40 files changed, 281 insertions, 178 deletions

diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
index 5e376bb93419..8defc6b3f9a2 100644
--- a/fs/bfs/inode.c
+++ b/fs/bfs/inode.c
@@ -40,7 +40,7 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
         int block, off;
 
         inode = iget_locked(sb, ino);
-        if (IS_ERR(inode))
+        if (!inode)
                 return ERR_PTR(-ENOMEM);
         if (!(inode->i_state & I_NEW))
                 return inode;
diff --git a/fs/bio.c b/fs/bio.c
index 94bbc04dba77..c5eae7251490 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -1045,12 +1045,22 @@ static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs,
 int bio_uncopy_user(struct bio *bio)
 {
         struct bio_map_data *bmd = bio->bi_private;
-        int ret = 0;
+        struct bio_vec *bvec;
+        int ret = 0, i;
 
-        if (!bio_flagged(bio, BIO_NULL_MAPPED))
-                ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
-                                     bmd->nr_sgvecs, bio_data_dir(bio) == READ,
-                                     0, bmd->is_our_pages);
+        if (!bio_flagged(bio, BIO_NULL_MAPPED)) {
+                /*
+                 * if we're in a workqueue, the request is orphaned, so
+                 * don't copy into a random user address space, just free.
+                 */
+                if (current->mm)
+                        ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
+                                             bmd->nr_sgvecs, bio_data_dir(bio) == READ,
+                                             0, bmd->is_our_pages);
+                else if (bmd->is_our_pages)
+                        bio_for_each_segment_all(bvec, bio, i)
+                                __free_page(bvec->bv_page);
+        }
         bio_free_map_data(bmd);
         bio_put(bio);
         return ret;
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 45e57cc38200..fc6f4f3a1a9d 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -43,17 +43,18 @@ cifs_crypto_shash_md5_allocate(struct TCP_Server_Info *server)
         server->secmech.md5 = crypto_alloc_shash("md5", 0, 0);
         if (IS_ERR(server->secmech.md5)) {
                 cifs_dbg(VFS, "could not allocate crypto md5\n");
-                return PTR_ERR(server->secmech.md5);
+                rc = PTR_ERR(server->secmech.md5);
+                server->secmech.md5 = NULL;
+                return rc;
         }
 
         size = sizeof(struct shash_desc) +
                         crypto_shash_descsize(server->secmech.md5);
         server->secmech.sdescmd5 = kmalloc(size, GFP_KERNEL);
         if (!server->secmech.sdescmd5) {
-                rc = -ENOMEM;
                 crypto_free_shash(server->secmech.md5);
                 server->secmech.md5 = NULL;
-                return rc;
+                return -ENOMEM;
         }
         server->secmech.sdescmd5->shash.tfm = server->secmech.md5;
         server->secmech.sdescmd5->shash.flags = 0x0;
@@ -421,7 +422,7 @@ find_domain_name(struct cifs_ses *ses, const struct nls_table *nls_cp)
                 if (blobptr + attrsize > blobend)
                         break;
                 if (type == NTLMSSP_AV_NB_DOMAIN_NAME) {
-                        if (!attrsize)
+                        if (!attrsize || attrsize >= CIFS_MAX_DOMAINNAME_LEN)
                                 break;
                         if (!ses->domainName) {
                                 ses->domainName =
@@ -591,6 +592,7 @@ CalcNTLMv2_response(const struct cifs_ses *ses, char *ntlmv2_hash)
 
 static int crypto_hmacmd5_alloc(struct TCP_Server_Info *server)
 {
+        int rc;
         unsigned int size;
 
         /* check if already allocated */
@@ -600,7 +602,9 @@ static int crypto_hmacmd5_alloc(struct TCP_Server_Info *server)
         server->secmech.hmacmd5 = crypto_alloc_shash("hmac(md5)", 0, 0);
         if (IS_ERR(server->secmech.hmacmd5)) {
                 cifs_dbg(VFS, "could not allocate crypto hmacmd5\n");
-                return PTR_ERR(server->secmech.hmacmd5);
+                rc = PTR_ERR(server->secmech.hmacmd5);
+                server->secmech.hmacmd5 = NULL;
+                return rc;
         }
 
         size = sizeof(struct shash_desc) +
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 4bdd547dbf6f..85ea98d139fc 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -147,18 +147,17 @@ cifs_read_super(struct super_block *sb)
                 goto out_no_root;
         }
 
+        if (cifs_sb_master_tcon(cifs_sb)->nocase)
+                sb->s_d_op = &cifs_ci_dentry_ops;
+        else
+                sb->s_d_op = &cifs_dentry_ops;
+
         sb->s_root = d_make_root(inode);
         if (!sb->s_root) {
                 rc = -ENOMEM;
                 goto out_no_root;
         }
 
-        /* do that *after* d_make_root() - we want NULL ->d_op for root here */
-        if (cifs_sb_master_tcon(cifs_sb)->nocase)
-                sb->s_d_op = &cifs_ci_dentry_ops;
-        else
-                sb->s_d_op = &cifs_dentry_ops;
-
 #ifdef CONFIG_CIFS_NFSD_EXPORT
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
                 cifs_dbg(FYI, "export ops supported\n");
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 1fdc37041057..52ca861ed35e 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -44,6 +44,7 @@
 #define MAX_TREE_SIZE (2 + MAX_SERVER_SIZE + 1 + MAX_SHARE_SIZE + 1)
 #define MAX_SERVER_SIZE 15
 #define MAX_SHARE_SIZE 80
+#define CIFS_MAX_DOMAINNAME_LEN 256 /* max domain name length */
 #define MAX_USERNAME_SIZE 256   /* reasonable maximum for current servers */
 #define MAX_PASSWORD_SIZE 512   /* max for windows seems to be 256 wide chars */
 
@@ -369,6 +370,9 @@ struct smb_version_operations {
         void (*generate_signingkey)(struct TCP_Server_Info *server);
         int (*calc_signature)(struct smb_rqst *rqst,
                                    struct TCP_Server_Info *server);
+        int (*query_mf_symlink)(const unsigned char *path, char *pbuf,
+                        unsigned int *pbytes_read, struct cifs_sb_info *cifs_sb,
+                        unsigned int xid);
 };
 
 struct smb_version_values {
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index f7e584d047e2..b29a012bed33 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -497,5 +497,7 @@ void cifs_writev_complete(struct work_struct *work);
 struct cifs_writedata *cifs_writedata_alloc(unsigned int nr_pages,
                                                 work_func_t complete);
 void cifs_writedata_release(struct kref *refcount);
-
+int open_query_close_cifs_symlink(const unsigned char *path, char *pbuf,
+                        unsigned int *pbytes_read, struct cifs_sb_info *cifs_sb,
+                        unsigned int xid);
 #endif                  /* _CIFSPROTO_H */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index fa68813396b5..d67c550c4980 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1675,7 +1675,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         if (string == NULL)
                                 goto out_nomem;
 
-                        if (strnlen(string, 256) == 256) {
+                        if (strnlen(string, CIFS_MAX_DOMAINNAME_LEN)
+                                        == CIFS_MAX_DOMAINNAME_LEN) {
                                 printk(KERN_WARNING "CIFS: domain name too"
                                                     " long\n");
                                 goto cifs_parse_mount_err;
@@ -2276,8 +2277,8 @@ cifs_put_smb_ses(struct cifs_ses *ses)
 
 #ifdef CONFIG_KEYS
 
-/* strlen("cifs:a:") + INET6_ADDRSTRLEN + 1 */
-#define CIFSCREDS_DESC_SIZE (7 + INET6_ADDRSTRLEN + 1)
+/* strlen("cifs:a:") + CIFS_MAX_DOMAINNAME_LEN + 1 */
+#define CIFSCREDS_DESC_SIZE (7 + CIFS_MAX_DOMAINNAME_LEN + 1)
 
 /* Populate username and pw fields from keyring if possible */
 static int
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 1e57f36ea1b2..7e36ae34e947 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -647,6 +647,7 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush)
                                      oflags, &oplock, &cfile->fid.netfid, xid);
                 if (rc == 0) {
                         cifs_dbg(FYI, "posix reopen succeeded\n");
+                        oparms.reconnect = true;
                         goto reopen_success;
                 }
                 /*
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index b83c3f5646bd..562044f700e5 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -305,67 +305,89 @@ CIFSCouldBeMFSymlink(const struct cifs_fattr *fattr)
 }
 
 int
-CIFSCheckMFSymlink(struct cifs_fattr *fattr,
-                   const unsigned char *path,
-                   struct cifs_sb_info *cifs_sb, unsigned int xid)
+open_query_close_cifs_symlink(const unsigned char *path, char *pbuf,
+                        unsigned int *pbytes_read, struct cifs_sb_info *cifs_sb,
+                        unsigned int xid)
 {
         int rc;
         int oplock = 0;
         __u16 netfid = 0;
         struct tcon_link *tlink;
-        struct cifs_tcon *pTcon;
+        struct cifs_tcon *ptcon;
         struct cifs_io_parms io_parms;
-        u8 *buf;
-        char *pbuf;
-        unsigned int bytes_read = 0;
         int buf_type = CIFS_NO_BUFFER;
-        unsigned int link_len = 0;
         FILE_ALL_INFO file_info;
 
-        if (!CIFSCouldBeMFSymlink(fattr))
-                /* it's not a symlink */
-                return 0;
-
         tlink = cifs_sb_tlink(cifs_sb);
         if (IS_ERR(tlink))
                 return PTR_ERR(tlink);
-        pTcon = tlink_tcon(tlink);
+        ptcon = tlink_tcon(tlink);
 
-        rc = CIFSSMBOpen(xid, pTcon, path, FILE_OPEN, GENERIC_READ,
+        rc = CIFSSMBOpen(xid, ptcon, path, FILE_OPEN, GENERIC_READ,
                          CREATE_NOT_DIR, &netfid, &oplock, &file_info,
                          cifs_sb->local_nls,
                          cifs_sb->mnt_cifs_flags &
                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
-        if (rc != 0)
-                goto out;
+        if (rc != 0) {
+                cifs_put_tlink(tlink);
+                return rc;
+        }
 
         if (file_info.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) {
-                CIFSSMBClose(xid, pTcon, netfid);
+                CIFSSMBClose(xid, ptcon, netfid);
+                cifs_put_tlink(tlink);
                 /* it's not a symlink */
-                goto out;
+                return rc;
         }
 
-        buf = kmalloc(CIFS_MF_SYMLINK_FILE_SIZE, GFP_KERNEL);
-        if (!buf) {
-                rc = -ENOMEM;
-                goto out;
-        }
-        pbuf = buf;
         io_parms.netfid = netfid;
         io_parms.pid = current->tgid;
-        io_parms.tcon = pTcon;
+        io_parms.tcon = ptcon;
         io_parms.offset = 0;
         io_parms.length = CIFS_MF_SYMLINK_FILE_SIZE;
 
-        rc = CIFSSMBRead(xid, &io_parms, &bytes_read, &pbuf, &buf_type);
-        CIFSSMBClose(xid, pTcon, netfid);
-        if (rc != 0) {
-                kfree(buf);
+        rc = CIFSSMBRead(xid, &io_parms, pbytes_read, &pbuf, &buf_type);
+        CIFSSMBClose(xid, ptcon, netfid);
+        cifs_put_tlink(tlink);
+        return rc;
+}
+
+
+int
+CIFSCheckMFSymlink(struct cifs_fattr *fattr,
+                   const unsigned char *path,
+                   struct cifs_sb_info *cifs_sb, unsigned int xid)
+{
+        int rc = 0;
+        u8 *buf = NULL;
+        unsigned int link_len = 0;
+        unsigned int bytes_read = 0;
+        struct cifs_tcon *ptcon;
+
+        if (!CIFSCouldBeMFSymlink(fattr))
+                /* it's not a symlink */
+                return 0;
+
+        buf = kmalloc(CIFS_MF_SYMLINK_FILE_SIZE, GFP_KERNEL);
+        if (!buf) {
+                rc = -ENOMEM;
                 goto out;
         }
 
+        ptcon = tlink_tcon(cifs_sb_tlink(cifs_sb));
+        if ((ptcon->ses) && (ptcon->ses->server->ops->query_mf_symlink))
+                rc = ptcon->ses->server->ops->query_mf_symlink(path, buf,
+                                                 &bytes_read, cifs_sb, xid);
+        else
+                goto out;
+
+        if (rc != 0)
+                goto out;
+
+        if (bytes_read == 0) /* not a symlink */
+                goto out;
+
         rc = CIFSParseMFSymlink(buf, bytes_read, &link_len, NULL);
-        kfree(buf);
         if (rc == -EINVAL) {
                 /* it's not a symlink */
                 rc = 0;
@@ -381,7 +403,7 @@ CIFSCheckMFSymlink(struct cifs_fattr *fattr,
         fattr->cf_mode |= S_IFLNK | S_IRWXU | S_IRWXG | S_IRWXO;
         fattr->cf_dtype = DT_LNK;
 out:
-        cifs_put_tlink(tlink);
+        kfree(buf);
         return rc;
 }
 
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index ab8778469394..69d2c826a23b 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -111,6 +111,14 @@ cifs_prime_dcache(struct dentry *parent, struct qstr *name,
                         return;
         }
 
+        /*
+         * If we know that the inode will need to be revalidated immediately,
+         * then don't create a new dentry for it. We'll end up doing an on
+         * the wire call either way and this spares us an invalidation.
+         */
+        if (fattr->cf_flags & CIFS_FATTR_NEED_REVAL)
+                return;
+
         dentry = d_alloc(parent, name);
         if (!dentry)
                 return;
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 79358e341fd2..08dd37bb23aa 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -197,7 +197,7 @@ static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
                 bytes_ret = 0;
         } else
                 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
-                                            256, nls_cp);
+                                            CIFS_MAX_DOMAINNAME_LEN, nls_cp);
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2;  /* account for null terminator */
 
@@ -255,8 +255,8 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
 
         /* copy domain */
         if (ses->domainName != NULL) {
-                strncpy(bcc_ptr, ses->domainName, 256);
-                bcc_ptr += strnlen(ses->domainName, 256);
+                strncpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
+                bcc_ptr += strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
         } /* else we will send a null domain name
              so the server will default to its own domain */
         *bcc_ptr = 0;
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index 6457690731a2..60943978aec3 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -944,6 +944,7 @@ struct smb_version_operations smb1_operations = {
         .mand_lock = cifs_mand_lock,
         .mand_unlock_range = cifs_unlock_range,
         .push_mand_locks = cifs_push_mandatory_locks,
+        .query_mf_symlink = open_query_close_cifs_symlink,
 };
 
 struct smb_version_values smb1_values = {
diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
index 301b191270b9..4f2300d020c7 100644
--- a/fs/cifs/smb2transport.c
+++ b/fs/cifs/smb2transport.c
@@ -42,6 +42,7 @@
 static int
 smb2_crypto_shash_allocate(struct TCP_Server_Info *server)
 {
+        int rc;
         unsigned int size;
 
         if (server->secmech.sdeschmacsha256 != NULL)
@@ -50,7 +51,9 @@ smb2_crypto_shash_allocate(struct TCP_Server_Info *server)
         server->secmech.hmacsha256 = crypto_alloc_shash("hmac(sha256)", 0, 0);
         if (IS_ERR(server->secmech.hmacsha256)) {
                 cifs_dbg(VFS, "could not allocate crypto hmacsha256\n");
-                return PTR_ERR(server->secmech.hmacsha256);
+                rc = PTR_ERR(server->secmech.hmacsha256);
+                server->secmech.hmacsha256 = NULL;
+                return rc;
         }
 
         size = sizeof(struct shash_desc) +
@@ -87,7 +90,9 @@ smb3_crypto_shash_allocate(struct TCP_Server_Info *server)
                 server->secmech.sdeschmacsha256 = NULL;
                 crypto_free_shash(server->secmech.hmacsha256);
                 server->secmech.hmacsha256 = NULL;
-                return PTR_ERR(server->secmech.cmacaes);
+                rc = PTR_ERR(server->secmech.cmacaes);
+                server->secmech.cmacaes = NULL;
+                return rc;
         }
 
         size = sizeof(struct shash_desc) +
diff --git a/fs/dcache.c b/fs/dcache.c
index 87bdb5329c3c..83cfb834db03 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2724,6 +2724,17 @@ char *dynamic_dname(struct dentry *dentry, char *buffer, int buflen,
         return memcpy(buffer, temp, sz);
 }
 
+char *simple_dname(struct dentry *dentry, char *buffer, int buflen)
+{
+        char *end = buffer + buflen;
+        /* these dentries are never renamed, so d_lock is not needed */
+        if (prepend(&end, &buflen, " (deleted)", 11) ||
+            prepend_name(&end, &buflen, &dentry->d_name) ||
+            prepend(&end, &buflen, "/", 1))  
+                end = ERR_PTR(-ENAMETOOLONG);
+        return end;  
+}
+
 /*
  * Write full pathname from the root of the filesystem into the buffer.
  */
diff --git a/fs/efs/inode.c b/fs/efs/inode.c
index f3913eb2c474..d15ccf20f1b3 100644
--- a/fs/efs/inode.c
+++ b/fs/efs/inode.c
@@ -57,7 +57,7 @@ struct inode *efs_iget(struct super_block *super, unsigned long ino)
         struct inode *inode;
 
         inode = iget_locked(super, ino);
-        if (IS_ERR(inode))
+        if (!inode)
                 return ERR_PTR(-ENOMEM);
         if (!(inode->i_state & I_NEW))
                 return inode;
diff --git a/fs/exec.c b/fs/exec.c
index 9c73def87642..fd774c7cb483 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -608,7 +608,7 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
                 return -ENOMEM;
 
         lru_add_drain();
-        tlb_gather_mmu(&tlb, mm, 0);
+        tlb_gather_mmu(&tlb, mm, old_start, old_end);
         if (new_end > old_start) {
                 /*
                  * when the old and new regions overlap clear from new_end.
@@ -625,7 +625,7 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
                 free_pgd_range(&tlb, old_start, old_end, new_end,
                         vma->vm_next ? vma->vm_next->vm_start : USER_PGTABLES_CEILING);
         }
-        tlb_finish_mmu(&tlb, new_end, old_end);
+        tlb_finish_mmu(&tlb, old_start, old_end);
 
         /*
          * Shrink the vma to just the new range.  Always succeeds.
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index b577e45425b0..0ab26fbf3380 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2086,6 +2086,7 @@ extern int  ext4_sync_inode(handle_t *, struct inode *);
 extern void ext4_dirty_inode(struct inode *, int);
 extern int ext4_change_inode_journal_flag(struct inode *, int);
 extern int ext4_get_inode_loc(struct inode *, struct ext4_iloc *);
+extern int ext4_inode_attach_jinode(struct inode *inode);
 extern int ext4_can_truncate(struct inode *inode);
 extern void ext4_truncate(struct inode *);
 extern int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length);
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index 72a3600aedbd..17ac112ab101 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -255,10 +255,10 @@ int __ext4_handle_dirty_metadata(const char *where, unsigned int line,
         set_buffer_prio(bh);
         if (ext4_handle_valid(handle)) {
                 err = jbd2_journal_dirty_metadata(handle, bh);
-                if (err) {
-                        /* Errors can only happen if there is a bug */
-                        handle->h_err = err;
-                        __ext4_journal_stop(where, line, handle);
+                /* Errors can only happen if there is a bug */
+                if (WARN_ON_ONCE(err)) {
+                        ext4_journal_abort_handle(where, line, __func__, bh,
+                                                  handle, err);
                 }
         } else {
                 if (inode)
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 6f4cc567c382..319c9d26279a 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -219,7 +219,6 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
 {
         struct super_block *sb = inode->i_sb;
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
-        struct ext4_inode_info *ei = EXT4_I(inode);
         struct vfsmount *mnt = filp->f_path.mnt;
         struct path path;
         char buf[64], *cp;
@@ -259,22 +258,10 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
          * Set up the jbd2_inode if we are opening the inode for
          * writing and the journal is present
          */
-        if (sbi->s_journal && !ei->jinode && (filp->f_mode & FMODE_WRITE)) {
-                struct jbd2_inode *jinode = jbd2_alloc_inode(GFP_KERNEL);
-
-                spin_lock(&inode->i_lock);
-                if (!ei->jinode) {
-                        if (!jinode) {
-                                spin_unlock(&inode->i_lock);
-                                return -ENOMEM;
-                        }
-                        ei->jinode = jinode;
-                        jbd2_journal_init_jbd_inode(ei->jinode, inode);
-                        jinode = NULL;
-                }
-                spin_unlock(&inode->i_lock);
-                if (unlikely(jinode != NULL))
-                        jbd2_free_inode(jinode);
+        if (filp->f_mode & FMODE_WRITE) {
+                int ret = ext4_inode_attach_jinode(inode);
+                if (ret < 0)
+                        return ret;
         }
         return dquot_file_open(inode, filp);
 }
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index dd32a2eacd0d..c2ca04e67a4f 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3533,6 +3533,18 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
                    offset;
         }
 
+        if (offset & (sb->s_blocksize - 1) ||
+            (offset + length) & (sb->s_blocksize - 1)) {
+                /*
+                 * Attach jinode to inode for jbd2 if we do any zeroing of
+                 * partial block
+                 */
+                ret = ext4_inode_attach_jinode(inode);
+                if (ret < 0)
+                        goto out_mutex;
+
+        }
+
         first_block_offset = round_up(offset, sb->s_blocksize);
         last_block_offset = round_down((offset + length), sb->s_blocksize) - 1;
 
@@ -3601,6 +3613,31 @@ out_mutex:
         return ret;
 }
 
+int ext4_inode_attach_jinode(struct inode *inode)
+{
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        struct jbd2_inode *jinode;
+
+        if (ei->jinode || !EXT4_SB(inode->i_sb)->s_journal)
+                return 0;
+
+        jinode = jbd2_alloc_inode(GFP_KERNEL);
+        spin_lock(&inode->i_lock);
+        if (!ei->jinode) {
+                if (!jinode) {
+                        spin_unlock(&inode->i_lock);
+                        return -ENOMEM;
+                }
+                ei->jinode = jinode;
+                jbd2_journal_init_jbd_inode(ei->jinode, inode);
+                jinode = NULL;
+        }
+        spin_unlock(&inode->i_lock);
+        if (unlikely(jinode != NULL))
+                jbd2_free_inode(jinode);
+        return 0;
+}
+
 /*
  * ext4_truncate()
  *
@@ -3661,6 +3698,12 @@ void ext4_truncate(struct inode *inode)
                         return;
         }
 
+        /* If we zero-out tail of the page, we have to create jinode for jbd2 */
+        if (inode->i_size & (inode->i_sb->s_blocksize - 1)) {
+                if (ext4_inode_attach_jinode(inode) < 0)
+                        return;
+        }
+
         if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
                 credits = ext4_writepage_trans_blocks(inode);
         else
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 9491ac0590f7..c0427e2f6648 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -77,8 +77,10 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2)
         memswap(ei1->i_data, ei2->i_data, sizeof(ei1->i_data));
         memswap(&ei1->i_flags, &ei2->i_flags, sizeof(ei1->i_flags));
         memswap(&ei1->i_disksize, &ei2->i_disksize, sizeof(ei1->i_disksize));
-        memswap(&ei1->i_es_tree, &ei2->i_es_tree, sizeof(ei1->i_es_tree));
-        memswap(&ei1->i_es_lru_nr, &ei2->i_es_lru_nr, sizeof(ei1->i_es_lru_nr));
+        ext4_es_remove_extent(inode1, 0, EXT_MAX_BLOCKS);
+        ext4_es_remove_extent(inode2, 0, EXT_MAX_BLOCKS);
+        ext4_es_lru_del(inode1);
+        ext4_es_lru_del(inode2);
 
         isize = i_size_read(inode1);
         i_size_write(inode1, i_size_read(inode2));
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 36b141e420b7..b59373b625e9 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1359,7 +1359,7 @@ static const struct mount_opts {
         {Opt_delalloc, EXT4_MOUNT_DELALLOC,
          MOPT_EXT4_ONLY | MOPT_SET | MOPT_EXPLICIT},
         {Opt_nodelalloc, EXT4_MOUNT_DELALLOC,
-         MOPT_EXT4_ONLY | MOPT_CLEAR | MOPT_EXPLICIT},
+         MOPT_EXT4_ONLY | MOPT_CLEAR},
         {Opt_journal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM,
          MOPT_EXT4_ONLY | MOPT_SET},
         {Opt_journal_async_commit, (EXT4_MOUNT_JOURNAL_ASYNC_COMMIT |
@@ -3483,7 +3483,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                 }
                 if (test_opt(sb, DIOREAD_NOLOCK)) {
                         ext4_msg(sb, KERN_ERR, "can't mount with "
-                                 "both data=journal and delalloc");
+                                 "both data=journal and dioread_nolock");
                         goto failed_mount;
                 }
                 if (test_opt(sb, DELALLOC))
@@ -4727,6 +4727,21 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
                 goto restore_opts;
         }
 
+        if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
+                if (test_opt2(sb, EXPLICIT_DELALLOC)) {
+                        ext4_msg(sb, KERN_ERR, "can't mount with "
+                                 "both data=journal and delalloc");
+                        err = -EINVAL;
+                        goto restore_opts;
+                }
+                if (test_opt(sb, DIOREAD_NOLOCK)) {
+                        ext4_msg(sb, KERN_ERR, "can't mount with "
+                                 "both data=journal and dioread_nolock");
+                        err = -EINVAL;
+                        goto restore_opts;
+                }
+        }
+
         if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED)
                 ext4_abort(sb, "Abort forced by user");
 
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 9435384562a2..544a809819c3 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1838,14 +1838,14 @@ int __init gfs2_glock_init(void)
 
         glock_workqueue = alloc_workqueue("glock_workqueue", WQ_MEM_RECLAIM |
                                           WQ_HIGHPRI | WQ_FREEZABLE, 0);
-        if (IS_ERR(glock_workqueue))
-                return PTR_ERR(glock_workqueue);
+        if (!glock_workqueue)
+                return -ENOMEM;
         gfs2_delete_workqueue = alloc_workqueue("delete_workqueue",
                                                 WQ_MEM_RECLAIM | WQ_FREEZABLE,
                                                 0);
-        if (IS_ERR(gfs2_delete_workqueue)) {
+        if (!gfs2_delete_workqueue) {
                 destroy_workqueue(glock_workqueue);
-                return PTR_ERR(gfs2_delete_workqueue);
+                return -ENOMEM;
         }
 
         register_shrinker(&glock_shrinker);
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 5f2e5224c51c..e2e0a90396e7 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -47,7 +47,8 @@ static void gfs2_ail_error(struct gfs2_glock *gl, const struct buffer_head *bh)
  * None of the buffers should be dirty, locked, or pinned.
  */
 
-static void __gfs2_ail_flush(struct gfs2_glock *gl, bool fsync)
+static void __gfs2_ail_flush(struct gfs2_glock *gl, bool fsync,
+                             unsigned int nr_revokes)
 {
         struct gfs2_sbd *sdp = gl->gl_sbd;
         struct list_head *head = &gl->gl_ail_list;
@@ -57,7 +58,9 @@ static void __gfs2_ail_flush(struct gfs2_glock *gl, bool fsync)
 
         gfs2_log_lock(sdp);
         spin_lock(&sdp->sd_ail_lock);
-        list_for_each_entry_safe(bd, tmp, head, bd_ail_gl_list) {
+        list_for_each_entry_safe_reverse(bd, tmp, head, bd_ail_gl_list) {
+                if (nr_revokes == 0)
+                        break;
                 bh = bd->bd_bh;
                 if (bh->b_state & b_state) {
                         if (fsync)
@@ -65,6 +68,7 @@ static void __gfs2_ail_flush(struct gfs2_glock *gl, bool fsync)
                         gfs2_ail_error(gl, bh);
                 }
                 gfs2_trans_add_revoke(sdp, bd);
+                nr_revokes--;
         }
         GLOCK_BUG_ON(gl, !fsync && atomic_read(&gl->gl_ail_count));
         spin_unlock(&sdp->sd_ail_lock);
@@ -91,7 +95,7 @@ static void gfs2_ail_empty_gl(struct gfs2_glock *gl)
         WARN_ON_ONCE(current->journal_info);
         current->journal_info = &tr;
 
-        __gfs2_ail_flush(gl, 0);
+        __gfs2_ail_flush(gl, 0, tr.tr_revokes);
 
         gfs2_trans_end(sdp);
         gfs2_log_flush(sdp, NULL);
@@ -101,15 +105,19 @@ void gfs2_ail_flush(struct gfs2_glock *gl, bool fsync)
 {
         struct gfs2_sbd *sdp = gl->gl_sbd;
         unsigned int revokes = atomic_read(&gl->gl_ail_count);
+        unsigned int max_revokes = (sdp->sd_sb.sb_bsize - sizeof(struct gfs2_log_descriptor)) / sizeof(u64);
         int ret;
 
         if (!revokes)
                 return;
 
-        ret = gfs2_trans_begin(sdp, 0, revokes);
+        while (revokes > max_revokes)
+                max_revokes += (sdp->sd_sb.sb_bsize - sizeof(struct gfs2_meta_header)) / sizeof(u64);
+
+        ret = gfs2_trans_begin(sdp, 0, max_revokes);
         if (ret)
                 return;
-        __gfs2_ail_flush(gl, fsync);
+        __gfs2_ail_flush(gl, fsync, max_revokes);
         gfs2_trans_end(sdp);
         gfs2_log_flush(sdp, NULL);
 }
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index bbb2715171cd..64915eeae5a7 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -594,7 +594,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
                 }
                 gfs2_glock_dq_uninit(ghs);
                 if (IS_ERR(d))
-                        return PTR_RET(d);
+                        return PTR_ERR(d);
                 return error;
         } else if (error != -ENOENT) {
                 goto fail_gunlock;
@@ -1750,6 +1750,10 @@ static ssize_t gfs2_getxattr(struct dentry *dentry, const char *name,
         struct gfs2_holder gh;
         int ret;
 
+        /* For selinux during lookup */
+        if (gfs2_glock_is_locked_by_me(ip->i_gl))
+                return generic_getxattr(dentry, name, data, size);
+
         gfs2_holder_init(ip->i_gl, LM_ST_SHARED, LM_FLAG_ANY, &gh);
         ret = gfs2_glock_nq(&gh);
         if (ret == 0) {
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index e04d0e09ee7b..7b0f5043cf24 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -155,7 +155,7 @@ static int __init init_gfs2_fs(void)
                 goto fail_wq;
 
         gfs2_control_wq = alloc_workqueue("gfs2_control",
-                               WQ_NON_REENTRANT | WQ_UNBOUND | WQ_FREEZABLE, 0);
+                                          WQ_UNBOUND | WQ_FREEZABLE, 0);
         if (!gfs2_control_wq)
                 goto fail_recovery;
 
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index a3f868ae3fd4..d19b30ababf1 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -463,6 +463,14 @@ static struct inode *hugetlbfs_get_root(struct super_block *sb,
         return inode;
 }
 
+/*
+ * Hugetlbfs is not reclaimable; therefore its i_mmap_mutex will never
+ * be taken from reclaim -- unlike regular filesystems. This needs an
+ * annotation because huge_pmd_share() does an allocation under
+ * i_mmap_mutex.
+ */
+struct lock_class_key hugetlbfs_i_mmap_mutex_key;
+
 static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                                         struct inode *dir,
                                         umode_t mode, dev_t dev)
@@ -474,6 +482,8 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                 struct hugetlbfs_inode_info *info;
                 inode->i_ino = get_next_ino();
                 inode_init_owner(inode, dir, mode);
+                lockdep_set_class(&inode->i_mapping->i_mmap_mutex,
+                                &hugetlbfs_i_mmap_mutex_key);
                 inode->i_mapping->a_ops = &hugetlbfs_aops;
                 inode->i_mapping->backing_dev_info =&hugetlbfs_backing_dev_info;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
@@ -916,14 +926,8 @@ static int get_hstate_idx(int page_size_log)
         return h - hstates;
 }
 
-static char *hugetlb_dname(struct dentry *dentry, char *buffer, int buflen)
-{
-        return dynamic_dname(dentry, buffer, buflen, "/%s (deleted)",
-                                dentry->d_name.name);
-}
-
 static struct dentry_operations anon_ops = {
-        .d_dname = hugetlb_dname
+        .d_dname = simple_dname
 };
 
 /*
diff --git a/fs/namespace.c b/fs/namespace.c
index 7b1ca9ba0b0a..a45ba4f267fe 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1429,7 +1429,7 @@ struct vfsmount *collect_mounts(struct path *path)
                          CL_COPY_ALL | CL_PRIVATE);
         namespace_unlock();
         if (IS_ERR(tree))
-                return NULL;
+                return ERR_CAST(tree);
         return &tree->mnt;
 }
 
diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
index dc9a913784ab..2d8be51f90dc 100644
--- a/fs/nilfs2/segbuf.c
+++ b/fs/nilfs2/segbuf.c
@@ -345,8 +345,7 @@ static void nilfs_end_bio_write(struct bio *bio, int err)
 
         if (err == -EOPNOTSUPP) {
                 set_bit(BIO_EOPNOTSUPP, &bio->bi_flags);
-                bio_put(bio);
-                /* to be detected by submit_seg_bio() */
+                /* to be detected by nilfs_segbuf_submit_bio() */
         }
 
         if (!uptodate)
@@ -377,12 +376,12 @@ static int nilfs_segbuf_submit_bio(struct nilfs_segment_buffer *segbuf,
         bio->bi_private = segbuf;
         bio_get(bio);
         submit_bio(mode, bio);
+        segbuf->sb_nbio++;
         if (bio_flagged(bio, BIO_EOPNOTSUPP)) {
                 bio_put(bio);
                 err = -EOPNOTSUPP;
                 goto failed;
         }
-        segbuf->sb_nbio++;
         bio_put(bio);
 
         wi->bio = NULL;
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 79736a28d84f..2abf97b2a592 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -1757,7 +1757,7 @@ try_again:
                 goto out;
         } else if (ret == 1) {
                 clusters_need = wc->w_clen;
-                ret = ocfs2_refcount_cow(inode, filp, di_bh,
+                ret = ocfs2_refcount_cow(inode, di_bh,
                                          wc->w_cpos, wc->w_clen, UINT_MAX);
                 if (ret) {
                         mlog_errno(ret);
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index eb760d8acd50..30544ce8e9f7 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -2153,11 +2153,9 @@ int ocfs2_empty_dir(struct inode *inode)
 {
         int ret;
         struct ocfs2_empty_dir_priv priv = {
-                .ctx.actor = ocfs2_empty_dir_filldir
+                .ctx.actor = ocfs2_empty_dir_filldir,
         };
 
-        memset(&priv, 0, sizeof(priv));
-
         if (ocfs2_dir_indexed(inode)) {
                 ret = ocfs2_empty_dir_dx(inode, &priv);
                 if (ret)
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 41000f223ca4..3261d71319ee 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -370,7 +370,7 @@ static int ocfs2_cow_file_pos(struct inode *inode,
         if (!(ext_flags & OCFS2_EXT_REFCOUNTED))
                 goto out;
 
-        return ocfs2_refcount_cow(inode, NULL, fe_bh, cpos, 1, cpos+1);
+        return ocfs2_refcount_cow(inode, fe_bh, cpos, 1, cpos+1);
 
 out:
         return status;
@@ -899,7 +899,7 @@ static int ocfs2_zero_extend_get_range(struct inode *inode,
                 zero_clusters = last_cpos - zero_cpos;
 
         if (needs_cow) {
-                rc = ocfs2_refcount_cow(inode, NULL, di_bh, zero_cpos,
+                rc = ocfs2_refcount_cow(inode, di_bh, zero_cpos,
                                         zero_clusters, UINT_MAX);
                 if (rc) {
                         mlog_errno(rc);
@@ -2078,7 +2078,7 @@ static int ocfs2_prepare_inode_for_refcount(struct inode *inode,
 
         *meta_level = 1;
 
-        ret = ocfs2_refcount_cow(inode, file, di_bh, cpos, clusters, UINT_MAX);
+        ret = ocfs2_refcount_cow(inode, di_bh, cpos, clusters, UINT_MAX);
         if (ret)
                 mlog_errno(ret);
 out:
diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
index 96f9ac237e86..0a992737dcaf 100644
--- a/fs/ocfs2/journal.h
+++ b/fs/ocfs2/journal.h
@@ -537,7 +537,7 @@ static inline int ocfs2_calc_extend_credits(struct super_block *sb,
         extent_blocks = 1 + 1 + le16_to_cpu(root_el->l_tree_depth);
 
         return bitmap_blocks + sysfile_bitmap_blocks + extent_blocks +
-               ocfs2_quota_trans_credits(sb) + bits_wanted;
+               ocfs2_quota_trans_credits(sb);
 }
 
 static inline int ocfs2_calc_symlink_credits(struct super_block *sb)
diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
index f1fc172175b6..452068b45749 100644
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -69,7 +69,7 @@ static int __ocfs2_move_extent(handle_t *handle,
         u64 ino = ocfs2_metadata_cache_owner(context->et.et_ci);
         u64 old_blkno = ocfs2_clusters_to_blocks(inode->i_sb, p_cpos);
 
-        ret = ocfs2_duplicate_clusters_by_page(handle, context->file, cpos,
+        ret = ocfs2_duplicate_clusters_by_page(handle, inode, cpos,
                                                p_cpos, new_p_cpos, len);
         if (ret) {
                 mlog_errno(ret);
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 9f6b96a09615..a70d604593b6 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -49,7 +49,6 @@
 
 struct ocfs2_cow_context {
         struct inode *inode;
-        struct file *file;
         u32 cow_start;
         u32 cow_len;
         struct ocfs2_extent_tree data_et;
@@ -66,7 +65,7 @@ struct ocfs2_cow_context {
                             u32 *num_clusters,
                             unsigned int *extent_flags);
         int (*cow_duplicate_clusters)(handle_t *handle,
-                                      struct file *file,
+                                      struct inode *inode,
                                       u32 cpos, u32 old_cluster,
                                       u32 new_cluster, u32 new_len);
 };
@@ -2922,14 +2921,12 @@ static int ocfs2_clear_cow_buffer(handle_t *handle, struct buffer_head *bh)
 }
 
 int ocfs2_duplicate_clusters_by_page(handle_t *handle,
-                                     struct file *file,
+                                     struct inode *inode,
                                      u32 cpos, u32 old_cluster,
                                      u32 new_cluster, u32 new_len)
 {
         int ret = 0, partial;
-        struct inode *inode = file_inode(file);
-        struct ocfs2_caching_info *ci = INODE_CACHE(inode);
-        struct super_block *sb = ocfs2_metadata_cache_get_super(ci);
+        struct super_block *sb = inode->i_sb;
         u64 new_block = ocfs2_clusters_to_blocks(sb, new_cluster);
         struct page *page;
         pgoff_t page_index;
@@ -2978,13 +2975,6 @@ int ocfs2_duplicate_clusters_by_page(handle_t *handle,
                 if (PAGE_CACHE_SIZE <= OCFS2_SB(sb)->s_clustersize)
                         BUG_ON(PageDirty(page));
 
-                if (PageReadahead(page)) {
-                        page_cache_async_readahead(mapping,
-                                                   &file->f_ra, file,
-                                                   page, page_index,
-                                                   readahead_pages);
-                }
-
                 if (!PageUptodate(page)) {
                         ret = block_read_full_page(page, ocfs2_get_block);
                         if (ret) {
@@ -3004,7 +2994,8 @@ int ocfs2_duplicate_clusters_by_page(handle_t *handle,
                         }
                 }
 
-                ocfs2_map_and_dirty_page(inode, handle, from, to,
+                ocfs2_map_and_dirty_page(inode,
+                                         handle, from, to,
                                          page, 0, &new_block);
                 mark_page_accessed(page);
 unlock:
@@ -3020,12 +3011,11 @@ unlock:
 }
 
 int ocfs2_duplicate_clusters_by_jbd(handle_t *handle,
-                                    struct file *file,
+                                    struct inode *inode,
                                     u32 cpos, u32 old_cluster,
                                     u32 new_cluster, u32 new_len)
 {
         int ret = 0;
-        struct inode *inode = file_inode(file);
         struct super_block *sb = inode->i_sb;
         struct ocfs2_caching_info *ci = INODE_CACHE(inode);
         int i, blocks = ocfs2_clusters_to_blocks(sb, new_len);
@@ -3150,7 +3140,7 @@ static int ocfs2_replace_clusters(handle_t *handle,
 
         /*If the old clusters is unwritten, no need to duplicate. */
         if (!(ext_flags & OCFS2_EXT_UNWRITTEN)) {
-                ret = context->cow_duplicate_clusters(handle, context->file,
+                ret = context->cow_duplicate_clusters(handle, context->inode,
                                                       cpos, old, new, len);
                 if (ret) {
                         mlog_errno(ret);
@@ -3428,35 +3418,12 @@ static int ocfs2_replace_cow(struct ocfs2_cow_context *context)
         return ret;
 }
 
-static void ocfs2_readahead_for_cow(struct inode *inode,
-                                    struct file *file,
-                                    u32 start, u32 len)
-{
-        struct address_space *mapping;
-        pgoff_t index;
-        unsigned long num_pages;
-        int cs_bits = OCFS2_SB(inode->i_sb)->s_clustersize_bits;
-
-        if (!file)
-                return;
-
-        mapping = file->f_mapping;
-        num_pages = (len << cs_bits) >> PAGE_CACHE_SHIFT;
-        if (!num_pages)
-                num_pages = 1;
-
-        index = ((loff_t)start << cs_bits) >> PAGE_CACHE_SHIFT;
-        page_cache_sync_readahead(mapping, &file->f_ra, file,
-                                  index, num_pages);
-}
-
 /*
  * Starting at cpos, try to CoW write_len clusters.  Don't CoW
  * past max_cpos.  This will stop when it runs into a hole or an
  * unrefcounted extent.
  */
 static int ocfs2_refcount_cow_hunk(struct inode *inode,
-                                   struct file *file,
                                    struct buffer_head *di_bh,
                                    u32 cpos, u32 write_len, u32 max_cpos)
 {
@@ -3485,8 +3452,6 @@ static int ocfs2_refcount_cow_hunk(struct inode *inode,
 
         BUG_ON(cow_len == 0);
 
-        ocfs2_readahead_for_cow(inode, file, cow_start, cow_len);
-
         context = kzalloc(sizeof(struct ocfs2_cow_context), GFP_NOFS);
         if (!context) {
                 ret = -ENOMEM;
@@ -3508,7 +3473,6 @@ static int ocfs2_refcount_cow_hunk(struct inode *inode,
         context->ref_root_bh = ref_root_bh;
         context->cow_duplicate_clusters = ocfs2_duplicate_clusters_by_page;
         context->get_clusters = ocfs2_di_get_clusters;
-        context->file = file;
 
         ocfs2_init_dinode_extent_tree(&context->data_et,
                                       INODE_CACHE(inode), di_bh);
@@ -3537,7 +3501,6 @@ out:
  * clusters between cpos and cpos+write_len are safe to modify.
  */
 int ocfs2_refcount_cow(struct inode *inode,
-                       struct file *file,
                        struct buffer_head *di_bh,
                        u32 cpos, u32 write_len, u32 max_cpos)
 {
@@ -3557,7 +3520,7 @@ int ocfs2_refcount_cow(struct inode *inode,
                         num_clusters = write_len;
 
                 if (ext_flags & OCFS2_EXT_REFCOUNTED) {
-                        ret = ocfs2_refcount_cow_hunk(inode, file, di_bh, cpos,
+                        ret = ocfs2_refcount_cow_hunk(inode, di_bh, cpos,
                                                       num_clusters, max_cpos);
                         if (ret) {
                                 mlog_errno(ret);
diff --git a/fs/ocfs2/refcounttree.h b/fs/ocfs2/refcounttree.h
index 7754608c83a4..6422bbcdb525 100644
--- a/fs/ocfs2/refcounttree.h
+++ b/fs/ocfs2/refcounttree.h
@@ -53,7 +53,7 @@ int ocfs2_prepare_refcount_change_for_del(struct inode *inode,
                                           int *credits,
                                           int *ref_blocks);
 int ocfs2_refcount_cow(struct inode *inode,
-                       struct file *filep, struct buffer_head *di_bh,
+                       struct buffer_head *di_bh,
                        u32 cpos, u32 write_len, u32 max_cpos);
 
 typedef int (ocfs2_post_refcount_func)(struct inode *inode,
@@ -85,11 +85,11 @@ int ocfs2_refcount_cow_xattr(struct inode *inode,
                              u32 cpos, u32 write_len,
                              struct ocfs2_post_refcount *post);
 int ocfs2_duplicate_clusters_by_page(handle_t *handle,
-                                     struct file *file,
+                                     struct inode *inode,
                                      u32 cpos, u32 old_cluster,
                                      u32 new_cluster, u32 new_len);
 int ocfs2_duplicate_clusters_by_jbd(handle_t *handle,
-                                    struct file *file,
+                                    struct inode *inode,
                                     u32 cpos, u32 old_cluster,
                                     u32 new_cluster, u32 new_len);
 int ocfs2_cow_sync_writeback(struct super_block *sb,
diff --git a/fs/proc/fd.c b/fs/proc/fd.c
index 75f2890abbd8..0ff80f9b930f 100644
--- a/fs/proc/fd.c
+++ b/fs/proc/fd.c
@@ -230,8 +230,6 @@ static int proc_readfd_common(struct file *file, struct dir_context *ctx,
 
         if (!dir_emit_dots(file, ctx))
                 goto out;
-        if (!dir_emit_dots(file, ctx))
-                goto out;
         files = get_files_struct(p);
         if (!files)
                 goto out;
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 94441a407337..737e15615b04 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -271,7 +271,7 @@ int proc_readdir_de(struct proc_dir_entry *de, struct file *file,
                 de = next;
         } while (de);
         spin_unlock(&proc_subdir_lock);
-        return 0;
+        return 1;
 }
 
 int proc_readdir(struct file *file, struct dir_context *ctx)
diff --git a/fs/proc/root.c b/fs/proc/root.c
index 229e366598da..e0a790da726d 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -205,7 +205,9 @@ static struct dentry *proc_root_lookup(struct inode * dir, struct dentry * dentr
 static int proc_root_readdir(struct file *file, struct dir_context *ctx)
 {
         if (ctx->pos < FIRST_PROCESS_ENTRY) {
-                proc_readdir(file, ctx);
+                int error = proc_readdir(file, ctx);
+                if (unlikely(error <= 0))
+                        return error;
                 ctx->pos = FIRST_PROCESS_ENTRY;
         }
 
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index dbf61f6174f0..107d026f5d6e 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -730,8 +730,16 @@ static inline void clear_soft_dirty(struct vm_area_struct *vma,
          * of how soft-dirty works.
          */
         pte_t ptent = *pte;
-        ptent = pte_wrprotect(ptent);
-        ptent = pte_clear_flags(ptent, _PAGE_SOFT_DIRTY);
+
+        if (pte_present(ptent)) {
+                ptent = pte_wrprotect(ptent);
+                ptent = pte_clear_flags(ptent, _PAGE_SOFT_DIRTY);
+        } else if (is_swap_pte(ptent)) {
+                ptent = pte_swp_clear_soft_dirty(ptent);
+        } else if (pte_file(ptent)) {
+                ptent = pte_file_clear_soft_dirty(ptent);
+        }
+
         set_pte_at(vma->vm_mm, addr, pte, ptent);
 #endif
 }
@@ -752,14 +760,15 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
         pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
         for (; addr != end; pte++, addr += PAGE_SIZE) {
                 ptent = *pte;
-                if (!pte_present(ptent))
-                        continue;
 
                 if (cp->type == CLEAR_REFS_SOFT_DIRTY) {
                         clear_soft_dirty(vma, addr, pte);
                         continue;
                 }
 
+                if (!pte_present(ptent))
+                        continue;
+
                 page = vm_normal_page(vma, addr, ptent);
                 if (!page)
                         continue;
@@ -859,7 +868,7 @@ typedef struct {
 } pagemap_entry_t;
 
 struct pagemapread {
-        int pos, len;
+        int pos, len;           /* units: PM_ENTRY_BYTES, not bytes */
         pagemap_entry_t *buffer;
         bool v2;
 };
@@ -867,7 +876,7 @@ struct pagemapread {
 #define PAGEMAP_WALK_SIZE       (PMD_SIZE)
 #define PAGEMAP_WALK_MASK       (PMD_MASK)
 
-#define PM_ENTRY_BYTES      sizeof(u64)
+#define PM_ENTRY_BYTES      sizeof(pagemap_entry_t)
 #define PM_STATUS_BITS      3
 #define PM_STATUS_OFFSET    (64 - PM_STATUS_BITS)
 #define PM_STATUS_MASK      (((1LL << PM_STATUS_BITS) - 1) << PM_STATUS_OFFSET)
@@ -930,8 +939,10 @@ static void pte_to_pagemap_entry(pagemap_entry_t *pme, struct pagemapread *pm,
                 flags = PM_PRESENT;
                 page = vm_normal_page(vma, addr, pte);
         } else if (is_swap_pte(pte)) {
-                swp_entry_t entry = pte_to_swp_entry(pte);
-
+                swp_entry_t entry;
+                if (pte_swp_soft_dirty(pte))
+                        flags2 |= __PM_SOFT_DIRTY;
+                entry = pte_to_swp_entry(pte);
                 frame = swp_type(entry) |
                         (swp_offset(entry) << MAX_SWAPFILES_SHIFT);
                 flags = PM_SWAP;
@@ -1116,8 +1127,8 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                 goto out_task;
 
         pm.v2 = soft_dirty_cleared;
-        pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
-        pm.buffer = kmalloc(pm.len, GFP_TEMPORARY);
+        pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
+        pm.buffer = kmalloc(pm.len * PM_ENTRY_BYTES, GFP_TEMPORARY);
         ret = -ENOMEM;
         if (!pm.buffer)
                 goto out_task;