From: J. Bruce Fields Date: Tue, 3 Aug 2010 21:22:20 +0000 (-0400) Subject: SUNRPC: prevent task_cleanup running on freed xprt X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=c3ae62ae08bb0db3639d8c579e4ff0967d908199;p=openwrt%2Fstaging%2Fblogic.git SUNRPC: prevent task_cleanup running on freed xprt We saw a report of a NULL dereference in xprt_autoclose: https://bugzilla.redhat.com/show_bug.cgi?id=611938 This appears to be the result of an xprt's task_cleanup running after the xprt is destroyed. Nothing in the current code appears to prevent that. Signed-off-by: J. Bruce Fields Signed-off-by: Trond Myklebust --- diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c index 70297836a191..970fb00f388c 100644 --- a/net/sunrpc/xprt.c +++ b/net/sunrpc/xprt.c @@ -1131,6 +1131,7 @@ static void xprt_destroy(struct kref *kref) rpc_destroy_wait_queue(&xprt->sending); rpc_destroy_wait_queue(&xprt->resend); rpc_destroy_wait_queue(&xprt->backlog); + cancel_work_sync(&xprt->task_cleanup); /* * Tear down transport state and free the rpc_xprt */