[PATCH 1/2] nvmet: preserve device path on allocation failure.

[PATCH 1/2] nvmet: preserve device path on allocation failure.

[Julian Sun]

nvmet_ns_device_path_store() frees the old path before allocating its
replacement, losing the existing configuration if allocation fails.
Allocate the new path before freeing the old one.

Fixes: a07b4970f464 ("nvmet: add a generic NVMe target")
Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
---
 drivers/nvme/target/configfs.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index 413ee2d16d29..37998bb91408 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -534,6 +534,7 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,
 	struct nvmet_subsys *subsys = ns->subsys;
 	size_t len;
 	int ret;
+	char *new_path = NULL;
 
 	mutex_lock(&subsys->lock);
 	ret = -EBUSY;
@@ -545,12 +546,14 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,
 	if (!len)
 		goto out_unlock;
 
-	kfree(ns->device_path);
 	ret = -ENOMEM;
-	ns->device_path = kmemdup_nul(page, len, GFP_KERNEL);
-	if (!ns->device_path)
+	new_path = kmemdup_nul(page, len, GFP_KERNEL);
+	if (!new_path)
 		goto out_unlock;
 
+	kfree(ns->device_path);
+	ns->device_path = new_path;
+
 	mutex_unlock(&subsys->lock);
 	return count;
 
-- 
2.39.5

[PATCH 2/2] nvmet: reject enabling a namespace without a device path

[Julian Sun]

With buffered I/O enabled, nvmet_bdev_ns_enable() returns -ENOTBLK
before validating the device path. Enabling a namespace without setting
device_path therefore passes NULL to filp_open() and crashes in
getname_kernel().

Reject enabling a namespace if no device path has been configured.

Fixes: 6f6d604b4ef8 ("nvmet: allow bdev in buffered_io mode")
Reported-by: syzbot+6c46a179b56c651c4c96@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c46a179b56c651c4c96
Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
---
 drivers/nvme/target/core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index d74c01c98f19..d73524947d63 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -591,6 +591,10 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
 	if (ns->enabled)
 		goto out_unlock;
 
+	ret = -EINVAL;
+	if (!ns->device_path)
+		goto out_unlock;
+
 	ret = nvmet_bdev_ns_enable(ns);
 	if (ret == -ENOTBLK)
 		ret = nvmet_file_ns_enable(ns);
-- 
2.39.5

Re: [PATCH 2/2] nvmet: reject enabling a namespace without a device path

[Christoph Hellwig]

On Tue, Sep 08, 2026 at 11:35:19AM +0800, Julian Sun wrote:
> With buffered I/O enabled, nvmet_bdev_ns_enable() returns -ENOTBLK
> before validating the device path. Enabling a namespace without setting
> device_path therefore passes NULL to filp_open() and crashes in
> getname_kernel().
> 
> Reject enabling a namespace if no device path has been configured.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Can you add test for this to blktests?

Re: [PATCH 2/2] nvmet: reject enabling a namespace without a device path

[Julian Sun]

On 9/10/26 1:42 PM, Christoph Hellwig wrote:
> On Tue, Sep 08, 2026 at 11:35:19AM +0800, Julian Sun wrote:
>> With buffered I/O enabled, nvmet_bdev_ns_enable() returns -ENOTBLK
>> before validating the device path. Enabling a namespace without setting
>> device_path therefore passes NULL to filp_open() and crashes in
>> getname_kernel().
>>
>> Reject enabling a namespace if no device path has been configured.
> 
> Looks good:
> 
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> 
> Can you add test for this to blktests?

I noticed that this has already been fixed:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=09d0c07bd9ce3b2f2d993f672698d32a17543c32

But sure, I'll add a test to blktests.

Thanks,
-- 
Julian Sun <sunjunchao@bytedance.com>

Re: [PATCH 1/2] nvmet: preserve device path on allocation failure.

[Christoph Hellwig]

Can you coordinate this with the configfs path checking series
from Runyu Xiao?  That one had a few resends, so I'd like to get it in
first.

Re: [PATCH 1/2] nvmet: preserve device path on allocation failure.

[Julian Sun]

On 9/10/26 1:25 PM, Christoph Hellwig wrote:
> Can you coordinate this with the configfs path checking series
> from Runyu Xiao?  That one had a few resends, so I'd like to get it in
> first.

Sure, I'll rebase and resend once you've merged Runyu's patches.

Thanks,
-- 
Julian Sun <sunjunchao@bytedance.com>

Re: [PATCH 1/2] nvmet: preserve device path on allocation failure.

[Christoph Hellwig]

On Thu, Sep 10, 2026 at 01:35:10PM +0800, Julian Sun wrote:
> On 9/10/26 1:25 PM, Christoph Hellwig wrote:
>> Can you coordinate this with the configfs path checking series
>> from Runyu Xiao?  That one had a few resends, so I'd like to get it in
>> first.
>
> Sure, I'll rebase and resend once you've merged Runyu's patches.

Actually I noticed we need another respin of that anyway.  Let me review
your patches and see if we can fast track them in.

Re: [PATCH 1/2] nvmet: preserve device path on allocation failure.

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH 1/2] nvmet: preserve device path on allocation failure.

[Keith Busch]

On Tue, Sep 08, 2026 at 11:35:18AM +0800, Julian Sun wrote:
> nvmet_ns_device_path_store() frees the old path before allocating its
> replacement, losing the existing configuration if allocation fails.
> Allocate the new path before freeing the old one.

Thanks, applied to nvme-7.3.