commit 0444568edbf87c1da76b61c798ce0f1c1e478467
Author: Ajay Neeli <ajay.neeli@amd.com>
Date:   Wed Dec 24 11:09:50 2025 +0530

    scsi: ufs: amd-versal2: Fix PHY initialization in HCE enable notify
    
    Move the PHY initialization from PRE_CHANGE to POST_CHANGE in the
    ufs_versal2_hce_enable_notify() callback. This ensures that the PHY is
    initialized after the host controller enable sequence is complete, rather
    than before it starts.
    
    The PHY initialization requires the UFS host controller to be in a stable
    enabled state to properly configure the MPHY registers. Moving this to
    POST_CHANGE aligns with the expected initialization order and prevents
    potential timing issues during controller startup.
    
    Fixes: 769b8b2ffded ("scsi: ufs: amd-versal2: Add UFS support for AMD Versal Gen 2 SoC")
    Signed-off-by: Ajay Neeli <ajay.neeli@amd.com>
    Link: https://patch.msgid.link/20251224053950.54213-1-ajay.neeli@amd.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit b2d6b1d443009ed4da2d69f5423ab38e5780505a
Author: Kery Qi <qikeyu2017@gmail.com>
Date:   Wed Jan 21 19:45:15 2026 +0800

    scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
    
    The code in sbp_make_tpg() limits "tpgt" to UINT_MAX but the data type of
    "tpg->tport_tpgt" is u16. This causes a type truncation issue.
    
    When a user creates a TPG via configfs mkdir, for example:
    
        mkdir /sys/kernel/config/target/sbp/<wwn>/tpgt_70000
    
    The value 70000 passes the "tpgt > UINT_MAX" check since 70000 is far less
    than 4294967295. However, when assigned to the u16 field tpg->tport_tpgt,
    the value is silently truncated to 4464 (70000 & 0xFFFF). This causes the
    value the user specified to differ from what is actually stored, leading to
    confusion and potential unexpected behavior.
    
    Fix this by changing the type of "tpgt" to u16 and using kstrtou16() which
    will properly reject values outside the u16 range.
    
    Fixes: a511ce339780 ("sbp-target: Initial merge of firewire/ieee-1394 target mode support")
    Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
    Link: https://patch.msgid.link/20260121114515.1829-2-qikeyu2017@gmail.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit 4747bafaa50115d9667ece446b1d2d4aba83dc7f
Author: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Date:   Sat Dec 13 16:36:43 2025 +0800

    scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
    
    If nonemb_cmd->va fails to be allocated, free the allocation previously
    made by alloc_mcc_wrb().
    
    Fixes: 50a4b824be9e ("scsi: be2iscsi: Fix to make boot discovery non-blocking")
    Cc: stable@vger.kernel.org
    Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
    Link: https://patch.msgid.link/20251213083643.301240-1-lihaoxiang@isrc.iscas.ac.cn
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

commit 56bd3c0f749f45793d1eae1d0ddde4255c749bf6
Author: Thomas Fourier <fourier.thomas@gmail.com>
Date:   Mon Jan 12 14:43:24 2026 +0100

    scsi: qla2xxx: edif: Fix dma_free_coherent() size
    
    Earlier in the function, the ha->flt buffer is allocated with size
    sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE but freed in the error
    path with size SFP_DEV_SIZE.
    
    Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
    Cc: stable@vger.kernel.org
    Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
    Link: https://patch.msgid.link/20260112134326.55466-2-fourier.thomas@gmail.com
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>