SUNRPC: Fix a potential race in rpc_pipefs. (969b7f25) · Commits · e / devices / android_kernel_fairphone_FP3

net/sunrpc/rpc_pipe.c

+6 −3

Original line number	Diff line number	Diff line
		@@ -70,8 +70,11 @@ rpc_timeout_upcall_queue(void *data)
		struct inode *inode = &rpci->vfs_inode;

		down(&inode->i_sem);
		if (rpci->ops == NULL)
		goto out;
		if (rpci->nreaders == 0 && !list_empty(&rpci->pipe))
		__rpc_purge_upcall(inode, -ETIMEDOUT);
		out:
		up(&inode->i_sem);
		}

		@@ -113,8 +116,6 @@ rpc_close_pipes(struct inode *inode)
		{
		struct rpc_inode *rpci = RPC_I(inode);

		cancel_delayed_work(&rpci->queue_timeout);
		flush_scheduled_work();
		down(&inode->i_sem);
		if (rpci->ops != NULL) {
		rpci->nreaders = 0;
		@@ -127,6 +128,8 @@ rpc_close_pipes(struct inode *inode)
		}
		rpc_inode_setowner(inode, NULL);
		up(&inode->i_sem);
		cancel_delayed_work(&rpci->queue_timeout);
		flush_scheduled_work();
		}

		static struct inode *
		@@ -166,7 +169,7 @@ rpc_pipe_open(struct inode inode, struct file filp)
		static int
		rpc_pipe_release(struct inode inode, struct file filp)
		{
		struct rpc_inode *rpci = RPC_I(filp->f_dentry->d_inode);
		struct rpc_inode *rpci = RPC_I(inode);
		struct rpc_pipe_msg *msg;

		down(&inode->i_sem);