A newly allocated namespace has a NULL device_path until userspace
configures the device_path attribute.

If buffered_io is enabled before device_path is configured,
nvmet_bdev_ns_enable() returns -ENOTBLK and nvmet_ns_enable() falls
back to nvmet_file_ns_enable(). The latter passes the NULL
device_path to filp_open(), causing a NULL pointer dereference in
getname_kernel().

Reject namespace enable when device_path has not been configured.

Reported-by: syzbot+f613f9f010ec98eb9d86@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f613f9f010ec98eb9d86
Signed-off-by: Seokgyu Choi <tjrrb0313@gmail.com>
---
 drivers/nvme/target/core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index d74c01c98f19..336013139ef6 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -591,6 +591,11 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
 	if (ns->enabled)
 		goto out_unlock;
 
+	if (!ns->device_path) {
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+
 	ret = nvmet_bdev_ns_enable(ns);
 	if (ret == -ENOTBLK)
 		ret = nvmet_file_ns_enable(ns);
-- 
2.53.0

On Thu, Aug 27, 2026 at 07:52:21AM +0000, Seokgyu Choi wrote:
> A newly allocated namespace has a NULL device_path until userspace
> configures the device_path attribute.
> 
> If buffered_io is enabled before device_path is configured,
> nvmet_bdev_ns_enable() returns -ENOTBLK and nvmet_ns_enable() falls
> back to nvmet_file_ns_enable(). The latter passes the NULL
> device_path to filp_open(), causing a NULL pointer dereference in
> getname_kernel().
> 
> Reject namespace enable when device_path has not been configured.

Thanks, applied to nvme-7.3.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Reviewed-by: Sagi Grimberg <sagi@grimberg.me>