Re: [PATCH] RDMA/srpt: fix NULL deref when sending BUSY before target_init_cmd()

[Bart Van Assche]

On 7/19/26 7:59 PM, kensanya@xxxxxxx wrote:
> +	rc = target_init_cmd(cmd, ch->sess, &send_ioctx->sense_data[0],
> +			     scsilun_to_int(&srp_cmd->lun), 0 /* data_len */,
> +			     TCM_SIMPLE_TAG, DMA_NONE, TARGET_SCF_ACK_KREF);
> +	if (rc != 0) {
> +		pr_debug("target_init_cmd() returned %d for tag %#llx\n", rc,
> +			 srp_cmd->tag);
> +		goto busy;
> +	}

This will cause target_send_busy() to be called on an uninitialized 
command and that isn't allowed, isn't it?

Thanks,

Bart.