Use the existing kzalloc_obj and kzalloc_objs helpers for PR abort state,
copy-manager list IDs, WRITE SAME state, latency statistics and UNMAP
fixtures. Drop the redundant default GFP_KERNEL argument in the ordering
fixture.
For single objects, the helper derives the allocation size from the
object expression. For arrays, keep the element count and checked
multiplication provided by the shared compatibility helper. Preserve
zeroing and explicit allocation flags, including the GFP_ATOMIC path.
These are allocation cleanups carried over from the historical analyzer
series; they do not fix an observed report-mode diagnostic in the
current Coccinelle run. No allocator model or exclusion is introduced.
Coccinelle free/ifnullfree.cocci reports:
scst/src/scst_lib.c:15441:2-7:
WARNING: NULL check before some freeing functions is not needed.
Remove the redundant guard around vfree(buf) in scst_copy_file and the
same guard around vfree(mem_verify) in vdev_verify. Both pointers may be
NULL on cleanup paths, which vfree accepts throughout the supported
kernel range.
Leave the NULL guards in backport.h intact: they protect older teardown
APIs whose NULL handling differs, rather than these vfree calls.
Coccinelle api/err_cast.cocci reports:
scst/src/scst_lib.c:8710:8-15:
WARNING: ERR_CAST can be used with bw
blk_copy_kern_sg returns an error pointer on failure. Its caller,
blk_map_kern_sg, converts that value to an integer with PTR_ERR and
immediately back to a pointer with ERR_PTR.
Assign ERR_CAST(bw) to rq instead. It expresses propagation of the same
error pointer to the request-pointer return type without the redundant
pointer-to-integer round trip.
Coccinelle reports "parse error" at declarations using compl, including
this fragment of struct scst_lksb in scst/include/scst.h:
BAD:!!!!! struct completion compl;
The parser treats compl as the C++ complement operator even in these C
files. Rename the DLM and SRPT fields and the local target variable to
completion. Update their init, wait and signal sites, as well as the
SRPT field documentation.
This removes the conflicting identifier without adding a parser model.
Types, structure layout and completion lifetimes remain unchanged.
Other unsupported macros can still cause independent parser failures.
Coccinelle emits "parse error" while recovering from BIO callbacks whose
opening braces occur separately in the two signature branches. The raw
log includes this fragment of scst/src/dev_handlers/scst_vdisk_main.c:
bad: static void vdev_flush_end_io(struct bio *bio, int error)
bad: {
bad: #else
Move the opening brace below the signature conditional in
vdev_flush_end_io, blockio_end_sync_io, blockio_endio and
blk_bio_map_kern_endio. Keep version-specific local error extraction
inside its existing compatibility condition.
Also bracket the conditional max_nr_vecs assignment in blockio_exec_rw
and the sendpage fast path in write_data. Initialize the legacy
sock_no_sendpage fallback before the fast path so an else no longer
appears in only one preprocessor branch.
These changes address parser failures, not runtime warnings. All kernel
compatibility conditions are retained. Preprocessed token comparisons
covering 56 kernel-version/SUSE combinations show unchanged C code.
Coccinelle iterators/use_after_iter.cocci reports the following diagnostic
in scst_event_disallow_event (message wrapped):
scst/src/scst_event.c:750:38-39:
ERROR: invalid reference to the index variable of the iterator
on line 731
After the disallow loop, e is the exhausted list iterator. The following
TRACE_MEM uses e even though the allocation about to be freed is
event_entry. Log event_entry instead so the trace names the allocation
passed to kfree immediately afterwards.
This fixes the diagnostic and the misleading trace address; the lookup,
list removal and allocation lifetime are unchanged.
Coccinelle api/atomic_as_refcounter.cocci reports:
scst/src/dev_handlers/scst_user_main.c:175:5-24:
WARNING: atomic_dec_and_test variation before object free at line 176.
ucmd_ref controls the lifetime of a user command. Replace its generic
atomic operations with kref and a last-reference release callback.
Update initialization, diagnostic reads and KUnit fixtures together.
A command can remain in the hash after its last put while the destructor
waits for cmd_list_lock. The old acquisition increments that zero count
and then undoes the increment. Use kref_get_unless_zero under the same
lock to reject a dying command without modifying its zero count.
Preserve the full ordering of successful acquisition that the old
atomic_inc_return supplied. Add KUnit cases for acquiring a live command
and rejecting the zero-count state before hash removal.
The kref API supports the old kernels in the build matrix without a new
refcount_t compatibility layer. No analyzer exclusion is needed.
Coccinelle api/atomic_as_refcounter.cocci reports:
scst/src/scst_priv.h:708:5-24:
WARNING: atomic_dec_and_test variation before object free at line 709.
cmd_ref counts ownership of struct scst_cmd, and its final put invokes
scst_free_cmd. Replace the generic atomic counter with kref, using
scst_free_cmd as the release callback. Update initialization, get/put,
diagnostic reads and the vdisk KUnit fixtures together.
Keep the existing barrier after reference acquisition and the deferred
out-of-sequence destruction path. Completion and work counters retain
their atomic types; only the command lifetime counter changes.
Use kref to retain compatibility with the supported old kernels without
introducing a separate refcount_t backport. This addresses the ownership
counter diagnostic without changing the Coccinelle rule.
Coccinelle api/atomic_as_refcounter.cocci reports:
scst/src/scst_mem.c:1642:5-24:
WARNING: atomic_dec_and_test variation before object free at line 1643.
Auditing this ownership counter exposes two bugs in shared pool lookup.
A lookup with a different owner mm returns the existing pool without
taking a reference. Its caller can then release another device's
ownership. Reject that lookup with NULL.
The last put can also reach zero before the destructor acquires
sgv_pools_mutex to unlink the pool. A concurrent lookup can still find
that pool. Use kref_get_unless_zero under the lookup mutex to reject a
pool whose destruction has already started.
Convert sgv_pool_ref to kref, retaining the existing nullable cleanup for
initialization failures separately from the last-reference callback.
The kref API also works on supported kernels predating refcount_t.
Add KUnit cases for same-mm acquisition, different-mm rejection and the
zero-reference state before unlinking. Export the private test header
in generated in-tree patches as well as the out-of-tree build.
The full SCS scan reports three instances of the same diagnostic:
scst/src/scst_lib.c:3007:1:
scst/src/scst_sysfs.c:1762:1:
scst/src/scst_targ.c:5666:1:
error: SCS.1: place SCST_KUNIT_VISIBLE on a line of its own
Move the annotations above the declarations of scst_check_reassign_sess,
__scst_acg_black_hole_store and scst_mgmt_cmd_init. This satisfies the
existing SCS.1 rule without changing visibility or function behavior.
The TX fixture assigns an ordinary integer to the restricted __be32
ddigest field, producing a Sparse type warning. Production digest code
stores little-endian CRC bytes in that field using an explicit __force
cast, despite its declared type.
Initialize the arbitrary test digest with cpu_to_le32 and the same cast.
This keeps its bytes unchanged on little-endian hosts and consistent on
big-endian hosts. The tests exercise send progress and offsets, not CRC
calculation or the contents of this placeholder.
KUNIT_EXPECT_PTR_EQ stores both operands in ordinary const void pointer
fields when reporting a failure. Passing the event fixture's __user
tokens directly produces two Sparse address-space warnings per assertion.
Explicitly cast the operands with __force at the three assertion sites.
Keep the __user annotations on the stub parameters and shared token, and
retain pointer equality checks and address reporting without dereferencing
the token.
TRACE_EXIT_HRES converts its argument to unsigned long for logging. Passing
an __poll_t directly triggers Sparse's restricted-type warning in both
scst_event_poll() and dev_user_poll().
Explicitly remove the bitwise restriction with __force at those two trace
calls. Keep the typed mask for event operations and the return value,
without weakening the shared trace macro for other callers.
The IB/CM and RDMA/CM callers of srpt_cm_req_recv() provide exactly one
connection identifier. Context setup branches on ib_cm_id, while error
cleanup branches on rdma_cm_id. Smatch loses the relationship between
the pointers and reports a possible NULL ib_cm_id dereference.
Select the connection identifier by ib_cm_id in both places and document
the caller contract. This preserves cleanup for both supported paths
and makes the control flow consistent without suppressing diagnostics.
SYNCHRONIZE CACHE with IMMED completes the command before calling
vdisk_fsync() with cmd=NULL and async=true. The write-through,
nonvolatile-cache and nullio bypasses dereference that pointer while
trying to complete the command again.
Only complete an asynchronous bypass when a command was supplied.
Enable the three commandless KUnit cases previously skipped for this
bug, removing their unreachable return after kunit_skip(). Also cover
SYNCHRONIZE CACHE(10/16) with IMMED in all three modes, checking that
completion occurs once, references are balanced and no flush is issued.
Fixes: 4cefa1b830 ("vdisk_fsync() fixes and cleanups")
WRITE SAME emulation chooses WRITE(16) or WRITE(32) from the required DIF
handling, independently of the input CDB length. The builder nevertheless
copies the flags from the output format's offset in the input command.
For WRITE SAME(16) converted to WRITE(32), that is byte 10 of the transfer
length; for a long command converted to WRITE(16), it is the control byte.
An unrelated value can therefore change WRPROTECT and other output flags.
Select the input flags once using the original CDB length and use that
value in both output formats. Preserve the existing WRPROTECT defaulting.
Add KUnit cases with different flag and unrelated-byte values for both
conversions and for commands that retain their format.
Fixes: 906f4dfefb ("Merge t10-pi branch back")
The internal WRITE(32) generated for DIF type 2 has three defects:
put_unaligned() infers a one-byte store from its destination pointer,
reserved/control bytes retain stack data, and the application-tag mask
is copied from bytes 26 and 27 even for a 16-byte input CDB. This can
corrupt the protection information or make the backend reject the write.
Clear the complete output buffer, use a sized big-endian application-tag
store and obtain the mask through scst_cmd_get_dif_app_tag_mask(). That
helper reads an explicit WRITE SAME(32) mask or derives the short-command
mask from the application's tag-check setting.
Extract the existing CDB builder behind the private KUnit interface. Add
regression cases for distinct tag bytes, full output images, short and
long commands, both short-command mask modes and buffer boundaries.
Nonzero poison patterns expose missing stores and reads beyond the short
CDB. Include the private header in generated in-tree kernel patches.
Fixes: 906f4dfefb ("Merge t10-pi branch back")
A progress timeout can occur before the child consumes all supplied
input. On Python 3.12, retrying communicate() without input stops
scheduling writes to stdin. The child waits for EOF while the driver
keeps waiting for output, which can hang the analyzer script tests
until the CI job timeout.
Run communicate() once in an I/O worker while the main thread waits
for its result and updates progress. On interruption, stop the owned
process group before joining the worker so blocked pipes cannot
prevent cleanup.
Make the regression wait for two progress updates before reading stdin
to force the pending-input case. Bound the entire child with an alarm
so a regression reports a failure instead of hanging the suite.
Validation: reproduce both check modes failing on Python 3.12.14
before the fix; all 75 lint-test fixtures pass on chesnokov-vm2
afterwards. All 11 process/log fixtures also pass locally on Python
3.14.8.
Fixes: c8648f9410 ("scripts: Share analyzer process and raw-log handling")
Add a parallel make checkpatch job for pushes to master and manual
runs. Fail analyzer jobs on remaining source findings with status 1;
keep tool, build and coverage failures separate with status 2.
Validate the current report, Make status and native coverage before
classifying results. Checkpatch needs its script and data, not a
prepared KUnit kernel. Update the isolated CI report fixtures.
Run SCST style fixtures and make scs_lint in a separate job without a
kernel build, alongside the native analyzers. Pin uv and its setup
action; the linter supplies its pinned parser dependencies.
Retain the pull-request Checkpatch workflow for patch and commit
checks. Remove the standalone push Checkpatch workflow, whose role
is now covered by the common static-analyzer workflow.
Rename Tooling to Analyzer script tests and clarify that analyzer
jobs include KUnit sources without executing KUnit. Update Checkout
and Upload Artifact to v7 to replace their deprecated Node.js 20
runtimes, and align the CI documentation with the actual jobs.
Document SCS.1 and expose make scs_lint for the common C source/header
scope, including userspace and KUnit. Adapt engine's OCS.7.5 check to
SCST_KUNIT_VISIBLE, SCST_KUNIT_VISIBLE_INLINE and VISIBLE_IF_KUNIT.
Require each annotation to occupy its own line; leave other function
attributes and source warnings unchanged.
Use Tree-sitter to distinguish code from comments, literals and
preprocessor directive contents while checking every conditional
branch. Pin the parser dependencies and run them through uv.
Support whole-tree, DIFFBR and explicit-file selection without new
exclusions or diagnostic exceptions. Retain findings and checked-file
records even when a later input fails. Add isolated rule, diff-mode,
coverage and read-failure fixtures with a separate test target.
Expose make checkpatch through the common C source/header policy,
including userspace and KUnit sources. DIFFBR selects whole changed
files. Use the kernel's Checkpatch and companion data with --strict,
without adding diagnostic exceptions or loading local configuration.
Retain raw output and require native totals and a completion record
for every selected file. Distinguish source findings from unreadable
inputs, inconsistent reports and tool failures, with isolated fixtures.
Keep native caches in a temporary directory and serialize only this
analyzer's reports so it can run alongside the Kbuild analyzers.
Make checkpatch_scan use this target's implementation and exit status
instead of suppressing errors. Preserve the separate existing policy
of patch/commit helpers and the kernel regression runner.
Reserve the legacy-kernel fork checks for manual runs instead of adding
two VM jobs and extra kernel builds to the regular CI selection. Remove
the Linux 5.8/5.9 Ginkgo jobs and regression matrix entries, retaining the
kernel pins and local-only VM runner for reproduction.
Label the fork spec manual and exclude that label from both ci-pr and
ci-push. Move smoke to the READ CAPACITY entries so their existing CI
coverage remains intact. Keep full manual runs inclusive, update the
selection checks, and document focused manual execution.
dev_user_map_buf() now switches at Linux 5.9: get_user_pages() with
mmap_read_lock() on 5.8, pin_user_pages() from 5.9. The GitHub regression
subset goes from 5.10 to 5.4, so neither side of that boundary is compiled
on pull requests. Add the 5.9 and 5.8 selectors, which resolve to the
5.9.16 and 5.8.18 entries already in ABT_KERNELS.
scst_user pins its data buffers from Linux 5.9, the first release in
which fork() gives the child a copy of a pinned page (commit
70e806e4e645, "mm: Do early cow for pinned pages during fork() for
ptes"). The Ginkgo "handler forks" spec checks this, but CI boots only
the current Fedora kernel, so the boundary itself is never tested.
Add a Ginkgo job matrix that runs the local "user" specs on Fedora 33's
Linux 5.8.18 and 5.9.16, on both sides of the boundary. On 5.9.16 the
fork spec relies on the pin alone; on 5.8.18 the handler protects its
buffers with MADV_DONTFORK, as required there. Both must keep correct
geometry and data. The jobs are named after their kernels, like the
regression jobs.
- kernel-5.8.env, kernel-5.9.env and their SHA256SUMS pin those kernels'
rpms from Fedora's koji, like kernel.env and kernel.SHA256SUMS.
Fedora's only 5.9.0 build is a rawhide kernel that defines RHEL_MAJOR 8
and RHEL_MINOR 99, so SCST's backports treat it as RHEL and the build
fails; 5.9.16 has the same fork() behavior.
- build-image takes an optional pin name, such as "kernel-5.9", for
Ginkgo images. The image is otherwise built the same way.
- The Dockerfile downloads exactly the rpms listed in the selected
checksum file, since 5.9 has no kernel-modules-core package.
- vm.py --local-only boots only the target guest, without the iSCSI
initiator or the private network, and expects only the local report.
The guest then writes a config without an iscsi section. The label
filter is restricted to local specs: "local && (<filter>)", or "local"
without one.
Extend the scst_user fault hook with a fork action: once armed, the
handler fork()s before its next scst_user ioctl, and the child only
sleeps, as a crash reporter, system() or popen() would. The new spec
reads LBA 0 first, so the handler's cached buffer holds known data,
then makes the handler fork. Afterwards READ CAPACITY(10) and (16),
reads and writes must return the right geometry and data.
The hook logs its success line only after the fault was applied, and
logs a failed fork() with its errno. The specs fail on that line and
require each fault's success line, so a failed fork() cannot pass as a
handler that forked.
Before Linux 5.9, the same boundary as dev_user_map_buf(), scst_user
keeps get_user_pages() and a handler that forks must use MADV_DONTFORK,
which fileio_tgt does not. There the hook applies MADV_DONTFORK to every
active data buffer before it forks and logs how many it protected. It
tracks the buffers from the handler's ALLOC_MEM and EXEC replies, and
restores MADV_DOFORK before the handler frees one. The spec requires
that line below 5.9 and its absence from 5.9, and the same correct
geometry and data on every kernel. So 5.9 and later test the pin
alone, and older kernels test the documented MADV_DONTFORK requirement.
Without pinned buffers SCST keeps reading the pre-fork page, and the
next READ CAPACITY reports the stale data block as its block length.
dev_user_map_buf() takes the handler's buffer pages with
get_user_pages(FOLL_WRITE). With SCST_USER_MEM_REUSE_* the buffer stays
cached in the SGV pool and is reused by later commands, so SCST keeps
these page references for a long time.
A page reference does not keep the handler and SCST on the same page
across fork(). After the handler forks, its private pages are shared
copy-on-write, and the handler's next write to a cached buffer moves the
handler to a new copy while SCST keeps using the old page. SCST then
returns stale data to the initiator. For READ CAPACITY it also takes the
stale bytes as the block length and changes the device geometry, for
example:
1 << 30 != 1145132097
scst_user: ...: Changed block shift from 12 into 30 / 30
Any fork() in the handler triggers this, including a crash reporter that
clones a minidump writer without CLONE_VM, system() and popen().
Pin the pages with FOLL_LONGTERM instead. Since Linux 5.9 (commit
70e806e4e645, "mm: Do early cow for pinned pages during fork() for
ptes"), fork() gives the child a copy of a pinned anonymous page, so the
handler and SCST keep sharing the same page. pin_user_pages() itself is
older, but before 5.9 fork() write-protects pinned pages like any other,
so pinning alone does not help there. Release them with
unpin_user_pages(), marking them dirty with SetPageDirty() as before.
unpin_user_pages_dirty_lock() is not usable here: it takes the page
lock, and on_free_cmd() can release an uncached buffer in atomic
context. Use the pin from Linux 5.9; older kernels, including
distribution kernels based on them, keep the existing code.
doc/scst_user_spec.sgml so far required handlers that fork() to mark
their data buffers MADV_DONTFORK. With the pin that is only needed on
kernels older than 5.9, and for private HugeTLB buffers on kernels older
than 5.12: fork() copies pinned HugeTLB pages only since commit
4eae4efa2c29 ("hugetlb: do early cow when page pinned on src mm"), which
5.10.y and 5.11.y do not have. Update that note and the source comment
accordingly. Also document that data
buffers should be anonymous or shared memory: since Linux 6.5 the kernel
refuses a long term writable pin of a MAP_SHARED mapping of a regular
file on a file system with writeback, and a command using such a buffer
then fails with INTERNAL TARGET FAILURE sense. Such a buffer was not
safe with get_user_pages() either, because SCST could write to it while
the file system wrote it back.
Add scst-USER-buffers, which maps a KUnit-owned user buffer with
dev_user_map_buf() and releases it with dev_user_unmap_buf() with
interrupts disabled, checking that the pages are unpinned and marked
dirty only after a write.
Run isolated tooling checks and separate Sparse and Smatch Make targets
on pushes to master and manual dispatch. Use the pinned kernel with
KUnit enabled and preserve full logs, policy and tool provenance.
During the source-fix rollout, completed source findings are advisory.
Tool, build, parser and coverage failures remain blocking, including an
empty scan or missing KUnit inputs. Local Make targets stay strict.
Validate the current run's report together with Make's exit status,
since Make maps both findings and incomplete analysis to status 2.
Prepare the runner and container for Coccinelle and Cppcheck as well,
but leave their matrix entries commented out. Cover all four report
formats and GNU Make exit mapping with isolated tooling fixtures.
Expose make cppcheck using freshly captured kernel CHECK commands and
real userspace compiler invocations. Keep their include paths and
definitions unchanged and analyze kernel and userspace contexts
separately.
Use the shared source scope without additional input exclusions, project
models or diagnostic suppressions. Relevant diffs trigger full
configured analysis; KUnit coverage follows the actual build
configuration.
Retain build logs, compilation databases, native XML and checker
coverage. Separate source findings from parser failures, missing inputs
and incomplete builds, with isolated report and capture fixtures.
Expose make coccicheck using report rules from the selected kernel and
the shared source policy, including userspace and KUnit sources. Diff
mode selects whole changed sources and headers.
Preserve full native output and record rule initialization, per-input
handling and finalization. Treat parser errors and missing coverage as
incomplete analysis even if spatch returns zero; report source findings
separately.
Add isolated log and policy fixtures. Do not introduce project macro
models, diagnostic exceptions or CI execution.
Build standalone Sparse and Smatch from recorded revisions, applying the
reviewed SCST Smatch frontend correction. Install matching native Smatch
data without replacing standalone Sparse or adding project models.
Reuse the existing checksum-pinned kernel headers. Record source
commits, patch and binary hashes, and installed model contents for CI
evidence. Fail preparation instead of silently falling back to different
tools; no SCST modules are built or loaded while preparing this image.
Use the dedicated native analyzer targets instead of regression wrappers
that return success after tool failures and summarize filtered output.
Remove their suffix switches and the analyzer-only IBM VIO option.
Update the regression caller and kernel-option parser together; the
maintained kernel list and compilation matrix are unchanged. Keep legacy
Checkpatch until its own integration series.
Run the native checkers through the ordered SCST module build with C=2.
Preserve Kbuild flags, full raw output and every attempted CHECK record.
Keep full, diff and explicit input selection on the shared scope; diff
selection triggers the complete configured module analysis.
Read exact diagnostic exceptions from policy/sparse.json and
smatch.json: two reviewed Smatch IRQ reports and the external FC
flexible-array warning. Keep the existing SCST matching boundaries and
reasons. Smatch uses its matching installed kernel data without
engine-specific additions.
Reject build, checker, frontend and truncation failures even when Kbuild
returns success. Retain per-invocation records and a machine-readable
run summary, and detect printed CHECK steps without a record. Require
selected C inputs to occur in the build. Keep findings distinct from
incompleteness.
Check native compatibility before compilation, and forward external
kernel capability probes to the real checker instead of skipping them as
inputs outside SCST. Include the pinned Smatch typeof frontend
correction and isolated fixtures for failure propagation and exact
exception boundaries.
Add show, files and validate commands to analyzer_policy.py and expose
policy inspection through make analyzer-policy. Support text and JSON
reports without installing or invoking an analyzer or preparing a build.
Show the configured roots, input exclusions and their reasons. The file
inventory uses the shared selector and reports eligible tracked inputs,
not completed analysis or build coverage. Configuration and Git failures
return an error instead of a successful empty report.
Expose only the common input policy at this stage. Individual analyzer
policies belong with their drivers. Keep the existing checkpatch and
kernel regression filtering separate and document that boundary.
Add isolated CLI fixtures for policy reporting, repository-relative input
inventory and visible failures. Document the inspection entry points.
Move the source roots, file types and input exclusions from lint_scope.py
into policy/common.json. Keep the existing scope, including KUnit sources,
the newer QLogic target and the exclusions for the legacy QLogic tree,
upstream QLogic sources, compiler probes and generated module metadata.
Adapt engine's reviewed-data and strict-loader approach to SCST. Require
reasons for input exclusions and reject malformed, missing or ambiguous
policy before selecting files. Do not import engine's exclusions or add
environment-based filtering or diagnostic suppression.
Use this policy for full, diff and explicit-file selection. Preserve both
lexical and resolved path checks, single-commit diff bases and index-based
selection. Treat policy paths literally in Git pathspecs as well as Python.
Add isolated fixtures for schema failures and policy-driven selection.
Extract the per-worktree build lock ahead of the Sparse/Smatch and
Cppcheck drivers. Keep one advisory lock file for analyzer builds that
share generated state; release the descriptor on success or exception
without unlinking the file.
Document that callers must hold the lock around build-state changes and
log reset, and that ordinary builds are not covered by this advisory lock.
Add isolated fixtures checking cross-process contention, lock reuse and
release after an exception. Kbuild collection and analyzer-specific build
targets remain with their respective integration series.
Provide common process, progress and report helpers for the upcoming
analyzer drivers. Preserve raw output bytes and command failure statuses,
keep progress separate from captured diagnostics, and terminate the owned
process group when an invocation is interrupted.
Forward valid inherited Make jobserver pipes without taking their tokens.
Document named-log truncation explicitly: a later run replaces that named
report unless the caller requests preservation.
Import the process and terminal fixtures and add raw-log coverage. No
analyzer-specific filtering or diagnostic exclusions are introduced.
Passing the base directly to git diff allows an option such as --quiet to
be interpreted as a flag. On a clean worktree it can succeed without
selecting any sources, instead of rejecting the invalid revision.
Resolve the base with rev-parse --verify --end-of-options and require a
commit before building the diff command. Reuse the resulting object ID so
options, ranges, tree objects and unknown revisions cannot turn an invalid
request into an empty selection.
Add a fixture covering rejected bases on a clean tree and a valid tag
before and after a source change. Expose the resolver for future patch
consumers as well.
Give the upcoming analyzer drivers one source-selection policy for full,
working-tree diff and explicit-file checks. Include product C sources and
headers, including KUnit, and keep both lexical and resolved paths within
the allowed directories.
Select only the newer QLogic SCST target directory. Exclude the legacy
QLogic tree, the upstream part of the newer driver, the two conftest trees
and generated .mod.c files. Document these input exclusions separately
from diagnostic filtering, which this helper does not perform.
Add temporary-repository fixtures and a make lint-test entry point. Keep
the existing checkpatch and kernel regression consumers unchanged until
their replacement drivers are introduced.
The Linux 3.10 backport selected uint unconditionally for ql2xmaxlun,
limiting the module parameter to 32 bits even on current kernels.
Select uint only when param_check_ullong is absent from the kernel's
module parameter API. Otherwise retain the upstream uint64_t/ullong type.
Use the same feature check for the extern declaration so all driver
translation units agree, including vendor kernels with this API backported.
The default value and existing 16-bit limit for older HBAs are unchanged.
The QLogic EDIF teardown now uses timer_shutdown(). Use the native helper
on Linux 6.2+, stable 6.1.158+ and 5.15.200+, RHEL 8.9+/9.3+, and the
Ubuntu kernels that backported it. Keep this compatibility change separate
from the import of upstream 292a089d78d3.
Also account for the timer_delete_sync() backport in Ubuntu 5.15.0-93.
Its headers report Linux 5.15.136, below the upstream stable 5.15.154
boundary, so the existing fallback redeclares a native kernel function.
The earlier Ubuntu fix covered timer_delete() but omitted its sync peer.
Limit the ABI check to the generic/HWE numbering range; flavour ABIs use
independent sequences.
Ubuntu 5.4.0-206 reports Linux 5.4.286 and is already covered by the
existing 5.4.274 stable boundary for timer_delete_sync().
On kernels without shutdown support, retain the previous timer_delete()
behavior. This fallback does not prevent rearming; that guarantee requires
support in the kernel timer implementation. Callers on these kernels still
have to exclude concurrent rearming themselves.
Fixes: d21b6f1457 ("scst: Port to Linux kernel v6.15")
Due to several bugs caused by timers being re-armed after they are
shutdown and just before they are freed, a new state of timers was added
called "shutdown". After a timer is set to this state, then it can no
longer be re-armed.
The following script was run to find all the trivial locations where
del_timer() or del_timer_sync() is called in the same function that the
object holding the timer is freed. It also ignores any locations where
the timer->function is modified between the del_timer*() and the free(),
as that is not considered a "trivial" case.
This was created by using a coccinelle script and the following
commands:
$ cat timer.cocci
@@
expression ptr, slab;
identifier timer, rfield;
@@
(
- del_timer(&ptr->timer);
+ timer_shutdown(&ptr->timer);
|
- del_timer_sync(&ptr->timer);
+ timer_shutdown_sync(&ptr->timer);
)
... when strict
when != ptr->timer
(
kfree_rcu(ptr, rfield);
|
kmem_cache_free(slab, ptr);
|
kfree(ptr);
)
$ spatch timer.cocci . > /tmp/t.patch
$ patch -p1 < /tmp/t.patch
Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: Pavel Machek <pavel@ucw.cz> [ LED ]
Acked-by: Kalle Valo <kvalo@kernel.org> [ wireless ]
Acked-by: Paolo Abeni <pabeni@redhat.com> [ networking ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[ commit 292a089d78d3e2f7944e60bb897c977785a321e3 upstream ]
The imported QLA29xx speed reporting uses FC_PORTSPEED_128GBIT. Supply
its upstream value before v4.16, following the existing 64 Gbit
definition and retaining vendor definitions when present. The newer
QLogic driver is the only current consumer; the legacy driver and other
transports are unaffected.
Use the existing BSG_JOB_TYPE compatibility selection for the five new
flash and MPI helpers. Older supported kernels use fc_bsg_job; vendor
kernels with the newer API already select bsg_job. This adapts upstream
2efa08b894c6 and 514664aa303d without changing their imports.
The imported 29xx CRC builder calls the protection SG walker
unconditionally, but SCST compiles that walker only with QLA_ENABLE_PI.
Match the existing 24xx caller so PI-disabled builds do not retain an
undefined symbol. Keep this SCST adaptation separate from upstream
b6781d71a414.
The module parameter is ql2xfc2target, but its MODULE_PARM_DESC() names
qla2xfc2target, so modinfo describes a parameter that does not exist and
shows no description for the real one.
Use the parameter name in the description.
Fixes: 877b03795fcf ("scsi: qla2xxx: Add option to disable FC2 Target support")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260906171009.2560-1-kmehltretter@gmail.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
[ commit 779f202a92ef10a426efc07d0f4267918cb07ca3 upstream ]
This loop timeout with "retries" set to -1, not 0. Fix the test for
failure.
Fixes: 7ec0effd30bb ("[SCSI] qla2xxx: Add support for ISP8044.")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/an1twcxTYSFkkUTA@stanley.mountain
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
[ commit 11e48f5201fd86ffa038809dd9c41144d43ee2e4 upstream ]
Negative -EIO was intended instead of positive EIO. The caller, doesn't
care so this doesn't affect runtime. It's just a cleanup.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/an1taxANE_4_vzJT@stanley.mountain
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
[ commit ff9365a4c9991cca68fd48c7729808f2fdae2036 upstream ]
After commit c3930ec119cb ("scsi: qla2xxx: Add FC operational firmware
load for 29xx"), there is a warning due to an incorrect format specifier
for a 'size_t' variable when building for 32-bit platforms, for which
'size_t' is 'unsigned int':
drivers/scsi/qla2xxx/qla_init.c: In function 'qla29xx_process_rd_image':
drivers/scsi/qla2xxx/qla_init.c:9272:74: error: format '%lx' expects argument of type 'long unsigned int', but argument 6 has type 'size_t' {aka 'unsigned int'} [-Werror=format=]
9272 | "TIM section too large (0x%x bytes, ring 0x%lx bytes).\n",
| ~~^
| |
| long unsigned int
| %x
9273 | section_size,
9274 | req->length * qla_req_entry_size(ha));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| size_t {aka unsigned int}
cc1: all warnings being treated as errors
Use '%zx', the proper 'size_t' format specifier, to clear up the
warning.
Fixes: c3930ec119cb ("scsi: qla2xxx: Add FC operational firmware load for 29xx")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260811-scsi-qla2xxxx-qla_init-wformat-v1-1-50760021914f@kernel.org
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
[ commit 431e735e9bb6b7fd8e2ea9d83f0627bb5c5687ee upstream ]
struct qla_i2c_access carries a 16-bit length field alongside a fixed
64-byte buffer:
struct qla_i2c_access {
uint16_t device, offset, option, length;
uint8_t buffer[0x40];
} __packed;
qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied
i2c->length without any bounds check. i2c is overlaid on a 256-byte
on-stack buffer and sfp is a 256-byte DMA-pool buffer, so a length up to
65535 overruns both:
- write: memcpy(sfp, i2c->buffer, i2c->length) over-reads the stack and
over-writes the sfp heap buffer, and qla2x00_write_sfp() then DMAs
i2c->length bytes out of the 256-byte buffer.
- read: qla2x00_read_sfp() DMAs i2c->length bytes into the 256-byte sfp,
then memcpy(i2c->buffer, sfp, i2c->length) overflows the 64-byte
buffer inside the on-stack array.
A caller holding CAP_SYS_RAWIO can use this to corrupt the heap and the
kernel stack. Reject requests whose length exceeds the buffer before any
copy or DMA transfer in both handlers.
Fixes: 9ebb5d9c69f1 ("[SCSI] qla2xxx: Add I2C BSG interface.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-33-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
[ commit 0918ee2c0eeb4d7f45b82b3dc11e65c2d9b7ad59 upstream ]
Gleb Chesnokov
wenlxieandGleb Chesnokov
Steven Rostedt (Google)andGleb Chesnokov
Karl MehltretterandGleb Chesnokov
Dan CarpenterandGleb Chesnokov
Nathan ChancellorandGleb Chesnokov
Nilesh JavaliandGleb Chesnokov