Patch "pnfs_nfs: fix _cancel_empty_pagelist" has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

pnfs_nfs: fix _cancel_empty_pagelist

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
pnfs_nfs-fix-_cancel_empty_pagelist.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Weston Andros Adamson <[email protected]>
Date: Fri, 17 Jun 2016 16:48:24 -0400
Subject: pnfs_nfs: fix _cancel_empty_pagelist

From: Weston Andros Adamson <[email protected]>

commit 5e3a98883e7ebdd1440f829a9e9dd5c3d2c5903b upstream.

pnfs_generic_commit_cancel_empty_pagelist calls nfs_commitdata_release, but that is wrong: nfs_commitdata_release puts the open context, something that isn't valid until nfs_init_commit is called, which is never the case when pnfs_generic_commit_cancel_empty_pagelist is called.

This was introduced in "nfs: avoid race that crashes nfs_init_commit".

---
 fs/nfs/pnfs_nfs.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

@@ -247,7 +247,11 @@ void pnfs_fetch_commit_bucket_list(struc
 }
 
 /* Helper function for pnfs_generic_commit_pagelist to catch an empty
- * page list. This can happen when two commits race. */
+ * page list. This can happen when two commits race.
+ *
+ * This must be called instead of nfs_init_commit - call one or the other, but
+ * not both!
+ */
 static bool
 pnfs_generic_commit_cancel_empty_pagelist(struct list_head *pages,
 					  struct nfs_commit_data *data,

@@ -256,7 +260,11 @@ pnfs_generic_commit_cancel_empty_pagelis
 	if (list_empty(pages)) {
 		if (atomic_dec_and_test(&cinfo->mds->rpcs_out))
 			wake_up_atomic_t(&cinfo->mds->rpcs_out);
-		nfs_commitdata_release(data);
+		/* don't call nfs_commitdata_release - it tries to put
+		 * the open_context which is not acquired until nfs_init_commit
+		 * which has not been called on @data */
+		WARN_ON_ONCE(data->context);
+		nfs_commit_free(data);
 		return true;
 	}
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/pnfs_nfs-fix-_cancel_empty_pagelist.patch