Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 37411cad authored by David Howells's avatar David Howells Committed by David S. Miller
Browse files

rxrpc: Fix potential NULL-pointer exception 



Fix a potential NULL-pointer exception in rxrpc_do_sendmsg().  The call
state check that I added should have gone into the else-body of the
if-statement where we actually have a call to check.

Found by CoverityScan CID#1414316 ("Dereference after null check").

Fixes: 540b1c48 ("rxrpc: Fix deadlock between call creation and sendmsg/recvmsg")
Reported-by: default avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b3b6157a

net/rxrpc/sendmsg.c

+8 −7
Original line number Original line Diff line number Diff line
@@ -517,13 +517,6 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) 
		ret = -EBADSLT;

		ret = -EBADSLT;

		if (cmd != RXRPC_CMD_SEND_DATA)

		if (cmd != RXRPC_CMD_SEND_DATA)

			goto error_release_sock;

			goto error_release_sock;

		ret = -EBUSY;

		if (call->state == RXRPC_CALL_UNINITIALISED ||

		    call->state == RXRPC_CALL_CLIENT_AWAIT_CONN ||

		    call->state == RXRPC_CALL_SERVER_PREALLOC ||

		    call->state == RXRPC_CALL_SERVER_SECURING ||

		    call->state == RXRPC_CALL_SERVER_ACCEPTING)

			goto error_release_sock;

		call = rxrpc_new_client_call_for_sendmsg(rx, msg, user_call_ID,

		call = rxrpc_new_client_call_for_sendmsg(rx, msg, user_call_ID,

							 exclusive);

							 exclusive);

		/* The socket is now unlocked... */

		/* The socket is now unlocked... */
@@ -531,6 +524,14 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) 
			return PTR_ERR(call);

			return PTR_ERR(call);

		/* ... and we have the call lock. */

		/* ... and we have the call lock. */

	} else {

	} else {

		ret = -EBUSY;

		if (call->state == RXRPC_CALL_UNINITIALISED ||

		    call->state == RXRPC_CALL_CLIENT_AWAIT_CONN ||

		    call->state == RXRPC_CALL_SERVER_PREALLOC ||

		    call->state == RXRPC_CALL_SERVER_SECURING ||

		    call->state == RXRPC_CALL_SERVER_ACCEPTING)

			goto error_release_sock;



		ret = mutex_lock_interruptible(&call->user_mutex);

		ret = mutex_lock_interruptible(&call->user_mutex);

		release_sock(&rx->sk);

		release_sock(&rx->sk);

		if (ret < 0) {

		if (ret < 0) {