mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-10-01 18:21:29 +00:00
85428beac8
Reset the ns->file value to NULL also in the error case in
nvmet_file_ns_enable().
The ns->file variable points either to file object or contains the
error code after the filp_open() call. This can lead to following
problem:
When the user first setups an invalid file backend and tries to enable
the ns, it will fail. Then the user switches over to a bdev backend
and enables successfully the ns. The first received I/O will crash the
system because the IO backend is chosen based on the ns->file value:
static u16 nvmet_parse_io_cmd(struct nvmet_req *req)
{
[...]
if (req->ns->file)
return nvmet_file_parse_io_cmd(req);
return nvmet_bdev_parse_io_cmd(req);
}
Reported-by: Enzo Matsumiya <ematsumiya@suse.com>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
|
History
|
|
|---|---|---|
| .. | ||
| admin-cmd.c | ||
| configfs.c | ||
| core.c | ||
| discovery.c | ||
| fabrics-cmd.c | ||
| fc.c | ||
| fcloop.c | ||
| io-cmd-bdev.c | ||
| io-cmd-file.c | ||
| Kconfig | ||
| loop.c | ||
| Makefile | ||
| nvmet.h | ||
| passthru.c | ||
| rdma.c | ||
| tcp.c | ||
| trace.c | ||
| trace.h | ||