[PATCH] NFS: Fix Oops in rpc_call_sync()

Fix the Oops in http://bugzilla.linux-nfs.org/show_bug.cgi?id=138
We shouldn't be calling rpc_release_task() for tasks that are not active.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2 files changed, 5 insertions, 6 deletions

diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index aba528b9ae76..16c9fbc1db69 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -490,16 +490,14 @@ int rpc_call_sync(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 
         /* Set up the call info struct and execute the task */
         status = task->tk_status;
-        if (status != 0) {
-                rpc_release_task(task);
+        if (status != 0)
                 goto out;
-        }
         atomic_inc(&task->tk_count);
         status = rpc_execute(task);
         if (status == 0)
                 status = task->tk_status;
-        rpc_put_task(task);
 out:
+        rpc_put_task(task);
         rpc_restore_sigmask(&oldset);
         return status;
 }
@@ -537,7 +535,7 @@ rpc_call_async(struct rpc_clnt *clnt, struct rpc_message *msg, int flags,
         if (status == 0)
                 rpc_execute(task);
         else
-                rpc_release_task(task);
+                rpc_put_task(task);
 
         rpc_restore_sigmask(&oldset);           
         return status;
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 79bc4cdf5d48..fc083f0b3544 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -42,6 +42,7 @@ static mempool_t	*rpc_buffer_mempool __read_mostly;
 static void                     __rpc_default_timer(struct rpc_task *task);
 static void                     rpciod_killall(void);
 static void                     rpc_async_schedule(struct work_struct *);
+static void                      rpc_release_task(struct rpc_task *task);
 
 /*
  * RPC tasks sit here while waiting for conditions to improve.
@@ -896,7 +897,7 @@ void rpc_put_task(struct rpc_task *task)
 }
 EXPORT_SYMBOL(rpc_put_task);
 
-void rpc_release_task(struct rpc_task *task)
+static void rpc_release_task(struct rpc_task *task)
 {
 #ifdef RPC_DEBUG
         BUG_ON(task->tk_magic != RPC_TASK_MAGIC_ID);