[BUG] nvmet: NULL pointer dereference in nvmet_file_ns_enable without device_path

[ZW Tang]

Hi,

I am reporting a NULL pointer dereference triggered by a syzkaller
reproducer on Linux 7.2.0-rc3. A similar issue appears to have been
reported before, but I can still reproduce it on Linux 7.2.0-rc3 with HEAD
commit 1137d8b5df06137fb49513cc923b3b24d94cb809.

The reproducer mounts configfs, creates an NVMe target subsystem and a
namespace, sets buffered_io to 1, and then enables the namespace without
setting a device_path. During the enable path, nvmet_ns_enable_store()
calls nvmet_ns_enable(), which then reaches nvmet_file_ns_enable().
nvmet_file_ns_enable() passes ns->device_path to filp_open(), but
ns->device_path is NULL. This eventually reaches do_getname_kernel() and
strlen(), causing a NULL pointer dereference.

This looks like an nvmet configfs validation issue. Enabling a namespace
without a configured device_path should be rejected cleanly instead of
passing a NULL path to filp_open().

Reproducer:

syz reproducer: https://pastebin.com/raw/HheWvkXb
console output: https://pastebin.com/raw/K1ppzMhe
kernel config: https://pastebin.com/raw/EhG6vG6K

Kernel:

HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full) (QEMU Ubuntu 24.10)

Relevant log:

nvmet: adding nsid 1 to subsystem testnqn

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

CPU: 0 UID: 0 PID: 10781 Comm: syz.0.17 Not tainted 7.2.0-rc3 #1 PREEMPT(full)
Hardware name: QEMU Ubuntu 24.10 PC (i440FX + PIIX, 1996)

RIP: 0010+0x1e/0xa0

Call Trace:
<TASK>
do_getname_kernel+0x1d/0x250
filp_open+0x1d/0x50
nvmet_file_ns_enable+0x97/0x4a0
nvmet_ns_enable+0x494/0x6b0
nvmet_ns_enable_store+0x11c/0x150
configfs_write_iter+0x2f4/0x4c0
vfs_write+0xbaf/0x1160
ksys_write+0x121/0x240
do_syscall_64+0xc4/0x7a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>

Kernel panic - not syncing: Fatal exception