rds: fix NULL pointer dereference panic during rds module unload

This issue reported happens during an unload of rds module with rds
reconnect timeout worker scheduled to execute in the future, and rds
module unloaded earlier than that. rds reconnect timeout worker was
introduced by 8991a87c6c3fc8b17383a140bd6f15a958e31298 ( RDS: SA query
optimization) commit. Fix is to flush/cancel any reconnect timeout
workers while performing rds connections destroy which is done during
module unload.

Orabug: 18952475

Signed-off-by: Rama Nichanamatlu <rama.nichanamatlu@oracle.com>
Acked-by: Chien Yen <chien.yen@oracle.com>
Signed-off-by: Guangyu Sun <guangyu.sun@oracle.com>
(cherry picked from commit 26c0879e51915b9ba0526d9a3630e08d2cc51a2b)

diff --git a/net/rds/connection.c b/net/rds/connection.c
index 7a53a8eaae86ec2a92469374defaba4043b59a18..b772e4ac06f1d6e2cbb35a56292059b38e1d3cc8 100644 (file)
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -380,6 +380,13 @@ void rds_conn_destroy(struct rds_connection *conn)
        rds_conn_drop(conn);
        flush_work(&conn->c_down_w);
 
+       /* now that conn down worker is flushed; there cannot be any
+        * more posting of reconn timeout work. But cancel any already
+        * posted reconn timeout worker as there is a race between rds
+        * module unload and a pending reconn delay work.
+        */
+       cancel_delayed_work_sync(&conn->c_reconn_w);
+
        /* make sure lingering queued work won't try to ref the conn */
        cancel_delayed_work_sync(&conn->c_send_w);
        cancel_delayed_work_sync(&conn->c_recv_w);