SUNRPC: Fix a potential race in rpc_pipefs.

 Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 16a2458f38f7055d889548289945cae243c5d844..24cc23af9b95d7d0ca1950ce7bcaf5ac098bdc6f 100644 (file)
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -70,8 +70,11 @@ rpc_timeout_upcall_queue(void *data)
        struct inode *inode = &rpci->vfs_inode;
 
        down(&inode->i_sem);
+       if (rpci->ops == NULL)
+               goto out;
        if (rpci->nreaders == 0 && !list_empty(&rpci->pipe))
                __rpc_purge_upcall(inode, -ETIMEDOUT);
+out:
        up(&inode->i_sem);
 }
 
@@ -113,8 +116,6 @@ rpc_close_pipes(struct inode *inode)
 {
        struct rpc_inode *rpci = RPC_I(inode);
 
-       cancel_delayed_work(&rpci->queue_timeout);
-       flush_scheduled_work();
        down(&inode->i_sem);
        if (rpci->ops != NULL) {
                rpci->nreaders = 0;
@@ -127,6 +128,8 @@ rpc_close_pipes(struct inode *inode)
        }
        rpc_inode_setowner(inode, NULL);
        up(&inode->i_sem);
+       cancel_delayed_work(&rpci->queue_timeout);
+       flush_scheduled_work();
 }
 
 static struct inode *
@@ -166,7 +169,7 @@ rpc_pipe_open(struct inode *inode, struct file *filp)
 static int
 rpc_pipe_release(struct inode *inode, struct file *filp)
 {
-       struct rpc_inode *rpci = RPC_I(filp->f_dentry->d_inode);
+       struct rpc_inode *rpci = RPC_I(inode);
        struct rpc_pipe_msg *msg;
 
        down(&inode->i_sem);