nvmet: fixup crash on NULL device path

When writing an empty string into the device_path attribute the kernel will crash with

nvmet: failed to open block device (null): (-22)

BUG: unable to handle kernel NULL pointer dereference at 0000000000000000

This patch sanitizes the error handling for invalid device path settings.

---
 drivers/nvme/target/configfs.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

index 3ba5ea5c4376..b41db23260de 100644
@@ -311,6 +311,7 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,
 {
 	struct nvmet_ns *ns = to_nvmet_ns(item);
 	struct nvmet_subsys *subsys = ns->subsys;
+	size_t len;
 	int ret;
 
 	mutex_lock(&subsys->lock);

@@ -318,10 +319,14 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,
 	if (ns->enabled)
 		goto out_unlock;
 
-	kfree(ns->device_path);
+	ret = -EINVAL;
+	len = strcspn(page, "\n");
+	if (!len)
+		goto out_unlock;
 
+	kfree(ns->device_path);
 	ret = -ENOMEM;
-	ns->device_path = kstrndup(page, strcspn(page, "\n"), GFP_KERNEL);
+	ns->device_path = kstrndup(page, len, GFP_KERNEL);
 	if (!ns->device_path)
 		goto out_unlock;
 

2.12.3

Looks good.

From: Linux-nvme <[email protected]> on behalf of Hannes Reinecke <[email protected]>
Sent: Tuesday, July 24, 2018 11:35 PM
To: Christoph Hellwig
Cc: Keith Busch; Hannes Reinecke; Sagi Grimberg; linux-nvme at lists.infradead.org; Hannes Reinecke
Subject: [PATCH] nvmet: fixup crash on NULL device path
?

When writing an empty string into the device_path attribute the kernel will crash with

nvmet: failed to open block device (null): (-22)

BUG: unable to handle kernel NULL pointer dereference at 0000000000000000

This patch sanitizes the error handling for invalid device path settings.

---
?drivers/nvme/target/configfs.c | 9 +++++++--
?1 file changed, 7 insertions(+), 2 deletions(-)

index 3ba5ea5c4376..b41db23260de 100644
@@ -311,6 +311,7 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,

?{
???????? struct nvmet_ns *ns = to_nvmet_ns(item);
???????? struct nvmet_subsys *subsys = ns->subsys;
+?????? size_t len;
???????? int ret;
?
???????? mutex_lock(&subsys->lock);
@@ -318,10 +319,14 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item, ???????? if (ns->enabled)
???????????????? goto out_unlock;
?
-?????? kfree(ns->device_path);
+?????? ret = -EINVAL;
+?????? len = strcspn(page, "\n");
+?????? if (!len)
+?????????????? goto out_unlock;
?
+?????? kfree(ns->device_path);
???????? ret = -ENOMEM;
-?????? ns->device_path = kstrndup(page, strcspn(page, "\n"), GFP_KERNEL); +?????? ns->device_path = kstrndup(page, len, GFP_KERNEL);
???????? if (!ns->device_path)
???????????????? goto out_unlock;
?

2.12.3


_______________________________________________
Linux-nvme mailing list
Linux-nvme at lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-nvme

Thanks,

applied to nvme-4.18.