Merge tag 'nfsd-4.9-1' of git://linux-nfs.org/~bfields/linux

Pull nfsd bugfixes from Bruce Fields:
 "Fixes for some recent regressions including fallout from the vmalloc'd
  stack change (after which we can no longer encrypt stuff on the
  stack)"

* tag 'nfsd-4.9-1' of git://linux-nfs.org/~bfields/linux:
  nfsd: Fix general protection fault in release_lock_stateid()
  svcrdma: backchannel cannot share a page for send and rcv buffers
  sunrpc: fix some missing rq_rbuffer assignments
  sunrpc: don't pass on-stack memory to sg_set_buf
  nfsd: move blocked lock handling under a dedicated spinlock

2 files changed, 24 insertions, 19 deletions

diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h
index b10d557f9c9e..ee36efd5aece 100644
--- a/fs/nfsd/netns.h
+++ b/fs/nfsd/netns.h
@@ -84,6 +84,8 @@ struct nfsd_net {
         struct list_head client_lru;
         struct list_head close_lru;
         struct list_head del_recall_lru;
+
+        /* protected by blocked_locks_lock */
         struct list_head blocked_locks_lru;
 
         struct delayed_work laundromat_work;
@@ -91,6 +93,9 @@ struct nfsd_net {
         /* client_lock protects the client lru list and session hash table */
         spinlock_t client_lock;
 
+        /* protects blocked_locks_lru */
+        spinlock_t blocked_locks_lock;
+
         struct file *rec_file;
         bool in_grace;
         const struct nfsd4_client_tracking_ops *client_tracking_ops;
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 9752beb78659..4b4beaaa4eaa 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -217,7 +217,7 @@ find_blocked_lock(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
 {
         struct nfsd4_blocked_lock *cur, *found = NULL;
 
-        spin_lock(&nn->client_lock);
+        spin_lock(&nn->blocked_locks_lock);
         list_for_each_entry(cur, &lo->lo_blocked, nbl_list) {
                 if (fh_match(fh, &cur->nbl_fh)) {
                         list_del_init(&cur->nbl_list);
@@ -226,7 +226,7 @@ find_blocked_lock(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
                         break;
                 }
         }
-        spin_unlock(&nn->client_lock);
+        spin_unlock(&nn->blocked_locks_lock);
         if (found)
                 posix_unblock_lock(&found->nbl_lock);
         return found;
@@ -1227,9 +1227,7 @@ static void put_ol_stateid_locked(struct nfs4_ol_stateid *stp,
 
 static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
 {
-        struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
-
-        lockdep_assert_held(&oo->oo_owner.so_client->cl_lock);
+        lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
 
         list_del_init(&stp->st_locks);
         nfs4_unhash_stid(&stp->st_stid);
@@ -1238,12 +1236,12 @@ static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
 
 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
 {
-        struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
+        struct nfs4_client *clp = stp->st_stid.sc_client;
         bool unhashed;
 
-        spin_lock(&oo->oo_owner.so_client->cl_lock);
+        spin_lock(&clp->cl_lock);
         unhashed = unhash_lock_stateid(stp);
-        spin_unlock(&oo->oo_owner.so_client->cl_lock);
+        spin_unlock(&clp->cl_lock);
         if (unhashed)
                 nfs4_put_stid(&stp->st_stid);
 }
@@ -4665,7 +4663,7 @@ nfs4_laundromat(struct nfsd_net *nn)
          * indefinitely once the lock does become free.
          */
         BUG_ON(!list_empty(&reaplist));
-        spin_lock(&nn->client_lock);
+        spin_lock(&nn->blocked_locks_lock);
         while (!list_empty(&nn->blocked_locks_lru)) {
                 nbl = list_first_entry(&nn->blocked_locks_lru,
                                         struct nfsd4_blocked_lock, nbl_lru);
@@ -4678,7 +4676,7 @@ nfs4_laundromat(struct nfsd_net *nn)
                 list_move(&nbl->nbl_lru, &reaplist);
                 list_del_init(&nbl->nbl_list);
         }
-        spin_unlock(&nn->client_lock);
+        spin_unlock(&nn->blocked_locks_lock);
 
         while (!list_empty(&reaplist)) {
                 nbl = list_first_entry(&nn->blocked_locks_lru,
@@ -5439,13 +5437,13 @@ nfsd4_lm_notify(struct file_lock *fl)
         bool queue = false;
 
         /* An empty list means that something else is going to be using it */
-        spin_lock(&nn->client_lock);
+        spin_lock(&nn->blocked_locks_lock);
         if (!list_empty(&nbl->nbl_list)) {
                 list_del_init(&nbl->nbl_list);
                 list_del_init(&nbl->nbl_lru);
                 queue = true;
         }
-        spin_unlock(&nn->client_lock);
+        spin_unlock(&nn->blocked_locks_lock);
 
         if (queue)
                 nfsd4_run_cb(&nbl->nbl_cb);
@@ -5868,10 +5866,10 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 
         if (fl_flags & FL_SLEEP) {
                 nbl->nbl_time = jiffies;
-                spin_lock(&nn->client_lock);
+                spin_lock(&nn->blocked_locks_lock);
                 list_add_tail(&nbl->nbl_list, &lock_sop->lo_blocked);
                 list_add_tail(&nbl->nbl_lru, &nn->blocked_locks_lru);
-                spin_unlock(&nn->client_lock);
+                spin_unlock(&nn->blocked_locks_lock);
         }
 
         err = vfs_lock_file(filp, F_SETLK, file_lock, conflock);
@@ -5900,10 +5898,10 @@ out:
         if (nbl) {
                 /* dequeue it if we queued it before */
                 if (fl_flags & FL_SLEEP) {
-                        spin_lock(&nn->client_lock);
+                        spin_lock(&nn->blocked_locks_lock);
                         list_del_init(&nbl->nbl_list);
                         list_del_init(&nbl->nbl_lru);
-                        spin_unlock(&nn->client_lock);
+                        spin_unlock(&nn->blocked_locks_lock);
                 }
                 free_blocked_lock(nbl);
         }
@@ -6943,9 +6941,11 @@ static int nfs4_state_create_net(struct net *net)
         INIT_LIST_HEAD(&nn->client_lru);
         INIT_LIST_HEAD(&nn->close_lru);
         INIT_LIST_HEAD(&nn->del_recall_lru);
-        INIT_LIST_HEAD(&nn->blocked_locks_lru);
         spin_lock_init(&nn->client_lock);
 
+        spin_lock_init(&nn->blocked_locks_lock);
+        INIT_LIST_HEAD(&nn->blocked_locks_lru);
+
         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
         get_net(net);
 
@@ -7063,14 +7063,14 @@ nfs4_state_shutdown_net(struct net *net)
         }
 
         BUG_ON(!list_empty(&reaplist));
-        spin_lock(&nn->client_lock);
+        spin_lock(&nn->blocked_locks_lock);
         while (!list_empty(&nn->blocked_locks_lru)) {
                 nbl = list_first_entry(&nn->blocked_locks_lru,
                                         struct nfsd4_blocked_lock, nbl_lru);
                 list_move(&nbl->nbl_lru, &reaplist);
                 list_del_init(&nbl->nbl_list);
         }
-        spin_unlock(&nn->client_lock);
+        spin_unlock(&nn->blocked_locks_lock);
 
         while (!list_empty(&reaplist)) {
                 nbl = list_first_entry(&nn->blocked_locks_lru,