BUG null dereference in drivers/message/fusion/mptscsih.c

BUG null dereference in drivers/message/fusion/mptscsih.c

[Alexander Strakh]

	KERNEL_VERSION: 2.6.32
	SUBJECT: null dereference in function mptscsih_qcmd
	DESCRIBE:
	In ./drivers/ata/sata_mv.c in function mptscsih_qcmd 

Null dereference in line 1371 of vdevice (vdevice->vtarget->id).
We assume that it may be null, because we check it in line 1361 in the if 
statement. (if vdevice is null we goto to the else part in line 1366)

1300 int
1301 mptscsih_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
1302 {
...
1361         if (vdevice
1362             && (vdevice->vtarget->tflags & MPT_TARGET_FLAGS_Q_YES)
1363             && (SCpnt->device->tagged_supported)) {
1364                 scsictl = scsidir | MPI_SCSIIO_CONTROL_SIMPLEQ;
1365         } else {
1366                 scsictl = scsidir | MPI_SCSIIO_CONTROL_UNTAGGED;
1367         }
1368
1369         /* Use the above information to set up the message frame
1370          */
1371         pScsiReq->TargetID = (u8) vdevice->vtarget->id;
1372         pScsiReq->Bus = vdevice->vtarget->channel;
...
}

Found by Linux Device Drivers Verification Project (Svace Detector)