NFSv4.1: Balance pnfs_layout_hdr refcount in pnfs_layout_(insert|remove)_lseg

Ensure that the reference count for pnfs_layout_hdr reverts to the
original value after a call to pnfs_layout_remove_lseg().

Note that the caller is expected to hold a reference to the struct
pnfs_layout_hdr.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index a93c734f14c907f070d0a8df90c38fc2b0f60a8c..4daeb655608afc35feddb1913348f9a7acd4e625 100644 (file)
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -295,8 +295,6 @@ static void pnfs_free_lseg(struct pnfs_layout_segment *lseg)
        struct inode *ino = lseg->pls_layout->plh_inode;
 
        NFS_SERVER(ino)->pnfs_curr_ld->free_lseg(lseg);
-       /* Matched by pnfs_get_layout_hdr in pnfs_layout_insert_lseg */
-       pnfs_put_layout_hdr(NFS_I(ino)->layout);
 }
 
 static void
@@ -307,6 +305,8 @@ pnfs_layout_remove_lseg(struct pnfs_layout_hdr *lo,
 
        WARN_ON(test_bit(NFS_LSEG_VALID, &lseg->pls_flags));
        list_del_init(&lseg->pls_list);
+       /* Matched by pnfs_get_layout_hdr in pnfs_layout_insert_lseg */
+       atomic_dec(&lo->plh_refcount);
        if (list_empty(&lo->plh_segs))
                set_bit(NFS_LAYOUT_DESTROYED, &lo->plh_flags);
        rpc_wake_up(&NFS_SERVER(inode)->roc_rpcwaitq);
@@ -327,9 +327,11 @@ pnfs_put_lseg(struct pnfs_layout_segment *lseg)
        lo = lseg->pls_layout;
        inode = lo->plh_inode;
        if (atomic_dec_and_lock(&lseg->pls_refcount, &inode->i_lock)) {
+               pnfs_get_layout_hdr(lo);
                pnfs_layout_remove_lseg(lo, lseg);
                spin_unlock(&inode->i_lock);
                pnfs_free_lseg(lseg);
+               pnfs_put_layout_hdr(lo);
        }
 }
 EXPORT_SYMBOL_GPL(pnfs_put_lseg);