6.12-stable patches

added patches:
	ata-libata-eh-fix-detection-of-deferred-qc-timeouts.patch

diff --git a/queue-6.12/ata-libata-eh-fix-detection-of-deferred-qc-timeouts.patch b/queue-6.12/ata-libata-eh-fix-detection-of-deferred-qc-timeouts.patch
new file mode 100644 (file)
index 0000000..b79536f
--- /dev/null
+++ b/queue-6.12/ata-libata-eh-fix-detection-of-deferred-qc-timeouts.patch
@@ -0,0 +1,48 @@
+From ee0e6e69a772d601e152e5368a1da25d656122a8 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 5 Mar 2026 18:48:05 -0800
+Subject: ata: libata-eh: Fix detection of deferred qc timeouts
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit ee0e6e69a772d601e152e5368a1da25d656122a8 upstream.
+
+If the ata_qc_for_each_raw() loop finishes without finding a matching SCSI
+command for any QC, the variable qc will hold a pointer to the last element
+examined, which has the tag i == ATA_MAX_QUEUE - 1. This qc can match the
+port deferred QC (ap->deferred_qc).
+
+If that happens, the condition qc == ap->deferred_qc evaluates to true
+despite the loop not breaking with a match on the SCSI command for this QC.
+In that case, the error handler mistakenly intercepts a command that has
+not been issued yet and that has not timed out, and thus erroneously
+returning a timeout error.
+
+Fix the problem by checking for i < ATA_MAX_QUEUE in addition to
+qc == ap->deferred_qc.
+
+The problem was found by an experimental code review agent based on
+gemini-3.1-pro while reviewing backports into v6.18.y.
+
+Assisted-by: Gemini:gemini-3.1-pro
+Fixes: eddb98ad9364 ("ata: libata-eh: correctly handle deferred qc timeouts")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+[cassel: modified commit log as suggested by Damien]
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-eh.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -649,7 +649,7 @@ void ata_scsi_cmd_error_handler(struct S
+                               break;
+               }
+ 
+-              if (qc == ap->deferred_qc) {
++              if (i < ATA_MAX_QUEUE && qc == ap->deferred_qc) {
+                       /*
+                        * This is a deferred command that timed out while
+                        * waiting for the command queue to drain. Since the qc

diff --git a/queue-6.12/series b/queue-6.12/series
index a209b1c19dad810c0673bea83233ca2505e4ec6b..b251cecaad75234bc9bae800332d5dd85b4a3177 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -262,3 +262,4 @@ ext4-fix-potential-null-deref-in-ext4_mb_init.patch
 ata-libata-core-fix-cancellation-of-a-port-deferred-qc-work.patch
 ata-libata-eh-correctly-handle-deferred-qc-timeouts.patch
 ata-libata-cancel-pending-work-after-clearing-deferred_qc.patch
+ata-libata-eh-fix-detection-of-deferred-qc-timeouts.patch