2023-01-11 18:30:03

by David Howells

Subject: [PATCH net] rxrpc: Fix wrong error return in rxrpc_connect_call()

Fix rxrpc_connect_call() to return -ENOMEM rather than 0 if it fails to
look up a peer.

This generated a smatch warning:
net/rxrpc/call_object.c:303 rxrpc_connect_call() warn: missing error code 'ret'

I think this also fixes a syzbot-found bug:

rxrpc: Assertion failed - 1(0x1) == 11(0xb) is false
------------[ cut here ]------------
kernel BUG at net/rxrpc/call_object.c:645!

where the call being put is in the wrong state - as would be the case if we
failed to clear up correctly after the error in rxrpc_connect_call().

Fixes: 9d35d880e0e4 ("rxrpc: Move client call connection to the I/O thread")
Reported-by: kernel test robot <[email protected]>
Reported-by: Dan Carpenter <[email protected]>
Reported-and-tested-by: [email protected]
Signed-off-by: David Howells <[email protected]>
Link: https://lore.kernel.org/r/[email protected]/
---
net/rxrpc/call_object.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index 3ded5a24627c..f3c9f0201c15 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -294,7 +294,7 @@ static void rxrpc_put_call_slot(struct rxrpc_call *call)
static int rxrpc_connect_call(struct rxrpc_call *call, gfp_t gfp)
{
struct rxrpc_local *local = call->local;
- int ret = 0;
+ int ret = -ENOMEM;

_enter("{%d,%lx},", call->debug_id, call->user_call_ID);

2023-01-12 18:59:13

by Alexander Duyck

Subject: Re: [PATCH net] rxrpc: Fix wrong error return in rxrpc_connect_call()

On Wed, 2023-01-11 at 18:07 +0000, David Howells wrote:
>
> Fix rxrpc_connect_call() to return -ENOMEM rather than 0 if it fails to
> look up a peer.
>
> This generated a smatch warning:
> net/rxrpc/call_object.c:303 rxrpc_connect_call() warn: missing error code 'ret'
>
> I think this also fixes a syzbot-found bug:
>
> rxrpc: Assertion failed - 1(0x1) == 11(0xb) is false
> ------------[ cut here ]------------
> kernel BUG at net/rxrpc/call_object.c:645!
>
> where the call being put is in the wrong state - as would be the case if we
> failed to clear up correctly after the error in rxrpc_connect_call().
>
> Fixes: 9d35d880e0e4 ("rxrpc: Move client call connection to the I/O thread")
> Reported-by: kernel test robot <[email protected]>
> Reported-by: Dan Carpenter <[email protected]>
> Reported-and-tested-by: [email protected]
> Signed-off-by: David Howells <[email protected]>
> Link: https://lore.kernel.org/r/[email protected]/
> ---
> net/rxrpc/call_object.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
> index 3ded5a24627c..f3c9f0201c15 100644
> --- a/net/rxrpc/call_object.c
> +++ b/net/rxrpc/call_object.c
> @@ -294,7 +294,7 @@ static void rxrpc_put_call_slot(struct rxrpc_call *call)
> static int rxrpc_connect_call(struct rxrpc_call *call, gfp_t gfp)
> {
> struct rxrpc_local *local = call->local;
> - int ret = 0;
> + int ret = -ENOMEM;
>
> _enter("{%d,%lx},", call->debug_id, call->user_call_ID);
>

Looks good to me.

Reviewed-by: Alexander Duyck <[email protected]>

2023-01-13 20:32:41

by Jakub Kicinski

Subject: Re: [PATCH net] rxrpc: Fix wrong error return in rxrpc_connect_call()

On Wed, 11 Jan 2023 18:07:15 +0000 David Howells wrote:
> Fix rxrpc_connect_call() to return -ENOMEM rather than 0 if it fails to
> look up a peer.
>
> This generated a smatch warning:
> net/rxrpc/call_object.c:303 rxrpc_connect_call() warn: missing error code 'ret'
>
> I think this also fixes a syzbot-found bug:
>
> rxrpc: Assertion failed - 1(0x1) == 11(0xb) is false
> ------------[ cut here ]------------
> kernel BUG at net/rxrpc/call_object.c:645!
>
> where the call being put is in the wrong state - as would be the case if we
> failed to clear up correctly after the error in rxrpc_connect_call().

Applied, thanks!