From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
When buffered_io is enabled, nvmet_bdev_ns_enable() returns -ENOTBLK
without checking whether device_path is configured. nvmet_ns_enable()
then falls back to nvmet_file_ns_enable(), which passes the NULL
device_path to filp_open() and causes a NULL pointer dereference.
Validate device_path before attempting to enable to namespace and
return -EINVAL when it has not been configured.
Fixes: 6f6d604b4ef8 ("nvmet: allow bdev in buffered_io mode")
Reported-by: syzbot+6c46a179b56c651c4c96@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c46a179b56c651c4c96
Tested-by: syzbot+6c46a179b56c651c4c96@syzkaller.appspotmail.com
Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
---
drivers/nvme/target/core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index d74c01c98f19..336013139ef6 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -591,6 +591,11 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
if (ns->enabled)
goto out_unlock;
+ if (!ns->device_path) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
+
ret = nvmet_bdev_ns_enable(ns);
if (ret == -ENOTBLK)
ret = nvmet_file_ns_enable(ns);
--
2.43.0