Patch "rxrpc: Fix missing unlock in rxrpc_do_sendmsg()" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    rxrpc: Fix missing unlock in rxrpc_do_sendmsg()

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-fix-missing-unlock-in-rxrpc_do_sendmsg.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 89c27ef0928d94fe3be2ede71ccc9fe6ce468f55
Author: David Howells <dhowells@xxxxxxxxxx>
Date:   Thu Dec 15 16:19:47 2022 +0000

    rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
    
    [ Upstream commit 4feb2c44629e6f9b459b41a5a60491069d346a95 ]
    
    One of the error paths in rxrpc_do_sendmsg() doesn't unlock the call mutex
    before returning.  Fix it to do this.
    
    Note that this still doesn't get rid of the checker warning:
    
       ../net/rxrpc/sendmsg.c:617:5: warning: context imbalance in 'rxrpc_do_sendmsg' - wrong count at exit
    
    I think the interplay between the socket lock and the call's user_mutex may
    be too complicated for checker to analyse, especially as
    rxrpc_new_client_call_for_sendmsg(), which it calls, returns with the
    call's user_mutex if successful but unconditionally drops the socket lock.
    
    Fixes: e754eba685aa ("rxrpc: Provide a cmsg to specify the amount of Tx data for a call")
    Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
    cc: Marc Dionne <marc.dionne@xxxxxxxxxxxx>
    cc: linux-afs@xxxxxxxxxxxxxxxxxxx
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index eef3c14fd1c1..a670553159ab 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -733,7 +733,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
 			if (call->tx_total_len != -1 ||
 			    call->tx_pending ||
 			    call->tx_top != 0)
-				goto error_put;
+				goto out_put_unlock;
 			call->tx_total_len = p.call.tx_total_len;
 		}
 	}