Commit 7a310f8d authored by David Howells's avatar David Howells Committed by Jakub Kicinski
Browse files

rxrpc: Fix uninitialised variable in rxrpc_send_data() 



Fix the uninitialised txb variable in rxrpc_send_data() by moving the code
that loads it above all the jumps to maybe_error, txb being stored back
into call->tx_pending right before the normal return.

Fixes: b0f571ec ("rxrpc: Fix locking in rxrpc's sendmsg")
Reported-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Closes: https://lists.infradead.org/pipermail/linux-afs/2024-October/008896.html


Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Link: https://patch.msgid.link/20241001132702.3122709-3-dhowells@redhat.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent bc212465

net/rxrpc/sendmsg.c

+5 −5
Original line number Diff line number Diff line
@@ -303,6 +303,11 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, 
	sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);



reload:

	txb = call->tx_pending;

	call->tx_pending = NULL;

	if (txb)

		rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more);



	ret = -EPIPE;

	if (sk->sk_shutdown & SEND_SHUTDOWN)

		goto maybe_error;
@@ -329,11 +334,6 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, 
			goto maybe_error;

	}



	txb = call->tx_pending;

	call->tx_pending = NULL;

	if (txb)

		rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more);



	do {

		if (!txb) {

			size_t remain;