Merge tag 'nfs-for-3.5-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

Pull NFS client bugfixes from Trond Myklebust:
 "Highlights include:

   - Fix a couple of mount regressions due to the recent cleanups.
   - Fix an Oops in the open recovery code
   - Fix an rpc_pipefs upcall hang that results from some of the net
     namespace work from 3.4.x (stable kernel candidate).
   - Fix a couple of write and o_direct regressions that were found at
     last weeks Bakeathon testing event in Ann Arbor."

* tag 'nfs-for-3.5-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFS: add an endian notation for sparse
  NFSv4.1: integer overflow in decode_cb_sequence_args()
  rpc_pipefs: allow rpc_purge_list to take a NULL waitq pointer
  NFSv4 do not send an empty SETATTR compound
  NFSv2: EOF incorrectly set on short read
  NFS: Use the NFS_DEFAULT_VERSION for v2 and v3 mounts
  NFS: fix directio refcount bug on commit
  NFSv4: Fix unnecessary delegation returns in nfs4_do_open
  NFSv4.1: Convert another trivial printk into a dprintk
  NFS4: Fix open bug when pnfs module blacklisted
  NFS: Remove incorrect BUG_ON in nfs_found_client
  NFS: Map minor mismatch error to protocol not support error.
  NFS: Fix a commit bug
  NFS4: Set parsed mount data version to 4
  NFSv4.1: Ensure we clear session state flags after a session creation
  NFSv4.1: Convert a trivial printk into a dprintk
  NFSv4: Fix up decode_attr_mdsthreshold
  NFSv4: Fix an Oops in the open recovery code
  NFSv4.1: Fix a request leak on the back channel

diff --combined fs/nfs/direct.c
index ad2775d3e219b65f6efed3454d6422f8822de0e8,05099890a929e8a754385a96bf3fefd39a42006b..3168f6e3d4d4f3670b65e946bbfefcc0ada8374a
--- 1/fs/nfs/direct.c
--- 2/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@@ -454,12 -454,6 +454,12 @@@ out
        return result;
  }
  
 +static void nfs_inode_dio_write_done(struct inode *inode)
 +{
 +      nfs_zap_mapping(inode, inode->i_mapping);
 +      inode_dio_done(inode);
 +}
 +
  #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
  static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
  {
@@@ -523,9 -517,9 +523,9 @@@ static void nfs_direct_commit_complete(
                nfs_list_remove_request(req);
                if (dreq->flags == NFS_ODIRECT_RESCHED_WRITES) {
                        /* Note the rewrite will go through mds */
-                       kref_get(&req->wb_kref);
                        nfs_mark_request_commit(req, NULL, &cinfo);
-               }
+               } else
+                       nfs_release_request(req);
                nfs_unlock_and_release_request(req);
        }
  
@@@ -570,7 -564,7 +570,7 @@@ static void nfs_direct_write_schedule_w
                        nfs_direct_write_reschedule(dreq);
                        break;
                default:
 -                      nfs_zap_mapping(dreq->inode, dreq->inode->i_mapping);
 +                      nfs_inode_dio_write_done(dreq->inode);
                        nfs_direct_complete(dreq);
        }
  }
@@@ -587,7 -581,7 +587,7 @@@ static void nfs_direct_write_schedule_w
  
  static void nfs_direct_write_complete(struct nfs_direct_req *dreq, struct inode *inode)
  {
 -      nfs_zap_mapping(inode, inode->i_mapping);
 +      nfs_inode_dio_write_done(inode);
        nfs_direct_complete(dreq);
  }
  #endif
@@@ -716,12 -710,12 +716,12 @@@ static void nfs_direct_write_completion
                        if (dreq->flags == NFS_ODIRECT_RESCHED_WRITES)
                                bit = NFS_IOHDR_NEED_RESCHED;
                        else if (dreq->flags == 0) {
-                               memcpy(&dreq->verf, &req->wb_verf,
+                               memcpy(&dreq->verf, hdr->verf,
                                       sizeof(dreq->verf));
                                bit = NFS_IOHDR_NEED_COMMIT;
                                dreq->flags = NFS_ODIRECT_DO_COMMIT;
                        } else if (dreq->flags == NFS_ODIRECT_DO_COMMIT) {
-                               if (memcmp(&dreq->verf, &req->wb_verf, sizeof(dreq->verf))) {
+                               if (memcmp(&dreq->verf, hdr->verf, sizeof(dreq->verf))) {
                                        dreq->flags = NFS_ODIRECT_RESCHED_WRITES;
                                        bit = NFS_IOHDR_NEED_RESCHED;
                                } else
@@@ -772,16 -766,14 +772,16 @@@ static ssize_t nfs_direct_write_schedul
                                               loff_t pos)
  {
        struct nfs_pageio_descriptor desc;
 +      struct inode *inode = dreq->inode;
        ssize_t result = 0;
        size_t requested_bytes = 0;
        unsigned long seg;
  
 -      nfs_pageio_init_write(&desc, dreq->inode, FLUSH_COND_STABLE,
 +      nfs_pageio_init_write(&desc, inode, FLUSH_COND_STABLE,
                              &nfs_direct_write_completion_ops);
        desc.pg_dreq = dreq;
        get_dreq(dreq);
 +      atomic_inc(&inode->i_dio_count);
  
        for (seg = 0; seg < nr_segs; seg++) {
                const struct iovec *vec = &iov[seg];
@@@ -801,7 -793,6 +801,7 @@@
         * generic layer handle the completion.
         */
        if (requested_bytes == 0) {
 +              inode_dio_done(inode);
                nfs_direct_req_release(dreq);
                return result < 0 ? result : -EIO;
        }

diff --combined net/sunrpc/svc.c
index 7e9baaa1e543e55878dcb0d9bd0378a0e51754e0,074df5a564dba521a343d819e1c87af136d08ef2..3ee7461926d8a01318ed2876e37651506c6b3c4b
--- 1/net/sunrpc/svc.c
--- 2/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@@ -407,14 -407,6 +407,14 @@@ static int svc_uses_rpcbind(struct svc_
        return 0;
  }
  
 +int svc_bind(struct svc_serv *serv, struct net *net)
 +{
 +      if (!svc_uses_rpcbind(serv))
 +              return 0;
 +      return svc_rpcb_setup(serv, net);
 +}
 +EXPORT_SYMBOL_GPL(svc_bind);
 +
  /*
   * Create an RPC service
   */
@@@ -479,8 -471,15 +479,8 @@@ __svc_create(struct svc_program *prog, 
                spin_lock_init(&pool->sp_lock);
        }
  
 -      if (svc_uses_rpcbind(serv)) {
 -              if (svc_rpcb_setup(serv, current->nsproxy->net_ns) < 0) {
 -                      kfree(serv->sv_pools);
 -                      kfree(serv);
 -                      return NULL;
 -              }
 -              if (!serv->sv_shutdown)
 -                      serv->sv_shutdown = svc_rpcb_cleanup;
 -      }
 +      if (svc_uses_rpcbind(serv) && (!serv->sv_shutdown))
 +              serv->sv_shutdown = svc_rpcb_cleanup;
  
        return serv;
  }
@@@ -537,6 -536,8 +537,6 @@@ EXPORT_SYMBOL_GPL(svc_shutdown_net)
  void
  svc_destroy(struct svc_serv *serv)
  {
 -      struct net *net = current->nsproxy->net_ns;
 -
        dprintk("svc: svc_destroy(%s, %d)\n",
                                serv->sv_program->pg_name,
                                serv->sv_nrthreads);
@@@ -551,6 -552,8 +551,6 @@@
  
        del_timer_sync(&serv->sv_temptimer);
  
 -      svc_shutdown_net(serv, net);
 -
        /*
         * The last user is gone and thus all sockets have to be destroyed to
         * the point. Check this.
@@@ -1374,7 -1377,8 +1374,8 @@@ bc_svc_process(struct svc_serv *serv, s
                                                sizeof(req->rq_snd_buf));
                return bc_send(req);
        } else {
-               /* Nothing to do to drop request */
+               /* drop request */
+               xprt_free_bc_request(req);
                return 0;
        }
  }