[PATCH] scsi: megaraid_sas: Fix NULL pointer dereference in megasas_complete_cmd()

[PATCH] scsi: megaraid_sas: Fix NULL pointer dereference in megasas_complete_cmd()

[Tuo Li]

MFI_CMD_LD_READ and MFI_CMD_LD_WRITE commands can be submitted through the
management ioctl interface, where cmd->sync_cmd is set and cmd->scmd is
NULL.

However, these commands bypass the sync_cmd check in megasas_complete_cmd()
due to their placement after the fallthrough statement. As a result, the
completion handler may dereference cmd->scmd, leading to a NULL pointer
dereference.

Move the MFI_CMD_LD_READ and MFI_CMD_LD_WRITE case labels before the
sync_cmd check so that synchronous commands are handled by
megasas_complete_int_cmd().

Fixes: c4a3e0a529ab ("[SCSI] MegaRAID SAS RAID: new driver")
Signed-off-by: Tuo Li <islituo@gmail.com>
---
 drivers/scsi/megaraid/megaraid_sas_base.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 602173fd313a..5e1aeec96a4d 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3635,6 +3635,8 @@ megasas_complete_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd,
 		break;
 	case MFI_CMD_PD_SCSI_IO:
 	case MFI_CMD_LD_SCSI_IO:
+	case MFI_CMD_LD_READ:
+	case MFI_CMD_LD_WRITE:
 
 		/*
 		 * MFI_CMD_PD_SCSI_IO and MFI_CMD_LD_SCSI_IO could have been
@@ -3646,10 +3648,6 @@ megasas_complete_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd,
 			megasas_complete_int_cmd(instance, cmd);
 			break;
 		}
-		fallthrough;
-
-	case MFI_CMD_LD_READ:
-	case MFI_CMD_LD_WRITE:
 
 		if (alt_status) {
 			cmd->scmd->result = alt_status << 16;
-- 
2.43.0