nvmet: seset ns->file when open fails
authorDaniel Wagner <dwagner@suse.de>
Wed, 12 May 2021 14:50:05 +0000 (16:50 +0200)
committerChristoph Hellwig <hch@lst.de>
Wed, 12 May 2021 17:48:48 +0000 (19:48 +0200)
commit85428beac80dbcace5b146b218697c73e367dcf5
tree981bbdfa251540cfa7f897d6b66c778e5c668d87
parent7a4ffd20ec6d31dfde2cc5608851e5109ffed7c9
nvmet: seset ns->file when open fails

Reset the ns->file value to NULL also in the error case in
nvmet_file_ns_enable().

The ns->file variable points either to file object or contains the
error code after the filp_open() call. This can lead to following
problem:

When the user first setups an invalid file backend and tries to enable
the ns, it will fail. Then the user switches over to a bdev backend
and enables successfully the ns. The first received I/O will crash the
system because the IO backend is chosen based on the ns->file value:

static u16 nvmet_parse_io_cmd(struct nvmet_req *req)
{
[...]

if (req->ns->file)
return nvmet_file_parse_io_cmd(req);

return nvmet_bdev_parse_io_cmd(req);
}

Reported-by: Enzo Matsumiya <ematsumiya@suse.com>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
drivers/nvme/target/io-cmd-file.c