79 files changed, 911 insertions, 889 deletions
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 1feb68ecef9..842d00048a6 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -94,25 +94,21 @@ static struct dentry *get_next_positive_subdir(struct dentry *prev,
 {
        struct autofs_sb_info *sbi = autofs4_sbi(root->d_sb);
        struct list_head *next;
-        struct dentry *p, *q;
+        struct dentry *q;
        spin_lock(&sbi->lookup_lock);
+        spin_lock(&root->d_lock);
-        if (prev == NULL) {
+        if (prev)
-                spin_lock(&root->d_lock);
+                next = prev->d_u.d_child.next;
+        else {
                prev = dget_dlock(root);
                next = prev->d_subdirs.next;
-                p = prev;
-                goto start;
        }
-        p = prev;
+cont:
-        spin_lock(&p->d_lock);
-again:
-        next = p->d_u.d_child.next;
-start:
        if (next == &root->d_subdirs) {
-                spin_unlock(&p->d_lock);
+                spin_unlock(&root->d_lock);
                spin_unlock(&sbi->lookup_lock);
                dput(prev);
                return NULL;
@@ -121,16 +117,15 @@ start:
        q = list_entry(next, struct dentry, d_u.d_child);
        spin_lock_nested(&q->d_lock, DENTRY_D_LOCK_NESTED);
-        /* Negative dentry - try next */
+        /* Already gone or negative dentry (under construction) - try next */
-        if (!simple_positive(q)) {
+        if (q->d_count == 0 || !simple_positive(q)) {
-                spin_unlock(&p->d_lock);
+                spin_unlock(&q->d_lock);
-                lock_set_subclass(&q->d_lock.dep_map, 0, _RET_IP_);
+                next = q->d_u.d_child.next;
-                p = q;
+                goto cont;
-                goto again;
        }
        dget_dlock(q);
        spin_unlock(&q->d_lock);
-        spin_unlock(&p->d_lock);
+        spin_unlock(&root->d_lock);
        spin_unlock(&sbi->lookup_lock);
        dput(prev);
@@ -404,11 +399,6 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
                        DPRINTK("checking mountpoint %p %.*s",
                                dentry, (int)dentry->d_name.len, dentry->d_name.name);
-                        /* Path walk currently on this dentry? */
-                        ino_count = atomic_read(&ino->count) + 2;
-                        if (dentry->d_count > ino_count)
-                                goto next;
                        /* Can we umount this guy */
                        if (autofs4_mount_busy(mnt, dentry))
                                goto next;
diff --git a/fs/bio.c b/fs/bio.c
index fed1f799cb5..71072ab9912 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -1313,7 +1313,7 @@ EXPORT_SYMBOL(bio_copy_kern);
 * Note that this code is very hard to test under normal circumstances because
 * direct-io pins the pages with get_user_pages().  This makes
 * is_page_cache_freeable return false, and the VM will not clean the pages.
- * But other code (eg, pdflush) could clean the pages if they are mapped
+ * But other code (eg, flusher threads) could clean the pages if they are mapped
 * pagecache.
 *
 * Simply disabling the call to bio_set_pages_dirty() is a good way to test the
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 83baec24946..6e8f416773d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -324,7 +324,8 @@ static noinline int add_async_extent(struct async_cow *cow,
 * If this code finds it can't get good compression, it puts an
 * entry onto the work queue to write the uncompressed bytes.  This
 * makes sure that both compressed inodes and uncompressed inodes
- * are written in the same order that pdflush sent them down.
+ * are written in the same order that the flusher thread sent them
+ * down.
 */
 static noinline int compress_file_range(struct inode *inode,
                                        struct page *locked_page,
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index bc2f6ffff3c..7bb755677a2 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -664,10 +664,6 @@ static noinline int btrfs_mksubvol(struct path *parent,
        struct dentry *dentry;
        int error;
-        error = mnt_want_write(parent->mnt);
-        if (error)
-                return error;
        mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
        dentry = lookup_one_len(name, parent->dentry, namelen);
@@ -703,7 +699,6 @@ out_dput:
        dput(dentry);
 out_unlock:
        mutex_unlock(&dir->i_mutex);
-        mnt_drop_write(parent->mnt);
        return error;
 }
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 643335a4fe3..051c7fe551d 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -596,7 +596,7 @@ void btrfs_start_ordered_extent(struct inode *inode,
        /*
         * pages in the range can be dirty, clean or writeback.  We
         * start IO on any dirty ones so the wait doesn't stall waiting
-         * for pdflush to find them
+         * for the flusher thread to find them
         */
        if (!test_bit(BTRFS_ORDERED_DIRECT, &entry->flags))
                filemap_fdatawrite_range(inode->i_mapping, start, end);
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 8c6e61d6eed..f2eb24c477a 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -100,10 +100,6 @@ static void __save_error_info(struct btrfs_fs_info *fs_info)
        fs_info->fs_state = BTRFS_SUPER_FLAG_ERROR;
 }
-/* NOTE:
- *      We move write_super stuff at umount in order to avoid deadlock
- *      for umount hold all lock.
- */
 static void save_error_info(struct btrfs_fs_info *fs_info)
 {
        __save_error_info(fs_info);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index b8708f994e6..e86ae04abe6 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1744,10 +1744,6 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
        device->fs_devices = root->fs_info->fs_devices;
-        /*
-         * we don't want write_supers to jump in here with our device
-         * half setup
-         */
        mutex_lock(&root->fs_info->fs_devices->device_list_mutex);
        list_add_rcu(&device->dev_list, &root->fs_info->fs_devices->devices);
        list_add(&device->dev_alloc_list,
diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c
index fb962efdace..6d59006bfa2 100644
--- a/fs/ceph/debugfs.c
+++ b/fs/ceph/debugfs.c
@@ -201,6 +201,7 @@ int ceph_fs_debugfs_init(struct ceph_fs_client *fsc)
        int err = -ENOMEM;
        dout("ceph_fs_debugfs_init\n");
+        BUG_ON(!fsc->client->debugfs_dir);
        fsc->debugfs_congestion_kb =
                debugfs_create_file("writeback_congestion_kb",
                                    0600,
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index f391f1e7541..e5b77319c97 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -633,44 +633,6 @@ static struct dentry *ceph_lookup(struct inode *dir, struct dentry *dentry,
        return dentry;
 }
-int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
-                     struct file *file, unsigned flags, umode_t mode,
-                     int *opened)
-{
-        int err;
-        struct dentry *res = NULL;
-        if (!(flags & O_CREAT)) {
-                if (dentry->d_name.len > NAME_MAX)
-                        return -ENAMETOOLONG;
-                err = ceph_init_dentry(dentry);
-                if (err < 0)
-                        return err;
-                return ceph_lookup_open(dir, dentry, file, flags, mode, opened);
-        }
-        if (d_unhashed(dentry)) {
-                res = ceph_lookup(dir, dentry, 0);
-                if (IS_ERR(res))
-                        return PTR_ERR(res);
-                if (res)
-                        dentry = res;
-        }
-        /* We don't deal with positive dentries here */
-        if (dentry->d_inode)
-                return finish_no_open(file, res);
-        *opened |= FILE_CREATED;
-        err = ceph_lookup_open(dir, dentry, file, flags, mode, opened);
-        dput(res);
-        return err;
-}
 /*
 * If we do a create but get no trace back from the MDS, follow up with
 * a lookup (the VFS expects us to link up the provided dentry).
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 1b81d6c3187..ecebbc09bfc 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -4,6 +4,7 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/file.h>
+#include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/writeback.h>
@@ -106,9 +107,6 @@ static int ceph_init_file(struct inode *inode, struct file *file, int fmode)
 }
 /*
- * If the filp already has private_data, that means the file was
- * already opened by intent during lookup, and we do nothing.
- *
 * If we already have the requisite capabilities, we can satisfy
 * the open request locally (no need to request new caps from the
 * MDS).  We do, however, need to inform the MDS (asynchronously)
@@ -207,24 +205,29 @@ out:
 /*
- * Do a lookup + open with a single request.
+ * Do a lookup + open with a single request.  If we get a non-existent
- *
+ * file or symlink, return 1 so the VFS can retry.
- * If this succeeds, but some subsequent check in the vfs
- * may_open() fails, the struct *file gets cleaned up (i.e.
- * ceph_release gets called).  So fear not!
 */
-int ceph_lookup_open(struct inode *dir, struct dentry *dentry,
+int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
                     struct file *file, unsigned flags, umode_t mode,
                     int *opened)
 {
        struct ceph_fs_client *fsc = ceph_sb_to_client(dir->i_sb);
        struct ceph_mds_client *mdsc = fsc->mdsc;
        struct ceph_mds_request *req;
-        struct dentry *ret;
+        struct dentry *dn;
        int err;
-        dout("ceph_lookup_open dentry %p '%.*s' flags %d mode 0%o\n",
+        dout("atomic_open %p dentry %p '%.*s' %s flags %d mode 0%o\n",
-             dentry, dentry->d_name.len, dentry->d_name.name, flags, mode);
+             dir, dentry, dentry->d_name.len, dentry->d_name.name,
+             d_unhashed(dentry) ? "unhashed" : "hashed", flags, mode);
+        if (dentry->d_name.len > NAME_MAX)
+                return -ENAMETOOLONG;
+        err = ceph_init_dentry(dentry);
+        if (err < 0)
+                return err;
        /* do the open */
        req = prepare_open_request(dir->i_sb, flags, mode);
@@ -241,22 +244,31 @@ int ceph_lookup_open(struct inode *dir, struct dentry *dentry,
                                   (flags & (O_CREAT|O_TRUNC)) ? dir : NULL,
                                   req);
        err = ceph_handle_snapdir(req, dentry, err);
-        if (err)
+        if (err == 0 && (flags & O_CREAT) && !req->r_reply_info.head->is_dentry)
-                goto out;
-        if ((flags & O_CREAT) && !req->r_reply_info.head->is_dentry)
                err = ceph_handle_notrace_create(dir, dentry);
-        if (err)
-                goto out;
-        err = finish_open(file, req->r_dentry, ceph_open, opened);
-out:
-        ret = ceph_finish_lookup(req, dentry, err);
-        ceph_mdsc_put_request(req);
-        dout("ceph_lookup_open result=%p\n", ret);
-        if (IS_ERR(ret))
+        if (d_unhashed(dentry)) {
-                return PTR_ERR(ret);
+                dn = ceph_finish_lookup(req, dentry, err);
+                if (IS_ERR(dn))
+                        err = PTR_ERR(dn);
+        } else {
+                /* we were given a hashed negative dentry */
+                dn = NULL;
+        }
+        if (err)
+                goto out_err;
+        if (dn || dentry->d_inode == NULL || S_ISLNK(dentry->d_inode->i_mode)) {
+                /* make vfs retry on splice, ENOENT, or symlink */
+                dout("atomic_open finish_no_open on dn %p\n", dn);
+                err = finish_no_open(file, dn);
+        } else {
+                dout("atomic_open finish_open on dn %p\n", dn);
+                err = finish_open(file, dentry, ceph_open, opened);
+        }
-        dput(ret);
+out_err:
+        ceph_mdsc_put_request(req);
+        dout("atomic_open result=%d\n", err);
        return err;
 }
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 9fff9f3b17e..4b5762ef7c2 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -992,11 +992,15 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
        if (rinfo->head->is_dentry) {
                struct inode *dir = req->r_locked_dir;
-                err = fill_inode(dir, &rinfo->diri, rinfo->dirfrag,
+                if (dir) {
-                                 session, req->r_request_started, -1,
+                        err = fill_inode(dir, &rinfo->diri, rinfo->dirfrag,
-                                 &req->r_caps_reservation);
+                                         session, req->r_request_started, -1,
-                if (err < 0)
+                                         &req->r_caps_reservation);
-                        return err;
+                        if (err < 0)
+                                return err;
+                } else {
+                        WARN_ON_ONCE(1);
+                }
        }
        /*
@@ -1004,6 +1008,7 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
         * will have trouble splicing in the virtual snapdir later
         */
        if (rinfo->head->is_dentry && !req->r_aborted &&
+            req->r_locked_dir &&
            (rinfo->head->is_target || strncmp(req->r_dentry->d_name.name,
                                               fsc->mount_options->snapdir_name,
                                               req->r_dentry->d_name.len))) {
diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
index 8e3fb69fbe6..1396ceb4679 100644
--- a/fs/ceph/ioctl.c
+++ b/fs/ceph/ioctl.c
@@ -42,7 +42,8 @@ static long __validate_layout(struct ceph_mds_client *mdsc,
        /* validate striping parameters */
        if ((l->object_size & ~PAGE_MASK) ||
            (l->stripe_unit & ~PAGE_MASK) ||
-            ((unsigned)l->object_size % (unsigned)l->stripe_unit))
+            (l->stripe_unit != 0 &&
+             ((unsigned)l->object_size % (unsigned)l->stripe_unit)))
                return -EINVAL;
        /* make sure it's a valid data pool */
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index ebc95cc652b..66ebe720e40 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -806,9 +806,9 @@ extern int ceph_copy_from_page_vector(struct page **pages,
                                    loff_t off, size_t len);
 extern struct page **ceph_alloc_page_vector(int num_pages, gfp_t flags);
 extern int ceph_open(struct inode *inode, struct file *file);
-extern int ceph_lookup_open(struct inode *dir, struct dentry *dentry,
+extern int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
-                             struct file *od, unsigned flags,
+                            struct file *file, unsigned flags, umode_t mode,
-                             umode_t mode, int *opened);
+                            int *opened);
 extern int ceph_release(struct inode *inode, struct file *filp);
 /* dir.c */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 497da5ce704..977dc0e85cc 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -246,6 +246,16 @@ struct smb_version_operations {
        bool (*can_echo)(struct TCP_Server_Info *);
        /* send echo request */
        int (*echo)(struct TCP_Server_Info *);
+        /* create directory */
+        int (*mkdir)(const unsigned int, struct cifs_tcon *, const char *,
+                     struct cifs_sb_info *);
+        /* set info on created directory */
+        void (*mkdir_setinfo)(struct inode *, const char *,
+                              struct cifs_sb_info *, struct cifs_tcon *,
+                              const unsigned int);
+        /* remove directory */
+        int (*rmdir)(const unsigned int, struct cifs_tcon *, const char *,
+                     struct cifs_sb_info *);
 };
 struct smb_version_values {
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index cf7fb185103..f1bbf8305d3 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -289,18 +289,15 @@ extern int CIFSSMBUnixSetFileInfo(const unsigned int xid,
                                  u16 fid, u32 pid_of_opener);
 extern int CIFSSMBUnixSetPathInfo(const unsigned int xid,
-                                  struct cifs_tcon *tcon, char *file_name,
+                                  struct cifs_tcon *tcon, const char *file_name,
                                  const struct cifs_unix_set_info_args *args,
                                  const struct nls_table *nls_codepage,
-                                  int remap_special_chars);
+                                  int remap);
 extern int CIFSSMBMkDir(const unsigned int xid, struct cifs_tcon *tcon,
-                        const char *newName,
+                        const char *name, struct cifs_sb_info *cifs_sb);
-                        const struct nls_table *nls_codepage,
-                        int remap_special_chars);
 extern int CIFSSMBRmDir(const unsigned int xid, struct cifs_tcon *tcon,
-                        const char *name, const struct nls_table *nls_codepage,
+                        const char *name, struct cifs_sb_info *cifs_sb);
-                        int remap_special_chars);
 extern int CIFSPOSIXDelFile(const unsigned int xid, struct cifs_tcon *tcon,
                        const char *name, __u16 type,
                        const struct nls_table *nls_codepage,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index cabc7a01f5d..074923ce593 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -948,15 +948,15 @@ DelFileRetry:
 }
 int
-CIFSSMBRmDir(const unsigned int xid, struct cifs_tcon *tcon,
+CIFSSMBRmDir(const unsigned int xid, struct cifs_tcon *tcon, const char *name,
-             const char *dirName, const struct nls_table *nls_codepage,
+             struct cifs_sb_info *cifs_sb)
-             int remap)
 {
        DELETE_DIRECTORY_REQ *pSMB = NULL;
        DELETE_DIRECTORY_RSP *pSMBr = NULL;
        int rc = 0;
        int bytes_returned;
        int name_len;
+        int remap = cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR;
        cFYI(1, "In CIFSSMBRmDir");
 RmDirRetry:
@@ -966,14 +966,15 @@ RmDirRetry:
                return rc;
        if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifsConvertToUTF16((__le16 *) pSMB->DirName, dirName,
+                name_len = cifsConvertToUTF16((__le16 *) pSMB->DirName, name,
-                                              PATH_MAX, nls_codepage, remap);
+                                              PATH_MAX, cifs_sb->local_nls,
+                                              remap);
                name_len++;     /* trailing null */
                name_len *= 2;
        } else {                /* BB improve check for buffer overruns BB */
-                name_len = strnlen(dirName, PATH_MAX);
+                name_len = strnlen(name, PATH_MAX);
                name_len++;     /* trailing null */
-                strncpy(pSMB->DirName, dirName, name_len);
+                strncpy(pSMB->DirName, name, name_len);
        }
        pSMB->BufferFormat = 0x04;
@@ -992,14 +993,15 @@ RmDirRetry:
 }
 int
-CIFSSMBMkDir(const unsigned int xid, struct cifs_tcon *tcon,
+CIFSSMBMkDir(const unsigned int xid, struct cifs_tcon *tcon, const char *name,
-             const char *name, const struct nls_table *nls_codepage, int remap)
+             struct cifs_sb_info *cifs_sb)
 {
        int rc = 0;
        CREATE_DIRECTORY_REQ *pSMB = NULL;
        CREATE_DIRECTORY_RSP *pSMBr = NULL;
        int bytes_returned;
        int name_len;
+        int remap = cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR;
        cFYI(1, "In CIFSSMBMkDir");
 MkDirRetry:
@@ -1010,7 +1012,8 @@ MkDirRetry:
        if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                name_len = cifsConvertToUTF16((__le16 *) pSMB->DirName, name,
-                                              PATH_MAX, nls_codepage, remap);
+                                              PATH_MAX, cifs_sb->local_nls,
+                                              remap);
                name_len++;     /* trailing null */
                name_len *= 2;
        } else {                /* BB improve check for buffer overruns BB */
@@ -5943,7 +5946,7 @@ CIFSSMBUnixSetFileInfo(const unsigned int xid, struct cifs_tcon *tcon,
 int
 CIFSSMBUnixSetPathInfo(const unsigned int xid, struct cifs_tcon *tcon,
-                       char *fileName,
+                       const char *file_name,
                       const struct cifs_unix_set_info_args *args,
                       const struct nls_table *nls_codepage, int remap)
 {
@@ -5964,14 +5967,14 @@ setPermsRetry:
        if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                name_len =
-                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, file_name,
                                       PATH_MAX, nls_codepage, remap);
                name_len++;     /* trailing null */
                name_len *= 2;
        } else {        /* BB improve the check for buffer overruns BB */
-                name_len = strnlen(fileName, PATH_MAX);
+                name_len = strnlen(file_name, PATH_MAX);
                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, fileName, name_len);
+                strncpy(pSMB->FileName, file_name, name_len);
        }
        params = 6 + name_len;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 35cb6a374a4..7354877fa3b 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1219,16 +1219,153 @@ unlink_out:
        return rc;
 }
+static int
+cifs_mkdir_qinfo(struct inode *inode, struct dentry *dentry, umode_t mode,
+                 const char *full_path, struct cifs_sb_info *cifs_sb,
+                 struct cifs_tcon *tcon, const unsigned int xid)
+{
+        int rc = 0;
+        struct inode *newinode = NULL;
+        if (tcon->unix_ext)
+                rc = cifs_get_inode_info_unix(&newinode, full_path, inode->i_sb,
+                                              xid);
+        else
+                rc = cifs_get_inode_info(&newinode, full_path, NULL,
+                                         inode->i_sb, xid, NULL);
+        if (rc)
+                return rc;
+        d_instantiate(dentry, newinode);
+        /*
+         * setting nlink not necessary except in cases where we failed to get it
+         * from the server or was set bogus
+         */
+        if ((dentry->d_inode) && (dentry->d_inode->i_nlink < 2))
+                set_nlink(dentry->d_inode, 2);
+        mode &= ~current_umask();
+        /* must turn on setgid bit if parent dir has it */
+        if (inode->i_mode & S_ISGID)
+                mode |= S_ISGID;
+        if (tcon->unix_ext) {
+                struct cifs_unix_set_info_args args = {
+                        .mode   = mode,
+                        .ctime  = NO_CHANGE_64,
+                        .atime  = NO_CHANGE_64,
+                        .mtime  = NO_CHANGE_64,
+                        .device = 0,
+                };
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
+                        args.uid = (__u64)current_fsuid();
+                        if (inode->i_mode & S_ISGID)
+                                args.gid = (__u64)inode->i_gid;
+                        else
+                                args.gid = (__u64)current_fsgid();
+                } else {
+                        args.uid = NO_CHANGE_64;
+                        args.gid = NO_CHANGE_64;
+                }
+                CIFSSMBUnixSetPathInfo(xid, tcon, full_path, &args,
+                                       cifs_sb->local_nls,
+                                       cifs_sb->mnt_cifs_flags &
+                                       CIFS_MOUNT_MAP_SPECIAL_CHR);
+        } else {
+                struct TCP_Server_Info *server = tcon->ses->server;
+                if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) &&
+                    (mode & S_IWUGO) == 0 && server->ops->mkdir_setinfo)
+                        server->ops->mkdir_setinfo(newinode, full_path, cifs_sb,
+                                                   tcon, xid);
+                if (dentry->d_inode) {
+                        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)
+                                dentry->d_inode->i_mode = (mode | S_IFDIR);
+                        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
+                                dentry->d_inode->i_uid = current_fsuid();
+                                if (inode->i_mode & S_ISGID)
+                                        dentry->d_inode->i_gid = inode->i_gid;
+                                else
+                                        dentry->d_inode->i_gid =
+                                                                current_fsgid();
+                        }
+                }
+        }
+        return rc;
+}
+static int
+cifs_posix_mkdir(struct inode *inode, struct dentry *dentry, umode_t mode,
+                 const char *full_path, struct cifs_sb_info *cifs_sb,
+                 struct cifs_tcon *tcon, const unsigned int xid)
+{
+        int rc = 0;
+        u32 oplock = 0;
+        FILE_UNIX_BASIC_INFO *info = NULL;
+        struct inode *newinode = NULL;
+        struct cifs_fattr fattr;
+        info = kzalloc(sizeof(FILE_UNIX_BASIC_INFO), GFP_KERNEL);
+        if (info == NULL) {
+                rc = -ENOMEM;
+                goto posix_mkdir_out;
+        }
+        mode &= ~current_umask();
+        rc = CIFSPOSIXCreate(xid, tcon, SMB_O_DIRECTORY | SMB_O_CREAT, mode,
+                             NULL /* netfid */, info, &oplock, full_path,
+                             cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
+                             CIFS_MOUNT_MAP_SPECIAL_CHR);
+        if (rc == -EOPNOTSUPP)
+                goto posix_mkdir_out;
+        else if (rc) {
+                cFYI(1, "posix mkdir returned 0x%x", rc);
+                d_drop(dentry);
+                goto posix_mkdir_out;
+        }
+        if (info->Type == cpu_to_le32(-1))
+                /* no return info, go query for it */
+                goto posix_mkdir_get_info;
+        /*
+         * BB check (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID ) to see if
+         * need to set uid/gid.
+         */
+        cifs_unix_basic_to_fattr(&fattr, info, cifs_sb);
+        cifs_fill_uniqueid(inode->i_sb, &fattr);
+        newinode = cifs_iget(inode->i_sb, &fattr);
+        if (!newinode)
+                goto posix_mkdir_get_info;
+        d_instantiate(dentry, newinode);
+#ifdef CONFIG_CIFS_DEBUG2
+        cFYI(1, "instantiated dentry %p %s to inode %p", dentry,
+             dentry->d_name.name, newinode);
+        if (newinode->i_nlink != 2)
+                cFYI(1, "unexpected number of links %d", newinode->i_nlink);
+#endif
+posix_mkdir_out:
+        kfree(info);
+        return rc;
+posix_mkdir_get_info:
+        rc = cifs_mkdir_qinfo(inode, dentry, mode, full_path, cifs_sb, tcon,
+                              xid);
+        goto posix_mkdir_out;
+}
 int cifs_mkdir(struct inode *inode, struct dentry *direntry, umode_t mode)
 {
-        int rc = 0, tmprc;
+        int rc = 0;
        unsigned int xid;
        struct cifs_sb_info *cifs_sb;
        struct tcon_link *tlink;
        struct cifs_tcon *tcon;
-        char *full_path = NULL;
+        struct TCP_Server_Info *server;
-        struct inode *newinode = NULL;
+        char *full_path;
-        struct cifs_fattr fattr;
        cFYI(1, "In cifs_mkdir, mode = 0x%hx inode = 0x%p", mode, inode);
@@ -1248,145 +1385,29 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, umode_t mode)
        if (cap_unix(tcon->ses) && (CIFS_UNIX_POSIX_PATH_OPS_CAP &
                                le64_to_cpu(tcon->fsUnixInfo.Capability))) {
-                u32 oplock = 0;
+                rc = cifs_posix_mkdir(inode, direntry, mode, full_path, cifs_sb,
-                FILE_UNIX_BASIC_INFO *pInfo =
+                                      tcon, xid);
-                        kzalloc(sizeof(FILE_UNIX_BASIC_INFO), GFP_KERNEL);
+                if (rc != -EOPNOTSUPP)
-                if (pInfo == NULL) {
-                        rc = -ENOMEM;
                        goto mkdir_out;
-                }
+        }
-                mode &= ~current_umask();
-                rc = CIFSPOSIXCreate(xid, tcon, SMB_O_DIRECTORY | SMB_O_CREAT,
-                                mode, NULL /* netfid */, pInfo, &oplock,
-                                full_path, cifs_sb->local_nls,
-                                cifs_sb->mnt_cifs_flags &
-                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
-                if (rc == -EOPNOTSUPP) {
-                        kfree(pInfo);
-                        goto mkdir_retry_old;
-                } else if (rc) {
-                        cFYI(1, "posix mkdir returned 0x%x", rc);
-                        d_drop(direntry);
-                } else {
-                        if (pInfo->Type == cpu_to_le32(-1)) {
-                                /* no return info, go query for it */
-                                kfree(pInfo);
-                                goto mkdir_get_info;
-                        }
-/*BB check (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID ) to see if need
-        to set uid/gid */
-                        cifs_unix_basic_to_fattr(&fattr, pInfo, cifs_sb);
-                        cifs_fill_uniqueid(inode->i_sb, &fattr);
-                        newinode = cifs_iget(inode->i_sb, &fattr);
-                        if (!newinode) {
-                                kfree(pInfo);
-                                goto mkdir_get_info;
-                        }
-                        d_instantiate(direntry, newinode);
-#ifdef CONFIG_CIFS_DEBUG2
+        server = tcon->ses->server;
-                        cFYI(1, "instantiated dentry %p %s to inode %p",
-                                direntry, direntry->d_name.name, newinode);
-                        if (newinode->i_nlink != 2)
+        if (!server->ops->mkdir) {
-                                cFYI(1, "unexpected number of links %d",
+                rc = -ENOSYS;
-                                        newinode->i_nlink);
-#endif
-                }
-                kfree(pInfo);
                goto mkdir_out;
        }
-mkdir_retry_old:
        /* BB add setting the equivalent of mode via CreateX w/ACLs */
-        rc = CIFSSMBMkDir(xid, tcon, full_path, cifs_sb->local_nls,
+        rc = server->ops->mkdir(xid, tcon, full_path, cifs_sb);
-                          cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
        if (rc) {
                cFYI(1, "cifs_mkdir returned 0x%x", rc);
                d_drop(direntry);
-        } else {
+                goto mkdir_out;
-mkdir_get_info:
-                if (tcon->unix_ext)
-                        rc = cifs_get_inode_info_unix(&newinode, full_path,
-                                                      inode->i_sb, xid);
-                else
-                        rc = cifs_get_inode_info(&newinode, full_path, NULL,
-                                                 inode->i_sb, xid, NULL);
-                d_instantiate(direntry, newinode);
-                 /* setting nlink not necessary except in cases where we
-                  * failed to get it from the server or was set bogus */
-                if ((direntry->d_inode) && (direntry->d_inode->i_nlink < 2))
-                        set_nlink(direntry->d_inode, 2);
-                mode &= ~current_umask();
-                /* must turn on setgid bit if parent dir has it */
-                if (inode->i_mode & S_ISGID)
-                        mode |= S_ISGID;
-                if (tcon->unix_ext) {
-                        struct cifs_unix_set_info_args args = {
-                                .mode   = mode,
-                                .ctime  = NO_CHANGE_64,
-                                .atime  = NO_CHANGE_64,
-                                .mtime  = NO_CHANGE_64,
-                                .device = 0,
-                        };
-                        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
-                                args.uid = (__u64)current_fsuid();
-                                if (inode->i_mode & S_ISGID)
-                                        args.gid = (__u64)inode->i_gid;
-                                else
-                                        args.gid = (__u64)current_fsgid();
-                        } else {
-                                args.uid = NO_CHANGE_64;
-                                args.gid = NO_CHANGE_64;
-                        }
-                        CIFSSMBUnixSetPathInfo(xid, tcon, full_path, &args,
-                                               cifs_sb->local_nls,
-                                               cifs_sb->mnt_cifs_flags &
-                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
-                } else {
-                        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) &&
-                            (mode & S_IWUGO) == 0) {
-                                FILE_BASIC_INFO pInfo;
-                                struct cifsInodeInfo *cifsInode;
-                                u32 dosattrs;
-                                memset(&pInfo, 0, sizeof(pInfo));
-                                cifsInode = CIFS_I(newinode);
-                                dosattrs = cifsInode->cifsAttrs|ATTR_READONLY;
-                                pInfo.Attributes = cpu_to_le32(dosattrs);
-                                tmprc = CIFSSMBSetPathInfo(xid, tcon,
-                                                full_path, &pInfo,
-                                                cifs_sb->local_nls,
-                                                cifs_sb->mnt_cifs_flags &
-                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
-                                if (tmprc == 0)
-                                        cifsInode->cifsAttrs = dosattrs;
-                        }
-                        if (direntry->d_inode) {
-                                if (cifs_sb->mnt_cifs_flags &
-                                     CIFS_MOUNT_DYNPERM)
-                                        direntry->d_inode->i_mode =
-                                                (mode | S_IFDIR);
-                                if (cifs_sb->mnt_cifs_flags &
-                                     CIFS_MOUNT_SET_UID) {
-                                        direntry->d_inode->i_uid =
-                                                current_fsuid();
-                                        if (inode->i_mode & S_ISGID)
-                                                direntry->d_inode->i_gid =
-                                                        inode->i_gid;
-                                        else
-                                                direntry->d_inode->i_gid =
-                                                        current_fsgid();
-                                }
-                        }
-                }
        }
+        rc = cifs_mkdir_qinfo(inode, direntry, mode, full_path, cifs_sb, tcon,
+                              xid);
 mkdir_out:
        /*
         * Force revalidate to get parent dir info when needed since cached
@@ -1405,7 +1426,8 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
        unsigned int xid;
        struct cifs_sb_info *cifs_sb;
        struct tcon_link *tlink;
-        struct cifs_tcon *pTcon;
+        struct cifs_tcon *tcon;
+        struct TCP_Server_Info *server;
        char *full_path = NULL;
        struct cifsInodeInfo *cifsInode;
@@ -1425,10 +1447,16 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
                rc = PTR_ERR(tlink);
                goto rmdir_exit;
        }
-        pTcon = tlink_tcon(tlink);
+        tcon = tlink_tcon(tlink);
+        server = tcon->ses->server;
+        if (!server->ops->rmdir) {
+                rc = -ENOSYS;
+                cifs_put_tlink(tlink);
+                goto rmdir_exit;
+        }
-        rc = CIFSSMBRmDir(xid, pTcon, full_path, cifs_sb->local_nls,
+        rc = server->ops->rmdir(xid, tcon, full_path, cifs_sb);
-                          cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
        cifs_put_tlink(tlink);
        if (!rc) {
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index c40356d24c5..3129ac74b81 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -586,6 +586,27 @@ cifs_print_stats(struct seq_file *m, struct cifs_tcon *tcon)
 #endif
 }
+static void
+cifs_mkdir_setinfo(struct inode *inode, const char *full_path,
+                   struct cifs_sb_info *cifs_sb, struct cifs_tcon *tcon,
+                   const unsigned int xid)
+{
+        FILE_BASIC_INFO info;
+        struct cifsInodeInfo *cifsInode;
+        u32 dosattrs;
+        int rc;
+        memset(&info, 0, sizeof(info));
+        cifsInode = CIFS_I(inode);
+        dosattrs = cifsInode->cifsAttrs|ATTR_READONLY;
+        info.Attributes = cpu_to_le32(dosattrs);
+        rc = CIFSSMBSetPathInfo(xid, tcon, full_path, &info, cifs_sb->local_nls,
+                                cifs_sb->mnt_cifs_flags &
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
+        if (rc == 0)
+                cifsInode->cifsAttrs = dosattrs;
+}
 struct smb_version_operations smb1_operations = {
        .send_cancel = send_nt_cancel,
        .compare_fids = cifs_compare_fids,
@@ -620,6 +641,9 @@ struct smb_version_operations smb1_operations = {
        .get_srv_inum = cifs_get_srv_inum,
        .build_path_to_root = cifs_build_path_to_root,
        .echo = CIFSSMBEcho,
+        .mkdir = CIFSSMBMkDir,
+        .mkdir_setinfo = cifs_mkdir_setinfo,
+        .rmdir = CIFSSMBRmDir,
 };
 struct smb_version_values smb1_values = {
diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c
index 1ba5c405315..2aa5cb08c52 100644
--- a/fs/cifs/smb2inode.c
+++ b/fs/cifs/smb2inode.c
@@ -122,3 +122,42 @@ out:
        kfree(smb2_data);
        return rc;
 }
+int
+smb2_mkdir(const unsigned int xid, struct cifs_tcon *tcon, const char *name,
+           struct cifs_sb_info *cifs_sb)
+{
+        return smb2_open_op_close(xid, tcon, cifs_sb, name,
+                                  FILE_WRITE_ATTRIBUTES, FILE_CREATE, 0,
+                                  CREATE_NOT_FILE, NULL, SMB2_OP_MKDIR);
+}
+void
+smb2_mkdir_setinfo(struct inode *inode, const char *name,
+                   struct cifs_sb_info *cifs_sb, struct cifs_tcon *tcon,
+                   const unsigned int xid)
+{
+        FILE_BASIC_INFO data;
+        struct cifsInodeInfo *cifs_i;
+        u32 dosattrs;
+        int tmprc;
+        memset(&data, 0, sizeof(data));
+        cifs_i = CIFS_I(inode);
+        dosattrs = cifs_i->cifsAttrs | ATTR_READONLY;
+        data.Attributes = cpu_to_le32(dosattrs);
+        tmprc = smb2_open_op_close(xid, tcon, cifs_sb, name,
+                                   FILE_WRITE_ATTRIBUTES, FILE_CREATE, 0,
+                                   CREATE_NOT_FILE, &data, SMB2_OP_SET_INFO);
+        if (tmprc == 0)
+                cifs_i->cifsAttrs = dosattrs;
+}
+int
+smb2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, const char *name,
+           struct cifs_sb_info *cifs_sb)
+{
+        return smb2_open_op_close(xid, tcon, cifs_sb, name, DELETE, FILE_OPEN,
+                                  0, CREATE_NOT_FILE | CREATE_DELETE_ON_CLOSE,
+                                  NULL, SMB2_OP_DELETE);
+}
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 410cf925ea2..826209bf368 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -318,6 +318,9 @@ struct smb_version_operations smb21_operations = {
        .query_path_info = smb2_query_path_info,
        .get_srv_inum = smb2_get_srv_inum,
        .build_path_to_root = smb2_build_path_to_root,
+        .mkdir = smb2_mkdir,
+        .mkdir_setinfo = smb2_mkdir_setinfo,
+        .rmdir = smb2_rmdir,
 };
 struct smb_version_values smb21_values = {
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 902bbe2b5ad..bfaa7b148af 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -52,6 +52,14 @@ extern int smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
                                struct cifs_sb_info *cifs_sb,
                                const char *full_path, FILE_ALL_INFO *data,
                                bool *adjust_tz);
+extern int smb2_mkdir(const unsigned int xid, struct cifs_tcon *tcon,
+                      const char *name, struct cifs_sb_info *cifs_sb);
+extern void smb2_mkdir_setinfo(struct inode *inode, const char *full_path,
+                               struct cifs_sb_info *cifs_sb,
+                               struct cifs_tcon *tcon, const unsigned int xid);
+extern int smb2_rmdir(const unsigned int xid, struct cifs_tcon *tcon,
+                      const char *name, struct cifs_sb_info *cifs_sb);
 /*
 * SMB2 Worker functions - most of protocol specific implementation details
 * are contained within these calls.
diff --git a/fs/compat.c b/fs/compat.c
index 6161255fac4..1bdb350ea5d 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1155,11 +1155,14 @@ compat_sys_readv(unsigned long fd, const struct compat_iovec __user *vec,
        struct file *file;
        int fput_needed;
        ssize_t ret;
+        loff_t pos;
        file = fget_light(fd, &fput_needed);
        if (!file)
                return -EBADF;
-        ret = compat_readv(file, vec, vlen, &file->f_pos);
+        pos = file->f_pos;
+        ret = compat_readv(file, vec, vlen, &pos);
+        file->f_pos = pos;
        fput_light(file, fput_needed);
        return ret;
 }
@@ -1221,11 +1224,14 @@ compat_sys_writev(unsigned long fd, const struct compat_iovec __user *vec,
        struct file *file;
        int fput_needed;
        ssize_t ret;
+        loff_t pos;
        file = fget_light(fd, &fput_needed);
        if (!file)
                return -EBADF;
-        ret = compat_writev(file, vec, vlen, &file->f_pos);
+        pos = file->f_pos;
+        ret = compat_writev(file, vec, vlen, &pos);
+        file->f_pos = pos;
        fput_light(file, fput_needed);
        return ret;
 }
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 989e034f02b..cfb4b9fed52 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -385,8 +385,6 @@ struct ecryptfs_msg_ctx {
        struct mutex mux;
 };
-struct ecryptfs_daemon;
 struct ecryptfs_daemon {
 #define ECRYPTFS_DAEMON_IN_READ      0x00000001
 #define ECRYPTFS_DAEMON_IN_POLL      0x00000002
@@ -394,10 +392,7 @@ struct ecryptfs_daemon {
 #define ECRYPTFS_DAEMON_MISCDEV_OPEN 0x00000008
        u32 flags;
        u32 num_queued_msg_ctx;
-        struct pid *pid;
+        struct file *file;
-        uid_t euid;
-        struct user_namespace *user_ns;
-        struct task_struct *task;
        struct mutex mux;
        struct list_head msg_ctx_out_queue;
        wait_queue_head_t wait;
@@ -554,6 +549,8 @@ extern struct kmem_cache *ecryptfs_key_tfm_cache;
 struct inode *ecryptfs_get_inode(struct inode *lower_inode,
                                 struct super_block *sb);
 void ecryptfs_i_size_init(const char *page_virt, struct inode *inode);
+int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
+                             struct inode *ecryptfs_inode);
 int ecryptfs_decode_and_decrypt_filename(char **decrypted_name,
                                         size_t *decrypted_name_size,
                                         struct dentry *ecryptfs_dentry,
@@ -607,13 +604,8 @@ int
 ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
                  size_t size, int flags);
 int ecryptfs_read_xattr_region(char *page_virt, struct inode *ecryptfs_inode);
-int ecryptfs_process_helo(uid_t euid, struct user_namespace *user_ns,
+int ecryptfs_process_response(struct ecryptfs_daemon *daemon,
-                          struct pid *pid);
+                              struct ecryptfs_message *msg, u32 seq);
-int ecryptfs_process_quit(uid_t euid, struct user_namespace *user_ns,
-                          struct pid *pid);
-int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
-                              struct user_namespace *user_ns, struct pid *pid,
-                              u32 seq);
 int ecryptfs_send_message(char *data, int data_len,
                          struct ecryptfs_msg_ctx **msg_ctx);
 int ecryptfs_wait_for_response(struct ecryptfs_msg_ctx *msg_ctx,
@@ -658,8 +650,7 @@ int ecryptfs_read_lower_page_segment(struct page *page_for_ecryptfs,
                                     struct inode *ecryptfs_inode);
 struct page *ecryptfs_get_locked_page(struct inode *inode, loff_t index);
 int ecryptfs_exorcise_daemon(struct ecryptfs_daemon *daemon);
-int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon, uid_t euid,
+int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon);
-                                 struct user_namespace *user_ns);
 int ecryptfs_parse_packet_length(unsigned char *data, size_t *size,
                                 size_t *length_size);
 int ecryptfs_write_packet_length(char *dest, size_t size,
@@ -671,8 +662,7 @@ int ecryptfs_send_miscdev(char *data, size_t data_size,
                          u16 msg_flags, struct ecryptfs_daemon *daemon);
 void ecryptfs_msg_ctx_alloc_to_free(struct ecryptfs_msg_ctx *msg_ctx);
 int
-ecryptfs_spawn_daemon(struct ecryptfs_daemon **daemon, uid_t euid,
+ecryptfs_spawn_daemon(struct ecryptfs_daemon **daemon, struct file *file);
-                      struct user_namespace *user_ns, struct pid *pid);
 int ecryptfs_init_kthread(void);
 void ecryptfs_destroy_kthread(void);
 int ecryptfs_privileged_open(struct file **lower_file,
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 2b17f2f9b12..44ce5c6a541 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -138,29 +138,50 @@ out:
        return rc;
 }
-static void ecryptfs_vma_close(struct vm_area_struct *vma)
+struct kmem_cache *ecryptfs_file_info_cache;
-{
-        filemap_write_and_wait(vma->vm_file->f_mapping);
-}
-static const struct vm_operations_struct ecryptfs_file_vm_ops = {
-        .close          = ecryptfs_vma_close,
-        .fault          = filemap_fault,
-};
-static int ecryptfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+static int read_or_initialize_metadata(struct dentry *dentry)
 {
+        struct inode *inode = dentry->d_inode;
+        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
+        struct ecryptfs_crypt_stat *crypt_stat;
        int rc;
-        rc = generic_file_mmap(file, vma);
+        crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
+        mount_crypt_stat = &ecryptfs_superblock_to_private(
+                                                inode->i_sb)->mount_crypt_stat;
+        mutex_lock(&crypt_stat->cs_mutex);
+        if (crypt_stat->flags & ECRYPTFS_POLICY_APPLIED &&
+            crypt_stat->flags & ECRYPTFS_KEY_VALID) {
+                rc = 0;
+                goto out;
+        }
+        rc = ecryptfs_read_metadata(dentry);
        if (!rc)
-                vma->vm_ops = &ecryptfs_file_vm_ops;
+                goto out;
+        if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) {
+                crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
+                                       | ECRYPTFS_ENCRYPTED);
+                rc = 0;
+                goto out;
+        }
+        if (!(mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) &&
+            !i_size_read(ecryptfs_inode_to_lower(inode))) {
+                rc = ecryptfs_initialize_file(dentry, inode);
+                if (!rc)
+                        goto out;
+        }
+        rc = -EIO;
+out:
+        mutex_unlock(&crypt_stat->cs_mutex);
        return rc;
 }
-struct kmem_cache *ecryptfs_file_info_cache;
 /**
 * ecryptfs_open
 * @inode: inode speciying file to open
@@ -236,32 +257,9 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                rc = 0;
                goto out;
        }
-        mutex_lock(&crypt_stat->cs_mutex);
+        rc = read_or_initialize_metadata(ecryptfs_dentry);
-        if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)
+        if (rc)
-            || !(crypt_stat->flags & ECRYPTFS_KEY_VALID)) {
+                goto out_put;
-                rc = ecryptfs_read_metadata(ecryptfs_dentry);
-                if (rc) {
-                        ecryptfs_printk(KERN_DEBUG,
-                                        "Valid headers not found\n");
-                        if (!(mount_crypt_stat->flags
-                              & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
-                                rc = -EIO;
-                                printk(KERN_WARNING "Either the lower file "
-                                       "is not in a valid eCryptfs format, "
-                                       "or the key could not be retrieved. "
-                                       "Plaintext passthrough mode is not "
-                                       "enabled; returning -EIO\n");
-                                mutex_unlock(&crypt_stat->cs_mutex);
-                                goto out_put;
-                        }
-                        rc = 0;
-                        crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
-                                               | ECRYPTFS_ENCRYPTED);
-                        mutex_unlock(&crypt_stat->cs_mutex);
-                        goto out;
-                }
-        }
-        mutex_unlock(&crypt_stat->cs_mutex);
        ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = "
                        "[0x%.16lx] size: [0x%.16llx]\n", inode, inode->i_ino,
                        (unsigned long long)i_size_read(inode));
@@ -292,15 +290,7 @@ static int ecryptfs_release(struct inode *inode, struct file *file)
 static int
 ecryptfs_fsync(struct file *file, loff_t start, loff_t end, int datasync)
 {
-        int rc = 0;
+        return vfs_fsync(ecryptfs_file_to_lower(file), datasync);
-        rc = generic_file_fsync(file, start, end, datasync);
-        if (rc)
-                goto out;
-        rc = vfs_fsync_range(ecryptfs_file_to_lower(file), start, end,
-                             datasync);
-out:
-        return rc;
 }
 static int ecryptfs_fasync(int fd, struct file *file, int flag)
@@ -369,7 +359,7 @@ const struct file_operations ecryptfs_main_fops = {
 #ifdef CONFIG_COMPAT
        .compat_ioctl = ecryptfs_compat_ioctl,
 #endif
-        .mmap = ecryptfs_file_mmap,
+        .mmap = generic_file_mmap,
        .open = ecryptfs_open,
        .flush = ecryptfs_flush,
        .release = ecryptfs_release,
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index c3ca12c33ca..534b129ea67 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -143,6 +143,31 @@ static int ecryptfs_interpose(struct dentry *lower_dentry,
        return 0;
 }
+static int ecryptfs_do_unlink(struct inode *dir, struct dentry *dentry,
+                              struct inode *inode)
+{
+        struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
+        struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
+        struct dentry *lower_dir_dentry;
+        int rc;
+        dget(lower_dentry);
+        lower_dir_dentry = lock_parent(lower_dentry);
+        rc = vfs_unlink(lower_dir_inode, lower_dentry);
+        if (rc) {
+                printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
+                goto out_unlock;
+        }
+        fsstack_copy_attr_times(dir, lower_dir_inode);
+        set_nlink(inode, ecryptfs_inode_to_lower(inode)->i_nlink);
+        inode->i_ctime = dir->i_ctime;
+        d_drop(dentry);
+out_unlock:
+        unlock_dir(lower_dir_dentry);
+        dput(lower_dentry);
+        return rc;
+}
 /**
 * ecryptfs_do_create
 * @directory_inode: inode of the new file's dentry's parent in ecryptfs
@@ -182,8 +207,10 @@ ecryptfs_do_create(struct inode *directory_inode,
        }
        inode = __ecryptfs_get_inode(lower_dentry->d_inode,
                                     directory_inode->i_sb);
-        if (IS_ERR(inode))
+        if (IS_ERR(inode)) {
+                vfs_unlink(lower_dir_dentry->d_inode, lower_dentry);
                goto out_lock;
+        }
        fsstack_copy_attr_times(directory_inode, lower_dir_dentry->d_inode);
        fsstack_copy_inode_size(directory_inode, lower_dir_dentry->d_inode);
 out_lock:
@@ -200,8 +227,8 @@ out:
 *
 * Returns zero on success
 */
-static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
+int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
-                                    struct inode *ecryptfs_inode)
+                             struct inode *ecryptfs_inode)
 {
        struct ecryptfs_crypt_stat *crypt_stat =
                &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
@@ -264,7 +291,9 @@ ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry,
         * that this on disk file is prepared to be an ecryptfs file */
        rc = ecryptfs_initialize_file(ecryptfs_dentry, ecryptfs_inode);
        if (rc) {
-                drop_nlink(ecryptfs_inode);
+                ecryptfs_do_unlink(directory_inode, ecryptfs_dentry,
+                                   ecryptfs_inode);
+                make_bad_inode(ecryptfs_inode);
                unlock_new_inode(ecryptfs_inode);
                iput(ecryptfs_inode);
                goto out;
@@ -466,27 +495,7 @@ out_lock:
 static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
 {
-        int rc = 0;
+        return ecryptfs_do_unlink(dir, dentry, dentry->d_inode);
-        struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
-        struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
-        struct dentry *lower_dir_dentry;
-        dget(lower_dentry);
-        lower_dir_dentry = lock_parent(lower_dentry);
-        rc = vfs_unlink(lower_dir_inode, lower_dentry);
-        if (rc) {
-                printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
-                goto out_unlock;
-        }
-        fsstack_copy_attr_times(dir, lower_dir_inode);
-        set_nlink(dentry->d_inode,
-                  ecryptfs_inode_to_lower(dentry->d_inode)->i_nlink);
-        dentry->d_inode->i_ctime = dir->i_ctime;
-        d_drop(dentry);
-out_unlock:
-        unlock_dir(lower_dir_dentry);
-        dput(lower_dentry);
-        return rc;
 }
 static int ecryptfs_symlink(struct inode *dir, struct dentry *dentry,
@@ -961,12 +970,6 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
                        goto out;
        }
-        if (S_ISREG(inode->i_mode)) {
-                rc = filemap_write_and_wait(inode->i_mapping);
-                if (rc)
-                        goto out;
-                fsstack_copy_attr_all(inode, lower_inode);
-        }
        memcpy(&lower_ia, ia, sizeof(lower_ia));
        if (ia->ia_valid & ATTR_FILE)
                lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file);
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 1c0b3b6b75c..2768138eefe 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -279,6 +279,7 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options,
        char *fnek_src;
        char *cipher_key_bytes_src;
        char *fn_cipher_key_bytes_src;
+        u8 cipher_code;
        *check_ruid = 0;
@@ -420,6 +421,18 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options,
            && !fn_cipher_key_bytes_set)
                mount_crypt_stat->global_default_fn_cipher_key_bytes =
                        mount_crypt_stat->global_default_cipher_key_size;
+        cipher_code = ecryptfs_code_for_cipher_string(
+                mount_crypt_stat->global_default_cipher_name,
+                mount_crypt_stat->global_default_cipher_key_size);
+        if (!cipher_code) {
+                ecryptfs_printk(KERN_ERR,
+                                "eCryptfs doesn't support cipher: %s",
+                                mount_crypt_stat->global_default_cipher_name);
+                rc = -EINVAL;
+                goto out;
+        }
        mutex_lock(&key_tfm_list_mutex);
        if (!ecryptfs_tfm_exists(mount_crypt_stat->global_default_cipher_name,
                                 NULL)) {
@@ -540,6 +553,15 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
        }
        ecryptfs_set_superblock_lower(s, path.dentry->d_sb);
+        /**
+         * Set the POSIX ACL flag based on whether they're enabled in the lower
+         * mount. Force a read-only eCryptfs mount if the lower mount is ro.
+         * Allow a ro eCryptfs mount even when the lower mount is rw.
+         */
+        s->s_flags = flags & ~MS_POSIXACL;
+        s->s_flags |= path.dentry->d_sb->s_flags & (MS_RDONLY | MS_POSIXACL);
        s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
        s->s_blocksize = path.dentry->d_sb->s_blocksize;
        s->s_magic = ECRYPTFS_SUPER_MAGIC;
diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
index a750f957b14..b29bb8bfa8d 100644
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -32,8 +32,8 @@ static struct mutex ecryptfs_msg_ctx_lists_mux;
 static struct hlist_head *ecryptfs_daemon_hash;
 struct mutex ecryptfs_daemon_hash_mux;
 static int ecryptfs_hash_bits;
-#define ecryptfs_uid_hash(uid) \
+#define ecryptfs_current_euid_hash(uid) \
-        hash_long((unsigned long)uid, ecryptfs_hash_bits)
+                hash_long((unsigned long)current_euid(), ecryptfs_hash_bits)
 static u32 ecryptfs_msg_counter;
 static struct ecryptfs_msg_ctx *ecryptfs_msg_ctx_arr;
@@ -105,26 +105,24 @@ void ecryptfs_msg_ctx_alloc_to_free(struct ecryptfs_msg_ctx *msg_ctx)
 /**
 * ecryptfs_find_daemon_by_euid
- * @euid: The effective user id which maps to the desired daemon id
- * @user_ns: The namespace in which @euid applies
 * @daemon: If return value is zero, points to the desired daemon pointer
 *
 * Must be called with ecryptfs_daemon_hash_mux held.
 *
- * Search the hash list for the given user id.
+ * Search the hash list for the current effective user id.
 *
 * Returns zero if the user id exists in the list; non-zero otherwise.
 */
-int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon, uid_t euid,
+int ecryptfs_find_daemon_by_euid(struct ecryptfs_daemon **daemon)
-                                 struct user_namespace *user_ns)
 {
        struct hlist_node *elem;
        int rc;
        hlist_for_each_entry(*daemon, elem,
-                             &ecryptfs_daemon_hash[ecryptfs_uid_hash(euid)],
+                            &ecryptfs_daemon_hash[ecryptfs_current_euid_hash()],
-                             euid_chain) {
+                            euid_chain) {
-                if ((*daemon)->euid == euid && (*daemon)->user_ns == user_ns) {
+                if ((*daemon)->file->f_cred->euid == current_euid() &&
+                    (*daemon)->file->f_cred->user_ns == current_user_ns()) {
                        rc = 0;
                        goto out;
                }
@@ -137,9 +135,7 @@ out:
 /**
 * ecryptfs_spawn_daemon - Create and initialize a new daemon struct
 * @daemon: Pointer to set to newly allocated daemon struct
- * @euid: Effective user id for the daemon
+ * @file: File used when opening /dev/ecryptfs
- * @user_ns: The namespace in which @euid applies
- * @pid: Process id for the daemon
 *
 * Must be called ceremoniously while in possession of
 * ecryptfs_sacred_daemon_hash_mux
@@ -147,8 +143,7 @@ out:
 * Returns zero on success; non-zero otherwise
 */
 int
-ecryptfs_spawn_daemon(struct ecryptfs_daemon **daemon, uid_t euid,
+ecryptfs_spawn_daemon(struct ecryptfs_daemon **daemon, struct file *file)
-                      struct user_namespace *user_ns, struct pid *pid)
 {
        int rc = 0;
@@ -159,16 +154,13 @@ ecryptfs_spawn_daemon(struct ecryptfs_daemon **daemon, uid_t euid,
                       "GFP_KERNEL memory\n", __func__, sizeof(**daemon));
                goto out;
        }
-        (*daemon)->euid = euid;
+        (*daemon)->file = file;
-        (*daemon)->user_ns = get_user_ns(user_ns);
-        (*daemon)->pid = get_pid(pid);
-        (*daemon)->task = current;
        mutex_init(&(*daemon)->mux);
        INIT_LIST_HEAD(&(*daemon)->msg_ctx_out_queue);
        init_waitqueue_head(&(*daemon)->wait);
        (*daemon)->num_queued_msg_ctx = 0;
        hlist_add_head(&(*daemon)->euid_chain,
-                       &ecryptfs_daemon_hash[ecryptfs_uid_hash(euid)]);
+                       &ecryptfs_daemon_hash[ecryptfs_current_euid_hash()]);
 out:
        return rc;
 }
@@ -188,9 +180,6 @@ int ecryptfs_exorcise_daemon(struct ecryptfs_daemon *daemon)
        if ((daemon->flags & ECRYPTFS_DAEMON_IN_READ)
            || (daemon->flags & ECRYPTFS_DAEMON_IN_POLL)) {
                rc = -EBUSY;
-                printk(KERN_WARNING "%s: Attempt to destroy daemon with pid "
-                       "[0x%p], but it is in the midst of a read or a poll\n",
-                       __func__, daemon->pid);
                mutex_unlock(&daemon->mux);
                goto out;
        }
@@ -203,12 +192,6 @@ int ecryptfs_exorcise_daemon(struct ecryptfs_daemon *daemon)
                ecryptfs_msg_ctx_alloc_to_free(msg_ctx);
        }
        hlist_del(&daemon->euid_chain);
-        if (daemon->task)
-                wake_up_process(daemon->task);
-        if (daemon->pid)
-                put_pid(daemon->pid);
-        if (daemon->user_ns)
-                put_user_ns(daemon->user_ns);
        mutex_unlock(&daemon->mux);
        kzfree(daemon);
 out:
@@ -216,42 +199,9 @@ out:
 }
 /**
- * ecryptfs_process_quit
- * @euid: The user ID owner of the message
- * @user_ns: The namespace in which @euid applies
- * @pid: The process ID for the userspace program that sent the
- *       message
- *
- * Deletes the corresponding daemon for the given euid and pid, if
- * it is the registered that is requesting the deletion. Returns zero
- * after deleting the desired daemon; non-zero otherwise.
- */
-int ecryptfs_process_quit(uid_t euid, struct user_namespace *user_ns,
-                          struct pid *pid)
-{
-        struct ecryptfs_daemon *daemon;
-        int rc;
-        mutex_lock(&ecryptfs_daemon_hash_mux);
-        rc = ecryptfs_find_daemon_by_euid(&daemon, euid, user_ns);
-        if (rc || !daemon) {
-                rc = -EINVAL;
-                printk(KERN_ERR "Received request from user [%d] to "
-                       "unregister unrecognized daemon [0x%p]\n", euid, pid);
-                goto out_unlock;
-        }
-        rc = ecryptfs_exorcise_daemon(daemon);
-out_unlock:
-        mutex_unlock(&ecryptfs_daemon_hash_mux);
-        return rc;
-}
-/**
 * ecryptfs_process_reponse
 * @msg: The ecryptfs message received; the caller should sanity check
 *       msg->data_len and free the memory
- * @pid: The process ID of the userspace application that sent the
- *       message
 * @seq: The sequence number of the message; must match the sequence
 *       number for the existing message context waiting for this
 *       response
@@ -270,16 +220,11 @@ out_unlock:
 *
 * Returns zero on success; non-zero otherwise
 */
-int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
+int ecryptfs_process_response(struct ecryptfs_daemon *daemon,
-                              struct user_namespace *user_ns, struct pid *pid,
+                              struct ecryptfs_message *msg, u32 seq)
-                              u32 seq)
 {
-        struct ecryptfs_daemon *uninitialized_var(daemon);
        struct ecryptfs_msg_ctx *msg_ctx;
        size_t msg_size;
-        struct nsproxy *nsproxy;
-        struct user_namespace *tsk_user_ns;
-        uid_t ctx_euid;
        int rc;
        if (msg->index >= ecryptfs_message_buf_len) {
@@ -292,51 +237,6 @@ int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
        }
        msg_ctx = &ecryptfs_msg_ctx_arr[msg->index];
        mutex_lock(&msg_ctx->mux);
-        mutex_lock(&ecryptfs_daemon_hash_mux);
-        rcu_read_lock();
-        nsproxy = task_nsproxy(msg_ctx->task);
-        if (nsproxy == NULL) {
-                rc = -EBADMSG;
-                printk(KERN_ERR "%s: Receiving process is a zombie. Dropping "
-                       "message.\n", __func__);
-                rcu_read_unlock();
-                mutex_unlock(&ecryptfs_daemon_hash_mux);
-                goto wake_up;
-        }
-        tsk_user_ns = __task_cred(msg_ctx->task)->user_ns;
-        ctx_euid = task_euid(msg_ctx->task);
-        rc = ecryptfs_find_daemon_by_euid(&daemon, ctx_euid, tsk_user_ns);
-        rcu_read_unlock();
-        mutex_unlock(&ecryptfs_daemon_hash_mux);
-        if (rc) {
-                rc = -EBADMSG;
-                printk(KERN_WARNING "%s: User [%d] received a "
-                       "message response from process [0x%p] but does "
-                       "not have a registered daemon\n", __func__,
-                       ctx_euid, pid);
-                goto wake_up;
-        }
-        if (ctx_euid != euid) {
-                rc = -EBADMSG;
-                printk(KERN_WARNING "%s: Received message from user "
-                       "[%d]; expected message from user [%d]\n", __func__,
-                       euid, ctx_euid);
-                goto unlock;
-        }
-        if (tsk_user_ns != user_ns) {
-                rc = -EBADMSG;
-                printk(KERN_WARNING "%s: Received message from user_ns "
-                       "[0x%p]; expected message from user_ns [0x%p]\n",
-                       __func__, user_ns, tsk_user_ns);
-                goto unlock;
-        }
-        if (daemon->pid != pid) {
-                rc = -EBADMSG;
-                printk(KERN_ERR "%s: User [%d] sent a message response "
-                       "from an unrecognized process [0x%p]\n",
-                       __func__, ctx_euid, pid);
-                goto unlock;
-        }
        if (msg_ctx->state != ECRYPTFS_MSG_CTX_STATE_PENDING) {
                rc = -EINVAL;
                printk(KERN_WARNING "%s: Desired context element is not "
@@ -359,9 +259,8 @@ int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
        }
        memcpy(msg_ctx->msg, msg, msg_size);
        msg_ctx->state = ECRYPTFS_MSG_CTX_STATE_DONE;
-        rc = 0;
-wake_up:
        wake_up_process(msg_ctx->task);
+        rc = 0;
 unlock:
        mutex_unlock(&msg_ctx->mux);
 out:
@@ -383,14 +282,11 @@ ecryptfs_send_message_locked(char *data, int data_len, u8 msg_type,
                             struct ecryptfs_msg_ctx **msg_ctx)
 {
        struct ecryptfs_daemon *daemon;
-        uid_t euid = current_euid();
        int rc;
-        rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
+        rc = ecryptfs_find_daemon_by_euid(&daemon);
        if (rc || !daemon) {
                rc = -ENOTCONN;
-                printk(KERN_ERR "%s: User [%d] does not have a daemon "
-                       "registered\n", __func__, euid);
                goto out;
        }
        mutex_lock(&ecryptfs_msg_ctx_lists_mux);
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index c0038f6566d..412e6eda25f 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -33,7 +33,7 @@ static atomic_t ecryptfs_num_miscdev_opens;
 /**
 * ecryptfs_miscdev_poll
- * @file: dev file (ignored)
+ * @file: dev file
 * @pt: dev poll table (ignored)
 *
 * Returns the poll mask
@@ -41,20 +41,10 @@ static atomic_t ecryptfs_num_miscdev_opens;
 static unsigned int
 ecryptfs_miscdev_poll(struct file *file, poll_table *pt)
 {
-        struct ecryptfs_daemon *daemon;
+        struct ecryptfs_daemon *daemon = file->private_data;
        unsigned int mask = 0;
-        uid_t euid = current_euid();
-        int rc;
-        mutex_lock(&ecryptfs_daemon_hash_mux);
-        /* TODO: Just use file->private_data? */
-        rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
-        if (rc || !daemon) {
-                mutex_unlock(&ecryptfs_daemon_hash_mux);
-                return -EINVAL;
-        }
        mutex_lock(&daemon->mux);
-        mutex_unlock(&ecryptfs_daemon_hash_mux);
        if (daemon->flags & ECRYPTFS_DAEMON_ZOMBIE) {
                printk(KERN_WARNING "%s: Attempt to poll on zombified "
                       "daemon\n", __func__);
@@ -79,7 +69,7 @@ out_unlock_daemon:
 /**
 * ecryptfs_miscdev_open
 * @inode: inode of miscdev handle (ignored)
- * @file: file for miscdev handle (ignored)
+ * @file: file for miscdev handle
 *
 * Returns zero on success; non-zero otherwise
 */
@@ -87,7 +77,6 @@ static int
 ecryptfs_miscdev_open(struct inode *inode, struct file *file)
 {
        struct ecryptfs_daemon *daemon = NULL;
-        uid_t euid = current_euid();
        int rc;
        mutex_lock(&ecryptfs_daemon_hash_mux);
@@ -98,30 +87,20 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
                       "count; rc = [%d]\n", __func__, rc);
                goto out_unlock_daemon_list;
        }
-        rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
+        rc = ecryptfs_find_daemon_by_euid(&daemon);
-        if (rc || !daemon) {
+        if (!rc) {
-                rc = ecryptfs_spawn_daemon(&daemon, euid, current_user_ns(),
-                                           task_pid(current));
-                if (rc) {
-                        printk(KERN_ERR "%s: Error attempting to spawn daemon; "
-                               "rc = [%d]\n", __func__, rc);
-                        goto out_module_put_unlock_daemon_list;
-                }
-        }
-        mutex_lock(&daemon->mux);
-        if (daemon->pid != task_pid(current)) {
                rc = -EINVAL;
-                printk(KERN_ERR "%s: pid [0x%p] has registered with euid [%d], "
+                goto out_unlock_daemon_list;
-                       "but pid [0x%p] has attempted to open the handle "
+        }
-                       "instead\n", __func__, daemon->pid, daemon->euid,
+        rc = ecryptfs_spawn_daemon(&daemon, file);
-                       task_pid(current));
+        if (rc) {
-                goto out_unlock_daemon;
+                printk(KERN_ERR "%s: Error attempting to spawn daemon; "
+                       "rc = [%d]\n", __func__, rc);
+                goto out_module_put_unlock_daemon_list;
        }
+        mutex_lock(&daemon->mux);
        if (daemon->flags & ECRYPTFS_DAEMON_MISCDEV_OPEN) {
                rc = -EBUSY;
-                printk(KERN_ERR "%s: Miscellaneous device handle may only be "
-                       "opened once per daemon; pid [0x%p] already has this "
-                       "handle open\n", __func__, daemon->pid);
                goto out_unlock_daemon;
        }
        daemon->flags |= ECRYPTFS_DAEMON_MISCDEV_OPEN;
@@ -140,7 +119,7 @@ out_unlock_daemon_list:
 /**
 * ecryptfs_miscdev_release
 * @inode: inode of fs/ecryptfs/euid handle (ignored)
- * @file: file for fs/ecryptfs/euid handle (ignored)
+ * @file: file for fs/ecryptfs/euid handle
 *
 * This keeps the daemon registered until the daemon sends another
 * ioctl to fs/ecryptfs/ctl or until the kernel module unregisters.
@@ -150,20 +129,18 @@ out_unlock_daemon_list:
 static int
 ecryptfs_miscdev_release(struct inode *inode, struct file *file)
 {
-        struct ecryptfs_daemon *daemon = NULL;
+        struct ecryptfs_daemon *daemon = file->private_data;
-        uid_t euid = current_euid();
        int rc;
-        mutex_lock(&ecryptfs_daemon_hash_mux);
-        rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
-        if (rc || !daemon)
-                daemon = file->private_data;
        mutex_lock(&daemon->mux);
        BUG_ON(!(daemon->flags & ECRYPTFS_DAEMON_MISCDEV_OPEN));
        daemon->flags &= ~ECRYPTFS_DAEMON_MISCDEV_OPEN;
        atomic_dec(&ecryptfs_num_miscdev_opens);
        mutex_unlock(&daemon->mux);
+        mutex_lock(&ecryptfs_daemon_hash_mux);
        rc = ecryptfs_exorcise_daemon(daemon);
+        mutex_unlock(&ecryptfs_daemon_hash_mux);
        if (rc) {
                printk(KERN_CRIT "%s: Fatal error whilst attempting to "
                       "shut down daemon; rc = [%d]. Please report this "
@@ -171,7 +148,6 @@ ecryptfs_miscdev_release(struct inode *inode, struct file *file)
                BUG();
        }
        module_put(THIS_MODULE);
-        mutex_unlock(&ecryptfs_daemon_hash_mux);
        return rc;
 }
@@ -248,7 +224,7 @@ int ecryptfs_send_miscdev(char *data, size_t data_size,
 /**
 * ecryptfs_miscdev_read - format and send message from queue
- * @file: fs/ecryptfs/euid miscdevfs handle (ignored)
+ * @file: miscdevfs handle
 * @buf: User buffer into which to copy the next message on the daemon queue
 * @count: Amount of space available in @buf
 * @ppos: Offset in file (ignored)
@@ -262,43 +238,27 @@ static ssize_t
 ecryptfs_miscdev_read(struct file *file, char __user *buf, size_t count,
                      loff_t *ppos)
 {
-        struct ecryptfs_daemon *daemon;
+        struct ecryptfs_daemon *daemon = file->private_data;
        struct ecryptfs_msg_ctx *msg_ctx;
        size_t packet_length_size;
        char packet_length[ECRYPTFS_MAX_PKT_LEN_SIZE];
        size_t i;
        size_t total_length;
-        uid_t euid = current_euid();
        int rc;
-        mutex_lock(&ecryptfs_daemon_hash_mux);
-        /* TODO: Just use file->private_data? */
-        rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
-        if (rc || !daemon) {
-                mutex_unlock(&ecryptfs_daemon_hash_mux);
-                return -EINVAL;
-        }
        mutex_lock(&daemon->mux);
-        if (task_pid(current) != daemon->pid) {
-                mutex_unlock(&daemon->mux);
-                mutex_unlock(&ecryptfs_daemon_hash_mux);
-                return -EPERM;
-        }
        if (daemon->flags & ECRYPTFS_DAEMON_ZOMBIE) {
                rc = 0;
-                mutex_unlock(&ecryptfs_daemon_hash_mux);
                printk(KERN_WARNING "%s: Attempt to read from zombified "
                       "daemon\n", __func__);
                goto out_unlock_daemon;
        }
        if (daemon->flags & ECRYPTFS_DAEMON_IN_READ) {
                rc = 0;
-                mutex_unlock(&ecryptfs_daemon_hash_mux);
                goto out_unlock_daemon;
        }
        /* This daemon will not go away so long as this flag is set */
        daemon->flags |= ECRYPTFS_DAEMON_IN_READ;
-        mutex_unlock(&ecryptfs_daemon_hash_mux);
 check_list:
        if (list_empty(&daemon->msg_ctx_out_queue)) {
                mutex_unlock(&daemon->mux);
@@ -382,16 +342,12 @@ out_unlock_daemon:
 * ecryptfs_miscdev_response - miscdevess response to message previously sent to daemon
 * @data: Bytes comprising struct ecryptfs_message
 * @data_size: sizeof(struct ecryptfs_message) + data len
- * @euid: Effective user id of miscdevess sending the miscdev response
- * @user_ns: The namespace in which @euid applies
- * @pid: Miscdevess id of miscdevess sending the miscdev response
 * @seq: Sequence number for miscdev response packet
 *
 * Returns zero on success; non-zero otherwise
 */
-static int ecryptfs_miscdev_response(char *data, size_t data_size,
+static int ecryptfs_miscdev_response(struct ecryptfs_daemon *daemon, char *data,
-                                     uid_t euid, struct user_namespace *user_ns,
+                                     size_t data_size, u32 seq)
-                                     struct pid *pid, u32 seq)
 {
        struct ecryptfs_message *msg = (struct ecryptfs_message *)data;
        int rc;
@@ -403,7 +359,7 @@ static int ecryptfs_miscdev_response(char *data, size_t data_size,
                rc = -EINVAL;
                goto out;
        }
-        rc = ecryptfs_process_response(msg, euid, user_ns, pid, seq);
+        rc = ecryptfs_process_response(daemon, msg, seq);
        if (rc)
                printk(KERN_ERR
                       "Error processing response message; rc = [%d]\n", rc);
@@ -413,7 +369,7 @@ out:
 /**
 * ecryptfs_miscdev_write - handle write to daemon miscdev handle
- * @file: File for misc dev handle (ignored)
+ * @file: File for misc dev handle
 * @buf: Buffer containing user data
 * @count: Amount of data in @buf
 * @ppos: Pointer to offset in file (ignored)
@@ -428,7 +384,6 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
        u32 seq;
        size_t packet_size, packet_size_length;
        char *data;
-        uid_t euid = current_euid();
        unsigned char packet_size_peek[ECRYPTFS_MAX_PKT_LEN_SIZE];
        ssize_t rc;
@@ -488,10 +443,9 @@ memdup:
                }
                memcpy(&counter_nbo, &data[PKT_CTR_OFFSET], PKT_CTR_SIZE);
                seq = be32_to_cpu(counter_nbo);
-                rc = ecryptfs_miscdev_response(
+                rc = ecryptfs_miscdev_response(file->private_data,
                                &data[PKT_LEN_OFFSET + packet_size_length],
-                                packet_size, euid, current_user_ns(),
+                                packet_size, seq);
-                                task_pid(current), seq);
                if (rc) {
                        printk(KERN_WARNING "%s: Failed to deliver miscdev "
                               "response to requesting operation; rc = [%zd]\n",
diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c
index a46b3a8fee1..bd1d57f98f7 100644
--- a/fs/ecryptfs/mmap.c
+++ b/fs/ecryptfs/mmap.c
@@ -66,18 +66,6 @@ static int ecryptfs_writepage(struct page *page, struct writeback_control *wbc)
 {
        int rc;
-        /*
-         * Refuse to write the page out if we are called from reclaim context
-         * since our writepage() path may potentially allocate memory when
-         * calling into the lower fs vfs_write() which may in turn invoke
-         * us again.
-         */
-        if (current->flags & PF_MEMALLOC) {
-                redirty_page_for_writepage(wbc, page);
-                rc = 0;
-                goto out;
-        }
        rc = ecryptfs_encrypt_page(page);
        if (rc) {
                ecryptfs_printk(KERN_WARNING, "Error encrypting "
@@ -498,7 +486,6 @@ static int ecryptfs_write_end(struct file *file,
        struct ecryptfs_crypt_stat *crypt_stat =
                &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
        int rc;
-        int need_unlock_page = 1;
        ecryptfs_printk(KERN_DEBUG, "Calling fill_zeros_to_end_of_page"
                        "(page w/ index = [0x%.16lx], to = [%d])\n", index, to);
@@ -519,26 +506,26 @@ static int ecryptfs_write_end(struct file *file,
                        "zeros in page with index = [0x%.16lx]\n", index);
                goto out;
        }
-        set_page_dirty(page);
+        rc = ecryptfs_encrypt_page(page);
-        unlock_page(page);
+        if (rc) {
-        need_unlock_page = 0;
+                ecryptfs_printk(KERN_WARNING, "Error encrypting page (upper "
+                                "index [0x%.16lx])\n", index);
+                goto out;
+        }
        if (pos + copied > i_size_read(ecryptfs_inode)) {
                i_size_write(ecryptfs_inode, pos + copied);
                ecryptfs_printk(KERN_DEBUG, "Expanded file size to "
                        "[0x%.16llx]\n",
                        (unsigned long long)i_size_read(ecryptfs_inode));
-                balance_dirty_pages_ratelimited(mapping);
-                rc = ecryptfs_write_inode_size_to_metadata(ecryptfs_inode);
-                if (rc) {
-                        printk(KERN_ERR "Error writing inode size to metadata; "
-                               "rc = [%d]\n", rc);
-                        goto out;
-                }
        }
-        rc = copied;
+        rc = ecryptfs_write_inode_size_to_metadata(ecryptfs_inode);
+        if (rc)
+                printk(KERN_ERR "Error writing inode size to metadata; "
+                       "rc = [%d]\n", rc);
+        else
+                rc = copied;
 out:
-        if (need_unlock_page)
+        unlock_page(page);
-                unlock_page(page);
        page_cache_release(page);
        return rc;
 }
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 1c8b5567080..eedec84c180 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1654,8 +1654,8 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
                error = PTR_ERR(file);
                goto out_free_fd;
        }
-        fd_install(fd, file);
        ep->file = file;
+        fd_install(fd, file);
        return fd;
 out_free_fd:
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 5badb0c039d..1562c27a2fa 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -37,15 +37,12 @@
 #define EXOFS_DBGMSG2(M...) do {} while (0)
-enum {MAX_PAGES_KMALLOC = PAGE_SIZE / sizeof(struct page *), };
 unsigned exofs_max_io_pages(struct ore_layout *layout,
                            unsigned expected_pages)
 {
-        unsigned pages = min_t(unsigned, expected_pages, MAX_PAGES_KMALLOC);
+        unsigned pages = min_t(unsigned, expected_pages,
+                               layout->max_io_length / PAGE_SIZE);
-        /* TODO: easily support bio chaining */
-        pages =  min_t(unsigned, pages, layout->max_io_length / PAGE_SIZE);
        return pages;
 }
@@ -101,7 +98,8 @@ static void _pcol_reset(struct page_collect *pcol)
         * it might not end here. don't be left with nothing
         */
        if (!pcol->expected_pages)
-                pcol->expected_pages = MAX_PAGES_KMALLOC;
+                pcol->expected_pages =
+                                exofs_max_io_pages(&pcol->sbi->layout, ~0);
 }
 static int pcol_try_alloc(struct page_collect *pcol)
@@ -389,6 +387,8 @@ static int readpage_strip(void *data, struct page *page)
        size_t len;
        int ret;
+        BUG_ON(!PageLocked(page));
        /* FIXME: Just for debugging, will be removed */
        if (PageUptodate(page))
                EXOFS_ERR("PageUptodate(0x%lx, 0x%lx)\n", pcol->inode->i_ino,
@@ -572,8 +572,16 @@ static struct page *__r4w_get_page(void *priv, u64 offset, bool *uptodate)
        if (!pcol->that_locked_page ||
            (pcol->that_locked_page->index != index)) {
-                struct page *page = find_get_page(pcol->inode->i_mapping, index);
+                struct page *page;
+                loff_t i_size = i_size_read(pcol->inode);
+                if (offset >= i_size) {
+                        *uptodate = true;
+                        EXOFS_DBGMSG("offset >= i_size index=0x%lx\n", index);
+                        return ZERO_PAGE(0);
+                }
+                page =  find_get_page(pcol->inode->i_mapping, index);
                if (!page) {
                        page = find_or_create_page(pcol->inode->i_mapping,
                                                   index, GFP_NOFS);
@@ -602,12 +610,13 @@ static void __r4w_put_page(void *priv, struct page *page)
 {
        struct page_collect *pcol = priv;
-        if (pcol->that_locked_page != page) {
+        if ((pcol->that_locked_page != page) && (ZERO_PAGE(0) != page)) {
                EXOFS_DBGMSG("index=0x%lx\n", page->index);
                page_cache_release(page);
                return;
        }
-        EXOFS_DBGMSG("that_locked_page index=0x%lx\n", page->index);
+        EXOFS_DBGMSG("that_locked_page index=0x%lx\n",
+                     ZERO_PAGE(0) == page ? -1 : page->index);
 }
 static const struct _ore_r4w_op _r4w_op = {
diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c
index 24a49d47e93..1585db1aa36 100644
--- a/fs/exofs/ore.c
+++ b/fs/exofs/ore.c
@@ -837,11 +837,11 @@ static int _write_mirror(struct ore_io_state *ios, int cur_comp)
                                bio->bi_rw |= REQ_WRITE;
                        }
-                        osd_req_write(or, _ios_obj(ios, dev), per_dev->offset,
+                        osd_req_write(or, _ios_obj(ios, cur_comp),
-                                      bio, per_dev->length);
+                                      per_dev->offset, bio, per_dev->length);
                        ORE_DBGMSG("write(0x%llx) offset=0x%llx "
                                      "length=0x%llx dev=%d\n",
-                                     _LLU(_ios_obj(ios, dev)->id),
+                                     _LLU(_ios_obj(ios, cur_comp)->id),
                                     _LLU(per_dev->offset),
                                     _LLU(per_dev->length), dev);
                } else if (ios->kern_buff) {
@@ -853,20 +853,20 @@ static int _write_mirror(struct ore_io_state *ios, int cur_comp)
                               (ios->si.unit_off + ios->length >
                                ios->layout->stripe_unit));
-                        ret = osd_req_write_kern(or, _ios_obj(ios, per_dev->dev),
+                        ret = osd_req_write_kern(or, _ios_obj(ios, cur_comp),
                                                 per_dev->offset,
                                                 ios->kern_buff, ios->length);
                        if (unlikely(ret))
                                goto out;
                        ORE_DBGMSG2("write_kern(0x%llx) offset=0x%llx "
                                      "length=0x%llx dev=%d\n",
-                                     _LLU(_ios_obj(ios, dev)->id),
+                                     _LLU(_ios_obj(ios, cur_comp)->id),
                                     _LLU(per_dev->offset),
                                     _LLU(ios->length), per_dev->dev);
                } else {
-                        osd_req_set_attributes(or, _ios_obj(ios, dev));
+                        osd_req_set_attributes(or, _ios_obj(ios, cur_comp));
                        ORE_DBGMSG2("obj(0x%llx) set_attributes=%d dev=%d\n",
-                                     _LLU(_ios_obj(ios, dev)->id),
+                                     _LLU(_ios_obj(ios, cur_comp)->id),
                                     ios->out_attr_len, dev);
                }
diff --git a/fs/exofs/super.c b/fs/exofs/super.c
index 433783624d1..dde41a75c7c 100644
--- a/fs/exofs/super.c
+++ b/fs/exofs/super.c
@@ -400,8 +400,6 @@ static int exofs_sync_fs(struct super_block *sb, int wait)
        ret = ore_write(ios);
        if (unlikely(ret))
                EXOFS_ERR("%s: ore_write failed.\n", __func__);
-        else
-                sb->s_dirt = 0;
        unlock_super(sb);
@@ -412,14 +410,6 @@ out:
        return ret;
 }
-static void exofs_write_super(struct super_block *sb)
-{
-        if (!(sb->s_flags & MS_RDONLY))
-                exofs_sync_fs(sb, 1);
-        else
-                sb->s_dirt = 0;
-}
 static void _exofs_print_device(const char *msg, const char *dev_path,
                                struct osd_dev *od, u64 pid)
 {
@@ -952,7 +942,6 @@ static const struct super_operations exofs_sops = {
        .write_inode    = exofs_write_inode,
        .evict_inode    = exofs_evict_inode,
        .put_super      = exofs_put_super,
-        .write_super    = exofs_write_super,
        .sync_fs        = exofs_sync_fs,
        .statfs         = exofs_statfs,
 };
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 9a4a5c48b1c..a07597307fd 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -3459,14 +3459,6 @@ ext3_reserve_inode_write(handle_t *handle, struct inode *inode,
 * inode out, but prune_icache isn't a user-visible syncing function.
 * Whenever the user wants stuff synced (sys_sync, sys_msync, sys_fsync)
 * we start and wait on commits.
- *
- * Is this efficient/effective?  Well, we're being nice to the system
- * by cleaning up our inodes proactively so they can be reaped
- * without I/O.  But we are potentially leaving up to five seconds'
- * worth of inodes floating about which prune_icache wants us to
- * write out.  One way to fix that would be to get prune_icache()
- * to do a write_super() to free up some memory.  It has the desired
- * effect.
 */
 int ext3_mark_inode_dirty(handle_t *handle, struct inode *inode)
 {
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index ff9bcdc5b0d..8c892e93d8e 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -64,11 +64,6 @@ static int ext3_freeze(struct super_block *sb);
 /*
 * Wrappers for journal_start/end.
- *
- * The only special thing we need to do here is to make sure that all
- * journal_end calls result in the superblock being marked dirty, so
- * that sync() will call the filesystem's write_super callback if
- * appropriate.
 */
 handle_t *ext3_journal_start_sb(struct super_block *sb, int nblocks)
 {
@@ -90,12 +85,6 @@ handle_t *ext3_journal_start_sb(struct super_block *sb, int nblocks)
        return journal_start(journal, nblocks);
 }
-/*
- * The only special thing we need to do here is to make sure that all
- * journal_stop calls result in the superblock being marked dirty, so
- * that sync() will call the filesystem's write_super callback if
- * appropriate.
- */
 int __ext3_journal_stop(const char *where, handle_t *handle)
 {
        struct super_block *sb;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index d23b31ca9d7..1b5089067d0 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -280,14 +280,18 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
        return desc;
 }
-static int ext4_valid_block_bitmap(struct super_block *sb,
+/*
-                                   struct ext4_group_desc *desc,
+ * Return the block number which was discovered to be invalid, or 0 if
-                                   unsigned int block_group,
+ * the block bitmap is valid.
-                                   struct buffer_head *bh)
+ */
+static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
+                                            struct ext4_group_desc *desc,
+                                            unsigned int block_group,
+                                            struct buffer_head *bh)
 {
        ext4_grpblk_t offset;
        ext4_grpblk_t next_zero_bit;
-        ext4_fsblk_t bitmap_blk;
+        ext4_fsblk_t blk;
        ext4_fsblk_t group_first_block;
        if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) {
@@ -297,37 +301,33 @@ static int ext4_valid_block_bitmap(struct super_block *sb,
                 * or it has to also read the block group where the bitmaps
                 * are located to verify they are set.
                 */
-                return 1;
+                return 0;
        }
        group_first_block = ext4_group_first_block_no(sb, block_group);
        /* check whether block bitmap block number is set */
-        bitmap_blk = ext4_block_bitmap(sb, desc);
+        blk = ext4_block_bitmap(sb, desc);
-        offset = bitmap_blk - group_first_block;
+        offset = blk - group_first_block;
        if (!ext4_test_bit(offset, bh->b_data))
                /* bad block bitmap */
-                goto err_out;
+                return blk;
        /* check whether the inode bitmap block number is set */
-        bitmap_blk = ext4_inode_bitmap(sb, desc);
+        blk = ext4_inode_bitmap(sb, desc);
-        offset = bitmap_blk - group_first_block;
+        offset = blk - group_first_block;
        if (!ext4_test_bit(offset, bh->b_data))
                /* bad block bitmap */
-                goto err_out;
+                return blk;
        /* check whether the inode table block number is set */
-        bitmap_blk = ext4_inode_table(sb, desc);
+        blk = ext4_inode_table(sb, desc);
-        offset = bitmap_blk - group_first_block;
+        offset = blk - group_first_block;
        next_zero_bit = ext4_find_next_zero_bit(bh->b_data,
                                offset + EXT4_SB(sb)->s_itb_per_group,
                                offset);
-        if (next_zero_bit >= offset + EXT4_SB(sb)->s_itb_per_group)
+        if (next_zero_bit < offset + EXT4_SB(sb)->s_itb_per_group)
-                /* good bitmap for inode tables */
+                /* bad bitmap for inode tables */
-                return 1;
+                return blk;
-err_out:
-        ext4_error(sb, "Invalid block bitmap - block_group = %d, block = %llu",
-                        block_group, bitmap_blk);
        return 0;
 }
@@ -336,14 +336,26 @@ void ext4_validate_block_bitmap(struct super_block *sb,
                               unsigned int block_group,
                               struct buffer_head *bh)
 {
+        ext4_fsblk_t    blk;
        if (buffer_verified(bh))
                return;
        ext4_lock_group(sb, block_group);
-        if (ext4_valid_block_bitmap(sb, desc, block_group, bh) &&
+        blk = ext4_valid_block_bitmap(sb, desc, block_group, bh);
-            ext4_block_bitmap_csum_verify(sb, block_group, desc, bh,
+        if (unlikely(blk != 0)) {
-                                          EXT4_BLOCKS_PER_GROUP(sb) / 8))
+                ext4_unlock_group(sb, block_group);
-                set_buffer_verified(bh);
+                ext4_error(sb, "bg %u: block %llu: invalid block bitmap",
+                           block_group, blk);
+                return;
+        }
+        if (unlikely(!ext4_block_bitmap_csum_verify(sb, block_group,
+                        desc, bh, EXT4_BLOCKS_PER_GROUP(sb) / 8))) {
+                ext4_unlock_group(sb, block_group);
+                ext4_error(sb, "bg %u: bad block bitmap checksum", block_group);
+                return;
+        }
+        set_buffer_verified(bh);
        ext4_unlock_group(sb, block_group);
 }
diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c
index f8716eab999..5c2d1813ebe 100644
--- a/fs/ext4/bitmap.c
+++ b/fs/ext4/bitmap.c
@@ -79,7 +79,6 @@ int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
        if (provided == calculated)
                return 1;
-        ext4_error(sb, "Bad block bitmap checksum: block_group = %u", group);
        return 0;
 }
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index cd0c7ed0677..aabbb3f5368 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2662,6 +2662,7 @@ cont:
                }
                path[0].p_depth = depth;
                path[0].p_hdr = ext_inode_hdr(inode);
+                i = 0;
                if (ext4_ext_check(inode, path[0].p_hdr, depth)) {
                        err = -EIO;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 6324f74e034..dff171c3a12 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1970,7 +1970,7 @@ static void ext4_end_io_buffer_write(struct buffer_head *bh, int uptodate);
 * This function can get called via...
 *   - ext4_da_writepages after taking page lock (have journal handle)
 *   - journal_submit_inode_data_buffers (no journal handle)
- *   - shrink_page_list via pdflush (no journal handle)
+ *   - shrink_page_list via the kswapd/direct reclaim (no journal handle)
 *   - grab_page_cache when doing write_begin (have journal handle)
 *
 * We don't do any block allocation in this function. If we have page with
@@ -4589,14 +4589,6 @@ static int ext4_expand_extra_isize(struct inode *inode,
 * inode out, but prune_icache isn't a user-visible syncing function.
 * Whenever the user wants stuff synced (sys_sync, sys_msync, sys_fsync)
 * we start and wait on commits.
- *
- * Is this efficient/effective?  Well, we're being nice to the system
- * by cleaning up our inodes proactively so they can be reaped
- * without I/O.  But we are potentially leaving up to five seconds'
- * worth of inodes floating about which prune_icache wants us to
- * write out.  One way to fix that would be to get prune_icache()
- * to do a write_super() to free up some memory.  It has the desired
- * effect.
 */
 int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
 {
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index d76ec8277d3..c6e0cb3d1f4 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -326,11 +326,6 @@ static void ext4_put_nojournal(handle_t *handle)
 /*
 * Wrappers for jbd2_journal_start/end.
- *
- * The only special thing we need to do here is to make sure that all
- * journal_end calls result in the superblock being marked dirty, so
- * that sync() will call the filesystem's write_super callback if
- * appropriate.
 */
 handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks)
 {
@@ -356,12 +351,6 @@ handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks)
        return jbd2_journal_start(journal, nblocks);
 }
-/*
- * The only special thing we need to do here is to make sure that all
- * jbd2_journal_stop calls result in the superblock being marked dirty, so
- * that sync() will call the filesystem's write_super callback if
- * appropriate.
- */
 int __ext4_journal_stop(const char *where, unsigned int line, handle_t *handle)
 {
        struct super_block *sb;
@@ -959,6 +948,7 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
        ei->i_reserved_meta_blocks = 0;
        ei->i_allocated_meta_blocks = 0;
        ei->i_da_metadata_calc_len = 0;
+        ei->i_da_metadata_calc_last_lblock = 0;
        spin_lock_init(&(ei->i_block_reservation_lock));
 #ifdef CONFIG_QUOTA
        ei->i_reserved_quota = 0;
@@ -3119,6 +3109,10 @@ static int count_overhead(struct super_block *sb, ext4_group_t grp,
        ext4_group_t            i, ngroups = ext4_get_groups_count(sb);
        int                     s, j, count = 0;
+        if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_BIGALLOC))
+                return (ext4_bg_has_super(sb, grp) + ext4_bg_num_gdb(sb, grp) +
+                        sbi->s_itb_per_group + 2);
        first_block = le32_to_cpu(sbi->s_es->s_first_data_block) +
                (grp * EXT4_BLOCKS_PER_GROUP(sb));
        last_block = first_block + EXT4_BLOCKS_PER_GROUP(sb) - 1;
@@ -4430,6 +4424,7 @@ static void ext4_clear_journal_err(struct super_block *sb,
                ext4_commit_super(sb, 1);
                jbd2_journal_clear_err(journal);
+                jbd2_journal_update_sb_errno(journal);
        }
 }
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 8964cf3999b..324bc085053 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -383,6 +383,9 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry,
        struct fuse_entry_out outentry;
        struct fuse_file *ff;
+        /* Userspace expects S_IFREG in create mode */
+        BUG_ON((mode & S_IFMT) != S_IFREG);
        forget = fuse_alloc_forget();
        err = -ENOMEM;
        if (!forget)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 93d8d6c9494..aba15f1b7ad 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -703,13 +703,16 @@ static ssize_t fuse_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
                                  unsigned long nr_segs, loff_t pos)
 {
        struct inode *inode = iocb->ki_filp->f_mapping->host;
+        struct fuse_conn *fc = get_fuse_conn(inode);
-        if (pos + iov_length(iov, nr_segs) > i_size_read(inode)) {
+        /*
+         * In auto invalidate mode, always update attributes on read.
+         * Otherwise, only update if we attempt to read past EOF (to ensure
+         * i_size is up to date).
+         */
+        if (fc->auto_inval_data ||
+            (pos + iov_length(iov, nr_segs) > i_size_read(inode))) {
                int err;
-                /*
-                 * If trying to read past EOF, make sure the i_size
-                 * attribute is up-to-date.
-                 */
                err = fuse_update_attributes(inode, NULL, iocb->ki_filp, NULL);
                if (err)
                        return err;
@@ -1700,7 +1703,7 @@ static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
        size_t n;
        u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
-        for (n = 0; n < count; n++) {
+        for (n = 0; n < count; n++, iov++) {
                if (iov->iov_len > (size_t) max)
                        return -ENOMEM;
                max -= iov->iov_len;
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 771fb6322c0..e24dd74e306 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -484,6 +484,9 @@ struct fuse_conn {
        /** Is fallocate not implemented by fs? */
        unsigned no_fallocate:1;
+        /** Use enhanced/automatic page cache invalidation. */
+        unsigned auto_inval_data:1;
        /** The number of requests waiting for completion */
        atomic_t num_waiting;
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 1cd61652018..ce0a2838ccd 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -197,6 +197,7 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
        struct fuse_conn *fc = get_fuse_conn(inode);
        struct fuse_inode *fi = get_fuse_inode(inode);
        loff_t oldsize;
+        struct timespec old_mtime;
        spin_lock(&fc->lock);
        if (attr_version != 0 && fi->attr_version > attr_version) {
@@ -204,15 +205,35 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
                return;
        }
+        old_mtime = inode->i_mtime;
        fuse_change_attributes_common(inode, attr, attr_valid);
        oldsize = inode->i_size;
        i_size_write(inode, attr->size);
        spin_unlock(&fc->lock);
-        if (S_ISREG(inode->i_mode) && oldsize != attr->size) {
+        if (S_ISREG(inode->i_mode)) {
-                truncate_pagecache(inode, oldsize, attr->size);
+                bool inval = false;
-                invalidate_inode_pages2(inode->i_mapping);
+                if (oldsize != attr->size) {
+                        truncate_pagecache(inode, oldsize, attr->size);
+                        inval = true;
+                } else if (fc->auto_inval_data) {
+                        struct timespec new_mtime = {
+                                .tv_sec = attr->mtime,
+                                .tv_nsec = attr->mtimensec,
+                        };
+                        /*
+                         * Auto inval mode also checks and invalidates if mtime
+                         * has changed.
+                         */
+                        if (!timespec_equal(&old_mtime, &new_mtime))
+                                inval = true;
+                }
+                if (inval)
+                        invalidate_inode_pages2(inode->i_mapping);
        }
 }
@@ -834,6 +855,8 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                                fc->big_writes = 1;
                        if (arg->flags & FUSE_DONT_MASK)
                                fc->dont_mask = 1;
+                        if (arg->flags & FUSE_AUTO_INVAL_DATA)
+                                fc->auto_inval_data = 1;
                } else {
                        ra_pages = fc->max_read / PAGE_CACHE_SIZE;
                        fc->no_lock = 1;
@@ -859,7 +882,8 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)
        arg->max_readahead = fc->bdi.ra_pages * PAGE_CACHE_SIZE;
        arg->flags |= FUSE_ASYNC_READ | FUSE_POSIX_LOCKS | FUSE_ATOMIC_O_TRUNC |
                FUSE_EXPORT_SUPPORT | FUSE_BIG_WRITES | FUSE_DONT_MASK |
-                FUSE_FLOCK_LOCKS;
+                FUSE_SPLICE_WRITE | FUSE_SPLICE_MOVE | FUSE_SPLICE_READ |
+                FUSE_FLOCK_LOCKS | FUSE_IOCTL_DIR | FUSE_AUTO_INVAL_DATA;
        req->in.h.opcode = FUSE_INIT;
        req->in.numargs = 1;
        req->in.args[0].size = sizeof(*arg);
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index 3a56c8d94de..22255d96b27 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -52,7 +52,7 @@ static int gfs2_aspace_writepage(struct page *page, struct writeback_control *wb
                /*
                 * If it's a fully non-blocking write attempt and we cannot
                 * lock the buffer then redirty the page.  Note that this can
-                 * potentially cause a busy-wait loop from pdflush and kswapd
+                 * potentially cause a busy-wait loop from flusher thread and kswapd
                 * activity, but those code paths have their own higher-level
                 * throttling.
                 */
diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
index 5fd51a5833f..b7ec224910c 100644
--- a/fs/hfs/mdb.c
+++ b/fs/hfs/mdb.c
@@ -236,10 +236,10 @@ out:
 * hfs_mdb_commit()
 *
 * Description:
- *   This updates the MDB on disk (look also at hfs_write_super()).
+ *   This updates the MDB on disk.
 *   It does not check, if the superblock has been modified, or
 *   if the filesystem has been mounted read-only. It is mainly
- *   called by hfs_write_super() and hfs_btree_extend().
+ *   called by hfs_sync_fs() and flush_mdb().
 * Input Variable(s):
 *   struct hfs_mdb *mdb: Pointer to the hfs MDB
 *   int backup;
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 425c2f2cf17..a2862339323 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -534,8 +534,8 @@ int journal_start_commit(journal_t *journal, tid_t *ptid)
                ret = 1;
        } else if (journal->j_committing_transaction) {
                /*
-                 * If ext3_write_super() recently started a commit, then we
+                 * If commit has been started, then we have to wait for
-                 * have to wait for completion of that transaction
+                 * completion of that transaction.
                 */
                if (ptid)
                        *ptid = journal->j_committing_transaction->t_tid;
@@ -1113,6 +1113,11 @@ static void mark_journal_empty(journal_t *journal)
        BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
        spin_lock(&journal->j_state_lock);
+        /* Is it already empty? */
+        if (sb->s_start == 0) {
+                spin_unlock(&journal->j_state_lock);
+                return;
+        }
        jbd_debug(1, "JBD: Marking journal as empty (seq %d)\n",
                  journal->j_tail_sequence);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index e9a3c4c8559..e149b99a7ff 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -612,8 +612,8 @@ int jbd2_journal_start_commit(journal_t *journal, tid_t *ptid)
                ret = 1;
        } else if (journal->j_committing_transaction) {
                /*
-                 * If ext3_write_super() recently started a commit, then we
+                 * If commit has been started, then we have to wait for
-                 * have to wait for completion of that transaction
+                 * completion of that transaction.
                 */
                if (ptid)
                        *ptid = journal->j_committing_transaction->t_tid;
@@ -1377,7 +1377,7 @@ static void jbd2_mark_journal_empty(journal_t *journal)
 * Update a journal's errno.  Write updated superblock to disk waiting for IO
 * to complete.
 */
-static void jbd2_journal_update_sb_errno(journal_t *journal)
+void jbd2_journal_update_sb_errno(journal_t *journal)
 {
        journal_superblock_t *sb = journal->j_superblock;
@@ -1390,6 +1390,7 @@ static void jbd2_journal_update_sb_errno(journal_t *journal)
        jbd2_write_superblock(journal, WRITE_SYNC);
 }
+EXPORT_SYMBOL(jbd2_journal_update_sb_errno);
 /*
 * Read the superblock for a given journal, performing initial
diff --git a/fs/namei.c b/fs/namei.c
index 1b464390dde..dd1ed1b8e98 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -352,6 +352,7 @@ int __inode_permission(struct inode *inode, int mask)
 /**
 * sb_permission - Check superblock-level permissions
 * @sb: Superblock of inode to check permission on
+ * @inode: Inode to check permission on
 * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
 *
 * Separate out file-system wide checks from inode-specific permission checks.
@@ -656,6 +657,7 @@ int sysctl_protected_hardlinks __read_mostly = 1;
 /**
 * may_follow_link - Check symlink following for unsafe situations
 * @link: The path of the symlink
+ * @nd: nameidata pathwalk data
 *
 * In the case of the sysctl_protected_symlinks sysctl being enabled,
 * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
@@ -2414,7 +2416,7 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
                goto out;
        }
-        mode = op->mode & S_IALLUGO;
+        mode = op->mode;
        if ((open_flag & O_CREAT) && !IS_POSIXACL(dir))
                mode &= ~current_umask();
@@ -2452,7 +2454,7 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
        }
        if (open_flag & O_CREAT) {
-                error = may_o_create(&nd->path, dentry, op->mode);
+                error = may_o_create(&nd->path, dentry, mode);
                if (error) {
                        create_error = error;
                        if (open_flag & O_EXCL)
@@ -2489,6 +2491,10 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
                        dput(dentry);
                        dentry = file->f_path.dentry;
                }
+                if (create_error && dentry->d_inode == NULL) {
+                        error = create_error;
+                        goto out;
+                }
                goto looked_up;
        }
diff --git a/fs/nfs/Makefile b/fs/nfs/Makefile
index 8bf3a3f6925..b7db60897f9 100644
--- a/fs/nfs/Makefile
+++ b/fs/nfs/Makefile
@@ -12,19 +12,19 @@ nfs-$(CONFIG_ROOT_NFS)	+= nfsroot.o
 nfs-$(CONFIG_SYSCTL)    += sysctl.o
 nfs-$(CONFIG_NFS_FSCACHE) += fscache.o fscache-index.o
-obj-$(CONFIG_NFS_V2) += nfs2.o
+obj-$(CONFIG_NFS_V2) += nfsv2.o
-nfs2-y := nfs2super.o proc.o nfs2xdr.o
+nfsv2-y := nfs2super.o proc.o nfs2xdr.o
-obj-$(CONFIG_NFS_V3) += nfs3.o
+obj-$(CONFIG_NFS_V3) += nfsv3.o
-nfs3-y := nfs3super.o nfs3client.o nfs3proc.o nfs3xdr.o
+nfsv3-y := nfs3super.o nfs3client.o nfs3proc.o nfs3xdr.o
-nfs3-$(CONFIG_NFS_V3_ACL) += nfs3acl.o
+nfsv3-$(CONFIG_NFS_V3_ACL) += nfs3acl.o
-obj-$(CONFIG_NFS_V4) += nfs4.o
+obj-$(CONFIG_NFS_V4) += nfsv4.o
-nfs4-y := nfs4proc.o nfs4xdr.o nfs4state.o nfs4renewd.o nfs4super.o nfs4file.o \
+nfsv4-y := nfs4proc.o nfs4xdr.o nfs4state.o nfs4renewd.o nfs4super.o nfs4file.o \
          delegation.o idmap.o callback.o callback_xdr.o callback_proc.o \
          nfs4namespace.o nfs4getroot.o nfs4client.o
-nfs4-$(CONFIG_SYSCTL)   += nfs4sysctl.o
+nfsv4-$(CONFIG_SYSCTL)  += nfs4sysctl.o
-nfs4-$(CONFIG_NFS_V4_1) += pnfs.o pnfs_dev.o
+nfsv4-$(CONFIG_NFS_V4_1)        += pnfs.o pnfs_dev.o
 obj-$(CONFIG_PNFS_FILE_LAYOUT) += nfs_layout_nfsv41_files.o
 nfs_layout_nfsv41_files-y := nfs4filelayout.o nfs4filelayoutdev.o
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 9fc0d9dfc91..99694442b93 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -105,7 +105,7 @@ struct nfs_subversion *get_nfs_version(unsigned int version)
        if (IS_ERR(nfs)) {
                mutex_lock(&nfs_version_mutex);
-                request_module("nfs%d", version);
+                request_module("nfsv%d", version);
                nfs = find_nfs_version(version);
                mutex_unlock(&nfs_version_mutex);
        }
diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
index b701358c39c..a850079467d 100644
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -61,6 +61,12 @@ struct idmap {
        struct mutex            idmap_mutex;
 };
+struct idmap_legacy_upcalldata {
+        struct rpc_pipe_msg pipe_msg;
+        struct idmap_msg idmap_msg;
+        struct idmap *idmap;
+};
 /**
 * nfs_fattr_init_names - initialise the nfs_fattr owner_name/group_name fields
 * @fattr: fully initialised struct nfs_fattr
@@ -324,6 +330,7 @@ static ssize_t nfs_idmap_get_key(const char *name, size_t namelen,
                ret = nfs_idmap_request_key(&key_type_id_resolver_legacy,
                                            name, namelen, type, data,
                                            data_size, idmap);
+                idmap->idmap_key_cons = NULL;
                mutex_unlock(&idmap->idmap_mutex);
        }
        return ret;
@@ -380,11 +387,13 @@ static const match_table_t nfs_idmap_tokens = {
 static int nfs_idmap_legacy_upcall(struct key_construction *, const char *, void *);
 static ssize_t idmap_pipe_downcall(struct file *, const char __user *,
                                   size_t);
+static void idmap_release_pipe(struct inode *);
 static void idmap_pipe_destroy_msg(struct rpc_pipe_msg *);
 static const struct rpc_pipe_ops idmap_upcall_ops = {
        .upcall         = rpc_pipe_generic_upcall,
        .downcall       = idmap_pipe_downcall,
+        .release_pipe   = idmap_release_pipe,
        .destroy_msg    = idmap_pipe_destroy_msg,
 };
@@ -616,7 +625,8 @@ void nfs_idmap_quit(void)
        nfs_idmap_quit_keyring();
 }
-static int nfs_idmap_prepare_message(char *desc, struct idmap_msg *im,
+static int nfs_idmap_prepare_message(char *desc, struct idmap *idmap,
+                                     struct idmap_msg *im,
                                     struct rpc_pipe_msg *msg)
 {
        substring_t substr;
@@ -659,6 +669,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
                                   const char *op,
                                   void *aux)
 {
+        struct idmap_legacy_upcalldata *data;
        struct rpc_pipe_msg *msg;
        struct idmap_msg *im;
        struct idmap *idmap = (struct idmap *)aux;
@@ -666,15 +677,15 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
        int ret = -ENOMEM;
        /* msg and im are freed in idmap_pipe_destroy_msg */
-        msg = kmalloc(sizeof(*msg), GFP_KERNEL);
+        data = kmalloc(sizeof(*data), GFP_KERNEL);
-        if (!msg)
+        if (!data)
-                goto out0;
-        im = kmalloc(sizeof(*im), GFP_KERNEL);
-        if (!im)
                goto out1;
-        ret = nfs_idmap_prepare_message(key->description, im, msg);
+        msg = &data->pipe_msg;
+        im = &data->idmap_msg;
+        data->idmap = idmap;
+        ret = nfs_idmap_prepare_message(key->description, idmap, im, msg);
        if (ret < 0)
                goto out2;
@@ -683,15 +694,15 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
        ret = rpc_queue_upcall(idmap->idmap_pipe, msg);
        if (ret < 0)
-                goto out2;
+                goto out3;
        return ret;
+out3:
+        idmap->idmap_key_cons = NULL;
 out2:
-        kfree(im);
+        kfree(data);
 out1:
-        kfree(msg);
-out0:
        complete_request_key(cons, ret);
        return ret;
 }
@@ -749,9 +760,8 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
        }
        if (!(im.im_status & IDMAP_STATUS_SUCCESS)) {
-                ret = mlen;
+                ret = -ENOKEY;
-                complete_request_key(cons, -ENOKEY);
+                goto out;
-                goto out_incomplete;
        }
        namelen_in = strnlen(im.im_name, IDMAP_NAMESZ);
@@ -768,16 +778,32 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 out:
        complete_request_key(cons, ret);
-out_incomplete:
        return ret;
 }
 static void
 idmap_pipe_destroy_msg(struct rpc_pipe_msg *msg)
 {
+        struct idmap_legacy_upcalldata *data = container_of(msg,
+                        struct idmap_legacy_upcalldata,
+                        pipe_msg);
+        struct idmap *idmap = data->idmap;
+        struct key_construction *cons;
+        if (msg->errno) {
+                cons = ACCESS_ONCE(idmap->idmap_key_cons);
+                idmap->idmap_key_cons = NULL;
+                complete_request_key(cons, msg->errno);
+        }
        /* Free memory allocated in nfs_idmap_legacy_upcall() */
-        kfree(msg->data);
+        kfree(data);
-        kfree(msg);
+}
+static void
+idmap_release_pipe(struct inode *inode)
+{
+        struct rpc_inode *rpci = RPC_I(inode);
+        struct idmap *idmap = (struct idmap *)rpci->private;
+        idmap->idmap_key_cons = NULL;
 }
 int nfs_map_name_to_uid(const struct nfs_server *server, const char *name, size_t namelen, __u32 *uid)
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 0952c791df3..d6b3b5f2d77 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -69,7 +69,7 @@ do_proc_get_root(struct rpc_clnt *client, struct nfs_fh *fhandle,
        nfs_fattr_init(info->fattr);
        status = rpc_call_sync(client, &msg, 0);
        dprintk("%s: reply fsinfo: %d\n", __func__, status);
-        if (!(info->fattr->valid & NFS_ATTR_FATTR)) {
+        if (status == 0 && !(info->fattr->valid & NFS_ATTR_FATTR)) {
                msg.rpc_proc = &nfs3_procedures[NFS3PROC_GETATTR];
                msg.rpc_resp = info->fattr;
                status = rpc_call_sync(client, &msg, 0);
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 3b950dd81e8..da0618aeead 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -205,6 +205,9 @@ extern const struct dentry_operations nfs4_dentry_operations;
 int nfs_atomic_open(struct inode *, struct dentry *, struct file *,
                    unsigned, umode_t, int *);
+/* super.c */
+extern struct file_system_type nfs4_fs_type;
 /* nfs4namespace.c */
 rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *);
 struct rpc_clnt *nfs4_create_sec_client(struct rpc_clnt *, struct inode *, struct qstr *);
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index cbcdfaf3250..24eb663f8ed 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -74,7 +74,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
        return clp;
 error:
-        kfree(clp);
+        nfs_free_client(clp);
        return ERR_PTR(err);
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index a99a8d94872..635274140b1 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3737,9 +3737,10 @@ out:
 static void nfs4_write_cached_acl(struct inode *inode, struct page **pages, size_t pgbase, size_t acl_len)
 {
        struct nfs4_cached_acl *acl;
+        size_t buflen = sizeof(*acl) + acl_len;
-        if (pages && acl_len <= PAGE_SIZE) {
+        if (pages && buflen <= PAGE_SIZE) {
-                acl = kmalloc(sizeof(*acl) + acl_len, GFP_KERNEL);
+                acl = kmalloc(buflen, GFP_KERNEL);
                if (acl == NULL)
                        goto out;
                acl->cached = 1;
@@ -3819,7 +3820,7 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
        if (ret)
                goto out_free;
-        acl_len = res.acl_len - res.acl_data_offset;
+        acl_len = res.acl_len;
        if (acl_len > args.acl_len)
                nfs4_write_cached_acl(inode, NULL, 0, acl_len);
        else
@@ -6223,11 +6224,58 @@ static void nfs4_layoutget_done(struct rpc_task *task, void *calldata)
        dprintk("<-- %s\n", __func__);
 }
+static size_t max_response_pages(struct nfs_server *server)
+{
+        u32 max_resp_sz = server->nfs_client->cl_session->fc_attrs.max_resp_sz;
+        return nfs_page_array_len(0, max_resp_sz);
+}
+static void nfs4_free_pages(struct page **pages, size_t size)
+{
+        int i;
+        if (!pages)
+                return;
+        for (i = 0; i < size; i++) {
+                if (!pages[i])
+                        break;
+                __free_page(pages[i]);
+        }
+        kfree(pages);
+}
+static struct page **nfs4_alloc_pages(size_t size, gfp_t gfp_flags)
+{
+        struct page **pages;
+        int i;
+        pages = kcalloc(size, sizeof(struct page *), gfp_flags);
+        if (!pages) {
+                dprintk("%s: can't alloc array of %zu pages\n", __func__, size);
+                return NULL;
+        }
+        for (i = 0; i < size; i++) {
+                pages[i] = alloc_page(gfp_flags);
+                if (!pages[i]) {
+                        dprintk("%s: failed to allocate page\n", __func__);
+                        nfs4_free_pages(pages, size);
+                        return NULL;
+                }
+        }
+        return pages;
+}
 static void nfs4_layoutget_release(void *calldata)
 {
        struct nfs4_layoutget *lgp = calldata;
+        struct nfs_server *server = NFS_SERVER(lgp->args.inode);
+        size_t max_pages = max_response_pages(server);
        dprintk("--> %s\n", __func__);
+        nfs4_free_pages(lgp->args.layout.pages, max_pages);
        put_nfs_open_context(lgp->args.ctx);
        kfree(calldata);
        dprintk("<-- %s\n", __func__);
@@ -6239,9 +6287,10 @@ static const struct rpc_call_ops nfs4_layoutget_call_ops = {
        .rpc_release = nfs4_layoutget_release,
 };
-int nfs4_proc_layoutget(struct nfs4_layoutget *lgp)
+void nfs4_proc_layoutget(struct nfs4_layoutget *lgp, gfp_t gfp_flags)
 {
        struct nfs_server *server = NFS_SERVER(lgp->args.inode);
+        size_t max_pages = max_response_pages(server);
        struct rpc_task *task;
        struct rpc_message msg = {
                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_LAYOUTGET],
@@ -6259,12 +6308,19 @@ int nfs4_proc_layoutget(struct nfs4_layoutget *lgp)
        dprintk("--> %s\n", __func__);
+        lgp->args.layout.pages = nfs4_alloc_pages(max_pages, gfp_flags);
+        if (!lgp->args.layout.pages) {
+                nfs4_layoutget_release(lgp);
+                return;
+        }
+        lgp->args.layout.pglen = max_pages * PAGE_SIZE;
        lgp->res.layoutp = &lgp->args.layout;
        lgp->res.seq_res.sr_slot = NULL;
        nfs41_init_sequence(&lgp->args.seq_args, &lgp->res.seq_res, 0);
        task = rpc_run_task(&task_setup_data);
        if (IS_ERR(task))
-                return PTR_ERR(task);
+                return;
        status = nfs4_wait_for_completion_rpc_task(task);
        if (status == 0)
                status = task->tk_status;
@@ -6272,7 +6328,7 @@ int nfs4_proc_layoutget(struct nfs4_layoutget *lgp)
                status = pnfs_layout_process(lgp);
        rpc_put_task(task);
        dprintk("<-- %s status=%d\n", __func__, status);
-        return status;
+        return;
 }
 static void
@@ -6304,12 +6360,8 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
                return;
        }
        spin_lock(&lo->plh_inode->i_lock);
-        if (task->tk_status == 0) {
+        if (task->tk_status == 0 && lrp->res.lrs_present)
-                if (lrp->res.lrs_present) {
+                pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
-                        pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
-                } else
-                        BUG_ON(!list_empty(&lo->plh_segs));
-        }
        lo->plh_block_lgets--;
        spin_unlock(&lo->plh_inode->i_lock);
        dprintk("<-- %s\n", __func__);
diff --git a/fs/nfs/nfs4super.c b/fs/nfs/nfs4super.c
index 12a31a9dbcd..bd61221ad2c 100644
--- a/fs/nfs/nfs4super.c
+++ b/fs/nfs/nfs4super.c
@@ -23,14 +23,6 @@ static struct dentry *nfs4_referral_mount(struct file_system_type *fs_type,
 static struct dentry *nfs4_remote_referral_mount(struct file_system_type *fs_type,
        int flags, const char *dev_name, void *raw_data);
-static struct file_system_type nfs4_fs_type = {
-        .owner          = THIS_MODULE,
-        .name           = "nfs4",
-        .mount          = nfs_fs_mount,
-        .kill_sb        = nfs_kill_super,
-        .fs_flags       = FS_RENAME_DOES_D_MOVE|FS_REVAL_DOT|FS_BINARY_MOUNTDATA,
-};
 static struct file_system_type nfs4_remote_fs_type = {
        .owner          = THIS_MODULE,
        .name           = "nfs4",
@@ -344,14 +336,8 @@ static int __init init_nfs_v4(void)
        if (err)
                goto out1;
-        err = register_filesystem(&nfs4_fs_type);
-        if (err < 0)
-                goto out2;
        register_nfs_version(&nfs_v4);
        return 0;
-out2:
-        nfs4_unregister_sysctl();
 out1:
        nfs_idmap_quit();
 out:
@@ -361,7 +347,6 @@ out:
 static void __exit exit_nfs_v4(void)
 {
        unregister_nfs_version(&nfs_v4);
-        unregister_filesystem(&nfs4_fs_type);
        nfs4_unregister_sysctl();
        nfs_idmap_quit();
 }
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index ca13483edd6..1bfbd67c556 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -5045,22 +5045,19 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                         struct nfs_getaclres *res)
 {
        unsigned int savep;
-        __be32 *bm_p;
        uint32_t attrlen,
                 bitmap[3] = {0};
        int status;
-        size_t page_len = xdr->buf->page_len;
+        unsigned int pg_offset;
        res->acl_len = 0;
        if ((status = decode_op_hdr(xdr, OP_GETATTR)) != 0)
                goto out;
-        bm_p = xdr->p;
+        xdr_enter_page(xdr, xdr->buf->page_len);
-        res->acl_data_offset = be32_to_cpup(bm_p) + 2;
-        res->acl_data_offset <<= 2;
+        /* Calculate the offset of the page data */
-        /* Check if the acl data starts beyond the allocated buffer */
+        pg_offset = xdr->buf->head[0].iov_len;
-        if (res->acl_data_offset > page_len)
-                return -ERANGE;
        if ((status = decode_attr_bitmap(xdr, bitmap)) != 0)
                goto out;
@@ -5074,23 +5071,20 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                /* The bitmap (xdr len + bitmaps) and the attr xdr len words
                 * are stored with the acl data to handle the problem of
                 * variable length bitmaps.*/
-                xdr->p = bm_p;
+                res->acl_data_offset = xdr_stream_pos(xdr) - pg_offset;
                /* We ignore &savep and don't do consistency checks on
                 * the attr length.  Let userspace figure it out.... */
-                attrlen += res->acl_data_offset;
+                res->acl_len = attrlen;
-                if (attrlen > page_len) {
+                if (attrlen > (xdr->nwords << 2)) {
                        if (res->acl_flags & NFS4_ACL_LEN_REQUEST) {
                                /* getxattr interface called with a NULL buf */
-                                res->acl_len = attrlen;
                                goto out;
                        }
-                        dprintk("NFS: acl reply: attrlen %u > page_len %zu\n",
+                        dprintk("NFS: acl reply: attrlen %u > page_len %u\n",
-                                        attrlen, page_len);
+                                        attrlen, xdr->nwords << 2);
                        return -EINVAL;
                }
-                xdr_read_pages(xdr, attrlen);
-                res->acl_len = attrlen;
        } else
                status = -EOPNOTSUPP;
diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
index f50d3e8d6f2..ea6d111b03e 100644
--- a/fs/nfs/objlayout/objio_osd.c
+++ b/fs/nfs/objlayout/objio_osd.c
@@ -570,17 +570,66 @@ static bool objio_pg_test(struct nfs_pageio_descriptor *pgio,
                return false;
        return pgio->pg_count + req->wb_bytes <=
-                        OBJIO_LSEG(pgio->pg_lseg)->layout.max_io_length;
+                        (unsigned long)pgio->pg_layout_private;
+}
+void objio_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+{
+        pnfs_generic_pg_init_read(pgio, req);
+        if (unlikely(pgio->pg_lseg == NULL))
+                return; /* Not pNFS */
+        pgio->pg_layout_private = (void *)
+                                OBJIO_LSEG(pgio->pg_lseg)->layout.max_io_length;
+}
+static bool aligned_on_raid_stripe(u64 offset, struct ore_layout *layout,
+                                   unsigned long *stripe_end)
+{
+        u32 stripe_off;
+        unsigned stripe_size;
+        if (layout->raid_algorithm == PNFS_OSD_RAID_0)
+                return true;
+        stripe_size = layout->stripe_unit *
+                                (layout->group_width - layout->parity);
+        div_u64_rem(offset, stripe_size, &stripe_off);
+        if (!stripe_off)
+                return true;
+        *stripe_end = stripe_size - stripe_off;
+        return false;
+}
+void objio_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+{
+        unsigned long stripe_end = 0;
+        pnfs_generic_pg_init_write(pgio, req);
+        if (unlikely(pgio->pg_lseg == NULL))
+                return; /* Not pNFS */
+        if (req->wb_offset ||
+            !aligned_on_raid_stripe(req->wb_index * PAGE_SIZE,
+                               &OBJIO_LSEG(pgio->pg_lseg)->layout,
+                               &stripe_end)) {
+                pgio->pg_layout_private = (void *)stripe_end;
+        } else {
+                pgio->pg_layout_private = (void *)
+                                OBJIO_LSEG(pgio->pg_lseg)->layout.max_io_length;
+        }
 }
 static const struct nfs_pageio_ops objio_pg_read_ops = {
-        .pg_init = pnfs_generic_pg_init_read,
+        .pg_init = objio_init_read,
        .pg_test = objio_pg_test,
        .pg_doio = pnfs_generic_pg_readpages,
 };
 static const struct nfs_pageio_ops objio_pg_write_ops = {
-        .pg_init = pnfs_generic_pg_init_write,
+        .pg_init = objio_init_write,
        .pg_test = objio_pg_test,
        .pg_doio = pnfs_generic_pg_writepages,
 };
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 1a6732ed04a..311a79681e2 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -49,6 +49,7 @@ void nfs_pgheader_init(struct nfs_pageio_descriptor *desc,
        hdr->io_start = req_offset(hdr->req);
        hdr->good_bytes = desc->pg_count;
        hdr->dreq = desc->pg_dreq;
+        hdr->layout_private = desc->pg_layout_private;
        hdr->release = release;
        hdr->completion_ops = desc->pg_completion_ops;
        if (hdr->completion_ops->init_hdr)
@@ -268,6 +269,7 @@ void nfs_pageio_init(struct nfs_pageio_descriptor *desc,
        desc->pg_error = 0;
        desc->pg_lseg = NULL;
        desc->pg_dreq = NULL;
+        desc->pg_layout_private = NULL;
 }
 EXPORT_SYMBOL_GPL(nfs_pageio_init);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 76875bfcf19..2e00feacd4b 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -583,9 +583,6 @@ send_layoutget(struct pnfs_layout_hdr *lo,
        struct nfs_server *server = NFS_SERVER(ino);
        struct nfs4_layoutget *lgp;
        struct pnfs_layout_segment *lseg = NULL;
-        struct page **pages = NULL;
-        int i;
-        u32 max_resp_sz, max_pages;
        dprintk("--> %s\n", __func__);
@@ -594,20 +591,6 @@ send_layoutget(struct pnfs_layout_hdr *lo,
        if (lgp == NULL)
                return NULL;
-        /* allocate pages for xdr post processing */
-        max_resp_sz = server->nfs_client->cl_session->fc_attrs.max_resp_sz;
-        max_pages = nfs_page_array_len(0, max_resp_sz);
-        pages = kcalloc(max_pages, sizeof(struct page *), gfp_flags);
-        if (!pages)
-                goto out_err_free;
-        for (i = 0; i < max_pages; i++) {
-                pages[i] = alloc_page(gfp_flags);
-                if (!pages[i])
-                        goto out_err_free;
-        }
        lgp->args.minlength = PAGE_CACHE_SIZE;
        if (lgp->args.minlength > range->length)
                lgp->args.minlength = range->length;
@@ -616,39 +599,19 @@ send_layoutget(struct pnfs_layout_hdr *lo,
        lgp->args.type = server->pnfs_curr_ld->id;
        lgp->args.inode = ino;
        lgp->args.ctx = get_nfs_open_context(ctx);
-        lgp->args.layout.pages = pages;
-        lgp->args.layout.pglen = max_pages * PAGE_SIZE;
        lgp->lsegpp = &lseg;
        lgp->gfp_flags = gfp_flags;
        /* Synchronously retrieve layout information from server and
         * store in lseg.
         */
-        nfs4_proc_layoutget(lgp);
+        nfs4_proc_layoutget(lgp, gfp_flags);
        if (!lseg) {
                /* remember that LAYOUTGET failed and suspend trying */
                set_bit(lo_fail_bit(range->iomode), &lo->plh_flags);
        }
-        /* free xdr pages */
-        for (i = 0; i < max_pages; i++)
-                __free_page(pages[i]);
-        kfree(pages);
        return lseg;
-out_err_free:
-        /* free any allocated xdr pages, lgp as it's not used */
-        if (pages) {
-                for (i = 0; i < max_pages; i++) {
-                        if (!pages[i])
-                                break;
-                        __free_page(pages[i]);
-                }
-                kfree(pages);
-        }
-        kfree(lgp);
-        return NULL;
 }
 /*
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 2c6c80503ba..745aa1b39e7 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -172,7 +172,7 @@ extern int nfs4_proc_getdevicelist(struct nfs_server *server,
                                   struct pnfs_devicelist *devlist);
 extern int nfs4_proc_getdeviceinfo(struct nfs_server *server,
                                   struct pnfs_device *dev);
-extern int nfs4_proc_layoutget(struct nfs4_layoutget *lgp);
+extern void nfs4_proc_layoutget(struct nfs4_layoutget *lgp, gfp_t gfp_flags);
 extern int nfs4_proc_layoutreturn(struct nfs4_layoutreturn *lrp);
 /* pnfs.c */
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ac6a3c55dce..239aff7338e 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -319,6 +319,34 @@ EXPORT_SYMBOL_GPL(nfs_sops);
 static void nfs4_validate_mount_flags(struct nfs_parsed_mount_data *);
 static int nfs4_validate_mount_data(void *options,
        struct nfs_parsed_mount_data *args, const char *dev_name);
+struct file_system_type nfs4_fs_type = {
+        .owner          = THIS_MODULE,
+        .name           = "nfs4",
+        .mount          = nfs_fs_mount,
+        .kill_sb        = nfs_kill_super,
+        .fs_flags       = FS_RENAME_DOES_D_MOVE|FS_REVAL_DOT|FS_BINARY_MOUNTDATA,
+};
+EXPORT_SYMBOL_GPL(nfs4_fs_type);
+static int __init register_nfs4_fs(void)
+{
+        return register_filesystem(&nfs4_fs_type);
+}
+static void unregister_nfs4_fs(void)
+{
+        unregister_filesystem(&nfs4_fs_type);
+}
+#else
+static int __init register_nfs4_fs(void)
+{
+        return 0;
+}
+static void unregister_nfs4_fs(void)
+{
+}
 #endif
 static struct shrinker acl_shrinker = {
@@ -337,12 +365,18 @@ int __init register_nfs_fs(void)
        if (ret < 0)
                goto error_0;
-        ret = nfs_register_sysctl();
+        ret = register_nfs4_fs();
        if (ret < 0)
                goto error_1;
+        ret = nfs_register_sysctl();
+        if (ret < 0)
+                goto error_2;
        register_shrinker(&acl_shrinker);
        return 0;
+error_2:
+        unregister_nfs4_fs();
 error_1:
        unregister_filesystem(&nfs_fs_type);
 error_0:
@@ -356,6 +390,7 @@ void __exit unregister_nfs_fs(void)
 {
        unregister_shrinker(&acl_shrinker);
        nfs_unregister_sysctl();
+        unregister_nfs4_fs();
        unregister_filesystem(&nfs_fs_type);
 }
@@ -2645,4 +2680,6 @@ MODULE_PARM_DESC(max_session_slots, "Maximum number of outstanding NFSv4.1 "
 module_param(send_implementation_id, ushort, 0644);
 MODULE_PARM_DESC(send_implementation_id,
                "Send implementation ID with NFSv4.1 exchange_id");
+MODULE_ALIAS("nfs4");
 #endif /* CONFIG_NFS_V4 */
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 5829d0ce7cf..e3b55372726 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1814,19 +1814,19 @@ int __init nfs_init_writepagecache(void)
        nfs_wdata_mempool = mempool_create_slab_pool(MIN_POOL_WRITE,
                                                     nfs_wdata_cachep);
        if (nfs_wdata_mempool == NULL)
-                return -ENOMEM;
+                goto out_destroy_write_cache;
        nfs_cdata_cachep = kmem_cache_create("nfs_commit_data",
                                             sizeof(struct nfs_commit_data),
                                             0, SLAB_HWCACHE_ALIGN,
                                             NULL);
        if (nfs_cdata_cachep == NULL)
-                return -ENOMEM;
+                goto out_destroy_write_mempool;
        nfs_commit_mempool = mempool_create_slab_pool(MIN_POOL_COMMIT,
                                                      nfs_wdata_cachep);
        if (nfs_commit_mempool == NULL)
-                return -ENOMEM;
+                goto out_destroy_commit_cache;
        /*
         * NFS congestion size, scale with available memory.
@@ -1849,11 +1849,20 @@ int __init nfs_init_writepagecache(void)
                nfs_congestion_kb = 256*1024;
        return 0;
+out_destroy_commit_cache:
+        kmem_cache_destroy(nfs_cdata_cachep);
+out_destroy_write_mempool:
+        mempool_destroy(nfs_wdata_mempool);
+out_destroy_write_cache:
+        kmem_cache_destroy(nfs_wdata_cachep);
+        return -ENOMEM;
 }
 void nfs_destroy_writepagecache(void)
 {
        mempool_destroy(nfs_commit_mempool);
+        kmem_cache_destroy(nfs_cdata_cachep);
        mempool_destroy(nfs_wdata_mempool);
        kmem_cache_destroy(nfs_wdata_cachep);
 }
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 6522cac6057..6a10812711c 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -676,17 +676,13 @@ static const struct super_operations nilfs_sops = {
        .alloc_inode    = nilfs_alloc_inode,
        .destroy_inode  = nilfs_destroy_inode,
        .dirty_inode    = nilfs_dirty_inode,
-        /* .write_inode    = nilfs_write_inode, */
-        /* .drop_inode    = nilfs_drop_inode, */
        .evict_inode    = nilfs_evict_inode,
        .put_super      = nilfs_put_super,
-        /* .write_super    = nilfs_write_super, */
        .sync_fs        = nilfs_sync_fs,
        .freeze_fs      = nilfs_freeze,
        .unfreeze_fs    = nilfs_unfreeze,
        .statfs         = nilfs_statfs,
        .remount_fs     = nilfs_remount,
-        /* .umount_begin */
        .show_options = nilfs_show_options
 };
diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h
index 6eee4177807..be1267a34ce 100644
--- a/fs/nilfs2/the_nilfs.h
+++ b/fs/nilfs2/the_nilfs.h
@@ -107,8 +107,6 @@ struct the_nilfs {
         * used for
         * - loading the latest checkpoint exclusively.
         * - allocating a new full segment.
-         * - protecting s_dirt in the super_block struct
-         *   (see nilfs_write_super) and the following fields.
         */
        struct buffer_head     *ns_sbh[2];
        struct nilfs_super_block *ns_sbp[2];
diff --git a/fs/open.c b/fs/open.c
index f3d96e7e7b1..e1f2cdb91a4 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -717,7 +717,7 @@ cleanup_all:
                         * here, so just reset the state.
                         */
                        file_reset_write(f);
-                        mnt_drop_write(f->f_path.mnt);
+                        __mnt_drop_write(f->f_path.mnt);
                }
        }
 cleanup_file:
@@ -852,9 +852,10 @@ static inline int build_open_flags(int flags, umode_t mode, struct open_flags *o
        int lookup_flags = 0;
        int acc_mode;
-        if (!(flags & O_CREAT))
+        if (flags & O_CREAT)
-                mode = 0;
+                op->mode = (mode & S_IALLUGO) | S_IFREG;
-        op->mode = mode;
+        else
+                op->mode = 0;
        /* Must never be set by userspace */
        flags &= ~FMODE_NONOTIFY;
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 36a29b753c7..c495a3055e2 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1589,10 +1589,10 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
                goto out;
        }
-        down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
        for (cnt = 0; cnt < MAXQUOTAS; cnt++)
                warn[cnt].w_type = QUOTA_NL_NOWARN;
+        down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
        spin_lock(&dq_data_lock);
        for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
                if (!dquots[cnt])
diff --git a/fs/reiserfs/bitmap.c b/fs/reiserfs/bitmap.c
index 4c0c7d163d1..a98b7740a0f 100644
--- a/fs/reiserfs/bitmap.c
+++ b/fs/reiserfs/bitmap.c
@@ -1334,9 +1334,7 @@ struct buffer_head *reiserfs_read_bitmap_block(struct super_block *sb,
        else if (bitmap == 0)
                block = (REISERFS_DISK_OFFSET_IN_BYTES >> sb->s_blocksize_bits) + 1;
-        reiserfs_write_unlock(sb);
        bh = sb_bread(sb, block);
-        reiserfs_write_lock(sb);
        if (bh == NULL)
                reiserfs_warning(sb, "sh-2029: %s: bitmap block (#%u) "
                                 "reading failed", __func__, block);
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index a6d4268fb6c..855da58db14 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -76,10 +76,10 @@ void reiserfs_evict_inode(struct inode *inode)
                ;
        }
      out:
+        reiserfs_write_unlock_once(inode->i_sb, depth);
        clear_inode(inode);     /* note this must go after the journal_end to prevent deadlock */
        dquot_drop(inode);
        inode->i_blocks = 0;
-        reiserfs_write_unlock_once(inode->i_sb, depth);
        return;
 no_delete:
diff --git a/fs/super.c b/fs/super.c
index b05cf47463d..0902cfa6a12 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -537,46 +537,6 @@ void drop_super(struct super_block *sb)
 EXPORT_SYMBOL(drop_super);
 /**
- * sync_supers - helper for periodic superblock writeback
- *
- * Call the write_super method if present on all dirty superblocks in
- * the system.  This is for the periodic writeback used by most older
- * filesystems.  For data integrity superblock writeback use
- * sync_filesystems() instead.
- *
- * Note: check the dirty flag before waiting, so we don't
- * hold up the sync while mounting a device. (The newly
- * mounted device won't need syncing.)
- */
-void sync_supers(void)
-{
-        struct super_block *sb, *p = NULL;
-        spin_lock(&sb_lock);
-        list_for_each_entry(sb, &super_blocks, s_list) {
-                if (hlist_unhashed(&sb->s_instances))
-                        continue;
-                if (sb->s_op->write_super && sb->s_dirt) {
-                        sb->s_count++;
-                        spin_unlock(&sb_lock);
-                        down_read(&sb->s_umount);
-                        if (sb->s_root && sb->s_dirt && (sb->s_flags & MS_BORN))
-                                sb->s_op->write_super(sb);
-                        up_read(&sb->s_umount);
-                        spin_lock(&sb_lock);
-                        if (p)
-                                __put_super(p);
-                        p = sb;
-                }
-        }
-        if (p)
-                __put_super(p);
-        spin_unlock(&sb_lock);
-}
-/**
 *      iterate_supers - call function for all active superblocks
 *      @f: function to call
 *      @arg: argument to pass to it
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index 8b8cc4e945f..760de723dad 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -167,7 +167,7 @@ struct ubifs_global_debug_info {
 #define ubifs_dbg_msg(type, fmt, ...) \
        pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__)
-#define DBG_KEY_BUF_LEN 32
+#define DBG_KEY_BUF_LEN 48
 #define ubifs_dbg_msg_key(type, key, fmt, ...) do {                            \
        char __tmp_key_buf[DBG_KEY_BUF_LEN];                                   \
        pr_debug("UBIFS DBG " type ": " fmt "%s\n", ##__VA_ARGS__,             \
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index 35389ca2d26..7bd6e72afd1 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -37,11 +37,11 @@
 *
 * A thing to keep in mind: inode @i_mutex is locked in most VFS operations we
 * implement. However, this is not true for 'ubifs_writepage()', which may be
- * called with @i_mutex unlocked. For example, when pdflush is doing background
+ * called with @i_mutex unlocked. For example, when flusher thread is doing
- * write-back, it calls 'ubifs_writepage()' with unlocked @i_mutex. At "normal"
+ * background write-back, it calls 'ubifs_writepage()' with unlocked @i_mutex.
- * work-paths the @i_mutex is locked in 'ubifs_writepage()', e.g. in the
+ * At "normal" work-paths the @i_mutex is locked in 'ubifs_writepage()', e.g.
- * "sys_write -> alloc_pages -> direct reclaim path". So, in 'ubifs_writepage()'
+ * in the "sys_write -> alloc_pages -> direct reclaim path". So, in
- * we are only guaranteed that the page is locked.
+ * 'ubifs_writepage()' we are only guaranteed that the page is locked.
 *
 * Similarly, @i_mutex is not always locked in 'ubifs_readpage()', e.g., the
 * read-ahead path does not lock it ("sys_read -> generic_file_aio_read ->
diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index ce33b2beb15..8640920766e 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -1749,7 +1749,10 @@ int ubifs_lpt_init(struct ubifs_info *c, int rd, int wr)
        return 0;
 out_err:
-        ubifs_lpt_free(c, 0);
+        if (wr)
+                ubifs_lpt_free(c, 1);
+        if (rd)
+                ubifs_lpt_free(c, 0);
        return err;
 }
diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
index c30d976b4be..edeec499c04 100644
--- a/fs/ubifs/recovery.c
+++ b/fs/ubifs/recovery.c
@@ -788,7 +788,7 @@ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
 corrupted_rescan:
        /* Re-scan the corrupted data with verbose messages */
-        ubifs_err("corruptio %d", ret);
+        ubifs_err("corruption %d", ret);
        ubifs_scan_a_node(c, buf, len, lnum, offs, 1);
 corrupted:
        ubifs_scanned_corruption(c, lnum, offs, buf);
diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
index eba46d4a761..94d78fc5d4e 100644
--- a/fs/ubifs/replay.c
+++ b/fs/ubifs/replay.c
@@ -1026,7 +1026,6 @@ int ubifs_replay_journal(struct ubifs_info *c)
        c->replaying = 1;
        lnum = c->ltail_lnum = c->lhead_lnum;
-        lnum = UBIFS_LOG_LNUM;
        do {
                err = replay_log_leb(c, lnum, 0, c->sbuf);
                if (err == 1)
@@ -1035,7 +1034,7 @@ int ubifs_replay_journal(struct ubifs_info *c)
                if (err)
                        goto out;
                lnum = ubifs_next_log_lnum(c, lnum);
-        } while (lnum != UBIFS_LOG_LNUM);
+        } while (lnum != c->ltail_lnum);
        err = replay_buds(c);
        if (err)
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 1c766c39c03..71a197f0f93 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -303,7 +303,7 @@ static int ubifs_write_inode(struct inode *inode, struct writeback_control *wbc)
        mutex_lock(&ui->ui_mutex);
        /*
         * Due to races between write-back forced by budgeting
-         * (see 'sync_some_inodes()') and pdflush write-back, the inode may
+         * (see 'sync_some_inodes()') and background write-back, the inode may
         * have already been synchronized, do not do this again. This might
         * also happen if it was synchronized in an VFS operation, e.g.
         * 'ubifs_link()'.
@@ -1157,9 +1157,6 @@ static int check_free_space(struct ubifs_info *c)
 *
 * This function mounts UBIFS file system. Returns zero in case of success and
 * a negative error code in case of failure.
- *
- * Note, the function does not de-allocate resources it it fails half way
- * through, and the caller has to do this instead.
 */
 static int mount_ubifs(struct ubifs_info *c)
 {
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index fafaad795cd..aa233469b3c 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1124,14 +1124,17 @@ int udf_setsize(struct inode *inode, loff_t newsize)
                                if (err)
                                        return err;
                                down_write(&iinfo->i_data_sem);
-                        } else
+                        } else {
                                iinfo->i_lenAlloc = newsize;
+                                goto set_size;
+                        }
                }
                err = udf_extend_file(inode, newsize);
                if (err) {
                        up_write(&iinfo->i_data_sem);
                        return err;
                }
+set_size:
                truncate_setsize(inode, newsize);
                up_write(&iinfo->i_data_sem);
        } else {
diff --git a/fs/udf/super.c b/fs/udf/super.c
index dcbf98722af..18fc038a438 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1344,6 +1344,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                udf_err(sb, "error loading logical volume descriptor: "
                        "Partition table too long (%u > %lu)\n", table_len,
                        sb->s_blocksize - sizeof(*lvd));
+                ret = 1;
                goto out_bh;
        }
@@ -1388,8 +1389,10 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                                                UDF_ID_SPARABLE,
                                                strlen(UDF_ID_SPARABLE))) {
                                if (udf_load_sparable_map(sb, map,
-                                    (struct sparablePartitionMap *)gpm) < 0)
+                                    (struct sparablePartitionMap *)gpm) < 0) {
+                                        ret = 1;
                                        goto out_bh;
+                                }
                        } else if (!strncmp(upm2->partIdent.ident,
                                                UDF_ID_METADATA,
                                                strlen(UDF_ID_METADATA))) {
@@ -2000,6 +2003,8 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
                        if (!silent)
                                pr_notice("Rescanning with blocksize %d\n",
                                          UDF_DEFAULT_BLOCKSIZE);
+                        brelse(sbi->s_lvid_bh);
+                        sbi->s_lvid_bh = NULL;
                        uopt.blocksize = UDF_DEFAULT_BLOCKSIZE;
                        ret = udf_load_vrs(sb, &uopt, silent, &fileset);
                }