From: Quanye Yang <quanyeyang@proton.me>

The info-response receive is posted for a SEND.  The completion
opcode comes from the peer, so RDMA WRITE with Immediate is a
legal WC on that WQE even though it violates the RTRS handshake.

WARN_ON(wc->opcode != IB_WC_RECV) treats that peer-controlled
field as an internal invariant and panics with panic_on_warn.
Treat a non-SEND completion as a handshake failure: log it and
keep the existing CONNECTING_ERR cleanup.

Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Link: https://lore.kernel.org/linux-rdma/CA+0ovCge-K+hcGHXZ4R3Ww5+cg159uxHBeVbKeUSLBRSMT8OWA@mail.gmail.com
Signed-off-by: Quanye Yang <quanyeyang@proton.me>
---
 drivers/infiniband/ulp/rtrs/rtrs-clt.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
index eac38b57b00d..3c23c27725a5 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -2514,7 +2514,12 @@ static void rtrs_clt_info_rsp_done(struct ib_cq *cq, struct ib_wc *wc)
 			  ib_wc_status_msg(wc->status));
 		goto out;
 	}
-	WARN_ON(wc->opcode != IB_WC_RECV);
+	if (wc->opcode != IB_WC_RECV) {
+		rtrs_err(clt_path->clt,
+			 "Path info response has unexpected opcode %d\n",
+			 wc->opcode);
+		goto out;
+	}
 
 	if (wc->byte_len < sizeof(*msg)) {
 		rtrs_err(clt_path->clt, "Path info response is malformed: size %d\n",

---
base-commit: 93f51579e7df248780214094418f205253383cc5
change-id: 20260921-rtrs-fix-rtrs-clt-info-rsp-done-3e5d47cfdc44

Best regards,
--  
Quanye Yang <quanyeyang@proton.me>

On Tue, Sep 22, 2026 at 6:25 AM Quanye Yang via B4 Relay
<devnull+quanyeyang.proton.me@kernel.org> wrote:
>
> From: Quanye Yang <quanyeyang@proton.me>
>
> The info-response receive is posted for a SEND.  The completion
> opcode comes from the peer, so RDMA WRITE with Immediate is a
> legal WC on that WQE even though it violates the RTRS handshake.
>
> WARN_ON(wc->opcode != IB_WC_RECV) treats that peer-controlled
> field as an internal invariant and panics with panic_on_warn.
> Treat a non-SEND completion as a handshake failure: log it and
> keep the existing CONNECTING_ERR cleanup.
>
> Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
> Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> Link: https://lore.kernel.org/linux-rdma/CA+0ovCge-K+hcGHXZ4R3Ww5+cg159uxHBeVbKeUSLBRSMT8OWA@mail.gmail.com
> Signed-off-by: Quanye Yang <quanyeyang@proton.me>
> ---
>  drivers/infiniband/ulp/rtrs/rtrs-clt.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
> index eac38b57b00d..3c23c27725a5 100644
> --- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
> +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
> @@ -2514,7 +2514,12 @@ static void rtrs_clt_info_rsp_done(struct ib_cq *cq, struct ib_wc *wc)
>                           ib_wc_status_msg(wc->status));
>                 goto out;
>         }
> -       WARN_ON(wc->opcode != IB_WC_RECV);
> +       if (wc->opcode != IB_WC_RECV) {
> +               rtrs_err(clt_path->clt,
> +                        "Path info response has unexpected opcode %d\n",
> +                        wc->opcode);
> +               goto out;
> +       }
>
>         if (wc->byte_len < sizeof(*msg)) {
>                 rtrs_err(clt_path->clt, "Path info response is malformed: size %d\n",
>
> ---
lgtm,
Reviewed-by: Jack Wang <jinpu.wang@cloud.ionos.com>
> base-commit: 93f51579e7df248780214094418f205253383cc5
> change-id: 20260921-rtrs-fix-rtrs-clt-info-rsp-done-3e5d47cfdc44
>
> Best regards,
> --
> Quanye Yang <quanyeyang@proton.me>
>
>