Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

Pull quota, reiserfs, UDF updates from Jan Kara:
 "Scalability improvements for quota, a few reiserfs fixes, and couple
  of misc cleanups (udf, ext2)"

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  reiserfs: Fix use after free in journal teardown
  reiserfs: fix corruption introduced by balance_leaf refactor
  udf: avoid redundant memcpy when writing data in ICB
  fs/udf: re-use hex_asc_upper_{hi,lo} macros
  fs/quota: kernel-doc warning fixes
  udf: use linux/uaccess.h
  fs/ext2/super.c: Drop memory allocation cast
  quota: remove dqptr_sem
  quota: simplify remove_inode_dquot_ref()
  quota: avoid unnecessary dqget()/dqput() calls
  quota: protect Q_GETFMT by dqonoff_mutex

5 files changed, 92 insertions, 61 deletions

diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
index 5739cb99de7b..9c02d96d3a42 100644
--- a/fs/reiserfs/do_balan.c
+++ b/fs/reiserfs/do_balan.c
@@ -286,12 +286,14 @@ static int balance_leaf_when_delete(struct tree_balance *tb, int flag)
         return 0;
 }
 
-static void balance_leaf_insert_left(struct tree_balance *tb,
-                                     struct item_head *ih, const char *body)
+static unsigned int balance_leaf_insert_left(struct tree_balance *tb,
+                                             struct item_head *const ih,
+                                             const char * const body)
 {
         int ret;
         struct buffer_info bi;
         int n = B_NR_ITEMS(tb->L[0]);
+        unsigned body_shift_bytes = 0;
 
         if (tb->item_pos == tb->lnum[0] - 1 && tb->lbytes != -1) {
                 /* part of new item falls into L[0] */
@@ -329,7 +331,7 @@ static void balance_leaf_insert_left(struct tree_balance *tb,
 
                 put_ih_item_len(ih, new_item_len);
                 if (tb->lbytes > tb->zeroes_num) {
-                        body += (tb->lbytes - tb->zeroes_num);
+                        body_shift_bytes = tb->lbytes - tb->zeroes_num;
                         tb->zeroes_num = 0;
                 } else
                         tb->zeroes_num -= tb->lbytes;
@@ -349,11 +351,12 @@ static void balance_leaf_insert_left(struct tree_balance *tb,
                 tb->insert_size[0] = 0;
                 tb->zeroes_num = 0;
         }
+        return body_shift_bytes;
 }
 
 static void balance_leaf_paste_left_shift_dirent(struct tree_balance *tb,
-                                                 struct item_head *ih,
-                                                 const char *body)
+                                                 struct item_head * const ih,
+                                                 const char * const body)
 {
         int n = B_NR_ITEMS(tb->L[0]);
         struct buffer_info bi;
@@ -413,17 +416,18 @@ static void balance_leaf_paste_left_shift_dirent(struct tree_balance *tb,
         tb->pos_in_item -= tb->lbytes;
 }
 
-static void balance_leaf_paste_left_shift(struct tree_balance *tb,
-                                          struct item_head *ih,
-                                          const char *body)
+static unsigned int balance_leaf_paste_left_shift(struct tree_balance *tb,
+                                                  struct item_head * const ih,
+                                                  const char * const body)
 {
         struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
         int n = B_NR_ITEMS(tb->L[0]);
         struct buffer_info bi;
+        int body_shift_bytes = 0;
 
         if (is_direntry_le_ih(item_head(tbS0, tb->item_pos))) {
                 balance_leaf_paste_left_shift_dirent(tb, ih, body);
-                return;
+                return 0;
         }
 
         RFALSE(tb->lbytes <= 0,
@@ -497,7 +501,7 @@ static void balance_leaf_paste_left_shift(struct tree_balance *tb,
                  * insert_size[0]
                  */
                 if (l_n > tb->zeroes_num) {
-                        body += (l_n - tb->zeroes_num);
+                        body_shift_bytes = l_n - tb->zeroes_num;
                         tb->zeroes_num = 0;
                 } else
                         tb->zeroes_num -= l_n;
@@ -526,13 +530,14 @@ static void balance_leaf_paste_left_shift(struct tree_balance *tb,
                  */
                 leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
         }
+        return body_shift_bytes;
 }
 
 
 /* appended item will be in L[0] in whole */
 static void balance_leaf_paste_left_whole(struct tree_balance *tb,
-                                          struct item_head *ih,
-                                          const char *body)
+                                          struct item_head * const ih,
+                                          const char * const body)
 {
         struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
         int n = B_NR_ITEMS(tb->L[0]);
@@ -584,39 +589,44 @@ static void balance_leaf_paste_left_whole(struct tree_balance *tb,
         tb->zeroes_num = 0;
 }
 
-static void balance_leaf_paste_left(struct tree_balance *tb,
-                                    struct item_head *ih, const char *body)
+static unsigned int balance_leaf_paste_left(struct tree_balance *tb,
+                                            struct item_head * const ih,
+                                            const char * const body)
 {
         /* we must shift the part of the appended item */
         if (tb->item_pos == tb->lnum[0] - 1 && tb->lbytes != -1)
-                balance_leaf_paste_left_shift(tb, ih, body);
+                return balance_leaf_paste_left_shift(tb, ih, body);
         else
                 balance_leaf_paste_left_whole(tb, ih, body);
+        return 0;
 }
 
 /* Shift lnum[0] items from S[0] to the left neighbor L[0] */
-static void balance_leaf_left(struct tree_balance *tb, struct item_head *ih,
-                              const char *body, int flag)
+static unsigned int balance_leaf_left(struct tree_balance *tb,
+                                      struct item_head * const ih,
+                                      const char * const body, int flag)
 {
         if (tb->lnum[0] <= 0)
-                return;
+                return 0;
 
         /* new item or it part falls to L[0], shift it too */
         if (tb->item_pos < tb->lnum[0]) {
                 BUG_ON(flag != M_INSERT && flag != M_PASTE);
 
                 if (flag == M_INSERT)
-                        balance_leaf_insert_left(tb, ih, body);
+                        return balance_leaf_insert_left(tb, ih, body);
                 else /* M_PASTE */
-                        balance_leaf_paste_left(tb, ih, body);
+                        return balance_leaf_paste_left(tb, ih, body);
         } else
                 /* new item doesn't fall into L[0] */
                 leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
+        return 0;
 }
 
 
 static void balance_leaf_insert_right(struct tree_balance *tb,
-                                      struct item_head *ih, const char *body)
+                                      struct item_head * const ih,
+                                      const char * const body)
 {
 
         struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
@@ -704,7 +714,8 @@ static void balance_leaf_insert_right(struct tree_balance *tb,
 
 
 static void balance_leaf_paste_right_shift_dirent(struct tree_balance *tb,
-                                     struct item_head *ih, const char *body)
+                                     struct item_head * const ih,
+                                     const char * const body)
 {
         struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
         struct buffer_info bi;
@@ -754,7 +765,8 @@ static void balance_leaf_paste_right_shift_dirent(struct tree_balance *tb,
 }
 
 static void balance_leaf_paste_right_shift(struct tree_balance *tb,
-                                     struct item_head *ih, const char *body)
+                                     struct item_head * const ih,
+                                     const char * const body)
 {
         struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
         int n_shift, n_rem, r_zeroes_number, version;
@@ -831,7 +843,8 @@ static void balance_leaf_paste_right_shift(struct tree_balance *tb,
 }
 
 static void balance_leaf_paste_right_whole(struct tree_balance *tb,
-                                     struct item_head *ih, const char *body)
+                                     struct item_head * const ih,
+                                     const char * const body)
 {
         struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
         int n = B_NR_ITEMS(tbS0);
@@ -874,7 +887,8 @@ static void balance_leaf_paste_right_whole(struct tree_balance *tb,
 }
 
 static void balance_leaf_paste_right(struct tree_balance *tb,
-                                     struct item_head *ih, const char *body)
+                                     struct item_head * const ih,
+                                     const char * const body)
 {
         struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
         int n = B_NR_ITEMS(tbS0);
@@ -896,8 +910,9 @@ static void balance_leaf_paste_right(struct tree_balance *tb,
 }
 
 /* shift rnum[0] items from S[0] to the right neighbor R[0] */
-static void balance_leaf_right(struct tree_balance *tb, struct item_head *ih,
-                               const char *body, int flag)
+static void balance_leaf_right(struct tree_balance *tb,
+                               struct item_head * const ih,
+                               const char * const body, int flag)
 {
         if (tb->rnum[0] <= 0)
                 return;
@@ -911,8 +926,8 @@ static void balance_leaf_right(struct tree_balance *tb, struct item_head *ih,
 }
 
 static void balance_leaf_new_nodes_insert(struct tree_balance *tb,
-                                          struct item_head *ih,
-                                          const char *body,
+                                          struct item_head * const ih,
+                                          const char * const body,
                                           struct item_head *insert_key,
                                           struct buffer_head **insert_ptr,
                                           int i)
@@ -1003,8 +1018,8 @@ static void balance_leaf_new_nodes_insert(struct tree_balance *tb,
 
 /* we append to directory item */
 static void balance_leaf_new_nodes_paste_dirent(struct tree_balance *tb,
-                                         struct item_head *ih,
-                                         const char *body,
+                                         struct item_head * const ih,
+                                         const char * const body,
                                          struct item_head *insert_key,
                                          struct buffer_head **insert_ptr,
                                          int i)
@@ -1058,8 +1073,8 @@ static void balance_leaf_new_nodes_paste_dirent(struct tree_balance *tb,
 }
 
 static void balance_leaf_new_nodes_paste_shift(struct tree_balance *tb,
-                                         struct item_head *ih,
-                                         const char *body,
+                                         struct item_head * const ih,
+                                         const char * const body,
                                          struct item_head *insert_key,
                                          struct buffer_head **insert_ptr,
                                          int i)
@@ -1131,8 +1146,8 @@ static void balance_leaf_new_nodes_paste_shift(struct tree_balance *tb,
 }
 
 static void balance_leaf_new_nodes_paste_whole(struct tree_balance *tb,
-                                               struct item_head *ih,
-                                               const char *body,
+                                               struct item_head * const ih,
+                                               const char * const body,
                                                struct item_head *insert_key,
                                                struct buffer_head **insert_ptr,
                                                int i)
@@ -1184,8 +1199,8 @@ static void balance_leaf_new_nodes_paste_whole(struct tree_balance *tb,
 
 }
 static void balance_leaf_new_nodes_paste(struct tree_balance *tb,
-                                         struct item_head *ih,
-                                         const char *body,
+                                         struct item_head * const ih,
+                                         const char * const body,
                                          struct item_head *insert_key,
                                          struct buffer_head **insert_ptr,
                                          int i)
@@ -1214,8 +1229,8 @@ static void balance_leaf_new_nodes_paste(struct tree_balance *tb,
 
 /* Fill new nodes that appear in place of S[0] */
 static void balance_leaf_new_nodes(struct tree_balance *tb,
-                                   struct item_head *ih,
-                                   const char *body,
+                                   struct item_head * const ih,
+                                   const char * const body,
                                    struct item_head *insert_key,
                                    struct buffer_head **insert_ptr,
                                    int flag)
@@ -1254,8 +1269,8 @@ static void balance_leaf_new_nodes(struct tree_balance *tb,
 }
 
 static void balance_leaf_finish_node_insert(struct tree_balance *tb,
-                                            struct item_head *ih,
-                                            const char *body)
+                                            struct item_head * const ih,
+                                            const char * const body)
 {
         struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
         struct buffer_info bi;
@@ -1271,8 +1286,8 @@ static void balance_leaf_finish_node_insert(struct tree_balance *tb,
 }
 
 static void balance_leaf_finish_node_paste_dirent(struct tree_balance *tb,
-                                                  struct item_head *ih,
-                                                  const char *body)
+                                                  struct item_head * const ih,
+                                                  const char * const body)
 {
         struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
         struct item_head *pasted = item_head(tbS0, tb->item_pos);
@@ -1305,8 +1320,8 @@ static void balance_leaf_finish_node_paste_dirent(struct tree_balance *tb,
 }
 
 static void balance_leaf_finish_node_paste(struct tree_balance *tb,
-                                           struct item_head *ih,
-                                           const char *body)
+                                           struct item_head * const ih,
+                                           const char * const body)
 {
         struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
         struct buffer_info bi;
@@ -1349,8 +1364,8 @@ static void balance_leaf_finish_node_paste(struct tree_balance *tb,
  * of the affected item which remains in S
  */
 static void balance_leaf_finish_node(struct tree_balance *tb,
-                                      struct item_head *ih,
-                                      const char *body, int flag)
+                                      struct item_head * const ih,
+                                      const char * const body, int flag)
 {
         /* if we must insert or append into buffer S[0] */
         if (0 <= tb->item_pos && tb->item_pos < tb->s0num) {
@@ -1402,7 +1417,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,
             && is_indirect_le_ih(item_head(tbS0, tb->item_pos)))
                 tb->pos_in_item *= UNFM_P_SIZE;
 
-        balance_leaf_left(tb, ih, body, flag);
+        body += balance_leaf_left(tb, ih, body, flag);
 
         /* tb->lnum[0] > 0 */
         /* Calculate new item position */
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index e8870de4627e..a88b1b3e7db3 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -1947,8 +1947,6 @@ static int do_journal_release(struct reiserfs_transaction_handle *th,
                 }
         }
 
-        /* wait for all commits to finish */
-        cancel_delayed_work(&SB_JOURNAL(sb)->j_work);
 
         /*
          * We must release the write lock here because
@@ -1956,8 +1954,14 @@ static int do_journal_release(struct reiserfs_transaction_handle *th,
          */
         reiserfs_write_unlock(sb);
 
+        /*
+         * Cancel flushing of old commits. Note that neither of these works
+         * will be requeued because superblock is being shutdown and doesn't
+         * have MS_ACTIVE set.
+         */
         cancel_delayed_work_sync(&REISERFS_SB(sb)->old_work);
-        flush_workqueue(REISERFS_SB(sb)->commit_wq);
+        /* wait for all commits to finish */
+        cancel_delayed_work_sync(&SB_JOURNAL(sb)->j_work);
 
         free_journal_ram(sb);
 
@@ -4292,9 +4296,15 @@ static int do_journal_end(struct reiserfs_transaction_handle *th, int flags)
         if (flush) {
                 flush_commit_list(sb, jl, 1);
                 flush_journal_list(sb, jl, 1);
-        } else if (!(jl->j_state & LIST_COMMIT_PENDING))
-                queue_delayed_work(REISERFS_SB(sb)->commit_wq,
-                                   &journal->j_work, HZ / 10);
+        } else if (!(jl->j_state & LIST_COMMIT_PENDING)) {
+                /*
+                 * Avoid queueing work when sb is being shut down. Transaction
+                 * will be flushed on journal shutdown.
+                 */
+                if (sb->s_flags & MS_ACTIVE)
+                        queue_delayed_work(REISERFS_SB(sb)->commit_wq,
+                                           &journal->j_work, HZ / 10);
+        }
 
         /*
          * if the next transaction has any chance of wrapping, flush
diff --git a/fs/reiserfs/lbalance.c b/fs/reiserfs/lbalance.c
index 814dda3ec998..249594a821e0 100644
--- a/fs/reiserfs/lbalance.c
+++ b/fs/reiserfs/lbalance.c
@@ -899,8 +899,9 @@ void leaf_delete_items(struct buffer_info *cur_bi, int last_first,
 
 /* insert item into the leaf node in position before */
 void leaf_insert_into_buf(struct buffer_info *bi, int before,
-                          struct item_head *inserted_item_ih,
-                          const char *inserted_item_body, int zeros_number)
+                          struct item_head * const inserted_item_ih,
+                          const char * const inserted_item_body,
+                          int zeros_number)
 {
         struct buffer_head *bh = bi->bi_bh;
         int nr, free_space;
diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h
index bf53888c7f59..735c2c2b4536 100644
--- a/fs/reiserfs/reiserfs.h
+++ b/fs/reiserfs/reiserfs.h
@@ -3216,11 +3216,12 @@ int leaf_shift_right(struct tree_balance *tb, int shift_num, int shift_bytes);
 void leaf_delete_items(struct buffer_info *cur_bi, int last_first, int first,
                        int del_num, int del_bytes);
 void leaf_insert_into_buf(struct buffer_info *bi, int before,
-                          struct item_head *inserted_item_ih,
-                          const char *inserted_item_body, int zeros_number);
-void leaf_paste_in_buffer(struct buffer_info *bi, int pasted_item_num,
-                          int pos_in_item, int paste_size, const char *body,
+                          struct item_head * const inserted_item_ih,
+                          const char * const inserted_item_body,
                           int zeros_number);
+void leaf_paste_in_buffer(struct buffer_info *bi, int pasted_item_num,
+                          int pos_in_item, int paste_size,
+                          const char * const body, int zeros_number);
 void leaf_cut_from_buffer(struct buffer_info *bi, int cut_item_num,
                           int pos_in_item, int cut_size);
 void leaf_paste_entries(struct buffer_info *bi, int item_num, int before,
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 709ea92d716f..d46e88a33b02 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -100,7 +100,11 @@ void reiserfs_schedule_old_flush(struct super_block *s)
         struct reiserfs_sb_info *sbi = REISERFS_SB(s);
         unsigned long delay;
 
-        if (s->s_flags & MS_RDONLY)
+        /*
+         * Avoid scheduling flush when sb is being shut down. It can race
+         * with journal shutdown and free still queued delayed work.
+         */
+        if (s->s_flags & MS_RDONLY || !(s->s_flags & MS_ACTIVE))
                 return;
 
         spin_lock(&sbi->old_work_lock);