RxRPC: do not unlock unheld spinlock in rxrpc_connect_exclusive()

If rx->conn is not NULL, rxrpc_connect_exclusive() does not
acquire the transport's client lock, but it still releases it.

The patch adds locking of the spinlock to this path.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: David Howells <dhowells@redhat.com>

diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
index 4106ca95ec86f43b8c235dd5d94e9fc016ea06f5..7bf5b5b9e8b9400af1cbaecaeaf9a8c222670492 100644 (file)
--- a/net/rxrpc/ar-connection.c
+++ b/net/rxrpc/ar-connection.c
@@ -381,6 +381,8 @@ static int rxrpc_connect_exclusive(struct rxrpc_sock *rx,
 
                rxrpc_assign_connection_id(conn);
                rx->conn = conn;
+       } else {
+               spin_lock(&trans->client_lock);
        }
 
        /* we've got a connection with a free channel and we can now attach the