[PATCH] scsi: mptfusion: Avoid NULL alt_ioc reload in reset work

[Ruoyu Wang]

mpt_fault_reset_work() alternates delayed fault polling between bound IOC
ports by switching to ioc->alt_ioc before rearming the timer.

The peer pointer is cleared from detach and probe-error paths without
holding the task management lock used when the worker rearms itself. The
old code tested ioc->alt_ioc and then loaded it again for assignment. If
the peer clear lands between those loads, ioc becomes NULL and the
following spin_lock_irqsave(&ioc->taskmgmt_lock, flags) dereferences
NULL.

Take one READ_ONCE() snapshot and fall back to the current IOC when no
alternate is present. This preserves the existing alternating polling
behavior while removing the NULL reload window.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: d54d48b80fb5 ("[SCSI] mpt fusion : Adding FAULT Reset polling work")
Signed-off-by: Ruoyu Wang <ruoyuw560@xxxxxxxxx>
---
 drivers/message/fusion/mptbase.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 3a431ffd3e2eb..29bcf44356d23 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -424,8 +424,7 @@ mpt_fault_reset_work(struct work_struct *work)
 	/*
 	 * Take turns polling alternate controller
 	 */
-	if (ioc->alt_ioc)
-		ioc = ioc->alt_ioc;
+	ioc = READ_ONCE(ioc->alt_ioc) ?: ioc;
 
 	/* rearm the timer */
 	spin_lock_irqsave(&ioc->taskmgmt_lock, flags);
-- 
2.51.0