Merge branch 'for-2.6.35' of git://linux-nfs.org/~bfields/linux

* 'for-2.6.35' of git://linux-nfs.org/~bfields/linux: (45 commits)
  Revert "nfsd4: distinguish expired from stale stateids"
  nfsd: safer initialization order in find_file()
  nfs4: minor callback code simplification, comment
  NFSD: don't report compiled-out versions as present
  nfsd4: implement reclaim_complete
  nfsd4: nfsd4_destroy_session must set callback client under the state lock
  nfsd4: keep a reference count on client while in use
  nfsd4: mark_client_expired
  nfsd4: introduce nfs4_client.cl_refcount
  nfsd4: refactor expire_client
  nfsd4: extend the client_lock to cover cl_lru
  nfsd4: use list_move in move_to_confirmed
  nfsd4: fold release_session into expire_client
  nfsd4: rename sessionid_lock to client_lock
  nfsd4: fix bare destroy_session null dereference
  nfsd4: use local variable in nfs4svc_encode_compoundres
  nfsd: further comment typos
  sunrpc: centralise most calls to svc_xprt_received
  nfsd4: fix unlikely race in session replay case
  nfsd4: fix filehandle comment
  ...

4 files changed, 34 insertions, 35 deletions

diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 77970fe8bff2..c2173ebdb33c 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -50,11 +50,17 @@ static void cache_init(struct cache_head *h)
         h->last_refresh = now;
 }
 
+static inline int cache_is_expired(struct cache_detail *detail, struct cache_head *h)
+{
+        return  (h->expiry_time < get_seconds()) ||
+                (detail->flush_time > h->last_refresh);
+}
+
 struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
                                        struct cache_head *key, int hash)
 {
         struct cache_head **head,  **hp;
-        struct cache_head *new = NULL;
+        struct cache_head *new = NULL, *freeme = NULL;
 
         head = &detail->hash_table[hash];
 
@@ -63,6 +69,9 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
         for (hp=head; *hp != NULL ; hp = &(*hp)->next) {
                 struct cache_head *tmp = *hp;
                 if (detail->match(tmp, key)) {
+                        if (cache_is_expired(detail, tmp))
+                                /* This entry is expired, we will discard it. */
+                                break;
                         cache_get(tmp);
                         read_unlock(&detail->hash_lock);
                         return tmp;
@@ -87,6 +96,13 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
         for (hp=head; *hp != NULL ; hp = &(*hp)->next) {
                 struct cache_head *tmp = *hp;
                 if (detail->match(tmp, key)) {
+                        if (cache_is_expired(detail, tmp)) {
+                                *hp = tmp->next;
+                                tmp->next = NULL;
+                                detail->entries --;
+                                freeme = tmp;
+                                break;
+                        }
                         cache_get(tmp);
                         write_unlock(&detail->hash_lock);
                         cache_put(new, detail);
@@ -99,6 +115,8 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
         cache_get(new);
         write_unlock(&detail->hash_lock);
 
+        if (freeme)
+                cache_put(freeme, detail);
         return new;
 }
 EXPORT_SYMBOL_GPL(sunrpc_cache_lookup);
@@ -184,10 +202,7 @@ static int cache_make_upcall(struct cache_detail *cd, struct cache_head *h)
 
 static inline int cache_is_valid(struct cache_detail *detail, struct cache_head *h)
 {
-        if (!test_bit(CACHE_VALID, &h->flags) ||
-            h->expiry_time < get_seconds())
-                return -EAGAIN;
-        else if (detail->flush_time > h->last_refresh)
+        if (!test_bit(CACHE_VALID, &h->flags))
                 return -EAGAIN;
         else {
                 /* entry is valid */
@@ -398,31 +413,27 @@ static int cache_clean(void)
                 /* Ok, now to clean this strand */
 
                 cp = & current_detail->hash_table[current_index];
-                ch = *cp;
-                for (; ch; cp= & ch->next, ch= *cp) {
+                for (ch = *cp ; ch ; cp = & ch->next, ch = *cp) {
                         if (current_detail->nextcheck > ch->expiry_time)
                                 current_detail->nextcheck = ch->expiry_time+1;
-                        if (ch->expiry_time >= get_seconds() &&
-                            ch->last_refresh >= current_detail->flush_time)
+                        if (!cache_is_expired(current_detail, ch))
                                 continue;
-                        if (test_and_clear_bit(CACHE_PENDING, &ch->flags))
-                                cache_dequeue(current_detail, ch);
 
-                        if (atomic_read(&ch->ref.refcount) == 1)
-                                break;
-                }
-                if (ch) {
                         *cp = ch->next;
                         ch->next = NULL;
                         current_detail->entries--;
                         rv = 1;
+                        break;
                 }
+
                 write_unlock(&current_detail->hash_lock);
                 d = current_detail;
                 if (!ch)
                         current_index ++;
                 spin_unlock(&cache_list_lock);
                 if (ch) {
+                        if (test_and_clear_bit(CACHE_PENDING, &ch->flags))
+                                cache_dequeue(current_detail, ch);
                         cache_revisit_request(ch);
                         cache_put(ch, d);
                 }
@@ -1234,8 +1245,10 @@ static int content_open(struct inode *inode, struct file *file,
         if (!cd || !try_module_get(cd->owner))
                 return -EACCES;
         han = __seq_open_private(file, &cache_content_op, sizeof(*han));
-        if (han == NULL)
+        if (han == NULL) {
+                module_put(cd->owner);
                 return -ENOMEM;
+        }
 
         han->cd = cd;
         return 0;
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 061b2e0f9118..cbc084939dd8 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -744,8 +744,10 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                 if (rqstp->rq_deferred) {
                         svc_xprt_received(xprt);
                         len = svc_deferred_recv(rqstp);
-                } else
+                } else {
                         len = xprt->xpt_ops->xpo_recvfrom(rqstp);
+                        svc_xprt_received(xprt);
+                }
                 dprintk("svc: got len=%d\n", len);
         }
 
@@ -893,12 +895,12 @@ void svc_delete_xprt(struct svc_xprt *xprt)
          */
         if (test_bit(XPT_TEMP, &xprt->xpt_flags))
                 serv->sv_tmpcnt--;
+        spin_unlock_bh(&serv->sv_lock);
 
         while ((dr = svc_deferred_dequeue(xprt)) != NULL)
                 kfree(dr);
 
         svc_xprt_put(xprt);
-        spin_unlock_bh(&serv->sv_lock);
 }
 
 void svc_close_xprt(struct svc_xprt *xprt)
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index a29f259204e6..a33892733643 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -547,7 +547,6 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
                         dprintk("svc: recvfrom returned error %d\n", -err);
                         set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
                 }
-                svc_xprt_received(&svsk->sk_xprt);
                 return -EAGAIN;
         }
         len = svc_addr_len(svc_addr(rqstp));
@@ -562,11 +561,6 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
         svsk->sk_sk->sk_stamp = skb->tstamp;
         set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags); /* there may be more data... */
 
-        /*
-         * Maybe more packets - kick another thread ASAP.
-         */
-        svc_xprt_received(&svsk->sk_xprt);
-
         len  = skb->len - sizeof(struct udphdr);
         rqstp->rq_arg.len = len;
 
@@ -917,7 +911,6 @@ static int svc_tcp_recv_record(struct svc_sock *svsk, struct svc_rqst *rqstp)
                 if (len < want) {
                         dprintk("svc: short recvfrom while reading record "
                                 "length (%d of %d)\n", len, want);
-                        svc_xprt_received(&svsk->sk_xprt);
                         goto err_again; /* record header not complete */
                 }
 
@@ -953,7 +946,6 @@ static int svc_tcp_recv_record(struct svc_sock *svsk, struct svc_rqst *rqstp)
         if (len < svsk->sk_reclen) {
                 dprintk("svc: incomplete TCP record (%d of %d)\n",
                         len, svsk->sk_reclen);
-                svc_xprt_received(&svsk->sk_xprt);
                 goto err_again; /* record not complete */
         }
         len = svsk->sk_reclen;
@@ -961,14 +953,11 @@ static int svc_tcp_recv_record(struct svc_sock *svsk, struct svc_rqst *rqstp)
 
         return len;
  error:
-        if (len == -EAGAIN) {
+        if (len == -EAGAIN)
                 dprintk("RPC: TCP recv_record got EAGAIN\n");
-                svc_xprt_received(&svsk->sk_xprt);
-        }
         return len;
  err_delete:
         set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
-        svc_xprt_received(&svsk->sk_xprt);
  err_again:
         return -EAGAIN;
 }
@@ -1110,7 +1099,6 @@ out:
         svsk->sk_tcplen = 0;
 
         svc_xprt_copy_addrs(rqstp, &svsk->sk_xprt);
-        svc_xprt_received(&svsk->sk_xprt);
         if (serv->sv_stats)
                 serv->sv_stats->nettcpcnt++;
 
@@ -1119,7 +1107,6 @@ out:
 err_again:
         if (len == -EAGAIN) {
                 dprintk("RPC: TCP recvfrom got EAGAIN\n");
-                svc_xprt_received(&svsk->sk_xprt);
                 return len;
         }
 error:
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index f92e37eb413c..0194de814933 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -566,7 +566,6 @@ static int rdma_read_complete(struct svc_rqst *rqstp,
                 ret, rqstp->rq_arg.len, rqstp->rq_arg.head[0].iov_base,
                 rqstp->rq_arg.head[0].iov_len);
 
-        svc_xprt_received(rqstp->rq_xprt);
         return ret;
 }
 
@@ -665,7 +664,6 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
                 rqstp->rq_arg.head[0].iov_len);
         rqstp->rq_prot = IPPROTO_MAX;
         svc_xprt_copy_addrs(rqstp, xprt);
-        svc_xprt_received(xprt);
         return ret;
 
  close_out:
@@ -678,6 +676,5 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
          */
         set_bit(XPT_CLOSE, &xprt->xpt_flags);
 defer:
-        svc_xprt_received(xprt);
         return 0;
 }