38 files changed, 378 insertions, 259 deletions

diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 63039ed9576..2bc5dc644b4 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -1864,6 +1864,7 @@ cleanup:
         kfree(psinfo);
         kfree(notes);
         kfree(fpu);
+        kfree(shdr4extnum);
 #ifdef ELF_CORE_COPY_XFPREGS
         kfree(xfpu);
 #endif
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index f30ac05dbda..3b859a3e6a0 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1335,6 +1335,11 @@ struct btrfs_ioctl_defrag_range_args {
  */
 #define BTRFS_STRING_ITEM_KEY   253
 
+/*
+ * Flags for mount options.
+ *
+ * Note: don't forget to add new options to btrfs_show_options()
+ */
 #define BTRFS_MOUNT_NODATASUM           (1 << 0)
 #define BTRFS_MOUNT_NODATACOW           (1 << 1)
 #define BTRFS_MOUNT_NOBARRIER           (1 << 2)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index d340f63d8f0..3601f0aebdd 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2678,12 +2678,14 @@ noinline int btrfs_update_inode(struct btrfs_trans_handle *trans,
         int ret;
 
         /*
-         * If root is tree root, it means this inode is used to
-         * store free space information. And these inodes are updated
-         * when committing the transaction, so they needn't delaye to
-         * be updated, or deadlock will occured.
+         * If the inode is a free space inode, we can deadlock during commit
+         * if we put it into the delayed code.
+         *
+         * The data relocation inode should also be directly updated
+         * without delay
          */
-        if (!is_free_space_inode(root, inode)) {
+        if (!is_free_space_inode(root, inode)
+            && root->root_key.objectid != BTRFS_DATA_RELOC_TREE_OBJECTID) {
                 ret = btrfs_delayed_update_inode(trans, root, inode);
                 if (!ret)
                         btrfs_set_inode_last_trans(trans, inode);
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 0bb4ebbb71b..15634d4648d 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -723,6 +723,12 @@ static int btrfs_show_options(struct seq_file *seq, struct vfsmount *vfs)
                 seq_puts(seq, ",clear_cache");
         if (btrfs_test_opt(root, USER_SUBVOL_RM_ALLOWED))
                 seq_puts(seq, ",user_subvol_rm_allowed");
+        if (btrfs_test_opt(root, ENOSPC_DEBUG))
+                seq_puts(seq, ",enospc_debug");
+        if (btrfs_test_opt(root, AUTO_DEFRAG))
+                seq_puts(seq, ",autodefrag");
+        if (btrfs_test_opt(root, INODE_MAP_CACHE))
+                seq_puts(seq, ",inode_cache");
         return 0;
 }
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 1efa56e18f9..19450bc5363 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2098,7 +2098,8 @@ int btrfs_balance(struct btrfs_root *dev_root)
                                            chunk_root->root_key.objectid,
                                            found_key.objectid,
                                            found_key.offset);
-                BUG_ON(ret && ret != -ENOSPC);
+                if (ret && ret != -ENOSPC)
+                        goto error;
                 key.offset = found_key.offset - 1;
         }
         ret = 0;
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 9542f07d0b9..4698a5c553d 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -290,7 +290,6 @@ static int striped_read(struct inode *inode,
         struct ceph_inode_info *ci = ceph_inode(inode);
         u64 pos, this_len;
         int io_align, page_align;
-        int page_off = off & ~PAGE_CACHE_MASK; /* first byte's offset in page */
         int left, pages_left;
         int read;
         struct page **page_pos;
@@ -326,12 +325,11 @@ more:
              ret, hit_stripe ? " HITSTRIPE" : "", was_short ? " SHORT" : "");
 
         if (ret > 0) {
-                int didpages =
-                        ((pos & ~PAGE_CACHE_MASK) + ret) >> PAGE_CACHE_SHIFT;
+                int didpages = (page_align + ret) >> PAGE_CACHE_SHIFT;
 
                 if (read < pos - off) {
                         dout(" zero gap %llu to %llu\n", off + read, pos);
-                        ceph_zero_page_vector_range(page_off + read,
+                        ceph_zero_page_vector_range(page_align + read,
                                                     pos - off - read, pages);
                 }
                 pos += ret;
@@ -356,7 +354,7 @@ more:
                                 left = inode->i_size - pos;
 
                         dout("zero tail %d\n", left);
-                        ceph_zero_page_vector_range(page_off + read, left,
+                        ceph_zero_page_vector_range(page_align + read, left,
                                                     pages);
                         read += left;
                 }
@@ -478,9 +476,6 @@ static ssize_t ceph_sync_write(struct file *file, const char __user *data,
         else
                 pos = *offset;
 
-        io_align = pos & ~PAGE_MASK;
-        buf_align = (unsigned long)data & ~PAGE_MASK;
-
         ret = filemap_write_and_wait_range(inode->i_mapping, pos, pos + left);
         if (ret < 0)
                 return ret;
@@ -504,6 +499,8 @@ static ssize_t ceph_sync_write(struct file *file, const char __user *data,
          * boundary.  this isn't atomic, unfortunately.  :(
          */
 more:
+        io_align = pos & ~PAGE_MASK;
+        buf_align = (unsigned long)data & ~PAGE_MASK;
         len = left;
         if (file->f_flags & O_DIRECT) {
                 /* write from beginning of first page, regardless of
@@ -593,6 +590,7 @@ out:
                 pos += len;
                 written += len;
                 left -= len;
+                data += written;
                 if (left)
                         goto more;
 
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 79743d146be..0c1d9175652 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1438,12 +1438,15 @@ char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *base,
         struct dentry *temp;
         char *path;
         int len, pos;
+        unsigned seq;
 
         if (dentry == NULL)
                 return ERR_PTR(-EINVAL);
 
 retry:
         len = 0;
+        seq = read_seqbegin(&rename_lock);
+        rcu_read_lock();
         for (temp = dentry; !IS_ROOT(temp);) {
                 struct inode *inode = temp->d_inode;
                 if (inode && ceph_snap(inode) == CEPH_SNAPDIR)
@@ -1455,10 +1458,12 @@ retry:
                         len += 1 + temp->d_name.len;
                 temp = temp->d_parent;
                 if (temp == NULL) {
+                        rcu_read_unlock();
                         pr_err("build_path corrupt dentry %p\n", dentry);
                         return ERR_PTR(-EINVAL);
                 }
         }
+        rcu_read_unlock();
         if (len)
                 len--;  /* no leading '/' */
 
@@ -1467,9 +1472,12 @@ retry:
                 return ERR_PTR(-ENOMEM);
         pos = len;
         path[pos] = 0;  /* trailing null */
+        rcu_read_lock();
         for (temp = dentry; !IS_ROOT(temp) && pos != 0; ) {
-                struct inode *inode = temp->d_inode;
+                struct inode *inode;
 
+                spin_lock(&temp->d_lock);
+                inode = temp->d_inode;
                 if (inode && ceph_snap(inode) == CEPH_SNAPDIR) {
                         dout("build_path path+%d: %p SNAPDIR\n",
                              pos, temp);
@@ -1478,21 +1486,26 @@ retry:
                         break;
                 } else {
                         pos -= temp->d_name.len;
-                        if (pos < 0)
+                        if (pos < 0) {
+                                spin_unlock(&temp->d_lock);
                                 break;
+                        }
                         strncpy(path + pos, temp->d_name.name,
                                 temp->d_name.len);
                 }
+                spin_unlock(&temp->d_lock);
                 if (pos)
                         path[--pos] = '/';
                 temp = temp->d_parent;
                 if (temp == NULL) {
+                        rcu_read_unlock();
                         pr_err("build_path corrupt dentry\n");
                         kfree(path);
                         return ERR_PTR(-EINVAL);
                 }
         }
-        if (pos != 0) {
+        rcu_read_unlock();
+        if (pos != 0 || read_seqretry(&rename_lock, seq)) {
                 pr_err("build_path did not end path lookup where "
                        "expected, namelen is %d, pos is %d\n", len, pos);
                 /* presumably this is only possible if racing with a
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 35f9154615f..bc4b12ca537 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -35,6 +35,7 @@
 #include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/freezer.h>
+#include <linux/namei.h>
 #include <net/ipv6.h>
 #include "cifsfs.h"
 #include "cifspdu.h"
@@ -542,14 +543,12 @@ static const struct super_operations cifs_super_ops = {
 static struct dentry *
 cifs_get_root(struct smb_vol *vol, struct super_block *sb)
 {
-        int xid, rc;
-        struct inode *inode;
-        struct qstr name;
-        struct dentry *dparent = NULL, *dchild = NULL, *alias;
+        struct dentry *dentry;
         struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
-        unsigned int i, full_len, len;
-        char *full_path = NULL, *pstart;
+        char *full_path = NULL;
+        char *s, *p;
         char sep;
+        int xid;
 
         full_path = cifs_build_path_to_root(vol, cifs_sb,
                                             cifs_sb_master_tcon(cifs_sb));
@@ -560,73 +559,32 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
 
         xid = GetXid();
         sep = CIFS_DIR_SEP(cifs_sb);
-        dparent = dget(sb->s_root);
-        full_len = strlen(full_path);
-        full_path[full_len] = sep;
-        pstart = full_path + 1;
-
-        for (i = 1, len = 0; i <= full_len; i++) {
-                if (full_path[i] != sep || !len) {
-                        len++;
-                        continue;
-                }
-
-                full_path[i] = 0;
-                cFYI(1, "get dentry for %s", pstart);
-
-                name.name = pstart;
-                name.len = len;
-                name.hash = full_name_hash(pstart, len);
-                dchild = d_lookup(dparent, &name);
-                if (dchild == NULL) {
-                        cFYI(1, "not exists");
-                        dchild = d_alloc(dparent, &name);
-                        if (dchild == NULL) {
-                                dput(dparent);
-                                dparent = ERR_PTR(-ENOMEM);
-                                goto out;
-                        }
-                }
-
-                cFYI(1, "get inode");
-                if (dchild->d_inode == NULL) {
-                        cFYI(1, "not exists");
-                        inode = NULL;
-                        if (cifs_sb_master_tcon(CIFS_SB(sb))->unix_ext)
-                                rc = cifs_get_inode_info_unix(&inode, full_path,
-                                                              sb, xid);
-                        else
-                                rc = cifs_get_inode_info(&inode, full_path,
-                                                         NULL, sb, xid, NULL);
-                        if (rc) {
-                                dput(dchild);
-                                dput(dparent);
-                                dparent = ERR_PTR(rc);
-                                goto out;
-                        }
-                        alias = d_materialise_unique(dchild, inode);
-                        if (alias != NULL) {
-                                dput(dchild);
-                                if (IS_ERR(alias)) {
-                                        dput(dparent);
-                                        dparent = ERR_PTR(-EINVAL); /* XXX */
-                                        goto out;
-                                }
-                                dchild = alias;
-                        }
-                }
-                cFYI(1, "parent %p, child %p", dparent, dchild);
-
-                dput(dparent);
-                dparent = dchild;
-                len = 0;
-                pstart = full_path + i + 1;
-                full_path[i] = sep;
-        }
-out:
+        dentry = dget(sb->s_root);
+        p = s = full_path;
+
+        do {
+                struct inode *dir = dentry->d_inode;
+                struct dentry *child;
+
+                /* skip separators */
+                while (*s == sep)
+                        s++;
+                if (!*s)
+                        break;
+                p = s++;
+                /* next separator */
+                while (*s && *s != sep)
+                        s++;
+
+                mutex_lock(&dir->i_mutex);
+                child = lookup_one_len(p, dentry, s - p);
+                mutex_unlock(&dir->i_mutex);
+                dput(dentry);
+                dentry = child;
+        } while (!IS_ERR(dentry));
         _FreeXid(xid);
         kfree(full_path);
-        return dparent;
+        return dentry;
 }
 
 static int cifs_set_super(struct super_block *sb, void *data)
@@ -649,9 +607,9 @@ cifs_do_mount(struct file_system_type *fs_type,
 
         cFYI(1, "Devname: %s flags: %d ", dev_name, flags);
 
-        rc = cifs_setup_volume_info(&volume_info, (char *)data, dev_name);
-        if (rc)
-                return ERR_PTR(rc);
+        volume_info = cifs_get_volume_info((char *)data, dev_name);
+        if (IS_ERR(volume_info))
+                return ERR_CAST(volume_info);
 
         cifs_sb = kzalloc(sizeof(struct cifs_sb_info), GFP_KERNEL);
         if (cifs_sb == NULL) {
@@ -713,7 +671,7 @@ cifs_do_mount(struct file_system_type *fs_type,
 out_super:
         deactivate_locked_super(sb);
 out:
-        cifs_cleanup_volume_info(&volume_info);
+        cifs_cleanup_volume_info(volume_info);
         return root;
 
 out_mountdata:
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 0900e1658c9..036ca83e5f4 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -129,5 +129,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CIFS_NFSD_EXPORT */
 
-#define CIFS_VERSION   "1.73"
+#define CIFS_VERSION   "1.74"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 257f312ede4..8df28e925e5 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -154,9 +154,9 @@ extern int set_cifs_acl(struct cifs_ntsd *, __u32, struct inode *,
 extern void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                                struct cifs_sb_info *cifs_sb);
 extern int cifs_match_super(struct super_block *, void *);
-extern void cifs_cleanup_volume_info(struct smb_vol **pvolume_info);
-extern int cifs_setup_volume_info(struct smb_vol **pvolume_info,
-                                  char *mount_data, const char *devname);
+extern void cifs_cleanup_volume_info(struct smb_vol *pvolume_info);
+extern struct smb_vol *cifs_get_volume_info(char *mount_data,
+                                            const char *devname);
 extern int cifs_mount(struct cifs_sb_info *, struct smb_vol *);
 extern void cifs_umount(struct cifs_sb_info *);
 extern void cifs_dfs_release_automount_timer(void);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 7f540df5252..ccc1afa0bf3 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -65,6 +65,8 @@ static int ip_connect(struct TCP_Server_Info *server);
 static int generic_ip_connect(struct TCP_Server_Info *server);
 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
 static void cifs_prune_tlinks(struct work_struct *work);
+static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
+                                        const char *devname);
 
 /*
  * cifs tcp session reconnection
@@ -2240,8 +2242,8 @@ cifs_match_super(struct super_block *sb, void *data)
 
         rc = compare_mount_options(sb, mnt_data);
 out:
-        cifs_put_tlink(tlink);
         spin_unlock(&cifs_tcp_ses_lock);
+        cifs_put_tlink(tlink);
         return rc;
 }
 
@@ -2474,14 +2476,6 @@ generic_ip_connect(struct TCP_Server_Info *server)
         if (rc < 0)
                 return rc;
 
-        rc = socket->ops->connect(socket, saddr, slen, 0);
-        if (rc < 0) {
-                cFYI(1, "Error %d connecting to server", rc);
-                sock_release(socket);
-                server->ssocket = NULL;
-                return rc;
-        }
-
         /*
          * Eventually check for other socket options to change from
          * the default. sock_setsockopt not used because it expects
@@ -2510,6 +2504,14 @@ generic_ip_connect(struct TCP_Server_Info *server)
                  socket->sk->sk_sndbuf,
                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
 
+        rc = socket->ops->connect(socket, saddr, slen, 0);
+        if (rc < 0) {
+                cFYI(1, "Error %d connecting to server", rc);
+                sock_release(socket);
+                server->ssocket = NULL;
+                return rc;
+        }
+
         if (sport == htons(RFC1001_PORT))
                 rc = ip_rfc1001_connect(server);
 
@@ -2830,15 +2832,9 @@ is_path_accessible(int xid, struct cifs_tcon *tcon,
         return rc;
 }
 
-void
-cifs_cleanup_volume_info(struct smb_vol **pvolume_info)
+static void
+cleanup_volume_info_contents(struct smb_vol *volume_info)
 {
-        struct smb_vol *volume_info;
-
-        if (!pvolume_info || !*pvolume_info)
-                return;
-
-        volume_info = *pvolume_info;
         kfree(volume_info->username);
         kzfree(volume_info->password);
         kfree(volume_info->UNC);
@@ -2846,28 +2842,44 @@ cifs_cleanup_volume_info(struct smb_vol **pvolume_info)
         kfree(volume_info->domainname);
         kfree(volume_info->iocharset);
         kfree(volume_info->prepath);
+}
+
+void
+cifs_cleanup_volume_info(struct smb_vol *volume_info)
+{
+        if (!volume_info)
+                return;
+        cleanup_volume_info_contents(volume_info);
         kfree(volume_info);
-        *pvolume_info = NULL;
-        return;
 }
 
+
 #ifdef CONFIG_CIFS_DFS_UPCALL
 /* build_path_to_root returns full path to root when
  * we do not have an exiting connection (tcon) */
 static char *
-build_unc_path_to_root(const struct smb_vol *volume_info,
+build_unc_path_to_root(const struct smb_vol *vol,
                 const struct cifs_sb_info *cifs_sb)
 {
-        char *full_path;
+        char *full_path, *pos;
+        unsigned int pplen = vol->prepath ? strlen(vol->prepath) : 0;
+        unsigned int unc_len = strnlen(vol->UNC, MAX_TREE_SIZE + 1);
 
-        int unc_len = strnlen(volume_info->UNC, MAX_TREE_SIZE + 1);
-        full_path = kmalloc(unc_len + 1, GFP_KERNEL);
+        full_path = kmalloc(unc_len + pplen + 1, GFP_KERNEL);
         if (full_path == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        strncpy(full_path, volume_info->UNC, unc_len);
-        full_path[unc_len] = 0; /* add trailing null */
+        strncpy(full_path, vol->UNC, unc_len);
+        pos = full_path + unc_len;
+
+        if (pplen) {
+                strncpy(pos, vol->prepath, pplen);
+                pos += pplen;
+        }
+
+        *pos = '\0'; /* add trailing null */
         convert_delimiter(full_path, CIFS_DIR_SEP(cifs_sb));
+        cFYI(1, "%s: full_path=%s", __func__, full_path);
         return full_path;
 }
 
@@ -2910,15 +2922,18 @@ expand_dfs_referral(int xid, struct cifs_ses *pSesInfo,
                                                    &fake_devname);
 
                 free_dfs_info_array(referrals, num_referrals);
-                kfree(fake_devname);
-
-                if (cifs_sb->mountdata != NULL)
-                        kfree(cifs_sb->mountdata);
 
                 if (IS_ERR(mdata)) {
                         rc = PTR_ERR(mdata);
                         mdata = NULL;
+                } else {
+                        cleanup_volume_info_contents(volume_info);
+                        memset(volume_info, '\0', sizeof(*volume_info));
+                        rc = cifs_setup_volume_info(volume_info, mdata,
+                                                        fake_devname);
                 }
+                kfree(fake_devname);
+                kfree(cifs_sb->mountdata);
                 cifs_sb->mountdata = mdata;
         }
         kfree(full_path);
@@ -2926,33 +2941,20 @@ expand_dfs_referral(int xid, struct cifs_ses *pSesInfo,
 }
 #endif
 
-int cifs_setup_volume_info(struct smb_vol **pvolume_info, char *mount_data,
-                           const char *devname)
+static int
+cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
+                        const char *devname)
 {
-        struct smb_vol *volume_info;
         int rc = 0;
 
-        *pvolume_info = NULL;
-
-        volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
-        if (!volume_info) {
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        if (cifs_parse_mount_options(mount_data, devname,
-                                     volume_info)) {
-                rc = -EINVAL;
-                goto out;
-        }
+        if (cifs_parse_mount_options(mount_data, devname, volume_info))
+                return -EINVAL;
 
         if (volume_info->nullauth) {
                 cFYI(1, "null user");
                 volume_info->username = kzalloc(1, GFP_KERNEL);
-                if (volume_info->username == NULL) {
-                        rc = -ENOMEM;
-                        goto out;
-                }
+                if (volume_info->username == NULL)
+                        return -ENOMEM;
         } else if (volume_info->username) {
                 /* BB fixme parse for domain name here */
                 cFYI(1, "Username: %s", volume_info->username);
@@ -2960,8 +2962,7 @@ int cifs_setup_volume_info(struct smb_vol **pvolume_info, char *mount_data,
                 cifserror("No username specified");
         /* In userspace mount helper we can get user name from alternate
            locations such as env variables and files on disk */
-                rc = -EINVAL;
-                goto out;
+                return -EINVAL;
         }
 
         /* this is needed for ASCII cp to Unicode converts */
@@ -2973,18 +2974,32 @@ int cifs_setup_volume_info(struct smb_vol **pvolume_info, char *mount_data,
                 if (volume_info->local_nls == NULL) {
                         cERROR(1, "CIFS mount error: iocharset %s not found",
                                  volume_info->iocharset);
-                        rc = -ELIBACC;
-                        goto out;
+                        return -ELIBACC;
                 }
         }
 
-        *pvolume_info = volume_info;
-        return rc;
-out:
-        cifs_cleanup_volume_info(&volume_info);
         return rc;
 }
 
+struct smb_vol *
+cifs_get_volume_info(char *mount_data, const char *devname)
+{
+        int rc;
+        struct smb_vol *volume_info;
+
+        volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
+        if (!volume_info)
+                return ERR_PTR(-ENOMEM);
+
+        rc = cifs_setup_volume_info(volume_info, mount_data, devname);
+        if (rc) {
+                cifs_cleanup_volume_info(volume_info);
+                volume_info = ERR_PTR(rc);
+        }
+
+        return volume_info;
+}
+
 int
 cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
 {
@@ -2997,6 +3012,7 @@ cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
         struct tcon_link *tlink;
 #ifdef CONFIG_CIFS_DFS_UPCALL
         int referral_walks_count = 0;
+#endif
 
         rc = bdi_setup_and_register(&cifs_sb->bdi, "cifs", BDI_CAP_MAP_COPY);
         if (rc)
@@ -3004,6 +3020,7 @@ cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
 
         cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
 
+#ifdef CONFIG_CIFS_DFS_UPCALL
 try_mount_again:
         /* cleanup activities if we're chasing a referral */
         if (referral_walks_count) {
@@ -3012,7 +3029,6 @@ try_mount_again:
                 else if (pSesInfo)
                         cifs_put_smb_ses(pSesInfo);
 
-                cifs_cleanup_volume_info(&volume_info);
                 FreeXid(xid);
         }
 #endif
@@ -3469,7 +3485,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
                 goto out;
         }
 
-        snprintf(username, MAX_USERNAME_SIZE, "krb50x%x", fsuid);
+        snprintf(username, sizeof(username), "krb50x%x", fsuid);
         vol_info->username = username;
         vol_info->local_nls = cifs_sb->local_nls;
         vol_info->linux_uid = fsuid;
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 81914df47ef..fa8c21d913b 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -55,6 +55,7 @@ build_path_from_dentry(struct dentry *direntry)
         char dirsep;
         struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb);
         struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
+        unsigned seq;
 
         if (direntry == NULL)
                 return NULL;  /* not much we can do if dentry is freed and
@@ -68,22 +69,29 @@ build_path_from_dentry(struct dentry *direntry)
                 dfsplen = 0;
 cifs_bp_rename_retry:
         namelen = dfsplen;
+        seq = read_seqbegin(&rename_lock);
+        rcu_read_lock();
         for (temp = direntry; !IS_ROOT(temp);) {
                 namelen += (1 + temp->d_name.len);
                 temp = temp->d_parent;
                 if (temp == NULL) {
                         cERROR(1, "corrupt dentry");
+                        rcu_read_unlock();
                         return NULL;
                 }
         }
+        rcu_read_unlock();
 
         full_path = kmalloc(namelen+1, GFP_KERNEL);
         if (full_path == NULL)
                 return full_path;
         full_path[namelen] = 0; /* trailing null */
+        rcu_read_lock();
         for (temp = direntry; !IS_ROOT(temp);) {
+                spin_lock(&temp->d_lock);
                 namelen -= 1 + temp->d_name.len;
                 if (namelen < 0) {
+                        spin_unlock(&temp->d_lock);
                         break;
                 } else {
                         full_path[namelen] = dirsep;
@@ -91,14 +99,17 @@ cifs_bp_rename_retry:
                                 temp->d_name.len);
                         cFYI(0, "name: %s", full_path + namelen);
                 }
+                spin_unlock(&temp->d_lock);
                 temp = temp->d_parent;
                 if (temp == NULL) {
                         cERROR(1, "corrupt dentry");
+                        rcu_read_unlock();
                         kfree(full_path);
                         return NULL;
                 }
         }
-        if (namelen != dfsplen) {
+        rcu_read_unlock();
+        if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) {
                 cERROR(1, "did not end path lookup where expected namelen is %d",
                         namelen);
                 /* presumably this is only possible if racing with a rename
diff --git a/fs/cifs/fscache.c b/fs/cifs/fscache.c
index 816696621ec..42e5363b410 100644
--- a/fs/cifs/fscache.c
+++ b/fs/cifs/fscache.c
@@ -92,6 +92,7 @@ static void cifs_fscache_disable_inode_cookie(struct inode *inode)
 
         if (cifsi->fscache) {
                 cFYI(1, "%s: (0x%p)", __func__, cifsi->fscache);
+                fscache_uncache_all_inode_pages(cifsi->fscache, inode);
                 fscache_relinquish_cookie(cifsi->fscache, 1);
                 cifsi->fscache = NULL;
         }
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 3892ab817a3..d3e619692ee 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -428,8 +428,7 @@ static void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
                 flags |= NTLMSSP_NEGOTIATE_SIGN;
                 if (!ses->server->session_estab)
-                        flags |= NTLMSSP_NEGOTIATE_KEY_XCH |
-                                NTLMSSP_NEGOTIATE_EXTENDED_SEC;
+                        flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
         }
 
         sec_blob->NegotiateFlags = cpu_to_le32(flags);
@@ -465,10 +464,11 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
                 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC;
         if (ses->server->sec_mode &
-           (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+           (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
                 flags |= NTLMSSP_NEGOTIATE_SIGN;
-        if (ses->server->sec_mode & SECMODE_SIGN_REQUIRED)
-                flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+                if (!ses->server->session_estab)
+                        flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
+        }
 
         tmp = pbuffer + sizeof(AUTHENTICATE_MESSAGE);
         sec_blob->NegotiateFlags = cpu_to_le32(flags);
diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
index e141939080f..739fb59bcdc 100644
--- a/fs/cramfs/inode.c
+++ b/fs/cramfs/inode.c
@@ -37,7 +37,7 @@ static DEFINE_MUTEX(read_mutex);
 /* These macros may change in future, to provide better st_ino semantics. */
 #define OFFSET(x)       ((x)->i_ino)
 
-static unsigned long cramino(struct cramfs_inode *cino, unsigned int offset)
+static unsigned long cramino(const struct cramfs_inode *cino, unsigned int offset)
 {
         if (!cino->offset)
                 return offset + 1;
@@ -61,7 +61,7 @@ static unsigned long cramino(struct cramfs_inode *cino, unsigned int offset)
 }
 
 static struct inode *get_cramfs_inode(struct super_block *sb,
-        struct cramfs_inode *cramfs_inode, unsigned int offset)
+        const struct cramfs_inode *cramfs_inode, unsigned int offset)
 {
         struct inode *inode;
         static struct timespec zerotime;
@@ -317,7 +317,7 @@ static int cramfs_fill_super(struct super_block *sb, void *data, int silent)
         /* Set it all up.. */
         sb->s_op = &cramfs_ops;
         root = get_cramfs_inode(sb, &super.root, 0);
-        if (!root)
+        if (IS_ERR(root))
                 goto out;
         sb->s_root = d_alloc_root(root);
         if (!sb->s_root) {
@@ -423,6 +423,7 @@ static int cramfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
 static struct dentry * cramfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
         unsigned int offset = 0;
+        struct inode *inode = NULL;
         int sorted;
 
         mutex_lock(&read_mutex);
@@ -449,8 +450,8 @@ static struct dentry * cramfs_lookup(struct inode *dir, struct dentry *dentry, s
 
                 for (;;) {
                         if (!namelen) {
-                                mutex_unlock(&read_mutex);
-                                return ERR_PTR(-EIO);
+                                inode = ERR_PTR(-EIO);
+                                goto out;
                         }
                         if (name[namelen-1])
                                 break;
@@ -462,17 +463,18 @@ static struct dentry * cramfs_lookup(struct inode *dir, struct dentry *dentry, s
                 if (retval > 0)
                         continue;
                 if (!retval) {
-                        struct cramfs_inode entry = *de;
-                        mutex_unlock(&read_mutex);
-                        d_add(dentry, get_cramfs_inode(dir->i_sb, &entry, dir_off));
-                        return NULL;
+                        inode = get_cramfs_inode(dir->i_sb, de, dir_off);
+                        break;
                 }
                 /* else (retval < 0) */
                 if (sorted)
                         break;
         }
+out:
         mutex_unlock(&read_mutex);
-        d_add(dentry, NULL);
+        if (IS_ERR(inode))
+                return ERR_CAST(inode);
+        d_add(dentry, inode);
         return NULL;
 }
 
diff --git a/fs/dcache.c b/fs/dcache.c
index 37f72ee5bf7..6e4ea6d8777 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2213,14 +2213,15 @@ static void dentry_unlock_parents_for_move(struct dentry *dentry,
  * The hash value has to match the hash queue that the dentry is on..
  */
 /*
- * d_move - move a dentry
+ * __d_move - move a dentry
  * @dentry: entry to move
  * @target: new dentry
  *
  * Update the dcache to reflect the move of a file name. Negative
- * dcache entries should not be moved in this way.
+ * dcache entries should not be moved in this way.  Caller hold
+ * rename_lock.
  */
-void d_move(struct dentry * dentry, struct dentry * target)
+static void __d_move(struct dentry * dentry, struct dentry * target)
 {
         if (!dentry->d_inode)
                 printk(KERN_WARNING "VFS: moving negative dcache entry\n");
@@ -2228,8 +2229,6 @@ void d_move(struct dentry * dentry, struct dentry * target)
         BUG_ON(d_ancestor(dentry, target));
         BUG_ON(d_ancestor(target, dentry));
 
-        write_seqlock(&rename_lock);
-
         dentry_lock_for_move(dentry, target);
 
         write_seqcount_begin(&dentry->d_seq);
@@ -2275,6 +2274,20 @@ void d_move(struct dentry * dentry, struct dentry * target)
         spin_unlock(&target->d_lock);
         fsnotify_d_move(dentry);
         spin_unlock(&dentry->d_lock);
+}
+
+/*
+ * d_move - move a dentry
+ * @dentry: entry to move
+ * @target: new dentry
+ *
+ * Update the dcache to reflect the move of a file name. Negative
+ * dcache entries should not be moved in this way.
+ */
+void d_move(struct dentry *dentry, struct dentry *target)
+{
+        write_seqlock(&rename_lock);
+        __d_move(dentry, target);
         write_sequnlock(&rename_lock);
 }
 EXPORT_SYMBOL(d_move);
@@ -2302,7 +2315,7 @@ struct dentry *d_ancestor(struct dentry *p1, struct dentry *p2)
  * This helper attempts to cope with remotely renamed directories
  *
  * It assumes that the caller is already holding
- * dentry->d_parent->d_inode->i_mutex and the inode->i_lock
+ * dentry->d_parent->d_inode->i_mutex, inode->i_lock and rename_lock
  *
  * Note: If ever the locking in lock_rename() changes, then please
  * remember to update this too...
@@ -2317,11 +2330,6 @@ static struct dentry *__d_unalias(struct inode *inode,
         if (alias->d_parent == dentry->d_parent)
                 goto out_unalias;
 
-        /* Check for loops */
-        ret = ERR_PTR(-ELOOP);
-        if (d_ancestor(alias, dentry))
-                goto out_err;
-
         /* See lock_rename() */
         ret = ERR_PTR(-EBUSY);
         if (!mutex_trylock(&dentry->d_sb->s_vfs_rename_mutex))
@@ -2331,7 +2339,7 @@ static struct dentry *__d_unalias(struct inode *inode,
                 goto out_err;
         m2 = &alias->d_parent->d_inode->i_mutex;
 out_unalias:
-        d_move(alias, dentry);
+        __d_move(alias, dentry);
         ret = alias;
 out_err:
         spin_unlock(&inode->i_lock);
@@ -2416,15 +2424,24 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
                 alias = __d_find_alias(inode, 0);
                 if (alias) {
                         actual = alias;
-                        /* Is this an anonymous mountpoint that we could splice
-                         * into our tree? */
-                        if (IS_ROOT(alias)) {
+                        write_seqlock(&rename_lock);
+
+                        if (d_ancestor(alias, dentry)) {
+                                /* Check for loops */
+                                actual = ERR_PTR(-ELOOP);
+                        } else if (IS_ROOT(alias)) {
+                                /* Is this an anonymous mountpoint that we
+                                 * could splice into our tree? */
                                 __d_materialise_dentry(dentry, alias);
+                                write_sequnlock(&rename_lock);
                                 __d_drop(alias);
                                 goto found;
+                        } else {
+                                /* Nope, but we must(!) avoid directory
+                                 * aliasing */
+                                actual = __d_unalias(inode, dentry, alias);
                         }
-                        /* Nope, but we must(!) avoid directory aliasing */
-                        actual = __d_unalias(inode, dentry, alias);
+                        write_sequnlock(&rename_lock);
                         if (IS_ERR(actual))
                                 dput(alias);
                         goto out_nolock;
diff --git a/fs/exofs/super.c b/fs/exofs/super.c
index 06065bd37fc..c57beddcc21 100644
--- a/fs/exofs/super.c
+++ b/fs/exofs/super.c
@@ -913,7 +913,7 @@ struct dentry *exofs_get_parent(struct dentry *child)
         unsigned long ino = exofs_parent_ino(child);
 
         if (!ino)
-                return NULL;
+                return ERR_PTR(-ESTALE);
 
         return d_obtain_alias(exofs_iget(child->d_inode->i_sb, ino));
 }
diff --git a/fs/fscache/page.c b/fs/fscache/page.c
index a2a5d19ece6..2f343b4d7a7 100644
--- a/fs/fscache/page.c
+++ b/fs/fscache/page.c
@@ -954,3 +954,47 @@ void fscache_mark_pages_cached(struct fscache_retrieval *op,
         pagevec_reinit(pagevec);
 }
 EXPORT_SYMBOL(fscache_mark_pages_cached);
+
+/*
+ * Uncache all the pages in an inode that are marked PG_fscache, assuming them
+ * to be associated with the given cookie.
+ */
+void __fscache_uncache_all_inode_pages(struct fscache_cookie *cookie,
+                                       struct inode *inode)
+{
+        struct address_space *mapping = inode->i_mapping;
+        struct pagevec pvec;
+        pgoff_t next;
+        int i;
+
+        _enter("%p,%p", cookie, inode);
+
+        if (!mapping || mapping->nrpages == 0) {
+                _leave(" [no pages]");
+                return;
+        }
+
+        pagevec_init(&pvec, 0);
+        next = 0;
+        while (next <= (loff_t)-1 &&
+               pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE)
+               ) {
+                for (i = 0; i < pagevec_count(&pvec); i++) {
+                        struct page *page = pvec.pages[i];
+                        pgoff_t page_index = page->index;
+
+                        ASSERTCMP(page_index, >=, next);
+                        next = page_index + 1;
+
+                        if (PageFsCache(page)) {
+                                __fscache_wait_on_page_write(cookie, page);
+                                __fscache_uncache_page(cookie, page);
+                        }
+                }
+                pagevec_release(&pvec);
+                cond_resched();
+        }
+
+        _leave("");
+}
+EXPORT_SYMBOL(__fscache_uncache_all_inode_pages);
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index 802ac5eeba2..f9fbbe96c22 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -1069,6 +1069,7 @@ int gfs2_releasepage(struct page *page, gfp_t gfp_mask)
                 return 0;
 
         gfs2_log_lock(sdp);
+        spin_lock(&sdp->sd_ail_lock);
         head = bh = page_buffers(page);
         do {
                 if (atomic_read(&bh->b_count))
@@ -1080,6 +1081,7 @@ int gfs2_releasepage(struct page *page, gfp_t gfp_mask)
                         goto not_possible;
                 bh = bh->b_this_page;
         } while(bh != head);
+        spin_unlock(&sdp->sd_ail_lock);
         gfs2_log_unlock(sdp);
 
         head = bh = page_buffers(page);
@@ -1112,6 +1114,7 @@ not_possible: /* Should never happen */
         WARN_ON(buffer_dirty(bh));
         WARN_ON(buffer_pinned(bh));
 cannot_release:
+        spin_unlock(&sdp->sd_ail_lock);
         gfs2_log_unlock(sdp);
         return 0;
 }
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 8ef70f46473..2cca29316bd 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -47,10 +47,10 @@ static void __gfs2_ail_flush(struct gfs2_glock *gl)
                                 bd_ail_gl_list);
                 bh = bd->bd_bh;
                 gfs2_remove_from_ail(bd);
-                spin_unlock(&sdp->sd_ail_lock);
-
                 bd->bd_bh = NULL;
                 bh->b_private = NULL;
+                spin_unlock(&sdp->sd_ail_lock);
+
                 bd->bd_blkno = bh->b_blocknr;
                 gfs2_log_lock(sdp);
                 gfs2_assert_withdraw(sdp, !buffer_busy(bh));
@@ -221,8 +221,10 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
                 }
         }
 
-        if (ip == GFS2_I(gl->gl_sbd->sd_rindex))
+        if (ip == GFS2_I(gl->gl_sbd->sd_rindex)) {
+                gfs2_log_flush(gl->gl_sbd, NULL);
                 gl->gl_sbd->sd_rindex_uptodate = 0;
+        }
         if (ip && S_ISREG(ip->i_inode.i_mode))
                 truncate_inode_pages(ip->i_inode.i_mapping, 0);
 }
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index 0a064e91ac7..81206e70cbf 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -17,6 +17,7 @@
 #include <linux/buffer_head.h>
 #include <linux/rcupdate.h>
 #include <linux/rculist_bl.h>
+#include <linux/completion.h>
 
 #define DIO_WAIT        0x00000010
 #define DIO_METADATA    0x00000020
@@ -546,6 +547,7 @@ struct gfs2_sbd {
         struct gfs2_glock *sd_trans_gl;
         wait_queue_head_t sd_glock_wait;
         atomic_t sd_glock_disposal;
+        struct completion sd_locking_init;
 
         /* Inode Stuff */
 
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 903115f2bb3..85c62923ee2 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -903,6 +903,7 @@ void gfs2_meta_syncfs(struct gfs2_sbd *sdp)
                 if (gfs2_ail1_empty(sdp))
                         break;
         }
+        gfs2_log_flush(sdp, NULL);
 }
 
 static inline int gfs2_jrnl_flush_reqd(struct gfs2_sbd *sdp)
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 8ac9ae189b5..2a77071fb7b 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -72,6 +72,7 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb)
 
         init_waitqueue_head(&sdp->sd_glock_wait);
         atomic_set(&sdp->sd_glock_disposal, 0);
+        init_completion(&sdp->sd_locking_init);
         spin_lock_init(&sdp->sd_statfs_spin);
 
         spin_lock_init(&sdp->sd_rindex_spin);
@@ -1017,11 +1018,13 @@ hostdata_error:
                 fsname++;
         if (lm->lm_mount == NULL) {
                 fs_info(sdp, "Now mounting FS...\n");
+                complete(&sdp->sd_locking_init);
                 return 0;
         }
         ret = lm->lm_mount(sdp, fsname);
         if (ret == 0)
                 fs_info(sdp, "Joined cluster. Now mounting FS...\n");
+        complete(&sdp->sd_locking_init);
         return ret;
 }
 
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index ed540e7018b..fb0edf73548 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -757,13 +757,17 @@ static int gfs2_write_inode(struct inode *inode, struct writeback_control *wbc)
         struct timespec atime;
         struct gfs2_dinode *di;
         int ret = -EAGAIN;
+        int unlock_required = 0;
 
         /* Skip timestamp update, if this is from a memalloc */
         if (current->flags & PF_MEMALLOC)
                 goto do_flush;
-        ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
-        if (ret)
-                goto do_flush;
+        if (!gfs2_glock_is_locked_by_me(ip->i_gl)) {
+                ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
+                if (ret)
+                        goto do_flush;
+                unlock_required = 1;
+        }
         ret = gfs2_trans_begin(sdp, RES_DINODE, 0);
         if (ret)
                 goto do_unlock;
@@ -780,7 +784,8 @@ static int gfs2_write_inode(struct inode *inode, struct writeback_control *wbc)
         }
         gfs2_trans_end(sdp);
 do_unlock:
-        gfs2_glock_dq_uninit(&gh);
+        if (unlock_required)
+                gfs2_glock_dq_uninit(&gh);
 do_flush:
         if (wbc->sync_mode == WB_SYNC_ALL)
                 gfs2_log_flush(GFS2_SB(inode), ip->i_gl);
@@ -1427,7 +1432,20 @@ out:
         return error;
 }
 
-/*
+/**
+ * gfs2_evict_inode - Remove an inode from cache
+ * @inode: The inode to evict
+ *
+ * There are three cases to consider:
+ * 1. i_nlink == 0, we are final opener (and must deallocate)
+ * 2. i_nlink == 0, we are not the final opener (and cannot deallocate)
+ * 3. i_nlink > 0
+ *
+ * If the fs is read only, then we have to treat all cases as per #3
+ * since we are unable to do any deallocation. The inode will be
+ * deallocated by the next read/write node to attempt an allocation
+ * in the same resource group
+ *
  * We have to (at the moment) hold the inodes main lock to cover
  * the gap between unlocking the shared lock on the iopen lock and
  * taking the exclusive lock. I'd rather do a shared -> exclusive
@@ -1470,6 +1488,8 @@ static void gfs2_evict_inode(struct inode *inode)
         if (error)
                 goto out_truncate;
 
+        /* Case 1 starts here */
+
         if (S_ISDIR(inode->i_mode) &&
             (ip->i_diskflags & GFS2_DIF_EXHASH)) {
                 error = gfs2_dir_exhash_dealloc(ip);
@@ -1493,13 +1513,16 @@ static void gfs2_evict_inode(struct inode *inode)
         goto out_unlock;
 
 out_truncate:
+        /* Case 2 starts here */
         error = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks);
         if (error)
                 goto out_unlock;
-        gfs2_final_release_pages(ip);
+        /* Needs to be done before glock release & also in a transaction */
+        truncate_inode_pages(&inode->i_data, 0);
         gfs2_trans_end(sdp);
 
 out_unlock:
+        /* Error path for case 1 */
         if (test_bit(HIF_HOLDER, &ip->i_iopen_gh.gh_iflags))
                 gfs2_glock_dq(&ip->i_iopen_gh);
         gfs2_holder_uninit(&ip->i_iopen_gh);
@@ -1507,6 +1530,7 @@ out_unlock:
         if (error && error != GLR_TRYFAILED && error != -EROFS)
                 fs_warn(sdp, "gfs2_evict_inode: %d\n", error);
 out:
+        /* Case 3 starts here */
         truncate_inode_pages(&inode->i_data, 0);
         end_writeback(inode);
 
diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index e20eab37bc8..443cabcfcd2 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -338,6 +338,9 @@ static ssize_t lkfirst_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
         rv = sscanf(buf, "%u", &first);
         if (rv != 1 || first > 1)
                 return -EINVAL;
+        rv = wait_for_completion_killable(&sdp->sd_locking_init);
+        if (rv)
+                return rv;
         spin_lock(&sdp->sd_jindex_spin);
         rv = -EBUSY;
         if (test_bit(SDF_NOJOURNALID, &sdp->sd_flags) == 0)
@@ -414,7 +417,9 @@ static ssize_t jid_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
         rv = sscanf(buf, "%d", &jid);
         if (rv != 1)
                 return -EINVAL;
-
+        rv = wait_for_completion_killable(&sdp->sd_locking_init);
+        if (rv)
+                return rv;
         spin_lock(&sdp->sd_jindex_spin);
         rv = -EINVAL;
         if (sdp->sd_lockstruct.ls_ops->lm_mount == NULL)
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index b49b55584c8..84a47b709f5 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -500,7 +500,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
 out_put_hidden_dir:
         iput(sbi->hidden_dir);
 out_put_root:
-        iput(sbi->alloc_file);
+        iput(root);
 out_put_alloc_file:
         iput(sbi->alloc_file);
 out_close_cat_tree:
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 3031d81f5f0..4ac88ff79aa 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -36,6 +36,7 @@ int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
 {
         DECLARE_COMPLETION_ONSTACK(wait);
         struct bio *bio;
+        int ret = 0;
 
         bio = bio_alloc(GFP_NOIO, 1);
         bio->bi_sector = sector;
@@ -54,8 +55,10 @@ int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
         wait_for_completion(&wait);
 
         if (!bio_flagged(bio, BIO_UPTODATE))
-                return -EIO;
-        return 0;
+                ret = -EIO;
+
+        bio_put(bio);
+        return ret;
 }
 
 static int hfsplus_read_mdb(void *bufptr, struct hfsplus_wd *wd)
diff --git a/fs/hppfs/hppfs.c b/fs/hppfs/hppfs.c
index 87ed48e0343..85c098a499f 100644
--- a/fs/hppfs/hppfs.c
+++ b/fs/hppfs/hppfs.c
@@ -139,7 +139,8 @@ static int file_removed(struct dentry *dentry, const char *file)
 static struct dentry *hppfs_lookup(struct inode *ino, struct dentry *dentry,
                                    struct nameidata *nd)
 {
-        struct dentry *proc_dentry, *new, *parent;
+        struct dentry *proc_dentry, *parent;
+        struct qstr *name = &dentry->d_name;
         struct inode *inode;
         int err, deleted;
 
@@ -149,23 +150,9 @@ static struct dentry *hppfs_lookup(struct inode *ino, struct dentry *dentry,
         else if (deleted)
                 return ERR_PTR(-ENOENT);
 
-        err = -ENOMEM;
         parent = HPPFS_I(ino)->proc_dentry;
         mutex_lock(&parent->d_inode->i_mutex);
-        proc_dentry = d_lookup(parent, &dentry->d_name);
-        if (proc_dentry == NULL) {
-                proc_dentry = d_alloc(parent, &dentry->d_name);
-                if (proc_dentry == NULL) {
-                        mutex_unlock(&parent->d_inode->i_mutex);
-                        goto out;
-                }
-                new = (*parent->d_inode->i_op->lookup)(parent->d_inode,
-                                                       proc_dentry, NULL);
-                if (new) {
-                        dput(proc_dentry);
-                        proc_dentry = new;
-                }
-        }
+        proc_dentry = lookup_one_len(name->name, parent, name->len);
         mutex_unlock(&parent->d_inode->i_mutex);
 
         if (IS_ERR(proc_dentry))
@@ -174,13 +161,11 @@ static struct dentry *hppfs_lookup(struct inode *ino, struct dentry *dentry,
         err = -ENOMEM;
         inode = get_inode(ino->i_sb, proc_dentry);
         if (!inode)
-                goto out_dput;
+                goto out;
 
         d_add(dentry, inode);
         return NULL;
 
- out_dput:
-        dput(proc_dentry);
  out:
         return ERR_PTR(err);
 }
@@ -690,8 +675,10 @@ static struct inode *get_inode(struct super_block *sb, struct dentry *dentry)
         struct inode *proc_ino = dentry->d_inode;
         struct inode *inode = new_inode(sb);
 
-        if (!inode)
+        if (!inode) {
+                dput(dentry);
                 return ERR_PTR(-ENOMEM);
+        }
 
         if (S_ISDIR(dentry->d_inode->i_mode)) {
                 inode->i_op = &hppfs_dir_iops;
@@ -704,7 +691,7 @@ static struct inode *get_inode(struct super_block *sb, struct dentry *dentry)
                 inode->i_fop = &hppfs_file_fops;
         }
 
-        HPPFS_I(inode)->proc_dentry = dget(dentry);
+        HPPFS_I(inode)->proc_dentry = dentry;
 
         inode->i_uid = proc_ino->i_uid;
         inode->i_gid = proc_ino->i_gid;
@@ -737,7 +724,7 @@ static int hppfs_fill_super(struct super_block *sb, void *d, int silent)
         sb->s_fs_info = proc_mnt;
 
         err = -ENOMEM;
-        root_inode = get_inode(sb, proc_mnt->mnt_sb->s_root);
+        root_inode = get_inode(sb, dget(proc_mnt->mnt_sb->s_root));
         if (!root_inode)
                 goto out_mntput;
 
diff --git a/fs/libfs.c b/fs/libfs.c
index c88eab55aec..275ca4749a2 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -822,7 +822,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
                 goto out;
 
         attr->set_buf[size] = '\0';
-        val = simple_strtol(attr->set_buf, NULL, 0);
+        val = simple_strtoll(attr->set_buf, NULL, 0);
         ret = attr->set(attr->data, val);
         if (ret == 0)
                 ret = len; /* on success, claim we got the whole input */
diff --git a/fs/locks.c b/fs/locks.c
index 0a4f50dfadf..b286539d547 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -160,10 +160,28 @@ EXPORT_SYMBOL_GPL(unlock_flocks);
 
 static struct kmem_cache *filelock_cache __read_mostly;
 
+static void locks_init_lock_always(struct file_lock *fl)
+{
+        fl->fl_next = NULL;
+        fl->fl_fasync = NULL;
+        fl->fl_owner = NULL;
+        fl->fl_pid = 0;
+        fl->fl_nspid = NULL;
+        fl->fl_file = NULL;
+        fl->fl_flags = 0;
+        fl->fl_type = 0;
+        fl->fl_start = fl->fl_end = 0;
+}
+
 /* Allocate an empty lock structure. */
 struct file_lock *locks_alloc_lock(void)
 {
-        return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
+        struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
+
+        if (fl)
+                locks_init_lock_always(fl);
+
+        return fl;
 }
 EXPORT_SYMBOL_GPL(locks_alloc_lock);
 
@@ -200,17 +218,9 @@ void locks_init_lock(struct file_lock *fl)
         INIT_LIST_HEAD(&fl->fl_link);
         INIT_LIST_HEAD(&fl->fl_block);
         init_waitqueue_head(&fl->fl_wait);
-        fl->fl_next = NULL;
-        fl->fl_fasync = NULL;
-        fl->fl_owner = NULL;
-        fl->fl_pid = 0;
-        fl->fl_nspid = NULL;
-        fl->fl_file = NULL;
-        fl->fl_flags = 0;
-        fl->fl_type = 0;
-        fl->fl_start = fl->fl_end = 0;
         fl->fl_ops = NULL;
         fl->fl_lmops = NULL;
+        locks_init_lock_always(fl);
 }
 
 EXPORT_SYMBOL(locks_init_lock);
diff --git a/fs/namei.c b/fs/namei.c
index 0223c41fb11..14ab8d3f2f0 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -433,6 +433,8 @@ static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
                         goto err_parent;
                 BUG_ON(nd->inode != parent->d_inode);
         } else {
+                if (dentry->d_parent != parent)
+                        goto err_parent;
                 spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
                 if (!__d_rcu_to_refcount(dentry, nd->seq))
                         goto err_child;
@@ -940,7 +942,6 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                  * Don't forget we might have a non-mountpoint managed dentry
                  * that wants to block transit.
                  */
-                *inode = path->dentry->d_inode;
                 if (unlikely(managed_dentry_might_block(path->dentry)))
                         return false;
 
@@ -953,6 +954,12 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                 path->mnt = mounted;
                 path->dentry = mounted->mnt_root;
                 nd->seq = read_seqcount_begin(&path->dentry->d_seq);
+                /*
+                 * Update the inode too. We don't need to re-check the
+                 * dentry sequence number here after this d_inode read,
+                 * because a mount-point is always pinned.
+                 */
+                *inode = path->dentry->d_inode;
         }
         return true;
 }
diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
index ce153a6b3ae..419119c371b 100644
--- a/fs/nfs/fscache.c
+++ b/fs/nfs/fscache.c
@@ -259,12 +259,10 @@ static void nfs_fscache_disable_inode_cookie(struct inode *inode)
                 dfprintk(FSCACHE,
                          "NFS: nfsi 0x%p turning cache off\n", NFS_I(inode));
 
-                /* Need to invalidate any mapped pages that were read in before
-                 * turning off the cache.
+                /* Need to uncache any pages attached to this inode that
+                 * fscache knows about before turning off the cache.
                  */
-                if (inode->i_mapping && inode->i_mapping->nrpages)
-                        invalidate_inode_pages2(inode->i_mapping);
-
+                fscache_uncache_all_inode_pages(NFS_I(inode)->fscache, inode);
                 nfs_fscache_zap_inode_cookie(inode);
         }
 }
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 0bafcc91c27..f9d03abcd04 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -398,7 +398,6 @@ filelayout_write_pagelist(struct nfs_write_data *data, int sync)
          * this offset and save the original offset.
          */
         data->args.offset = filelayout_get_dserver_offset(lseg, offset);
-        data->mds_offset = offset;
 
         /* Perform an asynchronous write */
         status = nfs_initiate_write(data, ds->ds_clp->cl_rpcclient,
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 6870bc61cee..e6e8f3b9a1d 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -91,7 +91,7 @@ static int nfs4_stat_to_errno(int);
 #define encode_getfh_maxsz      (op_encode_hdr_maxsz)
 #define decode_getfh_maxsz      (op_decode_hdr_maxsz + 1 + \
                                 ((3+NFS4_FHSIZE) >> 2))
-#define nfs4_fattr_bitmap_maxsz 3
+#define nfs4_fattr_bitmap_maxsz 4
 #define encode_getattr_maxsz    (op_encode_hdr_maxsz + nfs4_fattr_bitmap_maxsz)
 #define nfs4_name_maxsz         (1 + ((3 + NFS4_MAXNAMLEN) >> 2))
 #define nfs4_path_maxsz         (1 + ((3 + NFS4_MAXPATHLEN) >> 2))
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index e268e3b2349..72716805968 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -864,6 +864,8 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
 
         data->args.fh     = NFS_FH(inode);
         data->args.offset = req_offset(req) + offset;
+        /* pnfs_set_layoutcommit needs this */
+        data->mds_offset = data->args.offset;
         data->args.pgbase = req->wb_pgbase + offset;
         data->args.pages  = data->pagevec;
         data->args.count  = count;
diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
index 29309e25417..b57aab9a118 100644
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -56,16 +56,12 @@ static struct dentry *ufs_lookup(struct inode * dir, struct dentry *dentry, stru
 
         lock_ufs(dir->i_sb);
         ino = ufs_inode_by_name(dir, &dentry->d_name);
-        if (ino) {
+        if (ino)
                 inode = ufs_iget(dir->i_sb, ino);
-                if (IS_ERR(inode)) {
-                        unlock_ufs(dir->i_sb);
-                        return ERR_CAST(inode);
-                }
-        }
         unlock_ufs(dir->i_sb);
-        d_add(dentry, inode);
-        return NULL;
+        if (IS_ERR(inode))
+                return ERR_CAST(inode);
+        return d_splice_alias(inode, dentry);
 }
 
 /*
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 09983a3344a..b1e88d56069 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -681,15 +681,15 @@ xfs_inode_item_unlock(
  * where the cluster buffer may be unpinned before the inode is inserted into
  * the AIL during transaction committed processing. If the buffer is unpinned
  * before the inode item has been committed and inserted, then it is possible
- * for the buffer to be written and IO completions before the inode is inserted
+ * for the buffer to be written and IO completes before the inode is inserted
  * into the AIL. In that case, we'd be inserting a clean, stale inode into the
  * AIL which will never get removed. It will, however, get reclaimed which
  * triggers an assert in xfs_inode_free() complaining about freein an inode
  * still in the AIL.
  *
- * To avoid this, return a lower LSN than the one passed in so that the
- * transaction committed code will not move the inode forward in the AIL but
- * will still unpin it properly.
+ * To avoid this, just unpin the inode directly and return a LSN of -1 so the
+ * transaction committed code knows that it does not need to do any further
+ * processing on the item.
  */
 STATIC xfs_lsn_t
 xfs_inode_item_committed(
@@ -699,8 +699,10 @@ xfs_inode_item_committed(
         struct xfs_inode_log_item *iip = INODE_ITEM(lip);
         struct xfs_inode        *ip = iip->ili_inode;
 
-        if (xfs_iflags_test(ip, XFS_ISTALE))
-                return lsn - 1;
+        if (xfs_iflags_test(ip, XFS_ISTALE)) {
+                xfs_inode_item_unpin(lip, 0);
+                return -1;
+        }
         return lsn;
 }
 
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index 7c7bc2b786b..c83f63b33aa 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -1361,7 +1361,7 @@ xfs_trans_item_committed(
                 lip->li_flags |= XFS_LI_ABORTED;
         item_lsn = IOP_COMMITTED(lip, commit_lsn);
 
-        /* If the committed routine returns -1, item has been freed. */
+        /* item_lsn of -1 means the item needs no further processing */
         if (XFS_LSN_CMP(item_lsn, (xfs_lsn_t)-1) == 0)
                 return;
 
@@ -1474,7 +1474,7 @@ xfs_trans_committed_bulk(
                         lip->li_flags |= XFS_LI_ABORTED;
                 item_lsn = IOP_COMMITTED(lip, commit_lsn);
 
-                /* item_lsn of -1 means the item was freed */
+                /* item_lsn of -1 means the item needs no further processing */
                 if (XFS_LSN_CMP(item_lsn, (xfs_lsn_t)-1) == 0)
                         continue;