[PATCH] nvme-rdma: don't complete a request after a bogus remote invalidation

Keith Busch kbusch at kernel.org
Tue Oct 13 08:35:47 PDT 2026


On Tue, Sep 29, 2026 at 12:38:11AM +0900, Yehyeong Lee wrote:
> When a remote invalidation names an rkey that is not the one we handed out
> for this request, nvme_rdma_process_nvme_rsp() logs and schedules error
> recovery, then falls through to nvme_rdma_end_request().  The request is
> completed with req->mr never invalidated, and nvme_rdma_unmap_data() hands
> it back with ib_mr_pool_put(), which only puts it on a list.  The rkey
> stays valid and still maps the pages the completed read filled, so a
> controller that sent the bogus invalidation can write into those pages
> after pread() has returned.
> 
> Return instead, the way the local invalidation path below already does,
> and leave the request for error recovery to cancel.

Thanks, applied to nvme-7.4.



More information about the Linux-nvme mailing list