[BUG] rtrs-clt: general protection fault in process_io_rsp() / rtrs_clt_rdma_done()

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/135-rtrs-warn-on-peer-supplied-completion/

  Oops: general protection fault, probably for non-canonical address
0xdffffc000000000b: 0000 [#1] SMP KASAN NOPTI
  KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
  Workqueue: rxe_wq do_work
  RIP: 0010:process_io_rsp drivers/infiniband/ulp/rtrs/rtrs-clt.c:502 [inline]
  RIP: 0010:rtrs_clt_rdma_done+0x732/0x1450
drivers/infiniband/ulp/rtrs/rtrs-clt.c:637
  RBX: 0000000000000058
  Call Trace:
   <IRQ>
   rtrs_clt_rdma_done+0x732/0x1450 drivers/infiniband/ulp/rtrs/rtrs-clt.c:637
   __ib_process_cq+0x149/0x440 drivers/infiniband/core/cq.c:110
   ib_poll_handler+0x78/0x280 drivers/infiniband/core/cq.c:157
   irq_poll_softirq+0x1ea/0x500 lib/irq_poll.c:110
   handle_softirqs+0x191/0x5a0 kernel/softirq.c:622
   </IRQ>
   rxe_receiver+0x1224/0xc940 drivers/infiniband/sw/rxe/rxe_resp.c:1567
   do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
   do_work+0x1aa/0x720 drivers/infiniband/sw/rxe/rxe_task.c:191
  Kernel panic - not syncing: Fatal exception in interrupt

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,