1 files changed, 48 insertions, 17 deletions

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 8410ca275db1..a204d7e109d4 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4903,6 +4903,32 @@ nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         return nfs_ok;
 }
 
+static __be32
+nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s)
+{
+        struct nfs4_ol_stateid *stp = openlockstateid(s);
+        __be32 ret;
+
+        mutex_lock(&stp->st_mutex);
+
+        ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
+        if (ret)
+                goto out;
+
+        ret = nfserr_locks_held;
+        if (check_for_locks(stp->st_stid.sc_file,
+                            lockowner(stp->st_stateowner)))
+                goto out;
+
+        release_lock_stateid(stp);
+        ret = nfs_ok;
+
+out:
+        mutex_unlock(&stp->st_mutex);
+        nfs4_put_stid(s);
+        return ret;
+}
+
 __be32
 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                    struct nfsd4_free_stateid *free_stateid)
@@ -4910,7 +4936,6 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         stateid_t *stateid = &free_stateid->fr_stateid;
         struct nfs4_stid *s;
         struct nfs4_delegation *dp;
-        struct nfs4_ol_stateid *stp;
         struct nfs4_client *cl = cstate->session->se_client;
         __be32 ret = nfserr_bad_stateid;
 
@@ -4929,18 +4954,9 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 ret = nfserr_locks_held;
                 break;
         case NFS4_LOCK_STID:
-                ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
-                if (ret)
-                        break;
-                stp = openlockstateid(s);
-                ret = nfserr_locks_held;
-                if (check_for_locks(stp->st_stid.sc_file,
-                                    lockowner(stp->st_stateowner)))
-                        break;
-                WARN_ON(!unhash_lock_stateid(stp));
+                atomic_inc(&s->sc_count);
                 spin_unlock(&cl->cl_lock);
-                nfs4_put_stid(s);
-                ret = nfs_ok;
+                ret = nfsd4_free_lock_stateid(stateid, s);
                 goto out;
         case NFS4_REVOKED_DELEG_STID:
                 dp = delegstateid(s);
@@ -5507,7 +5523,7 @@ static __be32
 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
                             struct nfs4_ol_stateid *ost,
                             struct nfsd4_lock *lock,
-                            struct nfs4_ol_stateid **lst, bool *new)
+                            struct nfs4_ol_stateid **plst, bool *new)
 {
         __be32 status;
         struct nfs4_file *fi = ost->st_stid.sc_file;
@@ -5515,7 +5531,9 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
         struct nfs4_client *cl = oo->oo_owner.so_client;
         struct inode *inode = d_inode(cstate->current_fh.fh_dentry);
         struct nfs4_lockowner *lo;
+        struct nfs4_ol_stateid *lst;
         unsigned int strhashval;
+        bool hashed;
 
         lo = find_lockowner_str(cl, &lock->lk_new_owner);
         if (!lo) {
@@ -5531,12 +5549,27 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
                         goto out;
         }
 
-        *lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
-        if (*lst == NULL) {
+retry:
+        lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
+        if (lst == NULL) {
                 status = nfserr_jukebox;
                 goto out;
         }
+
+        mutex_lock(&lst->st_mutex);
+
+        /* See if it's still hashed to avoid race with FREE_STATEID */
+        spin_lock(&cl->cl_lock);
+        hashed = !list_empty(&lst->st_perfile);
+        spin_unlock(&cl->cl_lock);
+
+        if (!hashed) {
+                mutex_unlock(&lst->st_mutex);
+                nfs4_put_stid(&lst->st_stid);
+                goto retry;
+        }
         status = nfs_ok;
+        *plst = lst;
 out:
         nfs4_put_stateowner(&lo->lo_owner);
         return status;
@@ -5603,8 +5636,6 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                         goto out;
                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
                                                         &lock_stp, &new);
-                if (status == nfs_ok)
-                        mutex_lock(&lock_stp->st_mutex);
         } else {
                 status = nfs4_preprocess_seqid_op(cstate,
                                        lock->lk_old_lock_seqid,