From: Greg KH on
2.6.33-stable review patch. If anyone has any objections, please let me know.

-----------------

From: Neil Brown <neilb(a)suse.de>

commit ab1b18f70a007ea6caeb007d269abb75b131a410 upstream.

The 'struct svc_deferred_req's on the xpt_deferred queue do not
own a reference to the owning xprt. This is seen in svc_revisit
which is where things are added to this queue. dr->xprt is set to
NULL and the reference to the xprt it put.

So when this list is cleaned up in svc_delete_xprt, we mustn't
put the reference.

Also, replace the 'for' with a 'while' which is arguably
simpler and more likely to compile efficiently.

Cc: Tom Tucker <tom(a)opengridcomputing.com>
Signed-off-by: NeilBrown <neilb(a)suse.de>
Signed-off-by: J. Bruce Fields <bfields(a)citi.umich.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de>

---
net/sunrpc/svc_xprt.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)

--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -889,11 +889,8 @@ void svc_delete_xprt(struct svc_xprt *xp
if (test_bit(XPT_TEMP, &xprt->xpt_flags))
serv->sv_tmpcnt--;

- for (dr = svc_deferred_dequeue(xprt); dr;
- dr = svc_deferred_dequeue(xprt)) {
- svc_xprt_put(xprt);
+ while ((dr = svc_deferred_dequeue(xprt)) != NULL)
kfree(dr);
- }

svc_xprt_put(xprt);
spin_unlock_bh(&serv->sv_lock);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/