Linux kernel (drivers/infiniband/hw/bnxt_re): The NVMe-oF target host panics the moment a client connects.

Impact

The NVMe-oF target host panics the moment a client connects. Shared-receive-queue page geometry is only filled in for userspace consumers, so a kernel consumer such as nvmet-rdma creates an SRQ with a zero page size and the driver takes a divide-by-zero oops - an immediate whole-node crash triggered from the storage fabric.

Who can reach it

Target-side and reachable from any connecting client: the crash happens in the queue-connect handler, before the NVMe association is established, so no NVMe-level authentication stands in the way. Requires Broadcom bnxt_re HCAs, an exported nvmet-rdma subsystem, and use_srq enabled on the target. If tenants can reach the NVMe-oF listener, any of them can take the storage node down.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: disable use_srq on nvmet-rdma ports (the target works without it), or restrict the NVMe-oF listener to trusted initiator addresses until the node is patched.

References