Merge with /pub/scm/linux/kernel/git/torvalds/linux-2.6.git

Signed-off-by: Steve French <sfrench@us.ibm.com>

26 files changed, 337 insertions, 296 deletions

diff --git a/fs/Kconfig b/fs/Kconfig
index ef78e3a42d32..93b5dc4082ff 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -1327,7 +1327,7 @@ config UFS_FS
 
 config UFS_FS_WRITE
         bool "UFS file system write support (DANGEROUS)"
-        depends on UFS_FS && EXPERIMENTAL
+        depends on UFS_FS && EXPERIMENTAL && BROKEN
         help
           Say Y here if you want to try writing to UFS partitions. This is
           experimental, so you should back up your UFS partitions beforehand.
diff --git a/fs/bio.c b/fs/bio.c
index bbc442b8c867..1f3bb501c262 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -411,6 +411,7 @@ static int __bio_add_page(request_queue_t *q, struct bio *bio, struct page
 
 /**
  *      bio_add_pc_page -       attempt to add page to bio
+ *      @q: the target queue
  *      @bio: destination bio
  *      @page: page to add
  *      @len: vec entry length
diff --git a/fs/buffer.c b/fs/buffer.c
index 3dc712f29d2d..5e4a90ee103f 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1022,6 +1022,7 @@ try_again:
 
                 bh->b_state = 0;
                 atomic_set(&bh->b_count, 0);
+                bh->b_private = NULL;
                 bh->b_size = size;
 
                 /* Link the buffer to its page */
@@ -3050,6 +3051,66 @@ asmlinkage long sys_bdflush(int func, long data)
 }
 
 /*
+ * Migration function for pages with buffers. This function can only be used
+ * if the underlying filesystem guarantees that no other references to "page"
+ * exist.
+ */
+#ifdef CONFIG_MIGRATION
+int buffer_migrate_page(struct page *newpage, struct page *page)
+{
+        struct address_space *mapping = page->mapping;
+        struct buffer_head *bh, *head;
+
+        if (!mapping)
+                return -EAGAIN;
+
+        if (!page_has_buffers(page))
+                return migrate_page(newpage, page);
+
+        head = page_buffers(page);
+
+        if (migrate_page_remove_references(newpage, page, 3))
+                return -EAGAIN;
+
+        bh = head;
+        do {
+                get_bh(bh);
+                lock_buffer(bh);
+                bh = bh->b_this_page;
+
+        } while (bh != head);
+
+        ClearPagePrivate(page);
+        set_page_private(newpage, page_private(page));
+        set_page_private(page, 0);
+        put_page(page);
+        get_page(newpage);
+
+        bh = head;
+        do {
+                set_bh_page(bh, newpage, bh_offset(bh));
+                bh = bh->b_this_page;
+
+        } while (bh != head);
+
+        SetPagePrivate(newpage);
+
+        migrate_page_copy(newpage, page);
+
+        bh = head;
+        do {
+                unlock_buffer(bh);
+                put_bh(bh);
+                bh = bh->b_this_page;
+
+        } while (bh != head);
+
+        return 0;
+}
+EXPORT_SYMBOL(buffer_migrate_page);
+#endif
+
+/*
  * Buffer-head allocation
  */
 static kmem_cache_t *bh_cachep;
diff --git a/fs/compat.c b/fs/compat.c
index ff0bafcff720..cc58a20df57a 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1781,7 +1781,7 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
 {
         compat_sigset_t ss32;
         sigset_t ksigmask, sigsaved;
-        long timeout = MAX_SCHEDULE_TIMEOUT;
+        s64 timeout = MAX_SCHEDULE_TIMEOUT;
         struct compat_timespec ts;
         int ret;
 
diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
index e7d3f0522d01..a717837f272e 100644
--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -706,6 +706,7 @@ struct address_space_operations ext2_aops = {
         .bmap                   = ext2_bmap,
         .direct_IO              = ext2_direct_IO,
         .writepages             = ext2_writepages,
+        .migratepage            = buffer_migrate_page,
 };
 
 struct address_space_operations ext2_aops_xip = {
@@ -723,6 +724,7 @@ struct address_space_operations ext2_nobh_aops = {
         .bmap                   = ext2_bmap,
         .direct_IO              = ext2_direct_IO,
         .writepages             = ext2_writepages,
+        .migratepage            = buffer_migrate_page,
 };
 
 /*
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 8824e84f8a56..3fc4238e9703 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1559,6 +1559,7 @@ static struct address_space_operations ext3_ordered_aops = {
         .invalidatepage = ext3_invalidatepage,
         .releasepage    = ext3_releasepage,
         .direct_IO      = ext3_direct_IO,
+        .migratepage    = buffer_migrate_page,
 };
 
 static struct address_space_operations ext3_writeback_aops = {
@@ -1572,6 +1573,7 @@ static struct address_space_operations ext3_writeback_aops = {
         .invalidatepage = ext3_invalidatepage,
         .releasepage    = ext3_releasepage,
         .direct_IO      = ext3_direct_IO,
+        .migratepage    = buffer_migrate_page,
 };
 
 static struct address_space_operations ext3_journalled_aops = {
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index a7ef5e716f3c..296351615b00 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -335,9 +335,14 @@ static void fuse_send_readpages(struct fuse_req *req, struct file *file,
         loff_t pos = page_offset(req->pages[0]);
         size_t count = req->num_pages << PAGE_CACHE_SHIFT;
         req->out.page_zeroing = 1;
-        req->end = fuse_readpages_end;
         fuse_read_fill(req, file, inode, pos, count, FUSE_READ);
-        request_send_background(fc, req);
+        if (fc->async_read) {
+                req->end = fuse_readpages_end;
+                request_send_background(fc, req);
+        } else {
+                request_send(fc, req);
+                fuse_readpages_end(fc, req);
+        }
 }
 
 struct fuse_readpages_data {
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 46cf933aa3bf..4a83adfec968 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -272,6 +272,9 @@ struct fuse_conn {
             reply, before any other request, and never cleared */
         unsigned conn_error : 1;
 
+        /** Do readpages asynchronously?  Only set in INIT */
+        unsigned async_read : 1;
+
         /*
          * The following bitfields are only for optimization purposes
          * and hence races in setting them will not cause malfunction
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index c755a0440a66..879e6fba9480 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -473,6 +473,16 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
         if (req->out.h.error || arg->major != FUSE_KERNEL_VERSION)
                 fc->conn_error = 1;
         else {
+                unsigned long ra_pages;
+
+                if (arg->minor >= 6) {
+                        ra_pages = arg->max_readahead / PAGE_CACHE_SIZE;
+                        if (arg->flags & FUSE_ASYNC_READ)
+                                fc->async_read = 1;
+                } else
+                        ra_pages = fc->max_read / PAGE_CACHE_SIZE;
+
+                fc->bdi.ra_pages = min(fc->bdi.ra_pages, ra_pages);
                 fc->minor = arg->minor;
                 fc->max_write = arg->minor < 5 ? 4096 : arg->max_write;
         }
@@ -496,6 +506,8 @@ static void fuse_send_init(struct fuse_conn *fc)
 
         arg->major = FUSE_KERNEL_VERSION;
         arg->minor = FUSE_KERNEL_MINOR_VERSION;
+        arg->max_readahead = fc->bdi.ra_pages * PAGE_CACHE_SIZE;
+        arg->flags |= FUSE_ASYNC_READ;
         req->in.h.opcode = FUSE_INIT;
         req->in.numargs = 1;
         req->in.args[0].size = sizeof(*arg);
@@ -552,8 +564,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         fc->user_id = d.user_id;
         fc->group_id = d.group_id;
         fc->max_read = d.max_read;
-        if (fc->max_read / PAGE_CACHE_SIZE < fc->bdi.ra_pages)
-                fc->bdi.ra_pages = fc->max_read / PAGE_CACHE_SIZE;
 
         /* Used by get_root_inode() */
         sb->s_fs_info = fc;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index f568102da1e8..b35195289945 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -72,8 +72,8 @@ huge_pages_needed(struct address_space *mapping, struct vm_area_struct *vma)
         unsigned long start = vma->vm_start;
         unsigned long end = vma->vm_end;
         unsigned long hugepages = (end - start) >> HPAGE_SHIFT;
-        pgoff_t next = vma->vm_pgoff;
-        pgoff_t endpg = next + ((end - start) >> PAGE_SHIFT);
+        pgoff_t next = vma->vm_pgoff >> (HPAGE_SHIFT - PAGE_SHIFT);
+        pgoff_t endpg = next + hugepages;
 
         pagevec_init(&pvec, 0);
         while (next < endpg) {
diff --git a/fs/inode.c b/fs/inode.c
index 108138d4e909..d0be6159eb7f 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1179,7 +1179,7 @@ EXPORT_SYMBOL(bmap);
 /**
  *      touch_atime     -       update the access time
  *      @mnt: mount the inode is accessed on
- *      @inode: inode accessed
+ *      @dentry: dentry accessed
  *
  *      Update the accessed time on an inode and mark it for writeback.
  *      This function automatically handles read only file systems and media,
diff --git a/fs/namei.c b/fs/namei.c
index 4acdac043b6b..7ac9fb4acb2c 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1161,6 +1161,7 @@ static int __path_lookup_intent_open(int dfd, const char *name,
 
 /**
  * path_lookup_open - lookup a file path with open intent
+ * @dfd: the directory to use as base, or AT_FDCWD
  * @name: pointer to file name
  * @lookup_flags: lookup intent flags
  * @nd: pointer to nameidata
@@ -1175,6 +1176,7 @@ int path_lookup_open(int dfd, const char *name, unsigned int lookup_flags,
 
 /**
  * path_lookup_create - lookup a file path with open + create intent
+ * @dfd: the directory to use as base, or AT_FDCWD
  * @name: pointer to file name
  * @lookup_flags: lookup intent flags
  * @nd: pointer to nameidata
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 89ed04696865..1d163b616915 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -64,6 +64,32 @@ struct nfsd_list {
 };
 static struct list_head nfsd_list = LIST_HEAD_INIT(nfsd_list);
 
+#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
+static struct svc_stat  nfsd_acl_svcstats;
+static struct svc_version *     nfsd_acl_version[] = {
+        [2] = &nfsd_acl_version2,
+        [3] = &nfsd_acl_version3,
+};
+
+#define NFSD_ACL_MINVERS            2
+#define NFSD_ACL_NRVERS         (sizeof(nfsd_acl_version)/sizeof(nfsd_acl_version[0]))
+static struct svc_version *nfsd_acl_versions[NFSD_ACL_NRVERS];
+
+static struct svc_program       nfsd_acl_program = {
+        .pg_prog                = NFS_ACL_PROGRAM,
+        .pg_nvers               = NFSD_ACL_NRVERS,
+        .pg_vers                = nfsd_acl_versions,
+        .pg_name                = "nfsd",
+        .pg_class               = "nfsd",
+        .pg_stats               = &nfsd_acl_svcstats,
+        .pg_authenticate        = &svc_set_client,
+};
+
+static struct svc_stat  nfsd_acl_svcstats = {
+        .program        = &nfsd_acl_program,
+};
+#endif /* defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) */
+
 static struct svc_version *     nfsd_version[] = {
         [2] = &nfsd_version2,
 #if defined(CONFIG_NFSD_V3)
@@ -79,6 +105,9 @@ static struct svc_version *	nfsd_version[] = {
 static struct svc_version *nfsd_versions[NFSD_NRVERS];
 
 struct svc_program              nfsd_program = {
+#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
+        .pg_next                = &nfsd_acl_program,
+#endif
         .pg_prog                = NFS_PROGRAM,          /* program number */
         .pg_nvers               = NFSD_NRVERS,          /* nr of entries in nfsd_version */
         .pg_vers                = nfsd_versions,        /* version table */
@@ -147,6 +176,26 @@ nfsd_svc(unsigned short port, int nrservs)
                                 nfsd_program.pg_vers[i] = nfsd_version[i];
                 }
 
+
+#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
+                found_one = 0;
+
+                for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++) {
+                        if (NFSCTL_VERISSET(nfsd_versbits, i)) {
+                                nfsd_acl_program.pg_vers[i] =
+                                        nfsd_acl_version[i];
+                                found_one = 1;
+                        } else
+                                nfsd_acl_program.pg_vers[i] = NULL;
+                }
+
+                if (!found_one) {
+                        for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++)
+                                nfsd_acl_program.pg_vers[i] =
+                                        nfsd_acl_version[i];
+                }
+#endif
+
                 atomic_set(&nfsd_busy, 0);
                 error = -ENOMEM;
                 nfsd_serv = svc_create(&nfsd_program, NFSD_BUFSIZE);
@@ -411,30 +460,3 @@ nfsd_dispatch(struct svc_rqst *rqstp, u32 *statp)
         nfsd_cache_update(rqstp, proc->pc_cachetype, statp + 1);
         return 1;
 }
-
-#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
-static struct svc_stat  nfsd_acl_svcstats;
-static struct svc_version *     nfsd_acl_version[] = {
-        [2] = &nfsd_acl_version2,
-        [3] = &nfsd_acl_version3,
-};
-
-#define NFSD_ACL_NRVERS         (sizeof(nfsd_acl_version)/sizeof(nfsd_acl_version[0]))
-static struct svc_program       nfsd_acl_program = {
-        .pg_prog                = NFS_ACL_PROGRAM,
-        .pg_nvers               = NFSD_ACL_NRVERS,
-        .pg_vers                = nfsd_acl_version,
-        .pg_name                = "nfsd",
-        .pg_class               = "nfsd",
-        .pg_stats               = &nfsd_acl_svcstats,
-        .pg_authenticate        = &svc_set_client,
-};
-
-static struct svc_stat  nfsd_acl_svcstats = {
-        .program        = &nfsd_acl_program,
-};
-
-#define nfsd_acl_program_p      &nfsd_acl_program
-#else
-#define nfsd_acl_program_p      NULL
-#endif /* defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) */
diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
index 9dd71e807034..d71ac6579289 100644
--- a/fs/reiserfs/dir.c
+++ b/fs/reiserfs/dir.c
@@ -150,18 +150,15 @@ static int reiserfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                                 if (d_reclen <= 32) {
                                         local_buf = small_buf;
                                 } else {
-                                        local_buf =
-                                            reiserfs_kmalloc(d_reclen, GFP_NOFS,
-                                                             inode->i_sb);
+                                        local_buf = kmalloc(d_reclen,
+                                                            GFP_NOFS);
                                         if (!local_buf) {
                                                 pathrelse(&path_to_entry);
                                                 ret = -ENOMEM;
                                                 goto out;
                                         }
                                         if (item_moved(&tmp_ih, &path_to_entry)) {
-                                                reiserfs_kfree(local_buf,
-                                                               d_reclen,
-                                                               inode->i_sb);
+                                                kfree(local_buf);
                                                 goto research;
                                         }
                                 }
@@ -174,15 +171,12 @@ static int reiserfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                                     (dirent, local_buf, d_reclen, d_off, d_ino,
                                      DT_UNKNOWN) < 0) {
                                         if (local_buf != small_buf) {
-                                                reiserfs_kfree(local_buf,
-                                                               d_reclen,
-                                                               inode->i_sb);
+                                                kfree(local_buf);
                                         }
                                         goto end;
                                 }
                                 if (local_buf != small_buf) {
-                                        reiserfs_kfree(local_buf, d_reclen,
-                                                       inode->i_sb);
+                                        kfree(local_buf);
                                 }
                                 // next entry should be looked for with such offset
                                 next_pos = deh_offset(deh) + 1;
diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c
index ad6fa964b0e7..f3473176c83a 100644
--- a/fs/reiserfs/file.c
+++ b/fs/reiserfs/file.c
@@ -192,6 +192,8 @@ static int reiserfs_allocate_blocks_for_region(struct reiserfs_transaction_handl
 
         allocated_blocks = kmalloc((blocks_to_allocate + will_prealloc) *
                                    sizeof(b_blocknr_t), GFP_NOFS);
+        if (!allocated_blocks)
+                return -ENOMEM;
 
         /* First we compose a key to point at the writing position, we want to do
            that outside of any locking region. */
@@ -1285,6 +1287,23 @@ static ssize_t reiserfs_file_write(struct file *file,	/* the file we are going t
         struct reiserfs_transaction_handle th;
         th.t_trans_id = 0;
 
+        /* If a filesystem is converted from 3.5 to 3.6, we'll have v3.5 items
+        * lying around (most of the disk, in fact). Despite the filesystem
+        * now being a v3.6 format, the old items still can't support large
+        * file sizes. Catch this case here, as the rest of the VFS layer is
+        * oblivious to the different limitations between old and new items.
+        * reiserfs_setattr catches this for truncates. This chunk is lifted
+        * from generic_write_checks. */
+        if (get_inode_item_key_version (inode) == KEY_FORMAT_3_5 &&
+            *ppos + count > MAX_NON_LFS) {
+                if (*ppos >= MAX_NON_LFS) {
+                        send_sig(SIGXFSZ, current, 0);
+                        return -EFBIG;
+                }
+                if (count > MAX_NON_LFS - (unsigned long)*ppos)
+                        count = MAX_NON_LFS - (unsigned long)*ppos;
+        }
+
         if (file->f_flags & O_DIRECT) { // Direct IO needs treatment
                 ssize_t result, after_file_end = 0;
                 if ((*ppos + count >= inode->i_size)
diff --git a/fs/reiserfs/fix_node.c b/fs/reiserfs/fix_node.c
index 45829889dcdc..aa22588019ec 100644
--- a/fs/reiserfs/fix_node.c
+++ b/fs/reiserfs/fix_node.c
@@ -2021,38 +2021,6 @@ static int get_neighbors(struct tree_balance *p_s_tb, int n_h)
         return CARRY_ON;
 }
 
-#ifdef CONFIG_REISERFS_CHECK
-void *reiserfs_kmalloc(size_t size, gfp_t flags, struct super_block *s)
-{
-        void *vp;
-        static size_t malloced;
-
-        vp = kmalloc(size, flags);
-        if (vp) {
-                REISERFS_SB(s)->s_kmallocs += size;
-                if (REISERFS_SB(s)->s_kmallocs > malloced + 200000) {
-                        reiserfs_warning(s,
-                                         "vs-8301: reiserfs_kmalloc: allocated memory %d",
-                                         REISERFS_SB(s)->s_kmallocs);
-                        malloced = REISERFS_SB(s)->s_kmallocs;
-                }
-        }
-        return vp;
-}
-
-void reiserfs_kfree(const void *vp, size_t size, struct super_block *s)
-{
-        kfree(vp);
-
-        REISERFS_SB(s)->s_kmallocs -= size;
-        if (REISERFS_SB(s)->s_kmallocs < 0)
-                reiserfs_warning(s,
-                                 "vs-8302: reiserfs_kfree: allocated memory %d",
-                                 REISERFS_SB(s)->s_kmallocs);
-
-}
-#endif
-
 static int get_virtual_node_size(struct super_block *sb, struct buffer_head *bh)
 {
         int max_num_of_items;
@@ -2086,7 +2054,7 @@ static int get_mem_for_virtual_node(struct tree_balance *tb)
                 /* we have to allocate more memory for virtual node */
                 if (tb->vn_buf) {
                         /* free memory allocated before */
-                        reiserfs_kfree(tb->vn_buf, tb->vn_buf_size, tb->tb_sb);
+                        kfree(tb->vn_buf);
                         /* this is not needed if kfree is atomic */
                         check_fs = 1;
                 }
@@ -2095,24 +2063,15 @@ static int get_mem_for_virtual_node(struct tree_balance *tb)
                 tb->vn_buf_size = size;
 
                 /* get memory for virtual item */
-                buf =
-                    reiserfs_kmalloc(size, GFP_ATOMIC | __GFP_NOWARN,
-                                     tb->tb_sb);
+                buf = kmalloc(size, GFP_ATOMIC | __GFP_NOWARN);
                 if (!buf) {
                         /* getting memory with GFP_KERNEL priority may involve
                            balancing now (due to indirect_to_direct conversion on
                            dcache shrinking). So, release path and collected
                            resources here */
                         free_buffers_in_tb(tb);
-                        buf = reiserfs_kmalloc(size, GFP_NOFS, tb->tb_sb);
+                        buf = kmalloc(size, GFP_NOFS);
                         if (!buf) {
-#ifdef CONFIG_REISERFS_CHECK
-                                reiserfs_warning(tb->tb_sb,
-                                                 "vs-8345: get_mem_for_virtual_node: "
-                                                 "kmalloc failed. reiserfs kmalloced %d bytes",
-                                                 REISERFS_SB(tb->tb_sb)->
-                                                 s_kmallocs);
-#endif
                                 tb->vn_buf_size = 0;
                         }
                         tb->vn_buf = buf;
@@ -2619,7 +2578,6 @@ void unfix_nodes(struct tree_balance *tb)
                 }
         }
 
-        if (tb->vn_buf)
-                reiserfs_kfree(tb->vn_buf, tb->vn_buf_size, tb->tb_sb);
+        kfree(tb->vn_buf);
 
 }
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index ffa34b861bdb..b33d67bba2fd 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -2363,6 +2363,13 @@ static int reiserfs_write_full_page(struct page *page,
         int bh_per_page = PAGE_CACHE_SIZE / s->s_blocksize;
         th.t_trans_id = 0;
 
+        /* no logging allowed when nonblocking or from PF_MEMALLOC */
+        if (checked && (current->flags & PF_MEMALLOC)) {
+                redirty_page_for_writepage(wbc, page);
+                unlock_page(page);
+                return 0;
+        }
+
         /* The page dirty bit is cleared before writepage is called, which
          * means we have to tell create_empty_buffers to make dirty buffers
          * The page really should be up to date at this point, so tossing
@@ -2743,6 +2750,7 @@ static int invalidatepage_can_drop(struct inode *inode, struct buffer_head *bh)
         int ret = 1;
         struct reiserfs_journal *j = SB_JOURNAL(inode->i_sb);
 
+        lock_buffer(bh);
         spin_lock(&j->j_dirty_buffers_lock);
         if (!buffer_mapped(bh)) {
                 goto free_jh;
@@ -2758,7 +2766,7 @@ static int invalidatepage_can_drop(struct inode *inode, struct buffer_head *bh)
                 if (buffer_journaled(bh) || buffer_journal_dirty(bh)) {
                         ret = 0;
                 }
-        } else if (buffer_dirty(bh) || buffer_locked(bh)) {
+        } else  if (buffer_dirty(bh)) {
                 struct reiserfs_journal_list *jl;
                 struct reiserfs_jh *jh = bh->b_private;
 
@@ -2784,6 +2792,7 @@ static int invalidatepage_can_drop(struct inode *inode, struct buffer_head *bh)
                 reiserfs_free_jh(bh);
         }
         spin_unlock(&j->j_dirty_buffers_lock);
+        unlock_buffer(bh);
         return ret;
 }
 
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 4491fcf2a0e6..b7a179560ab4 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -152,18 +152,16 @@ static struct reiserfs_bitmap_node *allocate_bitmap_node(struct super_block
         struct reiserfs_bitmap_node *bn;
         static int id;
 
-        bn = reiserfs_kmalloc(sizeof(struct reiserfs_bitmap_node), GFP_NOFS,
-                              p_s_sb);
+        bn = kmalloc(sizeof(struct reiserfs_bitmap_node), GFP_NOFS);
         if (!bn) {
                 return NULL;
         }
-        bn->data = reiserfs_kmalloc(p_s_sb->s_blocksize, GFP_NOFS, p_s_sb);
+        bn->data = kzalloc(p_s_sb->s_blocksize, GFP_NOFS);
         if (!bn->data) {
-                reiserfs_kfree(bn, sizeof(struct reiserfs_bitmap_node), p_s_sb);
+                kfree(bn);
                 return NULL;
         }
         bn->id = id++;
-        memset(bn->data, 0, p_s_sb->s_blocksize);
         INIT_LIST_HEAD(&bn->list);
         return bn;
 }
@@ -197,8 +195,8 @@ static inline void free_bitmap_node(struct super_block *p_s_sb,
         struct reiserfs_journal *journal = SB_JOURNAL(p_s_sb);
         journal->j_used_bitmap_nodes--;
         if (journal->j_free_bitmap_nodes > REISERFS_MAX_BITMAP_NODES) {
-                reiserfs_kfree(bn->data, p_s_sb->s_blocksize, p_s_sb);
-                reiserfs_kfree(bn, sizeof(struct reiserfs_bitmap_node), p_s_sb);
+                kfree(bn->data);
+                kfree(bn);
         } else {
                 list_add(&bn->list, &journal->j_bitmap_nodes);
                 journal->j_free_bitmap_nodes++;
@@ -276,8 +274,8 @@ static int free_bitmap_nodes(struct super_block *p_s_sb)
         while (next != &journal->j_bitmap_nodes) {
                 bn = list_entry(next, struct reiserfs_bitmap_node, list);
                 list_del(next);
-                reiserfs_kfree(bn->data, p_s_sb->s_blocksize, p_s_sb);
-                reiserfs_kfree(bn, sizeof(struct reiserfs_bitmap_node), p_s_sb);
+                kfree(bn->data);
+                kfree(bn);
                 next = journal->j_bitmap_nodes.next;
                 journal->j_free_bitmap_nodes--;
         }
@@ -581,7 +579,7 @@ static inline void put_journal_list(struct super_block *s,
                                jl->j_trans_id, jl->j_refcount);
         }
         if (--jl->j_refcount == 0)
-                reiserfs_kfree(jl, sizeof(struct reiserfs_journal_list), s);
+                kfree(jl);
 }
 
 /*
@@ -848,6 +846,14 @@ static int write_ordered_buffers(spinlock_t * lock,
                         spin_lock(lock);
                         goto loop_next;
                 }
+                /* in theory, dirty non-uptodate buffers should never get here,
+                 * but the upper layer io error paths still have a few quirks.
+                 * Handle them here as gracefully as we can
+                 */
+                if (!buffer_uptodate(bh) && buffer_dirty(bh)) {
+                        clear_buffer_dirty(bh);
+                        ret = -EIO;
+                }
                 if (buffer_dirty(bh)) {
                         list_del_init(&jh->list);
                         list_add(&jh->list, &tmp);
@@ -879,6 +885,19 @@ static int write_ordered_buffers(spinlock_t * lock,
                 if (!buffer_uptodate(bh)) {
                         ret = -EIO;
                 }
+                /* ugly interaction with invalidatepage here.
+                 * reiserfs_invalidate_page will pin any buffer that has a valid
+                 * journal head from an older transaction.  If someone else sets
+                 * our buffer dirty after we write it in the first loop, and
+                 * then someone truncates the page away, nobody will ever write
+                 * the buffer. We're safe if we write the page one last time
+                 * after freeing the journal header.
+                 */
+                if (buffer_dirty(bh) && unlikely(bh->b_page->mapping == NULL)) {
+                        spin_unlock(lock);
+                        ll_rw_block(WRITE, 1, &bh);
+                        spin_lock(lock);
+                }
                 put_bh(bh);
                 cond_resched_lock(lock);
         }
@@ -977,6 +996,7 @@ static int flush_commit_list(struct super_block *s,
         struct reiserfs_journal *journal = SB_JOURNAL(s);
         int barrier = 0;
         int retval = 0;
+        int write_len;
 
         reiserfs_check_lock_depth(s, "flush_commit_list");
 
@@ -1018,24 +1038,35 @@ static int flush_commit_list(struct super_block *s,
         }
 
         if (!list_empty(&jl->j_bh_list)) {
+                int ret;
                 unlock_kernel();
-                write_ordered_buffers(&journal->j_dirty_buffers_lock,
-                                      journal, jl, &jl->j_bh_list);
+                ret = write_ordered_buffers(&journal->j_dirty_buffers_lock,
+                                            journal, jl, &jl->j_bh_list);
+                if (ret < 0 && retval == 0)
+                        retval = ret;
                 lock_kernel();
         }
         BUG_ON(!list_empty(&jl->j_bh_list));
         /*
          * for the description block and all the log blocks, submit any buffers
-         * that haven't already reached the disk
+         * that haven't already reached the disk.  Try to write at least 256
+         * log blocks. later on, we will only wait on blocks that correspond
+         * to this transaction, but while we're unplugging we might as well
+         * get a chunk of data on there.
          */
         atomic_inc(&journal->j_async_throttle);
-        for (i = 0; i < (jl->j_len + 1); i++) {
+        write_len = jl->j_len + 1;
+        if (write_len < 256)
+                write_len = 256;
+        for (i = 0 ; i < write_len ; i++) {
                 bn = SB_ONDISK_JOURNAL_1st_BLOCK(s) + (jl->j_start + i) %
                     SB_ONDISK_JOURNAL_SIZE(s);
                 tbh = journal_find_get_block(s, bn);
-                if (buffer_dirty(tbh))  /* redundant, ll_rw_block() checks */
-                        ll_rw_block(SWRITE, 1, &tbh);
-                put_bh(tbh);
+                if (tbh) {
+                        if (buffer_dirty(tbh))
+                            ll_rw_block(WRITE, 1, &tbh) ;
+                        put_bh(tbh) ;
+                }
         }
         atomic_dec(&journal->j_async_throttle);
 
@@ -1818,8 +1849,7 @@ void remove_journal_hash(struct super_block *sb,
 static void free_journal_ram(struct super_block *p_s_sb)
 {
         struct reiserfs_journal *journal = SB_JOURNAL(p_s_sb);
-        reiserfs_kfree(journal->j_current_jl,
-                       sizeof(struct reiserfs_journal_list), p_s_sb);
+        kfree(journal->j_current_jl);
         journal->j_num_lists--;
 
         vfree(journal->j_cnode_free_orig);
@@ -2093,21 +2123,15 @@ static int journal_read_transaction(struct super_block *p_s_sb,
         }
         trans_id = get_desc_trans_id(desc);
         /* now we know we've got a good transaction, and it was inside the valid time ranges */
-        log_blocks =
-            reiserfs_kmalloc(get_desc_trans_len(desc) *
-                             sizeof(struct buffer_head *), GFP_NOFS, p_s_sb);
-        real_blocks =
-            reiserfs_kmalloc(get_desc_trans_len(desc) *
-                             sizeof(struct buffer_head *), GFP_NOFS, p_s_sb);
+        log_blocks = kmalloc(get_desc_trans_len(desc) *
+                             sizeof(struct buffer_head *), GFP_NOFS);
+        real_blocks = kmalloc(get_desc_trans_len(desc) *
+                              sizeof(struct buffer_head *), GFP_NOFS);
         if (!log_blocks || !real_blocks) {
                 brelse(c_bh);
                 brelse(d_bh);
-                reiserfs_kfree(log_blocks,
-                               get_desc_trans_len(desc) *
-                               sizeof(struct buffer_head *), p_s_sb);
-                reiserfs_kfree(real_blocks,
-                               get_desc_trans_len(desc) *
-                               sizeof(struct buffer_head *), p_s_sb);
+                kfree(log_blocks);
+                kfree(real_blocks);
                 reiserfs_warning(p_s_sb,
                                  "journal-1169: kmalloc failed, unable to mount FS");
                 return -1;
@@ -2145,12 +2169,8 @@ static int journal_read_transaction(struct super_block *p_s_sb,
                         brelse_array(real_blocks, i);
                         brelse(c_bh);
                         brelse(d_bh);
-                        reiserfs_kfree(log_blocks,
-                                       get_desc_trans_len(desc) *
-                                       sizeof(struct buffer_head *), p_s_sb);
-                        reiserfs_kfree(real_blocks,
-                                       get_desc_trans_len(desc) *
-                                       sizeof(struct buffer_head *), p_s_sb);
+                        kfree(log_blocks);
+                        kfree(real_blocks);
                         return -1;
                 }
         }
@@ -2166,12 +2186,8 @@ static int journal_read_transaction(struct super_block *p_s_sb,
                         brelse_array(real_blocks, get_desc_trans_len(desc));
                         brelse(c_bh);
                         brelse(d_bh);
-                        reiserfs_kfree(log_blocks,
-                                       get_desc_trans_len(desc) *
-                                       sizeof(struct buffer_head *), p_s_sb);
-                        reiserfs_kfree(real_blocks,
-                                       get_desc_trans_len(desc) *
-                                       sizeof(struct buffer_head *), p_s_sb);
+                        kfree(log_blocks);
+                        kfree(real_blocks);
                         return -1;
                 }
                 memcpy(real_blocks[i]->b_data, log_blocks[i]->b_data,
@@ -2193,12 +2209,8 @@ static int journal_read_transaction(struct super_block *p_s_sb,
                                      get_desc_trans_len(desc) - i);
                         brelse(c_bh);
                         brelse(d_bh);
-                        reiserfs_kfree(log_blocks,
-                                       get_desc_trans_len(desc) *
-                                       sizeof(struct buffer_head *), p_s_sb);
-                        reiserfs_kfree(real_blocks,
-                                       get_desc_trans_len(desc) *
-                                       sizeof(struct buffer_head *), p_s_sb);
+                        kfree(log_blocks);
+                        kfree(real_blocks);
                         return -1;
                 }
                 brelse(real_blocks[i]);
@@ -2217,12 +2229,8 @@ static int journal_read_transaction(struct super_block *p_s_sb,
         journal->j_trans_id = trans_id + 1;
         brelse(c_bh);
         brelse(d_bh);
-        reiserfs_kfree(log_blocks,
-                       le32_to_cpu(desc->j_len) * sizeof(struct buffer_head *),
-                       p_s_sb);
-        reiserfs_kfree(real_blocks,
-                       le32_to_cpu(desc->j_len) * sizeof(struct buffer_head *),
-                       p_s_sb);
+        kfree(log_blocks);
+        kfree(real_blocks);
         return 0;
 }
 
@@ -2471,14 +2479,8 @@ static int journal_read(struct super_block *p_s_sb)
 static struct reiserfs_journal_list *alloc_journal_list(struct super_block *s)
 {
         struct reiserfs_journal_list *jl;
-      retry:
-        jl = reiserfs_kmalloc(sizeof(struct reiserfs_journal_list), GFP_NOFS,
-                              s);
-        if (!jl) {
-                yield();
-                goto retry;
-        }
-        memset(jl, 0, sizeof(*jl));
+        jl = kzalloc(sizeof(struct reiserfs_journal_list),
+                     GFP_NOFS | __GFP_NOFAIL);
         INIT_LIST_HEAD(&jl->j_list);
         INIT_LIST_HEAD(&jl->j_working_list);
         INIT_LIST_HEAD(&jl->j_tail_bh_list);
@@ -2821,6 +2823,9 @@ int journal_transaction_should_end(struct reiserfs_transaction_handle *th,
             journal->j_cnode_free < (journal->j_trans_max * 3)) {
                 return 1;
         }
+        /* protected by the BKL here */
+        journal->j_len_alloc += new_alloc;
+        th->t_blocks_allocated += new_alloc ;
         return 0;
 }
 
@@ -3042,14 +3047,12 @@ struct reiserfs_transaction_handle *reiserfs_persistent_transaction(struct
                 }
                 return th;
         }
-        th = reiserfs_kmalloc(sizeof(struct reiserfs_transaction_handle),
-                              GFP_NOFS, s);
+        th = kmalloc(sizeof(struct reiserfs_transaction_handle), GFP_NOFS);
         if (!th)
                 return NULL;
         ret = journal_begin(th, s, nblocks);
         if (ret) {
-                reiserfs_kfree(th, sizeof(struct reiserfs_transaction_handle),
-                               s);
+                kfree(th);
                 return NULL;
         }
 
@@ -3067,8 +3070,7 @@ int reiserfs_end_persistent_transaction(struct reiserfs_transaction_handle *th)
                 ret = -EIO;
         if (th->t_refcount == 0) {
                 SB_JOURNAL(s)->j_persistent_trans--;
-                reiserfs_kfree(th, sizeof(struct reiserfs_transaction_handle),
-                               s);
+                kfree(th);
         }
         return ret;
 }
diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
index 8f8d8d01107c..c8123308e060 100644
--- a/fs/reiserfs/namei.c
+++ b/fs/reiserfs/namei.c
@@ -456,7 +456,7 @@ static int reiserfs_add_entry(struct reiserfs_transaction_handle *th,
         /* get memory for composing the entry */
         buflen = DEH_SIZE + ROUND_UP(namelen);
         if (buflen > sizeof(small_buf)) {
-                buffer = reiserfs_kmalloc(buflen, GFP_NOFS, dir->i_sb);
+                buffer = kmalloc(buflen, GFP_NOFS);
                 if (buffer == 0)
                         return -ENOMEM;
         } else
@@ -490,7 +490,7 @@ static int reiserfs_add_entry(struct reiserfs_transaction_handle *th,
         retval = reiserfs_find_entry(dir, name, namelen, &path, &de);
         if (retval != NAME_NOT_FOUND) {
                 if (buffer != small_buf)
-                        reiserfs_kfree(buffer, buflen, dir->i_sb);
+                        kfree(buffer);
                 pathrelse(&path);
 
                 if (retval == IO_ERROR) {
@@ -515,7 +515,7 @@ static int reiserfs_add_entry(struct reiserfs_transaction_handle *th,
                 reiserfs_warning(dir->i_sb,
                                  "reiserfs_add_entry: Congratulations! we have got hash function screwed up");
                 if (buffer != small_buf)
-                        reiserfs_kfree(buffer, buflen, dir->i_sb);
+                        kfree(buffer);
                 pathrelse(&path);
                 return -EBUSY;
         }
@@ -535,7 +535,7 @@ static int reiserfs_add_entry(struct reiserfs_transaction_handle *th,
                                          &entry_key);
 
                         if (buffer != small_buf)
-                                reiserfs_kfree(buffer, buflen, dir->i_sb);
+                                kfree(buffer);
                         pathrelse(&path);
                         return -EBUSY;
                 }
@@ -546,7 +546,7 @@ static int reiserfs_add_entry(struct reiserfs_transaction_handle *th,
             reiserfs_paste_into_item(th, &path, &entry_key, dir, buffer,
                                      paste_size);
         if (buffer != small_buf)
-                reiserfs_kfree(buffer, buflen, dir->i_sb);
+                kfree(buffer);
         if (retval) {
                 reiserfs_check_path(&path);
                 return retval;
@@ -1065,7 +1065,7 @@ static int reiserfs_symlink(struct inode *parent_dir,
                 goto out_failed;
         }
 
-        name = reiserfs_kmalloc(item_len, GFP_NOFS, parent_dir->i_sb);
+        name = kmalloc(item_len, GFP_NOFS);
         if (!name) {
                 drop_new_inode(inode);
                 retval = -ENOMEM;
@@ -1079,14 +1079,14 @@ static int reiserfs_symlink(struct inode *parent_dir,
         retval = journal_begin(&th, parent_dir->i_sb, jbegin_count);
         if (retval) {
                 drop_new_inode(inode);
-                reiserfs_kfree(name, item_len, parent_dir->i_sb);
+                kfree(name);
                 goto out_failed;
         }
 
         retval =
             reiserfs_new_inode(&th, parent_dir, mode, name, strlen(symname),
                                dentry, inode);
-        reiserfs_kfree(name, item_len, parent_dir->i_sb);
+        kfree(name);
         if (retval) {           /* reiserfs_new_inode iputs for us */
                 goto out_failed;
         }
diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
index fc2f43c75df4..ef6caed9336b 100644
--- a/fs/reiserfs/procfs.c
+++ b/fs/reiserfs/procfs.c
@@ -88,7 +88,6 @@ static int show_super(struct seq_file *m, struct super_block *sb)
         seq_printf(m, "state: \t%s\n"
                    "mount options: \t%s%s%s%s%s%s%s%s%s%s%s\n"
                    "gen. counter: \t%i\n"
-                   "s_kmallocs: \t%i\n"
                    "s_disk_reads: \t%i\n"
                    "s_disk_writes: \t%i\n"
                    "s_fix_nodes: \t%i\n"
@@ -128,7 +127,7 @@ static int show_super(struct seq_file *m, struct super_block *sb)
                    "SMALL_TAILS " : "NO_TAILS ",
                    replay_only(sb) ? "REPLAY_ONLY " : "",
                    convert_reiserfs(sb) ? "CONV " : "",
-                   atomic_read(&r->s_generation_counter), SF(s_kmallocs),
+                   atomic_read(&r->s_generation_counter),
                    SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
                    SF(s_do_balance), SF(s_unneeded_left_neighbor),
                    SF(s_good_search_by_key_reada), SF(s_bmaps),
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 397d9590c8f2..77891de0e02e 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -472,12 +472,6 @@ static void reiserfs_put_super(struct super_block *s)
 
         print_statistics(s);
 
-        if (REISERFS_SB(s)->s_kmallocs != 0) {
-                reiserfs_warning(s,
-                                 "vs-2004: reiserfs_put_super: allocated memory left %d",
-                                 REISERFS_SB(s)->s_kmallocs);
-        }
-
         if (REISERFS_SB(s)->reserved_blocks != 0) {
                 reiserfs_warning(s,
                                  "green-2005: reiserfs_put_super: reserved blocks left %d",
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index cc061bfd437b..ffb79c48c5bf 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -368,15 +368,13 @@ static int __xattr_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 if (d_reclen <= 32) {
                         local_buf = small_buf;
                 } else {
-                        local_buf =
-                            reiserfs_kmalloc(d_reclen, GFP_NOFS, inode->i_sb);
+                        local_buf = kmalloc(d_reclen, GFP_NOFS);
                         if (!local_buf) {
                                 pathrelse(&path_to_entry);
                                 return -ENOMEM;
                         }
                         if (item_moved(&tmp_ih, &path_to_entry)) {
-                                reiserfs_kfree(local_buf, d_reclen,
-                                               inode->i_sb);
+                                kfree(local_buf);
 
                                 /* sigh, must retry.  Do this same offset again */
                                 next_pos = d_off;
@@ -399,13 +397,12 @@ static int __xattr_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 if (filldir(dirent, local_buf, d_reclen, d_off, d_ino,
                             DT_UNKNOWN) < 0) {
                         if (local_buf != small_buf) {
-                                reiserfs_kfree(local_buf, d_reclen,
-                                               inode->i_sb);
+                                kfree(local_buf);
                         }
                         goto end;
                 }
                 if (local_buf != small_buf) {
-                        reiserfs_kfree(local_buf, d_reclen, inode->i_sb);
+                        kfree(local_buf);
                 }
         }                       /* while */
 
@@ -1322,109 +1319,44 @@ int reiserfs_xattr_init(struct super_block *s, int mount_flags)
         return err;
 }
 
-static int
-__reiserfs_permission(struct inode *inode, int mask, struct nameidata *nd,
-                      int need_lock)
+static int reiserfs_check_acl(struct inode *inode, int mask)
 {
-        umode_t mode = inode->i_mode;
-
-        if (mask & MAY_WRITE) {
-                /*
-                 * Nobody gets write access to a read-only fs.
-                 */
-                if (IS_RDONLY(inode) &&
-                    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
-                        return -EROFS;
+        struct posix_acl *acl;
+        int error = -EAGAIN; /* do regular unix permission checks by default */
 
-                /*
-                 * Nobody gets write access to an immutable file.
-                 */
-                if (IS_IMMUTABLE(inode))
-                        return -EACCES;
-        }
+        reiserfs_read_lock_xattr_i(inode);
+        reiserfs_read_lock_xattrs(inode->i_sb);
 
-        /* We don't do permission checks on the internal objects.
-         * Permissions are determined by the "owning" object. */
-        if (is_reiserfs_priv_object(inode))
-                return 0;
+        acl = reiserfs_get_acl(inode, ACL_TYPE_ACCESS);
 
-        if (current->fsuid == inode->i_uid) {
-                mode >>= 6;
-#ifdef CONFIG_REISERFS_FS_POSIX_ACL
-        } else if (reiserfs_posixacl(inode->i_sb) &&
-                   get_inode_sd_version(inode) != STAT_DATA_V1) {
-                struct posix_acl *acl;
-
-                /* ACL can't contain additional permissions if
-                   the ACL_MASK entry is 0 */
-                if (!(mode & S_IRWXG))
-                        goto check_groups;
-
-                if (need_lock) {
-                        reiserfs_read_lock_xattr_i(inode);
-                        reiserfs_read_lock_xattrs(inode->i_sb);
-                }
-                acl = reiserfs_get_acl(inode, ACL_TYPE_ACCESS);
-                if (need_lock) {
-                        reiserfs_read_unlock_xattrs(inode->i_sb);
-                        reiserfs_read_unlock_xattr_i(inode);
-                }
-                if (IS_ERR(acl)) {
-                        if (PTR_ERR(acl) == -ENODATA)
-                                goto check_groups;
-                        return PTR_ERR(acl);
-                }
+        reiserfs_read_unlock_xattrs(inode->i_sb);
+        reiserfs_read_unlock_xattr_i(inode);
 
-                if (acl) {
-                        int err = posix_acl_permission(inode, acl, mask);
+        if (acl) {
+                if (!IS_ERR(acl)) {
+                        error = posix_acl_permission(inode, acl, mask);
                         posix_acl_release(acl);
-                        if (err == -EACCES) {
-                                goto check_capabilities;
-                        }
-                        return err;
-                } else {
-                        goto check_groups;
-                }
-#endif
-        } else {
-              check_groups:
-                if (in_group_p(inode->i_gid))
-                        mode >>= 3;
+                } else if (PTR_ERR(acl) != -ENODATA)
+                        error = PTR_ERR(acl);
         }
 
-        /*
-         * If the DACs are ok we don't need any capability check.
-         */
-        if (((mode & mask & (MAY_READ | MAY_WRITE | MAY_EXEC)) == mask))
-                return 0;
+        return error;
+}
 
-      check_capabilities:
+int reiserfs_permission(struct inode *inode, int mask, struct nameidata *nd)
+{
         /*
-         * Read/write DACs are always overridable.
-         * Executable DACs are overridable if at least one exec bit is set.
+         * We don't do permission checks on the internal objects.
+         * Permissions are determined by the "owning" object.
          */
-        if (!(mask & MAY_EXEC) ||
-            (inode->i_mode & S_IXUGO) || S_ISDIR(inode->i_mode))
-                if (capable(CAP_DAC_OVERRIDE))
-                        return 0;
+        if (is_reiserfs_priv_object(inode))
+                return 0;
 
         /*
-         * Searching includes executable on directories, else just read.
+         * Stat data v1 doesn't support ACLs.
          */
-        if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
-                if (capable(CAP_DAC_READ_SEARCH))
-                        return 0;
-
-        return -EACCES;
-}
-
-int reiserfs_permission(struct inode *inode, int mask, struct nameidata *nd)
-{
-        return __reiserfs_permission(inode, mask, nd, 1);
-}
-
-int
-reiserfs_permission_locked(struct inode *inode, int mask, struct nameidata *nd)
-{
-        return __reiserfs_permission(inode, mask, nd, 0);
+        if (get_inode_sd_version(inode) == STAT_DATA_V1)
+                return generic_permission(inode, mask, NULL);
+        else
+                return generic_permission(inode, mask, reiserfs_check_acl);
 }
diff --git a/fs/smbfs/dir.c b/fs/smbfs/dir.c
index c6c33e15143a..0424d06b147e 100644
--- a/fs/smbfs/dir.c
+++ b/fs/smbfs/dir.c
@@ -209,6 +209,8 @@ init_cache:
         ctl.valid  = 1;
 read_really:
         result = server->ops->readdir(filp, dirent, filldir, &ctl);
+        if (result == -ERESTARTSYS && page)
+                ClearPageUptodate(page);
         if (ctl.idx == -1)
                 goto invalid_cache;     /* retry */
         ctl.head.end = ctl.fpos - 1;
@@ -217,7 +219,8 @@ finished:
         if (page) {
                 cache->head = ctl.head;
                 kunmap(page);
-                SetPageUptodate(page);
+                if (result != -ERESTARTSYS)
+                        SetPageUptodate(page);
                 unlock_page(page);
                 page_cache_release(page);
         }
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index 120626789406..9892268e3005 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -1462,4 +1462,5 @@ struct address_space_operations linvfs_aops = {
         .commit_write           = generic_commit_write,
         .bmap                   = linvfs_bmap,
         .direct_IO              = linvfs_direct_IO,
+        .migratepage            = buffer_migrate_page,
 };
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index e44b7c1a3a36..bfb4f2917bb6 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -822,6 +822,13 @@ xfs_buf_rele(
 
         XB_TRACE(bp, "rele", bp->b_relse);
 
+        if (unlikely(!hash)) {
+                ASSERT(!bp->b_relse);
+                if (atomic_dec_and_test(&bp->b_hold))
+                        xfs_buf_free(bp);
+                return;
+        }
+
         if (atomic_dec_and_lock(&bp->b_hold, &hash->bh_lock)) {
                 if (bp->b_relse) {
                         atomic_inc(&bp->b_hold);
@@ -1514,6 +1521,7 @@ xfs_mapping_buftarg(
         struct address_space    *mapping;
         static struct address_space_operations mapping_aops = {
                 .sync_page = block_sync_page,
+                .migratepage = fail_migrate_page,
         };
 
         inode = new_inode(bdev->bd_inode->i_sb);
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index 76c6df34d0db..eda7919b70a1 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -262,6 +262,31 @@ has_fs_struct(struct task_struct *task)
         return (task->fs != init_task.fs);
 }
 
+STATIC inline void
+cleanup_inode(
+        vnode_t         *dvp,
+        vnode_t         *vp,
+        struct dentry   *dentry,        
+        int             mode)
+{
+        struct dentry   teardown = {};
+        int             err2;
+
+        /* Oh, the horror.
+         * If we can't add the ACL or we fail in 
+         * linvfs_init_security we must back out.
+         * ENOSPC can hit here, among other things.
+         */
+        teardown.d_inode = LINVFS_GET_IP(vp);
+        teardown.d_name = dentry->d_name;
+
+        if (S_ISDIR(mode))
+                VOP_RMDIR(dvp, &teardown, NULL, err2);
+        else
+                VOP_REMOVE(dvp, &teardown, NULL, err2);
+        VN_RELE(vp);
+}
+
 STATIC int
 linvfs_mknod(
         struct inode    *dir,
@@ -316,30 +341,19 @@ linvfs_mknod(
         }
 
         if (!error)
+        {
                 error = linvfs_init_security(vp, dir);
+                if (error)
+                        cleanup_inode(dvp, vp, dentry, mode);
+        }
 
         if (default_acl) {
                 if (!error) {
                         error = _ACL_INHERIT(vp, &va, default_acl);
-                        if (!error) {
+                        if (!error) 
                                 VMODIFY(vp);
-                        } else {
-                                struct dentry   teardown = {};
-                                int             err2;
-
-                                /* Oh, the horror.
-                                 * If we can't add the ACL we must back out.
-                                 * ENOSPC can hit here, among other things.
-                                 */
-                                teardown.d_inode = ip = LINVFS_GET_IP(vp);
-                                teardown.d_name = dentry->d_name;
-
-                                if (S_ISDIR(mode))
-                                        VOP_RMDIR(dvp, &teardown, NULL, err2);
-                                else
-                                        VOP_REMOVE(dvp, &teardown, NULL, err2);
-                                VN_RELE(vp);
-                        }
+                        else
+                                cleanup_inode(dvp, vp, dentry, mode);
                 }
                 _ACL_FREE(default_acl);
         }