Repository navigation
nvme: add few misc fixes - #4224
Merged
Merged
Conversation
nvmf_create_discovery_ctrl() reaches the libnvme_open() call only after __create_discovery_ctrl() has already connected the controller and linked it into the subsystem tree. The identify-failure path right below handles this correctly by calling libnvmf_disconnect_ctrl() followed by libnvme_free_ctrl(). The libnvme_open() failure path, however, returns the error without tearing anything down, so the freshly created discovery connection is left established even though the operation failed. Disconnect and free the controller on this path too, matching the identify-failure path. Signed-off-by: Martin George <marting@netapp.com>
libnvme_ctrl_scan_namespaces() stores the return of libnvme_scan_ctrl_namespaces() into a signed count and loops over it without first checking for a negative error. On a scan failure the negative count simply skips the loop and the function returns success, silently hiding the error. Its siblings libnvme_ctrl_scan_paths() and nvme_subsystem_scan_namespaces() both bail out on a negative count. Check for the error and return it, matching the other scanners. Signed-off-by: Martin George <marting@netapp.com>
libnvme_transport_handle_set_submit_entry() assigns the caller-provided submit_entry hook, but the subsequent NULL check and default assignment operate on submit_exit instead of submit_entry (a copy-paste slip; the sibling set_submit_exit()/set_decide_retry() setters correctly guard their own field). As a result, passing NULL to reset the entry hook to the library default leaves hdl->submit_entry NULL rather than restoring __libnvme_submit_entry. The next command execution then calls hdl->submit_entry() and dereferences a NULL function pointer. Guard and default submit_entry itself. Signed-off-by: Martin George <marting@netapp.com>
save_discovery_log() computes the discovery log size (header plus numrec * sizeof(entry)) into an int before passing it to shr_write_all(), whose length argument is a size_t. numrec is a 64-bit field read from the discovery log header, so a sufficiently large device-controlled record count can overflow the int and truncate the length, causing a short or corrupted saved log. Compute the length as size_t so the full byte count is preserved. Signed-off-by: Martin George <marting@netapp.com>
fabrics_dim() overwrites ret on every dim_operation() call, so when several controllers or devices are addressed only the status of the last one is returned; an earlier failure is masked by a later success. Keep the first error in a separate variable and return that, so a failure on any controller is reported. Signed-off-by: Martin George <marting@netapp.com>
json_output_key_value() passed strdup(key) through trim_white_space() and stored the result in a __cleanup_free pointer. trim_white_space() skips leading whitespace by advancing the pointer and returning that advanced position. When the key has leading whitespace, key_trim points into the middle of the strdup() allocation rather than to its start, so the __cleanup_free at scope exit is called on a pointer that was not returned by malloc()/strdup(), leading to undefined behavior and potential heap corruption. Keep the original allocation in its own __cleanup_free variable and let key_trim be a mere view into it, so the correct base pointer is freed. Signed-off-by: Martin George <marting@netapp.com>
Collaborator
|
Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adding few misc fixes across the codebase.