Re: [PATCH] RDMA/srp: Set scmnd->result only when scmnd is not NULL

[Bart Van Assche <bvanassche@acm.org>]

On 8/30/22 20:16, yangx.jy@fujitsu.com wrote:
> Sorry, I didn't make the right fix. I will send v2 patch.
> I think scmnd may be set to NULL after srp_claim_req() is called and
> then setting scmnd->result can trigger the NULL pointer dereference.

Something like this untested patch may be what you are looking for:

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c 
b/drivers/infiniband/ulp/srp/ib_srp.c
index 7720ea270ed8..d7f69e593a63 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1961,7 +1961,8 @@ static void srp_process_rsp(struct srp_rdma_ch 
*ch, struct srp_rsp *rsp)
  		if (scmnd) {
  			req = scsi_cmd_priv(scmnd);
  			scmnd = srp_claim_req(ch, req, NULL, scmnd);
-		} else {
+		}
+		if (!scmnd) {
  			shost_printk(KERN_ERR, target->scsi_host,
  				     "Null scmnd for RSP w/tag %#016llx received on ch %td / QP 
%#x\n",
  				     rsp->tag, ch - target->ch, ch->qp->qp_num);

Bart.