Skip to content

shared/table: do not pass a NULL string to strdup() - #3980

Draft
mittal-ishaan wants to merge 2 commits into
linux-nvme:masterfrom
mittal-ishaan:fix-table-null-string
Draft

shared/table: do not pass a NULL string to strdup()#3980
mittal-ishaan wants to merge 2 commits into
linux-nvme:masterfrom
mittal-ishaan:fix-table-null-string

Conversation

@mittal-ishaan

@mittal-ishaan mittal-ishaan commented Sep 3, 2026

Copy link
Copy Markdown

nvme list segfaults when a controller reports a blank firmware revision.

libnvme's __nvme_get_attr() strips trailing blanks and returns NULL when nothing is left, so libnvme_ns_get_firmware() returns NULL for such a controller. list_item() hands that to shr_table_set_value_str(), which calls strdup(str) unguarded and dies in strlen().

Seen on Ubuntu 26.04 (nvme-cli 2.16, libnvme 1.16.1), GCP node whose persistent disk (model nvme_card-pd) has an all-spaces firmware_rev:

~# nvme list
Segmentation fault         (core dumped) nvme list

~# nvme list -o json | jq '.Devices[] | select(.Firmware == null) | .DevicePath'
"/dev/nvme32n1"

A NULL string is now stored as an empty string, so the cell stays blank. Returning -EINVAL instead would make the callers drop the whole device row. The same setter also feeds serial, model and controller address, which can be
NULL for the same reason.

shr_table_set_value_str() passed @str straight to strdup(), so a NULL
value crashed in strlen(). libnvme returns NULL for a blank sysfs
attribute, so "nvme list" segfaults on a controller which reports an
all-spaces firmware revision.

Treat a NULL string as an empty string, leaving the cell blank.

Signed-off-by: mittal-ishaan <ishaanmittal123@gmail.com>
@mittal-ishaan
mittal-ishaan marked this pull request as draft September 3, 2026 22:56
Check that a NULL string is stored as an empty string and that the
table still prints. Without the previous patch the test segfaults.

Signed-off-by: mittal-ishaan <ishaanmittal123@gmail.com>
@igaw

igaw commented Sep 4, 2026

Copy link
Copy Markdown
Collaborator

I am not against making the table code more robust, that's fine.

Though we could just do the right thing with the defaults, that means instead of

libnvme_ctrl_get_firmware(n->c, &val, NULL);

do a

libnvme_ctrl_get_firmware(n->c, &val, "");

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants