Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Several conflicts here.

NFP driver bug fix adding nfp_netdev_is_nfp_repr() check to
nfp_fl_output() needed some adjustments because the code block is in
an else block now.

Parallel additions to net/pkt_cls.h and net/sch_generic.h

A bug fix in __tcp_retransmit_skb() conflicted with some of
the rbtree changes in net-next.

The tc action RCU callback fixes in 'net' had some overlap with some
of the recent tcf_block reworking.

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 25 insertions, 11 deletions

diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 4b00302e1867..6160d17a31c4 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1333,7 +1333,7 @@ void xprt_release(struct rpc_task *task)
                 rpc_count_iostats(task, task->tk_client->cl_metrics);
         spin_lock(&xprt->recv_lock);
         if (!list_empty(&req->rq_list)) {
-                list_del(&req->rq_list);
+                list_del_init(&req->rq_list);
                 xprt_wait_on_pinned_rqst(req);
         }
         spin_unlock(&xprt->recv_lock);
@@ -1444,6 +1444,23 @@ out:
         return xprt;
 }
 
+static void xprt_destroy_cb(struct work_struct *work)
+{
+        struct rpc_xprt *xprt =
+                container_of(work, struct rpc_xprt, task_cleanup);
+
+        rpc_xprt_debugfs_unregister(xprt);
+        rpc_destroy_wait_queue(&xprt->binding);
+        rpc_destroy_wait_queue(&xprt->pending);
+        rpc_destroy_wait_queue(&xprt->sending);
+        rpc_destroy_wait_queue(&xprt->backlog);
+        kfree(xprt->servername);
+        /*
+         * Tear down transport state and free the rpc_xprt
+         */
+        xprt->ops->destroy(xprt);
+}
+
 /**
  * xprt_destroy - destroy an RPC transport, killing off all requests.
  * @xprt: transport to destroy
@@ -1453,22 +1470,19 @@ static void xprt_destroy(struct rpc_xprt *xprt)
 {
         dprintk("RPC:       destroying transport %p\n", xprt);
 
-        /* Exclude transport connect/disconnect handlers */
+        /*
+         * Exclude transport connect/disconnect handlers and autoclose
+         */
         wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_UNINTERRUPTIBLE);
 
         del_timer_sync(&xprt->timer);
 
-        rpc_xprt_debugfs_unregister(xprt);
-        rpc_destroy_wait_queue(&xprt->binding);
-        rpc_destroy_wait_queue(&xprt->pending);
-        rpc_destroy_wait_queue(&xprt->sending);
-        rpc_destroy_wait_queue(&xprt->backlog);
-        cancel_work_sync(&xprt->task_cleanup);
-        kfree(xprt->servername);
         /*
-         * Tear down transport state and free the rpc_xprt
+         * Destroy sockets etc from the system workqueue so they can
+         * safely flush receive work running on rpciod.
          */
-        xprt->ops->destroy(xprt);
+        INIT_WORK(&xprt->task_cleanup, xprt_destroy_cb);
+        schedule_work(&xprt->task_cleanup);
 }
 
 static void xprt_destroy_kref(struct kref *kref)