[PATCH v2] nvme-rdma: fix NULL queue->ctrl dereference on reconnect

[Nilay Shroff]

On 10/29/26 7:49 PM, Christian Aurich Zanettini Martins wrote:
> Since commit 2a8513091d2f ("nvme-rdma: parallelize I/O queue allocation
> and startup"), a reconnect that gets more I/O queues than before grows
> the tag set before the new queues are set up. queue->ctrl is only set
> by nvme_rdma_setup_io_queues(), so I/O submitted in between reaches
> nvme_rdma_queue_rq() on a queue that was never allocated and
> dereferences a NULL queue->ctrl:
> 
>    BUG: kernel NULL pointer dereference, address: 000000000000034c
>    RIP: 0010:nvme_rdma_queue_rq+0x52/0xb90
> 
> Set queue->ctrl for every queue when allocating the controller. Such
> requests are then requeued like on any other queue that is not live.
> 
> Fixes: 2a8513091d2f ("nvme-rdma: parallelize I/O queue allocation and startup")
> Cc:stable at vger.kernel.org
> Signed-off-by: Christian Aurich Zanettini Martins<christian.aurichzm at gmail.com>

Looks good to me:
Reviewed-by: Nilay Shroff <nilay at linux.ibm.com>