Re: [BUG] rtrs-clt: general protection fault in process_io_rsp() / rtrs_clt_rdma_done()

[Jinpu Wang]

On Fri, Aug 28, 2026 at 7:22 AM Farhad Alemi <farhad.alemi@xxxxxxxxxxxx> wrote:
>
> Hello,
>
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
>
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/135-rtrs-warn-on-peer-supplied-completion/
>
>   Oops: general protection fault, probably for non-canonical address
> 0xdffffc000000000b: 0000 [#1] SMP KASAN NOPTI
>   KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
>   Workqueue: rxe_wq do_work
>   RIP: 0010:process_io_rsp drivers/infiniband/ulp/rtrs/rtrs-clt.c:502 [inline]
>   RIP: 0010:rtrs_clt_rdma_done+0x732/0x1450
> drivers/infiniband/ulp/rtrs/rtrs-clt.c:637
>   RBX: 0000000000000058
>   Call Trace:
>    <IRQ>
>    rtrs_clt_rdma_done+0x732/0x1450 drivers/infiniband/ulp/rtrs/rtrs-clt.c:637
>    __ib_process_cq+0x149/0x440 drivers/infiniband/core/cq.c:110
>    ib_poll_handler+0x78/0x280 drivers/infiniband/core/cq.c:157
>    irq_poll_softirq+0x1ea/0x500 lib/irq_poll.c:110
>    handle_softirqs+0x191/0x5a0 kernel/softirq.c:622
>    </IRQ>
>    rxe_receiver+0x1224/0xc940 drivers/infiniband/sw/rxe/rxe_resp.c:1567
>    do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
>    do_work+0x1aa/0x720 drivers/infiniband/sw/rxe/rxe_task.c:191
>   Kernel panic - not syncing: Fatal exception in interrupt
>
> Our reproducer.c is available upon request.
Hi Farhad,

Thanks for the report. Please share the reproducer.c so we can take a
closer look.

Thanks,

>
> Happy to test a patch if that would help.
>
> Regards,