From 750eb5ab457e62e221a9c8521e2274f14c85b387 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Thu, 29 Oct 2026 11:00:39 -0700 Subject: [PATCH] mctp i3c: Fix locking in an error path If netdev_alloc_skb() fails, mctp_i3c_read() jumps to a label that unlocks mi->lock although that mutex has not been locked yet. Fix this by returning -ENOMEM directly. This bug has been detected by the Clang thread-safety analyzer. Cc: Leo Yang Cc: Paolo Abeni Cc: Jeremy Kerr Cc: Matt Johnston Cc: netdev@vger.kernel.org Fixes: 2d2d4f60ed26 ("mctp i3c: fix MCTP I3C driver multi-thread issue") Signed-off-by: Bart Van Assche Acked-by: Matt Johnston Link: https://patch.msgid.link/71e0a880ffe7a83237e501b07884bf54343e76ca.1793296780.git.bvanassche@acm.org Signed-off-by: Paolo Abeni --- drivers/net/mctp/mctp-i3c.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/mctp/mctp-i3c.c b/drivers/net/mctp/mctp-i3c.c index 4e857dd5df64..5f225999d715 100644 --- a/drivers/net/mctp/mctp-i3c.c +++ b/drivers/net/mctp/mctp-i3c.c @@ -111,8 +111,7 @@ static int mctp_i3c_read(struct mctp_i3c_device *mi) mi->mrl + sizeof(struct mctp_i3c_internal_hdr)); if (!skb) { stats->rx_dropped++; - rc = -ENOMEM; - goto err; + return -ENOMEM; } skb->protocol = htons(ETH_P_MCTP);