svc_handle_xprt() publishes a newly accepted transport before tracing it. The publication can make the transport available to another worker, which may close and free it before the tracepoint has finished reading it. Take an extra reference before publication and drop it after the tracepoint so the accepted transport remains alive for the tracepoint dereferences. Fixes: 11bbb0f76e99 ("SUNRPC: Trace a few more generic svc_xprt events") Cc: stable@vger.kernel.org Reported-by: VEGA Assisted-by: LLM Signed-off-by: Zhiling Zou --- net/sunrpc/svc_xprt.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c index 40040af588fb2..9370401463b6a 100644 --- a/net/sunrpc/svc_xprt.c +++ b/net/sunrpc/svc_xprt.c @@ -852,8 +852,10 @@ static void svc_handle_xprt(struct svc_rqst *rqstp, struct svc_xprt *xprt) newxpt = xprt->xpt_ops->xpo_accept(xprt); if (newxpt) { newxpt->xpt_cred = get_cred(xprt->xpt_cred); + svc_xprt_get(newxpt); svc_add_new_temp_xprt(serv, newxpt); trace_svc_xprt_accept(newxpt, serv->sv_name); + svc_xprt_put(newxpt); } else { module_put(xprt->xpt_class->xcl_owner); } -- 2.43.0