Merge branch 'akpm' (patches from Andrew)

Merge more updates from Andrew Morton:

 - almost all of the rest of MM

 - kasan updates

 - lots of procfs work

 - misc things

 - lib/ updates

 - checkpatch

 - rapidio

 - ipc/shm updates

 - the start of willy's XArray conversion

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (140 commits)
  page cache: use xa_lock
  xarray: add the xa_lock to the radix_tree_root
  fscache: use appropriate radix tree accessors
  export __set_page_dirty
  unicore32: turn flush_dcache_mmap_lock into a no-op
  arm64: turn flush_dcache_mmap_lock into a no-op
  mac80211_hwsim: use DEFINE_IDA
  radix tree: use GFP_ZONEMASK bits of gfp_t for flags
  linux/const.h: refactor _BITUL and _BITULL a bit
  linux/const.h: move UL() macro to include/linux/const.h
  linux/const.h: prefix include guard of uapi/linux/const.h with _UAPI
  xen, mm: allow deferred page initialization for xen pv domains
  elf: enforce MAP_FIXED on overlaying elf segments
  fs, elf: drop MAP_FIXED usage from elf_map
  mm: introduce MAP_FIXED_NOREPLACE
  MAINTAINERS: update bouncing aacraid@adaptec.com addresses
  fs/dcache.c: add cond_resched() in shrink_dentry_list()
  include/linux/kfifo.h: fix comment
  ipc/shm.c: shm_split(): remove unneeded test for NULL shm_file_data.vm_ops
  kernel/sysctl.c: add kdoc comments to do_proc_do{u}intvec_minmax_conv_param
  ...

38 files changed, 547 insertions, 453 deletions

diff --git a/fs/afs/write.c b/fs/afs/write.c
index 9370e2feb999..dbc3c0b0142d 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -570,10 +570,11 @@ static int afs_writepages_region(struct address_space *mapping,
 
                 _debug("wback %lx", page->index);
 
-                /* at this point we hold neither mapping->tree_lock nor lock on
-                 * the page itself: the page may be truncated or invalidated
-                 * (changing page->mapping to NULL), or even swizzled back from
-                 * swapper_space to tmpfs file mapping
+                /*
+                 * at this point we hold neither the i_pages lock nor the
+                 * page lock: the page may be truncated or invalidated
+                 * (changing page->mapping to NULL), or even swizzled
+                 * back from swapper_space to tmpfs file mapping
                  */
                 ret = lock_page_killable(page);
                 if (ret < 0) {
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index a0c57c37fa21..be9c3dc048ab 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -19,9 +19,6 @@
  */
 static autofs_wqt_t autofs4_next_wait_queue = 1;
 
-/* These are the signals we allow interrupting a pending mount */
-#define SHUTDOWN_SIGS   (sigmask(SIGKILL) | sigmask(SIGINT) | sigmask(SIGQUIT))
-
 void autofs4_catatonic_mode(struct autofs_sb_info *sbi)
 {
         struct autofs_wait_queue *wq, *nwq;
@@ -486,29 +483,7 @@ int autofs4_wait(struct autofs_sb_info *sbi,
          * wq->name.name is NULL iff the lock is already released
          * or the mount has been made catatonic.
          */
-        if (wq->name.name) {
-                /* Block all but "shutdown" signals while waiting */
-                unsigned long shutdown_sigs_mask;
-                unsigned long irqflags;
-                sigset_t oldset;
-
-                spin_lock_irqsave(&current->sighand->siglock, irqflags);
-                oldset = current->blocked;
-                shutdown_sigs_mask = SHUTDOWN_SIGS & ~oldset.sig[0];
-                siginitsetinv(&current->blocked, shutdown_sigs_mask);
-                recalc_sigpending();
-                spin_unlock_irqrestore(&current->sighand->siglock, irqflags);
-
-                wait_event_interruptible(wq->queue, wq->name.name == NULL);
-
-                spin_lock_irqsave(&current->sighand->siglock, irqflags);
-                current->blocked = oldset;
-                recalc_sigpending();
-                spin_unlock_irqrestore(&current->sighand->siglock, irqflags);
-        } else {
-                pr_debug("skipped sleeping\n");
-        }
-
+        wait_event_killable(wq->queue, wq->name.name == NULL);
         status = wq->status;
 
         /*
@@ -574,7 +549,7 @@ int autofs4_wait_release(struct autofs_sb_info *sbi, autofs_wqt_t wait_queue_tok
         kfree(wq->name.name);
         wq->name.name = NULL;   /* Do not wait on this queue */
         wq->status = status;
-        wake_up_interruptible(&wq->queue);
+        wake_up(&wq->queue);
         if (!--wq->wait_ctr)
                 kfree(wq);
         mutex_unlock(&sbi->wq_mutex);
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index ce1824f47ba6..c3deb2e35f20 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -330,6 +330,7 @@ beyond_if:
 #ifdef __alpha__
         regs->gp = ex.a_gpvalue;
 #endif
+        finalize_exec(bprm);
         start_thread(regs, ex.a_entry, current->mm->start_stack);
         return 0;
 }
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index bdb201230bae..41e04183e4ce 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -377,6 +377,11 @@ static unsigned long elf_map(struct file *filep, unsigned long addr,
         } else
                 map_addr = vm_mmap(filep, addr, size, prot, type, off);
 
+        if ((type & MAP_FIXED_NOREPLACE) && BAD_ADDR(map_addr))
+                pr_info("%d (%s): Uhuuh, elf segment at %p requested but the memory is mapped already\n",
+                                task_pid_nr(current), current->comm,
+                                (void *)addr);
+
         return(map_addr);
 }
 
@@ -575,7 +580,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
                                 elf_prot |= PROT_EXEC;
                         vaddr = eppnt->p_vaddr;
                         if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
-                                elf_type |= MAP_FIXED;
+                                elf_type |= MAP_FIXED_NOREPLACE;
                         else if (no_base && interp_elf_ex->e_type == ET_DYN)
                                 load_addr = -vaddr;
 
@@ -890,7 +895,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
            the correct location in memory. */
         for(i = 0, elf_ppnt = elf_phdata;
             i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
-                int elf_prot = 0, elf_flags;
+                int elf_prot = 0, elf_flags, elf_fixed = MAP_FIXED_NOREPLACE;
                 unsigned long k, vaddr;
                 unsigned long total_size = 0;
 
@@ -922,6 +927,13 @@ static int load_elf_binary(struct linux_binprm *bprm)
                                          */
                                 }
                         }
+
+                        /*
+                         * Some binaries have overlapping elf segments and then
+                         * we have to forcefully map over an existing mapping
+                         * e.g. over this newly established brk mapping.
+                         */
+                        elf_fixed = MAP_FIXED;
                 }
 
                 if (elf_ppnt->p_flags & PF_R)
@@ -939,7 +951,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
                  * the ET_DYN load_addr calculations, proceed normally.
                  */
                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
-                        elf_flags |= MAP_FIXED;
+                        elf_flags |= elf_fixed;
                 } else if (loc->elf_ex.e_type == ET_DYN) {
                         /*
                          * This logic is run once for the first LOAD Program
@@ -975,7 +987,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
                                 load_bias = ELF_ET_DYN_BASE;
                                 if (current->flags & PF_RANDOMIZE)
                                         load_bias += arch_mmap_rnd();
-                                elf_flags |= MAP_FIXED;
+                                elf_flags |= elf_fixed;
                         } else
                                 load_bias = 0;
 
@@ -1155,6 +1167,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
         ELF_PLAT_INIT(regs, reloc_func_desc);
 #endif
 
+        finalize_exec(bprm);
         start_thread(regs, elf_entry, bprm->p);
         retval = 0;
 out:
@@ -1234,7 +1247,7 @@ static int load_elf_library(struct file *file)
                         (eppnt->p_filesz +
                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
                         PROT_READ | PROT_WRITE | PROT_EXEC,
-                        MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
+                        MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_DENYWRITE,
                         (eppnt->p_offset -
                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
         if (error != ELF_PAGESTART(eppnt->p_vaddr))
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 429326b6e2e7..d90993adeffa 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -463,6 +463,7 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm)
                             dynaddr);
 #endif
 
+        finalize_exec(bprm);
         /* everything is now ready... get the userspace context ready to roll */
         entryaddr = interp_params.entry_addr ?: exec_params.entry_addr;
         start_thread(regs, entryaddr, current->mm->start_stack);
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 5d6b94475f27..82a48e830018 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -994,6 +994,7 @@ static int load_flat_binary(struct linux_binprm *bprm)
         FLAT_PLAT_INIT(regs);
 #endif
 
+        finalize_exec(bprm);
         pr_debug("start_thread(regs=0x%p, entry=0x%lx, start_stack=0x%lx)\n",
                  regs, start_addr, current->mm->start_stack);
         start_thread(regs, start_addr, current->mm->start_stack);
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 562c3e633403..578181cd96b5 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -458,7 +458,7 @@ static noinline int add_ra_bio_pages(struct inode *inode,
                         break;
 
                 rcu_read_lock();
-                page = radix_tree_lookup(&mapping->page_tree, pg_index);
+                page = radix_tree_lookup(&mapping->i_pages, pg_index);
                 rcu_read_unlock();
                 if (page && !radix_tree_exceptional_entry(page)) {
                         misses++;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 47a8fe9d22e8..cf87976e389d 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -3963,11 +3963,11 @@ retry:
 
                         done_index = page->index;
                         /*
-                         * At this point we hold neither mapping->tree_lock nor
-                         * lock on the page itself: the page may be truncated or
-                         * invalidated (changing page->mapping to NULL), or even
-                         * swizzled back from swapper_space to tmpfs file
-                         * mapping
+                         * At this point we hold neither the i_pages lock nor
+                         * the page lock: the page may be truncated or
+                         * invalidated (changing page->mapping to NULL),
+                         * or even swizzled back from swapper_space to
+                         * tmpfs file mapping
                          */
                         if (!trylock_page(page)) {
                                 flush_write_bio(epd);
@@ -5174,13 +5174,13 @@ void clear_extent_buffer_dirty(struct extent_buffer *eb)
                 WARN_ON(!PagePrivate(page));
 
                 clear_page_dirty_for_io(page);
-                spin_lock_irq(&page->mapping->tree_lock);
+                xa_lock_irq(&page->mapping->i_pages);
                 if (!PageDirty(page)) {
-                        radix_tree_tag_clear(&page->mapping->page_tree,
+                        radix_tree_tag_clear(&page->mapping->i_pages,
                                                 page_index(page),
                                                 PAGECACHE_TAG_DIRTY);
                 }
-                spin_unlock_irq(&page->mapping->tree_lock);
+                xa_unlock_irq(&page->mapping->i_pages);
                 ClearPageError(page);
                 unlock_page(page);
         }
diff --git a/fs/buffer.c b/fs/buffer.c
index ec5dd39071e6..f3491074b035 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -185,10 +185,9 @@ EXPORT_SYMBOL(end_buffer_write_sync);
  * we get exclusion from try_to_free_buffers with the blockdev mapping's
  * private_lock.
  *
- * Hack idea: for the blockdev mapping, i_bufferlist_lock contention
+ * Hack idea: for the blockdev mapping, private_lock contention
  * may be quite high.  This code could TryLock the page, and if that
- * succeeds, there is no need to take private_lock. (But if
- * private_lock is contended then so is mapping->tree_lock).
+ * succeeds, there is no need to take private_lock.
  */
 static struct buffer_head *
 __find_get_block_slow(struct block_device *bdev, sector_t block)
@@ -594,20 +593,21 @@ EXPORT_SYMBOL(mark_buffer_dirty_inode);
  *
  * The caller must hold lock_page_memcg().
  */
-static void __set_page_dirty(struct page *page, struct address_space *mapping,
+void __set_page_dirty(struct page *page, struct address_space *mapping,
                              int warn)
 {
         unsigned long flags;
 
-        spin_lock_irqsave(&mapping->tree_lock, flags);
+        xa_lock_irqsave(&mapping->i_pages, flags);
         if (page->mapping) {    /* Race with truncate? */
                 WARN_ON_ONCE(warn && !PageUptodate(page));
                 account_page_dirtied(page, mapping);
-                radix_tree_tag_set(&mapping->page_tree,
+                radix_tree_tag_set(&mapping->i_pages,
                                 page_index(page), PAGECACHE_TAG_DIRTY);
         }
-        spin_unlock_irqrestore(&mapping->tree_lock, flags);
+        xa_unlock_irqrestore(&mapping->i_pages, flags);
 }
+EXPORT_SYMBOL_GPL(__set_page_dirty);
 
 /*
  * Add a page to the dirty page list.
@@ -1095,7 +1095,7 @@ __getblk_slow(struct block_device *bdev, sector_t block,
  * inode list.
  *
  * mark_buffer_dirty() is atomic.  It takes bh->b_page->mapping->private_lock,
- * mapping->tree_lock and mapping->host->i_lock.
+ * i_pages lock and mapping->host->i_lock.
  */
 void mark_buffer_dirty(struct buffer_head *bh)
 {
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 7cee97b93a61..4bcd4e838b47 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1987,11 +1987,10 @@ wdata_prepare_pages(struct cifs_writedata *wdata, unsigned int found_pages,
         for (i = 0; i < found_pages; i++) {
                 page = wdata->pages[i];
                 /*
-                 * At this point we hold neither mapping->tree_lock nor
-                 * lock on the page itself: the page may be truncated or
-                 * invalidated (changing page->mapping to NULL), or even
-                 * swizzled back from swapper_space to tmpfs file
-                 * mapping
+                 * At this point we hold neither the i_pages lock nor the
+                 * page lock: the page may be truncated or invalidated
+                 * (changing page->mapping to NULL), or even swizzled
+                 * back from swapper_space to tmpfs file mapping
                  */
 
                 if (nr_pages == 0)
diff --git a/fs/dax.c b/fs/dax.c
index a77394fe586e..aaec72ded1b6 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -158,11 +158,9 @@ static int wake_exceptional_entry_func(wait_queue_entry_t *wait, unsigned int mo
 }
 
 /*
- * We do not necessarily hold the mapping->tree_lock when we call this
- * function so it is possible that 'entry' is no longer a valid item in the
- * radix tree.  This is okay because all we really need to do is to find the
- * correct waitqueue where tasks might be waiting for that old 'entry' and
- * wake them.
+ * @entry may no longer be the entry at the index in the mapping.
+ * The important information it's conveying is whether the entry at
+ * this index used to be a PMD entry.
  */
 static void dax_wake_mapping_entry_waiter(struct address_space *mapping,
                 pgoff_t index, void *entry, bool wake_all)
@@ -174,7 +172,7 @@ static void dax_wake_mapping_entry_waiter(struct address_space *mapping,
 
         /*
          * Checking for locked entry and prepare_to_wait_exclusive() happens
-         * under mapping->tree_lock, ditto for entry handling in our callers.
+         * under the i_pages lock, ditto for entry handling in our callers.
          * So at this point all tasks that could have seen our entry locked
          * must be in the waitqueue and the following check will see them.
          */
@@ -183,41 +181,39 @@ static void dax_wake_mapping_entry_waiter(struct address_space *mapping,
 }
 
 /*
- * Check whether the given slot is locked. The function must be called with
- * mapping->tree_lock held
+ * Check whether the given slot is locked.  Must be called with the i_pages
+ * lock held.
  */
 static inline int slot_locked(struct address_space *mapping, void **slot)
 {
         unsigned long entry = (unsigned long)
-                radix_tree_deref_slot_protected(slot, &mapping->tree_lock);
+                radix_tree_deref_slot_protected(slot, &mapping->i_pages.xa_lock);
         return entry & RADIX_DAX_ENTRY_LOCK;
 }
 
 /*
- * Mark the given slot is locked. The function must be called with
- * mapping->tree_lock held
+ * Mark the given slot as locked.  Must be called with the i_pages lock held.
  */
 static inline void *lock_slot(struct address_space *mapping, void **slot)
 {
         unsigned long entry = (unsigned long)
-                radix_tree_deref_slot_protected(slot, &mapping->tree_lock);
+                radix_tree_deref_slot_protected(slot, &mapping->i_pages.xa_lock);
 
         entry |= RADIX_DAX_ENTRY_LOCK;
-        radix_tree_replace_slot(&mapping->page_tree, slot, (void *)entry);
+        radix_tree_replace_slot(&mapping->i_pages, slot, (void *)entry);
         return (void *)entry;
 }
 
 /*
- * Mark the given slot is unlocked. The function must be called with
- * mapping->tree_lock held
+ * Mark the given slot as unlocked.  Must be called with the i_pages lock held.
  */
 static inline void *unlock_slot(struct address_space *mapping, void **slot)
 {
         unsigned long entry = (unsigned long)
-                radix_tree_deref_slot_protected(slot, &mapping->tree_lock);
+                radix_tree_deref_slot_protected(slot, &mapping->i_pages.xa_lock);
 
         entry &= ~(unsigned long)RADIX_DAX_ENTRY_LOCK;
-        radix_tree_replace_slot(&mapping->page_tree, slot, (void *)entry);
+        radix_tree_replace_slot(&mapping->i_pages, slot, (void *)entry);
         return (void *)entry;
 }
 
@@ -228,7 +224,7 @@ static inline void *unlock_slot(struct address_space *mapping, void **slot)
  * put_locked_mapping_entry() when he locked the entry and now wants to
  * unlock it.
  *
- * The function must be called with mapping->tree_lock held.
+ * Must be called with the i_pages lock held.
  */
 static void *get_unlocked_mapping_entry(struct address_space *mapping,
                                         pgoff_t index, void ***slotp)
@@ -241,7 +237,7 @@ static void *get_unlocked_mapping_entry(struct address_space *mapping,
         ewait.wait.func = wake_exceptional_entry_func;
 
         for (;;) {
-                entry = __radix_tree_lookup(&mapping->page_tree, index, NULL,
+                entry = __radix_tree_lookup(&mapping->i_pages, index, NULL,
                                           &slot);
                 if (!entry ||
                     WARN_ON_ONCE(!radix_tree_exceptional_entry(entry)) ||
@@ -254,10 +250,10 @@ static void *get_unlocked_mapping_entry(struct address_space *mapping,
                 wq = dax_entry_waitqueue(mapping, index, entry, &ewait.key);
                 prepare_to_wait_exclusive(wq, &ewait.wait,
                                           TASK_UNINTERRUPTIBLE);
-                spin_unlock_irq(&mapping->tree_lock);
+                xa_unlock_irq(&mapping->i_pages);
                 schedule();
                 finish_wait(wq, &ewait.wait);
-                spin_lock_irq(&mapping->tree_lock);
+                xa_lock_irq(&mapping->i_pages);
         }
 }
 
@@ -266,15 +262,15 @@ static void dax_unlock_mapping_entry(struct address_space *mapping,
 {
         void *entry, **slot;
 
-        spin_lock_irq(&mapping->tree_lock);
-        entry = __radix_tree_lookup(&mapping->page_tree, index, NULL, &slot);
+        xa_lock_irq(&mapping->i_pages);
+        entry = __radix_tree_lookup(&mapping->i_pages, index, NULL, &slot);
         if (WARN_ON_ONCE(!entry || !radix_tree_exceptional_entry(entry) ||
                          !slot_locked(mapping, slot))) {
-                spin_unlock_irq(&mapping->tree_lock);
+                xa_unlock_irq(&mapping->i_pages);
                 return;
         }
         unlock_slot(mapping, slot);
-        spin_unlock_irq(&mapping->tree_lock);
+        xa_unlock_irq(&mapping->i_pages);
         dax_wake_mapping_entry_waiter(mapping, index, entry, false);
 }
 
@@ -388,7 +384,7 @@ static void *grab_mapping_entry(struct address_space *mapping, pgoff_t index,
         void *entry, **slot;
 
 restart:
-        spin_lock_irq(&mapping->tree_lock);
+        xa_lock_irq(&mapping->i_pages);
         entry = get_unlocked_mapping_entry(mapping, index, &slot);
 
         if (WARN_ON_ONCE(entry && !radix_tree_exceptional_entry(entry))) {
@@ -420,12 +416,12 @@ restart:
                 if (pmd_downgrade) {
                         /*
                          * Make sure 'entry' remains valid while we drop
-                         * mapping->tree_lock.
+                         * the i_pages lock.
                          */
                         entry = lock_slot(mapping, slot);
                 }
 
-                spin_unlock_irq(&mapping->tree_lock);
+                xa_unlock_irq(&mapping->i_pages);
                 /*
                  * Besides huge zero pages the only other thing that gets
                  * downgraded are empty entries which don't need to be
@@ -442,27 +438,27 @@ restart:
                                 put_locked_mapping_entry(mapping, index);
                         return ERR_PTR(err);
                 }
-                spin_lock_irq(&mapping->tree_lock);
+                xa_lock_irq(&mapping->i_pages);
 
                 if (!entry) {
                         /*
-                         * We needed to drop the page_tree lock while calling
+                         * We needed to drop the i_pages lock while calling
                          * radix_tree_preload() and we didn't have an entry to
                          * lock.  See if another thread inserted an entry at
                          * our index during this time.
                          */
-                        entry = __radix_tree_lookup(&mapping->page_tree, index,
+                        entry = __radix_tree_lookup(&mapping->i_pages, index,
                                         NULL, &slot);
                         if (entry) {
                                 radix_tree_preload_end();
-                                spin_unlock_irq(&mapping->tree_lock);
+                                xa_unlock_irq(&mapping->i_pages);
                                 goto restart;
                         }
                 }
 
                 if (pmd_downgrade) {
                         dax_disassociate_entry(entry, mapping, false);
-                        radix_tree_delete(&mapping->page_tree, index);
+                        radix_tree_delete(&mapping->i_pages, index);
                         mapping->nrexceptional--;
                         dax_wake_mapping_entry_waiter(mapping, index, entry,
                                         true);
@@ -470,11 +466,11 @@ restart:
 
                 entry = dax_radix_locked_entry(0, size_flag | RADIX_DAX_EMPTY);
 
-                err = __radix_tree_insert(&mapping->page_tree, index,
+                err = __radix_tree_insert(&mapping->i_pages, index,
                                 dax_radix_order(entry), entry);
                 radix_tree_preload_end();
                 if (err) {
-                        spin_unlock_irq(&mapping->tree_lock);
+                        xa_unlock_irq(&mapping->i_pages);
                         /*
                          * Our insertion of a DAX entry failed, most likely
                          * because we were inserting a PMD entry and it
@@ -487,12 +483,12 @@ restart:
                 }
                 /* Good, we have inserted empty locked entry into the tree. */
                 mapping->nrexceptional++;
-                spin_unlock_irq(&mapping->tree_lock);
+                xa_unlock_irq(&mapping->i_pages);
                 return entry;
         }
         entry = lock_slot(mapping, slot);
  out_unlock:
-        spin_unlock_irq(&mapping->tree_lock);
+        xa_unlock_irq(&mapping->i_pages);
         return entry;
 }
 
@@ -501,23 +497,23 @@ static int __dax_invalidate_mapping_entry(struct address_space *mapping,
 {
         int ret = 0;
         void *entry;
-        struct radix_tree_root *page_tree = &mapping->page_tree;
+        struct radix_tree_root *pages = &mapping->i_pages;
 
-        spin_lock_irq(&mapping->tree_lock);
+        xa_lock_irq(pages);
         entry = get_unlocked_mapping_entry(mapping, index, NULL);
         if (!entry || WARN_ON_ONCE(!radix_tree_exceptional_entry(entry)))
                 goto out;
         if (!trunc &&
-            (radix_tree_tag_get(page_tree, index, PAGECACHE_TAG_DIRTY) ||
-             radix_tree_tag_get(page_tree, index, PAGECACHE_TAG_TOWRITE)))
+            (radix_tree_tag_get(pages, index, PAGECACHE_TAG_DIRTY) ||
+             radix_tree_tag_get(pages, index, PAGECACHE_TAG_TOWRITE)))
                 goto out;
         dax_disassociate_entry(entry, mapping, trunc);
-        radix_tree_delete(page_tree, index);
+        radix_tree_delete(pages, index);
         mapping->nrexceptional--;
         ret = 1;
 out:
         put_unlocked_mapping_entry(mapping, index, entry);
-        spin_unlock_irq(&mapping->tree_lock);
+        xa_unlock_irq(pages);
         return ret;
 }
 /*
@@ -587,7 +583,7 @@ static void *dax_insert_mapping_entry(struct address_space *mapping,
                                       void *entry, pfn_t pfn_t,
                                       unsigned long flags, bool dirty)
 {
-        struct radix_tree_root *page_tree = &mapping->page_tree;
+        struct radix_tree_root *pages = &mapping->i_pages;
         unsigned long pfn = pfn_t_to_pfn(pfn_t);
         pgoff_t index = vmf->pgoff;
         void *new_entry;
@@ -604,7 +600,7 @@ static void *dax_insert_mapping_entry(struct address_space *mapping,
                         unmap_mapping_pages(mapping, vmf->pgoff, 1, false);
         }
 
-        spin_lock_irq(&mapping->tree_lock);
+        xa_lock_irq(pages);
         new_entry = dax_radix_locked_entry(pfn, flags);
         if (dax_entry_size(entry) != dax_entry_size(new_entry)) {
                 dax_disassociate_entry(entry, mapping, false);
@@ -624,17 +620,17 @@ static void *dax_insert_mapping_entry(struct address_space *mapping,
                 void **slot;
                 void *ret;
 
-                ret = __radix_tree_lookup(page_tree, index, &node, &slot);
+                ret = __radix_tree_lookup(pages, index, &node, &slot);
                 WARN_ON_ONCE(ret != entry);
-                __radix_tree_replace(page_tree, node, slot,
+                __radix_tree_replace(pages, node, slot,
                                      new_entry, NULL);
                 entry = new_entry;
         }
 
         if (dirty)
-                radix_tree_tag_set(page_tree, index, PAGECACHE_TAG_DIRTY);
+                radix_tree_tag_set(pages, index, PAGECACHE_TAG_DIRTY);
 
-        spin_unlock_irq(&mapping->tree_lock);
+        xa_unlock_irq(pages);
         return entry;
 }
 
@@ -723,7 +719,7 @@ unlock_pte:
 static int dax_writeback_one(struct dax_device *dax_dev,
                 struct address_space *mapping, pgoff_t index, void *entry)
 {
-        struct radix_tree_root *page_tree = &mapping->page_tree;
+        struct radix_tree_root *pages = &mapping->i_pages;
         void *entry2, **slot;
         unsigned long pfn;
         long ret = 0;
@@ -736,7 +732,7 @@ static int dax_writeback_one(struct dax_device *dax_dev,
         if (WARN_ON(!radix_tree_exceptional_entry(entry)))
                 return -EIO;
 
-        spin_lock_irq(&mapping->tree_lock);
+        xa_lock_irq(pages);
         entry2 = get_unlocked_mapping_entry(mapping, index, &slot);
         /* Entry got punched out / reallocated? */
         if (!entry2 || WARN_ON_ONCE(!radix_tree_exceptional_entry(entry2)))
@@ -755,7 +751,7 @@ static int dax_writeback_one(struct dax_device *dax_dev,
         }
 
         /* Another fsync thread may have already written back this entry */
-        if (!radix_tree_tag_get(page_tree, index, PAGECACHE_TAG_TOWRITE))
+        if (!radix_tree_tag_get(pages, index, PAGECACHE_TAG_TOWRITE))
                 goto put_unlocked;
         /* Lock the entry to serialize with page faults */
         entry = lock_slot(mapping, slot);
@@ -763,11 +759,11 @@ static int dax_writeback_one(struct dax_device *dax_dev,
          * We can clear the tag now but we have to be careful so that concurrent
          * dax_writeback_one() calls for the same index cannot finish before we
          * actually flush the caches. This is achieved as the calls will look
-         * at the entry only under tree_lock and once they do that they will
-         * see the entry locked and wait for it to unlock.
+         * at the entry only under the i_pages lock and once they do that
+         * they will see the entry locked and wait for it to unlock.
          */
-        radix_tree_tag_clear(page_tree, index, PAGECACHE_TAG_TOWRITE);
-        spin_unlock_irq(&mapping->tree_lock);
+        radix_tree_tag_clear(pages, index, PAGECACHE_TAG_TOWRITE);
+        xa_unlock_irq(pages);
 
         /*
          * Even if dax_writeback_mapping_range() was given a wbc->range_start
@@ -787,16 +783,16 @@ static int dax_writeback_one(struct dax_device *dax_dev,
          * the pfn mappings are writeprotected and fault waits for mapping
          * entry lock.
          */
-        spin_lock_irq(&mapping->tree_lock);
-        radix_tree_tag_clear(page_tree, index, PAGECACHE_TAG_DIRTY);
-        spin_unlock_irq(&mapping->tree_lock);
+        xa_lock_irq(pages);
+        radix_tree_tag_clear(pages, index, PAGECACHE_TAG_DIRTY);
+        xa_unlock_irq(pages);
         trace_dax_writeback_one(mapping->host, index, size >> PAGE_SHIFT);
         put_locked_mapping_entry(mapping, index);
         return ret;
 
  put_unlocked:
         put_unlocked_mapping_entry(mapping, index, entry2);
-        spin_unlock_irq(&mapping->tree_lock);
+        xa_unlock_irq(pages);
         return ret;
 }
 
@@ -1566,21 +1562,21 @@ static int dax_insert_pfn_mkwrite(struct vm_fault *vmf,
         pgoff_t index = vmf->pgoff;
         int vmf_ret, error;
 
-        spin_lock_irq(&mapping->tree_lock);
+        xa_lock_irq(&mapping->i_pages);
         entry = get_unlocked_mapping_entry(mapping, index, &slot);
         /* Did we race with someone splitting entry or so? */
         if (!entry ||
             (pe_size == PE_SIZE_PTE && !dax_is_pte_entry(entry)) ||
             (pe_size == PE_SIZE_PMD && !dax_is_pmd_entry(entry))) {
                 put_unlocked_mapping_entry(mapping, index, entry);
-                spin_unlock_irq(&mapping->tree_lock);
+                xa_unlock_irq(&mapping->i_pages);
                 trace_dax_insert_pfn_mkwrite_no_entry(mapping->host, vmf,
                                                       VM_FAULT_NOPAGE);
                 return VM_FAULT_NOPAGE;
         }
-        radix_tree_tag_set(&mapping->page_tree, index, PAGECACHE_TAG_DIRTY);
+        radix_tree_tag_set(&mapping->i_pages, index, PAGECACHE_TAG_DIRTY);
         entry = lock_slot(mapping, slot);
-        spin_unlock_irq(&mapping->tree_lock);
+        xa_unlock_irq(&mapping->i_pages);
         switch (pe_size) {
         case PE_SIZE_PTE:
                 error = vm_insert_mixed_mkwrite(vmf->vma, vmf->address, pfn);
diff --git a/fs/dcache.c b/fs/dcache.c
index 593079176123..86d2de63461e 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -257,11 +257,25 @@ static void __d_free(struct rcu_head *head)
         kmem_cache_free(dentry_cache, dentry); 
 }
 
+static void __d_free_external_name(struct rcu_head *head)
+{
+        struct external_name *name = container_of(head, struct external_name,
+                                                  u.head);
+
+        mod_node_page_state(page_pgdat(virt_to_page(name)),
+                            NR_INDIRECTLY_RECLAIMABLE_BYTES,
+                            -ksize(name));
+
+        kfree(name);
+}
+
 static void __d_free_external(struct rcu_head *head)
 {
         struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
-        kfree(external_name(dentry));
-        kmem_cache_free(dentry_cache, dentry); 
+
+        __d_free_external_name(&external_name(dentry)->u.head);
+
+        kmem_cache_free(dentry_cache, dentry);
 }
 
 static inline int dname_external(const struct dentry *dentry)
@@ -291,7 +305,7 @@ void release_dentry_name_snapshot(struct name_snapshot *name)
                 struct external_name *p;
                 p = container_of(name->name, struct external_name, name[0]);
                 if (unlikely(atomic_dec_and_test(&p->u.count)))
-                        kfree_rcu(p, u.head);
+                        call_rcu(&p->u.head, __d_free_external_name);
         }
 }
 EXPORT_SYMBOL(release_dentry_name_snapshot);
@@ -1038,6 +1052,8 @@ static void shrink_dentry_list(struct list_head *list)
         while (!list_empty(list)) {
                 struct dentry *dentry, *parent;
 
+                cond_resched();
+
                 dentry = list_entry(list->prev, struct dentry, d_lru);
                 spin_lock(&dentry->d_lock);
                 rcu_read_lock();
@@ -1191,7 +1207,6 @@ void shrink_dcache_sb(struct super_block *sb)
 
                 this_cpu_sub(nr_dentry_unused, freed);
                 shrink_dentry_list(&dispose);
-                cond_resched();
         } while (list_lru_count(&sb->s_dentry_lru) > 0);
 }
 EXPORT_SYMBOL(shrink_dcache_sb);
@@ -1473,7 +1488,6 @@ void shrink_dcache_parent(struct dentry *parent)
                         break;
 
                 shrink_dentry_list(&data.dispose);
-                cond_resched();
         }
 }
 EXPORT_SYMBOL(shrink_dcache_parent);
@@ -1600,7 +1614,6 @@ void d_invalidate(struct dentry *dentry)
                         detach_mounts(data.mountpoint);
                         dput(data.mountpoint);
                 }
-                cond_resched();
         }
 }
 EXPORT_SYMBOL(d_invalidate);
@@ -1617,6 +1630,7 @@ EXPORT_SYMBOL(d_invalidate);
  
 struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
 {
+        struct external_name *ext = NULL;
         struct dentry *dentry;
         char *dname;
         int err;
@@ -1637,14 +1651,14 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
                 dname = dentry->d_iname;
         } else if (name->len > DNAME_INLINE_LEN-1) {
                 size_t size = offsetof(struct external_name, name[1]);
-                struct external_name *p = kmalloc(size + name->len,
-                                                  GFP_KERNEL_ACCOUNT);
-                if (!p) {
+
+                ext = kmalloc(size + name->len, GFP_KERNEL_ACCOUNT);
+                if (!ext) {
                         kmem_cache_free(dentry_cache, dentry); 
                         return NULL;
                 }
-                atomic_set(&p->u.count, 1);
-                dname = p->name;
+                atomic_set(&ext->u.count, 1);
+                dname = ext->name;
         } else  {
                 dname = dentry->d_iname;
         }       
@@ -1683,6 +1697,12 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
                 }
         }
 
+        if (unlikely(ext)) {
+                pg_data_t *pgdat = page_pgdat(virt_to_page(ext));
+                mod_node_page_state(pgdat, NR_INDIRECTLY_RECLAIMABLE_BYTES,
+                                    ksize(ext));
+        }
+
         this_cpu_inc(nr_dentry);
 
         return dentry;
@@ -2770,7 +2790,7 @@ static void copy_name(struct dentry *dentry, struct dentry *target)
                 dentry->d_name.hash_len = target->d_name.hash_len;
         }
         if (old_name && likely(atomic_dec_and_test(&old_name->u.count)))
-                kfree_rcu(old_name, u.head);
+                call_rcu(&old_name->u.head, __d_free_external_name);
 }
 
 /*
diff --git a/fs/exec.c b/fs/exec.c
index a919a827d181..183059c427b9 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -257,7 +257,7 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
                  *    to work from.
                  */
                 limit = _STK_LIM / 4 * 3;
-                limit = min(limit, rlimit(RLIMIT_STACK) / 4);
+                limit = min(limit, bprm->rlim_stack.rlim_cur / 4);
                 if (size > limit)
                         goto fail;
         }
@@ -411,6 +411,11 @@ static int bprm_mm_init(struct linux_binprm *bprm)
         if (!mm)
                 goto err;
 
+        /* Save current stack limit for all calculations made during exec. */
+        task_lock(current->group_leader);
+        bprm->rlim_stack = current->signal->rlim[RLIMIT_STACK];
+        task_unlock(current->group_leader);
+
         err = __bprm_mm_init(bprm);
         if (err)
                 goto err;
@@ -697,7 +702,7 @@ int setup_arg_pages(struct linux_binprm *bprm,
 
 #ifdef CONFIG_STACK_GROWSUP
         /* Limit stack size */
-        stack_base = rlimit_max(RLIMIT_STACK);
+        stack_base = bprm->rlim_stack.rlim_max;
         if (stack_base > STACK_SIZE_MAX)
                 stack_base = STACK_SIZE_MAX;
 
@@ -770,7 +775,7 @@ int setup_arg_pages(struct linux_binprm *bprm,
          * Align this down to a page boundary as expand_stack
          * will align it up.
          */
-        rlim_stack = rlimit(RLIMIT_STACK) & PAGE_MASK;
+        rlim_stack = bprm->rlim_stack.rlim_cur & PAGE_MASK;
 #ifdef CONFIG_STACK_GROWSUP
         if (stack_size + stack_expand > rlim_stack)
                 stack_base = vma->vm_start + rlim_stack;
@@ -1341,11 +1346,11 @@ void setup_new_exec(struct linux_binprm * bprm)
                  * RLIMIT_STACK, but after the point of no return to avoid
                  * needing to clean up the change on failure.
                  */
-                if (current->signal->rlim[RLIMIT_STACK].rlim_cur > _STK_LIM)
-                        current->signal->rlim[RLIMIT_STACK].rlim_cur = _STK_LIM;
+                if (bprm->rlim_stack.rlim_cur > _STK_LIM)
+                        bprm->rlim_stack.rlim_cur = _STK_LIM;
         }
 
-        arch_pick_mmap_layout(current->mm);
+        arch_pick_mmap_layout(current->mm, &bprm->rlim_stack);
 
         current->sas_ss_sp = current->sas_ss_size = 0;
 
@@ -1378,6 +1383,16 @@ void setup_new_exec(struct linux_binprm * bprm)
 }
 EXPORT_SYMBOL(setup_new_exec);
 
+/* Runs immediately before start_thread() takes over. */
+void finalize_exec(struct linux_binprm *bprm)
+{
+        /* Store any stack rlimit changes before starting thread. */
+        task_lock(current->group_leader);
+        current->signal->rlim[RLIMIT_STACK] = bprm->rlim_stack;
+        task_unlock(current->group_leader);
+}
+EXPORT_SYMBOL(finalize_exec);
+
 /*
  * Prepare credentials and lock ->cred_guard_mutex.
  * install_exec_creds() commits the new creds and drops the lock.
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index db50686f5096..02237d4d91f5 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2424,12 +2424,12 @@ void f2fs_set_page_dirty_nobuffers(struct page *page)
         SetPageDirty(page);
         spin_unlock(&mapping->private_lock);
 
-        spin_lock_irqsave(&mapping->tree_lock, flags);
+        xa_lock_irqsave(&mapping->i_pages, flags);
         WARN_ON_ONCE(!PageUptodate(page));
         account_page_dirtied(page, mapping);
-        radix_tree_tag_set(&mapping->page_tree,
+        radix_tree_tag_set(&mapping->i_pages,
                         page_index(page), PAGECACHE_TAG_DIRTY);
-        spin_unlock_irqrestore(&mapping->tree_lock, flags);
+        xa_unlock_irqrestore(&mapping->i_pages, flags);
         unlock_page_memcg(page);
 
         __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index fe661274ff10..8c9c2f31b253 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -732,10 +732,10 @@ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
 
         if (bit_pos == NR_DENTRY_IN_BLOCK &&
                         !truncate_hole(dir, page->index, page->index + 1)) {
-                spin_lock_irqsave(&mapping->tree_lock, flags);
-                radix_tree_tag_clear(&mapping->page_tree, page_index(page),
+                xa_lock_irqsave(&mapping->i_pages, flags);
+                radix_tree_tag_clear(&mapping->i_pages, page_index(page),
                                      PAGECACHE_TAG_DIRTY);
-                spin_unlock_irqrestore(&mapping->tree_lock, flags);
+                xa_unlock_irqrestore(&mapping->i_pages, flags);
 
                 clear_page_dirty_for_io(page);
                 ClearPagePrivate(page);
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index bfb7a4a3a929..9327411fd93b 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1015,7 +1015,7 @@ int f2fs_gc(struct f2fs_sb_info *sbi, bool sync,
         unsigned int init_segno = segno;
         struct gc_inode_list gc_list = {
                 .ilist = LIST_HEAD_INIT(gc_list.ilist),
-                .iroot = RADIX_TREE_INIT(GFP_NOFS),
+                .iroot = RADIX_TREE_INIT(gc_list.iroot, GFP_NOFS),
         };
 
         trace_f2fs_gc_begin(sbi->sb, sync, background,
diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index 3b77d6421218..265da200daa8 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -226,10 +226,10 @@ int f2fs_write_inline_data(struct inode *inode, struct page *page)
         kunmap_atomic(src_addr);
         set_page_dirty(dn.inode_page);
 
-        spin_lock_irqsave(&mapping->tree_lock, flags);
-        radix_tree_tag_clear(&mapping->page_tree, page_index(page),
+        xa_lock_irqsave(&mapping->i_pages, flags);
+        radix_tree_tag_clear(&mapping->i_pages, page_index(page),
                              PAGECACHE_TAG_DIRTY);
-        spin_unlock_irqrestore(&mapping->tree_lock, flags);
+        xa_unlock_irqrestore(&mapping->i_pages, flags);
 
         set_inode_flag(inode, FI_APPEND_WRITE);
         set_inode_flag(inode, FI_DATA_EXIST);
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 9a99243054ba..f202398e20ea 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -91,11 +91,11 @@ static void clear_node_page_dirty(struct page *page)
         unsigned int long flags;
 
         if (PageDirty(page)) {
-                spin_lock_irqsave(&mapping->tree_lock, flags);
-                radix_tree_tag_clear(&mapping->page_tree,
+                xa_lock_irqsave(&mapping->i_pages, flags);
+                radix_tree_tag_clear(&mapping->i_pages,
                                 page_index(page),
                                 PAGECACHE_TAG_DIRTY);
-                spin_unlock_irqrestore(&mapping->tree_lock, flags);
+                xa_unlock_irqrestore(&mapping->i_pages, flags);
 
                 clear_page_dirty_for_io(page);
                 dec_page_count(F2FS_M_SB(mapping), F2FS_DIRTY_NODES);
@@ -1161,7 +1161,7 @@ void ra_node_page(struct f2fs_sb_info *sbi, nid_t nid)
         f2fs_bug_on(sbi, check_nid_range(sbi, nid));
 
         rcu_read_lock();
-        apage = radix_tree_lookup(&NODE_MAPPING(sbi)->page_tree, nid);
+        apage = radix_tree_lookup(&NODE_MAPPING(sbi)->i_pages, nid);
         rcu_read_unlock();
         if (apage)
                 return;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 1280f915079b..4b12ba70a895 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -347,9 +347,9 @@ static void inode_switch_wbs_work_fn(struct work_struct *work)
          * By the time control reaches here, RCU grace period has passed
          * since I_WB_SWITCH assertion and all wb stat update transactions
          * between unlocked_inode_to_wb_begin/end() are guaranteed to be
-         * synchronizing against mapping->tree_lock.
+         * synchronizing against the i_pages lock.
          *
-         * Grabbing old_wb->list_lock, inode->i_lock and mapping->tree_lock
+         * Grabbing old_wb->list_lock, inode->i_lock and the i_pages lock
          * gives us exclusion against all wb related operations on @inode
          * including IO list manipulations and stat updates.
          */
@@ -361,7 +361,7 @@ static void inode_switch_wbs_work_fn(struct work_struct *work)
                 spin_lock_nested(&old_wb->list_lock, SINGLE_DEPTH_NESTING);
         }
         spin_lock(&inode->i_lock);
-        spin_lock_irq(&mapping->tree_lock);
+        xa_lock_irq(&mapping->i_pages);
 
         /*
          * Once I_FREEING is visible under i_lock, the eviction path owns
@@ -373,22 +373,22 @@ static void inode_switch_wbs_work_fn(struct work_struct *work)
         /*
          * Count and transfer stats.  Note that PAGECACHE_TAG_DIRTY points
          * to possibly dirty pages while PAGECACHE_TAG_WRITEBACK points to
-         * pages actually under underwriteback.
+         * pages actually under writeback.
          */
-        radix_tree_for_each_tagged(slot, &mapping->page_tree, &iter, 0,
+        radix_tree_for_each_tagged(slot, &mapping->i_pages, &iter, 0,
                                    PAGECACHE_TAG_DIRTY) {
                 struct page *page = radix_tree_deref_slot_protected(slot,
-                                                        &mapping->tree_lock);
+                                                &mapping->i_pages.xa_lock);
                 if (likely(page) && PageDirty(page)) {
                         dec_wb_stat(old_wb, WB_RECLAIMABLE);
                         inc_wb_stat(new_wb, WB_RECLAIMABLE);
                 }
         }
 
-        radix_tree_for_each_tagged(slot, &mapping->page_tree, &iter, 0,
+        radix_tree_for_each_tagged(slot, &mapping->i_pages, &iter, 0,
                                    PAGECACHE_TAG_WRITEBACK) {
                 struct page *page = radix_tree_deref_slot_protected(slot,
-                                                        &mapping->tree_lock);
+                                                &mapping->i_pages.xa_lock);
                 if (likely(page)) {
                         WARN_ON_ONCE(!PageWriteback(page));
                         dec_wb_stat(old_wb, WB_WRITEBACK);
@@ -430,7 +430,7 @@ skip_switch:
          */
         smp_store_release(&inode->i_state, inode->i_state & ~I_WB_SWITCH);
 
-        spin_unlock_irq(&mapping->tree_lock);
+        xa_unlock_irq(&mapping->i_pages);
         spin_unlock(&inode->i_lock);
         spin_unlock(&new_wb->list_lock);
         spin_unlock(&old_wb->list_lock);
@@ -506,8 +506,8 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
 
         /*
          * In addition to synchronizing among switchers, I_WB_SWITCH tells
-         * the RCU protected stat update paths to grab the mapping's
-         * tree_lock so that stat transfer can synchronize against them.
+         * the RCU protected stat update paths to grab the i_page
+         * lock so that stat transfer can synchronize against them.
          * Let's continue after I_WB_SWITCH is guaranteed to be visible.
          */
         call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn);
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 7dc55b93a830..97137d7ec5ee 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -832,7 +832,7 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie,
         /* Clear pointers back to the netfs */
         cookie->netfs_data      = NULL;
         cookie->def             = NULL;
-        BUG_ON(cookie->stores.rnode);
+        BUG_ON(!radix_tree_empty(&cookie->stores));
 
         if (cookie->parent) {
                 ASSERTCMP(atomic_read(&cookie->parent->usage), >, 0);
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 1085ca12e25c..20e0d0a4dc8c 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -973,7 +973,7 @@ static const struct fscache_state *_fscache_invalidate_object(struct fscache_obj
          * retire the object instead.
          */
         if (!fscache_use_cookie(object)) {
-                ASSERT(object->cookie->stores.rnode == NULL);
+                ASSERT(radix_tree_empty(&object->cookie->stores));
                 set_bit(FSCACHE_OBJECT_RETIRED, &object->flags);
                 _leave(" [no cookie]");
                 return transit_to(KILL_OBJECT);
diff --git a/fs/inode.c b/fs/inode.c
index b153aeaa61ea..13ceb98c3bd3 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -348,8 +348,7 @@ EXPORT_SYMBOL(inc_nlink);
 
 static void __address_space_init_once(struct address_space *mapping)
 {
-        INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC | __GFP_ACCOUNT);
-        spin_lock_init(&mapping->tree_lock);
+        INIT_RADIX_TREE(&mapping->i_pages, GFP_ATOMIC | __GFP_ACCOUNT);
         init_rwsem(&mapping->i_mmap_rwsem);
         INIT_LIST_HEAD(&mapping->private_list);
         spin_lock_init(&mapping->private_lock);
@@ -504,14 +503,14 @@ EXPORT_SYMBOL(__remove_inode_hash);
 void clear_inode(struct inode *inode)
 {
         /*
-         * We have to cycle tree_lock here because reclaim can be still in the
+         * We have to cycle the i_pages lock here because reclaim can be in the
          * process of removing the last page (in __delete_from_page_cache())
-         * and we must not free mapping under it.
+         * and we must not free the mapping under it.
          */
-        spin_lock_irq(&inode->i_data.tree_lock);
+        xa_lock_irq(&inode->i_data.i_pages);
         BUG_ON(inode->i_data.nrpages);
         BUG_ON(inode->i_data.nrexceptional);
-        spin_unlock_irq(&inode->i_data.tree_lock);
+        xa_unlock_irq(&inode->i_data.i_pages);
         BUG_ON(!list_empty(&inode->i_data.private_list));
         BUG_ON(!(inode->i_state & I_FREEING));
         BUG_ON(inode->i_state & I_CLEAR);
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index c21e0b4454a6..dec98cab729d 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -193,9 +193,9 @@ retry:
                                        (unsigned long long)oldkey,
                                        (unsigned long long)newkey);
 
-                spin_lock_irq(&btnc->tree_lock);
-                err = radix_tree_insert(&btnc->page_tree, newkey, obh->b_page);
-                spin_unlock_irq(&btnc->tree_lock);
+                xa_lock_irq(&btnc->i_pages);
+                err = radix_tree_insert(&btnc->i_pages, newkey, obh->b_page);
+                xa_unlock_irq(&btnc->i_pages);
                 /*
                  * Note: page->index will not change to newkey until
                  * nilfs_btnode_commit_change_key() will be called.
@@ -251,11 +251,11 @@ void nilfs_btnode_commit_change_key(struct address_space *btnc,
                                        (unsigned long long)newkey);
                 mark_buffer_dirty(obh);
 
-                spin_lock_irq(&btnc->tree_lock);
-                radix_tree_delete(&btnc->page_tree, oldkey);
-                radix_tree_tag_set(&btnc->page_tree, newkey,
+                xa_lock_irq(&btnc->i_pages);
+                radix_tree_delete(&btnc->i_pages, oldkey);
+                radix_tree_tag_set(&btnc->i_pages, newkey,
                                    PAGECACHE_TAG_DIRTY);
-                spin_unlock_irq(&btnc->tree_lock);
+                xa_unlock_irq(&btnc->i_pages);
 
                 opage->index = obh->b_blocknr = newkey;
                 unlock_page(opage);
@@ -283,9 +283,9 @@ void nilfs_btnode_abort_change_key(struct address_space *btnc,
                 return;
 
         if (nbh == NULL) {      /* blocksize == pagesize */
-                spin_lock_irq(&btnc->tree_lock);
-                radix_tree_delete(&btnc->page_tree, newkey);
-                spin_unlock_irq(&btnc->tree_lock);
+                xa_lock_irq(&btnc->i_pages);
+                radix_tree_delete(&btnc->i_pages, newkey);
+                xa_unlock_irq(&btnc->i_pages);
                 unlock_page(ctxt->bh->b_page);
         } else
                 brelse(nbh);
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 68241512d7c1..4cb850a6f1c2 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -331,15 +331,15 @@ repeat:
                         struct page *page2;
 
                         /* move the page to the destination cache */
-                        spin_lock_irq(&smap->tree_lock);
-                        page2 = radix_tree_delete(&smap->page_tree, offset);
+                        xa_lock_irq(&smap->i_pages);
+                        page2 = radix_tree_delete(&smap->i_pages, offset);
                         WARN_ON(page2 != page);
 
                         smap->nrpages--;
-                        spin_unlock_irq(&smap->tree_lock);
+                        xa_unlock_irq(&smap->i_pages);
 
-                        spin_lock_irq(&dmap->tree_lock);
-                        err = radix_tree_insert(&dmap->page_tree, offset, page);
+                        xa_lock_irq(&dmap->i_pages);
+                        err = radix_tree_insert(&dmap->i_pages, offset, page);
                         if (unlikely(err < 0)) {
                                 WARN_ON(err == -EEXIST);
                                 page->mapping = NULL;
@@ -348,11 +348,11 @@ repeat:
                                 page->mapping = dmap;
                                 dmap->nrpages++;
                                 if (PageDirty(page))
-                                        radix_tree_tag_set(&dmap->page_tree,
+                                        radix_tree_tag_set(&dmap->i_pages,
                                                            offset,
                                                            PAGECACHE_TAG_DIRTY);
                         }
-                        spin_unlock_irq(&dmap->tree_lock);
+                        xa_unlock_irq(&dmap->i_pages);
                 }
                 unlock_page(page);
         }
@@ -474,15 +474,15 @@ int __nilfs_clear_page_dirty(struct page *page)
         struct address_space *mapping = page->mapping;
 
         if (mapping) {
-                spin_lock_irq(&mapping->tree_lock);
+                xa_lock_irq(&mapping->i_pages);
                 if (test_bit(PG_dirty, &page->flags)) {
-                        radix_tree_tag_clear(&mapping->page_tree,
+                        radix_tree_tag_clear(&mapping->i_pages,
                                              page_index(page),
                                              PAGECACHE_TAG_DIRTY);
-                        spin_unlock_irq(&mapping->tree_lock);
+                        xa_unlock_irq(&mapping->i_pages);
                         return clear_page_dirty_for_io(page);
                 }
-                spin_unlock_irq(&mapping->tree_lock);
+                xa_unlock_irq(&mapping->i_pages);
                 return 0;
         }
         return TestClearPageDirty(page);
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 598803576e4c..ae2c807fd719 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -141,25 +141,12 @@ static inline const char *get_task_state(struct task_struct *tsk)
         return task_state_array[task_state_index(tsk)];
 }
 
-static inline int get_task_umask(struct task_struct *tsk)
-{
-        struct fs_struct *fs;
-        int umask = -ENOENT;
-
-        task_lock(tsk);
-        fs = tsk->fs;
-        if (fs)
-                umask = fs->umask;
-        task_unlock(tsk);
-        return umask;
-}
-
 static inline void task_state(struct seq_file *m, struct pid_namespace *ns,
                                 struct pid *pid, struct task_struct *p)
 {
         struct user_namespace *user_ns = seq_user_ns(m);
         struct group_info *group_info;
-        int g, umask;
+        int g, umask = -1;
         struct task_struct *tracer;
         const struct cred *cred;
         pid_t ppid, tpid = 0, tgid, ngid;
@@ -177,17 +164,18 @@ static inline void task_state(struct seq_file *m, struct pid_namespace *ns,
         ngid = task_numa_group_id(p);
         cred = get_task_cred(p);
 
-        umask = get_task_umask(p);
-        if (umask >= 0)
-                seq_printf(m, "Umask:\t%#04o\n", umask);
-
         task_lock(p);
+        if (p->fs)
+                umask = p->fs->umask;
         if (p->files)
                 max_fds = files_fdtable(p->files)->max_fds;
         task_unlock(p);
         rcu_read_unlock();
 
-        seq_printf(m, "State:\t%s", get_task_state(p));
+        if (umask >= 0)
+                seq_printf(m, "Umask:\t%#04o\n", umask);
+        seq_puts(m, "State:\t");
+        seq_puts(m, get_task_state(p));
 
         seq_put_decimal_ull(m, "\nTgid:\t", tgid);
         seq_put_decimal_ull(m, "\nNgid:\t", ngid);
@@ -313,8 +301,8 @@ static void render_cap_t(struct seq_file *m, const char *header,
 
         seq_puts(m, header);
         CAP_FOR_EACH_U32(__capi) {
-                seq_printf(m, "%08x",
-                           a->cap[CAP_LAST_U32 - __capi]);
+                seq_put_hex_ll(m, NULL,
+                           a->cap[CAP_LAST_U32 - __capi], 8);
         }
         seq_putc(m, '\n');
 }
@@ -368,7 +356,8 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
 
 static inline void task_core_dumping(struct seq_file *m, struct mm_struct *mm)
 {
-        seq_printf(m, "CoreDumping:\t%d\n", !!mm->core_state);
+        seq_put_decimal_ull(m, "CoreDumping:\t", !!mm->core_state);
+        seq_putc(m, '\n');
 }
 
 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
@@ -504,7 +493,11 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
         /* convert nsec -> ticks */
         start_time = nsec_to_clock_t(task->real_start_time);
 
-        seq_printf(m, "%d (%s) %c", pid_nr_ns(pid, ns), tcomm, state);
+        seq_put_decimal_ull(m, "", pid_nr_ns(pid, ns));
+        seq_puts(m, " (");
+        seq_puts(m, tcomm);
+        seq_puts(m, ") ");
+        seq_putc(m, state);
         seq_put_decimal_ll(m, " ", ppid);
         seq_put_decimal_ll(m, " ", pgid);
         seq_put_decimal_ll(m, " ", sid);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index d53246863cfb..eafa39a3a88c 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -388,14 +388,17 @@ static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,
         unsigned long wchan;
         char symname[KSYM_NAME_LEN];
 
-        wchan = get_wchan(task);
+        if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
+                goto print0;
 
-        if (wchan && ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)
-                        && !lookup_symbol_name(wchan, symname))
-                seq_printf(m, "%s", symname);
-        else
-                seq_putc(m, '0');
+        wchan = get_wchan(task);
+        if (wchan && !lookup_symbol_name(wchan, symname)) {
+                seq_puts(m, symname);
+                return 0;
+        }
 
+print0:
+        seq_putc(m, '0');
         return 0;
 }
 #endif /* CONFIG_KALLSYMS */
@@ -1910,6 +1913,8 @@ static int dname_to_vma_addr(struct dentry *dentry,
         unsigned long long sval, eval;
         unsigned int len;
 
+        if (str[0] == '0' && str[1] != '-')
+                return -EINVAL;
         len = _parse_integer(str, 16, &sval);
         if (len & KSTRTOX_OVERFLOW)
                 return -EINVAL;
@@ -1921,6 +1926,8 @@ static int dname_to_vma_addr(struct dentry *dentry,
                 return -EINVAL;
         str++;
 
+        if (str[0] == '0' && str[1])
+                return -EINVAL;
         len = _parse_integer(str, 16, &eval);
         if (len & KSTRTOX_OVERFLOW)
                 return -EINVAL;
@@ -2204,6 +2211,7 @@ proc_map_files_readdir(struct file *file, struct dir_context *ctx)
                 }
         }
         up_read(&mm->mmap_sem);
+        mmput(mm);
 
         for (i = 0; i < nr_files; i++) {
                 char buf[4 * sizeof(long) + 2]; /* max: %lx-%lx\0 */
@@ -2221,7 +2229,6 @@ proc_map_files_readdir(struct file *file, struct dir_context *ctx)
         }
         if (fa)
                 flex_array_free(fa);
-        mmput(mm);
 
 out_put_task:
         put_task_struct(task);
diff --git a/fs/proc/cmdline.c b/fs/proc/cmdline.c
index 403cbb12a6e9..8233e7af9389 100644
--- a/fs/proc/cmdline.c
+++ b/fs/proc/cmdline.c
@@ -6,7 +6,8 @@
 
 static int cmdline_proc_show(struct seq_file *m, void *v)
 {
-        seq_printf(m, "%s\n", saved_command_line);
+        seq_puts(m, saved_command_line);
+        seq_putc(m, '\n');
         return 0;
 }
 
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 5d709fa8f3a2..04c4804cbdef 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -8,6 +8,7 @@
  * Copyright (C) 1997 Theodore Ts'o
  */
 
+#include <linux/cache.h>
 #include <linux/errno.h>
 #include <linux/time.h>
 #include <linux/proc_fs.h>
@@ -28,6 +29,17 @@
 
 static DEFINE_RWLOCK(proc_subdir_lock);
 
+struct kmem_cache *proc_dir_entry_cache __ro_after_init;
+
+void pde_free(struct proc_dir_entry *pde)
+{
+        if (S_ISLNK(pde->mode))
+                kfree(pde->data);
+        if (pde->name != pde->inline_name)
+                kfree(pde->name);
+        kmem_cache_free(proc_dir_entry_cache, pde);
+}
+
 static int proc_match(const char *name, struct proc_dir_entry *de, unsigned int len)
 {
         if (len < de->namelen)
@@ -40,8 +52,8 @@ static int proc_match(const char *name, struct proc_dir_entry *de, unsigned int
 
 static struct proc_dir_entry *pde_subdir_first(struct proc_dir_entry *dir)
 {
-        return rb_entry_safe(rb_first_cached(&dir->subdir),
-                             struct proc_dir_entry, subdir_node);
+        return rb_entry_safe(rb_first(&dir->subdir), struct proc_dir_entry,
+                             subdir_node);
 }
 
 static struct proc_dir_entry *pde_subdir_next(struct proc_dir_entry *dir)
@@ -54,7 +66,7 @@ static struct proc_dir_entry *pde_subdir_find(struct proc_dir_entry *dir,
                                               const char *name,
                                               unsigned int len)
 {
-        struct rb_node *node = dir->subdir.rb_root.rb_node;
+        struct rb_node *node = dir->subdir.rb_node;
 
         while (node) {
                 struct proc_dir_entry *de = rb_entry(node,
@@ -75,9 +87,8 @@ static struct proc_dir_entry *pde_subdir_find(struct proc_dir_entry *dir,
 static bool pde_subdir_insert(struct proc_dir_entry *dir,
                               struct proc_dir_entry *de)
 {
-        struct rb_root_cached *root = &dir->subdir;
-        struct rb_node **new = &root->rb_root.rb_node, *parent = NULL;
-        bool leftmost = true;
+        struct rb_root *root = &dir->subdir;
+        struct rb_node **new = &root->rb_node, *parent = NULL;
 
         /* Figure out where to put new node */
         while (*new) {
@@ -89,16 +100,15 @@ static bool pde_subdir_insert(struct proc_dir_entry *dir,
                 parent = *new;
                 if (result < 0)
                         new = &(*new)->rb_left;
-                else if (result > 0) {
+                else if (result > 0)
                         new = &(*new)->rb_right;
-                        leftmost = false;
-                } else
+                else
                         return false;
         }
 
         /* Add new node and rebalance tree. */
         rb_link_node(&de->subdir_node, parent, new);
-        rb_insert_color_cached(&de->subdir_node, root, leftmost);
+        rb_insert_color(&de->subdir_node, root);
         return true;
 }
 
@@ -354,6 +364,14 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent,
                 WARN(1, "name len %u\n", qstr.len);
                 return NULL;
         }
+        if (qstr.len == 1 && fn[0] == '.') {
+                WARN(1, "name '.'\n");
+                return NULL;
+        }
+        if (qstr.len == 2 && fn[0] == '.' && fn[1] == '.') {
+                WARN(1, "name '..'\n");
+                return NULL;
+        }
         if (*parent == &proc_root && name_to_int(&qstr) != ~0U) {
                 WARN(1, "create '/proc/%s' by hand\n", qstr.name);
                 return NULL;
@@ -363,16 +381,26 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent,
                 return NULL;
         }
 
-        ent = kzalloc(sizeof(struct proc_dir_entry) + qstr.len + 1, GFP_KERNEL);
+        ent = kmem_cache_zalloc(proc_dir_entry_cache, GFP_KERNEL);
         if (!ent)
                 goto out;
 
+        if (qstr.len + 1 <= sizeof(ent->inline_name)) {
+                ent->name = ent->inline_name;
+        } else {
+                ent->name = kmalloc(qstr.len + 1, GFP_KERNEL);
+                if (!ent->name) {
+                        pde_free(ent);
+                        return NULL;
+                }
+        }
+
         memcpy(ent->name, fn, qstr.len + 1);
         ent->namelen = qstr.len;
         ent->mode = mode;
         ent->nlink = nlink;
-        ent->subdir = RB_ROOT_CACHED;
-        atomic_set(&ent->count, 1);
+        ent->subdir = RB_ROOT;
+        refcount_set(&ent->refcnt, 1);
         spin_lock_init(&ent->pde_unload_lock);
         INIT_LIST_HEAD(&ent->pde_openers);
         proc_set_user(ent, (*parent)->uid, (*parent)->gid);
@@ -395,12 +423,11 @@ struct proc_dir_entry *proc_symlink(const char *name,
                         strcpy((char*)ent->data,dest);
                         ent->proc_iops = &proc_link_inode_operations;
                         if (proc_register(parent, ent) < 0) {
-                                kfree(ent->data);
-                                kfree(ent);
+                                pde_free(ent);
                                 ent = NULL;
                         }
                 } else {
-                        kfree(ent);
+                        pde_free(ent);
                         ent = NULL;
                 }
         }
@@ -423,7 +450,7 @@ struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode,
                 ent->proc_iops = &proc_dir_inode_operations;
                 parent->nlink++;
                 if (proc_register(parent, ent) < 0) {
-                        kfree(ent);
+                        pde_free(ent);
                         parent->nlink--;
                         ent = NULL;
                 }
@@ -458,7 +485,7 @@ struct proc_dir_entry *proc_create_mount_point(const char *name)
                 ent->proc_iops = NULL;
                 parent->nlink++;
                 if (proc_register(parent, ent) < 0) {
-                        kfree(ent);
+                        pde_free(ent);
                         parent->nlink--;
                         ent = NULL;
                 }
@@ -495,7 +522,7 @@ struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
                 goto out_free;
         return pde;
 out_free:
-        kfree(pde);
+        pde_free(pde);
 out:
         return NULL;
 }
@@ -522,19 +549,12 @@ void proc_set_user(struct proc_dir_entry *de, kuid_t uid, kgid_t gid)
 }
 EXPORT_SYMBOL(proc_set_user);
 
-static void free_proc_entry(struct proc_dir_entry *de)
-{
-        proc_free_inum(de->low_ino);
-
-        if (S_ISLNK(de->mode))
-                kfree(de->data);
-        kfree(de);
-}
-
 void pde_put(struct proc_dir_entry *pde)
 {
-        if (atomic_dec_and_test(&pde->count))
-                free_proc_entry(pde);
+        if (refcount_dec_and_test(&pde->refcnt)) {
+                proc_free_inum(pde->low_ino);
+                pde_free(pde);
+        }
 }
 
 /*
@@ -555,7 +575,7 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
 
         de = pde_subdir_find(parent, fn, len);
         if (de)
-                rb_erase_cached(&de->subdir_node, &parent->subdir);
+                rb_erase(&de->subdir_node, &parent->subdir);
         write_unlock(&proc_subdir_lock);
         if (!de) {
                 WARN(1, "name '%s'\n", name);
@@ -592,13 +612,13 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent)
                 write_unlock(&proc_subdir_lock);
                 return -ENOENT;
         }
-        rb_erase_cached(&root->subdir_node, &parent->subdir);
+        rb_erase(&root->subdir_node, &parent->subdir);
 
         de = root;
         while (1) {
                 next = pde_subdir_first(de);
                 if (next) {
-                        rb_erase_cached(&next->subdir_node, &de->subdir);
+                        rb_erase(&next->subdir_node, &de->subdir);
                         de = next;
                         continue;
                 }
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 6e8724958116..2cf3b74391ca 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -54,6 +54,7 @@ static void proc_evict_inode(struct inode *inode)
 }
 
 static struct kmem_cache *proc_inode_cachep __ro_after_init;
+static struct kmem_cache *pde_opener_cache __ro_after_init;
 
 static struct inode *proc_alloc_inode(struct super_block *sb)
 {
@@ -92,7 +93,7 @@ static void init_once(void *foo)
         inode_init_once(&ei->vfs_inode);
 }
 
-void __init proc_init_inodecache(void)
+void __init proc_init_kmemcache(void)
 {
         proc_inode_cachep = kmem_cache_create("proc_inode_cache",
                                              sizeof(struct proc_inode),
@@ -100,6 +101,13 @@ void __init proc_init_inodecache(void)
                                                 SLAB_MEM_SPREAD|SLAB_ACCOUNT|
                                                 SLAB_PANIC),
                                              init_once);
+        pde_opener_cache =
+                kmem_cache_create("pde_opener", sizeof(struct pde_opener), 0,
+                                  SLAB_ACCOUNT|SLAB_PANIC, NULL);
+        proc_dir_entry_cache = kmem_cache_create_usercopy(
+                "proc_dir_entry", sizeof(struct proc_dir_entry), 0, SLAB_PANIC,
+                offsetof(struct proc_dir_entry, inline_name),
+                sizeof_field(struct proc_dir_entry, inline_name), NULL);
 }
 
 static int proc_show_options(struct seq_file *seq, struct dentry *root)
@@ -138,7 +146,7 @@ static void unuse_pde(struct proc_dir_entry *pde)
                 complete(pde->pde_unload_completion);
 }
 
-/* pde is locked */
+/* pde is locked on entry, unlocked on exit */
 static void close_pdeo(struct proc_dir_entry *pde, struct pde_opener *pdeo)
 {
         /*
@@ -157,9 +165,10 @@ static void close_pdeo(struct proc_dir_entry *pde, struct pde_opener *pdeo)
                 pdeo->c = &c;
                 spin_unlock(&pde->pde_unload_lock);
                 wait_for_completion(&c);
-                spin_lock(&pde->pde_unload_lock);
         } else {
                 struct file *file;
+                struct completion *c;
+
                 pdeo->closing = true;
                 spin_unlock(&pde->pde_unload_lock);
                 file = pdeo->file;
@@ -167,9 +176,11 @@ static void close_pdeo(struct proc_dir_entry *pde, struct pde_opener *pdeo)
                 spin_lock(&pde->pde_unload_lock);
                 /* After ->release. */
                 list_del(&pdeo->lh);
-                if (unlikely(pdeo->c))
-                        complete(pdeo->c);
-                kfree(pdeo);
+                c = pdeo->c;
+                spin_unlock(&pde->pde_unload_lock);
+                if (unlikely(c))
+                        complete(c);
+                kmem_cache_free(pde_opener_cache, pdeo);
         }
 }
 
@@ -188,6 +199,7 @@ void proc_entry_rundown(struct proc_dir_entry *de)
                 struct pde_opener *pdeo;
                 pdeo = list_first_entry(&de->pde_openers, struct pde_opener, lh);
                 close_pdeo(de, pdeo);
+                spin_lock(&de->pde_unload_lock);
         }
         spin_unlock(&de->pde_unload_lock);
 }
@@ -338,31 +350,36 @@ static int proc_reg_open(struct inode *inode, struct file *file)
          *
          * Save every "struct file" with custom ->release hook.
          */
-        pdeo = kmalloc(sizeof(struct pde_opener), GFP_KERNEL);
-        if (!pdeo)
-                return -ENOMEM;
-
-        if (!use_pde(pde)) {
-                kfree(pdeo);
+        if (!use_pde(pde))
                 return -ENOENT;
-        }
-        open = pde->proc_fops->open;
+
         release = pde->proc_fops->release;
+        if (release) {
+                pdeo = kmem_cache_alloc(pde_opener_cache, GFP_KERNEL);
+                if (!pdeo) {
+                        rv = -ENOMEM;
+                        goto out_unuse;
+                }
+        }
 
+        open = pde->proc_fops->open;
         if (open)
                 rv = open(inode, file);
 
-        if (rv == 0 && release) {
-                /* To know what to release. */
-                pdeo->file = file;
-                pdeo->closing = false;
-                pdeo->c = NULL;
-                spin_lock(&pde->pde_unload_lock);
-                list_add(&pdeo->lh, &pde->pde_openers);
-                spin_unlock(&pde->pde_unload_lock);
-        } else
-                kfree(pdeo);
+        if (release) {
+                if (rv == 0) {
+                        /* To know what to release. */
+                        pdeo->file = file;
+                        pdeo->closing = false;
+                        pdeo->c = NULL;
+                        spin_lock(&pde->pde_unload_lock);
+                        list_add(&pdeo->lh, &pde->pde_openers);
+                        spin_unlock(&pde->pde_unload_lock);
+                } else
+                        kmem_cache_free(pde_opener_cache, pdeo);
+        }
 
+out_unuse:
         unuse_pde(pde);
         return rv;
 }
@@ -375,7 +392,7 @@ static int proc_reg_release(struct inode *inode, struct file *file)
         list_for_each_entry(pdeo, &pde->pde_openers, lh) {
                 if (pdeo->file == file) {
                         close_pdeo(pde, pdeo);
-                        break;
+                        return 0;
                 }
         }
         spin_unlock(&pde->pde_unload_lock);
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index d697c8ab0a14..0f1692e63cb6 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -11,6 +11,7 @@
 
 #include <linux/proc_fs.h>
 #include <linux/proc_ns.h>
+#include <linux/refcount.h>
 #include <linux/spinlock.h>
 #include <linux/atomic.h>
 #include <linux/binfmts.h>
@@ -36,7 +37,7 @@ struct proc_dir_entry {
          * negative -> it's going away RSN
          */
         atomic_t in_use;
-        atomic_t count;         /* use count */
+        refcount_t refcnt;
         struct list_head pde_openers;   /* who did ->open, but not ->release */
         /* protects ->pde_openers and all struct pde_opener instances */
         spinlock_t pde_unload_lock;
@@ -50,13 +51,22 @@ struct proc_dir_entry {
         kgid_t gid;
         loff_t size;
         struct proc_dir_entry *parent;
-        struct rb_root_cached subdir;
+        struct rb_root subdir;
         struct rb_node subdir_node;
+        char *name;
         umode_t mode;
         u8 namelen;
-        char name[];
+#ifdef CONFIG_64BIT
+#define SIZEOF_PDE_INLINE_NAME  (192-139)
+#else
+#define SIZEOF_PDE_INLINE_NAME  (128-87)
+#endif
+        char inline_name[SIZEOF_PDE_INLINE_NAME];
 } __randomize_layout;
 
+extern struct kmem_cache *proc_dir_entry_cache;
+void pde_free(struct proc_dir_entry *pde);
+
 union proc_op {
         int (*proc_get_link)(struct dentry *, struct path *);
         int (*proc_show)(struct seq_file *m,
@@ -159,7 +169,7 @@ int proc_readdir_de(struct file *, struct dir_context *, struct proc_dir_entry *
 
 static inline struct proc_dir_entry *pde_get(struct proc_dir_entry *pde)
 {
-        atomic_inc(&pde->count);
+        refcount_inc(&pde->refcnt);
         return pde;
 }
 extern void pde_put(struct proc_dir_entry *);
@@ -177,12 +187,12 @@ struct pde_opener {
         struct list_head lh;
         bool closing;
         struct completion *c;
-};
+} __randomize_layout;
 extern const struct inode_operations proc_link_inode_operations;
 
 extern const struct inode_operations proc_pid_link_inode_operations;
 
-extern void proc_init_inodecache(void);
+void proc_init_kmemcache(void);
 void set_proc_pid_nlink(void);
 extern struct inode *proc_get_inode(struct super_block *, struct proc_dir_entry *);
 extern int proc_fill_super(struct super_block *, void *data, int flags);
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index 6bb20f864259..65a72ab57471 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -26,20 +26,7 @@ void __attribute__((weak)) arch_report_meminfo(struct seq_file *m)
 
 static void show_val_kb(struct seq_file *m, const char *s, unsigned long num)
 {
-        char v[32];
-        static const char blanks[7] = {' ', ' ', ' ', ' ',' ', ' ', ' '};
-        int len;
-
-        len = num_to_str(v, sizeof(v), num << (PAGE_SHIFT - 10));
-
-        seq_write(m, s, 16);
-
-        if (len > 0) {
-                if (len < 8)
-                        seq_write(m, blanks, 8 - len);
-
-                seq_write(m, v, len);
-        }
+        seq_put_decimal_ull_width(m, s, num << (PAGE_SHIFT - 10), 8);
         seq_write(m, " kB\n", 4);
 }
 
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index 68c06ae7888c..1763f370489d 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -192,15 +192,16 @@ static __net_init int proc_net_ns_init(struct net *net)
         int err;
 
         err = -ENOMEM;
-        netd = kzalloc(sizeof(*netd) + 4, GFP_KERNEL);
+        netd = kmem_cache_zalloc(proc_dir_entry_cache, GFP_KERNEL);
         if (!netd)
                 goto out;
 
-        netd->subdir = RB_ROOT_CACHED;
+        netd->subdir = RB_ROOT;
         netd->data = net;
         netd->nlink = 2;
         netd->namelen = 3;
         netd->parent = &proc_root;
+        netd->name = netd->inline_name;
         memcpy(netd->name, "net", 4);
 
         uid = make_kuid(net->user_ns, 0);
@@ -223,7 +224,7 @@ static __net_init int proc_net_ns_init(struct net *net)
         return 0;
 
 free_net:
-        kfree(netd);
+        pde_free(netd);
 out:
         return err;
 }
@@ -231,7 +232,7 @@ out:
 static __net_exit void proc_net_ns_exit(struct net *net)
 {
         remove_proc_entry("stat", net->proc_net);
-        kfree(net->proc_net);
+        pde_free(net->proc_net);
 }
 
 static struct pernet_operations __net_initdata proc_net_ns_ops = {
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index c41ab261397d..8989936f2995 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -707,14 +707,14 @@ static bool proc_sys_link_fill_cache(struct file *file,
                                     struct ctl_table *table)
 {
         bool ret = true;
+
         head = sysctl_head_grab(head);
+        if (IS_ERR(head))
+                return false;
 
-        if (S_ISLNK(table->mode)) {
-                /* It is not an error if we can not follow the link ignore it */
-                int err = sysctl_follow_link(&head, &table);
-                if (err)
-                        goto out;
-        }
+        /* It is not an error if we can not follow the link ignore it */
+        if (sysctl_follow_link(&head, &table))
+                goto out;
 
         ret = proc_sys_fill_cache(file, ctx, head, table);
 out:
@@ -1086,7 +1086,7 @@ static int sysctl_check_table_array(const char *path, struct ctl_table *table)
         if ((table->proc_handler == proc_douintvec) ||
             (table->proc_handler == proc_douintvec_minmax)) {
                 if (table->maxlen != sizeof(unsigned int))
-                        err |= sysctl_err(path, table, "array now allowed");
+                        err |= sysctl_err(path, table, "array not allowed");
         }
 
         return err;
diff --git a/fs/proc/root.c b/fs/proc/root.c
index ede8e64974be..61b7340b357a 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -123,23 +123,13 @@ static struct file_system_type proc_fs_type = {
 
 void __init proc_root_init(void)
 {
-        int err;
-
-        proc_init_inodecache();
+        proc_init_kmemcache();
         set_proc_pid_nlink();
-        err = register_filesystem(&proc_fs_type);
-        if (err)
-                return;
-
         proc_self_init();
         proc_thread_self_init();
         proc_symlink("mounts", NULL, "self/mounts");
 
         proc_net_init();
-
-#ifdef CONFIG_SYSVIPC
-        proc_mkdir("sysvipc", NULL);
-#endif
         proc_mkdir("fs", NULL);
         proc_mkdir("driver", NULL);
         proc_create_mount_point("fs/nfsd"); /* somewhere for the nfsd filesystem to be mounted */
@@ -150,6 +140,8 @@ void __init proc_root_init(void)
         proc_tty_init();
         proc_mkdir("bus", NULL);
         proc_sys_init();
+
+        register_filesystem(&proc_fs_type);
 }
 
 static int proc_root_getattr(const struct path *path, struct kstat *stat,
@@ -207,12 +199,13 @@ struct proc_dir_entry proc_root = {
         .namelen        = 5, 
         .mode           = S_IFDIR | S_IRUGO | S_IXUGO, 
         .nlink          = 2, 
-        .count          = ATOMIC_INIT(1),
+        .refcnt         = REFCOUNT_INIT(1),
         .proc_iops      = &proc_root_inode_operations, 
         .proc_fops      = &proc_root_operations,
         .parent         = &proc_root,
-        .subdir         = RB_ROOT_CACHED,
-        .name           = "/proc",
+        .subdir         = RB_ROOT,
+        .name           = proc_root.inline_name,
+        .inline_name    = "/proc",
 };
 
 int pid_ns_prepare_proc(struct pid_namespace *ns)
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index ec6d2983a5cb..65ae54659833 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -24,6 +24,8 @@
 #include <asm/tlbflush.h>
 #include "internal.h"
 
+#define SEQ_PUT_DEC(str, val) \
+                seq_put_decimal_ull_width(m, str, (val) << (PAGE_SHIFT-10), 8)
 void task_mem(struct seq_file *m, struct mm_struct *mm)
 {
         unsigned long text, lib, swap, anon, file, shmem;
@@ -53,39 +55,28 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
         lib = (mm->exec_vm << PAGE_SHIFT) - text;
 
         swap = get_mm_counter(mm, MM_SWAPENTS);
-        seq_printf(m,
-                "VmPeak:\t%8lu kB\n"
-                "VmSize:\t%8lu kB\n"
-                "VmLck:\t%8lu kB\n"
-                "VmPin:\t%8lu kB\n"
-                "VmHWM:\t%8lu kB\n"
-                "VmRSS:\t%8lu kB\n"
-                "RssAnon:\t%8lu kB\n"
-                "RssFile:\t%8lu kB\n"
-                "RssShmem:\t%8lu kB\n"
-                "VmData:\t%8lu kB\n"
-                "VmStk:\t%8lu kB\n"
-                "VmExe:\t%8lu kB\n"
-                "VmLib:\t%8lu kB\n"
-                "VmPTE:\t%8lu kB\n"
-                "VmSwap:\t%8lu kB\n",
-                hiwater_vm << (PAGE_SHIFT-10),
-                total_vm << (PAGE_SHIFT-10),
-                mm->locked_vm << (PAGE_SHIFT-10),
-                mm->pinned_vm << (PAGE_SHIFT-10),
-                hiwater_rss << (PAGE_SHIFT-10),
-                total_rss << (PAGE_SHIFT-10),
-                anon << (PAGE_SHIFT-10),
-                file << (PAGE_SHIFT-10),
-                shmem << (PAGE_SHIFT-10),
-                mm->data_vm << (PAGE_SHIFT-10),
-                mm->stack_vm << (PAGE_SHIFT-10),
-                text >> 10,
-                lib >> 10,
-                mm_pgtables_bytes(mm) >> 10,
-                swap << (PAGE_SHIFT-10));
+        SEQ_PUT_DEC("VmPeak:\t", hiwater_vm);
+        SEQ_PUT_DEC(" kB\nVmSize:\t", total_vm);
+        SEQ_PUT_DEC(" kB\nVmLck:\t", mm->locked_vm);
+        SEQ_PUT_DEC(" kB\nVmPin:\t", mm->pinned_vm);
+        SEQ_PUT_DEC(" kB\nVmHWM:\t", hiwater_rss);
+        SEQ_PUT_DEC(" kB\nVmRSS:\t", total_rss);
+        SEQ_PUT_DEC(" kB\nRssAnon:\t", anon);
+        SEQ_PUT_DEC(" kB\nRssFile:\t", file);
+        SEQ_PUT_DEC(" kB\nRssShmem:\t", shmem);
+        SEQ_PUT_DEC(" kB\nVmData:\t", mm->data_vm);
+        SEQ_PUT_DEC(" kB\nVmStk:\t", mm->stack_vm);
+        seq_put_decimal_ull_width(m,
+                    " kB\nVmExe:\t", text >> 10, 8);
+        seq_put_decimal_ull_width(m,
+                    " kB\nVmLib:\t", lib >> 10, 8);
+        seq_put_decimal_ull_width(m,
+                    " kB\nVmPTE:\t", mm_pgtables_bytes(mm) >> 10, 8);
+        SEQ_PUT_DEC(" kB\nVmSwap:\t", swap);
+        seq_puts(m, " kB\n");
         hugetlb_report_usage(m, mm);
 }
+#undef SEQ_PUT_DEC
 
 unsigned long task_vsize(struct mm_struct *mm)
 {
@@ -287,15 +278,18 @@ static void show_vma_header_prefix(struct seq_file *m,
                                    dev_t dev, unsigned long ino)
 {
         seq_setwidth(m, 25 + sizeof(void *) * 6 - 1);
-        seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
-                   start,
-                   end,
-                   flags & VM_READ ? 'r' : '-',
-                   flags & VM_WRITE ? 'w' : '-',
-                   flags & VM_EXEC ? 'x' : '-',
-                   flags & VM_MAYSHARE ? 's' : 'p',
-                   pgoff,
-                   MAJOR(dev), MINOR(dev), ino);
+        seq_put_hex_ll(m, NULL, start, 8);
+        seq_put_hex_ll(m, "-", end, 8);
+        seq_putc(m, ' ');
+        seq_putc(m, flags & VM_READ ? 'r' : '-');
+        seq_putc(m, flags & VM_WRITE ? 'w' : '-');
+        seq_putc(m, flags & VM_EXEC ? 'x' : '-');
+        seq_putc(m, flags & VM_MAYSHARE ? 's' : 'p');
+        seq_put_hex_ll(m, " ", pgoff, 8);
+        seq_put_hex_ll(m, " ", MAJOR(dev), 2);
+        seq_put_hex_ll(m, ":", MINOR(dev), 2);
+        seq_put_decimal_ull(m, " ", ino);
+        seq_putc(m, ' ');
 }
 
 static void
@@ -694,8 +688,9 @@ static void show_smap_vma_flags(struct seq_file *m, struct vm_area_struct *vma)
                 if (!mnemonics[i][0])
                         continue;
                 if (vma->vm_flags & (1UL << i)) {
-                        seq_printf(m, "%c%c ",
-                                   mnemonics[i][0], mnemonics[i][1]);
+                        seq_putc(m, mnemonics[i][0]);
+                        seq_putc(m, mnemonics[i][1]);
+                        seq_putc(m, ' ');
                 }
         }
         seq_putc(m, '\n');
@@ -736,6 +731,8 @@ void __weak arch_show_smap(struct seq_file *m, struct vm_area_struct *vma)
 {
 }
 
+#define SEQ_PUT_DEC(str, val) \
+                seq_put_decimal_ull_width(m, str, (val) >> 10, 8)
 static int show_smap(struct seq_file *m, void *v, int is_pid)
 {
         struct proc_maps_private *priv = m->private;
@@ -809,51 +806,34 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
                 ret = SEQ_SKIP;
         }
 
-        if (!rollup_mode)
-                seq_printf(m,
-                           "Size:           %8lu kB\n"
-                           "KernelPageSize: %8lu kB\n"
-                           "MMUPageSize:    %8lu kB\n",
-                           (vma->vm_end - vma->vm_start) >> 10,
-                           vma_kernel_pagesize(vma) >> 10,
-                           vma_mmu_pagesize(vma) >> 10);
-
-
-        if (!rollup_mode || last_vma)
-                seq_printf(m,
-                           "Rss:            %8lu kB\n"
-                           "Pss:            %8lu kB\n"
-                           "Shared_Clean:   %8lu kB\n"
-                           "Shared_Dirty:   %8lu kB\n"
-                           "Private_Clean:  %8lu kB\n"
-                           "Private_Dirty:  %8lu kB\n"
-                           "Referenced:     %8lu kB\n"
-                           "Anonymous:      %8lu kB\n"
-                           "LazyFree:       %8lu kB\n"
-                           "AnonHugePages:  %8lu kB\n"
-                           "ShmemPmdMapped: %8lu kB\n"
-                           "Shared_Hugetlb: %8lu kB\n"
-                           "Private_Hugetlb: %7lu kB\n"
-                           "Swap:           %8lu kB\n"
-                           "SwapPss:        %8lu kB\n"
-                           "Locked:         %8lu kB\n",
-                           mss->resident >> 10,
-                           (unsigned long)(mss->pss >> (10 + PSS_SHIFT)),
-                           mss->shared_clean  >> 10,
-                           mss->shared_dirty  >> 10,
-                           mss->private_clean >> 10,
-                           mss->private_dirty >> 10,
-                           mss->referenced >> 10,
-                           mss->anonymous >> 10,
-                           mss->lazyfree >> 10,
-                           mss->anonymous_thp >> 10,
-                           mss->shmem_thp >> 10,
-                           mss->shared_hugetlb >> 10,
-                           mss->private_hugetlb >> 10,
-                           mss->swap >> 10,
-                           (unsigned long)(mss->swap_pss >> (10 + PSS_SHIFT)),
-                           (unsigned long)(mss->pss >> (10 + PSS_SHIFT)));
+        if (!rollup_mode) {
+                SEQ_PUT_DEC("Size:           ", vma->vm_end - vma->vm_start);
+                SEQ_PUT_DEC(" kB\nKernelPageSize: ", vma_kernel_pagesize(vma));
+                SEQ_PUT_DEC(" kB\nMMUPageSize:    ", vma_mmu_pagesize(vma));
+                seq_puts(m, " kB\n");
+        }
 
+        if (!rollup_mode || last_vma) {
+                SEQ_PUT_DEC("Rss:            ", mss->resident);
+                SEQ_PUT_DEC(" kB\nPss:            ", mss->pss >> PSS_SHIFT);
+                SEQ_PUT_DEC(" kB\nShared_Clean:   ", mss->shared_clean);
+                SEQ_PUT_DEC(" kB\nShared_Dirty:   ", mss->shared_dirty);
+                SEQ_PUT_DEC(" kB\nPrivate_Clean:  ", mss->private_clean);
+                SEQ_PUT_DEC(" kB\nPrivate_Dirty:  ", mss->private_dirty);
+                SEQ_PUT_DEC(" kB\nReferenced:     ", mss->referenced);
+                SEQ_PUT_DEC(" kB\nAnonymous:      ", mss->anonymous);
+                SEQ_PUT_DEC(" kB\nLazyFree:       ", mss->lazyfree);
+                SEQ_PUT_DEC(" kB\nAnonHugePages:  ", mss->anonymous_thp);
+                SEQ_PUT_DEC(" kB\nShmemPmdMapped: ", mss->shmem_thp);
+                SEQ_PUT_DEC(" kB\nShared_Hugetlb: ", mss->shared_hugetlb);
+                seq_put_decimal_ull_width(m, " kB\nPrivate_Hugetlb: ",
+                                          mss->private_hugetlb >> 10, 7);
+                SEQ_PUT_DEC(" kB\nSwap:           ", mss->swap);
+                SEQ_PUT_DEC(" kB\nSwapPss:        ",
+                                                mss->swap_pss >> PSS_SHIFT);
+                SEQ_PUT_DEC(" kB\nLocked:         ", mss->pss >> PSS_SHIFT);
+                seq_puts(m, " kB\n");
+        }
         if (!rollup_mode) {
                 arch_show_smap(m, vma);
                 show_smap_vma_flags(m, vma);
@@ -861,6 +841,7 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
         m_cache_vma(m, vma);
         return ret;
 }
+#undef SEQ_PUT_DEC
 
 static int show_pid_smap(struct seq_file *m, void *v)
 {
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 70057359fbaf..23148c3ed675 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2643,7 +2643,7 @@ static int journal_init_dev(struct super_block *super,
         if (IS_ERR(journal->j_dev_bd)) {
                 result = PTR_ERR(journal->j_dev_bd);
                 journal->j_dev_bd = NULL;
-                reiserfs_warning(super,
+                reiserfs_warning(super, "sh-457",
                                  "journal_init_dev: Cannot open '%s': %i",
                                  jdev_name, result);
                 return result;
diff --git a/fs/seq_file.c b/fs/seq_file.c
index eea09f6d8830..c6c27f1f9c98 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -6,6 +6,7 @@
  * initial implementation -- AV, Oct 2001.
  */
 
+#include <linux/cache.h>
 #include <linux/fs.h>
 #include <linux/export.h>
 #include <linux/seq_file.h>
@@ -19,6 +20,8 @@
 #include <linux/uaccess.h>
 #include <asm/page.h>
 
+static struct kmem_cache *seq_file_cache __ro_after_init;
+
 static void seq_set_overflow(struct seq_file *m)
 {
         m->count = m->size;
@@ -26,7 +29,7 @@ static void seq_set_overflow(struct seq_file *m)
 
 static void *seq_buf_alloc(unsigned long size)
 {
-        return kvmalloc(size, GFP_KERNEL);
+        return kvmalloc(size, GFP_KERNEL_ACCOUNT);
 }
 
 /**
@@ -51,7 +54,7 @@ int seq_open(struct file *file, const struct seq_operations *op)
 
         WARN_ON(file->private_data);
 
-        p = kzalloc(sizeof(*p), GFP_KERNEL);
+        p = kmem_cache_zalloc(seq_file_cache, GFP_KERNEL);
         if (!p)
                 return -ENOMEM;
 
@@ -366,7 +369,7 @@ int seq_release(struct inode *inode, struct file *file)
 {
         struct seq_file *m = file->private_data;
         kvfree(m->buf);
-        kfree(m);
+        kmem_cache_free(seq_file_cache, m);
         return 0;
 }
 EXPORT_SYMBOL(seq_release);
@@ -563,7 +566,7 @@ static void single_stop(struct seq_file *p, void *v)
 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
                 void *data)
 {
-        struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
+        struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL_ACCOUNT);
         int res = -ENOMEM;
 
         if (op) {
@@ -625,7 +628,7 @@ void *__seq_open_private(struct file *f, const struct seq_operations *ops,
         void *private;
         struct seq_file *seq;
 
-        private = kzalloc(psize, GFP_KERNEL);
+        private = kzalloc(psize, GFP_KERNEL_ACCOUNT);
         if (private == NULL)
                 goto out;
 
@@ -673,29 +676,37 @@ void seq_puts(struct seq_file *m, const char *s)
 }
 EXPORT_SYMBOL(seq_puts);
 
-/*
+/**
  * A helper routine for putting decimal numbers without rich format of printf().
  * only 'unsigned long long' is supported.
- * This routine will put strlen(delimiter) + number into seq_file.
+ * @m: seq_file identifying the buffer to which data should be written
+ * @delimiter: a string which is printed before the number
+ * @num: the number
+ * @width: a minimum field width
+ *
+ * This routine will put strlen(delimiter) + number into seq_filed.
  * This routine is very quick when you show lots of numbers.
  * In usual cases, it will be better to use seq_printf(). It's easier to read.
  */
-void seq_put_decimal_ull(struct seq_file *m, const char *delimiter,
-                         unsigned long long num)
+void seq_put_decimal_ull_width(struct seq_file *m, const char *delimiter,
+                         unsigned long long num, unsigned int width)
 {
         int len;
 
         if (m->count + 2 >= m->size) /* we'll write 2 bytes at least */
                 goto overflow;
 
-        len = strlen(delimiter);
-        if (m->count + len >= m->size)
-                goto overflow;
+        if (delimiter && delimiter[0]) {
+                if (delimiter[1] == 0)
+                        seq_putc(m, delimiter[0]);
+                else
+                        seq_puts(m, delimiter);
+        }
 
-        memcpy(m->buf + m->count, delimiter, len);
-        m->count += len;
+        if (!width)
+                width = 1;
 
-        if (m->count + 1 >= m->size)
+        if (m->count + width >= m->size)
                 goto overflow;
 
         if (num < 10) {
@@ -703,7 +714,7 @@ void seq_put_decimal_ull(struct seq_file *m, const char *delimiter,
                 return;
         }
 
-        len = num_to_str(m->buf + m->count, m->size - m->count, num);
+        len = num_to_str(m->buf + m->count, m->size - m->count, num, width);
         if (!len)
                 goto overflow;
 
@@ -713,8 +724,60 @@ void seq_put_decimal_ull(struct seq_file *m, const char *delimiter,
 overflow:
         seq_set_overflow(m);
 }
+
+void seq_put_decimal_ull(struct seq_file *m, const char *delimiter,
+                         unsigned long long num)
+{
+        return seq_put_decimal_ull_width(m, delimiter, num, 0);
+}
 EXPORT_SYMBOL(seq_put_decimal_ull);
 
+/**
+ * seq_put_hex_ll - put a number in hexadecimal notation
+ * @m: seq_file identifying the buffer to which data should be written
+ * @delimiter: a string which is printed before the number
+ * @v: the number
+ * @width: a minimum field width
+ *
+ * seq_put_hex_ll(m, "", v, 8) is equal to seq_printf(m, "%08llx", v)
+ *
+ * This routine is very quick when you show lots of numbers.
+ * In usual cases, it will be better to use seq_printf(). It's easier to read.
+ */
+void seq_put_hex_ll(struct seq_file *m, const char *delimiter,
+                                unsigned long long v, unsigned int width)
+{
+        unsigned int len;
+        int i;
+
+        if (delimiter && delimiter[0]) {
+                if (delimiter[1] == 0)
+                        seq_putc(m, delimiter[0]);
+                else
+                        seq_puts(m, delimiter);
+        }
+
+        /* If x is 0, the result of __builtin_clzll is undefined */
+        if (v == 0)
+                len = 1;
+        else
+                len = (sizeof(v) * 8 - __builtin_clzll(v) + 3) / 4;
+
+        if (len < width)
+                len = width;
+
+        if (m->count + len > m->size) {
+                seq_set_overflow(m);
+                return;
+        }
+
+        for (i = len - 1; i >= 0; i--) {
+                m->buf[m->count + i] = hex_asc[0xf & v];
+                v = v >> 4;
+        }
+        m->count += len;
+}
+
 void seq_put_decimal_ll(struct seq_file *m, const char *delimiter, long long num)
 {
         int len;
@@ -722,12 +785,12 @@ void seq_put_decimal_ll(struct seq_file *m, const char *delimiter, long long num
         if (m->count + 3 >= m->size) /* we'll write 2 bytes at least */
                 goto overflow;
 
-        len = strlen(delimiter);
-        if (m->count + len >= m->size)
-                goto overflow;
-
-        memcpy(m->buf + m->count, delimiter, len);
-        m->count += len;
+        if (delimiter && delimiter[0]) {
+                if (delimiter[1] == 0)
+                        seq_putc(m, delimiter[0]);
+                else
+                        seq_puts(m, delimiter);
+        }
 
         if (m->count + 2 >= m->size)
                 goto overflow;
@@ -742,7 +805,7 @@ void seq_put_decimal_ll(struct seq_file *m, const char *delimiter, long long num
                 return;
         }
 
-        len = num_to_str(m->buf + m->count, m->size - m->count, num);
+        len = num_to_str(m->buf + m->count, m->size - m->count, num, 0);
         if (!len)
                 goto overflow;
 
@@ -782,8 +845,14 @@ EXPORT_SYMBOL(seq_write);
 void seq_pad(struct seq_file *m, char c)
 {
         int size = m->pad_until - m->count;
-        if (size > 0)
-                seq_printf(m, "%*s", size, "");
+        if (size > 0) {
+                if (size + m->count > m->size) {
+                        seq_set_overflow(m);
+                        return;
+                }
+                memset(m->buf + m->count, ' ', size);
+                m->count += size;
+        }
         if (c)
                 seq_putc(m, c);
 }
@@ -1040,3 +1109,8 @@ seq_hlist_next_percpu(void *v, struct hlist_head __percpu *head,
         return NULL;
 }
 EXPORT_SYMBOL(seq_hlist_next_percpu);
+
+void __init seq_file_init(void)
+{
+        seq_file_cache = KMEM_CACHE(seq_file, SLAB_ACCOUNT|SLAB_PANIC);
+}
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 436a1de3fcdf..0ab824f574ed 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -1467,19 +1467,8 @@ xfs_vm_set_page_dirty(
         newly_dirty = !TestSetPageDirty(page);
         spin_unlock(&mapping->private_lock);
 
-        if (newly_dirty) {
-                /* sigh - __set_page_dirty() is static, so copy it here, too */
-                unsigned long flags;
-
-                spin_lock_irqsave(&mapping->tree_lock, flags);
-                if (page->mapping) {    /* Race with truncate? */
-                        WARN_ON_ONCE(!PageUptodate(page));
-                        account_page_dirtied(page, mapping);
-                        radix_tree_tag_set(&mapping->page_tree,
-                                        page_index(page), PAGECACHE_TAG_DIRTY);
-                }
-                spin_unlock_irqrestore(&mapping->tree_lock, flags);
-        }
+        if (newly_dirty)
+                __set_page_dirty(page, mapping, 1);
         unlock_page_memcg(page);
         if (newly_dirty)
                 __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);