11 files changed, 133 insertions, 52 deletions

diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index 32602c667b4a..7892e6fddb66 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -38,21 +38,30 @@ int hfsplus_cat_bin_cmp_key(const hfsplus_btree_key *k1,
         return hfsplus_strcmp(&k1->cat.name, &k2->cat.name);
 }
 
-void hfsplus_cat_build_key(struct super_block *sb, hfsplus_btree_key *key,
-                           u32 parent, struct qstr *str)
+/* Generates key for catalog file/folders record. */
+int hfsplus_cat_build_key(struct super_block *sb,
+                hfsplus_btree_key *key, u32 parent, struct qstr *str)
 {
-        int len;
+        int len, err;
 
         key->cat.parent = cpu_to_be32(parent);
-        if (str) {
-                hfsplus_asc2uni(sb, &key->cat.name, HFSPLUS_MAX_STRLEN,
-                                        str->name, str->len);
-                len = be16_to_cpu(key->cat.name.length);
-        } else {
-                key->cat.name.length = 0;
-                len = 0;
-        }
+        err = hfsplus_asc2uni(sb, &key->cat.name, HFSPLUS_MAX_STRLEN,
+                        str->name, str->len);
+        if (unlikely(err < 0))
+                return err;
+
+        len = be16_to_cpu(key->cat.name.length);
         key->key_len = cpu_to_be16(6 + 2 * len);
+        return 0;
+}
+
+/* Generates key for catalog thread record. */
+void hfsplus_cat_build_key_with_cnid(struct super_block *sb,
+                        hfsplus_btree_key *key, u32 parent)
+{
+        key->cat.parent = cpu_to_be32(parent);
+        key->cat.name.length = 0;
+        key->key_len = cpu_to_be16(6);
 }
 
 static void hfsplus_cat_build_key_uni(hfsplus_btree_key *key, u32 parent,
@@ -167,11 +176,16 @@ static int hfsplus_fill_cat_thread(struct super_block *sb,
                                    hfsplus_cat_entry *entry, int type,
                                    u32 parentid, struct qstr *str)
 {
+        int err;
+
         entry->type = cpu_to_be16(type);
         entry->thread.reserved = 0;
         entry->thread.parentID = cpu_to_be32(parentid);
-        hfsplus_asc2uni(sb, &entry->thread.nodeName, HFSPLUS_MAX_STRLEN,
+        err = hfsplus_asc2uni(sb, &entry->thread.nodeName, HFSPLUS_MAX_STRLEN,
                                 str->name, str->len);
+        if (unlikely(err < 0))
+                return err;
+
         return 10 + be16_to_cpu(entry->thread.nodeName.length) * 2;
 }
 
@@ -183,7 +197,7 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
         int err;
         u16 type;
 
-        hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
+        hfsplus_cat_build_key_with_cnid(sb, fd->search_key, cnid);
         err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
         if (err)
                 return err;
@@ -250,11 +264,16 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
         if (err)
                 return err;
 
-        hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL);
+        hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
         entry_size = hfsplus_fill_cat_thread(sb, &entry,
                 S_ISDIR(inode->i_mode) ?
                         HFSPLUS_FOLDER_THREAD : HFSPLUS_FILE_THREAD,
                 dir->i_ino, str);
+        if (unlikely(entry_size < 0)) {
+                err = entry_size;
+                goto err2;
+        }
+
         err = hfs_brec_find(&fd, hfs_find_rec_by_key);
         if (err != -ENOENT) {
                 if (!err)
@@ -265,7 +284,10 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
         if (err)
                 goto err2;
 
-        hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);
+        err = hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);
+        if (unlikely(err))
+                goto err1;
+
         entry_size = hfsplus_cat_build_record(&entry, cnid, inode);
         err = hfs_brec_find(&fd, hfs_find_rec_by_key);
         if (err != -ENOENT) {
@@ -288,7 +310,7 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
         return 0;
 
 err1:
-        hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL);
+        hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
         if (!hfs_brec_find(&fd, hfs_find_rec_by_key))
                 hfs_brec_remove(&fd);
 err2:
@@ -313,7 +335,7 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
         if (!str) {
                 int len;
 
-                hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL);
+                hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
                 err = hfs_brec_find(&fd, hfs_find_rec_by_key);
                 if (err)
                         goto out;
@@ -329,7 +351,9 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
                         off + 2, len);
                 fd.search_key->key_len = cpu_to_be16(6 + len);
         } else
-                hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);
+                err = hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, str);
+                if (unlikely(err))
+                        goto out;
 
         err = hfs_brec_find(&fd, hfs_find_rec_by_key);
         if (err)
@@ -360,7 +384,7 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
         if (err)
                 goto out;
 
-        hfsplus_cat_build_key(sb, fd.search_key, cnid, NULL);
+        hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
         err = hfs_brec_find(&fd, hfs_find_rec_by_key);
         if (err)
                 goto out;
@@ -405,7 +429,11 @@ int hfsplus_rename_cat(u32 cnid,
         dst_fd = src_fd;
 
         /* find the old dir entry and read the data */
-        hfsplus_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name);
+        err = hfsplus_cat_build_key(sb, src_fd.search_key,
+                        src_dir->i_ino, src_name);
+        if (unlikely(err))
+                goto out;
+
         err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);
         if (err)
                 goto out;
@@ -419,7 +447,11 @@ int hfsplus_rename_cat(u32 cnid,
         type = be16_to_cpu(entry.type);
 
         /* create new dir entry with the data from the old entry */
-        hfsplus_cat_build_key(sb, dst_fd.search_key, dst_dir->i_ino, dst_name);
+        err = hfsplus_cat_build_key(sb, dst_fd.search_key,
+                        dst_dir->i_ino, dst_name);
+        if (unlikely(err))
+                goto out;
+
         err = hfs_brec_find(&dst_fd, hfs_find_rec_by_key);
         if (err != -ENOENT) {
                 if (!err)
@@ -436,7 +468,11 @@ int hfsplus_rename_cat(u32 cnid,
         dst_dir->i_mtime = dst_dir->i_ctime = CURRENT_TIME_SEC;
 
         /* finally remove the old entry */
-        hfsplus_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name);
+        err = hfsplus_cat_build_key(sb, src_fd.search_key,
+                        src_dir->i_ino, src_name);
+        if (unlikely(err))
+                goto out;
+
         err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);
         if (err)
                 goto out;
@@ -449,7 +485,7 @@ int hfsplus_rename_cat(u32 cnid,
         src_dir->i_mtime = src_dir->i_ctime = CURRENT_TIME_SEC;
 
         /* remove old thread entry */
-        hfsplus_cat_build_key(sb, src_fd.search_key, cnid, NULL);
+        hfsplus_cat_build_key_with_cnid(sb, src_fd.search_key, cnid);
         err = hfs_brec_find(&src_fd, hfs_find_rec_by_key);
         if (err)
                 goto out;
@@ -459,9 +495,14 @@ int hfsplus_rename_cat(u32 cnid,
                 goto out;
 
         /* create new thread entry */
-        hfsplus_cat_build_key(sb, dst_fd.search_key, cnid, NULL);
+        hfsplus_cat_build_key_with_cnid(sb, dst_fd.search_key, cnid);
         entry_size = hfsplus_fill_cat_thread(sb, &entry, type,
                 dst_dir->i_ino, dst_name);
+        if (unlikely(entry_size < 0)) {
+                err = entry_size;
+                goto out;
+        }
+
         err = hfs_brec_find(&dst_fd, hfs_find_rec_by_key);
         if (err != -ENOENT) {
                 if (!err)
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index 610a3260bef1..435bea231cc6 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -44,7 +44,10 @@ static struct dentry *hfsplus_lookup(struct inode *dir, struct dentry *dentry,
         err = hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
         if (err)
                 return ERR_PTR(err);
-        hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino, &dentry->d_name);
+        err = hfsplus_cat_build_key(sb, fd.search_key, dir->i_ino,
+                        &dentry->d_name);
+        if (unlikely(err < 0))
+                goto fail;
 again:
         err = hfs_brec_read(&fd, &entry, sizeof(entry));
         if (err) {
@@ -97,9 +100,11 @@ again:
                                         be32_to_cpu(entry.file.permissions.dev);
                                 str.len = sprintf(name, "iNode%d", linkid);
                                 str.name = name;
-                                hfsplus_cat_build_key(sb, fd.search_key,
+                                err = hfsplus_cat_build_key(sb, fd.search_key,
                                         HFSPLUS_SB(sb)->hidden_dir->i_ino,
                                         &str);
+                                if (unlikely(err < 0))
+                                        goto fail;
                                 goto again;
                         }
                 } else if (!dentry->d_fsdata)
@@ -145,7 +150,7 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx)
                 err = -ENOMEM;
                 goto out;
         }
-        hfsplus_cat_build_key(sb, fd.search_key, inode->i_ino, NULL);
+        hfsplus_cat_build_key_with_cnid(sb, fd.search_key, inode->i_ino);
         err = hfs_brec_find(&fd, hfs_find_rec_by_key);
         if (err)
                 goto out;
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index eb5e059f481a..b0441d65fa54 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -443,8 +443,10 @@ int hfsplus_cat_case_cmp_key(const hfsplus_btree_key *k1,
                              const hfsplus_btree_key *k2);
 int hfsplus_cat_bin_cmp_key(const hfsplus_btree_key *k1,
                             const hfsplus_btree_key *k2);
-void hfsplus_cat_build_key(struct super_block *sb, hfsplus_btree_key *key,
+int hfsplus_cat_build_key(struct super_block *sb, hfsplus_btree_key *key,
                            u32 parent, struct qstr *str);
+void hfsplus_cat_build_key_with_cnid(struct super_block *sb,
+                                     hfsplus_btree_key *key, u32 parent);
 void hfsplus_cat_set_perms(struct inode *inode, struct hfsplus_perm *perms);
 int hfsplus_find_cat(struct super_block *sb, u32 cnid,
                      struct hfs_find_data *fd);
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 4cf2024b87da..593af2fdcc2d 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -515,7 +515,9 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         err = hfs_find_init(sbi->cat_tree, &fd);
         if (err)
                 goto out_put_root;
-        hfsplus_cat_build_key(sb, fd.search_key, HFSPLUS_ROOT_CNID, &str);
+        err = hfsplus_cat_build_key(sb, fd.search_key, HFSPLUS_ROOT_CNID, &str);
+        if (unlikely(err < 0))
+                goto out_put_root;
         if (!hfs_brec_read(&fd, &entry, sizeof(entry))) {
                 hfs_find_exit(&fd);
                 if (entry.type != cpu_to_be16(HFSPLUS_FOLDER))
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index a93bf9892256..fcae9ef1a328 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -5662,7 +5662,7 @@ int ocfs2_remove_btree_range(struct inode *inode,
                              struct ocfs2_extent_tree *et,
                              u32 cpos, u32 phys_cpos, u32 len, int flags,
                              struct ocfs2_cached_dealloc_ctxt *dealloc,
-                             u64 refcount_loc)
+                             u64 refcount_loc, bool refcount_tree_locked)
 {
         int ret, credits = 0, extra_blocks = 0;
         u64 phys_blkno = ocfs2_clusters_to_blocks(inode->i_sb, phys_cpos);
@@ -5676,11 +5676,13 @@ int ocfs2_remove_btree_range(struct inode *inode,
                 BUG_ON(!(OCFS2_I(inode)->ip_dyn_features &
                          OCFS2_HAS_REFCOUNT_FL));
 
-                ret = ocfs2_lock_refcount_tree(osb, refcount_loc, 1,
-                                               &ref_tree, NULL);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto bail;
+                if (!refcount_tree_locked) {
+                        ret = ocfs2_lock_refcount_tree(osb, refcount_loc, 1,
+                                                       &ref_tree, NULL);
+                        if (ret) {
+                                mlog_errno(ret);
+                                goto bail;
+                        }
                 }
 
                 ret = ocfs2_prepare_refcount_change_for_del(inode,
@@ -7021,6 +7023,7 @@ int ocfs2_commit_truncate(struct ocfs2_super *osb,
         u64 refcount_loc = le64_to_cpu(di->i_refcount_loc);
         struct ocfs2_extent_tree et;
         struct ocfs2_cached_dealloc_ctxt dealloc;
+        struct ocfs2_refcount_tree *ref_tree = NULL;
 
         ocfs2_init_dinode_extent_tree(&et, INODE_CACHE(inode), di_bh);
         ocfs2_init_dealloc_ctxt(&dealloc);
@@ -7130,9 +7133,18 @@ start:
 
         phys_cpos = ocfs2_blocks_to_clusters(inode->i_sb, blkno);
 
+        if ((flags & OCFS2_EXT_REFCOUNTED) && trunc_len && !ref_tree) {
+                status = ocfs2_lock_refcount_tree(osb, refcount_loc, 1,
+                                &ref_tree, NULL);
+                if (status) {
+                        mlog_errno(status);
+                        goto bail;
+                }
+        }
+
         status = ocfs2_remove_btree_range(inode, &et, trunc_cpos,
                                           phys_cpos, trunc_len, flags, &dealloc,
-                                          refcount_loc);
+                                          refcount_loc, true);
         if (status < 0) {
                 mlog_errno(status);
                 goto bail;
@@ -7147,6 +7159,8 @@ start:
         goto start;
 
 bail:
+        if (ref_tree)
+                ocfs2_unlock_refcount_tree(osb, ref_tree, 1);
 
         ocfs2_schedule_truncate_log_flush(osb, 1);
 
diff --git a/fs/ocfs2/alloc.h b/fs/ocfs2/alloc.h
index ca381c584127..fb09b97db162 100644
--- a/fs/ocfs2/alloc.h
+++ b/fs/ocfs2/alloc.h
@@ -142,7 +142,7 @@ int ocfs2_remove_btree_range(struct inode *inode,
                              struct ocfs2_extent_tree *et,
                              u32 cpos, u32 phys_cpos, u32 len, int flags,
                              struct ocfs2_cached_dealloc_ctxt *dealloc,
-                             u64 refcount_loc);
+                             u64 refcount_loc, bool refcount_tree_locked);
 
 int ocfs2_num_free_extents(struct ocfs2_super *osb,
                            struct ocfs2_extent_tree *et);
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index d9f222987f24..46d93e941f3d 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -894,7 +894,7 @@ void ocfs2_unlock_and_free_pages(struct page **pages, int num_pages)
         }
 }
 
-static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
+static void ocfs2_unlock_pages(struct ocfs2_write_ctxt *wc)
 {
         int i;
 
@@ -915,7 +915,11 @@ static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
                 page_cache_release(wc->w_target_page);
         }
         ocfs2_unlock_and_free_pages(wc->w_pages, wc->w_num_pages);
+}
 
+static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
+{
+        ocfs2_unlock_pages(wc);
         brelse(wc->w_di_bh);
         kfree(wc);
 }
@@ -2042,11 +2046,19 @@ out_write_size:
         ocfs2_update_inode_fsync_trans(handle, inode, 1);
         ocfs2_journal_dirty(handle, wc->w_di_bh);
 
+        /* unlock pages before dealloc since it needs acquiring j_trans_barrier
+         * lock, or it will cause a deadlock since journal commit threads holds
+         * this lock and will ask for the page lock when flushing the data.
+         * put it here to preserve the unlock order.
+         */
+        ocfs2_unlock_pages(wc);
+
         ocfs2_commit_trans(osb, handle);
 
         ocfs2_run_deallocs(osb, &wc->w_dealloc);
 
-        ocfs2_free_write_ctxt(wc);
+        brelse(wc->w_di_bh);
+        kfree(wc);
 
         return copied;
 }
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index 79d56dc981bc..319e786175af 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -4479,7 +4479,7 @@ int ocfs2_dx_dir_truncate(struct inode *dir, struct buffer_head *di_bh)
                 p_cpos = ocfs2_blocks_to_clusters(dir->i_sb, blkno);
 
                 ret = ocfs2_remove_btree_range(dir, &et, cpos, p_cpos, clen, 0,
-                                               &dealloc, 0);
+                                               &dealloc, 0, false);
                 if (ret) {
                         mlog_errno(ret);
                         goto out;
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 3689b3592042..a6944b25fd5b 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -695,14 +695,6 @@ void __dlm_lockres_grab_inflight_worker(struct dlm_ctxt *dlm,
                         res->inflight_assert_workers);
 }
 
-static void dlm_lockres_grab_inflight_worker(struct dlm_ctxt *dlm,
-                struct dlm_lock_resource *res)
-{
-        spin_lock(&res->spinlock);
-        __dlm_lockres_grab_inflight_worker(dlm, res);
-        spin_unlock(&res->spinlock);
-}
-
 static void __dlm_lockres_drop_inflight_worker(struct dlm_ctxt *dlm,
                 struct dlm_lock_resource *res)
 {
@@ -1646,6 +1638,7 @@ send_response:
                 }
                 mlog(0, "%u is the owner of %.*s, cleaning everyone else\n",
                              dlm->node_num, res->lockname.len, res->lockname.name);
+                spin_lock(&res->spinlock);
                 ret = dlm_dispatch_assert_master(dlm, res, 0, request->node_idx,
                                                  DLM_ASSERT_MASTER_MLE_CLEANUP);
                 if (ret < 0) {
@@ -1653,7 +1646,8 @@ send_response:
                         response = DLM_MASTER_RESP_ERROR;
                         dlm_lockres_put(res);
                 } else
-                        dlm_lockres_grab_inflight_worker(dlm, res);
+                        __dlm_lockres_grab_inflight_worker(dlm, res);
+                spin_unlock(&res->spinlock);
         } else {
                 if (res)
                         dlm_lockres_put(res);
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 69fb9f75b082..3950693dd0f6 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1803,7 +1803,7 @@ static int ocfs2_remove_inode_range(struct inode *inode,
 
                 ret = ocfs2_remove_btree_range(inode, &et, trunc_cpos,
                                                phys_cpos, trunc_len, flags,
-                                               &dealloc, refcount_loc);
+                                               &dealloc, refcount_loc, false);
                 if (ret < 0) {
                         mlog_errno(ret);
                         goto out;
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index aa1eee06420f..d3ebf2e61853 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -12,6 +12,9 @@
 #include <linux/vmstat.h>
 #include <linux/atomic.h>
 #include <linux/vmalloc.h>
+#ifdef CONFIG_CMA
+#include <linux/cma.h>
+#endif
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include "internal.h"
@@ -138,6 +141,10 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
                 "AnonHugePages:  %8lu kB\n"
 #endif
+#ifdef CONFIG_CMA
+                "CmaTotal:       %8lu kB\n"
+                "CmaFree:        %8lu kB\n"
+#endif
                 ,
                 K(i.totalram),
                 K(i.freeram),
@@ -187,12 +194,16 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
                 vmi.used >> 10,
                 vmi.largest_chunk >> 10
 #ifdef CONFIG_MEMORY_FAILURE
-                ,atomic_long_read(&num_poisoned_pages) << (PAGE_SHIFT - 10)
+                , atomic_long_read(&num_poisoned_pages) << (PAGE_SHIFT - 10)
 #endif
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
-                ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
+                , K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
                    HPAGE_PMD_NR)
 #endif
+#ifdef CONFIG_CMA
+                , K(totalcma_pages)
+                , K(global_page_state(NR_FREE_CMA_PAGES))
+#endif
                 );
 
         hugetlb_report_meminfo(m);