Merge 5.3-rc5 into usb-next

We need the usb fixes in here as well for other patches to build on.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

15 files changed, 176 insertions, 163 deletions

diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index 4f1b6f466ff5..b86195e4dc6c 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -505,18 +505,14 @@ static void SRXAFSCB_ProbeUuid(struct work_struct *work)
         struct afs_call *call = container_of(work, struct afs_call, work);
         struct afs_uuid *r = call->request;
 
-        struct {
-                __be32  match;
-        } reply;
-
         _enter("");
 
         if (memcmp(r, &call->net->uuid, sizeof(call->net->uuid)) == 0)
-                reply.match = htonl(0);
+                afs_send_empty_reply(call);
         else
-                reply.match = htonl(1);
+                rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
+                                        1, 1, "K-1");
 
-        afs_send_simple_reply(call, &reply, sizeof(reply));
         afs_put_call(call);
         _leave("");
 }
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index e640d67274be..81207dc3c997 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -440,7 +440,7 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode,
  * iterate through the data blob that lists the contents of an AFS directory
  */
 static int afs_dir_iterate(struct inode *dir, struct dir_context *ctx,
-                           struct key *key)
+                           struct key *key, afs_dataversion_t *_dir_version)
 {
         struct afs_vnode *dvnode = AFS_FS_I(dir);
         struct afs_xdr_dir_page *dbuf;
@@ -460,6 +460,7 @@ static int afs_dir_iterate(struct inode *dir, struct dir_context *ctx,
         req = afs_read_dir(dvnode, key);
         if (IS_ERR(req))
                 return PTR_ERR(req);
+        *_dir_version = req->data_version;
 
         /* round the file position up to the next entry boundary */
         ctx->pos += sizeof(union afs_xdr_dirent) - 1;
@@ -514,7 +515,10 @@ out:
  */
 static int afs_readdir(struct file *file, struct dir_context *ctx)
 {
-        return afs_dir_iterate(file_inode(file), ctx, afs_file_key(file));
+        afs_dataversion_t dir_version;
+
+        return afs_dir_iterate(file_inode(file), ctx, afs_file_key(file),
+                               &dir_version);
 }
 
 /*
@@ -555,7 +559,8 @@ static int afs_lookup_one_filldir(struct dir_context *ctx, const char *name,
  * - just returns the FID the dentry name maps to if found
  */
 static int afs_do_lookup_one(struct inode *dir, struct dentry *dentry,
-                             struct afs_fid *fid, struct key *key)
+                             struct afs_fid *fid, struct key *key,
+                             afs_dataversion_t *_dir_version)
 {
         struct afs_super_info *as = dir->i_sb->s_fs_info;
         struct afs_lookup_one_cookie cookie = {
@@ -568,7 +573,7 @@ static int afs_do_lookup_one(struct inode *dir, struct dentry *dentry,
         _enter("{%lu},%p{%pd},", dir->i_ino, dentry, dentry);
 
         /* search the directory */
-        ret = afs_dir_iterate(dir, &cookie.ctx, key);
+        ret = afs_dir_iterate(dir, &cookie.ctx, key, _dir_version);
         if (ret < 0) {
                 _leave(" = %d [iter]", ret);
                 return ret;
@@ -642,6 +647,7 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry,
         struct afs_server *server;
         struct afs_vnode *dvnode = AFS_FS_I(dir), *vnode;
         struct inode *inode = NULL, *ti;
+        afs_dataversion_t data_version = READ_ONCE(dvnode->status.data_version);
         int ret, i;
 
         _enter("{%lu},%p{%pd},", dir->i_ino, dentry, dentry);
@@ -669,12 +675,14 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry,
                 cookie->fids[i].vid = as->volume->vid;
 
         /* search the directory */
-        ret = afs_dir_iterate(dir, &cookie->ctx, key);
+        ret = afs_dir_iterate(dir, &cookie->ctx, key, &data_version);
         if (ret < 0) {
                 inode = ERR_PTR(ret);
                 goto out;
         }
 
+        dentry->d_fsdata = (void *)(unsigned long)data_version;
+
         inode = ERR_PTR(-ENOENT);
         if (!cookie->found)
                 goto out;
@@ -968,7 +976,8 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
         struct dentry *parent;
         struct inode *inode;
         struct key *key;
-        long dir_version, de_version;
+        afs_dataversion_t dir_version;
+        long de_version;
         int ret;
 
         if (flags & LOOKUP_RCU)
@@ -1014,20 +1023,20 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
          * on a 32-bit system, we only have 32 bits in the dentry to store the
          * version.
          */
-        dir_version = (long)dir->status.data_version;
+        dir_version = dir->status.data_version;
         de_version = (long)dentry->d_fsdata;
-        if (de_version == dir_version)
-                goto out_valid;
+        if (de_version == (long)dir_version)
+                goto out_valid_noupdate;
 
-        dir_version = (long)dir->invalid_before;
-        if (de_version - dir_version >= 0)
+        dir_version = dir->invalid_before;
+        if (de_version - (long)dir_version >= 0)
                 goto out_valid;
 
         _debug("dir modified");
         afs_stat_v(dir, n_reval);
 
         /* search the directory for this vnode */
-        ret = afs_do_lookup_one(&dir->vfs_inode, dentry, &fid, key);
+        ret = afs_do_lookup_one(&dir->vfs_inode, dentry, &fid, key, &dir_version);
         switch (ret) {
         case 0:
                 /* the filename maps to something */
@@ -1080,7 +1089,8 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
         }
 
 out_valid:
-        dentry->d_fsdata = (void *)dir_version;
+        dentry->d_fsdata = (void *)(unsigned long)dir_version;
+out_valid_noupdate:
         dput(parent);
         key_put(key);
         _leave(" = 1 [valid]");
@@ -1186,6 +1196,20 @@ static void afs_prep_for_new_inode(struct afs_fs_cursor *fc,
 }
 
 /*
+ * Note that a dentry got changed.  We need to set d_fsdata to the data version
+ * number derived from the result of the operation.  It doesn't matter if
+ * d_fsdata goes backwards as we'll just revalidate.
+ */
+static void afs_update_dentry_version(struct afs_fs_cursor *fc,
+                                      struct dentry *dentry,
+                                      struct afs_status_cb *scb)
+{
+        if (fc->ac.error == 0)
+                dentry->d_fsdata =
+                        (void *)(unsigned long)scb->status.data_version;
+}
+
+/*
  * create a directory on an AFS filesystem
  */
 static int afs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
@@ -1227,6 +1251,7 @@ static int afs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
                 afs_check_for_remote_deletion(&fc, dvnode);
                 afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                         &data_version, &scb[0]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                 afs_vnode_new_inode(&fc, dentry, &iget_data, &scb[1]);
                 ret = afs_end_vnode_operation(&fc);
                 if (ret < 0)
@@ -1319,6 +1344,7 @@ static int afs_rmdir(struct inode *dir, struct dentry *dentry)
 
                 afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                         &data_version, scb);
+                afs_update_dentry_version(&fc, dentry, scb);
                 ret = afs_end_vnode_operation(&fc);
                 if (ret == 0) {
                         afs_dir_remove_subdir(dentry);
@@ -1458,6 +1484,7 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry)
                                         &data_version, &scb[0]);
                 afs_vnode_commit_status(&fc, vnode, fc.cb_break_2,
                                         &data_version_2, &scb[1]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                 ret = afs_end_vnode_operation(&fc);
                 if (ret == 0 && !(scb[1].have_status || scb[1].have_error))
                         ret = afs_dir_remove_link(dvnode, dentry, key);
@@ -1526,6 +1553,7 @@ static int afs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
                 afs_check_for_remote_deletion(&fc, dvnode);
                 afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                         &data_version, &scb[0]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                 afs_vnode_new_inode(&fc, dentry, &iget_data, &scb[1]);
                 ret = afs_end_vnode_operation(&fc);
                 if (ret < 0)
@@ -1607,6 +1635,7 @@ static int afs_link(struct dentry *from, struct inode *dir,
                 afs_vnode_commit_status(&fc, vnode, fc.cb_break_2,
                                         NULL, &scb[1]);
                 ihold(&vnode->vfs_inode);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                 d_instantiate(dentry, &vnode->vfs_inode);
 
                 mutex_unlock(&vnode->io_lock);
@@ -1686,6 +1715,7 @@ static int afs_symlink(struct inode *dir, struct dentry *dentry,
                 afs_check_for_remote_deletion(&fc, dvnode);
                 afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                         &data_version, &scb[0]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                 afs_vnode_new_inode(&fc, dentry, &iget_data, &scb[1]);
                 ret = afs_end_vnode_operation(&fc);
                 if (ret < 0)
@@ -1791,6 +1821,17 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 }
         }
 
+        /* This bit is potentially nasty as there's a potential race with
+         * afs_d_revalidate{,_rcu}().  We have to change d_fsdata on the dentry
+         * to reflect it's new parent's new data_version after the op, but
+         * d_revalidate may see old_dentry between the op having taken place
+         * and the version being updated.
+         *
+         * So drop the old_dentry for now to make other threads go through
+         * lookup instead - which we hold a lock against.
+         */
+        d_drop(old_dentry);
+
         ret = -ERESTARTSYS;
         if (afs_begin_vnode_operation(&fc, orig_dvnode, key, true)) {
                 afs_dataversion_t orig_data_version;
@@ -1802,9 +1843,9 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 if (orig_dvnode != new_dvnode) {
                         if (mutex_lock_interruptible_nested(&new_dvnode->io_lock, 1) < 0) {
                                 afs_end_vnode_operation(&fc);
-                                goto error_rehash;
+                                goto error_rehash_old;
                         }
-                        new_data_version = new_dvnode->status.data_version;
+                        new_data_version = new_dvnode->status.data_version + 1;
                 } else {
                         new_data_version = orig_data_version;
                         new_scb = &scb[0];
@@ -1827,7 +1868,7 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 }
                 ret = afs_end_vnode_operation(&fc);
                 if (ret < 0)
-                        goto error_rehash;
+                        goto error_rehash_old;
         }
 
         if (ret == 0) {
@@ -1853,10 +1894,26 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                                 drop_nlink(new_inode);
                         spin_unlock(&new_inode->i_lock);
                 }
+
+                /* Now we can update d_fsdata on the dentries to reflect their
+                 * new parent's data_version.
+                 *
+                 * Note that if we ever implement RENAME_EXCHANGE, we'll have
+                 * to update both dentries with opposing dir versions.
+                 */
+                if (new_dvnode != orig_dvnode) {
+                        afs_update_dentry_version(&fc, old_dentry, &scb[1]);
+                        afs_update_dentry_version(&fc, new_dentry, &scb[1]);
+                } else {
+                        afs_update_dentry_version(&fc, old_dentry, &scb[0]);
+                        afs_update_dentry_version(&fc, new_dentry, &scb[0]);
+                }
                 d_move(old_dentry, new_dentry);
                 goto error_tmp;
         }
 
+error_rehash_old:
+        d_rehash(new_dentry);
 error_rehash:
         if (rehash)
                 d_rehash(rehash);
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 56b69576274d..dd3c55c9101c 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -191,11 +191,13 @@ void afs_put_read(struct afs_read *req)
         int i;
 
         if (refcount_dec_and_test(&req->usage)) {
-                for (i = 0; i < req->nr_pages; i++)
-                        if (req->pages[i])
-                                put_page(req->pages[i]);
-                if (req->pages != req->array)
-                        kfree(req->pages);
+                if (req->pages) {
+                        for (i = 0; i < req->nr_pages; i++)
+                                if (req->pages[i])
+                                        put_page(req->pages[i]);
+                        if (req->pages != req->array)
+                                kfree(req->pages);
+                }
                 kfree(req);
         }
 }
diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
index d7e0fd3c00df..cfb0ac4bd039 100644
--- a/fs/afs/vlclient.c
+++ b/fs/afs/vlclient.c
@@ -56,23 +56,24 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call)
                 struct afs_uuid__xdr *xdr;
                 struct afs_uuid *uuid;
                 int j;
+                int n = entry->nr_servers;
 
                 tmp = ntohl(uvldb->serverFlags[i]);
                 if (tmp & AFS_VLSF_DONTUSE ||
                     (new_only && !(tmp & AFS_VLSF_NEWREPSITE)))
                         continue;
                 if (tmp & AFS_VLSF_RWVOL) {
-                        entry->fs_mask[i] |= AFS_VOL_VTM_RW;
+                        entry->fs_mask[n] |= AFS_VOL_VTM_RW;
                         if (vlflags & AFS_VLF_BACKEXISTS)
-                                entry->fs_mask[i] |= AFS_VOL_VTM_BAK;
+                                entry->fs_mask[n] |= AFS_VOL_VTM_BAK;
                 }
                 if (tmp & AFS_VLSF_ROVOL)
-                        entry->fs_mask[i] |= AFS_VOL_VTM_RO;
-                if (!entry->fs_mask[i])
+                        entry->fs_mask[n] |= AFS_VOL_VTM_RO;
+                if (!entry->fs_mask[n])
                         continue;
 
                 xdr = &uvldb->serverNumber[i];
-                uuid = (struct afs_uuid *)&entry->fs_server[i];
+                uuid = (struct afs_uuid *)&entry->fs_server[n];
                 uuid->time_low                  = xdr->time_low;
                 uuid->time_mid                  = htons(ntohl(xdr->time_mid));
                 uuid->time_hi_and_version       = htons(ntohl(xdr->time_hi_and_version));
diff --git a/fs/block_dev.c b/fs/block_dev.c
index eb657ab94060..677cb364d33f 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -345,24 +345,15 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
         struct bio *bio;
         bool is_poll = (iocb->ki_flags & IOCB_HIPRI) != 0;
         bool is_read = (iov_iter_rw(iter) == READ), is_sync;
-        bool nowait = (iocb->ki_flags & IOCB_NOWAIT) != 0;
         loff_t pos = iocb->ki_pos;
         blk_qc_t qc = BLK_QC_T_NONE;
-        gfp_t gfp;
-        int ret;
+        int ret = 0;
 
         if ((pos | iov_iter_alignment(iter)) &
             (bdev_logical_block_size(bdev) - 1))
                 return -EINVAL;
 
-        if (nowait)
-                gfp = GFP_NOWAIT;
-        else
-                gfp = GFP_KERNEL;
-
-        bio = bio_alloc_bioset(gfp, nr_pages, &blkdev_dio_pool);
-        if (!bio)
-                return -EAGAIN;
+        bio = bio_alloc_bioset(GFP_KERNEL, nr_pages, &blkdev_dio_pool);
 
         dio = container_of(bio, struct blkdev_dio, bio);
         dio->is_sync = is_sync = is_sync_kiocb(iocb);
@@ -384,7 +375,6 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
         if (!is_poll)
                 blk_start_plug(&plug);
 
-        ret = 0;
         for (;;) {
                 bio_set_dev(bio, bdev);
                 bio->bi_iter.bi_sector = pos >> 9;
@@ -409,14 +399,7 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
                         task_io_account_write(bio->bi_iter.bi_size);
                 }
 
-                /*
-                 * Tell underlying layer to not block for resource shortage.
-                 * And if we would have blocked, return error inline instead
-                 * of through the bio->bi_end_io() callback.
-                 */
-                if (nowait)
-                        bio->bi_opf |= (REQ_NOWAIT | REQ_NOWAIT_INLINE);
-
+                dio->size += bio->bi_iter.bi_size;
                 pos += bio->bi_iter.bi_size;
 
                 nr_pages = iov_iter_npages(iter, BIO_MAX_PAGES);
@@ -428,13 +411,7 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
                                 polled = true;
                         }
 
-                        dio->size += bio->bi_iter.bi_size;
                         qc = submit_bio(bio);
-                        if (qc == BLK_QC_T_EAGAIN) {
-                                dio->size -= bio->bi_iter.bi_size;
-                                ret = -EAGAIN;
-                                goto error;
-                        }
 
                         if (polled)
                                 WRITE_ONCE(iocb->ki_cookie, qc);
@@ -455,19 +432,8 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
                         atomic_inc(&dio->ref);
                 }
 
-                dio->size += bio->bi_iter.bi_size;
-                qc = submit_bio(bio);
-                if (qc == BLK_QC_T_EAGAIN) {
-                        dio->size -= bio->bi_iter.bi_size;
-                        ret = -EAGAIN;
-                        goto error;
-                }
-
-                bio = bio_alloc(gfp, nr_pages);
-                if (!bio) {
-                        ret = -EAGAIN;
-                        goto error;
-                }
+                submit_bio(bio);
+                bio = bio_alloc(GFP_KERNEL, nr_pages);
         }
 
         if (!is_poll)
@@ -487,7 +453,6 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
         }
         __set_current_state(TASK_RUNNING);
 
-out:
         if (!ret)
                 ret = blk_status_to_errno(dio->bio.bi_status);
         if (likely(!ret))
@@ -495,10 +460,6 @@ out:
 
         bio_put(&dio->bio);
         return ret;
-error:
-        if (!is_poll)
-                blk_finish_plug(&plug);
-        goto out;
 }
 
 static ssize_t
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 299e11e6c554..94660063a162 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -401,7 +401,6 @@ struct btrfs_dev_replace {
 struct raid_kobject {
         u64 flags;
         struct kobject kobj;
-        struct list_head list;
 };
 
 /*
@@ -915,8 +914,6 @@ struct btrfs_fs_info {
         u32 thread_pool_size;
 
         struct kobject *space_info_kobj;
-        struct list_head pending_raid_kobjs;
-        spinlock_t pending_raid_kobjs_lock; /* uncontended */
 
         u64 total_pinned;
 
@@ -2698,7 +2695,6 @@ int btrfs_can_relocate(struct btrfs_fs_info *fs_info, u64 bytenr);
 int btrfs_make_block_group(struct btrfs_trans_handle *trans,
                            u64 bytes_used, u64 type, u64 chunk_offset,
                            u64 size);
-void btrfs_add_raid_kobjects(struct btrfs_fs_info *fs_info);
 struct btrfs_trans_handle *btrfs_start_trans_remove_block_group(
                                 struct btrfs_fs_info *fs_info,
                                 const u64 chunk_offset);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 5f7ee70b3d1a..97beb351a10c 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2683,8 +2683,6 @@ int open_ctree(struct super_block *sb,
         INIT_LIST_HEAD(&fs_info->delayed_iputs);
         INIT_LIST_HEAD(&fs_info->delalloc_roots);
         INIT_LIST_HEAD(&fs_info->caching_block_groups);
-        INIT_LIST_HEAD(&fs_info->pending_raid_kobjs);
-        spin_lock_init(&fs_info->pending_raid_kobjs_lock);
         spin_lock_init(&fs_info->delalloc_root_lock);
         spin_lock_init(&fs_info->trans_lock);
         spin_lock_init(&fs_info->fs_roots_radix_lock);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index d3b58e388535..8b7eb22d508a 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4,6 +4,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/sched/mm.h>
 #include <linux/sched/signal.h>
 #include <linux/pagemap.h>
 #include <linux/writeback.h>
@@ -7888,33 +7889,6 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
         return 0;
 }
 
-/* link_block_group will queue up kobjects to add when we're reclaim-safe */
-void btrfs_add_raid_kobjects(struct btrfs_fs_info *fs_info)
-{
-        struct btrfs_space_info *space_info;
-        struct raid_kobject *rkobj;
-        LIST_HEAD(list);
-        int ret = 0;
-
-        spin_lock(&fs_info->pending_raid_kobjs_lock);
-        list_splice_init(&fs_info->pending_raid_kobjs, &list);
-        spin_unlock(&fs_info->pending_raid_kobjs_lock);
-
-        list_for_each_entry(rkobj, &list, list) {
-                space_info = btrfs_find_space_info(fs_info, rkobj->flags);
-
-                ret = kobject_add(&rkobj->kobj, &space_info->kobj,
-                                "%s", btrfs_bg_type_to_raid_name(rkobj->flags));
-                if (ret) {
-                        kobject_put(&rkobj->kobj);
-                        break;
-                }
-        }
-        if (ret)
-                btrfs_warn(fs_info,
-                           "failed to add kobject for block cache, ignoring");
-}
-
 static void link_block_group(struct btrfs_block_group_cache *cache)
 {
         struct btrfs_space_info *space_info = cache->space_info;
@@ -7929,18 +7903,36 @@ static void link_block_group(struct btrfs_block_group_cache *cache)
         up_write(&space_info->groups_sem);
 
         if (first) {
-                struct raid_kobject *rkobj = kzalloc(sizeof(*rkobj), GFP_NOFS);
+                struct raid_kobject *rkobj;
+                unsigned int nofs_flag;
+                int ret;
+
+                /*
+                 * Setup a NOFS context because kobject_add(), deep in its call
+                 * chain, does GFP_KERNEL allocations, and we are often called
+                 * in a context where if reclaim is triggered we can deadlock
+                 * (we are either holding a transaction handle or some lock
+                 * required for a transaction commit).
+                 */
+                nofs_flag = memalloc_nofs_save();
+                rkobj = kzalloc(sizeof(*rkobj), GFP_KERNEL);
                 if (!rkobj) {
+                        memalloc_nofs_restore(nofs_flag);
                         btrfs_warn(cache->fs_info,
                                 "couldn't alloc memory for raid level kobject");
                         return;
                 }
                 rkobj->flags = cache->flags;
                 kobject_init(&rkobj->kobj, &btrfs_raid_ktype);
-
-                spin_lock(&fs_info->pending_raid_kobjs_lock);
-                list_add_tail(&rkobj->list, &fs_info->pending_raid_kobjs);
-                spin_unlock(&fs_info->pending_raid_kobjs_lock);
+                ret = kobject_add(&rkobj->kobj, &space_info->kobj, "%s",
+                                  btrfs_bg_type_to_raid_name(rkobj->flags));
+                memalloc_nofs_restore(nofs_flag);
+                if (ret) {
+                        kobject_put(&rkobj->kobj);
+                        btrfs_warn(fs_info,
+                           "failed to add kobject for block cache, ignoring");
+                        return;
+                }
                 space_info->block_group_kobjs[index] = &rkobj->kobj;
         }
 }
@@ -8206,7 +8198,6 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info)
                         inc_block_group_ro(cache, 1);
         }
 
-        btrfs_add_raid_kobjects(info);
         btrfs_init_global_block_rsv(info);
         ret = check_chunk_block_group_mappings(info);
 error:
@@ -8975,6 +8966,7 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
         struct btrfs_device *device;
         struct list_head *devices;
         u64 group_trimmed;
+        u64 range_end = U64_MAX;
         u64 start;
         u64 end;
         u64 trimmed = 0;
@@ -8984,16 +8976,23 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
         int dev_ret = 0;
         int ret = 0;
 
+        /*
+         * Check range overflow if range->len is set.
+         * The default range->len is U64_MAX.
+         */
+        if (range->len != U64_MAX &&
+            check_add_overflow(range->start, range->len, &range_end))
+                return -EINVAL;
+
         cache = btrfs_lookup_first_block_group(fs_info, range->start);
         for (; cache; cache = next_block_group(cache)) {
-                if (cache->key.objectid >= (range->start + range->len)) {
+                if (cache->key.objectid >= range_end) {
                         btrfs_put_block_group(cache);
                         break;
                 }
 
                 start = max(range->start, cache->key.objectid);
-                end = min(range->start + range->len,
-                                cache->key.objectid + cache->key.offset);
+                end = min(range_end, cache->key.objectid + cache->key.offset);
 
                 if (end - start >= range->minlen) {
                         if (!block_group_cache_done(cache)) {
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index d74b74ca07af..a447d3ec48d5 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3087,16 +3087,6 @@ static int btrfs_relocate_chunk(struct btrfs_fs_info *fs_info, u64 chunk_offset)
         if (ret)
                 return ret;
 
-        /*
-         * We add the kobjects here (and after forcing data chunk creation)
-         * since relocation is the only place we'll create chunks of a new
-         * type at runtime.  The only place where we'll remove the last
-         * chunk of a type is the call immediately below this one.  Even
-         * so, we're protected against races with the cleaner thread since
-         * we're covered by the delete_unused_bgs_mutex.
-         */
-        btrfs_add_raid_kobjects(fs_info);
-
         trans = btrfs_start_trans_remove_block_group(root->fs_info,
                                                      chunk_offset);
         if (IS_ERR(trans)) {
@@ -3223,9 +3213,6 @@ static int btrfs_may_alloc_data_chunk(struct btrfs_fs_info *fs_info,
                         btrfs_end_transaction(trans);
                         if (ret < 0)
                                 return ret;
-
-                        btrfs_add_raid_kobjects(fs_info);
-
                         return 1;
                 }
         }
diff --git a/fs/io_uring.c b/fs/io_uring.c
index d542f1cf4428..24bbe3cb7ad4 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1097,10 +1097,8 @@ static int io_import_fixed(struct io_ring_ctx *ctx, int rw,
 
                         iter->bvec = bvec + seg_skip;
                         iter->nr_segs -= seg_skip;
-                        iter->count -= (seg_skip << PAGE_SHIFT);
+                        iter->count -= bvec->bv_len + offset;
                         iter->iov_offset = offset & ~PAGE_MASK;
-                        if (iter->iov_offset)
-                                iter->count -= iter->iov_offset;
                 }
         }
 
@@ -2025,6 +2023,15 @@ static int io_queue_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req,
 {
         int ret;
 
+        ret = io_req_defer(ctx, req, s->sqe);
+        if (ret) {
+                if (ret != -EIOCBQUEUED) {
+                        io_free_req(req);
+                        io_cqring_add_event(ctx, s->sqe->user_data, ret);
+                }
+                return 0;
+        }
+
         ret = __io_submit_sqe(ctx, req, s, true);
         if (ret == -EAGAIN && !(req->flags & REQ_F_NOWAIT)) {
                 struct io_uring_sqe *sqe_copy;
@@ -2097,13 +2104,6 @@ err:
                 return;
         }
 
-        ret = io_req_defer(ctx, req, s->sqe);
-        if (ret) {
-                if (ret != -EIOCBQUEUED)
-                        goto err_req;
-                return;
-        }
-
         /*
          * If we already have a head request, queue this one for async
          * submittal once the head completes. If we don't have a head but
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 04f09689cd6d..1600034a929b 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -119,6 +119,7 @@ static int traverse(struct seq_file *m, loff_t offset)
                 }
                 if (seq_has_overflowed(m))
                         goto Eoverflow;
+                p = m->op->next(m, p, &m->index);
                 if (pos + m->count > offset) {
                         m->from = offset - pos;
                         m->count -= m->from;
@@ -126,7 +127,6 @@ static int traverse(struct seq_file *m, loff_t offset)
                 }
                 pos += m->count;
                 m->count = 0;
-                p = m->op->next(m, p, &m->index);
                 if (pos == offset)
                         break;
         }
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index baf0b72c0a37..07aad70f3931 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -3835,15 +3835,28 @@ xfs_bmapi_read(
         XFS_STATS_INC(mp, xs_blk_mapr);
 
         ifp = XFS_IFORK_PTR(ip, whichfork);
+        if (!ifp) {
+                /* No CoW fork?  Return a hole. */
+                if (whichfork == XFS_COW_FORK) {
+                        mval->br_startoff = bno;
+                        mval->br_startblock = HOLESTARTBLOCK;
+                        mval->br_blockcount = len;
+                        mval->br_state = XFS_EXT_NORM;
+                        *nmap = 1;
+                        return 0;
+                }
 
-        /* No CoW fork?  Return a hole. */
-        if (whichfork == XFS_COW_FORK && !ifp) {
-                mval->br_startoff = bno;
-                mval->br_startblock = HOLESTARTBLOCK;
-                mval->br_blockcount = len;
-                mval->br_state = XFS_EXT_NORM;
-                *nmap = 1;
-                return 0;
+                /*
+                 * A missing attr ifork implies that the inode says we're in
+                 * extents or btree format but failed to pass the inode fork
+                 * verifier while trying to load it.  Treat that as a file
+                 * corruption too.
+                 */
+#ifdef DEBUG
+                xfs_alert(mp, "%s: inode %llu missing fork %d",
+                                __func__, ip->i_ino, whichfork);
+#endif /* DEBUG */
+                return -EFSCORRUPTED;
         }
 
         if (!(ifp->if_flags & XFS_IFEXTENTS)) {
diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c
index d1c77fd0815d..0bf56e94bfe9 100644
--- a/fs/xfs/libxfs/xfs_da_btree.c
+++ b/fs/xfs/libxfs/xfs_da_btree.c
@@ -487,10 +487,8 @@ xfs_da3_split(
         ASSERT(state->path.active == 0);
         oldblk = &state->path.blk[0];
         error = xfs_da3_root_split(state, oldblk, addblk);
-        if (error) {
-                addblk->bp = NULL;
-                return error;   /* GROT: dir is inconsistent */
-        }
+        if (error)
+                goto out;
 
         /*
          * Update pointers to the node which used to be block 0 and just got
@@ -505,7 +503,10 @@ xfs_da3_split(
          */
         node = oldblk->bp->b_addr;
         if (node->hdr.info.forw) {
-                ASSERT(be32_to_cpu(node->hdr.info.forw) == addblk->blkno);
+                if (be32_to_cpu(node->hdr.info.forw) != addblk->blkno) {
+                        error = -EFSCORRUPTED;
+                        goto out;
+                }
                 node = addblk->bp->b_addr;
                 node->hdr.info.back = cpu_to_be32(oldblk->blkno);
                 xfs_trans_log_buf(state->args->trans, addblk->bp,
@@ -514,15 +515,19 @@ xfs_da3_split(
         }
         node = oldblk->bp->b_addr;
         if (node->hdr.info.back) {
-                ASSERT(be32_to_cpu(node->hdr.info.back) == addblk->blkno);
+                if (be32_to_cpu(node->hdr.info.back) != addblk->blkno) {
+                        error = -EFSCORRUPTED;
+                        goto out;
+                }
                 node = addblk->bp->b_addr;
                 node->hdr.info.forw = cpu_to_be32(oldblk->blkno);
                 xfs_trans_log_buf(state->args->trans, addblk->bp,
                                   XFS_DA_LOGRANGE(node, &node->hdr.info,
                                   sizeof(node->hdr.info)));
         }
+out:
         addblk->bp = NULL;
-        return 0;
+        return error;
 }
 
 /*
diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
index afcc6642690a..1fc44efc344d 100644
--- a/fs/xfs/libxfs/xfs_dir2_node.c
+++ b/fs/xfs/libxfs/xfs_dir2_node.c
@@ -741,7 +741,8 @@ xfs_dir2_leafn_lookup_for_entry(
         ents = dp->d_ops->leaf_ents_p(leaf);
 
         xfs_dir3_leaf_check(dp, bp);
-        ASSERT(leafhdr.count > 0);
+        if (leafhdr.count <= 0)
+                return -EFSCORRUPTED;
 
         /*
          * Look up the hash value in the leaf entries.
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 00e9f5c388d3..7fc3c1ad36bc 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -429,10 +429,7 @@ xfs_log_reserve(
 
         ASSERT(*ticp == NULL);
         tic = xlog_ticket_alloc(log, unit_bytes, cnt, client, permanent,
-                                KM_SLEEP | KM_MAYFAIL);
-        if (!tic)
-                return -ENOMEM;
-
+                                KM_SLEEP);
         *ticp = tic;
 
         xlog_grant_push_ail(log, tic->t_cnt ? tic->t_unit_res * tic->t_cnt