Merge branch 'hotfixes' into devel

19 files changed, 332 insertions, 118 deletions

diff --git a/fs/bio.c b/fs/bio.c
index 3312fcc3c098..553b5b7960ad 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -1194,6 +1194,8 @@ EXPORT_SYMBOL(bio_hw_segments);
 EXPORT_SYMBOL(bio_add_page);
 EXPORT_SYMBOL(bio_add_pc_page);
 EXPORT_SYMBOL(bio_get_nr_vecs);
+EXPORT_SYMBOL(bio_map_user);
+EXPORT_SYMBOL(bio_unmap_user);
 EXPORT_SYMBOL(bio_map_kern);
 EXPORT_SYMBOL(bio_pair_release);
 EXPORT_SYMBOL(bio_split);
diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
index 878bf25dbc6a..92fb358ce824 100644
--- a/fs/hfs/brec.c
+++ b/fs/hfs/brec.c
@@ -229,7 +229,7 @@ skip:
 static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
 {
         struct hfs_btree *tree;
-        struct hfs_bnode *node, *new_node;
+        struct hfs_bnode *node, *new_node, *next_node;
         struct hfs_bnode_desc node_desc;
         int num_recs, new_rec_off, new_off, old_rec_off;
         int data_start, data_end, size;
@@ -248,6 +248,17 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
         new_node->type = node->type;
         new_node->height = node->height;
 
+        if (node->next)
+                next_node = hfs_bnode_find(tree, node->next);
+        else
+                next_node = NULL;
+
+        if (IS_ERR(next_node)) {
+                hfs_bnode_put(node);
+                hfs_bnode_put(new_node);
+                return next_node;
+        }
+
         size = tree->node_size / 2 - node->num_recs * 2 - 14;
         old_rec_off = tree->node_size - 4;
         num_recs = 1;
@@ -261,6 +272,8 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
                 /* panic? */
                 hfs_bnode_put(node);
                 hfs_bnode_put(new_node);
+                if (next_node)
+                        hfs_bnode_put(next_node);
                 return ERR_PTR(-ENOSPC);
         }
 
@@ -315,8 +328,7 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
         hfs_bnode_write(node, &node_desc, 0, sizeof(node_desc));
 
         /* update next bnode header */
-        if (new_node->next) {
-                struct hfs_bnode *next_node = hfs_bnode_find(tree, new_node->next);
+        if (next_node) {
                 next_node->prev = new_node->this;
                 hfs_bnode_read(next_node, &node_desc, 0, sizeof(node_desc));
                 node_desc.prev = cpu_to_be32(next_node->prev);
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index be9e8270f4d7..ab2f7d233e01 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -531,7 +531,10 @@ readpage_async_filler(void *data, struct page *page)
 
         if (len < PAGE_CACHE_SIZE)
                 zero_user_segment(page, len, PAGE_CACHE_SIZE);
-        nfs_pageio_add_request(desc->pgio, new);
+        if (!nfs_pageio_add_request(desc->pgio, new)) {
+                error = desc->pgio->pg_error;
+                goto out_unlock;
+        }
         return 0;
 out_error:
         error = PTR_ERR(new);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 1667e3984418..4cb88df12f83 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -39,6 +39,7 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context*,
                                             unsigned int, unsigned int);
 static void nfs_pageio_init_write(struct nfs_pageio_descriptor *desc,
                                   struct inode *inode, int ioflags);
+static void nfs_redirty_request(struct nfs_page *req);
 static const struct rpc_call_ops nfs_write_partial_ops;
 static const struct rpc_call_ops nfs_write_full_ops;
 static const struct rpc_call_ops nfs_commit_ops;
@@ -279,7 +280,12 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                 BUG();
         }
         spin_unlock(&inode->i_lock);
-        nfs_pageio_add_request(pgio, req);
+        if (!nfs_pageio_add_request(pgio, req)) {
+                nfs_redirty_request(req);
+                nfs_end_page_writeback(page);
+                nfs_clear_page_tag_locked(req);
+                return pgio->pg_error;
+        }
         return 0;
 }
 
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index 1eb771d79cca..3e6b3f41ee1f 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -232,6 +232,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                 fhp->fh_dentry = dentry;
                 fhp->fh_export = exp;
                 nfsd_nr_verified++;
+                cache_get(&exp->h);
         } else {
                 /*
                  * just rechecking permissions
@@ -241,6 +242,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                 dprintk("nfsd: fh_verify - just checking\n");
                 dentry = fhp->fh_dentry;
                 exp = fhp->fh_export;
+                cache_get(&exp->h);
                 /*
                  * Set user creds for this exportpoint; necessary even
                  * in the "just checking" case because this may be a
@@ -252,8 +254,6 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                 if (error)
                         goto out;
         }
-        cache_get(&exp->h);
-
 
         error = nfsd_mode_check(rqstp, dentry->d_inode->i_mode, type);
         if (error)
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index ee50c9610e7f..b8057c51b205 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -451,9 +451,9 @@ static void o2net_set_nn_state(struct o2net_node *nn,
                 /* delay if we're withing a RECONNECT_DELAY of the
                  * last attempt */
                 delay = (nn->nn_last_connect_attempt +
-                         msecs_to_jiffies(o2net_reconnect_delay(sc->sc_node)))
+                         msecs_to_jiffies(o2net_reconnect_delay(NULL)))
                         - jiffies;
-                if (delay > msecs_to_jiffies(o2net_reconnect_delay(sc->sc_node)))
+                if (delay > msecs_to_jiffies(o2net_reconnect_delay(NULL)))
                         delay = 0;
                 mlog(ML_CONN, "queueing conn attempt in %lu jiffies\n", delay);
                 queue_delayed_work(o2net_wq, &nn->nn_connect_work, delay);
@@ -1552,12 +1552,11 @@ static void o2net_connect_expired(struct work_struct *work)
 
         spin_lock(&nn->nn_lock);
         if (!nn->nn_sc_valid) {
-                struct o2nm_node *node = nn->nn_sc->sc_node;
                 mlog(ML_ERROR, "no connection established with node %u after "
                      "%u.%u seconds, giving up and returning errors.\n",
                      o2net_num_from_nn(nn),
-                     o2net_idle_timeout(node) / 1000,
-                     o2net_idle_timeout(node) % 1000);
+                     o2net_idle_timeout(NULL) / 1000,
+                     o2net_idle_timeout(NULL) % 1000);
 
                 o2net_set_nn_state(nn, NULL, 0, -ENOTCONN);
         }
diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h
index 9843ee17ea27..dc8ea666efdb 100644
--- a/fs/ocfs2/dlm/dlmcommon.h
+++ b/fs/ocfs2/dlm/dlmcommon.h
@@ -176,6 +176,7 @@ struct dlm_mig_lockres_priv
 {
         struct dlm_lock_resource *lockres;
         u8 real_master;
+        u8 extra_ref;
 };
 
 struct dlm_assert_master_priv
@@ -602,17 +603,19 @@ enum dlm_query_join_response_code {
         JOIN_PROTOCOL_MISMATCH,
 };
 
+struct dlm_query_join_packet {
+        u8 code;        /* Response code.  dlm_minor and fs_minor
+                           are only valid if this is JOIN_OK */
+        u8 dlm_minor;   /* The minor version of the protocol the
+                           dlm is speaking. */
+        u8 fs_minor;    /* The minor version of the protocol the
+                           filesystem is speaking. */
+        u8 reserved;
+};
+
 union dlm_query_join_response {
         u32 intval;
-        struct {
-                u8 code;        /* Response code.  dlm_minor and fs_minor
-                                   are only valid if this is JOIN_OK */
-                u8 dlm_minor;   /* The minor version of the protocol the
-                                   dlm is speaking. */
-                u8 fs_minor;    /* The minor version of the protocol the
-                                   filesystem is speaking. */
-                u8 reserved;
-        } packet;
+        struct dlm_query_join_packet packet;
 };
 
 struct dlm_lock_request
diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
index ecb4d997221e..75997b4deaf3 100644
--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -487,7 +487,7 @@ int dlm_convert_lock_handler(struct o2net_msg *msg, u32 len, void *data,
                                "cookie=%u:%llu\n",
                      dlm_get_lock_cookie_node(be64_to_cpu(cnv->cookie)),
                      dlm_get_lock_cookie_seq(be64_to_cpu(cnv->cookie)));
-                __dlm_print_one_lock_resource(res);
+                dlm_print_one_lock_resource(res);
                 goto leave;
         }
 
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 638d2ebb892b..0879d86113e3 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -713,14 +713,46 @@ static int dlm_query_join_proto_check(char *proto_type, int node,
         return rc;
 }
 
+/*
+ * struct dlm_query_join_packet is made up of four one-byte fields.  They
+ * are effectively in big-endian order already.  However, little-endian
+ * machines swap them before putting the packet on the wire (because
+ * query_join's response is a status, and that status is treated as a u32
+ * on the wire).  Thus, a big-endian and little-endian machines will treat
+ * this structure differently.
+ *
+ * The solution is to have little-endian machines swap the structure when
+ * converting from the structure to the u32 representation.  This will
+ * result in the structure having the correct format on the wire no matter
+ * the host endian format.
+ */
+static void dlm_query_join_packet_to_wire(struct dlm_query_join_packet *packet,
+                                          u32 *wire)
+{
+        union dlm_query_join_response response;
+
+        response.packet = *packet;
+        *wire = cpu_to_be32(response.intval);
+}
+
+static void dlm_query_join_wire_to_packet(u32 wire,
+                                          struct dlm_query_join_packet *packet)
+{
+        union dlm_query_join_response response;
+
+        response.intval = cpu_to_be32(wire);
+        *packet = response.packet;
+}
+
 static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data,
                                   void **ret_data)
 {
         struct dlm_query_join_request *query;
-        union dlm_query_join_response response = {
-                .packet.code = JOIN_DISALLOW,
+        struct dlm_query_join_packet packet = {
+                .code = JOIN_DISALLOW,
         };
         struct dlm_ctxt *dlm = NULL;
+        u32 response;
         u8 nodenum;
 
         query = (struct dlm_query_join_request *) msg->buf;
@@ -737,11 +769,11 @@ static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data,
                 mlog(0, "node %u is not in our live map yet\n",
                      query->node_idx);
 
-                response.packet.code = JOIN_DISALLOW;
+                packet.code = JOIN_DISALLOW;
                 goto respond;
         }
 
-        response.packet.code = JOIN_OK_NO_MAP;
+        packet.code = JOIN_OK_NO_MAP;
 
         spin_lock(&dlm_domain_lock);
         dlm = __dlm_lookup_domain_full(query->domain, query->name_len);
@@ -760,7 +792,7 @@ static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data,
                                 mlog(0, "disallow join as node %u does not "
                                      "have node %u in its nodemap\n",
                                      query->node_idx, nodenum);
-                                response.packet.code = JOIN_DISALLOW;
+                                packet.code = JOIN_DISALLOW;
                                 goto unlock_respond;
                         }
                 }
@@ -780,23 +812,23 @@ static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data,
                         /*If this is a brand new context and we
                          * haven't started our join process yet, then
                          * the other node won the race. */
-                        response.packet.code = JOIN_OK_NO_MAP;
+                        packet.code = JOIN_OK_NO_MAP;
                 } else if (dlm->joining_node != DLM_LOCK_RES_OWNER_UNKNOWN) {
                         /* Disallow parallel joins. */
-                        response.packet.code = JOIN_DISALLOW;
+                        packet.code = JOIN_DISALLOW;
                 } else if (dlm->reco.state & DLM_RECO_STATE_ACTIVE) {
                         mlog(0, "node %u trying to join, but recovery "
                              "is ongoing.\n", bit);
-                        response.packet.code = JOIN_DISALLOW;
+                        packet.code = JOIN_DISALLOW;
                 } else if (test_bit(bit, dlm->recovery_map)) {
                         mlog(0, "node %u trying to join, but it "
                              "still needs recovery.\n", bit);
-                        response.packet.code = JOIN_DISALLOW;
+                        packet.code = JOIN_DISALLOW;
                 } else if (test_bit(bit, dlm->domain_map)) {
                         mlog(0, "node %u trying to join, but it "
                              "is still in the domain! needs recovery?\n",
                              bit);
-                        response.packet.code = JOIN_DISALLOW;
+                        packet.code = JOIN_DISALLOW;
                 } else {
                         /* Alright we're fully a part of this domain
                          * so we keep some state as to who's joining
@@ -807,19 +839,15 @@ static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data,
                         if (dlm_query_join_proto_check("DLM", bit,
                                                        &dlm->dlm_locking_proto,
                                                        &query->dlm_proto)) {
-                                response.packet.code =
-                                        JOIN_PROTOCOL_MISMATCH;
+                                packet.code = JOIN_PROTOCOL_MISMATCH;
                         } else if (dlm_query_join_proto_check("fs", bit,
                                                               &dlm->fs_locking_proto,
                                                               &query->fs_proto)) {
-                                response.packet.code =
-                                        JOIN_PROTOCOL_MISMATCH;
+                                packet.code = JOIN_PROTOCOL_MISMATCH;
                         } else {
-                                response.packet.dlm_minor =
-                                        query->dlm_proto.pv_minor;
-                                response.packet.fs_minor =
-                                        query->fs_proto.pv_minor;
-                                response.packet.code = JOIN_OK;
+                                packet.dlm_minor = query->dlm_proto.pv_minor;
+                                packet.fs_minor = query->fs_proto.pv_minor;
+                                packet.code = JOIN_OK;
                                 __dlm_set_joining_node(dlm, query->node_idx);
                         }
                 }
@@ -830,9 +858,10 @@ unlock_respond:
         spin_unlock(&dlm_domain_lock);
 
 respond:
-        mlog(0, "We respond with %u\n", response.packet.code);
+        mlog(0, "We respond with %u\n", packet.code);
 
-        return response.intval;
+        dlm_query_join_packet_to_wire(&packet, &response);
+        return response;
 }
 
 static int dlm_assert_joined_handler(struct o2net_msg *msg, u32 len, void *data,
@@ -937,7 +966,7 @@ static int dlm_send_join_cancels(struct dlm_ctxt *dlm,
                          sizeof(unsigned long))) {
                 mlog(ML_ERROR,
                      "map_size %u != BITS_TO_LONGS(O2NM_MAX_NODES) %u\n",
-                     map_size, BITS_TO_LONGS(O2NM_MAX_NODES));
+                     map_size, (unsigned)BITS_TO_LONGS(O2NM_MAX_NODES));
                 return -EINVAL;
         }
 
@@ -968,7 +997,8 @@ static int dlm_request_join(struct dlm_ctxt *dlm,
 {
         int status;
         struct dlm_query_join_request join_msg;
-        union dlm_query_join_response join_resp;
+        struct dlm_query_join_packet packet;
+        u32 join_resp;
 
         mlog(0, "querying node %d\n", node);
 
@@ -984,11 +1014,12 @@ static int dlm_request_join(struct dlm_ctxt *dlm,
 
         status = o2net_send_message(DLM_QUERY_JOIN_MSG, DLM_MOD_KEY, &join_msg,
                                     sizeof(join_msg), node,
-                                    &join_resp.intval);
+                                    &join_resp);
         if (status < 0 && status != -ENOPROTOOPT) {
                 mlog_errno(status);
                 goto bail;
         }
+        dlm_query_join_wire_to_packet(join_resp, &packet);
 
         /* -ENOPROTOOPT from the net code means the other side isn't
             listening for our message type -- that's fine, it means
@@ -997,10 +1028,10 @@ static int dlm_request_join(struct dlm_ctxt *dlm,
         if (status == -ENOPROTOOPT) {
                 status = 0;
                 *response = JOIN_OK_NO_MAP;
-        } else if (join_resp.packet.code == JOIN_DISALLOW ||
-                   join_resp.packet.code == JOIN_OK_NO_MAP) {
-                *response = join_resp.packet.code;
-        } else if (join_resp.packet.code == JOIN_PROTOCOL_MISMATCH) {
+        } else if (packet.code == JOIN_DISALLOW ||
+                   packet.code == JOIN_OK_NO_MAP) {
+                *response = packet.code;
+        } else if (packet.code == JOIN_PROTOCOL_MISMATCH) {
                 mlog(ML_NOTICE,
                      "This node requested DLM locking protocol %u.%u and "
                      "filesystem locking protocol %u.%u.  At least one of "
@@ -1012,14 +1043,12 @@ static int dlm_request_join(struct dlm_ctxt *dlm,
                      dlm->fs_locking_proto.pv_minor,
                      node);
                 status = -EPROTO;
-                *response = join_resp.packet.code;
-        } else if (join_resp.packet.code == JOIN_OK) {
-                *response = join_resp.packet.code;
+                *response = packet.code;
+        } else if (packet.code == JOIN_OK) {
+                *response = packet.code;
                 /* Use the same locking protocol as the remote node */
-                dlm->dlm_locking_proto.pv_minor =
-                        join_resp.packet.dlm_minor;
-                dlm->fs_locking_proto.pv_minor =
-                        join_resp.packet.fs_minor;
+                dlm->dlm_locking_proto.pv_minor = packet.dlm_minor;
+                dlm->fs_locking_proto.pv_minor = packet.fs_minor;
                 mlog(0,
                      "Node %d responds JOIN_OK with DLM locking protocol "
                      "%u.%u and fs locking protocol %u.%u\n",
@@ -1031,11 +1060,11 @@ static int dlm_request_join(struct dlm_ctxt *dlm,
         } else {
                 status = -EINVAL;
                 mlog(ML_ERROR, "invalid response %d from node %u\n",
-                     join_resp.packet.code, node);
+                     packet.code, node);
         }
 
         mlog(0, "status %d, node %d response is %d\n", status, node,
-                  *response);
+             *response);
 
 bail:
         return status;
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index c92d1b19fc0b..ea6b89577860 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -1663,7 +1663,12 @@ way_up_top:
                 dlm_put_mle(tmpmle);
         }
 send_response:
-
+        /*
+         * __dlm_lookup_lockres() grabbed a reference to this lockres.
+         * The reference is released by dlm_assert_master_worker() under
+         * the call to dlm_dispatch_assert_master().  If
+         * dlm_assert_master_worker() isn't called, we drop it here.
+         */
         if (dispatch_assert) {
                 if (response != DLM_MASTER_RESP_YES)
                         mlog(ML_ERROR, "invalid response %d\n", response);
@@ -1678,7 +1683,11 @@ send_response:
                 if (ret < 0) {
                         mlog(ML_ERROR, "failed to dispatch assert master work\n");
                         response = DLM_MASTER_RESP_ERROR;
+                        dlm_lockres_put(res);
                 }
+        } else {
+                if (res)
+                        dlm_lockres_put(res);
         }
 
         dlm_put(dlm);
@@ -2348,7 +2357,7 @@ int dlm_deref_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
                         mlog(ML_ERROR, "%s:%.*s: node %u trying to drop ref "
                         "but it is already dropped!\n", dlm->name,
                         res->lockname.len, res->lockname.name, node);
-                        __dlm_print_one_lock_resource(res);
+                        dlm_print_one_lock_resource(res);
                 }
                 ret = 0;
                 goto done;
@@ -2408,7 +2417,7 @@ static void dlm_deref_lockres_worker(struct dlm_work_item *item, void *data)
                 mlog(ML_ERROR, "%s:%.*s: node %u trying to drop ref "
                      "but it is already dropped!\n", dlm->name,
                      res->lockname.len, res->lockname.name, node);
-                __dlm_print_one_lock_resource(res);
+                dlm_print_one_lock_resource(res);
         }
 
         dlm_lockres_put(res);
@@ -2933,6 +2942,9 @@ static void dlm_remove_nonlocal_locks(struct dlm_ctxt *dlm,
                                 dlm_lockres_clear_refmap_bit(lock->ml.node, res);
                                 list_del_init(&lock->list);
                                 dlm_lock_put(lock);
+                                /* In a normal unlock, we would have added a
+                                 * DLM_UNLOCK_FREE_LOCK action. Force it. */
+                                dlm_lock_put(lock);
                         }
                 }
                 queue++;
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 91f747b8a538..bcb9260c3735 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -519,9 +519,9 @@ static int dlm_do_recovery(struct dlm_ctxt *dlm)
         return 0;
 
 master_here:
-        mlog(0, "(%d) mastering recovery of %s:%u here(this=%u)!\n",
-             task_pid_nr(dlm->dlm_reco_thread_task),
-             dlm->name, dlm->reco.dead_node, dlm->node_num);
+        mlog(ML_NOTICE, "(%d) Node %u is the Recovery Master for the Dead Node "
+             "%u for Domain %s\n", task_pid_nr(dlm->dlm_reco_thread_task),
+             dlm->node_num, dlm->reco.dead_node, dlm->name);
 
         status = dlm_remaster_locks(dlm, dlm->reco.dead_node);
         if (status < 0) {
@@ -1191,7 +1191,7 @@ static int dlm_add_lock_to_array(struct dlm_lock *lock,
                             (ml->type == LKM_EXMODE ||
                              memcmp(mres->lvb, lock->lksb->lvb, DLM_LVB_LEN))) {
                                 mlog(ML_ERROR, "mismatched lvbs!\n");
-                                __dlm_print_one_lock_resource(lock->lockres);
+                                dlm_print_one_lock_resource(lock->lockres);
                                 BUG();
                         }
                         memcpy(mres->lvb, lock->lksb->lvb, DLM_LVB_LEN);
@@ -1327,6 +1327,7 @@ int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
                 (struct dlm_migratable_lockres *)msg->buf;
         int ret = 0;
         u8 real_master;
+        u8 extra_refs = 0;
         char *buf = NULL;
         struct dlm_work_item *item = NULL;
         struct dlm_lock_resource *res = NULL;
@@ -1404,16 +1405,28 @@ int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
                 __dlm_insert_lockres(dlm, res);
                 spin_unlock(&dlm->spinlock);
 
+                /* Add an extra ref for this lock-less lockres lest the
+                 * dlm_thread purges it before we get the chance to add
+                 * locks to it */
+                dlm_lockres_get(res);
+
+                /* There are three refs that need to be put.
+                 * 1. Taken above.
+                 * 2. kref_init in dlm_new_lockres()->dlm_init_lockres().
+                 * 3. dlm_lookup_lockres()
+                 * The first one is handled at the end of this function. The
+                 * other two are handled in the worker thread after locks have
+                 * been attached. Yes, we don't wait for purge time to match
+                 * kref_init. The lockres will still have atleast one ref
+                 * added because it is in the hash __dlm_insert_lockres() */
+                extra_refs++;
+
                 /* now that the new lockres is inserted,
                  * make it usable by other processes */
                 spin_lock(&res->spinlock);
                 res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
                 spin_unlock(&res->spinlock);
                 wake_up(&res->wq);
-
-                /* add an extra ref for just-allocated lockres 
-                 * otherwise the lockres will be purged immediately */
-                dlm_lockres_get(res);
         }
 
         /* at this point we have allocated everything we need,
@@ -1443,12 +1456,17 @@ int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
         dlm_init_work_item(dlm, item, dlm_mig_lockres_worker, buf);
         item->u.ml.lockres = res; /* already have a ref */
         item->u.ml.real_master = real_master;
+        item->u.ml.extra_ref = extra_refs;
         spin_lock(&dlm->work_lock);
         list_add_tail(&item->list, &dlm->work_list);
         spin_unlock(&dlm->work_lock);
         queue_work(dlm->dlm_worker, &dlm->dispatched_work);
 
 leave:
+        /* One extra ref taken needs to be put here */
+        if (extra_refs)
+                dlm_lockres_put(res);
+
         dlm_put(dlm);
         if (ret < 0) {
                 if (buf)
@@ -1464,17 +1482,19 @@ leave:
 
 static void dlm_mig_lockres_worker(struct dlm_work_item *item, void *data)
 {
-        struct dlm_ctxt *dlm = data;
+        struct dlm_ctxt *dlm;
         struct dlm_migratable_lockres *mres;
         int ret = 0;
         struct dlm_lock_resource *res;
         u8 real_master;
+        u8 extra_ref;
 
         dlm = item->dlm;
         mres = (struct dlm_migratable_lockres *)data;
 
         res = item->u.ml.lockres;
         real_master = item->u.ml.real_master;
+        extra_ref = item->u.ml.extra_ref;
 
         if (real_master == DLM_LOCK_RES_OWNER_UNKNOWN) {
                 /* this case is super-rare. only occurs if
@@ -1517,6 +1537,12 @@ again:
         }
 
 leave:
+        /* See comment in dlm_mig_lockres_handler() */
+        if (res) {
+                if (extra_ref)
+                        dlm_lockres_put(res);
+                dlm_lockres_put(res);
+        }
         kfree(data);
         mlog_exit(ret);
 }
@@ -1644,7 +1670,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
                                 /* retry!? */
                                 BUG();
                         }
-                }
+                } else /* put.. incase we are not the master */
+                        dlm_lockres_put(res);
                 spin_unlock(&res->spinlock);
         }
         spin_unlock(&dlm->spinlock);
@@ -1921,6 +1948,7 @@ void dlm_move_lockres_to_recovery_list(struct dlm_ctxt *dlm,
                      "Recovering res %s:%.*s, is already on recovery list!\n",
                      dlm->name, res->lockname.len, res->lockname.name);
                 list_del_init(&res->recovering);
+                dlm_lockres_put(res);
         }
         /* We need to hold a reference while on the recovery list */
         dlm_lockres_get(res);
@@ -2130,11 +2158,16 @@ static void dlm_free_dead_locks(struct dlm_ctxt *dlm,
         assert_spin_locked(&dlm->spinlock);
         assert_spin_locked(&res->spinlock);
 
+        /* We do two dlm_lock_put(). One for removing from list and the other is
+         * to force the DLM_UNLOCK_FREE_LOCK action so as to free the locks */
+
         /* TODO: check pending_asts, pending_basts here */
         list_for_each_entry_safe(lock, next, &res->granted, list) {
                 if (lock->ml.node == dead_node) {
                         list_del_init(&lock->list);
                         dlm_lock_put(lock);
+                        /* Can't schedule DLM_UNLOCK_FREE_LOCK - do manually */
+                        dlm_lock_put(lock);
                         freed++;
                 }
         }
@@ -2142,6 +2175,8 @@ static void dlm_free_dead_locks(struct dlm_ctxt *dlm,
                 if (lock->ml.node == dead_node) {
                         list_del_init(&lock->list);
                         dlm_lock_put(lock);
+                        /* Can't schedule DLM_UNLOCK_FREE_LOCK - do manually */
+                        dlm_lock_put(lock);
                         freed++;
                 }
         }
@@ -2149,6 +2184,8 @@ static void dlm_free_dead_locks(struct dlm_ctxt *dlm,
                 if (lock->ml.node == dead_node) {
                         list_del_init(&lock->list);
                         dlm_lock_put(lock);
+                        /* Can't schedule DLM_UNLOCK_FREE_LOCK - do manually */
+                        dlm_lock_put(lock);
                         freed++;
                 }
         }
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index cebd089f8955..4060bb328bc8 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -176,12 +176,14 @@ static int dlm_purge_lockres(struct dlm_ctxt *dlm,
              res->lockname.name, master);
 
         if (!master) {
+                /* drop spinlock...  retake below */
+                spin_unlock(&dlm->spinlock);
+
                 spin_lock(&res->spinlock);
                 /* This ensures that clear refmap is sent after the set */
                 __dlm_wait_on_lockres_flags(res, DLM_LOCK_RES_SETREF_INPROG);
                 spin_unlock(&res->spinlock);
-                /* drop spinlock to do messaging, retake below */
-                spin_unlock(&dlm->spinlock);
+
                 /* clear our bit from the master's refmap, ignore errors */
                 ret = dlm_drop_lockres_ref(dlm, res);
                 if (ret < 0) {
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index f7794306b2bd..1f1873bf41fb 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -2409,7 +2409,7 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
         return 0;
 }
 
-static struct seq_operations ocfs2_dlm_seq_ops = {
+static const struct seq_operations ocfs2_dlm_seq_ops = {
         .start =        ocfs2_dlm_seq_start,
         .stop =         ocfs2_dlm_seq_stop,
         .next =         ocfs2_dlm_seq_next,
diff --git a/fs/ocfs2/resize.c b/fs/ocfs2/resize.c
index 37835ffcb039..8166968e9015 100644
--- a/fs/ocfs2/resize.c
+++ b/fs/ocfs2/resize.c
@@ -597,7 +597,7 @@ int ocfs2_group_add(struct inode *inode, struct ocfs2_new_group_input *input)
                 memset(cr, 0, sizeof(struct ocfs2_chain_rec));
         }
 
-        cr->c_blkno = le64_to_cpu(input->group);
+        cr->c_blkno = cpu_to_le64(input->group);
         le32_add_cpu(&cr->c_total, input->clusters * cl_bpc);
         le32_add_cpu(&cr->c_free, input->frees * cl_bpc);
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 91a1bd67ac1d..8a10f6fe24a1 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1036,6 +1036,26 @@ static const struct file_operations proc_loginuid_operations = {
         .read           = proc_loginuid_read,
         .write          = proc_loginuid_write,
 };
+
+static ssize_t proc_sessionid_read(struct file * file, char __user * buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct inode * inode = file->f_path.dentry->d_inode;
+        struct task_struct *task = get_proc_task(inode);
+        ssize_t length;
+        char tmpbuf[TMPBUFLEN];
+
+        if (!task)
+                return -ESRCH;
+        length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
+                                audit_get_sessionid(task));
+        put_task_struct(task);
+        return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
+}
+
+static const struct file_operations proc_sessionid_operations = {
+        .read           = proc_sessionid_read,
+};
 #endif
 
 #ifdef CONFIG_FAULT_INJECTION
@@ -2269,6 +2289,9 @@ static const struct pid_entry tgid_base_stuff[] = {
         DIR("task",       S_IRUGO|S_IXUGO, task),
         DIR("fd",         S_IRUSR|S_IXUSR, fd),
         DIR("fdinfo",     S_IRUSR|S_IXUSR, fdinfo),
+#ifdef CONFIG_NET
+        DIR("net",        S_IRUGO|S_IXUSR, net),
+#endif
         REG("environ",    S_IRUSR, environ),
         INF("auxv",       S_IRUSR, pid_auxv),
         ONE("status",     S_IRUGO, pid_status),
@@ -2316,6 +2339,7 @@ static const struct pid_entry tgid_base_stuff[] = {
         REG("oom_adj",    S_IRUGO|S_IWUSR, oom_adjust),
 #ifdef CONFIG_AUDITSYSCALL
         REG("loginuid",   S_IWUSR|S_IRUGO, loginuid),
+        REG("sessionid",  S_IRUSR, sessionid),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
         REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
@@ -2646,6 +2670,7 @@ static const struct pid_entry tid_base_stuff[] = {
         REG("oom_adj",   S_IRUGO|S_IWUSR, oom_adjust),
 #ifdef CONFIG_AUDITSYSCALL
         REG("loginuid",  S_IWUSR|S_IRUGO, loginuid),
+        REG("sessionid",  S_IRUSR, sessionid),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
         REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 68971e66cd41..a36ad3c75cf4 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -377,15 +377,14 @@ static struct dentry_operations proc_dentry_operations =
  * Don't create negative dentries here, return -ENOENT by hand
  * instead.
  */
-struct dentry *proc_lookup(struct inode * dir, struct dentry *dentry, struct nameidata *nd)
+struct dentry *proc_lookup_de(struct proc_dir_entry *de, struct inode *dir,
+                struct dentry *dentry)
 {
         struct inode *inode = NULL;
-        struct proc_dir_entry * de;
         int error = -ENOENT;
 
         lock_kernel();
         spin_lock(&proc_subdir_lock);
-        de = PDE(dir);
         if (de) {
                 for (de = de->subdir; de ; de = de->next) {
                         if (de->namelen != dentry->d_name.len)
@@ -393,8 +392,6 @@ struct dentry *proc_lookup(struct inode * dir, struct dentry *dentry, struct nam
                         if (!memcmp(dentry->d_name.name, de->name, de->namelen)) {
                                 unsigned int ino;
 
-                                if (de->shadow_proc)
-                                        de = de->shadow_proc(current, de);
                                 ino = de->low_ino;
                                 de_get(de);
                                 spin_unlock(&proc_subdir_lock);
@@ -417,6 +414,12 @@ out_unlock:
         return ERR_PTR(error);
 }
 
+struct dentry *proc_lookup(struct inode *dir, struct dentry *dentry,
+                struct nameidata *nd)
+{
+        return proc_lookup_de(PDE(dir), dir, dentry);
+}
+
 /*
  * This returns non-zero if at EOF, so that the /proc
  * root directory can use this and check if it should
@@ -426,10 +429,9 @@ out_unlock:
  * value of the readdir() call, as long as it's non-negative
  * for success..
  */
-int proc_readdir(struct file * filp,
-        void * dirent, filldir_t filldir)
+int proc_readdir_de(struct proc_dir_entry *de, struct file *filp, void *dirent,
+                filldir_t filldir)
 {
-        struct proc_dir_entry * de;
         unsigned int ino;
         int i;
         struct inode *inode = filp->f_path.dentry->d_inode;
@@ -438,7 +440,6 @@ int proc_readdir(struct file * filp,
         lock_kernel();
 
         ino = inode->i_ino;
-        de = PDE(inode);
         if (!de) {
                 ret = -EINVAL;
                 goto out;
@@ -499,6 +500,13 @@ out:	unlock_kernel();
         return ret;     
 }
 
+int proc_readdir(struct file *filp, void *dirent, filldir_t filldir)
+{
+        struct inode *inode = filp->f_path.dentry->d_inode;
+
+        return proc_readdir_de(PDE(inode), filp, dirent, filldir);
+}
+
 /*
  * These are the generic /proc directory operations. They
  * use the in-memory "struct proc_dir_entry" tree to parse
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 1c81c8f1aeed..bc72f5c8c47d 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -64,6 +64,8 @@ extern const struct file_operations proc_numa_maps_operations;
 extern const struct file_operations proc_smaps_operations;
 extern const struct file_operations proc_clear_refs_operations;
 extern const struct file_operations proc_pagemap_operations;
+extern const struct file_operations proc_net_operations;
+extern const struct inode_operations proc_net_inode_operations;
 
 void free_proc_entry(struct proc_dir_entry *de);
 
@@ -83,3 +85,8 @@ static inline int proc_fd(struct inode *inode)
 {
         return PROC_I(inode)->fd;
 }
+
+struct dentry *proc_lookup_de(struct proc_dir_entry *de, struct inode *ino,
+                struct dentry *dentry);
+int proc_readdir_de(struct proc_dir_entry *de, struct file *filp, void *dirent,
+                filldir_t filldir);
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index 14e9b5aaf863..4caa5f774fb7 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -63,6 +63,82 @@ int seq_release_net(struct inode *ino, struct file *f)
 }
 EXPORT_SYMBOL_GPL(seq_release_net);
 
+static struct net *get_proc_task_net(struct inode *dir)
+{
+        struct task_struct *task;
+        struct nsproxy *ns;
+        struct net *net = NULL;
+
+        rcu_read_lock();
+        task = pid_task(proc_pid(dir), PIDTYPE_PID);
+        if (task != NULL) {
+                ns = task_nsproxy(task);
+                if (ns != NULL)
+                        net = get_net(ns->net_ns);
+        }
+        rcu_read_unlock();
+
+        return net;
+}
+
+static struct dentry *proc_tgid_net_lookup(struct inode *dir,
+                struct dentry *dentry, struct nameidata *nd)
+{
+        struct dentry *de;
+        struct net *net;
+
+        de = ERR_PTR(-ENOENT);
+        net = get_proc_task_net(dir);
+        if (net != NULL) {
+                de = proc_lookup_de(net->proc_net, dir, dentry);
+                put_net(net);
+        }
+        return de;
+}
+
+static int proc_tgid_net_getattr(struct vfsmount *mnt, struct dentry *dentry,
+                struct kstat *stat)
+{
+        struct inode *inode = dentry->d_inode;
+        struct net *net;
+
+        net = get_proc_task_net(inode);
+
+        generic_fillattr(inode, stat);
+
+        if (net != NULL) {
+                stat->nlink = net->proc_net->nlink;
+                put_net(net);
+        }
+
+        return 0;
+}
+
+const struct inode_operations proc_net_inode_operations = {
+        .lookup         = proc_tgid_net_lookup,
+        .getattr        = proc_tgid_net_getattr,
+};
+
+static int proc_tgid_net_readdir(struct file *filp, void *dirent,
+                filldir_t filldir)
+{
+        int ret;
+        struct net *net;
+
+        ret = -EINVAL;
+        net = get_proc_task_net(filp->f_path.dentry->d_inode);
+        if (net != NULL) {
+                ret = proc_readdir_de(net->proc_net, filp, dirent, filldir);
+                put_net(net);
+        }
+        return ret;
+}
+
+const struct file_operations proc_net_operations = {
+        .read           = generic_read_dir,
+        .readdir        = proc_tgid_net_readdir,
+};
+
 
 struct proc_dir_entry *proc_net_fops_create(struct net *net,
         const char *name, mode_t mode, const struct file_operations *fops)
@@ -83,14 +159,6 @@ struct net *get_proc_net(const struct inode *inode)
 }
 EXPORT_SYMBOL_GPL(get_proc_net);
 
-static struct proc_dir_entry *shadow_pde;
-
-static struct proc_dir_entry *proc_net_shadow(struct task_struct *task,
-                                                struct proc_dir_entry *de)
-{
-        return task->nsproxy->net_ns->proc_net;
-}
-
 struct proc_dir_entry *proc_net_mkdir(struct net *net, const char *name,
                 struct proc_dir_entry *parent)
 {
@@ -104,45 +172,39 @@ EXPORT_SYMBOL_GPL(proc_net_mkdir);
 
 static __net_init int proc_net_ns_init(struct net *net)
 {
-        struct proc_dir_entry *root, *netd, *net_statd;
+        struct proc_dir_entry *netd, *net_statd;
         int err;
 
         err = -ENOMEM;
-        root = kzalloc(sizeof(*root), GFP_KERNEL);
-        if (!root)
+        netd = kzalloc(sizeof(*netd), GFP_KERNEL);
+        if (!netd)
                 goto out;
 
-        err = -EEXIST;
-        netd = proc_net_mkdir(net, "net", root);
-        if (!netd)
-                goto free_root;
+        netd->data = net;
+        netd->nlink = 2;
+        netd->name = "net";
+        netd->namelen = 3;
+        netd->parent = &proc_root;
 
         err = -EEXIST;
         net_statd = proc_net_mkdir(net, "stat", netd);
         if (!net_statd)
                 goto free_net;
 
-        root->data = net;
-
-        net->proc_net_root = root;
         net->proc_net = netd;
         net->proc_net_stat = net_statd;
-        err = 0;
+        return 0;
 
+free_net:
+        kfree(netd);
 out:
         return err;
-free_net:
-        remove_proc_entry("net", root);
-free_root:
-        kfree(root);
-        goto out;
 }
 
 static __net_exit void proc_net_ns_exit(struct net *net)
 {
         remove_proc_entry("stat", net->proc_net);
-        remove_proc_entry("net", net->proc_net_root);
-        kfree(net->proc_net_root);
+        kfree(net->proc_net);
 }
 
 static struct pernet_operations __net_initdata proc_net_ns_ops = {
@@ -152,8 +214,7 @@ static struct pernet_operations __net_initdata proc_net_ns_ops = {
 
 int __init proc_net_init(void)
 {
-        shadow_pde = proc_mkdir("net", NULL);
-        shadow_pde->shadow_proc = proc_net_shadow;
+        proc_symlink("net", NULL, "self/net");
 
         return register_pernet_subsys(&proc_net_ns_ops);
 }
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 6dc0334815f7..4206454734e0 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -640,17 +640,17 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
 
         ret = -EACCES;
         if (!ptrace_may_attach(task))
-                goto out;
+                goto out_task;
 
         ret = -EINVAL;
         /* file position must be aligned */
         if (*ppos % PM_ENTRY_BYTES)
-                goto out;
+                goto out_task;
 
         ret = 0;
         mm = get_task_mm(task);
         if (!mm)
-                goto out;
+                goto out_task;
 
         ret = -ENOMEM;
         uaddr = (unsigned long)buf & PAGE_MASK;
@@ -658,7 +658,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
         pagecount = (PAGE_ALIGN(uend) - uaddr) / PAGE_SIZE;
         pages = kmalloc(pagecount * sizeof(struct page *), GFP_KERNEL);
         if (!pages)
-                goto out_task;
+                goto out_mm;
 
         down_read(&current->mm->mmap_sem);
         ret = get_user_pages(current, current->mm, uaddr, pagecount,
@@ -668,6 +668,12 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
         if (ret < 0)
                 goto out_free;
 
+        if (ret != pagecount) {
+                pagecount = ret;
+                ret = -EFAULT;
+                goto out_pages;
+        }
+
         pm.out = buf;
         pm.end = buf + count;
 
@@ -699,15 +705,17 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                         ret = pm.out - buf;
         }
 
+out_pages:
         for (; pagecount; pagecount--) {
                 page = pages[pagecount-1];
                 if (!PageReserved(page))
                         SetPageDirty(page);
                 page_cache_release(page);
         }
-        mmput(mm);
 out_free:
         kfree(pages);
+out_mm:
+        mmput(mm);
 out_task:
         put_task_struct(task);
 out: