From: NeilBrown <neilb@suse.de>
Subject: NFSv4.1 - backchannel request should hold ref on xprt
References: bsc#1152624
Patch-mainline: Not yet, maintainer has different version queued
It is possible for an xprt to be freed while there are still
pending back-channel replies waiting to go out. This causes
problems.
As the rpc_rqst already has a pointer to the xprt, it is easy
to change that to a counted reference, so the xprt cannot go away
while the rpc_rqst exists.
Signed-off-by: NeilBrown <neilb@suse.de>
Acked-by: NeilBrown <neilb@suse.com>
---
net/sunrpc/backchannel_rqst.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -61,6 +61,7 @@ static void xprt_free_allocation(struct
free_page((unsigned long)xbufp->head[0].iov_base);
xbufp = &req->rq_snd_buf;
free_page((unsigned long)xbufp->head[0].iov_base);
+ xprt_put(req->rq_xprt);
kfree(req);
}
@@ -85,7 +86,7 @@ struct rpc_rqst *xprt_alloc_bc_req(struc
if (req == NULL)
return NULL;
- req->rq_xprt = xprt;
+ req->rq_xprt = xprt_get(xprt);
INIT_LIST_HEAD(&req->rq_bc_list);
/* Preallocate one XDR receive buffer */