2 files changed, 10 insertions, 5 deletions

diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 4c6f9d0a00e7..c2c35cf4e308 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -1161,19 +1161,19 @@ int rxrpc_extract_header(struct rxrpc_skb_priv *sp, struct sk_buff *skb)
  * handle data received on the local endpoint
  * - may be called in interrupt context
  *
- * The socket is locked by the caller and this prevents the socket from being
- * shut down and the local endpoint from going away, thus sk_user_data will not
- * be cleared until this function returns.
+ * [!] Note that as this is called from the encap_rcv hook, the socket is not
+ * held locked by the caller and nothing prevents sk_user_data on the UDP from
+ * being cleared in the middle of processing this function.
  *
  * Called with the RCU read lock held from the IP layer via UDP.
  */
 int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
 {
+        struct rxrpc_local *local = rcu_dereference_sk_user_data(udp_sk);
         struct rxrpc_connection *conn;
         struct rxrpc_channel *chan;
         struct rxrpc_call *call = NULL;
         struct rxrpc_skb_priv *sp;
-        struct rxrpc_local *local = udp_sk->sk_user_data;
         struct rxrpc_peer *peer = NULL;
         struct rxrpc_sock *rx = NULL;
         unsigned int channel;
@@ -1181,6 +1181,10 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
 
         _enter("%p", udp_sk);
 
+        if (unlikely(!local)) {
+                kfree_skb(skb);
+                return 0;
+        }
         if (skb->tstamp == 0)
                 skb->tstamp = ktime_get_real();
 
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index 15cf42d5b53a..01959db51445 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -304,7 +304,8 @@ nomem:
         ret = -ENOMEM;
 sock_error:
         mutex_unlock(&rxnet->local_mutex);
-        kfree(local);
+        if (local)
+                call_rcu(&local->rcu, rxrpc_local_rcu);
         _leave(" = %d", ret);
         return ERR_PTR(ret);