• Daniel Wagner's avatar
    nvmet: seset ns->file when open fails · 85428bea
    Daniel Wagner authored
    Reset the ns->file value to NULL also in the error case in
    nvmet_file_ns_enable().
    
    The ns->file variable points either to file object or contains the
    error code after the filp_open() call. This can lead to following
    problem:
    
    When the user first setups an invalid file backend and tries to enable
    the ns, it will fail. Then the user switches over to a bdev backend
    and enables successfully the ns. The first received I/O will crash the
    system because the IO backend is chosen based on the ns->file value:
    
    static u16 nvmet_parse_io_cmd(struct nvmet_req *req)
    {
    	[...]
    
    	if (req->ns->file)
    		return nvmet_file_parse_io_cmd(req);
    
    	return nvmet_bdev_parse_io_cmd(req);
    }
    Reported-by: default avatarEnzo Matsumiya <ematsumiya@suse.com>
    Signed-off-by: default avatarDaniel Wagner <dwagner@suse.de>
    Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
    85428bea
io-cmd-file.c 9.54 KB