[PATCH nvme-7.3 0/4] nvme-fabrics: localize string option parsing

[raoxu]

From: Xu Rao <raoxu@xxxxxxxxxxxxx>

nvmf_parse_options() currently combines option tokenization with string
allocation, validation, conversion, ownership transfer and error cleanup in
one large switch.  The DH-CHAP parse-failure leak showed how easy it is for
a match_strdup() allocation to escape cleanup when those lifetime rules are
spread across the main parser.

This series follows Christoph's suggestion to keep strdup allocations in
the scope that parses the corresponding option and to stop reusing the
pointer used for the option token.  It deliberately does not introduce a
generic parser framework and leaves integer, key and flag options alone.
The goal is only to make the existing string lifetimes local and easy to
audit without changing option semantics.

The series is split by parsing and lifetime semantics:

  1/4 separates tokenization from allocated string storage.  option is the
      current entry returned by strsep() and passed to match_token(); the
      existing p is left only as the temporary match_strdup() pointer and
      disappears as the following helpers are introduced.  Keeping this
      patch mechanical avoids renaming the same temporary variable only to
      delete it again later in the series.

  2/4 adds nvmf_parse_string_option() for the five direct owned-string
      replacements: transport, traddr, trsvcid, host_traddr and host_iface.
      Their complete lifetime is duplicate -> replace old value -> transfer
      ownership, so sharing one helper removes identical code without
      mixing in validation policy.

  3/4 handles non-sensitive identity strings that need additional parsing.
      nvmf_parse_subsysnqn() owns subsystem-NQN replacement, length checking
      and discovery-NQN state; nvmf_parse_hostnqn() validates a temporary
      host NQN and copies it to the host buffer; nvmf_parse_hostid()
      converts the temporary string to uuid_t and frees it on every exit
      path.

  4/4 adds nvmf_parse_dhchap_secret() for dhchap_secret and
      dhchap_ctrl_secret.  These values share DHHC-1 validation and
      sensitive cleanup on rejection, so their resource rules stay out of
      the generic string helper.

The resulting five helpers are intentionally small and self-describing:

  nvmf_parse_string_option()
  nvmf_parse_subsysnqn()
  nvmf_parse_hostnqn()
  nvmf_parse_hostid()
  nvmf_parse_dhchap_secret()

The first helper represents one common ownership operation; the remaining
helpers are named after the exact protocol/identity value they parse.  A
future string option can reuse nvmf_parse_string_option() only if it has the
same direct replacement semantics.  A value with new validation or
conversion rules should get a dedicated helper rather than adding flags to
a generic parser.

This keeps the helpers grouped by ownership and validation semantics rather
than adding one helper per token, avoiding duplication for identical direct
string replacement while still keeping validation and sensitive cleanup local
to the options that need them.

This series is intended to be applied after the recently accepted
"nvme-fabrics: fix DHCHAP secret leak on parse failure" change.

No functional changes are intended.

Xu Rao (4):
  nvme-fabrics: separate option tokenizer pointer
  nvme-fabrics: add helper for owned string options
  nvme-fabrics: add helpers for subsystem and host identity options
  nvme-fabrics: add helper for DH-CHAP secret options

 drivers/nvme/host/fabrics.c | 229 +++++++++++++++++++-----------------
 1 file changed, 121 insertions(+), 108 deletions(-)

-- 
2.50.1