[PATCH net] mctp i3c: Fix locking in an error path

[PATCH net] mctp i3c: Fix locking in an error path

[Bart Van Assche]

If netdev_alloc_skb() fails, mctp_i3c_read() jumps to a label that
unlocks mi->lock although that mutex has not been locked yet. Fix this
by jumping to a label that only frees the skb. This bug has been
detected by the Clang thread-safety analyzer.

Cc: Leo Yang <Leo-Yang@quantatw.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Jeremy Kerr <jk@codeconstruct.com.au>
Cc: Matt Johnston <matt@codeconstruct.com.au>
Cc: netdev@vger.kernel.org
Fixes: 2d2d4f60ed26 ("mctp i3c: fix MCTP I3C driver multi-thread issue")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
 drivers/net/mctp/mctp-i3c.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mctp/mctp-i3c.c b/drivers/net/mctp/mctp-i3c.c
index 4e857dd5df64..59e7bf56fce3 100644
--- a/drivers/net/mctp/mctp-i3c.c
+++ b/drivers/net/mctp/mctp-i3c.c
@@ -112,7 +112,7 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
 	if (!skb) {
 		stats->rx_dropped++;
 		rc = -ENOMEM;
-		goto err;
+		goto free_skb;
 	}
 
 	skb->protocol = htons(ETH_P_MCTP);
@@ -170,8 +170,11 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
 
 	mutex_unlock(&mi->lock);
 	return 0;
+
 err:
 	mutex_unlock(&mi->lock);
+
+free_skb:
 	kfree_skb(skb);
 	return rc;
 }

Re: [PATCH net] mctp i3c: Fix locking in an error path

[Paolo Abeni]

On 10/26/26 20:59, Bart Van Assche wrote:
> If netdev_alloc_skb() fails, mctp_i3c_read() jumps to a label that
> unlocks mi->lock although that mutex has not been locked yet. Fix this
> by jumping to a label that only frees the skb. This bug has been
> detected by the Clang thread-safety analyzer.
> 
> Cc: Leo Yang <Leo-Yang@quantatw.com>
> Cc: Paolo Abeni <pabeni@redhat.com>
> Cc: Jeremy Kerr <jk@codeconstruct.com.au>
> Cc: Matt Johnston <matt@codeconstruct.com.au>
> Cc: netdev@vger.kernel.org
> Fixes: 2d2d4f60ed26 ("mctp i3c: fix MCTP I3C driver multi-thread issue")
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
>   drivers/net/mctp/mctp-i3c.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/mctp/mctp-i3c.c b/drivers/net/mctp/mctp-i3c.c
> index 4e857dd5df64..59e7bf56fce3 100644
> --- a/drivers/net/mctp/mctp-i3c.c
> +++ b/drivers/net/mctp/mctp-i3c.c
> @@ -112,7 +112,7 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi)
>   	if (!skb) {
>   		stats->rx_dropped++;
>   		rc = -ENOMEM;
> -		goto err;
> +		goto free_skb;

Why the additional churn? Just return -ENOMEM, no point in freeing a NULL skb.

/P