diff options
| author | David Howells <dhowells@redhat.com> | 2009-02-06 21:50:52 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-02-06 21:50:52 -0800 |
| commit | 15bde72738f373aa060ececeda8e064e4f924360 (patch) | |
| tree | 9f13defd4cbdfff49b1e39a0ac43b9df4c4581de | |
| parent | 355423d0849f4506bc71ab2738d38cb74429aaef (diff) | |
| download | linux-15bde72738f373aa060ececeda8e064e4f924360.tar.gz linux-15bde72738f373aa060ececeda8e064e4f924360.tar.bz2 linux-15bde72738f373aa060ececeda8e064e4f924360.zip | |
RxRPC: Fix a potential NULL dereference
Fix a potential NULL dereference bug during error handling in
rxrpc_kernel_begin_call(), whereby rxrpc_put_transport() may be handed a NULL
pointer.
This was found with a code checker (http://repo.or.cz/w/smatch.git/).
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/rxrpc/af_rxrpc.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c index d7d2bed7a699..eac5e7bb7365 100644 --- a/net/rxrpc/af_rxrpc.c +++ b/net/rxrpc/af_rxrpc.c @@ -284,13 +284,13 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock, if (IS_ERR(trans)) { call = ERR_CAST(trans); trans = NULL; - goto out; + goto out_notrans; } } else { trans = rx->trans; if (!trans) { call = ERR_PTR(-ENOTCONN); - goto out; + goto out_notrans; } atomic_inc(&trans->usage); } @@ -315,6 +315,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock, rxrpc_put_bundle(trans, bundle); out: rxrpc_put_transport(trans); +out_notrans: release_sock(&rx->sk); _leave(" = %p", call); return call; |