rxrpc: Fix handling of connection failure in client call creation

If rxrpc_connect_call() fails during the creation of a client connection,
there are two bugs that we can hit that need fixing:

 (1) The call state should be moved to RXRPC_CALL_DEAD before the call
     cleanup phase is invoked.  If not, this can cause an assertion failure
     later.

 (2) call->link should be reinitialised after being deleted in
     rxrpc_new_client_call() - which otherwise leads to a failure later
     when the call cleanup attempts to delete the link again.

Signed-off-by: David Howells <dhowells@redhat.com>

diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index ad933daae13b90b469f74cfe56a2af01f9cb76d8..6223a7ed831f9a19f4d30492c6c02a7675975813 100644 (file)
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -425,9 +425,10 @@ error:
        rxrpc_put_call(call);
 
        write_lock_bh(&rxrpc_call_lock);
-       list_del(&call->link);
+       list_del_init(&call->link);
        write_unlock_bh(&rxrpc_call_lock);
 
+       call->state = RXRPC_CALL_DEAD;
        rxrpc_put_call(call);
        _leave(" = %d", ret);
        return ERR_PTR(ret);
@@ -439,6 +440,7 @@ error:
         */
 found_user_ID_now_present:
        write_unlock(&rx->call_lock);
+       call->state = RXRPC_CALL_DEAD;
        rxrpc_put_call(call);
        _leave(" = -EEXIST [%p]", call);
        return ERR_PTR(-EEXIST);