Linux kernel NVMe-oF TCP target (nvmet-tcp queue command allocation failure): When command allocation for a new queue

Impact

When command allocation for a new queue fails, nr_cmds is left non-zero and the release path walks a NULL array, oopsing the target. A remote initiator induces the allocation failure by opening queues faster than the target can back them - an unauthenticated remote party choosing when the storage target for the whole cluster goes down.

Who can reach it

Remote, unauthenticated, by driving queue creation until allocation fails.

What to do

Kernel update zeroing nr_cmds on the allocation failure path. Rate-limit and allow-list initiator connections at the network layer in the meantime.

References