[PATCH v2] mctp i3c: Fix locking in an error path

[PATCH v2] mctp i3c: Fix locking in an error path

[Bart Van Assche]

If netdev_alloc_skb() fails, mctp_i3c_read() jumps to a label that
unlocks mi->lock although that mutex has not been locked yet. Fix this
by returning -ENOMEM directly. This bug has been detected by the Clang
thread-safety analyzer.

Cc: Leo Yang <Leo-Yang@quantatw.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Jeremy Kerr <jk@codeconstruct.com.au>
Cc: Matt Johnston <matt@codeconstruct.com.au>
Cc: netdev@vger.kernel.org
Fixes: 2d2d4f60ed26 ("mctp i3c: fix MCTP I3C driver multi-thread issue")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
v1 -> v2:
- Return -ENOMEM directly upon allocation failure instead of adding a
  free_skb label.

 drivers/net/mctp/mctp-i3c.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/mctp/mctp-i3c.c b/drivers/net/mctp/mctp-i3c.c
index 4e857dd5df64..5f225999d715 100644
--- a/drivers/net/mctp/mctp-i3c.c
+++ b/drivers/net/mctp/mctp-i3c.c
@@ -111,8 +111,7 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
 			       mi->mrl + sizeof(struct mctp_i3c_internal_hdr));
 	if (!skb) {
 		stats->rx_dropped++;
-		rc = -ENOMEM;
-		goto err;
+		return -ENOMEM;
 	}
 
 	skb->protocol = htons(ETH_P_MCTP);

Re: [PATCH v2] mctp i3c: Fix locking in an error path

[Matt Johnston]

On Thu, 2026-10-29 at 11:00 -0700, Bart Van Assche wrote:
> If netdev_alloc_skb() fails, mctp_i3c_read() jumps to a label that
> unlocks mi->lock although that mutex has not been locked yet. Fix this
> by returning -ENOMEM directly. This bug has been detected by the Clang
> thread-safety analyzer.
> 
> Cc: Leo Yang <Leo-Yang@quantatw.com>
> Cc: Paolo Abeni <pabeni@redhat.com>
> Cc: Jeremy Kerr <jk@codeconstruct.com.au>
> Cc: Matt Johnston <matt@codeconstruct.com.au>
> Cc: netdev@vger.kernel.org
> Fixes: 2d2d4f60ed26 ("mctp i3c: fix MCTP I3C driver multi-thread issue")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
> v1 -> v2:
> - Return -ENOMEM directly upon allocation failure instead of adding a
>   free_skb label.
> 
>  drivers/net/mctp/mctp-i3c.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/net/mctp/mctp-i3c.c b/drivers/net/mctp/mctp-i3c.c
> index 4e857dd5df64..5f225999d715 100644
> --- a/drivers/net/mctp/mctp-i3c.c
> +++ b/drivers/net/mctp/mctp-i3c.c
> @@ -111,8 +111,7 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
>  			       mi->mrl + sizeof(struct mctp_i3c_internal_hdr));
>  	if (!skb) {
>  		stats->rx_dropped++;
> -		rc = -ENOMEM;
> -		goto err;
> +		return -ENOMEM;
>  	}

Thank you.

Acked-by: Matt Johnston <matt@codeconstruct.com.au>

Re: [PATCH v2] mctp i3c: Fix locking in an error path

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Thu, 29 Oct 2026 11:00:39 -0700 you wrote:
> If netdev_alloc_skb() fails, mctp_i3c_read() jumps to a label that
> unlocks mi->lock although that mutex has not been locked yet. Fix this
> by returning -ENOMEM directly. This bug has been detected by the Clang
> thread-safety analyzer.
> 
> Cc: Leo Yang <Leo-Yang@quantatw.com>
> Cc: Paolo Abeni <pabeni@redhat.com>
> Cc: Jeremy Kerr <jk@codeconstruct.com.au>
> Cc: Matt Johnston <matt@codeconstruct.com.au>
> Cc: netdev@vger.kernel.org
> Fixes: 2d2d4f60ed26 ("mctp i3c: fix MCTP I3C driver multi-thread issue")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> 
> [...]

Here is the summary with links:
  - [v2] mctp i3c: Fix locking in an error path
    https://git.kernel.org/netdev/net/c/750eb5ab457e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html