[PATCH] nvme-rdma: fix NULL metadata_sgl dereference with T10-PI

[PATCH] nvme-rdma: fix NULL metadata_sgl dereference with T10-PI

[Christian Aurich Zanettini Martins]

Since commit 2a8513091d2f ("nvme-rdma: parallelize I/O queue allocation
and startup") the I/O tag set is allocated before the I/O queues.
nvme_rdma_init_request() only sets req->metadata_sgl if
queue->pi_support is set, but pi_support is only set later by
nvme_rdma_alloc_queue(), so every I/O request is left with a NULL
metadata_sgl.

With an RDMA device that supports integrity and a namespace formatted
with protection information, nvme_rdma_dma_map_req() then dereferences
the NULL pointer on the first integrity I/O, already during the
namespace scan when there is more than one I/O queue.

Queues that a later reconnect adds for the first time have the same
problem.

Check queue_idx and the controller's max_integrity_segments instead,
which is what nvme_rdma_alloc_queue() derives pi_support from.

Fixes: 2a8513091d2f ("nvme-rdma: parallelize I/O queue allocation and startup")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
---
Based on nvme-7.4 (aaedcff90148); also applies to mainline and v7.3.

Found by code reading while looking at the same reorder in nvme-tcp.
Without PI-capable hardware (only mlx5 supports it) I could not
reproduce the oops. On rxe in QEMU, a debug print showed every I/O
request initialized before its queue was allocated, and with the patch
connect, I/O and a reconnect growing the queues from 2 to 4 still work.
A Tested-by from someone with ConnectX and a PI namespace is welcome.

 drivers/nvme/host/rdma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 5b9b540693b5..07216890f75c 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -313,7 +313,7 @@ static int nvme_rdma_init_request(struct blk_mq_tag_set *set,
 		return -ENOMEM;
 
 	/* metadata nvme_rdma_sgl struct is located after command's data SGL */
-	if (queue->pi_support)
+	if (queue_idx && ctrl->ctrl.max_integrity_segments)
 		req->metadata_sgl = (void *)nvme_req(rq) +
 			sizeof(struct nvme_rdma_request) +
 			NVME_RDMA_DATA_SGL_SIZE;
-- 
2.43.0

Re: [PATCH] nvme-rdma: fix NULL metadata_sgl dereference with T10-PI

[Keith Busch]

On Sat, Oct 24, 2026 at 06:37:37PM -0300, Christian Aurich Zanettini Martins wrote:
> Since commit 2a8513091d2f ("nvme-rdma: parallelize I/O queue allocation
> and startup") the I/O tag set is allocated before the I/O queues.
> nvme_rdma_init_request() only sets req->metadata_sgl if
> queue->pi_support is set, but pi_support is only set later by
> nvme_rdma_alloc_queue(), so every I/O request is left with a NULL
> metadata_sgl.
> 
> With an RDMA device that supports integrity and a namespace formatted
> with protection information, nvme_rdma_dma_map_req() then dereferences
> the NULL pointer on the first integrity I/O, already during the
> namespace scan when there is more than one I/O queue.
> 
> Queues that a later reconnect adds for the first time have the same
> problem.
> 
> Check queue_idx and the controller's max_integrity_segments instead,
> which is what nvme_rdma_alloc_queue() derives pi_support from.

Thanks, applied to nvme-7.4.