Commit 6cb3ece9 authored Oct 20, 2017 by David Howells Committed by David S. Miller Oct 22, 2017

rxrpc: Don't release call mutex on error pointer



Don't release call mutex at the end of rxrpc_kernel_begin_call() if the
call pointer actually holds an error value.

Fixes: 540b1c48 ("rxrpc: Fix deadlock between call creation and sendmsg/recvmsg")
Reported-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 748759d5

net/rxrpc/af_rxrpc.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -308,10 +308,11 @@ struct rxrpc_call rxrpc_kernel_begin_call(struct socket sock,
		call = rxrpc_new_client_call(rx, &cp, srx, user_call_ID, tx_total_len,
		gfp);
		/* The socket has been unlocked. */
		if (!IS_ERR(call))
		if (!IS_ERR(call)) {
		call->notify_rx = notify_rx;

		mutex_unlock(&call->user_mutex);
		}

		_leave(" = %p", call);
		return call;
		}