Merge tag 'nfs-for-5.1-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

Pull NFS client bugfixes from Trond Myklebust:
 "Highlights include:

  Stable fixes:
   - Fix nfs4_lock_state refcounting in nfs4_alloc_{lock,unlock}data()
   - fix mount/umount race in nlmclnt.
   - NFSv4.1 don't free interrupted slot on open

  Bugfixes:
   - Don't let RPC_SOFTCONN tasks time out if the transport is connected
   - Fix a typo in nfs_init_timeout_values()
   - Fix layoutstats handling during read failovers
   - fix uninitialized variable warning"

* tag 'nfs-for-5.1-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  SUNRPC: fix uninitialized variable warning
  pNFS/flexfiles: Fix layoutstats handling during read failovers
  NFS: Fix a typo in nfs_init_timeout_values()
  SUNRPC: Don't let RPC_SOFTCONN tasks time out if the transport is connected
  NFSv4.1 don't free interrupted slot on open
  NFS: fix mount/umount race in nlmclnt.
  NFS: Fix nfs4_lock_state refcounting in nfs4_alloc_{lock,unlock}data()

6 files changed, 21 insertions, 10 deletions

diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index 93fb7cf0b92b..f0b5c987d6ae 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -290,12 +290,11 @@ void nlmclnt_release_host(struct nlm_host *host)
 
         WARN_ON_ONCE(host->h_server);
 
-        if (refcount_dec_and_test(&host->h_count)) {
+        if (refcount_dec_and_mutex_lock(&host->h_count, &nlm_host_mutex)) {
                 WARN_ON_ONCE(!list_empty(&host->h_lockowners));
                 WARN_ON_ONCE(!list_empty(&host->h_granted));
                 WARN_ON_ONCE(!list_empty(&host->h_reclaim));
 
-                mutex_lock(&nlm_host_mutex);
                 nlm_destroy_host_locked(host);
                 mutex_unlock(&nlm_host_mutex);
         }
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index fb1cf1a4bda2..90d71fda65ce 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -453,7 +453,7 @@ void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
         case XPRT_TRANSPORT_RDMA:
                 if (retrans == NFS_UNSPEC_RETRANS)
                         to->to_retries = NFS_DEF_TCP_RETRANS;
-                if (timeo == NFS_UNSPEC_TIMEO || to->to_retries == 0)
+                if (timeo == NFS_UNSPEC_TIMEO || to->to_initval == 0)
                         to->to_initval = NFS_DEF_TCP_TIMEO * HZ / 10;
                 if (to->to_initval > NFS_MAX_TCP_TIMEOUT)
                         to->to_initval = NFS_MAX_TCP_TIMEOUT;
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index f9264e1922a2..6673d4ff5a2a 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1289,6 +1289,7 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg,
 static int ff_layout_read_done_cb(struct rpc_task *task,
                                 struct nfs_pgio_header *hdr)
 {
+        int new_idx = hdr->pgio_mirror_idx;
         int err;
 
         trace_nfs4_pnfs_read(hdr, task->tk_status);
@@ -1307,7 +1308,7 @@ static int ff_layout_read_done_cb(struct rpc_task *task,
         case -NFS4ERR_RESET_TO_PNFS:
                 if (ff_layout_choose_best_ds_for_read(hdr->lseg,
                                         hdr->pgio_mirror_idx + 1,
-                                        &hdr->pgio_mirror_idx))
+                                        &new_idx))
                         goto out_layouterror;
                 set_bit(NFS_IOHDR_RESEND_PNFS, &hdr->flags);
                 return task->tk_status;
@@ -1320,7 +1321,9 @@ static int ff_layout_read_done_cb(struct rpc_task *task,
 
         return 0;
 out_layouterror:
+        ff_layout_read_record_layoutstats_done(task, hdr);
         ff_layout_send_layouterror(hdr->lseg);
+        hdr->pgio_mirror_idx = new_idx;
 out_eagain:
         rpc_restart_call_prepare(task);
         return -EAGAIN;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 4dbb0ee23432..741ff8c9c6ed 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2933,7 +2933,8 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
         }
 
 out:
-        nfs4_sequence_free_slot(&opendata->o_res.seq_res);
+        if (!opendata->cancelled)
+                nfs4_sequence_free_slot(&opendata->o_res.seq_res);
         return ret;
 }
 
@@ -6301,7 +6302,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
         p->arg.seqid = seqid;
         p->res.seqid = seqid;
         p->lsp = lsp;
-        refcount_inc(&lsp->ls_count);
         /* Ensure we don't close file until we're done freeing locks! */
         p->ctx = get_nfs_open_context(ctx);
         p->l_ctx = nfs_get_lock_context(ctx);
@@ -6526,7 +6526,6 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl,
         p->res.lock_seqid = p->arg.lock_seqid;
         p->lsp = lsp;
         p->server = server;
-        refcount_inc(&lsp->ls_count);
         p->ctx = get_nfs_open_context(ctx);
         locks_init_lock(&p->fl);
         locks_copy_lock(&p->fl, fl);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 228970e6e52b..187d10443a15 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -2311,6 +2311,15 @@ out_exit:
         rpc_exit(task, status);
 }
 
+static bool
+rpc_check_connected(const struct rpc_rqst *req)
+{
+        /* No allocated request or transport? return true */
+        if (!req || !req->rq_xprt)
+                return true;
+        return xprt_connected(req->rq_xprt);
+}
+
 static void
 rpc_check_timeout(struct rpc_task *task)
 {
@@ -2322,10 +2331,11 @@ rpc_check_timeout(struct rpc_task *task)
         dprintk("RPC: %5u call_timeout (major)\n", task->tk_pid);
         task->tk_timeouts++;
 
-        if (RPC_IS_SOFTCONN(task)) {
+        if (RPC_IS_SOFTCONN(task) && !rpc_check_connected(task->tk_rqstp)) {
                 rpc_exit(task, -ETIMEDOUT);
                 return;
         }
+
         if (RPC_IS_SOFT(task)) {
                 if (clnt->cl_chatty) {
                         printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 9359539907ba..732d4b57411a 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -495,8 +495,8 @@ xs_read_stream_request(struct sock_xprt *transport, struct msghdr *msg,
                 int flags, struct rpc_rqst *req)
 {
         struct xdr_buf *buf = &req->rq_private_buf;
-        size_t want, read;
-        ssize_t ret;
+        size_t want, uninitialized_var(read);
+        ssize_t uninitialized_var(ret);
 
         xs_read_header(transport, buf);