From: Benjamin Kaduk <kaduk@mit.edu>
Date: Thu, 5 Jun 2014 00:41:57 +0000 (-0400)
Subject: rx: Do not try to cancel nonexistent events
X-Git-Tag: upstream/1.8.0_pre1^2~656
X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=4bf942f5c38fd711136e1a2010cb0b2ea4612901;p=packages%2Fo%2Fopenafs.git

rx: Do not try to cancel nonexistent events

Unconditionally cancelling the resend event and releasing the
reference it was supposed to have on the call, can cause the
call reference count to go negative.

In particular, the call chain when a new rx_call structure is
allocated would cause its reference count to become negative.

Behave similarly to all the other rxevent_Cancel calls touched
by 20034a815750beff262d49b37fba225c72dd0ab1, and only cancel the
event and drop a reference when the event is present on the call.

Change-Id: Icf2dd58c2545814ac17bb960077621c6d3209da0
Reviewed-on: http://gerrit.openafs.org/11201
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: D Brashear <shadow@your-file-system.com>
---

diff --git a/src/rx/rx.c b/src/rx/rx.c
index 0b8cc48ba..68b7b02ca 100644
--- a/src/rx/rx.c
+++ b/src/rx/rx.c
@@ -710,8 +710,10 @@ rxi_rto_startTimer(struct rx_call *call, int lastPacket, int istack)
 static_inline void
 rxi_rto_cancel(struct rx_call *call)
 {
-    rxevent_Cancel(&call->resendEvent);
-    CALL_RELE(call, RX_CALL_REFCOUNT_RESEND);
+    if (call->resendEvent != NULL) {
+	rxevent_Cancel(&call->resendEvent);
+	CALL_RELE(call, RX_CALL_REFCOUNT_RESEND);
+    }
 }
 
 /*!