[PATCH] scsi: mvumi: Fix a NULL pointer dereference in mvumi_timed_out()

[PATCH] scsi: mvumi: Fix a NULL pointer dereference in mvumi_timed_out()

[Ginger Li]

mvumi_timed_out() reads mvumi_priv(scmd)->cmd_priv before it takes host_lock.
If the command completes in the meantime, the interrupt handler clears
cmd_priv in mvumi_complete_cmd(), and mvumi_timed_out() then uses the NULL
pointer for cmd->frame->tag and cmd->queue_pointer.

Read cmd_priv under host_lock and return without doing anything if the command
has already been completed.

Fixes: f0c568a478f0 ("[SCSI] mvumi: Add Marvell UMI driver")
Signed-off-by: Ginger Li <ginger.jzllee@gmail.com>
---
 drivers/scsi/mvumi.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
--- a/drivers/scsi/mvumi.c
+++ b/drivers/scsi/mvumi.c
@@ -2111,12 +2111,24 @@ static enum scsi_timeout_action mvumi_timed_out(struct
 
 static enum scsi_timeout_action mvumi_timed_out(struct scsi_cmnd *scmd)
 {
-	struct mvumi_cmd *cmd = mvumi_priv(scmd)->cmd_priv;
 	struct Scsi_Host *host = scmd->device->host;
 	struct mvumi_hba *mhba = shost_priv(host);
+	struct mvumi_cmd *cmd;
 	unsigned long flags;
 
 	spin_lock_irqsave(mhba->shost->host_lock, flags);
+
+	/*
+	 * The command may have been completed by the interrupt handler just
+	 * before the timeout fired, in which case mvumi_complete_cmd() has
+	 * already cleared cmd_priv.  Read the pointer under host_lock so that
+	 * it is consistent with the state of the command.
+	 */
+	cmd = mvumi_priv(scmd)->cmd_priv;
+	if (!cmd) {
+		spin_unlock_irqrestore(mhba->shost->host_lock, flags);
+		return SCSI_EH_NOT_HANDLED;
+	}
 
 	if (mhba->tag_cmd[cmd->frame->tag]) {
 		mhba->tag_cmd[cmd->frame->tag] = NULL;
-- 
2.43.0