5 files changed, 31 insertions, 28 deletions

diff --git a/net/sunrpc/pmap_clnt.c b/net/sunrpc/pmap_clnt.c
index 919d5ba7ca0a..e52afab413de 100644
--- a/net/sunrpc/pmap_clnt.c
+++ b/net/sunrpc/pmap_clnt.c
@@ -101,11 +101,13 @@ void rpc_getport(struct rpc_task *task)
         /* Autobind on cloned rpc clients is discouraged */
         BUG_ON(clnt->cl_parent != clnt);
 
-        if (xprt_test_and_set_binding(xprt)) {
-                task->tk_status = -EACCES;      /* tell caller to check again */
-                rpc_sleep_on(&xprt->binding, task, NULL, NULL);
-                return;
-        }
+        /* Put self on queue before sending rpcbind request, in case
+         * pmap_getport_done completes before we return from rpc_run_task */
+        rpc_sleep_on(&xprt->binding, task, NULL, NULL);
+
+        status = -EACCES;               /* tell caller to check again */
+        if (xprt_test_and_set_binding(xprt))
+                goto bailout_nofree;
 
         /* Someone else may have bound if we slept */
         status = 0;
@@ -134,8 +136,6 @@ void rpc_getport(struct rpc_task *task)
                 goto bailout;
         rpc_release_task(child);
 
-        rpc_sleep_on(&xprt->binding, task, NULL, NULL);
-
         task->tk_xprt->stat.bind_count++;
         return;
 
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 2807fa0eab40..eb44ec929ca1 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -828,6 +828,11 @@ svc_process(struct svc_rqst *rqstp)
                 *statp = procp->pc_func(rqstp, rqstp->rq_argp, rqstp->rq_resp);
 
                 /* Encode reply */
+                if (*statp == rpc_drop_reply) {
+                        if (procp->pc_release)
+                                procp->pc_release(rqstp, NULL, rqstp->rq_resp);
+                        goto dropit;
+                }
                 if (*statp == rpc_success && (xdr = procp->pc_encode)
                  && !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
                         dprintk("svc: failed to encode reply\n");
diff --git a/net/sunrpc/svcauth.c b/net/sunrpc/svcauth.c
index 8f2320aded5c..ee9bb1522d5e 100644
--- a/net/sunrpc/svcauth.c
+++ b/net/sunrpc/svcauth.c
@@ -126,6 +126,7 @@ void auth_domain_put(struct auth_domain *dom)
         if (atomic_dec_and_lock(&dom->ref.refcount, &auth_domain_lock)) {
                 hlist_del(&dom->hash);
                 dom->flavour->domain_release(dom);
+                spin_unlock(&auth_domain_lock);
         }
 }
 
@@ -147,10 +148,8 @@ auth_domain_lookup(char *name, struct auth_domain *new)
                         return hp;
                 }
         }
-        if (new) {
+        if (new)
                 hlist_add_head(&new->hash, head);
-                kref_get(&new->ref);
-        }
         spin_unlock(&auth_domain_lock);
         return new;
 }
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 61e307cca13d..64ca1f61dd94 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -299,9 +299,15 @@ void svc_reserve(struct svc_rqst *rqstp, int space)
 static inline void
 svc_sock_put(struct svc_sock *svsk)
 {
-        if (atomic_dec_and_test(&svsk->sk_inuse) && test_bit(SK_DEAD, &svsk->sk_flags)) {
+        if (atomic_dec_and_test(&svsk->sk_inuse) &&
+                        test_bit(SK_DEAD, &svsk->sk_flags)) {
                 dprintk("svc: releasing dead socket\n");
-                sock_release(svsk->sk_sock);
+                if (svsk->sk_sock->file)
+                        sockfd_put(svsk->sk_sock);
+                else
+                        sock_release(svsk->sk_sock);
+                if (svsk->sk_info_authunix != NULL)
+                        svcauth_unix_info_release(svsk->sk_info_authunix);
                 kfree(svsk);
         }
 }
@@ -973,7 +979,7 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 return 0;
         }
 
-        if (test_bit(SK_CONN, &svsk->sk_flags)) {
+        if (svsk->sk_sk->sk_state == TCP_LISTEN) {
                 svc_tcp_accept(svsk);
                 svc_sock_received(svsk);
                 return 0;
@@ -1604,20 +1610,13 @@ svc_delete_socket(struct svc_sock *svsk)
                 if (test_bit(SK_TEMP, &svsk->sk_flags))
                         serv->sv_tmpcnt--;
 
-        if (!atomic_read(&svsk->sk_inuse)) {
-                spin_unlock_bh(&serv->sv_lock);
-                if (svsk->sk_sock->file)
-                        sockfd_put(svsk->sk_sock);
-                else
-                        sock_release(svsk->sk_sock);
-                if (svsk->sk_info_authunix != NULL)
-                        svcauth_unix_info_release(svsk->sk_info_authunix);
-                kfree(svsk);
-        } else {
-                spin_unlock_bh(&serv->sv_lock);
-                dprintk(KERN_NOTICE "svc: server socket destroy delayed\n");
-                /* svsk->sk_server = NULL; */
-        }
+        /* This atomic_inc should be needed - svc_delete_socket
+         * should have the semantic of dropping a reference.
+         * But it doesn't yet....
+         */
+        atomic_inc(&svsk->sk_inuse);
+        spin_unlock_bh(&serv->sv_lock);
+        svc_sock_put(svsk);
 }
 
 /*
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 28100e019225..757fc91ef25d 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1366,7 +1366,7 @@ int xs_setup_udp(struct rpc_xprt *xprt, struct rpc_timeout *to)
         if (xprt->slot == NULL)
                 return -ENOMEM;
 
-        if (ntohs(addr->sin_port != 0))
+        if (ntohs(addr->sin_port) != 0)
                 xprt_set_bound(xprt);
         xprt->port = xs_get_random_port();