diff options
| author | J. Bruce Fields <bfields@redhat.com> | 2010-08-03 17:22:20 -0400 |
|---|---|---|
| committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2010-08-04 08:54:10 -0400 |
| commit | c3ae62ae08bb0db3639d8c579e4ff0967d908199 (patch) | |
| tree | 75228755a6cdd508a62597be61a04408f949975d /net/sunrpc | |
| parent | d6a1ed08c6acea647b3f2aaebe0261f079e1be49 (diff) | |
| download | lwn-c3ae62ae08bb0db3639d8c579e4ff0967d908199.tar.gz lwn-c3ae62ae08bb0db3639d8c579e4ff0967d908199.zip | |
SUNRPC: prevent task_cleanup running on freed xprt
We saw a report of a NULL dereference in xprt_autoclose:
https://bugzilla.redhat.com/show_bug.cgi?id=611938
This appears to be the result of an xprt's task_cleanup running after
the xprt is destroyed. Nothing in the current code appears to prevent
that.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'net/sunrpc')
| -rw-r--r-- | net/sunrpc/xprt.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c index 70297836a191..970fb00f388c 100644 --- a/net/sunrpc/xprt.c +++ b/net/sunrpc/xprt.c @@ -1131,6 +1131,7 @@ static void xprt_destroy(struct kref *kref) rpc_destroy_wait_queue(&xprt->sending); rpc_destroy_wait_queue(&xprt->resend); rpc_destroy_wait_queue(&xprt->backlog); + cancel_work_sync(&xprt->task_cleanup); /* * Tear down transport state and free the rpc_xprt */ |