Prior to Linux 5.3, ->transport_lock in sunrpc required the _bh style
spinlocks (when not called from a bottom-half handler).

When upstream 3848e96edf4788f772d83990022fa7023a233d83 was backported to
stable kernels, the spin_lock/unlock calls should have been changed to
the _bh version, but this wasn't noted in the patch and didn't happen.

So convert these lock/unlock calls to the _bh versions.

This patch is required for any stable kernel prior to 5.3 to which the
above mentioned patch was backported.  Namely 4.9.y, 4.14.y, 4.19.y.

Signed-off-by: NeilBrown <neilb@suse.de>
---
 net/sunrpc/xprt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index d05fa7c36d00..b1abf4848bbc 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1550,9 +1550,9 @@ static void xprt_destroy(struct rpc_xprt *xprt)
 	 * is cleared.  We use ->transport_lock to ensure the mod_timer()
 	 * can only run *before* del_time_sync(), never after.
 	 */
-	spin_lock(&xprt->transport_lock);
+	spin_lock_bh(&xprt->transport_lock);
 	del_timer_sync(&xprt->timer);
-	spin_unlock(&xprt->transport_lock);
+	spin_unlock_bh(&xprt->transport_lock);
 
 	/*
 	 * Destroy sockets etc from the system workqueue so they can
-- 
2.37.1

Hello Neil,

Many thanks for the solution. Much appreciated.

On Mo, Sep 12, 2022 at 09:00:52 +1000, NeilBrown wrote:
> 
> Prior to Linux 5.3, ->transport_lock in sunrpc required the _bh style
> spinlocks (when not called from a bottom-half handler).
> 
> When upstream 3848e96edf4788f772d83990022fa7023a233d83 was backported to
> stable kernels, the spin_lock/unlock calls should have been changed to
> the _bh version, but this wasn't noted in the patch and didn't happen.
> 
> So convert these lock/unlock calls to the _bh versions.
> 
> This patch is required for any stable kernel prior to 5.3 to which the
> above mentioned patch was backported.  Namely 4.9.y, 4.14.y, 4.19.y.
> 
> Signed-off-by: NeilBrown <neilb@suse.de>
> ---
>  net/sunrpc/xprt.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
> index d05fa7c36d00..b1abf4848bbc 100644
> --- a/net/sunrpc/xprt.c
> +++ b/net/sunrpc/xprt.c
> @@ -1550,9 +1550,9 @@ static void xprt_destroy(struct rpc_xprt *xprt)
>  	 * is cleared.  We use ->transport_lock to ensure the mod_timer()
>  	 * can only run *before* del_time_sync(), never after.
>  	 */
> -	spin_lock(&xprt->transport_lock);
> +	spin_lock_bh(&xprt->transport_lock);
>  	del_timer_sync(&xprt->timer);
> -	spin_unlock(&xprt->transport_lock);
> +	spin_unlock_bh(&xprt->transport_lock);
>  
>  	/*
>  	 * Destroy sockets etc from the system workqueue so they can

Fixes: v4.19.238 commit 242a3e0c75b64b ("SUNRPC: avoid race between mod_timer() and del_timer_sync()")
Fixes: v4.14.276 commit dd7d3a609aac16 ("SUNRPC: avoid race between mod_timer() and del_timer_sync()")
Fixes: v4.9.311 commit 6180bbce52739e ("SUNRPC: avoid race between mod_timer() and del_timer_sync()")

Reported-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Reviewed-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Tested-by: Eugeniu Rosca <erosca@de.adit-jv.com>

Best Regards,
Eugeniu Rosca