diff options
| author | J. Bruce Fields <bfields@redhat.com> | 2010-08-03 17:22:20 -0400 |
|---|---|---|
| committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2010-08-04 08:54:10 -0400 |
| commit | c3ae62ae08bb0db3639d8c579e4ff0967d908199 (patch) | |
| tree | 75228755a6cdd508a62597be61a04408f949975d /net/sunrpc | |
| parent | d6a1ed08c6acea647b3f2aaebe0261f079e1be49 (diff) | |
SUNRPC: prevent task_cleanup running on freed xprt
We saw a report of a NULL dereference in xprt_autoclose:
https://bugzilla.redhat.com/show_bug.cgi?id=611938
This appears to be the result of an xprt's task_cleanup running after
the xprt is destroyed. Nothing in the current code appears to prevent
that.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'net/sunrpc')
| -rw-r--r-- | net/sunrpc/xprt.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c index 70297836a191..970fb00f388c 100644 --- a/net/sunrpc/xprt.c +++ b/net/sunrpc/xprt.c | |||
| @@ -1131,6 +1131,7 @@ static void xprt_destroy(struct kref *kref) | |||
| 1131 | rpc_destroy_wait_queue(&xprt->sending); | 1131 | rpc_destroy_wait_queue(&xprt->sending); |
| 1132 | rpc_destroy_wait_queue(&xprt->resend); | 1132 | rpc_destroy_wait_queue(&xprt->resend); |
| 1133 | rpc_destroy_wait_queue(&xprt->backlog); | 1133 | rpc_destroy_wait_queue(&xprt->backlog); |
| 1134 | cancel_work_sync(&xprt->task_cleanup); | ||
| 1134 | /* | 1135 | /* |
| 1135 | * Tear down transport state and free the rpc_xprt | 1136 | * Tear down transport state and free the rpc_xprt |
| 1136 | */ | 1137 | */ |