Commit 969b7f2522c90dfed5d0d2553a91522bda2c3bf3

Authored by Trond Myklebust
1 parent 566dd6064e

SUNRPC: Fix a potential race in rpc_pipefs.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Showing 1 changed file with 6 additions and 3 deletions Side-by-side Diff

net/sunrpc/rpc_pipe.c
... ... @@ -70,8 +70,11 @@
70 70 struct inode *inode = &rpci->vfs_inode;
71 71  
72 72 down(&inode->i_sem);
  73 + if (rpci->ops == NULL)
  74 + goto out;
73 75 if (rpci->nreaders == 0 && !list_empty(&rpci->pipe))
74 76 __rpc_purge_upcall(inode, -ETIMEDOUT);
  77 +out:
75 78 up(&inode->i_sem);
76 79 }
77 80  
... ... @@ -113,8 +116,6 @@
113 116 {
114 117 struct rpc_inode *rpci = RPC_I(inode);
115 118  
116   - cancel_delayed_work(&rpci->queue_timeout);
117   - flush_scheduled_work();
118 119 down(&inode->i_sem);
119 120 if (rpci->ops != NULL) {
120 121 rpci->nreaders = 0;
... ... @@ -127,6 +128,8 @@
127 128 }
128 129 rpc_inode_setowner(inode, NULL);
129 130 up(&inode->i_sem);
  131 + cancel_delayed_work(&rpci->queue_timeout);
  132 + flush_scheduled_work();
130 133 }
131 134  
132 135 static struct inode *
... ... @@ -166,7 +169,7 @@
166 169 static int
167 170 rpc_pipe_release(struct inode *inode, struct file *filp)
168 171 {
169   - struct rpc_inode *rpci = RPC_I(filp->f_dentry->d_inode);
  172 + struct rpc_inode *rpci = RPC_I(inode);
170 173 struct rpc_pipe_msg *msg;
171 174  
172 175 down(&inode->i_sem);