qla2x00_dfs_fce_release() tests ha->flags.fce_enabled and ha->fce before taking fce_mutex. Since commit 841df27d619e ("scsi: qla2xxx: Move FCE Trace buffer allocation to user control") the buffer can be freed at runtime by writing 0 to the fce debugfs file, which clears ha->fce under fce_mutex. If that write runs between the unlocked check and mutex_lock() in release, release goes on to memset(ha->fce, ...) with ha->fce == NULL: CPU0 (close) CPU1 (echo 0 > fce) !ha->fce -> false mutex_lock(&ha->fce_mutex) qla2x00_free_fce_trace() ha->fce = NULL mutex_unlock(&ha->fce_mutex) mutex_lock(&ha->fce_mutex) memset(NULL, 0, ...) Move the check under fce_mutex. Fixes: 841df27d619e ("scsi: qla2xxx: Move FCE Trace buffer allocation to user control") Cc: stable@vger.kernel.org Signed-off-by: Daniel Wagner --- drivers/scsi/qla2xxx/qla_dfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c index 5d08bdbcf70a..247174a38d94 100644 --- a/drivers/scsi/qla2xxx/qla_dfs.c +++ b/drivers/scsi/qla2xxx/qla_dfs.c @@ -464,11 +464,11 @@ qla2x00_dfs_fce_release(struct inode *inode, struct file *file) struct qla_hw_data *ha = vha->hw; int rval; - if (ha->flags.fce_enabled || !ha->fce) - goto out; - mutex_lock(&ha->fce_mutex); + if (ha->flags.fce_enabled || !ha->fce) + goto unlock; + /* Re-enable FCE tracing. */ ha->flags.fce_enabled = 1; memset(ha->fce, 0, fce_calc_size(ha->fce_bufs)); @@ -480,8 +480,8 @@ qla2x00_dfs_fce_release(struct inode *inode, struct file *file) ha->flags.fce_enabled = 0; } +unlock: mutex_unlock(&ha->fce_mutex); -out: return single_release(inode, file); } --- base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8 change-id: 20261029-qla2xxx-fix-91c92616c10c Best regards, -- Daniel Wagner