[PATCH] scsi: target: Fix NULL pointer dereference in core_alua_do_port_transition()

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

core_alua_do_port_transition() assumes that the device has an ALUA LU
group member and that the member is associated with an LU group. Neither
is guaranteed: internal-use HBAs never allocate dev_alua_lu_gp_mem, and
the association with an LU group is dropped when "NULL" is written to the
device's alua_lu_gp attribute.

The configfs path can reach the second case. After clearing the LU group
association, writing the implicit ALUA access state of a target port
group calls core_alua_do_port_transition(), which dereferences the NULL
lu_gp in atomic_inc(&lu_gp->lu_gp_ref_cnt).

Return -ENODEV when the device has no LU group association instead.

Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6")
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index 140154d93c43..17386c96de13 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -1081,8 +1081,15 @@ int core_alua_do_port_transition(
 		return -EINVAL;

 	local_lu_gp_mem = l_dev->dev_alua_lu_gp_mem;
+	if (!local_lu_gp_mem)
+		return -ENODEV;
+
 	spin_lock(&local_lu_gp_mem->lu_gp_mem_lock);
 	lu_gp = local_lu_gp_mem->lu_gp;
+	if (!lu_gp) {
+		spin_unlock(&local_lu_gp_mem->lu_gp_mem_lock);
+		return -ENODEV;
+	}
 	atomic_inc(&lu_gp->lu_gp_ref_cnt);
 	spin_unlock(&local_lu_gp_mem->lu_gp_mem_lock);
 	/*