Merge branch 'for-2.6.35' of git://linux-nfs.org/~bfields/linux

* 'for-2.6.35' of git://linux-nfs.org/~bfields/linux: (45 commits)
  Revert "nfsd4: distinguish expired from stale stateids"
  nfsd: safer initialization order in find_file()
  nfs4: minor callback code simplification, comment
  NFSD: don't report compiled-out versions as present
  nfsd4: implement reclaim_complete
  nfsd4: nfsd4_destroy_session must set callback client under the state lock
  nfsd4: keep a reference count on client while in use
  nfsd4: mark_client_expired
  nfsd4: introduce nfs4_client.cl_refcount
  nfsd4: refactor expire_client
  nfsd4: extend the client_lock to cover cl_lru
  nfsd4: use list_move in move_to_confirmed
  nfsd4: fold release_session into expire_client
  nfsd4: rename sessionid_lock to client_lock
  nfsd4: fix bare destroy_session null dereference
  nfsd4: use local variable in nfs4svc_encode_compoundres
  nfsd: further comment typos
  sunrpc: centralise most calls to svc_xprt_received
  nfsd4: fix unlikely race in session replay case
  nfsd4: fix filehandle comment
  ...

diff --combined net/sunrpc/cache.c
index 77970fe8bff24b2e7afe41538eac48992106fdfd,a3f340c8b79a83dccc52b413f517a21ccb91b751..c2173ebdb33cf91c8cc2c573be98da93f049cc2f
--- 1/net/sunrpc/cache.c
--- 2/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@@ -28,7 -28,6 +28,7 @@@
  #include <linux/workqueue.h>
  #include <linux/mutex.h>
  #include <linux/pagemap.h>
 +#include <linux/smp_lock.h>
  #include <asm/ioctls.h>
  #include <linux/sunrpc/types.h>
  #include <linux/sunrpc/cache.h>
@@@ -50,11 -49,17 +50,17 @@@ static void cache_init(struct cache_hea
        h->last_refresh = now;
  }
  
+ static inline int cache_is_expired(struct cache_detail *detail, struct cache_head *h)
+ {
+       return  (h->expiry_time < get_seconds()) ||
+               (detail->flush_time > h->last_refresh);
+ }
+ 
  struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
                                       struct cache_head *key, int hash)
  {
        struct cache_head **head,  **hp;
-       struct cache_head *new = NULL;
+       struct cache_head *new = NULL, *freeme = NULL;
  
        head = &detail->hash_table[hash];
  
@@@ -63,6 -68,9 +69,9 @@@
        for (hp=head; *hp != NULL ; hp = &(*hp)->next) {
                struct cache_head *tmp = *hp;
                if (detail->match(tmp, key)) {
+                       if (cache_is_expired(detail, tmp))
+                               /* This entry is expired, we will discard it. */
+                               break;
                        cache_get(tmp);
                        read_unlock(&detail->hash_lock);
                        return tmp;
@@@ -87,6 -95,13 +96,13 @@@
        for (hp=head; *hp != NULL ; hp = &(*hp)->next) {
                struct cache_head *tmp = *hp;
                if (detail->match(tmp, key)) {
+                       if (cache_is_expired(detail, tmp)) {
+                               *hp = tmp->next;
+                               tmp->next = NULL;
+                               detail->entries --;
+                               freeme = tmp;
+                               break;
+                       }
                        cache_get(tmp);
                        write_unlock(&detail->hash_lock);
                        cache_put(new, detail);
@@@ -99,6 -114,8 +115,8 @@@
        cache_get(new);
        write_unlock(&detail->hash_lock);
  
+       if (freeme)
+               cache_put(freeme, detail);
        return new;
  }
  EXPORT_SYMBOL_GPL(sunrpc_cache_lookup);
@@@ -184,10 -201,7 +202,7 @@@ static int cache_make_upcall(struct cac
  
  static inline int cache_is_valid(struct cache_detail *detail, struct cache_head *h)
  {
-       if (!test_bit(CACHE_VALID, &h->flags) ||
-           h->expiry_time < get_seconds())
-               return -EAGAIN;
-       else if (detail->flush_time > h->last_refresh)
+       if (!test_bit(CACHE_VALID, &h->flags))
                return -EAGAIN;
        else {
                /* entry is valid */
@@@ -398,31 -412,27 +413,27 @@@ static int cache_clean(void
                /* Ok, now to clean this strand */
  
                cp = & current_detail->hash_table[current_index];
-               ch = *cp;
-               for (; ch; cp= & ch->next, ch= *cp) {
+               for (ch = *cp ; ch ; cp = & ch->next, ch = *cp) {
                        if (current_detail->nextcheck > ch->expiry_time)
                                current_detail->nextcheck = ch->expiry_time+1;
-                       if (ch->expiry_time >= get_seconds() &&
-                           ch->last_refresh >= current_detail->flush_time)
+                       if (!cache_is_expired(current_detail, ch))
                                continue;
-                       if (test_and_clear_bit(CACHE_PENDING, &ch->flags))
-                               cache_dequeue(current_detail, ch);
  
-                       if (atomic_read(&ch->ref.refcount) == 1)
-                               break;
-               }
-               if (ch) {
                        *cp = ch->next;
                        ch->next = NULL;
                        current_detail->entries--;
                        rv = 1;
+                       break;
                }
+ 
                write_unlock(&current_detail->hash_lock);
                d = current_detail;
                if (!ch)
                        current_index ++;
                spin_unlock(&cache_list_lock);
                if (ch) {
+                       if (test_and_clear_bit(CACHE_PENDING, &ch->flags))
+                               cache_dequeue(current_detail, ch);
                        cache_revisit_request(ch);
                        cache_put(ch, d);
                }
@@@ -1234,8 -1244,10 +1245,10 @@@ static int content_open(struct inode *i
        if (!cd || !try_module_get(cd->owner))
                return -EACCES;
        han = __seq_open_private(file, &cache_content_op, sizeof(*han));
-       if (han == NULL)
+       if (han == NULL) {
+               module_put(cd->owner);
                return -ENOMEM;
+       }
  
        han->cd = cd;
        return 0;
@@@ -1332,18 -1344,12 +1345,18 @@@ static unsigned int cache_poll_procfs(s
        return cache_poll(filp, wait, cd);
  }
  
 -static int cache_ioctl_procfs(struct inode *inode, struct file *filp,
 -                            unsigned int cmd, unsigned long arg)
 +static long cache_ioctl_procfs(struct file *filp,
 +                             unsigned int cmd, unsigned long arg)
  {
 +      long ret;
 +      struct inode *inode = filp->f_path.dentry->d_inode;
        struct cache_detail *cd = PDE(inode)->data;
  
 -      return cache_ioctl(inode, filp, cmd, arg, cd);
 +      lock_kernel();
 +      ret = cache_ioctl(inode, filp, cmd, arg, cd);
 +      unlock_kernel();
 +
 +      return ret;
  }
  
  static int cache_open_procfs(struct inode *inode, struct file *filp)
@@@ -1366,7 -1372,7 +1379,7 @@@ static const struct file_operations cac
        .read           = cache_read_procfs,
        .write          = cache_write_procfs,
        .poll           = cache_poll_procfs,
 -      .ioctl          = cache_ioctl_procfs, /* for FIONREAD */
 +      .unlocked_ioctl = cache_ioctl_procfs, /* for FIONREAD */
        .open           = cache_open_procfs,
        .release        = cache_release_procfs,
  };