[PATCH] nvme-rdma: fix NULL metadata_sgl dereference with T10-PI

[Keith Busch]

On Sat, Oct 24, 2026 at 06:37:37PM -0300, Christian Aurich Zanettini Martins wrote:
> Since commit 2a8513091d2f ("nvme-rdma: parallelize I/O queue allocation
> and startup") the I/O tag set is allocated before the I/O queues.
> nvme_rdma_init_request() only sets req->metadata_sgl if
> queue->pi_support is set, but pi_support is only set later by
> nvme_rdma_alloc_queue(), so every I/O request is left with a NULL
> metadata_sgl.
> 
> With an RDMA device that supports integrity and a namespace formatted
> with protection information, nvme_rdma_dma_map_req() then dereferences
> the NULL pointer on the first integrity I/O, already during the
> namespace scan when there is more than one I/O queue.
> 
> Queues that a later reconnect adds for the first time have the same
> problem.
> 
> Check queue_idx and the controller's max_integrity_segments instead,
> which is what nvme_rdma_alloc_queue() derives pi_support from.

Thanks, applied to nvme-7.4.