Re: [PATCH] nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

[Damien Le Moal <dlemoal@kernel.org>]

On 8/4/26 12:36, Guixin Liu wrote:
> When a host issues an Identify command with CNS 05h (I/O Command Set
> specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed
> namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on
> req->ns->bdev. A file-backed namespace has no block device, so
> req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing.
> 
> The I/O command set is selected by the host-supplied CSI field and the
> command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled,
> independent of the namespace backing type, so any file-backed namespace
> is exposed.
> 
> Reject the command with Invalid Field when the namespace is not backed
> by a block device.
> 
> Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support")
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>

Looks good to me.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

-- 
Damien Le Moal
Western Digital Research