4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tomas Bortoli <tomasbortoli@xxxxxxxxx> commit 430ac66eb4c5b5c4eb846b78ebf65747510b30f1 upstream. The patch adds the flush in p9_mux_poll_stop() as it the function used by p9_conn_destroy(), in turn called by p9_fd_close() to stop the async polling associated with the data regarding the connection. Link: http://lkml.kernel.org/r/20180720092730.27104-1-tomasbortoli@xxxxxxxxx Signed-off-by: Tomas Bortoli <tomasbortoli@xxxxxxxxx> Reported-by: syzbot+39749ed7d9ef6dfb23f6@xxxxxxxxxxxxxxxxxxxxxxxxx To: Eric Van Hensbergen <ericvh@xxxxxxxxx> To: Ron Minnich <rminnich@xxxxxxxxxx> To: Latchesar Ionkov <lucho@xxxxxxxxxx> Cc: Yiwen Jiang <jiangyiwen@xxxxxxxxx> Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Dominique Martinet <dominique.martinet@xxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/9p/trans_fd.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -185,6 +185,8 @@ static void p9_mux_poll_stop(struct p9_c spin_lock_irqsave(&p9_poll_lock, flags); list_del_init(&m->poll_pending_link); spin_unlock_irqrestore(&p9_poll_lock, flags); + + flush_work(&p9_poll_work); } /**
