x25: Fix broken locking in ioctl error paths.

[ Upstream commit 4ccb93ce7439b63c31bc7597bfffd13567fa483d ]

Two of the x25 ioctl cases have error paths that break out of the function without
unlocking the socket, leading to this warning:

================================================
[ BUG: lock held when returning to user space! ]
3.10.0-rc7+ #36 Not tainted
------------------------------------------------
trinity-child2/31407 is leaving the kernel with locks still held!
1 lock held by trinity-child2/31407:
 #0:  (sk_lock-AF_X25){+.+.+.}, at: [<ffffffffa024b6da>] x25_ioctl+0x8a/0x740 [x25]

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index fb37356e41ec0e80dcdeb7aabdcd6ed92d0a26bc..5867429990fcde118192865ff3113ecd394dd061 100644 (file)
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1584,11 +1584,11 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                case SIOCX25CALLACCPTAPPRV: {
                        rc = -EINVAL;
                        lock_sock(sk);
-                       if (sk->sk_state != TCP_CLOSE)
-                               break;
-                       clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
+                       if (sk->sk_state == TCP_CLOSE) {
+                               clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
+                               rc = 0;
+                       }
                        release_sock(sk);
-                       rc = 0;
                        break;
                }
 
@@ -1596,14 +1596,15 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                        rc = -EINVAL;
                        lock_sock(sk);
                        if (sk->sk_state != TCP_ESTABLISHED)
-                               break;
+                               goto out_sendcallaccpt_release;
                        /* must call accptapprv above */
                        if (test_bit(X25_ACCPT_APPRV_FLAG, &x25->flags))
-                               break;
+                               goto out_sendcallaccpt_release;
                        x25_write_internal(sk, X25_CALL_ACCEPTED);
                        x25->state = X25_STATE_3;
-                       release_sock(sk);
                        rc = 0;
+out_sendcallaccpt_release:
+                       release_sock(sk);
                        break;
                }