Merge tag 'nfs-for-4.14-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

Pull NFS client bugfixes from Trond Myklebust:
 "Hightlights include:

  stable fixes:
   - nfs/filelayout: fix oops when freeing filelayout segment
   - NFS: Fix uninitialized rpc_wait_queue

  bugfixes:
   - NFSv4/pnfs: Fix an infinite layoutget loop
   - nfs: RPC_MAX_AUTH_SIZE is in bytes"

* tag 'nfs-for-4.14-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFSv4/pnfs: Fix an infinite layoutget loop
  nfs/filelayout: fix oops when freeing filelayout segment
  sunrpc: remove redundant initialization of sock
  NFS: Fix uninitialized rpc_wait_queue
  NFS: Cleanup error handling in nfs_idmap_request_key()
  nfs: RPC_MAX_AUTH_SIZE is in bytes

6 files changed, 8 insertions, 8 deletions

diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index efebe6cf4378..22880ef6d8dd 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -218,7 +218,6 @@ static void nfs_cb_idr_remove_locked(struct nfs_client *clp)
 static void pnfs_init_server(struct nfs_server *server)
 {
         rpc_init_wait_queue(&server->roc_rpcwaitq, "pNFS ROC");
-        rpc_init_wait_queue(&server->uoc_rpcwaitq, "NFS UOC");
 }
 
 #else
@@ -888,6 +887,7 @@ struct nfs_server *nfs_alloc_server(void)
         ida_init(&server->openowner_id);
         ida_init(&server->lockowner_id);
         pnfs_init_server(server);
+        rpc_init_wait_queue(&server->uoc_rpcwaitq, "NFS UOC");
 
         return server;
 }
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index 44c638b7876c..508126eb49f9 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -745,7 +745,8 @@ filelayout_free_lseg(struct pnfs_layout_segment *lseg)
         struct nfs4_filelayout_segment *fl = FILELAYOUT_LSEG(lseg);
 
         dprintk("--> %s\n", __func__);
-        nfs4_fl_put_deviceid(fl->dsaddr);
+        if (fl->dsaddr != NULL)
+                nfs4_fl_put_deviceid(fl->dsaddr);
         /* This assumes a single RW lseg */
         if (lseg->pls_range.iomode == IOMODE_RW) {
                 struct nfs4_filelayout *flo;
diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c
index dd5d27da8c0c..30426c1a1bbd 100644
--- a/fs/nfs/nfs4idmap.c
+++ b/fs/nfs/nfs4idmap.c
@@ -274,7 +274,7 @@ static struct key *nfs_idmap_request_key(const char *name, size_t namelen,
         ssize_t ret;
 
         ret = nfs_idmap_get_desc(name, namelen, type, strlen(type), &desc);
-        if (ret <= 0)
+        if (ret < 0)
                 return ERR_PTR(ret);
 
         rkey = request_key(&key_type_id_resolver, desc, "");
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 6c61e2b99635..f90090e8c959 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -8399,8 +8399,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                 lo = NFS_I(inode)->layout;
                 /* If the open stateid was bad, then recover it. */
                 if (!lo || test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) ||
-                    nfs4_stateid_match_other(&lgp->args.stateid,
-                                        &lgp->args.ctx->state->stateid)) {
+                    !nfs4_stateid_match_other(&lgp->args.stateid, &lo->plh_stateid)) {
                         spin_unlock(&inode->i_lock);
                         exception->state = lgp->args.ctx->state;
                         exception->stateid = &lgp->args.stateid;
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 37c8af003275..14ed9791ec9c 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1842,8 +1842,8 @@ static void encode_create_session(struct xdr_stream *xdr,
          * Assumes OPEN is the biggest non-idempotent compound.
          * 2 is the verifier.
          */
-        max_resp_sz_cached = (NFS4_dec_open_sz + RPC_REPHDRSIZE +
-                              RPC_MAX_AUTH_SIZE + 2) * XDR_UNIT;
+        max_resp_sz_cached = (NFS4_dec_open_sz + RPC_REPHDRSIZE + 2)
+                                * XDR_UNIT + RPC_MAX_AUTH_SIZE;
 
         encode_op_hdr(xdr, OP_CREATE_SESSION, decode_create_session_maxsz, hdr);
         p = reserve_space(xdr, 16 + 2*28 + 20 + clnt->cl_nodelen + 12);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 9b5de31aa429..c1841f234a71 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2203,7 +2203,7 @@ static void xs_udp_setup_socket(struct work_struct *work)
         struct sock_xprt *transport =
                 container_of(work, struct sock_xprt, connect_worker.work);
         struct rpc_xprt *xprt = &transport->xprt;
-        struct socket *sock = transport->sock;
+        struct socket *sock;
         int status = -EIO;
 
         sock = xs_create_sock(xprt, transport,