Re: [PATCH blktests] nvme/070: add a test for Identify CNS 07h NULL pointer dereference

On Aug 01, 2026 / 19:31, Nilay Shroff wrote:
> On 7/31/26 8:56 AM, Guixin Liu wrote:
> > +test() {
> > +	echo "Running ${TEST_NAME}"
> > +
> > +	_setup_nvmet
> > +
> > +	_nvmet_target_setup
> > +
> > +	_nvme_connect_subsys
> > +
> > +	local nvmedev
> > +	nvmedev=$(_find_nvme_dev "${def_subsysnqn}")
> > +
> > +	# CNS 07h == Active Namespace ID list for the specified I/O Command Set.
> > +	# CDW10 bits[7:0] hold the CNS; CDW11 bits[31:24] hold the CSI (0 == NVM).
> > +	# Request from NSID 0 so the enabled namespace (NSID 1) is listed, which
> > +	# is exactly the condition that used to dereference the NULL req->ns.
> > +	if ! nvme admin-passthru "/dev/${nvmedev}" --opcode=0x06 \
> > +		--namespace-id=0 --cdw10=0x07 --cdw11=0 --data-len=4096 -r \
> > +		>> "${FULL}" 2>&1; then
> > +		echo "Error: Identify CNS 07h failed"
> > +	fi
> 
> The nvme admin-passthru ... works but why instead not use the existing
> "nvme list-ns /dev/<nvmedev> --csi=0 ?

The patch looks good to me. I also confirmed that the test case recreates the
NULL pointer dereference that the kernel patch "nvmet: fix NULL pointer
dereference in nvmet_execute_identify_nslist()" fixes. Good.

I also confirmed that "nvme list-ns /dev/<nvmedev> --csi=0" can recreate the
NULL pointer dereference. I'm okay either way admin-passthru or list-ns. I
would like to know Guixin's view about it.