Merge branch 'master' into for-2.6.33

72 files changed, 1896 insertions, 449 deletions

diff --git a/fs/9p/cache.c b/fs/9p/cache.c
index 51c94e26a346..e777961939f3 100644
--- a/fs/9p/cache.c
+++ b/fs/9p/cache.c
@@ -343,18 +343,7 @@ int __v9fs_fscache_release_page(struct page *page, gfp_t gfp)
 
         BUG_ON(!vcookie->fscache);
 
-        if (PageFsCache(page)) {
-                if (fscache_check_page_write(vcookie->fscache, page)) {
-                        if (!(gfp & __GFP_WAIT))
-                                return 0;
-                        fscache_wait_on_page_write(vcookie->fscache, page);
-                }
-
-                fscache_uncache_page(vcookie->fscache, page);
-                ClearPageFsCache(page);
-        }
-
-        return 1;
+        return fscache_maybe_release_page(vcookie->fscache, page, gfp);
 }
 
 void __v9fs_fscache_invalidate_page(struct page *page)
@@ -368,7 +357,6 @@ void __v9fs_fscache_invalidate_page(struct page *page)
                 fscache_wait_on_page_write(vcookie->fscache, page);
                 BUG_ON(!PageLocked(page));
                 fscache_uncache_page(vcookie->fscache, page);
-                ClearPageFsCache(page);
         }
 }
 
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index 873cd31baa47..15cce53bf61e 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -40,6 +40,24 @@
 #include "fid.h"
 
 /**
+ * struct p9_rdir - readdir accounting
+ * @mutex: mutex protecting readdir
+ * @head: start offset of current dirread buffer
+ * @tail: end offset of current dirread buffer
+ * @buf: dirread buffer
+ *
+ * private structure for keeping track of readdir
+ * allocated on demand
+ */
+
+struct p9_rdir {
+        struct mutex mutex;
+        int head;
+        int tail;
+        uint8_t *buf;
+};
+
+/**
  * dt_type - return file type
  * @mistat: mistat structure
  *
@@ -70,56 +88,79 @@ static int v9fs_dir_readdir(struct file *filp, void *dirent, filldir_t filldir)
 {
         int over;
         struct p9_wstat st;
-        int err;
+        int err = 0;
         struct p9_fid *fid;
         int buflen;
-        char *statbuf;
-        int n, i = 0;
+        int reclen = 0;
+        struct p9_rdir *rdir;
 
         P9_DPRINTK(P9_DEBUG_VFS, "name %s\n", filp->f_path.dentry->d_name.name);
         fid = filp->private_data;
 
         buflen = fid->clnt->msize - P9_IOHDRSZ;
-        statbuf = kmalloc(buflen, GFP_KERNEL);
-        if (!statbuf)
-                return -ENOMEM;
-
-        while (1) {
-                err = v9fs_file_readn(filp, statbuf, NULL, buflen,
-                                                                fid->rdir_fpos);
-                if (err <= 0)
-                        break;
-
-                n = err;
-                while (i < n) {
-                        err = p9stat_read(statbuf + i, buflen-i, &st,
-                                                        fid->clnt->dotu);
+
+        /* allocate rdir on demand */
+        if (!fid->rdir) {
+                rdir = kmalloc(sizeof(struct p9_rdir) + buflen, GFP_KERNEL);
+
+                if (rdir == NULL) {
+                        err = -ENOMEM;
+                        goto exit;
+                }
+                spin_lock(&filp->f_dentry->d_lock);
+                if (!fid->rdir) {
+                        rdir->buf = (uint8_t *)rdir + sizeof(struct p9_rdir);
+                        mutex_init(&rdir->mutex);
+                        rdir->head = rdir->tail = 0;
+                        fid->rdir = (void *) rdir;
+                        rdir = NULL;
+                }
+                spin_unlock(&filp->f_dentry->d_lock);
+                kfree(rdir);
+        }
+        rdir = (struct p9_rdir *) fid->rdir;
+
+        err = mutex_lock_interruptible(&rdir->mutex);
+        while (err == 0) {
+                if (rdir->tail == rdir->head) {
+                        err = v9fs_file_readn(filp, rdir->buf, NULL,
+                                                        buflen, filp->f_pos);
+                        if (err <= 0)
+                                goto unlock_and_exit;
+
+                        rdir->head = 0;
+                        rdir->tail = err;
+                }
+
+                while (rdir->head < rdir->tail) {
+                        err = p9stat_read(rdir->buf + rdir->head,
+                                                buflen - rdir->head, &st,
+                                                fid->clnt->dotu);
                         if (err) {
                                 P9_DPRINTK(P9_DEBUG_VFS, "returned %d\n", err);
                                 err = -EIO;
                                 p9stat_free(&st);
-                                goto free_and_exit;
+                                goto unlock_and_exit;
                         }
-
-                        i += st.size+2;
-                        fid->rdir_fpos += st.size+2;
+                        reclen = st.size+2;
 
                         over = filldir(dirent, st.name, strlen(st.name),
                             filp->f_pos, v9fs_qid2ino(&st.qid), dt_type(&st));
 
-                        filp->f_pos += st.size+2;
-
                         p9stat_free(&st);
 
                         if (over) {
                                 err = 0;
-                                goto free_and_exit;
+                                goto unlock_and_exit;
                         }
+                        rdir->head += reclen;
+                        filp->f_pos += reclen;
                 }
         }
 
-free_and_exit:
-        kfree(statbuf);
+unlock_and_exit:
+        mutex_unlock(&rdir->mutex);
+exit:
         return err;
 }
 
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 5947628aefef..18f74ec4dce9 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -994,8 +994,7 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
         P9_DPRINTK(P9_DEBUG_VFS,
                 "%s -> %s (%s)\n", dentry->d_name.name, st->extension, buffer);
 
-        retval = buflen;
-
+        retval = strnlen(buffer, buflen);
 done:
         kfree(st);
         return retval;
@@ -1062,7 +1061,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
                         __putname(link);
                         link = ERR_PTR(len);
                 } else
-                        link[len] = 0;
+                        link[min(len, PATH_MAX-1)] = 0;
         }
         nd_set_link(nd, link);
 
diff --git a/fs/Kconfig b/fs/Kconfig
index 2126078a38ed..64d44efad7a5 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -135,7 +135,7 @@ config TMPFS_POSIX_ACL
 
 config HUGETLBFS
         bool "HugeTLB file system support"
-        depends on X86 || IA64 || PPC_BOOK3S_64 || SPARC64 || (S390 && 64BIT) || \
+        depends on X86 || IA64 || SPARC64 || (S390 && 64BIT) || \
                    SYS_SUPPORTS_HUGETLBFS || BROKEN
         help
           hugetlbfs is a filesystem backing for HugeTLB pages, based on
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 681c2a7b013f..39b301662f22 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -315,7 +315,6 @@ static void afs_invalidatepage(struct page *page, unsigned long offset)
                         struct afs_vnode *vnode = AFS_FS_I(page->mapping->host);
                         fscache_wait_on_page_write(vnode->cache, page);
                         fscache_uncache_page(vnode->cache, page);
-                        ClearPageFsCache(page);
                 }
 #endif
 
@@ -349,17 +348,9 @@ static int afs_releasepage(struct page *page, gfp_t gfp_flags)
         /* deny if page is being written to the cache and the caller hasn't
          * elected to wait */
 #ifdef CONFIG_AFS_FSCACHE
-        if (PageFsCache(page)) {
-                if (fscache_check_page_write(vnode->cache, page)) {
-                        if (!(gfp_flags & __GFP_WAIT)) {
-                                _leave(" = F [cache busy]");
-                                return 0;
-                        }
-                        fscache_wait_on_page_write(vnode->cache, page);
-                }
-
-                fscache_uncache_page(vnode->cache, page);
-                ClearPageFsCache(page);
+        if (!fscache_maybe_release_page(vnode->cache, page, gfp_flags)) {
+                _leave(" = F [cache busy]");
+                return 0;
         }
 #endif
 
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index e238a0cdac67..94627c4cc193 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2977,10 +2977,10 @@ static int maybe_allocate_chunk(struct btrfs_root *root,
 
         free_space = btrfs_super_total_bytes(disk_super);
         /*
-         * we allow the metadata to grow to a max of either 5gb or 5% of the
+         * we allow the metadata to grow to a max of either 10gb or 5% of the
          * space in the volume.
          */
-        min_metadata = min((u64)5 * 1024 * 1024 * 1024,
+        min_metadata = min((u64)10 * 1024 * 1024 * 1024,
                              div64_u64(free_space * 5, 100));
         if (info->total_bytes >= min_metadata) {
                 spin_unlock(&info->lock);
@@ -4102,7 +4102,7 @@ wait_block_group_cache_done(struct btrfs_block_group_cache *cache)
 }
 
 enum btrfs_loop_type {
-        LOOP_CACHED_ONLY = 0,
+        LOOP_FIND_IDEAL = 0,
         LOOP_CACHING_NOWAIT = 1,
         LOOP_CACHING_WAIT = 2,
         LOOP_ALLOC_CHUNK = 3,
@@ -4131,12 +4131,15 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
         struct btrfs_block_group_cache *block_group = NULL;
         int empty_cluster = 2 * 1024 * 1024;
         int allowed_chunk_alloc = 0;
+        int done_chunk_alloc = 0;
         struct btrfs_space_info *space_info;
         int last_ptr_loop = 0;
         int loop = 0;
         bool found_uncached_bg = false;
         bool failed_cluster_refill = false;
         bool failed_alloc = false;
+        u64 ideal_cache_percent = 0;
+        u64 ideal_cache_offset = 0;
 
         WARN_ON(num_bytes < root->sectorsize);
         btrfs_set_key_type(ins, BTRFS_EXTENT_ITEM_KEY);
@@ -4172,14 +4175,19 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
                 empty_cluster = 0;
 
         if (search_start == hint_byte) {
+ideal_cache:
                 block_group = btrfs_lookup_block_group(root->fs_info,
                                                        search_start);
                 /*
                  * we don't want to use the block group if it doesn't match our
                  * allocation bits, or if its not cached.
+                 *
+                 * However if we are re-searching with an ideal block group
+                 * picked out then we don't care that the block group is cached.
                  */
                 if (block_group && block_group_bits(block_group, data) &&
-                    block_group_cache_done(block_group)) {
+                    (block_group->cached != BTRFS_CACHE_NO ||
+                     search_start == ideal_cache_offset)) {
                         down_read(&space_info->groups_sem);
                         if (list_empty(&block_group->list) ||
                             block_group->ro) {
@@ -4191,13 +4199,13 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
                                  */
                                 btrfs_put_block_group(block_group);
                                 up_read(&space_info->groups_sem);
-                        } else
+                        } else {
                                 goto have_block_group;
+                        }
                 } else if (block_group) {
                         btrfs_put_block_group(block_group);
                 }
         }
-
 search:
         down_read(&space_info->groups_sem);
         list_for_each_entry(block_group, &space_info->block_groups, list) {
@@ -4209,28 +4217,45 @@ search:
 
 have_block_group:
                 if (unlikely(block_group->cached == BTRFS_CACHE_NO)) {
+                        u64 free_percent;
+
+                        free_percent = btrfs_block_group_used(&block_group->item);
+                        free_percent *= 100;
+                        free_percent = div64_u64(free_percent,
+                                                 block_group->key.offset);
+                        free_percent = 100 - free_percent;
+                        if (free_percent > ideal_cache_percent &&
+                            likely(!block_group->ro)) {
+                                ideal_cache_offset = block_group->key.objectid;
+                                ideal_cache_percent = free_percent;
+                        }
+
                         /*
-                         * we want to start caching kthreads, but not too many
-                         * right off the bat so we don't overwhelm the system,
-                         * so only start them if there are less than 2 and we're
-                         * in the initial allocation phase.
+                         * We only want to start kthread caching if we are at
+                         * the point where we will wait for caching to make
+                         * progress, or if our ideal search is over and we've
+                         * found somebody to start caching.
                          */
                         if (loop > LOOP_CACHING_NOWAIT ||
-                            atomic_read(&space_info->caching_threads) < 2) {
+                            (loop > LOOP_FIND_IDEAL &&
+                             atomic_read(&space_info->caching_threads) < 2)) {
                                 ret = cache_block_group(block_group);
                                 BUG_ON(ret);
                         }
-                }
-
-                cached = block_group_cache_done(block_group);
-                if (unlikely(!cached)) {
                         found_uncached_bg = true;
 
-                        /* if we only want cached bgs, loop */
-                        if (loop == LOOP_CACHED_ONLY)
+                        /*
+                         * If loop is set for cached only, try the next block
+                         * group.
+                         */
+                        if (loop == LOOP_FIND_IDEAL)
                                 goto loop;
                 }
 
+                cached = block_group_cache_done(block_group);
+                if (unlikely(!cached))
+                        found_uncached_bg = true;
+
                 if (unlikely(block_group->ro))
                         goto loop;
 
@@ -4410,9 +4435,11 @@ loop:
         }
         up_read(&space_info->groups_sem);
 
-        /* LOOP_CACHED_ONLY, only search fully cached block groups
-         * LOOP_CACHING_NOWAIT, search partially cached block groups, but
-         *                      dont wait foR them to finish caching
+        /* LOOP_FIND_IDEAL, only search caching/cached bg's, and don't wait for
+         *                      for them to make caching progress.  Also
+         *                      determine the best possible bg to cache
+         * LOOP_CACHING_NOWAIT, search partially cached block groups, kicking
+         *                      caching kthreads as we move along
          * LOOP_CACHING_WAIT, search everything, and wait if our bg is caching
          * LOOP_ALLOC_CHUNK, force a chunk allocation and try again
          * LOOP_NO_EMPTY_SIZE, set empty_size and empty_cluster to 0 and try
@@ -4421,12 +4448,47 @@ loop:
         if (!ins->objectid && loop < LOOP_NO_EMPTY_SIZE &&
             (found_uncached_bg || empty_size || empty_cluster ||
              allowed_chunk_alloc)) {
-                if (found_uncached_bg) {
+                if (loop == LOOP_FIND_IDEAL && found_uncached_bg) {
                         found_uncached_bg = false;
-                        if (loop < LOOP_CACHING_WAIT) {
-                                loop++;
+                        loop++;
+                        if (!ideal_cache_percent &&
+                            atomic_read(&space_info->caching_threads))
                                 goto search;
-                        }
+
+                        /*
+                         * 1 of the following 2 things have happened so far
+                         *
+                         * 1) We found an ideal block group for caching that
+                         * is mostly full and will cache quickly, so we might
+                         * as well wait for it.
+                         *
+                         * 2) We searched for cached only and we didn't find
+                         * anything, and we didn't start any caching kthreads
+                         * either, so chances are we will loop through and
+                         * start a couple caching kthreads, and then come back
+                         * around and just wait for them.  This will be slower
+                         * because we will have 2 caching kthreads reading at
+                         * the same time when we could have just started one
+                         * and waited for it to get far enough to give us an
+                         * allocation, so go ahead and go to the wait caching
+                         * loop.
+                         */
+                        loop = LOOP_CACHING_WAIT;
+                        search_start = ideal_cache_offset;
+                        ideal_cache_percent = 0;
+                        goto ideal_cache;
+                } else if (loop == LOOP_FIND_IDEAL) {
+                        /*
+                         * Didn't find a uncached bg, wait on anything we find
+                         * next.
+                         */
+                        loop = LOOP_CACHING_WAIT;
+                        goto search;
+                }
+
+                if (loop < LOOP_CACHING_WAIT) {
+                        loop++;
+                        goto search;
                 }
 
                 if (loop == LOOP_ALLOC_CHUNK) {
@@ -4438,7 +4500,8 @@ loop:
                         ret = do_chunk_alloc(trans, root, num_bytes +
                                              2 * 1024 * 1024, data, 1);
                         allowed_chunk_alloc = 0;
-                } else {
+                        done_chunk_alloc = 1;
+                } else if (!done_chunk_alloc) {
                         space_info->force_alloc = 1;
                 }
 
diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 2c726b7b9faa..ccbdcb54ec5d 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -208,7 +208,7 @@ int unpin_extent_cache(struct extent_map_tree *tree, u64 start, u64 len)
         write_lock(&tree->lock);
         em = lookup_extent_mapping(tree, start, len);
 
-        WARN_ON(em->start != start || !em);
+        WARN_ON(!em || em->start != start);
 
         if (!em)
                 goto out;
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 5c2caad76212..cb2849f03251 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1296,7 +1296,7 @@ again:
                         window_start = entry->offset;
                         window_free = entry->bytes;
                         last = entry;
-                        max_extent = 0;
+                        max_extent = entry->bytes;
                 } else {
                         last = next;
                         window_free += next->bytes;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index dae12dc7e159..b3ad168a0bfc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -538,7 +538,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
         struct extent_io_tree *io_tree;
-        int ret;
+        int ret = 0;
 
         if (list_empty(&async_cow->extents))
                 return 0;
@@ -552,6 +552,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
 
                 io_tree = &BTRFS_I(inode)->io_tree;
 
+retry:
                 /* did the compression code fall back to uncompressed IO? */
                 if (!async_extent->pages) {
                         int page_started = 0;
@@ -562,11 +563,11 @@ static noinline int submit_compressed_extents(struct inode *inode,
                                     async_extent->ram_size - 1, GFP_NOFS);
 
                         /* allocate blocks */
-                        cow_file_range(inode, async_cow->locked_page,
-                                       async_extent->start,
-                                       async_extent->start +
-                                       async_extent->ram_size - 1,
-                                       &page_started, &nr_written, 0);
+                        ret = cow_file_range(inode, async_cow->locked_page,
+                                             async_extent->start,
+                                             async_extent->start +
+                                             async_extent->ram_size - 1,
+                                             &page_started, &nr_written, 0);
 
                         /*
                          * if page_started, cow_file_range inserted an
@@ -574,7 +575,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
                          * and IO for us.  Otherwise, we need to submit
                          * all those pages down to the drive.
                          */
-                        if (!page_started)
+                        if (!page_started && !ret)
                                 extent_write_locked_range(io_tree,
                                                   inode, async_extent->start,
                                                   async_extent->start +
@@ -602,7 +603,21 @@ static noinline int submit_compressed_extents(struct inode *inode,
                                            async_extent->compressed_size,
                                            0, alloc_hint,
                                            (u64)-1, &ins, 1);
-                BUG_ON(ret);
+                if (ret) {
+                        int i;
+                        for (i = 0; i < async_extent->nr_pages; i++) {
+                                WARN_ON(async_extent->pages[i]->mapping);
+                                page_cache_release(async_extent->pages[i]);
+                        }
+                        kfree(async_extent->pages);
+                        async_extent->nr_pages = 0;
+                        async_extent->pages = NULL;
+                        unlock_extent(io_tree, async_extent->start,
+                                      async_extent->start +
+                                      async_extent->ram_size - 1, GFP_NOFS);
+                        goto retry;
+                }
+
                 em = alloc_extent_map(GFP_NOFS);
                 em->start = async_extent->start;
                 em->len = async_extent->ram_size;
@@ -743,8 +758,22 @@ static noinline int cow_file_range(struct inode *inode,
         em = search_extent_mapping(&BTRFS_I(inode)->extent_tree,
                                    start, num_bytes);
         if (em) {
-                alloc_hint = em->block_start;
-                free_extent_map(em);
+                /*
+                 * if block start isn't an actual block number then find the
+                 * first block in this inode and use that as a hint.  If that
+                 * block is also bogus then just don't worry about it.
+                 */
+                if (em->block_start >= EXTENT_MAP_LAST_BYTE) {
+                        free_extent_map(em);
+                        em = search_extent_mapping(em_tree, 0, 0);
+                        if (em && em->block_start < EXTENT_MAP_LAST_BYTE)
+                                alloc_hint = em->block_start;
+                        if (em)
+                                free_extent_map(em);
+                } else {
+                        alloc_hint = em->block_start;
+                        free_extent_map(em);
+                }
         }
         read_unlock(&BTRFS_I(inode)->extent_tree.lock);
         btrfs_drop_extent_cache(inode, start, start + num_bytes - 1, 0);
@@ -2474,7 +2503,19 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
 
         root = BTRFS_I(dir)->root;
 
+        /*
+         * 5 items for unlink inode
+         * 1 for orphan
+         */
+        ret = btrfs_reserve_metadata_space(root, 6);
+        if (ret)
+                return ret;
+
         trans = btrfs_start_transaction(root, 1);
+        if (IS_ERR(trans)) {
+                btrfs_unreserve_metadata_space(root, 6);
+                return PTR_ERR(trans);
+        }
 
         btrfs_set_trans_block_group(trans, dir);
 
@@ -2489,6 +2530,7 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
         nr = trans->blocks_used;
 
         btrfs_end_transaction_throttle(trans, root);
+        btrfs_unreserve_metadata_space(root, 6);
         btrfs_btree_balance_dirty(root, nr);
         return ret;
 }
@@ -2569,7 +2611,16 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
             inode->i_ino == BTRFS_FIRST_FREE_OBJECTID)
                 return -ENOTEMPTY;
 
+        ret = btrfs_reserve_metadata_space(root, 5);
+        if (ret)
+                return ret;
+
         trans = btrfs_start_transaction(root, 1);
+        if (IS_ERR(trans)) {
+                btrfs_unreserve_metadata_space(root, 5);
+                return PTR_ERR(trans);
+        }
+
         btrfs_set_trans_block_group(trans, dir);
 
         if (unlikely(inode->i_ino == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID)) {
@@ -2592,6 +2643,7 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
 out:
         nr = trans->blocks_used;
         ret = btrfs_end_transaction_throttle(trans, root);
+        btrfs_unreserve_metadata_space(root, 5);
         btrfs_btree_balance_dirty(root, nr);
 
         if (ret && !err)
@@ -5128,6 +5180,7 @@ struct inode *btrfs_alloc_inode(struct super_block *sb)
         ei->logged_trans = 0;
         ei->outstanding_extents = 0;
         ei->reserved_extents = 0;
+        ei->root = NULL;
         spin_lock_init(&ei->accounting_lock);
         btrfs_ordered_inode_tree_init(&ei->ordered_tree);
         INIT_LIST_HEAD(&ei->i_orphan);
@@ -5144,6 +5197,14 @@ void btrfs_destroy_inode(struct inode *inode)
         WARN_ON(inode->i_data.nrpages);
 
         /*
+         * This can happen where we create an inode, but somebody else also
+         * created the same inode and we need to destroy the one we already
+         * created.
+         */
+        if (!root)
+                goto free;
+
+        /*
          * Make sure we're properly removed from the ordered operation
          * lists.
          */
@@ -5178,6 +5239,7 @@ void btrfs_destroy_inode(struct inode *inode)
         }
         inode_tree_del(inode);
         btrfs_drop_extent_cache(inode, 0, (u64)-1, 0);
+free:
         kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode));
 }
 
@@ -5283,11 +5345,14 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 return -ENOTEMPTY;
 
         /*
-         * 2 items for dir items
-         * 1 item for orphan entry
-         * 1 item for ref
+         * We want to reserve the absolute worst case amount of items.  So if
+         * both inodes are subvols and we need to unlink them then that would
+         * require 4 item modifications, but if they are both normal inodes it
+         * would require 5 item modifications, so we'll assume their normal
+         * inodes.  So 5 * 2 is 10, plus 1 for the new link, so 11 total items
+         * should cover the worst case number of items we'll modify.
          */
-        ret = btrfs_reserve_metadata_space(root, 4);
+        ret = btrfs_reserve_metadata_space(root, 11);
         if (ret)
                 return ret;
 
@@ -5403,7 +5468,7 @@ out_fail:
         if (old_inode->i_ino == BTRFS_FIRST_FREE_OBJECTID)
                 up_read(&root->fs_info->subvol_sem);
 
-        btrfs_unreserve_metadata_space(root, 4);
+        btrfs_unreserve_metadata_space(root, 11);
         return ret;
 }
 
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index 9351428f30e2..67fa2d29d663 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -159,7 +159,6 @@ int btrfs_update_root(struct btrfs_trans_handle *trans, struct btrfs_root
         write_extent_buffer(l, item, ptr, sizeof(*item));
         btrfs_mark_buffer_dirty(path->nodes[0]);
 out:
-        btrfs_release_path(root, path);
         btrfs_free_path(path);
         return ret;
 }
@@ -332,7 +331,6 @@ int btrfs_del_root(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         BUG_ON(refs != 0);
         ret = btrfs_del_item(trans, root, path);
 out:
-        btrfs_release_path(root, path);
         btrfs_free_path(path);
         return ret;
 }
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index bca82a4ca8e6..c207e8c32c9b 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -163,8 +163,14 @@ static void wait_current_trans(struct btrfs_root *root)
         }
 }
 
+enum btrfs_trans_type {
+        TRANS_START,
+        TRANS_JOIN,
+        TRANS_USERSPACE,
+};
+
 static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
-                                             int num_blocks, int wait)
+                                             int num_blocks, int type)
 {
         struct btrfs_trans_handle *h =
                 kmem_cache_alloc(btrfs_trans_handle_cachep, GFP_NOFS);
@@ -172,7 +178,8 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
 
         mutex_lock(&root->fs_info->trans_mutex);
         if (!root->fs_info->log_root_recovering &&
-            ((wait == 1 && !root->fs_info->open_ioctl_trans) || wait == 2))
+            ((type == TRANS_START && !root->fs_info->open_ioctl_trans) ||
+             type == TRANS_USERSPACE))
                 wait_current_trans(root);
         ret = join_transaction(root);
         BUG_ON(ret);
@@ -186,7 +193,7 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
         h->alloc_exclude_start = 0;
         h->delayed_ref_updates = 0;
 
-        if (!current->journal_info)
+        if (!current->journal_info && type != TRANS_USERSPACE)
                 current->journal_info = h;
 
         root->fs_info->running_transaction->use_count++;
@@ -198,18 +205,18 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
 struct btrfs_trans_handle *btrfs_start_transaction(struct btrfs_root *root,
                                                    int num_blocks)
 {
-        return start_transaction(root, num_blocks, 1);
+        return start_transaction(root, num_blocks, TRANS_START);
 }
 struct btrfs_trans_handle *btrfs_join_transaction(struct btrfs_root *root,
                                                    int num_blocks)
 {
-        return start_transaction(root, num_blocks, 0);
+        return start_transaction(root, num_blocks, TRANS_JOIN);
 }
 
 struct btrfs_trans_handle *btrfs_start_ioctl_transaction(struct btrfs_root *r,
                                                          int num_blocks)
 {
-        return start_transaction(r, num_blocks, 2);
+        return start_transaction(r, num_blocks, TRANS_USERSPACE);
 }
 
 /* wait for a transaction commit to be fully complete */
diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c
index 431accd475a7..27089311fbea 100644
--- a/fs/cachefiles/interface.c
+++ b/fs/cachefiles/interface.c
@@ -114,8 +114,9 @@ nomem_lookup_data:
 
 /*
  * attempt to look up the nominated node in this cache
+ * - return -ETIMEDOUT to be scheduled again
  */
-static void cachefiles_lookup_object(struct fscache_object *_object)
+static int cachefiles_lookup_object(struct fscache_object *_object)
 {
         struct cachefiles_lookup_data *lookup_data;
         struct cachefiles_object *parent, *object;
@@ -145,13 +146,15 @@ static void cachefiles_lookup_object(struct fscache_object *_object)
             object->fscache.cookie->def->type != FSCACHE_COOKIE_TYPE_INDEX)
                 cachefiles_attr_changed(&object->fscache);
 
-        if (ret < 0) {
-                printk(KERN_WARNING "CacheFiles: Lookup failed error %d\n",
-                       ret);
+        if (ret < 0 && ret != -ETIMEDOUT) {
+                if (ret != -ENOBUFS)
+                        printk(KERN_WARNING
+                               "CacheFiles: Lookup failed error %d\n", ret);
                 fscache_object_lookup_error(&object->fscache);
         }
 
         _leave(" [%d]", ret);
+        return ret;
 }
 
 /*
@@ -331,6 +334,7 @@ static void cachefiles_put_object(struct fscache_object *_object)
                 }
 
                 cache = object->fscache.cache;
+                fscache_object_destroy(&object->fscache);
                 kmem_cache_free(cachefiles_object_jar, object);
                 fscache_object_destroyed(cache);
         }
@@ -403,12 +407,26 @@ static int cachefiles_attr_changed(struct fscache_object *_object)
         if (oi_size == ni_size)
                 return 0;
 
-        newattrs.ia_size = ni_size;
-        newattrs.ia_valid = ATTR_SIZE;
-
         cachefiles_begin_secure(cache, &saved_cred);
         mutex_lock(&object->backer->d_inode->i_mutex);
+
+        /* if there's an extension to a partial page at the end of the backing
+         * file, we need to discard the partial page so that we pick up new
+         * data after it */
+        if (oi_size & ~PAGE_MASK && ni_size > oi_size) {
+                _debug("discard tail %llx", oi_size);
+                newattrs.ia_valid = ATTR_SIZE;
+                newattrs.ia_size = oi_size & PAGE_MASK;
+                ret = notify_change(object->backer, &newattrs);
+                if (ret < 0)
+                        goto truncate_failed;
+        }
+
+        newattrs.ia_valid = ATTR_SIZE;
+        newattrs.ia_size = ni_size;
         ret = notify_change(object->backer, &newattrs);
+
+truncate_failed:
         mutex_unlock(&object->backer->d_inode->i_mutex);
         cachefiles_end_secure(cache, saved_cred);
 
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index 4ce818ae39ea..14ac4806e291 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -21,17 +21,81 @@
 #include <linux/security.h>
 #include "internal.h"
 
-static int cachefiles_wait_bit(void *flags)
+#define CACHEFILES_KEYBUF_SIZE 512
+
+/*
+ * dump debugging info about an object
+ */
+static noinline
+void __cachefiles_printk_object(struct cachefiles_object *object,
+                                const char *prefix,
+                                u8 *keybuf)
 {
-        schedule();
-        return 0;
+        struct fscache_cookie *cookie;
+        unsigned keylen, loop;
+
+        printk(KERN_ERR "%sobject: OBJ%x\n",
+               prefix, object->fscache.debug_id);
+        printk(KERN_ERR "%sobjstate=%s fl=%lx swfl=%lx ev=%lx[%lx]\n",
+               prefix, fscache_object_states[object->fscache.state],
+               object->fscache.flags, object->fscache.work.flags,
+               object->fscache.events,
+               object->fscache.event_mask & FSCACHE_OBJECT_EVENTS_MASK);
+        printk(KERN_ERR "%sops=%u inp=%u exc=%u\n",
+               prefix, object->fscache.n_ops, object->fscache.n_in_progress,
+               object->fscache.n_exclusive);
+        printk(KERN_ERR "%sparent=%p\n",
+               prefix, object->fscache.parent);
+
+        spin_lock(&object->fscache.lock);
+        cookie = object->fscache.cookie;
+        if (cookie) {
+                printk(KERN_ERR "%scookie=%p [pr=%p nd=%p fl=%lx]\n",
+                       prefix,
+                       object->fscache.cookie,
+                       object->fscache.cookie->parent,
+                       object->fscache.cookie->netfs_data,
+                       object->fscache.cookie->flags);
+                if (keybuf)
+                        keylen = cookie->def->get_key(cookie->netfs_data, keybuf,
+                                                      CACHEFILES_KEYBUF_SIZE);
+                else
+                        keylen = 0;
+        } else {
+                printk(KERN_ERR "%scookie=NULL\n", prefix);
+                keylen = 0;
+        }
+        spin_unlock(&object->fscache.lock);
+
+        if (keylen) {
+                printk(KERN_ERR "%skey=[%u] '", prefix, keylen);
+                for (loop = 0; loop < keylen; loop++)
+                        printk("%02x", keybuf[loop]);
+                printk("'\n");
+        }
+}
+
+/*
+ * dump debugging info about a pair of objects
+ */
+static noinline void cachefiles_printk_object(struct cachefiles_object *object,
+                                              struct cachefiles_object *xobject)
+{
+        u8 *keybuf;
+
+        keybuf = kmalloc(CACHEFILES_KEYBUF_SIZE, GFP_NOIO);
+        if (object)
+                __cachefiles_printk_object(object, "", keybuf);
+        if (xobject)
+                __cachefiles_printk_object(xobject, "x", keybuf);
+        kfree(keybuf);
 }
 
 /*
  * record the fact that an object is now active
  */
-static void cachefiles_mark_object_active(struct cachefiles_cache *cache,
-                                          struct cachefiles_object *object)
+static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
+                                         struct cachefiles_object *object)
 {
         struct cachefiles_object *xobject;
         struct rb_node **_p, *_parent = NULL;
@@ -42,8 +106,11 @@ static void cachefiles_mark_object_active(struct cachefiles_cache *cache,
 try_again:
         write_lock(&cache->active_lock);
 
-        if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags))
+        if (test_and_set_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags)) {
+                printk(KERN_ERR "CacheFiles: Error: Object already active\n");
+                cachefiles_printk_object(object, NULL);
                 BUG();
+        }
 
         dentry = object->dentry;
         _p = &cache->active_nodes.rb_node;
@@ -66,8 +133,8 @@ try_again:
         rb_insert_color(&object->active_node, &cache->active_nodes);
 
         write_unlock(&cache->active_lock);
-        _leave("");
-        return;
+        _leave(" = 0");
+        return 0;
 
         /* an old object from a previous incarnation is hogging the slot - we
          * need to wait for it to be destroyed */
@@ -76,44 +143,70 @@ wait_for_old_object:
                 printk(KERN_ERR "\n");
                 printk(KERN_ERR "CacheFiles: Error:"
                        " Unexpected object collision\n");
-                printk(KERN_ERR "xobject: OBJ%x\n",
-                       xobject->fscache.debug_id);
-                printk(KERN_ERR "xobjstate=%s\n",
-                       fscache_object_states[xobject->fscache.state]);
-                printk(KERN_ERR "xobjflags=%lx\n", xobject->fscache.flags);
-                printk(KERN_ERR "xobjevent=%lx [%lx]\n",
-                       xobject->fscache.events, xobject->fscache.event_mask);
-                printk(KERN_ERR "xops=%u inp=%u exc=%u\n",
-                       xobject->fscache.n_ops, xobject->fscache.n_in_progress,
-                       xobject->fscache.n_exclusive);
-                printk(KERN_ERR "xcookie=%p [pr=%p nd=%p fl=%lx]\n",
-                       xobject->fscache.cookie,
-                       xobject->fscache.cookie->parent,
-                       xobject->fscache.cookie->netfs_data,
-                       xobject->fscache.cookie->flags);
-                printk(KERN_ERR "xparent=%p\n",
-                       xobject->fscache.parent);
-                printk(KERN_ERR "object: OBJ%x\n",
-                       object->fscache.debug_id);
-                printk(KERN_ERR "cookie=%p [pr=%p nd=%p fl=%lx]\n",
-                       object->fscache.cookie,
-                       object->fscache.cookie->parent,
-                       object->fscache.cookie->netfs_data,
-                       object->fscache.cookie->flags);
-                printk(KERN_ERR "parent=%p\n",
-                       object->fscache.parent);
+                cachefiles_printk_object(object, xobject);
                 BUG();
         }
         atomic_inc(&xobject->usage);
         write_unlock(&cache->active_lock);
 
-        _debug(">>> wait");
-        wait_on_bit(&xobject->flags, CACHEFILES_OBJECT_ACTIVE,
-                    cachefiles_wait_bit, TASK_UNINTERRUPTIBLE);
-        _debug("<<< waited");
+        if (test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
+                wait_queue_head_t *wq;
+
+                signed long timeout = 60 * HZ;
+                wait_queue_t wait;
+                bool requeue;
+
+                /* if the object we're waiting for is queued for processing,
+                 * then just put ourselves on the queue behind it */
+                if (slow_work_is_queued(&xobject->fscache.work)) {
+                        _debug("queue OBJ%x behind OBJ%x immediately",
+                               object->fscache.debug_id,
+                               xobject->fscache.debug_id);
+                        goto requeue;
+                }
+
+                /* otherwise we sleep until either the object we're waiting for
+                 * is done, or the slow-work facility wants the thread back to
+                 * do other work */
+                wq = bit_waitqueue(&xobject->flags, CACHEFILES_OBJECT_ACTIVE);
+                init_wait(&wait);
+                requeue = false;
+                do {
+                        prepare_to_wait(wq, &wait, TASK_UNINTERRUPTIBLE);
+                        if (!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags))
+                                break;
+                        requeue = slow_work_sleep_till_thread_needed(
+                                &object->fscache.work, &timeout);
+                } while (timeout > 0 && !requeue);
+                finish_wait(wq, &wait);
+
+                if (requeue &&
+                    test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags)) {
+                        _debug("queue OBJ%x behind OBJ%x after wait",
+                               object->fscache.debug_id,
+                               xobject->fscache.debug_id);
+                        goto requeue;
+                }
+
+                if (timeout <= 0) {
+                        printk(KERN_ERR "\n");
+                        printk(KERN_ERR "CacheFiles: Error: Overlong"
+                               " wait for old active object to go away\n");
+                        cachefiles_printk_object(object, xobject);
+                        goto requeue;
+                }
+        }
+
+        ASSERT(!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags));
 
         cache->cache.ops->put_object(&xobject->fscache);
         goto try_again;
+
+requeue:
+        clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
+        cache->cache.ops->put_object(&xobject->fscache);
+        _leave(" = -ETIMEDOUT");
+        return -ETIMEDOUT;
 }
 
 /*
@@ -254,7 +347,7 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
 
         dir = dget_parent(object->dentry);
 
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
         ret = cachefiles_bury_object(cache, dir, object->dentry);
 
         dput(dir);
@@ -307,7 +400,7 @@ lookup_again:
         /* search the current directory for the element name */
         _debug("lookup '%s'", name);
 
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
 
         start = jiffies;
         next = lookup_one_len(name, dir, nlen);
@@ -418,12 +511,15 @@ lookup_again:
         }
 
         /* note that we're now using this object */
-        cachefiles_mark_object_active(cache, object);
+        ret = cachefiles_mark_object_active(cache, object);
 
         mutex_unlock(&dir->d_inode->i_mutex);
         dput(dir);
         dir = NULL;
 
+        if (ret == -ETIMEDOUT)
+                goto mark_active_timed_out;
+
         _debug("=== OBTAINED_OBJECT ===");
 
         if (object->new) {
@@ -467,6 +563,10 @@ create_error:
                 cachefiles_io_error(cache, "Create/mkdir failed");
         goto error;
 
+mark_active_timed_out:
+        _debug("mark active timed out");
+        goto release_dentry;
+
 check_error:
         _debug("check error %d", ret);
         write_lock(&cache->active_lock);
@@ -474,7 +574,7 @@ check_error:
         clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
         wake_up_bit(&object->flags, CACHEFILES_OBJECT_ACTIVE);
         write_unlock(&cache->active_lock);
-
+release_dentry:
         dput(object->dentry);
         object->dentry = NULL;
         goto error_out;
@@ -495,9 +595,6 @@ error:
 error_out2:
         dput(dir);
 error_out:
-        if (ret == -ENOSPC)
-                ret = -ENOBUFS;
-
         _leave(" = error %d", -ret);
         return ret;
 }
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index a69787e7dd96..a6c8c6fe8df9 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -11,6 +11,7 @@
 
 #include <linux/mount.h>
 #include <linux/file.h>
+#include <linux/ima.h>
 #include "internal.h"
 
 /*
@@ -40,8 +41,10 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode,
 
         _debug("--- monitor %p %lx ---", page, page->flags);
 
-        if (!PageUptodate(page) && !PageError(page))
-                dump_stack();
+        if (!PageUptodate(page) && !PageError(page)) {
+                /* unlocked, not uptodate and not erronous? */
+                _debug("page probably truncated");
+        }
 
         /* remove from the waitqueue */
         list_del(&wait->task_list);
@@ -61,6 +64,84 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode,
 }
 
 /*
+ * handle a probably truncated page
+ * - check to see if the page is still relevant and reissue the read if
+ *   possible
+ * - return -EIO on error, -ENODATA if the page is gone, -EINPROGRESS if we
+ *   must wait again and 0 if successful
+ */
+static int cachefiles_read_reissue(struct cachefiles_object *object,
+                                   struct cachefiles_one_read *monitor)
+{
+        struct address_space *bmapping = object->backer->d_inode->i_mapping;
+        struct page *backpage = monitor->back_page, *backpage2;
+        int ret;
+
+        kenter("{ino=%lx},{%lx,%lx}",
+               object->backer->d_inode->i_ino,
+               backpage->index, backpage->flags);
+
+        /* skip if the page was truncated away completely */
+        if (backpage->mapping != bmapping) {
+                kleave(" = -ENODATA [mapping]");
+                return -ENODATA;
+        }
+
+        backpage2 = find_get_page(bmapping, backpage->index);
+        if (!backpage2) {
+                kleave(" = -ENODATA [gone]");
+                return -ENODATA;
+        }
+
+        if (backpage != backpage2) {
+                put_page(backpage2);
+                kleave(" = -ENODATA [different]");
+                return -ENODATA;
+        }
+
+        /* the page is still there and we already have a ref on it, so we don't
+         * need a second */
+        put_page(backpage2);
+
+        INIT_LIST_HEAD(&monitor->op_link);
+        add_page_wait_queue(backpage, &monitor->monitor);
+
+        if (trylock_page(backpage)) {
+                ret = -EIO;
+                if (PageError(backpage))
+                        goto unlock_discard;
+                ret = 0;
+                if (PageUptodate(backpage))
+                        goto unlock_discard;
+
+                kdebug("reissue read");
+                ret = bmapping->a_ops->readpage(NULL, backpage);
+                if (ret < 0)
+                        goto unlock_discard;
+        }
+
+        /* but the page may have been read before the monitor was installed, so
+         * the monitor may miss the event - so we have to ensure that we do get
+         * one in such a case */
+        if (trylock_page(backpage)) {
+                _debug("jumpstart %p {%lx}", backpage, backpage->flags);
+                unlock_page(backpage);
+        }
+
+        /* it'll reappear on the todo list */
+        kleave(" = -EINPROGRESS");
+        return -EINPROGRESS;
+
+unlock_discard:
+        unlock_page(backpage);
+        spin_lock_irq(&object->work_lock);
+        list_del(&monitor->op_link);
+        spin_unlock_irq(&object->work_lock);
+        kleave(" = %d", ret);
+        return ret;
+}
+
+/*
  * copy data from backing pages to netfs pages to complete a read operation
  * - driven by FS-Cache's thread pool
  */
@@ -92,20 +173,26 @@ static void cachefiles_read_copier(struct fscache_operation *_op)
 
                 _debug("- copy {%lu}", monitor->back_page->index);
 
-                error = -EIO;
+        recheck:
                 if (PageUptodate(monitor->back_page)) {
                         copy_highpage(monitor->netfs_page, monitor->back_page);
 
                         pagevec_add(&pagevec, monitor->netfs_page);
                         fscache_mark_pages_cached(monitor->op, &pagevec);
                         error = 0;
-                }
-
-                if (error)
+                } else if (!PageError(monitor->back_page)) {
+                        /* the page has probably been truncated */
+                        error = cachefiles_read_reissue(object, monitor);
+                        if (error == -EINPROGRESS)
+                                goto next;
+                        goto recheck;
+                } else {
                         cachefiles_io_error_obj(
                                 object,
                                 "Readpage failed on backing file %lx",
                                 (unsigned long) monitor->back_page->flags);
+                        error = -EIO;
+                }
 
                 page_cache_release(monitor->back_page);
 
@@ -114,6 +201,7 @@ static void cachefiles_read_copier(struct fscache_operation *_op)
                 fscache_put_retrieval(op);
                 kfree(monitor);
 
+        next:
                 /* let the thread pool have some air occasionally */
                 max--;
                 if (max < 0 || need_resched()) {
@@ -333,7 +421,8 @@ int cachefiles_read_or_alloc_page(struct fscache_retrieval *op,
 
         shift = PAGE_SHIFT - inode->i_sb->s_blocksize_bits;
 
-        op->op.flags = FSCACHE_OP_FAST;
+        op->op.flags &= FSCACHE_OP_KEEP_FLAGS;
+        op->op.flags |= FSCACHE_OP_FAST;
         op->op.processor = cachefiles_read_copier;
 
         pagevec_init(&pagevec, 0);
@@ -639,7 +728,8 @@ int cachefiles_read_or_alloc_pages(struct fscache_retrieval *op,
 
         pagevec_init(&pagevec, 0);
 
-        op->op.flags = FSCACHE_OP_FAST;
+        op->op.flags &= FSCACHE_OP_KEEP_FLAGS;
+        op->op.flags |= FSCACHE_OP_FAST;
         op->op.processor = cachefiles_read_copier;
 
         INIT_LIST_HEAD(&backpages);
@@ -801,7 +891,8 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
         struct cachefiles_cache *cache;
         mm_segment_t old_fs;
         struct file *file;
-        loff_t pos;
+        loff_t pos, eof;
+        size_t len;
         void *data;
         int ret;
 
@@ -832,18 +923,33 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
         if (IS_ERR(file)) {
                 ret = PTR_ERR(file);
         } else {
+                ima_counts_get(file);
                 ret = -EIO;
                 if (file->f_op->write) {
                         pos = (loff_t) page->index << PAGE_SHIFT;
+
+                        /* we mustn't write more data than we have, so we have
+                         * to beware of a partial page at EOF */
+                        eof = object->fscache.store_limit_l;
+                        len = PAGE_SIZE;
+                        if (eof & ~PAGE_MASK) {
+                                ASSERTCMP(pos, <, eof);
+                                if (eof - pos < PAGE_SIZE) {
+                                        _debug("cut short %llx to %llx",
+                                               pos, eof);
+                                        len = eof - pos;
+                                        ASSERTCMP(pos + len, ==, eof);
+                                }
+                        }
+
                         data = kmap(page);
                         old_fs = get_fs();
                         set_fs(KERNEL_DS);
                         ret = file->f_op->write(
-                                file, (const void __user *) data, PAGE_SIZE,
-                                &pos);
+                                file, (const void __user *) data, len, &pos);
                         set_fs(old_fs);
                         kunmap(page);
-                        if (ret != PAGE_SIZE)
+                        if (ret != len)
                                 ret = -EIO;
                 }
                 fput(file);
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 145540a316ab..094ea65afc85 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,12 @@
+Version 1.61
+------------
+Fix append problem to Samba servers (files opened with O_APPEND could
+have duplicated data). Fix oops in cifs_lookup. Workaround problem
+mounting to OS/400 Netserve. Fix oops in cifs_get_tcp_session.
+Disable use of server inode numbers when server only
+partially supports them (e.g. for one server querying inode numbers on
+FindFirst fails but QPathInfo queries works).
+
 Version 1.60
 -------------
 Fix memory leak in reconnect.  Fix oops in DFS mount error path.
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 9a5e4f5f3122..29f1da761bbf 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1037,7 +1037,7 @@ init_cifs(void)
         if (rc)
                 goto out_unregister_key_type;
 #endif
-        rc = slow_work_register_user();
+        rc = slow_work_register_user(THIS_MODULE);
         if (rc)
                 goto out_unregister_resolver_key;
 
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 6928c24d1d42..5646727e33f5 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -388,4 +388,5 @@ extern int CIFSSMBSetPosixACL(const int xid, struct cifsTconInfo *tcon,
                 const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSGetExtAttr(const int xid, struct cifsTconInfo *tcon,
                         const int netfid, __u64 *pExtAttrBits, __u64 *pMask);
+extern void cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb);
 #endif                  /* _CIFSPROTO_H */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index b09098079916..63ea83ff687f 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2220,16 +2220,8 @@ is_path_accessible(int xid, struct cifsTconInfo *tcon,
                    struct cifs_sb_info *cifs_sb, const char *full_path)
 {
         int rc;
-        __u64 inode_num;
         FILE_ALL_INFO *pfile_info;
 
-        rc = CIFSGetSrvInodeNumber(xid, tcon, full_path, &inode_num,
-                                   cifs_sb->local_nls,
-                                   cifs_sb->mnt_cifs_flags &
-                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
-        if (rc != -EOPNOTSUPP)
-                return rc;
-
         pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
         if (pfile_info == NULL)
                 return -ENOMEM;
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 627a60a6c1b1..1f42f772865a 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -214,8 +214,6 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
                 posix_flags |= SMB_O_EXCL;
         if (oflags & O_TRUNC)
                 posix_flags |= SMB_O_TRUNC;
-        if (oflags & O_APPEND)
-                posix_flags |= SMB_O_APPEND;
         if (oflags & O_SYNC)
                 posix_flags |= SMB_O_SYNC;
         if (oflags & O_DIRECTORY)
@@ -643,9 +641,9 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
          * O_EXCL: optimize away the lookup, but don't hash the dentry. Let
          * the VFS handle the create.
          */
-        if (nd->flags & LOOKUP_EXCL) {
+        if (nd && (nd->flags & LOOKUP_EXCL)) {
                 d_instantiate(direntry, NULL);
-                return 0;
+                return NULL;
         }
 
         /* can not grab the rename sem here since it would
@@ -675,7 +673,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
          * reduction in network traffic in the other paths.
          */
         if (pTcon->unix_ext) {
-                if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
+                if (nd && !(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
                      (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open &&
                      (nd->intent.open.flags & O_CREAT)) {
                         rc = cifs_posix_open(full_path, &newInode, nd->path.mnt,
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 5e2492535daa..cababd8a52df 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -512,13 +512,10 @@ int cifs_get_inode_info(struct inode **pinode,
                                         cifs_sb->local_nls,
                                         cifs_sb->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
-                        if (rc1) {
+                        if (rc1 || !fattr.cf_uniqueid) {
                                 cFYI(1, ("GetSrvInodeNum rc %d", rc1));
                                 fattr.cf_uniqueid = iunique(sb, ROOT_I);
-                                /* disable serverino if call not supported */
-                                if (rc1 == -EINVAL)
-                                        cifs_sb->mnt_cifs_flags &=
-                                                        ~CIFS_MOUNT_SERVER_INUM;
+                                cifs_autodisable_serverino(cifs_sb);
                         }
                 } else {
                         fattr.cf_uniqueid = iunique(sb, ROOT_I);
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 0241b25ac33f..d27d4ec6579b 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -715,3 +715,17 @@ cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
 ctoUCS_out:
         return i;
 }
+
+void
+cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb)
+{
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
+                cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM;
+                cERROR(1, ("Autodisabling the use of server inode numbers on "
+                           "%s. This server doesn't seem to support them "
+                           "properly. Hardlinks will not be recognized on this "
+                           "mount. Consider mounting with the \"noserverino\" "
+                           "option to silence this message.",
+                           cifs_sb->tcon->treeName));
+        }
+}
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 1f098ca71636..f84062f9a985 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -727,11 +727,12 @@ static int cifs_filldir(char *pfindEntry, struct file *file, filldir_t filldir,
                 cifs_dir_info_to_fattr(&fattr, (FILE_DIRECTORY_INFO *)
                                         pfindEntry, cifs_sb);
 
-        /* FIXME: make _to_fattr functions fill this out */
-        if (pCifsF->srch_inf.info_level == SMB_FIND_FILE_ID_FULL_DIR_INFO)
+        if (inum && (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) {
                 fattr.cf_uniqueid = inum;
-        else
+        } else {
                 fattr.cf_uniqueid = iunique(sb, ROOT_I);
+                cifs_autodisable_serverino(cifs_sb);
+        }
 
         ino = cifs_uniqueid_to_ino_t(fattr.cf_uniqueid);
         tmp_dentry = cifs_readdir_lookup(file->f_dentry, &qstring, &fattr);
diff --git a/fs/compat.c b/fs/compat.c
index d576b552e8e2..6c19040ffeef 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1532,6 +1532,8 @@ int compat_do_execve(char * filename,
         if (retval < 0)
                 goto out;
 
+        current->stack_start = current->mm->start_stack;
+
         /* execve succeeded */
         current->fs->in_exec = 0;
         current->in_execve = 0;
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index f91fd51b32e3..d84e7058c298 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1800,7 +1800,7 @@ struct space_resv_32 {
 /* just account for different alignment */
 static int compat_ioctl_preallocate(struct file *file, unsigned long arg)
 {
-        struct space_resv_32    __user *p32 = (void __user *)arg;
+        struct space_resv_32    __user *p32 = compat_ptr(arg);
         struct space_resv       __user *p = compat_alloc_user_space(sizeof(*p));
 
         if (copy_in_user(&p->l_type,    &p32->l_type,   sizeof(s16)) ||
@@ -2802,7 +2802,7 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
 #else
         case FS_IOC_RESVSP:
         case FS_IOC_RESVSP64:
-                error = ioctl_preallocate(filp, (void __user *)arg);
+                error = ioctl_preallocate(filp, compat_ptr(arg));
                 goto out_fput;
 #endif
 
diff --git a/fs/exec.c b/fs/exec.c
index d49be6bc1793..ba112bd4a339 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -624,10 +624,8 @@ int setup_arg_pages(struct linux_binprm *bprm,
         /* Move stack pages down in memory. */
         if (stack_shift) {
                 ret = shift_arg_pages(vma, stack_shift);
-                if (ret) {
-                        up_write(&mm->mmap_sem);
-                        return ret;
-                }
+                if (ret)
+                        goto out_unlock;
         }
 
 #ifdef CONFIG_STACK_GROWSUP
@@ -641,7 +639,7 @@ int setup_arg_pages(struct linux_binprm *bprm,
 
 out_unlock:
         up_write(&mm->mmap_sem);
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL(setup_arg_pages);
 
diff --git a/fs/ext3/fsync.c b/fs/ext3/fsync.c
index 451d166bbe93..8209f266e9ad 100644
--- a/fs/ext3/fsync.c
+++ b/fs/ext3/fsync.c
@@ -46,19 +46,21 @@
 int ext3_sync_file(struct file * file, struct dentry *dentry, int datasync)
 {
         struct inode *inode = dentry->d_inode;
+        struct ext3_inode_info *ei = EXT3_I(inode);
+        journal_t *journal = EXT3_SB(inode->i_sb)->s_journal;
         int ret = 0;
+        tid_t commit_tid;
+
+        if (inode->i_sb->s_flags & MS_RDONLY)
+                return 0;
 
         J_ASSERT(ext3_journal_current_handle() == NULL);
 
         /*
-         * data=writeback:
+         * data=writeback,ordered:
          *  The caller's filemap_fdatawrite()/wait will sync the data.
-         *  sync_inode() will sync the metadata
-         *
-         * data=ordered:
-         *  The caller's filemap_fdatawrite() will write the data and
-         *  sync_inode() will write the inode if it is dirty.  Then the caller's
-         *  filemap_fdatawait() will wait on the pages.
+         *  Metadata is in the journal, we wait for a proper transaction
+         *  to commit here.
          *
          * data=journal:
          *  filemap_fdatawrite won't do anything (the buffers are clean).
@@ -73,22 +75,16 @@ int ext3_sync_file(struct file * file, struct dentry *dentry, int datasync)
                 goto out;
         }
 
-        if (datasync && !(inode->i_state & I_DIRTY_DATASYNC))
-                goto flush;
+        if (datasync)
+                commit_tid = atomic_read(&ei->i_datasync_tid);
+        else
+                commit_tid = atomic_read(&ei->i_sync_tid);
 
-        /*
-         * The VFS has written the file data.  If the inode is unaltered
-         * then we need not start a commit.
-         */
-        if (inode->i_state & (I_DIRTY_SYNC|I_DIRTY_DATASYNC)) {
-                struct writeback_control wbc = {
-                        .sync_mode = WB_SYNC_ALL,
-                        .nr_to_write = 0, /* sys_fsync did this */
-                };
-                ret = sync_inode(inode, &wbc);
+        if (log_start_commit(journal, commit_tid)) {
+                log_wait_commit(journal, commit_tid);
                 goto out;
         }
-flush:
+
         /*
          * In case we didn't commit a transaction, we have to flush
          * disk caches manually so that data really is on persistent
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index acf1b1423327..354ed3b47b30 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -699,8 +699,9 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode,
         int err = 0;
         struct ext3_block_alloc_info *block_i;
         ext3_fsblk_t current_block;
+        struct ext3_inode_info *ei = EXT3_I(inode);
 
-        block_i = EXT3_I(inode)->i_block_alloc_info;
+        block_i = ei->i_block_alloc_info;
         /*
          * If we're splicing into a [td]indirect block (as opposed to the
          * inode) then we need to get write access to the [td]indirect block
@@ -741,6 +742,8 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode,
 
         inode->i_ctime = CURRENT_TIME_SEC;
         ext3_mark_inode_dirty(handle, inode);
+        /* ext3_mark_inode_dirty already updated i_sync_tid */
+        atomic_set(&ei->i_datasync_tid, handle->h_transaction->t_tid);
 
         /* had we spliced it onto indirect block? */
         if (where->bh) {
@@ -1735,6 +1738,7 @@ static ssize_t ext3_direct_IO(int rw, struct kiocb *iocb,
         ssize_t ret;
         int orphan = 0;
         size_t count = iov_length(iov, nr_segs);
+        int retries = 0;
 
         if (rw == WRITE) {
                 loff_t final_size = offset + count;
@@ -1757,9 +1761,12 @@ static ssize_t ext3_direct_IO(int rw, struct kiocb *iocb,
                 }
         }
 
+retry:
         ret = blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
                                  offset, nr_segs,
                                  ext3_get_block, NULL);
+        if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
+                goto retry;
 
         if (orphan) {
                 int err;
@@ -2750,6 +2757,8 @@ struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
         struct ext3_inode_info *ei;
         struct buffer_head *bh;
         struct inode *inode;
+        journal_t *journal = EXT3_SB(sb)->s_journal;
+        transaction_t *transaction;
         long ret;
         int block;
 
@@ -2827,6 +2836,30 @@ struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
                 ei->i_data[block] = raw_inode->i_block[block];
         INIT_LIST_HEAD(&ei->i_orphan);
 
+        /*
+         * Set transaction id's of transactions that have to be committed
+         * to finish f[data]sync. We set them to currently running transaction
+         * as we cannot be sure that the inode or some of its metadata isn't
+         * part of the transaction - the inode could have been reclaimed and
+         * now it is reread from disk.
+         */
+        if (journal) {
+                tid_t tid;
+
+                spin_lock(&journal->j_state_lock);
+                if (journal->j_running_transaction)
+                        transaction = journal->j_running_transaction;
+                else
+                        transaction = journal->j_committing_transaction;
+                if (transaction)
+                        tid = transaction->t_tid;
+                else
+                        tid = journal->j_commit_sequence;
+                spin_unlock(&journal->j_state_lock);
+                atomic_set(&ei->i_sync_tid, tid);
+                atomic_set(&ei->i_datasync_tid, tid);
+        }
+
         if (inode->i_ino >= EXT3_FIRST_INO(inode->i_sb) + 1 &&
             EXT3_INODE_SIZE(inode->i_sb) > EXT3_GOOD_OLD_INODE_SIZE) {
                 /*
@@ -3011,6 +3044,7 @@ again:
                 err = rc;
         ei->i_state &= ~EXT3_STATE_NEW;
 
+        atomic_set(&ei->i_sync_tid, handle->h_transaction->t_tid);
 out_brelse:
         brelse (bh);
         ext3_std_error(inode->i_sb, err);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 7a520a862f49..427496c4767c 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -466,6 +466,8 @@ static struct inode *ext3_alloc_inode(struct super_block *sb)
                 return NULL;
         ei->i_block_alloc_info = NULL;
         ei->vfs_inode.i_version = 1;
+        atomic_set(&ei->i_datasync_tid, 0);
+        atomic_set(&ei->i_sync_tid, 0);
         return &ei->vfs_inode;
 }
 
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 984ca0cb38c3..8825515eeddd 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -322,6 +322,7 @@ static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
 #define EXT4_STATE_NO_EXPAND            0x00000008 /* No space for expansion */
 #define EXT4_STATE_DA_ALLOC_CLOSE       0x00000010 /* Alloc DA blks on close */
 #define EXT4_STATE_EXT_MIGRATE          0x00000020 /* Inode is migrating */
+#define EXT4_STATE_DIO_UNWRITTEN        0x00000040 /* need convert on dio done*/
 
 /* Used to pass group descriptor data when online resize is done */
 struct ext4_new_group_input {
@@ -743,6 +744,7 @@ struct ext4_inode_info {
 #define EXT4_MOUNT_QUOTA                0x80000 /* Some quota option set */
 #define EXT4_MOUNT_USRQUOTA             0x100000 /* "old" user quota */
 #define EXT4_MOUNT_GRPQUOTA             0x200000 /* "old" group quota */
+#define EXT4_MOUNT_JOURNAL_CHECKSUM     0x800000 /* Journal checksums */
 #define EXT4_MOUNT_JOURNAL_ASYNC_COMMIT 0x1000000 /* Journal Async Commit */
 #define EXT4_MOUNT_I_VERSION            0x2000000 /* i_version support */
 #define EXT4_MOUNT_DELALLOC             0x8000000 /* Delalloc support */
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 10539e364283..715264b4bae4 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2807,6 +2807,8 @@ fix_extent_len:
  * into three uninitialized extent(at most). After IO complete, the part
  * being filled will be convert to initialized by the end_io callback function
  * via ext4_convert_unwritten_extents().
+ *
+ * Returns the size of uninitialized extent to be written on success.
  */
 static int ext4_split_unwritten_extents(handle_t *handle,
                                         struct inode *inode,
@@ -2824,7 +2826,6 @@ static int ext4_split_unwritten_extents(handle_t *handle,
         unsigned int allocated, ee_len, depth;
         ext4_fsblk_t newblock;
         int err = 0;
-        int ret = 0;
 
         ext_debug("ext4_split_unwritten_extents: inode %lu,"
                   "iblock %llu, max_blocks %u\n", inode->i_ino,
@@ -2842,12 +2843,12 @@ static int ext4_split_unwritten_extents(handle_t *handle,
         ext4_ext_store_pblock(&orig_ex, ext_pblock(ex));
 
         /*
-         * if the entire unintialized extent length less than
-         * the size of extent to write, there is no need to split
-         * uninitialized extent
+         * If the uninitialized extent begins at the same logical
+         * block where the write begins, and the write completely
+         * covers the extent, then we don't need to split it.
          */
-        if (allocated <= max_blocks)
-                return ret;
+        if ((iblock == ee_block) && (allocated <= max_blocks))
+                return allocated;
 
         err = ext4_ext_get_access(handle, inode, path + depth);
         if (err)
@@ -3048,12 +3049,18 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                 ret = ext4_split_unwritten_extents(handle,
                                                 inode, path, iblock,
                                                 max_blocks, flags);
-                /* flag the io_end struct that we need convert when IO done */
+                /*
+                 * Flag the inode(non aio case) or end_io struct (aio case)
+                 * that this IO needs to convertion to written when IO is
+                 * completed
+                 */
                 if (io)
                         io->flag = DIO_AIO_UNWRITTEN;
+                else
+                        EXT4_I(inode)->i_state |= EXT4_STATE_DIO_UNWRITTEN;
                 goto out;
         }
-        /* DIO end_io complete, convert the filled extent to written */
+        /* async DIO end_io complete, convert the filled extent to written */
         if (flags == EXT4_GET_BLOCKS_DIO_CONVERT_EXT) {
                 ret = ext4_convert_unwritten_extents_dio(handle, inode,
                                                         path);
@@ -3295,10 +3302,16 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
                  * To avoid unecessary convertion for every aio dio rewrite
                  * to the mid of file, here we flag the IO that is really
                  * need the convertion.
-                 *
+                 * For non asycn direct IO case, flag the inode state
+                 * that we need to perform convertion when IO is done.
                  */
-                if (io && flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT)
-                        io->flag = DIO_AIO_UNWRITTEN;
+                if (flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT) {
+                        if (io)
+                                io->flag = DIO_AIO_UNWRITTEN;
+                        else
+                                EXT4_I(inode)->i_state |=
+                                        EXT4_STATE_DIO_UNWRITTEN;;
+                }
         }
         err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
         if (err) {
@@ -3519,6 +3532,7 @@ retry:
  *
  * This function is called from the direct IO end io call back
  * function, to convert the fallocated extents after IO is completed.
+ * Returns 0 on success.
  */
 int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
                                     loff_t len)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5c5bc5dafff8..2c8caa51addb 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -193,7 +193,7 @@ static int try_to_extend_transaction(handle_t *handle, struct inode *inode)
  * so before we call here everything must be consistently dirtied against
  * this transaction.
  */
- int ext4_truncate_restart_trans(handle_t *handle, struct inode *inode,
+int ext4_truncate_restart_trans(handle_t *handle, struct inode *inode,
                                  int nblocks)
 {
         int ret;
@@ -209,6 +209,7 @@ static int try_to_extend_transaction(handle_t *handle, struct inode *inode)
         up_write(&EXT4_I(inode)->i_data_sem);
         ret = ext4_journal_restart(handle, blocks_for_truncate(inode));
         down_write(&EXT4_I(inode)->i_data_sem);
+        ext4_discard_preallocations(inode);
 
         return ret;
 }
@@ -3445,8 +3446,6 @@ out:
         return ret;
 }
 
-/* Maximum number of blocks we map for direct IO at once. */
-
 static int ext4_get_block_dio_write(struct inode *inode, sector_t iblock,
                    struct buffer_head *bh_result, int create)
 {
@@ -3654,13 +3653,14 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
         ext4_io_end_t *io_end = iocb->private;
         struct workqueue_struct *wq;
 
+        /* if not async direct IO or dio with 0 bytes write, just return */
+        if (!io_end || !size)
+                return;
+
         ext_debug("ext4_end_io_dio(): io_end 0x%p"
                   "for inode %lu, iocb 0x%p, offset %llu, size %llu\n",
                   iocb->private, io_end->inode->i_ino, iocb, offset,
                   size);
-        /* if not async direct IO or dio with 0 bytes write, just return */
-        if (!io_end || !size)
-                return;
 
         /* if not aio dio with unwritten extents, just free io and return */
         if (io_end->flag != DIO_AIO_UNWRITTEN){
@@ -3771,13 +3771,19 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
                 if (ret != -EIOCBQUEUED && ret <= 0 && iocb->private) {
                         ext4_free_io_end(iocb->private);
                         iocb->private = NULL;
-                } else if (ret > 0)
+                } else if (ret > 0 && (EXT4_I(inode)->i_state &
+                                       EXT4_STATE_DIO_UNWRITTEN)) {
+                        int err;
                         /*
                          * for non AIO case, since the IO is already
                          * completed, we could do the convertion right here
                          */
-                        ret = ext4_convert_unwritten_extents(inode,
-                                                                offset, ret);
+                        err = ext4_convert_unwritten_extents(inode,
+                                                             offset, ret);
+                        if (err < 0)
+                                ret = err;
+                        EXT4_I(inode)->i_state &= ~EXT4_STATE_DIO_UNWRITTEN;
+                }
                 return ret;
         }
 
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 7c8fe80bacdd..6d2c1b897fc7 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1518,12 +1518,8 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
                         return retval;
 
                 if (blocks == 1 && !dx_fallback &&
-                    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
-                        retval = make_indexed_dir(handle, dentry, inode, bh);
-                        if (retval == -ENOSPC)
-                                brelse(bh);
-                        return retval;
-                }
+                    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+                        return make_indexed_dir(handle, dentry, inode, bh);
                 brelse(bh);
         }
         bh = ext4_append(handle, dir, &block, &retval);
@@ -1532,10 +1528,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
         de = (struct ext4_dir_entry_2 *) bh->b_data;
         de->inode = 0;
         de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
-        retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
-        if (retval == -ENOSPC)
-                brelse(bh);
-        return retval;
+        return add_dirent_to_buf(handle, dentry, inode, de, bh);
 }
 
 /*
@@ -1664,8 +1657,7 @@ static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
         if (!de)
                 goto cleanup;
         err = add_dirent_to_buf(handle, dentry, inode, de, bh);
-        if (err != -ENOSPC)
-                bh = NULL;
+        bh = NULL;
         goto cleanup;
 
 journal_error:
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 312211ee05af..d4ca92aab514 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1300,9 +1300,11 @@ static int parse_options(char *options, struct super_block *sb,
                         *journal_devnum = option;
                         break;
                 case Opt_journal_checksum:
-                        break;  /* Kept for backwards compatibility */
+                        set_opt(sbi->s_mount_opt, JOURNAL_CHECKSUM);
+                        break;
                 case Opt_journal_async_commit:
                         set_opt(sbi->s_mount_opt, JOURNAL_ASYNC_COMMIT);
+                        set_opt(sbi->s_mount_opt, JOURNAL_CHECKSUM);
                         break;
                 case Opt_noload:
                         set_opt(sbi->s_mount_opt, NOLOAD);
@@ -2759,14 +2761,20 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                 goto failed_mount4;
         }
 
-        jbd2_journal_set_features(sbi->s_journal,
-                                  JBD2_FEATURE_COMPAT_CHECKSUM, 0, 0);
-        if (test_opt(sb, JOURNAL_ASYNC_COMMIT))
-                jbd2_journal_set_features(sbi->s_journal, 0, 0,
+        if (test_opt(sb, JOURNAL_ASYNC_COMMIT)) {
+                jbd2_journal_set_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0,
                                 JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
-        else
+        } else if (test_opt(sb, JOURNAL_CHECKSUM)) {
+                jbd2_journal_set_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0, 0);
                 jbd2_journal_clear_features(sbi->s_journal, 0, 0,
                                 JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
+        } else {
+                jbd2_journal_clear_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0,
+                                JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
+        }
 
         /* We have now updated the journal if required, so we can
          * validate the data journaling mode. */
diff --git a/fs/fcntl.c b/fs/fcntl.c
index fc089f2f7f56..2cf93ec40a67 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -284,7 +284,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
                 type = PIDTYPE_PID;
                 break;
 
-        case F_OWNER_GID:
+        case F_OWNER_PGRP:
                 type = PIDTYPE_PGID;
                 break;
 
@@ -321,7 +321,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg)
                 break;
 
         case PIDTYPE_PGID:
-                owner.type = F_OWNER_GID;
+                owner.type = F_OWNER_PGRP;
                 break;
 
         default:
diff --git a/fs/fscache/Kconfig b/fs/fscache/Kconfig
index 9bbb8ce7bea0..864dac20a242 100644
--- a/fs/fscache/Kconfig
+++ b/fs/fscache/Kconfig
@@ -54,3 +54,10 @@ config FSCACHE_DEBUG
           enabled by setting bits in /sys/modules/fscache/parameter/debug.
 
           See Documentation/filesystems/caching/fscache.txt for more information.
+
+config FSCACHE_OBJECT_LIST
+        bool "Maintain global object list for debugging purposes"
+        depends on FSCACHE && PROC_FS
+        help
+          Maintain a global list of active fscache objects that can be
+          retrieved through /proc/fs/fscache/objects for debugging purposes
diff --git a/fs/fscache/Makefile b/fs/fscache/Makefile
index 91571b95aacc..6d561531cb36 100644
--- a/fs/fscache/Makefile
+++ b/fs/fscache/Makefile
@@ -15,5 +15,6 @@ fscache-y := \
 fscache-$(CONFIG_PROC_FS) += proc.o
 fscache-$(CONFIG_FSCACHE_STATS) += stats.o
 fscache-$(CONFIG_FSCACHE_HISTOGRAM) += histogram.o
+fscache-$(CONFIG_FSCACHE_OBJECT_LIST) += object-list.o
 
 obj-$(CONFIG_FSCACHE) := fscache.o
diff --git a/fs/fscache/cache.c b/fs/fscache/cache.c
index e21985bbb1fb..6a3c48abd677 100644
--- a/fs/fscache/cache.c
+++ b/fs/fscache/cache.c
@@ -263,6 +263,7 @@ int fscache_add_cache(struct fscache_cache *cache,
         spin_lock(&cache->object_list_lock);
         list_add_tail(&ifsdef->cache_link, &cache->object_list);
         spin_unlock(&cache->object_list_lock);
+        fscache_objlist_add(ifsdef);
 
         /* add the cache's netfs definition index object to the top level index
          * cookie as a known backing object */
@@ -380,11 +381,15 @@ void fscache_withdraw_cache(struct fscache_cache *cache)
 
         /* make sure all pages pinned by operations on behalf of the netfs are
          * written to disk */
+        fscache_stat(&fscache_n_cop_sync_cache);
         cache->ops->sync_cache(cache);
+        fscache_stat_d(&fscache_n_cop_sync_cache);
 
         /* dissociate all the netfs pages backed by this cache from the block
          * mappings in the cache */
+        fscache_stat(&fscache_n_cop_dissociate_pages);
         cache->ops->dissociate_pages(cache);
+        fscache_stat_d(&fscache_n_cop_dissociate_pages);
 
         /* we now have to destroy all the active objects pertaining to this
          * cache - which we do by passing them off to thread pool to be
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 72fd18f6c71f..990535071a8a 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -36,6 +36,7 @@ void fscache_cookie_init_once(void *_cookie)
 
         memset(cookie, 0, sizeof(*cookie));
         spin_lock_init(&cookie->lock);
+        spin_lock_init(&cookie->stores_lock);
         INIT_HLIST_HEAD(&cookie->backing_objects);
 }
 
@@ -102,7 +103,9 @@ struct fscache_cookie *__fscache_acquire_cookie(
         cookie->netfs_data      = netfs_data;
         cookie->flags           = 0;
 
-        INIT_RADIX_TREE(&cookie->stores, GFP_NOFS);
+        /* radix tree insertion won't use the preallocation pool unless it's
+         * told it may not wait */
+        INIT_RADIX_TREE(&cookie->stores, GFP_NOFS & ~__GFP_WAIT);
 
         switch (cookie->def->type) {
         case FSCACHE_COOKIE_TYPE_INDEX:
@@ -249,7 +252,9 @@ static int fscache_alloc_object(struct fscache_cache *cache,
 
         /* ask the cache to allocate an object (we may end up with duplicate
          * objects at this stage, but we sort that out later) */
+        fscache_stat(&fscache_n_cop_alloc_object);
         object = cache->ops->alloc_object(cache, cookie);
+        fscache_stat_d(&fscache_n_cop_alloc_object);
         if (IS_ERR(object)) {
                 fscache_stat(&fscache_n_object_no_alloc);
                 ret = PTR_ERR(object);
@@ -270,8 +275,11 @@ static int fscache_alloc_object(struct fscache_cache *cache,
         /* only attach if we managed to allocate all we needed, otherwise
          * discard the object we just allocated and instead use the one
          * attached to the cookie */
-        if (fscache_attach_object(cookie, object) < 0)
+        if (fscache_attach_object(cookie, object) < 0) {
+                fscache_stat(&fscache_n_cop_put_object);
                 cache->ops->put_object(object);
+                fscache_stat_d(&fscache_n_cop_put_object);
+        }
 
         _leave(" = 0");
         return 0;
@@ -287,7 +295,9 @@ object_already_extant:
         return 0;
 
 error_put:
+        fscache_stat(&fscache_n_cop_put_object);
         cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 error:
         _leave(" = %d", ret);
         return ret;
@@ -349,6 +359,8 @@ static int fscache_attach_object(struct fscache_cookie *cookie,
         object->cookie = cookie;
         atomic_inc(&cookie->usage);
         hlist_add_head(&object->cookie_link, &cookie->backing_objects);
+
+        fscache_objlist_add(object);
         ret = 0;
 
 cant_attach_object:
@@ -403,6 +415,8 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
         unsigned long event;
 
         fscache_stat(&fscache_n_relinquishes);
+        if (retire)
+                fscache_stat(&fscache_n_relinquishes_retire);
 
         if (!cookie) {
                 fscache_stat(&fscache_n_relinquishes_null);
@@ -428,12 +442,8 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
 
         event = retire ? FSCACHE_OBJECT_EV_RETIRE : FSCACHE_OBJECT_EV_RELEASE;
 
-        /* detach pointers back to the netfs */
         spin_lock(&cookie->lock);
 
-        cookie->netfs_data      = NULL;
-        cookie->def             = NULL;
-
         /* break links with all the active objects */
         while (!hlist_empty(&cookie->backing_objects)) {
                 object = hlist_entry(cookie->backing_objects.first,
@@ -456,6 +466,10 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
                         BUG();
         }
 
+        /* detach pointers back to the netfs */
+        cookie->netfs_data      = NULL;
+        cookie->def             = NULL;
+
         spin_unlock(&cookie->lock);
 
         if (cookie->parent) {
diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
index 1c341304621f..edd7434ab6e5 100644
--- a/fs/fscache/internal.h
+++ b/fs/fscache/internal.h
@@ -17,6 +17,7 @@
  * - cache->object_list_lock
  * - object->lock
  * - object->parent->lock
+ * - cookie->stores_lock
  * - fscache_thread_lock
  *
  */
@@ -88,17 +89,31 @@ extern int fscache_wait_bit_interruptible(void *);
 /*
  * object.c
  */
+extern const char fscache_object_states_short[FSCACHE_OBJECT__NSTATES][5];
+
 extern void fscache_withdrawing_object(struct fscache_cache *,
                                        struct fscache_object *);
 extern void fscache_enqueue_object(struct fscache_object *);
 
 /*
+ * object-list.c
+ */
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+extern const struct file_operations fscache_objlist_fops;
+
+extern void fscache_objlist_add(struct fscache_object *);
+#else
+#define fscache_objlist_add(object) do {} while(0)
+#endif
+
+/*
  * operation.c
  */
 extern int fscache_submit_exclusive_op(struct fscache_object *,
                                        struct fscache_operation *);
 extern int fscache_submit_op(struct fscache_object *,
                              struct fscache_operation *);
+extern int fscache_cancel_op(struct fscache_operation *);
 extern void fscache_abort_object(struct fscache_object *);
 extern void fscache_start_operations(struct fscache_object *);
 extern void fscache_operation_gc(struct work_struct *);
@@ -127,6 +142,8 @@ extern atomic_t fscache_n_op_enqueue;
 extern atomic_t fscache_n_op_deferred_release;
 extern atomic_t fscache_n_op_release;
 extern atomic_t fscache_n_op_gc;
+extern atomic_t fscache_n_op_cancelled;
+extern atomic_t fscache_n_op_rejected;
 
 extern atomic_t fscache_n_attr_changed;
 extern atomic_t fscache_n_attr_changed_ok;
@@ -138,6 +155,8 @@ extern atomic_t fscache_n_allocs;
 extern atomic_t fscache_n_allocs_ok;
 extern atomic_t fscache_n_allocs_wait;
 extern atomic_t fscache_n_allocs_nobufs;
+extern atomic_t fscache_n_allocs_intr;
+extern atomic_t fscache_n_allocs_object_dead;
 extern atomic_t fscache_n_alloc_ops;
 extern atomic_t fscache_n_alloc_op_waits;
 
@@ -148,6 +167,7 @@ extern atomic_t fscache_n_retrievals_nodata;
 extern atomic_t fscache_n_retrievals_nobufs;
 extern atomic_t fscache_n_retrievals_intr;
 extern atomic_t fscache_n_retrievals_nomem;
+extern atomic_t fscache_n_retrievals_object_dead;
 extern atomic_t fscache_n_retrieval_ops;
 extern atomic_t fscache_n_retrieval_op_waits;
 
@@ -158,6 +178,14 @@ extern atomic_t fscache_n_stores_nobufs;
 extern atomic_t fscache_n_stores_oom;
 extern atomic_t fscache_n_store_ops;
 extern atomic_t fscache_n_store_calls;
+extern atomic_t fscache_n_store_pages;
+extern atomic_t fscache_n_store_radix_deletes;
+extern atomic_t fscache_n_store_pages_over_limit;
+
+extern atomic_t fscache_n_store_vmscan_not_storing;
+extern atomic_t fscache_n_store_vmscan_gone;
+extern atomic_t fscache_n_store_vmscan_busy;
+extern atomic_t fscache_n_store_vmscan_cancelled;
 
 extern atomic_t fscache_n_marks;
 extern atomic_t fscache_n_uncaches;
@@ -176,6 +204,7 @@ extern atomic_t fscache_n_updates_run;
 extern atomic_t fscache_n_relinquishes;
 extern atomic_t fscache_n_relinquishes_null;
 extern atomic_t fscache_n_relinquishes_waitcrt;
+extern atomic_t fscache_n_relinquishes_retire;
 
 extern atomic_t fscache_n_cookie_index;
 extern atomic_t fscache_n_cookie_data;
@@ -186,6 +215,7 @@ extern atomic_t fscache_n_object_no_alloc;
 extern atomic_t fscache_n_object_lookups;
 extern atomic_t fscache_n_object_lookups_negative;
 extern atomic_t fscache_n_object_lookups_positive;
+extern atomic_t fscache_n_object_lookups_timed_out;
 extern atomic_t fscache_n_object_created;
 extern atomic_t fscache_n_object_avail;
 extern atomic_t fscache_n_object_dead;
@@ -195,15 +225,41 @@ extern atomic_t fscache_n_checkaux_okay;
 extern atomic_t fscache_n_checkaux_update;
 extern atomic_t fscache_n_checkaux_obsolete;
 
+extern atomic_t fscache_n_cop_alloc_object;
+extern atomic_t fscache_n_cop_lookup_object;
+extern atomic_t fscache_n_cop_lookup_complete;
+extern atomic_t fscache_n_cop_grab_object;
+extern atomic_t fscache_n_cop_update_object;
+extern atomic_t fscache_n_cop_drop_object;
+extern atomic_t fscache_n_cop_put_object;
+extern atomic_t fscache_n_cop_sync_cache;
+extern atomic_t fscache_n_cop_attr_changed;
+extern atomic_t fscache_n_cop_read_or_alloc_page;
+extern atomic_t fscache_n_cop_read_or_alloc_pages;
+extern atomic_t fscache_n_cop_allocate_page;
+extern atomic_t fscache_n_cop_allocate_pages;
+extern atomic_t fscache_n_cop_write_page;
+extern atomic_t fscache_n_cop_uncache_page;
+extern atomic_t fscache_n_cop_dissociate_pages;
+
 static inline void fscache_stat(atomic_t *stat)
 {
         atomic_inc(stat);
 }
 
+static inline void fscache_stat_d(atomic_t *stat)
+{
+        atomic_dec(stat);
+}
+
+#define __fscache_stat(stat) (stat)
+
 extern const struct file_operations fscache_stats_fops;
 #else
 
+#define __fscache_stat(stat) (NULL)
 #define fscache_stat(stat) do {} while (0)
+#define fscache_stat_d(stat) do {} while (0)
 #endif
 
 /*
diff --git a/fs/fscache/main.c b/fs/fscache/main.c
index 4de41b597499..add6bdb53f04 100644
--- a/fs/fscache/main.c
+++ b/fs/fscache/main.c
@@ -48,7 +48,7 @@ static int __init fscache_init(void)
 {
         int ret;
 
-        ret = slow_work_register_user();
+        ret = slow_work_register_user(THIS_MODULE);
         if (ret < 0)
                 goto error_slow_work;
 
@@ -80,7 +80,7 @@ error_kobj:
 error_cookie_jar:
         fscache_proc_cleanup();
 error_proc:
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
 error_slow_work:
         return ret;
 }
@@ -97,7 +97,7 @@ static void __exit fscache_exit(void)
         kobject_put(fscache_root);
         kmem_cache_destroy(fscache_cookie_jar);
         fscache_proc_cleanup();
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
         printk(KERN_NOTICE "FS-Cache: Unloaded\n");
 }
 
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
new file mode 100644
index 000000000000..e590242fa41a
--- /dev/null
+++ b/fs/fscache/object-list.c
@@ -0,0 +1,432 @@
+/* Global fscache object list maintainer and viewer
+ *
+ * Copyright (C) 2009 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#define FSCACHE_DEBUG_LEVEL COOKIE
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/key.h>
+#include <keys/user-type.h>
+#include "internal.h"
+
+static struct rb_root fscache_object_list;
+static DEFINE_RWLOCK(fscache_object_list_lock);
+
+struct fscache_objlist_data {
+        unsigned long   config;         /* display configuration */
+#define FSCACHE_OBJLIST_CONFIG_KEY      0x00000001      /* show object keys */
+#define FSCACHE_OBJLIST_CONFIG_AUX      0x00000002      /* show object auxdata */
+#define FSCACHE_OBJLIST_CONFIG_COOKIE   0x00000004      /* show objects with cookies */
+#define FSCACHE_OBJLIST_CONFIG_NOCOOKIE 0x00000008      /* show objects without cookies */
+#define FSCACHE_OBJLIST_CONFIG_BUSY     0x00000010      /* show busy objects */
+#define FSCACHE_OBJLIST_CONFIG_IDLE     0x00000020      /* show idle objects */
+#define FSCACHE_OBJLIST_CONFIG_PENDWR   0x00000040      /* show objects with pending writes */
+#define FSCACHE_OBJLIST_CONFIG_NOPENDWR 0x00000080      /* show objects without pending writes */
+#define FSCACHE_OBJLIST_CONFIG_READS    0x00000100      /* show objects with active reads */
+#define FSCACHE_OBJLIST_CONFIG_NOREADS  0x00000200      /* show objects without active reads */
+#define FSCACHE_OBJLIST_CONFIG_EVENTS   0x00000400      /* show objects with events */
+#define FSCACHE_OBJLIST_CONFIG_NOEVENTS 0x00000800      /* show objects without no events */
+#define FSCACHE_OBJLIST_CONFIG_WORK     0x00001000      /* show objects with slow work */
+#define FSCACHE_OBJLIST_CONFIG_NOWORK   0x00002000      /* show objects without slow work */
+
+        u8              buf[512];       /* key and aux data buffer */
+};
+
+/*
+ * Add an object to the object list
+ * - we use the address of the fscache_object structure as the key into the
+ *   tree
+ */
+void fscache_objlist_add(struct fscache_object *obj)
+{
+        struct fscache_object *xobj;
+        struct rb_node **p = &fscache_object_list.rb_node, *parent = NULL;
+
+        write_lock(&fscache_object_list_lock);
+
+        while (*p) {
+                parent = *p;
+                xobj = rb_entry(parent, struct fscache_object, objlist_link);
+
+                if (obj < xobj)
+                        p = &(*p)->rb_left;
+                else if (obj > xobj)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&obj->objlist_link, parent, p);
+        rb_insert_color(&obj->objlist_link, &fscache_object_list);
+
+        write_unlock(&fscache_object_list_lock);
+}
+
+/**
+ * fscache_object_destroy - Note that a cache object is about to be destroyed
+ * @object: The object to be destroyed
+ *
+ * Note the imminent destruction and deallocation of a cache object record.
+ */
+void fscache_object_destroy(struct fscache_object *obj)
+{
+        write_lock(&fscache_object_list_lock);
+
+        BUG_ON(RB_EMPTY_ROOT(&fscache_object_list));
+        rb_erase(&obj->objlist_link, &fscache_object_list);
+
+        write_unlock(&fscache_object_list_lock);
+}
+EXPORT_SYMBOL(fscache_object_destroy);
+
+/*
+ * find the object in the tree on or after the specified index
+ */
+static struct fscache_object *fscache_objlist_lookup(loff_t *_pos)
+{
+        struct fscache_object *pobj, *obj, *minobj = NULL;
+        struct rb_node *p;
+        unsigned long pos;
+
+        if (*_pos >= (unsigned long) ERR_PTR(-ENOENT))
+                return NULL;
+        pos = *_pos;
+
+        /* banners (can't represent line 0 by pos 0 as that would involve
+         * returning a NULL pointer) */
+        if (pos == 0)
+                return (struct fscache_object *) ++(*_pos);
+        if (pos < 3)
+                return (struct fscache_object *)pos;
+
+        pobj = (struct fscache_object *)pos;
+        p = fscache_object_list.rb_node;
+        while (p) {
+                obj = rb_entry(p, struct fscache_object, objlist_link);
+                if (pobj < obj) {
+                        if (!minobj || minobj > obj)
+                                minobj = obj;
+                        p = p->rb_left;
+                } else if (pobj > obj) {
+                        p = p->rb_right;
+                } else {
+                        minobj = obj;
+                        break;
+                }
+                obj = NULL;
+        }
+
+        if (!minobj)
+                *_pos = (unsigned long) ERR_PTR(-ENOENT);
+        else if (minobj != obj)
+                *_pos = (unsigned long) minobj;
+        return minobj;
+}
+
+/*
+ * set up the iterator to start reading from the first line
+ */
+static void *fscache_objlist_start(struct seq_file *m, loff_t *_pos)
+        __acquires(&fscache_object_list_lock)
+{
+        read_lock(&fscache_object_list_lock);
+        return fscache_objlist_lookup(_pos);
+}
+
+/*
+ * move to the next line
+ */
+static void *fscache_objlist_next(struct seq_file *m, void *v, loff_t *_pos)
+{
+        (*_pos)++;
+        return fscache_objlist_lookup(_pos);
+}
+
+/*
+ * clean up after reading
+ */
+static void fscache_objlist_stop(struct seq_file *m, void *v)
+        __releases(&fscache_object_list_lock)
+{
+        read_unlock(&fscache_object_list_lock);
+}
+
+/*
+ * display an object
+ */
+static int fscache_objlist_show(struct seq_file *m, void *v)
+{
+        struct fscache_objlist_data *data = m->private;
+        struct fscache_object *obj = v;
+        unsigned long config = data->config;
+        uint16_t keylen, auxlen;
+        char _type[3], *type;
+        bool no_cookie;
+        u8 *buf = data->buf, *p;
+
+        if ((unsigned long) v == 1) {
+                seq_puts(m, "OBJECT   PARENT   STAT CHLDN OPS OOP IPR EX READS"
+                         " EM EV F S"
+                         " | NETFS_COOKIE_DEF TY FL NETFS_DATA");
+                if (config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                              FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, "       ");
+                if (config & FSCACHE_OBJLIST_CONFIG_KEY)
+                        seq_puts(m, "OBJECT_KEY");
+                if ((config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                               FSCACHE_OBJLIST_CONFIG_AUX)) ==
+                    (FSCACHE_OBJLIST_CONFIG_KEY | FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, ", ");
+                if (config & FSCACHE_OBJLIST_CONFIG_AUX)
+                        seq_puts(m, "AUX_DATA");
+                seq_puts(m, "\n");
+                return 0;
+        }
+
+        if ((unsigned long) v == 2) {
+                seq_puts(m, "======== ======== ==== ===== === === === == ====="
+                         " == == = ="
+                         " | ================ == == ================");
+                if (config & (FSCACHE_OBJLIST_CONFIG_KEY |
+                              FSCACHE_OBJLIST_CONFIG_AUX))
+                        seq_puts(m, " ================");
+                seq_puts(m, "\n");
+                return 0;
+        }
+
+        /* filter out any unwanted objects */
+#define FILTER(criterion, _yes, _no)                                    \
+        do {                                                            \
+                unsigned long yes = FSCACHE_OBJLIST_CONFIG_##_yes;      \
+                unsigned long no = FSCACHE_OBJLIST_CONFIG_##_no;        \
+                if (criterion) {                                        \
+                        if (!(config & yes))                            \
+                                return 0;                               \
+                } else {                                                \
+                        if (!(config & no))                             \
+                                return 0;                               \
+                }                                                       \
+        } while(0)
+
+        if (~config) {
+                FILTER(obj->cookie,
+                       COOKIE, NOCOOKIE);
+                FILTER(obj->state != FSCACHE_OBJECT_ACTIVE ||
+                       obj->n_ops != 0 ||
+                       obj->n_obj_ops != 0 ||
+                       obj->flags ||
+                       !list_empty(&obj->dependents),
+                       BUSY, IDLE);
+                FILTER(test_bit(FSCACHE_OBJECT_PENDING_WRITE, &obj->flags),
+                       PENDWR, NOPENDWR);
+                FILTER(atomic_read(&obj->n_reads),
+                       READS, NOREADS);
+                FILTER(obj->events & obj->event_mask,
+                       EVENTS, NOEVENTS);
+                FILTER(obj->work.flags & ~(1UL << SLOW_WORK_VERY_SLOW),
+                       WORK, NOWORK);
+        }
+
+        seq_printf(m,
+                   "%8x %8x %s %5u %3u %3u %3u %2u %5u %2lx %2lx %1lx %1lx | ",
+                   obj->debug_id,
+                   obj->parent ? obj->parent->debug_id : -1,
+                   fscache_object_states_short[obj->state],
+                   obj->n_children,
+                   obj->n_ops,
+                   obj->n_obj_ops,
+                   obj->n_in_progress,
+                   obj->n_exclusive,
+                   atomic_read(&obj->n_reads),
+                   obj->event_mask & FSCACHE_OBJECT_EVENTS_MASK,
+                   obj->events,
+                   obj->flags,
+                   obj->work.flags);
+
+        no_cookie = true;
+        keylen = auxlen = 0;
+        if (obj->cookie) {
+                spin_lock(&obj->lock);
+                if (obj->cookie) {
+                        switch (obj->cookie->def->type) {
+                        case 0:
+                                type = "IX";
+                                break;
+                        case 1:
+                                type = "DT";
+                                break;
+                        default:
+                                sprintf(_type, "%02u",
+                                        obj->cookie->def->type);
+                                type = _type;
+                                break;
+                        }
+
+                        seq_printf(m, "%-16s %s %2lx %16p",
+                                   obj->cookie->def->name,
+                                   type,
+                                   obj->cookie->flags,
+                                   obj->cookie->netfs_data);
+
+                        if (obj->cookie->def->get_key &&
+                            config & FSCACHE_OBJLIST_CONFIG_KEY)
+                                keylen = obj->cookie->def->get_key(
+                                        obj->cookie->netfs_data,
+                                        buf, 400);
+
+                        if (obj->cookie->def->get_aux &&
+                            config & FSCACHE_OBJLIST_CONFIG_AUX)
+                                auxlen = obj->cookie->def->get_aux(
+                                        obj->cookie->netfs_data,
+                                        buf + keylen, 512 - keylen);
+
+                        no_cookie = false;
+                }
+                spin_unlock(&obj->lock);
+
+                if (!no_cookie && (keylen > 0 || auxlen > 0)) {
+                        seq_printf(m, " ");
+                        for (p = buf; keylen > 0; keylen--)
+                                seq_printf(m, "%02x", *p++);
+                        if (auxlen > 0) {
+                                if (config & FSCACHE_OBJLIST_CONFIG_KEY)
+                                        seq_printf(m, ", ");
+                                for (; auxlen > 0; auxlen--)
+                                        seq_printf(m, "%02x", *p++);
+                        }
+                }
+        }
+
+        if (no_cookie)
+                seq_printf(m, "<no_cookie>\n");
+        else
+                seq_printf(m, "\n");
+        return 0;
+}
+
+static const struct seq_operations fscache_objlist_ops = {
+        .start          = fscache_objlist_start,
+        .stop           = fscache_objlist_stop,
+        .next           = fscache_objlist_next,
+        .show           = fscache_objlist_show,
+};
+
+/*
+ * get the configuration for filtering the list
+ */
+static void fscache_objlist_config(struct fscache_objlist_data *data)
+{
+#ifdef CONFIG_KEYS
+        struct user_key_payload *confkey;
+        unsigned long config;
+        struct key *key;
+        const char *buf;
+        int len;
+
+        key = request_key(&key_type_user, "fscache:objlist", NULL);
+        if (IS_ERR(key))
+                goto no_config;
+
+        config = 0;
+        rcu_read_lock();
+
+        confkey = key->payload.data;
+        buf = confkey->data;
+
+        for (len = confkey->datalen - 1; len >= 0; len--) {
+                switch (buf[len]) {
+                case 'K': config |= FSCACHE_OBJLIST_CONFIG_KEY;         break;
+                case 'A': config |= FSCACHE_OBJLIST_CONFIG_AUX;         break;
+                case 'C': config |= FSCACHE_OBJLIST_CONFIG_COOKIE;      break;
+                case 'c': config |= FSCACHE_OBJLIST_CONFIG_NOCOOKIE;    break;
+                case 'B': config |= FSCACHE_OBJLIST_CONFIG_BUSY;        break;
+                case 'b': config |= FSCACHE_OBJLIST_CONFIG_IDLE;        break;
+                case 'W': config |= FSCACHE_OBJLIST_CONFIG_PENDWR;      break;
+                case 'w': config |= FSCACHE_OBJLIST_CONFIG_NOPENDWR;    break;
+                case 'R': config |= FSCACHE_OBJLIST_CONFIG_READS;       break;
+                case 'r': config |= FSCACHE_OBJLIST_CONFIG_NOREADS;     break;
+                case 'S': config |= FSCACHE_OBJLIST_CONFIG_WORK;        break;
+                case 's': config |= FSCACHE_OBJLIST_CONFIG_NOWORK;      break;
+                }
+        }
+
+        rcu_read_unlock();
+        key_put(key);
+
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_COOKIE | FSCACHE_OBJLIST_CONFIG_NOCOOKIE)))
+            config   |= FSCACHE_OBJLIST_CONFIG_COOKIE | FSCACHE_OBJLIST_CONFIG_NOCOOKIE;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_BUSY | FSCACHE_OBJLIST_CONFIG_IDLE)))
+            config   |= FSCACHE_OBJLIST_CONFIG_BUSY | FSCACHE_OBJLIST_CONFIG_IDLE;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_PENDWR | FSCACHE_OBJLIST_CONFIG_NOPENDWR)))
+            config   |= FSCACHE_OBJLIST_CONFIG_PENDWR | FSCACHE_OBJLIST_CONFIG_NOPENDWR;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_READS | FSCACHE_OBJLIST_CONFIG_NOREADS)))
+            config   |= FSCACHE_OBJLIST_CONFIG_READS | FSCACHE_OBJLIST_CONFIG_NOREADS;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_EVENTS | FSCACHE_OBJLIST_CONFIG_NOEVENTS)))
+            config   |= FSCACHE_OBJLIST_CONFIG_EVENTS | FSCACHE_OBJLIST_CONFIG_NOEVENTS;
+        if (!(config & (FSCACHE_OBJLIST_CONFIG_WORK | FSCACHE_OBJLIST_CONFIG_NOWORK)))
+            config   |= FSCACHE_OBJLIST_CONFIG_WORK | FSCACHE_OBJLIST_CONFIG_NOWORK;
+
+        data->config = config;
+        return;
+
+no_config:
+#endif
+        data->config = ULONG_MAX;
+}
+
+/*
+ * open "/proc/fs/fscache/objects" to provide a list of active objects
+ * - can be configured by a user-defined key added to the caller's keyrings
+ */
+static int fscache_objlist_open(struct inode *inode, struct file *file)
+{
+        struct fscache_objlist_data *data;
+        struct seq_file *m;
+        int ret;
+
+        ret = seq_open(file, &fscache_objlist_ops);
+        if (ret < 0)
+                return ret;
+
+        m = file->private_data;
+
+        /* buffer for key extraction */
+        data = kmalloc(sizeof(struct fscache_objlist_data), GFP_KERNEL);
+        if (!data) {
+                seq_release(inode, file);
+                return -ENOMEM;
+        }
+
+        /* get the configuration key */
+        fscache_objlist_config(data);
+
+        m->private = data;
+        return 0;
+}
+
+/*
+ * clean up on close
+ */
+static int fscache_objlist_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *m = file->private_data;
+
+        kfree(m->private);
+        m->private = NULL;
+        return seq_release(inode, file);
+}
+
+const struct file_operations fscache_objlist_fops = {
+        .owner          = THIS_MODULE,
+        .open           = fscache_objlist_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = fscache_objlist_release,
+};
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 392a41b1b79d..e513ac599c8e 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -14,9 +14,10 @@
 
 #define FSCACHE_DEBUG_LEVEL COOKIE
 #include <linux/module.h>
+#include <linux/seq_file.h>
 #include "internal.h"
 
-const char *fscache_object_states[] = {
+const char *fscache_object_states[FSCACHE_OBJECT__NSTATES] = {
         [FSCACHE_OBJECT_INIT]           = "OBJECT_INIT",
         [FSCACHE_OBJECT_LOOKING_UP]     = "OBJECT_LOOKING_UP",
         [FSCACHE_OBJECT_CREATING]       = "OBJECT_CREATING",
@@ -33,9 +34,28 @@ const char *fscache_object_states[] = {
 };
 EXPORT_SYMBOL(fscache_object_states);
 
+const char fscache_object_states_short[FSCACHE_OBJECT__NSTATES][5] = {
+        [FSCACHE_OBJECT_INIT]           = "INIT",
+        [FSCACHE_OBJECT_LOOKING_UP]     = "LOOK",
+        [FSCACHE_OBJECT_CREATING]       = "CRTN",
+        [FSCACHE_OBJECT_AVAILABLE]      = "AVBL",
+        [FSCACHE_OBJECT_ACTIVE]         = "ACTV",
+        [FSCACHE_OBJECT_UPDATING]       = "UPDT",
+        [FSCACHE_OBJECT_DYING]          = "DYNG",
+        [FSCACHE_OBJECT_LC_DYING]       = "LCDY",
+        [FSCACHE_OBJECT_ABORT_INIT]     = "ABTI",
+        [FSCACHE_OBJECT_RELEASING]      = "RELS",
+        [FSCACHE_OBJECT_RECYCLING]      = "RCYC",
+        [FSCACHE_OBJECT_WITHDRAWING]    = "WTHD",
+        [FSCACHE_OBJECT_DEAD]           = "DEAD",
+};
+
 static void fscache_object_slow_work_put_ref(struct slow_work *);
 static int  fscache_object_slow_work_get_ref(struct slow_work *);
 static void fscache_object_slow_work_execute(struct slow_work *);
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_object_slow_work_desc(struct slow_work *, struct seq_file *);
+#endif
 static void fscache_initialise_object(struct fscache_object *);
 static void fscache_lookup_object(struct fscache_object *);
 static void fscache_object_available(struct fscache_object *);
@@ -45,9 +65,13 @@ static void fscache_enqueue_dependents(struct fscache_object *);
 static void fscache_dequeue_object(struct fscache_object *);
 
 const struct slow_work_ops fscache_object_slow_work_ops = {
+        .owner          = THIS_MODULE,
         .get_ref        = fscache_object_slow_work_get_ref,
         .put_ref        = fscache_object_slow_work_put_ref,
         .execute        = fscache_object_slow_work_execute,
+#ifdef CONFIG_SLOW_WORK_PROC
+        .desc           = fscache_object_slow_work_desc,
+#endif
 };
 EXPORT_SYMBOL(fscache_object_slow_work_ops);
 
@@ -81,6 +105,7 @@ static inline void fscache_done_parent_op(struct fscache_object *object)
 static void fscache_object_state_machine(struct fscache_object *object)
 {
         enum fscache_object_state new_state;
+        struct fscache_cookie *cookie;
 
         ASSERT(object != NULL);
 
@@ -120,20 +145,31 @@ static void fscache_object_state_machine(struct fscache_object *object)
         case FSCACHE_OBJECT_UPDATING:
                 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
                 fscache_stat(&fscache_n_updates_run);
+                fscache_stat(&fscache_n_cop_update_object);
                 object->cache->ops->update_object(object);
+                fscache_stat_d(&fscache_n_cop_update_object);
                 goto active_transit;
 
                 /* handle an object dying during lookup or creation */
         case FSCACHE_OBJECT_LC_DYING:
                 object->event_mask &= ~(1 << FSCACHE_OBJECT_EV_UPDATE);
+                fscache_stat(&fscache_n_cop_lookup_complete);
                 object->cache->ops->lookup_complete(object);
+                fscache_stat_d(&fscache_n_cop_lookup_complete);
 
                 spin_lock(&object->lock);
                 object->state = FSCACHE_OBJECT_DYING;
-                if (test_and_clear_bit(FSCACHE_COOKIE_CREATING,
-                                       &object->cookie->flags))
-                        wake_up_bit(&object->cookie->flags,
-                                    FSCACHE_COOKIE_CREATING);
+                cookie = object->cookie;
+                if (cookie) {
+                        if (test_and_clear_bit(FSCACHE_COOKIE_LOOKING_UP,
+                                               &cookie->flags))
+                                wake_up_bit(&cookie->flags,
+                                            FSCACHE_COOKIE_LOOKING_UP);
+                        if (test_and_clear_bit(FSCACHE_COOKIE_CREATING,
+                                               &cookie->flags))
+                                wake_up_bit(&cookie->flags,
+                                            FSCACHE_COOKIE_CREATING);
+                }
                 spin_unlock(&object->lock);
 
                 fscache_done_parent_op(object);
@@ -165,6 +201,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
                 }
                 spin_unlock(&object->lock);
                 fscache_enqueue_dependents(object);
+                fscache_start_operations(object);
                 goto terminal_transit;
 
                 /* handle an abort during initialisation */
@@ -316,14 +353,29 @@ static void fscache_object_slow_work_execute(struct slow_work *work)
 
         _enter("{OBJ%x}", object->debug_id);
 
-        clear_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
-
         start = jiffies;
         fscache_object_state_machine(object);
         fscache_hist(fscache_objs_histogram, start);
         if (object->events & object->event_mask)
                 fscache_enqueue_object(object);
+        clear_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+}
+
+/*
+ * describe an object for slow-work debugging
+ */
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_object_slow_work_desc(struct slow_work *work,
+                                          struct seq_file *m)
+{
+        struct fscache_object *object =
+                container_of(work, struct fscache_object, work);
+
+        seq_printf(m, "FSC: OBJ%x: %s",
+                   object->debug_id,
+                   fscache_object_states_short[object->state]);
 }
+#endif
 
 /*
  * initialise an object
@@ -376,7 +428,9 @@ static void fscache_initialise_object(struct fscache_object *object)
                          * binding on to us, so we need to make sure we don't
                          * add ourself to the list multiple times */
                         if (list_empty(&object->dep_link)) {
+                                fscache_stat(&fscache_n_cop_grab_object);
                                 object->cache->ops->grab_object(object);
+                                fscache_stat_d(&fscache_n_cop_grab_object);
                                 list_add(&object->dep_link,
                                          &parent->dependents);
 
@@ -414,6 +468,7 @@ static void fscache_lookup_object(struct fscache_object *object)
 {
         struct fscache_cookie *cookie = object->cookie;
         struct fscache_object *parent;
+        int ret;
 
         _enter("");
 
@@ -438,11 +493,20 @@ static void fscache_lookup_object(struct fscache_object *object)
                object->cache->tag->name);
 
         fscache_stat(&fscache_n_object_lookups);
-        object->cache->ops->lookup_object(object);
+        fscache_stat(&fscache_n_cop_lookup_object);
+        ret = object->cache->ops->lookup_object(object);
+        fscache_stat_d(&fscache_n_cop_lookup_object);
 
         if (test_bit(FSCACHE_OBJECT_EV_ERROR, &object->events))
                 set_bit(FSCACHE_COOKIE_UNAVAILABLE, &cookie->flags);
 
+        if (ret == -ETIMEDOUT) {
+                /* probably stuck behind another object, so move this one to
+                 * the back of the queue */
+                fscache_stat(&fscache_n_object_lookups_timed_out);
+                set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+        }
+
         _leave("");
 }
 
@@ -546,7 +610,8 @@ static void fscache_object_available(struct fscache_object *object)
 
         spin_lock(&object->lock);
 
-        if (test_and_clear_bit(FSCACHE_COOKIE_CREATING, &object->cookie->flags))
+        if (object->cookie &&
+            test_and_clear_bit(FSCACHE_COOKIE_CREATING, &object->cookie->flags))
                 wake_up_bit(&object->cookie->flags, FSCACHE_COOKIE_CREATING);
 
         fscache_done_parent_op(object);
@@ -562,7 +627,9 @@ static void fscache_object_available(struct fscache_object *object)
         }
         spin_unlock(&object->lock);
 
+        fscache_stat(&fscache_n_cop_lookup_complete);
         object->cache->ops->lookup_complete(object);
+        fscache_stat_d(&fscache_n_cop_lookup_complete);
         fscache_enqueue_dependents(object);
 
         fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
@@ -581,11 +648,16 @@ static void fscache_drop_object(struct fscache_object *object)
 
         _enter("{OBJ%x,%d}", object->debug_id, object->n_children);
 
+        ASSERTCMP(object->cookie, ==, NULL);
+        ASSERT(hlist_unhashed(&object->cookie_link));
+
         spin_lock(&cache->object_list_lock);
         list_del_init(&object->cache_link);
         spin_unlock(&cache->object_list_lock);
 
+        fscache_stat(&fscache_n_cop_drop_object);
         cache->ops->drop_object(object);
+        fscache_stat_d(&fscache_n_cop_drop_object);
 
         if (parent) {
                 _debug("release parent OBJ%x {%d}",
@@ -600,7 +672,9 @@ static void fscache_drop_object(struct fscache_object *object)
         }
 
         /* this just shifts the object release to the slow work processor */
+        fscache_stat(&fscache_n_cop_put_object);
         object->cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 
         _leave("");
 }
@@ -690,8 +764,12 @@ static int fscache_object_slow_work_get_ref(struct slow_work *work)
 {
         struct fscache_object *object =
                 container_of(work, struct fscache_object, work);
+        int ret;
 
-        return object->cache->ops->grab_object(object) ? 0 : -EAGAIN;
+        fscache_stat(&fscache_n_cop_grab_object);
+        ret = object->cache->ops->grab_object(object) ? 0 : -EAGAIN;
+        fscache_stat_d(&fscache_n_cop_grab_object);
+        return ret;
 }
 
 /*
@@ -702,7 +780,9 @@ static void fscache_object_slow_work_put_ref(struct slow_work *work)
         struct fscache_object *object =
                 container_of(work, struct fscache_object, work);
 
-        return object->cache->ops->put_object(object);
+        fscache_stat(&fscache_n_cop_put_object);
+        object->cache->ops->put_object(object);
+        fscache_stat_d(&fscache_n_cop_put_object);
 }
 
 /*
@@ -739,7 +819,9 @@ static void fscache_enqueue_dependents(struct fscache_object *object)
 
                 /* sort onto appropriate lists */
                 fscache_enqueue_object(dep);
+                fscache_stat(&fscache_n_cop_put_object);
                 dep->cache->ops->put_object(dep);
+                fscache_stat_d(&fscache_n_cop_put_object);
 
                 if (!list_empty(&object->dependents))
                         cond_resched_lock(&object->lock);
diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
index e7f8d53b8b6b..313e79a14266 100644
--- a/fs/fscache/operation.c
+++ b/fs/fscache/operation.c
@@ -13,6 +13,7 @@
 
 #define FSCACHE_DEBUG_LEVEL OPERATION
 #include <linux/module.h>
+#include <linux/seq_file.h>
 #include "internal.h"
 
 atomic_t fscache_op_debug_id;
@@ -31,32 +32,33 @@ void fscache_enqueue_operation(struct fscache_operation *op)
         _enter("{OBJ%x OP%x,%u}",
                op->object->debug_id, op->debug_id, atomic_read(&op->usage));
 
+        fscache_set_op_state(op, "EnQ");
+
+        ASSERT(list_empty(&op->pend_link));
         ASSERT(op->processor != NULL);
         ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
         ASSERTCMP(atomic_read(&op->usage), >, 0);
 
-        if (list_empty(&op->pend_link)) {
-                switch (op->flags & FSCACHE_OP_TYPE) {
-                case FSCACHE_OP_FAST:
-                        _debug("queue fast");
-                        atomic_inc(&op->usage);
-                        if (!schedule_work(&op->fast_work))
-                                fscache_put_operation(op);
-                        break;
-                case FSCACHE_OP_SLOW:
-                        _debug("queue slow");
-                        slow_work_enqueue(&op->slow_work);
-                        break;
-                case FSCACHE_OP_MYTHREAD:
-                        _debug("queue for caller's attention");
-                        break;
-                default:
-                        printk(KERN_ERR "FS-Cache: Unexpected op type %lx",
-                               op->flags);
-                        BUG();
-                        break;
-                }
-                fscache_stat(&fscache_n_op_enqueue);
+        fscache_stat(&fscache_n_op_enqueue);
+        switch (op->flags & FSCACHE_OP_TYPE) {
+        case FSCACHE_OP_FAST:
+                _debug("queue fast");
+                atomic_inc(&op->usage);
+                if (!schedule_work(&op->fast_work))
+                        fscache_put_operation(op);
+                break;
+        case FSCACHE_OP_SLOW:
+                _debug("queue slow");
+                slow_work_enqueue(&op->slow_work);
+                break;
+        case FSCACHE_OP_MYTHREAD:
+                _debug("queue for caller's attention");
+                break;
+        default:
+                printk(KERN_ERR "FS-Cache: Unexpected op type %lx",
+                       op->flags);
+                BUG();
+                break;
         }
 }
 EXPORT_SYMBOL(fscache_enqueue_operation);
@@ -67,6 +69,8 @@ EXPORT_SYMBOL(fscache_enqueue_operation);
 static void fscache_run_op(struct fscache_object *object,
                            struct fscache_operation *op)
 {
+        fscache_set_op_state(op, "Run");
+
         object->n_in_progress++;
         if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
                 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
@@ -87,9 +91,12 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
 
         _enter("{OBJ%x OP%x},", object->debug_id, op->debug_id);
 
+        fscache_set_op_state(op, "SubmitX");
+
         spin_lock(&object->lock);
         ASSERTCMP(object->n_ops, >=, object->n_in_progress);
         ASSERTCMP(object->n_ops, >=, object->n_exclusive);
+        ASSERT(list_empty(&op->pend_link));
 
         ret = -ENOBUFS;
         if (fscache_object_is_active(object)) {
@@ -190,9 +197,12 @@ int fscache_submit_op(struct fscache_object *object,
 
         ASSERTCMP(atomic_read(&op->usage), >, 0);
 
+        fscache_set_op_state(op, "Submit");
+
         spin_lock(&object->lock);
         ASSERTCMP(object->n_ops, >=, object->n_in_progress);
         ASSERTCMP(object->n_ops, >=, object->n_exclusive);
+        ASSERT(list_empty(&op->pend_link));
 
         ostate = object->state;
         smp_rmb();
@@ -222,6 +232,11 @@ int fscache_submit_op(struct fscache_object *object,
                 list_add_tail(&op->pend_link, &object->pending_ops);
                 fscache_stat(&fscache_n_op_pend);
                 ret = 0;
+        } else if (object->state == FSCACHE_OBJECT_DYING ||
+                   object->state == FSCACHE_OBJECT_LC_DYING ||
+                   object->state == FSCACHE_OBJECT_WITHDRAWING) {
+                fscache_stat(&fscache_n_op_rejected);
+                ret = -ENOBUFS;
         } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
                 fscache_report_unexpected_submission(object, op, ostate);
                 ASSERT(!fscache_object_is_active(object));
@@ -264,12 +279,7 @@ void fscache_start_operations(struct fscache_object *object)
                         stop = true;
                 }
                 list_del_init(&op->pend_link);
-                object->n_in_progress++;
-
-                if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
-                        wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
-                if (op->processor)
-                        fscache_enqueue_operation(op);
+                fscache_run_op(object, op);
 
                 /* the pending queue was holding a ref on the object */
                 fscache_put_operation(op);
@@ -282,6 +292,36 @@ void fscache_start_operations(struct fscache_object *object)
 }
 
 /*
+ * cancel an operation that's pending on an object
+ */
+int fscache_cancel_op(struct fscache_operation *op)
+{
+        struct fscache_object *object = op->object;
+        int ret;
+
+        _enter("OBJ%x OP%x}", op->object->debug_id, op->debug_id);
+
+        spin_lock(&object->lock);
+
+        ret = -EBUSY;
+        if (!list_empty(&op->pend_link)) {
+                fscache_stat(&fscache_n_op_cancelled);
+                list_del_init(&op->pend_link);
+                object->n_ops--;
+                if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
+                        object->n_exclusive--;
+                if (test_and_clear_bit(FSCACHE_OP_WAITING, &op->flags))
+                        wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
+                fscache_put_operation(op);
+                ret = 0;
+        }
+
+        spin_unlock(&object->lock);
+        _leave(" = %d", ret);
+        return ret;
+}
+
+/*
  * release an operation
  * - queues pending ops if this is the last in-progress op
  */
@@ -298,6 +338,8 @@ void fscache_put_operation(struct fscache_operation *op)
         if (!atomic_dec_and_test(&op->usage))
                 return;
 
+        fscache_set_op_state(op, "Put");
+
         _debug("PUT OP");
         if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
                 BUG();
@@ -311,6 +353,9 @@ void fscache_put_operation(struct fscache_operation *op)
 
         object = op->object;
 
+        if (test_bit(FSCACHE_OP_DEC_READ_CNT, &op->flags))
+                atomic_dec(&object->n_reads);
+
         /* now... we may get called with the object spinlock held, so we
          * complete the cleanup here only if we can immediately acquire the
          * lock, and defer it otherwise */
@@ -452,8 +497,27 @@ static void fscache_op_execute(struct slow_work *work)
         _leave("");
 }
 
+/*
+ * describe an operation for slow-work debugging
+ */
+#ifdef CONFIG_SLOW_WORK_PROC
+static void fscache_op_desc(struct slow_work *work, struct seq_file *m)
+{
+        struct fscache_operation *op =
+                container_of(work, struct fscache_operation, slow_work);
+
+        seq_printf(m, "FSC: OBJ%x OP%x: %s/%s fl=%lx",
+                   op->object->debug_id, op->debug_id,
+                   op->name, op->state, op->flags);
+}
+#endif
+
 const struct slow_work_ops fscache_op_slow_work_ops = {
+        .owner          = THIS_MODULE,
         .get_ref        = fscache_op_get_ref,
         .put_ref        = fscache_op_put_ref,
         .execute        = fscache_op_execute,
+#ifdef CONFIG_SLOW_WORK_PROC
+        .desc           = fscache_op_desc,
+#endif
 };
diff --git a/fs/fscache/page.c b/fs/fscache/page.c
index 2568e0eb644f..c598ea4c4e7d 100644
--- a/fs/fscache/page.c
+++ b/fs/fscache/page.c
@@ -43,18 +43,102 @@ void __fscache_wait_on_page_write(struct fscache_cookie *cookie, struct page *pa
 EXPORT_SYMBOL(__fscache_wait_on_page_write);
 
 /*
- * note that a page has finished being written to the cache
+ * decide whether a page can be released, possibly by cancelling a store to it
+ * - we're allowed to sleep if __GFP_WAIT is flagged
  */
-static void fscache_end_page_write(struct fscache_cookie *cookie, struct page *page)
+bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
+                                  struct page *page,
+                                  gfp_t gfp)
 {
         struct page *xpage;
+        void *val;
+
+        _enter("%p,%p,%x", cookie, page, gfp);
+
+        rcu_read_lock();
+        val = radix_tree_lookup(&cookie->stores, page->index);
+        if (!val) {
+                rcu_read_unlock();
+                fscache_stat(&fscache_n_store_vmscan_not_storing);
+                __fscache_uncache_page(cookie, page);
+                return true;
+        }
+
+        /* see if the page is actually undergoing storage - if so we can't get
+         * rid of it till the cache has finished with it */
+        if (radix_tree_tag_get(&cookie->stores, page->index,
+                               FSCACHE_COOKIE_STORING_TAG)) {
+                rcu_read_unlock();
+                goto page_busy;
+        }
+
+        /* the page is pending storage, so we attempt to cancel the store and
+         * discard the store request so that the page can be reclaimed */
+        spin_lock(&cookie->stores_lock);
+        rcu_read_unlock();
+
+        if (radix_tree_tag_get(&cookie->stores, page->index,
+                               FSCACHE_COOKIE_STORING_TAG)) {
+                /* the page started to undergo storage whilst we were looking,
+                 * so now we can only wait or return */
+                spin_unlock(&cookie->stores_lock);
+                goto page_busy;
+        }
 
-        spin_lock(&cookie->lock);
         xpage = radix_tree_delete(&cookie->stores, page->index);
-        spin_unlock(&cookie->lock);
-        ASSERT(xpage != NULL);
+        spin_unlock(&cookie->stores_lock);
+
+        if (xpage) {
+                fscache_stat(&fscache_n_store_vmscan_cancelled);
+                fscache_stat(&fscache_n_store_radix_deletes);
+                ASSERTCMP(xpage, ==, page);
+        } else {
+                fscache_stat(&fscache_n_store_vmscan_gone);
+        }
 
         wake_up_bit(&cookie->flags, 0);
+        if (xpage)
+                page_cache_release(xpage);
+        __fscache_uncache_page(cookie, page);
+        return true;
+
+page_busy:
+        /* we might want to wait here, but that could deadlock the allocator as
+         * the slow-work threads writing to the cache may all end up sleeping
+         * on memory allocation */
+        fscache_stat(&fscache_n_store_vmscan_busy);
+        return false;
+}
+EXPORT_SYMBOL(__fscache_maybe_release_page);
+
+/*
+ * note that a page has finished being written to the cache
+ */
+static void fscache_end_page_write(struct fscache_object *object,
+                                   struct page *page)
+{
+        struct fscache_cookie *cookie;
+        struct page *xpage = NULL;
+
+        spin_lock(&object->lock);
+        cookie = object->cookie;
+        if (cookie) {
+                /* delete the page from the tree if it is now no longer
+                 * pending */
+                spin_lock(&cookie->stores_lock);
+                radix_tree_tag_clear(&cookie->stores, page->index,
+                                     FSCACHE_COOKIE_STORING_TAG);
+                if (!radix_tree_tag_get(&cookie->stores, page->index,
+                                        FSCACHE_COOKIE_PENDING_TAG)) {
+                        fscache_stat(&fscache_n_store_radix_deletes);
+                        xpage = radix_tree_delete(&cookie->stores, page->index);
+                }
+                spin_unlock(&cookie->stores_lock);
+                wake_up_bit(&cookie->flags, 0);
+        }
+        spin_unlock(&object->lock);
+        if (xpage)
+                page_cache_release(xpage);
 }
 
 /*
@@ -63,14 +147,21 @@ static void fscache_end_page_write(struct fscache_cookie *cookie, struct page *p
 static void fscache_attr_changed_op(struct fscache_operation *op)
 {
         struct fscache_object *object = op->object;
+        int ret;
 
         _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
 
         fscache_stat(&fscache_n_attr_changed_calls);
 
-        if (fscache_object_is_active(object) &&
-            object->cache->ops->attr_changed(object) < 0)
-                fscache_abort_object(object);
+        if (fscache_object_is_active(object)) {
+                fscache_set_op_state(op, "CallFS");
+                fscache_stat(&fscache_n_cop_attr_changed);
+                ret = object->cache->ops->attr_changed(object);
+                fscache_stat_d(&fscache_n_cop_attr_changed);
+                fscache_set_op_state(op, "Done");
+                if (ret < 0)
+                        fscache_abort_object(object);
+        }
 
         _leave("");
 }
@@ -99,6 +190,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
         fscache_operation_init(op, NULL);
         fscache_operation_init_slow(op, fscache_attr_changed_op);
         op->flags = FSCACHE_OP_SLOW | (1 << FSCACHE_OP_EXCLUSIVE);
+        fscache_set_op_name(op, "Attr");
 
         spin_lock(&cookie->lock);
 
@@ -184,6 +276,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
         op->start_time  = jiffies;
         INIT_WORK(&op->op.fast_work, fscache_retrieval_work);
         INIT_LIST_HEAD(&op->to_do);
+        fscache_set_op_name(&op->op, "Retr");
         return op;
 }
 
@@ -221,6 +314,43 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
 }
 
 /*
+ * wait for an object to become active (or dead)
+ */
+static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
+                                                 struct fscache_retrieval *op,
+                                                 atomic_t *stat_op_waits,
+                                                 atomic_t *stat_object_dead)
+{
+        int ret;
+
+        if (!test_bit(FSCACHE_OP_WAITING, &op->op.flags))
+                goto check_if_dead;
+
+        _debug(">>> WT");
+        fscache_stat(stat_op_waits);
+        if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
+                        fscache_wait_bit_interruptible,
+                        TASK_INTERRUPTIBLE) < 0) {
+                ret = fscache_cancel_op(&op->op);
+                if (ret == 0)
+                        return -ERESTARTSYS;
+
+                /* it's been removed from the pending queue by another party,
+                 * so we should get to run shortly */
+                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
+                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
+        }
+        _debug("<<< GO");
+
+check_if_dead:
+        if (unlikely(fscache_object_is_dead(object))) {
+                fscache_stat(stat_object_dead);
+                return -ENOBUFS;
+        }
+        return 0;
+}
+
+/*
  * read a page from the cache or allocate a block in which to store it
  * - we return:
  *   -ENOMEM    - out of memory, nothing done
@@ -257,6 +387,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
                 _leave(" = -ENOMEM");
                 return -ENOMEM;
         }
+        fscache_set_op_name(&op->op, "RetrRA1");
 
         spin_lock(&cookie->lock);
 
@@ -267,6 +398,9 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
 
         ASSERTCMP(object->state, >, FSCACHE_OBJECT_LOOKING_UP);
 
+        atomic_inc(&object->n_reads);
+        set_bit(FSCACHE_OP_DEC_READ_CNT, &op->op.flags);
+
         if (fscache_submit_op(object, &op->op) < 0)
                 goto nobufs_unlock;
         spin_unlock(&cookie->lock);
@@ -279,23 +413,27 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
 
         /* we wait for the operation to become active, and then process it
          * *here*, in this thread, and not in the thread pool */
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_retrieval_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_retrieval_op_waits),
+                __fscache_stat(&fscache_n_retrievals_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
         if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags)) {
+                fscache_stat(&fscache_n_cop_allocate_page);
                 ret = object->cache->ops->allocate_page(op, page, gfp);
+                fscache_stat_d(&fscache_n_cop_allocate_page);
                 if (ret == 0)
                         ret = -ENODATA;
         } else {
+                fscache_stat(&fscache_n_cop_read_or_alloc_page);
                 ret = object->cache->ops->read_or_alloc_page(op, page, gfp);
+                fscache_stat_d(&fscache_n_cop_read_or_alloc_page);
         }
 
+error:
         if (ret == -ENOMEM)
                 fscache_stat(&fscache_n_retrievals_nomem);
         else if (ret == -ERESTARTSYS)
@@ -347,7 +485,6 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
                                   void *context,
                                   gfp_t gfp)
 {
-        fscache_pages_retrieval_func_t func;
         struct fscache_retrieval *op;
         struct fscache_object *object;
         int ret;
@@ -369,6 +506,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
         op = fscache_alloc_retrieval(mapping, end_io_func, context);
         if (!op)
                 return -ENOMEM;
+        fscache_set_op_name(&op->op, "RetrRAN");
 
         spin_lock(&cookie->lock);
 
@@ -377,6 +515,9 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
         object = hlist_entry(cookie->backing_objects.first,
                              struct fscache_object, cookie_link);
 
+        atomic_inc(&object->n_reads);
+        set_bit(FSCACHE_OP_DEC_READ_CNT, &op->op.flags);
+
         if (fscache_submit_op(object, &op->op) < 0)
                 goto nobufs_unlock;
         spin_unlock(&cookie->lock);
@@ -389,21 +530,27 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
 
         /* we wait for the operation to become active, and then process it
          * *here*, in this thread, and not in the thread pool */
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_retrieval_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_retrieval_op_waits),
+                __fscache_stat(&fscache_n_retrievals_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
-        if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags))
-                func = object->cache->ops->allocate_pages;
-        else
-                func = object->cache->ops->read_or_alloc_pages;
-        ret = func(op, pages, nr_pages, gfp);
+        if (test_bit(FSCACHE_COOKIE_NO_DATA_YET, &object->cookie->flags)) {
+                fscache_stat(&fscache_n_cop_allocate_pages);
+                ret = object->cache->ops->allocate_pages(
+                        op, pages, nr_pages, gfp);
+                fscache_stat_d(&fscache_n_cop_allocate_pages);
+        } else {
+                fscache_stat(&fscache_n_cop_read_or_alloc_pages);
+                ret = object->cache->ops->read_or_alloc_pages(
+                        op, pages, nr_pages, gfp);
+                fscache_stat_d(&fscache_n_cop_read_or_alloc_pages);
+        }
 
+error:
         if (ret == -ENOMEM)
                 fscache_stat(&fscache_n_retrievals_nomem);
         else if (ret == -ERESTARTSYS)
@@ -461,6 +608,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
         op = fscache_alloc_retrieval(page->mapping, NULL, NULL);
         if (!op)
                 return -ENOMEM;
+        fscache_set_op_name(&op->op, "RetrAL1");
 
         spin_lock(&cookie->lock);
 
@@ -475,18 +623,22 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
 
         fscache_stat(&fscache_n_alloc_ops);
 
-        if (test_bit(FSCACHE_OP_WAITING, &op->op.flags)) {
-                _debug(">>> WT");
-                fscache_stat(&fscache_n_alloc_op_waits);
-                wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
-                            fscache_wait_bit, TASK_UNINTERRUPTIBLE);
-                _debug("<<< GO");
-        }
+        ret = fscache_wait_for_retrieval_activation(
+                object, op,
+                __fscache_stat(&fscache_n_alloc_op_waits),
+                __fscache_stat(&fscache_n_allocs_object_dead));
+        if (ret < 0)
+                goto error;
 
         /* ask the cache to honour the operation */
+        fscache_stat(&fscache_n_cop_allocate_page);
         ret = object->cache->ops->allocate_page(op, page, gfp);
+        fscache_stat_d(&fscache_n_cop_allocate_page);
 
-        if (ret < 0)
+error:
+        if (ret == -ERESTARTSYS)
+                fscache_stat(&fscache_n_allocs_intr);
+        else if (ret < 0)
                 fscache_stat(&fscache_n_allocs_nobufs);
         else
                 fscache_stat(&fscache_n_allocs_ok);
@@ -521,7 +673,7 @@ static void fscache_write_op(struct fscache_operation *_op)
         struct fscache_storage *op =
                 container_of(_op, struct fscache_storage, op);
         struct fscache_object *object = op->op.object;
-        struct fscache_cookie *cookie = object->cookie;
+        struct fscache_cookie *cookie;
         struct page *page;
         unsigned n;
         void *results[1];
@@ -529,16 +681,19 @@ static void fscache_write_op(struct fscache_operation *_op)
 
         _enter("{OP%x,%d}", op->op.debug_id, atomic_read(&op->op.usage));
 
-        spin_lock(&cookie->lock);
+        fscache_set_op_state(&op->op, "GetPage");
+
         spin_lock(&object->lock);
+        cookie = object->cookie;
 
-        if (!fscache_object_is_active(object)) {
+        if (!fscache_object_is_active(object) || !cookie) {
                 spin_unlock(&object->lock);
-                spin_unlock(&cookie->lock);
                 _leave("");
                 return;
         }
 
+        spin_lock(&cookie->stores_lock);
+
         fscache_stat(&fscache_n_store_calls);
 
         /* find a page to store */
@@ -549,23 +704,35 @@ static void fscache_write_op(struct fscache_operation *_op)
                 goto superseded;
         page = results[0];
         _debug("gang %d [%lx]", n, page->index);
-        if (page->index > op->store_limit)
+        if (page->index > op->store_limit) {
+                fscache_stat(&fscache_n_store_pages_over_limit);
                 goto superseded;
+        }
 
-        radix_tree_tag_clear(&cookie->stores, page->index,
-                             FSCACHE_COOKIE_PENDING_TAG);
+        if (page) {
+                radix_tree_tag_set(&cookie->stores, page->index,
+                                   FSCACHE_COOKIE_STORING_TAG);
+                radix_tree_tag_clear(&cookie->stores, page->index,
+                                     FSCACHE_COOKIE_PENDING_TAG);
+        }
 
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
-        spin_unlock(&cookie->lock);
 
         if (page) {
+                fscache_set_op_state(&op->op, "Store");
+                fscache_stat(&fscache_n_store_pages);
+                fscache_stat(&fscache_n_cop_write_page);
                 ret = object->cache->ops->write_page(op, page);
-                fscache_end_page_write(cookie, page);
-                page_cache_release(page);
-                if (ret < 0)
+                fscache_stat_d(&fscache_n_cop_write_page);
+                fscache_set_op_state(&op->op, "EndWrite");
+                fscache_end_page_write(object, page);
+                if (ret < 0) {
+                        fscache_set_op_state(&op->op, "Abort");
                         fscache_abort_object(object);
-                else
+                } else {
                         fscache_enqueue_operation(&op->op);
+                }
         }
 
         _leave("");
@@ -575,9 +742,9 @@ superseded:
         /* this writer is going away and there aren't any more things to
          * write */
         _debug("cease");
+        spin_unlock(&cookie->stores_lock);
         clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags);
         spin_unlock(&object->lock);
-        spin_unlock(&cookie->lock);
         _leave("");
 }
 
@@ -634,6 +801,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         fscache_operation_init(&op->op, fscache_release_write_op);
         fscache_operation_init_slow(&op->op, fscache_write_op);
         op->op.flags = FSCACHE_OP_SLOW | (1 << FSCACHE_OP_WAITING);
+        fscache_set_op_name(&op->op, "Write1");
 
         ret = radix_tree_preload(gfp & ~__GFP_HIGHMEM);
         if (ret < 0)
@@ -652,6 +820,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         /* add the page to the pending-storage radix tree on the backing
          * object */
         spin_lock(&object->lock);
+        spin_lock(&cookie->stores_lock);
 
         _debug("store limit %llx", (unsigned long long) object->store_limit);
 
@@ -672,6 +841,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
         if (test_and_set_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags))
                 goto already_pending;
 
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
 
         op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
@@ -693,6 +863,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
 already_queued:
         fscache_stat(&fscache_n_stores_again);
 already_pending:
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
         spin_unlock(&cookie->lock);
         radix_tree_preload_end();
@@ -702,7 +873,9 @@ already_pending:
         return 0;
 
 submit_failed:
+        spin_lock(&cookie->stores_lock);
         radix_tree_delete(&cookie->stores, page->index);
+        spin_unlock(&cookie->stores_lock);
         page_cache_release(page);
         ret = -ENOBUFS;
         goto nobufs;
@@ -763,7 +936,9 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
         if (TestClearPageFsCache(page) &&
             object->cache->ops->uncache_page) {
                 /* the cache backend releases the cookie lock */
+                fscache_stat(&fscache_n_cop_uncache_page);
                 object->cache->ops->uncache_page(object, page);
+                fscache_stat_d(&fscache_n_cop_uncache_page);
                 goto done;
         }
 
diff --git a/fs/fscache/proc.c b/fs/fscache/proc.c
index beeab44bc31a..1d9e4951a597 100644
--- a/fs/fscache/proc.c
+++ b/fs/fscache/proc.c
@@ -37,10 +37,20 @@ int __init fscache_proc_init(void)
                 goto error_histogram;
 #endif
 
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        if (!proc_create("fs/fscache/objects", S_IFREG | 0444, NULL,
+                         &fscache_objlist_fops))
+                goto error_objects;
+#endif
+
         _leave(" = 0");
         return 0;
 
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+error_objects:
+#endif
 #ifdef CONFIG_FSCACHE_HISTOGRAM
+        remove_proc_entry("fs/fscache/histogram", NULL);
 error_histogram:
 #endif
 #ifdef CONFIG_FSCACHE_STATS
@@ -58,6 +68,9 @@ error_dir:
  */
 void fscache_proc_cleanup(void)
 {
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        remove_proc_entry("fs/fscache/objects", NULL);
+#endif
 #ifdef CONFIG_FSCACHE_HISTOGRAM
         remove_proc_entry("fs/fscache/histogram", NULL);
 #endif
diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
index 65deb99e756b..46435f3aae68 100644
--- a/fs/fscache/stats.c
+++ b/fs/fscache/stats.c
@@ -25,6 +25,8 @@ atomic_t fscache_n_op_requeue;
 atomic_t fscache_n_op_deferred_release;
 atomic_t fscache_n_op_release;
 atomic_t fscache_n_op_gc;
+atomic_t fscache_n_op_cancelled;
+atomic_t fscache_n_op_rejected;
 
 atomic_t fscache_n_attr_changed;
 atomic_t fscache_n_attr_changed_ok;
@@ -36,6 +38,8 @@ atomic_t fscache_n_allocs;
 atomic_t fscache_n_allocs_ok;
 atomic_t fscache_n_allocs_wait;
 atomic_t fscache_n_allocs_nobufs;
+atomic_t fscache_n_allocs_intr;
+atomic_t fscache_n_allocs_object_dead;
 atomic_t fscache_n_alloc_ops;
 atomic_t fscache_n_alloc_op_waits;
 
@@ -46,6 +50,7 @@ atomic_t fscache_n_retrievals_nodata;
 atomic_t fscache_n_retrievals_nobufs;
 atomic_t fscache_n_retrievals_intr;
 atomic_t fscache_n_retrievals_nomem;
+atomic_t fscache_n_retrievals_object_dead;
 atomic_t fscache_n_retrieval_ops;
 atomic_t fscache_n_retrieval_op_waits;
 
@@ -56,6 +61,14 @@ atomic_t fscache_n_stores_nobufs;
 atomic_t fscache_n_stores_oom;
 atomic_t fscache_n_store_ops;
 atomic_t fscache_n_store_calls;
+atomic_t fscache_n_store_pages;
+atomic_t fscache_n_store_radix_deletes;
+atomic_t fscache_n_store_pages_over_limit;
+
+atomic_t fscache_n_store_vmscan_not_storing;
+atomic_t fscache_n_store_vmscan_gone;
+atomic_t fscache_n_store_vmscan_busy;
+atomic_t fscache_n_store_vmscan_cancelled;
 
 atomic_t fscache_n_marks;
 atomic_t fscache_n_uncaches;
@@ -74,6 +87,7 @@ atomic_t fscache_n_updates_run;
 atomic_t fscache_n_relinquishes;
 atomic_t fscache_n_relinquishes_null;
 atomic_t fscache_n_relinquishes_waitcrt;
+atomic_t fscache_n_relinquishes_retire;
 
 atomic_t fscache_n_cookie_index;
 atomic_t fscache_n_cookie_data;
@@ -84,6 +98,7 @@ atomic_t fscache_n_object_no_alloc;
 atomic_t fscache_n_object_lookups;
 atomic_t fscache_n_object_lookups_negative;
 atomic_t fscache_n_object_lookups_positive;
+atomic_t fscache_n_object_lookups_timed_out;
 atomic_t fscache_n_object_created;
 atomic_t fscache_n_object_avail;
 atomic_t fscache_n_object_dead;
@@ -93,6 +108,23 @@ atomic_t fscache_n_checkaux_okay;
 atomic_t fscache_n_checkaux_update;
 atomic_t fscache_n_checkaux_obsolete;
 
+atomic_t fscache_n_cop_alloc_object;
+atomic_t fscache_n_cop_lookup_object;
+atomic_t fscache_n_cop_lookup_complete;
+atomic_t fscache_n_cop_grab_object;
+atomic_t fscache_n_cop_update_object;
+atomic_t fscache_n_cop_drop_object;
+atomic_t fscache_n_cop_put_object;
+atomic_t fscache_n_cop_sync_cache;
+atomic_t fscache_n_cop_attr_changed;
+atomic_t fscache_n_cop_read_or_alloc_page;
+atomic_t fscache_n_cop_read_or_alloc_pages;
+atomic_t fscache_n_cop_allocate_page;
+atomic_t fscache_n_cop_allocate_pages;
+atomic_t fscache_n_cop_write_page;
+atomic_t fscache_n_cop_uncache_page;
+atomic_t fscache_n_cop_dissociate_pages;
+
 /*
  * display the general statistics
  */
@@ -129,10 +161,11 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_acquires_nobufs),
                    atomic_read(&fscache_n_acquires_oom));
 
-        seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u\n",
+        seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
                    atomic_read(&fscache_n_object_lookups),
                    atomic_read(&fscache_n_object_lookups_negative),
                    atomic_read(&fscache_n_object_lookups_positive),
+                   atomic_read(&fscache_n_object_lookups_timed_out),
                    atomic_read(&fscache_n_object_created));
 
         seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
@@ -140,10 +173,11 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_updates_null),
                    atomic_read(&fscache_n_updates_run));
 
-        seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u\n",
+        seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
                    atomic_read(&fscache_n_relinquishes),
                    atomic_read(&fscache_n_relinquishes_null),
-                   atomic_read(&fscache_n_relinquishes_waitcrt));
+                   atomic_read(&fscache_n_relinquishes_waitcrt),
+                   atomic_read(&fscache_n_relinquishes_retire));
 
         seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
                    atomic_read(&fscache_n_attr_changed),
@@ -152,14 +186,16 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_attr_changed_nomem),
                    atomic_read(&fscache_n_attr_changed_calls));
 
-        seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u\n",
+        seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
                    atomic_read(&fscache_n_allocs),
                    atomic_read(&fscache_n_allocs_ok),
                    atomic_read(&fscache_n_allocs_wait),
-                   atomic_read(&fscache_n_allocs_nobufs));
-        seq_printf(m, "Allocs : ops=%u owt=%u\n",
+                   atomic_read(&fscache_n_allocs_nobufs),
+                   atomic_read(&fscache_n_allocs_intr));
+        seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
                    atomic_read(&fscache_n_alloc_ops),
-                   atomic_read(&fscache_n_alloc_op_waits));
+                   atomic_read(&fscache_n_alloc_op_waits),
+                   atomic_read(&fscache_n_allocs_object_dead));
 
         seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
                    " int=%u oom=%u\n",
@@ -170,9 +206,10 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_retrievals_nobufs),
                    atomic_read(&fscache_n_retrievals_intr),
                    atomic_read(&fscache_n_retrievals_nomem));
-        seq_printf(m, "Retrvls: ops=%u owt=%u\n",
+        seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
                    atomic_read(&fscache_n_retrieval_ops),
-                   atomic_read(&fscache_n_retrieval_op_waits));
+                   atomic_read(&fscache_n_retrieval_op_waits),
+                   atomic_read(&fscache_n_retrievals_object_dead));
 
         seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
                    atomic_read(&fscache_n_stores),
@@ -180,18 +217,49 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_stores_again),
                    atomic_read(&fscache_n_stores_nobufs),
                    atomic_read(&fscache_n_stores_oom));
-        seq_printf(m, "Stores : ops=%u run=%u\n",
+        seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
                    atomic_read(&fscache_n_store_ops),
-                   atomic_read(&fscache_n_store_calls));
+                   atomic_read(&fscache_n_store_calls),
+                   atomic_read(&fscache_n_store_pages),
+                   atomic_read(&fscache_n_store_radix_deletes),
+                   atomic_read(&fscache_n_store_pages_over_limit));
 
-        seq_printf(m, "Ops    : pend=%u run=%u enq=%u\n",
+        seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
+                   atomic_read(&fscache_n_store_vmscan_not_storing),
+                   atomic_read(&fscache_n_store_vmscan_gone),
+                   atomic_read(&fscache_n_store_vmscan_busy),
+                   atomic_read(&fscache_n_store_vmscan_cancelled));
+
+        seq_printf(m, "Ops    : pend=%u run=%u enq=%u can=%u rej=%u\n",
                    atomic_read(&fscache_n_op_pend),
                    atomic_read(&fscache_n_op_run),
-                   atomic_read(&fscache_n_op_enqueue));
+                   atomic_read(&fscache_n_op_enqueue),
+                   atomic_read(&fscache_n_op_cancelled),
+                   atomic_read(&fscache_n_op_rejected));
         seq_printf(m, "Ops    : dfr=%u rel=%u gc=%u\n",
                    atomic_read(&fscache_n_op_deferred_release),
                    atomic_read(&fscache_n_op_release),
                    atomic_read(&fscache_n_op_gc));
+
+        seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
+                   atomic_read(&fscache_n_cop_alloc_object),
+                   atomic_read(&fscache_n_cop_lookup_object),
+                   atomic_read(&fscache_n_cop_lookup_complete),
+                   atomic_read(&fscache_n_cop_grab_object));
+        seq_printf(m, "CacheOp: upo=%d dro=%d pto=%d atc=%d syn=%d\n",
+                   atomic_read(&fscache_n_cop_update_object),
+                   atomic_read(&fscache_n_cop_drop_object),
+                   atomic_read(&fscache_n_cop_put_object),
+                   atomic_read(&fscache_n_cop_attr_changed),
+                   atomic_read(&fscache_n_cop_sync_cache));
+        seq_printf(m, "CacheOp: rap=%d ras=%d alp=%d als=%d wrp=%d ucp=%d dsp=%d\n",
+                   atomic_read(&fscache_n_cop_read_or_alloc_page),
+                   atomic_read(&fscache_n_cop_read_or_alloc_pages),
+                   atomic_read(&fscache_n_cop_allocate_page),
+                   atomic_read(&fscache_n_cop_allocate_pages),
+                   atomic_read(&fscache_n_cop_write_page),
+                   atomic_read(&fscache_n_cop_uncache_page),
+                   atomic_read(&fscache_n_cop_dissociate_pages));
         return 0;
 }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 992f6c9410bb..4787ae6c5c1c 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -385,6 +385,9 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         if (fc->no_create)
                 return -ENOSYS;
 
+        if (flags & O_DIRECT)
+                return -EINVAL;
+
         forget_req = fuse_get_req(fc);
         if (IS_ERR(forget_req))
                 return PTR_ERR(forget_req);
@@ -712,8 +715,10 @@ static int fuse_rename(struct inode *olddir, struct dentry *oldent,
                         fuse_invalidate_attr(newdir);
 
                 /* newent will end up negative */
-                if (newent->d_inode)
+                if (newent->d_inode) {
+                        fuse_invalidate_attr(newent->d_inode);
                         fuse_invalidate_entry_cache(newent);
+                }
         } else if (err == -EINTR) {
                 /* If request was interrupted, DEITY only knows if the
                    rename actually took place.  If the invalidation
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index a3492f7d207c..c18913a777ae 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1063,7 +1063,8 @@ ssize_t fuse_direct_io(struct file *file, const char __user *buf,
                                 break;
                 }
         }
-        fuse_put_request(fc, req);
+        if (!IS_ERR(req))
+                fuse_put_request(fc, req);
         if (res > 0)
                 *ppos = pos;
 
@@ -1599,7 +1600,7 @@ static int fuse_ioctl_copy_user(struct page **pages, struct iovec *iov,
                         kaddr += copy;
                 }
 
-                kunmap(map);
+                kunmap(page);
         }
 
         return 0;
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index eacd78a5d082..5b31f7741a8f 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -114,7 +114,7 @@ static int __init init_gfs2_fs(void)
         if (error)
                 goto fail_unregister;
 
-        error = slow_work_register_user();
+        error = slow_work_register_user(THIS_MODULE);
         if (error)
                 goto fail_slow;
 
@@ -163,7 +163,7 @@ static void __exit exit_gfs2_fs(void)
         gfs2_unregister_debugfs();
         unregister_filesystem(&gfs2_fs_type);
         unregister_filesystem(&gfs2meta_fs_type);
-        slow_work_unregister_user();
+        slow_work_unregister_user(THIS_MODULE);
 
         kmem_cache_destroy(gfs2_quotad_cachep);
         kmem_cache_destroy(gfs2_rgrpd_cachep);
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index 59d2695509d3..09fa31965576 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -7,6 +7,7 @@
  * of the GNU General Public License version 2.
  */
 
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
@@ -593,6 +594,7 @@ fail:
 }
 
 struct slow_work_ops gfs2_recover_ops = {
+        .owner   = THIS_MODULE,
         .get_ref = gfs2_recover_get_ref,
         .put_ref = gfs2_recover_put_ref,
         .execute = gfs2_recover_work,
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 7b17a14396ff..6c751106c2e5 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -254,7 +254,7 @@ int __generic_block_fiemap(struct inode *inode,
                            u64 len, get_block_t *get_block)
 {
         struct buffer_head tmp;
-        unsigned int start_blk;
+        unsigned long long start_blk;
         long long length = 0, map_len = 0;
         u64 logical = 0, phys = 0, size = 0;
         u32 flags = FIEMAP_EXTENT_MERGED;
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index bd3c073b485d..4160afad6d00 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -73,6 +73,7 @@ EXPORT_SYMBOL(journal_errno);
 EXPORT_SYMBOL(journal_ack_err);
 EXPORT_SYMBOL(journal_clear_err);
 EXPORT_SYMBOL(log_wait_commit);
+EXPORT_SYMBOL(log_start_commit);
 EXPORT_SYMBOL(journal_start_commit);
 EXPORT_SYMBOL(journal_force_commit_nested);
 EXPORT_SYMBOL(journal_wipe);
@@ -756,6 +757,7 @@ journal_t * journal_init_dev(struct block_device *bdev,
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         kfree(journal);
         return NULL;
 }
@@ -820,6 +822,7 @@ journal_t * journal_init_inode (struct inode *inode)
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         kfree(journal);
         return NULL;
 }
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index b0ab5219becb..fed85388ee86 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -913,6 +913,7 @@ journal_t * jbd2_journal_init_dev(struct block_device *bdev,
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         jbd2_stats_proc_exit(journal);
         kfree(journal);
         return NULL;
@@ -986,6 +987,7 @@ journal_t * jbd2_journal_init_inode (struct inode *inode)
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         jbd2_stats_proc_exit(journal);
         kfree(journal);
         return NULL;
diff --git a/fs/jffs2/read.c b/fs/jffs2/read.c
index cfe05c1966a5..3f39be1b0455 100644
--- a/fs/jffs2/read.c
+++ b/fs/jffs2/read.c
@@ -164,12 +164,15 @@ int jffs2_read_inode_range(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 
         /* XXX FIXME: Where a single physical node actually shows up in two
            frags, we read it twice. Don't do that. */
-        /* Now we're pointing at the first frag which overlaps our page */
+        /* Now we're pointing at the first frag which overlaps our page
+         * (or perhaps is before it, if we've been asked to read off the
+         * end of the file). */
         while(offset < end) {
                 D2(printk(KERN_DEBUG "jffs2_read_inode_range: offset %d, end %d\n", offset, end));
-                if (unlikely(!frag || frag->ofs > offset)) {
+                if (unlikely(!frag || frag->ofs > offset ||
+                             frag->ofs + frag->size <= offset)) {
                         uint32_t holesize = end - offset;
-                        if (frag) {
+                        if (frag && frag->ofs > offset) {
                                 D1(printk(KERN_NOTICE "Eep. Hole in ino #%u fraglist. frag->ofs = 0x%08x, offset = 0x%08x\n", f->inocache->ino, frag->ofs, offset));
                                 holesize = min(holesize, frag->ofs - offset);
                         }
diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
index 70fad69eb959..fa588006588d 100644
--- a/fs/nfs/fscache.c
+++ b/fs/nfs/fscache.c
@@ -359,17 +359,13 @@ int nfs_fscache_release_page(struct page *page, gfp_t gfp)
 
         BUG_ON(!cookie);
 
-        if (fscache_check_page_write(cookie, page)) {
-                if (!(gfp & __GFP_WAIT))
-                        return 0;
-                fscache_wait_on_page_write(cookie, page);
-        }
-
         if (PageFsCache(page)) {
                 dfprintk(FSCACHE, "NFS: fscache releasepage (0x%p/0x%p/0x%p)\n",
                          cookie, page, nfsi);
 
-                fscache_uncache_page(cookie, page);
+                if (!fscache_maybe_release_page(cookie, page, gfp))
+                        return 0;
+
                 nfs_add_fscache_stats(page->mapping->host,
                                       NFSIOS_FSCACHE_PAGES_UNCACHED, 1);
         }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ff37454fa783..741a562177fc 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2767,7 +2767,7 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
                 .pages = &page,
                 .pgbase = 0,
                 .count = count,
-                .bitmask = NFS_SERVER(dentry->d_inode)->cache_consistency_bitmask,
+                .bitmask = NFS_SERVER(dentry->d_inode)->attr_bitmask,
         };
         struct nfs4_readdir_res res;
         struct rpc_message msg = {
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index edf926e1062f..d0a2ce1b4324 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -958,7 +958,7 @@ encode_entry(struct readdir_cd *ccd, const char *name, int namlen,
                 p1 = encode_entry_baggage(cd, p1, name, namlen, ino);
 
                 if (plus)
-                        p = encode_entryplus_baggage(cd, p1, name, namlen);
+                        p1 = encode_entryplus_baggage(cd, p1, name, namlen);
 
                 /* determine entry word length and lengths to go in pages */
                 num_entry_words = p1 - tmp;
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index 5941958f1e47..84c25382f8e3 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -87,6 +87,7 @@ int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,
                         brelse(bh);
                         BUG();
                 }
+                memset(bh->b_data, 0, 1 << inode->i_blkbits);
                 bh->b_bdev = NILFS_I_NILFS(inode)->ns_bdev;
                 bh->b_blocknr = blocknr;
                 set_buffer_mapped(bh);
@@ -276,8 +277,7 @@ void nilfs_btnode_commit_change_key(struct address_space *btnc,
                                        "invalid oldkey %lld (newkey=%lld)",
                                        (unsigned long long)oldkey,
                                        (unsigned long long)newkey);
-                if (!test_set_buffer_dirty(obh) && TestSetPageDirty(opage))
-                        BUG();
+                nilfs_btnode_mark_dirty(obh);
 
                 spin_lock_irq(&btnc->tree_lock);
                 radix_tree_delete(&btnc->page_tree, oldkey);
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index 1c6cfb59128d..3f5d5d06f53c 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -871,7 +871,6 @@ int nilfs_cpfile_change_cpmode(struct inode *cpfile, __u64 cno, int mode)
                  * exclusive with a new mount job.  Though it doesn't cover
                  * umount, it's enough for the purpose.
                  */
-                mutex_lock(&nilfs->ns_mount_mutex);
                 if (nilfs_checkpoint_is_mounted(nilfs, cno, 1)) {
                         /* Current implementation does not have to protect
                            plain read-only mounts since they are exclusive
@@ -880,7 +879,6 @@ int nilfs_cpfile_change_cpmode(struct inode *cpfile, __u64 cno, int mode)
                         ret = -EBUSY;
                 } else
                         ret = nilfs_cpfile_clear_snapshot(cpfile, cno);
-                mutex_unlock(&nilfs->ns_mount_mutex);
                 return ret;
         case NILFS_SNAPSHOT:
                 return nilfs_cpfile_set_snapshot(cpfile, cno);
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 5040220c3732..2a0a5a3ac134 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -664,7 +664,6 @@ int nilfs_load_inode_block(struct nilfs_sb_info *sbi, struct inode *inode,
         int err;
 
         spin_lock(&sbi->s_inode_lock);
-        /* Caller of this function MUST lock s_inode_lock */
         if (ii->i_bh == NULL) {
                 spin_unlock(&sbi->s_inode_lock);
                 err = nilfs_ifile_get_inode_block(sbi->s_ifile, inode->i_ino,
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 6572ea4bc4df..f6af76042d80 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -99,7 +99,8 @@ static int nilfs_ioctl_wrap_copy(struct the_nilfs *nilfs,
 static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
                                      unsigned int cmd, void __user *argp)
 {
-        struct inode *cpfile = NILFS_SB(inode->i_sb)->s_nilfs->ns_cpfile;
+        struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+        struct inode *cpfile = nilfs->ns_cpfile;
         struct nilfs_transaction_info ti;
         struct nilfs_cpmode cpmode;
         int ret;
@@ -109,14 +110,17 @@ static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
         if (copy_from_user(&cpmode, argp, sizeof(cpmode)))
                 return -EFAULT;
 
+        mutex_lock(&nilfs->ns_mount_mutex);
         nilfs_transaction_begin(inode->i_sb, &ti, 0);
         ret = nilfs_cpfile_change_cpmode(
                 cpfile, cpmode.cm_cno, cpmode.cm_mode);
         if (unlikely(ret < 0)) {
                 nilfs_transaction_abort(inode->i_sb);
+                mutex_unlock(&nilfs->ns_mount_mutex);
                 return ret;
         }
         nilfs_transaction_commit(inode->i_sb); /* never fails */
+        mutex_unlock(&nilfs->ns_mount_mutex);
         return ret;
 }
 
@@ -297,7 +301,18 @@ static int nilfs_ioctl_move_inode_block(struct inode *inode,
                                (unsigned long long)vdesc->vd_vblocknr);
                 return ret;
         }
-        bh->b_private = vdesc;
+        if (unlikely(!list_empty(&bh->b_assoc_buffers))) {
+                printk(KERN_CRIT "%s: conflicting %s buffer: ino=%llu, "
+                       "cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu\n",
+                       __func__, vdesc->vd_flags ? "node" : "data",
+                       (unsigned long long)vdesc->vd_ino,
+                       (unsigned long long)vdesc->vd_cno,
+                       (unsigned long long)vdesc->vd_offset,
+                       (unsigned long long)vdesc->vd_blocknr,
+                       (unsigned long long)vdesc->vd_vblocknr);
+                brelse(bh);
+                return -EEXIST;
+        }
         list_add_tail(&bh->b_assoc_buffers, buffers);
         return 0;
 }
@@ -335,24 +350,10 @@ static int nilfs_ioctl_move_blocks(struct the_nilfs *nilfs,
         list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) {
                 ret = nilfs_gccache_wait_and_mark_dirty(bh);
                 if (unlikely(ret < 0)) {
-                        if (ret == -EEXIST) {
-                                vdesc = bh->b_private;
-                                printk(KERN_CRIT
-                                       "%s: conflicting %s buffer: "
-                                       "ino=%llu, cno=%llu, offset=%llu, "
-                                       "blocknr=%llu, vblocknr=%llu\n",
-                                       __func__,
-                                       vdesc->vd_flags ? "node" : "data",
-                                       (unsigned long long)vdesc->vd_ino,
-                                       (unsigned long long)vdesc->vd_cno,
-                                       (unsigned long long)vdesc->vd_offset,
-                                       (unsigned long long)vdesc->vd_blocknr,
-                                       (unsigned long long)vdesc->vd_vblocknr);
-                        }
+                        WARN_ON(ret == -EEXIST);
                         goto failed;
                 }
                 list_del_init(&bh->b_assoc_buffers);
-                bh->b_private = NULL;
                 brelse(bh);
         }
         return nmembs;
@@ -360,7 +361,6 @@ static int nilfs_ioctl_move_blocks(struct the_nilfs *nilfs,
  failed:
         list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) {
                 list_del_init(&bh->b_assoc_buffers);
-                bh->b_private = NULL;
                 brelse(bh);
         }
         return ret;
@@ -471,7 +471,6 @@ int nilfs_ioctl_prepare_clean_segments(struct the_nilfs *nilfs,
         return 0;
 
  failed:
-        nilfs_remove_all_gcinode(nilfs);
         printk(KERN_ERR "NILFS: GC failed during preparation: %s: err=%d\n",
                msg, ret);
         return ret;
@@ -560,6 +559,8 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
         else
                 ret = nilfs_clean_segments(inode->i_sb, argv, kbufs);
 
+        if (ret < 0)
+                nilfs_remove_all_gcinode(nilfs);
         clear_nilfs_gc_running(nilfs);
 
  out_free:
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 683df89dbae5..6eff66a070d5 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2468,17 +2468,22 @@ static void nilfs_segctor_notify(struct nilfs_sc_info *sci,
         /* Clear requests (even when the construction failed) */
         spin_lock(&sci->sc_state_lock);
 
-        sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
-
         if (req->mode == SC_LSEG_SR) {
+                sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
                 sci->sc_seq_done = req->seq_accepted;
                 nilfs_segctor_wakeup(sci, req->sc_err ? : req->sb_err);
                 sci->sc_flush_request = 0;
-        } else if (req->mode == SC_FLUSH_FILE)
-                sci->sc_flush_request &= ~FLUSH_FILE_BIT;
-        else if (req->mode == SC_FLUSH_DAT)
-                sci->sc_flush_request &= ~FLUSH_DAT_BIT;
+        } else {
+                if (req->mode == SC_FLUSH_FILE)
+                        sci->sc_flush_request &= ~FLUSH_FILE_BIT;
+                else if (req->mode == SC_FLUSH_DAT)
+                        sci->sc_flush_request &= ~FLUSH_DAT_BIT;
 
+                /* re-enable timer if checkpoint creation was not done */
+                if (sci->sc_timer && (sci->sc_state & NILFS_SEGCTOR_COMMIT) &&
+                    time_before(jiffies, sci->sc_timer->expires))
+                        add_timer(sci->sc_timer);
+        }
         spin_unlock(&sci->sc_state_lock);
 }
 
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 89fc8ee1f5a5..de059f490586 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1712,7 +1712,8 @@ int ocfs2_check_range_for_refcount(struct inode *inode, loff_t pos,
         struct super_block *sb = inode->i_sb;
 
         if (!ocfs2_refcount_tree(OCFS2_SB(inode->i_sb)) ||
-            !(OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_REFCOUNT_FL))
+            !(OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_REFCOUNT_FL) ||
+            OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL)
                 return 0;
 
         cpos = pos >> OCFS2_SB(sb)->s_clustersize_bits;
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index eae404602424..d963d8638709 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -35,12 +35,7 @@
 #include <linux/kref.h>
 #include <linux/mutex.h>
 #include <linux/lockdep.h>
-#ifndef CONFIG_OCFS2_COMPAT_JBD
-# include <linux/jbd2.h>
-#else
-# include <linux/jbd.h>
-# include "ocfs2_jbd_compat.h"
-#endif
+#include <linux/jbd2.h>
 
 /* For union ocfs2_dlm_lksb */
 #include "stackglue.h"
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 60287fc56bcb..3a0df7a1b810 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -3743,6 +3743,9 @@ static int ocfs2_attach_refcount_tree(struct inode *inode,
                 goto out;
         }
 
+        if (oi->ip_dyn_features & OCFS2_INLINE_DATA_FL)
+                goto attach_xattr;
+
         ocfs2_init_dinode_extent_tree(&di_et, INODE_CACHE(inode), di_bh);
 
         size = i_size_read(inode);
@@ -3769,6 +3772,7 @@ static int ocfs2_attach_refcount_tree(struct inode *inode,
                 cpos += num_clusters;
         }
 
+attach_xattr:
         if (oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) {
                 ret = ocfs2_xattr_attach_refcount_tree(inode, di_bh,
                                                        &ref_tree->rf_ci,
@@ -3858,6 +3862,49 @@ out:
         return ret;
 }
 
+static int ocfs2_duplicate_inline_data(struct inode *s_inode,
+                                       struct buffer_head *s_bh,
+                                       struct inode *t_inode,
+                                       struct buffer_head *t_bh)
+{
+        int ret;
+        handle_t *handle;
+        struct ocfs2_super *osb = OCFS2_SB(s_inode->i_sb);
+        struct ocfs2_dinode *s_di = (struct ocfs2_dinode *)s_bh->b_data;
+        struct ocfs2_dinode *t_di = (struct ocfs2_dinode *)t_bh->b_data;
+
+        BUG_ON(!(OCFS2_I(s_inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL));
+
+        handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                mlog_errno(ret);
+                goto out;
+        }
+
+        ret = ocfs2_journal_access_di(handle, INODE_CACHE(t_inode), t_bh,
+                                      OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out_commit;
+        }
+
+        t_di->id2.i_data.id_count = s_di->id2.i_data.id_count;
+        memcpy(t_di->id2.i_data.id_data, s_di->id2.i_data.id_data,
+               le16_to_cpu(s_di->id2.i_data.id_count));
+        spin_lock(&OCFS2_I(t_inode)->ip_lock);
+        OCFS2_I(t_inode)->ip_dyn_features |= OCFS2_INLINE_DATA_FL;
+        t_di->i_dyn_features = cpu_to_le16(OCFS2_I(t_inode)->ip_dyn_features);
+        spin_unlock(&OCFS2_I(t_inode)->ip_lock);
+
+        ocfs2_journal_dirty(handle, t_bh);
+
+out_commit:
+        ocfs2_commit_trans(osb, handle);
+out:
+        return ret;
+}
+
 static int ocfs2_duplicate_extent_list(struct inode *s_inode,
                                 struct inode *t_inode,
                                 struct buffer_head *t_bh,
@@ -3997,6 +4044,14 @@ static int ocfs2_create_reflink_node(struct inode *s_inode,
                 goto out;
         }
 
+        if (OCFS2_I(s_inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+                ret = ocfs2_duplicate_inline_data(s_inode, s_bh,
+                                                  t_inode, t_bh);
+                if (ret)
+                        mlog_errno(ret);
+                goto out;
+        }
+
         ret = ocfs2_lock_refcount_tree(osb, le64_to_cpu(di->i_refcount_loc),
                                        1, &ref_tree, &ref_root_bh);
         if (ret) {
@@ -4013,10 +4068,6 @@ static int ocfs2_create_reflink_node(struct inode *s_inode,
                 goto out_unlock_refcount;
         }
 
-        ret = ocfs2_complete_reflink(s_inode, s_bh, t_inode, t_bh, preserve);
-        if (ret)
-                mlog_errno(ret);
-
 out_unlock_refcount:
         ocfs2_unlock_refcount_tree(osb, ref_tree, 1);
         brelse(ref_root_bh);
@@ -4068,9 +4119,17 @@ static int __ocfs2_reflink(struct dentry *old_dentry,
                 ret = ocfs2_reflink_xattrs(inode, old_bh,
                                            new_inode, new_bh,
                                            preserve);
-                if (ret)
+                if (ret) {
                         mlog_errno(ret);
+                        goto inode_unlock;
+                }
         }
+
+        ret = ocfs2_complete_reflink(inode, old_bh,
+                                     new_inode, new_bh, preserve);
+        if (ret)
+                mlog_errno(ret);
+
 inode_unlock:
         ocfs2_inode_unlock(new_inode, 1);
         brelse(new_bh);
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index c0e48aeebb1c..14f47d2bfe02 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -773,18 +773,20 @@ static int ocfs2_sb_probe(struct super_block *sb,
                 if (tmpstat < 0) {
                         status = tmpstat;
                         mlog_errno(status);
-                        goto bail;
+                        break;
                 }
                 di = (struct ocfs2_dinode *) (*bh)->b_data;
                 memset(stats, 0, sizeof(struct ocfs2_blockcheck_stats));
                 spin_lock_init(&stats->b_lock);
-                status = ocfs2_verify_volume(di, *bh, blksize, stats);
-                if (status >= 0)
-                        goto bail;
-                brelse(*bh);
-                *bh = NULL;
-                if (status != -EAGAIN)
+                tmpstat = ocfs2_verify_volume(di, *bh, blksize, stats);
+                if (tmpstat < 0) {
+                        brelse(*bh);
+                        *bh = NULL;
+                }
+                if (tmpstat != -EAGAIN) {
+                        status = tmpstat;
                         break;
+                }
         }
 
 bail:
@@ -1645,6 +1647,10 @@ static int ocfs2_statfs(struct dentry *dentry, struct kstatfs *buf)
         buf->f_bavail = buf->f_bfree;
         buf->f_files = numbits;
         buf->f_ffree = freebits;
+        buf->f_fsid.val[0] = crc32_le(0, osb->uuid_str, OCFS2_VOL_UUID_LEN)
+                                & 0xFFFFFFFFUL;
+        buf->f_fsid.val[1] = crc32_le(0, osb->uuid_str + OCFS2_VOL_UUID_LEN,
+                                OCFS2_VOL_UUID_LEN) & 0xFFFFFFFFUL;
 
         brelse(bh);
 
diff --git a/fs/ocfs2/uptodate.c b/fs/ocfs2/uptodate.c
index b6284f235d2f..c61369342a27 100644
--- a/fs/ocfs2/uptodate.c
+++ b/fs/ocfs2/uptodate.c
@@ -53,11 +53,6 @@
 #include <linux/highmem.h>
 #include <linux/buffer_head.h>
 #include <linux/rbtree.h>
-#ifndef CONFIG_OCFS2_COMPAT_JBD
-# include <linux/jbd2.h>
-#else
-# include <linux/jbd.h>
-#endif
 
 #define MLOG_MASK_PREFIX ML_UPTODATE
 
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 07f77a7945c3..822c2d506518 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -571,7 +571,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                 rsslim,
                 mm ? mm->start_code : 0,
                 mm ? mm->end_code : 0,
-                (permitted) ? task->stack_start : 0,
+                (permitted && mm) ? task->stack_start : 0,
                 esp,
                 eip,
                 /* The signal information here is obsolete.
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 837469a96598..af643b5aefe8 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2597,8 +2597,7 @@ static void proc_flush_task_mnt(struct vfsmount *mnt, pid_t pid, pid_t tgid)
         name.len = snprintf(buf, sizeof(buf), "%d", pid);
         dentry = d_hash_and_lookup(mnt->mnt_root, &name);
         if (dentry) {
-                if (!(current->flags & PF_EXITING))
-                        shrink_dcache_parent(dentry);
+                shrink_dcache_parent(dentry);
                 d_drop(dentry);
                 dput(dentry);
         }
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 5fad489ce5bc..e0201837d244 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -21,6 +21,7 @@
 #include <linux/completion.h>
 #include <linux/mutex.h>
 #include <linux/slab.h>
+#include <linux/security.h>
 #include "sysfs.h"
 
 DEFINE_MUTEX(sysfs_mutex);
@@ -285,6 +286,9 @@ void release_sysfs_dirent(struct sysfs_dirent * sd)
                 sysfs_put(sd->s_symlink.target_sd);
         if (sysfs_type(sd) & SYSFS_COPY_NAME)
                 kfree(sd->s_name);
+        if (sd->s_iattr && sd->s_iattr->ia_secdata)
+                security_release_secctx(sd->s_iattr->ia_secdata,
+                                        sd->s_iattr->ia_secdata_len);
         kfree(sd->s_iattr);
         sysfs_free_ino(sd->s_ino);
         kmem_cache_free(sysfs_dir_cachep, sd);
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 1099395d7d6c..fb17f8226b09 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1980,7 +1980,7 @@ xlog_recover_do_reg_buffer(
                                         "XFS: NULL dquot in %s.", __func__);
                                 goto next;
                         }
-                        if (item->ri_buf[i].i_len < sizeof(xfs_dqblk_t)) {
+                        if (item->ri_buf[i].i_len < sizeof(xfs_disk_dquot_t)) {
                                 cmn_err(CE_ALERT,
                                         "XFS: dquot too small (%d) in %s.",
                                         item->ri_buf[i].i_len, __func__);
@@ -2635,7 +2635,7 @@ xlog_recover_do_dquot_trans(
                         "XFS: NULL dquot in %s.", __func__);
                 return XFS_ERROR(EIO);
         }
-        if (item->ri_buf[1].i_len < sizeof(xfs_dqblk_t)) {
+        if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) {
                 cmn_err(CE_ALERT,
                         "XFS: dquot too small (%d) in %s.",
                         item->ri_buf[1].i_len, __func__);
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index f31271c30de9..2ffc570679be 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -467,6 +467,7 @@ xfs_trans_ail_update(
 {
         xfs_log_item_t          *dlip = NULL;
         xfs_log_item_t          *mlip;  /* ptr to minimum lip */
+        xfs_lsn_t               tail_lsn;
 
         mlip = xfs_ail_min(ailp);
 
@@ -483,8 +484,16 @@ xfs_trans_ail_update(
 
         if (mlip == dlip) {
                 mlip = xfs_ail_min(ailp);
+                /*
+                 * It is not safe to access mlip after the AIL lock is
+                 * dropped, so we must get a copy of li_lsn before we do
+                 * so.  This is especially important on 32-bit platforms
+                 * where accessing and updating 64-bit values like li_lsn
+                 * is not atomic.
+                 */
+                tail_lsn = mlip->li_lsn;
                 spin_unlock(&ailp->xa_lock);
-                xfs_log_move_tail(ailp->xa_mount, mlip->li_lsn);
+                xfs_log_move_tail(ailp->xa_mount, tail_lsn);
         } else {
                 spin_unlock(&ailp->xa_lock);
         }
@@ -514,6 +523,7 @@ xfs_trans_ail_delete(
 {
         xfs_log_item_t          *dlip;
         xfs_log_item_t          *mlip;
+        xfs_lsn_t               tail_lsn;
 
         if (lip->li_flags & XFS_LI_IN_AIL) {
                 mlip = xfs_ail_min(ailp);
@@ -527,9 +537,16 @@ xfs_trans_ail_delete(
 
                 if (mlip == dlip) {
                         mlip = xfs_ail_min(ailp);
+                        /*
+                         * It is not safe to access mlip after the AIL lock
+                         * is dropped, so we must get a copy of li_lsn
+                         * before we do so.  This is especially important
+                         * on 32-bit platforms where accessing and updating
+                         * 64-bit values like li_lsn is not atomic.
+                         */
+                        tail_lsn = mlip ? mlip->li_lsn : 0;
                         spin_unlock(&ailp->xa_lock);
-                        xfs_log_move_tail(ailp->xa_mount,
-                                                (mlip ? mlip->li_lsn : 0));
+                        xfs_log_move_tail(ailp->xa_mount, tail_lsn);
                 } else {
                         spin_unlock(&ailp->xa_lock);
                 }