[syzbot] [net?] [afs?] kernel BUG in rxrpc_destroy_all_connections (2)

[Jose A. Perez de Azpillaga]

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git a7bfaba4823e

diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 865f05fe37ab..2ecfd58cd566 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -1205,2 +1205,3 @@ void rxrpc_disconnect_call(struct rxrpc_call *);
 void rxrpc_kill_client_conn(struct rxrpc_connection *);
+void rxrpc_discard_unactivated_client_conn(struct rxrpc_connection *);
 void rxrpc_queue_conn(struct rxrpc_connection *, enum rxrpc_conn_trace);
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index 48519f0de185..8ccf69cc973f 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -697,2 +697,13 @@ static void rxrpc_unbundle_conn(struct rxrpc_connection *conn)

+void rxrpc_discard_unactivated_client_conn(struct rxrpc_connection *conn)
+{
+	if (!rxrpc_conn_is_client(conn) || !conn->bundle)
+		return;
+	if (conn->act_chans || !list_empty(&conn->cache_link))
+		return;
+
+	_debug("C=%x never activated", conn->debug_id);
+	rxrpc_unbundle_conn(conn);
+}
+
 /*
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 611c790bc6d0..a30cbaa8a48b 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -40,2 +40,5 @@ static bool rxrpc_set_conn_aborted(struct rxrpc_connection *conn,
 		spin_unlock_irq(&conn->state_lock);
+
+		if (aborted)
+			rxrpc_discard_unactivated_client_conn(conn);
 	}
@@ -274,4 +277,10 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,

-	if (conn->state == RXRPC_CONN_ABORTED)
+	if (conn->state == RXRPC_CONN_ABORTED) {
+		if (sp->hdr.type == RXRPC_PACKET_TYPE_CHALLENGE &&
+		    sp->chall.conn) {
+			rxrpc_put_connection(conn, rxrpc_conn_put_challenge_input);
+			sp->chall.conn = NULL;
+		}
 		return -ECONNABORTED;
+	}

diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
index 0ece717db0f8..6d453b9a9457 100644
--- a/net/rxrpc/conn_object.c
+++ b/net/rxrpc/conn_object.c
@@ -251,2 +251,3 @@ struct rxrpc_connection *rxrpc_get_connection(struct rxrpc_connection *conn,
 	__refcount_inc(&conn->ref, &r);
+	pr_err("AF_RXRPC: conn %x GET why=%d r=%d\n", conn->debug_id, why, r + 1);
 	trace_rxrpc_conn(conn->debug_id, r + 1, why);
@@ -367,2 +368,3 @@ void rxrpc_put_connection(struct rxrpc_connection *conn,
 	dead = __refcount_dec_and_test(&conn->ref, &r);
+	pr_err("AF_RXRPC: conn %x PUT why=%d r=%d dead=%d\n", debug_id, why, r - 1, dead);
 	trace_rxrpc_conn(debug_id, r - 1, why);
@@ -487,2 +489,18 @@ void rxrpc_destroy_all_connections(struct rxrpc_net *rxnet)

+	if (!list_empty(&rxnet->conn_proc_list)) {
+		struct rxrpc_connection *c;
+
+		pr_err("AF_RXRPC: conn_proc_list not empty\n");
+		write_lock(&rxnet->conn_lock);
+		list_for_each_entry(c, &rxnet->conn_proc_list, proc_link)
+			pr_err("AF_RXRPC: proc conn %x cid %x state %d ref %d act %d flags %lx cache_empty %d calls %px %px %px %px bundle %px\n",
+			       c->debug_id, c->proto.cid, c->state,
+			       refcount_read(&c->ref), c->act_chans, c->flags,
+			       list_empty(&c->cache_link),
+			       c->channels[0].call, c->channels[1].call,
+			       c->channels[2].call, c->channels[3].call,
+			       c->bundle);
+		write_unlock(&rxnet->conn_lock);
+	}
+
 	ASSERT(list_empty(&rxnet->conn_proc_list));