On 8/30/22 20:16, yangx.jy@xxxxxxxxxxx wrote:
Sorry, I didn't make the right fix. I will send v2 patch.
I think scmnd may be set to NULL after srp_claim_req() is called and
then setting scmnd->result can trigger the NULL pointer dereference.
Something like this untested patch may be what you are looking for:
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c
b/drivers/infiniband/ulp/srp/ib_srp.c
index 7720ea270ed8..d7f69e593a63 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1961,7 +1961,8 @@ static void srp_process_rsp(struct srp_rdma_ch
*ch, struct srp_rsp *rsp)
if (scmnd) {
req = scsi_cmd_priv(scmnd);
scmnd = srp_claim_req(ch, req, NULL, scmnd);
- } else {
+ }
+ if (!scmnd) {
shost_printk(KERN_ERR, target->scsi_host,
"Null scmnd for RSP w/tag %#016llx received on ch %td / QP
%#x\n",
rsp->tag, ch - target->ch, ch->qp->qp_num);
Bart.
