[PATCH] nvmet-tcp: fix NULL pointer dereference in nvmet_execute_identify_nslist()

[PATCH] nvmet-tcp: fix NULL pointer dereference in nvmet_execute_identify_nslist()

[Shivam Kumar]

nvmet_execute_identify_nslist() handles the I/O Command Set Active
Namespace ID List (CNS 07h) with match_css set. The per-namespace
filter in the iteration loop tests req->ns->csi, but req->ns is NULL
for this command: nvmet_req_init() clears req->ns for every request,
and CNS 07h uses the NSID field only as a starting filter (min_nsid),
so no namespace is ever looked up. The intended value is the loop
variable ns->csi.

A remote host that sends an Identify command with CNS 07h to a
subsystem with at least one enabled namespace dereferences the NULL
req->ns (at offsetof(struct nvmet_ns, csi)) and crashes the target.
Use the loop variable ns instead.

Fixes: 61c9967cd634 ("nvmet: implement active command set ns list")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
Cc: stable@vger.kernel.org
---
 drivers/nvme/target/admin-cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 01b799e92ae6..ab6a0a98dd5d 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -958,7 +958,7 @@ static void nvmet_execute_identify_nslist(struct nvmet_req *req, bool match_css)
 	nvmet_for_each_enabled_ns(&ctrl->subsys->namespaces, idx, ns) {
 		if (ns->nsid <= min_nsid)
 			continue;
-		if (match_css && req->ns->csi != req->cmd->identify.csi)
+		if (match_css && ns->csi != req->cmd->identify.csi)
 			continue;
 		list[i++] = cpu_to_le32(ns->nsid);
 		if (i == buf_size / sizeof(__le32))
-- 
2.53.0

Re: [PATCH] nvmet-tcp: fix NULL pointer dereference in nvmet_execute_identify_nslist()

[Christoph Hellwig]

This was already fixed by Guixin Liu.

Re: [PATCH] nvmet-tcp: fix NULL pointer dereference in nvmet_execute_identify_nslist()

[Ingo Molnar]

* Christoph Hellwig <hch@lst.de> wrote:

> This was already fixed by Guixin Liu.

For the record, it's this commit currently pending in linux-next:

  79aba4c94034 ("nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()")

Also attached below.

Thanks,

	Ingo

==================>
# AuthorDate: Tue Aug 4 10:18:57 2026 +0800
# CommitDate: Mon Aug 10 12:25:54 2026 -0700

From: Guixin Liu <kanie@linux.alibaba.com>
Date: Tue, 4 Aug 2026 10:18:57 +0800
Subject: [PATCH] nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()

When a host issues an Identify command with CNS 07h (Active Namespace ID
List for a specific I/O Command Set), nvmet_execute_identify_nslist() is
called with match_css set. The command-set filter dereferences req->ns,
but this handler never calls nvmet_req_find_ns(), so req->ns is always
NULL (nvmet_req_init() resets it to NULL). As soon as an enabled
namespace with an NSID greater than the requested value exists,
req->ns->csi dereferences a NULL pointer and oopses.

Besides the crash, the comparison is logically wrong: to filter the list
by command set it must test the command set of the namespace being
iterated, not a single fixed value. Use the loop variable ns->csi.

Fixes: 61c9967cd634 ("nvmet: implement active command set ns list")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
---
 drivers/nvme/target/admin-cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 0b24d31f966d..3fde09b4d78a 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -960,7 +960,7 @@ static void nvmet_execute_identify_nslist(struct nvmet_req *req, bool match_css)
 	nvmet_for_each_enabled_ns(&ctrl->subsys->namespaces, idx, ns) {
 		if (ns->nsid <= min_nsid)
 			continue;
-		if (match_css && req->ns->csi != req->cmd->identify.csi)
+		if (match_css && ns->csi != req->cmd->identify.csi)
 			continue;
 		list[i++] = cpu_to_le32(ns->nsid);
 		if (i == buf_size / sizeof(__le32))