8 files changed, 45 insertions, 23 deletions

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index aaf7bd0cbae2..d8015a03db4c 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -424,12 +424,17 @@ static int xdr_decode(nfs_readdir_descriptor_t *desc,
 static
 int nfs_same_file(struct dentry *dentry, struct nfs_entry *entry)
 {
+        struct inode *inode;
         struct nfs_inode *nfsi;
 
         if (d_really_is_negative(dentry))
                 return 0;
 
-        nfsi = NFS_I(d_inode(dentry));
+        inode = d_inode(dentry);
+        if (is_bad_inode(inode) || NFS_STALE(inode))
+                return 0;
+
+        nfsi = NFS_I(inode);
         if (entry->fattr->fileid == nfsi->fileid)
                 return 1;
         if (nfs_compare_fh(entry->fh, &nfsi->fh) == 0)
@@ -1363,7 +1368,6 @@ EXPORT_SYMBOL_GPL(nfs_dentry_operations);
 struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, unsigned int flags)
 {
         struct dentry *res;
-        struct dentry *parent;
         struct inode *inode = NULL;
         struct nfs_fh *fhandle = NULL;
         struct nfs_fattr *fattr = NULL;
@@ -1393,7 +1397,6 @@ struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, unsigned in
         if (IS_ERR(label))
                 goto out;
 
-        parent = dentry->d_parent;
         /* Protect against concurrent sillydeletes */
         trace_nfs_lookup_enter(dir, dentry, flags);
         error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr, label);
@@ -1536,9 +1539,9 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
                 err = PTR_ERR(inode);
                 trace_nfs_atomic_open_exit(dir, ctx, open_flags, err);
                 put_nfs_open_context(ctx);
+                d_drop(dentry);
                 switch (err) {
                 case -ENOENT:
-                        d_drop(dentry);
                         d_add(dentry, NULL);
                         nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
                         break;
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 979b3c4dee6a..c7326c2af2c3 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -353,10 +353,12 @@ static ssize_t nfs_direct_wait(struct nfs_direct_req *dreq)
 
         result = wait_for_completion_killable(&dreq->completion);
 
+        if (!result) {
+                result = dreq->count;
+                WARN_ON_ONCE(dreq->count < 0);
+        }
         if (!result)
                 result = dreq->error;
-        if (!result)
-                result = dreq->count;
 
 out:
         return (ssize_t) result;
@@ -386,8 +388,10 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq, bool write)
 
         if (dreq->iocb) {
                 long res = (long) dreq->error;
-                if (!res)
+                if (dreq->count != 0) {
                         res = (long) dreq->count;
+                        WARN_ON_ONCE(dreq->count < 0);
+                }
                 dreq->iocb->ki_complete(dreq->iocb, res, 0);
         }
 
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 52e7d6869e3b..dda689d7a8a7 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -282,6 +282,7 @@ nfs_init_locked(struct inode *inode, void *opaque)
         struct nfs_fattr        *fattr = desc->fattr;
 
         set_nfs_fileid(inode, fattr->fileid);
+        inode->i_mode = fattr->mode;
         nfs_copy_fh(NFS_FH(inode), desc->fh);
         return 0;
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index de97567795a5..ff416d0e24bc 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2882,12 +2882,11 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
                         call_close |= is_wronly;
                 else if (is_wronly)
                         calldata->arg.fmode |= FMODE_WRITE;
+                if (calldata->arg.fmode != (FMODE_READ|FMODE_WRITE))
+                        call_close |= is_rdwr;
         } else if (is_rdwr)
                 calldata->arg.fmode |= FMODE_READ|FMODE_WRITE;
 
-        if (calldata->arg.fmode == 0)
-                call_close |= is_rdwr;
-
         if (!nfs4_valid_open_stateid(state))
                 call_close = 0;
         spin_unlock(&state->owner->so_lock);
@@ -7924,8 +7923,8 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                         break;
                 }
                 lo = NFS_I(inode)->layout;
-                if (lo && nfs4_stateid_match(&lgp->args.stateid,
-                                        &lo->plh_stateid)) {
+                if (lo && !test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) &&
+                    nfs4_stateid_match_other(&lgp->args.stateid, &lo->plh_stateid)) {
                         LIST_HEAD(head);
 
                         /*
@@ -7936,10 +7935,10 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                         pnfs_mark_matching_lsegs_invalid(lo, &head, NULL, 0);
                         spin_unlock(&inode->i_lock);
                         pnfs_free_lseg_list(&head);
+                        status = -EAGAIN;
+                        goto out;
                 } else
                         spin_unlock(&inode->i_lock);
-                status = -EAGAIN;
-                goto out;
         }
 
         status = nfs4_handle_exception(server, status, exception);
@@ -8036,7 +8035,10 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout, gfp_t gfp_flags)
                 .flags = RPC_TASK_ASYNC,
         };
         struct pnfs_layout_segment *lseg = NULL;
-        struct nfs4_exception exception = { .timeout = *timeout };
+        struct nfs4_exception exception = {
+                .inode = inode,
+                .timeout = *timeout,
+        };
         int status = 0;
 
         dprintk("--> %s\n", __func__);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 9679f4749364..834b875900d6 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1488,9 +1488,9 @@ restart:
                                         }
                                         spin_unlock(&state->state_lock);
                                 }
-                                nfs4_put_open_state(state);
                                 clear_bit(NFS_STATE_RECLAIM_NOGRACE,
                                         &state->flags);
+                                nfs4_put_open_state(state);
                                 spin_lock(&sp->so_lock);
                                 goto restart;
                         }
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 0c7e0d45a4de..0fbe734cc38c 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -361,8 +361,10 @@ pnfs_layout_remove_lseg(struct pnfs_layout_hdr *lo,
         list_del_init(&lseg->pls_list);
         /* Matched by pnfs_get_layout_hdr in pnfs_layout_insert_lseg */
         atomic_dec(&lo->plh_refcount);
-        if (list_empty(&lo->plh_segs))
+        if (list_empty(&lo->plh_segs)) {
+                set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
                 clear_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags);
+        }
         rpc_wake_up(&NFS_SERVER(inode)->roc_rpcwaitq);
 }
 
@@ -1290,6 +1292,7 @@ alloc_init_layout_hdr(struct inode *ino,
         INIT_LIST_HEAD(&lo->plh_bulk_destroy);
         lo->plh_inode = ino;
         lo->plh_lc_cred = get_rpccred(ctx->cred);
+        lo->plh_flags |= 1 << NFS_LAYOUT_INVALID_STID;
         return lo;
 }
 
@@ -1297,6 +1300,8 @@ static struct pnfs_layout_hdr *
 pnfs_find_alloc_layout(struct inode *ino,
                        struct nfs_open_context *ctx,
                        gfp_t gfp_flags)
+        __releases(&ino->i_lock)
+        __acquires(&ino->i_lock)
 {
         struct nfs_inode *nfsi = NFS_I(ino);
         struct pnfs_layout_hdr *new = NULL;
@@ -1565,8 +1570,7 @@ lookup_again:
          * stateid, or it has been invalidated, then we must use the open
          * stateid.
          */
-        if (lo->plh_stateid.seqid == 0 ||
-            test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags)) {
+        if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags)) {
 
                 /*
                  * The first layoutget for the file. Need to serialize per
diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index 0dfc476da3e1..b38e3c0dc790 100644
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -247,7 +247,11 @@ void pnfs_fetch_commit_bucket_list(struct list_head *pages,
 }
 
 /* Helper function for pnfs_generic_commit_pagelist to catch an empty
- * page list. This can happen when two commits race. */
+ * page list. This can happen when two commits race.
+ *
+ * This must be called instead of nfs_init_commit - call one or the other, but
+ * not both!
+ */
 static bool
 pnfs_generic_commit_cancel_empty_pagelist(struct list_head *pages,
                                           struct nfs_commit_data *data,
@@ -256,7 +260,11 @@ pnfs_generic_commit_cancel_empty_pagelist(struct list_head *pages,
         if (list_empty(pages)) {
                 if (atomic_dec_and_test(&cinfo->mds->rpcs_out))
                         wake_up_atomic_t(&cinfo->mds->rpcs_out);
-                nfs_commitdata_release(data);
+                /* don't call nfs_commitdata_release - it tries to put
+                 * the open_context which is not acquired until nfs_init_commit
+                 * which has not been called on @data */
+                WARN_ON_ONCE(data->context);
+                nfs_commit_free(data);
                 return true;
         }
 
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 6776d7a7839e..572e5b3b06f1 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -367,13 +367,13 @@ readpage_async_filler(void *data, struct page *page)
                 nfs_list_remove_request(new);
                 nfs_readpage_release(new);
                 error = desc->pgio->pg_error;
-                goto out_unlock;
+                goto out;
         }
         return 0;
 out_error:
         error = PTR_ERR(new);
-out_unlock:
         unlock_page(page);
+out:
         return error;
 }