Re: [PATCH v3 2/3] scsi: libiscsi: validate the ITT reflected in a Reject PDU

[Yehyeong Lee]

Thanks for looking at this.

The reflected ITT here is resolved with iscsi_itt_to_task(), which
returns a fixed slot in the static command pool (session->cmds[i])
and is non-NULL for any in-range index. The previous check was
"if (!task)", so a valid-range ITT was never rejected: before this
change a Reject PDU could already drive any pool slot to completion,
in any state, including a fully set-up in-flight SCSI command. This
patch rejects slots that are free or carry an active SCSI command,
which strictly reduces that set rather than widening it.

The window you point at is real but predates this change: in
iscsi_alloc_task() a slot is briefly ISCSI_TASK_PENDING with task->sc
not yet assigned (freed slots are cleared to sc == NULL), and the
allocation runs under frwd_lock while this check runs under back_lock.
That window is unchanged by this patch and is independent of the NULL
task->conn dereference fixed here.

Closing it is a separate change -- e.g. assigning task->state last in
iscsi_alloc_task(), after task->sc, so a findable slot is never
PENDING with a NULL sc. Happy to send that as a follow-up.