scsi: qla2xxx: Fix potential NULL pointer dereference

BugLink: https://bugs.launchpad.net/bugs/2036075
commit 464ea494a40c6e3e0e8f91dd325408aaf21515ba upstream.

Klocwork tool reported 'cur_dsd' may be dereferenced.  Add fix to validate
pointer before dereferencing the pointer.

Cc: stable@vger.kernel.org
Signed-off-by: Bikash Hazarika <bhazarika@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230607113843.37185-3-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index f6a9fdb3151d419f0f8371b3848c5f7e0ea5541a..c9a686f06d29d7d6061c6031db4333eaa6c094a6 100644 (file)
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -607,7 +607,8 @@ qla24xx_build_scsi_type_6_iocbs(srb_t *sp, struct cmd_type_6 *cmd_pkt,
        put_unaligned_le32(COMMAND_TYPE_6, &cmd_pkt->entry_type);
 
        /* No data transfer */
-       if (!scsi_bufflen(cmd) || cmd->sc_data_direction == DMA_NONE) {
+       if (!scsi_bufflen(cmd) || cmd->sc_data_direction == DMA_NONE ||
+           tot_dsds == 0) {
                cmd_pkt->byte_count = cpu_to_le32(0);
                return 0;
        }