[PATCH] nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

[PATCH] nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

[Guixin Liu]

When a host issues an Identify command with CNS 05h (I/O Command Set
specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed
namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on
req->ns->bdev. A file-backed namespace has no block device, so
req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing.

The I/O command set is selected by the host-supplied CSI field and the
command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled,
independent of the namespace backing type, so any file-backed namespace
is exposed.

Reject the command with Invalid Field when the namespace is not backed
by a block device.

Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
 drivers/nvme/target/zns.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c
index f00921931eb6..a13befd5f3ad 100644
--- a/drivers/nvme/target/zns.c
+++ b/drivers/nvme/target/zns.c
@@ -116,7 +116,7 @@ void nvmet_execute_identify_ns_zns(struct nvmet_req *req)
 		mutex_unlock(&req->ns->subsys->lock);
 	}
 
-	if (!bdev_is_zoned(req->ns->bdev)) {
+	if (!req->ns->bdev || !bdev_is_zoned(req->ns->bdev)) {
 		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
 		req->error_loc = offsetof(struct nvme_identify, nsid);
 		goto out;
-- 
2.43.7

Re: [PATCH] nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

[Damien Le Moal]

On 8/4/26 12:36, Guixin Liu wrote:
> When a host issues an Identify command with CNS 05h (I/O Command Set
> specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed
> namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on
> req->ns->bdev. A file-backed namespace has no block device, so
> req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing.
> 
> The I/O command set is selected by the host-supplied CSI field and the
> command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled,
> independent of the namespace backing type, so any file-backed namespace
> is exposed.
> 
> Reject the command with Invalid Field when the namespace is not backed
> by a block device.
> 
> Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support")
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>

Looks good to me.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

-- 
Damien Le Moal
Western Digital Research

Re: [PATCH] nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>