rxrpc: Fix uninitialised variable in rxrpc_send_data()

Fix the uninitialised txb variable in rxrpc_send_data() by moving the code
that loads it above all the jumps to maybe_error, txb being stored back
into call->tx_pending right before the normal return.

Fixes: b0f571ecd794 ("rxrpc: Fix locking in rxrpc's sendmsg")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lists.infradead.org/pipermail/linux-afs/2024-October/008896.html
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Link: https://patch.msgid.link/20241001132702.3122709-3-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 894b8fa68e5e9546ad2dd17372420976d7eb76c0..23d18fe5de9f0d356c936b4ed80b24c18ddfeeb9 100644 (file)
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -303,6 +303,11 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
        sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 
 reload:
+       txb = call->tx_pending;
+       call->tx_pending = NULL;
+       if (txb)
+               rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more);
+
        ret = -EPIPE;
        if (sk->sk_shutdown & SEND_SHUTDOWN)
                goto maybe_error;
@@ -329,11 +334,6 @@ reload:
                        goto maybe_error;
        }
 
-       txb = call->tx_pending;
-       call->tx_pending = NULL;
-       if (txb)
-               rxrpc_see_txbuf(txb, rxrpc_txbuf_see_send_more);
-
        do {
                if (!txb) {
                        size_t remain;