RxRPC: Fix a potential NULL dereference

Fix a potential NULL dereference bug during error handling in
rxrpc_kernel_begin_call(), whereby rxrpc_put_transport() may be handed a NULL
pointer.

This was found with a code checker (http://repo.or.cz/w/smatch.git/).

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index d7d2bed7a6995691eaedb13055f732d1efaa3ac6..eac5e7bb73659c3b951bd7fc9f564e7d380e4d9b 100644 (file)
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -284,13 +284,13 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
                if (IS_ERR(trans)) {
                        call = ERR_CAST(trans);
                        trans = NULL;
-                       goto out;
+                       goto out_notrans;
                }
        } else {
                trans = rx->trans;
                if (!trans) {
                        call = ERR_PTR(-ENOTCONN);
-                       goto out;
+                       goto out_notrans;
                }
                atomic_inc(&trans->usage);
        }
@@ -315,6 +315,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
        rxrpc_put_bundle(trans, bundle);
 out:
        rxrpc_put_transport(trans);
+out_notrans:
        release_sock(&rx->sk);
        _leave(" = %p", call);
        return call;