From 370a0d6c462ba3b622ed79eee2c5b1b5cd3c8d92 Mon Sep 17 00:00:00 2001
From: Stuart Ray <88628337+Stuartwastaken@users.noreply.github.com>
Date: Wed, 28 Oct 2026 21:28:30 +0000
Subject: [PATCH] Unlink the RPC from waiting_for_bufs in homa_rpc_alloc_server
 errors

* When the pool is full, homa_pool_alloc_msg queues the new RPC on
  waiting_for_bufs and returns 0. If the socket is then found to be
  shut down, the error path freed the RPC while it was still on the
  list.
---
 homa_rpc.c           |  1 +
 test/unit_homa_rpc.c | 15 +++++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/homa_rpc.c b/homa_rpc.c
index 7804577e..04af7ad6 100644
--- a/homa_rpc.c
+++ b/homa_rpc.c
@@ -213,6 +213,7 @@ struct homa_rpc *homa_rpc_alloc_server(struct homa_sock *hsk,
 
 error:
 	if (srpc) {
+		homa_pool_unlink(srpc);
 		homa_pool_release(srpc);
 		if (srpc->route)
 			homa_route_release(srpc->route);
diff --git a/test/unit_homa_rpc.c b/test/unit_homa_rpc.c
index 06d55123..9d1260bd 100644
--- a/test/unit_homa_rpc.c
+++ b/test/unit_homa_rpc.c
@@ -261,6 +261,21 @@ TEST_F(homa_rpc, homa_rpc_alloc_server__socket_shutdown)
 	EXPECT_EQ(0, unit_list_length(&self->hsk.active_rpcs));
 	self->hsk.shutdown = 0;
 }
+TEST_F(homa_rpc, homa_rpc_alloc_server__socket_shutdown_while_waiting_for_bufs)
+{
+	struct homa_rpc *srpc;
+
+	mock_check_bpool_leaks = false;
+	self->data.msg_length = N(1400);
+	atomic_set(&self->hsk.buffer_pool->free_bpages, 0);
+	self->hsk.shutdown = 1;
+	srpc = homa_rpc_alloc_server(&self->hsk, self->client_ip,
+				     &self->data.common);
+	EXPECT_TRUE(IS_ERR(srpc));
+	EXPECT_EQ(ESHUTDOWN, -PTR_ERR(srpc));
+	EXPECT_EQ(0, unit_list_length(&self->hsk.buffer_pool->waiting_for_bufs));
+	self->hsk.shutdown = 0;
+}
 TEST_F(homa_rpc, homa_rpc_alloc_server__handoff_rpc)
 {
 	struct homa_rpc *srpc;