From: Yuqiang Sun <izaiahsun@gmail.com>
To: haris.iqbal@ionos.com, jinpu.wang@ionos.com
Cc: jgg@ziepe.ca, leon@kernel.org, guoqing.jiang@linux.dev,
gi-oh.kim@ionos.com, aleksei.marov@ionos.com,
lgs201920130244@gmail.com, linux-rdma@vger.kernel.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: [PATCH 3/3] RDMA/rtrs-srv: Reject an empty pathname
Date: Thu, 29 Oct 2026 12:27:19 +0800 [thread overview]
Message-ID: <20261029042719.75868-4-izaiahsun@gmail.com> (raw)
In-Reply-To: <20261029042719.75868-1-izaiahsun@gmail.com>
process_info_req() uses the pathname sent by the client as the name of
the session device and rejects names containing '/' or '.', but it
accepts an empty one. dev_set_name() succeeds for it, and device_add()
then fails in kobject_add_internal(), which warns about the empty name.
Reject an empty pathname together with the other invalid ones.
Build-tested with x86_64 and arm64 allmodconfig (W=1, sparse): no new
warnings. Run-tested under KVM with KASAN, lockdep and kmemleak, using
a small user-space rtrs client that sends an empty pathname: the server
now rejects it at the check above, nothing is reported, and an ordinary
rnbd map, I/O and unmap afterwards still work. Not tested on RDMA
hardware.
Fixes: dea7bb3ad3e0 ("RDMA/rtrs: Do not allow sessname to contain special symbols / and .")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5 kbound
Signed-off-by: Yuqiang Sun <izaiahsun@gmail.com>
---
drivers/infiniband/ulp/rtrs/rtrs-srv.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
index 56f0ab5a7619..d34a177f7ba2 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
@@ -823,6 +823,10 @@ static int process_info_req(struct rtrs_srv_con *con,
return err;
}
+ if (!msg->pathname[0]) {
+ rtrs_err(s, "pathname cannot be empty\n");
+ return -EINVAL;
+ }
if (strchr(msg->pathname, '/') || strchr(msg->pathname, '.')) {
rtrs_err(s, "pathname cannot contain / and .\n");
return -EINVAL;
--
2.53.0
next prev parent reply other threads:[~2026-10-29 4:27 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-29 4:27 [PATCH 0/3] RDMA/rtrs-srv: fix use-after-free on sysfs setup failure Yuqiang Sun
2026-10-29 4:27 ` [PATCH 1/3] RDMA/rtrs-srv: Do not free the path on path file creation failure Yuqiang Sun
2026-10-29 4:35 ` sashiko-bot
2026-10-29 4:27 ` [PATCH 2/3] RDMA/rtrs-srv: Balance the session device reference in sysfs setup Yuqiang Sun
2026-10-29 4:36 ` sashiko-bot
2026-10-29 4:27 ` Yuqiang Sun [this message]
2026-10-29 4:40 ` [PATCH 3/3] RDMA/rtrs-srv: Reject an empty pathname sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261029042719.75868-4-izaiahsun@gmail.com \
--to=izaiahsun@gmail.com \
--cc=aleksei.marov@ionos.com \
--cc=gi-oh.kim@ionos.com \
--cc=guoqing.jiang@linux.dev \
--cc=haris.iqbal@ionos.com \
--cc=jgg@ziepe.ca \
--cc=jinpu.wang@ionos.com \
--cc=leon@kernel.org \
--cc=lgs201920130244@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.