From 81ce4d9bbe8cf47d4b023e932ee29b22367545e6 Mon Sep 17 00:00:00 2001 From: Josef Bacik Date: Wed, 28 Oct 2026 10:42:19 -0600 Subject: [PATCH] nvmet: fix NULL dereference in debugfs host_traddr The host_traddr callbacks of tcp, rdma and fc take the host address from the transport queue around ctrl->sqs[0], which nvmet_sq_destroy() clears when the admin queue goes away while the controller lives on with its I/O queues. A host that closes the admin connection and keeps an I/O queue leaves such a controller behind, and reading its host_traddr in debugfs dereferences a near-NULL pointer: BUG: kernel NULL pointer dereference, address: 00000000000002e0 RIP: 0010:nvmet_tcp_host_port_addr+0x19/0x50 [nvmet_tcp] Don't ask the transport if there's no admin queue. Nothing holds the queue for debugfs, so a reader that's past the check when the queue goes away is still on its own. Fixes: 7e5c3de3f2f2 ("nvmet: add 'host_traddr' callback for debugfs") Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Chaitanya Kulkarni Signed-off-by: Josef Bacik Signed-off-by: Jens Axboe Signed-off-by: Keith Busch --- drivers/nvme/target/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c index 62f56ba6ad29..956f9a552e70 100644 --- a/drivers/nvme/target/core.c +++ b/drivers/nvme/target/core.c @@ -1821,6 +1821,9 @@ ssize_t nvmet_ctrl_host_traddr(struct nvmet_ctrl *ctrl, { if (!ctrl->ops->host_traddr) return -EOPNOTSUPP; + /* They all take the address from the admin queue */ + if (!ctrl->sqs[0]) + return -ENOTCONN; return ctrl->ops->host_traddr(ctrl, traddr, traddr_len); }