commit 12e67eb89eb2b9516685c744d3f7de0a2d1bd701 Author: Chen Changcheng Date: Mon Jul 27 15:34:38 2026 +0800 scsi: snic: Fix SCSI host leak on workqueue allocation failure In snic_add_host(), if scsi_add_host() succeeds but alloc_ordered_workqueue() fails, the function returns -ENOMEM with shost->work_q left as NULL. The caller's error path then calls snic_del_host(), which returns early when !shost->work_q without calling scsi_remove_host(). The Scsi_Host remains registered in sysfs as a zombie device even after the probe has failed. This causes: - The leaked host remains visible in /sys/class/scsi_host/ after probe failure, with state "running". - Subsequent SCSI host numbering is permanently shifted (the leaked host ID from ida_alloc() is never reclaimed). - Memory leak: the Scsi_Host allocation can never be freed because device_add() took a reference that can only be released by device_del() inside scsi_remove_host(). Fix by adding scsi_remove_host() in the workqueue allocation failure path inside snic_add_host(), undoing the successful scsi_add_host() before returning the error. This is cleaner than modifying snic_del_host() because snic_del_host() is called from a shared error label that also serves paths where snic_add_host() was never invoked. Reproducer (requires no real SNIC hardware): - Build CONFIG_SCSI_SNIC=y (built-in) - Add snic.test_mode=1 snic.inject_wq_fail=1 to kernel cmdline - Boot with a PCI device matching the snic driver (e.g. QEMU edu device, PCI ID 0x1234:0x11e8, temporarily added to the driver's PCI ID table) Before the fix: # /sys/class/scsi_host/ contains a zombie host0: $ cat /sys/class/scsi_host/host0/proc_name snic_scsi $ cat /sys/class/scsi_host/host0/state running # ata_piix gets host1, host2 (host0 stuck): scsi host1: ata_piix scsi host2: ata_piix After the fix: # host0 is properly freed and reused by ata_piix: scsi host0: ata_piix scsi host1: ata_piix # No zombie host in /sys/class/scsi_host/ Signed-off-by: Chen Changcheng Acked-by: Narsimhulu Musini Link: https://patch.msgid.link/20260727073438.209673-1-chenchangcheng@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) commit df125bd16280b19835bfa2eef6504b505790f1f6 Author: Martin K. Petersen (Oracle) Date: Sun Aug 23 22:08:18 2026 -0400 scsi: MAINTAINERS: Update my email address Use my kernel.org address for Linux development. Signed-off-by: Martin K. Petersen (Oracle) commit 764587d7d76846716a568dea7ae48be1c50ecc18 Author: Finn Thain Date: Tue Aug 18 11:00:24 2026 +1000 scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers The NCR5380 entry in MAINTAINERS includes drivers/scsi/arm/cumana_1.c and drivers/scsi/arm/oak.c. However, those two files are also covered by the drivers/scsi/arm/ pathname in the ARM/RISCPC entry. The latter entry is more effective than the former because, AIUI, neither Michael nor I have access to the necessary hardware. IMHO, such access is a pre-requisite for the 'maintainer' role for device drivers. To work on these particular drivers would require an old GCC compiler, having support for -march=armv3m, which is a problem for contributors. Cc: Michael Schmitz Cc: Russell King Cc: Arnd Bergmann Signed-off-by: Finn Thain Acked-by: Michael Schmitz Link: https://patch.msgid.link/935b08c0fb292888c06c2233570331f2ccadcd53.1787014824.git.fthain@linux-m68k.org Signed-off-by: Martin K. Petersen (Oracle) commit 46f861d300e87283f81faf9ee377d1e73682903d Author: Dongdong Hao Date: Fri Aug 14 17:05:26 2026 +0800 scsi: leapraid: Standardize NCQ priority sysfs attributes Replace the earlier LeapRAID ncq_cmd_prio_enable attribute with the standard sas_ncq_prio_supported and sas_ncq_prio_enable names documented in Documentation/ABI/testing/sysfs-block-device, and rename the per-device NCQ priority state to match. The earlier ncq_cmd_prio_enable name has not yet been established as part of a released userspace ABI, so no compatibility alias is needed. For LeapRAID, sas_ncq_prio_enable is backed by the driver's per-device NCQ priority state and controls whether RT-class I/O requests are issued with command priority on supported SATA devices. Update leapraid.rst to describe the standard attribute names and paths, and clean up the surrounding RST text for consistency with kernel documentation style. Also switch the capability check from open-coded VPD page 0x89 parsing to sas_ata_ncq_prio_supported(), use kstrtobool() for the enable path, and expose the NCQ priority attributes only for SATA devices using LeapRAID's target-private SAS device state. Reviewed-by: Damien Le Moal Signed-off-by: Dongdong Hao Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260814090526.395704-1-doubled@leap-io-kernel.com Signed-off-by: Martin K. Petersen (Oracle) commit 00b7c8d4ce441aa9ac704840332ba4738e1c6d51 Author: Linmao Li Date: Fri Aug 14 11:38:45 2026 +0800 scsi: leapraid: Serialize firmware log mmap with teardown leapraid_fw_log_exit() waits for mmap_refcnt to reach zero before it frees the firmware log buffer. leapraid_fw_mmap() checks host_removing, but it does not increment mmap_refcnt until after dma_mmap_coherent() succeeds and the VMA open callback runs. Removal can set host_removing and observe a zero mmap_refcnt between the check and the VMA open. It can then free the coherent buffer while the mmap path is still establishing a userspace mapping of it. Claim a temporary mmap reference while looking up the adapter under leapraid_adapter_lock. Removal deletes the adapter from the same locked list after setting host_removing, so a mapping is either rejected or included in the count that removal waits for. Drop the temporary reference on the common exit path, after a successful VMA open has acquired the reference covering the VMA lifetime. Fixes: 5597088c9e79 ("scsi: leapraid: Add new SCSI driver") Signed-off-by: Linmao Li Reviewed-by: Dongdong Hao Link: https://patch.msgid.link/20260814033845.2971706-3-lilinmao@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) commit 970f69b6bf71562df5afcefb89c77b4e971d68de Author: Linmao Li Date: Fri Aug 14 11:38:44 2026 +0800 scsi: leapraid: Balance host references for firmware log VMAs leapraid_fw_mmap() keeps the Scsi_Host reference obtained while looking up the adapter for the lifetime of the initial VMA. The VMA close callback drops that reference. The open callback is also invoked when a VMA is duplicated or split, but it only increments mmap_refcnt. Since every corresponding close callback drops a host reference, cloning the mapping can release the host while another VMA still refers to the adapter. Take a host device reference for every VMA open and release the lookup reference once the initial mapping has acquired its own reference. Use get_device() because a VMA can be cloned after the host enters SHOST_DEL; an existing VMA still pins the host at that point and open cannot fail. Fixes: 5597088c9e79 ("scsi: leapraid: Add new SCSI driver") Signed-off-by: Linmao Li Reviewed-by: Dongdong Hao Link: https://patch.msgid.link/20260814033845.2971706-2-lilinmao@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) commit 0ec418204f23f0a1dfff79d5f6721080ec006042 Author: Dan Carpenter Date: Thu Aug 13 10:09:32 2026 +0300 scsi: lpfc: Remove unnnecessary NULL check The "evt_dat" variale is non-NULL at this point so there is no need to check. Delete the check and pull the code in a tab. Signed-off-by: Dan Carpenter Reviewed-by: Paul Ely Link: https://patch.msgid.link/an1trOAUeQmYEus_@stanley.mountain Signed-off-by: Martin K. Petersen (Oracle) commit 11e48f5201fd86ffa038809dd9c41144d43ee2e4 Author: Dan Carpenter Date: Thu Aug 13 10:09:53 2026 +0300 scsi: qla2xxx: Fix an loop timeout test This loop timeout with "retries" set to -1, not 0. Fix the test for failure. Fixes: 7ec0effd30bb ("[SCSI] qla2xxx: Add support for ISP8044.") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/an1twcxTYSFkkUTA@stanley.mountain Signed-off-by: Martin K. Petersen (Oracle) commit ff9365a4c9991cca68fd48c7729808f2fdae2036 Author: Dan Carpenter Date: Thu Aug 13 10:08:27 2026 +0300 scsi: qla2xxx: Fix an error code in qla_get_tmf() Negative -EIO was intended instead of positive EIO. The caller, doesn't care so this doesn't affect runtime. It's just a cleanup. Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/an1taxANE_4_vzJT@stanley.mountain Signed-off-by: Martin K. Petersen (Oracle) commit b79b88b655a84187aed12d773566dabf5ab72ed6 Author: Nathan Chancellor Date: Mon Aug 17 12:04:55 2026 -0700 scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work() After commit 696d1cc2aaa2 ("scsi: ibmvfc: process NVMe/FC rports in work thread"), clang warns (or errors with CONFIG_WERROR=y / W=e): drivers/scsi/ibmvscsi/ibmvfc-core.c:6154:15: error: variable 'rport' is uninitialized when used here [-Werror,-Wuninitialized] 6154 | } else if (rport && tgt->action == IBMVFC_TGT_ACTION_DEL_AND_LOGOUT_RPORT) { | ^~~~~ The check for rport is unnecessary in this block, it was accidentally included from copying and pasting. Remove it to clear up the warning. Fixes: 696d1cc2aaa2 ("scsi: ibmvfc: process NVMe/FC rports in work thread") Suggested-by: Tyrel Datwyler Link: https://lore.kernel.org/6ccbe8c5-beb6-483f-bfa4-c2d3819ad5f2@linux.ibm.com/ Signed-off-by: Nathan Chancellor Acked-by: Tyrel Datwyler Link: https://patch.msgid.link/20260817-ibmvscsi-rport-wuninitialized-v1-1-0fdfb27a5f01@kernel.org Signed-off-by: Martin K. Petersen (Oracle) commit d34a88f53a7ab0a4d84fbff137c9077701e95b06 Author: Bart Van Assche Date: Fri Aug 14 16:20:08 2026 +0000 scsi: core: Enable context analysis for hosts.o Enable compiler-based context analysis for drivers/scsi/hosts.c by setting CONTEXT_ANALYSIS_hosts.o := y in drivers/scsi/Makefile. The SCSI host management code in hosts.c now has the necessary lock context annotations (such as __must_hold(shost->host_lock) on scsi_host_set_state) and conforms to compile-time lock checking rules. It builds cleanly without triggering any context analysis warnings. Enable context analysis for hosts.o so that lock correctness and context safety invariants for SCSI host operations are verified at compile time when CONFIG_WARN_CONTEXT_ANALYSIS is enabled. Fixes: fb0fc67db962 ("scsi: core: Enable context analysis") Reported-by: John Garry Signed-off-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/3e1c3c0ca9307e2581cf4b96cf3fcdae35202255.1786724393.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 36b6dcb2b7463b290d63c83d82bec8065a1a93de Author: Ian Bridges Date: Wed Jul 29 09:46:17 2026 -0500 scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions In preparation for removing the strlcat() API[1], replace its uses in lpfc_cmf_info_show(), lpfc_nvme_info_show() and lpfc_scsi_stat_show(). The three functions build sysfs attribute output, and sysfs_emit_at() is the designated helper for that. The single write paths become sysfs_emit(), the offset zero form of the same helper. Each intermediate tmp buffer and its per fragment overflow check become unnecessary. Once the page is full, sysfs_emit_at() writes nothing more, so dropping the early exits does not change the produced bytes. Each loop that appends keeps one exit, so a full page stops the iteration. In lpfc_nvme_info_show() the exit also releases the fc_nodes_list_lock as it did before. The unlock_buf_done label loses its last user and is removed. The old code capped every fragment at LPFC_MAX_INFO_TMP_LEN or LPFC_MAX_SCSI_INFO_TMP_LEN bytes before appending it. The replacement formats each fragment directly into the page, so a fragment longer than its old tmp buffer is no longer truncated when the page has room for it. Both macros lose their last user and are removed. The running length that sysfs_emit_at() maintains equals the length that the removed strnlen() calls computed, so the "Could be more info" overflow markers keep their trigger condition. Link: https://github.com/KSPP/linux/issues/370 [1] Signed-off-by: Ian Bridges Link: https://patch.msgid.link/20260729144617.1388646-6-icb@fastmail.org Reviewed-by: Nigel Kirkland Signed-off-by: Martin K. Petersen (Oracle) commit 4832a60e0a7818400afffa392b74776d084ddf4a Author: Ian Bridges Date: Wed Jul 29 09:46:16 2026 -0500 scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers In preparation for removing the strlcat() API[1], replace its uses in lpfc_debugfs_multixripools_data(), lpfc_debugfs_scsistat_data() and lpfc_debugfs_hdwqstat_data(). Each helper accumulates a variable number of lines into the debugfs buffer, which is what seq_buf is for. The intermediate tmp buffers and the per fragment overflow checks become unnecessary. Once a seq_buf overflows, later writes to it do nothing, so dropping the early exits does not change the produced bytes. Each loop that appends keeps one seq_buf_has_overflowed() exit, so a full buffer stops the iteration. lpfc_debugfs_multixripools_data() and lpfc_debugfs_hdwqstat_data() append to whatever the buffer already holds, so their seq_buf is anchored at the current end of the string. All three helpers keep returning strnlen() because seq_buf_used() reports the full buffer size after an overflow. Link: https://github.com/KSPP/linux/issues/370 [1] Signed-off-by: Ian Bridges Link: https://patch.msgid.link/20260729144617.1388646-5-icb@fastmail.org Reviewed-by: Nigel Kirkland Signed-off-by: Martin K. Petersen (Oracle) commit 22d4cbf6f7509f0aab58d60d488a0082916a2fb0 Author: Ian Bridges Date: Wed Jul 29 09:46:15 2026 -0500 scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report() In preparation for removing the strlcat() API[1], replace its use in lpfc_rx_monitor_report(). The function accumulates one line per ring entry, which is what seq_buf is for. seq_buf tracks the write position, so the per entry strlen() rescans of the destination are gone. Each record is still formatted into the tmp buffer. seq_buf_puts() appends it only when it fits whole, so the output keeps ending at the last complete record. The loop still stops on overflow without consuming the current entry, and the returned count and the ring head keep their old meaning. The produced bytes are unchanged. Link: https://github.com/KSPP/linux/issues/370 [1] Signed-off-by: Ian Bridges Link: https://patch.msgid.link/20260729144617.1388646-4-icb@fastmail.org Reviewed-by: Nigel Kirkland Signed-off-by: Martin K. Petersen (Oracle) commit 07f46a9f8964b91d56951ef7f74c551af0eddeac Author: Ian Bridges Date: Wed Jul 29 09:46:14 2026 -0500 scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name() In preparation for removing the strlcat() API[1], replace its uses in lpfc_vport_symbolic_node_name(). The function builds five unconditional fragments, so one scnprintf() call composes the whole string. The intermediate tmp buffer and the per fragment overflow checks become unnecessary. scnprintf() truncates at the buffer size and returns the number of bytes it wrote, which equals the length that the removed strnlen() call computed. The old code capped every fragment at MAXHOSTNAMELEN bytes before appending it, independently of the room left in the destination. The replacement formats each fragment directly into the destination, so a fragment longer than MAXHOSTNAMELEN is no longer truncated when the destination has room for it. Link: https://github.com/KSPP/linux/issues/370 [1] Signed-off-by: Ian Bridges Link: https://patch.msgid.link/20260729144617.1388646-3-icb@fastmail.org Reviewed-by: Nigel Kirkland Signed-off-by: Martin K. Petersen (Oracle) commit 5a03dbfd670092a6960de433005aae1734c18f1f Author: Ian Bridges Date: Wed Jul 29 09:46:13 2026 -0500 scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info() In preparation for removing the strlcat() API[1], replace its uses in lpfc_info(). The function accumulates a variable number of optional fragments, which is what seq_buf is for. The intermediate tmp buffer and the per fragment overflow checks become unnecessary. seq_buf is memory safe by construction and silently truncates in the same way as the replaced pattern. The old code passed phba->ModelDesc as the format string of the first scnprintf() call. The model description comes from adapter VPD data. seq_buf_printf() takes a format string, so the replacement prints it through "%s". A model description containing conversion specifiers is no longer interpreted. Link: https://github.com/KSPP/linux/issues/370 [1] Signed-off-by: Ian Bridges Link: https://patch.msgid.link/20260729144617.1388646-2-icb@fastmail.org Reviewed-by: Nigel Kirkland Signed-off-by: Martin K. Petersen (Oracle) commit fb0fc67db96292a65539e63f536c6f586490c78b Author: Bart Van Assche Date: Fri Aug 7 15:49:51 2026 -0700 scsi: core: Enable context analysis Enable context analysis for those SCSI core files that build without triggering any context analysis warnings. Signed-off-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/2576d2f7e3530b721b5050ac6d25c413037d7e7e.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 4c461ee2b2a5a7c327fe092b41de1fcc002adc01 Author: Bart Van Assche Date: Fri Aug 7 15:49:50 2026 -0700 scsi: core: Protect host state changes with the host lock Some but not all SCSI host state changes are protected with the SCSI host lock. Annotate the SCSI host state with __guarded_by(host_lock) and protect all SCSI host state changes with the SCSI host lock. This patch prevents that KCSAN complains about data races when accessing the SCSI host state. Reported-by: Jianzhou Zhao Closes: https://lore.kernel.org/all/36d59d0e.6db0.19cdbeee01b.Coremail.luckd0g@163.com/ Signed-off-by: Bart Van Assche Reviewed-by: John Garry Link: https://patch.msgid.link/681e4a5260c182feb5fc1d96f0d43c62c21dc6c9.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 09982efcc07e739c7e4ac6089e3e521132388b53 Author: Bart Van Assche Date: Fri Aug 7 15:49:49 2026 -0700 scsi: core: Add lock context annotations Document which functions expect that shost->scan_mutex is held. Reviewed-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/ad5ca37acf8c933a12830c0811c293af54c87573.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit e70647b25a641b9f5602558839182d036b512de5 Author: Bart Van Assche Date: Fri Aug 7 15:49:48 2026 -0700 scsi: core: Pass the SCSI host pointer directly to scanning functions In the functions scsi_probe_and_add_lun(), scsi_sequential_lun_scan(), scsi_report_lun_scan() and __scsi_scan_target() the SCSI host pointer is derived from the SCSI target pointer. Pass the SCSI host pointer directly. This patch prepares for enabling context analysis. With this patch applied, context annotations can refer to the SCSI host pointer directly, e.g. __must_hold(&shost->scan_mutex). Without this patch, the following annotation would have to be used: __must_hold(&dev_to_shost(starget->dev.parent)->scan_mutex) Additionally, in code that locks shost->scan_mutex, the following would have to be added to help the compiler understand that shost == dev_to_shost(starget->dev.parent): __assume_ctx_lock(&dev_to_shost(starget->dev.parent)->scan_mutex); __assume_ctx_lock() statements should be avoided if there is a good alternative. Hence this patch. No functionality has been changed. Reviewed-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/49d2fc5fae5cb5dca2536818155581c73f39c883.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit ff5d552022b35f7475bdc538173b3ceb95d55d85 Author: Bart Van Assche Date: Fri Aug 7 15:49:47 2026 -0700 scsi: ufs: core: Enable context analysis Annotate functions that modify the state of a synchronization object. Remove the struct semaphore annotations because lock context annotations are not supported for semaphores. Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/3c975386a5bcb939f8a2a0d47fd621f234321a9e.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit 720d8b2f2457f4962ca353dd90395e2660d9a10d Author: Bart Van Assche Date: Fri Aug 7 15:49:46 2026 -0700 scsi: ufs: core: Set task state before io_schedule_timeout() Set the task state to TASK_UNINTERRUPTIBLE before calling io_schedule_timeout() in ufshcd_wait_for_pending_cmds(). Without setting the task state, io_schedule_timeout() returns immediately because the task state remains TASK_RUNNING. This results in a busy loop that wastes CPU cycles. Fixes: 2000bc309703 ("scsi: ufs: core: Reduce the clock scaling latency") Reviewed-by: Peter Wang Reported-by: Sashiko Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/8fe4526ce272811b28e99048b42358dd8f7c48af.1786142946.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) commit db441dcb8c1452279956b7ea4e394b5ce8ce77f1 Author: Xingui Yang Date: Tue Aug 11 12:03:34 2026 +0800 scsi: libsas: Add linkrate and sas_addr change detection in rediscover Introduce sas_dev_is_flutter() and sas_rediscover_ex_phy() to improve flutter and device replace detection during rediscovery. sas_dev_is_flutter() calls sas_ex_phy_discover() before looking up the child device via sas_ex_phy_to_dev(), ensuring the PHY state is always updated and avoiding use-after-free since the child device pointer is obtained after the sleeping SMP request completes. Add validation for linkrate and sas_addr changes. When the SAS address changes, phy->attached_sas_addr is restored to the original address before returning false, so sas_unregister_devs_sas_addr() can properly match and unregister the old device. The sas_addr check is ordered before the linkrate check to avoid skipping the restoration when both change simultaneously. sas_rediscover_ex_phy() uses the async discovery pattern (sas_discover_event) instead of the synchronous sas_discover_new() to ensure proper ordering between device unregistration and rediscovery, avoiding sysfs_warn_dup() errors. Signed-off-by: Xingui Yang Suggested-by: John Garry Link: https://patch.msgid.link/20260811040334.4184911-3-yangxingui@huawei.com Signed-off-by: Martin K. Petersen (Oracle) commit 4c2128c1a399318859d9eea0b74613d90f4bcb66 Author: Xingui Yang Date: Tue Aug 11 12:03:33 2026 +0800 scsi: libsas: Add sas_ex_phy_to_dev() helper Add sas_ex_phy_to_dev() to return any device type attached to an expander phy, and refactor sas_ex_to_ata() to use it. No functional changes intended. Signed-off-by: Xingui Yang Reviewed-by: John Garry Link: https://patch.msgid.link/20260811040334.4184911-2-yangxingui@huawei.com Signed-off-by: Martin K. Petersen (Oracle) commit b9f679dfe629004b593f018df33b330d799bcee4 Author: Chandrakanth Patil Date: Sat Aug 8 20:40:10 2026 +0530 scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers _base_release_memory_pools() unconditionally frees every ioc->pcie_sg_lookup[] entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warning on debug kernels or a NULL pointer dereference otherwise. Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Reported-by: Laurence Oberman Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20260808151010.185603-1-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen (Oracle) commit 431e735e9bb6b7fd8e2ea9d83f0627bb5c5687ee Author: Nathan Chancellor Date: Tue Aug 11 14:39:51 2026 -0700 scsi: qla2xxx: Fix size_t format specifier in qla29xx_process_rd_image() After commit c3930ec119cb ("scsi: qla2xxx: Add FC operational firmware load for 29xx"), there is a warning due to an incorrect format specifier for a 'size_t' variable when building for 32-bit platforms, for which 'size_t' is 'unsigned int': drivers/scsi/qla2xxx/qla_init.c: In function 'qla29xx_process_rd_image': drivers/scsi/qla2xxx/qla_init.c:9272:74: error: format '%lx' expects argument of type 'long unsigned int', but argument 6 has type 'size_t' {aka 'unsigned int'} [-Werror=format=] 9272 | "TIM section too large (0x%x bytes, ring 0x%lx bytes).\n", | ~~^ | | | long unsigned int | %x 9273 | section_size, 9274 | req->length * qla_req_entry_size(ha)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | size_t {aka unsigned int} cc1: all warnings being treated as errors Use '%zx', the proper 'size_t' format specifier, to clear up the warning. Fixes: c3930ec119cb ("scsi: qla2xxx: Add FC operational firmware load for 29xx") Signed-off-by: Nathan Chancellor Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260811-scsi-qla2xxxx-qla_init-wformat-v1-1-50760021914f@kernel.org Signed-off-by: Martin K. Petersen (Oracle)