22 files changed, 171 insertions, 122 deletions

diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
index 55e8ee1900a..3263084eef9 100644
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -42,7 +42,7 @@ config BINFMT_ELF_FDPIC
 
 config BINFMT_FLAT
         bool "Kernel support for flat binaries"
-        depends on !MMU
+        depends on !MMU && (!FRV || BROKEN)
         help
           Support uClinux FLAT format binaries.
 
diff --git a/fs/afs/callback.c b/fs/afs/callback.c
index a78d5b236bb..587ef5123cd 100644
--- a/fs/afs/callback.c
+++ b/fs/afs/callback.c
@@ -8,7 +8,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Authors: David Woodhouse <dwmw2@cambridge.redhat.com>
+ * Authors: David Woodhouse <dwmw2@infradead.org>
  *          David Howells <dhowells@redhat.com>
  *
  */
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 08db82e1343..bb47217f6a1 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -8,7 +8,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Authors: David Woodhouse <dwmw2@cambridge.redhat.com>
+ * Authors: David Woodhouse <dwmw2@infradead.org>
  *          David Howells <dhowells@redhat.com>
  *
  */
diff --git a/fs/afs/super.c b/fs/afs/super.c
index 4b572b801d8..7e3faeef681 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -10,7 +10,7 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
  * Authors: David Howells <dhowells@redhat.com>
- *          David Woodhouse <dwmw2@redhat.com>
+ *          David Woodhouse <dwmw2@infradead.org>
  *
  */
 
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index ddd35d87339..d051a32e627 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -390,7 +390,7 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
         }
 
         /* expand the stack mapping to use up the entire allocation granule */
-        fullsize = ksize((char *) current->mm->start_brk);
+        fullsize = kobjsize((char *) current->mm->start_brk);
         if (!IS_ERR_VALUE(do_mremap(current->mm->start_brk, stack_size,
                                     fullsize, 0, 0)))
                 stack_size = fullsize;
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 3b40d45a3a1..2cb1acda3a8 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -548,7 +548,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                         PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0);
                 /* Remap to use all availabe slack region space */
                 if (realdatastart && (realdatastart < (unsigned long)-4096)) {
-                        reallen = ksize((void *)realdatastart);
+                        reallen = kobjsize((void *)realdatastart);
                         if (reallen > len) {
                                 realdatastart = do_mremap(realdatastart, len,
                                         reallen, MREMAP_FIXED, realdatastart);
@@ -600,7 +600,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                         PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0);
                 /* Remap to use all availabe slack region space */
                 if (textpos && (textpos < (unsigned long) -4096)) {
-                        reallen = ksize((void *)textpos);
+                        reallen = kobjsize((void *)textpos);
                         if (reallen > len) {
                                 textpos = do_mremap(textpos, len, reallen,
                                         MREMAP_FIXED, textpos);
@@ -683,7 +683,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                  */
                 current->mm->start_brk = datapos + data_len + bss_len;
                 current->mm->brk = (current->mm->start_brk + 3) & ~3;
-                current->mm->context.end_brk = memp + ksize((void *) memp) - stack_len;
+                current->mm->context.end_brk = memp + kobjsize((void *) memp) - stack_len;
         }
 
         if (flags & FLAT_FLAG_KTRACE)
@@ -790,7 +790,7 @@ static int load_flat_file(struct linux_binprm * bprm,
 
         /* zero the BSS,  BRK and stack areas */
         memset((void*)(datapos + data_len), 0, bss_len + 
-                        (memp + ksize((void *) memp) - stack_len -      /* end brk */
+                        (memp + kobjsize((void *) memp) - stack_len -   /* end brk */
                         libinfo->lib_list[id].start_brk) +              /* start brk */
                         stack_len);
 
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 7d822fae776..470c10ceb0f 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -12,6 +12,7 @@
 #include <linux/kmod.h>
 #include <linux/major.h>
 #include <linux/smp_lock.h>
+#include <linux/device_cgroup.h>
 #include <linux/highmem.h>
 #include <linux/blkdev.h>
 #include <linux/module.h>
@@ -928,9 +929,14 @@ static int do_open(struct block_device *bdev, struct file *file, int for_part)
 {
         struct module *owner = NULL;
         struct gendisk *disk;
-        int ret = -ENXIO;
+        int ret;
         int part;
 
+        ret = devcgroup_inode_permission(bdev->bd_inode, file->f_mode);
+        if (ret != 0)
+                return ret;
+
+        ret = -ENXIO;
         file->f_mapping = bdev->bd_inode->i_mapping;
         lock_kernel();
         disk = get_gendisk(bdev->bd_dev, &part);
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index cb52cbbe45f..f58e41d3ba4 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -186,6 +186,11 @@ asn1_length_decode(struct asn1_ctx *ctx, unsigned int *def, unsigned int *len)
                         }
                 }
         }
+
+        /* don't trust len bigger than ctx buffer */
+        if (*len > ctx->end - ctx->pointer)
+                return 0;
+
         return 1;
 }
 
@@ -203,6 +208,10 @@ asn1_header_decode(struct asn1_ctx *ctx,
         if (!asn1_length_decode(ctx, &def, &len))
                 return 0;
 
+        /* primitive shall be definite, indefinite shall be constructed */
+        if (*con == ASN1_PRI && !def)
+                return 0;
+
         if (def)
                 *eoc = ctx->pointer + len;
         else
@@ -389,6 +398,11 @@ asn1_oid_decode(struct asn1_ctx *ctx,
         unsigned long *optr;
 
         size = eoc - ctx->pointer + 1;
+
+        /* first subid actually encodes first two subids */
+        if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
+                return 0;
+
         *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
         if (*oid == NULL)
                 return 0;
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 9b8b4cfdf99..fb655b4593c 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -3927,9 +3927,9 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
         }
 
         ref = (struct dfs_referral_level_3 *) &(pSMBr->referrals);
-        if (ref->VersionNumber != 3) {
+        if (ref->VersionNumber != cpu_to_le16(3)) {
                 cERROR(1, ("Referrals of V%d version are not supported,"
-                        "should be V3", ref->VersionNumber));
+                        "should be V3", le16_to_cpu(ref->VersionNumber)));
                 rc = -EINVAL;
                 goto parse_DFS_referrals_exit;
         }
@@ -3977,7 +3977,7 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 if (rc)
                         goto parse_DFS_referrals_exit;
 
-                ref += ref->Size;
+                ref += le16_to_cpu(ref->Size);
         }
 
 parse_DFS_referrals_exit:
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 951ee33a022..c15c25745e0 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -660,8 +660,6 @@ int ecryptfs_get_tfm_and_mutex_for_cipher_name(struct crypto_blkcipher **tfm,
 int ecryptfs_keyring_auth_tok_for_sig(struct key **auth_tok_key,
                                       struct ecryptfs_auth_tok **auth_tok,
                                       char *sig);
-int ecryptfs_write_zeros(struct file *file, pgoff_t index, int start,
-                         int num_zeros);
 int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
                          loff_t offset, size_t size);
 int ecryptfs_write_lower_page_segment(struct inode *ecryptfs_inode,
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index ebf55150be5..75c2ea9fee3 100644
--- a/fs/ecryptfs/read_write.c
+++ b/fs/ecryptfs/read_write.c
@@ -157,20 +157,6 @@ int ecryptfs_write(struct file *ecryptfs_file, char *data, loff_t offset,
                                ecryptfs_page_idx, rc);
                         goto out;
                 }
-                if (start_offset_in_page) {
-                        /* Read in the page from the lower
-                         * into the eCryptfs inode page cache,
-                         * decrypting */
-                        rc = ecryptfs_decrypt_page(ecryptfs_page);
-                        if (rc) {
-                                printk(KERN_ERR "%s: Error decrypting "
-                                       "page; rc = [%d]\n",
-                                       __func__, rc);
-                                ClearPageUptodate(ecryptfs_page);
-                                page_cache_release(ecryptfs_page);
-                                goto out;
-                        }
-                }
                 ecryptfs_page_virt = kmap_atomic(ecryptfs_page, KM_USER0);
 
                 /*
@@ -349,14 +335,6 @@ int ecryptfs_read(char *data, loff_t offset, size_t size,
                                ecryptfs_page_idx, rc);
                         goto out;
                 }
-                rc = ecryptfs_decrypt_page(ecryptfs_page);
-                if (rc) {
-                        printk(KERN_ERR "%s: Error decrypting "
-                               "page; rc = [%d]\n", __func__, rc);
-                        ClearPageUptodate(ecryptfs_page);
-                        page_cache_release(ecryptfs_page);
-                        goto out;
-                }
                 ecryptfs_page_virt = kmap_atomic(ecryptfs_page, KM_USER0);
                 memcpy((data + data_offset),
                        ((char *)ecryptfs_page_virt + start_offset_in_page),
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 28cfd0b4052..77278e947e9 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -580,7 +580,8 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
         }
 
         blk = EXT3_SB(sb)->s_sbh->b_blocknr + 1 + EXT3_SB(sb)->s_gdb_count;
-        data = (__le32 *)dind->b_data + EXT3_SB(sb)->s_gdb_count;
+        data = (__le32 *)dind->b_data + (EXT3_SB(sb)->s_gdb_count %
+                                         EXT3_ADDR_PER_BLOCK(sb));
         end = (__le32 *)dind->b_data + EXT3_ADDR_PER_BLOCK(sb);
 
         /* Get each reserved primary GDT block and verify it holds backups */
diff --git a/fs/libfs.c b/fs/libfs.c
index b004dfadd89..892d41cb338 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -528,6 +528,23 @@ ssize_t simple_read_from_buffer(void __user *to, size_t count, loff_t *ppos,
         return count;
 }
 
+ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,
+                                const void *from, size_t available)
+{
+        loff_t pos = *ppos;
+
+        if (pos < 0)
+                return -EINVAL;
+        if (pos >= available)
+                return 0;
+        if (count > available - pos)
+                count = available - pos;
+        memcpy(to, from + pos, count);
+        *ppos = pos + count;
+
+        return count;
+}
+
 /*
  * Transaction based IO.
  * The file expects a single write which triggers the transaction, and then
@@ -800,6 +817,7 @@ EXPORT_SYMBOL(simple_statfs);
 EXPORT_SYMBOL(simple_sync_file);
 EXPORT_SYMBOL(simple_unlink);
 EXPORT_SYMBOL(simple_read_from_buffer);
+EXPORT_SYMBOL(memory_read_from_buffer);
 EXPORT_SYMBOL(simple_transaction_get);
 EXPORT_SYMBOL(simple_transaction_read);
 EXPORT_SYMBOL(simple_transaction_release);
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 1e44ad14881..a27d61581bd 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -142,53 +142,43 @@ static void o2net_idle_timer(unsigned long data);
 static void o2net_sc_postpone_idle(struct o2net_sock_container *sc);
 static void o2net_sc_reset_idle_timer(struct o2net_sock_container *sc);
 
-static void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
-                           u32 msgkey, struct task_struct *task, u8 node)
-{
 #ifdef CONFIG_DEBUG_FS
+void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
+                    u32 msgkey, struct task_struct *task, u8 node)
+{
         INIT_LIST_HEAD(&nst->st_net_debug_item);
         nst->st_task = task;
         nst->st_msg_type = msgtype;
         nst->st_msg_key = msgkey;
         nst->st_node = node;
-#endif
 }
 
-static void o2net_set_nst_sock_time(struct o2net_send_tracking *nst)
+void o2net_set_nst_sock_time(struct o2net_send_tracking *nst)
 {
-#ifdef CONFIG_DEBUG_FS
         do_gettimeofday(&nst->st_sock_time);
-#endif
 }
 
-static void o2net_set_nst_send_time(struct o2net_send_tracking *nst)
+void o2net_set_nst_send_time(struct o2net_send_tracking *nst)
 {
-#ifdef CONFIG_DEBUG_FS
         do_gettimeofday(&nst->st_send_time);
-#endif
 }
 
-static void o2net_set_nst_status_time(struct o2net_send_tracking *nst)
+void o2net_set_nst_status_time(struct o2net_send_tracking *nst)
 {
-#ifdef CONFIG_DEBUG_FS
         do_gettimeofday(&nst->st_status_time);
-#endif
 }
 
-static void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
+void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
                                          struct o2net_sock_container *sc)
 {
-#ifdef CONFIG_DEBUG_FS
         nst->st_sc = sc;
-#endif
 }
 
-static void o2net_set_nst_msg_id(struct o2net_send_tracking *nst, u32 msg_id)
+void o2net_set_nst_msg_id(struct o2net_send_tracking *nst, u32 msg_id)
 {
-#ifdef CONFIG_DEBUG_FS
         nst->st_id = msg_id;
-#endif
 }
+#endif /* CONFIG_DEBUG_FS */
 
 static inline int o2net_reconnect_delay(void)
 {
diff --git a/fs/ocfs2/cluster/tcp.h b/fs/ocfs2/cluster/tcp.h
index a705d5d1903..fd6179eb26d 100644
--- a/fs/ocfs2/cluster/tcp.h
+++ b/fs/ocfs2/cluster/tcp.h
@@ -128,23 +128,23 @@ void o2net_debug_del_nst(struct o2net_send_tracking *nst);
 void o2net_debug_add_sc(struct o2net_sock_container *sc);
 void o2net_debug_del_sc(struct o2net_sock_container *sc);
 #else
-static int o2net_debugfs_init(void)
+static inline int o2net_debugfs_init(void)
 {
         return 0;
 }
-static void o2net_debugfs_exit(void)
+static inline void o2net_debugfs_exit(void)
 {
 }
-static void o2net_debug_add_nst(struct o2net_send_tracking *nst)
+static inline void o2net_debug_add_nst(struct o2net_send_tracking *nst)
 {
 }
-static void o2net_debug_del_nst(struct o2net_send_tracking *nst)
+static inline void o2net_debug_del_nst(struct o2net_send_tracking *nst)
 {
 }
-static void o2net_debug_add_sc(struct o2net_sock_container *sc)
+static inline void o2net_debug_add_sc(struct o2net_sock_container *sc)
 {
 }
-static void o2net_debug_del_sc(struct o2net_sock_container *sc)
+static inline void o2net_debug_del_sc(struct o2net_sock_container *sc)
 {
 }
 #endif  /* CONFIG_DEBUG_FS */
diff --git a/fs/ocfs2/cluster/tcp_internal.h b/fs/ocfs2/cluster/tcp_internal.h
index 8d58cfe410b..18307ff81b7 100644
--- a/fs/ocfs2/cluster/tcp_internal.h
+++ b/fs/ocfs2/cluster/tcp_internal.h
@@ -224,10 +224,42 @@ struct o2net_send_tracking {
         struct timeval                  st_send_time;
         struct timeval                  st_status_time;
 };
+
+void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
+                    u32 msgkey, struct task_struct *task, u8 node);
+void o2net_set_nst_sock_time(struct o2net_send_tracking *nst);
+void o2net_set_nst_send_time(struct o2net_send_tracking *nst);
+void o2net_set_nst_status_time(struct o2net_send_tracking *nst);
+void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
+                                  struct o2net_sock_container *sc);
+void o2net_set_nst_msg_id(struct o2net_send_tracking *nst, u32 msg_id);
+
 #else
 struct o2net_send_tracking {
         u32     dummy;
 };
+
+static inline void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
+                                  u32 msgkey, struct task_struct *task, u8 node)
+{
+}
+static inline void o2net_set_nst_sock_time(struct o2net_send_tracking *nst)
+{
+}
+static inline void o2net_set_nst_send_time(struct o2net_send_tracking *nst)
+{
+}
+static inline void o2net_set_nst_status_time(struct o2net_send_tracking *nst)
+{
+}
+static inline void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
+                                                struct o2net_sock_container *sc)
+{
+}
+static inline void o2net_set_nst_msg_id(struct o2net_send_tracking *nst,
+                                        u32 msg_id)
+{
+}
 #endif  /* CONFIG_DEBUG_FS */
 
 #endif /* O2CLUSTER_TCP_INTERNAL_H */
diff --git a/fs/ocfs2/dlm/dlmdebug.h b/fs/ocfs2/dlm/dlmdebug.h
index d34a62a3a62..8c686d22f9c 100644
--- a/fs/ocfs2/dlm/dlmdebug.h
+++ b/fs/ocfs2/dlm/dlmdebug.h
@@ -60,25 +60,25 @@ void dlm_destroy_debugfs_root(void);
 
 #else
 
-static int dlm_debug_init(struct dlm_ctxt *dlm)
+static inline int dlm_debug_init(struct dlm_ctxt *dlm)
 {
         return 0;
 }
-static void dlm_debug_shutdown(struct dlm_ctxt *dlm)
+static inline void dlm_debug_shutdown(struct dlm_ctxt *dlm)
 {
 }
-static int dlm_create_debugfs_subroot(struct dlm_ctxt *dlm)
+static inline int dlm_create_debugfs_subroot(struct dlm_ctxt *dlm)
 {
         return 0;
 }
-static void dlm_destroy_debugfs_subroot(struct dlm_ctxt *dlm)
+static inline void dlm_destroy_debugfs_subroot(struct dlm_ctxt *dlm)
 {
 }
-static int dlm_create_debugfs_root(void)
+static inline int dlm_create_debugfs_root(void)
 {
         return 0;
 }
-static void dlm_destroy_debugfs_root(void)
+static inline void dlm_destroy_debugfs_root(void)
 {
 }
 
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index b503772cd0e..6b97d11f6bf 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -61,7 +61,7 @@
  * negotiated by the client.  The client negotiates based on the maximum
  * version advertised in /sys/fs/ocfs2/max_locking_protocol.  The major
  * number from the "SETV" message must match
- * user_stack.sp_proto->lp_max_version.pv_major, and the minor number
+ * ocfs2_user_plugin.sp_proto->lp_max_version.pv_major, and the minor number
  * must be less than or equal to ...->lp_max_version.pv_minor.
  *
  * Once this information has been set, mounts will be allowed.  From this
@@ -153,7 +153,7 @@ union ocfs2_control_message {
         struct ocfs2_control_message_down       u_down;
 };
 
-static struct ocfs2_stack_plugin user_stack;
+static struct ocfs2_stack_plugin ocfs2_user_plugin;
 
 static atomic_t ocfs2_control_opened;
 static int ocfs2_control_this_node = -1;
@@ -399,7 +399,7 @@ static int ocfs2_control_do_setversion_msg(struct file *file,
         char *ptr = NULL;
         struct ocfs2_control_private *p = file->private_data;
         struct ocfs2_protocol_version *max =
-                &user_stack.sp_proto->lp_max_version;
+                &ocfs2_user_plugin.sp_proto->lp_max_version;
 
         if (ocfs2_control_get_handshake_state(file) !=
             OCFS2_CONTROL_HANDSHAKE_PROTOCOL)
@@ -680,7 +680,7 @@ static void fsdlm_lock_ast_wrapper(void *astarg)
         struct dlm_lksb *lksb = fsdlm_astarg_to_lksb(astarg);
         int status = lksb->sb_status;
 
-        BUG_ON(user_stack.sp_proto == NULL);
+        BUG_ON(ocfs2_user_plugin.sp_proto == NULL);
 
         /*
          * For now we're punting on the issue of other non-standard errors
@@ -693,16 +693,16 @@ static void fsdlm_lock_ast_wrapper(void *astarg)
          */
 
         if (status == -DLM_EUNLOCK || status == -DLM_ECANCEL)
-                user_stack.sp_proto->lp_unlock_ast(astarg, 0);
+                ocfs2_user_plugin.sp_proto->lp_unlock_ast(astarg, 0);
         else
-                user_stack.sp_proto->lp_lock_ast(astarg);
+                ocfs2_user_plugin.sp_proto->lp_lock_ast(astarg);
 }
 
 static void fsdlm_blocking_ast_wrapper(void *astarg, int level)
 {
-        BUG_ON(user_stack.sp_proto == NULL);
+        BUG_ON(ocfs2_user_plugin.sp_proto == NULL);
 
-        user_stack.sp_proto->lp_blocking_ast(astarg, level);
+        ocfs2_user_plugin.sp_proto->lp_blocking_ast(astarg, level);
 }
 
 static int user_dlm_lock(struct ocfs2_cluster_connection *conn,
@@ -838,7 +838,7 @@ static int user_cluster_this_node(unsigned int *this_node)
         return 0;
 }
 
-static struct ocfs2_stack_operations user_stack_ops = {
+static struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
         .connect        = user_cluster_connect,
         .disconnect     = user_cluster_disconnect,
         .this_node      = user_cluster_this_node,
@@ -849,20 +849,20 @@ static struct ocfs2_stack_operations user_stack_ops = {
         .dump_lksb      = user_dlm_dump_lksb,
 };
 
-static struct ocfs2_stack_plugin user_stack = {
+static struct ocfs2_stack_plugin ocfs2_user_plugin = {
         .sp_name        = "user",
-        .sp_ops         = &user_stack_ops,
+        .sp_ops         = &ocfs2_user_plugin_ops,
         .sp_owner       = THIS_MODULE,
 };
 
 
-static int __init user_stack_init(void)
+static int __init ocfs2_user_plugin_init(void)
 {
         int rc;
 
         rc = ocfs2_control_init();
         if (!rc) {
-                rc = ocfs2_stack_glue_register(&user_stack);
+                rc = ocfs2_stack_glue_register(&ocfs2_user_plugin);
                 if (rc)
                         ocfs2_control_exit();
         }
@@ -870,14 +870,14 @@ static int __init user_stack_init(void)
         return rc;
 }
 
-static void __exit user_stack_exit(void)
+static void __exit ocfs2_user_plugin_exit(void)
 {
-        ocfs2_stack_glue_unregister(&user_stack);
+        ocfs2_stack_glue_unregister(&ocfs2_user_plugin);
         ocfs2_control_exit();
 }
 
 MODULE_AUTHOR("Oracle");
 MODULE_DESCRIPTION("ocfs2 driver for userspace cluster stacks");
 MODULE_LICENSE("GPL");
-module_init(user_stack_init);
-module_exit(user_stack_exit);
+module_init(ocfs2_user_plugin_init);
+module_exit(ocfs2_user_plugin_exit);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index c447e0743a3..3b455371e7f 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -127,6 +127,25 @@ struct pid_entry {
                 NULL, &proc_single_file_operations,     \
                 { .proc_show = &proc_##OTYPE } )
 
+/*
+ * Count the number of hardlinks for the pid_entry table, excluding the .
+ * and .. links.
+ */
+static unsigned int pid_entry_count_dirs(const struct pid_entry *entries,
+        unsigned int n)
+{
+        unsigned int i;
+        unsigned int count;
+
+        count = 0;
+        for (i = 0; i < n; ++i) {
+                if (S_ISDIR(entries[i].mode))
+                        ++count;
+        }
+
+        return count;
+}
+
 int maps_protect;
 EXPORT_SYMBOL(maps_protect);
 
@@ -2585,10 +2604,9 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
         inode->i_op = &proc_tgid_base_inode_operations;
         inode->i_fop = &proc_tgid_base_operations;
         inode->i_flags|=S_IMMUTABLE;
-        inode->i_nlink = 5;
-#ifdef CONFIG_SECURITY
-        inode->i_nlink += 1;
-#endif
+
+        inode->i_nlink = 2 + pid_entry_count_dirs(tgid_base_stuff,
+                ARRAY_SIZE(tgid_base_stuff));
 
         dentry->d_op = &pid_dentry_operations;
 
@@ -2816,10 +2834,9 @@ static struct dentry *proc_task_instantiate(struct inode *dir,
         inode->i_op = &proc_tid_base_inode_operations;
         inode->i_fop = &proc_tid_base_operations;
         inode->i_flags|=S_IMMUTABLE;
-        inode->i_nlink = 4;
-#ifdef CONFIG_SECURITY
-        inode->i_nlink += 1;
-#endif
+
+        inode->i_nlink = 2 + pid_entry_count_dirs(tid_base_stuff,
+                ARRAY_SIZE(tid_base_stuff));
 
         dentry->d_op = &pid_dentry_operations;
 
diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
index 32dc14cd890..7e277f2ad46 100644
--- a/fs/proc/proc_misc.c
+++ b/fs/proc/proc_misc.c
@@ -716,7 +716,7 @@ static ssize_t kpagecount_read(struct file *file, char __user *buf,
         pfn = src / KPMSIZE;
         count = min_t(size_t, count, (max_pfn * KPMSIZE) - src);
         if (src & KPMMASK || count & KPMMASK)
-                return -EIO;
+                return -EINVAL;
 
         while (count > 0) {
                 ppage = NULL;
@@ -726,7 +726,7 @@ static ssize_t kpagecount_read(struct file *file, char __user *buf,
                 if (!ppage)
                         pcount = 0;
                 else
-                        pcount = atomic_read(&ppage->_count);
+                        pcount = page_mapcount(ppage);
 
                 if (put_user(pcount, out++)) {
                         ret = -EFAULT;
@@ -782,7 +782,7 @@ static ssize_t kpageflags_read(struct file *file, char __user *buf,
         pfn = src / KPMSIZE;
         count = min_t(unsigned long, count, (max_pfn * KPMSIZE) - src);
         if (src & KPMMASK || count & KPMMASK)
-                return -EIO;
+                return -EINVAL;
 
         while (count > 0) {
                 ppage = NULL;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 88717c0f941..17403629e33 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -496,7 +496,7 @@ const struct file_operations proc_clear_refs_operations = {
 };
 
 struct pagemapread {
-        char __user *out, *end;
+        u64 __user *out, *end;
 };
 
 #define PM_ENTRY_BYTES      sizeof(u64)
@@ -519,21 +519,11 @@ struct pagemapread {
 static int add_to_pagemap(unsigned long addr, u64 pfn,
                           struct pagemapread *pm)
 {
-        /*
-         * Make sure there's room in the buffer for an
-         * entire entry.  Otherwise, only copy part of
-         * the pfn.
-         */
-        if (pm->out + PM_ENTRY_BYTES >= pm->end) {
-                if (copy_to_user(pm->out, &pfn, pm->end - pm->out))
-                        return -EFAULT;
-                pm->out = pm->end;
-                return PM_END_OF_BUFFER;
-        }
-
         if (put_user(pfn, pm->out))
                 return -EFAULT;
-        pm->out += PM_ENTRY_BYTES;
+        pm->out++;
+        if (pm->out >= pm->end)
+                return PM_END_OF_BUFFER;
         return 0;
 }
 
@@ -634,7 +624,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
 
         ret = -EINVAL;
         /* file position must be aligned */
-        if (*ppos % PM_ENTRY_BYTES)
+        if ((*ppos % PM_ENTRY_BYTES) || (count % PM_ENTRY_BYTES))
                 goto out_task;
 
         ret = 0;
@@ -664,8 +654,8 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                 goto out_pages;
         }
 
-        pm.out = buf;
-        pm.end = buf + count;
+        pm.out = (u64 *)buf;
+        pm.end = (u64 *)(buf + count);
 
         if (!ptrace_may_attach(task)) {
                 ret = -EIO;
@@ -690,9 +680,9 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                 if (ret == PM_END_OF_BUFFER)
                         ret = 0;
                 /* don't need mmap_sem for these, but this looks cleaner */
-                *ppos += pm.out - buf;
+                *ppos += (char *)pm.out - buf;
                 if (!ret)
-                        ret = pm.out - buf;
+                        ret = (char *)pm.out - buf;
         }
 
 out_pages:
diff --git a/fs/splice.c b/fs/splice.c
index 78150038b58..aa5f6f60b30 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -58,8 +58,8 @@ static int page_cache_pipe_buf_steal(struct pipe_inode_info *pipe,
                  */
                 wait_on_page_writeback(page);
 
-                if (PagePrivate(page))
-                        try_to_release_page(page, GFP_KERNEL);
+                if (PagePrivate(page) && !try_to_release_page(page, GFP_KERNEL))
+                        goto out_unlock;
 
                 /*
                  * If we succeeded in removing the mapping, set LRU flag
@@ -75,6 +75,7 @@ static int page_cache_pipe_buf_steal(struct pipe_inode_info *pipe,
          * Raced with truncate or failed to remove page from current
          * address space, unlock and return failure.
          */
+out_unlock:
         unlock_page(page);
         return 1;
 }
@@ -983,7 +984,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
 
         while (len) {
                 size_t read_len;
-                loff_t pos = sd->pos;
+                loff_t pos = sd->pos, prev_pos = pos;
 
                 ret = do_splice_to(in, &pos, pipe, len, flags);
                 if (unlikely(ret <= 0))
@@ -998,15 +999,19 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
                  * could get stuck data in the internal pipe:
                  */
                 ret = actor(pipe, sd);
-                if (unlikely(ret <= 0))
+                if (unlikely(ret <= 0)) {
+                        sd->pos = prev_pos;
                         goto out_release;
+                }
 
                 bytes += ret;
                 len -= ret;
                 sd->pos = pos;
 
-                if (ret < read_len)
+                if (ret < read_len) {
+                        sd->pos = prev_pos + ret;
                         goto out_release;
+                }
         }
 
 done:
@@ -1072,7 +1077,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
 
         ret = splice_direct_to_actor(in, &sd, direct_splice_actor);
         if (ret > 0)
-                *ppos += ret;
+                *ppos = sd.pos;
 
         return ret;
 }