9 files changed, 106 insertions, 29 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 84a751005f5b..14b93159ef83 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -165,6 +165,15 @@ static struct vfsmount *aio_mnt;
 static const struct file_operations aio_ring_fops;
 static const struct address_space_operations aio_ctx_aops;
 
+/* Backing dev info for aio fs.
+ * -no dirty page accounting or writeback happens
+ */
+static struct backing_dev_info aio_fs_backing_dev_info = {
+        .name           = "aiofs",
+        .state          = 0,
+        .capabilities   = BDI_CAP_NO_ACCT_AND_WRITEBACK | BDI_CAP_MAP_COPY,
+};
+
 static struct file *aio_private_file(struct kioctx *ctx, loff_t nr_pages)
 {
         struct qstr this = QSTR_INIT("[aio]", 5);
@@ -176,6 +185,7 @@ static struct file *aio_private_file(struct kioctx *ctx, loff_t nr_pages)
 
         inode->i_mapping->a_ops = &aio_ctx_aops;
         inode->i_mapping->private_data = ctx;
+        inode->i_mapping->backing_dev_info = &aio_fs_backing_dev_info;
         inode->i_size = PAGE_SIZE * nr_pages;
 
         path.dentry = d_alloc_pseudo(aio_mnt->mnt_sb, &this);
@@ -220,6 +230,9 @@ static int __init aio_setup(void)
         if (IS_ERR(aio_mnt))
                 panic("Failed to create aio fs mount.");
 
+        if (bdi_init(&aio_fs_backing_dev_info))
+                panic("Failed to init aio fs backing dev info.");
+
         kiocb_cachep = KMEM_CACHE(kiocb, SLAB_HWCACHE_ALIGN|SLAB_PANIC);
         kioctx_cachep = KMEM_CACHE(kioctx,SLAB_HWCACHE_ALIGN|SLAB_PANIC);
 
@@ -281,11 +294,6 @@ static const struct file_operations aio_ring_fops = {
         .mmap = aio_ring_mmap,
 };
 
-static int aio_set_page_dirty(struct page *page)
-{
-        return 0;
-}
-
 #if IS_ENABLED(CONFIG_MIGRATION)
 static int aio_migratepage(struct address_space *mapping, struct page *new,
                         struct page *old, enum migrate_mode mode)
@@ -357,7 +365,7 @@ out:
 #endif
 
 static const struct address_space_operations aio_ctx_aops = {
-        .set_page_dirty = aio_set_page_dirty,
+        .set_page_dirty = __set_page_dirty_no_writeback,
 #if IS_ENABLED(CONFIG_MIGRATION)
         .migratepage    = aio_migratepage,
 #endif
@@ -412,7 +420,6 @@ static int aio_setup_ring(struct kioctx *ctx)
                 pr_debug("pid(%d) page[%d]->count=%d\n",
                          current->pid, i, page_count(page));
                 SetPageUptodate(page);
-                SetPageDirty(page);
                 unlock_page(page);
 
                 ctx->ring_pages[i] = page;
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index d3220d31d3cb..dcd9be32ac57 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -1011,8 +1011,6 @@ int btrfs_decompress_buf2page(char *buf, unsigned long buf_start,
                 bytes = min(bytes, working_bytes);
                 kaddr = kmap_atomic(page_out);
                 memcpy(kaddr + *pg_offset, buf + buf_offset, bytes);
-                if (*pg_index == (vcnt - 1) && *pg_offset == 0)
-                        memset(kaddr + bytes, 0, PAGE_CACHE_SIZE - bytes);
                 kunmap_atomic(kaddr);
                 flush_dcache_page(page_out);
 
@@ -1054,3 +1052,34 @@ int btrfs_decompress_buf2page(char *buf, unsigned long buf_start,
 
         return 1;
 }
+
+/*
+ * When uncompressing data, we need to make sure and zero any parts of
+ * the biovec that were not filled in by the decompression code.  pg_index
+ * and pg_offset indicate the last page and the last offset of that page
+ * that have been filled in.  This will zero everything remaining in the
+ * biovec.
+ */
+void btrfs_clear_biovec_end(struct bio_vec *bvec, int vcnt,
+                                   unsigned long pg_index,
+                                   unsigned long pg_offset)
+{
+        while (pg_index < vcnt) {
+                struct page *page = bvec[pg_index].bv_page;
+                unsigned long off = bvec[pg_index].bv_offset;
+                unsigned long len = bvec[pg_index].bv_len;
+
+                if (pg_offset < off)
+                        pg_offset = off;
+                if (pg_offset < off + len) {
+                        unsigned long bytes = off + len - pg_offset;
+                        char *kaddr;
+
+                        kaddr = kmap_atomic(page);
+                        memset(kaddr + pg_offset, 0, bytes);
+                        kunmap_atomic(kaddr);
+                }
+                pg_index++;
+                pg_offset = 0;
+        }
+}
diff --git a/fs/btrfs/compression.h b/fs/btrfs/compression.h
index 0c803b4fbf93..d181f70caae0 100644
--- a/fs/btrfs/compression.h
+++ b/fs/btrfs/compression.h
@@ -45,7 +45,9 @@ int btrfs_submit_compressed_write(struct inode *inode, u64 start,
                                   unsigned long nr_pages);
 int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
                                  int mirror_num, unsigned long bio_flags);
-
+void btrfs_clear_biovec_end(struct bio_vec *bvec, int vcnt,
+                                   unsigned long pg_index,
+                                   unsigned long pg_offset);
 struct btrfs_compress_op {
         struct list_head *(*alloc_workspace)(void);
 
diff --git a/fs/btrfs/lzo.c b/fs/btrfs/lzo.c
index 78285f30909e..617553cdb7d3 100644
--- a/fs/btrfs/lzo.c
+++ b/fs/btrfs/lzo.c
@@ -373,6 +373,8 @@ cont:
         }
 done:
         kunmap(pages_in[page_in_index]);
+        if (!ret)
+                btrfs_clear_biovec_end(bvec, vcnt, page_out_index, pg_offset);
         return ret;
 }
 
@@ -410,10 +412,23 @@ static int lzo_decompress(struct list_head *ws, unsigned char *data_in,
                 goto out;
         }
 
+        /*
+         * the caller is already checking against PAGE_SIZE, but lets
+         * move this check closer to the memcpy/memset
+         */
+        destlen = min_t(unsigned long, destlen, PAGE_SIZE);
         bytes = min_t(unsigned long, destlen, out_len - start_byte);
 
         kaddr = kmap_atomic(dest_page);
         memcpy(kaddr, workspace->buf + start_byte, bytes);
+
+        /*
+         * btrfs_getblock is doing a zero on the tail of the page too,
+         * but this will cover anything missing from the decompressed
+         * data.
+         */
+        if (bytes < destlen)
+                memset(kaddr+bytes, 0, destlen-bytes);
         kunmap_atomic(kaddr);
 out:
         return ret;
diff --git a/fs/btrfs/zlib.c b/fs/btrfs/zlib.c
index 759fa4e2de8f..fb22fd8d8fb8 100644
--- a/fs/btrfs/zlib.c
+++ b/fs/btrfs/zlib.c
@@ -299,6 +299,8 @@ done:
         zlib_inflateEnd(&workspace->strm);
         if (data_in)
                 kunmap(pages_in[page_in_index]);
+        if (!ret)
+                btrfs_clear_biovec_end(bvec, vcnt, page_out_index, pg_offset);
         return ret;
 }
 
@@ -310,10 +312,14 @@ static int zlib_decompress(struct list_head *ws, unsigned char *data_in,
         struct workspace *workspace = list_entry(ws, struct workspace, list);
         int ret = 0;
         int wbits = MAX_WBITS;
-        unsigned long bytes_left = destlen;
+        unsigned long bytes_left;
         unsigned long total_out = 0;
+        unsigned long pg_offset = 0;
         char *kaddr;
 
+        destlen = min_t(unsigned long, destlen, PAGE_SIZE);
+        bytes_left = destlen;
+
         workspace->strm.next_in = data_in;
         workspace->strm.avail_in = srclen;
         workspace->strm.total_in = 0;
@@ -341,7 +347,6 @@ static int zlib_decompress(struct list_head *ws, unsigned char *data_in,
                 unsigned long buf_start;
                 unsigned long buf_offset;
                 unsigned long bytes;
-                unsigned long pg_offset = 0;
 
                 ret = zlib_inflate(&workspace->strm, Z_NO_FLUSH);
                 if (ret != Z_OK && ret != Z_STREAM_END)
@@ -384,6 +389,17 @@ next:
                 ret = 0;
 
         zlib_inflateEnd(&workspace->strm);
+
+        /*
+         * this should only happen if zlib returned fewer bytes than we
+         * expected.  btrfs_get_block is responsible for zeroing from the
+         * end of the inline extent (destlen) to the end of the page
+         */
+        if (pg_offset < destlen) {
+                kaddr = kmap_atomic(dest_page);
+                memset(kaddr + pg_offset, 0, destlen - pg_offset);
+                kunmap_atomic(kaddr);
+        }
         return ret;
 }
 
diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
index 6df8d3d885e5..b8b92c2f9683 100644
--- a/fs/fat/namei_vfat.c
+++ b/fs/fat/namei_vfat.c
@@ -736,7 +736,12 @@ static struct dentry *vfat_lookup(struct inode *dir, struct dentry *dentry,
         }
 
         alias = d_find_alias(inode);
-        if (alias && !vfat_d_anon_disconn(alias)) {
+        /*
+         * Checking "alias->d_parent == dentry->d_parent" to make sure
+         * FS is not corrupted (especially double linked dir).
+         */
+        if (alias && alias->d_parent == dentry->d_parent &&
+            !vfat_d_anon_disconn(alias)) {
                 /*
                  * This inode has non anonymous-DCACHE_DISCONNECTED
                  * dentry. This means, the user did ->lookup() by an
@@ -755,12 +760,9 @@ static struct dentry *vfat_lookup(struct inode *dir, struct dentry *dentry,
 
 out:
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
-        dentry->d_time = dentry->d_parent->d_inode->i_version;
-        dentry = d_splice_alias(inode, dentry);
-        if (dentry)
-                dentry->d_time = dentry->d_parent->d_inode->i_version;
-        return dentry;
-
+        if (!inode)
+                dentry->d_time = dir->i_version;
+        return d_splice_alias(inode, dentry);
 error:
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
         return ERR_PTR(err);
@@ -793,7 +795,6 @@ static int vfat_create(struct inode *dir, struct dentry *dentry, umode_t mode,
         inode->i_mtime = inode->i_atime = inode->i_ctime = ts;
         /* timestamp is already written, so mark_inode_dirty() is unneeded. */
 
-        dentry->d_time = dentry->d_parent->d_inode->i_version;
         d_instantiate(dentry, inode);
 out:
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
@@ -824,6 +825,7 @@ static int vfat_rmdir(struct inode *dir, struct dentry *dentry)
         clear_nlink(inode);
         inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC;
         fat_detach(inode);
+        dentry->d_time = dir->i_version;
 out:
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
 
@@ -849,6 +851,7 @@ static int vfat_unlink(struct inode *dir, struct dentry *dentry)
         clear_nlink(inode);
         inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC;
         fat_detach(inode);
+        dentry->d_time = dir->i_version;
 out:
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
 
@@ -889,7 +892,6 @@ static int vfat_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
         inode->i_mtime = inode->i_atime = inode->i_ctime = ts;
         /* timestamp is already written, so mark_inode_dirty() is unneeded. */
 
-        dentry->d_time = dentry->d_parent->d_inode->i_version;
         d_instantiate(dentry, inode);
 
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index e4dc74713a43..1df94fabe4eb 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1853,13 +1853,12 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
                                 journal->j_chksum_driver = NULL;
                                 return 0;
                         }
-                }
 
-                /* Precompute checksum seed for all metadata */
-                if (jbd2_journal_has_csum_v2or3(journal))
+                        /* Precompute checksum seed for all metadata */
                         journal->j_csum_seed = jbd2_chksum(journal, ~0,
                                                            sb->s_uuid,
                                                            sizeof(sb->s_uuid));
+                }
         }
 
         /* If enabling v1 checksums, downgrade superblock */
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index ed2b1151b171..7cbdf1b2e4ab 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -774,8 +774,12 @@ static bool nfsd41_cb_get_slot(struct nfs4_client *clp, struct rpc_task *task)
 {
         if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
                 rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
-                dprintk("%s slot is busy\n", __func__);
-                return false;
+                /* Race breaker */
+                if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
+                        dprintk("%s slot is busy\n", __func__);
+                        return false;
+                }
+                rpc_wake_up_queued_task(&clp->cl_cb_waitq, task);
         }
         return true;
 }
diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
index 747f3b95bd11..33a46a8dfaf7 100644
--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -335,12 +335,15 @@ void		nfsd_lockd_shutdown(void);
         (NFSD4_SUPPORTED_ATTRS_WORD2 | FATTR4_WORD2_SUPPATTR_EXCLCREAT)
 
 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
-#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \
-        (NFSD4_1_SUPPORTED_ATTRS_WORD2 | FATTR4_WORD2_SECURITY_LABEL)
+#define NFSD4_2_SECURITY_ATTRS          FATTR4_WORD2_SECURITY_LABEL
 #else
-#define NFSD4_2_SUPPORTED_ATTRS_WORD2 0
+#define NFSD4_2_SECURITY_ATTRS          0
 #endif
 
+#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \
+        (NFSD4_1_SUPPORTED_ATTRS_WORD2 | \
+        NFSD4_2_SECURITY_ATTRS)
+
 static inline u32 nfsd_suppattrs0(u32 minorversion)
 {
         return minorversion ? NFSD4_1_SUPPORTED_ATTRS_WORD0