[PATCH 3/5] nvme-fabrics: reset io_queues before computing the queue mapping

[Hannes Reinecke]

On 10/14/26 9:46 AM, Daniel Wagner wrote:
> From: Daniel Wagner <wagi at kernel.org>
> 
> nvmf_set_io_queues only sets the io_queues entries of the queue types it
> hands out, but the array is reused on every reconnect.  When the
> controller grants fewer queues on a reconnect, stale entries survive and
> nvmf_map_queues maps CPUs to hardware contexts that don't exist anymore,
> which crashes blk_mq_map_swqueue with a NULL pointer dereference.  E.g.
> with nr_io_queues=8, nr_write_queues=8 and nr_poll_queues=8, 24 queues
> are mapped 8/8/8 (default/read/poll).  If the controller grants only 16
> queues on the reconnect, the poll map still starts at hardware context
> 16.
> 
> Clear the array before computing the new mapping.
> 
> Fixes: 6486199378a5 ("nvme-tcp: fix queue mapping when queue count is limited")
> Fixes: 5651cd3c4336 ("nvme-rdma: fix queue mapping when queue count is limited")
> Signed-off-by: Daniel Wagner <wagi at kernel.org>
> ---
>   drivers/nvme/host/fabrics.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
> index 59f823dfbbcc..571de549fbaf 100644
> --- a/drivers/nvme/host/fabrics.c
> +++ b/drivers/nvme/host/fabrics.c
> @@ -1125,6 +1125,8 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
>   void nvmf_set_io_queues(struct nvmf_ctrl_options *opts, u32 nr_io_queues,
>   			u32 io_queues[HCTX_MAX_TYPES])
>   {
> +	memset(io_queues, 0, sizeof(*io_queues) * HCTX_MAX_TYPES);
> +
>   	if (opts->nr_write_queues && opts->nr_io_queues < nr_io_queues) {
>   		/*
>   		 * separate read/write queues
> 

Reviewed-by: Hannes Reinecke <hare at kernel.org>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare at suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich