[PATCH] nvme-rdma: fix NULL queue->ctrl dereference on reconnect

[Christian Aurich Zanettini Martins]

On Thu, Oct 29, 2026 at 03:05:21AM -0300, Christian Aurich Zanettini Martins wrote:
>  static void nvme_rdma_free_ctrl(struct nvme_ctrl *nctrl)
>  {
>  	struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(nctrl);
> +	int i, nr_queues = NVME_RDMA_OPT_NR_QUEUES(nctrl->opts);

Please drop this one, I'll send a v2. Thanks for the reviews, Nilay
and Christoph.

When creating the controller fails, nvmf_create_ctrl() frees opts right
after nvme_put_ctrl(), but that put is not always the last one. With
CONFIG_DEBUG_KOBJECT_RELEASE, KASAN reports a use-after-free here on
every failed connect.

v2 only moves queue->ctrl and leaves queue_lock where it is.