Merge git://git.linux-nfs.org/pub/linux/nfs-2.6

* git://git.linux-nfs.org/pub/linux/nfs-2.6:
  SUNRPC: Replace flush_workqueue() with cancel_work_sync() and friends
  NFS: Replace flush_scheduled_work with cancel_work_sync() and friends
  SUNRPC: Don't call gss_delete_sec_context() from an rcu context
  NFSv4: Don't call put_rpccred() from an rcu callback
  NFS: Fix NFSv4 open stateid regressions
  NFSv4: Fix a locking regression in nfs4_set_mode_locked()
  NFS: Fix put_nfs_open_context
  SUNRPC: Fix a race in rpciod_down()

4 files changed, 31 insertions, 41 deletions

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 4bbc59cc237c..53995af9ca4b 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -736,9 +736,6 @@ gss_do_free_ctx(struct gss_cl_ctx *ctx)
 {
         dprintk("RPC:       gss_free_ctx\n");
 
-        if (ctx->gc_gss_ctx)
-                gss_delete_sec_context(&ctx->gc_gss_ctx);
-
         kfree(ctx->gc_wire_ctx.data);
         kfree(ctx);
 }
@@ -753,7 +750,13 @@ gss_free_ctx_callback(struct rcu_head *head)
 static void
 gss_free_ctx(struct gss_cl_ctx *ctx)
 {
+        struct gss_ctx *gc_gss_ctx;
+
+        gc_gss_ctx = rcu_dereference(ctx->gc_gss_ctx);
+        rcu_assign_pointer(ctx->gc_gss_ctx, NULL);
         call_rcu(&ctx->gc_rcu, gss_free_ctx_callback);
+        if (gc_gss_ctx)
+                gss_delete_sec_context(&gc_gss_ctx);
 }
 
 static void
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 01c3c4105204..ebe344f34d1a 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -371,8 +371,7 @@ int cache_unregister(struct cache_detail *cd)
         }
         if (list_empty(&cache_list)) {
                 /* module must be being unloaded so its safe to kill the worker */
-                cancel_delayed_work(&cache_cleaner);
-                flush_scheduled_work();
+                cancel_delayed_work_sync(&cache_cleaner);
         }
         return 0;
 }
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 650af064ff8d..669e12a4ed18 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -132,8 +132,7 @@ rpc_close_pipes(struct inode *inode)
                 rpci->nwriters = 0;
                 if (ops->release_pipe)
                         ops->release_pipe(inode);
-                cancel_delayed_work(&rpci->queue_timeout);
-                flush_workqueue(rpciod_workqueue);
+                cancel_delayed_work_sync(&rpci->queue_timeout);
         }
         rpc_inode_setowner(inode, NULL);
         mutex_unlock(&inode->i_mutex);
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index b5723c262a3e..954d7ec86c7e 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -50,8 +50,6 @@ static RPC_WAITQ(delay_queue, "delayq");
 /*
  * rpciod-related stuff
  */
-static DEFINE_MUTEX(rpciod_mutex);
-static atomic_t rpciod_users = ATOMIC_INIT(0);
 struct workqueue_struct *rpciod_workqueue;
 
 /*
@@ -961,60 +959,49 @@ void rpc_killall_tasks(struct rpc_clnt *clnt)
         spin_unlock(&clnt->cl_lock);
 }
 
+int rpciod_up(void)
+{
+        return try_module_get(THIS_MODULE) ? 0 : -EINVAL;
+}
+
+void rpciod_down(void)
+{
+        module_put(THIS_MODULE);
+}
+
 /*
- * Start up the rpciod process if it's not already running.
+ * Start up the rpciod workqueue.
  */
-int
-rpciod_up(void)
+static int rpciod_start(void)
 {
         struct workqueue_struct *wq;
-        int error = 0;
-
-        if (atomic_inc_not_zero(&rpciod_users))
-                return 0;
-
-        mutex_lock(&rpciod_mutex);
 
-        /* Guard against races with rpciod_down() */
-        if (rpciod_workqueue != NULL)
-                goto out_ok;
         /*
          * Create the rpciod thread and wait for it to start.
          */
         dprintk("RPC:       creating workqueue rpciod\n");
-        error = -ENOMEM;
         wq = create_workqueue("rpciod");
-        if (wq == NULL)
-                goto out;
-
         rpciod_workqueue = wq;
-        error = 0;
-out_ok:
-        atomic_inc(&rpciod_users);
-out:
-        mutex_unlock(&rpciod_mutex);
-        return error;
+        return rpciod_workqueue != NULL;
 }
 
-void
-rpciod_down(void)
+static void rpciod_stop(void)
 {
-        if (!atomic_dec_and_test(&rpciod_users))
-                return;
+        struct workqueue_struct *wq = NULL;
 
-        mutex_lock(&rpciod_mutex);
+        if (rpciod_workqueue == NULL)
+                return;
         dprintk("RPC:       destroying workqueue rpciod\n");
 
-        if (atomic_read(&rpciod_users) == 0 && rpciod_workqueue != NULL) {
-                destroy_workqueue(rpciod_workqueue);
-                rpciod_workqueue = NULL;
-        }
-        mutex_unlock(&rpciod_mutex);
+        wq = rpciod_workqueue;
+        rpciod_workqueue = NULL;
+        destroy_workqueue(wq);
 }
 
 void
 rpc_destroy_mempool(void)
 {
+        rpciod_stop();
         if (rpc_buffer_mempool)
                 mempool_destroy(rpc_buffer_mempool);
         if (rpc_task_mempool)
@@ -1048,6 +1035,8 @@ rpc_init_mempool(void)
                                                       rpc_buffer_slabp);
         if (!rpc_buffer_mempool)
                 goto err_nomem;
+        if (!rpciod_start())
+                goto err_nomem;
         return 0;
 err_nomem:
         rpc_destroy_mempool();