SCSI fixes on 20260522

Small fixes, two in drivers and the remaining a sign conversion probem in sd
 with no user visible consequences (non-zero is error).
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCahCGHxsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
 c2hpcC5jb20ACgkQ50LJTO6YrIX6/wD8DDul4OL9k/6NvnhX93V4yt5yEVUKwyLi
 71sI1y8Y9UIA/R+0OPRjl6z4KOZaMPZqLIQFLOAweVsHpXAQ20IrPcuU
 =7Y5a
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Small fixes, two in drivers and the remaining a sign conversion probem
  in sd with no user visible consequences (non-zero is error)"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: target: tcm_loop: Fix NULL ptr dereference
  scsi: isci: Fix use-after-free in device removal path
  scsi: sd: Fix return code handling in sd_spinup_disk()
master
Linus Torvalds 2026-05-22 16:08:06 -07:00
commit 0e6582a516
3 changed files with 14 additions and 4 deletions

View File

@ -1252,6 +1252,9 @@ void isci_host_deinit(struct isci_host *ihost)
wait_for_stop(ihost);
/* No further IRQ-driven scheduling can happen past wait_for_stop(). */
tasklet_kill(&ihost->completion_tasklet);
/* phy stop is after controller stop to allow port and device to
* go idle before shutting down the phys, but the expectation is
* that i/o has been shut off well before we reach this

View File

@ -2476,8 +2476,7 @@ sd_spinup_disk(struct scsi_disk *sdkp)
{
static const u8 cmd[10] = { TEST_UNIT_READY };
unsigned long spintime_expire = 0;
int spintime, sense_valid = 0;
unsigned int the_result;
int the_result, spintime, sense_valid = 0;
struct scsi_sense_hdr sshdr;
struct scsi_failure failure_defs[] = {
/* Do not retry Medium Not Present */

View File

@ -393,6 +393,7 @@ static int tcm_loop_driver_probe(struct device *dev)
if (error) {
pr_err("%s: scsi_add_host failed\n", __func__);
scsi_host_put(sh);
tl_hba->sh = NULL;
return -ENODEV;
}
return 0;
@ -406,8 +407,10 @@ static void tcm_loop_driver_remove(struct device *dev)
tl_hba = to_tcm_loop_hba(dev);
sh = tl_hba->sh;
scsi_remove_host(sh);
scsi_host_put(sh);
if (sh) {
scsi_remove_host(sh);
scsi_host_put(sh);
}
}
static void tcm_loop_release_adapter(struct device *dev)
@ -436,6 +439,11 @@ static int tcm_loop_setup_hba_bus(struct tcm_loop_hba *tl_hba, int tcm_loop_host
return -ENODEV;
}
if (!tl_hba->sh) {
device_unregister(&tl_hba->dev);
return -ENODEV;
}
return 0;
}