From: Trond Myklebust Date: Sun, 12 Sep 2010 23:55:25 +0000 (-0400) Subject: SUNRPC: Fix race corrupting rpc upcall X-Git-Tag: v2.6.36-rc5~36^2~9 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5a67657a2e90c9e4a48518f95d4ba7777aa20fbb;p=pandora-kernel.git SUNRPC: Fix race corrupting rpc upcall If rpc_queue_upcall() adds a new upcall to the rpci->pipe list just after rpc_pipe_release calls rpc_purge_list(), but before it calls gss_pipe_release (as rpci->ops->release_pipe(inode)), then the latter will free a message without deleting it from the rpci->pipe list. We will be left with a freed object on the rpc->pipe list. Most frequent symptoms are kernel crashes in rpc.gssd system calls on the pipe in question. Reported-by: J. Bruce Fields Signed-off-by: Trond Myklebust Cc: stable@kernel.org --- Reading git-diff-tree failed