Index: /trunk/server/common/patches/openafs-afs_conn-overcounts.patch
===================================================================
--- /trunk/server/common/patches/openafs-afs_conn-overcounts.patch	(revision 2649)
+++ /trunk/server/common/patches/openafs-afs_conn-overcounts.patch	(revision 2649)
@@ -0,0 +1,76 @@
+From 368fff3b2fef5b559ed6da016e1e9f0413b55552 Mon Sep 17 00:00:00 2001
+From: Andrew Deason <adeason@sinenomine.net>
+Date: Sun, 14 Sep 2014 14:10:11 -0500
+Subject: [PATCH] afs: Fix some afs_conn overcounts
+
+The usual pattern of using afs_Conn looks like this:
+
+  do {
+      tc = afs_Conn(...);
+      if (tc) {
+          code = /* ... */
+      } else {
+          code = -1;
+      }
+  } while (afs_Analyze(...));
+
+The afs_Analyze call, amongst other things, puts back the reference to
+the connection obtained from afs_Conn. If anything inside the do/while
+block exits that block without calling afs_Analyze or afs_PutConn, we
+will leak a reference to the conn.
+
+A few places currently do this, by jumping out of the loop with
+'goto's. Specifically, in afs_dcache.c and afs_bypasscache.c. These
+locations currently leak references to our connection object (and to
+the underlying Rx connection object), which can cause problems over
+time. Specifically, this can cause a panic when the refcount overflows
+and becomes negative, causing a panic message that looks like:
+
+  afs_PutConn: refcount imbalance 0xd34db33f -32768
+
+To avoid this, make sure we afs_PutConn in these cases where we 'goto'
+out of the afs_Conn/afs_Analyze loop. Perhaps ideally we should cause
+afs_Analyze itself to be called in these situations, but for now just
+fix the problem with the least amount of impact possible.
+
+FIXES 131885
+
+Change-Id: I3a52f8ccef24f01d04c02db0a4b711405360e323
+---
+ src/afs/afs_bypasscache.c | 1 +
+ src/afs/afs_dcache.c      | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/src/afs/afs_bypasscache.c b/src/afs/afs_bypasscache.c
+index 744feb2..8fc6009 100644
+--- a/src/afs/afs_bypasscache.c
++++ b/src/afs/afs_bypasscache.c
+@@ -637,6 +637,7 @@ afs_PrefetchNoCache(struct vcache *avc,
+ 	    } else {
+ 		afs_warn("BYPASS: StartRXAFS_FetchData failed: %d\n", code);
+ 		unlock_and_release_pages(auio);
++		afs_PutConn(tc, rxconn, SHARED_LOCK);
+ 		goto done;
+ 	    }
+ 	    if (code == 0) {
+diff --git a/src/afs/afs_dcache.c b/src/afs/afs_dcache.c
+index dc1e039..a156e22 100644
+--- a/src/afs/afs_dcache.c
++++ b/src/afs/afs_dcache.c
+@@ -2399,6 +2399,13 @@ afs_GetDCache(struct vcache *avc, afs_size_t abyte,
+ 			afs_PutDCache(tdc);
+ 			tdc = 0;
+ 			ReleaseReadLock(&avc->lock);
++
++			if (tc) {
++			    /* If we have a connection, we must put it back,
++			     * since afs_Analyze will not be called here. */
++			    afs_PutConn(tc, rxconn, SHARED_LOCK);
++			}
++
+ 			slowPass = 1;
+ 			goto RetryGetDCache;
+ 		    }
+-- 
+2.2.0
+
Index: /trunk/server/fedora/specs/openafs.spec.patch
===================================================================
--- /trunk/server/fedora/specs/openafs.spec.patch	(revision 2648)
+++ /trunk/server/fedora/specs/openafs.spec.patch	(revision 2649)
@@ -10,5 +10,5 @@
  %{!?fedorakmod: %define fedorakmod 1}
  %{!?build_dkmspkg: %define build_dkmspkg 1}
-@@ -249,9 +249,19 @@
+@@ -249,9 +249,20 @@
  %if %{build_modules}
  BuildRequires: kernel-devel
@@ -25,4 +25,5 @@
 +Patch1006: openafs-linux-3.17.patch
 +Patch1007: openafs-mvid-NULL-deref.patch
++Patch1008: openafs-afs_conn-overcounts.patch
 +%define _default_patch_fuzz 2
 +
@@ -95,5 +96,5 @@
  %else
  
-@@ -698,6 +712,15 @@
+@@ -698,6 +712,16 @@
  #%setup -q -n %{srcdir}
  %setup -q -b 1 -n %{srcdir}
@@ -107,4 +108,5 @@
 +%patch1006 -p1 -b .linux-3.17
 +%patch1007 -p1 -b .mvid-NULL-deref.patch
++%patch1008 -p1 -b .afs_conn-overcounts.patch
 +
  ##############################################################################