Merge branch 'master'

12 files changed, 584 insertions, 216 deletions

diff --git a/fs/buffer.c b/fs/buffer.c
index 7cdf48a9a501..3dc712f29d2d 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1027,7 +1027,7 @@ try_again:
                 /* Link the buffer to its page */
                 set_bh_page(bh, page, offset);
 
-                bh->b_end_io = NULL;
+                init_buffer(bh, NULL, NULL);
         }
         return head;
 /*
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index e08ab4702d97..4526da8907c6 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -21,18 +21,18 @@ MODULE_ALIAS_MISCDEV(FUSE_MINOR);
 
 static kmem_cache_t *fuse_req_cachep;
 
-static inline struct fuse_conn *fuse_get_conn(struct file *file)
+static struct fuse_conn *fuse_get_conn(struct file *file)
 {
         struct fuse_conn *fc;
         spin_lock(&fuse_lock);
         fc = file->private_data;
-        if (fc && !fc->mounted)
+        if (fc && !fc->connected)
                 fc = NULL;
         spin_unlock(&fuse_lock);
         return fc;
 }
 
-static inline void fuse_request_init(struct fuse_req *req)
+static void fuse_request_init(struct fuse_req *req)
 {
         memset(req, 0, sizeof(*req));
         INIT_LIST_HEAD(&req->list);
@@ -53,7 +53,7 @@ void fuse_request_free(struct fuse_req *req)
         kmem_cache_free(fuse_req_cachep, req);
 }
 
-static inline void block_sigs(sigset_t *oldset)
+static void block_sigs(sigset_t *oldset)
 {
         sigset_t mask;
 
@@ -61,7 +61,7 @@ static inline void block_sigs(sigset_t *oldset)
         sigprocmask(SIG_BLOCK, &mask, oldset);
 }
 
-static inline void restore_sigs(sigset_t *oldset)
+static void restore_sigs(sigset_t *oldset)
 {
         sigprocmask(SIG_SETMASK, oldset, NULL);
 }
@@ -109,18 +109,24 @@ struct fuse_req *fuse_get_request(struct fuse_conn *fc)
         int intr;
         sigset_t oldset;
 
+        atomic_inc(&fc->num_waiting);
         block_sigs(&oldset);
         intr = down_interruptible(&fc->outstanding_sem);
         restore_sigs(&oldset);
-        return intr ? NULL : do_get_request(fc);
+        if (intr) {
+                atomic_dec(&fc->num_waiting);
+                return NULL;
+        }
+        return do_get_request(fc);
 }
 
 static void fuse_putback_request(struct fuse_conn *fc, struct fuse_req *req)
 {
         spin_lock(&fuse_lock);
-        if (req->preallocated)
+        if (req->preallocated) {
+                atomic_dec(&fc->num_waiting);
                 list_add(&req->list, &fc->unused_list);
-        else
+        } else
                 fuse_request_free(req);
 
         /* If we are in debt decrease that first */
@@ -148,42 +154,23 @@ void fuse_release_background(struct fuse_req *req)
         spin_unlock(&fuse_lock);
 }
 
-static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
-{
-        int i;
-        struct fuse_init_out *arg = &req->misc.init_out;
-
-        if (arg->major != FUSE_KERNEL_VERSION)
-                fc->conn_error = 1;
-        else {
-                fc->minor = arg->minor;
-                fc->max_write = arg->minor < 5 ? 4096 : arg->max_write;
-        }
-
-        /* After INIT reply is received other requests can go
-           out.  So do (FUSE_MAX_OUTSTANDING - 1) number of
-           up()s on outstanding_sem.  The last up() is done in
-           fuse_putback_request() */
-        for (i = 1; i < FUSE_MAX_OUTSTANDING; i++)
-                up(&fc->outstanding_sem);
-}
-
 /*
  * This function is called when a request is finished.  Either a reply
  * has arrived or it was interrupted (and not yet sent) or some error
- * occurred during communication with userspace, or the device file was
- * closed.  It decreases the reference count for the request.  In case
- * of a background request the reference to the stored objects are
- * released.  The requester thread is woken up (if still waiting), and
- * finally the request is either freed or put on the unused_list
+ * occurred during communication with userspace, or the device file
+ * was closed.  In case of a background request the reference to the
+ * stored objects are released.  The requester thread is woken up (if
+ * still waiting), the 'end' callback is called if given, else the
+ * reference to the request is released
  *
  * Called with fuse_lock, unlocks it
  */
 static void request_end(struct fuse_conn *fc, struct fuse_req *req)
 {
-        int putback;
-        req->finished = 1;
-        putback = atomic_dec_and_test(&req->count);
+        void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
+        req->end = NULL;
+        list_del(&req->list);
+        req->state = FUSE_REQ_FINISHED;
         spin_unlock(&fuse_lock);
         if (req->background) {
                 down_read(&fc->sbput_sem);
@@ -192,18 +179,10 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
                 up_read(&fc->sbput_sem);
         }
         wake_up(&req->waitq);
-        if (req->in.h.opcode == FUSE_INIT)
-                process_init_reply(fc, req);
-        else if (req->in.h.opcode == FUSE_RELEASE && req->inode == NULL) {
-                /* Special case for failed iget in CREATE */
-                u64 nodeid = req->in.h.nodeid;
-                __fuse_get_request(req);
-                fuse_reset_request(req);
-                fuse_send_forget(fc, req, nodeid, 1);
-                putback = 0;
-        }
-        if (putback)
-                fuse_putback_request(fc, req);
+        if (end)
+                end(fc, req);
+        else
+                fuse_put_request(fc, req);
 }
 
 /*
@@ -254,14 +233,16 @@ static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
 
         spin_unlock(&fuse_lock);
         block_sigs(&oldset);
-        wait_event_interruptible(req->waitq, req->finished);
+        wait_event_interruptible(req->waitq, req->state == FUSE_REQ_FINISHED);
         restore_sigs(&oldset);
         spin_lock(&fuse_lock);
-        if (req->finished)
+        if (req->state == FUSE_REQ_FINISHED && !req->interrupted)
                 return;
 
-        req->out.h.error = -EINTR;
-        req->interrupted = 1;
+        if (!req->interrupted) {
+                req->out.h.error = -EINTR;
+                req->interrupted = 1;
+        }
         if (req->locked) {
                 /* This is uninterruptible sleep, because data is
                    being copied to/from the buffers of req.  During
@@ -272,10 +253,10 @@ static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
                 wait_event(req->waitq, !req->locked);
                 spin_lock(&fuse_lock);
         }
-        if (!req->sent && !list_empty(&req->list)) {
+        if (req->state == FUSE_REQ_PENDING) {
                 list_del(&req->list);
                 __fuse_put_request(req);
-        } else if (!req->finished && req->sent)
+        } else if (req->state == FUSE_REQ_SENT)
                 background_request(fc, req);
 }
 
@@ -310,6 +291,7 @@ static void queue_request(struct fuse_conn *fc, struct fuse_req *req)
                         fc->outstanding_debt++;
         }
         list_add_tail(&req->list, &fc->pending);
+        req->state = FUSE_REQ_PENDING;
         wake_up(&fc->waitq);
 }
 
@@ -362,34 +344,12 @@ void request_send_background(struct fuse_conn *fc, struct fuse_req *req)
         request_send_nowait(fc, req);
 }
 
-void fuse_send_init(struct fuse_conn *fc)
-{
-        /* This is called from fuse_read_super() so there's guaranteed
-           to be a request available */
-        struct fuse_req *req = do_get_request(fc);
-        struct fuse_init_in *arg = &req->misc.init_in;
-        arg->major = FUSE_KERNEL_VERSION;
-        arg->minor = FUSE_KERNEL_MINOR_VERSION;
-        req->in.h.opcode = FUSE_INIT;
-        req->in.numargs = 1;
-        req->in.args[0].size = sizeof(*arg);
-        req->in.args[0].value = arg;
-        req->out.numargs = 1;
-        /* Variable length arguement used for backward compatibility
-           with interface version < 7.5.  Rest of init_out is zeroed
-           by do_get_request(), so a short reply is not a problem */
-        req->out.argvar = 1;
-        req->out.args[0].size = sizeof(struct fuse_init_out);
-        req->out.args[0].value = &req->misc.init_out;
-        request_send_background(fc, req);
-}
-
 /*
  * Lock the request.  Up to the next unlock_request() there mustn't be
  * anything that could cause a page-fault.  If the request was already
  * interrupted bail out.
  */
-static inline int lock_request(struct fuse_req *req)
+static int lock_request(struct fuse_req *req)
 {
         int err = 0;
         if (req) {
@@ -408,7 +368,7 @@ static inline int lock_request(struct fuse_req *req)
  * requester thread is currently waiting for it to be unlocked, so
  * wake it up.
  */
-static inline void unlock_request(struct fuse_req *req)
+static void unlock_request(struct fuse_req *req)
 {
         if (req) {
                 spin_lock(&fuse_lock);
@@ -444,7 +404,7 @@ static void fuse_copy_init(struct fuse_copy_state *cs, int write,
 }
 
 /* Unmap and put previous page of userspace buffer */
-static inline void fuse_copy_finish(struct fuse_copy_state *cs)
+static void fuse_copy_finish(struct fuse_copy_state *cs)
 {
         if (cs->mapaddr) {
                 kunmap_atomic(cs->mapaddr, KM_USER0);
@@ -493,8 +453,7 @@ static int fuse_copy_fill(struct fuse_copy_state *cs)
 }
 
 /* Do as much copy to/from userspace buffer as we can */
-static inline int fuse_copy_do(struct fuse_copy_state *cs, void **val,
-                               unsigned *size)
+static int fuse_copy_do(struct fuse_copy_state *cs, void **val, unsigned *size)
 {
         unsigned ncpy = min(*size, cs->len);
         if (val) {
@@ -514,8 +473,8 @@ static inline int fuse_copy_do(struct fuse_copy_state *cs, void **val,
  * Copy a page in the request to/from the userspace buffer.  Must be
  * done atomically
  */
-static inline int fuse_copy_page(struct fuse_copy_state *cs, struct page *page,
-                                 unsigned offset, unsigned count, int zeroing)
+static int fuse_copy_page(struct fuse_copy_state *cs, struct page *page,
+                          unsigned offset, unsigned count, int zeroing)
 {
         if (page && zeroing && count < PAGE_SIZE) {
                 void *mapaddr = kmap_atomic(page, KM_USER1);
@@ -597,7 +556,7 @@ static void request_wait(struct fuse_conn *fc)
         DECLARE_WAITQUEUE(wait, current);
 
         add_wait_queue_exclusive(&fc->waitq, &wait);
-        while (fc->mounted && list_empty(&fc->pending)) {
+        while (fc->connected && list_empty(&fc->pending)) {
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (signal_pending(current))
                         break;
@@ -637,14 +596,15 @@ static ssize_t fuse_dev_readv(struct file *file, const struct iovec *iov,
                 goto err_unlock;
         request_wait(fc);
         err = -ENODEV;
-        if (!fc->mounted)
+        if (!fc->connected)
                 goto err_unlock;
         err = -ERESTARTSYS;
         if (list_empty(&fc->pending))
                 goto err_unlock;
 
         req = list_entry(fc->pending.next, struct fuse_req, list);
-        list_del_init(&req->list);
+        req->state = FUSE_REQ_READING;
+        list_move(&req->list, &fc->io);
 
         in = &req->in;
         reqsize = in->h.len;
@@ -677,8 +637,8 @@ static ssize_t fuse_dev_readv(struct file *file, const struct iovec *iov,
         if (!req->isreply)
                 request_end(fc, req);
         else {
-                req->sent = 1;
-                list_add_tail(&req->list, &fc->processing);
+                req->state = FUSE_REQ_SENT;
+                list_move_tail(&req->list, &fc->processing);
                 spin_unlock(&fuse_lock);
         }
         return reqsize;
@@ -766,17 +726,23 @@ static ssize_t fuse_dev_writev(struct file *file, const struct iovec *iov,
                 goto err_finish;
 
         spin_lock(&fuse_lock);
+        err = -ENOENT;
+        if (!fc->connected)
+                goto err_unlock;
+
         req = request_find(fc, oh.unique);
         err = -EINVAL;
         if (!req)
                 goto err_unlock;
 
-        list_del_init(&req->list);
         if (req->interrupted) {
-                request_end(fc, req);
+                spin_unlock(&fuse_lock);
                 fuse_copy_finish(&cs);
+                spin_lock(&fuse_lock);
+                request_end(fc, req);
                 return -ENOENT;
         }
+        list_move(&req->list, &fc->io);
         req->out.h = oh;
         req->locked = 1;
         cs.req = req;
@@ -830,19 +796,90 @@ static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
         return mask;
 }
 
-/* Abort all requests on the given list (pending or processing) */
+/*
+ * Abort all requests on the given list (pending or processing)
+ *
+ * This function releases and reacquires fuse_lock
+ */
 static void end_requests(struct fuse_conn *fc, struct list_head *head)
 {
         while (!list_empty(head)) {
                 struct fuse_req *req;
                 req = list_entry(head->next, struct fuse_req, list);
-                list_del_init(&req->list);
                 req->out.h.error = -ECONNABORTED;
                 request_end(fc, req);
                 spin_lock(&fuse_lock);
         }
 }
 
+/*
+ * Abort requests under I/O
+ *
+ * The requests are set to interrupted and finished, and the request
+ * waiter is woken up.  This will make request_wait_answer() wait
+ * until the request is unlocked and then return.
+ *
+ * If the request is asynchronous, then the end function needs to be
+ * called after waiting for the request to be unlocked (if it was
+ * locked).
+ */
+static void end_io_requests(struct fuse_conn *fc)
+{
+        while (!list_empty(&fc->io)) {
+                struct fuse_req *req =
+                        list_entry(fc->io.next, struct fuse_req, list);
+                void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
+
+                req->interrupted = 1;
+                req->out.h.error = -ECONNABORTED;
+                req->state = FUSE_REQ_FINISHED;
+                list_del_init(&req->list);
+                wake_up(&req->waitq);
+                if (end) {
+                        req->end = NULL;
+                        /* The end function will consume this reference */
+                        __fuse_get_request(req);
+                        spin_unlock(&fuse_lock);
+                        wait_event(req->waitq, !req->locked);
+                        end(fc, req);
+                        spin_lock(&fuse_lock);
+                }
+        }
+}
+
+/*
+ * Abort all requests.
+ *
+ * Emergency exit in case of a malicious or accidental deadlock, or
+ * just a hung filesystem.
+ *
+ * The same effect is usually achievable through killing the
+ * filesystem daemon and all users of the filesystem.  The exception
+ * is the combination of an asynchronous request and the tricky
+ * deadlock (see Documentation/filesystems/fuse.txt).
+ *
+ * During the aborting, progression of requests from the pending and
+ * processing lists onto the io list, and progression of new requests
+ * onto the pending list is prevented by req->connected being false.
+ *
+ * Progression of requests under I/O to the processing list is
+ * prevented by the req->interrupted flag being true for these
+ * requests.  For this reason requests on the io list must be aborted
+ * first.
+ */
+void fuse_abort_conn(struct fuse_conn *fc)
+{
+        spin_lock(&fuse_lock);
+        if (fc->connected) {
+                fc->connected = 0;
+                end_io_requests(fc);
+                end_requests(fc, &fc->pending);
+                end_requests(fc, &fc->processing);
+                wake_up_all(&fc->waitq);
+        }
+        spin_unlock(&fuse_lock);
+}
+
 static int fuse_dev_release(struct inode *inode, struct file *file)
 {
         struct fuse_conn *fc;
@@ -853,9 +890,11 @@ static int fuse_dev_release(struct inode *inode, struct file *file)
                 fc->connected = 0;
                 end_requests(fc, &fc->pending);
                 end_requests(fc, &fc->processing);
-                fuse_release_conn(fc);
         }
         spin_unlock(&fuse_lock);
+        if (fc)
+                kobject_put(&fc->kobj);
+
         return 0;
 }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 417bcee466f6..21fd59c7bc24 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -23,8 +23,7 @@
 /*
  * Calculate the time in jiffies until a dentry/attributes are valid
  */
-static inline unsigned long time_to_jiffies(unsigned long sec,
-                                            unsigned long nsec)
+static unsigned long time_to_jiffies(unsigned long sec, unsigned long nsec)
 {
         struct timespec ts = {sec, nsec};
         return jiffies + timespec_to_jiffies(&ts);
@@ -157,7 +156,7 @@ static int dir_alias(struct inode *inode)
         return 0;
 }
 
-static inline int invalid_nodeid(u64 nodeid)
+static int invalid_nodeid(u64 nodeid)
 {
         return !nodeid || nodeid == FUSE_ROOT_ID;
 }
@@ -166,7 +165,7 @@ static struct dentry_operations fuse_dentry_operations = {
         .d_revalidate   = fuse_dentry_revalidate,
 };
 
-static inline int valid_mode(int m)
+static int valid_mode(int m)
 {
         return S_ISREG(m) || S_ISDIR(m) || S_ISLNK(m) || S_ISCHR(m) ||
                 S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m);
@@ -763,13 +762,6 @@ static int parse_dirfile(char *buf, size_t nbytes, struct file *file,
         return 0;
 }
 
-static inline size_t fuse_send_readdir(struct fuse_req *req, struct file *file,
-                                       struct inode *inode, loff_t pos,
-                                       size_t count)
-{
-        return fuse_send_read_common(req, file, inode, pos, count, 1);
-}
-
 static int fuse_readdir(struct file *file, void *dstbuf, filldir_t filldir)
 {
         int err;
@@ -793,7 +785,9 @@ static int fuse_readdir(struct file *file, void *dstbuf, filldir_t filldir)
         }
         req->num_pages = 1;
         req->pages[0] = page;
-        nbytes = fuse_send_readdir(req, file, inode, file->f_pos, PAGE_SIZE);
+        fuse_read_fill(req, file, inode, file->f_pos, PAGE_SIZE, FUSE_READDIR);
+        request_send(fc, req);
+        nbytes = req->out.args[0].size;
         err = req->out.h.error;
         fuse_put_request(fc, req);
         if (!err)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 63d2980df5c9..a7ef5e716f3c 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -113,6 +113,14 @@ int fuse_open_common(struct inode *inode, struct file *file, int isdir)
         return err;
 }
 
+/* Special case for failed iget in CREATE */
+static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
+{
+        u64 nodeid = req->in.h.nodeid;
+        fuse_reset_request(req);
+        fuse_send_forget(fc, req, nodeid, 1);
+}
+
 void fuse_send_release(struct fuse_conn *fc, struct fuse_file *ff,
                        u64 nodeid, struct inode *inode, int flags, int isdir)
 {
@@ -128,6 +136,8 @@ void fuse_send_release(struct fuse_conn *fc, struct fuse_file *ff,
         req->in.args[0].size = sizeof(struct fuse_release_in);
         req->in.args[0].value = inarg;
         request_send_background(fc, req);
+        if (!inode)
+                req->end = fuse_release_end;
         kfree(ff);
 }
 
@@ -240,38 +250,35 @@ static int fuse_fsync(struct file *file, struct dentry *de, int datasync)
         return fuse_fsync_common(file, de, datasync, 0);
 }
 
-size_t fuse_send_read_common(struct fuse_req *req, struct file *file,
-                             struct inode *inode, loff_t pos, size_t count,
-                             int isdir)
+void fuse_read_fill(struct fuse_req *req, struct file *file,
+                    struct inode *inode, loff_t pos, size_t count, int opcode)
 {
-        struct fuse_conn *fc = get_fuse_conn(inode);
         struct fuse_file *ff = file->private_data;
-        struct fuse_read_in inarg;
+        struct fuse_read_in *inarg = &req->misc.read_in;
 
-        memset(&inarg, 0, sizeof(struct fuse_read_in));
-        inarg.fh = ff->fh;
-        inarg.offset = pos;
-        inarg.size = count;
-        req->in.h.opcode = isdir ? FUSE_READDIR : FUSE_READ;
+        inarg->fh = ff->fh;
+        inarg->offset = pos;
+        inarg->size = count;
+        req->in.h.opcode = opcode;
         req->in.h.nodeid = get_node_id(inode);
         req->inode = inode;
         req->file = file;
         req->in.numargs = 1;
         req->in.args[0].size = sizeof(struct fuse_read_in);
-        req->in.args[0].value = &inarg;
+        req->in.args[0].value = inarg;
         req->out.argpages = 1;
         req->out.argvar = 1;
         req->out.numargs = 1;
         req->out.args[0].size = count;
-        request_send(fc, req);
-        return req->out.args[0].size;
 }
 
-static inline size_t fuse_send_read(struct fuse_req *req, struct file *file,
-                                    struct inode *inode, loff_t pos,
-                                    size_t count)
+static size_t fuse_send_read(struct fuse_req *req, struct file *file,
+                             struct inode *inode, loff_t pos, size_t count)
 {
-        return fuse_send_read_common(req, file, inode, pos, count, 0);
+        struct fuse_conn *fc = get_fuse_conn(inode);
+        fuse_read_fill(req, file, inode, pos, count, FUSE_READ);
+        request_send(fc, req);
+        return req->out.args[0].size;
 }
 
 static int fuse_readpage(struct file *file, struct page *page)
@@ -304,21 +311,33 @@ static int fuse_readpage(struct file *file, struct page *page)
         return err;
 }
 
-static int fuse_send_readpages(struct fuse_req *req, struct file *file,
-                               struct inode *inode)
+static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req)
 {
-        loff_t pos = page_offset(req->pages[0]);
-        size_t count = req->num_pages << PAGE_CACHE_SHIFT;
-        unsigned i;
-        req->out.page_zeroing = 1;
-        fuse_send_read(req, file, inode, pos, count);
+        int i;
+
+        fuse_invalidate_attr(req->pages[0]->mapping->host); /* atime changed */
+
         for (i = 0; i < req->num_pages; i++) {
                 struct page *page = req->pages[i];
                 if (!req->out.h.error)
                         SetPageUptodate(page);
+                else
+                        SetPageError(page);
                 unlock_page(page);
         }
-        return req->out.h.error;
+        fuse_put_request(fc, req);
+}
+
+static void fuse_send_readpages(struct fuse_req *req, struct file *file,
+                                struct inode *inode)
+{
+        struct fuse_conn *fc = get_fuse_conn(inode);
+        loff_t pos = page_offset(req->pages[0]);
+        size_t count = req->num_pages << PAGE_CACHE_SHIFT;
+        req->out.page_zeroing = 1;
+        req->end = fuse_readpages_end;
+        fuse_read_fill(req, file, inode, pos, count, FUSE_READ);
+        request_send_background(fc, req);
 }
 
 struct fuse_readpages_data {
@@ -338,12 +357,12 @@ static int fuse_readpages_fill(void *_data, struct page *page)
             (req->num_pages == FUSE_MAX_PAGES_PER_REQ ||
              (req->num_pages + 1) * PAGE_CACHE_SIZE > fc->max_read ||
              req->pages[req->num_pages - 1]->index + 1 != page->index)) {
-                int err = fuse_send_readpages(req, data->file, inode);
-                if (err) {
+                fuse_send_readpages(req, data->file, inode);
+                data->req = req = fuse_get_request(fc);
+                if (!req) {
                         unlock_page(page);
-                        return err;
+                        return -EINTR;
                 }
-                fuse_reset_request(req);
         }
         req->pages[req->num_pages] = page;
         req->num_pages ++;
@@ -368,10 +387,8 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
                 return -EINTR;
 
         err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
-        if (!err && data.req->num_pages)
-                err = fuse_send_readpages(data.req, file, inode);
-        fuse_put_request(fc, data.req);
-        fuse_invalidate_attr(inode); /* atime changed */
+        if (!err)
+                fuse_send_readpages(data.req, file, inode);
         return err;
 }
 
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 74c8d098a14a..46cf933aa3bf 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -94,6 +94,11 @@ struct fuse_out {
         /** Header returned from userspace */
         struct fuse_out_header h;
 
+        /*
+         * The following bitfields are not changed during the request
+         * processing
+         */
+
         /** Last argument is variable length (can be shorter than
             arg->size) */
         unsigned argvar:1;
@@ -111,12 +116,23 @@ struct fuse_out {
         struct fuse_arg args[3];
 };
 
+/** The request state */
+enum fuse_req_state {
+        FUSE_REQ_INIT = 0,
+        FUSE_REQ_PENDING,
+        FUSE_REQ_READING,
+        FUSE_REQ_SENT,
+        FUSE_REQ_FINISHED
+};
+
+struct fuse_conn;
+
 /**
  * A request to the client
  */
 struct fuse_req {
-        /** This can be on either unused_list, pending or processing
-            lists in fuse_conn */
+        /** This can be on either unused_list, pending processing or
+            io lists in fuse_conn */
         struct list_head list;
 
         /** Entry on the background list */
@@ -125,6 +141,12 @@ struct fuse_req {
         /** refcount */
         atomic_t count;
 
+        /*
+         * The following bitfields are either set once before the
+         * request is queued or setting/clearing them is protected by
+         * fuse_lock
+         */
+
         /** True if the request has reply */
         unsigned isreply:1;
 
@@ -140,11 +162,8 @@ struct fuse_req {
         /** Data is being copied to/from the request */
         unsigned locked:1;
 
-        /** Request has been sent to userspace */
-        unsigned sent:1;
-
-        /** The request is finished */
-        unsigned finished:1;
+        /** State of the request */
+        enum fuse_req_state state;
 
         /** The request input */
         struct fuse_in in;
@@ -161,6 +180,7 @@ struct fuse_req {
                 struct fuse_release_in release_in;
                 struct fuse_init_in init_in;
                 struct fuse_init_out init_out;
+                struct fuse_read_in read_in;
         } misc;
 
         /** page vector */
@@ -180,6 +200,9 @@ struct fuse_req {
 
         /** File used in the request (or NULL) */
         struct file *file;
+
+        /** Request completion callback */
+        void (*end)(struct fuse_conn *, struct fuse_req *);
 };
 
 /**
@@ -190,9 +213,6 @@ struct fuse_req {
  * unmounted.
  */
 struct fuse_conn {
-        /** Reference count */
-        int count;
-
         /** The user id for this mount */
         uid_t user_id;
 
@@ -217,6 +237,9 @@ struct fuse_conn {
         /** The list of requests being processed */
         struct list_head processing;
 
+        /** The list of requests under I/O */
+        struct list_head io;
+
         /** Requests put in the background (RELEASE or any other
             interrupted request) */
         struct list_head background;
@@ -238,14 +261,22 @@ struct fuse_conn {
         u64 reqctr;
 
         /** Mount is active */
-        unsigned mounted : 1;
+        unsigned mounted;
 
-        /** Connection established */
-        unsigned connected : 1;
+        /** Connection established, cleared on umount, connection
+            abort and device release */
+        unsigned connected;
 
-        /** Connection failed (version mismatch) */
+        /** Connection failed (version mismatch).  Cannot race with
+            setting other bitfields since it is only set once in INIT
+            reply, before any other request, and never cleared */
         unsigned conn_error : 1;
 
+        /*
+         * The following bitfields are only for optimization purposes
+         * and hence races in setting them will not cause malfunction
+         */
+
         /** Is fsync not implemented by fs? */
         unsigned no_fsync : 1;
 
@@ -273,21 +304,22 @@ struct fuse_conn {
         /** Is create not implemented by fs? */
         unsigned no_create : 1;
 
+        /** The number of requests waiting for completion */
+        atomic_t num_waiting;
+
         /** Negotiated minor version */
         unsigned minor;
 
         /** Backing dev info */
         struct backing_dev_info bdi;
-};
 
-static inline struct fuse_conn **get_fuse_conn_super_p(struct super_block *sb)
-{
-        return (struct fuse_conn **) &sb->s_fs_info;
-}
+        /** kobject */
+        struct kobject kobj;
+};
 
 static inline struct fuse_conn *get_fuse_conn_super(struct super_block *sb)
 {
-        return *get_fuse_conn_super_p(sb);
+        return sb->s_fs_info;
 }
 
 static inline struct fuse_conn *get_fuse_conn(struct inode *inode)
@@ -295,6 +327,11 @@ static inline struct fuse_conn *get_fuse_conn(struct inode *inode)
         return get_fuse_conn_super(inode->i_sb);
 }
 
+static inline struct fuse_conn *get_fuse_conn_kobj(struct kobject *obj)
+{
+        return container_of(obj, struct fuse_conn, kobj);
+}
+
 static inline struct fuse_inode *get_fuse_inode(struct inode *inode)
 {
         return container_of(inode, struct fuse_inode, inode);
@@ -336,11 +373,10 @@ void fuse_send_forget(struct fuse_conn *fc, struct fuse_req *req,
                       unsigned long nodeid, u64 nlookup);
 
 /**
- * Send READ or READDIR request
+ * Initialize READ or READDIR request
  */
-size_t fuse_send_read_common(struct fuse_req *req, struct file *file,
-                             struct inode *inode, loff_t pos, size_t count,
-                             int isdir);
+void fuse_read_fill(struct fuse_req *req, struct file *file,
+                    struct inode *inode, loff_t pos, size_t count, int opcode);
 
 /**
  * Send OPEN or OPENDIR request
@@ -395,12 +431,6 @@ void fuse_init_symlink(struct inode *inode);
 void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr);
 
 /**
- * Check if the connection can be released, and if yes, then free the
- * connection structure
- */
-void fuse_release_conn(struct fuse_conn *fc);
-
-/**
  * Initialize the client device
  */
 int fuse_dev_init(void);
@@ -456,6 +486,9 @@ void request_send_background(struct fuse_conn *fc, struct fuse_req *req);
  */
 void fuse_release_background(struct fuse_req *req);
 
+/* Abort all requests */
+void fuse_abort_conn(struct fuse_conn *fc);
+
 /**
  * Get the attributes of a file
  */
@@ -465,8 +498,3 @@ int fuse_do_getattr(struct inode *inode);
  * Invalidate inode attributes
  */
 void fuse_invalidate_attr(struct inode *inode);
-
-/**
- * Send the INIT message
- */
-void fuse_send_init(struct fuse_conn *fc);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 04c80cc957a3..c755a0440a66 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -24,6 +24,13 @@ MODULE_LICENSE("GPL");
 
 spinlock_t fuse_lock;
 static kmem_cache_t *fuse_inode_cachep;
+static struct subsystem connections_subsys;
+
+struct fuse_conn_attr {
+        struct attribute attr;
+        ssize_t (*show)(struct fuse_conn *, char *);
+        ssize_t (*store)(struct fuse_conn *, const char *, size_t);
+};
 
 #define FUSE_SUPER_MAGIC 0x65735546
 
@@ -189,6 +196,11 @@ struct inode *fuse_iget(struct super_block *sb, unsigned long nodeid,
         return inode;
 }
 
+static void fuse_umount_begin(struct super_block *sb)
+{
+        fuse_abort_conn(get_fuse_conn_super(sb));
+}
+
 static void fuse_put_super(struct super_block *sb)
 {
         struct fuse_conn *fc = get_fuse_conn_super(sb);
@@ -200,14 +212,13 @@ static void fuse_put_super(struct super_block *sb)
 
         spin_lock(&fuse_lock);
         fc->mounted = 0;
-        fc->user_id = 0;
-        fc->group_id = 0;
-        fc->flags = 0;
+        fc->connected = 0;
+        spin_unlock(&fuse_lock);
+        up_write(&fc->sbput_sem);
         /* Flush all readers on this fs */
         wake_up_all(&fc->waitq);
-        up_write(&fc->sbput_sem);
-        fuse_release_conn(fc);
-        spin_unlock(&fuse_lock);
+        kobject_del(&fc->kobj);
+        kobject_put(&fc->kobj);
 }
 
 static void convert_fuse_statfs(struct kstatfs *stbuf, struct fuse_kstatfs *attr)
@@ -356,8 +367,10 @@ static int fuse_show_options(struct seq_file *m, struct vfsmount *mnt)
         return 0;
 }
 
-static void free_conn(struct fuse_conn *fc)
+static void fuse_conn_release(struct kobject *kobj)
 {
+        struct fuse_conn *fc = get_fuse_conn_kobj(kobj);
+
         while (!list_empty(&fc->unused_list)) {
                 struct fuse_req *req;
                 req = list_entry(fc->unused_list.next, struct fuse_req, list);
@@ -367,33 +380,28 @@ static void free_conn(struct fuse_conn *fc)
         kfree(fc);
 }
 
-/* Must be called with the fuse lock held */
-void fuse_release_conn(struct fuse_conn *fc)
-{
-        fc->count--;
-        if (!fc->count)
-                free_conn(fc);
-}
-
 static struct fuse_conn *new_conn(void)
 {
         struct fuse_conn *fc;
 
-        fc = kmalloc(sizeof(*fc), GFP_KERNEL);
-        if (fc != NULL) {
+        fc = kzalloc(sizeof(*fc), GFP_KERNEL);
+        if (fc) {
                 int i;
-                memset(fc, 0, sizeof(*fc));
                 init_waitqueue_head(&fc->waitq);
                 INIT_LIST_HEAD(&fc->pending);
                 INIT_LIST_HEAD(&fc->processing);
+                INIT_LIST_HEAD(&fc->io);
                 INIT_LIST_HEAD(&fc->unused_list);
                 INIT_LIST_HEAD(&fc->background);
-                sema_init(&fc->outstanding_sem, 0);
+                sema_init(&fc->outstanding_sem, 1); /* One for INIT */
                 init_rwsem(&fc->sbput_sem);
+                kobj_set_kset_s(fc, connections_subsys);
+                kobject_init(&fc->kobj);
+                atomic_set(&fc->num_waiting, 0);
                 for (i = 0; i < FUSE_MAX_OUTSTANDING; i++) {
                         struct fuse_req *req = fuse_request_alloc();
                         if (!req) {
-                                free_conn(fc);
+                                kobject_put(&fc->kobj);
                                 return NULL;
                         }
                         list_add(&req->list, &fc->unused_list);
@@ -408,25 +416,32 @@ static struct fuse_conn *new_conn(void)
 static struct fuse_conn *get_conn(struct file *file, struct super_block *sb)
 {
         struct fuse_conn *fc;
+        int err;
 
+        err = -EINVAL;
         if (file->f_op != &fuse_dev_operations)
-                return ERR_PTR(-EINVAL);
+                goto out_err;
+
+        err = -ENOMEM;
         fc = new_conn();
-        if (fc == NULL)
-                return ERR_PTR(-ENOMEM);
+        if (!fc)
+                goto out_err;
+
         spin_lock(&fuse_lock);
-        if (file->private_data) {
-                free_conn(fc);
-                fc = ERR_PTR(-EINVAL);
-        } else {
-                file->private_data = fc;
-                *get_fuse_conn_super_p(sb) = fc;
-                fc->mounted = 1;
-                fc->connected = 1;
-                fc->count = 2;
-        }
+        err = -EINVAL;
+        if (file->private_data)
+                goto out_unlock;
+
+        kobject_get(&fc->kobj);
+        file->private_data = fc;
         spin_unlock(&fuse_lock);
         return fc;
+
+ out_unlock:
+        spin_unlock(&fuse_lock);
+        kobject_put(&fc->kobj);
+ out_err:
+        return ERR_PTR(err);
 }
 
 static struct inode *get_root_inode(struct super_block *sb, unsigned mode)
@@ -445,16 +460,74 @@ static struct super_operations fuse_super_operations = {
         .read_inode     = fuse_read_inode,
         .clear_inode    = fuse_clear_inode,
         .put_super      = fuse_put_super,
+        .umount_begin   = fuse_umount_begin,
         .statfs         = fuse_statfs,
         .show_options   = fuse_show_options,
 };
 
+static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
+{
+        int i;
+        struct fuse_init_out *arg = &req->misc.init_out;
+
+        if (req->out.h.error || arg->major != FUSE_KERNEL_VERSION)
+                fc->conn_error = 1;
+        else {
+                fc->minor = arg->minor;
+                fc->max_write = arg->minor < 5 ? 4096 : arg->max_write;
+        }
+
+        /* After INIT reply is received other requests can go
+           out.  So do (FUSE_MAX_OUTSTANDING - 1) number of
+           up()s on outstanding_sem.  The last up() is done in
+           fuse_putback_request() */
+        for (i = 1; i < FUSE_MAX_OUTSTANDING; i++)
+                up(&fc->outstanding_sem);
+
+        fuse_put_request(fc, req);
+}
+
+static void fuse_send_init(struct fuse_conn *fc)
+{
+        /* This is called from fuse_read_super() so there's guaranteed
+           to be exactly one request available */
+        struct fuse_req *req = fuse_get_request(fc);
+        struct fuse_init_in *arg = &req->misc.init_in;
+
+        arg->major = FUSE_KERNEL_VERSION;
+        arg->minor = FUSE_KERNEL_MINOR_VERSION;
+        req->in.h.opcode = FUSE_INIT;
+        req->in.numargs = 1;
+        req->in.args[0].size = sizeof(*arg);
+        req->in.args[0].value = arg;
+        req->out.numargs = 1;
+        /* Variable length arguement used for backward compatibility
+           with interface version < 7.5.  Rest of init_out is zeroed
+           by do_get_request(), so a short reply is not a problem */
+        req->out.argvar = 1;
+        req->out.args[0].size = sizeof(struct fuse_init_out);
+        req->out.args[0].value = &req->misc.init_out;
+        req->end = process_init_reply;
+        request_send_background(fc, req);
+}
+
+static unsigned long long conn_id(void)
+{
+        static unsigned long long ctr = 1;
+        unsigned long long val;
+        spin_lock(&fuse_lock);
+        val = ctr++;
+        spin_unlock(&fuse_lock);
+        return val;
+}
+
 static int fuse_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct fuse_conn *fc;
         struct inode *root;
         struct fuse_mount_data d;
         struct file *file;
+        struct dentry *root_dentry;
         int err;
 
         if (!parse_fuse_opt((char *) data, &d))
@@ -482,23 +555,42 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         if (fc->max_read / PAGE_CACHE_SIZE < fc->bdi.ra_pages)
                 fc->bdi.ra_pages = fc->max_read / PAGE_CACHE_SIZE;
 
+        /* Used by get_root_inode() */
+        sb->s_fs_info = fc;
+
         err = -ENOMEM;
         root = get_root_inode(sb, d.rootmode);
-        if (root == NULL)
+        if (!root)
                 goto err;
 
-        sb->s_root = d_alloc_root(root);
-        if (!sb->s_root) {
+        root_dentry = d_alloc_root(root);
+        if (!root_dentry) {
                 iput(root);
                 goto err;
         }
+
+        err = kobject_set_name(&fc->kobj, "%llu", conn_id());
+        if (err)
+                goto err_put_root;
+
+        err = kobject_add(&fc->kobj);
+        if (err)
+                goto err_put_root;
+
+        sb->s_root = root_dentry;
+        spin_lock(&fuse_lock);
+        fc->mounted = 1;
+        fc->connected = 1;
+        spin_unlock(&fuse_lock);
+
         fuse_send_init(fc);
+
         return 0;
 
+ err_put_root:
+        dput(root_dentry);
  err:
-        spin_lock(&fuse_lock);
-        fuse_release_conn(fc);
-        spin_unlock(&fuse_lock);
+        kobject_put(&fc->kobj);
         return err;
 }
 
@@ -516,6 +608,69 @@ static struct file_system_type fuse_fs_type = {
         .kill_sb        = kill_anon_super,
 };
 
+static ssize_t fuse_conn_waiting_show(struct fuse_conn *fc, char *page)
+{
+        return sprintf(page, "%i\n", atomic_read(&fc->num_waiting));
+}
+
+static ssize_t fuse_conn_abort_store(struct fuse_conn *fc, const char *page,
+                                     size_t count)
+{
+        fuse_abort_conn(fc);
+        return count;
+}
+
+static struct fuse_conn_attr fuse_conn_waiting =
+        __ATTR(waiting, 0400, fuse_conn_waiting_show, NULL);
+static struct fuse_conn_attr fuse_conn_abort =
+        __ATTR(abort, 0600, NULL, fuse_conn_abort_store);
+
+static struct attribute *fuse_conn_attrs[] = {
+        &fuse_conn_waiting.attr,
+        &fuse_conn_abort.attr,
+        NULL,
+};
+
+static ssize_t fuse_conn_attr_show(struct kobject *kobj,
+                                   struct attribute *attr,
+                                   char *page)
+{
+        struct fuse_conn_attr *fca =
+                container_of(attr, struct fuse_conn_attr, attr);
+
+        if (fca->show)
+                return fca->show(get_fuse_conn_kobj(kobj), page);
+        else
+                return -EACCES;
+}
+
+static ssize_t fuse_conn_attr_store(struct kobject *kobj,
+                                    struct attribute *attr,
+                                    const char *page, size_t count)
+{
+        struct fuse_conn_attr *fca =
+                container_of(attr, struct fuse_conn_attr, attr);
+
+        if (fca->store)
+                return fca->store(get_fuse_conn_kobj(kobj), page, count);
+        else
+                return -EACCES;
+}
+
+static struct sysfs_ops fuse_conn_sysfs_ops = {
+        .show   = &fuse_conn_attr_show,
+        .store  = &fuse_conn_attr_store,
+};
+
+static struct kobj_type ktype_fuse_conn = {
+        .release        = fuse_conn_release,
+        .sysfs_ops      = &fuse_conn_sysfs_ops,
+        .default_attrs  = fuse_conn_attrs,
+};
+
+static decl_subsys(fuse, NULL, NULL);
+static decl_subsys(connections, &ktype_fuse_conn, NULL);
+
 static void fuse_inode_init_once(void *foo, kmem_cache_t *cachep,
                                  unsigned long flags)
 {
@@ -553,6 +708,34 @@ static void fuse_fs_cleanup(void)
         kmem_cache_destroy(fuse_inode_cachep);
 }
 
+static int fuse_sysfs_init(void)
+{
+        int err;
+
+        kset_set_kset_s(&fuse_subsys, fs_subsys);
+        err = subsystem_register(&fuse_subsys);
+        if (err)
+                goto out_err;
+
+        kset_set_kset_s(&connections_subsys, fuse_subsys);
+        err = subsystem_register(&connections_subsys);
+        if (err)
+                goto out_fuse_unregister;
+
+        return 0;
+
+ out_fuse_unregister:
+        subsystem_unregister(&fuse_subsys);
+ out_err:
+        return err;
+}
+
+static void fuse_sysfs_cleanup(void)
+{
+        subsystem_unregister(&connections_subsys);
+        subsystem_unregister(&fuse_subsys);
+}
+
 static int __init fuse_init(void)
 {
         int res;
@@ -569,8 +752,14 @@ static int __init fuse_init(void)
         if (res)
                 goto err_fs_cleanup;
 
+        res = fuse_sysfs_init();
+        if (res)
+                goto err_dev_cleanup;
+
         return 0;
 
+ err_dev_cleanup:
+        fuse_dev_cleanup();
  err_fs_cleanup:
         fuse_fs_cleanup();
  err:
@@ -581,6 +770,7 @@ static void __exit fuse_exit(void)
 {
         printk(KERN_DEBUG "fuse exit\n");
 
+        fuse_sysfs_cleanup();
         fuse_fs_cleanup();
         fuse_dev_cleanup();
 }
diff --git a/fs/partitions/Kconfig b/fs/partitions/Kconfig
index 7490cc9208b3..c9a478099281 100644
--- a/fs/partitions/Kconfig
+++ b/fs/partitions/Kconfig
@@ -222,6 +222,13 @@ config SUN_PARTITION
           given by the tar program ("man tar" or preferably "info tar"). If
           you don't know what all this is about, say N.
 
+config KARMA_PARTITION
+        bool "Karma Partition support"
+        depends on PARTITION_ADVANCED
+        help
+          Say Y here if you would like to mount the Rio Karma MP3 player, as it
+          uses a proprietary partition table.
+
 config EFI_PARTITION
         bool "EFI GUID Partition support"
         depends on PARTITION_ADVANCED
diff --git a/fs/partitions/Makefile b/fs/partitions/Makefile
index 66d5cc26fafb..42c7d3878ed0 100644
--- a/fs/partitions/Makefile
+++ b/fs/partitions/Makefile
@@ -17,3 +17,4 @@ obj-$(CONFIG_SUN_PARTITION) += sun.o
 obj-$(CONFIG_ULTRIX_PARTITION) += ultrix.o
 obj-$(CONFIG_IBM_PARTITION) += ibm.o
 obj-$(CONFIG_EFI_PARTITION) += efi.o
+obj-$(CONFIG_KARMA_PARTITION) += karma.o
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index 7881ce05daef..f924f459bdb8 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -35,6 +35,7 @@
 #include "ibm.h"
 #include "ultrix.h"
 #include "efi.h"
+#include "karma.h"
 
 #ifdef CONFIG_BLK_DEV_MD
 extern void md_autodetect_dev(dev_t dev);
@@ -103,6 +104,9 @@ static int (*check_part[])(struct parsed_partitions *, struct block_device *) =
 #ifdef CONFIG_IBM_PARTITION
         ibm_partition,
 #endif
+#ifdef CONFIG_KARMA_PARTITION
+        karma_partition,
+#endif
         NULL
 };
  
diff --git a/fs/partitions/karma.c b/fs/partitions/karma.c
new file mode 100644
index 000000000000..176d89bcf123
--- /dev/null
+++ b/fs/partitions/karma.c
@@ -0,0 +1,57 @@
+/*
+ *  fs/partitions/karma.c
+ *  Rio Karma partition info.
+ *
+ *  Copyright (C) 2006 Bob Copeland (me@bobcopeland.com)
+ *  based on osf.c
+ */
+
+#include "check.h"
+#include "karma.h"
+
+int karma_partition(struct parsed_partitions *state, struct block_device *bdev)
+{
+        int i;
+        int slot = 1;
+        Sector sect;
+        unsigned char *data;
+        struct disklabel {
+                u8 d_reserved[270];
+                struct d_partition {
+                        __le32 p_res;
+                        u8 p_fstype;
+                        u8 p_res2[3];
+                        __le32 p_offset;
+                        __le32 p_size;
+                } d_partitions[2];
+                u8 d_blank[208];
+                __le16 d_magic;
+        } __attribute__((packed)) *label;
+        struct d_partition *p;
+
+        data = read_dev_sector(bdev, 0, &sect);
+        if (!data)
+                return -1;
+
+        label = (struct disklabel *)data;
+        if (le16_to_cpu(label->d_magic) != KARMA_LABEL_MAGIC) {
+                put_dev_sector(sect);
+                return 0;
+        }
+
+        p = label->d_partitions;
+        for (i = 0 ; i < 2; i++, p++) {
+                if (slot == state->limit)
+                        break;
+
+                if (p->p_fstype == 0x4d && le32_to_cpu(p->p_size)) {
+                        put_partition(state, slot, le32_to_cpu(p->p_offset),
+                                le32_to_cpu(p->p_size));
+                }
+                slot++;
+        }
+        printk("\n");
+        put_dev_sector(sect);
+        return 1;
+}
+
diff --git a/fs/partitions/karma.h b/fs/partitions/karma.h
new file mode 100644
index 000000000000..ecf7d3f2a3d8
--- /dev/null
+++ b/fs/partitions/karma.h
@@ -0,0 +1,8 @@
+/*
+ *  fs/partitions/karma.h
+ */
+
+#define KARMA_LABEL_MAGIC               0xAB56
+
+int karma_partition(struct parsed_partitions *state, struct block_device *bdev);
+
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index d1db8c17a74e..120626789406 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -336,24 +336,47 @@ static inline int bio_add_buffer(struct bio *bio, struct buffer_head *bh)
 }
 
 /*
- * Submit all of the bios for all of the ioends we have saved up,
- * covering the initial writepage page and also any probed pages.
+ * Submit all of the bios for all of the ioends we have saved up, covering the
+ * initial writepage page and also any probed pages.
+ *
+ * Because we may have multiple ioends spanning a page, we need to start
+ * writeback on all the buffers before we submit them for I/O. If we mark the
+ * buffers as we got, then we can end up with a page that only has buffers
+ * marked async write and I/O complete on can occur before we mark the other
+ * buffers async write.
+ *
+ * The end result of this is that we trip a bug in end_page_writeback() because
+ * we call it twice for the one page as the code in end_buffer_async_write()
+ * assumes that all buffers on the page are started at the same time.
+ *
+ * The fix is two passes across the ioend list - one to start writeback on the
+ * bufferheads, and then the second one submit them for I/O.
  */
 STATIC void
 xfs_submit_ioend(
         xfs_ioend_t             *ioend)
 {
+        xfs_ioend_t             *head = ioend;
         xfs_ioend_t             *next;
         struct buffer_head      *bh;
         struct bio              *bio;
         sector_t                lastblock = 0;
 
+        /* Pass 1 - start writeback */
+        do {
+                next = ioend->io_list;
+                for (bh = ioend->io_buffer_head; bh; bh = bh->b_private) {
+                        xfs_start_buffer_writeback(bh);
+                }
+        } while ((ioend = next) != NULL);
+
+        /* Pass 2 - submit I/O */
+        ioend = head;
         do {
                 next = ioend->io_list;
                 bio = NULL;
 
                 for (bh = ioend->io_buffer_head; bh; bh = bh->b_private) {
-                        xfs_start_buffer_writeback(bh);
 
                         if (!bio) {
  retry: