Linux kernel (drivers/nvme/target): When the target's peer-to-peer memory pool runs dry, it still tries to return the

Impact

When the target's peer-to-peer memory pool runs dry, it still tries to return the request's scatterlist to the P2P pool instead of the regular one, hitting a kernel BUG() in the allocator and taking the storage node down. Client I/O volume alone decides when the pool runs dry, so a peer can drive the panic.

Who can reach it

Driven by a connected NVMe-oF client's I/O against a target configured with a P2P memory device - enough concurrent requests to exhaust the p2pmem pool is sufficient, no crafted command needed. The observed crash path is nvmet-rdma completion, i.e. a peer on the RDMA fabric. Conditional on the target having p2pmem enabled (CMB / GPUDirect-Storage style setups), which is exactly the configuration an AI-storage node is likely to run.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: disable p2pmem on the nvmet port/subsystem so allocations fall back to the regular SGL pool, or size the P2P pool so it cannot be exhausted by expected client concurrency.

References