[PATCH blktests] nvme/070: add multipath command effects log lifetime test

[PATCH blktests] nvme/070: add multipath command effects log lifetime test

[Yao Sang]

Add a regression test for namespace head command effects log lifetime.

Create a two-path loop subsystem, remove the first controller, and issue
an I/O passthrough command through the namespace-head character device.
Kernels that keep the command effects log pointer in the shared namespace
head report the stale access through KASAN.

Signed-off-by: Yao Sang <sangyao@kylinos.cn>
---
 tests/nvme/070     | 57 ++++++++++++++++++++++++++++++++++++++++++++++
 tests/nvme/070.out |  2 ++
 2 files changed, 59 insertions(+)
 create mode 100755 tests/nvme/070
 create mode 100644 tests/nvme/070.out

diff --git a/tests/nvme/070 b/tests/nvme/070
new file mode 100755
index 0000000..39195be
--- /dev/null
+++ b/tests/nvme/070
@@ -0,0 +1,57 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-3.0+
+# Copyright (C) 2026 Yao Sang <sangyao@kylinos.cn>
+#
+# Test NVMe multipath command effects log lifetime.
+
+. tests/nvme/rc
+
+nvme_trtype=loop
+
+DESCRIPTION="test NVMe multipath command effects log lifetime"
+QUICK=1
+CHECK_DMESG=1
+
+requires() {
+	_nvme_requires
+	_have_loop
+	_have_module_param_value nvme_core multipath Y
+	_require_nvme_trtype_is_loop
+	_have_kernel_options KASAN
+}
+
+test() {
+	echo "Running ${TEST_NAME}"
+
+	local first_ctrl
+	local ngdev
+	local ns
+	local nsid
+	local -a ports
+
+	_setup_nvmet
+	_nvmet_target_setup --ports 2
+
+	_get_nvmet_ports "${def_subsysnqn}" ports
+
+	_nvme_connect_subsys --port "${ports[0]}"
+	first_ctrl=$(_find_nvme_dev "${def_subsysnqn}")
+
+	_nvme_connect_subsys --port "${ports[1]}"
+
+	ns=$(_find_nvme_ns "${def_subsys_uuid}")
+	nsid=$(cat "/sys/block/${ns}/nsid")
+	ngdev="${ns/nvme/ng}"
+
+	_nvme_disconnect_ctrl "${first_ctrl}"
+
+	if ! nvme io-passthru "/dev/${ngdev}" --opcode 0 \
+		--namespace-id "${nsid}" >> "${FULL}" 2>&1; then
+		echo "io-passthru failed"
+	fi
+
+	_nvme_disconnect_subsys >> "${FULL}" 2>&1
+	_nvmet_target_cleanup
+
+	echo "Test complete"
+}
diff --git a/tests/nvme/070.out b/tests/nvme/070.out
new file mode 100644
index 0000000..b765a28
--- /dev/null
+++ b/tests/nvme/070.out
@@ -0,0 +1,2 @@
+Running nvme/070
+Test complete
-- 
2.25.1

Re: [PATCH blktests] nvme/070: add multipath command effects log lifetime test

[Shin'ichiro Kawasaki]

On Aug 14, 2026 / 15:00, Yao Sang wrote:
> Add a regression test for namespace head command effects log lifetime.
> 
> Create a two-path loop subsystem, remove the first controller, and issue
> an I/O passthrough command through the namespace-head character device.
> Kernels that keep the command effects log pointer in the shared namespace
> head report the stale access through KASAN.
> 
> Signed-off-by: Yao Sang <sangyao@kylinos.cn>

Thanks for the patch. I ran the test case, and confirmed it recreates the KASAN
slab-use-after-free that was mentioned in your kernel side fix patch [*]. I also
confirmed that the kernel fix avoids the KASAN. The test case looks valuable :)

[*] https://lore.kernel.org/linux-nvme/20260814070651.3973067-1-sangyao@kylinos.cn/

It's the better to mention the kernel side fix in the commit log above and the
test case script header comment. Let's wait until the kernel patch gets
applied before making the changes, so that we can note the git hash of the
kernel fix commit.

Also please find in-line comments.

> ---
>  tests/nvme/070     | 57 ++++++++++++++++++++++++++++++++++++++++++++++
>  tests/nvme/070.out |  2 ++
>  2 files changed, 59 insertions(+)
>  create mode 100755 tests/nvme/070
>  create mode 100644 tests/nvme/070.out
> 
> diff --git a/tests/nvme/070 b/tests/nvme/070
> new file mode 100755
> index 0000000..39195be
> --- /dev/null
> +++ b/tests/nvme/070
> @@ -0,0 +1,57 @@
> +#!/bin/bash
> +# SPDX-License-Identifier: GPL-3.0+
> +# Copyright (C) 2026 Yao Sang <sangyao@kylinos.cn>
> +#
> +# Test NVMe multipath command effects log lifetime.
> +
> +. tests/nvme/rc
> +
> +nvme_trtype=loop

Is there any reason to run this test only for loop transport type?
If not, I suggest to drop the line above and add set_conditions() to
run this test case for all transport types.

  set_conditions() {
          _set_nvme_trtype "$@"
  }

> +
> +DESCRIPTION="test NVMe multipath command effects log lifetime"
> +QUICK=1
> +CHECK_DMESG=1
> +
> +requires() {
> +	_nvme_requires
> +	_have_loop
> +	_have_module_param_value nvme_core multipath Y
> +	_require_nvme_trtype_is_loop

If this case is not restricted to loop transport, the line above will not be
required.

> +	_have_kernel_options KASAN

Certain amount of blktests users do not enable KASAN. I think this test case
is still worth running under such conditions, so suggest to drop the line above.

Re: [PATCH blktests] nvme/070: add multipath command effects log lifetime test

[Yao Sang]

Hi Shin'ichiro,

Thanks for the review. I agree with the other suggestions, but I have one
concern about dropping the KASAN requirement.

The issue is reliably reproducible with KASAN enabled. Without KASAN,
however, the test may pass even on an affected kernel and fail to catch
the bug. Given this limitation, do you think it is still appropriate to
remove the _have_kernel_options KASAN check?

I will also update the commit message and test comments with the actual
kernel fix commit once it is merged.

Thanks,
Yao

Re: [PATCH blktests] nvme/070: add multipath command effects log lifetime test

[Shin'ichiro Kawasaki]

On Aug 20, 2026 / 08:55, Yao Sang wrote:
> Hi Shin'ichiro,
> 
> Thanks for the review. I agree with the other suggestions, but I have one
> concern about dropping the KASAN requirement.
> 
> The issue is reliably reproducible with KASAN enabled. Without KASAN,
> however, the test may pass even on an affected kernel and fail to catch
> the bug. Given this limitation, do you think it is still appropriate to
> remove the _have_kernel_options KASAN check?

I rethought about this point, and now I think the KASAN check is fine. Let's
keep it.

As I noted, there are pros and cons for the KASAN check: if the test
case runs on kernels that disable KASAN, the KASAN check will decresase
code coverage. Said that, now I agree wint your point: the KASAN check is
straight forward and it clearly describes the condition to recreate the failure.

Actually, the test case nvme/069 also has the KASAN check already. Let's keep
the KASAN check for consistency.