diff options
| author | Trond Myklebust <Trond.Myklebust@netapp.com> | 2008-04-19 13:15:47 -0400 |
|---|---|---|
| committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2008-04-19 16:52:33 -0400 |
| commit | 24b74bf0c9e08cbda74d3c64af69ad402ed54e04 (patch) | |
| tree | bd18884769eef620d12babbc86a008561321758e | |
| parent | 0490a54a00c14212f22c5948c8c13a4553d745bd (diff) | |
| download | op-kernel-dev-24b74bf0c9e08cbda74d3c64af69ad402ed54e04.zip op-kernel-dev-24b74bf0c9e08cbda74d3c64af69ad402ed54e04.tar.gz | |
SUNRPC: Fix a bug in call_decode()
call_verify() can, under certain circumstances, free the RPC slot. In that
case, our cached pointer 'req = task->tk_rqstp' is invalid. Bug was
introduced in commit 220bcc2afd7011b3e0569fc178331fa983c92c1b (SUNRPC:
Don't call xprt_release in call refresh).
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
| -rw-r--r-- | net/sunrpc/clnt.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c index ea14314..522b068 100644 --- a/net/sunrpc/clnt.c +++ b/net/sunrpc/clnt.c @@ -1240,10 +1240,13 @@ call_decode(struct rpc_task *task) task->tk_status); return; out_retry: - req->rq_received = req->rq_private_buf.len = 0; task->tk_status = 0; - if (task->tk_client->cl_discrtry) - xprt_force_disconnect(task->tk_xprt); + /* Note: call_verify() may have freed the RPC slot */ + if (task->tk_rqstp == req) { + req->rq_received = req->rq_private_buf.len = 0; + if (task->tk_client->cl_discrtry) + xprt_force_disconnect(task->tk_xprt); + } } /* |
