Merge branch 'x86/urgent' into x86/asm, to pick up fixes

Signed-off-by: Ingo Molnar <mingo@kernel.org>

38 files changed, 554 insertions, 312 deletions

diff --git a/fs/block_dev.c b/fs/block_dev.c
index 7b9cd49622b1..39b3a174a425 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1730,43 +1730,25 @@ static int blkdev_dax_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         return __dax_fault(vma, vmf, blkdev_get_block, NULL);
 }
 
-static int blkdev_dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr,
-                pmd_t *pmd, unsigned int flags)
-{
-        return __dax_pmd_fault(vma, addr, pmd, flags, blkdev_get_block, NULL);
-}
-
-static void blkdev_vm_open(struct vm_area_struct *vma)
+static int blkdev_dax_pfn_mkwrite(struct vm_area_struct *vma,
+                struct vm_fault *vmf)
 {
-        struct inode *bd_inode = bdev_file_inode(vma->vm_file);
-        struct block_device *bdev = I_BDEV(bd_inode);
-
-        inode_lock(bd_inode);
-        bdev->bd_map_count++;
-        inode_unlock(bd_inode);
+        return dax_pfn_mkwrite(vma, vmf);
 }
 
-static void blkdev_vm_close(struct vm_area_struct *vma)
+static int blkdev_dax_pmd_fault(struct vm_area_struct *vma, unsigned long addr,
+                pmd_t *pmd, unsigned int flags)
 {
-        struct inode *bd_inode = bdev_file_inode(vma->vm_file);
-        struct block_device *bdev = I_BDEV(bd_inode);
-
-        inode_lock(bd_inode);
-        bdev->bd_map_count--;
-        inode_unlock(bd_inode);
+        return __dax_pmd_fault(vma, addr, pmd, flags, blkdev_get_block, NULL);
 }
 
 static const struct vm_operations_struct blkdev_dax_vm_ops = {
-        .open           = blkdev_vm_open,
-        .close          = blkdev_vm_close,
         .fault          = blkdev_dax_fault,
         .pmd_fault      = blkdev_dax_pmd_fault,
-        .pfn_mkwrite    = blkdev_dax_fault,
+        .pfn_mkwrite    = blkdev_dax_pfn_mkwrite,
 };
 
 static const struct vm_operations_struct blkdev_default_vm_ops = {
-        .open           = blkdev_vm_open,
-        .close          = blkdev_vm_close,
         .fault          = filemap_fault,
         .map_pages      = filemap_map_pages,
 };
@@ -1774,18 +1756,14 @@ static const struct vm_operations_struct blkdev_default_vm_ops = {
 static int blkdev_mmap(struct file *file, struct vm_area_struct *vma)
 {
         struct inode *bd_inode = bdev_file_inode(file);
-        struct block_device *bdev = I_BDEV(bd_inode);
 
         file_accessed(file);
-        inode_lock(bd_inode);
-        bdev->bd_map_count++;
         if (IS_DAX(bd_inode)) {
                 vma->vm_ops = &blkdev_dax_vm_ops;
                 vma->vm_flags |= VM_MIXEDMAP | VM_HUGEPAGE;
         } else {
                 vma->vm_ops = &blkdev_default_vm_ops;
         }
-        inode_unlock(bd_inode);
 
         return 0;
 }
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 88d9af3d4581..5fb60ea7eee2 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -328,8 +328,8 @@ static inline void __btrfs_queue_work(struct __btrfs_workqueue *wq,
                 list_add_tail(&work->ordered_list, &wq->ordered_list);
                 spin_unlock_irqrestore(&wq->list_lock, flags);
         }
-        queue_work(wq->normal_wq, &work->normal_work);
         trace_btrfs_work_queued(work);
+        queue_work(wq->normal_wq, &work->normal_work);
 }
 
 void btrfs_queue_work(struct btrfs_workqueue *wq,
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index b90cd3776f8e..f6dac40f87ff 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1406,7 +1406,8 @@ char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                         read_extent_buffer(eb, dest + bytes_left,
                                            name_off, name_len);
                 if (eb != eb_in) {
-                        btrfs_tree_read_unlock_blocking(eb);
+                        if (!path->skip_locking)
+                                btrfs_tree_read_unlock_blocking(eb);
                         free_extent_buffer(eb);
                 }
                 ret = btrfs_find_item(fs_root, path, parent, 0,
@@ -1426,9 +1427,10 @@ char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                 eb = path->nodes[0];
                 /* make sure we can use eb after releasing the path */
                 if (eb != eb_in) {
-                        atomic_inc(&eb->refs);
-                        btrfs_tree_read_lock(eb);
-                        btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
+                        if (!path->skip_locking)
+                                btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
+                        path->nodes[0] = NULL;
+                        path->locks[0] = 0;
                 }
                 btrfs_release_path(path);
                 iref = btrfs_item_ptr(eb, slot, struct btrfs_inode_ref);
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index c473c42d7d6c..3346cd8f9910 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -637,11 +637,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
         faili = nr_pages - 1;
         cb->nr_pages = nr_pages;
 
-        /* In the parent-locked case, we only locked the range we are
-         * interested in.  In all other cases, we can opportunistically
-         * cache decompressed data that goes beyond the requested range. */
-        if (!(bio_flags & EXTENT_BIO_PARENT_LOCKED))
-                add_ra_bio_pages(inode, em_start + em_len, cb);
+        add_ra_bio_pages(inode, em_start + em_len, cb);
 
         /* include any pages we added in add_ra-bio_pages */
         uncompressed_len = bio->bi_vcnt * PAGE_CACHE_SIZE;
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 0be47e4b8136..b57daa895cea 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -1689,7 +1689,7 @@ int btrfs_should_delete_dir_index(struct list_head *del_list,
  *
  */
 int btrfs_readdir_delayed_dir_index(struct dir_context *ctx,
-                                    struct list_head *ins_list)
+                                    struct list_head *ins_list, bool *emitted)
 {
         struct btrfs_dir_item *di;
         struct btrfs_delayed_item *curr, *next;
@@ -1733,6 +1733,7 @@ int btrfs_readdir_delayed_dir_index(struct dir_context *ctx,
 
                 if (over)
                         return 1;
+                *emitted = true;
         }
         return 0;
 }
diff --git a/fs/btrfs/delayed-inode.h b/fs/btrfs/delayed-inode.h
index f70119f25421..0167853c84ae 100644
--- a/fs/btrfs/delayed-inode.h
+++ b/fs/btrfs/delayed-inode.h
@@ -144,7 +144,7 @@ void btrfs_put_delayed_items(struct list_head *ins_list,
 int btrfs_should_delete_dir_index(struct list_head *del_list,
                                   u64 index);
 int btrfs_readdir_delayed_dir_index(struct dir_context *ctx,
-                                    struct list_head *ins_list);
+                                    struct list_head *ins_list, bool *emitted);
 
 /* for init */
 int __init btrfs_delayed_inode_init(void);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index d9286497924f..5699bbc23feb 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -182,6 +182,7 @@ static struct btrfs_lockdep_keyset {
         { .id = BTRFS_TREE_RELOC_OBJECTID,      .name_stem = "treloc"   },
         { .id = BTRFS_DATA_RELOC_TREE_OBJECTID, .name_stem = "dreloc"   },
         { .id = BTRFS_UUID_TREE_OBJECTID,       .name_stem = "uuid"     },
+        { .id = BTRFS_FREE_SPACE_TREE_OBJECTID, .name_stem = "free-space" },
         { .id = 0,                              .name_stem = "tree"     },
 };
 
@@ -1787,7 +1788,6 @@ static int cleaner_kthread(void *arg)
         int again;
         struct btrfs_trans_handle *trans;
 
-        set_freezable();
         do {
                 again = 0;
 
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 2e7c97a3f344..392592dc7010 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2897,12 +2897,11 @@ static int __do_readpage(struct extent_io_tree *tree,
         struct block_device *bdev;
         int ret;
         int nr = 0;
-        int parent_locked = *bio_flags & EXTENT_BIO_PARENT_LOCKED;
         size_t pg_offset = 0;
         size_t iosize;
         size_t disk_io_size;
         size_t blocksize = inode->i_sb->s_blocksize;
-        unsigned long this_bio_flag = *bio_flags & EXTENT_BIO_PARENT_LOCKED;
+        unsigned long this_bio_flag = 0;
 
         set_page_extent_mapped(page);
 
@@ -2942,18 +2941,16 @@ static int __do_readpage(struct extent_io_tree *tree,
                         kunmap_atomic(userpage);
                         set_extent_uptodate(tree, cur, cur + iosize - 1,
                                             &cached, GFP_NOFS);
-                        if (!parent_locked)
-                                unlock_extent_cached(tree, cur,
-                                                     cur + iosize - 1,
-                                                     &cached, GFP_NOFS);
+                        unlock_extent_cached(tree, cur,
+                                             cur + iosize - 1,
+                                             &cached, GFP_NOFS);
                         break;
                 }
                 em = __get_extent_map(inode, page, pg_offset, cur,
                                       end - cur + 1, get_extent, em_cached);
                 if (IS_ERR_OR_NULL(em)) {
                         SetPageError(page);
-                        if (!parent_locked)
-                                unlock_extent(tree, cur, end);
+                        unlock_extent(tree, cur, end);
                         break;
                 }
                 extent_offset = cur - em->start;
@@ -3038,12 +3035,9 @@ static int __do_readpage(struct extent_io_tree *tree,
 
                         set_extent_uptodate(tree, cur, cur + iosize - 1,
                                             &cached, GFP_NOFS);
-                        if (parent_locked)
-                                free_extent_state(cached);
-                        else
-                                unlock_extent_cached(tree, cur,
-                                                     cur + iosize - 1,
-                                                     &cached, GFP_NOFS);
+                        unlock_extent_cached(tree, cur,
+                                             cur + iosize - 1,
+                                             &cached, GFP_NOFS);
                         cur = cur + iosize;
                         pg_offset += iosize;
                         continue;
@@ -3052,8 +3046,7 @@ static int __do_readpage(struct extent_io_tree *tree,
                 if (test_range_bit(tree, cur, cur_end,
                                    EXTENT_UPTODATE, 1, NULL)) {
                         check_page_uptodate(tree, page);
-                        if (!parent_locked)
-                                unlock_extent(tree, cur, cur + iosize - 1);
+                        unlock_extent(tree, cur, cur + iosize - 1);
                         cur = cur + iosize;
                         pg_offset += iosize;
                         continue;
@@ -3063,8 +3056,7 @@ static int __do_readpage(struct extent_io_tree *tree,
                  */
                 if (block_start == EXTENT_MAP_INLINE) {
                         SetPageError(page);
-                        if (!parent_locked)
-                                unlock_extent(tree, cur, cur + iosize - 1);
+                        unlock_extent(tree, cur, cur + iosize - 1);
                         cur = cur + iosize;
                         pg_offset += iosize;
                         continue;
@@ -3083,8 +3075,7 @@ static int __do_readpage(struct extent_io_tree *tree,
                         *bio_flags = this_bio_flag;
                 } else {
                         SetPageError(page);
-                        if (!parent_locked)
-                                unlock_extent(tree, cur, cur + iosize - 1);
+                        unlock_extent(tree, cur, cur + iosize - 1);
                 }
                 cur = cur + iosize;
                 pg_offset += iosize;
@@ -3213,20 +3204,6 @@ int extent_read_full_page(struct extent_io_tree *tree, struct page *page,
         return ret;
 }
 
-int extent_read_full_page_nolock(struct extent_io_tree *tree, struct page *page,
-                                 get_extent_t *get_extent, int mirror_num)
-{
-        struct bio *bio = NULL;
-        unsigned long bio_flags = EXTENT_BIO_PARENT_LOCKED;
-        int ret;
-
-        ret = __do_readpage(tree, page, get_extent, NULL, &bio, mirror_num,
-                            &bio_flags, READ, NULL);
-        if (bio)
-                ret = submit_one_bio(READ, bio, mirror_num, bio_flags);
-        return ret;
-}
-
 static noinline void update_nr_written(struct page *page,
                                       struct writeback_control *wbc,
                                       unsigned long nr_written)
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 0377413bd4b9..880d5292e972 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -29,7 +29,6 @@
  */
 #define EXTENT_BIO_COMPRESSED 1
 #define EXTENT_BIO_TREE_LOG 2
-#define EXTENT_BIO_PARENT_LOCKED 4
 #define EXTENT_BIO_FLAG_SHIFT 16
 
 /* these are bit numbers for test/set bit */
@@ -210,8 +209,6 @@ static inline int lock_extent(struct extent_io_tree *tree, u64 start, u64 end)
 int try_lock_extent(struct extent_io_tree *tree, u64 start, u64 end);
 int extent_read_full_page(struct extent_io_tree *tree, struct page *page,
                           get_extent_t *get_extent, int mirror_num);
-int extent_read_full_page_nolock(struct extent_io_tree *tree, struct page *page,
-                                 get_extent_t *get_extent, int mirror_num);
 int __init extent_io_init(void);
 void extent_io_exit(void);
 
diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c
index 393e36bd5845..53dbeaf6ce94 100644
--- a/fs/btrfs/free-space-tree.c
+++ b/fs/btrfs/free-space-tree.c
@@ -153,6 +153,20 @@ static inline u32 free_space_bitmap_size(u64 size, u32 sectorsize)
 
 static unsigned long *alloc_bitmap(u32 bitmap_size)
 {
+        void *mem;
+
+        /*
+         * The allocation size varies, observed numbers were < 4K up to 16K.
+         * Using vmalloc unconditionally would be too heavy, we'll try
+         * contiguous allocations first.
+         */
+        if  (bitmap_size <= PAGE_SIZE)
+                return kzalloc(bitmap_size, GFP_NOFS);
+
+        mem = kzalloc(bitmap_size, GFP_NOFS | __GFP_NOWARN);
+        if (mem)
+                return mem;
+
         return __vmalloc(bitmap_size, GFP_NOFS | __GFP_HIGHMEM | __GFP_ZERO,
                          PAGE_KERNEL);
 }
@@ -289,7 +303,7 @@ int convert_free_space_to_bitmaps(struct btrfs_trans_handle *trans,
 
         ret = 0;
 out:
-        vfree(bitmap);
+        kvfree(bitmap);
         if (ret)
                 btrfs_abort_transaction(trans, root, ret);
         return ret;
@@ -438,7 +452,7 @@ int convert_free_space_to_extents(struct btrfs_trans_handle *trans,
 
         ret = 0;
 out:
-        vfree(bitmap);
+        kvfree(bitmap);
         if (ret)
                 btrfs_abort_transaction(trans, root, ret);
         return ret;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index e28f3d4691af..151b7c71b868 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5717,6 +5717,7 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx)
         char *name_ptr;
         int name_len;
         int is_curr = 0;        /* ctx->pos points to the current index? */
+        bool emitted;
 
         /* FIXME, use a real flag for deciding about the key type */
         if (root->fs_info->tree_root == root)
@@ -5745,6 +5746,7 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx)
         if (ret < 0)
                 goto err;
 
+        emitted = false;
         while (1) {
                 leaf = path->nodes[0];
                 slot = path->slots[0];
@@ -5824,6 +5826,7 @@ skip:
 
                         if (over)
                                 goto nopos;
+                        emitted = true;
                         di_len = btrfs_dir_name_len(leaf, di) +
                                  btrfs_dir_data_len(leaf, di) + sizeof(*di);
                         di_cur += di_len;
@@ -5836,11 +5839,20 @@ next:
         if (key_type == BTRFS_DIR_INDEX_KEY) {
                 if (is_curr)
                         ctx->pos++;
-                ret = btrfs_readdir_delayed_dir_index(ctx, &ins_list);
+                ret = btrfs_readdir_delayed_dir_index(ctx, &ins_list, &emitted);
                 if (ret)
                         goto nopos;
         }
 
+        /*
+         * If we haven't emitted any dir entry, we must not touch ctx->pos as
+         * it was was set to the termination value in previous call. We assume
+         * that "." and ".." were emitted if we reach this point and set the
+         * termination value as well for an empty directory.
+         */
+        if (ctx->pos > 2 && !emitted)
+                goto nopos;
+
         /* Reached end of directory/root. Bump pos past the last item. */
         ctx->pos++;
 
@@ -7116,21 +7128,41 @@ static struct extent_map *btrfs_new_extent_direct(struct inode *inode,
         if (ret)
                 return ERR_PTR(ret);
 
-        em = create_pinned_em(inode, start, ins.offset, start, ins.objectid,
-                              ins.offset, ins.offset, ins.offset, 0);
-        if (IS_ERR(em)) {
-                btrfs_free_reserved_extent(root, ins.objectid, ins.offset, 1);
-                return em;
-        }
-
+        /*
+         * Create the ordered extent before the extent map. This is to avoid
+         * races with the fast fsync path that would lead to it logging file
+         * extent items that point to disk extents that were not yet written to.
+         * The fast fsync path collects ordered extents into a local list and
+         * then collects all the new extent maps, so we must create the ordered
+         * extent first and make sure the fast fsync path collects any new
+         * ordered extents after collecting new extent maps as well.
+         * The fsync path simply can not rely on inode_dio_wait() because it
+         * causes deadlock with AIO.
+         */
         ret = btrfs_add_ordered_extent_dio(inode, start, ins.objectid,
                                            ins.offset, ins.offset, 0);
         if (ret) {
                 btrfs_free_reserved_extent(root, ins.objectid, ins.offset, 1);
-                free_extent_map(em);
                 return ERR_PTR(ret);
         }
 
+        em = create_pinned_em(inode, start, ins.offset, start, ins.objectid,
+                              ins.offset, ins.offset, ins.offset, 0);
+        if (IS_ERR(em)) {
+                struct btrfs_ordered_extent *oe;
+
+                btrfs_free_reserved_extent(root, ins.objectid, ins.offset, 1);
+                oe = btrfs_lookup_ordered_extent(inode, start);
+                ASSERT(oe);
+                if (WARN_ON(!oe))
+                        return em;
+                set_bit(BTRFS_ORDERED_IOERR, &oe->flags);
+                set_bit(BTRFS_ORDERED_IO_DONE, &oe->flags);
+                btrfs_remove_ordered_extent(inode, oe);
+                /* Once for our lookup and once for the ordered extents tree. */
+                btrfs_put_ordered_extent(oe);
+                btrfs_put_ordered_extent(oe);
+        }
         return em;
 }
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 952172ca7e45..48aee9846329 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2794,24 +2794,29 @@ out:
 static struct page *extent_same_get_page(struct inode *inode, pgoff_t index)
 {
         struct page *page;
-        struct extent_io_tree *tree = &BTRFS_I(inode)->io_tree;
 
         page = grab_cache_page(inode->i_mapping, index);
         if (!page)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         if (!PageUptodate(page)) {
-                if (extent_read_full_page_nolock(tree, page, btrfs_get_extent,
-                                                 0))
-                        return NULL;
+                int ret;
+
+                ret = btrfs_readpage(NULL, page);
+                if (ret)
+                        return ERR_PTR(ret);
                 lock_page(page);
                 if (!PageUptodate(page)) {
                         unlock_page(page);
                         page_cache_release(page);
-                        return NULL;
+                        return ERR_PTR(-EIO);
+                }
+                if (page->mapping != inode->i_mapping) {
+                        unlock_page(page);
+                        page_cache_release(page);
+                        return ERR_PTR(-EAGAIN);
                 }
         }
-        unlock_page(page);
 
         return page;
 }
@@ -2823,17 +2828,31 @@ static int gather_extent_pages(struct inode *inode, struct page **pages,
         pgoff_t index = off >> PAGE_CACHE_SHIFT;
 
         for (i = 0; i < num_pages; i++) {
+again:
                 pages[i] = extent_same_get_page(inode, index + i);
-                if (!pages[i])
-                        return -ENOMEM;
+                if (IS_ERR(pages[i])) {
+                        int err = PTR_ERR(pages[i]);
+
+                        if (err == -EAGAIN)
+                                goto again;
+                        pages[i] = NULL;
+                        return err;
+                }
         }
         return 0;
 }
 
-static inline void lock_extent_range(struct inode *inode, u64 off, u64 len)
+static int lock_extent_range(struct inode *inode, u64 off, u64 len,
+                             bool retry_range_locking)
 {
-        /* do any pending delalloc/csum calc on src, one way or
-           another, and lock file content */
+        /*
+         * Do any pending delalloc/csum calculations on inode, one way or
+         * another, and lock file content.
+         * The locking order is:
+         *
+         *   1) pages
+         *   2) range in the inode's io tree
+         */
         while (1) {
                 struct btrfs_ordered_extent *ordered;
                 lock_extent(&BTRFS_I(inode)->io_tree, off, off + len - 1);
@@ -2851,8 +2870,11 @@ static inline void lock_extent_range(struct inode *inode, u64 off, u64 len)
                 unlock_extent(&BTRFS_I(inode)->io_tree, off, off + len - 1);
                 if (ordered)
                         btrfs_put_ordered_extent(ordered);
+                if (!retry_range_locking)
+                        return -EAGAIN;
                 btrfs_wait_ordered_range(inode, off, len);
         }
+        return 0;
 }
 
 static void btrfs_double_inode_unlock(struct inode *inode1, struct inode *inode2)
@@ -2877,15 +2899,24 @@ static void btrfs_double_extent_unlock(struct inode *inode1, u64 loff1,
         unlock_extent(&BTRFS_I(inode2)->io_tree, loff2, loff2 + len - 1);
 }
 
-static void btrfs_double_extent_lock(struct inode *inode1, u64 loff1,
-                                     struct inode *inode2, u64 loff2, u64 len)
+static int btrfs_double_extent_lock(struct inode *inode1, u64 loff1,
+                                    struct inode *inode2, u64 loff2, u64 len,
+                                    bool retry_range_locking)
 {
+        int ret;
+
         if (inode1 < inode2) {
                 swap(inode1, inode2);
                 swap(loff1, loff2);
         }
-        lock_extent_range(inode1, loff1, len);
-        lock_extent_range(inode2, loff2, len);
+        ret = lock_extent_range(inode1, loff1, len, retry_range_locking);
+        if (ret)
+                return ret;
+        ret = lock_extent_range(inode2, loff2, len, retry_range_locking);
+        if (ret)
+                unlock_extent(&BTRFS_I(inode1)->io_tree, loff1,
+                              loff1 + len - 1);
+        return ret;
 }
 
 struct cmp_pages {
@@ -2901,11 +2932,15 @@ static void btrfs_cmp_data_free(struct cmp_pages *cmp)
 
         for (i = 0; i < cmp->num_pages; i++) {
                 pg = cmp->src_pages[i];
-                if (pg)
+                if (pg) {
+                        unlock_page(pg);
                         page_cache_release(pg);
+                }
                 pg = cmp->dst_pages[i];
-                if (pg)
+                if (pg) {
+                        unlock_page(pg);
                         page_cache_release(pg);
+                }
         }
         kfree(cmp->src_pages);
         kfree(cmp->dst_pages);
@@ -2966,6 +3001,8 @@ static int btrfs_cmp_data(struct inode *src, u64 loff, struct inode *dst,
 
                 src_page = cmp->src_pages[i];
                 dst_page = cmp->dst_pages[i];
+                ASSERT(PageLocked(src_page));
+                ASSERT(PageLocked(dst_page));
 
                 addr = kmap_atomic(src_page);
                 dst_addr = kmap_atomic(dst_page);
@@ -3078,14 +3115,46 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
                 goto out_unlock;
         }
 
+again:
         ret = btrfs_cmp_data_prepare(src, loff, dst, dst_loff, olen, &cmp);
         if (ret)
                 goto out_unlock;
 
         if (same_inode)
-                lock_extent_range(src, same_lock_start, same_lock_len);
+                ret = lock_extent_range(src, same_lock_start, same_lock_len,
+                                        false);
         else
-                btrfs_double_extent_lock(src, loff, dst, dst_loff, len);
+                ret = btrfs_double_extent_lock(src, loff, dst, dst_loff, len,
+                                               false);
+        /*
+         * If one of the inodes has dirty pages in the respective range or
+         * ordered extents, we need to flush dellaloc and wait for all ordered
+         * extents in the range. We must unlock the pages and the ranges in the
+         * io trees to avoid deadlocks when flushing delalloc (requires locking
+         * pages) and when waiting for ordered extents to complete (they require
+         * range locking).
+         */
+        if (ret == -EAGAIN) {
+                /*
+                 * Ranges in the io trees already unlocked. Now unlock all
+                 * pages before waiting for all IO to complete.
+                 */
+                btrfs_cmp_data_free(&cmp);
+                if (same_inode) {
+                        btrfs_wait_ordered_range(src, same_lock_start,
+                                                 same_lock_len);
+                } else {
+                        btrfs_wait_ordered_range(src, loff, len);
+                        btrfs_wait_ordered_range(dst, dst_loff, len);
+                }
+                goto again;
+        }
+        ASSERT(ret == 0);
+        if (WARN_ON(ret)) {
+                /* ranges in the io trees already unlocked */
+                btrfs_cmp_data_free(&cmp);
+                return ret;
+        }
 
         /* pass original length for comparison so we stay within i_size */
         ret = btrfs_cmp_data(src, loff, dst, dst_loff, olen, &cmp);
@@ -3795,9 +3864,15 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src,
                 u64 lock_start = min_t(u64, off, destoff);
                 u64 lock_len = max_t(u64, off, destoff) + len - lock_start;
 
-                lock_extent_range(src, lock_start, lock_len);
+                ret = lock_extent_range(src, lock_start, lock_len, true);
         } else {
-                btrfs_double_extent_lock(src, off, inode, destoff, len);
+                ret = btrfs_double_extent_lock(src, off, inode, destoff, len,
+                                               true);
+        }
+        ASSERT(ret == 0);
+        if (WARN_ON(ret)) {
+                /* ranges in the io trees already unlocked */
+                goto out_unlock;
         }
 
         ret = btrfs_clone(src, inode, off, olen, len, destoff, 0);
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index fd1c4d982463..2bd0011450df 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -575,7 +575,8 @@ static int is_cowonly_root(u64 root_objectid)
             root_objectid == BTRFS_TREE_LOG_OBJECTID ||
             root_objectid == BTRFS_CSUM_TREE_OBJECTID ||
             root_objectid == BTRFS_UUID_TREE_OBJECTID ||
-            root_objectid == BTRFS_QUOTA_TREE_OBJECTID)
+            root_objectid == BTRFS_QUOTA_TREE_OBJECTID ||
+            root_objectid == BTRFS_FREE_SPACE_TREE_OBJECTID)
                 return 1;
         return 0;
 }
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index e0ac85949067..539e7b5e3f86 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -202,6 +202,7 @@ BTRFS_FEAT_ATTR_INCOMPAT(extended_iref, EXTENDED_IREF);
 BTRFS_FEAT_ATTR_INCOMPAT(raid56, RAID56);
 BTRFS_FEAT_ATTR_INCOMPAT(skinny_metadata, SKINNY_METADATA);
 BTRFS_FEAT_ATTR_INCOMPAT(no_holes, NO_HOLES);
+BTRFS_FEAT_ATTR_COMPAT_RO(free_space_tree, FREE_SPACE_TREE);
 
 static struct attribute *btrfs_supported_feature_attrs[] = {
         BTRFS_FEAT_ATTR_PTR(mixed_backref),
@@ -213,6 +214,7 @@ static struct attribute *btrfs_supported_feature_attrs[] = {
         BTRFS_FEAT_ATTR_PTR(raid56),
         BTRFS_FEAT_ATTR_PTR(skinny_metadata),
         BTRFS_FEAT_ATTR_PTR(no_holes),
+        BTRFS_FEAT_ATTR_PTR(free_space_tree),
         NULL
 };
 
@@ -780,6 +782,39 @@ failure:
         return error;
 }
 
+
+/*
+ * Change per-fs features in /sys/fs/btrfs/UUID/features to match current
+ * values in superblock. Call after any changes to incompat/compat_ro flags
+ */
+void btrfs_sysfs_feature_update(struct btrfs_fs_info *fs_info,
+                u64 bit, enum btrfs_feature_set set)
+{
+        struct btrfs_fs_devices *fs_devs;
+        struct kobject *fsid_kobj;
+        u64 features;
+        int ret;
+
+        if (!fs_info)
+                return;
+
+        features = get_features(fs_info, set);
+        ASSERT(bit & supported_feature_masks[set]);
+
+        fs_devs = fs_info->fs_devices;
+        fsid_kobj = &fs_devs->fsid_kobj;
+
+        if (!fsid_kobj->state_initialized)
+                return;
+
+        /*
+         * FIXME: this is too heavy to update just one value, ideally we'd like
+         * to use sysfs_update_group but some refactoring is needed first.
+         */
+        sysfs_remove_group(fsid_kobj, &btrfs_feature_attr_group);
+        ret = sysfs_create_group(fsid_kobj, &btrfs_feature_attr_group);
+}
+
 static int btrfs_init_debugfs(void)
 {
 #ifdef CONFIG_DEBUG_FS
diff --git a/fs/btrfs/sysfs.h b/fs/btrfs/sysfs.h
index 9c09522125a6..d7da1a4c2f6c 100644
--- a/fs/btrfs/sysfs.h
+++ b/fs/btrfs/sysfs.h
@@ -56,7 +56,7 @@ static struct btrfs_feature_attr btrfs_attr_##_name = {			     \
 #define BTRFS_FEAT_ATTR_COMPAT(name, feature) \
         BTRFS_FEAT_ATTR(name, FEAT_COMPAT, BTRFS_FEATURE_COMPAT, feature)
 #define BTRFS_FEAT_ATTR_COMPAT_RO(name, feature) \
-        BTRFS_FEAT_ATTR(name, FEAT_COMPAT_RO, BTRFS_FEATURE_COMPAT, feature)
+        BTRFS_FEAT_ATTR(name, FEAT_COMPAT_RO, BTRFS_FEATURE_COMPAT_RO, feature)
 #define BTRFS_FEAT_ATTR_INCOMPAT(name, feature) \
         BTRFS_FEAT_ATTR(name, FEAT_INCOMPAT, BTRFS_FEATURE_INCOMPAT, feature)
 
@@ -90,4 +90,7 @@ int btrfs_sysfs_add_fsid(struct btrfs_fs_devices *fs_devs,
                                 struct kobject *parent);
 int btrfs_sysfs_add_device(struct btrfs_fs_devices *fs_devs);
 void btrfs_sysfs_remove_fsid(struct btrfs_fs_devices *fs_devs);
+void btrfs_sysfs_feature_update(struct btrfs_fs_info *fs_info,
+                u64 bit, enum btrfs_feature_set set);
+
 #endif /* _BTRFS_SYSFS_H_ */
diff --git a/fs/btrfs/tests/btrfs-tests.c b/fs/btrfs/tests/btrfs-tests.c
index b1d920b30070..0e1e61a7ec23 100644
--- a/fs/btrfs/tests/btrfs-tests.c
+++ b/fs/btrfs/tests/btrfs-tests.c
@@ -82,18 +82,18 @@ void btrfs_destroy_test_fs(void)
 struct btrfs_fs_info *btrfs_alloc_dummy_fs_info(void)
 {
         struct btrfs_fs_info *fs_info = kzalloc(sizeof(struct btrfs_fs_info),
-                                                GFP_NOFS);
+                                                GFP_KERNEL);
 
         if (!fs_info)
                 return fs_info;
         fs_info->fs_devices = kzalloc(sizeof(struct btrfs_fs_devices),
-                                      GFP_NOFS);
+                                      GFP_KERNEL);
         if (!fs_info->fs_devices) {
                 kfree(fs_info);
                 return NULL;
         }
         fs_info->super_copy = kzalloc(sizeof(struct btrfs_super_block),
-                                      GFP_NOFS);
+                                      GFP_KERNEL);
         if (!fs_info->super_copy) {
                 kfree(fs_info->fs_devices);
                 kfree(fs_info);
@@ -180,11 +180,11 @@ btrfs_alloc_dummy_block_group(unsigned long length)
 {
         struct btrfs_block_group_cache *cache;
 
-        cache = kzalloc(sizeof(*cache), GFP_NOFS);
+        cache = kzalloc(sizeof(*cache), GFP_KERNEL);
         if (!cache)
                 return NULL;
         cache->free_space_ctl = kzalloc(sizeof(*cache->free_space_ctl),
-                                        GFP_NOFS);
+                                        GFP_KERNEL);
         if (!cache->free_space_ctl) {
                 kfree(cache);
                 return NULL;
diff --git a/fs/btrfs/tests/extent-io-tests.c b/fs/btrfs/tests/extent-io-tests.c
index e29fa297e053..669b58201e36 100644
--- a/fs/btrfs/tests/extent-io-tests.c
+++ b/fs/btrfs/tests/extent-io-tests.c
@@ -94,7 +94,7 @@ static int test_find_delalloc(void)
          * test.
          */
         for (index = 0; index < (total_dirty >> PAGE_CACHE_SHIFT); index++) {
-                page = find_or_create_page(inode->i_mapping, index, GFP_NOFS);
+                page = find_or_create_page(inode->i_mapping, index, GFP_KERNEL);
                 if (!page) {
                         test_msg("Failed to allocate test page\n");
                         ret = -ENOMEM;
@@ -113,7 +113,7 @@ static int test_find_delalloc(void)
          * |--- delalloc ---|
          * |---  search  ---|
          */
-        set_extent_delalloc(&tmp, 0, 4095, NULL, GFP_NOFS);
+        set_extent_delalloc(&tmp, 0, 4095, NULL, GFP_KERNEL);
         start = 0;
         end = 0;
         found = find_lock_delalloc_range(inode, &tmp, locked_page, &start,
@@ -144,7 +144,7 @@ static int test_find_delalloc(void)
                 test_msg("Couldn't find the locked page\n");
                 goto out_bits;
         }
-        set_extent_delalloc(&tmp, 4096, max_bytes - 1, NULL, GFP_NOFS);
+        set_extent_delalloc(&tmp, 4096, max_bytes - 1, NULL, GFP_KERNEL);
         start = test_start;
         end = 0;
         found = find_lock_delalloc_range(inode, &tmp, locked_page, &start,
@@ -199,7 +199,7 @@ static int test_find_delalloc(void)
          *
          * We are re-using our test_start from above since it works out well.
          */
-        set_extent_delalloc(&tmp, max_bytes, total_dirty - 1, NULL, GFP_NOFS);
+        set_extent_delalloc(&tmp, max_bytes, total_dirty - 1, NULL, GFP_KERNEL);
         start = test_start;
         end = 0;
         found = find_lock_delalloc_range(inode, &tmp, locked_page, &start,
@@ -262,7 +262,7 @@ static int test_find_delalloc(void)
         }
         ret = 0;
 out_bits:
-        clear_extent_bits(&tmp, 0, total_dirty - 1, (unsigned)-1, GFP_NOFS);
+        clear_extent_bits(&tmp, 0, total_dirty - 1, (unsigned)-1, GFP_KERNEL);
 out:
         if (locked_page)
                 page_cache_release(locked_page);
@@ -360,7 +360,7 @@ static int test_eb_bitmaps(void)
 
         test_msg("Running extent buffer bitmap tests\n");
 
-        bitmap = kmalloc(len, GFP_NOFS);
+        bitmap = kmalloc(len, GFP_KERNEL);
         if (!bitmap) {
                 test_msg("Couldn't allocate test bitmap\n");
                 return -ENOMEM;
diff --git a/fs/btrfs/tests/inode-tests.c b/fs/btrfs/tests/inode-tests.c
index 5de55fdd28bc..e2d3da02deee 100644
--- a/fs/btrfs/tests/inode-tests.c
+++ b/fs/btrfs/tests/inode-tests.c
@@ -974,7 +974,7 @@ static int test_extent_accounting(void)
                                (BTRFS_MAX_EXTENT_SIZE >> 1) + 4095,
                                EXTENT_DELALLOC | EXTENT_DIRTY |
                                EXTENT_UPTODATE | EXTENT_DO_ACCOUNTING, 0, 0,
-                               NULL, GFP_NOFS);
+                               NULL, GFP_KERNEL);
         if (ret) {
                 test_msg("clear_extent_bit returned %d\n", ret);
                 goto out;
@@ -1045,7 +1045,7 @@ static int test_extent_accounting(void)
                                BTRFS_MAX_EXTENT_SIZE+8191,
                                EXTENT_DIRTY | EXTENT_DELALLOC |
                                EXTENT_DO_ACCOUNTING | EXTENT_UPTODATE, 0, 0,
-                               NULL, GFP_NOFS);
+                               NULL, GFP_KERNEL);
         if (ret) {
                 test_msg("clear_extent_bit returned %d\n", ret);
                 goto out;
@@ -1079,7 +1079,7 @@ static int test_extent_accounting(void)
         ret = clear_extent_bit(&BTRFS_I(inode)->io_tree, 0, (u64)-1,
                                EXTENT_DIRTY | EXTENT_DELALLOC |
                                EXTENT_DO_ACCOUNTING | EXTENT_UPTODATE, 0, 0,
-                               NULL, GFP_NOFS);
+                               NULL, GFP_KERNEL);
         if (ret) {
                 test_msg("clear_extent_bit returned %d\n", ret);
                 goto out;
@@ -1096,7 +1096,7 @@ out:
                 clear_extent_bit(&BTRFS_I(inode)->io_tree, 0, (u64)-1,
                                  EXTENT_DIRTY | EXTENT_DELALLOC |
                                  EXTENT_DO_ACCOUNTING | EXTENT_UPTODATE, 0, 0,
-                                 NULL, GFP_NOFS);
+                                 NULL, GFP_KERNEL);
         iput(inode);
         btrfs_free_dummy_root(root);
         return ret;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 323e12cc9d2f..978c3a810893 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -4127,7 +4127,9 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
                                      struct inode *inode,
                                      struct btrfs_path *path,
                                      struct list_head *logged_list,
-                                     struct btrfs_log_ctx *ctx)
+                                     struct btrfs_log_ctx *ctx,
+                                     const u64 start,
+                                     const u64 end)
 {
         struct extent_map *em, *n;
         struct list_head extents;
@@ -4166,7 +4168,13 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
         }
 
         list_sort(NULL, &extents, extent_cmp);
-
+        /*
+         * Collect any new ordered extents within the range. This is to
+         * prevent logging file extent items without waiting for the disk
+         * location they point to being written. We do this only to deal
+         * with races against concurrent lockless direct IO writes.
+         */
+        btrfs_get_logged_extents(inode, logged_list, start, end);
 process:
         while (!list_empty(&extents)) {
                 em = list_entry(extents.next, struct extent_map, list);
@@ -4701,7 +4709,7 @@ log_extents:
                         goto out_unlock;
                 }
                 ret = btrfs_log_changed_extents(trans, root, inode, dst_path,
-                                                &logged_list, ctx);
+                                                &logged_list, ctx, start, end);
                 if (ret) {
                         err = ret;
                         goto out_unlock;
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 86a9c383955e..eb9028e8cfc5 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -698,8 +698,8 @@ static void ceph_aio_retry_work(struct work_struct *work)
 
         req = ceph_osdc_alloc_request(orig_req->r_osdc, snapc, 2,
                         false, GFP_NOFS);
-        if (IS_ERR(req)) {
-                ret = PTR_ERR(req);
+        if (!req) {
+                ret = -ENOMEM;
                 req = orig_req;
                 goto out;
         }
@@ -716,7 +716,6 @@ static void ceph_aio_retry_work(struct work_struct *work)
         ceph_osdc_build_request(req, req->r_ops[0].extent.offset,
                                 snapc, CEPH_NOSNAP, &aio_req->mtime);
 
-        ceph_put_snap_context(snapc);
         ceph_osdc_put_request(orig_req);
 
         req->r_callback = ceph_aio_complete_req;
@@ -731,6 +730,7 @@ out:
                 ceph_aio_complete_req(req, NULL);
         }
 
+        ceph_put_snap_context(snapc);
         kfree(aio_work);
 }
 
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index a5b8eb69a8f4..6402eaf8ab95 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1261,6 +1261,9 @@ COMPATIBLE_IOCTL(HCIUNBLOCKADDR)
 COMPATIBLE_IOCTL(HCIINQUIRY)
 COMPATIBLE_IOCTL(HCIUARTSETPROTO)
 COMPATIBLE_IOCTL(HCIUARTGETPROTO)
+COMPATIBLE_IOCTL(HCIUARTGETDEVICE)
+COMPATIBLE_IOCTL(HCIUARTSETFLAGS)
+COMPATIBLE_IOCTL(HCIUARTGETFLAGS)
 COMPATIBLE_IOCTL(RFCOMMCREATEDEV)
 COMPATIBLE_IOCTL(RFCOMMRELEASEDEV)
 COMPATIBLE_IOCTL(RFCOMMGETDEVLIST)
diff --git a/fs/dax.c b/fs/dax.c
index 4fd6b0c5c6b5..fc2e3141138b 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -58,6 +58,26 @@ static void dax_unmap_atomic(struct block_device *bdev,
         blk_queue_exit(bdev->bd_queue);
 }
 
+struct page *read_dax_sector(struct block_device *bdev, sector_t n)
+{
+        struct page *page = alloc_pages(GFP_KERNEL, 0);
+        struct blk_dax_ctl dax = {
+                .size = PAGE_SIZE,
+                .sector = n & ~((((int) PAGE_SIZE) / 512) - 1),
+        };
+        long rc;
+
+        if (!page)
+                return ERR_PTR(-ENOMEM);
+
+        rc = dax_map_atomic(bdev, &dax);
+        if (rc < 0)
+                return ERR_PTR(rc);
+        memcpy_from_pmem(page_address(page), dax.addr, PAGE_SIZE);
+        dax_unmap_atomic(bdev, &dax);
+        return page;
+}
+
 /*
  * dax_clear_blocks() is called from within transaction context from XFS,
  * and hence this means the stack from this point must follow GFP_NOFS
@@ -338,7 +358,8 @@ static int dax_radix_entry(struct address_space *mapping, pgoff_t index,
         void *entry;
 
         WARN_ON_ONCE(pmd_entry && !dirty);
-        __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
+        if (dirty)
+                __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
 
         spin_lock_irq(&mapping->tree_lock);
 
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 1f107fd51328..655f21f99160 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -575,6 +575,26 @@ void devpts_kill_index(struct inode *ptmx_inode, int idx)
         mutex_unlock(&allocated_ptys_lock);
 }
 
+/*
+ * pty code needs to hold extra references in case of last /dev/tty close
+ */
+
+void devpts_add_ref(struct inode *ptmx_inode)
+{
+        struct super_block *sb = pts_sb_from_inode(ptmx_inode);
+
+        atomic_inc(&sb->s_active);
+        ihold(ptmx_inode);
+}
+
+void devpts_del_ref(struct inode *ptmx_inode)
+{
+        struct super_block *sb = pts_sb_from_inode(ptmx_inode);
+
+        iput(ptmx_inode);
+        deactivate_super(sb);
+}
+
 /**
  * devpts_pty_new -- create a new inode in /dev/pts/
  * @ptmx_inode: inode of the master
diff --git a/fs/efivarfs/file.c b/fs/efivarfs/file.c
index c424e4813ec8..d48e0d261d78 100644
--- a/fs/efivarfs/file.c
+++ b/fs/efivarfs/file.c
@@ -10,6 +10,7 @@
 #include <linux/efi.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
+#include <linux/mount.h>
 
 #include "internal.h"
 
@@ -103,9 +104,78 @@ out_free:
         return size;
 }
 
+static int
+efivarfs_ioc_getxflags(struct file *file, void __user *arg)
+{
+        struct inode *inode = file->f_mapping->host;
+        unsigned int i_flags;
+        unsigned int flags = 0;
+
+        i_flags = inode->i_flags;
+        if (i_flags & S_IMMUTABLE)
+                flags |= FS_IMMUTABLE_FL;
+
+        if (copy_to_user(arg, &flags, sizeof(flags)))
+                return -EFAULT;
+        return 0;
+}
+
+static int
+efivarfs_ioc_setxflags(struct file *file, void __user *arg)
+{
+        struct inode *inode = file->f_mapping->host;
+        unsigned int flags;
+        unsigned int i_flags = 0;
+        int error;
+
+        if (!inode_owner_or_capable(inode))
+                return -EACCES;
+
+        if (copy_from_user(&flags, arg, sizeof(flags)))
+                return -EFAULT;
+
+        if (flags & ~FS_IMMUTABLE_FL)
+                return -EOPNOTSUPP;
+
+        if (!capable(CAP_LINUX_IMMUTABLE))
+                return -EPERM;
+
+        if (flags & FS_IMMUTABLE_FL)
+                i_flags |= S_IMMUTABLE;
+
+
+        error = mnt_want_write_file(file);
+        if (error)
+                return error;
+
+        inode_lock(inode);
+        inode_set_flags(inode, i_flags, S_IMMUTABLE);
+        inode_unlock(inode);
+
+        mnt_drop_write_file(file);
+
+        return 0;
+}
+
+long
+efivarfs_file_ioctl(struct file *file, unsigned int cmd, unsigned long p)
+{
+        void __user *arg = (void __user *)p;
+
+        switch (cmd) {
+        case FS_IOC_GETFLAGS:
+                return efivarfs_ioc_getxflags(file, arg);
+        case FS_IOC_SETFLAGS:
+                return efivarfs_ioc_setxflags(file, arg);
+        }
+
+        return -ENOTTY;
+}
+
 const struct file_operations efivarfs_file_operations = {
         .open   = simple_open,
         .read   = efivarfs_file_read,
         .write  = efivarfs_file_write,
         .llseek = no_llseek,
+        .unlocked_ioctl = efivarfs_file_ioctl,
 };
diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
index 3381b9da9ee6..e2ab6d0497f2 100644
--- a/fs/efivarfs/inode.c
+++ b/fs/efivarfs/inode.c
@@ -15,7 +15,8 @@
 #include "internal.h"
 
 struct inode *efivarfs_get_inode(struct super_block *sb,
-                                const struct inode *dir, int mode, dev_t dev)
+                                const struct inode *dir, int mode,
+                                dev_t dev, bool is_removable)
 {
         struct inode *inode = new_inode(sb);
 
@@ -23,6 +24,7 @@ struct inode *efivarfs_get_inode(struct super_block *sb,
                 inode->i_ino = get_next_ino();
                 inode->i_mode = mode;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+                inode->i_flags = is_removable ? 0 : S_IMMUTABLE;
                 switch (mode & S_IFMT) {
                 case S_IFREG:
                         inode->i_fop = &efivarfs_file_operations;
@@ -102,22 +104,17 @@ static void efivarfs_hex_to_guid(const char *str, efi_guid_t *guid)
 static int efivarfs_create(struct inode *dir, struct dentry *dentry,
                           umode_t mode, bool excl)
 {
-        struct inode *inode;
+        struct inode *inode = NULL;
         struct efivar_entry *var;
         int namelen, i = 0, err = 0;
+        bool is_removable = false;
 
         if (!efivarfs_valid_name(dentry->d_name.name, dentry->d_name.len))
                 return -EINVAL;
 
-        inode = efivarfs_get_inode(dir->i_sb, dir, mode, 0);
-        if (!inode)
-                return -ENOMEM;
-
         var = kzalloc(sizeof(struct efivar_entry), GFP_KERNEL);
-        if (!var) {
-                err = -ENOMEM;
-                goto out;
-        }
+        if (!var)
+                return -ENOMEM;
 
         /* length of the variable name itself: remove GUID and separator */
         namelen = dentry->d_name.len - EFI_VARIABLE_GUID_LEN - 1;
@@ -125,6 +122,16 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
         efivarfs_hex_to_guid(dentry->d_name.name + namelen + 1,
                         &var->var.VendorGuid);
 
+        if (efivar_variable_is_removable(var->var.VendorGuid,
+                                         dentry->d_name.name, namelen))
+                is_removable = true;
+
+        inode = efivarfs_get_inode(dir->i_sb, dir, mode, 0, is_removable);
+        if (!inode) {
+                err = -ENOMEM;
+                goto out;
+        }
+
         for (i = 0; i < namelen; i++)
                 var->var.VariableName[i] = dentry->d_name.name[i];
 
@@ -138,7 +145,8 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
 out:
         if (err) {
                 kfree(var);
-                iput(inode);
+                if (inode)
+                        iput(inode);
         }
         return err;
 }
diff --git a/fs/efivarfs/internal.h b/fs/efivarfs/internal.h
index b5ff16addb7c..b4505188e799 100644
--- a/fs/efivarfs/internal.h
+++ b/fs/efivarfs/internal.h
@@ -15,7 +15,8 @@ extern const struct file_operations efivarfs_file_operations;
 extern const struct inode_operations efivarfs_dir_inode_operations;
 extern bool efivarfs_valid_name(const char *str, int len);
 extern struct inode *efivarfs_get_inode(struct super_block *sb,
-                        const struct inode *dir, int mode, dev_t dev);
+                        const struct inode *dir, int mode, dev_t dev,
+                        bool is_removable);
 
 extern struct list_head efivarfs_list;
 
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index b8a564f29107..dd029d13ea61 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -118,8 +118,9 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
         struct dentry *dentry, *root = sb->s_root;
         unsigned long size = 0;
         char *name;
-        int len, i;
+        int len;
         int err = -ENOMEM;
+        bool is_removable = false;
 
         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
         if (!entry)
@@ -128,15 +129,17 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
         memcpy(entry->var.VariableName, name16, name_size);
         memcpy(&(entry->var.VendorGuid), &vendor, sizeof(efi_guid_t));
 
-        len = ucs2_strlen(entry->var.VariableName);
+        len = ucs2_utf8size(entry->var.VariableName);
 
         /* name, plus '-', plus GUID, plus NUL*/
         name = kmalloc(len + 1 + EFI_VARIABLE_GUID_LEN + 1, GFP_KERNEL);
         if (!name)
                 goto fail;
 
-        for (i = 0; i < len; i++)
-                name[i] = entry->var.VariableName[i] & 0xFF;
+        ucs2_as_utf8(name, entry->var.VariableName, len);
+
+        if (efivar_variable_is_removable(entry->var.VendorGuid, name, len))
+                is_removable = true;
 
         name[len] = '-';
 
@@ -144,7 +147,8 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
 
         name[len + EFI_VARIABLE_GUID_LEN+1] = '\0';
 
-        inode = efivarfs_get_inode(sb, d_inode(root), S_IFREG | 0644, 0);
+        inode = efivarfs_get_inode(sb, d_inode(root), S_IFREG | 0644, 0,
+                                   is_removable);
         if (!inode)
                 goto fail_name;
 
@@ -200,7 +204,7 @@ static int efivarfs_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_d_op              = &efivarfs_d_ops;
         sb->s_time_gran         = 1;
 
-        inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0);
+        inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0, true);
         if (!inode)
                 return -ENOMEM;
         inode->i_op = &efivarfs_dir_inode_operations;
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index ae1dbcf47e97..cde60741cad2 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -94,6 +94,11 @@
 /* Epoll private bits inside the event mask */
 #define EP_PRIVATE_BITS (EPOLLWAKEUP | EPOLLONESHOT | EPOLLET | EPOLLEXCLUSIVE)
 
+#define EPOLLINOUT_BITS (POLLIN | POLLOUT)
+
+#define EPOLLEXCLUSIVE_OK_BITS (EPOLLINOUT_BITS | POLLERR | POLLHUP | \
+                                EPOLLWAKEUP | EPOLLET | EPOLLEXCLUSIVE)
+
 /* Maximum number of nesting allowed inside epoll sets */
 #define EP_MAX_NESTS 4
 
@@ -1068,7 +1073,22 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
          * wait list.
          */
         if (waitqueue_active(&ep->wq)) {
-                ewake = 1;
+                if ((epi->event.events & EPOLLEXCLUSIVE) &&
+                                        !((unsigned long)key & POLLFREE)) {
+                        switch ((unsigned long)key & EPOLLINOUT_BITS) {
+                        case POLLIN:
+                                if (epi->event.events & POLLIN)
+                                        ewake = 1;
+                                break;
+                        case POLLOUT:
+                                if (epi->event.events & POLLOUT)
+                                        ewake = 1;
+                                break;
+                        case 0:
+                                ewake = 1;
+                                break;
+                        }
+                }
                 wake_up_locked(&ep->wq);
         }
         if (waitqueue_active(&ep->poll_wait))
@@ -1875,9 +1895,13 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
          * so EPOLLEXCLUSIVE is not allowed for a EPOLL_CTL_MOD operation.
          * Also, we do not currently supported nested exclusive wakeups.
          */
-        if ((epds.events & EPOLLEXCLUSIVE) && (op == EPOLL_CTL_MOD ||
-                (op == EPOLL_CTL_ADD && is_file_epoll(tf.file))))
-                goto error_tgt_fput;
+        if (epds.events & EPOLLEXCLUSIVE) {
+                if (op == EPOLL_CTL_MOD)
+                        goto error_tgt_fput;
+                if (op == EPOLL_CTL_ADD && (is_file_epoll(tf.file) ||
+                                (epds.events & ~EPOLLEXCLUSIVE_OK_BITS)))
+                        goto error_tgt_fput;
+        }
 
         /*
          * At this point it is safe to assume that the "private_data" contains
@@ -1950,8 +1974,10 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                 break;
         case EPOLL_CTL_MOD:
                 if (epi) {
-                        epds.events |= POLLERR | POLLHUP;
-                        error = ep_modify(ep, epi, &epds);
+                        if (!(epi->event.events & EPOLLEXCLUSIVE)) {
+                                epds.events |= POLLERR | POLLHUP;
+                                error = ep_modify(ep, epi, &epds);
+                        }
                 } else
                         error = -ENOENT;
                 break;
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 5bcd92d50e82..0cb1abd535e3 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1215,7 +1215,7 @@ static int ff_layout_read_done_cb(struct rpc_task *task,
                                         hdr->pgio_mirror_idx + 1,
                                         &hdr->pgio_mirror_idx))
                         goto out_eagain;
-                set_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
+                set_bit(NFS_LAYOUT_RETURN_REQUESTED,
                         &hdr->lseg->pls_layout->plh_flags);
                 pnfs_read_resend_pnfs(hdr);
                 return task->tk_status;
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 29898a9550fa..eb370460ce20 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -412,7 +412,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
                                          OP_ILLEGAL, GFP_NOIO);
                 if (!fail_return) {
                         if (ff_layout_has_available_ds(lseg))
-                                set_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
+                                set_bit(NFS_LAYOUT_RETURN_REQUESTED,
                                         &lseg->pls_layout->plh_flags);
                         else
                                 pnfs_error_mark_layout_for_return(ino, lseg);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index a3592cc34a20..482b6e94bb37 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -52,9 +52,7 @@ static DEFINE_SPINLOCK(pnfs_spinlock);
  */
 static LIST_HEAD(pnfs_modules_tbl);
 
-static int
-pnfs_send_layoutreturn(struct pnfs_layout_hdr *lo, const nfs4_stateid *stateid,
-                       enum pnfs_iomode iomode, bool sync);
+static void pnfs_layoutreturn_before_put_layout_hdr(struct pnfs_layout_hdr *lo);
 
 /* Return the registered pnfs layout driver module matching given id */
 static struct pnfs_layoutdriver_type *
@@ -243,6 +241,8 @@ pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo)
 {
         struct inode *inode = lo->plh_inode;
 
+        pnfs_layoutreturn_before_put_layout_hdr(lo);
+
         if (atomic_dec_and_lock(&lo->plh_refcount, &inode->i_lock)) {
                 if (!list_empty(&lo->plh_segs))
                         WARN_ONCE(1, "NFS: BUG unfreed layout segments.\n");
@@ -345,58 +345,6 @@ pnfs_layout_remove_lseg(struct pnfs_layout_hdr *lo,
         rpc_wake_up(&NFS_SERVER(inode)->roc_rpcwaitq);
 }
 
-/* Return true if layoutreturn is needed */
-static bool
-pnfs_layout_need_return(struct pnfs_layout_hdr *lo,
-                        struct pnfs_layout_segment *lseg)
-{
-        struct pnfs_layout_segment *s;
-
-        if (!test_and_clear_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags))
-                return false;
-
-        list_for_each_entry(s, &lo->plh_segs, pls_list)
-                if (s != lseg && test_bit(NFS_LSEG_LAYOUTRETURN, &s->pls_flags))
-                        return false;
-
-        return true;
-}
-
-static bool
-pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo)
-{
-        if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
-                return false;
-        lo->plh_return_iomode = 0;
-        pnfs_get_layout_hdr(lo);
-        clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE, &lo->plh_flags);
-        return true;
-}
-
-static void pnfs_layoutreturn_before_put_lseg(struct pnfs_layout_segment *lseg,
-                struct pnfs_layout_hdr *lo, struct inode *inode)
-{
-        lo = lseg->pls_layout;
-        inode = lo->plh_inode;
-
-        spin_lock(&inode->i_lock);
-        if (pnfs_layout_need_return(lo, lseg)) {
-                nfs4_stateid stateid;
-                enum pnfs_iomode iomode;
-                bool send;
-
-                nfs4_stateid_copy(&stateid, &lo->plh_stateid);
-                iomode = lo->plh_return_iomode;
-                send = pnfs_prepare_layoutreturn(lo);
-                spin_unlock(&inode->i_lock);
-                if (send) {
-                        /* Send an async layoutreturn so we dont deadlock */
-                        pnfs_send_layoutreturn(lo, &stateid, iomode, false);
-                }
-        } else
-                spin_unlock(&inode->i_lock);
-}
-
 void
 pnfs_put_lseg(struct pnfs_layout_segment *lseg)
 {
@@ -410,15 +358,8 @@ pnfs_put_lseg(struct pnfs_layout_segment *lseg)
                 atomic_read(&lseg->pls_refcount),
                 test_bit(NFS_LSEG_VALID, &lseg->pls_flags));
 
-        /* Handle the case where refcount != 1 */
-        if (atomic_add_unless(&lseg->pls_refcount, -1, 1))
-                return;
-
         lo = lseg->pls_layout;
         inode = lo->plh_inode;
-        /* Do we need a layoutreturn? */
-        if (test_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags))
-                pnfs_layoutreturn_before_put_lseg(lseg, lo, inode);
 
         if (atomic_dec_and_lock(&lseg->pls_refcount, &inode->i_lock)) {
                 if (test_bit(NFS_LSEG_VALID, &lseg->pls_flags)) {
@@ -937,6 +878,17 @@ void pnfs_clear_layoutreturn_waitbit(struct pnfs_layout_hdr *lo)
         rpc_wake_up(&NFS_SERVER(lo->plh_inode)->roc_rpcwaitq);
 }
 
+static bool
+pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo)
+{
+        if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
+                return false;
+        lo->plh_return_iomode = 0;
+        pnfs_get_layout_hdr(lo);
+        clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
+        return true;
+}
+
 static int
 pnfs_send_layoutreturn(struct pnfs_layout_hdr *lo, const nfs4_stateid *stateid,
                        enum pnfs_iomode iomode, bool sync)
@@ -971,6 +923,48 @@ out:
         return status;
 }
 
+/* Return true if layoutreturn is needed */
+static bool
+pnfs_layout_need_return(struct pnfs_layout_hdr *lo)
+{
+        struct pnfs_layout_segment *s;
+
+        if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags))
+                return false;
+
+        /* Defer layoutreturn until all lsegs are done */
+        list_for_each_entry(s, &lo->plh_segs, pls_list) {
+                if (test_bit(NFS_LSEG_LAYOUTRETURN, &s->pls_flags))
+                        return false;
+        }
+
+        return true;
+}
+
+static void pnfs_layoutreturn_before_put_layout_hdr(struct pnfs_layout_hdr *lo)
+{
+        struct inode *inode= lo->plh_inode;
+
+        if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags))
+                return;
+        spin_lock(&inode->i_lock);
+        if (pnfs_layout_need_return(lo)) {
+                nfs4_stateid stateid;
+                enum pnfs_iomode iomode;
+                bool send;
+
+                nfs4_stateid_copy(&stateid, &lo->plh_stateid);
+                iomode = lo->plh_return_iomode;
+                send = pnfs_prepare_layoutreturn(lo);
+                spin_unlock(&inode->i_lock);
+                if (send) {
+                        /* Send an async layoutreturn so we dont deadlock */
+                        pnfs_send_layoutreturn(lo, &stateid, iomode, false);
+                }
+        } else
+                spin_unlock(&inode->i_lock);
+}
+
 /*
  * Initiates a LAYOUTRETURN(FILE), and removes the pnfs_layout_hdr
  * when the layout segment list is empty.
@@ -1091,7 +1085,7 @@ bool pnfs_roc(struct inode *ino)
 
         nfs4_stateid_copy(&stateid, &lo->plh_stateid);
         /* always send layoutreturn if being marked so */
-        if (test_and_clear_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
+        if (test_and_clear_bit(NFS_LAYOUT_RETURN_REQUESTED,
                                    &lo->plh_flags))
                 layoutreturn = pnfs_prepare_layoutreturn(lo);
 
@@ -1772,7 +1766,7 @@ pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo,
                         pnfs_set_plh_return_iomode(lo, return_range->iomode);
                         if (!mark_lseg_invalid(lseg, tmp_list))
                                 remaining++;
-                        set_bit(NFS_LAYOUT_RETURN_BEFORE_CLOSE,
+                        set_bit(NFS_LAYOUT_RETURN_REQUESTED,
                                         &lo->plh_flags);
                 }
         return remaining;
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 9f4e2a47f4aa..1ac1db5f6dad 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -94,8 +94,8 @@ enum {
         NFS_LAYOUT_RO_FAILED = 0,       /* get ro layout failed stop trying */
         NFS_LAYOUT_RW_FAILED,           /* get rw layout failed stop trying */
         NFS_LAYOUT_BULK_RECALL,         /* bulk recall affecting layout */
-        NFS_LAYOUT_RETURN,              /* Return this layout ASAP */
-        NFS_LAYOUT_RETURN_BEFORE_CLOSE, /* Return this layout before close */
+        NFS_LAYOUT_RETURN,              /* layoutreturn in progress */
+        NFS_LAYOUT_RETURN_REQUESTED,    /* Return this layout ASAP */
         NFS_LAYOUT_INVALID_STID,        /* layout stateid id is invalid */
         NFS_LAYOUT_FIRST_LAYOUTGET,     /* Serialize first layoutget */
 };
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index a3cc6d2fc896..a76b9ea7722e 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1254,15 +1254,15 @@ static const struct file_operations o2hb_debug_fops = {
 
 void o2hb_exit(void)
 {
-        kfree(o2hb_db_livenodes);
-        kfree(o2hb_db_liveregions);
-        kfree(o2hb_db_quorumregions);
-        kfree(o2hb_db_failedregions);
         debugfs_remove(o2hb_debug_failedregions);
         debugfs_remove(o2hb_debug_quorumregions);
         debugfs_remove(o2hb_debug_liveregions);
         debugfs_remove(o2hb_debug_livenodes);
         debugfs_remove(o2hb_debug_dir);
+        kfree(o2hb_db_livenodes);
+        kfree(o2hb_db_liveregions);
+        kfree(o2hb_db_quorumregions);
+        kfree(o2hb_db_failedregions);
 }
 
 static struct dentry *o2hb_debug_create(const char *name, struct dentry *dir,
@@ -1438,13 +1438,15 @@ static void o2hb_region_release(struct config_item *item)
 
         kfree(reg->hr_slots);
 
-        kfree(reg->hr_db_regnum);
-        kfree(reg->hr_db_livenodes);
         debugfs_remove(reg->hr_debug_livenodes);
         debugfs_remove(reg->hr_debug_regnum);
         debugfs_remove(reg->hr_debug_elapsed_time);
         debugfs_remove(reg->hr_debug_pinned);
         debugfs_remove(reg->hr_debug_dir);
+        kfree(reg->hr_db_livenodes);
+        kfree(reg->hr_db_regnum);
+        kfree(reg->hr_debug_elapsed_time);
+        kfree(reg->hr_debug_pinned);
 
         spin_lock(&o2hb_live_lock);
         list_del(&reg->hr_all_item);
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index c5bdf02c213b..b94a425f0175 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -2367,6 +2367,8 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
                                                 break;
                                         }
                                 }
+                                dlm_lockres_clear_refmap_bit(dlm, res,
+                                                dead_node);
                                 spin_unlock(&res->spinlock);
                                 continue;
                         }
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 85d16c67c33e..fa95ab2d3674 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -259,23 +259,29 @@ static int do_maps_open(struct inode *inode, struct file *file,
                                 sizeof(struct proc_maps_private));
 }
 
-static pid_t pid_of_stack(struct proc_maps_private *priv,
-                                struct vm_area_struct *vma, bool is_pid)
+/*
+ * Indicate if the VMA is a stack for the given task; for
+ * /proc/PID/maps that is the stack of the main task.
+ */
+static int is_stack(struct proc_maps_private *priv,
+                    struct vm_area_struct *vma, int is_pid)
 {
-        struct inode *inode = priv->inode;
-        struct task_struct *task;
-        pid_t ret = 0;
+        int stack = 0;
+
+        if (is_pid) {
+                stack = vma->vm_start <= vma->vm_mm->start_stack &&
+                        vma->vm_end >= vma->vm_mm->start_stack;
+        } else {
+                struct inode *inode = priv->inode;
+                struct task_struct *task;
 
-        rcu_read_lock();
-        task = pid_task(proc_pid(inode), PIDTYPE_PID);
-        if (task) {
-                task = task_of_stack(task, vma, is_pid);
+                rcu_read_lock();
+                task = pid_task(proc_pid(inode), PIDTYPE_PID);
                 if (task)
-                        ret = task_pid_nr_ns(task, inode->i_sb->s_fs_info);
+                        stack = vma_is_stack_for_task(vma, task);
+                rcu_read_unlock();
         }
-        rcu_read_unlock();
-
-        return ret;
+        return stack;
 }
 
 static void
@@ -335,8 +341,6 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
 
         name = arch_vma_name(vma);
         if (!name) {
-                pid_t tid;
-
                 if (!mm) {
                         name = "[vdso]";
                         goto done;
@@ -348,21 +352,8 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
                         goto done;
                 }
 
-                tid = pid_of_stack(priv, vma, is_pid);
-                if (tid != 0) {
-                        /*
-                         * Thread stack in /proc/PID/task/TID/maps or
-                         * the main process stack.
-                         */
-                        if (!is_pid || (vma->vm_start <= mm->start_stack &&
-                            vma->vm_end >= mm->start_stack)) {
-                                name = "[stack]";
-                        } else {
-                                /* Thread stack in /proc/PID/maps */
-                                seq_pad(m, ' ');
-                                seq_printf(m, "[stack:%d]", tid);
-                        }
-                }
+                if (is_stack(priv, vma, is_pid))
+                        name = "[stack]";
         }
 
 done:
@@ -1552,18 +1543,19 @@ static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
 static int gather_hugetlb_stats(pte_t *pte, unsigned long hmask,
                 unsigned long addr, unsigned long end, struct mm_walk *walk)
 {
+        pte_t huge_pte = huge_ptep_get(pte);
         struct numa_maps *md;
         struct page *page;
 
-        if (!pte_present(*pte))
+        if (!pte_present(huge_pte))
                 return 0;
 
-        page = pte_page(*pte);
+        page = pte_page(huge_pte);
         if (!page)
                 return 0;
 
         md = walk->private;
-        gather_stats(page, md, pte_dirty(*pte), 1);
+        gather_stats(page, md, pte_dirty(huge_pte), 1);
         return 0;
 }
 
@@ -1617,19 +1609,8 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
                 seq_file_path(m, file, "\n\t= ");
         } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
                 seq_puts(m, " heap");
-        } else {
-                pid_t tid = pid_of_stack(proc_priv, vma, is_pid);
-                if (tid != 0) {
-                        /*
-                         * Thread stack in /proc/PID/task/TID/maps or
-                         * the main process stack.
-                         */
-                        if (!is_pid || (vma->vm_start <= mm->start_stack &&
-                            vma->vm_end >= mm->start_stack))
-                                seq_puts(m, " stack");
-                        else
-                                seq_printf(m, " stack:%d", tid);
-                }
+        } else if (is_stack(proc_priv, vma, is_pid)) {
+                seq_puts(m, " stack");
         }
 
         if (is_vm_hugetlb_page(vma))
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index e0d64c92e4f6..faacb0c0d857 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -123,23 +123,26 @@ unsigned long task_statm(struct mm_struct *mm,
         return size;
 }
 
-static pid_t pid_of_stack(struct proc_maps_private *priv,
-                                struct vm_area_struct *vma, bool is_pid)
+static int is_stack(struct proc_maps_private *priv,
+                    struct vm_area_struct *vma, int is_pid)
 {
-        struct inode *inode = priv->inode;
-        struct task_struct *task;
-        pid_t ret = 0;
-
-        rcu_read_lock();
-        task = pid_task(proc_pid(inode), PIDTYPE_PID);
-        if (task) {
-                task = task_of_stack(task, vma, is_pid);
+        struct mm_struct *mm = vma->vm_mm;
+        int stack = 0;
+
+        if (is_pid) {
+                stack = vma->vm_start <= mm->start_stack &&
+                        vma->vm_end >= mm->start_stack;
+        } else {
+                struct inode *inode = priv->inode;
+                struct task_struct *task;
+
+                rcu_read_lock();
+                task = pid_task(proc_pid(inode), PIDTYPE_PID);
                 if (task)
-                        ret = task_pid_nr_ns(task, inode->i_sb->s_fs_info);
+                        stack = vma_is_stack_for_task(vma, task);
+                rcu_read_unlock();
         }
-        rcu_read_unlock();
-
-        return ret;
+        return stack;
 }
 
 /*
@@ -181,21 +184,9 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma,
         if (file) {
                 seq_pad(m, ' ');
                 seq_file_path(m, file, "");
-        } else if (mm) {
-                pid_t tid = pid_of_stack(priv, vma, is_pid);
-
-                if (tid != 0) {
-                        seq_pad(m, ' ');
-                        /*
-                         * Thread stack in /proc/PID/task/TID/maps or
-                         * the main process stack.
-                         */
-                        if (!is_pid || (vma->vm_start <= mm->start_stack &&
-                            vma->vm_end >= mm->start_stack))
-                                seq_printf(m, "[stack]");
-                        else
-                                seq_printf(m, "[stack:%d]", tid);
-                }
+        } else if (mm && is_stack(priv, vma, is_pid)) {
+                seq_pad(m, ' ');
+                seq_printf(m, "[stack]");
         }
 
         seq_putc(m, '\n');
diff --git a/fs/timerfd.c b/fs/timerfd.c
index b94fa6c3c6eb..053818dd6c18 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -153,7 +153,7 @@ static ktime_t timerfd_get_remaining(struct timerfd_ctx *ctx)
         if (isalarm(ctx))
                 remaining = alarm_expires_remaining(&ctx->t.alarm);
         else
-                remaining = hrtimer_expires_remaining(&ctx->t.tmr);
+                remaining = hrtimer_expires_remaining_adjusted(&ctx->t.tmr);
 
         return remaining.tv64 < 0 ? ktime_set(0, 0): remaining;
 }
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index da37beb76f6e..594f7e63b432 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -4491,7 +4491,7 @@ xlog_recover_process(
          * know precisely what failed.
          */
         if (pass == XLOG_RECOVER_CRCPASS) {
-                if (rhead->h_crc && crc != le32_to_cpu(rhead->h_crc))
+                if (rhead->h_crc && crc != rhead->h_crc)
                         return -EFSBADCRC;
                 return 0;
         }
@@ -4502,7 +4502,7 @@ xlog_recover_process(
          * zero CRC check prevents warnings from being emitted when upgrading
          * the kernel from one that does not add CRCs by default.
          */
-        if (crc != le32_to_cpu(rhead->h_crc)) {
+        if (crc != rhead->h_crc) {
                 if (rhead->h_crc || xfs_sb_version_hascrc(&log->l_mp->m_sb)) {
                         xfs_alert(log->l_mp,
                 "log record CRC mismatch: found 0x%x, expected 0x%x.",