Merge tag 'ib-mfd-regulator-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into regulator-tps65090

Immutable branch between MFD and Regulator due for v3.16 merge-window.

24 files changed, 336 insertions, 144 deletions

diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index df9c9141c099..5be1f997ecde 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -253,6 +253,11 @@ cifs_alloc_inode(struct super_block *sb)
         cifs_set_oplock_level(cifs_inode, 0);
         cifs_inode->delete_pending = false;
         cifs_inode->invalid_mapping = false;
+        clear_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cifs_inode->flags);
+        clear_bit(CIFS_INODE_PENDING_WRITERS, &cifs_inode->flags);
+        clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, &cifs_inode->flags);
+        spin_lock_init(&cifs_inode->writers_lock);
+        cifs_inode->writers = 0;
         cifs_inode->vfs_inode.i_blkbits = 14;  /* 2**14 = CIFS_MAX_MSGSIZE */
         cifs_inode->server_eof = 0;
         cifs_inode->uniqueid = 0;
@@ -732,19 +737,26 @@ static ssize_t cifs_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
                                    unsigned long nr_segs, loff_t pos)
 {
         struct inode *inode = file_inode(iocb->ki_filp);
+        struct cifsInodeInfo *cinode = CIFS_I(inode);
         ssize_t written;
         int rc;
 
+        written = cifs_get_writer(cinode);
+        if (written)
+                return written;
+
         written = generic_file_aio_write(iocb, iov, nr_segs, pos);
 
         if (CIFS_CACHE_WRITE(CIFS_I(inode)))
-                return written;
+                goto out;
 
         rc = filemap_fdatawrite(inode->i_mapping);
         if (rc)
                 cifs_dbg(FYI, "cifs_file_aio_write: %d rc on %p inode\n",
                          rc, inode);
 
+out:
+        cifs_put_writer(cinode);
         return written;
 }
 
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index c0f3718b77a8..30f6e9251a4a 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -228,6 +228,8 @@ struct smb_version_operations {
         /* verify the message */
         int (*check_message)(char *, unsigned int);
         bool (*is_oplock_break)(char *, struct TCP_Server_Info *);
+        void (*downgrade_oplock)(struct TCP_Server_Info *,
+                                        struct cifsInodeInfo *, bool);
         /* process transaction2 response */
         bool (*check_trans2)(struct mid_q_entry *, struct TCP_Server_Info *,
                              char *, int);
@@ -1113,6 +1115,12 @@ struct cifsInodeInfo {
         unsigned int epoch;             /* used to track lease state changes */
         bool delete_pending;            /* DELETE_ON_CLOSE is set */
         bool invalid_mapping;           /* pagecache is invalid */
+        unsigned long flags;
+#define CIFS_INODE_PENDING_OPLOCK_BREAK   (0) /* oplock break in progress */
+#define CIFS_INODE_PENDING_WRITERS        (1) /* Writes in progress */
+#define CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 (2) /* Downgrade oplock to L2 */
+        spinlock_t writers_lock;
+        unsigned int writers;           /* Number of writers on this inode */
         unsigned long time;             /* jiffies of last update of inode */
         u64  server_eof;                /* current file size on server -- protected by i_lock */
         u64  uniqueid;                  /* server inode number */
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index acc4ee8ed075..ca7980a1e303 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -127,6 +127,9 @@ extern u64 cifs_UnixTimeToNT(struct timespec);
 extern struct timespec cnvrtDosUnixTm(__le16 le_date, __le16 le_time,
                                       int offset);
 extern void cifs_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock);
+extern int cifs_get_writer(struct cifsInodeInfo *cinode);
+extern void cifs_put_writer(struct cifsInodeInfo *cinode);
+extern void cifs_done_oplock_break(struct cifsInodeInfo *cinode);
 extern int cifs_unlock_range(struct cifsFileInfo *cfile,
                              struct file_lock *flock, const unsigned int xid);
 extern int cifs_push_mandatory_locks(struct cifsFileInfo *cfile);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index f3264bd7a83d..6ce4e0954b98 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -6197,6 +6197,9 @@ QAllEAsRetry:
         cifs_dbg(FYI, "ea length %d\n", list_len);
         if (list_len <= 8) {
                 cifs_dbg(FYI, "empty EA list returned from server\n");
+                /* didn't find the named attribute */
+                if (ea_name)
+                        rc = -ENODATA;
                 goto QAllEAsOut;
         }
 
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 8add25538a3b..5ed03e0b8b40 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2599,7 +2599,7 @@ cifs_writev(struct kiocb *iocb, const struct iovec *iov,
                         ssize_t err;
 
                         err = generic_write_sync(file, iocb->ki_pos - rc, rc);
-                        if (rc < 0)
+                        if (err < 0)
                                 rc = err;
                 }
         } else {
@@ -2621,12 +2621,20 @@ cifs_strict_writev(struct kiocb *iocb, const struct iovec *iov,
         struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
         ssize_t written;
 
+        written = cifs_get_writer(cinode);
+        if (written)
+                return written;
+
         if (CIFS_CACHE_WRITE(cinode)) {
                 if (cap_unix(tcon->ses) &&
                 (CIFS_UNIX_FCNTL_CAP & le64_to_cpu(tcon->fsUnixInfo.Capability))
-                    && ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOPOSIXBRL) == 0))
-                        return generic_file_aio_write(iocb, iov, nr_segs, pos);
-                return cifs_writev(iocb, iov, nr_segs, pos);
+                  && ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOPOSIXBRL) == 0)) {
+                        written = generic_file_aio_write(
+                                        iocb, iov, nr_segs, pos);
+                        goto out;
+                }
+                written = cifs_writev(iocb, iov, nr_segs, pos);
+                goto out;
         }
         /*
          * For non-oplocked files in strict cache mode we need to write the data
@@ -2646,6 +2654,8 @@ cifs_strict_writev(struct kiocb *iocb, const struct iovec *iov,
                          inode);
                 cinode->oplock = 0;
         }
+out:
+        cifs_put_writer(cinode);
         return written;
 }
 
@@ -2872,7 +2882,7 @@ ssize_t cifs_user_readv(struct kiocb *iocb, const struct iovec *iov,
                                             cifs_uncached_readv_complete);
                 if (!rdata) {
                         rc = -ENOMEM;
-                        goto error;
+                        break;
                 }
 
                 rc = cifs_read_allocate_pages(rdata, npages);
@@ -3621,6 +3631,13 @@ static int cifs_launder_page(struct page *page)
         return rc;
 }
 
+static int
+cifs_pending_writers_wait(void *unused)
+{
+        schedule();
+        return 0;
+}
+
 void cifs_oplock_break(struct work_struct *work)
 {
         struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo,
@@ -3628,8 +3645,15 @@ void cifs_oplock_break(struct work_struct *work)
         struct inode *inode = cfile->dentry->d_inode;
         struct cifsInodeInfo *cinode = CIFS_I(inode);
         struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
+        struct TCP_Server_Info *server = tcon->ses->server;
         int rc = 0;
 
+        wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS,
+                        cifs_pending_writers_wait, TASK_UNINTERRUPTIBLE);
+
+        server->ops->downgrade_oplock(server, cinode,
+                test_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, &cinode->flags));
+
         if (!CIFS_CACHE_WRITE(cinode) && CIFS_CACHE_READ(cinode) &&
                                                 cifs_has_mand_locks(cinode)) {
                 cifs_dbg(FYI, "Reset oplock to None for inode=%p due to mand locks\n",
@@ -3666,6 +3690,7 @@ void cifs_oplock_break(struct work_struct *work)
                                                              cinode);
                 cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
         }
+        cifs_done_oplock_break(cinode);
 }
 
 /*
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 2f9f3790679d..3b0c62e622da 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -466,8 +466,22 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
                                 cifs_dbg(FYI, "file id match, oplock break\n");
                                 pCifsInode = CIFS_I(netfile->dentry->d_inode);
 
-                                cifs_set_oplock_level(pCifsInode,
-                                        pSMB->OplockLevel ? OPLOCK_READ : 0);
+                                set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK,
+                                        &pCifsInode->flags);
+
+                                /*
+                                 * Set flag if the server downgrades the oplock
+                                 * to L2 else clear.
+                                 */
+                                if (pSMB->OplockLevel)
+                                        set_bit(
+                                           CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+                                           &pCifsInode->flags);
+                                else
+                                        clear_bit(
+                                           CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+                                           &pCifsInode->flags);
+
                                 queue_work(cifsiod_wq,
                                            &netfile->oplock_break);
                                 netfile->oplock_break_cancelled = false;
@@ -551,6 +565,62 @@ void cifs_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock)
                 cinode->oplock = 0;
 }
 
+static int
+cifs_oplock_break_wait(void *unused)
+{
+        schedule();
+        return signal_pending(current) ? -ERESTARTSYS : 0;
+}
+
+/*
+ * We wait for oplock breaks to be processed before we attempt to perform
+ * writes.
+ */
+int cifs_get_writer(struct cifsInodeInfo *cinode)
+{
+        int rc;
+
+start:
+        rc = wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_OPLOCK_BREAK,
+                                   cifs_oplock_break_wait, TASK_KILLABLE);
+        if (rc)
+                return rc;
+
+        spin_lock(&cinode->writers_lock);
+        if (!cinode->writers)
+                set_bit(CIFS_INODE_PENDING_WRITERS, &cinode->flags);
+        cinode->writers++;
+        /* Check to see if we have started servicing an oplock break */
+        if (test_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags)) {
+                cinode->writers--;
+                if (cinode->writers == 0) {
+                        clear_bit(CIFS_INODE_PENDING_WRITERS, &cinode->flags);
+                        wake_up_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS);
+                }
+                spin_unlock(&cinode->writers_lock);
+                goto start;
+        }
+        spin_unlock(&cinode->writers_lock);
+        return 0;
+}
+
+void cifs_put_writer(struct cifsInodeInfo *cinode)
+{
+        spin_lock(&cinode->writers_lock);
+        cinode->writers--;
+        if (cinode->writers == 0) {
+                clear_bit(CIFS_INODE_PENDING_WRITERS, &cinode->flags);
+                wake_up_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS);
+        }
+        spin_unlock(&cinode->writers_lock);
+}
+
+void cifs_done_oplock_break(struct cifsInodeInfo *cinode)
+{
+        clear_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags);
+        wake_up_bit(&cinode->flags, CIFS_INODE_PENDING_OPLOCK_BREAK);
+}
+
 bool
 backup_cred(struct cifs_sb_info *cifs_sb)
 {
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index 526fb89f9230..d1fdfa848703 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -372,6 +372,16 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr)
         return 0;
 }
 
+static void
+cifs_downgrade_oplock(struct TCP_Server_Info *server,
+                        struct cifsInodeInfo *cinode, bool set_level2)
+{
+        if (set_level2)
+                cifs_set_oplock_level(cinode, OPLOCK_READ);
+        else
+                cifs_set_oplock_level(cinode, 0);
+}
+
 static bool
 cifs_check_trans2(struct mid_q_entry *mid, struct TCP_Server_Info *server,
                   char *buf, int malformed)
@@ -1019,6 +1029,7 @@ struct smb_version_operations smb1_operations = {
         .clear_stats = cifs_clear_stats,
         .print_stats = cifs_print_stats,
         .is_oplock_break = is_valid_oplock_break,
+        .downgrade_oplock = cifs_downgrade_oplock,
         .check_trans2 = cifs_check_trans2,
         .need_neg = cifs_need_neg,
         .negotiate = cifs_negotiate,
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index fb3966265b6e..b8021fde987d 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -575,9 +575,21 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
                                 else
                                         cfile->oplock_break_cancelled = false;
 
-                                server->ops->set_oplock_level(cinode,
-                                  rsp->OplockLevel ? SMB2_OPLOCK_LEVEL_II : 0,
-                                  0, NULL);
+                                set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK,
+                                        &cinode->flags);
+
+                                /*
+                                 * Set flag if the server downgrades the oplock
+                                 * to L2 else clear.
+                                 */
+                                if (rsp->OplockLevel)
+                                        set_bit(
+                                           CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+                                           &cinode->flags);
+                                else
+                                        clear_bit(
+                                           CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+                                           &cinode->flags);
 
                                 queue_work(cifsiod_wq, &cfile->oplock_break);
 
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 192f51a12cf1..35ddc3ed119d 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -905,6 +905,17 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
 }
 
 static void
+smb2_downgrade_oplock(struct TCP_Server_Info *server,
+                        struct cifsInodeInfo *cinode, bool set_level2)
+{
+        if (set_level2)
+                server->ops->set_oplock_level(cinode, SMB2_OPLOCK_LEVEL_II,
+                                                0, NULL);
+        else
+                server->ops->set_oplock_level(cinode, 0, 0, NULL);
+}
+
+static void
 smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
                       unsigned int epoch, bool *purge_cache)
 {
@@ -1110,6 +1121,7 @@ struct smb_version_operations smb20_operations = {
         .clear_stats = smb2_clear_stats,
         .print_stats = smb2_print_stats,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
         .negotiate_wsize = smb2_negotiate_wsize,
@@ -1184,6 +1196,7 @@ struct smb_version_operations smb21_operations = {
         .clear_stats = smb2_clear_stats,
         .print_stats = smb2_print_stats,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
         .negotiate_wsize = smb2_negotiate_wsize,
@@ -1259,6 +1272,7 @@ struct smb_version_operations smb30_operations = {
         .print_stats = smb2_print_stats,
         .dump_share_caps = smb2_dump_share_caps,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
         .negotiate_wsize = smb2_negotiate_wsize,
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 860344701067..3802f8c94acc 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1352,7 +1352,6 @@ SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
                      u64 persistent_fid, u64 volatile_fid)
 {
         int rc;
-        char *res_key = NULL;
         struct  compress_ioctl fsctl_input;
         char *ret_data = NULL;
 
@@ -1365,7 +1364,6 @@ SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
                         2 /* in data len */, &ret_data /* out data */, NULL);
 
         cifs_dbg(FYI, "set compression rc %d\n", rc);
-        kfree(res_key);
 
         return rc;
 }
diff --git a/fs/coredump.c b/fs/coredump.c
index e3ad709a4232..0b2528fb640e 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -73,10 +73,15 @@ static int expand_corename(struct core_name *cn, int size)
 static int cn_vprintf(struct core_name *cn, const char *fmt, va_list arg)
 {
         int free, need;
+        va_list arg_copy;
 
 again:
         free = cn->size - cn->used;
-        need = vsnprintf(cn->corename + cn->used, free, fmt, arg);
+
+        va_copy(arg_copy, arg);
+        need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy);
+        va_end(arg_copy);
+
         if (need < free) {
                 cn->used += need;
                 return 0;
diff --git a/fs/kernfs/inode.c b/fs/kernfs/inode.c
index abb0f1f53d93..985217626e66 100644
--- a/fs/kernfs/inode.c
+++ b/fs/kernfs/inode.c
@@ -48,14 +48,18 @@ void __init kernfs_inode_init(void)
 
 static struct kernfs_iattrs *kernfs_iattrs(struct kernfs_node *kn)
 {
+        static DEFINE_MUTEX(iattr_mutex);
+        struct kernfs_iattrs *ret;
         struct iattr *iattrs;
 
+        mutex_lock(&iattr_mutex);
+
         if (kn->iattr)
-                return kn->iattr;
+                goto out_unlock;
 
         kn->iattr = kzalloc(sizeof(struct kernfs_iattrs), GFP_KERNEL);
         if (!kn->iattr)
-                return NULL;
+                goto out_unlock;
         iattrs = &kn->iattr->ia_iattr;
 
         /* assign default attributes */
@@ -65,8 +69,10 @@ static struct kernfs_iattrs *kernfs_iattrs(struct kernfs_node *kn)
         iattrs->ia_atime = iattrs->ia_mtime = iattrs->ia_ctime = CURRENT_TIME;
 
         simple_xattrs_init(&kn->iattr->xattrs);
-
-        return kn->iattr;
+out_unlock:
+        ret = kn->iattr;
+        mutex_unlock(&iattr_mutex);
+        return ret;
 }
 
 static int __kernfs_setattr(struct kernfs_node *kn, const struct iattr *iattr)
diff --git a/fs/super.c b/fs/super.c
index e9dc3c3fe159..48377f7463c0 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -800,7 +800,10 @@ void emergency_remount(void)
 
 static DEFINE_IDA(unnamed_dev_ida);
 static DEFINE_SPINLOCK(unnamed_dev_lock);/* protects the above */
-static int unnamed_dev_start = 0; /* don't bother trying below it */
+/* Many userspace utilities consider an FSID of 0 invalid.
+ * Always return at least 1 from get_anon_bdev.
+ */
+static int unnamed_dev_start = 1;
 
 int get_anon_bdev(dev_t *p)
 {
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 1b8b91b67fdb..28cc1acd5439 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -453,95 +453,3 @@ void sysfs_remove_bin_file(struct kobject *kobj,
         kernfs_remove_by_name(kobj->sd, attr->attr.name);
 }
 EXPORT_SYMBOL_GPL(sysfs_remove_bin_file);
-
-struct sysfs_schedule_callback_struct {
-        struct list_head        workq_list;
-        struct kobject          *kobj;
-        void                    (*func)(void *);
-        void                    *data;
-        struct module           *owner;
-        struct work_struct      work;
-};
-
-static struct workqueue_struct *sysfs_workqueue;
-static DEFINE_MUTEX(sysfs_workq_mutex);
-static LIST_HEAD(sysfs_workq);
-static void sysfs_schedule_callback_work(struct work_struct *work)
-{
-        struct sysfs_schedule_callback_struct *ss = container_of(work,
-                        struct sysfs_schedule_callback_struct, work);
-
-        (ss->func)(ss->data);
-        kobject_put(ss->kobj);
-        module_put(ss->owner);
-        mutex_lock(&sysfs_workq_mutex);
-        list_del(&ss->workq_list);
-        mutex_unlock(&sysfs_workq_mutex);
-        kfree(ss);
-}
-
-/**
- * sysfs_schedule_callback - helper to schedule a callback for a kobject
- * @kobj: object we're acting for.
- * @func: callback function to invoke later.
- * @data: argument to pass to @func.
- * @owner: module owning the callback code
- *
- * sysfs attribute methods must not unregister themselves or their parent
- * kobject (which would amount to the same thing).  Attempts to do so will
- * deadlock, since unregistration is mutually exclusive with driver
- * callbacks.
- *
- * Instead methods can call this routine, which will attempt to allocate
- * and schedule a workqueue request to call back @func with @data as its
- * argument in the workqueue's process context.  @kobj will be pinned
- * until @func returns.
- *
- * Returns 0 if the request was submitted, -ENOMEM if storage could not
- * be allocated, -ENODEV if a reference to @owner isn't available,
- * -EAGAIN if a callback has already been scheduled for @kobj.
- */
-int sysfs_schedule_callback(struct kobject *kobj, void (*func)(void *),
-                void *data, struct module *owner)
-{
-        struct sysfs_schedule_callback_struct *ss, *tmp;
-
-        if (!try_module_get(owner))
-                return -ENODEV;
-
-        mutex_lock(&sysfs_workq_mutex);
-        list_for_each_entry_safe(ss, tmp, &sysfs_workq, workq_list)
-                if (ss->kobj == kobj) {
-                        module_put(owner);
-                        mutex_unlock(&sysfs_workq_mutex);
-                        return -EAGAIN;
-                }
-        mutex_unlock(&sysfs_workq_mutex);
-
-        if (sysfs_workqueue == NULL) {
-                sysfs_workqueue = create_singlethread_workqueue("sysfsd");
-                if (sysfs_workqueue == NULL) {
-                        module_put(owner);
-                        return -ENOMEM;
-                }
-        }
-
-        ss = kmalloc(sizeof(*ss), GFP_KERNEL);
-        if (!ss) {
-                module_put(owner);
-                return -ENOMEM;
-        }
-        kobject_get(kobj);
-        ss->kobj = kobj;
-        ss->func = func;
-        ss->data = data;
-        ss->owner = owner;
-        INIT_WORK(&ss->work, sysfs_schedule_callback_work);
-        INIT_LIST_HEAD(&ss->workq_list);
-        mutex_lock(&sysfs_workq_mutex);
-        list_add_tail(&ss->workq_list, &sysfs_workq);
-        mutex_unlock(&sysfs_workq_mutex);
-        queue_work(sysfs_workqueue, &ss->work);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(sysfs_schedule_callback);
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 75df77d09f75..0479c32c5eb1 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -1344,6 +1344,14 @@ __xfs_get_blocks(
         /*
          * If this is O_DIRECT or the mpage code calling tell them how large
          * the mapping is, so that we can avoid repeated get_blocks calls.
+         *
+         * If the mapping spans EOF, then we have to break the mapping up as the
+         * mapping for blocks beyond EOF must be marked new so that sub block
+         * regions can be correctly zeroed. We can't do this for mappings within
+         * EOF unless the mapping was just allocated or is unwritten, otherwise
+         * the callers would overwrite existing data with zeros. Hence we have
+         * to split the mapping into a range up to and including EOF, and a
+         * second mapping for beyond EOF.
          */
         if (direct || size > (1 << inode->i_blkbits)) {
                 xfs_off_t               mapping_size;
@@ -1354,6 +1362,12 @@ __xfs_get_blocks(
                 ASSERT(mapping_size > 0);
                 if (mapping_size > size)
                         mapping_size = size;
+                if (offset < i_size_read(inode) &&
+                    offset + mapping_size >= i_size_read(inode)) {
+                        /* limit mapping to block that spans EOF */
+                        mapping_size = roundup_64(i_size_read(inode) - offset,
+                                                  1 << inode->i_blkbits);
+                }
                 if (mapping_size > LONG_MAX)
                         mapping_size = LONG_MAX;
 
@@ -1566,6 +1580,16 @@ xfs_vm_write_failed(
 
                 xfs_vm_kill_delalloc_range(inode, block_offset,
                                            block_offset + bh->b_size);
+
+                /*
+                 * This buffer does not contain data anymore. make sure anyone
+                 * who finds it knows that for certain.
+                 */
+                clear_buffer_delay(bh);
+                clear_buffer_uptodate(bh);
+                clear_buffer_mapped(bh);
+                clear_buffer_new(bh);
+                clear_buffer_dirty(bh);
         }
 
 }
@@ -1599,12 +1623,21 @@ xfs_vm_write_begin(
         status = __block_write_begin(page, pos, len, xfs_get_blocks);
         if (unlikely(status)) {
                 struct inode    *inode = mapping->host;
+                size_t          isize = i_size_read(inode);
 
                 xfs_vm_write_failed(inode, page, pos, len);
                 unlock_page(page);
 
-                if (pos + len > i_size_read(inode))
-                        truncate_pagecache(inode, i_size_read(inode));
+                /*
+                 * If the write is beyond EOF, we only want to kill blocks
+                 * allocated in this write, not blocks that were previously
+                 * written successfully.
+                 */
+                if (pos + len > isize) {
+                        ssize_t start = max_t(ssize_t, pos, isize);
+
+                        truncate_pagecache_range(inode, start, pos + len);
+                }
 
                 page_cache_release(page);
                 page = NULL;
@@ -1615,9 +1648,12 @@ xfs_vm_write_begin(
 }
 
 /*
- * On failure, we only need to kill delalloc blocks beyond EOF because they
- * will never be written. For blocks within EOF, generic_write_end() zeros them
- * so they are safe to leave alone and be written with all the other valid data.
+ * On failure, we only need to kill delalloc blocks beyond EOF in the range of
+ * this specific write because they will never be written. Previous writes
+ * beyond EOF where block allocation succeeded do not need to be trashed, so
+ * only new blocks from this write should be trashed. For blocks within
+ * EOF, generic_write_end() zeros them so they are safe to leave alone and be
+ * written with all the other valid data.
  */
 STATIC int
 xfs_vm_write_end(
@@ -1640,8 +1676,11 @@ xfs_vm_write_end(
                 loff_t          to = pos + len;
 
                 if (to > isize) {
-                        truncate_pagecache(inode, isize);
+                        /* only kill blocks in this write beyond EOF */
+                        if (pos > isize)
+                                isize = pos;
                         xfs_vm_kill_delalloc_range(inode, isize, to);
+                        truncate_pagecache_range(inode, isize, to);
                 }
         }
         return ret;
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 5b6092ef51ef..f0efc7e970ef 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -5413,6 +5413,7 @@ xfs_bmap_shift_extents(
         int                             whichfork = XFS_DATA_FORK;
         int                             logflags;
         xfs_filblks_t                   blockcount = 0;
+        int                             total_extents;
 
         if (unlikely(XFS_TEST_ERROR(
             (XFS_IFORK_FORMAT(ip, whichfork) != XFS_DINODE_FMT_EXTENTS &&
@@ -5429,7 +5430,6 @@ xfs_bmap_shift_extents(
         ASSERT(current_ext != NULL);
 
         ifp = XFS_IFORK_PTR(ip, whichfork);
-
         if (!(ifp->if_flags & XFS_IFEXTENTS)) {
                 /* Read in all the extents */
                 error = xfs_iread_extents(tp, ip, whichfork);
@@ -5456,7 +5456,6 @@ xfs_bmap_shift_extents(
 
         /* We are going to change core inode */
         logflags = XFS_ILOG_CORE;
-
         if (ifp->if_flags & XFS_IFBROOT) {
                 cur = xfs_bmbt_init_cursor(mp, tp, ip, whichfork);
                 cur->bc_private.b.firstblock = *firstblock;
@@ -5467,8 +5466,14 @@ xfs_bmap_shift_extents(
                 logflags |= XFS_ILOG_DEXT;
         }
 
-        while (nexts++ < num_exts &&
-               *current_ext <  XFS_IFORK_NEXTENTS(ip, whichfork)) {
+        /*
+         * There may be delalloc extents in the data fork before the range we
+         * are collapsing out, so we cannot
+         * use the count of real extents here. Instead we have to calculate it
+         * from the incore fork.
+         */
+        total_extents = ifp->if_bytes / sizeof(xfs_bmbt_rec_t);
+        while (nexts++ < num_exts && *current_ext < total_extents) {
 
                 gotp = xfs_iext_get_ext(ifp, *current_ext);
                 xfs_bmbt_get_all(gotp, &got);
@@ -5556,10 +5561,11 @@ xfs_bmap_shift_extents(
                 }
 
                 (*current_ext)++;
+                total_extents = ifp->if_bytes / sizeof(xfs_bmbt_rec_t);
         }
 
         /* Check if we are done */
-        if (*current_ext ==  XFS_IFORK_NEXTENTS(ip, whichfork))
+        if (*current_ext == total_extents)
                 *done = 1;
 
 del_cursor:
@@ -5568,6 +5574,5 @@ del_cursor:
                         error ? XFS_BTREE_ERROR : XFS_BTREE_NOERROR);
 
         xfs_trans_log_inode(tp, ip, logflags);
-
         return error;
 }
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 01f6a646caa1..296160b8e78c 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1418,6 +1418,8 @@ xfs_zero_file_space(
         xfs_off_t               end_boundary;
         int                     error;
 
+        trace_xfs_zero_file_space(ip);
+
         granularity = max_t(uint, 1 << mp->m_sb.sb_blocklog, PAGE_CACHE_SIZE);
 
         /*
@@ -1432,9 +1434,18 @@ xfs_zero_file_space(
         ASSERT(end_boundary <= offset + len);
 
         if (start_boundary < end_boundary - 1) {
-                /* punch out the page cache over the conversion range */
+                /*
+                 * punch out delayed allocation blocks and the page cache over
+                 * the conversion range
+                 */
+                xfs_ilock(ip, XFS_ILOCK_EXCL);
+                error = xfs_bmap_punch_delalloc_range(ip,
+                                XFS_B_TO_FSBT(mp, start_boundary),
+                                XFS_B_TO_FSB(mp, end_boundary - start_boundary));
+                xfs_iunlock(ip, XFS_ILOCK_EXCL);
                 truncate_pagecache_range(VFS_I(ip), start_boundary,
                                          end_boundary - 1);
+
                 /* convert the blocks */
                 error = xfs_alloc_file_space(ip, start_boundary,
                                         end_boundary - start_boundary - 1,
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 107f2fdfe41f..cb10a0aaab3a 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -1372,21 +1372,29 @@ xfs_buf_iorequest(
                 xfs_buf_wait_unpin(bp);
         xfs_buf_hold(bp);
 
-        /* Set the count to 1 initially, this will stop an I/O
+        /*
+         * Set the count to 1 initially, this will stop an I/O
          * completion callout which happens before we have started
          * all the I/O from calling xfs_buf_ioend too early.
          */
         atomic_set(&bp->b_io_remaining, 1);
         _xfs_buf_ioapply(bp);
-        _xfs_buf_ioend(bp, 1);
+        /*
+         * If _xfs_buf_ioapply failed, we'll get back here with
+         * only the reference we took above.  _xfs_buf_ioend will
+         * drop it to zero, so we'd better not queue it for later,
+         * or we'll free it before it's done.
+         */
+        _xfs_buf_ioend(bp, bp->b_error ? 0 : 1);
 
         xfs_buf_rele(bp);
 }
 
 /*
  * Waits for I/O to complete on the buffer supplied.  It returns immediately if
- * no I/O is pending or there is already a pending error on the buffer.  It
- * returns the I/O error code, if any, or 0 if there was no error.
+ * no I/O is pending or there is already a pending error on the buffer, in which
+ * case nothing will ever complete.  It returns the I/O error code, if any, or
+ * 0 if there was no error.
  */
 int
 xfs_buf_iowait(
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 79e96ce98733..82afdcb33183 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -679,7 +679,7 @@ xfs_file_dio_aio_write(
                 goto out;
 
         if (mapping->nrpages) {
-                ret = -filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
+                ret = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
                                                     pos, -1);
                 if (ret)
                         goto out;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 5e7a38fa6ee6..768087bedbac 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1334,7 +1334,8 @@ int
 xfs_create_tmpfile(
         struct xfs_inode        *dp,
         struct dentry           *dentry,
-        umode_t                 mode)
+        umode_t                 mode,
+        struct xfs_inode        **ipp)
 {
         struct xfs_mount        *mp = dp->i_mount;
         struct xfs_inode        *ip = NULL;
@@ -1402,7 +1403,6 @@ xfs_create_tmpfile(
         xfs_qm_vop_create_dqattach(tp, ip, udqp, gdqp, pdqp);
 
         ip->i_d.di_nlink--;
-        d_tmpfile(dentry, VFS_I(ip));
         error = xfs_iunlink(tp, ip);
         if (error)
                 goto out_trans_abort;
@@ -1415,6 +1415,7 @@ xfs_create_tmpfile(
         xfs_qm_dqrele(gdqp);
         xfs_qm_dqrele(pdqp);
 
+        *ipp = ip;
         return 0;
 
  out_trans_abort:
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 396cc1fafd0d..f2fcde52b66d 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -334,7 +334,7 @@ int		xfs_lookup(struct xfs_inode *dp, struct xfs_name *name,
 int             xfs_create(struct xfs_inode *dp, struct xfs_name *name,
                            umode_t mode, xfs_dev_t rdev, struct xfs_inode **ipp);
 int             xfs_create_tmpfile(struct xfs_inode *dp, struct dentry *dentry,
-                           umode_t mode);
+                           umode_t mode, struct xfs_inode **ipp);
 int             xfs_remove(struct xfs_inode *dp, struct xfs_name *name,
                            struct xfs_inode *ip);
 int             xfs_link(struct xfs_inode *tdp, struct xfs_inode *sip,
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 89b07e43ca28..ef1ca010f417 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -1053,11 +1053,25 @@ xfs_vn_tmpfile(
         struct dentry   *dentry,
         umode_t         mode)
 {
-        int             error;
+        int                     error;
+        struct xfs_inode        *ip;
+        struct inode            *inode;
 
-        error = xfs_create_tmpfile(XFS_I(dir), dentry, mode);
+        error = xfs_create_tmpfile(XFS_I(dir), dentry, mode, &ip);
+        if (unlikely(error))
+                return -error;
 
-        return -error;
+        inode = VFS_I(ip);
+
+        error = xfs_init_security(inode, dir, &dentry->d_name);
+        if (unlikely(error)) {
+                iput(inode);
+                return -error;
+        }
+
+        d_tmpfile(dentry, inode);
+
+        return 0;
 }
 
 static const struct inode_operations xfs_inode_operations = {
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 8497a00e399d..08624dc67317 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -1181,11 +1181,14 @@ xlog_iodone(xfs_buf_t *bp)
         /* log I/O is always issued ASYNC */
         ASSERT(XFS_BUF_ISASYNC(bp));
         xlog_state_done_syncing(iclog, aborted);
+
         /*
-         * do not reference the buffer (bp) here as we could race
-         * with it being freed after writing the unmount record to the
-         * log.
+         * drop the buffer lock now that we are done. Nothing references
+         * the buffer after this, so an unmount waiting on this lock can now
+         * tear it down safely. As such, it is unsafe to reference the buffer
+         * (bp) after the unlock as we could race with it being freed.
          */
+        xfs_buf_unlock(bp);
 }
 
 /*
@@ -1368,8 +1371,16 @@ xlog_alloc_log(
         bp = xfs_buf_alloc(mp->m_logdev_targp, 0, BTOBB(log->l_iclog_size), 0);
         if (!bp)
                 goto out_free_log;
-        bp->b_iodone = xlog_iodone;
+
+        /*
+         * The iclogbuf buffer locks are held over IO but we are not going to do
+         * IO yet.  Hence unlock the buffer so that the log IO path can grab it
+         * when appropriately.
+         */
         ASSERT(xfs_buf_islocked(bp));
+        xfs_buf_unlock(bp);
+
+        bp->b_iodone = xlog_iodone;
         log->l_xbuf = bp;
 
         spin_lock_init(&log->l_icloglock);
@@ -1398,6 +1409,9 @@ xlog_alloc_log(
                 if (!bp)
                         goto out_free_iclog;
 
+                ASSERT(xfs_buf_islocked(bp));
+                xfs_buf_unlock(bp);
+
                 bp->b_iodone = xlog_iodone;
                 iclog->ic_bp = bp;
                 iclog->ic_data = bp->b_addr;
@@ -1422,7 +1436,6 @@ xlog_alloc_log(
                 iclog->ic_callback_tail = &(iclog->ic_callback);
                 iclog->ic_datap = (char *)iclog->ic_data + log->l_iclog_hsize;
 
-                ASSERT(xfs_buf_islocked(iclog->ic_bp));
                 init_waitqueue_head(&iclog->ic_force_wait);
                 init_waitqueue_head(&iclog->ic_write_wait);
 
@@ -1631,6 +1644,12 @@ xlog_cksum(
  * we transition the iclogs to IOERROR state *after* flushing all existing
  * iclogs to disk. This is because we don't want anymore new transactions to be
  * started or completed afterwards.
+ *
+ * We lock the iclogbufs here so that we can serialise against IO completion
+ * during unmount. We might be processing a shutdown triggered during unmount,
+ * and that can occur asynchronously to the unmount thread, and hence we need to
+ * ensure that completes before tearing down the iclogbufs. Hence we need to
+ * hold the buffer lock across the log IO to acheive that.
  */
 STATIC int
 xlog_bdstrat(
@@ -1638,6 +1657,7 @@ xlog_bdstrat(
 {
         struct xlog_in_core     *iclog = bp->b_fspriv;
 
+        xfs_buf_lock(bp);
         if (iclog->ic_state & XLOG_STATE_IOERROR) {
                 xfs_buf_ioerror(bp, EIO);
                 xfs_buf_stale(bp);
@@ -1645,7 +1665,8 @@ xlog_bdstrat(
                 /*
                  * It would seem logical to return EIO here, but we rely on
                  * the log state machine to propagate I/O errors instead of
-                 * doing it here.
+                 * doing it here. Similarly, IO completion will unlock the
+                 * buffer, so we don't do it here.
                  */
                 return 0;
         }
@@ -1847,14 +1868,28 @@ xlog_dealloc_log(
         xlog_cil_destroy(log);
 
         /*
-         * always need to ensure that the extra buffer does not point to memory
-         * owned by another log buffer before we free it.
+         * Cycle all the iclogbuf locks to make sure all log IO completion
+         * is done before we tear down these buffers.
          */
+        iclog = log->l_iclog;
+        for (i = 0; i < log->l_iclog_bufs; i++) {
+                xfs_buf_lock(iclog->ic_bp);
+                xfs_buf_unlock(iclog->ic_bp);
+                iclog = iclog->ic_next;
+        }
+
+        /*
+         * Always need to ensure that the extra buffer does not point to memory
+         * owned by another log buffer before we free it. Also, cycle the lock
+         * first to ensure we've completed IO on it.
+         */
+        xfs_buf_lock(log->l_xbuf);
+        xfs_buf_unlock(log->l_xbuf);
         xfs_buf_set_empty(log->l_xbuf, BTOBB(log->l_iclog_size));
         xfs_buf_free(log->l_xbuf);
 
         iclog = log->l_iclog;
-        for (i=0; i<log->l_iclog_bufs; i++) {
+        for (i = 0; i < log->l_iclog_bufs; i++) {
                 xfs_buf_free(iclog->ic_bp);
                 next_iclog = iclog->ic_next;
                 kmem_free(iclog);
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index a4ae41c179a8..65d8c793a25c 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -603,6 +603,7 @@ DEFINE_INODE_EVENT(xfs_readlink);
 DEFINE_INODE_EVENT(xfs_inactive_symlink);
 DEFINE_INODE_EVENT(xfs_alloc_file_space);
 DEFINE_INODE_EVENT(xfs_free_file_space);
+DEFINE_INODE_EVENT(xfs_zero_file_space);
 DEFINE_INODE_EVENT(xfs_collapse_file_space);
 DEFINE_INODE_EVENT(xfs_readdir);
 #ifdef CONFIG_XFS_POSIX_ACL