qla2x00t-32gbit: Fix FCE trace enable parsing in debugfs

qla2x00_dfs_fce_write() called kstrtoul() with a NULL result pointer,
so a successful parse would dereference NULL and oops. Worse, the int
return value (0 on success, negative errno on failure) was assigned to
the unsigned long enable flag, inverting the intended logic: a valid
number was treated as "disable" while a parse failure enabled FCE.

Parse the value into enable and propagate parse errors to userspace.

Fixes: 841df27d619e ("scsi: qla2xxx: Move FCE Trace buffer allocation to user control")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-10-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

[ commit b7368687e3d11f51392d3c4774ec0263d5fbf31f upstream ]
This commit is contained in:
Nilesh Javali
2026-10-19 17:38:13 +03:00
committed by Gleb Chesnokov
parent 9d0bb4fd0a
commit ec36f8fb80
+3 -1
View File
@@ -514,7 +514,9 @@ qla2x00_dfs_fce_write(struct file *file, const char __user *buffer,
return PTR_ERR(buf);
}
enable = kstrtoul(buf, 0, 0);
rc = kstrtoul(buf, 0, &enable);
if (rc)
goto out_free;
rc = count;
mutex_lock(&ha->fce_mutex);