[PATCH] nvmet: validate device_path before enabling namespace

[PATCH] nvmet: validate device_path before enabling namespace

[pavankumaryalagada]

From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>

When buffered_io is enabled, nvmet_bdev_ns_enable() returns -ENOTBLK
without checking whether device_path is configured. nvmet_ns_enable()
then falls back to nvmet_file_ns_enable(), which passes the NULL
device_path to filp_open() and causes a NULL pointer dereference.

Validate device_path before attempting to enable to namespace and
return -EINVAL when it has not been configured.

Fixes: 6f6d604b4ef8 ("nvmet: allow bdev in buffered_io mode")
Reported-by: syzbot+6c46a179b56c651c4c96@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c46a179b56c651c4c96
Tested-by: syzbot+6c46a179b56c651c4c96@syzkaller.appspotmail.com
Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
---
 drivers/nvme/target/core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index d74c01c98f19..336013139ef6 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -591,6 +591,11 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
 	if (ns->enabled)
 		goto out_unlock;
 
+	if (!ns->device_path) {
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+
 	ret = nvmet_bdev_ns_enable(ns);
 	if (ret == -ENOTBLK)
 		ret = nvmet_file_ns_enable(ns);
-- 
2.43.0

Re: [PATCH] nvmet: validate device_path before enabling namespace

[Keith Busch]

On Wed, Sep 09, 2026 at 01:04:52AM +0530, pavankumaryalagada@gmail.com wrote:
> From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
> 
> When buffered_io is enabled, nvmet_bdev_ns_enable() returns -ENOTBLK
> without checking whether device_path is configured. nvmet_ns_enable()
> then falls back to nvmet_file_ns_enable(), which passes the NULL
> device_path to filp_open() and causes a NULL pointer dereference.
> 
> Validate device_path before attempting to enable to namespace and
> return -EINVAL when it has not been configured.

This was alraedy closed:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=09d0c07bd9ce3b2f2d993f672698d32a17543c32

Re: [PATCH] nvmet: validate device_path before enabling namespace

[Yalagada Pavan Kumar]

On Tue, Sep 08, 2026 at 01:57:17PM -0600, Keith Busch wrote:
> On Wed, Sep 09, 2026 at 01:04:52AM +0530, pavankumaryalagada@gmail.com wrote:
> > From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
> > 
> > When buffered_io is enabled, nvmet_bdev_ns_enable() returns -ENOTBLK
> > without checking whether device_path is configured. nvmet_ns_enable()
> > then falls back to nvmet_file_ns_enable(), which passes the NULL
> > device_path to filp_open() and causes a NULL pointer dereference.
> > 
> > Validate device_path before attempting to enable to namespace and
> > return -EINVAL when it has not been configured.
> 
> This was alraedy closed:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=09d0c07bd9ce3b2f2d993f672698d32a17543c32

Good to hear this has already been fixed. I'll drop the patch.

Thanks
Pavan