]> git.karo-electronics.de Git - karo-tx-linux.git/commit
svcrpc: fix list-corrupting race on nfsd shutdown
authorJ. Bruce Fields <bfields@redhat.com>
Wed, 29 Jun 2011 20:49:04 +0000 (16:49 -0400)
committerPaul Gortmaker <paul.gortmaker@windriver.com>
Thu, 17 May 2012 15:21:21 +0000 (11:21 -0400)
commit893a36baacd2825a02d3b7e6135a73db1e469aea
tree4f91ef8452282bb80bf6d5e76bd7befdfe5ad046
parent6bc5888eb29b669d57522671b17f76b62296cbd7
svcrpc: fix list-corrupting race on nfsd shutdown

commit ebc63e531cc6a457595dd110b07ac530eae788c3 upstream.

After commit 3262c816a3d7fb1eaabce633caa317887ed549ae "[PATCH] knfsd:
split svc_serv into pools", svc_delete_xprt (then svc_delete_socket) no
longer removed its xpt_ready (then sk_ready) field from whatever list it
was on, noting that there was no point since the whole list was about to
be destroyed anyway.

That was mostly true, but forgot that a few svc_xprt_enqueue()'s might
still be hanging around playing with the about-to-be-destroyed list, and
could get themselves into trouble writing to freed memory if we left
this xprt on the list after freeing it.

(This is actually functionally identical to a patch made first by Ben
Greear, but with more comments.)

Cc: gnb@fmeh.org
Reported-by: Ben Greear <greearb@candelatech.com>
Tested-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
net/sunrpc/svc_xprt.c