Re: [PATCH] nvme-rdma: fix NULL queue->ctrl dereference on reconnect

[Nilay Shroff]

On 10/29/26 11:35 AM, Christian Aurich Zanettini Martins wrote:
> Since commit 2a8513091d2f ("nvme-rdma: parallelize I/O queue allocation
> and startup"), a reconnect that gets more I/O queues than before grows
> the tag set before the new queues are set up. queue->ctrl is only set
> by nvme_rdma_setup_io_queues(), so I/O submitted in between reaches
> nvme_rdma_queue_rq() on a queue that was never allocated and
> dereferences a NULL queue->ctrl:
>
>    BUG: kernel NULL pointer dereference, address: 000000000000034c
>    RIP: 0010:nvme_rdma_queue_rq+0x52/0xb90
>
> Add nvme_rdma_init_queue() for the queue fields that do not depend on
> the connection and call it for every queue when allocating the
> controller. Such requests are then requeued like on any other queue
> that is not live. queue_lock moves there as well, and
> nvme_rdma_exit_queue() destroys it when the controller is freed.
>
> Fixes: 2a8513091d2f ("nvme-rdma: parallelize I/O queue allocation and startup")
> Cc:stable@xxxxxxxxxxxxxxx
> Signed-off-by: Christian Aurich Zanettini Martins<christian.aurichzm@xxxxxxxxx>

Looks good to me.
Reviewed-by: Nilay Shroff <nilay@xxxxxxxxxxxxx>