commit f07317a8d57f382ec505597816271dd72ffa20c7 Author: Nitin Rawat Date: Wed Sep 9 11:09:44 2026 +0530 scsi: ufs: ufs-qcom: Enable only lane clocks in lane clock APIs ufs_qcom_enable_lane_clks() and ufs_qcom_disable_lane_clks() currently use clk_bulk_prepare_enable()/clk_bulk_disable_unprepare() on the entire host->clks array obtained from devm_clk_bulk_get_all(). This array contains all device clocks, not just lane symbol clocks. Since the UFS core framework already manages the non-lane clocks via the setup_clocks callback, the bulk enable/disable in the lane clock APIs resulted in duplicate reference count increments on those shared clocks. The extra enable counts were never balanced by a corresponding disable from the framework's clock gating path, preventing the clock reference counts from reaching zero and ultimately blocking CXO shutdown during low-power states. Fix this by restricting the lane clock APIs to only prepare/enable and disable/unprepare the three lane symbol clocks (tx_lane0_sync_clk, rx_lane0_sync_clk, rx_lane1_sync_clk), leaving the handling of all other clocks to the UFS core framework. The lane clocks are now acquired individually via devm_clk_get() instead of being looked up in the bulk clock array. Signed-off-by: Nitin Rawat Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260909053944.2827968-1-nitin.rawat@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit 55ad5deeea922ea854086b70e41415f50e2987ea Author: Bean Huo Date: Mon Sep 7 21:21:40 2026 +0200 scsi: ufs: core: Report the current clock frequency to devfreq When a driver does not provide a ->get_cur_freq() callback, the cur_freq sysfs attribute shows devfreq->previous_freq, which only tracks the scaling that the governor itself did. The UFS controller is also scaled outside the governor. The clearest example is writing 0 to clkscale_enable: ufshcd_clkscale_enable_store() sets the clocks to max_freq through ufshcd_devfreq_scale() and suspends the governor, so devfreq_set_target() is never called. After that, cur_freq keeps showing the last frequency the governor chose instead of the one the controller runs at, and it does so as long as clock scaling stays disabled. Add ufshcd_devfreq_get_cur_freq(). It reports clk_scaling.target_freq when OPPs are used and the first clock's curr_freq otherwise, the same values that ufshcd_devfreq_get_dev_status() reports. Signed-off-by: Bean Huo Reviewed-by: Avri Altman Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260907192140.2701755-5-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen (Oracle) commit 20ae446921e78e4e0182cea7559d34d839550e66 Author: Bean Huo Date: Mon Sep 7 21:21:39 2026 +0200 scsi: ufs: core: Record the frequency the controller starts at ufshcd_init_clocks() puts the controller at its highest frequency, but nothing writes that down. clk_scaling.target_freq stays 0, and devfreq_dev_profile.initial_freq is never set, so devfreq->previous_freq is 0 as well. With use_pm_opp this shows up in a few places. The target_freq attribute reads 0 until the governor scales for the first time. ufshcd_devfreq_get_dev_status() reports 0 Hz, which makes the ondemand governor ask for the maximum frequency. ufshcd_devfreq_target() then sees 0 != max and runs a full ufshcd_devfreq_scale(), which holds up the queue for up to a second only to set the same OPP and the same gear again. Without OPPs the frequency is not reported as 0, but previous_freq is, and devfreq_update_status() then drops the first time_in_state update. Record the maximum frequency in ufshcd_devfreq_init() instead. ufshcd_add_lus() runs after ufshcd_probe_hba() has geared up to hba->max_pwr_info.info, so the clocks and the gear are both at their maximum by the time we get here. The only difference is that the first governor poll no longer redoes work that is already done. From the second poll on nothing changes, because target_freq held the maximum frequency there anyway. That first scale also re-applied the gear that ufshcd_vops_freq_to_gear_speed() maps the maximum frequency to, so it quietly corrected the link if the OPP table and the gear negotiated at probe disagreed. That does not happen any more. On ufs-qcom the two cannot disagree, because ufs_qcom_negotiate_pwr_mode() clamps the gear through ufshcd_negotiate_pwr_params() against the same controller capability the OPP table is written from. clki->max_freq is the right value in both modes. ufshcd_parse_clock_min_max_freq() fills it from the highest OPP, and ufshcd_clkscale_enable_store() already uses it the same way. Suggested-by: Stanley Jhu Signed-off-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260907192140.2701755-4-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen (Oracle) commit a09d77bcbe22db1a0b89f18d0a70074bb2453bc4 Author: Christoph Hellwig Date: Mon Aug 31 09:44:57 2026 +0300 scsi: scsi_debug: Add support to corrupt data and/or reftag Add a new debugfs file to inject corruptions of the data and/or reftag. This will be used to detect that protection information and/or file system checksumming can detect random bit errors or misplaced writes. To use this echo the start LBA, number of logical blocks and type of corruption into the new "corrupt" debugfs file for each scsi_debug device. For example: echo lba=42,num=1,bit_errors=2 > /sys/kernel/debug/scsi_debug/1:0:0:0/corrupt or echo lba=2,num=4,reftag_adjust=8 > /sys/kernel/debug/scsi_debug/1:0:0:0/corrupt The injection will be used by new xfstests test cases. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260831064500.2576832-2-hch@lst.de Signed-off-by: Martin K. Petersen (Oracle) commit 2ba1d12b2629827fdb1116eb3c9f8566911f2034 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:11 2026 +0530 scsi: mpi3mr: Fix NULL pointer dereference on PCI error recovery On a frozen PCI channel the driver unmaps the register window and frees the interrupts, but leaves the firmware event workqueue running. An event handler that is already in flight can still reach the register window after it has been unmapped. Stop event processing and drain the queue first, and start it again when the channel resumes. Fixes: 30bafe1774f0 ("scsi: mpi3mr: Support PCI Error Recovery callback handlers") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-18-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit c94c746e6c80439a4a9a0e1e20f2dae62a4d57ef Author: Chandrakanth Patil Date: Wed Aug 26 02:34:10 2026 +0530 scsi: mpi3mr: Fix use-after-free of the firmware event workqueue The enqueue path reads the workqueue pointer before taking the event lock, while the remove path clears that pointer and destroys the workqueue while holding it. The enqueue can therefore reach queue_work() after the workqueue is gone. Move the check inside the lock. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-17-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 052aea807cfbcefaf5b6ed8202f65da1fc65f4a0 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:09 2026 +0530 scsi: mpi3mr: zero out diagnostic buffer status memory Memory allocated for the BSG diagnostic buffer status is not zeroed before it is copied back to user space. Several fields in this structure are reserved and never written by the driver. Use kzalloc() instead of kmalloc() to zero out the allocated memory. Fixes: 78b506984ebe ("scsi: mpi3mr: Add ioctl support for HDB") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-16-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 7d572b4dc4ed0494e67097d4b7368666655f5c99 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:08 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read in PCIe topology change events The number of entries in a PCIe topology change event is used to walk the entry array without being compared against the amount of event data that was received. Bound the entry count to the received event data before use. Fixes: 8e653455547a ("scsi: mpi3mr: Add support for PCIe device event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-15-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 203b3072e7aa10d98b3f2b766693ea925cfc571d Author: Chandrakanth Patil Date: Wed Aug 26 02:34:07 2026 +0530 scsi: mpi3mr: Fix buffer overflow in the BSG target device map The size of the target device map buffer is held in a u16 while the number of devices it is derived from is not bounded to fit. With enough devices the size wraps, a short buffer is allocated, and the loop that fills it writes past the end. Do the calculation in size_t. Fixes: fb428a2005fc ("scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-14-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit f67caaa2521a3c8f931d1e679d831ba5ca654794 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:06 2026 +0530 scsi: mpi3mr: Fix out-of-bounds phy array access on link change The phy number that comes with a link change is used to index the node's phy array without being compared against the number of phys allocated for that node. Check it first. Fixes: 42fc9fee116f ("scsi: mpi3mr: Add helper functions to manage device's port") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-13-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 77554f01187d91c20f04d2a8e28270943ed64cca Author: Chandrakanth Patil Date: Wed Aug 26 02:34:05 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read of event data The event data length from the reply is used as is, both when caching log data and when sizing the buffer handed to the bottom half. A length larger than the frame makes both of them read past the end of it. Clamp the length to what the frame can hold. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Fixes: d0d19250ed81 ("scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-12-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9e220ce4bd0468e47cc9eea07e40799ebae6eda8 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:04 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read in SAS topology change events The number of entries in a SAS topology change event is used to walk the entry array without being compared against the amount of event data that was received, so the walk can run past the end of the buffer. Work out how many entries the payload can hold and skip the event if it claims more. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-11-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit a04b0f3a17e32aa449fd896163a7b40efc29c4f5 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:03 2026 +0530 scsi: mpi3mr: Fix target device reference leak in device removal handshake The device removal handshake looks up the target device to update its state but never drops the reference that the lookup takes. Drop it once the state has been updated. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-10-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 5dade59551d344d0308256edfef6bc3fb4202eb3 Author: Chandrakanth Patil Date: Wed Aug 26 02:34:02 2026 +0530 scsi: mpi3mr: Fix out-of-bounds bitmap access during device removal Device handles reported by the controller are used to index the remove pending bitmap and to build a task management request without being compared against the maximum handle the controller reported. Check the handle before using it. Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-9-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 7fea128f6b829ad834f21834d2605d28a45b903d Author: Chandrakanth Patil Date: Wed Aug 26 02:34:01 2026 +0530 scsi: mpi3mr: Fix out-of-bounds sense buffer access The sense buffer address reported on completion is turned into a virtual address with no range check, so an address outside the pool resolves to memory that does not belong to it. Check that it lies within the pool and is correctly aligned. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-8-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit bcf0a5bed59acd5ae19d80e1f617c1a5b355af0b Author: Chandrakanth Patil Date: Wed Aug 26 02:34:00 2026 +0530 scsi: mpi3mr: Fix out-of-bounds reply frame access The reply frame address reported on completion is only checked against the start and the end of the pool. An address near the top can pass the check while leaving less than a full frame, and an unaligned one resolves into the middle of a frame instead of the start of one. Require a whole frame to fit and the address to be frame aligned. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-7-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9ff1af19c488efad66f2b803eefa0abd5fdac8f4 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:59 2026 +0530 scsi: mpi3mr: Fix buffer overflow when caching log data Each log data slot holds a header followed by the payload, but the copy was sized against the whole slot and so wrote one header length past the end of it. Subtracting the header on its own is not enough either, because the entry size is derived from the controller reply size and can be smaller than the header. Work out the payload room first and clamp the copy to it. Fixes: 43ca11005098 ("scsi: mpi3mr: Add support for PEL commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-6-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit f0ec04bdf6156ed2ae7d86a8819dafdd9383b705 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:58 2026 +0530 scsi: mpi3mr: Fix target device reference leak in BSG task management The target device lookup takes a reference, but it is only dropped inside a branch that also requires the SCSI target data to be set up. When it is not, the reference is leaked. Drop the reference whenever the lookup succeeded. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-5-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 37e7d274272bc5e545e2d5f9261afa7f33f1cf49 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:57 2026 +0530 scsi: mpi3mr: Fix I/O block counter leak on admin request post failure The per device I/O block counter is raised before a task management request is posted and only lowered once the request completes. If the post itself fails the counter stays raised and I/O to that device remains blocked. Lower it on the failure path as well. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-4-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 9fac4cbd66d852958e8a8d0952eb57f8554ce83b Author: Chandrakanth Patil Date: Wed Aug 26 02:33:56 2026 +0530 scsi: mpi3mr: Fix out-of-bounds read when copying BSG MPI requests The MPI request is copied out of the caller supplied payload without first checking that the requested amount is actually present, so the copy can read past the end of the payload buffer. Check the range before copying. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-3-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 896abdd4d81f40575b05d593f7fe004935a6cf97 Author: Chandrakanth Patil Date: Wed Aug 26 02:33:55 2026 +0530 scsi: mpi3mr: Fix buffer overflow in BSG passthrough request copy The size of an incoming BSG request is checked using a variable that is narrower than the field it is read from, so large values wrap and pass the check. The copy that follows then uses the full value and writes past the request buffer. Widen the variable and copy only the amount that was checked. Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands") Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260825210411.301535-2-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 2cf34575b6498e909193222c3c2c940a2e3fbd8f Author: John Garry Date: Wed Sep 2 10:28:44 2026 +0100 scsi: scsi_debug: Default to a higher throughput config Currently the default config goes not give as high a throughput as some would like. Give a higher default throughput by modifying the following: - Set completion response delay as 0 - Increase shost can_queue to 4096, which aligns better with modern high-speed HBAs - Turn on clustering Signed-off-by: John Garry Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260902092844.1741533-1-john.garry@linux.dev Signed-off-by: Martin K. Petersen (Oracle) commit 657eff806d38abd73e0002cda070c4cf14eb9882 Author: Jorge Ramirez-Ortiz Date: Mon Aug 31 17:48:01 2026 +0200 scsi: ufs: rpmb: Use a fixed-length RPMB dev_id The RPMB authentication key is derived from the dev_id handed to the RPMB subsystem. OP-TEE implements the eMMC RPMB flow, where the dev_id is the eMMC CID: a fixed 16-byte value the key derivation depends on. The UFS RPMB id is "-R", which is variable length and longer than 16 bytes. Handing it to the RPMB subsystem as-is would tie the derived key to a length OP-TEE does not expect and diverge from the fixed-CID eMMC ABI, forcing OP-TEE to be taught about variable-length UFS ids. A fixed 16-byte dev_id is needed so the derived key stays stable and unique per region while matching the eMMC CID layout OP-TEE relies on, keeping the key-derivation ABI identical with no OP-TEE change. The reduction to a fixed 16 bytes must also be reproducible by the bootloaders (such as U-Boot) that derive the same dev_id. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260831154804.719528-3-jorge.ramirez@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit a8a34238e5e65609a434fc13aa1d64fcf2df1d23 Author: Jorge Ramirez-Ortiz Date: Mon Aug 31 17:48:00 2026 +0200 scsi: ufs: rpmb: Retry power-on UNIT ATTENTION on the RPMB WLUN After a power cycle, the first command sent to any UFS logical unit completes with CHECK CONDITION reporting a power-on UNIT ATTENTION. The SCSI core surfaces this condition to the caller rather than retrying it. For the RPMB well-known LU the first command after boot is the first RPMB frame, and RPMB has no earlier, guaranteed access that could clear the condition beforehand. The power-on UNIT ATTENTION therefore reaches RPMB and fails that first frame, breaking RPMB on every cold boot. The RPMB WLUN needs the power-on UNIT ATTENTION to be retried so that RPMB works from the very first access after a power cycle. Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bean Huo Reviewed-by: Stanley Jhu Link: https://patch.msgid.link/20260831154804.719528-2-jorge.ramirez@oss.qualcomm.com Signed-off-by: Martin K. Petersen (Oracle) commit 6b0f8a689ef3e84a9b2fc1a5753466dfbd566306 Author: Geert Uytterhoeven Date: Mon Aug 31 11:49:20 2026 +0200 scsi: zorro7xx: Use individual zorro_driver_data structures Using an array of zorro_driver_data objects and referring to its elements by index obfuscates the code and is error-prone. Improve readability and reduce code size by replacing the array (which includes an unneeded sentinel) by individual zorro_driver_data objects. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/7deafe83754415c5beb280f3c1808e153029e890.1788169600.git.geert@linux-m68k.org Signed-off-by: Martin K. Petersen (Oracle) commit e83b47309f73313e75c3888d7839666aba5b2b2a Author: John Garry Date: Mon Aug 31 09:58:21 2026 +0000 scsi: core: Drop Scsi_Host.default_lock Back in the 2.6.xx days, it was possible to for low-level drivers to set the shost lock pointer. That is why there is a default lock and a pointer to the shost lock. However, support for this has long been removed, so drop Scsi_Host.default_lock and make Scsi_Host.host_lock as the actual lock. Getting the address of embedded host_lock structure just requires adding a fixed offset value to the shost pointer. However, getting the value of the host_lock pointer requires loading from a fixed offset to the shost pointer. The latter should be very slightly slower, which is relevant as this lock is used a lot throughout the core code and drivers. Signed-off-by: John Garry Acked-by: Damien Le Moal # ata parts Reviewed-by: Hannes Reinecke Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260831095821.3486994-1-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen (Oracle) commit e64b8f3224add21f02c5d64e11371830e631cdba Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:37 2026 +0300 scsi: sym53c8xx_2: Replace __get_free_pages() with kmalloc() sym53c8xx_2 driver has an internal memory allocator for small allocations of the driver structures. The backing memory for that allocator is allocated with __get_free_pages(). This memory can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Performance difference between kmalloc() and __get_free_pages() is not measurable as both allocators take an object/page from a per-CPU list for fast path allocations. For the slow path the performance is anyway determined by the amount of reclaim involved rather than by what allocator is used. Replace use of __get_free_pages() with kmalloc() and free_pages() with kfree(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-4-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit 0abe3fb1c5056b7f2f99178b23db8aa95dd03f85 Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:36 2026 +0300 scsi: ipr: Use kmalloc() to allocate IPR dump buffer memory IPR dump machinery allocates memory to save adapter's crash dump using __get_free_page(). This memory can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). While on it, relax GFP_ATOMIC to GFP_NOIO for allocation of dump buffers. The allocations happen in a workqueue context, but with storage adapter being in a state where it can't handle I/O. Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Tested-by: Wen Xiong Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-3-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit b4fe0d7d41eacf3c2ffa54eef3e5e93ac8777518 Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:35 2026 +0300 scsi: proc: Use kmalloc() in proc writers proc_scsi_host_write(), proc_scsi_write() and proc_scsi_devinfo_write() allocate temporary buffers for /proc writes using __get_free_page(). These buffers can be allocated with kmalloc() as there's nothing special about them to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Reviewed-by: John Garry Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-2-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit f07ed527235c44e0aae53100133bb547f5ee448f Author: Mike Rapoport (Microsoft) Date: Sat Jul 4 09:13:34 2026 +0300 scsi: target: file: Use kmalloc() to allocate temporary protection buffer fd_do_prot_unmap() uses __get_free_page() to allocate a temporary buffer that is used to invalidate protection info for the unmapped region by filling with 0xff pattern. This buffer can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Replace use of __get_free_page() with kmalloc(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Hannes Reinecke Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260704-b4-scsi-v2-1-7d2d21a810de@kernel.org Signed-off-by: Martin K. Petersen (Oracle)