rx: Do not try to cancel nonexistent events

Unconditionally cancelling the resend event and releasing the
reference it was supposed to have on the call, can cause the
call reference count to go negative.

In particular, the call chain when a new rx_call structure is
allocated would cause its reference count to become negative.

Behave similarly to all the other rxevent_Cancel calls touched
by 20034a815750beff262d49b37fba225c72dd0ab1, and only cancel the
event and drop a reference when the event is present on the call.

Change-Id: Icf2dd58c2545814ac17bb960077621c6d3209da0
Reviewed-on: http://gerrit.openafs.org/11201
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: D Brashear <shadow@your-file-system.com>

diff --git a/src/rx/rx.c b/src/rx/rx.c
index 0b8cc48bac5bfd3cac068d8edf299de364c3f71d..68b7b02ca1d49b6afde051ebfdb2865a8f886c71 100644 (file)
--- a/src/rx/rx.c
+++ b/src/rx/rx.c
@@ -710,8 +710,10 @@ rxi_rto_startTimer(struct rx_call *call, int lastPacket, int istack)
 static_inline void
 rxi_rto_cancel(struct rx_call *call)
 {
-    rxevent_Cancel(&call->resendEvent);
-    CALL_RELE(call, RX_CALL_REFCOUNT_RESEND);
+    if (call->resendEvent != NULL) {
+       rxevent_Cancel(&call->resendEvent);
+       CALL_RELE(call, RX_CALL_REFCOUNT_RESEND);
+    }
 }
 
 /*!