From: NeilBrown <neilb@suse.de>
Subject: NFSv4.1 - backchannel request should hold ref on xprt
References: bsc#1152624
Patch-mainline: Not yet, maintainer has different version queued

It is possible for an xprt to be freed while there are still
pending back-channel replies waiting to go out.  This causes
problems.
As the rpc_rqst already has a pointer to the xprt, it is easy
to change that to a counted reference, so the xprt cannot go away
while the rpc_rqst exists.

Signed-off-by: NeilBrown <neilb@suse.de>
Acked-by: NeilBrown <neilb@suse.com>

---
 net/sunrpc/backchannel_rqst.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -66,6 +66,7 @@ static void xprt_free_allocation(struct
 	free_page((unsigned long)xbufp->head[0].iov_base);
 	xbufp = &req->rq_snd_buf;
 	free_page((unsigned long)xbufp->head[0].iov_base);
+	xprt_put(req->rq_xprt);
 	kfree(req);
 }
 
@@ -90,7 +91,7 @@ struct rpc_rqst *xprt_alloc_bc_req(struc
 	if (req == NULL)
 		return NULL;
 
-	req->rq_xprt = xprt;
+	req->rq_xprt = xprt_get(xprt);
 	INIT_LIST_HEAD(&req->rq_list);
 	INIT_LIST_HEAD(&req->rq_bc_list);