Merge branch 'upstream-fixes'

8 files changed, 40 insertions, 26 deletions

diff --git a/fs/buffer.c b/fs/buffer.c
index 62cfd17dc5fe..a9b399402007 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -3060,6 +3060,7 @@ int buffer_migrate_page(struct page *newpage, struct page *page)
 {
         struct address_space *mapping = page->mapping;
         struct buffer_head *bh, *head;
+        int rc;
 
         if (!mapping)
                 return -EAGAIN;
@@ -3069,8 +3070,9 @@ int buffer_migrate_page(struct page *newpage, struct page *page)
 
         head = page_buffers(page);
 
-        if (migrate_page_remove_references(newpage, page, 3))
-                return -EAGAIN;
+        rc = migrate_page_remove_references(newpage, page, 3);
+        if (rc)
+                return rc;
 
         bh = head;
         do {
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 848044af7e16..27f3e787faca 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -1155,15 +1155,16 @@ direct_io_worker(int rw, struct kiocb *iocb, struct inode *inode,
  * For writes, i_mutex is not held on entry; it is never taken.
  *
  * DIO_LOCKING (simple locking for regular files)
- * For writes we are called under i_mutex and return with i_mutex held, even though
- * it is internally dropped.
+ * For writes we are called under i_mutex and return with i_mutex held, even
+ * though it is internally dropped.
  * For reads, i_mutex is not held on entry, but it is taken and dropped before
  * returning.
  *
  * DIO_OWN_LOCKING (filesystem provides synchronisation and handling of
  *      uninitialised data, allowing parallel direct readers and writers)
  * For writes we are called without i_mutex, return without it, never touch it.
- * For reads, i_mutex is held on entry and will be released before returning.
+ * For reads we are called under i_mutex and return with i_mutex held, even
+ * though it may be internally dropped.
  *
  * Additional i_alloc_sem locking requirements described inline below.
  */
@@ -1182,7 +1183,8 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
         ssize_t retval = -EINVAL;
         loff_t end = offset;
         struct dio *dio;
-        int reader_with_isem = (rw == READ && dio_lock_type == DIO_OWN_LOCKING);
+        int release_i_mutex = 0;
+        int acquire_i_mutex = 0;
 
         if (rw & WRITE)
                 current->flags |= PF_SYNCWRITE;
@@ -1225,7 +1227,6 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
          *      writers need to grab i_alloc_sem only (i_mutex is already held)
          * For regular files using DIO_OWN_LOCKING,
          *      neither readers nor writers take any locks here
-         *      (i_mutex is already held and release for writers here)
          */
         dio->lock_type = dio_lock_type;
         if (dio_lock_type != DIO_NO_LOCKING) {
@@ -1236,7 +1237,7 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
                         mapping = iocb->ki_filp->f_mapping;
                         if (dio_lock_type != DIO_OWN_LOCKING) {
                                 mutex_lock(&inode->i_mutex);
-                                reader_with_isem = 1;
+                                release_i_mutex = 1;
                         }
 
                         retval = filemap_write_and_wait_range(mapping, offset,
@@ -1248,7 +1249,7 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
 
                         if (dio_lock_type == DIO_OWN_LOCKING) {
                                 mutex_unlock(&inode->i_mutex);
-                                reader_with_isem = 0;
+                                acquire_i_mutex = 1;
                         }
                 }
 
@@ -1269,11 +1270,13 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
                                 nr_segs, blkbits, get_blocks, end_io, dio);
 
         if (rw == READ && dio_lock_type == DIO_LOCKING)
-                reader_with_isem = 0;
+                release_i_mutex = 0;
 
 out:
-        if (reader_with_isem)
+        if (release_i_mutex)
                 mutex_unlock(&inode->i_mutex);
+        else if (acquire_i_mutex)
+                mutex_lock(&inode->i_mutex);
         if (rw & WRITE)
                 current->flags &= ~PF_SYNCWRITE;
         return retval;
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 2967b7393415..79b5404db100 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -532,10 +532,10 @@ dbUpdatePMap(struct inode *ipbmap,
 
                 lastlblkno = lblkno;
 
+                LOGSYNC_LOCK(log, flags);
                 if (mp->lsn != 0) {
                         /* inherit older/smaller lsn */
                         logdiff(diffp, mp->lsn, log);
-                        LOGSYNC_LOCK(log, flags);
                         if (difft < diffp) {
                                 mp->lsn = lsn;
 
@@ -548,20 +548,17 @@ dbUpdatePMap(struct inode *ipbmap,
                         logdiff(diffp, mp->clsn, log);
                         if (difft > diffp)
                                 mp->clsn = tblk->clsn;
-                        LOGSYNC_UNLOCK(log, flags);
                 } else {
                         mp->log = log;
                         mp->lsn = lsn;
 
                         /* insert bp after tblock in logsync list */
-                        LOGSYNC_LOCK(log, flags);
-
                         log->count++;
                         list_add(&mp->synclist, &tblk->synclist);
 
                         mp->clsn = tblk->clsn;
-                        LOGSYNC_UNLOCK(log, flags);
                 }
+                LOGSYNC_UNLOCK(log, flags);
         }
 
         /* write the last buffer. */
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 31b4aa13dd4b..4efa0d0eec39 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -2844,11 +2844,11 @@ diUpdatePMap(struct inode *ipimap,
          */
         lsn = tblk->lsn;
         log = JFS_SBI(tblk->sb)->log;
+        LOGSYNC_LOCK(log, flags);
         if (mp->lsn != 0) {
                 /* inherit older/smaller lsn */
                 logdiff(difft, lsn, log);
                 logdiff(diffp, mp->lsn, log);
-                LOGSYNC_LOCK(log, flags);
                 if (difft < diffp) {
                         mp->lsn = lsn;
                         /* move mp after tblock in logsync list */
@@ -2860,17 +2860,15 @@ diUpdatePMap(struct inode *ipimap,
                 logdiff(diffp, mp->clsn, log);
                 if (difft > diffp)
                         mp->clsn = tblk->clsn;
-                LOGSYNC_UNLOCK(log, flags);
         } else {
                 mp->log = log;
                 mp->lsn = lsn;
                 /* insert mp after tblock in logsync list */
-                LOGSYNC_LOCK(log, flags);
                 log->count++;
                 list_add(&mp->synclist, &tblk->synclist);
                 mp->clsn = tblk->clsn;
-                LOGSYNC_UNLOCK(log, flags);
         }
+        LOGSYNC_UNLOCK(log, flags);
         write_metapage(mp);
         return (0);
 }
diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
index 220058d8616d..970b6a6aa337 100644
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -662,12 +662,18 @@ nlmclnt_unlock(struct nlm_rqst *req, struct file_lock *fl)
          * reclaimed while we're stuck in the unlock call. */
         fl->fl_u.nfs_fl.flags &= ~NFS_LCK_GRANTED;
 
+        /*
+         * Note: the server is supposed to either grant us the unlock
+         * request, or to deny it with NLM_LCK_DENIED_GRACE_PERIOD. In either
+         * case, we want to unlock.
+         */
+        do_vfs_lock(fl);
+
         if (req->a_flags & RPC_TASK_ASYNC) {
                 status = nlmclnt_async_call(req, NLMPROC_UNLOCK,
                                         &nlmclnt_unlock_ops);
                 /* Hrmf... Do the unlock early since locks_remove_posix()
                  * really expects us to free the lock synchronously */
-                do_vfs_lock(fl);
                 if (status < 0) {
                         nlmclnt_release_lockargs(req);
                         kfree(req);
@@ -680,7 +686,6 @@ nlmclnt_unlock(struct nlm_rqst *req, struct file_lock *fl)
         if (status < 0)
                 return status;
 
-        do_vfs_lock(fl);
         if (resp->status == NLM_LCK_GRANTED)
                 return 0;
 
diff --git a/fs/namespace.c b/fs/namespace.c
index 058a44865beb..39c81a8d6316 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1338,7 +1338,7 @@ struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
 
         new_ns = kmalloc(sizeof(struct namespace), GFP_KERNEL);
         if (!new_ns)
-                goto out;
+                return NULL;
 
         atomic_set(&new_ns->count, 1);
         INIT_LIST_HEAD(&new_ns->list);
@@ -1352,7 +1352,7 @@ struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
         if (!new_ns->root) {
                 up_write(&namespace_sem);
                 kfree(new_ns);
-                goto out;
+                return NULL;
         }
         spin_lock(&vfsmount_lock);
         list_add_tail(&new_ns->list, &new_ns->root->mnt_list);
@@ -1393,7 +1393,6 @@ struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
         if (altrootmnt)
                 mntput(altrootmnt);
 
-out:
         return new_ns;
 }
 
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 04ab2fc360e7..4e9b3a1b36c5 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -57,6 +57,7 @@
 #define NFSDBG_FACILITY         NFSDBG_VFS
 #define MAX_DIRECTIO_SIZE       (4096UL << PAGE_SHIFT)
 
+static void nfs_free_user_pages(struct page **pages, int npages, int do_dirty);
 static kmem_cache_t *nfs_direct_cachep;
 
 /*
@@ -107,6 +108,15 @@ nfs_get_user_pages(int rw, unsigned long user_addr, size_t size,
                                         page_count, (rw == READ), 0,
                                         *pages, NULL);
                 up_read(&current->mm->mmap_sem);
+                /*
+                 * If we got fewer pages than expected from get_user_pages(),
+                 * the user buffer runs off the end of a mapping; return EFAULT.
+                 */
+                if (result >= 0 && result < page_count) {
+                        nfs_free_user_pages(*pages, result, 0);
+                        *pages = NULL;
+                        result = -EFAULT;
+                }
         }
         return result;
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 984ca3454d04..f8c0066e02e1 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1430,7 +1430,7 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
         if (status == 0)
                 status = nfs4_do_fsinfo(server, fhandle, info);
 out:
-        return status;
+        return nfs4_map_errors(status);
 }
 
 static int _nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)