
int ret;

if (!xen_clock)
return;
goto out;

t.addr.v = &xen_clock->pvti;

Expand All @@ -422,6 +430,11 @@ void xen_restore_time_memory_area(void)
if (ret != 0)
pr_notice("Cannot restore secondary vcpu_time_info (err %d)",
ret);

out:
/* Need pvclock_resume() before using xen_clocksource_read(). */
pvclock_resume();
xen_sched_clock_offset = xen_clocksource_read() - xen_clock_value_saved;
}

static void xen_setup_vsyscall_time_info(void)
Expand Down Expand Up @@ -513,6 +526,7 @@ static void __init xen_time_init(void)

void __ref xen_init_time_ops(void)
{
xen_sched_clock_offset = xen_clocksource_read();
pv_time_ops = xen_time_ops;

x86_init.timers.timer_init = xen_time_init;
Expand Down Expand Up @@ -541,6 +555,11 @@ static void xen_hvm_setup_cpu_clockevents(void)

void __init xen_hvm_init_time_ops(void)
{
static bool hvm_time_initialized;

if (hvm_time_initialized)
return;

/*
* vector callback is needed otherwise we cannot receive interrupts
* on cpu > 0 and at this point we don't know how many cpus are
Expand All @@ -550,17 +569,34 @@ void __init xen_hvm_init_time_ops(void)
return;

if (!xen_feature(XENFEAT_hvm_safe_pvclock)) {
printk(KERN_INFO "Xen doesn't support pvclock on HVM,"
"disable pv timer\n");
pr_info_once("Xen doesn't support pvclock on HVM, disable pv timer");
return;
}

/*
* Only MAX_VIRT_CPUS 'vcpu_info' are embedded inside 'shared_info'.
* The __this_cpu_read(xen_vcpu) is still NULL when Xen HVM guest
* boots on vcpu >= MAX_VIRT_CPUS (e.g., kexec), To access
* __this_cpu_read(xen_vcpu) via xen_clocksource_read() will panic.
*
* The xen_hvm_init_time_ops() should be called again later after
* __this_cpu_read(xen_vcpu) is available.
*/
if (!__this_cpu_read(xen_vcpu)) {
pr_info("Delay xen_init_time_common() as kernel is running on vcpu=%d\n",
xen_vcpu_nr(0));
return;
}

xen_sched_clock_offset = xen_clocksource_read();
pv_time_ops = xen_time_ops;
x86_init.timers.setup_percpu_clockev = xen_time_init;
x86_cpuinit.setup_percpu_clockev = xen_hvm_setup_cpu_clockevents;

x86_platform.calibrate_tsc = xen_tsc_khz;
x86_platform.get_wallclock = xen_get_wallclock;
x86_platform.set_wallclock = xen_set_wallclock;

hvm_time_initialized = true;
}
#endif
63 changes: 63 additions & 0 deletions ciq/ciq_backports/kernel-4.18.0-553.97.1.el8_10/05ae6c9c.failed
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands

jira KERNEL-548
Rebuild_History Non-Buildable kernel-4.18.0-553.97.1.el8_10
commit-author Justin Tee <justin.tee@broadcom.com>
commit 05ae6c9c7315d844fbc15afe393f5ba5e5771126
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-4.18.0-553.97.1.el8_10/05ae6c9c.failed

In lpfc_check_sli_ndlp(), the get_job_els_rsp64_did remote_id assignment
does not apply for GEN_REQUEST64 commands as it only has meaning for a
ELS_REQUEST64 command. So, if (iocb->ndlp == ndlp) is false, we could
erroneously return the wrong value. Fix by replacing the fallthrough
statement with a break statement before the remote_id check.

Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Link: https://lore.kernel.org/r/20250425194806.3585-2-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 05ae6c9c7315d844fbc15afe393f5ba5e5771126)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>

# Conflicts:
# drivers/scsi/lpfc/lpfc_hbadisc.c
diff --cc drivers/scsi/lpfc/lpfc_hbadisc.c
index 0c20ab745390,b5273cb1adbd..000000000000
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@@ -5211,20 -5044,23 +5211,24 @@@ lpfc_check_sli_ndlp(struct lpfc_hba *ph
if (iocb->vport != vport)
return 0;

- ulp_command = get_job_cmnd(phba, iocb);
- ulp_context = get_job_ulpcontext(phba, iocb);
- remote_id = get_job_els_rsp64_did(phba, iocb);
-
if (pring->ringno == LPFC_ELS_RING) {
- switch (ulp_command) {
+ switch (icmd->ulpCommand) {
case CMD_GEN_REQUEST64_CR:
- if (iocb->ndlp == ndlp)
+ if (iocb->context_un.ndlp == ndlp)
return 1;
++<<<<<<< HEAD
+ /* fall through */
++=======
+ break;
++>>>>>>> 05ae6c9c7315 (scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands)
case CMD_ELS_REQUEST64_CR:
- if (remote_id == ndlp->nlp_DID)
+ if (icmd->un.elsreq64.remoteID == ndlp->nlp_DID)
return 1;
- fallthrough;
+ /* fall through */
case CMD_XMIT_ELS_RSP64_CX:
- if (iocb->ndlp == ndlp)
+ if (iocb->context1 == (uint8_t *) ndlp)
return 1;
+ /* fall through */
}
} else if (pring->ringno == LPFC_FCP_RING) {
/* Skip match check if waiting to relogin to FCP target */
* Unmerged path drivers/scsi/lpfc/lpfc_hbadisc.c
135 changes: 135 additions & 0 deletions ciq/ciq_backports/kernel-4.18.0-553.97.1.el8_10/07caedc6.failed
Original file line number Diff line number Diff line change
@@ -0,0 +1,135 @@
scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI

jira KERNEL-548
Rebuild_History Non-Buildable kernel-4.18.0-553.97.1.el8_10
commit-author Justin Tee <justin.tee@broadcom.com>
commit 07caedc6a3887938813727beafea40f07c497705
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-4.18.0-553.97.1.el8_10/07caedc6.failed

It's possible for an unstable link to repeatedly bounce allowing a FLOGI
retry, but then bounce again forcing an abort of the FLOGI. Ensure that
the initial reference count on the FLOGI ndlp is restored in this faulty
link scenario.

Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Link: https://patch.msgid.link/20251106224639.139176-8-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 07caedc6a3887938813727beafea40f07c497705)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>

# Conflicts:
# drivers/scsi/lpfc/lpfc_els.c
# drivers/scsi/lpfc/lpfc_hbadisc.c
diff --cc drivers/scsi/lpfc/lpfc_els.c
index 5c9369b9b870,0045c1e29619..000000000000
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@@ -1061,15 -995,15 +1066,24 @@@ lpfc_cmpl_els_flogi(struct lpfc_hba *ph

stop_rr_fcf_flogi:
/* FLOGI failure */
- if (!(ulp_status == IOSTAT_LOCAL_REJECT &&
- ((ulp_word4 & IOERR_PARAM_MASK) ==
+ if (!(irsp->ulpStatus == IOSTAT_LOCAL_REJECT &&
+ ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) ==
IOERR_LOOP_OPEN_FAILURE)))
++<<<<<<< HEAD
+ lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
+ "2858 FLOGI failure Status:x%x/x%x TMO"
+ ":x%x Data x%x x%x\n",
+ irsp->ulpStatus, irsp->un.ulpWord[4],
+ irsp->ulpTimeout, phba->hba_flag,
+ phba->fcf.fcf_flag);
++=======
+ lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+ "2858 FLOGI Status:x%x/x%x TMO"
+ ":x%x Data x%lx x%x x%lx x%x\n",
+ ulp_status, ulp_word4, tmo,
+ phba->hba_flag, phba->fcf.fcf_flag,
+ ndlp->nlp_flag, ndlp->fc4_xpt_flags);
++>>>>>>> 07caedc6a388 (scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI)

/* Check for retry */
if (lpfc_els_retry(phba, cmdiocb, rspiocb)) {
@@@ -1086,28 -1020,35 +1100,43 @@@
* registered with the SCSI transport, remove the initial
* reference to trigger node release.
*/
++<<<<<<< HEAD
+ if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS) &&
+ !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD))
++=======
+ if (!test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag) &&
+ !test_bit(NLP_DROPPED, &ndlp->nlp_flag) &&
+ !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) {
+ set_bit(NLP_DROPPED, &ndlp->nlp_flag);
++>>>>>>> 07caedc6a388 (scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI)
lpfc_nlp_put(ndlp);
+ }

lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS,
++<<<<<<< HEAD
+ "0150 FLOGI failure Status:x%x/x%x "
+ "xri x%x TMO:x%x refcnt %d\n",
+ irsp->ulpStatus, irsp->un.ulpWord[4],
+ cmdiocb->sli4_xritag, irsp->ulpTimeout,
+ kref_read(&ndlp->kref));
++=======
+ "0150 FLOGI Status:x%x/x%x "
+ "xri x%x iotag x%x TMO:x%x refcnt %d\n",
+ ulp_status, ulp_word4, cmdiocb->sli4_xritag,
+ cmdiocb->iotag, tmo, kref_read(&ndlp->kref));
++>>>>>>> 07caedc6a388 (scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI)

/* If this is not a loop open failure, bail out */
- if (!(ulp_status == IOSTAT_LOCAL_REJECT &&
- ((ulp_word4 & IOERR_PARAM_MASK) ==
- IOERR_LOOP_OPEN_FAILURE))) {
- /* Warn FLOGI status */
- lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
- "0100 FLOGI Status:x%x/x%x "
- "TMO:x%x\n",
- ulp_status, ulp_word4, tmo);
+ if (!(irsp->ulpStatus == IOSTAT_LOCAL_REJECT &&
+ ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) ==
+ IOERR_LOOP_OPEN_FAILURE)))
goto flogifail;
- }

/* FLOGI failed, so there is no fabric */
- clear_bit(FC_FABRIC, &vport->fc_flag);
- clear_bit(FC_PUBLIC_LOOP, &vport->fc_flag);
- clear_bit(FC_PT2PT_NO_NVME, &vport->fc_flag);
+ spin_lock_irq(shost->host_lock);
+ vport->fc_flag &= ~(FC_FABRIC | FC_PUBLIC_LOOP |
+ FC_PT2PT_NO_NVME);
+ spin_unlock_irq(shost->host_lock);

/* If private loop, then allow max outstanding els to be
* LPFC_MAX_DISC_THREADS (32). Scanning in the case of no
diff --cc drivers/scsi/lpfc/lpfc_hbadisc.c
index 2be2e893f962,717ae56c8e4b..000000000000
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@@ -415,12 -423,8 +415,17 @@@ voi
lpfc_check_nlp_post_devloss(struct lpfc_vport *vport,
struct lpfc_nodelist *ndlp)
{
++<<<<<<< HEAD
+ unsigned long iflags;
+
+ spin_lock_irqsave(&ndlp->lock, iflags);
+ if (ndlp->save_flags & NLP_IN_RECOV_POST_DEV_LOSS) {
+ ndlp->save_flags &= ~NLP_IN_RECOV_POST_DEV_LOSS;
+ spin_unlock_irqrestore(&ndlp->lock, iflags);
++=======
+ if (test_and_clear_bit(NLP_IN_RECOV_POST_DEV_LOSS, &ndlp->save_flags)) {
+ clear_bit(NLP_DROPPED, &ndlp->nlp_flag);
++>>>>>>> 07caedc6a388 (scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI)
lpfc_nlp_get(ndlp);
lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY | LOG_NODE,
"8438 Devloss timeout reversed on DID x%x "
* Unmerged path drivers/scsi/lpfc/lpfc_els.c
* Unmerged path drivers/scsi/lpfc/lpfc_hbadisc.c
Loading