[PATCH] rxrpc: Fix oops due to abort delegated to rxrpc_input_call_event()

[David Howells]

When sendmsg or recvmsg delegate an abort to the I/O thread, this is
processed by rxrpc_input_call_event().  But this may get called before the
call is connected, in which case call->conn might be NULL still.  This can
cause an oops, whereby we go on from aborting the call to trying to emit
ACKs and the attempt to allocate a txbuf for the ACK goes splat:

    BUG: kernel NULL pointer dereference, address: 0000000000000000
    ...
    RIP: 0010:rxrpc_alloc_txbuf+0xc0/0x157
    ...
    Call Trace:
     rxrpc_send_ACK+0x50/0x13b
     rxrpc_input_call_event+0x1bc/0x68b
     rxrpc_io_thread+0x1b6/0x45f
     kthread+0xe7/0xef
     ret_from_fork+0x22/0x30

Fix this by going to the cleanup in rxrpc_input_call_event() and skipping
the ACK generation stuff, etc. if we complete the delegation of an ABORT
packet.

Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: linux-afs at lists.infradead.org
---

 net/rxrpc/call_event.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index 148bb7fc0415..ce3cad298449 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -395,9 +395,11 @@ bool rxrpc_input_call_event(struct rxrpc_call *call, struct sk_buff *skb)
 	}
 
 	abort_code = smp_load_acquire(&call->send_abort);
-	if (abort_code)
+	if (abort_code) {
 		rxrpc_abort_call(call, 0, call->send_abort, call->send_abort_err,
 				 call->send_abort_why);
+		goto out;
+	}
 
 	if (skb && skb->mark == RXRPC_SKB_MARK_ERROR)
 		goto out;