[PATCH] scsi: target: Fix NULL pointer dereference in target_dev_alua_lu_gp_store()

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

Writing "NULL" to the alua_lu_gp attribute clears the ALUA LU group
association of a device. The attribute can be written again after the
association has already been cleared. In that case lu_gp_mem->lu_gp and
lu_gp_new are both NULL, but the code still calls
__core_alua_attach_lu_gp_mem(), which dereferences the NULL lu_gp
pointer:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  ...
  __core_alua_attach_lu_gp_mem
  target_dev_alua_lu_gp_store

Clearing an already cleared association is a no-op, so return early when
there is no association left to clear.

Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6")
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 2b19a956007b..430fc1eaeca5 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -2547,6 +2547,14 @@ static ssize_t target_dev_alua_lu_gp_store(struct config_item *item,

 	spin_lock(&lu_gp_mem->lu_gp_mem_lock);
 	lu_gp = lu_gp_mem->lu_gp;
+	if (!lu_gp && !lu_gp_new) {
+		/*
+		 * The LU group association has already been cleared, so
+		 * there is nothing left to do.
+		 */
+		spin_unlock(&lu_gp_mem->lu_gp_mem_lock);
+		return count;
+	}
 	if (lu_gp) {
 		/*
 		 * Clearing an existing lu_gp association, and replacing