5 files changed, 36 insertions, 18 deletions

diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index b35069a2aa9e..bd1b9d663fb9 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -115,6 +115,7 @@ struct nfs4_lock_state {
 #define NFS_LOCK_INITIALIZED 1
         int                     ls_flags;
         struct nfs_seqid_counter        ls_seqid;
+        struct rpc_sequence     ls_sequence;
         struct nfs_unique_id    ls_id;
         nfs4_stateid            ls_stateid;
         atomic_t                ls_count;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f03d9d5f5ba4..9e2e1c7291db 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -741,10 +741,10 @@ static void nfs4_open_confirm_done(struct rpc_task *task, void *calldata)
         if (data->rpc_status == 0) {
                 memcpy(data->o_res.stateid.data, data->c_res.stateid.data,
                                 sizeof(data->o_res.stateid.data));
+                nfs_confirm_seqid(&data->owner->so_seqid, 0);
                 renew_lease(data->o_res.server, data->timestamp);
                 data->rpc_done = 1;
         }
-        nfs_confirm_seqid(&data->owner->so_seqid, data->rpc_status);
         nfs_increment_open_seqid(data->rpc_status, data->c_arg.seqid);
 }
 
@@ -759,7 +759,6 @@ static void nfs4_open_confirm_release(void *calldata)
         /* In case of error, no cleanup! */
         if (!data->rpc_done)
                 goto out_free;
-        nfs_confirm_seqid(&data->owner->so_seqid, 0);
         state = nfs4_opendata_to_nfs4_state(data);
         if (!IS_ERR(state))
                 nfs4_close_state(&data->path, state, data->o_arg.open_flags);
@@ -886,7 +885,6 @@ static void nfs4_open_release(void *calldata)
         /* In case we need an open_confirm, no cleanup! */
         if (data->o_res.rflags & NFS4_OPEN_RESULT_CONFIRM)
                 goto out_free;
-        nfs_confirm_seqid(&data->owner->so_seqid, 0);
         state = nfs4_opendata_to_nfs4_state(data);
         if (!IS_ERR(state))
                 nfs4_close_state(&data->path, state, data->o_arg.open_flags);
@@ -3333,6 +3331,12 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl,
 
         p->arg.fh = NFS_FH(inode);
         p->arg.fl = &p->fl;
+        if (!(lsp->ls_seqid.flags & NFS_SEQID_CONFIRMED)) {
+                p->arg.open_seqid = nfs_alloc_seqid(&lsp->ls_state->owner->so_seqid);
+                if (p->arg.open_seqid == NULL)
+                        goto out_free;
+
+        }
         p->arg.lock_seqid = nfs_alloc_seqid(&lsp->ls_seqid);
         if (p->arg.lock_seqid == NULL)
                 goto out_free;
@@ -3345,6 +3349,8 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl,
         memcpy(&p->fl, fl, sizeof(p->fl));
         return p;
 out_free:
+        if (p->arg.open_seqid != NULL)
+                nfs_free_seqid(p->arg.open_seqid);
         kfree(p);
         return NULL;
 }
@@ -3361,23 +3367,23 @@ static void nfs4_lock_prepare(struct rpc_task *task, void *calldata)
                 .rpc_cred = sp->so_cred,
         };
 
-        if (nfs_wait_on_sequence(data->arg.lock_seqid, task) != 0)
-                return;
         dprintk("%s: begin!\n", __FUNCTION__);
         /* Do we need to do an open_to_lock_owner? */
         if (!(data->arg.lock_seqid->sequence->flags & NFS_SEQID_CONFIRMED)) {
-                data->arg.open_seqid = nfs_alloc_seqid(&sp->so_seqid);
-                if (data->arg.open_seqid == NULL) {
-                        data->rpc_status = -ENOMEM;
-                        task->tk_action = NULL;
-                        goto out;
-                }
+                if (nfs_wait_on_sequence(data->arg.open_seqid, task) != 0)
+                        return;
                 data->arg.open_stateid = &state->stateid;
                 data->arg.new_lock_owner = 1;
+                /* Retest in case we raced... */
+                if (!(data->arg.lock_seqid->sequence->flags & NFS_SEQID_CONFIRMED))
+                        goto do_rpc;
         }
+        if (nfs_wait_on_sequence(data->arg.lock_seqid, task) != 0)
+                return;
+        data->arg.new_lock_owner = 0;
+do_rpc: 
         data->timestamp = jiffies;
         rpc_call_setup(task, &msg, 0);
-out:
         dprintk("%s: done!, ret = %d\n", __FUNCTION__, data->rpc_status);
 }
 
@@ -3413,8 +3419,6 @@ static void nfs4_lock_release(void *calldata)
         struct nfs4_lockdata *data = calldata;
 
         dprintk("%s: begin!\n", __FUNCTION__);
-        if (data->arg.open_seqid != NULL)
-                nfs_free_seqid(data->arg.open_seqid);
         if (data->cancelled != 0) {
                 struct rpc_task *task;
                 task = nfs4_do_unlck(&data->fl, data->ctx, data->lsp,
@@ -3424,6 +3428,8 @@ static void nfs4_lock_release(void *calldata)
                 dprintk("%s: cancelling lock!\n", __FUNCTION__);
         } else
                 nfs_free_seqid(data->arg.lock_seqid);
+        if (data->arg.open_seqid != NULL)
+                nfs_free_seqid(data->arg.open_seqid);
         nfs4_put_lock_state(data->lsp);
         put_nfs_open_context(data->ctx);
         kfree(data);
diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
index 3ea352d82eba..5e2e4af1a0e6 100644
--- a/fs/nfs/nfs4renewd.c
+++ b/fs/nfs/nfs4renewd.c
@@ -133,9 +133,7 @@ nfs4_renewd_prepare_shutdown(struct nfs_server *server)
 void
 nfs4_kill_renewd(struct nfs_client *clp)
 {
-        down_read(&clp->cl_sem);
         cancel_delayed_work_sync(&clp->cl_renewd);
-        up_read(&clp->cl_sem);
 }
 
 /*
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 23a9a36556bf..5a39c6f78acf 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -509,7 +509,10 @@ static struct nfs4_lock_state *nfs4_alloc_lock_state(struct nfs4_state *state, f
         lsp = kzalloc(sizeof(*lsp), GFP_KERNEL);
         if (lsp == NULL)
                 return NULL;
-        lsp->ls_seqid.sequence = &state->owner->so_sequence;
+        rpc_init_wait_queue(&lsp->ls_sequence.wait, "lock_seqid_waitqueue");
+        spin_lock_init(&lsp->ls_sequence.lock);
+        INIT_LIST_HEAD(&lsp->ls_sequence.list);
+        lsp->ls_seqid.sequence = &lsp->ls_sequence;
         atomic_set(&lsp->ls_count, 1);
         lsp->ls_owner = fl_owner;
         spin_lock(&clp->cl_lock);
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ea929207f274..0b0c72a072ff 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1475,7 +1475,7 @@ static int nfs_xdev_get_sb(struct file_system_type *fs_type, int flags,
                 error = PTR_ERR(mntroot);
                 goto error_splat_super;
         }
-        if (mntroot->d_inode->i_op != server->nfs_client->rpc_ops->dir_inode_ops) {
+        if (mntroot->d_inode->i_op != NFS_SB(s)->nfs_client->rpc_ops->dir_inode_ops) {
                 dput(mntroot);
                 error = -ESTALE;
                 goto error_splat_super;
@@ -1826,6 +1826,11 @@ static int nfs4_xdev_get_sb(struct file_system_type *fs_type, int flags,
                 error = PTR_ERR(mntroot);
                 goto error_splat_super;
         }
+        if (mntroot->d_inode->i_op != NFS_SB(s)->nfs_client->rpc_ops->dir_inode_ops) {
+                dput(mntroot);
+                error = -ESTALE;
+                goto error_splat_super;
+        }
 
         s->s_flags |= MS_ACTIVE;
         mnt->mnt_sb = s;
@@ -1900,6 +1905,11 @@ static int nfs4_referral_get_sb(struct file_system_type *fs_type, int flags,
                 error = PTR_ERR(mntroot);
                 goto error_splat_super;
         }
+        if (mntroot->d_inode->i_op != NFS_SB(s)->nfs_client->rpc_ops->dir_inode_ops) {
+                dput(mntroot);
+                error = -ESTALE;
+                goto error_splat_super;
+        }
 
         s->s_flags |= MS_ACTIVE;
         mnt->mnt_sb = s;