Merge git://git.linux-nfs.org/pub/linux/nfs-2.6

* git://git.linux-nfs.org/pub/linux/nfs-2.6:
  SUNRPC: Replace flush_workqueue() with cancel_work_sync() and friends
  NFS: Replace flush_scheduled_work with cancel_work_sync() and friends
  SUNRPC: Don't call gss_delete_sec_context() from an rcu context
  NFSv4: Don't call put_rpccred() from an rcu callback
  NFS: Fix NFSv4 open stateid regressions
  NFSv4: Fix a locking regression in nfs4_set_mode_locked()
  NFS: Fix put_nfs_open_context
  SUNRPC: Fix a race in rpciod_down()

6 files changed, 35 insertions, 42 deletions

diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 20ac403469a0..c55a761c22bb 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -20,10 +20,8 @@
 #include "delegation.h"
 #include "internal.h"
 
-static void nfs_free_delegation(struct nfs_delegation *delegation)
+static void nfs_do_free_delegation(struct nfs_delegation *delegation)
 {
-        if (delegation->cred)
-                put_rpccred(delegation->cred);
         kfree(delegation);
 }
 
@@ -31,7 +29,18 @@ static void nfs_free_delegation_callback(struct rcu_head *head)
 {
         struct nfs_delegation *delegation = container_of(head, struct nfs_delegation, rcu);
 
-        nfs_free_delegation(delegation);
+        nfs_do_free_delegation(delegation);
+}
+
+static void nfs_free_delegation(struct nfs_delegation *delegation)
+{
+        struct rpc_cred *cred;
+
+        cred = rcu_dereference(delegation->cred);
+        rcu_assign_pointer(delegation->cred, NULL);
+        call_rcu(&delegation->rcu, nfs_free_delegation_callback);
+        if (cred)
+                put_rpccred(cred);
 }
 
 static int nfs_delegation_claim_locks(struct nfs_open_context *ctx, struct nfs4_state *state)
@@ -166,7 +175,7 @@ static int nfs_do_return_delegation(struct inode *inode, struct nfs_delegation *
         int res = 0;
 
         res = nfs4_proc_delegreturn(inode, delegation->cred, &delegation->stateid);
-        call_rcu(&delegation->rcu, nfs_free_delegation_callback);
+        nfs_free_delegation(delegation);
         return res;
 }
 
@@ -448,7 +457,7 @@ restart:
                 spin_unlock(&clp->cl_lock);
                 rcu_read_unlock();
                 if (delegation != NULL)
-                        call_rcu(&delegation->rcu, nfs_free_delegation_callback);
+                        nfs_free_delegation(delegation);
                 goto restart;
         }
         rcu_read_unlock();
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index bca6cdcb9f0d..71a49c3acabd 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -468,7 +468,7 @@ static struct nfs_open_context *alloc_nfs_open_context(struct vfsmount *mnt, str
                 ctx->lockowner = current->files;
                 ctx->error = 0;
                 ctx->dir_cookie = 0;
-                kref_init(&ctx->kref);
+                atomic_set(&ctx->count, 1);
         }
         return ctx;
 }
@@ -476,21 +476,18 @@ static struct nfs_open_context *alloc_nfs_open_context(struct vfsmount *mnt, str
 struct nfs_open_context *get_nfs_open_context(struct nfs_open_context *ctx)
 {
         if (ctx != NULL)
-                kref_get(&ctx->kref);
+                atomic_inc(&ctx->count);
         return ctx;
 }
 
-static void nfs_free_open_context(struct kref *kref)
+void put_nfs_open_context(struct nfs_open_context *ctx)
 {
-        struct nfs_open_context *ctx = container_of(kref,
-                        struct nfs_open_context, kref);
+        struct inode *inode = ctx->path.dentry->d_inode;
 
-        if (!list_empty(&ctx->list)) {
-                struct inode *inode = ctx->path.dentry->d_inode;
-                spin_lock(&inode->i_lock);
-                list_del(&ctx->list);
-                spin_unlock(&inode->i_lock);
-        }
+        if (!atomic_dec_and_lock(&ctx->count, &inode->i_lock))
+                return;
+        list_del(&ctx->list);
+        spin_unlock(&inode->i_lock);
         if (ctx->state != NULL)
                 nfs4_close_state(&ctx->path, ctx->state, ctx->mode);
         if (ctx->cred != NULL)
@@ -500,11 +497,6 @@ static void nfs_free_open_context(struct kref *kref)
         kfree(ctx);
 }
 
-void put_nfs_open_context(struct nfs_open_context *ctx)
-{
-        kref_put(&ctx->kref, nfs_free_open_context);
-}
-
 /*
  * Ensure that mmap has a recent RPC credential for use when writing out
  * shared pages
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 7f86e65182e4..aea76d0e5fbd 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -175,10 +175,8 @@ static void nfs_expire_automounts(struct work_struct *work)
 
 void nfs_release_automount_timer(void)
 {
-        if (list_empty(&nfs_automount_list)) {
-                cancel_delayed_work(&nfs_automount_task);
-                flush_scheduled_work();
-        }
+        if (list_empty(&nfs_automount_list))
+                cancel_delayed_work_sync(&nfs_automount_task);
 }
 
 /*
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 6ca2795ccd9c..62b3ae280310 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -332,11 +332,9 @@ static int can_open_cached(struct nfs4_state *state, int mode)
         switch (mode & (FMODE_READ|FMODE_WRITE|O_EXCL)) {
                 case FMODE_READ:
                         ret |= test_bit(NFS_O_RDONLY_STATE, &state->flags) != 0;
-                        ret |= test_bit(NFS_O_RDWR_STATE, &state->flags) != 0;
                         break;
                 case FMODE_WRITE:
                         ret |= test_bit(NFS_O_WRONLY_STATE, &state->flags) != 0;
-                        ret |= test_bit(NFS_O_RDWR_STATE, &state->flags) != 0;
                         break;
                 case FMODE_READ|FMODE_WRITE:
                         ret |= test_bit(NFS_O_RDWR_STATE, &state->flags) != 0;
@@ -1260,7 +1258,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
         nfs_increment_open_seqid(task->tk_status, calldata->arg.seqid);
         switch (task->tk_status) {
                 case 0:
-                        nfs_set_open_stateid(state, &calldata->res.stateid, calldata->arg.open_flags);
+                        nfs_set_open_stateid(state, &calldata->res.stateid, 0);
                         renew_lease(server, calldata->timestamp);
                         break;
                 case -NFS4ERR_STALE_STATEID:
@@ -1286,23 +1284,19 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
                 .rpc_cred = state->owner->so_cred,
         };
         int clear_rd, clear_wr, clear_rdwr;
-        int mode;
 
         if (nfs_wait_on_sequence(calldata->arg.seqid, task) != 0)
                 return;
 
-        mode = FMODE_READ|FMODE_WRITE;
         clear_rd = clear_wr = clear_rdwr = 0;
         spin_lock(&state->owner->so_lock);
         /* Calculate the change in open mode */
         if (state->n_rdwr == 0) {
                 if (state->n_rdonly == 0) {
-                        mode &= ~FMODE_READ;
                         clear_rd |= test_and_clear_bit(NFS_O_RDONLY_STATE, &state->flags);
                         clear_rdwr |= test_and_clear_bit(NFS_O_RDWR_STATE, &state->flags);
                 }
                 if (state->n_wronly == 0) {
-                        mode &= ~FMODE_WRITE;
                         clear_wr |= test_and_clear_bit(NFS_O_WRONLY_STATE, &state->flags);
                         clear_rdwr |= test_and_clear_bit(NFS_O_RDWR_STATE, &state->flags);
                 }
@@ -1314,9 +1308,13 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
                 return;
         }
         nfs_fattr_init(calldata->res.fattr);
-        if (mode != 0)
+        if (test_bit(NFS_O_RDONLY_STATE, &state->flags) != 0) {
                 msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
-        calldata->arg.open_flags = mode;
+                calldata->arg.open_flags = FMODE_READ;
+        } else if (test_bit(NFS_O_WRONLY_STATE, &state->flags) != 0) {
+                msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
+                calldata->arg.open_flags = FMODE_WRITE;
+        }
         calldata->timestamp = jiffies;
         rpc_call_setup(task, &msg, 0);
 }
diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
index 0505ca124034..3ea352d82eba 100644
--- a/fs/nfs/nfs4renewd.c
+++ b/fs/nfs/nfs4renewd.c
@@ -127,16 +127,15 @@ nfs4_schedule_state_renewal(struct nfs_client *clp)
 void
 nfs4_renewd_prepare_shutdown(struct nfs_server *server)
 {
-        flush_scheduled_work();
+        cancel_delayed_work(&server->nfs_client->cl_renewd);
 }
 
 void
 nfs4_kill_renewd(struct nfs_client *clp)
 {
         down_read(&clp->cl_sem);
-        cancel_delayed_work(&clp->cl_renewd);
+        cancel_delayed_work_sync(&clp->cl_renewd);
         up_read(&clp->cl_sem);
-        flush_scheduled_work();
 }
 
 /*
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index e9662ba81d86..3e4adf8c8312 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -341,8 +341,6 @@ nfs4_state_set_mode_locked(struct nfs4_state *state, mode_t mode)
                 else
                         list_move_tail(&state->open_states, &state->owner->so_states);
         }
-        if (mode == 0)
-                list_del_init(&state->inode_states);
         state->state = mode;
 }
 
@@ -415,8 +413,7 @@ void nfs4_put_open_state(struct nfs4_state *state)
         if (!atomic_dec_and_lock(&state->count, &owner->so_lock))
                 return;
         spin_lock(&inode->i_lock);
-        if (!list_empty(&state->inode_states))
-                list_del(&state->inode_states);
+        list_del(&state->inode_states);
         list_del(&state->open_states);
         spin_unlock(&inode->i_lock);
         spin_unlock(&owner->so_lock);