BUG: unable to handle kernel NULL pointer dereference in rxrpc_send_data_packet

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 3ffe1e79 Linux 4.14.138
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12203bce600000
kernel config: https://syzkaller.appspot.com/x/.config?x=978e269523a888e8
dashboard link: https://syzkaller.appspot.com/bug?extid=52f0215f1f2c895cd985
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13676eee600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11b97e72600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+52f021...@syzkaller.appspotmail.com

BUG: unable to handle kernel NULL pointer dereference at 0000000000000268
IP: atomic_add_return arch/x86/include/asm/atomic.h:157 [inline]
IP: rxrpc_send_data_packet+0xc8/0x13f0 net/rxrpc/output.c:281
PGD 84745067 P4D 84745067 PUD 8b21a067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 429 Comm: kworker/0:1 Not tainted 4.14.138 #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: krxrpcd rxrpc_process_call
task: ffff8880a9196280 task.stack: ffff8880a91a0000
RIP: 0010:atomic_add_return arch/x86/include/asm/atomic.h:157 [inline]
RIP: 0010:rxrpc_send_data_packet+0xc8/0x13f0 net/rxrpc/output.c:281
RSP: 0018:ffff8880a91a7ab0 EFLAGS: 00010246
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 1ffff11015232d69
RDX: 0000000000000000 RSI: ffff888095701280 RDI: ffff888087099810
RBP: ffff8880a91a7c60 R08: 0000000000000001 R09: ffff8880a9196b48
R10: ffff8880a91a7c78 R11: 0000000000000000 R12: ffff888095701280
R13: ffff888087099918 R14: ffff888087099800 R15: ffff888095701280
FS: 0000000000000000(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000268 CR3: 000000009746d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
rxrpc_resend net/rxrpc/call_event.c:322 [inline]
rxrpc_process_call+0x56f/0x1169 net/rxrpc/call_event.c:407
process_one_work+0x863/0x1600 kernel/workqueue.c:2114
worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248
kthread+0x319/0x430 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: f3 c7 40 24 f3 f3 f3 f3 e8 66 8a c6 fb 49 8d 7e 10 48 89 f8 48 c1 e8
03 80 3c 18 00 0f 85 31 11 00 00 49 8b 5e 10 b8 01 00 00 00 <f0> 0f c1 83
68 02 00 00 83 c0 01 48 89 da 48 c1 ea 03 89 85 8c
RIP: atomic_add_return arch/x86/include/asm/atomic.h:157 [inline] RSP:
ffff8880a91a7ab0
RIP: rxrpc_send_data_packet+0xc8/0x13f0 net/rxrpc/output.c:281 RSP:
ffff8880a91a7ab0
CR2: 0000000000000268
---[ end trace e732324fe7f1e661 ]---


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches