scsi: dc395x: Fix a missing check on list iterator

commit 036a45aa587a10fa2abbd50fbd0f6c4cfc44f69f upstream.

The bug is here:

	p->target_id, p->target_lun);

The list iterator 'p' will point to a bogus position containing HEAD if the
list is empty or no element is found. This case must be checked before any
use of the iterator, otherwise it will lead to an invalid memory access.

To fix this bug, add a check. Use a new variable 'iter' as the list
iterator, and use the original variable 'p' as a dedicated pointer to point
to the found element.

Link: https://lore.kernel.org/r/20220414040231.2662-1-xiam0nd.tong@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index 16b9dc2fff6bdb67db82eef1227c6b61e7379dc0..8b5a07503d5f000bb986bec8f5748d4050c8ad6c 100644 (file)
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -3771,10 +3771,19 @@ static struct DeviceCtlBlk *device_alloc(struct AdapterCtlBlk *acb,
 #endif
        if (dcb->target_lun != 0) {
                /* Copy settings */
-               struct DeviceCtlBlk *p;
-               list_for_each_entry(p, &acb->dcb_list, list)
-                       if (p->target_id == dcb->target_id)
+               struct DeviceCtlBlk *p = NULL, *iter;
+
+               list_for_each_entry(iter, &acb->dcb_list, list)
+                       if (iter->target_id == dcb->target_id) {
+                               p = iter;
                                break;
+                       }
+
+               if (!p) {
+                       kfree(dcb);
+                       return NULL;
+               }
+
                dprintkdbg(DBG_1, 
                       "device_alloc: <%02i-%i> copy from <%02i-%i>\n",
                       dcb->target_id, dcb->target_lun,