[PATCH] scsi: target: Fix NULL deref when clearing alua_lu_gp twice

From: TanZheng <[email protected]>

Writing "NULL" to the alua_lu_gp configuration file attribute will
clear the LU group association of the device. This early return
path is only executed when lu_gp has been set. If the device has
been unassociated (for example, after the second write of "NULL"),
the storage operation will jump to  __core_alua_attach_lu_gp_mem(),
at which point lu_gp_new is NULL and a kernel crash occurs when
obtaining spin_lock(&lu_gp->lu_gp_lock).

Crash information is as follows:
[  850.069209][ T2984] BUG: kernel NULL pointer dereference, address: 0000000000000010
[  850.070015][ T2984] #PF: supervisor write access in kernel mode
[  850.070654][ T2984] #PF: error_code(0x0002) - not-present page
[  850.071284][ T2984] PGD 14d4c2067 P4D 0
[  850.071715][ T2984] Oops: Oops: 0002 [#1] SMP KASAN NOPTI
...
[  850.077945][ T2984] RSP: 0018:ff1100010a0877f8 EFLAGS: 00010297
[  850.078578][ T2984] RAX: 0000000000000000 RBX: 0000000000000010 RCX: ffffffff86b17884
[  850.079402][ T2984] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ff1100010a087818
[  850.080237][ T2984] RBP: 1fe2200021410eff R08: 0000000000000001 R09: ffe21c0021410f03
[  850.081065][ T2984] R10: 0000000000000003 R11: 6e696c6261736944 R12: ff11000113c16788
[  850.081897][ T2984] R13: ff11000113c16780 R14: 0000000000000010 R15: 0000000000000000
[  850.082721][ T2984] FS:  00007fc9a84d6740(0000) GS:ff11000388fe1000(0000) knlGS:0000000000000000
[  850.083649][ T2984] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  850.084342][ T2984] CR2: 0000000000000010 CR3: 0000000154a24004 CR4: 0000000000773ef0
[  850.085172][ T2984] PKRU: 55555554
[  850.085546][ T2984] Call Trace:
[  850.085897][ T2984]  <TASK>
[  850.086208][ T2984]  ? __pfx__raw_spin_lock+0x10/0x10
[  850.086755][ T2984]  ? configfs_write_iter+0x362/0x550
[  850.087309][ T2984]  ? _raw_spin_lock+0x84/0xe0
[  850.087807][ T2984]  ? __pfx__raw_spin_lock+0x10/0x10
[  850.088345][ T2984]  __core_alua_attach_lu_gp_mem+0x29/0x1f0 [target_core_mod]
[  850.089162][ T2984]  target_dev_alua_lu_gp_store+0x1a8/0x520 [target_core_mod]
[  850.089975][ T2984]  ? __pfx_target_dev_alua_lu_gp_store+0x10/0x10 [target_core_mod]
...

When both the current group and the requested group are NULL,
an early return occurs.

Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6")
Reported-by: sashiko-bot <[email protected]>
Link: https://sashiko.dev/#/patchset/[email protected]?part=1
Signed-off-by: TanZheng <[email protected]>
---
 drivers/target/target_core_configfs.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 0e50987e6dbe..292730f98db4 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -2572,6 +2572,12 @@ static ssize_t target_dev_alua_lu_gp_store(struct config_item *item,
 		__core_alua_drop_lu_gp_mem(lu_gp_mem, lu_gp);
 		move = 1;
 	}
+
+	if (!lu_gp_new) {
+		spin_unlock(&lu_gp_mem->lu_gp_mem_lock);
+		return count;
+	}
+
 	/*
 	 * Associate lu_gp_mem with lu_gp_new.
 	 */
-- 
2.25.1