[PATCH 2/2] nvmet: reject enabling a namespace without a device path

[Julian Sun]

With buffered I/O enabled, nvmet_bdev_ns_enable() returns -ENOTBLK
before validating the device path. Enabling a namespace without setting
device_path therefore passes NULL to filp_open() and crashes in
getname_kernel().

Reject enabling a namespace if no device path has been configured.

Fixes: 6f6d604b4ef8 ("nvmet: allow bdev in buffered_io mode")
Reported-by: syzbot+6c46a179b56c651c4c96 at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c46a179b56c651c4c96
Signed-off-by: Julian Sun <sunjunchao at bytedance.com>
---
 drivers/nvme/target/core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index d74c01c98f19..d73524947d63 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -591,6 +591,10 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
 	if (ns->enabled)
 		goto out_unlock;
 
+	ret = -EINVAL;
+	if (!ns->device_path)
+		goto out_unlock;
+
 	ret = nvmet_bdev_ns_enable(ns);
 	if (ret == -ENOTBLK)
 		ret = nvmet_file_ns_enable(ns);
-- 
2.39.5