26 files changed, 376 insertions, 284 deletions

diff --git a/fs/affs/affs.h b/fs/affs/affs.h
index 9bca88159725..ff44ff3ff015 100644
--- a/fs/affs/affs.h
+++ b/fs/affs/affs.h
@@ -135,8 +135,10 @@ extern void	affs_fix_checksum(struct super_block *sb, struct buffer_head *bh);
 extern void     secs_to_datestamp(time_t secs, struct affs_date *ds);
 extern umode_t  prot_to_mode(u32 prot);
 extern void     mode_to_prot(struct inode *inode);
+__printf(3, 4)
 extern void     affs_error(struct super_block *sb, const char *function,
                            const char *fmt, ...);
+__printf(3, 4)
 extern void     affs_warning(struct super_block *sb, const char *function,
                              const char *fmt, ...);
 extern bool     affs_nofilenametruncate(const struct dentry *dentry);
diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
index 937ce8754b24..c852f2fa1710 100644
--- a/fs/affs/amigaffs.c
+++ b/fs/affs/amigaffs.c
@@ -10,8 +10,6 @@
 
 #include "affs.h"
 
-static char ErrorBuffer[256];
-
 /*
  * Functions for accessing Amiga-FFS structures.
  */
@@ -444,30 +442,30 @@ mode_to_prot(struct inode *inode)
 void
 affs_error(struct super_block *sb, const char *function, const char *fmt, ...)
 {
-        va_list  args;
-
-        va_start(args,fmt);
-        vsnprintf(ErrorBuffer,sizeof(ErrorBuffer),fmt,args);
-        va_end(args);
+        struct va_format vaf;
+        va_list args;
 
-        pr_crit("error (device %s): %s(): %s\n", sb->s_id,
-                function,ErrorBuffer);
+        va_start(args, fmt);
+        vaf.fmt = fmt;
+        vaf.va = &args;
+        pr_crit("error (device %s): %s(): %pV\n", sb->s_id, function, &vaf);
         if (!(sb->s_flags & MS_RDONLY))
                 pr_warn("Remounting filesystem read-only\n");
         sb->s_flags |= MS_RDONLY;
+        va_end(args);
 }
 
 void
 affs_warning(struct super_block *sb, const char *function, const char *fmt, ...)
 {
-        va_list  args;
+        struct va_format vaf;
+        va_list args;
 
-        va_start(args,fmt);
-        vsnprintf(ErrorBuffer,sizeof(ErrorBuffer),fmt,args);
+        va_start(args, fmt);
+        vaf.fmt = fmt;
+        vaf.va = &args;
+        pr_warn("(device %s): %s(): %pV\n", sb->s_id, function, &vaf);
         va_end(args);
-
-        pr_warn("(device %s): %s(): %s\n", sb->s_id,
-                function,ErrorBuffer);
 }
 
 bool
diff --git a/fs/affs/file.c b/fs/affs/file.c
index 1ed590aafecf..8faa6593ca6d 100644
--- a/fs/affs/file.c
+++ b/fs/affs/file.c
@@ -12,35 +12,10 @@
  *  affs regular file handling primitives
  */
 
+#include <linux/aio.h>
 #include "affs.h"
 
-#if PAGE_SIZE < 4096
-#error PAGE_SIZE must be at least 4096
-#endif
-
-static int affs_grow_extcache(struct inode *inode, u32 lc_idx);
-static struct buffer_head *affs_alloc_extblock(struct inode *inode, struct buffer_head *bh, u32 ext);
-static inline struct buffer_head *affs_get_extblock(struct inode *inode, u32 ext);
 static struct buffer_head *affs_get_extblock_slow(struct inode *inode, u32 ext);
-static int affs_file_open(struct inode *inode, struct file *filp);
-static int affs_file_release(struct inode *inode, struct file *filp);
-
-const struct file_operations affs_file_operations = {
-        .llseek         = generic_file_llseek,
-        .read           = new_sync_read,
-        .read_iter      = generic_file_read_iter,
-        .write          = new_sync_write,
-        .write_iter     = generic_file_write_iter,
-        .mmap           = generic_file_mmap,
-        .open           = affs_file_open,
-        .release        = affs_file_release,
-        .fsync          = affs_file_fsync,
-        .splice_read    = generic_file_splice_read,
-};
-
-const struct inode_operations affs_file_inode_operations = {
-        .setattr        = affs_notify_change,
-};
 
 static int
 affs_file_open(struct inode *inode, struct file *filp)
@@ -355,7 +330,8 @@ affs_get_block(struct inode *inode, sector_t block, struct buffer_head *bh_resul
 
                 /* store new block */
                 if (bh_result->b_blocknr)
-                        affs_warning(sb, "get_block", "block already set (%x)", bh_result->b_blocknr);
+                        affs_warning(sb, "get_block", "block already set (%lx)",
+                                     (unsigned long)bh_result->b_blocknr);
                 AFFS_BLOCK(sb, ext_bh, block) = cpu_to_be32(blocknr);
                 AFFS_HEAD(ext_bh)->block_count = cpu_to_be32(block + 1);
                 affs_adjust_checksum(ext_bh, blocknr - bh_result->b_blocknr + 1);
@@ -377,7 +353,8 @@ affs_get_block(struct inode *inode, sector_t block, struct buffer_head *bh_resul
         return 0;
 
 err_big:
-        affs_error(inode->i_sb,"get_block","strange block request %d", block);
+        affs_error(inode->i_sb, "get_block", "strange block request %d",
+                   (int)block);
         return -EIO;
 err_ext:
         // unlock cache
@@ -412,6 +389,22 @@ static void affs_write_failed(struct address_space *mapping, loff_t to)
         }
 }
 
+static ssize_t
+affs_direct_IO(int rw, struct kiocb *iocb, struct iov_iter *iter,
+               loff_t offset)
+{
+        struct file *file = iocb->ki_filp;
+        struct address_space *mapping = file->f_mapping;
+        struct inode *inode = mapping->host;
+        size_t count = iov_iter_count(iter);
+        ssize_t ret;
+
+        ret = blockdev_direct_IO(rw, iocb, inode, iter, offset, affs_get_block);
+        if (ret < 0 && (rw & WRITE))
+                affs_write_failed(mapping, offset + count);
+        return ret;
+}
+
 static int affs_write_begin(struct file *file, struct address_space *mapping,
                         loff_t pos, unsigned len, unsigned flags,
                         struct page **pagep, void **fsdata)
@@ -438,6 +431,7 @@ const struct address_space_operations affs_aops = {
         .writepage = affs_writepage,
         .write_begin = affs_write_begin,
         .write_end = generic_write_end,
+        .direct_IO = affs_direct_IO,
         .bmap = _affs_bmap
 };
 
@@ -867,8 +861,9 @@ affs_truncate(struct inode *inode)
         // lock cache
         ext_bh = affs_get_extblock(inode, ext);
         if (IS_ERR(ext_bh)) {
-                affs_warning(sb, "truncate", "unexpected read error for ext block %u (%d)",
-                             ext, PTR_ERR(ext_bh));
+                affs_warning(sb, "truncate",
+                             "unexpected read error for ext block %u (%ld)",
+                             (unsigned int)ext, PTR_ERR(ext_bh));
                 return;
         }
         if (AFFS_I(inode)->i_lc) {
@@ -914,8 +909,9 @@ affs_truncate(struct inode *inode)
                         struct buffer_head *bh = affs_bread_ino(inode, last_blk, 0);
                         u32 tmp;
                         if (IS_ERR(bh)) {
-                                affs_warning(sb, "truncate", "unexpected read error for last block %u (%d)",
-                                             ext, PTR_ERR(bh));
+                                affs_warning(sb, "truncate",
+                                             "unexpected read error for last block %u (%ld)",
+                                             (unsigned int)ext, PTR_ERR(bh));
                                 return;
                         }
                         tmp = be32_to_cpu(AFFS_DATA_HEAD(bh)->next);
@@ -961,3 +957,19 @@ int affs_file_fsync(struct file *filp, loff_t start, loff_t end, int datasync)
         mutex_unlock(&inode->i_mutex);
         return ret;
 }
+const struct file_operations affs_file_operations = {
+        .llseek         = generic_file_llseek,
+        .read           = new_sync_read,
+        .read_iter      = generic_file_read_iter,
+        .write          = new_sync_write,
+        .write_iter     = generic_file_write_iter,
+        .mmap           = generic_file_mmap,
+        .open           = affs_file_open,
+        .release        = affs_file_release,
+        .fsync          = affs_file_fsync,
+        .splice_read    = generic_file_splice_read,
+};
+
+const struct inode_operations affs_file_inode_operations = {
+        .setattr        = affs_notify_change,
+};
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index b94d1cc9cd30..edf47774b03d 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -269,10 +269,6 @@ more:
         }
         ctx->pos++;
         goto more;
-
-        befs_debug(sb, "<--- %s pos %lld", __func__, ctx->pos);
-
-        return 0;
 }
 
 static struct inode *
diff --git a/fs/binfmt_em86.c b/fs/binfmt_em86.c
index f37b08cea1f7..490538536cb4 100644
--- a/fs/binfmt_em86.c
+++ b/fs/binfmt_em86.c
@@ -42,6 +42,10 @@ static int load_em86(struct linux_binprm *bprm)
                         return -ENOEXEC;
         }
 
+        /* Need to be able to load the file after exec */
+        if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE)
+                return -ENOENT;
+
         allow_write_access(bprm->file);
         fput(bprm->file);
         bprm->file = NULL;
diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index 70789e198dea..c04ef1d4f18a 100644
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -144,6 +144,10 @@ static int load_misc_binary(struct linux_binprm *bprm)
         if (!fmt)
                 goto ret;
 
+        /* Need to be able to load the file after exec */
+        if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE)
+                return -ENOENT;
+
         if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
                 retval = remove_arg_zero(bprm);
                 if (retval)
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index 5027a3e14922..afdf4e3cafc2 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -24,6 +24,16 @@ static int load_script(struct linux_binprm *bprm)
 
         if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
                 return -ENOEXEC;
+
+        /*
+         * If the script filename will be inaccessible after exec, typically
+         * because it is a "/dev/fd/<fd>/.." path against an O_CLOEXEC fd, give
+         * up now (on the assumption that the interpreter will want to load
+         * this file).
+         */
+        if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE)
+                return -ENOENT;
+
         /*
          * This section does the #! interpretation.
          * Sorta complicated, but hopefully it will work.  -TYT
diff --git a/fs/drop_caches.c b/fs/drop_caches.c
index 1de7294aad20..2bc2c87f35e7 100644
--- a/fs/drop_caches.c
+++ b/fs/drop_caches.c
@@ -40,13 +40,14 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
 static void drop_slab(void)
 {
         int nr_objects;
-        struct shrink_control shrink = {
-                .gfp_mask = GFP_KERNEL,
-        };
 
-        nodes_setall(shrink.nodes_to_scan);
         do {
-                nr_objects = shrink_slab(&shrink, 1000, 1000);
+                int nid;
+
+                nr_objects = 0;
+                for_each_online_node(nid)
+                        nr_objects += shrink_node_slabs(GFP_KERNEL, nid,
+                                                        1000, 1000);
         } while (nr_objects > 10);
 }
 
diff --git a/fs/exec.c b/fs/exec.c
index 01aebe300200..ad8798e26be9 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -748,18 +748,25 @@ EXPORT_SYMBOL(setup_arg_pages);
 
 #endif /* CONFIG_MMU */
 
-static struct file *do_open_exec(struct filename *name)
+static struct file *do_open_execat(int fd, struct filename *name, int flags)
 {
         struct file *file;
         int err;
-        static const struct open_flags open_exec_flags = {
+        struct open_flags open_exec_flags = {
                 .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
                 .acc_mode = MAY_EXEC | MAY_OPEN,
                 .intent = LOOKUP_OPEN,
                 .lookup_flags = LOOKUP_FOLLOW,
         };
 
-        file = do_filp_open(AT_FDCWD, name, &open_exec_flags);
+        if ((flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
+                return ERR_PTR(-EINVAL);
+        if (flags & AT_SYMLINK_NOFOLLOW)
+                open_exec_flags.lookup_flags &= ~LOOKUP_FOLLOW;
+        if (flags & AT_EMPTY_PATH)
+                open_exec_flags.lookup_flags |= LOOKUP_EMPTY;
+
+        file = do_filp_open(fd, name, &open_exec_flags);
         if (IS_ERR(file))
                 goto out;
 
@@ -770,12 +777,13 @@ static struct file *do_open_exec(struct filename *name)
         if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)
                 goto exit;
 
-        fsnotify_open(file);
-
         err = deny_write_access(file);
         if (err)
                 goto exit;
 
+        if (name->name[0] != '\0')
+                fsnotify_open(file);
+
 out:
         return file;
 
@@ -787,7 +795,7 @@ exit:
 struct file *open_exec(const char *name)
 {
         struct filename tmp = { .name = name };
-        return do_open_exec(&tmp);
+        return do_open_execat(AT_FDCWD, &tmp, 0);
 }
 EXPORT_SYMBOL(open_exec);
 
@@ -1428,10 +1436,12 @@ static int exec_binprm(struct linux_binprm *bprm)
 /*
  * sys_execve() executes a new program.
  */
-static int do_execve_common(struct filename *filename,
-                                struct user_arg_ptr argv,
-                                struct user_arg_ptr envp)
+static int do_execveat_common(int fd, struct filename *filename,
+                              struct user_arg_ptr argv,
+                              struct user_arg_ptr envp,
+                              int flags)
 {
+        char *pathbuf = NULL;
         struct linux_binprm *bprm;
         struct file *file;
         struct files_struct *displaced;
@@ -1472,7 +1482,7 @@ static int do_execve_common(struct filename *filename,
         check_unsafe_exec(bprm);
         current->in_execve = 1;
 
-        file = do_open_exec(filename);
+        file = do_open_execat(fd, filename, flags);
         retval = PTR_ERR(file);
         if (IS_ERR(file))
                 goto out_unmark;
@@ -1480,7 +1490,28 @@ static int do_execve_common(struct filename *filename,
         sched_exec();
 
         bprm->file = file;
-        bprm->filename = bprm->interp = filename->name;
+        if (fd == AT_FDCWD || filename->name[0] == '/') {
+                bprm->filename = filename->name;
+        } else {
+                if (filename->name[0] == '\0')
+                        pathbuf = kasprintf(GFP_TEMPORARY, "/dev/fd/%d", fd);
+                else
+                        pathbuf = kasprintf(GFP_TEMPORARY, "/dev/fd/%d/%s",
+                                            fd, filename->name);
+                if (!pathbuf) {
+                        retval = -ENOMEM;
+                        goto out_unmark;
+                }
+                /*
+                 * Record that a name derived from an O_CLOEXEC fd will be
+                 * inaccessible after exec. Relies on having exclusive access to
+                 * current->files (due to unshare_files above).
+                 */
+                if (close_on_exec(fd, rcu_dereference_raw(current->files->fdt)))
+                        bprm->interp_flags |= BINPRM_FLAGS_PATH_INACCESSIBLE;
+                bprm->filename = pathbuf;
+        }
+        bprm->interp = bprm->filename;
 
         retval = bprm_mm_init(bprm);
         if (retval)
@@ -1521,6 +1552,7 @@ static int do_execve_common(struct filename *filename,
         acct_update_integrals(current);
         task_numa_free(current);
         free_bprm(bprm);
+        kfree(pathbuf);
         putname(filename);
         if (displaced)
                 put_files_struct(displaced);
@@ -1538,6 +1570,7 @@ out_unmark:
 
 out_free:
         free_bprm(bprm);
+        kfree(pathbuf);
 
 out_files:
         if (displaced)
@@ -1553,7 +1586,18 @@ int do_execve(struct filename *filename,
 {
         struct user_arg_ptr argv = { .ptr.native = __argv };
         struct user_arg_ptr envp = { .ptr.native = __envp };
-        return do_execve_common(filename, argv, envp);
+        return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
+}
+
+int do_execveat(int fd, struct filename *filename,
+                const char __user *const __user *__argv,
+                const char __user *const __user *__envp,
+                int flags)
+{
+        struct user_arg_ptr argv = { .ptr.native = __argv };
+        struct user_arg_ptr envp = { .ptr.native = __envp };
+
+        return do_execveat_common(fd, filename, argv, envp, flags);
 }
 
 #ifdef CONFIG_COMPAT
@@ -1569,7 +1613,23 @@ static int compat_do_execve(struct filename *filename,
                 .is_compat = true,
                 .ptr.compat = __envp,
         };
-        return do_execve_common(filename, argv, envp);
+        return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
+}
+
+static int compat_do_execveat(int fd, struct filename *filename,
+                              const compat_uptr_t __user *__argv,
+                              const compat_uptr_t __user *__envp,
+                              int flags)
+{
+        struct user_arg_ptr argv = {
+                .is_compat = true,
+                .ptr.compat = __argv,
+        };
+        struct user_arg_ptr envp = {
+                .is_compat = true,
+                .ptr.compat = __envp,
+        };
+        return do_execveat_common(fd, filename, argv, envp, flags);
 }
 #endif
 
@@ -1609,6 +1669,20 @@ SYSCALL_DEFINE3(execve,
 {
         return do_execve(getname(filename), argv, envp);
 }
+
+SYSCALL_DEFINE5(execveat,
+                int, fd, const char __user *, filename,
+                const char __user *const __user *, argv,
+                const char __user *const __user *, envp,
+                int, flags)
+{
+        int lookup_flags = (flags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0;
+
+        return do_execveat(fd,
+                           getname_flags(filename, lookup_flags, NULL),
+                           argv, envp, flags);
+}
+
 #ifdef CONFIG_COMPAT
 COMPAT_SYSCALL_DEFINE3(execve, const char __user *, filename,
         const compat_uptr_t __user *, argv,
@@ -1616,4 +1690,17 @@ COMPAT_SYSCALL_DEFINE3(execve, const char __user *, filename,
 {
         return compat_do_execve(getname(filename), argv, envp);
 }
+
+COMPAT_SYSCALL_DEFINE5(execveat, int, fd,
+                       const char __user *, filename,
+                       const compat_uptr_t __user *, argv,
+                       const compat_uptr_t __user *, envp,
+                       int,  flags)
+{
+        int lookup_flags = (flags & AT_EMPTY_PATH) ? LOOKUP_EMPTY : 0;
+
+        return compat_do_execveat(fd,
+                                  getname_flags(filename, lookup_flags, NULL),
+                                  argv, envp, flags);
+}
 #endif
diff --git a/fs/fat/fat.h b/fs/fat/fat.h
index e0c4ba39a377..64e295e8ff38 100644
--- a/fs/fat/fat.h
+++ b/fs/fat/fat.h
@@ -370,6 +370,7 @@ extern int fat_file_fsync(struct file *file, loff_t start, loff_t end,
                           int datasync);
 
 /* fat/inode.c */
+extern int fat_block_truncate_page(struct inode *inode, loff_t from);
 extern void fat_attach(struct inode *inode, loff_t i_pos);
 extern void fat_detach(struct inode *inode);
 extern struct inode *fat_iget(struct super_block *sb, loff_t i_pos);
diff --git a/fs/fat/file.c b/fs/fat/file.c
index 85f79a89e747..8429c68e3057 100644
--- a/fs/fat/file.c
+++ b/fs/fat/file.c
@@ -443,6 +443,9 @@ int fat_setattr(struct dentry *dentry, struct iattr *attr)
         }
 
         if (attr->ia_valid & ATTR_SIZE) {
+                error = fat_block_truncate_page(inode, attr->ia_size);
+                if (error)
+                        goto out;
                 down_write(&MSDOS_I(inode)->truncate_lock);
                 truncate_setsize(inode, attr->ia_size);
                 fat_truncate_blocks(inode, attr->ia_size);
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 756aead10d96..7b41a2dcdd76 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -294,6 +294,18 @@ static sector_t _fat_bmap(struct address_space *mapping, sector_t block)
         return blocknr;
 }
 
+/*
+ * fat_block_truncate_page() zeroes out a mapping from file offset `from'
+ * up to the end of the block which corresponds to `from'.
+ * This is required during truncate to physically zeroout the tail end
+ * of that block so it doesn't yield old data if the file is later grown.
+ * Also, avoid causing failure from fsx for cases of "data past EOF"
+ */
+int fat_block_truncate_page(struct inode *inode, loff_t from)
+{
+        return block_truncate_page(inode->i_mapping, from, fat_get_block);
+}
+
 static const struct address_space_operations fat_aops = {
         .readpage       = fat_readpage,
         .readpages      = fat_readpages,
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 1e2872b25343..5eba47f593f8 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -412,10 +412,10 @@ static int hugetlb_vmtruncate(struct inode *inode, loff_t offset)
         pgoff = offset >> PAGE_SHIFT;
 
         i_size_write(inode, offset);
-        mutex_lock(&mapping->i_mmap_mutex);
+        i_mmap_lock_write(mapping);
         if (!RB_EMPTY_ROOT(&mapping->i_mmap))
                 hugetlb_vmtruncate_list(&mapping->i_mmap, pgoff);
-        mutex_unlock(&mapping->i_mmap_mutex);
+        i_mmap_unlock_write(mapping);
         truncate_hugepages(inode, offset);
         return 0;
 }
@@ -472,12 +472,12 @@ static struct inode *hugetlbfs_get_root(struct super_block *sb,
 }
 
 /*
- * Hugetlbfs is not reclaimable; therefore its i_mmap_mutex will never
+ * Hugetlbfs is not reclaimable; therefore its i_mmap_rwsem will never
  * be taken from reclaim -- unlike regular filesystems. This needs an
  * annotation because huge_pmd_share() does an allocation under
- * i_mmap_mutex.
+ * i_mmap_rwsem.
  */
-static struct lock_class_key hugetlbfs_i_mmap_mutex_key;
+static struct lock_class_key hugetlbfs_i_mmap_rwsem_key;
 
 static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                                         struct inode *dir,
@@ -495,8 +495,8 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                 struct hugetlbfs_inode_info *info;
                 inode->i_ino = get_next_ino();
                 inode_init_owner(inode, dir, mode);
-                lockdep_set_class(&inode->i_mapping->i_mmap_mutex,
-                                &hugetlbfs_i_mmap_mutex_key);
+                lockdep_set_class(&inode->i_mapping->i_mmap_rwsem,
+                                &hugetlbfs_i_mmap_rwsem_key);
                 inode->i_mapping->a_ops = &hugetlbfs_aops;
                 inode->i_mapping->backing_dev_info =&hugetlbfs_backing_dev_info;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
diff --git a/fs/inode.c b/fs/inode.c
index 2ed95f7caa4f..ad60555b4768 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -346,7 +346,7 @@ void address_space_init_once(struct address_space *mapping)
         memset(mapping, 0, sizeof(*mapping));
         INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC);
         spin_lock_init(&mapping->tree_lock);
-        mutex_init(&mapping->i_mmap_mutex);
+        init_rwsem(&mapping->i_mmap_rwsem);
         INIT_LIST_HEAD(&mapping->private_list);
         spin_lock_init(&mapping->private_lock);
         mapping->i_mmap = RB_ROOT;
diff --git a/fs/namei.c b/fs/namei.c
index db5fe86319e6..ca814165d84c 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -130,7 +130,7 @@ void final_putname(struct filename *name)
 
 #define EMBEDDED_NAME_MAX       (PATH_MAX - sizeof(struct filename))
 
-static struct filename *
+struct filename *
 getname_flags(const char __user *filename, int flags, int *empty)
 {
         struct filename *result, *err;
diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
index caaaf9dfe353..44523f4a6084 100644
--- a/fs/notify/dnotify/dnotify.c
+++ b/fs/notify/dnotify/dnotify.c
@@ -69,8 +69,8 @@ static void dnotify_recalc_inode_mask(struct fsnotify_mark *fsn_mark)
         if (old_mask == new_mask)
                 return;
 
-        if (fsn_mark->i.inode)
-                fsnotify_recalc_inode_mask(fsn_mark->i.inode);
+        if (fsn_mark->inode)
+                fsnotify_recalc_inode_mask(fsn_mark->inode);
 }
 
 /*
diff --git a/fs/notify/fdinfo.c b/fs/notify/fdinfo.c
index 6ffd220eb14d..58b7cdb63da9 100644
--- a/fs/notify/fdinfo.c
+++ b/fs/notify/fdinfo.c
@@ -80,7 +80,7 @@ static void inotify_fdinfo(struct seq_file *m, struct fsnotify_mark *mark)
                 return;
 
         inode_mark = container_of(mark, struct inotify_inode_mark, fsn_mark);
-        inode = igrab(mark->i.inode);
+        inode = igrab(mark->inode);
         if (inode) {
                 seq_printf(m, "inotify wd:%x ino:%lx sdev:%x mask:%x ignored_mask:%x ",
                            inode_mark->wd, inode->i_ino, inode->i_sb->s_dev,
@@ -112,7 +112,7 @@ static void fanotify_fdinfo(struct seq_file *m, struct fsnotify_mark *mark)
                 mflags |= FAN_MARK_IGNORED_SURV_MODIFY;
 
         if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) {
-                inode = igrab(mark->i.inode);
+                inode = igrab(mark->inode);
                 if (!inode)
                         return;
                 seq_printf(m, "fanotify ino:%lx sdev:%x mflags:%x mask:%x ignored_mask:%x ",
@@ -122,7 +122,7 @@ static void fanotify_fdinfo(struct seq_file *m, struct fsnotify_mark *mark)
                 seq_putc(m, '\n');
                 iput(inode);
         } else if (mark->flags & FSNOTIFY_MARK_FLAG_VFSMOUNT) {
-                struct mount *mnt = real_mount(mark->m.mnt);
+                struct mount *mnt = real_mount(mark->mnt);
 
                 seq_printf(m, "fanotify mnt_id:%x mflags:%x mask:%x ignored_mask:%x\n",
                            mnt->mnt_id, mflags, mark->mask, mark->ignored_mask);
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index 41e39102743a..dd3fb0b17be7 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -242,13 +242,13 @@ int fsnotify(struct inode *to_tell, __u32 mask, void *data, int data_is,
 
                 if (inode_node) {
                         inode_mark = hlist_entry(srcu_dereference(inode_node, &fsnotify_mark_srcu),
-                                                 struct fsnotify_mark, i.i_list);
+                                                 struct fsnotify_mark, obj_list);
                         inode_group = inode_mark->group;
                 }
 
                 if (vfsmount_node) {
                         vfsmount_mark = hlist_entry(srcu_dereference(vfsmount_node, &fsnotify_mark_srcu),
-                                                        struct fsnotify_mark, m.m_list);
+                                                    struct fsnotify_mark, obj_list);
                         vfsmount_group = vfsmount_mark->group;
                 }
 
diff --git a/fs/notify/fsnotify.h b/fs/notify/fsnotify.h
index 3b68b0ae0a97..13a00be516d2 100644
--- a/fs/notify/fsnotify.h
+++ b/fs/notify/fsnotify.h
@@ -12,12 +12,19 @@ extern void fsnotify_flush_notify(struct fsnotify_group *group);
 /* protects reads of inode and vfsmount marks list */
 extern struct srcu_struct fsnotify_mark_srcu;
 
+/* Calculate mask of events for a list of marks */
+extern u32 fsnotify_recalc_mask(struct hlist_head *head);
+
 /* compare two groups for sorting of marks lists */
 extern int fsnotify_compare_groups(struct fsnotify_group *a,
                                    struct fsnotify_group *b);
 
 extern void fsnotify_set_inode_mark_mask_locked(struct fsnotify_mark *fsn_mark,
                                                 __u32 mask);
+/* Add mark to a proper place in mark list */
+extern int fsnotify_add_mark_list(struct hlist_head *head,
+                                  struct fsnotify_mark *mark,
+                                  int allow_dups);
 /* add a mark to an inode */
 extern int fsnotify_add_inode_mark(struct fsnotify_mark *mark,
                                    struct fsnotify_group *group, struct inode *inode,
@@ -31,6 +38,11 @@ extern int fsnotify_add_vfsmount_mark(struct fsnotify_mark *mark,
 extern void fsnotify_destroy_vfsmount_mark(struct fsnotify_mark *mark);
 /* inode specific destruction of a mark */
 extern void fsnotify_destroy_inode_mark(struct fsnotify_mark *mark);
+/* Destroy all marks in the given list */
+extern void fsnotify_destroy_marks(struct list_head *to_free);
+/* Find mark belonging to given group in the list of marks */
+extern struct fsnotify_mark *fsnotify_find_mark(struct hlist_head *head,
+                                                struct fsnotify_group *group);
 /* run the list of all marks associated with inode and flag them to be freed */
 extern void fsnotify_clear_marks_by_inode(struct inode *inode);
 /* run the list of all marks associated with vfsmount and flag them to be freed */
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index dfbf5447eea4..3daf513ee99e 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -31,28 +31,13 @@
 #include "../internal.h"
 
 /*
- * Recalculate the mask of events relevant to a given inode locked.
- */
-static void fsnotify_recalc_inode_mask_locked(struct inode *inode)
-{
-        struct fsnotify_mark *mark;
-        __u32 new_mask = 0;
-
-        assert_spin_locked(&inode->i_lock);
-
-        hlist_for_each_entry(mark, &inode->i_fsnotify_marks, i.i_list)
-                new_mask |= mark->mask;
-        inode->i_fsnotify_mask = new_mask;
-}
-
-/*
  * Recalculate the inode->i_fsnotify_mask, or the mask of all FS_* event types
  * any notifier is interested in hearing for this inode.
  */
 void fsnotify_recalc_inode_mask(struct inode *inode)
 {
         spin_lock(&inode->i_lock);
-        fsnotify_recalc_inode_mask_locked(inode);
+        inode->i_fsnotify_mask = fsnotify_recalc_mask(&inode->i_fsnotify_marks);
         spin_unlock(&inode->i_lock);
 
         __fsnotify_update_child_dentry_flags(inode);
@@ -60,23 +45,22 @@ void fsnotify_recalc_inode_mask(struct inode *inode)
 
 void fsnotify_destroy_inode_mark(struct fsnotify_mark *mark)
 {
-        struct inode *inode = mark->i.inode;
+        struct inode *inode = mark->inode;
 
         BUG_ON(!mutex_is_locked(&mark->group->mark_mutex));
         assert_spin_locked(&mark->lock);
 
         spin_lock(&inode->i_lock);
 
-        hlist_del_init_rcu(&mark->i.i_list);
-        mark->i.inode = NULL;
+        hlist_del_init_rcu(&mark->obj_list);
+        mark->inode = NULL;
 
         /*
          * this mark is now off the inode->i_fsnotify_marks list and we
          * hold the inode->i_lock, so this is the perfect time to update the
          * inode->i_fsnotify_mask
          */
-        fsnotify_recalc_inode_mask_locked(inode);
-
+        inode->i_fsnotify_mask = fsnotify_recalc_mask(&inode->i_fsnotify_marks);
         spin_unlock(&inode->i_lock);
 }
 
@@ -85,30 +69,19 @@ void fsnotify_destroy_inode_mark(struct fsnotify_mark *mark)
  */
 void fsnotify_clear_marks_by_inode(struct inode *inode)
 {
-        struct fsnotify_mark *mark, *lmark;
+        struct fsnotify_mark *mark;
         struct hlist_node *n;
         LIST_HEAD(free_list);
 
         spin_lock(&inode->i_lock);
-        hlist_for_each_entry_safe(mark, n, &inode->i_fsnotify_marks, i.i_list) {
-                list_add(&mark->i.free_i_list, &free_list);
-                hlist_del_init_rcu(&mark->i.i_list);
+        hlist_for_each_entry_safe(mark, n, &inode->i_fsnotify_marks, obj_list) {
+                list_add(&mark->free_list, &free_list);
+                hlist_del_init_rcu(&mark->obj_list);
                 fsnotify_get_mark(mark);
         }
         spin_unlock(&inode->i_lock);
 
-        list_for_each_entry_safe(mark, lmark, &free_list, i.free_i_list) {
-                struct fsnotify_group *group;
-
-                spin_lock(&mark->lock);
-                fsnotify_get_group(mark->group);
-                group = mark->group;
-                spin_unlock(&mark->lock);
-
-                fsnotify_destroy_mark(mark, group);
-                fsnotify_put_mark(mark);
-                fsnotify_put_group(group);
-        }
+        fsnotify_destroy_marks(&free_list);
 }
 
 /*
@@ -123,34 +96,13 @@ void fsnotify_clear_inode_marks_by_group(struct fsnotify_group *group)
  * given a group and inode, find the mark associated with that combination.
  * if found take a reference to that mark and return it, else return NULL
  */
-static struct fsnotify_mark *fsnotify_find_inode_mark_locked(
-                struct fsnotify_group *group,
-                struct inode *inode)
-{
-        struct fsnotify_mark *mark;
-
-        assert_spin_locked(&inode->i_lock);
-
-        hlist_for_each_entry(mark, &inode->i_fsnotify_marks, i.i_list) {
-                if (mark->group == group) {
-                        fsnotify_get_mark(mark);
-                        return mark;
-                }
-        }
-        return NULL;
-}
-
-/*
- * given a group and inode, find the mark associated with that combination.
- * if found take a reference to that mark and return it, else return NULL
- */
 struct fsnotify_mark *fsnotify_find_inode_mark(struct fsnotify_group *group,
                                                struct inode *inode)
 {
         struct fsnotify_mark *mark;
 
         spin_lock(&inode->i_lock);
-        mark = fsnotify_find_inode_mark_locked(group, inode);
+        mark = fsnotify_find_mark(&inode->i_fsnotify_marks, group);
         spin_unlock(&inode->i_lock);
 
         return mark;
@@ -168,10 +120,10 @@ void fsnotify_set_inode_mark_mask_locked(struct fsnotify_mark *mark,
         assert_spin_locked(&mark->lock);
 
         if (mask &&
-            mark->i.inode &&
+            mark->inode &&
             !(mark->flags & FSNOTIFY_MARK_FLAG_OBJECT_PINNED)) {
                 mark->flags |= FSNOTIFY_MARK_FLAG_OBJECT_PINNED;
-                inode = igrab(mark->i.inode);
+                inode = igrab(mark->inode);
                 /*
                  * we shouldn't be able to get here if the inode wasn't
                  * already safely held in memory.  But bug in case it
@@ -192,9 +144,7 @@ int fsnotify_add_inode_mark(struct fsnotify_mark *mark,
                             struct fsnotify_group *group, struct inode *inode,
                             int allow_dups)
 {
-        struct fsnotify_mark *lmark, *last = NULL;
-        int ret = 0;
-        int cmp;
+        int ret;
 
         mark->flags |= FSNOTIFY_MARK_FLAG_INODE;
 
@@ -202,37 +152,10 @@ int fsnotify_add_inode_mark(struct fsnotify_mark *mark,
         assert_spin_locked(&mark->lock);
 
         spin_lock(&inode->i_lock);
-
-        mark->i.inode = inode;
-
-        /* is mark the first mark? */
-        if (hlist_empty(&inode->i_fsnotify_marks)) {
-                hlist_add_head_rcu(&mark->i.i_list, &inode->i_fsnotify_marks);
-                goto out;
-        }
-
-        /* should mark be in the middle of the current list? */
-        hlist_for_each_entry(lmark, &inode->i_fsnotify_marks, i.i_list) {
-                last = lmark;
-
-                if ((lmark->group == group) && !allow_dups) {
-                        ret = -EEXIST;
-                        goto out;
-                }
-
-                cmp = fsnotify_compare_groups(lmark->group, mark->group);
-                if (cmp < 0)
-                        continue;
-
-                hlist_add_before_rcu(&mark->i.i_list, &lmark->i.i_list);
-                goto out;
-        }
-
-        BUG_ON(last == NULL);
-        /* mark should be the last entry.  last is the current last entry */
-        hlist_add_behind_rcu(&mark->i.i_list, &last->i.i_list);
-out:
-        fsnotify_recalc_inode_mask_locked(inode);
+        mark->inode = inode;
+        ret = fsnotify_add_mark_list(&inode->i_fsnotify_marks, mark,
+                                     allow_dups);
+        inode->i_fsnotify_mask = fsnotify_recalc_mask(&inode->i_fsnotify_marks);
         spin_unlock(&inode->i_lock);
 
         return ret;
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index 7d888d77d59a..2cd900c2c737 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -156,7 +156,7 @@ static int idr_callback(int id, void *p, void *data)
          */
         if (fsn_mark)
                 printk(KERN_WARNING "fsn_mark->group=%p inode=%p wd=%d\n",
-                        fsn_mark->group, fsn_mark->i.inode, i_mark->wd);
+                        fsn_mark->group, fsn_mark->inode, i_mark->wd);
         return 0;
 }
 
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 283aa312d745..450648697433 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -433,7 +433,7 @@ static void inotify_remove_from_idr(struct fsnotify_group *group,
         if (wd == -1) {
                 WARN_ONCE(1, "%s: i_mark=%p i_mark->wd=%d i_mark->group=%p"
                         " i_mark->inode=%p\n", __func__, i_mark, i_mark->wd,
-                        i_mark->fsn_mark.group, i_mark->fsn_mark.i.inode);
+                        i_mark->fsn_mark.group, i_mark->fsn_mark.inode);
                 goto out;
         }
 
@@ -442,7 +442,7 @@ static void inotify_remove_from_idr(struct fsnotify_group *group,
         if (unlikely(!found_i_mark)) {
                 WARN_ONCE(1, "%s: i_mark=%p i_mark->wd=%d i_mark->group=%p"
                         " i_mark->inode=%p\n", __func__, i_mark, i_mark->wd,
-                        i_mark->fsn_mark.group, i_mark->fsn_mark.i.inode);
+                        i_mark->fsn_mark.group, i_mark->fsn_mark.inode);
                 goto out;
         }
 
@@ -456,9 +456,9 @@ static void inotify_remove_from_idr(struct fsnotify_group *group,
                         "mark->inode=%p found_i_mark=%p found_i_mark->wd=%d "
                         "found_i_mark->group=%p found_i_mark->inode=%p\n",
                         __func__, i_mark, i_mark->wd, i_mark->fsn_mark.group,
-                        i_mark->fsn_mark.i.inode, found_i_mark, found_i_mark->wd,
+                        i_mark->fsn_mark.inode, found_i_mark, found_i_mark->wd,
                         found_i_mark->fsn_mark.group,
-                        found_i_mark->fsn_mark.i.inode);
+                        found_i_mark->fsn_mark.inode);
                 goto out;
         }
 
@@ -470,7 +470,7 @@ static void inotify_remove_from_idr(struct fsnotify_group *group,
         if (unlikely(atomic_read(&i_mark->fsn_mark.refcnt) < 3)) {
                 printk(KERN_ERR "%s: i_mark=%p i_mark->wd=%d i_mark->group=%p"
                         " i_mark->inode=%p\n", __func__, i_mark, i_mark->wd,
-                        i_mark->fsn_mark.group, i_mark->fsn_mark.i.inode);
+                        i_mark->fsn_mark.group, i_mark->fsn_mark.inode);
                 /* we can't really recover with bad ref cnting.. */
                 BUG();
         }
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index 34c38fabf514..92e48c70f0f0 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -110,6 +110,17 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
         }
 }
 
+/* Calculate mask of events for a list of marks */
+u32 fsnotify_recalc_mask(struct hlist_head *head)
+{
+        u32 new_mask = 0;
+        struct fsnotify_mark *mark;
+
+        hlist_for_each_entry(mark, head, obj_list)
+                new_mask |= mark->mask;
+        return new_mask;
+}
+
 /*
  * Any time a mark is getting freed we end up here.
  * The caller had better be holding a reference to this mark so we don't actually
@@ -133,7 +144,7 @@ void fsnotify_destroy_mark_locked(struct fsnotify_mark *mark,
         mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
 
         if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) {
-                inode = mark->i.inode;
+                inode = mark->inode;
                 fsnotify_destroy_inode_mark(mark);
         } else if (mark->flags & FSNOTIFY_MARK_FLAG_VFSMOUNT)
                 fsnotify_destroy_vfsmount_mark(mark);
@@ -150,7 +161,7 @@ void fsnotify_destroy_mark_locked(struct fsnotify_mark *mark,
         mutex_unlock(&group->mark_mutex);
 
         spin_lock(&destroy_lock);
-        list_add(&mark->destroy_list, &destroy_list);
+        list_add(&mark->g_list, &destroy_list);
         spin_unlock(&destroy_lock);
         wake_up(&destroy_waitq);
         /*
@@ -192,6 +203,27 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark,
         mutex_unlock(&group->mark_mutex);
 }
 
+/*
+ * Destroy all marks in the given list. The marks must be already detached from
+ * the original inode / vfsmount.
+ */
+void fsnotify_destroy_marks(struct list_head *to_free)
+{
+        struct fsnotify_mark *mark, *lmark;
+        struct fsnotify_group *group;
+
+        list_for_each_entry_safe(mark, lmark, to_free, free_list) {
+                spin_lock(&mark->lock);
+                fsnotify_get_group(mark->group);
+                group = mark->group;
+                spin_unlock(&mark->lock);
+
+                fsnotify_destroy_mark(mark, group);
+                fsnotify_put_mark(mark);
+                fsnotify_put_group(group);
+        }
+}
+
 void fsnotify_set_mark_mask_locked(struct fsnotify_mark *mark, __u32 mask)
 {
         assert_spin_locked(&mark->lock);
@@ -245,6 +277,39 @@ int fsnotify_compare_groups(struct fsnotify_group *a, struct fsnotify_group *b)
         return -1;
 }
 
+/* Add mark into proper place in given list of marks */
+int fsnotify_add_mark_list(struct hlist_head *head, struct fsnotify_mark *mark,
+                           int allow_dups)
+{
+        struct fsnotify_mark *lmark, *last = NULL;
+        int cmp;
+
+        /* is mark the first mark? */
+        if (hlist_empty(head)) {
+                hlist_add_head_rcu(&mark->obj_list, head);
+                return 0;
+        }
+
+        /* should mark be in the middle of the current list? */
+        hlist_for_each_entry(lmark, head, obj_list) {
+                last = lmark;
+
+                if ((lmark->group == mark->group) && !allow_dups)
+                        return -EEXIST;
+
+                cmp = fsnotify_compare_groups(lmark->group, mark->group);
+                if (cmp >= 0) {
+                        hlist_add_before_rcu(&mark->obj_list, &lmark->obj_list);
+                        return 0;
+                }
+        }
+
+        BUG_ON(last == NULL);
+        /* mark should be the last entry.  last is the current last entry */
+        hlist_add_behind_rcu(&mark->obj_list, &last->obj_list);
+        return 0;
+}
+
 /*
  * Attach an initialized mark to a given group and fs object.
  * These marks may be used for the fsnotify backend to determine which
@@ -305,7 +370,7 @@ err:
         spin_unlock(&mark->lock);
 
         spin_lock(&destroy_lock);
-        list_add(&mark->destroy_list, &destroy_list);
+        list_add(&mark->g_list, &destroy_list);
         spin_unlock(&destroy_lock);
         wake_up(&destroy_waitq);
 
@@ -323,6 +388,24 @@ int fsnotify_add_mark(struct fsnotify_mark *mark, struct fsnotify_group *group,
 }
 
 /*
+ * Given a list of marks, find the mark associated with given group. If found
+ * take a reference to that mark and return it, else return NULL.
+ */
+struct fsnotify_mark *fsnotify_find_mark(struct hlist_head *head,
+                                         struct fsnotify_group *group)
+{
+        struct fsnotify_mark *mark;
+
+        hlist_for_each_entry(mark, head, obj_list) {
+                if (mark->group == group) {
+                        fsnotify_get_mark(mark);
+                        return mark;
+                }
+        }
+        return NULL;
+}
+
+/*
  * clear any marks in a group in which mark->flags & flags is true
  */
 void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group,
@@ -352,8 +435,8 @@ void fsnotify_clear_marks_by_group(struct fsnotify_group *group)
 void fsnotify_duplicate_mark(struct fsnotify_mark *new, struct fsnotify_mark *old)
 {
         assert_spin_locked(&old->lock);
-        new->i.inode = old->i.inode;
-        new->m.mnt = old->m.mnt;
+        new->inode = old->inode;
+        new->mnt = old->mnt;
         if (old->group)
                 fsnotify_get_group(old->group);
         new->group = old->group;
@@ -386,8 +469,8 @@ static int fsnotify_mark_destroy(void *ignored)
 
                 synchronize_srcu(&fsnotify_mark_srcu);
 
-                list_for_each_entry_safe(mark, next, &private_destroy_list, destroy_list) {
-                        list_del_init(&mark->destroy_list);
+                list_for_each_entry_safe(mark, next, &private_destroy_list, g_list) {
+                        list_del_init(&mark->g_list);
                         fsnotify_put_mark(mark);
                 }
 
diff --git a/fs/notify/vfsmount_mark.c b/fs/notify/vfsmount_mark.c
index faefa72a11eb..326b148e623c 100644
--- a/fs/notify/vfsmount_mark.c
+++ b/fs/notify/vfsmount_mark.c
@@ -32,31 +32,20 @@
 
 void fsnotify_clear_marks_by_mount(struct vfsmount *mnt)
 {
-        struct fsnotify_mark *mark, *lmark;
+        struct fsnotify_mark *mark;
         struct hlist_node *n;
         struct mount *m = real_mount(mnt);
         LIST_HEAD(free_list);
 
         spin_lock(&mnt->mnt_root->d_lock);
-        hlist_for_each_entry_safe(mark, n, &m->mnt_fsnotify_marks, m.m_list) {
-                list_add(&mark->m.free_m_list, &free_list);
-                hlist_del_init_rcu(&mark->m.m_list);
+        hlist_for_each_entry_safe(mark, n, &m->mnt_fsnotify_marks, obj_list) {
+                list_add(&mark->free_list, &free_list);
+                hlist_del_init_rcu(&mark->obj_list);
                 fsnotify_get_mark(mark);
         }
         spin_unlock(&mnt->mnt_root->d_lock);
 
-        list_for_each_entry_safe(mark, lmark, &free_list, m.free_m_list) {
-                struct fsnotify_group *group;
-
-                spin_lock(&mark->lock);
-                fsnotify_get_group(mark->group);
-                group = mark->group;
-                spin_unlock(&mark->lock);
-
-                fsnotify_destroy_mark(mark, group);
-                fsnotify_put_mark(mark);
-                fsnotify_put_group(group);
-        }
+        fsnotify_destroy_marks(&free_list);
 }
 
 void fsnotify_clear_vfsmount_marks_by_group(struct fsnotify_group *group)
@@ -65,66 +54,35 @@ void fsnotify_clear_vfsmount_marks_by_group(struct fsnotify_group *group)
 }
 
 /*
- * Recalculate the mask of events relevant to a given vfsmount locked.
- */
-static void fsnotify_recalc_vfsmount_mask_locked(struct vfsmount *mnt)
-{
-        struct mount *m = real_mount(mnt);
-        struct fsnotify_mark *mark;
-        __u32 new_mask = 0;
-
-        assert_spin_locked(&mnt->mnt_root->d_lock);
-
-        hlist_for_each_entry(mark, &m->mnt_fsnotify_marks, m.m_list)
-                new_mask |= mark->mask;
-        m->mnt_fsnotify_mask = new_mask;
-}
-
-/*
  * Recalculate the mnt->mnt_fsnotify_mask, or the mask of all FS_* event types
  * any notifier is interested in hearing for this mount point
  */
 void fsnotify_recalc_vfsmount_mask(struct vfsmount *mnt)
 {
+        struct mount *m = real_mount(mnt);
+
         spin_lock(&mnt->mnt_root->d_lock);
-        fsnotify_recalc_vfsmount_mask_locked(mnt);
+        m->mnt_fsnotify_mask = fsnotify_recalc_mask(&m->mnt_fsnotify_marks);
         spin_unlock(&mnt->mnt_root->d_lock);
 }
 
 void fsnotify_destroy_vfsmount_mark(struct fsnotify_mark *mark)
 {
-        struct vfsmount *mnt = mark->m.mnt;
+        struct vfsmount *mnt = mark->mnt;
+        struct mount *m = real_mount(mnt);
 
         BUG_ON(!mutex_is_locked(&mark->group->mark_mutex));
         assert_spin_locked(&mark->lock);
 
         spin_lock(&mnt->mnt_root->d_lock);
 
-        hlist_del_init_rcu(&mark->m.m_list);
-        mark->m.mnt = NULL;
-
-        fsnotify_recalc_vfsmount_mask_locked(mnt);
+        hlist_del_init_rcu(&mark->obj_list);
+        mark->mnt = NULL;
 
+        m->mnt_fsnotify_mask = fsnotify_recalc_mask(&m->mnt_fsnotify_marks);
         spin_unlock(&mnt->mnt_root->d_lock);
 }
 
-static struct fsnotify_mark *fsnotify_find_vfsmount_mark_locked(struct fsnotify_group *group,
-                                                                struct vfsmount *mnt)
-{
-        struct mount *m = real_mount(mnt);
-        struct fsnotify_mark *mark;
-
-        assert_spin_locked(&mnt->mnt_root->d_lock);
-
-        hlist_for_each_entry(mark, &m->mnt_fsnotify_marks, m.m_list) {
-                if (mark->group == group) {
-                        fsnotify_get_mark(mark);
-                        return mark;
-                }
-        }
-        return NULL;
-}
-
 /*
  * given a group and vfsmount, find the mark associated with that combination.
  * if found take a reference to that mark and return it, else return NULL
@@ -132,10 +90,11 @@ static struct fsnotify_mark *fsnotify_find_vfsmount_mark_locked(struct fsnotify_
 struct fsnotify_mark *fsnotify_find_vfsmount_mark(struct fsnotify_group *group,
                                                   struct vfsmount *mnt)
 {
+        struct mount *m = real_mount(mnt);
         struct fsnotify_mark *mark;
 
         spin_lock(&mnt->mnt_root->d_lock);
-        mark = fsnotify_find_vfsmount_mark_locked(group, mnt);
+        mark = fsnotify_find_mark(&m->mnt_fsnotify_marks, group);
         spin_unlock(&mnt->mnt_root->d_lock);
 
         return mark;
@@ -151,9 +110,7 @@ int fsnotify_add_vfsmount_mark(struct fsnotify_mark *mark,
                                int allow_dups)
 {
         struct mount *m = real_mount(mnt);
-        struct fsnotify_mark *lmark, *last = NULL;
-        int ret = 0;
-        int cmp;
+        int ret;
 
         mark->flags |= FSNOTIFY_MARK_FLAG_VFSMOUNT;
 
@@ -161,37 +118,9 @@ int fsnotify_add_vfsmount_mark(struct fsnotify_mark *mark,
         assert_spin_locked(&mark->lock);
 
         spin_lock(&mnt->mnt_root->d_lock);
-
-        mark->m.mnt = mnt;
-
-        /* is mark the first mark? */
-        if (hlist_empty(&m->mnt_fsnotify_marks)) {
-                hlist_add_head_rcu(&mark->m.m_list, &m->mnt_fsnotify_marks);
-                goto out;
-        }
-
-        /* should mark be in the middle of the current list? */
-        hlist_for_each_entry(lmark, &m->mnt_fsnotify_marks, m.m_list) {
-                last = lmark;
-
-                if ((lmark->group == group) && !allow_dups) {
-                        ret = -EEXIST;
-                        goto out;
-                }
-
-                cmp = fsnotify_compare_groups(lmark->group, mark->group);
-                if (cmp < 0)
-                        continue;
-
-                hlist_add_before_rcu(&mark->m.m_list, &lmark->m.m_list);
-                goto out;
-        }
-
-        BUG_ON(last == NULL);
-        /* mark should be the last entry.  last is the current last entry */
-        hlist_add_behind_rcu(&mark->m.m_list, &last->m.m_list);
-out:
-        fsnotify_recalc_vfsmount_mask_locked(mnt);
+        mark->mnt = mnt;
+        ret = fsnotify_add_mark_list(&m->mnt_fsnotify_marks, mark, allow_dups);
+        m->mnt_fsnotify_mask = fsnotify_recalc_mask(&m->mnt_fsnotify_marks);
         spin_unlock(&mnt->mnt_root->d_lock);
 
         return ret;
diff --git a/fs/open.c b/fs/open.c
index b1bf3d542d5d..d45bd905d418 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -295,6 +295,17 @@ int do_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
 
         sb_start_write(inode->i_sb);
         ret = file->f_op->fallocate(file, mode, offset, len);
+
+        /*
+         * Create inotify and fanotify events.
+         *
+         * To keep the logic simple always create events if fallocate succeeds.
+         * This implies that events are even created if the file size remains
+         * unchanged, e.g. when using flag FALLOC_FL_KEEP_SIZE.
+         */
+        if (ret == 0)
+                fsnotify_modify(file);
+
         sb_end_write(inode->i_sb);
         return ret;
 }
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 353948ba1c5b..dbf3a59c86bb 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -25,7 +25,11 @@ static void *seq_buf_alloc(unsigned long size)
 {
         void *buf;
 
-        buf = kmalloc(size, GFP_KERNEL | __GFP_NOWARN);
+        /*
+         * __GFP_NORETRY to avoid oom-killings with high-order allocations -
+         * it's better to fall back to vmalloc() than to kill things.
+         */
+        buf = kmalloc(size, GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
         if (!buf && size > PAGE_SIZE)
                 buf = vmalloc(size);
         return buf;