Re: [PATCH v3 3/3] scsi: libiscsi: validate the task named by a management response

[Yehyeong Lee]

Thanks for looking at this.

The management-response ITT is resolved with iscsi_itt_to_task(),
which returns a fixed slot in the static command pool
(session->cmds[i]) and is non-NULL for any in-range index. The
previous check was "if (!task)", so a valid-range ITT was never
rejected: before this change a management response could already
drive any pool slot to completion, in any state. This patch rejects
slots that are free or carry an active SCSI command, which strictly
reduces that set.

On the two paths you raise:

- The allocation window -- a slot briefly ISCSI_TASK_PENDING with
  task->sc not yet assigned in iscsi_alloc_task() (freed slots are
  cleared to sc == NULL), allocation under frwd_lock and this check
  under back_lock -- is unchanged by this patch; it pre-exists and
  sits outside the NULL task->conn dereference and the
  ISCSI_TASK_FREE refcount underflow fixed here.
- Completing a still-queued PENDING task was likewise already
  reachable under the old "if (!task)"; this patch does not widen it.

Fully closing the allocation window is a separate change -- e.g.
assigning task->state last in iscsi_alloc_task(), after task->sc, so a
findable slot is never PENDING with a NULL sc. Happy to send that as a
follow-up.