[PATCH blktests] nvme/070: add a test for Identify CNS 07h NULL pointer dereference

[PATCH blktests] nvme/070: add a test for Identify CNS 07h NULL pointer dereference

[Guixin Liu]

nvmet_execute_identify_nslist() handles both the Active Namespace ID list
(CNS 02h) and the per-command-set variant (CNS 07h). For CNS 07h it
filtered the list on req->ns->csi, but this handler never resolves
req->ns, so it is always NULL. As soon as an enabled namespace with an
NSID above the requested value exists, the target dereferenced a NULL
pointer and oopsed.

This test connects a target with a single namespace and issues an
Identify with CNS 07h starting from NSID 0, which is exactly the
condition that triggered the crash. Without the kernel fix [0] the target
oopses; with it the command completes normally.

[0] https://lore.kernel.org/linux-nvme/20260730043105.3071328-2-kanie@linux.alibaba.com/

Suggested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
 tests/nvme/070     | 54 ++++++++++++++++++++++++++++++++++++++++++++++
 tests/nvme/070.out |  2 ++
 2 files changed, 56 insertions(+)
 create mode 100755 tests/nvme/070
 create mode 100644 tests/nvme/070.out

diff --git a/tests/nvme/070 b/tests/nvme/070
new file mode 100755
index 0000000..1f29a69
--- /dev/null
+++ b/tests/nvme/070
@@ -0,0 +1,54 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-3.0+
+# Copyright (C) 2026 Guixin Liu
+#
+# Regression test for the NULL pointer dereference in
+# nvmet_execute_identify_nslist() when handling Identify CNS 07h (Active
+# Namespace ID List for the specified I/O Command Set). The CNS 07h handler
+# filtered the list on req->ns->csi, but this handler never resolves req->ns
+# so it is always NULL. As soon as an enabled namespace with an NSID above the
+# requested value exists, the target dereferenced a NULL pointer and oopsed.
+
+. tests/nvme/rc
+
+DESCRIPTION="issue Identify CNS 07h (per-command-set active NS list)"
+QUICK=1
+
+requires() {
+	_nvme_requires
+	_have_loop
+	_require_nvme_trtype_is_fabrics
+}
+
+set_conditions() {
+	_set_nvme_trtype "$@"
+}
+
+test() {
+	echo "Running ${TEST_NAME}"
+
+	_setup_nvmet
+
+	_nvmet_target_setup
+
+	_nvme_connect_subsys
+
+	local nvmedev
+	nvmedev=$(_find_nvme_dev "${def_subsysnqn}")
+
+	# CNS 07h == Active Namespace ID list for the specified I/O Command Set.
+	# CDW10 bits[7:0] hold the CNS; CDW11 bits[31:24] hold the CSI (0 == NVM).
+	# Request from NSID 0 so the enabled namespace (NSID 1) is listed, which
+	# is exactly the condition that used to dereference the NULL req->ns.
+	if ! nvme admin-passthru "/dev/${nvmedev}" --opcode=0x06 \
+		--namespace-id=0 --cdw10=0x07 --cdw11=0 --data-len=4096 -r \
+		>> "${FULL}" 2>&1; then
+		echo "Error: Identify CNS 07h failed"
+	fi
+
+	_nvme_disconnect_subsys
+
+	_nvmet_target_cleanup
+
+	echo "Test complete"
+}
diff --git a/tests/nvme/070.out b/tests/nvme/070.out
new file mode 100644
index 0000000..b765a28
--- /dev/null
+++ b/tests/nvme/070.out
@@ -0,0 +1,2 @@
+Running nvme/070
+Test complete
-- 
2.43.7

Re: [PATCH blktests] nvme/070: add a test for Identify CNS 07h NULL pointer dereference

[Nilay Shroff]

On 7/31/26 8:56 AM, Guixin Liu wrote:
> +test() {
> +	echo "Running ${TEST_NAME}"
> +
> +	_setup_nvmet
> +
> +	_nvmet_target_setup
> +
> +	_nvme_connect_subsys
> +
> +	local nvmedev
> +	nvmedev=$(_find_nvme_dev "${def_subsysnqn}")
> +
> +	# CNS 07h == Active Namespace ID list for the specified I/O Command Set.
> +	# CDW10 bits[7:0] hold the CNS; CDW11 bits[31:24] hold the CSI (0 == NVM).
> +	# Request from NSID 0 so the enabled namespace (NSID 1) is listed, which
> +	# is exactly the condition that used to dereference the NULL req->ns.
> +	if ! nvme admin-passthru "/dev/${nvmedev}" --opcode=0x06 \
> +		--namespace-id=0 --cdw10=0x07 --cdw11=0 --data-len=4096 -r \
> +		>> "${FULL}" 2>&1; then
> +		echo "Error: Identify CNS 07h failed"
> +	fi

The nvme admin-passthru ... works but why instead not use the existing
"nvme list-ns /dev/<nvmedev> --csi=0 ?

Thanks,
--Nilay

Re: [PATCH blktests] nvme/070: add a test for Identify CNS 07h NULL pointer dereference

[Shin'ichiro Kawasaki]

On Aug 01, 2026 / 19:31, Nilay Shroff wrote:
> On 7/31/26 8:56 AM, Guixin Liu wrote:
> > +test() {
> > +	echo "Running ${TEST_NAME}"
> > +
> > +	_setup_nvmet
> > +
> > +	_nvmet_target_setup
> > +
> > +	_nvme_connect_subsys
> > +
> > +	local nvmedev
> > +	nvmedev=$(_find_nvme_dev "${def_subsysnqn}")
> > +
> > +	# CNS 07h == Active Namespace ID list for the specified I/O Command Set.
> > +	# CDW10 bits[7:0] hold the CNS; CDW11 bits[31:24] hold the CSI (0 == NVM).
> > +	# Request from NSID 0 so the enabled namespace (NSID 1) is listed, which
> > +	# is exactly the condition that used to dereference the NULL req->ns.
> > +	if ! nvme admin-passthru "/dev/${nvmedev}" --opcode=0x06 \
> > +		--namespace-id=0 --cdw10=0x07 --cdw11=0 --data-len=4096 -r \
> > +		>> "${FULL}" 2>&1; then
> > +		echo "Error: Identify CNS 07h failed"
> > +	fi
> 
> The nvme admin-passthru ... works but why instead not use the existing
> "nvme list-ns /dev/<nvmedev> --csi=0 ?

The patch looks good to me. I also confirmed that the test case recreates the
NULL pointer dereference that the kernel patch "nvmet: fix NULL pointer
dereference in nvmet_execute_identify_nslist()" fixes. Good.

I also confirmed that "nvme list-ns /dev/<nvmedev> --csi=0" can recreate the
NULL pointer dereference. I'm okay either way admin-passthru or list-ns. I
would like to know Guixin's view about it.

Re: [PATCH blktests] nvme/070: add a test for Identify CNS 07h NULL pointer dereference

[Guixin Liu]

在 2026/8/3 12:14, Shin'ichiro Kawasaki 写道:
> On Aug 01, 2026 / 19:31, Nilay Shroff wrote:
>> On 7/31/26 8:56 AM, Guixin Liu wrote:
>>> +test() {
>>> +	echo "Running ${TEST_NAME}"
>>> +
>>> +	_setup_nvmet
>>> +
>>> +	_nvmet_target_setup
>>> +
>>> +	_nvme_connect_subsys
>>> +
>>> +	local nvmedev
>>> +	nvmedev=$(_find_nvme_dev "${def_subsysnqn}")
>>> +
>>> +	# CNS 07h == Active Namespace ID list for the specified I/O Command Set.
>>> +	# CDW10 bits[7:0] hold the CNS; CDW11 bits[31:24] hold the CSI (0 == NVM).
>>> +	# Request from NSID 0 so the enabled namespace (NSID 1) is listed, which
>>> +	# is exactly the condition that used to dereference the NULL req->ns.
>>> +	if ! nvme admin-passthru "/dev/${nvmedev}" --opcode=0x06 \
>>> +		--namespace-id=0 --cdw10=0x07 --cdw11=0 --data-len=4096 -r \
>>> +		>> "${FULL}" 2>&1; then
>>> +		echo "Error: Identify CNS 07h failed"
>>> +	fi
>> The nvme admin-passthru ... works but why instead not use the existing
>> "nvme list-ns /dev/<nvmedev> --csi=0 ?
> The patch looks good to me. I also confirmed that the test case recreates the
> NULL pointer dereference that the kernel patch "nvmet: fix NULL pointer
> dereference in nvmet_execute_identify_nslist()" fixes. Good.
>
> I also confirmed that "nvme list-ns /dev/<nvmedev> --csi=0" can recreate the
> NULL pointer dereference. I'm okay either way admin-passthru or list-ns. I
> would like to know Guixin's view about it.

I think nvme list-ns /dev/<nvmedev> --csi=0 is better, I will change this in v2, thanks.

Best Regards,
Guixin Liu