Re: [PATCH] RDMA/srpt: fix NULL deref when sending BUSY before target_init_cmd()

Bart Van Assche <[email protected]> Mon, 20 Jul 2026 09:31:58 -0700

Newsgroups	org.kernel.vger.target-devel,org.kernel.vger.linux-kernel,org.kernel.vger.linux-rdma
Message-ID	<[email protected]>

On 7/19/26 7:59 PM, [email protected] wrote:
> +	rc = target_init_cmd(cmd, ch->sess, &send_ioctx->sense_data[0],
> +			     scsilun_to_int(&srp_cmd->lun), 0 /* data_len */,
> +			     TCM_SIMPLE_TAG, DMA_NONE, TARGET_SCF_ACK_KREF);
> +	if (rc != 0) {
> +		pr_debug("target_init_cmd() returned %d for tag %#llx\n", rc,
> +			 srp_cmd->tag);
> +		goto busy;
> +	}

This will cause target_send_busy() to be called on an uninitialized 
command and that isn't allowed, isn't it?

Thanks,

Bart.