Merge branch 'master' of /pub/scm/linux/kernel/git/torvalds/linux-2.6

25 files changed, 289 insertions, 189 deletions

diff --git a/fs/block_dev.c b/fs/block_dev.c
index 7346c96308a5..99d6af811747 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -706,8 +706,13 @@ retry:
  * @bdev is about to be opened exclusively.  Check @bdev can be opened
  * exclusively and mark that an exclusive open is in progress.  Each
  * successful call to this function must be matched with a call to
- * either bd_claim() or bd_abort_claiming().  If this function
- * succeeds, the matching bd_claim() is guaranteed to succeed.
+ * either bd_finish_claiming() or bd_abort_claiming() (which do not
+ * fail).
+ *
+ * This function is used to gain exclusive access to the block device
+ * without actually causing other exclusive open attempts to fail. It
+ * should be used when the open sequence itself requires exclusive
+ * access but may subsequently fail.
  *
  * CONTEXT:
  * Might sleep.
@@ -734,6 +739,7 @@ static struct block_device *bd_start_claiming(struct block_device *bdev,
                 return ERR_PTR(-ENXIO);
 
         whole = bdget_disk(disk, 0);
+        module_put(disk->fops->owner);
         put_disk(disk);
         if (!whole)
                 return ERR_PTR(-ENOMEM);
@@ -782,15 +788,46 @@ static void bd_abort_claiming(struct block_device *whole, void *holder)
         __bd_abort_claiming(whole, holder);             /* releases bdev_lock */
 }
 
+/* increment holders when we have a legitimate claim. requires bdev_lock */
+static void __bd_claim(struct block_device *bdev, struct block_device *whole,
+                                        void *holder)
+{
+        /* note that for a whole device bd_holders
+         * will be incremented twice, and bd_holder will
+         * be set to bd_claim before being set to holder
+         */
+        whole->bd_holders++;
+        whole->bd_holder = bd_claim;
+        bdev->bd_holders++;
+        bdev->bd_holder = holder;
+}
+
+/**
+ * bd_finish_claiming - finish claiming a block device
+ * @bdev: block device of interest (passed to bd_start_claiming())
+ * @whole: whole block device returned by bd_start_claiming()
+ * @holder: holder trying to claim @bdev
+ *
+ * Finish a claiming block started by bd_start_claiming().
+ *
+ * CONTEXT:
+ * Grabs and releases bdev_lock.
+ */
+static void bd_finish_claiming(struct block_device *bdev,
+                                struct block_device *whole, void *holder)
+{
+        spin_lock(&bdev_lock);
+        BUG_ON(!bd_may_claim(bdev, whole, holder));
+        __bd_claim(bdev, whole, holder);
+        __bd_abort_claiming(whole, holder); /* not actually an abort */
+}
+
 /**
  * bd_claim - claim a block device
  * @bdev: block device to claim
  * @holder: holder trying to claim @bdev
  *
- * Try to claim @bdev which must have been opened successfully.  This
- * function may be called with or without preceding
- * blk_start_claiming().  In the former case, this function is always
- * successful and terminates the claiming block.
+ * Try to claim @bdev which must have been opened successfully.
  *
  * CONTEXT:
  * Might sleep.
@@ -806,23 +843,10 @@ int bd_claim(struct block_device *bdev, void *holder)
         might_sleep();
 
         spin_lock(&bdev_lock);
-
         res = bd_prepare_to_claim(bdev, whole, holder);
-        if (res == 0) {
-                /* note that for a whole device bd_holders
-                 * will be incremented twice, and bd_holder will
-                 * be set to bd_claim before being set to holder
-                 */
-                whole->bd_holders++;
-                whole->bd_holder = bd_claim;
-                bdev->bd_holders++;
-                bdev->bd_holder = holder;
-        }
-
-        if (whole->bd_claiming)
-                __bd_abort_claiming(whole, holder);     /* releases bdev_lock */
-        else
-                spin_unlock(&bdev_lock);
+        if (res == 0)
+                __bd_claim(bdev, whole, holder);
+        spin_unlock(&bdev_lock);
 
         return res;
 }
@@ -1476,7 +1500,7 @@ static int blkdev_open(struct inode * inode, struct file * filp)
 
         if (whole) {
                 if (res == 0)
-                        BUG_ON(bd_claim(bdev, filp) != 0);
+                        bd_finish_claiming(bdev, whole, filp);
                 else
                         bd_abort_claiming(whole, filp);
         }
@@ -1712,7 +1736,7 @@ struct block_device *open_bdev_exclusive(const char *path, fmode_t mode, void *h
         if ((mode & FMODE_WRITE) && bdev_read_only(bdev))
                 goto out_blkdev_put;
 
-        BUG_ON(bd_claim(bdev, holder) != 0);
+        bd_finish_claiming(bdev, whole, holder);
         return bdev;
 
 out_blkdev_put:
diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
index 8d432cd9d580..2222d161c7b6 100644
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -60,6 +60,8 @@ static struct posix_acl *btrfs_get_acl(struct inode *inode, int type)
                 size = __btrfs_getxattr(inode, name, value, size);
                 if (size > 0) {
                         acl = posix_acl_from_xattr(value, size);
+                        if (IS_ERR(acl))
+                                return acl;
                         set_cached_acl(inode, type, acl);
                 }
                 kfree(value);
@@ -160,6 +162,12 @@ static int btrfs_xattr_acl_set(struct dentry *dentry, const char *name,
         int ret;
         struct posix_acl *acl = NULL;
 
+        if (!is_owner_or_cap(dentry->d_inode))
+                return -EPERM;
+
+        if (!IS_POSIXACL(dentry->d_inode))
+                return -EOPNOTSUPP;
+
         if (value) {
                 acl = posix_acl_from_xattr(value, size);
                 if (acl == NULL) {
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index f3b287c22caf..34f7c375567e 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1941,8 +1941,11 @@ struct btrfs_root *open_ctree(struct super_block *sb,
                      btrfs_level_size(tree_root,
                                       btrfs_super_log_root_level(disk_super));
 
-                log_tree_root = kzalloc(sizeof(struct btrfs_root),
-                                                      GFP_NOFS);
+                log_tree_root = kzalloc(sizeof(struct btrfs_root), GFP_NOFS);
+                if (!log_tree_root) {
+                        err = -ENOMEM;
+                        goto fail_trans_kthread;
+                }
 
                 __setup_root(nodesize, leafsize, sectorsize, stripesize,
                              log_tree_root, fs_info, BTRFS_TREE_LOG_OBJECTID);
@@ -1982,6 +1985,10 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         fs_info->fs_root = btrfs_read_fs_root_no_name(fs_info, &location);
         if (!fs_info->fs_root)
                 goto fail_trans_kthread;
+        if (IS_ERR(fs_info->fs_root)) {
+                err = PTR_ERR(fs_info->fs_root);
+                goto fail_trans_kthread;
+        }
 
         if (!(sb->s_flags & MS_RDONLY)) {
                 down_read(&fs_info->cleanup_work_sem);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index b9080d71991a..32d094002a57 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4360,7 +4360,8 @@ void btrfs_free_tree_block(struct btrfs_trans_handle *trans,
 
         block_rsv = get_block_rsv(trans, root);
         cache = btrfs_lookup_block_group(root->fs_info, buf->start);
-        BUG_ON(block_rsv->space_info != cache->space_info);
+        if (block_rsv->space_info != cache->space_info)
+                goto out;
 
         if (btrfs_header_generation(buf) == trans->transid) {
                 if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID) {
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 787b50a16a14..e354c33df082 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1140,7 +1140,7 @@ int btrfs_sync_file(struct file *file, int datasync)
         /*
          * ok we haven't committed the transaction yet, lets do a commit
          */
-        if (file && file->private_data)
+        if (file->private_data)
                 btrfs_ioctl_trans_end(file);
 
         trans = btrfs_start_transaction(root, 0);
@@ -1190,14 +1190,22 @@ static const struct vm_operations_struct btrfs_file_vm_ops = {
 
 static int btrfs_file_mmap(struct file  *filp, struct vm_area_struct *vma)
 {
-        vma->vm_ops = &btrfs_file_vm_ops;
+        struct address_space *mapping = filp->f_mapping;
+
+        if (!mapping->a_ops->readpage)
+                return -ENOEXEC;
+
         file_accessed(filp);
+        vma->vm_ops = &btrfs_file_vm_ops;
+        vma->vm_flags |= VM_CAN_NONLINEAR;
+
         return 0;
 }
 
 const struct file_operations btrfs_file_operations = {
         .llseek         = generic_file_llseek,
         .read           = do_sync_read,
+        .write          = do_sync_write,
         .aio_read       = generic_file_aio_read,
         .splice_read    = generic_file_splice_read,
         .aio_write      = btrfs_file_aio_write,
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index fa6ccc1bfe2a..1bff92ad4744 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2673,7 +2673,7 @@ static int check_path_shared(struct btrfs_root *root,
         struct extent_buffer *eb;
         int level;
         int ret;
-        u64 refs;
+        u64 refs = 1;
 
         for (level = 0; level < BTRFS_MAX_LEVEL; level++) {
                 if (!path->nodes[level])
@@ -6884,7 +6884,7 @@ static long btrfs_fallocate(struct inode *inode, int mode,
                 if (em->block_start == EXTENT_MAP_HOLE ||
                     (cur_offset >= inode->i_size &&
                      !test_bit(EXTENT_FLAG_PREALLOC, &em->flags))) {
-                        ret = btrfs_prealloc_file_range(inode, 0, cur_offset,
+                        ret = btrfs_prealloc_file_range(inode, mode, cur_offset,
                                                         last_byte - cur_offset,
                                                         1 << inode->i_blkbits,
                                                         offset + len,
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 4cdb98cf26de..4dbaf89b1337 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1280,7 +1280,7 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
         trans = btrfs_start_transaction(root, 0);
         if (IS_ERR(trans)) {
                 err = PTR_ERR(trans);
-                goto out;
+                goto out_up_write;
         }
         trans->block_rsv = &root->fs_info->global_block_rsv;
 
@@ -1845,7 +1845,7 @@ static long btrfs_ioctl_default_subvol(struct file *file, void __user *argp)
         dir_id = btrfs_super_root_dir(&root->fs_info->super_copy);
         di = btrfs_lookup_dir_item(trans, root->fs_info->tree_root, path,
                                    dir_id, "default", 7, 1);
-        if (!di) {
+        if (IS_ERR_OR_NULL(di)) {
                 btrfs_free_path(path);
                 btrfs_end_transaction(trans, root);
                 printk(KERN_ERR "Umm, you don't have the default dir item, "
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 05d41e569236..b37d723b9d4a 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -784,16 +784,17 @@ again:
                                 struct btrfs_extent_ref_v0 *ref0;
                                 ref0 = btrfs_item_ptr(eb, path1->slots[0],
                                                 struct btrfs_extent_ref_v0);
-                                root = find_tree_root(rc, eb, ref0);
-                                if (!root->ref_cows)
-                                        cur->cowonly = 1;
                                 if (key.objectid == key.offset) {
+                                        root = find_tree_root(rc, eb, ref0);
                                         if (root && !should_ignore_root(root))
                                                 cur->root = root;
                                         else
                                                 list_add(&cur->list, &useless);
                                         break;
                                 }
+                                if (is_cowonly_root(btrfs_ref_root_v0(eb,
+                                                                      ref0)))
+                                        cur->cowonly = 1;
                         }
 #else
                 BUG_ON(key.type == BTRFS_EXTENT_REF_V0_KEY);
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index b91ccd972644..2d958be761c8 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -330,7 +330,6 @@ int btrfs_del_root(struct btrfs_trans_handle *trans, struct btrfs_root *root,
 {
         struct btrfs_path *path;
         int ret;
-        u32 refs;
         struct btrfs_root_item *ri;
         struct extent_buffer *leaf;
 
@@ -344,8 +343,6 @@ int btrfs_del_root(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         leaf = path->nodes[0];
         ri = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_root_item);
 
-        refs = btrfs_disk_root_refs(leaf, ri);
-        BUG_ON(refs != 0);
         ret = btrfs_del_item(trans, root, path);
 out:
         btrfs_free_path(path);
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index d34b2dfc9628..f2393b390318 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -360,6 +360,8 @@ static struct dentry *get_default_root(struct super_block *sb,
          */
         dir_id = btrfs_super_root_dir(&root->fs_info->super_copy);
         di = btrfs_lookup_dir_item(NULL, root, path, dir_id, "default", 7, 0);
+        if (IS_ERR(di))
+                return ERR_CAST(di);
         if (!di) {
                 /*
                  * Ok the default dir item isn't there.  This is weird since
@@ -390,8 +392,8 @@ setup_root:
         location.offset = 0;
 
         inode = btrfs_iget(sb, &location, new_root, &new);
-        if (!inode)
-                return ERR_PTR(-ENOMEM);
+        if (IS_ERR(inode))
+                return ERR_CAST(inode);
 
         /*
          * If we're just mounting the root most subvol put the inode and return
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index ae3e3a306445..619b61655ee5 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -981,6 +981,46 @@ static int send_cap_msg(struct ceph_mds_session *session,
         return 0;
 }
 
+static void __queue_cap_release(struct ceph_mds_session *session,
+                                u64 ino, u64 cap_id, u32 migrate_seq,
+                                u32 issue_seq)
+{
+        struct ceph_msg *msg;
+        struct ceph_mds_cap_release *head;
+        struct ceph_mds_cap_item *item;
+
+        spin_lock(&session->s_cap_lock);
+        BUG_ON(!session->s_num_cap_releases);
+        msg = list_first_entry(&session->s_cap_releases,
+                               struct ceph_msg, list_head);
+
+        dout(" adding %llx release to mds%d msg %p (%d left)\n",
+             ino, session->s_mds, msg, session->s_num_cap_releases);
+
+        BUG_ON(msg->front.iov_len + sizeof(*item) > PAGE_CACHE_SIZE);
+        head = msg->front.iov_base;
+        head->num = cpu_to_le32(le32_to_cpu(head->num) + 1);
+        item = msg->front.iov_base + msg->front.iov_len;
+        item->ino = cpu_to_le64(ino);
+        item->cap_id = cpu_to_le64(cap_id);
+        item->migrate_seq = cpu_to_le32(migrate_seq);
+        item->seq = cpu_to_le32(issue_seq);
+
+        session->s_num_cap_releases--;
+
+        msg->front.iov_len += sizeof(*item);
+        if (le32_to_cpu(head->num) == CEPH_CAPS_PER_RELEASE) {
+                dout(" release msg %p full\n", msg);
+                list_move_tail(&msg->list_head, &session->s_cap_releases_done);
+        } else {
+                dout(" release msg %p at %d/%d (%d)\n", msg,
+                     (int)le32_to_cpu(head->num),
+                     (int)CEPH_CAPS_PER_RELEASE,
+                     (int)msg->front.iov_len);
+        }
+        spin_unlock(&session->s_cap_lock);
+}
+
 /*
  * Queue cap releases when an inode is dropped from our cache.  Since
  * inode is about to be destroyed, there is no need for i_lock.
@@ -994,41 +1034,9 @@ void ceph_queue_caps_release(struct inode *inode)
         while (p) {
                 struct ceph_cap *cap = rb_entry(p, struct ceph_cap, ci_node);
                 struct ceph_mds_session *session = cap->session;
-                struct ceph_msg *msg;
-                struct ceph_mds_cap_release *head;
-                struct ceph_mds_cap_item *item;
 
-                spin_lock(&session->s_cap_lock);
-                BUG_ON(!session->s_num_cap_releases);
-                msg = list_first_entry(&session->s_cap_releases,
-                                       struct ceph_msg, list_head);
-
-                dout(" adding %p release to mds%d msg %p (%d left)\n",
-                     inode, session->s_mds, msg, session->s_num_cap_releases);
-
-                BUG_ON(msg->front.iov_len + sizeof(*item) > PAGE_CACHE_SIZE);
-                head = msg->front.iov_base;
-                head->num = cpu_to_le32(le32_to_cpu(head->num) + 1);
-                item = msg->front.iov_base + msg->front.iov_len;
-                item->ino = cpu_to_le64(ceph_ino(inode));
-                item->cap_id = cpu_to_le64(cap->cap_id);
-                item->migrate_seq = cpu_to_le32(cap->mseq);
-                item->seq = cpu_to_le32(cap->issue_seq);
-
-                session->s_num_cap_releases--;
-
-                msg->front.iov_len += sizeof(*item);
-                if (le32_to_cpu(head->num) == CEPH_CAPS_PER_RELEASE) {
-                        dout(" release msg %p full\n", msg);
-                        list_move_tail(&msg->list_head,
-                                       &session->s_cap_releases_done);
-                } else {
-                        dout(" release msg %p at %d/%d (%d)\n", msg,
-                             (int)le32_to_cpu(head->num),
-                             (int)CEPH_CAPS_PER_RELEASE,
-                             (int)msg->front.iov_len);
-                }
-                spin_unlock(&session->s_cap_lock);
+                __queue_cap_release(session, ceph_ino(inode), cap->cap_id,
+                                    cap->mseq, cap->issue_seq);
                 p = rb_next(p);
                 __ceph_remove_cap(cap);
         }
@@ -2655,7 +2663,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         struct ceph_mds_caps *h;
         int mds = session->s_mds;
         int op;
-        u32 seq;
+        u32 seq, mseq;
         struct ceph_vino vino;
         u64 cap_id;
         u64 size, max_size;
@@ -2675,6 +2683,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         vino.snap = CEPH_NOSNAP;
         cap_id = le64_to_cpu(h->cap_id);
         seq = le32_to_cpu(h->seq);
+        mseq = le32_to_cpu(h->migrate_seq);
         size = le64_to_cpu(h->size);
         max_size = le64_to_cpu(h->max_size);
 
@@ -2689,6 +2698,18 @@ void ceph_handle_caps(struct ceph_mds_session *session,
              vino.snap, inode);
         if (!inode) {
                 dout(" i don't have ino %llx\n", vino.ino);
+
+                if (op == CEPH_CAP_OP_IMPORT)
+                        __queue_cap_release(session, vino.ino, cap_id,
+                                            mseq, seq);
+
+                /*
+                 * send any full release message to try to move things
+                 * along for the mds (who clearly thinks we still have this
+                 * cap).
+                 */
+                ceph_add_cap_releases(mdsc, session, -1);
+                ceph_send_cap_releases(mdsc, session);
                 goto done;
         }
 
@@ -2714,7 +2735,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         spin_lock(&inode->i_lock);
         cap = __get_cap_for_mds(ceph_inode(inode), mds);
         if (!cap) {
-                dout("no cap on %p ino %llx.%llx from mds%d, releasing\n",
+                dout(" no cap on %p ino %llx.%llx from mds%d\n",
                      inode, ceph_ino(inode), ceph_snap(inode), mds);
                 spin_unlock(&inode->i_lock);
                 goto done;
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 226f5a50d362..ab47f46ca282 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -827,7 +827,7 @@ static void ceph_set_dentry_offset(struct dentry *dn)
 
         spin_lock(&dcache_lock);
         spin_lock(&dn->d_lock);
-        list_move_tail(&dir->d_subdirs, &dn->d_u.d_child);
+        list_move(&dn->d_u.d_child, &dir->d_subdirs);
         dout("set_dentry_offset %p %lld (%p %p)\n", dn, di->offset,
              dn->d_u.d_child.prev, dn->d_u.d_child.next);
         spin_unlock(&dn->d_lock);
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index b49f12822cbc..1766947fc07a 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1066,9 +1066,9 @@ static int trim_caps(struct ceph_mds_client *mdsc,
  *
  * Called under s_mutex.
  */
-static int add_cap_releases(struct ceph_mds_client *mdsc,
-                            struct ceph_mds_session *session,
-                            int extra)
+int ceph_add_cap_releases(struct ceph_mds_client *mdsc,
+                          struct ceph_mds_session *session,
+                          int extra)
 {
         struct ceph_msg *msg;
         struct ceph_mds_cap_release *head;
@@ -1176,8 +1176,8 @@ static int check_cap_flush(struct ceph_mds_client *mdsc, u64 want_flush_seq)
 /*
  * called under s_mutex
  */
-static void send_cap_releases(struct ceph_mds_client *mdsc,
-                       struct ceph_mds_session *session)
+void ceph_send_cap_releases(struct ceph_mds_client *mdsc,
+                            struct ceph_mds_session *session)
 {
         struct ceph_msg *msg;
 
@@ -1980,7 +1980,7 @@ out_err:
         }
         mutex_unlock(&mdsc->mutex);
 
-        add_cap_releases(mdsc, req->r_session, -1);
+        ceph_add_cap_releases(mdsc, req->r_session, -1);
         mutex_unlock(&session->s_mutex);
 
         /* kick calling process */
@@ -2433,6 +2433,7 @@ static void handle_lease(struct ceph_mds_client *mdsc,
         struct ceph_dentry_info *di;
         int mds = session->s_mds;
         struct ceph_mds_lease *h = msg->front.iov_base;
+        u32 seq;
         struct ceph_vino vino;
         int mask;
         struct qstr dname;
@@ -2446,6 +2447,7 @@ static void handle_lease(struct ceph_mds_client *mdsc,
         vino.ino = le64_to_cpu(h->ino);
         vino.snap = CEPH_NOSNAP;
         mask = le16_to_cpu(h->mask);
+        seq = le32_to_cpu(h->seq);
         dname.name = (void *)h + sizeof(*h) + sizeof(u32);
         dname.len = msg->front.iov_len - sizeof(*h) - sizeof(u32);
         if (dname.len != get_unaligned_le32(h+1))
@@ -2456,8 +2458,9 @@ static void handle_lease(struct ceph_mds_client *mdsc,
 
         /* lookup inode */
         inode = ceph_find_inode(sb, vino);
-        dout("handle_lease '%s', mask %d, ino %llx %p\n",
-             ceph_lease_op_name(h->action), mask, vino.ino, inode);
+        dout("handle_lease %s, mask %d, ino %llx %p %.*s\n",
+             ceph_lease_op_name(h->action), mask, vino.ino, inode,
+             dname.len, dname.name);
         if (inode == NULL) {
                 dout("handle_lease no inode %llx\n", vino.ino);
                 goto release;
@@ -2482,7 +2485,8 @@ static void handle_lease(struct ceph_mds_client *mdsc,
         switch (h->action) {
         case CEPH_MDS_LEASE_REVOKE:
                 if (di && di->lease_session == session) {
-                        h->seq = cpu_to_le32(di->lease_seq);
+                        if (ceph_seq_cmp(di->lease_seq, seq) > 0)
+                                h->seq = cpu_to_le32(di->lease_seq);
                         __ceph_mdsc_drop_dentry_lease(dentry);
                 }
                 release = 1;
@@ -2496,7 +2500,7 @@ static void handle_lease(struct ceph_mds_client *mdsc,
                         unsigned long duration =
                                 le32_to_cpu(h->duration_ms) * HZ / 1000;
 
-                        di->lease_seq = le32_to_cpu(h->seq);
+                        di->lease_seq = seq;
                         dentry->d_time = di->lease_renew_from + duration;
                         di->lease_renew_after = di->lease_renew_from +
                                 (duration >> 1);
@@ -2686,10 +2690,10 @@ static void delayed_work(struct work_struct *work)
                         send_renew_caps(mdsc, s);
                 else
                         ceph_con_keepalive(&s->s_con);
-                add_cap_releases(mdsc, s, -1);
+                ceph_add_cap_releases(mdsc, s, -1);
                 if (s->s_state == CEPH_MDS_SESSION_OPEN ||
                     s->s_state == CEPH_MDS_SESSION_HUNG)
-                        send_cap_releases(mdsc, s);
+                        ceph_send_cap_releases(mdsc, s);
                 mutex_unlock(&s->s_mutex);
                 ceph_put_mds_session(s);
 
diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
index d9936c4f1212..b292fa42a66d 100644
--- a/fs/ceph/mds_client.h
+++ b/fs/ceph/mds_client.h
@@ -322,6 +322,12 @@ static inline void ceph_mdsc_put_request(struct ceph_mds_request *req)
         kref_put(&req->r_kref, ceph_mdsc_release_request);
 }
 
+extern int ceph_add_cap_releases(struct ceph_mds_client *mdsc,
+                                 struct ceph_mds_session *session,
+                                 int extra);
+extern void ceph_send_cap_releases(struct ceph_mds_client *mdsc,
+                                   struct ceph_mds_session *session);
+
 extern void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc);
 
 extern char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *base,
diff --git a/fs/ceph/mon_client.c b/fs/ceph/mon_client.c
index 21c62e9b7d1d..07a539906e67 100644
--- a/fs/ceph/mon_client.c
+++ b/fs/ceph/mon_client.c
@@ -400,6 +400,8 @@ static void release_generic_request(struct kref *kref)
                 ceph_msg_put(req->reply);
         if (req->request)
                 ceph_msg_put(req->request);
+
+        kfree(req);
 }
 
 static void put_generic_request(struct ceph_mon_generic_request *req)
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 4e0bee240b9d..fa87f51e38e1 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -89,7 +89,7 @@ static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf)
 
         buf->f_files = le64_to_cpu(st.num_objects);
         buf->f_ffree = -1;
-        buf->f_namelen = PATH_MAX;
+        buf->f_namelen = NAME_MAX;
         buf->f_frsize = PAGE_CACHE_SIZE;
 
         /* leave fsid little-endian, regardless of host endianness */
@@ -926,7 +926,7 @@ static int ceph_compare_super(struct super_block *sb, void *data)
 /*
  * construct our own bdi so we can control readahead, etc.
  */
-static atomic_long_t bdi_seq = ATOMIC_INIT(0);
+static atomic_long_t bdi_seq = ATOMIC_LONG_INIT(0);
 
 static int ceph_register_bdi(struct super_block *sb, struct ceph_client *client)
 {
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 19df61c321fd..42272d67955a 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4942,20 +4942,26 @@ void ext4_set_inode_flags(struct inode *inode)
 /* Propagate flags from i_flags to EXT4_I(inode)->i_flags */
 void ext4_get_inode_flags(struct ext4_inode_info *ei)
 {
-        unsigned int flags = ei->vfs_inode.i_flags;
-
-        ei->i_flags &= ~(EXT4_SYNC_FL|EXT4_APPEND_FL|
-                        EXT4_IMMUTABLE_FL|EXT4_NOATIME_FL|EXT4_DIRSYNC_FL);
-        if (flags & S_SYNC)
-                ei->i_flags |= EXT4_SYNC_FL;
-        if (flags & S_APPEND)
-                ei->i_flags |= EXT4_APPEND_FL;
-        if (flags & S_IMMUTABLE)
-                ei->i_flags |= EXT4_IMMUTABLE_FL;
-        if (flags & S_NOATIME)
-                ei->i_flags |= EXT4_NOATIME_FL;
-        if (flags & S_DIRSYNC)
-                ei->i_flags |= EXT4_DIRSYNC_FL;
+        unsigned int vfs_fl;
+        unsigned long old_fl, new_fl;
+
+        do {
+                vfs_fl = ei->vfs_inode.i_flags;
+                old_fl = ei->i_flags;
+                new_fl = old_fl & ~(EXT4_SYNC_FL|EXT4_APPEND_FL|
+                                EXT4_IMMUTABLE_FL|EXT4_NOATIME_FL|
+                                EXT4_DIRSYNC_FL);
+                if (vfs_fl & S_SYNC)
+                        new_fl |= EXT4_SYNC_FL;
+                if (vfs_fl & S_APPEND)
+                        new_fl |= EXT4_APPEND_FL;
+                if (vfs_fl & S_IMMUTABLE)
+                        new_fl |= EXT4_IMMUTABLE_FL;
+                if (vfs_fl & S_NOATIME)
+                        new_fl |= EXT4_NOATIME_FL;
+                if (vfs_fl & S_DIRSYNC)
+                        new_fl |= EXT4_DIRSYNC_FL;
+        } while (cmpxchg(&ei->i_flags, old_fl, new_fl) != old_fl);
 }
 
 static blkcnt_t ext4_inode_blocks(struct ext4_inode *raw_inode,
@@ -5191,7 +5197,7 @@ static int ext4_inode_blocks_set(handle_t *handle,
                  */
                 raw_inode->i_blocks_lo   = cpu_to_le32(i_blocks);
                 raw_inode->i_blocks_high = 0;
-                ei->i_flags &= ~EXT4_HUGE_FILE_FL;
+                ext4_clear_inode_flag(inode, EXT4_INODE_HUGE_FILE);
                 return 0;
         }
         if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_HUGE_FILE))
@@ -5204,9 +5210,9 @@ static int ext4_inode_blocks_set(handle_t *handle,
                  */
                 raw_inode->i_blocks_lo   = cpu_to_le32(i_blocks);
                 raw_inode->i_blocks_high = cpu_to_le16(i_blocks >> 32);
-                ei->i_flags &= ~EXT4_HUGE_FILE_FL;
+                ext4_clear_inode_flag(inode, EXT4_INODE_HUGE_FILE);
         } else {
-                ei->i_flags |= EXT4_HUGE_FILE_FL;
+                ext4_set_inode_flag(inode, EXT4_INODE_HUGE_FILE);
                 /* i_block is stored in file system block size */
                 i_blocks = i_blocks >> (inode->i_blkbits - 9);
                 raw_inode->i_blocks_lo   = cpu_to_le32(i_blocks);
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 3a6c92ac131c..52abfa12762a 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -960,6 +960,9 @@ mext_check_arguments(struct inode *orig_inode,
                 return -EINVAL;
         }
 
+        if (IS_IMMUTABLE(donor_inode) || IS_APPEND(donor_inode))
+                return -EPERM;
+
         /* Ext4 move extent does not support swapfile */
         if (IS_SWAPFILE(orig_inode) || IS_SWAPFILE(donor_inode)) {
                 ext4_debug("ext4 move extent: The argument files should "
diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c
index a33aab6b5e68..54a92fd02bbd 100644
--- a/fs/jffs2/acl.c
+++ b/fs/jffs2/acl.c
@@ -234,8 +234,9 @@ static int jffs2_set_acl(struct inode *inode, int type, struct posix_acl *acl)
                         if (inode->i_mode != mode) {
                                 struct iattr attr;
 
-                                attr.ia_valid = ATTR_MODE;
+                                attr.ia_valid = ATTR_MODE | ATTR_CTIME;
                                 attr.ia_mode = mode;
+                                attr.ia_ctime = CURRENT_TIME_SEC;
                                 rc = jffs2_do_setattr(inode, &attr);
                                 if (rc < 0)
                                         return rc;
diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
index 7aa4417e085f..166062a68230 100644
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -222,15 +222,18 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry, int mode,
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(ri->ctime));
 
         jffs2_free_raw_inode(ri);
-        d_instantiate(dentry, inode);
 
         D1(printk(KERN_DEBUG "jffs2_create: Created ino #%lu with mode %o, nlink %d(%d). nrpages %ld\n",
                   inode->i_ino, inode->i_mode, inode->i_nlink,
                   f->inocache->pino_nlink, inode->i_mapping->nrpages));
+
+        d_instantiate(dentry, inode);
+        unlock_new_inode(inode);
         return 0;
 
  fail:
         make_bad_inode(inode);
+        unlock_new_inode(inode);
         iput(inode);
         jffs2_free_raw_inode(ri);
         return ret;
@@ -360,8 +363,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 /* Eeek. Wave bye bye */
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fn);
+                ret = PTR_ERR(fn);
+                goto fail;
         }
 
         /* We use f->target field to store the target path. */
@@ -370,8 +373,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 printk(KERN_WARNING "Can't allocate %d bytes of memory\n", targetlen + 1);
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         memcpy(f->target, target, targetlen + 1);
@@ -386,30 +389,24 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         jffs2_complete_reservation(c);
 
         ret = jffs2_init_security(inode, dir_i);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
+
         ret = jffs2_init_acl_post(inode);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                   ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-        if (ret) {
-                /* Eep. */
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         rd = jffs2_alloc_raw_dirent();
         if (!rd) {
                 /* Argh. Now we treat it like a normal delete */
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         dir_f = JFFS2_INODE_INFO(dir_i);
@@ -437,8 +434,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 jffs2_complete_reservation(c);
                 jffs2_free_raw_dirent(rd);
                 mutex_unlock(&dir_f->sem);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fd);
+                ret = PTR_ERR(fd);
+                goto fail;
         }
 
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -453,7 +450,14 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         jffs2_complete_reservation(c);
 
         d_instantiate(dentry, inode);
+        unlock_new_inode(inode);
         return 0;
+
+ fail:
+        make_bad_inode(inode);
+        unlock_new_inode(inode);
+        iput(inode);
+        return ret;
 }
 
 
@@ -519,8 +523,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
                 /* Eeek. Wave bye bye */
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fn);
+                ret = PTR_ERR(fn);
+                goto fail;
         }
         /* No data here. Only a metadata node, which will be
            obsoleted by the first data write
@@ -531,30 +535,24 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         jffs2_complete_reservation(c);
 
         ret = jffs2_init_security(inode, dir_i);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
+
         ret = jffs2_init_acl_post(inode);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                   ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-        if (ret) {
-                /* Eep. */
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         rd = jffs2_alloc_raw_dirent();
         if (!rd) {
                 /* Argh. Now we treat it like a normal delete */
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         dir_f = JFFS2_INODE_INFO(dir_i);
@@ -582,8 +580,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
                 jffs2_complete_reservation(c);
                 jffs2_free_raw_dirent(rd);
                 mutex_unlock(&dir_f->sem);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fd);
+                ret = PTR_ERR(fd);
+                goto fail;
         }
 
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -599,7 +597,14 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         jffs2_complete_reservation(c);
 
         d_instantiate(dentry, inode);
+        unlock_new_inode(inode);
         return 0;
+
+ fail:
+        make_bad_inode(inode);
+        unlock_new_inode(inode);
+        iput(inode);
+        return ret;
 }
 
 static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry)
@@ -693,8 +698,8 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
                 /* Eeek. Wave bye bye */
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fn);
+                ret = PTR_ERR(fn);
+                goto fail;
         }
         /* No data here. Only a metadata node, which will be
            obsoleted by the first data write
@@ -705,30 +710,24 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         jffs2_complete_reservation(c);
 
         ret = jffs2_init_security(inode, dir_i);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
+
         ret = jffs2_init_acl_post(inode);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                   ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-        if (ret) {
-                /* Eep. */
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         rd = jffs2_alloc_raw_dirent();
         if (!rd) {
                 /* Argh. Now we treat it like a normal delete */
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         dir_f = JFFS2_INODE_INFO(dir_i);
@@ -759,8 +758,8 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
                 jffs2_complete_reservation(c);
                 jffs2_free_raw_dirent(rd);
                 mutex_unlock(&dir_f->sem);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fd);
+                ret = PTR_ERR(fd);
+                goto fail;
         }
 
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -775,8 +774,14 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         jffs2_complete_reservation(c);
 
         d_instantiate(dentry, inode);
-
+        unlock_new_inode(inode);
         return 0;
+
+ fail:
+        make_bad_inode(inode);
+        unlock_new_inode(inode);
+        iput(inode);
+        return ret;
 }
 
 static int jffs2_rename (struct inode *old_dir_i, struct dentry *old_dentry,
diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 8bc2c80ab159..459d39d1ea0b 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -465,7 +465,12 @@ struct inode *jffs2_new_inode (struct inode *dir_i, int mode, struct jffs2_raw_i
         inode->i_blocks = 0;
         inode->i_size = 0;
 
-        insert_inode_hash(inode);
+        if (insert_inode_locked(inode) < 0) {
+                make_bad_inode(inode);
+                unlock_new_inode(inode);
+                iput(inode);
+                return ERR_PTR(-EINVAL);
+        }
 
         return inode;
 }
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 12f7109720c2..4a2734758778 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4122,8 +4122,8 @@ nfs4_state_shutdown(void)
         nfs4_lock_state();
         nfs4_release_reclaim();
         __nfs4_state_shutdown();
-        nfsd4_destroy_callback_queue();
         nfs4_unlock_state();
+        nfsd4_destroy_callback_queue();
 }
 
 /*
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index ebbf3b6b2457..3c111120b619 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -443,8 +443,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
         if (size_change)
                 put_write_access(inode);
         if (!err)
-                if (EX_ISSYNC(fhp->fh_export))
-                        write_inode_now(inode, 1);
+                commit_metadata(fhp);
 out:
         return err;
 
diff --git a/fs/pipe.c b/fs/pipe.c
index 69c4c7c13ea9..279eef96c51c 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1145,13 +1145,20 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
          * and adjust the indexes.
          */
         if (pipe->nrbufs) {
-                const unsigned int tail = pipe->nrbufs & (pipe->buffers - 1);
-                const unsigned int head = pipe->nrbufs - tail;
+                unsigned int tail;
+                unsigned int head;
 
+                tail = pipe->curbuf + pipe->nrbufs;
+                if (tail < pipe->buffers)
+                        tail = 0;
+                else
+                        tail &= (pipe->buffers - 1);
+
+                head = pipe->nrbufs - tail;
                 if (head)
                         memcpy(bufs, pipe->bufs + pipe->curbuf, head * sizeof(struct pipe_buffer));
                 if (tail)
-                        memcpy(bufs + head, pipe->bufs + pipe->curbuf, tail * sizeof(struct pipe_buffer));
+                        memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer));
         }
 
         pipe->curbuf = 0;
@@ -1208,12 +1215,13 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
                 size = round_pipe_size(arg);
                 nr_pages = size >> PAGE_SHIFT;
 
+                ret = -EINVAL;
+                if (!nr_pages)
+                        goto out;
+
                 if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
                         ret = -EPERM;
                         goto out;
-                } else if (nr_pages < PAGE_SIZE) {
-                        ret = -EINVAL;
-                        goto out;
                 }
                 ret = pipe_set_size(pipe, nr_pages);
                 break;
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index a0fa3bf0d1bb..34640d6dbdcb 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -1381,14 +1381,6 @@ xfs_vm_writepage(
         if (!page_has_buffers(page))
                 create_empty_buffers(page, 1 << inode->i_blkbits, 0);
 
-
-        /*
-         *  VM calculation for nr_to_write seems off.  Bump it way
-         *  up, this gets simple streaming writes zippy again.
-         *  To be reviewed again after Jens' writeback changes.
-         */
-        wbc->nr_to_write *= 4;
-
         /*
          * Convert delayed allocate, unwritten or unmapped space
          * to real space and flush out to disk.