From 87dee58968fbacf257434993f5b105f10435e0e2 Mon Sep 17 00:00:00 2001 From: Sarah Ahmed Date: Thu, 6 Aug 2026 10:44:12 -0500 Subject: [PATCH] tree-fabrics: fix null pointer dereference in ctrl_lookups() The ctrl_lookups() function calls libnvme_first_host() to get the first host entry, then immediately passes @h to libnvme_get_subsystem() without checking whether the return value is NULL. libnvme_first_host() returns NULL when the host list is empty. Dereferencing a NULL @h inside libnvme_get_subsystem() causes undefined behavior. Add shr_assert(h) after the call to libnvme_first_host() to catch a NULL return and abort early, consistent with the existing check used after libnvme_create_host() in the same file. Signed-off-by: Sarah Ahmed --- libnvme/test/tree-fabrics.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libnvme/test/tree-fabrics.c b/libnvme/test/tree-fabrics.c index 83b65e86f0..d6269b2bea 100644 --- a/libnvme/test/tree-fabrics.c +++ b/libnvme/test/tree-fabrics.c @@ -255,6 +255,7 @@ static bool ctrl_lookups(struct libnvme_global_ctx *ctx) bool pass = true; h = libnvme_first_host(ctx); + shr_assert(h); shr_assert(!libnvme_get_subsystem(ctx, h, DEFAULT_SUBSYSNAME, DEFAULT_SUBSYSNQN, &s)); shr_assert(s);