In quirks_param_set(), if nvme_parse_quirk_entry() fails to parse an
entry from the user-provided quirks string, the function prints an
error message with pr_err() and jumps to out_free_qlist to free
resources.

However, the variable 'err' is not updated upon parse failure,
retaining the value '0' from the preceding call to
param_set_copystring(). As a result, quirks_param_set() frees the
allocated memory but returns 0 (success) to the kernel parameter
subsystem, silently masking the parsing failure and incorrectly
reporting success to the caller.

Fix this by explicitly setting 'err = -EINVAL;' before jumping to
out_free_qlist, ensuring that parse failures are correctly propagated
to the caller.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
 drivers/nvme/host/pci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 69932d640b53..560560268c05 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -213,6 +213,7 @@ static int quirks_param_set(const char *value, const struct kernel_param *kp)
 		if (nvme_parse_quirk_entry(field, &qlist[i])) {
 			pr_err("nvme: failed to parse quirk string %s\n",
 				value);
+			err = -EINVAL;
 			goto out_free_qlist;
 		}
 
-- 
2.54.0

On Sat, Aug 15, 2026 at 01:47:45PM +0000, Sreeraj S Kurup wrote:
> In quirks_param_set(), if nvme_parse_quirk_entry() fails to parse an
> entry from the user-provided quirks string, the function prints an
> error message with pr_err() and jumps to out_free_qlist to free
> resources.
> 
> However, the variable 'err' is not updated upon parse failure,
> retaining the value '0' from the preceding call to
> param_set_copystring(). As a result, quirks_param_set() frees the
> allocated memory but returns 0 (success) to the kernel parameter
> subsystem, silently masking the parsing failure and incorrectly
> reporting success to the caller.
> 
> Fix this by explicitly setting 'err = -EINVAL;' before jumping to
> out_free_qlist, ensuring that parse failures are correctly propagated
> to the caller.

This fix was submitted earlier:

https://lore.kernel.org/linux-nvme/20260729105958.1403095-1-kanie@linux.alibaba.com/

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>