Linux kernel NVMe-oF RDMA target (nvmet-rdma error completion handling with shared CQ): After the switch to shared

Impact

After the switch to shared completion queues the cq_context no longer identifies the queue, but the SEND error handler still used it - so a transport-level error such as retry-counter-exceeded dereferences a stale pointer and crashes the target. The trigger is link disruption on the RDMA fabric, which a co-tenant can induce (link flap, congestion, or simply disconnecting mid-transfer) without any access to the target itself.

Who can reach it

Remote/fabric. Any condition that produces a SEND completion error on the target's RDMA queue pairs - reachable by a peer able to disturb the fabric path.

What to do

Kernel update obtaining the queue from wc->qp instead of cq_context. Fabric-level: keep storage RDMA traffic on its own partition/VLAN so tenant-induced congestion does not reach the target's queue pairs.

References