Re: [PATCH] RDMA/srp: Set scmnd->result only when scmnd is not NULL

[Bart Van Assche]

On 8/30/22 20:16, yangx.jy@xxxxxxxxxxx wrote:
> Sorry, I didn't make the right fix. I will send v2 patch.
> I think scmnd may be set to NULL after srp_claim_req() is called and
> then setting scmnd->result can trigger the NULL pointer dereference.

Something like this untested patch may be what you are looking for:

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c 
b/drivers/infiniband/ulp/srp/ib_srp.c
index 7720ea270ed8..d7f69e593a63 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1961,7 +1961,8 @@ static void srp_process_rsp(struct srp_rdma_ch 
*ch, struct srp_rsp *rsp)
 		if (scmnd) {
 			req = scsi_cmd_priv(scmnd);
 			scmnd = srp_claim_req(ch, req, NULL, scmnd);
-		} else {
+		}
+		if (!scmnd) {
 			shost_printk(KERN_ERR, target->scsi_host,
 				     "Null scmnd for RSP w/tag %#016llx received on ch %td / QP 
%#x\n",
 				     rsp->tag, ch - target->ch, ch->qp->qp_num);

Bart.