Re:Re: [PATCH] RDMA/srpt: fix NULL deref when sending BUSY before target_init_cmd()

[kensanya <kensanya@163.com>]

At 2026-07-21 00:31:58, "Bart Van Assche" <bvanassche@acm.org> wrote:
>On 7/19/26 7:59 PM, kensanya@163.com wrote:
>> +	rc = target_init_cmd(cmd, ch->sess, &send_ioctx->sense_data[0],
>> +			     scsilun_to_int(&srp_cmd->lun), 0 /* data_len */,
>> +			     TCM_SIMPLE_TAG, DMA_NONE, TARGET_SCF_ACK_KREF);
>> +	if (rc != 0) {
>> +		pr_debug("target_init_cmd() returned %d for tag %#llx\n", rc,
>> +			 srp_cmd->tag);
>> +		goto busy;
>> +	}
>
>This will cause target_send_busy() to be called on an uninitialized 
>command and that isn't allowed, isn't it?
>
>Thanks,
>
>Bart.

You are right that target_send_busy() must not be used when
target_init_cmd() fails: the command is not fully set up for the
target-core completion path (e.g. cmd_cnt was not taken on
-ESHUTDOWN). That goto-busy-on-init-failure path already existed
before the reorder.

How about the following plan?
  - If target_init_cmd() fails:
      release the send ioctx locally via target_free_tag(ch->sess, cmd)
      and do not call target_send_busy()
  - If target_init_cmd() succeeds but a later step fails
    (e.g. srpt_get_desc_tbl()):
      keep using target_send_busy(cmd)

Thanks，
TanZheng