ipv6: fix an oops when force unload ipv6 module

[safe/jmp/linux-2.6] / net / 9p / trans_fd.c

diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 1df0356..4dd873e 100644 (file)
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -119,8 +119,8 @@ struct p9_poll_wait {
  * @wpos: write position for current frame
  * @wsize: amount of data to write for current frame
  * @wbuf: current write buffer
+ * @poll_pending_link: pending links to be polled per conn
  * @poll_wait: array of wait_q's for various worker threads
- * @poll_waddr: ????
  * @pt: poll state
  * @rq: current read work
  * @wq: current write work
@@ -213,8 +213,8 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
        spin_unlock_irqrestore(&m->client->lock, flags);
 
        list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) {
-               list_del(&req->req_list);
                P9_DPRINTK(P9_DEBUG_ERROR, "call back req %p\n", req);
+               list_del(&req->req_list);
                p9_client_cb(m->client, req);
        }
 }
@@ -336,7 +336,8 @@ static void p9_read_work(struct work_struct *work)
                        "mux %p pkt: size: %d bytes tag: %d\n", m, n, tag);
 
                m->req = p9_tag_lookup(m->client, tag);
-               if (!m->req) {
+               if (!m->req || (m->req->status != REQ_STATUS_SENT &&
+                                       m->req->status != REQ_STATUS_FLSH)) {
                        P9_DPRINTK(P9_DEBUG_ERROR, "Unexpected packet tag %d\n",
                                                                 tag);
                        err = -EIO;
@@ -361,10 +362,11 @@ static void p9_read_work(struct work_struct *work)
        if ((m->req) && (m->rpos == m->rsize)) { /* packet is read in */
                P9_DPRINTK(P9_DEBUG_TRANS, "got new packet\n");
                spin_lock(&m->client->lock);
+               if (m->req->status != REQ_STATUS_ERROR)
+                       m->req->status = REQ_STATUS_RCVD;
                list_del(&m->req->req_list);
                spin_unlock(&m->client->lock);
                p9_client_cb(m->client, m->req);
-
                m->rbuf = NULL;
                m->rpos = 0;
                m->rsize = 0;
@@ -417,7 +419,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len)
        oldfs = get_fs();
        set_fs(get_ds());
        /* The cast to a user pointer is valid due to the set_fs() */
-       ret = vfs_write(ts->wr, (void __user *)v, len, &ts->wr->f_pos);
+       ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
        set_fs(oldfs);
 
        if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
@@ -454,6 +456,7 @@ static void p9_write_work(struct work_struct *work)
                req = list_entry(m->unsent_req_list.next, struct p9_req_t,
                               req_list);
                req->status = REQ_STATUS_SENT;
+               P9_DPRINTK(P9_DEBUG_TRANS, "move req %p\n", req);
                list_move_tail(&req->req_list, &m->req_list);
 
                m->wbuf = req->tc->sdata;
@@ -630,8 +633,8 @@ static void p9_poll_mux(struct p9_conn *m)
        if (n & POLLOUT) {
                set_bit(Wpending, &m->wsched);
                P9_DPRINTK(P9_DEBUG_TRANS, "mux %p can write\n", m);
-               if ((m->wsize || !list_empty(&m->unsent_req_list))
-                   && !test_and_set_bit(Wworksched, &m->wsched)) {
+               if ((m->wsize || !list_empty(&m->unsent_req_list)) &&
+                   !test_and_set_bit(Wworksched, &m->wsched)) {
                        P9_DPRINTK(P9_DEBUG_TRANS, "sched write work %p\n", m);
                        queue_work(p9_mux_wq, &m->wq);
                }
@@ -683,12 +686,13 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req)
        P9_DPRINTK(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
 
        spin_lock(&client->lock);
-       list_del(&req->req_list);
 
        if (req->status == REQ_STATUS_UNSENT) {
+               list_del(&req->req_list);
                req->status = REQ_STATUS_FLSHD;
                ret = 0;
-       }
+       } else if (req->status == REQ_STATUS_SENT)
+               req->status = REQ_STATUS_FLSH;
 
        spin_unlock(&client->lock);
 
@@ -696,9 +700,9 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req)
 }
 
 /**
- * parse_options - parse mount options into session structure
- * @options: options string passed from mount
- * @opts: transport-specific structure to parse options into
+ * parse_opts - parse mount options into p9_fd_opts structure
+ * @params: options string passed from mount
+ * @opts: fd transport-specific structure to parse options into
  *
  * Returns 0 upon success, -ERRNO upon failure
  */
@@ -731,12 +735,14 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
                if (!*p)
                        continue;
                token = match_token(p, tokens, args);
-               r = match_int(&args[0], &option);
-               if (r < 0) {
-                       P9_DPRINTK(P9_DEBUG_ERROR,
-                        "integer field, but no integer?\n");
-                       ret = r;
-                       continue;
+               if (token != Opt_err) {
+                       r = match_int(&args[0], &option);
+                       if (r < 0) {
+                               P9_DPRINTK(P9_DEBUG_ERROR,
+                               "integer field, but no integer?\n");
+                               ret = r;
+                               continue;
+                       }
                }
                switch (token) {
                case Opt_port: