SUNRPC: Fix a race in xs_tcp_state_change()

When scheduling the autoclose RPC call, we want to ensure that we don't
race against the test_bit() call in xprt_clear_locked().

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

2 files changed, 21 insertions, 4 deletions

diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index fb92f51405c5..a3af02168af1 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -570,6 +570,7 @@ static void xprt_autoclose(struct work_struct *work)
 
         xprt_disconnect(xprt);
         xprt->ops->close(xprt);
+        clear_bit(XPRT_CLOSE_WAIT, &xprt->state);
         xprt_release_write(xprt, NULL);
 }
 
@@ -588,6 +589,25 @@ void xprt_disconnect(struct rpc_xprt *xprt)
 }
 EXPORT_SYMBOL_GPL(xprt_disconnect);
 
+/**
+ * xprt_force_disconnect - force a transport to disconnect
+ * @xprt: transport to disconnect
+ *
+ */
+void xprt_force_disconnect(struct rpc_xprt *xprt)
+{
+        /* Don't race with the test_bit() in xprt_clear_locked() */
+        spin_lock_bh(&xprt->transport_lock);
+        set_bit(XPRT_CLOSE_WAIT, &xprt->state);
+        /* Try to schedule an autoclose RPC call */
+        if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0)
+                queue_work(rpciod_workqueue, &xprt->task_cleanup);
+        else if (xprt->snd_task != NULL)
+                rpc_wake_up_task(xprt->snd_task);
+        spin_unlock_bh(&xprt->transport_lock);
+}
+EXPORT_SYMBOL_GPL(xprt_force_disconnect);
+
 static void
 xprt_init_autodisconnect(unsigned long data)
 {
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 6fa52f44de0f..abb40c140738 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1122,10 +1122,7 @@ static void xs_tcp_state_change(struct sock *sk)
         case TCP_SYN_RECV:
                 break;
         case TCP_CLOSE_WAIT:
-                /* Try to schedule an autoclose RPC calls */
-                set_bit(XPRT_CLOSE_WAIT, &xprt->state);
-                if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0)
-                        queue_work(rpciod_workqueue, &xprt->task_cleanup);
+                xprt_force_disconnect(xprt);
         default:
                 xprt_disconnect(xprt);
         }