summaryrefslogtreecommitdiff
path: root/net/sunrpc
diff options
context:
space:
mode:
authorJ. Bruce Fields <bfields@redhat.com>2010-08-03 17:22:20 -0400
committerTrond Myklebust <Trond.Myklebust@netapp.com>2010-08-04 08:54:10 -0400
commitc3ae62ae08bb0db3639d8c579e4ff0967d908199 (patch)
tree75228755a6cdd508a62597be61a04408f949975d /net/sunrpc
parentd6a1ed08c6acea647b3f2aaebe0261f079e1be49 (diff)
SUNRPC: prevent task_cleanup running on freed xprt
We saw a report of a NULL dereference in xprt_autoclose: https://bugzilla.redhat.com/show_bug.cgi?id=611938 This appears to be the result of an xprt's task_cleanup running after the xprt is destroyed. Nothing in the current code appears to prevent that. Signed-off-by: J. Bruce Fields <bfields@redhat.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'net/sunrpc')
-rw-r--r--net/sunrpc/xprt.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 70297836a191..970fb00f388c 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1131,6 +1131,7 @@ static void xprt_destroy(struct kref *kref)
rpc_destroy_wait_queue(&xprt->sending);
rpc_destroy_wait_queue(&xprt->resend);
rpc_destroy_wait_queue(&xprt->backlog);
+ cancel_work_sync(&xprt->task_cleanup);
/*
* Tear down transport state and free the rpc_xprt
*/