SUNRPC: Fix Oopsable condition in rpc_pipefs

 The elements on rpci->in_upcall are tracked by the filp->private_data,
 which will ensure that they get released when the file is closed.

 The exception is if rpc_close_pipes() gets called first, since that
 sets rpci->ops to NULL.

 Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index e3b242daf53c64506f9ba77937a94bb544bcefe6..c76ea221798caf96666ef99ac3ce5c1694c832b7 100644 (file)
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -59,7 +59,6 @@ __rpc_purge_upcall(struct inode *inode, int err)
        struct rpc_inode *rpci = RPC_I(inode);
 
        __rpc_purge_list(rpci, &rpci->pipe, err);
-       __rpc_purge_list(rpci, &rpci->in_upcall, err);
        rpci->pipelen = 0;
        wake_up(&rpci->waitq);
 }
@@ -119,6 +118,7 @@ rpc_close_pipes(struct inode *inode)
        down(&inode->i_sem);
        if (rpci->ops != NULL) {
                rpci->nreaders = 0;
+               __rpc_purge_list(rpci, &rpci->in_upcall, -EPIPE);
                __rpc_purge_upcall(inode, -EPIPE);
                rpci->nwriters = 0;
                if (rpci->ops->release_pipe)