rxrpc: Fix overwaking on call poking

If an rxrpc call is given a poke, it will get woken up unconditionally,
even if there's already a poke pending (for which there will have been a
wake) or if the call refcount has gone to 0.

Fix this by only waking the call if it is still referenced and if it
doesn't already have a poke pending.

Fixes: 15f661dc95da ("rxrpc: Implement a mechanism to send an event notification to a call")
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org

diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index 6eaffb0d8fdcf1431bd1f498fdd226ed7cc6a6d5..e9f1f49d18c2a4dcb75da510cbffbbf90af3cf47 100644 (file)
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -54,12 +54,14 @@ void rxrpc_poke_call(struct rxrpc_call *call, enum rxrpc_call_poke_trace what)
                spin_lock_bh(&local->lock);
                busy = !list_empty(&call->attend_link);
                trace_rxrpc_poke_call(call, busy, what);
+               if (!busy && !rxrpc_try_get_call(call, rxrpc_call_get_poke))
+                       busy = true;
                if (!busy) {
-                       rxrpc_get_call(call, rxrpc_call_get_poke);
                        list_add_tail(&call->attend_link, &local->call_attend_q);
                }
                spin_unlock_bh(&local->lock);
-               rxrpc_wake_up_io_thread(local);
+               if (!busy)
+                       rxrpc_wake_up_io_thread(local);
        }
 }