Merge branch 'hotfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6

* 'hotfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:
  NFS: Fix dentry revalidation for NFSv4 referrals and mountpoint crossings
  NFS: Fix the fsid revalidation in nfs_update_inode()
  SUNRPC: Fix a nfs4 over rdma transport oops
  NFS: Fix an f_mode/f_flags confusion in fs/nfs/write.c

5 files changed, 13 insertions, 4 deletions

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index ae04892a5e5d..6cea7479c5b4 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -710,6 +710,8 @@ int nfs_lookup_verify_inode(struct inode *inode, struct nameidata *nd)
 {
         struct nfs_server *server = NFS_SERVER(inode);
 
+        if (test_bit(NFS_INO_MOUNTPOINT, &NFS_I(inode)->flags))
+                return 0;
         if (nd != NULL) {
                 /* VFS wants an on-the-wire revalidation */
                 if (nd->flags & LOOKUP_REVAL)
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 966a8850aa30..a4c7cf2bff3a 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -299,6 +299,7 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr)
                                 else
                                         inode->i_op = &nfs_mountpoint_inode_operations;
                                 inode->i_fop = NULL;
+                                set_bit(NFS_INO_MOUNTPOINT, &nfsi->flags);
                         }
                 } else if (S_ISLNK(inode->i_mode))
                         inode->i_op = &nfs_symlink_inode_operations;
@@ -1003,8 +1004,9 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 
         server = NFS_SERVER(inode);
         /* Update the fsid? */
-        if (S_ISDIR(inode->i_mode)
-                        && !nfs_fsid_equal(&server->fsid, &fattr->fsid))
+        if (S_ISDIR(inode->i_mode) &&
+                        !nfs_fsid_equal(&server->fsid, &fattr->fsid) &&
+                        !test_bit(NFS_INO_MOUNTPOINT, &nfsi->flags))
                 server->fsid = fattr->fsid;
 
         /*
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index f55c437124a2..80c61fdb2720 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -734,7 +734,7 @@ int nfs_updatepage(struct file *file, struct page *page,
          */
         if (nfs_write_pageuptodate(page, inode) &&
                         inode->i_flock == NULL &&
-                        !(file->f_mode & O_SYNC)) {
+                        !(file->f_flags & O_SYNC)) {
                 count = max(count + offset, nfs_page_length(page));
                 offset = 0;
         }
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index a69ba80f2dfe..f4a0e4c218df 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -195,6 +195,7 @@ struct nfs_inode {
 #define NFS_INO_ADVISE_RDPLUS   (1)             /* advise readdirplus */
 #define NFS_INO_STALE           (2)             /* possible stale inode */
 #define NFS_INO_ACL_LRU_SET     (3)             /* Inode is on the LRU list */
+#define NFS_INO_MOUNTPOINT      (4)             /* inode is remote mountpoint */
 
 static inline struct nfs_inode *NFS_I(const struct inode *inode)
 {
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 02c522c17de5..a564c1a39ec5 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -614,7 +614,11 @@ xprt_rdma_free(void *buffer)
                 return;
 
         req = container_of(buffer, struct rpcrdma_req, rl_xdr_buf[0]);
-        r_xprt = container_of(req->rl_buffer, struct rpcrdma_xprt, rx_buf);
+        if (req->rl_iov.length == 0) {  /* see allocate above */
+                r_xprt = container_of(((struct rpcrdma_req *) req->rl_buffer)->rl_buffer,
+                                      struct rpcrdma_xprt, rx_buf);
+        } else
+                r_xprt = container_of(req->rl_buffer, struct rpcrdma_xprt, rx_buf);
         rep = req->rl_reply;
 
         dprintk("RPC:       %s: called on 0x%p%s\n",