[PATCH] scsi: rdac: Keep the error status when controller lookup fails

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

initialize_controller() records SCSI_DH_RES_TEMP_UNAVAIL when
get_controller() fails, but then overwrites it with SCSI_DH_OK
unconditionally. It therefore reports success with h->ctlr == NULL and
rdac_bus_attach() continues with check_ownership(), which dereferences
h->ctlr:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  ...
  check_ownership
  rdac_bus_attach

get_controller() only fails when its GFP_ATOMIC allocation fails, so the
crash happens exactly when memory is already scarce.

Only report success after the controller was found and the device was
added to its list.

Fixes: 327825574132 ("scsi_dh_rdac: switch to scsi_execute_req_flags()")
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 742534c99386..0986a6e2a6ae 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -450,14 +450,14 @@ static int initialize_controller(struct scsi_device *sdev,

 		spin_lock(&list_lock);
 		h->ctlr = get_controller(index, array_name, array_id, sdev);
-		if (!h->ctlr)
+		if (!h->ctlr) {
 			err = SCSI_DH_RES_TEMP_UNAVAIL;
-		else {
+		} else {
 			h->sdev = sdev;
 			list_add_rcu(&h->node, &h->ctlr->dh_list);
+			err = SCSI_DH_OK;
 		}
 		spin_unlock(&list_lock);
-		err = SCSI_DH_OK;
 	}
 	return err;
 }