6 files changed, 24 insertions, 4 deletions

diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f5fcd6360056..65d9771e49f9 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -303,6 +303,7 @@ cifs_alloc_inode(struct super_block *sb)
         cifs_inode->uniqueid = 0;
         cifs_inode->createtime = 0;
         cifs_inode->epoch = 0;
+        spin_lock_init(&cifs_inode->open_file_lock);
         generate_random_uuid(cifs_inode->lease_key);
 
         /*
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 334ff5f9c3f3..4777b3c4a92c 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1377,6 +1377,7 @@ struct cifsInodeInfo {
         struct rw_semaphore lock_sem;   /* protect the fields above */
         /* BB add in lists for dirty pages i.e. write caching info for oplock */
         struct list_head openFileList;
+        spinlock_t      open_file_lock; /* protects openFileList */
         __u32 cifsAttrs; /* e.g. DOS archive bit, sparse, compressed, system */
         unsigned int oplock;            /* oplock/lease level we have */
         unsigned int epoch;             /* used to track lease state changes */
@@ -1780,10 +1781,14 @@ require use of the stronger protocol */
  *  tcp_ses_lock protects:
  *      list operations on tcp and SMB session lists
  *  tcon->open_file_lock protects the list of open files hanging off the tcon
+ *  inode->open_file_lock protects the openFileList hanging off the inode
  *  cfile->file_info_lock protects counters and fields in cifs file struct
  *  f_owner.lock protects certain per file struct operations
  *  mapping->page_lock protects certain per page operations
  *
+ *  Note that the cifs_tcon.open_file_lock should be taken before
+ *  not after the cifsInodeInfo.open_file_lock
+ *
  *  Semaphores
  *  ----------
  *  sesSem     operations on smb session
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 8c4121da624e..8dd6637a3cbb 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -476,6 +476,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
         spin_lock(&GlobalMid_Lock);
         server->nr_targets = 1;
 #ifdef CONFIG_CIFS_DFS_UPCALL
+        spin_unlock(&GlobalMid_Lock);
         cifs_sb = find_super_by_tcp(server);
         if (IS_ERR(cifs_sb)) {
                 rc = PTR_ERR(cifs_sb);
@@ -493,6 +494,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
         }
         cifs_dbg(FYI, "%s: will retry %d target(s)\n", __func__,
                  server->nr_targets);
+        spin_lock(&GlobalMid_Lock);
 #endif
         if (server->tcpStatus == CifsExiting) {
                 /* the demux thread will exit normally
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 06e27ac6d82c..97090693d182 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -338,10 +338,12 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
         atomic_inc(&tcon->num_local_opens);
 
         /* if readable file instance put first in list*/
+        spin_lock(&cinode->open_file_lock);
         if (file->f_mode & FMODE_READ)
                 list_add(&cfile->flist, &cinode->openFileList);
         else
                 list_add_tail(&cfile->flist, &cinode->openFileList);
+        spin_unlock(&cinode->open_file_lock);
         spin_unlock(&tcon->open_file_lock);
 
         if (fid->purge_cache)
@@ -413,7 +415,9 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
         cifs_add_pending_open_locked(&fid, cifs_file->tlink, &open);
 
         /* remove it from the lists */
+        spin_lock(&cifsi->open_file_lock);
         list_del(&cifs_file->flist);
+        spin_unlock(&cifsi->open_file_lock);
         list_del(&cifs_file->tlist);
         atomic_dec(&tcon->num_local_opens);
 
@@ -1950,9 +1954,9 @@ refind_writable:
                         return 0;
                 }
 
-                spin_lock(&tcon->open_file_lock);
+                spin_lock(&cifs_inode->open_file_lock);
                 list_move_tail(&inv_file->flist, &cifs_inode->openFileList);
-                spin_unlock(&tcon->open_file_lock);
+                spin_unlock(&cifs_inode->open_file_lock);
                 cifsFileInfo_put(inv_file);
                 ++refind;
                 inv_file = NULL;
diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c
index e32c264e3adb..82ade16c9501 100644
--- a/fs/cifs/smb2maperror.c
+++ b/fs/cifs/smb2maperror.c
@@ -457,7 +457,7 @@ static const struct status_to_posix_error smb2_error_map_table[] = {
         {STATUS_FILE_INVALID, -EIO, "STATUS_FILE_INVALID"},
         {STATUS_ALLOTTED_SPACE_EXCEEDED, -EIO,
         "STATUS_ALLOTTED_SPACE_EXCEEDED"},
-        {STATUS_INSUFFICIENT_RESOURCES, -EREMOTEIO,
+        {STATUS_INSUFFICIENT_RESOURCES, -EAGAIN,
                                 "STATUS_INSUFFICIENT_RESOURCES"},
         {STATUS_DFS_EXIT_PATH_FOUND, -EIO, "STATUS_DFS_EXIT_PATH_FOUND"},
         {STATUS_DEVICE_DATA_ERROR, -EIO, "STATUS_DEVICE_DATA_ERROR"},
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 29b699d532ef..75311a8a68bf 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3114,9 +3114,14 @@ void smb2_reconnect_server(struct work_struct *work)
                                 tcon_exist = true;
                         }
                 }
+                /*
+                 * IPC has the same lifetime as its session and uses its
+                 * refcount.
+                 */
                 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) {
                         list_add_tail(&ses->tcon_ipc->rlist, &tmp_list);
                         tcon_exist = true;
+                        ses->ses_count++;
                 }
         }
         /*
@@ -3135,7 +3140,10 @@ void smb2_reconnect_server(struct work_struct *work)
                 else
                         resched = true;
                 list_del_init(&tcon->rlist);
-                cifs_put_tcon(tcon);
+                if (tcon->ipc)
+                        cifs_put_smb_ses(tcon->ses);
+                else
+                        cifs_put_tcon(tcon);
         }
 
         cifs_dbg(FYI, "Reconnecting tcons finished\n");