[PATCH] scsi: scsi_dh_rdac: fix NULL pointer dereference in error handling

[PATCH] scsi: scsi_dh_rdac: fix NULL pointer dereference in error handling

[Aleksey Shishkin]

From: Aleksey Shishkin <aishishkin@cloud.ru>

There is a critical logic error in error handling. If get_controller()
fails and returns NULL, the function sets err = SCSI_DH_RES_TEMP_UNAVAIL.
However, immediately after spin_unlock(), the code unconditionally
overwrites err with SCSI_DH_OK.

This causes the kernel to falsely report a successful initialization,
leading to an inevitable Null Pointer Dereference (Kernel Panic) later
when the driver attempts to use the uninitialized h->ctlr.

Fix this by moving the assignment err = SCSI_DH_OK inside the else block
so it is only set when the controller is successfully acquired.

Signed-off-by: Aleksey Shishkin <aishishkin@cloud.ru>
---
 drivers/scsi/device_handler/scsi_dh_rdac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 88c8e36b221e..ed02e1737bd7 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -455,9 +455,9 @@ static int initialize_controller(struct scsi_device *sdev,
 		else {
 			h->sdev = sdev;
 			list_add_rcu(&h->node, &h->ctlr->dh_list);
+			err = SCSI_DH_OK;
 		}
 		spin_unlock(&list_lock);
-		err = SCSI_DH_OK;
 	}
 	return err;
 }
-- 
2.47.3