Linux kernel (drivers/nvme/target): When the target's peer-to-peer memory pool runs dry, it still tries to return the

CVSS 7.5CVE-2021-47130Kernel, userspace & hypervisorcurated

Impact

When the target's peer-to-peer memory pool runs dry, it still tries to return the request's scatterlist to the P2P pool instead of the regular one, hitting a kernel BUG() in the allocator and taking the storage node down. Client I/O volume alone decides when the pool runs dry, so a peer can drive the panic.

Who can reach it

Driven by a connected NVMe-oF client's I/O against a target configured with a P2P memory device - enough concurrent requests to exhaust the p2pmem pool is sufficient, no crafted command needed. The observed crash path is nvmet-rdma completion, i.e. a peer on the RDMA fabric. Conditional on the target having p2pmem enabled (CMB / GPUDirect-Storage style setups), which is exactly the configuration an AI-storage node is likely to run.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: disable p2pmem on the nvmet port/subsystem so allocations fall back to the regular SGL pool, or size the P2P pool so it cannot be exhausted by expected client concurrency.

References

https://git.kernel.org/stable/c/c440cd080761b18a52cac20f2a42e5da1e3995af https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271 https://nvd.nist.gov/vuln/detail/CVE-2021-47130

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.