From: Leon Romanovsky <leonro@nvidia.com>

srpt_handle_cmd() maps the initiator-supplied srp_cmd->task_attr into
cmd->sam_task_attr, but then hands a hardcoded TCM_SIMPLE_TAG to
target_init_cmd().

Pass the already mapped cmd->sam_task_attr instead, so target core sees the
attribute the initiator requested.

Fixes: 9474b043132f ("ib_srpt: Convert I/O path to target_submit_cmd + drop legacy ioctx->kref")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
Bart,

I found this during code review, but I'm not sure what the
original intention was.

The Fixes line references the addition of MSG_SIMPLE_TAG as a
hardcoded value. MSG_SIMPLE_TAG was later renamed to TCM_SIMPLE_TAG.

Thanks
---
 drivers/infiniband/ulp/srpt/ib_srpt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index a22ee4fc1e4c..7197d95f2216 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1602,7 +1602,7 @@ static void srpt_handle_cmd(struct srpt_rdma_ch *ch,
 
 	rc = target_init_cmd(cmd, ch->sess, &send_ioctx->sense_data[0],
 			     scsilun_to_int(&srp_cmd->lun), data_len,
-			     TCM_SIMPLE_TAG, dir, TARGET_SCF_ACK_KREF);
+			     cmd->sam_task_attr, dir, TARGET_SCF_ACK_KREF);
 	if (rc != 0) {
 		pr_debug("target_submit_cmd() returned %d for tag %#llx\n", rc,
 			 srp_cmd->tag);

---
base-commit: 28a06de7318fad1d0dec9bf54fe04243cc0635ff
change-id: 20260721-b4-scsi-ordering-violation-due-to-hardc-42a3335bd169

Best regards,
--  
Leon Romanovsky <leonro@nvidia.com>

On Tue, 21 Jul 2026 12:10:56 +0300, Leon Romanovsky wrote:
> srpt_handle_cmd() maps the initiator-supplied srp_cmd->task_attr into
> cmd->sam_task_attr, but then hands a hardcoded TCM_SIMPLE_TAG to
> target_init_cmd().
> 
> Pass the already mapped cmd->sam_task_attr instead, so target core sees the
> attribute the initiator requested.
> 
> [...]

Applied, thanks!

[1/1] RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
      https://git.kernel.org/rdma/rdma/c/ef63cc44170341

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>

On 7/21/26 2:10 AM, Leon Romanovsky wrote:
> From: Leon Romanovsky <leonro@nvidia.com>
> 
> srpt_handle_cmd() maps the initiator-supplied srp_cmd->task_attr into
> cmd->sam_task_attr, but then hands a hardcoded TCM_SIMPLE_TAG to
> target_init_cmd().
> 
> Pass the already mapped cmd->sam_task_attr instead, so target core sees the
> attribute the initiator requested.
> 
> Fixes: 9474b043132f ("ib_srpt: Convert I/O path to target_submit_cmd + drop legacy ioctx->kref")
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> ---
> Bart,
> 
> I found this during code review, but I'm not sure what the
> original intention was.
> 
> The Fixes line references the addition of MSG_SIMPLE_TAG as a
> hardcoded value. MSG_SIMPLE_TAG was later renamed to TCM_SIMPLE_TAG.
> 
> Thanks
> ---
>   drivers/infiniband/ulp/srpt/ib_srpt.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
> index a22ee4fc1e4c..7197d95f2216 100644
> --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
> +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
> @@ -1602,7 +1602,7 @@ static void srpt_handle_cmd(struct srpt_rdma_ch *ch,
>   
>   	rc = target_init_cmd(cmd, ch->sess, &send_ioctx->sense_data[0],
>   			     scsilun_to_int(&srp_cmd->lun), data_len,
> -			     TCM_SIMPLE_TAG, dir, TARGET_SCF_ACK_KREF);
> +			     cmd->sam_task_attr, dir, TARGET_SCF_ACK_KREF);
>   	if (rc != 0) {
>   		pr_debug("target_submit_cmd() returned %d for tag %#llx\n", rc,
>   			 srp_cmd->tag);

Although the Linux kernel SRP initiator always uses the SIMPLE tag, the
above change looks good to me. Hence:

Reviewed-by: Bart Van Assche <bvanassche@acm.org>