Merge branch 'for-linus' into for-4.12/block

We've added a considerable amount of fixes for stalls and issues
with the blk-mq scheduling in the 4.11 series since forking
off the for-4.12/block branch. We need to do improvements on
top of that for 4.12, so pull in the previous fixes to make
our lives easier going forward.

Signed-off-by: Jens Axboe <axboe@fb.com>

20 files changed, 167 insertions, 209 deletions

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 28e81922a21c..8df797432740 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1714,7 +1714,8 @@ static int __process_pages_contig(struct address_space *mapping,
                          * can we find nothing at @index.
                          */
                         ASSERT(page_ops & PAGE_LOCK);
-                        return ret;
+                        err = -EAGAIN;
+                        goto out;
                 }
 
                 for (i = 0; i < ret; i++) {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index c40060cc481f..231503935652 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6709,6 +6709,20 @@ static noinline int uncompress_inline(struct btrfs_path *path,
         max_size = min_t(unsigned long, PAGE_SIZE, max_size);
         ret = btrfs_decompress(compress_type, tmp, page,
                                extent_offset, inline_size, max_size);
+
+        /*
+         * decompression code contains a memset to fill in any space between the end
+         * of the uncompressed data and the end of max_size in case the decompressed
+         * data ends up shorter than ram_bytes.  That doesn't cover the hole between
+         * the end of an inline extent and the beginning of the next block, so we
+         * cover that region here.
+         */
+
+        if (max_size + pg_offset < PAGE_SIZE) {
+                char *map = kmap(page);
+                memset(map + pg_offset + max_size, 0, PAGE_SIZE - max_size - pg_offset);
+                kunmap(page);
+        }
         kfree(tmp);
         return ret;
 }
diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
index 02a7a9286449..6d6eca394d4d 100644
--- a/fs/crypto/crypto.c
+++ b/fs/crypto/crypto.c
@@ -327,7 +327,6 @@ EXPORT_SYMBOL(fscrypt_decrypt_page);
 static int fscrypt_d_revalidate(struct dentry *dentry, unsigned int flags)
 {
         struct dentry *dir;
-        struct fscrypt_info *ci;
         int dir_has_key, cached_with_key;
 
         if (flags & LOOKUP_RCU)
@@ -339,18 +338,11 @@ static int fscrypt_d_revalidate(struct dentry *dentry, unsigned int flags)
                 return 0;
         }
 
-        ci = d_inode(dir)->i_crypt_info;
-        if (ci && ci->ci_keyring_key &&
-            (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-                                          (1 << KEY_FLAG_REVOKED) |
-                                          (1 << KEY_FLAG_DEAD))))
-                ci = NULL;
-
         /* this should eventually be an flag in d_flags */
         spin_lock(&dentry->d_lock);
         cached_with_key = dentry->d_flags & DCACHE_ENCRYPTED_WITH_KEY;
         spin_unlock(&dentry->d_lock);
-        dir_has_key = (ci != NULL);
+        dir_has_key = (d_inode(dir)->i_crypt_info != NULL);
         dput(dir);
 
         /*
diff --git a/fs/crypto/fname.c b/fs/crypto/fname.c
index 13052b85c393..37b49894c762 100644
--- a/fs/crypto/fname.c
+++ b/fs/crypto/fname.c
@@ -350,7 +350,7 @@ int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname,
                 fname->disk_name.len = iname->len;
                 return 0;
         }
-        ret = fscrypt_get_crypt_info(dir);
+        ret = fscrypt_get_encryption_info(dir);
         if (ret && ret != -EOPNOTSUPP)
                 return ret;
 
diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h
index fdbb8af32eaf..e39696e64494 100644
--- a/fs/crypto/fscrypt_private.h
+++ b/fs/crypto/fscrypt_private.h
@@ -67,7 +67,6 @@ struct fscrypt_info {
         u8 ci_filename_mode;
         u8 ci_flags;
         struct crypto_skcipher *ci_ctfm;
-        struct key *ci_keyring_key;
         u8 ci_master_key[FS_KEY_DESCRIPTOR_SIZE];
 };
 
@@ -101,7 +100,4 @@ extern int fscrypt_do_page_crypto(const struct inode *inode,
 extern struct page *fscrypt_alloc_bounce_page(struct fscrypt_ctx *ctx,
                                               gfp_t gfp_flags);
 
-/* keyinfo.c */
-extern int fscrypt_get_crypt_info(struct inode *);
-
 #endif /* _FSCRYPT_PRIVATE_H */
diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
index d5d896fa5a71..8cdfddce2b34 100644
--- a/fs/crypto/keyinfo.c
+++ b/fs/crypto/keyinfo.c
@@ -95,6 +95,7 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
         kfree(description);
         if (IS_ERR(keyring_key))
                 return PTR_ERR(keyring_key);
+        down_read(&keyring_key->sem);
 
         if (keyring_key->type != &key_type_logon) {
                 printk_once(KERN_WARNING
@@ -102,11 +103,9 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
                 res = -ENOKEY;
                 goto out;
         }
-        down_read(&keyring_key->sem);
         ukp = user_key_payload_locked(keyring_key);
         if (ukp->datalen != sizeof(struct fscrypt_key)) {
                 res = -EINVAL;
-                up_read(&keyring_key->sem);
                 goto out;
         }
         master_key = (struct fscrypt_key *)ukp->data;
@@ -117,17 +116,11 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
                                 "%s: key size incorrect: %d\n",
                                 __func__, master_key->size);
                 res = -ENOKEY;
-                up_read(&keyring_key->sem);
                 goto out;
         }
         res = derive_key_aes(ctx->nonce, master_key->raw, raw_key);
-        up_read(&keyring_key->sem);
-        if (res)
-                goto out;
-
-        crypt_info->ci_keyring_key = keyring_key;
-        return 0;
 out:
+        up_read(&keyring_key->sem);
         key_put(keyring_key);
         return res;
 }
@@ -169,12 +162,11 @@ static void put_crypt_info(struct fscrypt_info *ci)
         if (!ci)
                 return;
 
-        key_put(ci->ci_keyring_key);
         crypto_free_skcipher(ci->ci_ctfm);
         kmem_cache_free(fscrypt_info_cachep, ci);
 }
 
-int fscrypt_get_crypt_info(struct inode *inode)
+int fscrypt_get_encryption_info(struct inode *inode)
 {
         struct fscrypt_info *crypt_info;
         struct fscrypt_context ctx;
@@ -184,21 +176,15 @@ int fscrypt_get_crypt_info(struct inode *inode)
         u8 *raw_key = NULL;
         int res;
 
+        if (inode->i_crypt_info)
+                return 0;
+
         res = fscrypt_initialize(inode->i_sb->s_cop->flags);
         if (res)
                 return res;
 
         if (!inode->i_sb->s_cop->get_context)
                 return -EOPNOTSUPP;
-retry:
-        crypt_info = ACCESS_ONCE(inode->i_crypt_info);
-        if (crypt_info) {
-                if (!crypt_info->ci_keyring_key ||
-                                key_validate(crypt_info->ci_keyring_key) == 0)
-                        return 0;
-                fscrypt_put_encryption_info(inode, crypt_info);
-                goto retry;
-        }
 
         res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx));
         if (res < 0) {
@@ -229,7 +215,6 @@ retry:
         crypt_info->ci_data_mode = ctx.contents_encryption_mode;
         crypt_info->ci_filename_mode = ctx.filenames_encryption_mode;
         crypt_info->ci_ctfm = NULL;
-        crypt_info->ci_keyring_key = NULL;
         memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor,
                                 sizeof(crypt_info->ci_master_key));
 
@@ -273,14 +258,8 @@ retry:
         if (res)
                 goto out;
 
-        kzfree(raw_key);
-        raw_key = NULL;
-        if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) != NULL) {
-                put_crypt_info(crypt_info);
-                goto retry;
-        }
-        return 0;
-
+        if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) == NULL)
+                crypt_info = NULL;
 out:
         if (res == -ENOKEY)
                 res = 0;
@@ -288,6 +267,7 @@ out:
         kzfree(raw_key);
         return res;
 }
+EXPORT_SYMBOL(fscrypt_get_encryption_info);
 
 void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci)
 {
@@ -305,17 +285,3 @@ void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci)
         put_crypt_info(ci);
 }
 EXPORT_SYMBOL(fscrypt_put_encryption_info);
-
-int fscrypt_get_encryption_info(struct inode *inode)
-{
-        struct fscrypt_info *ci = inode->i_crypt_info;
-
-        if (!ci ||
-                (ci->ci_keyring_key &&
-                 (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-                                               (1 << KEY_FLAG_REVOKED) |
-                                               (1 << KEY_FLAG_DEAD)))))
-                return fscrypt_get_crypt_info(inode);
-        return 0;
-}
-EXPORT_SYMBOL(fscrypt_get_encryption_info);
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index 14b76da71269..4908906d54d5 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -33,17 +33,10 @@ static int create_encryption_context_from_policy(struct inode *inode,
                                 const struct fscrypt_policy *policy)
 {
         struct fscrypt_context ctx;
-        int res;
 
         if (!inode->i_sb->s_cop->set_context)
                 return -EOPNOTSUPP;
 
-        if (inode->i_sb->s_cop->prepare_context) {
-                res = inode->i_sb->s_cop->prepare_context(inode);
-                if (res)
-                        return res;
-        }
-
         ctx.format = FS_ENCRYPTION_CONTEXT_FORMAT_V1;
         memcpy(ctx.master_key_descriptor, policy->master_key_descriptor,
                                         FS_KEY_DESCRIPTOR_SIZE);
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 30a9f210d1e3..375fb1c05d49 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1169,10 +1169,9 @@ static int ext4_finish_convert_inline_dir(handle_t *handle,
         set_buffer_uptodate(dir_block);
         err = ext4_handle_dirty_dirent_node(handle, inode, dir_block);
         if (err)
-                goto out;
+                return err;
         set_buffer_verified(dir_block);
-out:
-        return err;
+        return ext4_mark_inode_dirty(handle, inode);
 }
 
 static int ext4_convert_inline_data_nolock(handle_t *handle,
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 7385e6a6b6cb..4247d8d25687 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5400,7 +5400,7 @@ int ext4_getattr(const struct path *path, struct kstat *stat,
          * If there is inline data in the inode, the inode will normally not
          * have data blocks allocated (it may have an external xattr block).
          * Report at least one sector for such files, so tools like tar, rsync,
-         * others doen't incorrectly think the file is completely sparse.
+         * others don't incorrectly think the file is completely sparse.
          */
         if (unlikely(ext4_has_inline_data(inode)))
                 stat->blocks += (stat->size + 511) >> 9;
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 578f8c33fb44..c992ef2c2f94 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -511,7 +511,7 @@ mext_check_arguments(struct inode *orig_inode,
         if ((orig_start & ~(PAGE_MASK >> orig_inode->i_blkbits)) !=
             (donor_start & ~(PAGE_MASK >> orig_inode->i_blkbits))) {
                 ext4_debug("ext4 move extent: orig and donor's start "
-                        "offset are not alligned [ino:orig %lu, donor %lu]\n",
+                        "offsets are not aligned [ino:orig %lu, donor %lu]\n",
                         orig_inode->i_ino, donor_inode->i_ino);
                 return -EINVAL;
         }
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 2e03a0a88d92..a9448db1cf7e 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1120,17 +1120,16 @@ static int ext4_get_context(struct inode *inode, void *ctx, size_t len)
                                  EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, ctx, len);
 }
 
-static int ext4_prepare_context(struct inode *inode)
-{
-        return ext4_convert_inline_data(inode);
-}
-
 static int ext4_set_context(struct inode *inode, const void *ctx, size_t len,
                                                         void *fs_data)
 {
         handle_t *handle = fs_data;
         int res, res2, retries = 0;
 
+        res = ext4_convert_inline_data(inode);
+        if (res)
+                return res;
+
         /*
          * If a journal handle was specified, then the encryption context is
          * being set on a new inode via inheritance and is part of a larger
@@ -1196,7 +1195,6 @@ static unsigned ext4_max_namelen(struct inode *inode)
 static const struct fscrypt_operations ext4_cryptops = {
         .key_prefix             = "ext4:",
         .get_context            = ext4_get_context,
-        .prepare_context        = ext4_prepare_context,
         .set_context            = ext4_set_context,
         .dummy_context          = ext4_dummy_context,
         .is_encrypted           = ext4_encrypted_inode,
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 67636acf7624..996e7900d4c8 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -131,31 +131,26 @@ static __le32 ext4_xattr_block_csum(struct inode *inode,
 }
 
 static int ext4_xattr_block_csum_verify(struct inode *inode,
-                                        sector_t block_nr,
-                                        struct ext4_xattr_header *hdr)
+                                        struct buffer_head *bh)
 {
-        if (ext4_has_metadata_csum(inode->i_sb) &&
-            (hdr->h_checksum != ext4_xattr_block_csum(inode, block_nr, hdr)))
-                return 0;
-        return 1;
-}
-
-static void ext4_xattr_block_csum_set(struct inode *inode,
-                                      sector_t block_nr,
-                                      struct ext4_xattr_header *hdr)
-{
-        if (!ext4_has_metadata_csum(inode->i_sb))
-                return;
+        struct ext4_xattr_header *hdr = BHDR(bh);
+        int ret = 1;
 
-        hdr->h_checksum = ext4_xattr_block_csum(inode, block_nr, hdr);
+        if (ext4_has_metadata_csum(inode->i_sb)) {
+                lock_buffer(bh);
+                ret = (hdr->h_checksum == ext4_xattr_block_csum(inode,
+                                                        bh->b_blocknr, hdr));
+                unlock_buffer(bh);
+        }
+        return ret;
 }
 
-static inline int ext4_handle_dirty_xattr_block(handle_t *handle,
-                                                struct inode *inode,
-                                                struct buffer_head *bh)
+static void ext4_xattr_block_csum_set(struct inode *inode,
+                                      struct buffer_head *bh)
 {
-        ext4_xattr_block_csum_set(inode, bh->b_blocknr, BHDR(bh));
-        return ext4_handle_dirty_metadata(handle, inode, bh);
+        if (ext4_has_metadata_csum(inode->i_sb))
+                BHDR(bh)->h_checksum = ext4_xattr_block_csum(inode,
+                                                bh->b_blocknr, BHDR(bh));
 }
 
 static inline const struct xattr_handler *
@@ -233,7 +228,7 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh)
         if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
             BHDR(bh)->h_blocks != cpu_to_le32(1))
                 return -EFSCORRUPTED;
-        if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh)))
+        if (!ext4_xattr_block_csum_verify(inode, bh))
                 return -EFSBADCRC;
         error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size,
                                        bh->b_data);
@@ -618,23 +613,22 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
                         }
                 }
 
+                ext4_xattr_block_csum_set(inode, bh);
                 /*
                  * Beware of this ugliness: Releasing of xattr block references
                  * from different inodes can race and so we have to protect
                  * from a race where someone else frees the block (and releases
                  * its journal_head) before we are done dirtying the buffer. In
                  * nojournal mode this race is harmless and we actually cannot
-                 * call ext4_handle_dirty_xattr_block() with locked buffer as
+                 * call ext4_handle_dirty_metadata() with locked buffer as
                  * that function can call sync_dirty_buffer() so for that case
                  * we handle the dirtying after unlocking the buffer.
                  */
                 if (ext4_handle_valid(handle))
-                        error = ext4_handle_dirty_xattr_block(handle, inode,
-                                                              bh);
+                        error = ext4_handle_dirty_metadata(handle, inode, bh);
                 unlock_buffer(bh);
                 if (!ext4_handle_valid(handle))
-                        error = ext4_handle_dirty_xattr_block(handle, inode,
-                                                              bh);
+                        error = ext4_handle_dirty_metadata(handle, inode, bh);
                 if (IS_SYNC(inode))
                         ext4_handle_sync(handle);
                 dquot_free_block(inode, EXT4_C2B(EXT4_SB(inode->i_sb), 1));
@@ -863,13 +857,14 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
                                 ext4_xattr_cache_insert(ext4_mb_cache,
                                         bs->bh);
                         }
+                        ext4_xattr_block_csum_set(inode, bs->bh);
                         unlock_buffer(bs->bh);
                         if (error == -EFSCORRUPTED)
                                 goto bad_block;
                         if (!error)
-                                error = ext4_handle_dirty_xattr_block(handle,
-                                                                      inode,
-                                                                      bs->bh);
+                                error = ext4_handle_dirty_metadata(handle,
+                                                                   inode,
+                                                                   bs->bh);
                         if (error)
                                 goto cleanup;
                         goto inserted;
@@ -967,10 +962,11 @@ inserted:
                                         ce->e_reusable = 0;
                                 ea_bdebug(new_bh, "reusing; refcount now=%d",
                                           ref);
+                                ext4_xattr_block_csum_set(inode, new_bh);
                                 unlock_buffer(new_bh);
-                                error = ext4_handle_dirty_xattr_block(handle,
-                                                                      inode,
-                                                                      new_bh);
+                                error = ext4_handle_dirty_metadata(handle,
+                                                                   inode,
+                                                                   new_bh);
                                 if (error)
                                         goto cleanup_dquot;
                         }
@@ -1020,11 +1016,12 @@ getblk_failed:
                                 goto getblk_failed;
                         }
                         memcpy(new_bh->b_data, s->base, new_bh->b_size);
+                        ext4_xattr_block_csum_set(inode, new_bh);
                         set_buffer_uptodate(new_bh);
                         unlock_buffer(new_bh);
                         ext4_xattr_cache_insert(ext4_mb_cache, new_bh);
-                        error = ext4_handle_dirty_xattr_block(handle,
-                                                              inode, new_bh);
+                        error = ext4_handle_dirty_metadata(handle, inode,
+                                                           new_bh);
                         if (error)
                                 goto cleanup;
                 }
diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
index a77df377e2e8..ee2d0a485fc3 100644
--- a/fs/f2fs/debug.c
+++ b/fs/f2fs/debug.c
@@ -196,6 +196,7 @@ static void update_mem_info(struct f2fs_sb_info *sbi)
         si->base_mem += (NM_I(sbi)->nat_bits_blocks << F2FS_BLKSIZE_BITS);
         si->base_mem += NM_I(sbi)->nat_blocks * NAT_ENTRY_BITMAP_SIZE;
         si->base_mem += NM_I(sbi)->nat_blocks / 8;
+        si->base_mem += NM_I(sbi)->nat_blocks * sizeof(unsigned short);
 
 get_cache:
         si->cache_mem = 0;
diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 4650c9b85de7..8d5c62b07b28 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -750,7 +750,7 @@ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
         dentry_blk = page_address(page);
         bit_pos = dentry - dentry_blk->dentry;
         for (i = 0; i < slots; i++)
-                clear_bit_le(bit_pos + i, &dentry_blk->dentry_bitmap);
+                __clear_bit_le(bit_pos + i, &dentry_blk->dentry_bitmap);
 
         /* Let's check and deallocate this dentry page */
         bit_pos = find_next_bit_le(&dentry_blk->dentry_bitmap,
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index e849f83d6114..0a6e115562f6 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -561,6 +561,8 @@ struct f2fs_nm_info {
         struct mutex build_lock;        /* lock for build free nids */
         unsigned char (*free_nid_bitmap)[NAT_ENTRY_BITMAP_SIZE];
         unsigned char *nat_block_bitmap;
+        unsigned short *free_nid_count; /* free nid count of NAT block */
+        spinlock_t free_nid_lock;       /* protect updating of nid count */
 
         /* for checkpoint */
         char *nat_bitmap;               /* NAT bitmap pointer */
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 94967171dee8..481aa8dc79f4 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -338,9 +338,6 @@ static void set_node_addr(struct f2fs_sb_info *sbi, struct node_info *ni,
                 set_nat_flag(e, IS_CHECKPOINTED, false);
         __set_nat_cache_dirty(nm_i, e);
 
-        if (enabled_nat_bits(sbi, NULL) && new_blkaddr == NEW_ADDR)
-                clear_bit_le(NAT_BLOCK_OFFSET(ni->nid), nm_i->empty_nat_bits);
-
         /* update fsync_mark if its inode nat entry is still alive */
         if (ni->nid != ni->ino)
                 e = __lookup_nat_cache(nm_i, ni->ino);
@@ -1823,7 +1820,8 @@ static void remove_free_nid(struct f2fs_sb_info *sbi, nid_t nid)
                 kmem_cache_free(free_nid_slab, i);
 }
 
-void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid, bool set)
+static void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid,
+                        bool set, bool build, bool locked)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
         unsigned int nat_ofs = NAT_BLOCK_OFFSET(nid);
@@ -1833,9 +1831,18 @@ void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid, bool set)
                 return;
 
         if (set)
-                set_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+                __set_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
         else
-                clear_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+                __clear_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+
+        if (!locked)
+                spin_lock(&nm_i->free_nid_lock);
+        if (set)
+                nm_i->free_nid_count[nat_ofs]++;
+        else if (!build)
+                nm_i->free_nid_count[nat_ofs]--;
+        if (!locked)
+                spin_unlock(&nm_i->free_nid_lock);
 }
 
 static void scan_nat_page(struct f2fs_sb_info *sbi,
@@ -1847,7 +1854,10 @@ static void scan_nat_page(struct f2fs_sb_info *sbi,
         unsigned int nat_ofs = NAT_BLOCK_OFFSET(start_nid);
         int i;
 
-        set_bit_le(nat_ofs, nm_i->nat_block_bitmap);
+        if (test_bit_le(nat_ofs, nm_i->nat_block_bitmap))
+                return;
+
+        __set_bit_le(nat_ofs, nm_i->nat_block_bitmap);
 
         i = start_nid % NAT_ENTRY_PER_BLOCK;
 
@@ -1861,7 +1871,7 @@ static void scan_nat_page(struct f2fs_sb_info *sbi,
                 f2fs_bug_on(sbi, blk_addr == NEW_ADDR);
                 if (blk_addr == NULL_ADDR)
                         freed = add_free_nid(sbi, start_nid, true);
-                update_free_nid_bitmap(sbi, start_nid, freed);
+                update_free_nid_bitmap(sbi, start_nid, freed, true, false);
         }
 }
 
@@ -1877,6 +1887,8 @@ static void scan_free_nid_bits(struct f2fs_sb_info *sbi)
         for (i = 0; i < nm_i->nat_blocks; i++) {
                 if (!test_bit_le(i, nm_i->nat_block_bitmap))
                         continue;
+                if (!nm_i->free_nid_count[i])
+                        continue;
                 for (idx = 0; idx < NAT_ENTRY_PER_BLOCK; idx++) {
                         nid_t nid;
 
@@ -1907,58 +1919,6 @@ out:
         up_read(&nm_i->nat_tree_lock);
 }
 
-static int scan_nat_bits(struct f2fs_sb_info *sbi)
-{
-        struct f2fs_nm_info *nm_i = NM_I(sbi);
-        struct page *page;
-        unsigned int i = 0;
-        nid_t nid;
-
-        if (!enabled_nat_bits(sbi, NULL))
-                return -EAGAIN;
-
-        down_read(&nm_i->nat_tree_lock);
-check_empty:
-        i = find_next_bit_le(nm_i->empty_nat_bits, nm_i->nat_blocks, i);
-        if (i >= nm_i->nat_blocks) {
-                i = 0;
-                goto check_partial;
-        }
-
-        for (nid = i * NAT_ENTRY_PER_BLOCK; nid < (i + 1) * NAT_ENTRY_PER_BLOCK;
-                                                                        nid++) {
-                if (unlikely(nid >= nm_i->max_nid))
-                        break;
-                add_free_nid(sbi, nid, true);
-        }
-
-        if (nm_i->nid_cnt[FREE_NID_LIST] >= MAX_FREE_NIDS)
-                goto out;
-        i++;
-        goto check_empty;
-
-check_partial:
-        i = find_next_zero_bit_le(nm_i->full_nat_bits, nm_i->nat_blocks, i);
-        if (i >= nm_i->nat_blocks) {
-                disable_nat_bits(sbi, true);
-                up_read(&nm_i->nat_tree_lock);
-                return -EINVAL;
-        }
-
-        nid = i * NAT_ENTRY_PER_BLOCK;
-        page = get_current_nat_page(sbi, nid);
-        scan_nat_page(sbi, page, nid);
-        f2fs_put_page(page, 1);
-
-        if (nm_i->nid_cnt[FREE_NID_LIST] < MAX_FREE_NIDS) {
-                i++;
-                goto check_partial;
-        }
-out:
-        up_read(&nm_i->nat_tree_lock);
-        return 0;
-}
-
 static void __build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
@@ -1980,21 +1940,6 @@ static void __build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount)
 
                 if (nm_i->nid_cnt[FREE_NID_LIST])
                         return;
-
-                /* try to find free nids with nat_bits */
-                if (!scan_nat_bits(sbi) && nm_i->nid_cnt[FREE_NID_LIST])
-                        return;
-        }
-
-        /* find next valid candidate */
-        if (enabled_nat_bits(sbi, NULL)) {
-                int idx = find_next_zero_bit_le(nm_i->full_nat_bits,
-                                        nm_i->nat_blocks, 0);
-
-                if (idx >= nm_i->nat_blocks)
-                        set_sbi_flag(sbi, SBI_NEED_FSCK);
-                else
-                        nid = idx * NAT_ENTRY_PER_BLOCK;
         }
 
         /* readahead nat pages to be scanned */
@@ -2081,7 +2026,7 @@ retry:
                 __insert_nid_to_list(sbi, i, ALLOC_NID_LIST, false);
                 nm_i->available_nids--;
 
-                update_free_nid_bitmap(sbi, *nid, false);
+                update_free_nid_bitmap(sbi, *nid, false, false, false);
 
                 spin_unlock(&nm_i->nid_list_lock);
                 return true;
@@ -2137,7 +2082,7 @@ void alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid)
 
         nm_i->available_nids++;
 
-        update_free_nid_bitmap(sbi, nid, true);
+        update_free_nid_bitmap(sbi, nid, true, false, false);
 
         spin_unlock(&nm_i->nid_list_lock);
 
@@ -2383,7 +2328,7 @@ add_out:
         list_add_tail(&nes->set_list, head);
 }
 
-void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
+static void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
                                                 struct page *page)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
@@ -2402,16 +2347,16 @@ void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
                         valid++;
         }
         if (valid == 0) {
-                set_bit_le(nat_index, nm_i->empty_nat_bits);
-                clear_bit_le(nat_index, nm_i->full_nat_bits);
+                __set_bit_le(nat_index, nm_i->empty_nat_bits);
+                __clear_bit_le(nat_index, nm_i->full_nat_bits);
                 return;
         }
 
-        clear_bit_le(nat_index, nm_i->empty_nat_bits);
+        __clear_bit_le(nat_index, nm_i->empty_nat_bits);
         if (valid == NAT_ENTRY_PER_BLOCK)
-                set_bit_le(nat_index, nm_i->full_nat_bits);
+                __set_bit_le(nat_index, nm_i->full_nat_bits);
         else
-                clear_bit_le(nat_index, nm_i->full_nat_bits);
+                __clear_bit_le(nat_index, nm_i->full_nat_bits);
 }
 
 static void __flush_nat_entry_set(struct f2fs_sb_info *sbi,
@@ -2467,11 +2412,11 @@ static void __flush_nat_entry_set(struct f2fs_sb_info *sbi,
                         add_free_nid(sbi, nid, false);
                         spin_lock(&NM_I(sbi)->nid_list_lock);
                         NM_I(sbi)->available_nids++;
-                        update_free_nid_bitmap(sbi, nid, true);
+                        update_free_nid_bitmap(sbi, nid, true, false, false);
                         spin_unlock(&NM_I(sbi)->nid_list_lock);
                 } else {
                         spin_lock(&NM_I(sbi)->nid_list_lock);
-                        update_free_nid_bitmap(sbi, nid, false);
+                        update_free_nid_bitmap(sbi, nid, false, false, false);
                         spin_unlock(&NM_I(sbi)->nid_list_lock);
                 }
         }
@@ -2577,6 +2522,40 @@ static int __get_nat_bitmaps(struct f2fs_sb_info *sbi)
         return 0;
 }
 
+inline void load_free_nid_bitmap(struct f2fs_sb_info *sbi)
+{
+        struct f2fs_nm_info *nm_i = NM_I(sbi);
+        unsigned int i = 0;
+        nid_t nid, last_nid;
+
+        if (!enabled_nat_bits(sbi, NULL))
+                return;
+
+        for (i = 0; i < nm_i->nat_blocks; i++) {
+                i = find_next_bit_le(nm_i->empty_nat_bits, nm_i->nat_blocks, i);
+                if (i >= nm_i->nat_blocks)
+                        break;
+
+                __set_bit_le(i, nm_i->nat_block_bitmap);
+
+                nid = i * NAT_ENTRY_PER_BLOCK;
+                last_nid = (i + 1) * NAT_ENTRY_PER_BLOCK;
+
+                spin_lock(&nm_i->free_nid_lock);
+                for (; nid < last_nid; nid++)
+                        update_free_nid_bitmap(sbi, nid, true, true, true);
+                spin_unlock(&nm_i->free_nid_lock);
+        }
+
+        for (i = 0; i < nm_i->nat_blocks; i++) {
+                i = find_next_bit_le(nm_i->full_nat_bits, nm_i->nat_blocks, i);
+                if (i >= nm_i->nat_blocks)
+                        break;
+
+                __set_bit_le(i, nm_i->nat_block_bitmap);
+        }
+}
+
 static int init_node_manager(struct f2fs_sb_info *sbi)
 {
         struct f2fs_super_block *sb_raw = F2FS_RAW_SUPER(sbi);
@@ -2638,7 +2617,7 @@ static int init_node_manager(struct f2fs_sb_info *sbi)
         return 0;
 }
 
-int init_free_nid_cache(struct f2fs_sb_info *sbi)
+static int init_free_nid_cache(struct f2fs_sb_info *sbi)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
 
@@ -2651,6 +2630,14 @@ int init_free_nid_cache(struct f2fs_sb_info *sbi)
                                                                 GFP_KERNEL);
         if (!nm_i->nat_block_bitmap)
                 return -ENOMEM;
+
+        nm_i->free_nid_count = f2fs_kvzalloc(nm_i->nat_blocks *
+                                        sizeof(unsigned short), GFP_KERNEL);
+        if (!nm_i->free_nid_count)
+                return -ENOMEM;
+
+        spin_lock_init(&nm_i->free_nid_lock);
+
         return 0;
 }
 
@@ -2670,6 +2657,9 @@ int build_node_manager(struct f2fs_sb_info *sbi)
         if (err)
                 return err;
 
+        /* load free nid status from nat_bits table */
+        load_free_nid_bitmap(sbi);
+
         build_free_nids(sbi, true, true);
         return 0;
 }
@@ -2730,6 +2720,7 @@ void destroy_node_manager(struct f2fs_sb_info *sbi)
 
         kvfree(nm_i->nat_block_bitmap);
         kvfree(nm_i->free_nid_bitmap);
+        kvfree(nm_i->free_nid_count);
 
         kfree(nm_i->nat_bitmap);
         kfree(nm_i->nat_bits);
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 4bd7a8b19332..29ef7088c558 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1163,6 +1163,12 @@ static void update_sit_entry(struct f2fs_sb_info *sbi, block_t blkaddr, int del)
                 if (f2fs_discard_en(sbi) &&
                         !f2fs_test_and_set_bit(offset, se->discard_map))
                         sbi->discard_blks--;
+
+                /* don't overwrite by SSR to keep node chain */
+                if (se->type == CURSEG_WARM_NODE) {
+                        if (!f2fs_test_and_set_bit(offset, se->ckpt_valid_map))
+                                se->ckpt_valid_blocks++;
+                }
         } else {
                 if (!f2fs_test_and_clear_bit(offset, se->cur_valid_map)) {
 #ifdef CONFIG_F2FS_CHECK_FS
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index a1a359bfcc9c..5adc2fb62b0f 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1125,10 +1125,8 @@ static journal_t *journal_init_common(struct block_device *bdev,
 
         /* Set up a default-sized revoke table for the new mount. */
         err = jbd2_journal_init_revoke(journal, JOURNAL_REVOKE_DEFAULT_HASH);
-        if (err) {
-                kfree(journal);
-                return NULL;
-        }
+        if (err)
+                goto err_cleanup;
 
         spin_lock_init(&journal->j_history_lock);
 
@@ -1145,23 +1143,25 @@ static journal_t *journal_init_common(struct block_device *bdev,
         journal->j_wbufsize = n;
         journal->j_wbuf = kmalloc_array(n, sizeof(struct buffer_head *),
                                         GFP_KERNEL);
-        if (!journal->j_wbuf) {
-                kfree(journal);
-                return NULL;
-        }
+        if (!journal->j_wbuf)
+                goto err_cleanup;
 
         bh = getblk_unmovable(journal->j_dev, start, journal->j_blocksize);
         if (!bh) {
                 pr_err("%s: Cannot get buffer for journal superblock\n",
                         __func__);
-                kfree(journal->j_wbuf);
-                kfree(journal);
-                return NULL;
+                goto err_cleanup;
         }
         journal->j_sb_buffer = bh;
         journal->j_superblock = (journal_superblock_t *)bh->b_data;
 
         return journal;
+
+err_cleanup:
+        kfree(journal->j_wbuf);
+        jbd2_journal_destroy_revoke(journal);
+        kfree(journal);
+        return NULL;
 }
 
 /* jbd2_journal_init_dev and jbd2_journal_init_inode:
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index cfc38b552118..f9aefcda5854 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -280,6 +280,7 @@ int jbd2_journal_init_revoke(journal_t *journal, int hash_size)
 
 fail1:
         jbd2_journal_destroy_revoke_table(journal->j_revoke_table[0]);
+        journal->j_revoke_table[0] = NULL;
 fail0:
         return -ENOMEM;
 }
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 8e4dc7ab584c..ac2dfe0c5a9c 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -809,7 +809,8 @@ void kernfs_drain_open_files(struct kernfs_node *kn)
                 if (kn->flags & KERNFS_HAS_MMAP)
                         unmap_mapping_range(inode->i_mapping, 0, 0, 1);
 
-                kernfs_release_file(kn, of);
+                if (kn->flags & KERNFS_HAS_RELEASE)
+                        kernfs_release_file(kn, of);
         }
 
         mutex_unlock(&kernfs_open_file_mutex);