svcrpc: fix list-corrupting race on nfsd shutdown

[linux-imx.git] / net / sunrpc / svc_xprt.c

diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 2f5fb71854d311bac39c19c09e2044a955ee9cff..49aa3ff093a69e003bac6aee695244dac9785bb7 100644 (file)
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -894,12 +894,13 @@ void svc_delete_xprt(struct svc_xprt *xprt)
        if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
                list_del_init(&xprt->xpt_list);
        /*
-        * We used to delete the transport from whichever list
-        * it's sk_xprt.xpt_ready node was on, but we don't actually
-        * need to.  This is because the only time we're called
-        * while still attached to a queue, the queue itself
-        * is about to be destroyed (in svc_destroy).
+        * The only time we're called while xpt_ready is still on a list
+        * is while the list itself is about to be destroyed (in
+        * svc_destroy).  BUT svc_xprt_enqueue could still be attempting
+        * to add new entries to the sp_sockets list, so we can't leave
+        * a freed xprt on it.
         */
+       list_del_init(&xprt->xpt_ready);
        if (test_bit(XPT_TEMP, &xprt->xpt_flags))
                serv->sv_tmpcnt--;
        spin_unlock_bh(&serv->sv_lock);