Patch "IB/srp: Avoid that duplicate responses trigger a kernel bug" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

IB/srp: Avoid that duplicate responses trigger a kernel bug

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ib-srp-avoid-that-duplicate-responses-trigger-a-kernel-bug.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Bart Van Assche <[email protected]>
Date: Tue, 14 Feb 2017 10:56:30 -0800
Subject: IB/srp: Avoid that duplicate responses trigger a kernel bug

From: Bart Van Assche <[email protected]>

commit 6cb72bc1b40bb2c1750ee7a5ebade93bed49a5fb upstream.

After srp_process_rsp() returns there is a short time during which the scsi_host_find_tag() call will return a pointer to the SCSI command that is being completed. If during that time a duplicate response is received, avoid that the following call stack appears:

BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: srp_recv_done+0x450/0x6b0 [ib_srp]
Oops: 0000 [#1] SMP
CPU: 10 PID: 0 Comm: swapper/10 Not tainted 4.10.0-rc7-dbg+ #1
Call Trace:
 <IRQ>
 __ib_process_cq+0x4b/0xd0 [ib_core]
 ib_poll_handler+0x1d/0x70 [ib_core]
 irq_poll_softirq+0xba/0x120
 __do_softirq+0xba/0x4c0
 irq_exit+0xbe/0xd0
 smp_apic_timer_interrupt+0x38/0x50
 apic_timer_interrupt+0x90/0xa0
 </IRQ>
RIP: srp_recv_done+0x450/0x6b0 [ib_srp] RSP: ffff88046f483e20

---
 drivers/infiniband/ulp/srp/ib_srp.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -1880,9 +1880,11 @@ static void srp_process_rsp(struct srp_r
 		complete(&ch->tsk_mgmt_done);
 	} else {
 		scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag);
-		if (scmnd) {
+		if (scmnd && scmnd->host_scribble) {
 			req = (void *)scmnd->host_scribble;
 			scmnd = srp_claim_req(ch, req, NULL, scmnd);
+		} else {
+			scmnd = NULL;
 		}
 		if (!scmnd) {
 			shost_printk(KERN_ERR, target->scsi_host,

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/ib-srp-avoid-that-duplicate-responses-trigger-a-kernel-bug.patch queue-4.9/ib-srp-fix-race-conditions-related-to-task-management.patch queue-4.9/ib-srp-avoid-using-ib_mr_type_sg_gaps.patch