SUNRPC: The TCP back channel mustn't disappear while requests are outstanding

If there are TCP back channel requests being processed by the
server threads, then we should hold a reference to the transport
to ensure it doesn't get freed from underneath us.

Reported-by: Neil Brown <neilb@suse.de>
Fixes: 2ea24497a1b3 ("SUNRPC: RPC callbacks may be split across several..")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

1 files changed, 3 insertions, 2 deletions

diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 339e8c077c2d..7eb251372f94 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -307,8 +307,8 @@ void xprt_free_bc_rqst(struct rpc_rqst *req)
                  */
                 dprintk("RPC:       Last session removed req=%p\n", req);
                 xprt_free_allocation(req);
-                return;
         }
+        xprt_put(xprt);
 }
 
 /*
@@ -339,7 +339,7 @@ found:
                 spin_unlock(&xprt->bc_pa_lock);
                 if (new) {
                         if (req != new)
-                                xprt_free_bc_rqst(new);
+                                xprt_free_allocation(new);
                         break;
                 } else if (req)
                         break;
@@ -368,6 +368,7 @@ void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
         set_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
 
         dprintk("RPC:       add callback request to list\n");
+        xprt_get(xprt);
         spin_lock(&bc_serv->sv_cb_lock);
         list_add(&req->rq_bc_list, &bc_serv->sv_cb_list);
         wake_up(&bc_serv->sv_cb_waitq);