diff options
| author | Seokgyu Choi <tjrrb0313@gmail.com> | 2026-08-27 07:52:21 +0000 |
|---|---|---|
| committer | Keith Busch <kbusch@kernel.org> | 2026-09-03 14:15:11 -0700 |
| commit | 09d0c07bd9ce3b2f2d993f672698d32a17543c32 (patch) | |
| tree | c9db24bfd9646e914876771b407c042d0ba8f5dc | |
| parent | eaa948c0e19b1bb2d93262207bca0c3d19cc3406 (diff) | |
| download | linux-next-09d0c07bd9ce3b2f2d993f672698d32a17543c32.tar.gz linux-next-09d0c07bd9ce3b2f2d993f672698d32a17543c32.zip | |
nvmet: reject namespace enable without device path
A newly allocated namespace has a NULL device_path until userspace
configures the device_path attribute.
If buffered_io is enabled before device_path is configured,
nvmet_bdev_ns_enable() returns -ENOTBLK and nvmet_ns_enable() falls
back to nvmet_file_ns_enable(). The latter passes the NULL
device_path to filp_open(), causing a NULL pointer dereference in
getname_kernel().
Reject namespace enable when device_path has not been configured.
Reported-by: syzbot+f613f9f010ec98eb9d86@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f613f9f010ec98eb9d86
Signed-off-by: Seokgyu Choi <tjrrb0313@gmail.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
| -rw-r--r-- | drivers/nvme/target/core.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c index 1663ab7ac607..43871a8f56ca 100644 --- a/drivers/nvme/target/core.c +++ b/drivers/nvme/target/core.c @@ -591,6 +591,11 @@ int nvmet_ns_enable(struct nvmet_ns *ns) if (ns->enabled) goto out_unlock; + if (!ns->device_path) { + ret = -EINVAL; + goto out_unlock; + } + ret = nvmet_bdev_ns_enable(ns); if (ret == -ENOTBLK) ret = nvmet_file_ns_enable(ns); |