linux-toradex.git/drivers/xen, branch master

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2026-07-18T19:36:19+00:00

Pull SCSI fixes from James Bottomley:
 "The biggest core change is the reliable wake fix for scsi_schedule_eh
  which is used by both libata and libsas which could otherwise cause
  error handler hangs due to rare races.

  All other fixes are in drivers (well except the export symbol removal)
  the next biggest being the target PR-OUT transportid parsing fix"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
  scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
  scsi: elx: efct: Fix I/O leak on unsupported additional CDB
  scsi: core: wake eh reliably when using scsi_schedule_eh
  scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
  scsi: target: Bound PR-OUT TransportID parsing to the received buffer
  scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
  scsi: sg: Report request-table problems when any status is set
  scsi: ufs: core: tracing: Do not dereference pointers in TP_printk()
  scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
  scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
  scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
  scsi: core: Remove export for scsi_device_from_queue()

Merge branch 7.2/scsi-queue into 7.2/scsi-fixes

2026-07-09T01:21:52+00:00

Pull in outstanding commits from 7.2/scsi-queue.

Signed-off-by: Martin K. Petersen

xenbus: reject unterminated directory replies

2026-07-01T08:01:14+00:00

split_strings() walks each directory entry with strlen(). Although the
transport adds a terminator after the reply buffer, a malformed reply
without a final NUL inside its advertised length would let that walk
cross the protocol payload boundary.

Reject such replies before counting the strings. Report the protocol
violation once and return -EIO to the caller.

Signed-off-by: Yousef Alhouseen 
Reviewed-by: Juergen Gross 
Signed-off-by: Juergen Gross 
Message-ID: <20260626223738.43742-1-alhouseenyousef@gmail.com>

xen/gntalloc: validate grant count before allocation

2026-07-01T07:58:24+00:00

gntalloc_ioctl_alloc() allocates the grant-id array before checking
whether the requested count fits within the global grant limit. Counts
above that limit cannot succeed, so reject them before the
user-controlled allocation reaches kcalloc().

Use a subtraction-based check while holding gref_mutex so adding the
requested count cannot wrap. Also cast the count before advancing the
per-file index so the page-size multiplication is performed in 64-bit
arithmetic.

Signed-off-by: Yousef Alhouseen 
Reviewed-by: Juergen Gross 
Signed-off-by: Juergen Gross 
Message-ID: <20260626223805.43781-3-alhouseenyousef@gmail.com>

xen/gntalloc: make grant counters unsigned

2026-07-01T07:58:24+00:00

The module limit and current allocation count cannot validly be
negative. Give both variables unsigned types so their representation
matches the u32 grant count supplied through the ioctl and negative
module parameter values are rejected by parameter parsing.

This also prepares the limit check for overflow-safe unsigned
arithmetic.

Signed-off-by: Yousef Alhouseen 
Reviewed-by: Juergen Gross 
Signed-off-by: Juergen Gross 
Message-ID: <20260626223805.43781-2-alhouseenyousef@gmail.com>

xen/front-pgdir-shbuf: free grant reference head on errors

2026-07-01T07:51:41+00:00

grant_references() allocates a private grant-reference head before
claiming references for the page directory and, for guest-owned buffers,
the data pages. The success path frees the remaining head, but claim
failures and grant_refs_for_buffer() errors return immediately.

Unwind through a common exit path so the private grant-reference head is
released even when granting fails part-way through setup. The caller
still tears down any references already stored in buf->grefs.

Signed-off-by: Yousef Alhouseen 
Reviewed-by: Stefano Stabellini 
Signed-off-by: Juergen Gross 
Message-ID: <20260629160517.29340-1-alhouseenyousef@gmail.com>

xen/gntdev: fix error handling in ioctl

2026-07-01T07:51:09+00:00

When gntdev_ioctl_map_grant_ref() fails to copy the operation result
back to userspace after successfully adding the mapping to the list,
the error path returns -EFAULT without releasing the reference
acquired by gntdev_alloc_map(). The mapping remains in priv->maps
with a refcount of 1, causing a memory leak and a dangling list
entry.

Additionally, gntdev_add_map() may modify map->index to avoid overlap
with existing mappings. Therefore, the index returned to userspace
must be obtained after gntdev_add_map() completes.

Fix this by holding the mutex across gntdev_add_map(), retrieving
the correct index, and copy_to_user(). If copy_to_user() fails,
remove the mapping from the list and release the reference while
still holding the lock.

Cc: stable@vger.kernel.org

Fix these issues by properly handling all error cases.

Fixes: 1401c00e59ea ("xen/gntdev: convert priv->lock to a mutex")
Fixes: 68b025c813c2 ("xen-gntdev: Add reference counting to maps")

Signed-off-by: Wentao Liang 
Reviewed-by: Juergen Gross 
Signed-off-by: Juergen Gross 
Message-ID: <20260622112541.38194-1-vulab@iscas.ac.cn>

xen/pvcalls: bound backend response req_id before indexing rsp[]

2026-07-01T07:31:02+00:00

pvcalls_front_event_handler() takes req_id directly from the
backend-supplied ring response and uses it to index the fixed-size
bedata->rsp[] array for a memcpy() and a store, with no range check. A
malicious or buggy backend can set req_id past PVCALLS_NR_RSP_PER_RING
and drive an out-of-bounds write past the bedata allocation.

req_id was also declared int while the wire field rsp->req_id is u32, so
a range check on the signed value alone is insufficient: a backend
req_id of 0xffffffff becomes -1, passes a >= PVCALLS_NR_RSP_PER_RING
test and indexes bedata->rsp[-1]. Declare req_id as u32 so a single
bound covers both ends.

A backend that sends an out-of-range req_id has violated the wire
protocol, so rather than silently dropping the response, log once and
stop trusting the backend: set bedata->disabled. The event handler then
ignores further responses, and the request paths that wait for a
response return -EIO instead of blocking forever. This mirrors the
fatal-error handling xen-netback uses (xenvif_fatal_tx_err()).

The pvcalls frontend currently trusts its backend, so this is not a
classic-Xen security issue, but it matters for hardening PV frontends
against malicious backends (confidential and disaggregated deployments).

Fixes: 2195046bfd69 ("xen/pvcalls: implement socket command and handle events")
Suggested-by: Juergen Gross 
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito 
Reviewed-by: Juergen Gross 
Signed-off-by: Juergen Gross 
Message-ID: <20260617014149.2647404-1-michael.bommarito@gmail.com>

Merge tag 'devicetree-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2026-06-17T18:54:57+00:00

Pull devicetree updates from Rob Herring:
 "DT core:

   - Add support for handling multiple cells in "iommu-map" entries

   - Support only 1 entry in /reserved-memory "reg" entries. Support for
     more than 1 entry has been broken

   - Fix a UAF on alloc_reserved_mem_array() failure

   - Make "ibm,phandle" handling logic specific to PPC

   - Use memcpy() instead of strcpy() for known length strings

   - Ensure __of_find_n_match_cpu_property() handles malformed "reg"
     entries

   - Add various checks that expected strings are strings before
     accessing them

   - Drop redundant memset() when unflattening DT

  DT bindings:

   - Add a DTS style checker. Currently hooked up to dt_binding_check to
     check examples

   - Convert st,nomadik platform, ti,omap-dmm, and ti,irq-crossbar
     bindings to DT schema

   - Add Apple System Management Controller hwmon, Qualcomm Hamoa
     Embedded Controller, Qualcomm IPQ6018 PWM controller, fsl,mc1323,
     Samsung SOFEF01-M DDIC panel, Freescale i.MX53 Television Encoder,
     Samsung S2M series PMIC extcon, and MT6365 PMIC AuxADC schemas

   - Extend bindings for QCom Maili and Nord PDC, QCom Hali fastrpc,
     qcom,eliza-imem, qcom,oryon-1-5 CPU, and MT6365 Keys

   - Consolidate "sram" property definitions

   - Fix constraints on "nvmem" properties which only contain phandles
     and no arg cells

   - Another pass of fixing "phandle-array" constraints

   - Add Gira vendor prefix"

* tag 'devicetree-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (50 commits)
  dt-bindings: interrupt-controller: qcom,pdc: Add Maili compatible string
  dt-bindings: interrupt-controller: ti,irq-crossbar: Convert to DT schema
  dt-bindings: vendor-prefixes: add Gira
  dt-bindings: embedded-controller: Add Qualcomm reference device EC description
  dt-bindings: pwm: add IPQ6018 binding
  dt-bindings: hwmon: Add Apple System Management Controller hwmon schema
  docs: dt: writing-schema: Clarify what is required in a schema
  of: Respect #{iommu,msi}-cells in maps
  of: Factor arguments passed to of_map_id() into a struct
  of: Add convenience wrappers for of_map_id()
  of: reserved_mem: zero total_reserved_mem_cnt if no valid /reserved-memory entry
  of: reserved_mem: handle NULL name in of_reserved_mem_lookup()
  dt-bindings: cache: l2c2x0: Add missing power-domains
  dt-bindings: interrupt-controller: renesas,r9a09g077-icu: Fix reg size in example
  dt-bindings: nvmem: consumer: Make 'nvmem' an array of one-item entries
  drivers/of/overlay: Use memcpy() to copy known length strings
  dt-bindings: add self-test fixtures for style checker
  dt-bindings: wire style checker into dt_binding_check
  scripts/jobserver-exec: propagate child exit status
  dt-bindings: add DTS style checker
  ...

scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

2026-06-16T01:52:39+00:00

scsiback_device_action() obtains a command tag in
scsiback_get_pend_req() and submits a task-management request with
target_submit_tmr(). When target_submit_tmr() fails it returns < 0 and
scsiback jumps to the err: label, which sends a response but frees
nothing, leaking the tag.

Impact: a pvSCSI guest can leak the command tags of a LUN's session,
stopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests
whenever target_submit_tmr() fails.

transport_generic_free_cmd() cannot be used here. By the time
target_submit_tmr() returns an error it has already run
__target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on its
target_get_sess_cmd() error path it has freed se_cmd->se_tmr_req via
core_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the
pointer dangling. Letting the command release run target_free_cmd_mem()
would then double-free se_tmr_req.

Use the same helper, which returns just the tag, on this path too.

Fixes: 2dbcdf33dbf6 ("xen-scsiback: Convert to percpu_ida tag allocation")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito 
Reviewed-by: Juergen Gross 
Link: https://patch.msgid.link/20260611123046.2323342-3-michael.bommarito@gmail.com
Signed-off-by: Martin K. Petersen