nfsd4: fix 4.1 connection registration race

If a connection is closed just after a sequence or create_session
is sent over it, we could end up trying to register a callback that will
never get called since the xprt is already marked dead.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>

1 files changed, 14 insertions, 4 deletions

diff --git a/include/linux/sunrpc/svc_xprt.h b/include/linux/sunrpc/svc_xprt.h
index bbdb680ffbe9..aea0d438e3c7 100644
--- a/include/linux/sunrpc/svc_xprt.h
+++ b/include/linux/sunrpc/svc_xprt.h
@@ -82,18 +82,28 @@ struct svc_xprt {
         struct net              *xpt_net;
 };
 
-static inline void register_xpt_user(struct svc_xprt *xpt, struct svc_xpt_user *u)
+static inline void unregister_xpt_user(struct svc_xprt *xpt, struct svc_xpt_user *u)
 {
         spin_lock(&xpt->xpt_lock);
-        list_add(&u->list, &xpt->xpt_users);
+        list_del_init(&u->list);
         spin_unlock(&xpt->xpt_lock);
 }
 
-static inline void unregister_xpt_user(struct svc_xprt *xpt, struct svc_xpt_user *u)
+static inline int register_xpt_user(struct svc_xprt *xpt, struct svc_xpt_user *u)
 {
         spin_lock(&xpt->xpt_lock);
-        list_del_init(&u->list);
+        if (test_bit(XPT_CLOSE, &xpt->xpt_flags)) {
+                /*
+                 * The connection is about to be deleted soon (or,
+                 * worse, may already be deleted--in which case we've
+                 * already notified the xpt_users).
+                 */
+                spin_unlock(&xpt->xpt_lock);
+                return -ENOTCONN;
+        }
+        list_add(&u->list, &xpt->xpt_users);
         spin_unlock(&xpt->xpt_lock);
+        return 0;
 }
 
 int     svc_reg_xprt_class(struct svc_xprt_class *);