13 files changed, 144 insertions, 74 deletions

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 909dc0c31aab..6e5c824b040b 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -192,17 +192,23 @@ gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct
         const void *q;
         unsigned int seclen;
         unsigned int timeout;
+        unsigned long now = jiffies;
         u32 window_size;
         int ret;
 
-        /* First unsigned int gives the lifetime (in seconds) of the cred */
+        /* First unsigned int gives the remaining lifetime in seconds of the
+         * credential - e.g. the remaining TGT lifetime for Kerberos or
+         * the -t value passed to GSSD.
+         */
         p = simple_get_bytes(p, end, &timeout, sizeof(timeout));
         if (IS_ERR(p))
                 goto err;
         if (timeout == 0)
                 timeout = GSSD_MIN_TIMEOUT;
-        ctx->gc_expiry = jiffies + (unsigned long)timeout * HZ * 3 / 4;
-        /* Sequence number window. Determines the maximum number of simultaneous requests */
+        ctx->gc_expiry = now + ((unsigned long)timeout * HZ);
+        /* Sequence number window. Determines the maximum number of
+         * simultaneous requests
+         */
         p = simple_get_bytes(p, end, &window_size, sizeof(window_size));
         if (IS_ERR(p))
                 goto err;
@@ -237,9 +243,12 @@ gss_fill_context(const void *p, const void *end, struct gss_cl_ctx *ctx, struct
                 p = ERR_PTR(ret);
                 goto err;
         }
+        dprintk("RPC:       %s Success. gc_expiry %lu now %lu timeout %u\n",
+                __func__, ctx->gc_expiry, now, timeout);
         return q;
 err:
-        dprintk("RPC:       %s returning %ld\n", __func__, -PTR_ERR(p));
+        dprintk("RPC:       %s returns %ld gc_expiry %lu now %lu timeout %u\n",
+                __func__, -PTR_ERR(p), ctx->gc_expiry, now, timeout);
         return p;
 }
 
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index a9c0bbccad6b..890a29912d5a 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -59,7 +59,7 @@ static void xprt_free_allocation(struct rpc_rqst *req)
         struct xdr_buf *xbufp;
 
         dprintk("RPC:        free allocations for req= %p\n", req);
-        BUG_ON(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
+        WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
         xbufp = &req->rq_private_buf;
         free_page((unsigned long)xbufp->head[0].iov_base);
         xbufp = &req->rq_snd_buf;
@@ -191,7 +191,9 @@ void xprt_destroy_backchannel(struct rpc_xprt *xprt, unsigned int max_reqs)
 
         dprintk("RPC:        destroy backchannel transport\n");
 
-        BUG_ON(max_reqs == 0);
+        if (max_reqs == 0)
+                goto out;
+
         spin_lock_bh(&xprt->bc_pa_lock);
         xprt_dec_alloc_count(xprt, max_reqs);
         list_for_each_entry_safe(req, tmp, &xprt->bc_pa_list, rq_bc_pa_list) {
@@ -202,6 +204,7 @@ void xprt_destroy_backchannel(struct rpc_xprt *xprt, unsigned int max_reqs)
         }
         spin_unlock_bh(&xprt->bc_pa_lock);
 
+out:
         dprintk("RPC:        backchannel list empty= %s\n",
                 list_empty(&xprt->bc_pa_list) ? "true" : "false");
 }
@@ -255,7 +258,7 @@ void xprt_free_bc_request(struct rpc_rqst *req)
         dprintk("RPC:       free backchannel req=%p\n", req);
 
         smp_mb__before_clear_bit();
-        BUG_ON(!test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
+        WARN_ON_ONCE(!test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
         clear_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
         smp_mb__after_clear_bit();
 
diff --git a/net/sunrpc/bc_svc.c b/net/sunrpc/bc_svc.c
index 0b2eb388cbda..15c7a8a1c24f 100644
--- a/net/sunrpc/bc_svc.c
+++ b/net/sunrpc/bc_svc.c
@@ -53,7 +53,7 @@ int bc_send(struct rpc_rqst *req)
         if (IS_ERR(task))
                 ret = PTR_ERR(task);
         else {
-                BUG_ON(atomic_read(&task->tk_count) != 1);
+                WARN_ON_ONCE(atomic_read(&task->tk_count) != 1);
                 ret = task->tk_status;
                 rpc_put_task(task);
         }
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index fc2f7aa4dca7..9afa4393c217 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -775,11 +775,11 @@ static ssize_t cache_read(struct file *filp, char __user *buf, size_t count,
         if (rp->q.list.next == &cd->queue) {
                 spin_unlock(&queue_lock);
                 mutex_unlock(&inode->i_mutex);
-                BUG_ON(rp->offset);
+                WARN_ON_ONCE(rp->offset);
                 return 0;
         }
         rq = container_of(rp->q.list.next, struct cache_request, q.list);
-        BUG_ON(rq->q.reader);
+        WARN_ON_ONCE(rq->q.reader);
         if (rp->offset == 0)
                 rq->readers++;
         spin_unlock(&queue_lock);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index cdc7564b4512..822f020fa7f4 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -132,8 +132,10 @@ static struct dentry *rpc_setup_pipedir_sb(struct super_block *sb,
         int error;
 
         dir = rpc_d_lookup_sb(sb, dir_name);
-        if (dir == NULL)
+        if (dir == NULL) {
+                pr_info("RPC: pipefs directory doesn't exist: %s\n", dir_name);
                 return dir;
+        }
         for (;;) {
                 q.len = snprintf(name, sizeof(name), "clnt%x", (unsigned int)clntid++);
                 name[sizeof(name) - 1] = '\0';
@@ -192,7 +194,8 @@ static int __rpc_clnt_handle_event(struct rpc_clnt *clnt, unsigned long event,
         case RPC_PIPEFS_MOUNT:
                 dentry = rpc_setup_pipedir_sb(sb, clnt,
                                               clnt->cl_program->pipe_dir_name);
-                BUG_ON(dentry == NULL);
+                if (!dentry)
+                        return -ENOENT;
                 if (IS_ERR(dentry))
                         return PTR_ERR(dentry);
                 clnt->cl_dentry = dentry;
@@ -234,7 +237,7 @@ static struct rpc_clnt *rpc_get_client_for_event(struct net *net, int event)
         spin_lock(&sn->rpc_client_lock);
         list_for_each_entry(clnt, &sn->all_clients, cl_clients) {
                 if (clnt->cl_program->pipe_dir_name == NULL)
-                        break;
+                        continue;
                 if (rpc_clnt_skip_event(clnt, event))
                         continue;
                 if (atomic_inc_not_zero(&clnt->cl_count) == 0)
@@ -607,6 +610,13 @@ EXPORT_SYMBOL_GPL(rpc_killall_tasks);
  */
 void rpc_shutdown_client(struct rpc_clnt *clnt)
 {
+        /*
+         * To avoid deadlock, never call rpc_shutdown_client from a
+         * workqueue context!
+         */
+        WARN_ON_ONCE(current->flags & PF_WQ_WORKER);
+        might_sleep();
+
         dprintk_rcu("RPC:       shutting down %s client for %s\n",
                         clnt->cl_protname,
                         rcu_dereference(clnt->cl_xprt)->servername);
@@ -693,21 +703,19 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old,
                                       const struct rpc_program *program,
                                       u32 vers)
 {
+        struct rpc_create_args args = {
+                .program        = program,
+                .prognumber     = program->number,
+                .version        = vers,
+                .authflavor     = old->cl_auth->au_flavor,
+                .client_name    = old->cl_principal,
+        };
         struct rpc_clnt *clnt;
-        const struct rpc_version *version;
         int err;
 
-        BUG_ON(vers >= program->nrvers || !program->version[vers]);
-        version = program->version[vers];
-        clnt = rpc_clone_client(old);
+        clnt = __rpc_clone_client(&args, old);
         if (IS_ERR(clnt))
                 goto out;
-        clnt->cl_procinfo = version->procs;
-        clnt->cl_maxproc  = version->nrprocs;
-        clnt->cl_protname = program->name;
-        clnt->cl_prog     = program->number;
-        clnt->cl_vers     = version->number;
-        clnt->cl_stats    = program->stats;
         err = rpc_ping(clnt);
         if (err != 0) {
                 rpc_shutdown_client(clnt);
@@ -832,7 +840,12 @@ int rpc_call_sync(struct rpc_clnt *clnt, const struct rpc_message *msg, int flag
         };
         int status;
 
-        BUG_ON(flags & RPC_TASK_ASYNC);
+        WARN_ON_ONCE(flags & RPC_TASK_ASYNC);
+        if (flags & RPC_TASK_ASYNC) {
+                rpc_release_calldata(task_setup_data.callback_ops,
+                        task_setup_data.callback_data);
+                return -EINVAL;
+        }
 
         task = rpc_run_task(&task_setup_data);
         if (IS_ERR(task))
@@ -908,7 +921,7 @@ struct rpc_task *rpc_run_bc_task(struct rpc_rqst *req,
 
         task->tk_action = call_bc_transmit;
         atomic_inc(&task->tk_count);
-        BUG_ON(atomic_read(&task->tk_count) != 2);
+        WARN_ON_ONCE(atomic_read(&task->tk_count) != 2);
         rpc_execute(task);
 
 out:
@@ -1368,6 +1381,7 @@ call_refreshresult(struct rpc_task *task)
                 return;
         case -ETIMEDOUT:
                 rpc_delay(task, 3*HZ);
+        case -EKEYEXPIRED:
         case -EAGAIN:
                 status = -EACCES;
                 if (!task->tk_cred_retry)
@@ -1654,7 +1668,6 @@ call_transmit(struct rpc_task *task)
         task->tk_action = call_transmit_status;
         /* Encode here so that rpcsec_gss can use correct sequence number. */
         if (rpc_task_need_encode(task)) {
-                BUG_ON(task->tk_rqstp->rq_bytes_sent != 0);
                 rpc_xdr_encode(task);
                 /* Did the encode result in an error condition? */
                 if (task->tk_status != 0) {
@@ -1738,7 +1751,6 @@ call_bc_transmit(struct rpc_task *task)
 {
         struct rpc_rqst *req = task->tk_rqstp;
 
-        BUG_ON(task->tk_status != 0);
         task->tk_status = xprt_prepare_transmit(task);
         if (task->tk_status == -EAGAIN) {
                 /*
@@ -1785,7 +1797,7 @@ call_bc_transmit(struct rpc_task *task)
                  * We were unable to reply and will have to drop the
                  * request.  The server should reconnect and retransmit.
                  */
-                BUG_ON(task->tk_status == -EAGAIN);
+                WARN_ON_ONCE(task->tk_status == -EAGAIN);
                 printk(KERN_NOTICE "RPC: Could not send backchannel reply "
                         "error: %d\n", task->tk_status);
                 break;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 80f5dd23417d..fd10981ea792 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -1093,7 +1093,7 @@ void rpc_put_sb_net(const struct net *net)
 {
         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 
-        BUG_ON(sn->pipefs_sb == NULL);
+        WARN_ON(sn->pipefs_sb == NULL);
         mutex_unlock(&sn->pipefs_sb_lock);
 }
 EXPORT_SYMBOL_GPL(rpc_put_sb_net);
@@ -1152,14 +1152,19 @@ static void rpc_kill_sb(struct super_block *sb)
         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 
         mutex_lock(&sn->pipefs_sb_lock);
+        if (sn->pipefs_sb != sb) {
+                mutex_unlock(&sn->pipefs_sb_lock);
+                goto out;
+        }
         sn->pipefs_sb = NULL;
         mutex_unlock(&sn->pipefs_sb_lock);
-        put_net(net);
         dprintk("RPC:       sending pipefs UMOUNT notification for net %p%s\n",
                 net, NET_NAME(net));
         blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
                                            RPC_PIPEFS_UMOUNT,
                                            sb);
+        put_net(net);
+out:
         kill_litter_super(sb);
 }
 
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index a70acae496e4..411f332de0b3 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -884,7 +884,10 @@ static void encode_rpcb_string(struct xdr_stream *xdr, const char *string,
         u32 len;
 
         len = strlen(string);
-        BUG_ON(len > maxstrlen);
+        WARN_ON_ONCE(len > maxstrlen);
+        if (len > maxstrlen)
+                /* truncate and hope for the best */
+                len = maxstrlen;
         p = xdr_reserve_space(xdr, 4 + len);
         xdr_encode_opaque(p, string, len);
 }
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 6357fcb00c7e..d17a704aaf5f 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -98,6 +98,23 @@ __rpc_add_timer(struct rpc_wait_queue *queue, struct rpc_task *task)
         list_add(&task->u.tk_wait.timer_list, &queue->timer_list.list);
 }
 
+static void rpc_set_waitqueue_priority(struct rpc_wait_queue *queue, int priority)
+{
+        queue->priority = priority;
+}
+
+static void rpc_set_waitqueue_owner(struct rpc_wait_queue *queue, pid_t pid)
+{
+        queue->owner = pid;
+        queue->nr = RPC_BATCH_COUNT;
+}
+
+static void rpc_reset_waitqueue_priority(struct rpc_wait_queue *queue)
+{
+        rpc_set_waitqueue_priority(queue, queue->maxpriority);
+        rpc_set_waitqueue_owner(queue, 0);
+}
+
 /*
  * Add new request to a priority queue.
  */
@@ -109,9 +126,11 @@ static void __rpc_add_wait_queue_priority(struct rpc_wait_queue *queue,
         struct rpc_task *t;
 
         INIT_LIST_HEAD(&task->u.tk_wait.links);
-        q = &queue->tasks[queue_priority];
         if (unlikely(queue_priority > queue->maxpriority))
-                q = &queue->tasks[queue->maxpriority];
+                queue_priority = queue->maxpriority;
+        if (queue_priority > queue->priority)
+                rpc_set_waitqueue_priority(queue, queue_priority);
+        q = &queue->tasks[queue_priority];
         list_for_each_entry(t, q, u.tk_wait.list) {
                 if (t->tk_owner == task->tk_owner) {
                         list_add_tail(&task->u.tk_wait.list, &t->u.tk_wait.links);
@@ -133,7 +152,9 @@ static void __rpc_add_wait_queue(struct rpc_wait_queue *queue,
                 struct rpc_task *task,
                 unsigned char queue_priority)
 {
-        BUG_ON (RPC_IS_QUEUED(task));
+        WARN_ON_ONCE(RPC_IS_QUEUED(task));
+        if (RPC_IS_QUEUED(task))
+                return;
 
         if (RPC_IS_PRIORITY(queue))
                 __rpc_add_wait_queue_priority(queue, task, queue_priority);
@@ -178,24 +199,6 @@ static void __rpc_remove_wait_queue(struct rpc_wait_queue *queue, struct rpc_tas
                         task->tk_pid, queue, rpc_qname(queue));
 }
 
-static inline void rpc_set_waitqueue_priority(struct rpc_wait_queue *queue, int priority)
-{
-        queue->priority = priority;
-        queue->count = 1 << (priority * 2);
-}
-
-static inline void rpc_set_waitqueue_owner(struct rpc_wait_queue *queue, pid_t pid)
-{
-        queue->owner = pid;
-        queue->nr = RPC_BATCH_COUNT;
-}
-
-static inline void rpc_reset_waitqueue_priority(struct rpc_wait_queue *queue)
-{
-        rpc_set_waitqueue_priority(queue, queue->maxpriority);
-        rpc_set_waitqueue_owner(queue, 0);
-}
-
 static void __rpc_init_priority_wait_queue(struct rpc_wait_queue *queue, const char *qname, unsigned char nr_queues)
 {
         int i;
@@ -334,7 +337,7 @@ static void __rpc_sleep_on_priority(struct rpc_wait_queue *q,
 
         __rpc_add_wait_queue(q, task, queue_priority);
 
-        BUG_ON(task->tk_callback != NULL);
+        WARN_ON_ONCE(task->tk_callback != NULL);
         task->tk_callback = action;
         __rpc_add_timer(q, task);
 }
@@ -343,7 +346,12 @@ void rpc_sleep_on(struct rpc_wait_queue *q, struct rpc_task *task,
                                 rpc_action action)
 {
         /* We shouldn't ever put an inactive task to sleep */
-        BUG_ON(!RPC_IS_ACTIVATED(task));
+        WARN_ON_ONCE(!RPC_IS_ACTIVATED(task));
+        if (!RPC_IS_ACTIVATED(task)) {
+                task->tk_status = -EIO;
+                rpc_put_task_async(task);
+                return;
+        }
 
         /*
          * Protect the queue operations.
@@ -358,7 +366,12 @@ void rpc_sleep_on_priority(struct rpc_wait_queue *q, struct rpc_task *task,
                 rpc_action action, int priority)
 {
         /* We shouldn't ever put an inactive task to sleep */
-        BUG_ON(!RPC_IS_ACTIVATED(task));
+        WARN_ON_ONCE(!RPC_IS_ACTIVATED(task));
+        if (!RPC_IS_ACTIVATED(task)) {
+                task->tk_status = -EIO;
+                rpc_put_task_async(task);
+                return;
+        }
 
         /*
          * Protect the queue operations.
@@ -367,6 +380,7 @@ void rpc_sleep_on_priority(struct rpc_wait_queue *q, struct rpc_task *task,
         __rpc_sleep_on_priority(q, task, action, priority - RPC_PRIORITY_LOW);
         spin_unlock_bh(&q->lock);
 }
+EXPORT_SYMBOL_GPL(rpc_sleep_on_priority);
 
 /**
  * __rpc_do_wake_up_task - wake up a single rpc_task
@@ -451,8 +465,7 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
                 /*
                  * Check if we need to switch queues.
                  */
-                if (--queue->count)
-                        goto new_owner;
+                goto new_owner;
         }
 
         /*
@@ -697,7 +710,9 @@ static void __rpc_execute(struct rpc_task *task)
         dprintk("RPC: %5u __rpc_execute flags=0x%x\n",
                         task->tk_pid, task->tk_flags);
 
-        BUG_ON(RPC_IS_QUEUED(task));
+        WARN_ON_ONCE(RPC_IS_QUEUED(task));
+        if (RPC_IS_QUEUED(task))
+                return;
 
         for (;;) {
                 void (*do_action)(struct rpc_task *);
@@ -981,7 +996,7 @@ static void rpc_release_task(struct rpc_task *task)
 {
         dprintk("RPC: %5u release task\n", task->tk_pid);
 
-        BUG_ON (RPC_IS_QUEUED(task));
+        WARN_ON_ONCE(RPC_IS_QUEUED(task));
 
         rpc_release_resources_task(task);
 
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 3ee7461926d8..dfa4ba69ff45 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -324,7 +324,9 @@ svc_pool_map_set_cpumask(struct task_struct *task, unsigned int pidx)
          * The caller checks for sv_nrpools > 1, which
          * implies that we've been initialized.
          */
-        BUG_ON(m->count == 0);
+        WARN_ON_ONCE(m->count == 0);
+        if (m->count == 0)
+                return;
 
         switch (m->mode) {
         case SVC_POOL_PERCPU:
@@ -585,7 +587,9 @@ svc_init_buffer(struct svc_rqst *rqstp, unsigned int size, int node)
                                        * We assume one is at most one page
                                        */
         arghi = 0;
-        BUG_ON(pages > RPCSVC_MAXPAGES);
+        WARN_ON_ONCE(pages > RPCSVC_MAXPAGES);
+        if (pages > RPCSVC_MAXPAGES)
+                pages = RPCSVC_MAXPAGES;
         while (pages) {
                 struct page *p = alloc_pages_node(node, GFP_KERNEL, 0);
                 if (!p)
@@ -946,7 +950,9 @@ int svc_register(const struct svc_serv *serv, struct net *net,
         unsigned int            i;
         int                     error = 0;
 
-        BUG_ON(proto == 0 && port == 0);
+        WARN_ON_ONCE(proto == 0 && port == 0);
+        if (proto == 0 && port == 0)
+                return -EINVAL;
 
         for (progp = serv->sv_program; progp; progp = progp->pg_next) {
                 for (i = 0; i < progp->pg_nvers; i++) {
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 194d865fae72..b8e47fac7315 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -218,7 +218,9 @@ static struct svc_xprt *__svc_xpo_create(struct svc_xprt_class *xcl,
  */
 static void svc_xprt_received(struct svc_xprt *xprt)
 {
-        BUG_ON(!test_bit(XPT_BUSY, &xprt->xpt_flags));
+        WARN_ON_ONCE(!test_bit(XPT_BUSY, &xprt->xpt_flags));
+        if (!test_bit(XPT_BUSY, &xprt->xpt_flags))
+                return;
         /* As soon as we clear busy, the xprt could be closed and
          * 'put', so we need a reference to call svc_xprt_enqueue with:
          */
@@ -577,7 +579,10 @@ int svc_alloc_arg(struct svc_rqst *rqstp)
 
         /* now allocate needed pages.  If we get a failure, sleep briefly */
         pages = (serv->sv_max_mesg + PAGE_SIZE) / PAGE_SIZE;
-        BUG_ON(pages >= RPCSVC_MAXPAGES);
+        WARN_ON_ONCE(pages >= RPCSVC_MAXPAGES);
+        if (pages >= RPCSVC_MAXPAGES)
+                /* use as many pages as possible */
+                pages = RPCSVC_MAXPAGES - 1;
         for (i = 0; i < pages ; i++)
                 while (rqstp->rq_pages[i] == NULL) {
                         struct page *p = alloc_page(GFP_KERNEL);
@@ -926,7 +931,7 @@ static void svc_delete_xprt(struct svc_xprt *xprt)
         spin_lock_bh(&serv->sv_lock);
         if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
                 list_del_init(&xprt->xpt_list);
-        BUG_ON(!list_empty(&xprt->xpt_ready));
+        WARN_ON_ONCE(!list_empty(&xprt->xpt_ready));
         if (test_bit(XPT_TEMP, &xprt->xpt_flags))
                 serv->sv_tmpcnt--;
         spin_unlock_bh(&serv->sv_lock);
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 03827cef1fa7..cc3020d16789 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -84,7 +84,11 @@ static struct lock_class_key svc_slock_key[2];
 static void svc_reclassify_socket(struct socket *sock)
 {
         struct sock *sk = sock->sk;
-        BUG_ON(sock_owned_by_user(sk));
+
+        WARN_ON_ONCE(sock_owned_by_user(sk));
+        if (sock_owned_by_user(sk))
+                return;
+
         switch (sk->sk_family) {
         case AF_INET:
                 sock_lock_init_class_and_name(sk, "slock-AF_INET-NFSD",
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 08f50afd5f2a..56055632f151 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -318,7 +318,10 @@ xdr_shrink_bufhead(struct xdr_buf *buf, size_t len)
 
         tail = buf->tail;
         head = buf->head;
-        BUG_ON (len > head->iov_len);
+
+        WARN_ON_ONCE(len > head->iov_len);
+        if (len > head->iov_len)
+                len = head->iov_len;
 
         /* Shift the tail first */
         if (tail->iov_len != 0) {
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 75853cabf4c9..68b0a81c31d5 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1746,7 +1746,6 @@ static inline void xs_reclassify_socketu(struct socket *sock)
 {
         struct sock *sk = sock->sk;
 
-        BUG_ON(sock_owned_by_user(sk));
         sock_lock_init_class_and_name(sk, "slock-AF_LOCAL-RPC",
                 &xs_slock_key[1], "sk_lock-AF_LOCAL-RPC", &xs_key[1]);
 }
@@ -1755,7 +1754,6 @@ static inline void xs_reclassify_socket4(struct socket *sock)
 {
         struct sock *sk = sock->sk;
 
-        BUG_ON(sock_owned_by_user(sk));
         sock_lock_init_class_and_name(sk, "slock-AF_INET-RPC",
                 &xs_slock_key[0], "sk_lock-AF_INET-RPC", &xs_key[0]);
 }
@@ -1764,13 +1762,16 @@ static inline void xs_reclassify_socket6(struct socket *sock)
 {
         struct sock *sk = sock->sk;
 
-        BUG_ON(sock_owned_by_user(sk));
         sock_lock_init_class_and_name(sk, "slock-AF_INET6-RPC",
                 &xs_slock_key[1], "sk_lock-AF_INET6-RPC", &xs_key[1]);
 }
 
 static inline void xs_reclassify_socket(int family, struct socket *sock)
 {
+        WARN_ON_ONCE(sock_owned_by_user(sock->sk));
+        if (sock_owned_by_user(sock->sk))
+                return;
+
         switch (family) {
         case AF_LOCAL:
                 xs_reclassify_socketu(sock);
@@ -1901,6 +1902,10 @@ static void xs_local_setup_socket(struct work_struct *work)
                 dprintk("RPC:       xprt %p: socket %s does not exist\n",
                                 xprt, xprt->address_strings[RPC_DISPLAY_ADDR]);
                 break;
+        case -ECONNREFUSED:
+                dprintk("RPC:       xprt %p: connection refused for %s\n",
+                                xprt, xprt->address_strings[RPC_DISPLAY_ADDR]);
+                break;
         default:
                 printk(KERN_ERR "%s: unhandled error (%d) connecting to %s\n",
                                 __func__, -status,
@@ -2329,9 +2334,11 @@ static void *bc_malloc(struct rpc_task *task, size_t size)
         struct page *page;
         struct rpc_buffer *buf;
 
-        BUG_ON(size > PAGE_SIZE - sizeof(struct rpc_buffer));
-        page = alloc_page(GFP_KERNEL);
+        WARN_ON_ONCE(size > PAGE_SIZE - sizeof(struct rpc_buffer));
+        if (size > PAGE_SIZE - sizeof(struct rpc_buffer))
+                return NULL;
 
+        page = alloc_page(GFP_KERNEL);
         if (!page)
                 return NULL;
 
@@ -2393,7 +2400,6 @@ static int bc_send_request(struct rpc_task *task)
 {
         struct rpc_rqst *req = task->tk_rqstp;
         struct svc_xprt *xprt;
-        struct svc_sock         *svsk;
         u32                     len;
 
         dprintk("sending request with xid: %08x\n", ntohl(req->rq_xid));
@@ -2401,7 +2407,6 @@ static int bc_send_request(struct rpc_task *task)
          * Get the server socket associated with this callback xprt
          */
         xprt = req->rq_xprt->bc_xprt;
-        svsk = container_of(xprt, struct svc_sock, sk_xprt);
 
         /*
          * Grab the mutex to serialize data as the connection is shared