[PATCH] RDMA/mlx5: Check SIG_ERR CQE mkey lookup before dereferencing

[lirongqing <lirongqing@baidu.com>]

From: Li RongQing <lirongqing@baidu.com>

In mlx5_poll_one, a MLX5_CQE_SIG_ERR completion looks up the signature
context in dev->sig_mrs via xa_load() but dereferences the result without
a NULL check. If the corresponding MR has been concurrently deregistered
(which removes the xarray entry without holding the CQ lock), xa_load()
returns NULL and the subsequent get_sig_err_item(sig_err_cqe, &sig->err_item)
crashes in atomic context under xa_lock.

Add a NULL check that drops the lock, logs a warning, and repolls.

Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/infiniband/hw/mlx5/cq.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 49b4bf1..b0b1177 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -563,6 +563,13 @@ static int mlx5_poll_one(struct mlx5_ib_cq *cq,
 		xa_lock(&dev->sig_mrs);
 		sig = xa_load(&dev->sig_mrs,
 				mlx5_base_mkey(be32_to_cpu(sig_err_cqe->mkey)));
+		if (!sig) {
+			xa_unlock(&dev->sig_mrs);
+			mlx5_ib_warn(dev, "CQN: 0x%x Got SIGERR on unknown mkey: 0x%x\n",
+				     cq->mcq.cqn,
+				     be32_to_cpu(sig_err_cqe->mkey));
+			goto repoll;
+		}
 		get_sig_err_item(sig_err_cqe, &sig->err_item);
 		sig->sig_err_exists = true;
 		sig->sigerr_count++;
-- 
2.9.4