Commit b6dff26a authored Oct 19, 2006 by Trond Myklebust Committed by Linus Torvalds Oct 20, 2006

[PATCH] NFS: Fix oops in nfs_cancel_commit_list



Fix two bugs:
 - nfs_inode_remove_request will call nfs_clear_request, so we cannot
   reference req->wb_page after it. Move the call to dec_zone_page_state so
   that it occurs while req->wb_page is still valid.
 - Calling nfs_clear_page_writeback is unnecessary since the radix tree
   tags will have been cleared by the call to nfs_inode_remove_request.
   Replace with a simple call to nfs_unlock_request.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

parent 575b5c78

fs/nfs/write.c

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -590,10 +590,10 @@ static void nfs_cancel_commit_list(struct list_head *head)

	while(!list_empty(head)) {		while(!list_empty(head)) {
	req = nfs_list_entry(head->next);		req = nfs_list_entry(head->next);
			dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
	nfs_list_remove_request(req);		nfs_list_remove_request(req);
	nfs_inode_remove_request(req);		nfs_inode_remove_request(req);
	dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);		nfs_unlock_request(req);
	nfs_clear_page_writeback(req);
	}		}
	}		}