Merge branch 'timers/posix-cpu-timers-for-tglx' of

git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks into timers/core

Frederic sayed: "Most of these patches have been hanging around for
several month now, in -mmotm for a significant chunk. They already
missed a few releases."

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

110 files changed, 1617 insertions, 918 deletions

diff --git a/fs/aio.c b/fs/aio.c
index c5b1a8c10411..2bbcacf74d0c 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -141,9 +141,6 @@ static void aio_free_ring(struct kioctx *ctx)
         for (i = 0; i < ctx->nr_pages; i++)
                 put_page(ctx->ring_pages[i]);
 
-        if (ctx->mmap_size)
-                vm_munmap(ctx->mmap_base, ctx->mmap_size);
-
         if (ctx->ring_pages && ctx->ring_pages != ctx->internal_pages)
                 kfree(ctx->ring_pages);
 }
@@ -307,7 +304,9 @@ static void free_ioctx(struct kioctx *ctx)
         kunmap_atomic(ring);
 
         while (atomic_read(&ctx->reqs_active) > 0) {
-                wait_event(ctx->wait, head != ctx->tail);
+                wait_event(ctx->wait,
+                                head != ctx->tail ||
+                                atomic_read(&ctx->reqs_active) <= 0);
 
                 avail = (head <= ctx->tail ? ctx->tail : ctx->nr_events) - head;
 
@@ -320,11 +319,6 @@ static void free_ioctx(struct kioctx *ctx)
 
         aio_free_ring(ctx);
 
-        spin_lock(&aio_nr_lock);
-        BUG_ON(aio_nr - ctx->max_reqs > aio_nr);
-        aio_nr -= ctx->max_reqs;
-        spin_unlock(&aio_nr_lock);
-
         pr_debug("freeing %p\n", ctx);
 
         /*
@@ -433,17 +427,24 @@ static void kill_ioctx(struct kioctx *ctx)
 {
         if (!atomic_xchg(&ctx->dead, 1)) {
                 hlist_del_rcu(&ctx->list);
-                /* Between hlist_del_rcu() and dropping the initial ref */
-                synchronize_rcu();
 
                 /*
-                 * We can't punt to workqueue here because put_ioctx() ->
-                 * free_ioctx() will unmap the ringbuffer, and that has to be
-                 * done in the original process's context. kill_ioctx_rcu/work()
-                 * exist for exit_aio(), as in that path free_ioctx() won't do
-                 * the unmap.
+                 * It'd be more correct to do this in free_ioctx(), after all
+                 * the outstanding kiocbs have finished - but by then io_destroy
+                 * has already returned, so io_setup() could potentially return
+                 * -EAGAIN with no ioctxs actually in use (as far as userspace
+                 *  could tell).
                  */
-                kill_ioctx_work(&ctx->rcu_work);
+                spin_lock(&aio_nr_lock);
+                BUG_ON(aio_nr - ctx->max_reqs > aio_nr);
+                aio_nr -= ctx->max_reqs;
+                spin_unlock(&aio_nr_lock);
+
+                if (ctx->mmap_size)
+                        vm_munmap(ctx->mmap_base, ctx->mmap_size);
+
+                /* Between hlist_del_rcu() and dropping the initial ref */
+                call_rcu(&ctx->rcu_head, kill_ioctx_rcu);
         }
 }
 
@@ -493,10 +494,7 @@ void exit_aio(struct mm_struct *mm)
                  */
                 ctx->mmap_size = 0;
 
-                if (!atomic_xchg(&ctx->dead, 1)) {
-                        hlist_del_rcu(&ctx->list);
-                        call_rcu(&ctx->rcu_head, kill_ioctx_rcu);
-                }
+                kill_ioctx(ctx);
         }
 }
 
@@ -1299,8 +1297,7 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb,
  *      < min_nr if the timeout specified by timeout has elapsed
  *      before sufficient events are available, where timeout == NULL
  *      specifies an infinite timeout. Note that the timeout pointed to by
- *      timeout is relative and will be updated if not NULL and the
- *      operation blocks. Will fail with -ENOSYS if not implemented.
+ *      timeout is relative.  Will fail with -ENOSYS if not implemented.
  */
 SYSCALL_DEFINE5(io_getevents, aio_context_t, ctx_id,
                 long, min_nr,
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 8615ee89ab55..f95dddced968 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -265,8 +265,8 @@ befs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 result = filldir(dirent, keybuf, keysize, filp->f_pos,
                                  (ino_t) value, d_type);
         }
-
-        filp->f_pos++;
+        if (!result)
+                filp->f_pos++;
 
         befs_debug(sb, "<--- befs_readdir() filp->f_pos %Ld", filp->f_pos);
 
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index b4fb41558111..290e347b6db3 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -918,7 +918,8 @@ again:
                                                            ref->parent, bsz, 0);
                                 if (!eb || !extent_buffer_uptodate(eb)) {
                                         free_extent_buffer(eb);
-                                        return -EIO;
+                                        ret = -EIO;
+                                        goto out;
                                 }
                                 ret = find_extent_in_eb(eb, bytenr,
                                                         *extent_item_pos, &eie);
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index 18af6f48781a..1431a6965017 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -1700,7 +1700,7 @@ static int btrfsic_read_block(struct btrfsic_state *state,
                 unsigned int j;
                 DECLARE_COMPLETION_ONSTACK(complete);
 
-                bio = bio_alloc(GFP_NOFS, num_pages - i);
+                bio = btrfs_io_bio_alloc(GFP_NOFS, num_pages - i);
                 if (!bio) {
                         printk(KERN_INFO
                                "btrfsic: bio_alloc() for %u pages failed!\n",
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index de6de8e60b46..02fae7f7e42c 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -951,10 +951,12 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
                         BUG_ON(ret); /* -ENOMEM */
                 }
                 if (new_flags != 0) {
+                        int level = btrfs_header_level(buf);
+
                         ret = btrfs_set_disk_extent_flags(trans, root,
                                                           buf->start,
                                                           buf->len,
-                                                          new_flags, 0);
+                                                          new_flags, level, 0);
                         if (ret)
                                 return ret;
                 }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 63c328a9ce95..d6dd49b51ba8 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -88,12 +88,12 @@ struct btrfs_ordered_sum;
 /* holds checksums of all the data extents */
 #define BTRFS_CSUM_TREE_OBJECTID 7ULL
 
-/* for storing balance parameters in the root tree */
-#define BTRFS_BALANCE_OBJECTID -4ULL
-
 /* holds quota configuration and tracking */
 #define BTRFS_QUOTA_TREE_OBJECTID 8ULL
 
+/* for storing balance parameters in the root tree */
+#define BTRFS_BALANCE_OBJECTID -4ULL
+
 /* orhpan objectid for tracking unlinked/truncated files */
 #define BTRFS_ORPHAN_OBJECTID -5ULL
 
@@ -3075,7 +3075,7 @@ int btrfs_dec_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
 int btrfs_set_disk_extent_flags(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
                                 u64 bytenr, u64 num_bytes, u64 flags,
-                                int is_data);
+                                int level, int is_data);
 int btrfs_free_extent(struct btrfs_trans_handle *trans,
                       struct btrfs_root *root,
                       u64 bytenr, u64 num_bytes, u64 parent, u64 root_objectid,
diff --git a/fs/btrfs/delayed-ref.h b/fs/btrfs/delayed-ref.h
index f75fcaf79aeb..70b962cc177d 100644
--- a/fs/btrfs/delayed-ref.h
+++ b/fs/btrfs/delayed-ref.h
@@ -60,6 +60,7 @@ struct btrfs_delayed_ref_node {
 struct btrfs_delayed_extent_op {
         struct btrfs_disk_key key;
         u64 flags_to_set;
+        int level;
         unsigned int update_key:1;
         unsigned int update_flags:1;
         unsigned int is_data:1;
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 7ba7b3900cb8..65241f32d3f8 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -313,6 +313,11 @@ int btrfs_dev_replace_start(struct btrfs_root *root,
         struct btrfs_device *tgt_device = NULL;
         struct btrfs_device *src_device = NULL;
 
+        if (btrfs_fs_incompat(fs_info, RAID56)) {
+                pr_warn("btrfs: dev_replace cannot yet handle RAID5/RAID6\n");
+                return -EINVAL;
+        }
+
         switch (args->start.cont_reading_from_srcdev_mode) {
         case BTRFS_IOCTL_DEV_REPLACE_CONT_READING_FROM_SRCDEV_MODE_ALWAYS:
         case BTRFS_IOCTL_DEV_REPLACE_CONT_READING_FROM_SRCDEV_MODE_AVOID:
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 4e9ebe1f1827..b8b60b660c8f 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -152,7 +152,7 @@ static struct btrfs_lockdep_keyset {
         { .id = BTRFS_DEV_TREE_OBJECTID,        .name_stem = "dev"      },
         { .id = BTRFS_FS_TREE_OBJECTID,         .name_stem = "fs"       },
         { .id = BTRFS_CSUM_TREE_OBJECTID,       .name_stem = "csum"     },
-        { .id = BTRFS_ORPHAN_OBJECTID,          .name_stem = "orphan"   },
+        { .id = BTRFS_QUOTA_TREE_OBJECTID,      .name_stem = "quota"    },
         { .id = BTRFS_TREE_LOG_OBJECTID,        .name_stem = "log"      },
         { .id = BTRFS_TREE_RELOC_OBJECTID,      .name_stem = "treloc"   },
         { .id = BTRFS_DATA_RELOC_TREE_OBJECTID, .name_stem = "dreloc"   },
@@ -1513,7 +1513,6 @@ struct btrfs_root *btrfs_read_fs_root_no_radix(struct btrfs_root *tree_root,
         }
 
         root->commit_root = btrfs_root_node(root);
-        BUG_ON(!root->node); /* -ENOMEM */
 out:
         if (location->objectid != BTRFS_TREE_LOG_OBJECTID) {
                 root->ref_cows = 1;
@@ -1988,30 +1987,33 @@ static void free_root_pointers(struct btrfs_fs_info *info, int chunk_root)
 {
         free_extent_buffer(info->tree_root->node);
         free_extent_buffer(info->tree_root->commit_root);
-        free_extent_buffer(info->dev_root->node);
-        free_extent_buffer(info->dev_root->commit_root);
-        free_extent_buffer(info->extent_root->node);
-        free_extent_buffer(info->extent_root->commit_root);
-        free_extent_buffer(info->csum_root->node);
-        free_extent_buffer(info->csum_root->commit_root);
-        if (info->quota_root) {
-                free_extent_buffer(info->quota_root->node);
-                free_extent_buffer(info->quota_root->commit_root);
-        }
-
         info->tree_root->node = NULL;
         info->tree_root->commit_root = NULL;
-        info->dev_root->node = NULL;
-        info->dev_root->commit_root = NULL;
-        info->extent_root->node = NULL;
-        info->extent_root->commit_root = NULL;
-        info->csum_root->node = NULL;
-        info->csum_root->commit_root = NULL;
+
+        if (info->dev_root) {
+                free_extent_buffer(info->dev_root->node);
+                free_extent_buffer(info->dev_root->commit_root);
+                info->dev_root->node = NULL;
+                info->dev_root->commit_root = NULL;
+        }
+        if (info->extent_root) {
+                free_extent_buffer(info->extent_root->node);
+                free_extent_buffer(info->extent_root->commit_root);
+                info->extent_root->node = NULL;
+                info->extent_root->commit_root = NULL;
+        }
+        if (info->csum_root) {
+                free_extent_buffer(info->csum_root->node);
+                free_extent_buffer(info->csum_root->commit_root);
+                info->csum_root->node = NULL;
+                info->csum_root->commit_root = NULL;
+        }
         if (info->quota_root) {
+                free_extent_buffer(info->quota_root->node);
+                free_extent_buffer(info->quota_root->commit_root);
                 info->quota_root->node = NULL;
                 info->quota_root->commit_root = NULL;
         }
-
         if (chunk_root) {
                 free_extent_buffer(info->chunk_root->node);
                 free_extent_buffer(info->chunk_root->commit_root);
@@ -2857,8 +2859,8 @@ fail_qgroup:
         btrfs_free_qgroup_config(fs_info);
 fail_trans_kthread:
         kthread_stop(fs_info->transaction_kthread);
-        del_fs_roots(fs_info);
         btrfs_cleanup_transaction(fs_info->tree_root);
+        del_fs_roots(fs_info);
 fail_cleaner:
         kthread_stop(fs_info->cleaner_kthread);
 
@@ -3128,7 +3130,7 @@ static int write_dev_flush(struct btrfs_device *device, int wait)
          * caller
          */
         device->flush_bio = NULL;
-        bio = bio_alloc(GFP_NOFS, 0);
+        bio = btrfs_io_bio_alloc(GFP_NOFS, 0);
         if (!bio)
                 return -ENOMEM;
 
@@ -3510,15 +3512,15 @@ int close_ctree(struct btrfs_root *root)
                        percpu_counter_sum(&fs_info->delalloc_bytes));
         }
 
-        free_root_pointers(fs_info, 1);
-
         btrfs_free_block_groups(fs_info);
 
+        btrfs_stop_all_workers(fs_info);
+
         del_fs_roots(fs_info);
 
-        iput(fs_info->btree_inode);
+        free_root_pointers(fs_info, 1);
 
-        btrfs_stop_all_workers(fs_info);
+        iput(fs_info->btree_inode);
 
 #ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
         if (btrfs_test_opt(root, CHECK_INTEGRITY))
@@ -3659,8 +3661,11 @@ static void btrfs_destroy_ordered_operations(struct btrfs_transaction *t,
                                          ordered_operations);
 
                 list_del_init(&btrfs_inode->ordered_operations);
+                spin_unlock(&root->fs_info->ordered_extent_lock);
 
                 btrfs_invalidate_inodes(btrfs_inode->root);
+
+                spin_lock(&root->fs_info->ordered_extent_lock);
         }
 
         spin_unlock(&root->fs_info->ordered_extent_lock);
@@ -3782,8 +3787,11 @@ static void btrfs_destroy_delalloc_inodes(struct btrfs_root *root)
                 list_del_init(&btrfs_inode->delalloc_inodes);
                 clear_bit(BTRFS_INODE_IN_DELALLOC_LIST,
                           &btrfs_inode->runtime_flags);
+                spin_unlock(&root->fs_info->delalloc_lock);
 
                 btrfs_invalidate_inodes(btrfs_inode->root);
+
+                spin_lock(&root->fs_info->delalloc_lock);
         }
 
         spin_unlock(&root->fs_info->delalloc_lock);
@@ -3808,7 +3816,7 @@ static int btrfs_destroy_marked_extents(struct btrfs_root *root,
                 while (start <= end) {
                         eb = btrfs_find_tree_block(root, start,
                                                    root->leafsize);
-                        start += eb->len;
+                        start += root->leafsize;
                         if (!eb)
                                 continue;
                         wait_on_extent_buffer_writeback(eb);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 2305b5c5cf00..df472ab1b5ac 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2070,8 +2070,7 @@ static int run_delayed_extent_op(struct btrfs_trans_handle *trans,
         u32 item_size;
         int ret;
         int err = 0;
-        int metadata = (node->type == BTRFS_TREE_BLOCK_REF_KEY ||
-                        node->type == BTRFS_SHARED_BLOCK_REF_KEY);
+        int metadata = !extent_op->is_data;
 
         if (trans->aborted)
                 return 0;
@@ -2086,11 +2085,8 @@ static int run_delayed_extent_op(struct btrfs_trans_handle *trans,
         key.objectid = node->bytenr;
 
         if (metadata) {
-                struct btrfs_delayed_tree_ref *tree_ref;
-
-                tree_ref = btrfs_delayed_node_to_tree_ref(node);
                 key.type = BTRFS_METADATA_ITEM_KEY;
-                key.offset = tree_ref->level;
+                key.offset = extent_op->level;
         } else {
                 key.type = BTRFS_EXTENT_ITEM_KEY;
                 key.offset = node->num_bytes;
@@ -2719,7 +2715,7 @@ out:
 int btrfs_set_disk_extent_flags(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
                                 u64 bytenr, u64 num_bytes, u64 flags,
-                                int is_data)
+                                int level, int is_data)
 {
         struct btrfs_delayed_extent_op *extent_op;
         int ret;
@@ -2732,6 +2728,7 @@ int btrfs_set_disk_extent_flags(struct btrfs_trans_handle *trans,
         extent_op->update_flags = 1;
         extent_op->update_key = 0;
         extent_op->is_data = is_data ? 1 : 0;
+        extent_op->level = level;
 
         ret = btrfs_add_delayed_extent_op(root->fs_info, trans, bytenr,
                                           num_bytes, extent_op);
@@ -3109,6 +3106,11 @@ again:
         WARN_ON(ret);
 
         if (i_size_read(inode) > 0) {
+                ret = btrfs_check_trunc_cache_free_space(root,
+                                        &root->fs_info->global_block_rsv);
+                if (ret)
+                        goto out_put;
+
                 ret = btrfs_truncate_free_space_cache(root, trans, path,
                                                       inode);
                 if (ret)
@@ -4562,6 +4564,8 @@ static void init_global_block_rsv(struct btrfs_fs_info *fs_info)
         fs_info->csum_root->block_rsv = &fs_info->global_block_rsv;
         fs_info->dev_root->block_rsv = &fs_info->global_block_rsv;
         fs_info->tree_root->block_rsv = &fs_info->global_block_rsv;
+        if (fs_info->quota_root)
+                fs_info->quota_root->block_rsv = &fs_info->global_block_rsv;
         fs_info->chunk_root->block_rsv = &fs_info->chunk_block_rsv;
 
         update_global_block_rsv(fs_info);
@@ -6651,51 +6655,51 @@ use_block_rsv(struct btrfs_trans_handle *trans,
         struct btrfs_block_rsv *block_rsv;
         struct btrfs_block_rsv *global_rsv = &root->fs_info->global_block_rsv;
         int ret;
+        bool global_updated = false;
 
         block_rsv = get_block_rsv(trans, root);
 
-        if (block_rsv->size == 0) {
-                ret = reserve_metadata_bytes(root, block_rsv, blocksize,
-                                             BTRFS_RESERVE_NO_FLUSH);
-                /*
-                 * If we couldn't reserve metadata bytes try and use some from
-                 * the global reserve.
-                 */
-                if (ret && block_rsv != global_rsv) {
-                        ret = block_rsv_use_bytes(global_rsv, blocksize);
-                        if (!ret)
-                                return global_rsv;
-                        return ERR_PTR(ret);
-                } else if (ret) {
-                        return ERR_PTR(ret);
-                }
+        if (unlikely(block_rsv->size == 0))
+                goto try_reserve;
+again:
+        ret = block_rsv_use_bytes(block_rsv, blocksize);
+        if (!ret)
                 return block_rsv;
+
+        if (block_rsv->failfast)
+                return ERR_PTR(ret);
+
+        if (block_rsv->type == BTRFS_BLOCK_RSV_GLOBAL && !global_updated) {
+                global_updated = true;
+                update_global_block_rsv(root->fs_info);
+                goto again;
         }
 
-        ret = block_rsv_use_bytes(block_rsv, blocksize);
+        if (btrfs_test_opt(root, ENOSPC_DEBUG)) {
+                static DEFINE_RATELIMIT_STATE(_rs,
+                                DEFAULT_RATELIMIT_INTERVAL * 10,
+                                /*DEFAULT_RATELIMIT_BURST*/ 1);
+                if (__ratelimit(&_rs))
+                        WARN(1, KERN_DEBUG
+                                "btrfs: block rsv returned %d\n", ret);
+        }
+try_reserve:
+        ret = reserve_metadata_bytes(root, block_rsv, blocksize,
+                                     BTRFS_RESERVE_NO_FLUSH);
         if (!ret)
                 return block_rsv;
-        if (ret && !block_rsv->failfast) {
-                if (btrfs_test_opt(root, ENOSPC_DEBUG)) {
-                        static DEFINE_RATELIMIT_STATE(_rs,
-                                        DEFAULT_RATELIMIT_INTERVAL * 10,
-                                        /*DEFAULT_RATELIMIT_BURST*/ 1);
-                        if (__ratelimit(&_rs))
-                                WARN(1, KERN_DEBUG
-                                        "btrfs: block rsv returned %d\n", ret);
-                }
-                ret = reserve_metadata_bytes(root, block_rsv, blocksize,
-                                             BTRFS_RESERVE_NO_FLUSH);
-                if (!ret) {
-                        return block_rsv;
-                } else if (ret && block_rsv != global_rsv) {
-                        ret = block_rsv_use_bytes(global_rsv, blocksize);
-                        if (!ret)
-                                return global_rsv;
-                }
+        /*
+         * If we couldn't reserve metadata bytes try and use some from
+         * the global reserve if its space type is the same as the global
+         * reservation.
+         */
+        if (block_rsv->type != BTRFS_BLOCK_RSV_GLOBAL &&
+            block_rsv->space_info == global_rsv->space_info) {
+                ret = block_rsv_use_bytes(global_rsv, blocksize);
+                if (!ret)
+                        return global_rsv;
         }
-
-        return ERR_PTR(-ENOSPC);
+        return ERR_PTR(ret);
 }
 
 static void unuse_block_rsv(struct btrfs_fs_info *fs_info,
@@ -6763,6 +6767,7 @@ struct extent_buffer *btrfs_alloc_free_block(struct btrfs_trans_handle *trans,
                         extent_op->update_key = 1;
                 extent_op->update_flags = 1;
                 extent_op->is_data = 0;
+                extent_op->level = level;
 
                 ret = btrfs_add_delayed_tree_ref(root->fs_info, trans,
                                         ins.objectid,
@@ -6934,7 +6939,8 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans,
                 ret = btrfs_dec_ref(trans, root, eb, 0, wc->for_reloc);
                 BUG_ON(ret); /* -ENOMEM */
                 ret = btrfs_set_disk_extent_flags(trans, root, eb->start,
-                                                  eb->len, flag, 0);
+                                                  eb->len, flag,
+                                                  btrfs_header_level(eb), 0);
                 BUG_ON(ret); /* -ENOMEM */
                 wc->flags[level] |= flag;
         }
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 32d67a822e93..e7e7afb4a872 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -23,6 +23,7 @@
 
 static struct kmem_cache *extent_state_cache;
 static struct kmem_cache *extent_buffer_cache;
+static struct bio_set *btrfs_bioset;
 
 #ifdef CONFIG_BTRFS_DEBUG
 static LIST_HEAD(buffers);
@@ -125,10 +126,20 @@ int __init extent_io_init(void)
                         SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD, NULL);
         if (!extent_buffer_cache)
                 goto free_state_cache;
+
+        btrfs_bioset = bioset_create(BIO_POOL_SIZE,
+                                     offsetof(struct btrfs_io_bio, bio));
+        if (!btrfs_bioset)
+                goto free_buffer_cache;
         return 0;
 
+free_buffer_cache:
+        kmem_cache_destroy(extent_buffer_cache);
+        extent_buffer_cache = NULL;
+
 free_state_cache:
         kmem_cache_destroy(extent_state_cache);
+        extent_state_cache = NULL;
         return -ENOMEM;
 }
 
@@ -145,6 +156,8 @@ void extent_io_exit(void)
                 kmem_cache_destroy(extent_state_cache);
         if (extent_buffer_cache)
                 kmem_cache_destroy(extent_buffer_cache);
+        if (btrfs_bioset)
+                bioset_free(btrfs_bioset);
 }
 
 void extent_io_tree_init(struct extent_io_tree *tree,
@@ -1948,28 +1961,6 @@ static void check_page_uptodate(struct extent_io_tree *tree, struct page *page)
 }
 
 /*
- * helper function to unlock a page if all the extents in the tree
- * for that page are unlocked
- */
-static void check_page_locked(struct extent_io_tree *tree, struct page *page)
-{
-        u64 start = page_offset(page);
-        u64 end = start + PAGE_CACHE_SIZE - 1;
-        if (!test_range_bit(tree, start, end, EXTENT_LOCKED, 0, NULL))
-                unlock_page(page);
-}
-
-/*
- * helper function to end page writeback if all the extents
- * in the tree for that page are done with writeback
- */
-static void check_page_writeback(struct extent_io_tree *tree,
-                                 struct page *page)
-{
-        end_page_writeback(page);
-}
-
-/*
  * When IO fails, either with EIO or csum verification fails, we
  * try other mirrors that might have a good copy of the data.  This
  * io_failure_record is used to record state as we go through all the
@@ -2046,7 +2037,7 @@ int repair_io_failure(struct btrfs_fs_info *fs_info, u64 start,
         if (btrfs_is_parity_mirror(map_tree, logical, length, mirror_num))
                 return 0;
 
-        bio = bio_alloc(GFP_NOFS, 1);
+        bio = btrfs_io_bio_alloc(GFP_NOFS, 1);
         if (!bio)
                 return -EIO;
         bio->bi_private = &compl;
@@ -2336,7 +2327,7 @@ static int bio_readpage_error(struct bio *failed_bio, struct page *page,
                 return -EIO;
         }
 
-        bio = bio_alloc(GFP_NOFS, 1);
+        bio = btrfs_io_bio_alloc(GFP_NOFS, 1);
         if (!bio) {
                 free_io_failure(inode, failrec, 0);
                 return -EIO;
@@ -2398,19 +2389,24 @@ static void end_bio_extent_writepage(struct bio *bio, int err)
         struct extent_io_tree *tree;
         u64 start;
         u64 end;
-        int whole_page;
 
         do {
                 struct page *page = bvec->bv_page;
                 tree = &BTRFS_I(page->mapping->host)->io_tree;
 
-                start = page_offset(page) + bvec->bv_offset;
-                end = start + bvec->bv_len - 1;
+                /* We always issue full-page reads, but if some block
+                 * in a page fails to read, blk_update_request() will
+                 * advance bv_offset and adjust bv_len to compensate.
+                 * Print a warning for nonzero offsets, and an error
+                 * if they don't add up to a full page.  */
+                if (bvec->bv_offset || bvec->bv_len != PAGE_CACHE_SIZE)
+                        printk("%s page write in btrfs with offset %u and length %u\n",
+                               bvec->bv_offset + bvec->bv_len != PAGE_CACHE_SIZE
+                               ? KERN_ERR "partial" : KERN_INFO "incomplete",
+                               bvec->bv_offset, bvec->bv_len);
 
-                if (bvec->bv_offset == 0 && bvec->bv_len == PAGE_CACHE_SIZE)
-                        whole_page = 1;
-                else
-                        whole_page = 0;
+                start = page_offset(page);
+                end = start + bvec->bv_offset + bvec->bv_len - 1;
 
                 if (--bvec >= bio->bi_io_vec)
                         prefetchw(&bvec->bv_page->flags);
@@ -2418,10 +2414,7 @@ static void end_bio_extent_writepage(struct bio *bio, int err)
                 if (end_extent_writepage(page, err, start, end))
                         continue;
 
-                if (whole_page)
-                        end_page_writeback(page);
-                else
-                        check_page_writeback(tree, page);
+                end_page_writeback(page);
         } while (bvec >= bio->bi_io_vec);
 
         bio_put(bio);
@@ -2446,7 +2439,6 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
         struct extent_io_tree *tree;
         u64 start;
         u64 end;
-        int whole_page;
         int mirror;
         int ret;
 
@@ -2457,19 +2449,26 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                 struct page *page = bvec->bv_page;
                 struct extent_state *cached = NULL;
                 struct extent_state *state;
+                struct btrfs_io_bio *io_bio = btrfs_io_bio(bio);
 
                 pr_debug("end_bio_extent_readpage: bi_sector=%llu, err=%d, "
-                         "mirror=%ld\n", (u64)bio->bi_sector, err,
-                         (long int)bio->bi_bdev);
+                         "mirror=%lu\n", (u64)bio->bi_sector, err,
+                         io_bio->mirror_num);
                 tree = &BTRFS_I(page->mapping->host)->io_tree;
 
-                start = page_offset(page) + bvec->bv_offset;
-                end = start + bvec->bv_len - 1;
+                /* We always issue full-page reads, but if some block
+                 * in a page fails to read, blk_update_request() will
+                 * advance bv_offset and adjust bv_len to compensate.
+                 * Print a warning for nonzero offsets, and an error
+                 * if they don't add up to a full page.  */
+                if (bvec->bv_offset || bvec->bv_len != PAGE_CACHE_SIZE)
+                        printk("%s page read in btrfs with offset %u and length %u\n",
+                               bvec->bv_offset + bvec->bv_len != PAGE_CACHE_SIZE
+                               ? KERN_ERR "partial" : KERN_INFO "incomplete",
+                               bvec->bv_offset, bvec->bv_len);
 
-                if (bvec->bv_offset == 0 && bvec->bv_len == PAGE_CACHE_SIZE)
-                        whole_page = 1;
-                else
-                        whole_page = 0;
+                start = page_offset(page);
+                end = start + bvec->bv_offset + bvec->bv_len - 1;
 
                 if (++bvec <= bvec_end)
                         prefetchw(&bvec->bv_page->flags);
@@ -2485,7 +2484,7 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                 }
                 spin_unlock(&tree->lock);
 
-                mirror = (int)(unsigned long)bio->bi_bdev;
+                mirror = io_bio->mirror_num;
                 if (uptodate && tree->ops && tree->ops->readpage_end_io_hook) {
                         ret = tree->ops->readpage_end_io_hook(page, start, end,
                                                               state, mirror);
@@ -2528,39 +2527,35 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                 }
                 unlock_extent_cached(tree, start, end, &cached, GFP_ATOMIC);
 
-                if (whole_page) {
-                        if (uptodate) {
-                                SetPageUptodate(page);
-                        } else {
-                                ClearPageUptodate(page);
-                                SetPageError(page);
-                        }
-                        unlock_page(page);
+                if (uptodate) {
+                        SetPageUptodate(page);
                 } else {
-                        if (uptodate) {
-                                check_page_uptodate(tree, page);
-                        } else {
-                                ClearPageUptodate(page);
-                                SetPageError(page);
-                        }
-                        check_page_locked(tree, page);
+                        ClearPageUptodate(page);
+                        SetPageError(page);
                 }
+                unlock_page(page);
         } while (bvec <= bvec_end);
 
         bio_put(bio);
 }
 
+/*
+ * this allocates from the btrfs_bioset.  We're returning a bio right now
+ * but you can call btrfs_io_bio for the appropriate container_of magic
+ */
 struct bio *
 btrfs_bio_alloc(struct block_device *bdev, u64 first_sector, int nr_vecs,
                 gfp_t gfp_flags)
 {
         struct bio *bio;
 
-        bio = bio_alloc(gfp_flags, nr_vecs);
+        bio = bio_alloc_bioset(gfp_flags, nr_vecs, btrfs_bioset);
 
         if (bio == NULL && (current->flags & PF_MEMALLOC)) {
-                while (!bio && (nr_vecs /= 2))
-                        bio = bio_alloc(gfp_flags, nr_vecs);
+                while (!bio && (nr_vecs /= 2)) {
+                        bio = bio_alloc_bioset(gfp_flags,
+                                               nr_vecs, btrfs_bioset);
+                }
         }
 
         if (bio) {
@@ -2571,6 +2566,19 @@ btrfs_bio_alloc(struct block_device *bdev, u64 first_sector, int nr_vecs,
         return bio;
 }
 
+struct bio *btrfs_bio_clone(struct bio *bio, gfp_t gfp_mask)
+{
+        return bio_clone_bioset(bio, gfp_mask, btrfs_bioset);
+}
+
+
+/* this also allocates from the btrfs_bioset */
+struct bio *btrfs_io_bio_alloc(gfp_t gfp_mask, unsigned int nr_iovecs)
+{
+        return bio_alloc_bioset(gfp_mask, nr_iovecs, btrfs_bioset);
+}
+
+
 static int __must_check submit_one_bio(int rw, struct bio *bio,
                                        int mirror_num, unsigned long bio_flags)
 {
@@ -3988,7 +3996,7 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                 last_for_get_extent = isize;
         }
 
-        lock_extent_bits(&BTRFS_I(inode)->io_tree, start, start + len, 0,
+        lock_extent_bits(&BTRFS_I(inode)->io_tree, start, start + len - 1, 0,
                          &cached_state);
 
         em = get_extent_skip_holes(inode, start, last_for_get_extent,
@@ -4075,7 +4083,7 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 out_free:
         free_extent_map(em);
 out:
-        unlock_extent_cached(&BTRFS_I(inode)->io_tree, start, start + len,
+        unlock_extent_cached(&BTRFS_I(inode)->io_tree, start, start + len - 1,
                              &cached_state, GFP_NOFS);
         return ret;
 }
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index a2c03a175009..41fb81e7ec53 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -336,6 +336,8 @@ int extent_clear_unlock_delalloc(struct inode *inode,
 struct bio *
 btrfs_bio_alloc(struct block_device *bdev, u64 first_sector, int nr_vecs,
                 gfp_t gfp_flags);
+struct bio *btrfs_io_bio_alloc(gfp_t gfp_mask, unsigned int nr_iovecs);
+struct bio *btrfs_bio_clone(struct bio *bio, gfp_t gfp_mask);
 
 struct btrfs_fs_info;
 
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index ecca6c7375a6..e53009657f0e 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -197,30 +197,32 @@ int create_free_space_inode(struct btrfs_root *root,
                                          block_group->key.objectid);
 }
 
-int btrfs_truncate_free_space_cache(struct btrfs_root *root,
-                                    struct btrfs_trans_handle *trans,
-                                    struct btrfs_path *path,
-                                    struct inode *inode)
+int btrfs_check_trunc_cache_free_space(struct btrfs_root *root,
+                                       struct btrfs_block_rsv *rsv)
 {
-        struct btrfs_block_rsv *rsv;
         u64 needed_bytes;
-        loff_t oldsize;
-        int ret = 0;
-
-        rsv = trans->block_rsv;
-        trans->block_rsv = &root->fs_info->global_block_rsv;
+        int ret;
 
         /* 1 for slack space, 1 for updating the inode */
         needed_bytes = btrfs_calc_trunc_metadata_size(root, 1) +
                 btrfs_calc_trans_metadata_size(root, 1);
 
-        spin_lock(&trans->block_rsv->lock);
-        if (trans->block_rsv->reserved < needed_bytes) {
-                spin_unlock(&trans->block_rsv->lock);
-                trans->block_rsv = rsv;
-                return -ENOSPC;
-        }
-        spin_unlock(&trans->block_rsv->lock);
+        spin_lock(&rsv->lock);
+        if (rsv->reserved < needed_bytes)
+                ret = -ENOSPC;
+        else
+                ret = 0;
+        spin_unlock(&rsv->lock);
+        return 0;
+}
+
+int btrfs_truncate_free_space_cache(struct btrfs_root *root,
+                                    struct btrfs_trans_handle *trans,
+                                    struct btrfs_path *path,
+                                    struct inode *inode)
+{
+        loff_t oldsize;
+        int ret = 0;
 
         oldsize = i_size_read(inode);
         btrfs_i_size_write(inode, 0);
@@ -232,9 +234,7 @@ int btrfs_truncate_free_space_cache(struct btrfs_root *root,
          */
         ret = btrfs_truncate_inode_items(trans, root, inode,
                                          0, BTRFS_EXTENT_DATA_KEY);
-
         if (ret) {
-                trans->block_rsv = rsv;
                 btrfs_abort_transaction(trans, root, ret);
                 return ret;
         }
@@ -242,7 +242,6 @@ int btrfs_truncate_free_space_cache(struct btrfs_root *root,
         ret = btrfs_update_inode(trans, root, inode);
         if (ret)
                 btrfs_abort_transaction(trans, root, ret);
-        trans->block_rsv = rsv;
 
         return ret;
 }
@@ -920,10 +919,8 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,
 
         /* Make sure we can fit our crcs into the first page */
         if (io_ctl.check_crcs &&
-            (io_ctl.num_pages * sizeof(u32)) >= PAGE_CACHE_SIZE) {
-                WARN_ON(1);
+            (io_ctl.num_pages * sizeof(u32)) >= PAGE_CACHE_SIZE)
                 goto out_nospc;
-        }
 
         io_ctl_set_generation(&io_ctl, trans->transid);
 
diff --git a/fs/btrfs/free-space-cache.h b/fs/btrfs/free-space-cache.h
index 4dc17d8809c7..8b7f19f44961 100644
--- a/fs/btrfs/free-space-cache.h
+++ b/fs/btrfs/free-space-cache.h
@@ -54,6 +54,8 @@ int create_free_space_inode(struct btrfs_root *root,
                             struct btrfs_block_group_cache *block_group,
                             struct btrfs_path *path);
 
+int btrfs_check_trunc_cache_free_space(struct btrfs_root *root,
+                                       struct btrfs_block_rsv *rsv);
 int btrfs_truncate_free_space_cache(struct btrfs_root *root,
                                     struct btrfs_trans_handle *trans,
                                     struct btrfs_path *path,
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index d26f67a59e36..2c66ddbbe670 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -429,11 +429,12 @@ int btrfs_save_ino_cache(struct btrfs_root *root,
         num_bytes = trans->bytes_reserved;
         /*
          * 1 item for inode item insertion if need
-         * 3 items for inode item update (in the worst case)
+         * 4 items for inode item update (in the worst case)
+         * 1 items for slack space if we need do truncation
          * 1 item for free space object
          * 3 items for pre-allocation
          */
-        trans->bytes_reserved = btrfs_calc_trans_metadata_size(root, 8);
+        trans->bytes_reserved = btrfs_calc_trans_metadata_size(root, 10);
         ret = btrfs_block_rsv_add(root, trans->block_rsv,
                                   trans->bytes_reserved,
                                   BTRFS_RESERVE_NO_FLUSH);
@@ -468,7 +469,8 @@ again:
         if (i_size_read(inode) > 0) {
                 ret = btrfs_truncate_free_space_cache(root, trans, path, inode);
                 if (ret) {
-                        btrfs_abort_transaction(trans, root, ret);
+                        if (ret != -ENOSPC)
+                                btrfs_abort_transaction(trans, root, ret);
                         goto out_put;
                 }
         }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 9b31b3b091fc..17f3064b4a3e 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -715,8 +715,10 @@ retry:
                                         async_extent->ram_size - 1, 0);
 
                 em = alloc_extent_map();
-                if (!em)
+                if (!em) {
+                        ret = -ENOMEM;
                         goto out_free_reserve;
+                }
                 em->start = async_extent->start;
                 em->len = async_extent->ram_size;
                 em->orig_start = em->start;
@@ -923,8 +925,10 @@ static noinline int __cow_file_range(struct btrfs_trans_handle *trans,
                 }
 
                 em = alloc_extent_map();
-                if (!em)
+                if (!em) {
+                        ret = -ENOMEM;
                         goto out_reserve;
+                }
                 em->start = start;
                 em->orig_start = em->start;
                 ram_size = ins.offset;
@@ -4724,6 +4728,7 @@ void btrfs_evict_inode(struct inode *inode)
         btrfs_end_transaction(trans, root);
         btrfs_btree_balance_dirty(root);
 no_delete:
+        btrfs_remove_delayed_node(inode);
         clear_inode(inode);
         return;
 }
@@ -4839,14 +4844,13 @@ static void inode_tree_add(struct inode *inode)
         struct rb_node **p;
         struct rb_node *parent;
         u64 ino = btrfs_ino(inode);
-again:
-        p = &root->inode_tree.rb_node;
-        parent = NULL;
 
         if (inode_unhashed(inode))
                 return;
-
+again:
+        parent = NULL;
         spin_lock(&root->inode_lock);
+        p = &root->inode_tree.rb_node;
         while (*p) {
                 parent = *p;
                 entry = rb_entry(parent, struct btrfs_inode, rb_node);
@@ -6928,7 +6932,11 @@ struct btrfs_dio_private {
         /* IO errors */
         int errors;
 
+        /* orig_bio is our btrfs_io_bio */
         struct bio *orig_bio;
+
+        /* dio_bio came from fs/direct-io.c */
+        struct bio *dio_bio;
 };
 
 static void btrfs_endio_direct_read(struct bio *bio, int err)
@@ -6938,6 +6946,7 @@ static void btrfs_endio_direct_read(struct bio *bio, int err)
         struct bio_vec *bvec = bio->bi_io_vec;
         struct inode *inode = dip->inode;
         struct btrfs_root *root = BTRFS_I(inode)->root;
+        struct bio *dio_bio;
         u64 start;
 
         start = dip->logical_offset;
@@ -6977,14 +6986,15 @@ failed:
 
         unlock_extent(&BTRFS_I(inode)->io_tree, dip->logical_offset,
                       dip->logical_offset + dip->bytes - 1);
-        bio->bi_private = dip->private;
+        dio_bio = dip->dio_bio;
 
         kfree(dip);
 
         /* If we had a csum failure make sure to clear the uptodate flag */
         if (err)
-                clear_bit(BIO_UPTODATE, &bio->bi_flags);
-        dio_end_io(bio, err);
+                clear_bit(BIO_UPTODATE, &dio_bio->bi_flags);
+        dio_end_io(dio_bio, err);
+        bio_put(bio);
 }
 
 static void btrfs_endio_direct_write(struct bio *bio, int err)
@@ -6995,6 +7005,7 @@ static void btrfs_endio_direct_write(struct bio *bio, int err)
         struct btrfs_ordered_extent *ordered = NULL;
         u64 ordered_offset = dip->logical_offset;
         u64 ordered_bytes = dip->bytes;
+        struct bio *dio_bio;
         int ret;
 
         if (err)
@@ -7022,14 +7033,15 @@ out_test:
                 goto again;
         }
 out_done:
-        bio->bi_private = dip->private;
+        dio_bio = dip->dio_bio;
 
         kfree(dip);
 
         /* If we had an error make sure to clear the uptodate flag */
         if (err)
-                clear_bit(BIO_UPTODATE, &bio->bi_flags);
-        dio_end_io(bio, err);
+                clear_bit(BIO_UPTODATE, &dio_bio->bi_flags);
+        dio_end_io(dio_bio, err);
+        bio_put(bio);
 }
 
 static int __btrfs_submit_bio_start_direct_io(struct inode *inode, int rw,
@@ -7065,10 +7077,10 @@ static void btrfs_end_dio_bio(struct bio *bio, int err)
         if (!atomic_dec_and_test(&dip->pending_bios))
                 goto out;
 
-        if (dip->errors)
+        if (dip->errors) {
                 bio_io_error(dip->orig_bio);
-        else {
-                set_bit(BIO_UPTODATE, &dip->orig_bio->bi_flags);
+        } else {
+                set_bit(BIO_UPTODATE, &dip->dio_bio->bi_flags);
                 bio_endio(dip->orig_bio, 0);
         }
 out:
@@ -7243,25 +7255,34 @@ out_err:
         return 0;
 }
 
-static void btrfs_submit_direct(int rw, struct bio *bio, struct inode *inode,
-                                loff_t file_offset)
+static void btrfs_submit_direct(int rw, struct bio *dio_bio,
+                                struct inode *inode, loff_t file_offset)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_dio_private *dip;
-        struct bio_vec *bvec = bio->bi_io_vec;
+        struct bio_vec *bvec = dio_bio->bi_io_vec;
+        struct bio *io_bio;
         int skip_sum;
         int write = rw & REQ_WRITE;
         int ret = 0;
 
         skip_sum = BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM;
 
+        io_bio = btrfs_bio_clone(dio_bio, GFP_NOFS);
+
+        if (!io_bio) {
+                ret = -ENOMEM;
+                goto free_ordered;
+        }
+
         dip = kmalloc(sizeof(*dip), GFP_NOFS);
         if (!dip) {
                 ret = -ENOMEM;
-                goto free_ordered;
+                goto free_io_bio;
         }
 
-        dip->private = bio->bi_private;
+        dip->private = dio_bio->bi_private;
+        io_bio->bi_private = dio_bio->bi_private;
         dip->inode = inode;
         dip->logical_offset = file_offset;
 
@@ -7269,22 +7290,27 @@ static void btrfs_submit_direct(int rw, struct bio *bio, struct inode *inode,
         do {
                 dip->bytes += bvec->bv_len;
                 bvec++;
-        } while (bvec <= (bio->bi_io_vec + bio->bi_vcnt - 1));
+        } while (bvec <= (dio_bio->bi_io_vec + dio_bio->bi_vcnt - 1));
 
-        dip->disk_bytenr = (u64)bio->bi_sector << 9;
-        bio->bi_private = dip;
+        dip->disk_bytenr = (u64)dio_bio->bi_sector << 9;
+        io_bio->bi_private = dip;
         dip->errors = 0;
-        dip->orig_bio = bio;
+        dip->orig_bio = io_bio;
+        dip->dio_bio = dio_bio;
         atomic_set(&dip->pending_bios, 0);
 
         if (write)
-                bio->bi_end_io = btrfs_endio_direct_write;
+                io_bio->bi_end_io = btrfs_endio_direct_write;
         else
-                bio->bi_end_io = btrfs_endio_direct_read;
+                io_bio->bi_end_io = btrfs_endio_direct_read;
 
         ret = btrfs_submit_direct_hook(rw, dip, skip_sum);
         if (!ret)
                 return;
+
+free_io_bio:
+        bio_put(io_bio);
+
 free_ordered:
         /*
          * If this is a write, we need to clean up the reserved space and kill
@@ -7300,7 +7326,7 @@ free_ordered:
                 btrfs_put_ordered_extent(ordered);
                 btrfs_put_ordered_extent(ordered);
         }
-        bio_endio(bio, ret);
+        bio_endio(dio_bio, ret);
 }
 
 static ssize_t check_direct_IO(struct btrfs_root *root, int rw, struct kiocb *iocb,
@@ -7979,7 +8005,6 @@ void btrfs_destroy_inode(struct inode *inode)
         inode_tree_del(inode);
         btrfs_drop_extent_cache(inode, 0, (u64)-1, 0);
 free:
-        btrfs_remove_delayed_node(inode);
         call_rcu(&inode->i_rcu, btrfs_i_callback);
 }
 
@@ -7987,6 +8012,9 @@ int btrfs_drop_inode(struct inode *inode)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
 
+        if (root == NULL)
+                return 1;
+
         /* the snap/subvol tree is on deleting */
         if (btrfs_root_refs(&root->root_item) == 0 &&
             root != root->fs_info->tree_root)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 0de4a2fcfb24..0f81d67cdc8d 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1801,7 +1801,11 @@ static noinline int copy_to_sk(struct btrfs_root *root,
                 item_off = btrfs_item_ptr_offset(leaf, i);
                 item_len = btrfs_item_size_nr(leaf, i);
 
-                if (item_len > BTRFS_SEARCH_ARGS_BUFSIZE)
+                btrfs_item_key_to_cpu(leaf, key, i);
+                if (!key_in_sk(key, sk))
+                        continue;
+
+                if (sizeof(sh) + item_len > BTRFS_SEARCH_ARGS_BUFSIZE)
                         item_len = 0;
 
                 if (sizeof(sh) + item_len + *sk_offset >
@@ -1810,10 +1814,6 @@ static noinline int copy_to_sk(struct btrfs_root *root,
                         goto overflow;
                 }
 
-                btrfs_item_key_to_cpu(leaf, key, i);
-                if (!key_in_sk(key, sk))
-                        continue;
-
                 sh.objectid = key->objectid;
                 sh.offset = key->offset;
                 sh.type = key->type;
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index 0740621daf6c..0525e1389f5b 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -1050,7 +1050,7 @@ static int rbio_add_io_page(struct btrfs_raid_bio *rbio,
         }
 
         /* put a new bio on the list */
-        bio = bio_alloc(GFP_NOFS, bio_max_len >> PAGE_SHIFT?:1);
+        bio = btrfs_io_bio_alloc(GFP_NOFS, bio_max_len >> PAGE_SHIFT?:1);
         if (!bio)
                 return -ENOMEM;
 
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 704a1b8d2a2b..4febca4fc2de 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1773,7 +1773,7 @@ again:
                         if (!eb || !extent_buffer_uptodate(eb)) {
                                 ret = (!eb) ? -ENOMEM : -EIO;
                                 free_extent_buffer(eb);
-                                return ret;
+                                break;
                         }
                         btrfs_tree_lock(eb);
                         if (cow) {
@@ -3350,6 +3350,11 @@ static int delete_block_group_cache(struct btrfs_fs_info *fs_info,
         }
 
 truncate:
+        ret = btrfs_check_trunc_cache_free_space(root,
+                                                 &fs_info->global_block_rsv);
+        if (ret)
+                goto out;
+
         path = btrfs_alloc_path();
         if (!path) {
                 ret = -ENOMEM;
@@ -4077,7 +4082,7 @@ out:
         return inode;
 }
 
-static struct reloc_control *alloc_reloc_control(void)
+static struct reloc_control *alloc_reloc_control(struct btrfs_fs_info *fs_info)
 {
         struct reloc_control *rc;
 
@@ -4088,7 +4093,8 @@ static struct reloc_control *alloc_reloc_control(void)
         INIT_LIST_HEAD(&rc->reloc_roots);
         backref_cache_init(&rc->backref_cache);
         mapping_tree_init(&rc->reloc_root_tree);
-        extent_io_tree_init(&rc->processed_blocks, NULL);
+        extent_io_tree_init(&rc->processed_blocks,
+                            fs_info->btree_inode->i_mapping);
         return rc;
 }
 
@@ -4105,7 +4111,7 @@ int btrfs_relocate_block_group(struct btrfs_root *extent_root, u64 group_start)
         int rw = 0;
         int err = 0;
 
-        rc = alloc_reloc_control();
+        rc = alloc_reloc_control(fs_info);
         if (!rc)
                 return -ENOMEM;
 
@@ -4306,7 +4312,7 @@ int btrfs_recover_relocation(struct btrfs_root *root)
         if (list_empty(&reloc_roots))
                 goto out;
 
-        rc = alloc_reloc_control();
+        rc = alloc_reloc_control(root->fs_info);
         if (!rc) {
                 err = -ENOMEM;
                 goto out;
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index f489e24659a4..79bd479317cb 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -1296,7 +1296,7 @@ static void scrub_recheck_block(struct btrfs_fs_info *fs_info,
                 }
 
                 WARN_ON(!page->page);
-                bio = bio_alloc(GFP_NOFS, 1);
+                bio = btrfs_io_bio_alloc(GFP_NOFS, 1);
                 if (!bio) {
                         page->io_error = 1;
                         sblock->no_io_error_seen = 0;
@@ -1431,7 +1431,7 @@ static int scrub_repair_page_from_good_copy(struct scrub_block *sblock_bad,
                         return -EIO;
                 }
 
-                bio = bio_alloc(GFP_NOFS, 1);
+                bio = btrfs_io_bio_alloc(GFP_NOFS, 1);
                 if (!bio)
                         return -EIO;
                 bio->bi_bdev = page_bad->dev->bdev;
@@ -1522,7 +1522,7 @@ again:
                 sbio->dev = wr_ctx->tgtdev;
                 bio = sbio->bio;
                 if (!bio) {
-                        bio = bio_alloc(GFP_NOFS, wr_ctx->pages_per_wr_bio);
+                        bio = btrfs_io_bio_alloc(GFP_NOFS, wr_ctx->pages_per_wr_bio);
                         if (!bio) {
                                 mutex_unlock(&wr_ctx->wr_lock);
                                 return -ENOMEM;
@@ -1930,7 +1930,7 @@ again:
                 sbio->dev = spage->dev;
                 bio = sbio->bio;
                 if (!bio) {
-                        bio = bio_alloc(GFP_NOFS, sctx->pages_per_rd_bio);
+                        bio = btrfs_io_bio_alloc(GFP_NOFS, sctx->pages_per_rd_bio);
                         if (!bio)
                                 return -ENOMEM;
                         sbio->bio = bio;
@@ -3307,7 +3307,7 @@ static int write_page_nocow(struct scrub_ctx *sctx,
                         "btrfs: scrub write_page_nocow(bdev == NULL) is unexpected!\n");
                 return -EIO;
         }
-        bio = bio_alloc(GFP_NOFS, 1);
+        bio = btrfs_io_bio_alloc(GFP_NOFS, 1);
         if (!bio) {
                 spin_lock(&sctx->stat_lock);
                 sctx->stat.malloc_errors++;
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index a4807ced23cc..f0857e092a3c 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1263,6 +1263,7 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
 
                 btrfs_dev_replace_suspend_for_unmount(fs_info);
                 btrfs_scrub_cancel(fs_info);
+                btrfs_pause_balance(fs_info);
 
                 ret = btrfs_commit_super(root);
                 if (ret)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 0e925ced971b..8bffb9174afb 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3120,14 +3120,13 @@ int btrfs_balance(struct btrfs_balance_control *bctl,
         allowed = BTRFS_AVAIL_ALLOC_BIT_SINGLE;
         if (num_devices == 1)
                 allowed |= BTRFS_BLOCK_GROUP_DUP;
-        else if (num_devices < 4)
+        else if (num_devices > 1)
                 allowed |= (BTRFS_BLOCK_GROUP_RAID0 | BTRFS_BLOCK_GROUP_RAID1);
-        else
-                allowed |= (BTRFS_BLOCK_GROUP_RAID0 | BTRFS_BLOCK_GROUP_RAID1 |
-                                BTRFS_BLOCK_GROUP_RAID10 |
-                                BTRFS_BLOCK_GROUP_RAID5 |
-                                BTRFS_BLOCK_GROUP_RAID6);
-
+        if (num_devices > 2)
+                allowed |= BTRFS_BLOCK_GROUP_RAID5;
+        if (num_devices > 3)
+                allowed |= (BTRFS_BLOCK_GROUP_RAID10 |
+                            BTRFS_BLOCK_GROUP_RAID6);
         if ((bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
             (!alloc_profile_is_valid(bctl->data.target, 1) ||
              (bctl->data.target & ~allowed))) {
@@ -5019,42 +5018,16 @@ int btrfs_rmap_block(struct btrfs_mapping_tree *map_tree,
         return 0;
 }
 
-static void *merge_stripe_index_into_bio_private(void *bi_private,
-                                                 unsigned int stripe_index)
-{
-        /*
-         * with single, dup, RAID0, RAID1 and RAID10, stripe_index is
-         * at most 1.
-         * The alternative solution (instead of stealing bits from the
-         * pointer) would be to allocate an intermediate structure
-         * that contains the old private pointer plus the stripe_index.
-         */
-        BUG_ON((((uintptr_t)bi_private) & 3) != 0);
-        BUG_ON(stripe_index > 3);
-        return (void *)(((uintptr_t)bi_private) | stripe_index);
-}
-
-static struct btrfs_bio *extract_bbio_from_bio_private(void *bi_private)
-{
-        return (struct btrfs_bio *)(((uintptr_t)bi_private) & ~((uintptr_t)3));
-}
-
-static unsigned int extract_stripe_index_from_bio_private(void *bi_private)
-{
-        return (unsigned int)((uintptr_t)bi_private) & 3;
-}
-
 static void btrfs_end_bio(struct bio *bio, int err)
 {
-        struct btrfs_bio *bbio = extract_bbio_from_bio_private(bio->bi_private);
+        struct btrfs_bio *bbio = bio->bi_private;
         int is_orig_bio = 0;
 
         if (err) {
                 atomic_inc(&bbio->error);
                 if (err == -EIO || err == -EREMOTEIO) {
                         unsigned int stripe_index =
-                                extract_stripe_index_from_bio_private(
-                                        bio->bi_private);
+                                btrfs_io_bio(bio)->stripe_index;
                         struct btrfs_device *dev;
 
                         BUG_ON(stripe_index >= bbio->num_stripes);
@@ -5084,8 +5057,7 @@ static void btrfs_end_bio(struct bio *bio, int err)
                 }
                 bio->bi_private = bbio->private;
                 bio->bi_end_io = bbio->end_io;
-                bio->bi_bdev = (struct block_device *)
-                                        (unsigned long)bbio->mirror_num;
+                btrfs_io_bio(bio)->mirror_num = bbio->mirror_num;
                 /* only send an error to the higher layers if it is
                  * beyond the tolerance of the btrfs bio
                  */
@@ -5211,8 +5183,7 @@ static void submit_stripe_bio(struct btrfs_root *root, struct btrfs_bio *bbio,
         struct btrfs_device *dev = bbio->stripes[dev_nr].dev;
 
         bio->bi_private = bbio;
-        bio->bi_private = merge_stripe_index_into_bio_private(
-                        bio->bi_private, (unsigned int)dev_nr);
+        btrfs_io_bio(bio)->stripe_index = dev_nr;
         bio->bi_end_io = btrfs_end_bio;
         bio->bi_sector = physical >> 9;
 #ifdef DEBUG
@@ -5273,8 +5244,7 @@ static void bbio_error(struct btrfs_bio *bbio, struct bio *bio, u64 logical)
         if (atomic_dec_and_test(&bbio->stripes_pending)) {
                 bio->bi_private = bbio->private;
                 bio->bi_end_io = bbio->end_io;
-                bio->bi_bdev = (struct block_device *)
-                        (unsigned long)bbio->mirror_num;
+                btrfs_io_bio(bio)->mirror_num = bbio->mirror_num;
                 bio->bi_sector = logical >> 9;
                 kfree(bbio);
                 bio_endio(bio, -EIO);
@@ -5352,7 +5322,7 @@ int btrfs_map_bio(struct btrfs_root *root, int rw, struct bio *bio,
                 }
 
                 if (dev_nr < total_devs - 1) {
-                        bio = bio_clone(first_bio, GFP_NOFS);
+                        bio = btrfs_bio_clone(first_bio, GFP_NOFS);
                         BUG_ON(!bio); /* -ENOMEM */
                 } else {
                         bio = first_bio;
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 845ccbb0d2e3..f6247e2a47f7 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -152,6 +152,26 @@ struct btrfs_fs_devices {
         int rotating;
 };
 
+/*
+ * we need the mirror number and stripe index to be passed around
+ * the call chain while we are processing end_io (especially errors).
+ * Really, what we need is a btrfs_bio structure that has this info
+ * and is properly sized with its stripe array, but we're not there
+ * quite yet.  We have our own btrfs bioset, and all of the bios
+ * we allocate are actually btrfs_io_bios.  We'll cram as much of
+ * struct btrfs_bio as we can into this over time.
+ */
+struct btrfs_io_bio {
+        unsigned long mirror_num;
+        unsigned long stripe_index;
+        struct bio bio;
+};
+
+static inline struct btrfs_io_bio *btrfs_io_bio(struct bio *bio)
+{
+        return container_of(bio, struct btrfs_io_bio, bio);
+}
+
 struct btrfs_bio_stripe {
         struct btrfs_device *dev;
         u64 physical;
diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
index 202dd3d68be0..ebbf680378e2 100644
--- a/fs/ceph/locks.c
+++ b/fs/ceph/locks.c
@@ -191,27 +191,23 @@ void ceph_count_locks(struct inode *inode, int *fcntl_count, int *flock_count)
 }
 
 /**
- * Encode the flock and fcntl locks for the given inode into the pagelist.
- * Format is: #fcntl locks, sequential fcntl locks, #flock locks,
- * sequential flock locks.
- * Must be called with lock_flocks() already held.
- * If we encounter more of a specific lock type than expected,
- * we return the value 1.
+ * Encode the flock and fcntl locks for the given inode into the ceph_filelock
+ * array. Must be called with lock_flocks() already held.
+ * If we encounter more of a specific lock type than expected, return -ENOSPC.
  */
-int ceph_encode_locks(struct inode *inode, struct ceph_pagelist *pagelist,
-                      int num_fcntl_locks, int num_flock_locks)
+int ceph_encode_locks_to_buffer(struct inode *inode,
+                                struct ceph_filelock *flocks,
+                                int num_fcntl_locks, int num_flock_locks)
 {
         struct file_lock *lock;
-        struct ceph_filelock cephlock;
         int err = 0;
         int seen_fcntl = 0;
         int seen_flock = 0;
+        int l = 0;
 
         dout("encoding %d flock and %d fcntl locks", num_flock_locks,
              num_fcntl_locks);
-        err = ceph_pagelist_append(pagelist, &num_fcntl_locks, sizeof(u32));
-        if (err)
-                goto fail;
+
         for (lock = inode->i_flock; lock != NULL; lock = lock->fl_next) {
                 if (lock->fl_flags & FL_POSIX) {
                         ++seen_fcntl;
@@ -219,19 +215,12 @@ int ceph_encode_locks(struct inode *inode, struct ceph_pagelist *pagelist,
                                 err = -ENOSPC;
                                 goto fail;
                         }
-                        err = lock_to_ceph_filelock(lock, &cephlock);
+                        err = lock_to_ceph_filelock(lock, &flocks[l]);
                         if (err)
                                 goto fail;
-                        err = ceph_pagelist_append(pagelist, &cephlock,
-                                           sizeof(struct ceph_filelock));
+                        ++l;
                 }
-                if (err)
-                        goto fail;
         }
-
-        err = ceph_pagelist_append(pagelist, &num_flock_locks, sizeof(u32));
-        if (err)
-                goto fail;
         for (lock = inode->i_flock; lock != NULL; lock = lock->fl_next) {
                 if (lock->fl_flags & FL_FLOCK) {
                         ++seen_flock;
@@ -239,19 +228,51 @@ int ceph_encode_locks(struct inode *inode, struct ceph_pagelist *pagelist,
                                 err = -ENOSPC;
                                 goto fail;
                         }
-                        err = lock_to_ceph_filelock(lock, &cephlock);
+                        err = lock_to_ceph_filelock(lock, &flocks[l]);
                         if (err)
                                 goto fail;
-                        err = ceph_pagelist_append(pagelist, &cephlock,
-                                           sizeof(struct ceph_filelock));
+                        ++l;
                 }
-                if (err)
-                        goto fail;
         }
 fail:
         return err;
 }
 
+/**
+ * Copy the encoded flock and fcntl locks into the pagelist.
+ * Format is: #fcntl locks, sequential fcntl locks, #flock locks,
+ * sequential flock locks.
+ * Returns zero on success.
+ */
+int ceph_locks_to_pagelist(struct ceph_filelock *flocks,
+                           struct ceph_pagelist *pagelist,
+                           int num_fcntl_locks, int num_flock_locks)
+{
+        int err = 0;
+        __le32 nlocks;
+
+        nlocks = cpu_to_le32(num_fcntl_locks);
+        err = ceph_pagelist_append(pagelist, &nlocks, sizeof(nlocks));
+        if (err)
+                goto out_fail;
+
+        err = ceph_pagelist_append(pagelist, flocks,
+                                   num_fcntl_locks * sizeof(*flocks));
+        if (err)
+                goto out_fail;
+
+        nlocks = cpu_to_le32(num_flock_locks);
+        err = ceph_pagelist_append(pagelist, &nlocks, sizeof(nlocks));
+        if (err)
+                goto out_fail;
+
+        err = ceph_pagelist_append(pagelist,
+                                   &flocks[num_fcntl_locks],
+                                   num_flock_locks * sizeof(*flocks));
+out_fail:
+        return err;
+}
+
 /*
  * Given a pointer to a lock, convert it to a ceph filelock
  */
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 4f22671a5bd4..4d2920304be8 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2478,39 +2478,44 @@ static int encode_caps_cb(struct inode *inode, struct ceph_cap *cap,
 
         if (recon_state->flock) {
                 int num_fcntl_locks, num_flock_locks;
-                struct ceph_pagelist_cursor trunc_point;
-
-                ceph_pagelist_set_cursor(pagelist, &trunc_point);
-                do {
-                        lock_flocks();
-                        ceph_count_locks(inode, &num_fcntl_locks,
-                                         &num_flock_locks);
-                        rec.v2.flock_len = (2*sizeof(u32) +
-                                            (num_fcntl_locks+num_flock_locks) *
-                                            sizeof(struct ceph_filelock));
-                        unlock_flocks();
-
-                        /* pre-alloc pagelist */
-                        ceph_pagelist_truncate(pagelist, &trunc_point);
-                        err = ceph_pagelist_append(pagelist, &rec, reclen);
-                        if (!err)
-                                err = ceph_pagelist_reserve(pagelist,
-                                                            rec.v2.flock_len);
-
-                        /* encode locks */
-                        if (!err) {
-                                lock_flocks();
-                                err = ceph_encode_locks(inode,
-                                                        pagelist,
-                                                        num_fcntl_locks,
-                                                        num_flock_locks);
-                                unlock_flocks();
-                        }
-                } while (err == -ENOSPC);
+                struct ceph_filelock *flocks;
+
+encode_again:
+                lock_flocks();
+                ceph_count_locks(inode, &num_fcntl_locks, &num_flock_locks);
+                unlock_flocks();
+                flocks = kmalloc((num_fcntl_locks+num_flock_locks) *
+                                 sizeof(struct ceph_filelock), GFP_NOFS);
+                if (!flocks) {
+                        err = -ENOMEM;
+                        goto out_free;
+                }
+                lock_flocks();
+                err = ceph_encode_locks_to_buffer(inode, flocks,
+                                                  num_fcntl_locks,
+                                                  num_flock_locks);
+                unlock_flocks();
+                if (err) {
+                        kfree(flocks);
+                        if (err == -ENOSPC)
+                                goto encode_again;
+                        goto out_free;
+                }
+                /*
+                 * number of encoded locks is stable, so copy to pagelist
+                 */
+                rec.v2.flock_len = cpu_to_le32(2*sizeof(u32) +
+                                    (num_fcntl_locks+num_flock_locks) *
+                                    sizeof(struct ceph_filelock));
+                err = ceph_pagelist_append(pagelist, &rec, reclen);
+                if (!err)
+                        err = ceph_locks_to_pagelist(flocks, pagelist,
+                                                     num_fcntl_locks,
+                                                     num_flock_locks);
+                kfree(flocks);
         } else {
                 err = ceph_pagelist_append(pagelist, &rec, reclen);
         }
-
 out_free:
         kfree(path);
 out_dput:
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 8696be2ff679..7ccfdb4aea2e 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -822,8 +822,13 @@ extern const struct export_operations ceph_export_ops;
 extern int ceph_lock(struct file *file, int cmd, struct file_lock *fl);
 extern int ceph_flock(struct file *file, int cmd, struct file_lock *fl);
 extern void ceph_count_locks(struct inode *inode, int *p_num, int *f_num);
-extern int ceph_encode_locks(struct inode *i, struct ceph_pagelist *p,
-                             int p_locks, int f_locks);
+extern int ceph_encode_locks_to_buffer(struct inode *inode,
+                                       struct ceph_filelock *flocks,
+                                       int num_fcntl_locks,
+                                       int num_flock_locks);
+extern int ceph_locks_to_pagelist(struct ceph_filelock *flocks,
+                                  struct ceph_pagelist *pagelist,
+                                  int num_fcntl_locks, int num_flock_locks);
 extern int lock_to_ceph_filelock(struct file_lock *fl, struct ceph_filelock *c);
 
 /* debugfs.c */
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index 8e33ec65847b..58df174deb10 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -18,6 +18,7 @@
 #include <linux/slab.h>
 #include <linux/vfs.h>
 #include <linux/fs.h>
+#include <linux/inet.h>
 #include "cifsglob.h"
 #include "cifsproto.h"
 #include "cifsfs.h"
@@ -48,58 +49,74 @@ void cifs_dfs_release_automount_timer(void)
 }
 
 /**
- * cifs_get_share_name  -       extracts share name from UNC
- * @node_name:  pointer to UNC string
+ * cifs_build_devname - build a devicename from a UNC and optional prepath
+ * @nodename:   pointer to UNC string
+ * @prepath:    pointer to prefixpath (or NULL if there isn't one)
  *
- * Extracts sharename form full UNC.
- * i.e. strips from UNC trailing path that is not part of share
- * name and fixup missing '\' in the beginning of DFS node refferal
- * if necessary.
- * Returns pointer to share name on success or ERR_PTR on error.
- * Caller is responsible for freeing returned string.
+ * Build a new cifs devicename after chasing a DFS referral. Allocate a buffer
+ * big enough to hold the final thing. Copy the UNC from the nodename, and
+ * concatenate the prepath onto the end of it if there is one.
+ *
+ * Returns pointer to the built string, or a ERR_PTR. Caller is responsible
+ * for freeing the returned string.
  */
-static char *cifs_get_share_name(const char *node_name)
+static char *
+cifs_build_devname(char *nodename, const char *prepath)
 {
-        int len;
-        char *UNC;
-        char *pSep;
-
-        len = strlen(node_name);
-        UNC = kmalloc(len+2 /*for term null and additional \ if it's missed */,
-                         GFP_KERNEL);
-        if (!UNC)
-                return ERR_PTR(-ENOMEM);
+        size_t pplen;
+        size_t unclen;
+        char *dev;
+        char *pos;
+
+        /* skip over any preceding delimiters */
+        nodename += strspn(nodename, "\\");
+        if (!*nodename)
+                return ERR_PTR(-EINVAL);
 
-        /* get share name and server name */
-        if (node_name[1] != '\\') {
-                UNC[0] = '\\';
-                strncpy(UNC+1, node_name, len);
-                len++;
-                UNC[len] = 0;
-        } else {
-                strncpy(UNC, node_name, len);
-                UNC[len] = 0;
-        }
+        /* get length of UNC and set pos to last char */
+        unclen = strlen(nodename);
+        pos = nodename + unclen - 1;
 
-        /* find server name end */
-        pSep = memchr(UNC+2, '\\', len-2);
-        if (!pSep) {
-                cifs_dbg(VFS, "%s: no server name end in node name: %s\n",
-                         __func__, node_name);
-                kfree(UNC);
-                return ERR_PTR(-EINVAL);
+        /* trim off any trailing delimiters */
+        while (*pos == '\\') {
+                --pos;
+                --unclen;
         }
 
-        /* find sharename end */
-        pSep++;
-        pSep = memchr(UNC+(pSep-UNC), '\\', len-(pSep-UNC));
-        if (pSep) {
-                /* trim path up to sharename end
-                 * now we have share name in UNC */
-                *pSep = 0;
+        /* allocate a buffer:
+         * +2 for preceding "//"
+         * +1 for delimiter between UNC and prepath
+         * +1 for trailing NULL
+         */
+        pplen = prepath ? strlen(prepath) : 0;
+        dev = kmalloc(2 + unclen + 1 + pplen + 1, GFP_KERNEL);
+        if (!dev)
+                return ERR_PTR(-ENOMEM);
+
+        pos = dev;
+        /* add the initial "//" */
+        *pos = '/';
+        ++pos;
+        *pos = '/';
+        ++pos;
+
+        /* copy in the UNC portion from referral */
+        memcpy(pos, nodename, unclen);
+        pos += unclen;
+
+        /* copy the prefixpath remainder (if there is one) */
+        if (pplen) {
+                *pos = '/';
+                ++pos;
+                memcpy(pos, prepath, pplen);
+                pos += pplen;
         }
 
-        return UNC;
+        /* NULL terminator */
+        *pos = '\0';
+
+        convert_delimiter(dev, '/');
+        return dev;
 }
 
 
@@ -123,6 +140,7 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
 {
         int rc;
         char *mountdata = NULL;
+        const char *prepath = NULL;
         int md_len;
         char *tkn_e;
         char *srvIP = NULL;
@@ -132,7 +150,10 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
         if (sb_mountdata == NULL)
                 return ERR_PTR(-EINVAL);
 
-        *devname = cifs_get_share_name(ref->node_name);
+        if (strlen(fullpath) - ref->path_consumed)
+                prepath = fullpath + ref->path_consumed;
+
+        *devname = cifs_build_devname(ref->node_name, prepath);
         if (IS_ERR(*devname)) {
                 rc = PTR_ERR(*devname);
                 *devname = NULL;
@@ -146,12 +167,14 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
                 goto compose_mount_options_err;
         }
 
-        /* md_len = strlen(...) + 12 for 'sep+prefixpath='
-         * assuming that we have 'unc=' and 'ip=' in
-         * the original sb_mountdata
+        /*
+         * In most cases, we'll be building a shorter string than the original,
+         * but we do have to assume that the address in the ip= option may be
+         * much longer than the original. Add the max length of an address
+         * string to the length of the original string to allow for worst case.
          */
-        md_len = strlen(sb_mountdata) + rc + strlen(ref->node_name) + 12;
-        mountdata = kzalloc(md_len+1, GFP_KERNEL);
+        md_len = strlen(sb_mountdata) + INET6_ADDRSTRLEN;
+        mountdata = kzalloc(md_len + 1, GFP_KERNEL);
         if (mountdata == NULL) {
                 rc = -ENOMEM;
                 goto compose_mount_options_err;
@@ -195,26 +218,6 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
                 strncat(mountdata, &sep, 1);
         strcat(mountdata, "ip=");
         strcat(mountdata, srvIP);
-        strncat(mountdata, &sep, 1);
-        strcat(mountdata, "unc=");
-        strcat(mountdata, *devname);
-
-        /* find & copy prefixpath */
-        tkn_e = strchr(ref->node_name + 2, '\\');
-        if (tkn_e == NULL) {
-                /* invalid unc, missing share name*/
-                rc = -EINVAL;
-                goto compose_mount_options_err;
-        }
-
-        tkn_e = strchr(tkn_e + 1, '\\');
-        if (tkn_e || (strlen(fullpath) - ref->path_consumed)) {
-                strncat(mountdata, &sep, 1);
-                strcat(mountdata, "prefixpath=");
-                if (tkn_e)
-                        strcat(mountdata, tkn_e + 1);
-                strcat(mountdata, fullpath + ref->path_consumed);
-        }
 
         /*cifs_dbg(FYI, "%s: parent mountdata: %s\n", __func__, sb_mountdata);*/
         /*cifs_dbg(FYI, "%s: submount mountdata: %s\n", __func__, mountdata );*/
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 72e4efee1389..3752b9f6d9e4 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -372,9 +372,6 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
         cifs_show_security(s, tcon->ses->server);
         cifs_show_cache_flavor(s, cifs_sb);
 
-        seq_printf(s, ",unc=");
-        seq_escape(s, tcon->treeName, " \t\n\\");
-
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER)
                 seq_printf(s, ",multiuser");
         else if (tcon->ses->user_name)
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 99eeaa17ee00..e3bc39bb9d12 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1061,6 +1061,7 @@ static int cifs_parse_security_flavors(char *value,
 #endif
         case Opt_sec_none:
                 vol->nullauth = 1;
+                vol->secFlg |= CIFSSEC_MAY_NTLM;
                 break;
         default:
                 cifs_dbg(VFS, "bad security option: %s\n", value);
@@ -1257,14 +1258,18 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
         vol->backupuid_specified = false; /* no backup intent for a user */
         vol->backupgid_specified = false; /* no backup intent for a group */
 
-        /*
-         * For now, we ignore -EINVAL errors under the assumption that the
-         * unc= and prefixpath= options will be usable.
-         */
-        if (cifs_parse_devname(devname, vol) == -ENOMEM) {
-                printk(KERN_ERR "CIFS: Unable to allocate memory to parse "
-                                "device string.\n");
-                goto out_nomem;
+        switch (cifs_parse_devname(devname, vol)) {
+        case 0:
+                break;
+        case -ENOMEM:
+                cifs_dbg(VFS, "Unable to allocate memory for devname.\n");
+                goto cifs_parse_mount_err;
+        case -EINVAL:
+                cifs_dbg(VFS, "Malformed UNC in devname.\n");
+                goto cifs_parse_mount_err;
+        default:
+                cifs_dbg(VFS, "Unknown error parsing devname.\n");
+                goto cifs_parse_mount_err;
         }
 
         while ((data = strsep(&options, separator)) != NULL) {
@@ -1826,7 +1831,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
         }
 #endif
         if (!vol->UNC) {
-                cifs_dbg(VFS, "CIFS mount error: No usable UNC path provided in device string or in unc= option!\n");
+                cifs_dbg(VFS, "CIFS mount error: No usable UNC path provided in device string!\n");
                 goto cifs_parse_mount_err;
         }
 
@@ -3274,8 +3279,8 @@ build_unc_path_to_root(const struct smb_vol *vol,
         pos = full_path + unc_len;
 
         if (pplen) {
-                *pos++ = CIFS_DIR_SEP(cifs_sb);
-                strncpy(pos, vol->prepath, pplen);
+                *pos = CIFS_DIR_SEP(cifs_sb);
+                strncpy(pos + 1, vol->prepath, pplen);
                 pos += pplen;
         }
 
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index e7512e497611..7ede7306599f 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -34,7 +34,7 @@
 
 /**
  * dns_resolve_server_name_to_ip - Resolve UNC server name to ip address.
- * @unc: UNC path specifying the server
+ * @unc: UNC path specifying the server (with '/' as delimiter)
  * @ip_addr: Where to return the IP address.
  *
  * The IP address will be returned in string form, and the caller is
@@ -64,7 +64,7 @@ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
         hostname = unc + 2;
 
         /* Search for server name delimiter */
-        sep = memchr(hostname, '\\', len);
+        sep = memchr(hostname, '/', len);
         if (sep)
                 len = sep - hostname;
         else
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index fc3025199cb3..20efd81266c6 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -171,7 +171,8 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
 
         if (fattr->cf_flags & CIFS_FATTR_DFS_REFERRAL)
                 inode->i_flags |= S_AUTOMOUNT;
-        cifs_set_ops(inode);
+        if (inode->i_state & I_NEW)
+                cifs_set_ops(inode);
 }
 
 void
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 201f0a0d6b0a..a7abbea2c096 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -295,6 +295,12 @@ static int ecryptfs_release(struct inode *inode, struct file *file)
 static int
 ecryptfs_fsync(struct file *file, loff_t start, loff_t end, int datasync)
 {
+        int rc;
+
+        rc = filemap_write_and_wait(file->f_mapping);
+        if (rc)
+                return rc;
+
         return vfs_fsync(ecryptfs_file_to_lower(file), datasync);
 }
 
diff --git a/fs/efivarfs/file.c b/fs/efivarfs/file.c
index bfb531564319..8dd524f32284 100644
--- a/fs/efivarfs/file.c
+++ b/fs/efivarfs/file.c
@@ -44,8 +44,11 @@ static ssize_t efivarfs_file_write(struct file *file,
 
         bytes = efivar_entry_set_get_size(var, attributes, &datasize,
                                           data, &set);
-        if (!set && bytes)
+        if (!set && bytes) {
+                if (bytes == -ENOENT)
+                        bytes = -EIO;
                 goto out;
+        }
 
         if (bytes == -ENOENT) {
                 drop_nlink(inode);
@@ -76,7 +79,14 @@ static ssize_t efivarfs_file_read(struct file *file, char __user *userbuf,
         int err;
 
         err = efivar_entry_size(var, &datasize);
-        if (err)
+
+        /*
+         * efivarfs represents uncommitted variables with
+         * zero-length files. Reading them should return EOF.
+         */
+        if (err == -ENOENT)
+                return 0;
+        else if (err)
                 return err;
 
         data = kmalloc(datasize + sizeof(attributes), GFP_KERNEL);
diff --git a/fs/exec.c b/fs/exec.c
index 643019585574..ffd7a813ad3d 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1135,13 +1135,6 @@ void setup_new_exec(struct linux_binprm * bprm)
                         set_dumpable(current->mm, suid_dumpable);
         }
 
-        /*
-         * Flush performance counters when crossing a
-         * security domain:
-         */
-        if (!get_dumpable(current->mm))
-                perf_event_exit_task(current);
-
         /* An exec changes our domain. We are no longer part of the thread
            group */
 
@@ -1205,6 +1198,15 @@ void install_exec_creds(struct linux_binprm *bprm)
 
         commit_creds(bprm->cred);
         bprm->cred = NULL;
+
+        /*
+         * Disable monitoring for regular users
+         * when executing setuid binaries. Must
+         * wait until new credentials are committed
+         * by commit_creds() above
+         */
+        if (get_dumpable(current->mm) != SUID_DUMP_USER)
+                perf_event_exit_task(current);
         /*
          * cred_guard_mutex must be held at least to this point to prevent
          * ptrace_attach() from altering our determination of the task's
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index dfce656ddb33..5d4513cb1b3c 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -1229,6 +1229,19 @@ static int fat_read_root(struct inode *inode)
         return 0;
 }
 
+static unsigned long calc_fat_clusters(struct super_block *sb)
+{
+        struct msdos_sb_info *sbi = MSDOS_SB(sb);
+
+        /* Divide first to avoid overflow */
+        if (sbi->fat_bits != 12) {
+                unsigned long ent_per_sec = sb->s_blocksize * 8 / sbi->fat_bits;
+                return ent_per_sec * sbi->fat_length;
+        }
+
+        return sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits;
+}
+
 /*
  * Read the super block of an MS-DOS FS.
  */
@@ -1434,7 +1447,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
                 sbi->dirty = b->fat16.state & FAT_STATE_DIRTY;
 
         /* check that FAT table does not overflow */
-        fat_clusters = sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits;
+        fat_clusters = calc_fat_clusters(sb);
         total_clusters = min(total_clusters, fat_clusters - FAT_START_ENT);
         if (total_clusters > MAX_FAT(sb)) {
                 if (!silent)
diff --git a/fs/file_table.c b/fs/file_table.c
index cd4d87a82951..485dc0eddd67 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -306,17 +306,18 @@ void fput(struct file *file)
 {
         if (atomic_long_dec_and_test(&file->f_count)) {
                 struct task_struct *task = current;
+                unsigned long flags;
+
                 file_sb_list_del(file);
-                if (unlikely(in_interrupt() || task->flags & PF_KTHREAD)) {
-                        unsigned long flags;
-                        spin_lock_irqsave(&delayed_fput_lock, flags);
-                        list_add(&file->f_u.fu_list, &delayed_fput_list);
-                        schedule_work(&delayed_fput_work);
-                        spin_unlock_irqrestore(&delayed_fput_lock, flags);
-                        return;
+                if (likely(!in_interrupt() && !(task->flags & PF_KTHREAD))) {
+                        init_task_work(&file->f_u.fu_rcuhead, ____fput);
+                        if (!task_work_add(task, &file->f_u.fu_rcuhead, true))
+                                return;
                 }
-                init_task_work(&file->f_u.fu_rcuhead, ____fput);
-                task_work_add(task, &file->f_u.fu_rcuhead, true);
+                spin_lock_irqsave(&delayed_fput_lock, flags);
+                list_add(&file->f_u.fu_list, &delayed_fput_list);
+                schedule_work(&delayed_fput_work);
+                spin_unlock_irqrestore(&delayed_fput_lock, flags);
         }
 }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 254df56b847b..f3f783dc4f75 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -180,6 +180,8 @@ u64 fuse_get_attr_version(struct fuse_conn *fc)
 static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
 {
         struct inode *inode;
+        struct dentry *parent;
+        struct fuse_conn *fc;
 
         inode = ACCESS_ONCE(entry->d_inode);
         if (inode && is_bad_inode(inode))
@@ -187,10 +189,8 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
         else if (fuse_dentry_time(entry) < get_jiffies_64()) {
                 int err;
                 struct fuse_entry_out outarg;
-                struct fuse_conn *fc;
                 struct fuse_req *req;
                 struct fuse_forget_link *forget;
-                struct dentry *parent;
                 u64 attr_version;
 
                 /* For negative dentries, always do a fresh lookup */
@@ -241,8 +241,14 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
                                        entry_attr_timeout(&outarg),
                                        attr_version);
                 fuse_change_entry_timeout(entry, &outarg);
+        } else if (inode) {
+                fc = get_fuse_conn(inode);
+                if (fc->readdirplus_auto) {
+                        parent = dget_parent(entry);
+                        fuse_advise_use_readdirplus(parent->d_inode);
+                        dput(parent);
+                }
         }
-        fuse_advise_use_readdirplus(inode);
         return 1;
 }
 
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index d1c9b85b3f58..35f281033142 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -16,6 +16,7 @@
 #include <linux/compat.h>
 #include <linux/swap.h>
 #include <linux/aio.h>
+#include <linux/falloc.h>
 
 static const struct file_operations fuse_direct_io_file_operations;
 
@@ -1278,7 +1279,10 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, const struct iovec *iov,
 
         iov_iter_init(&ii, iov, nr_segs, count, 0);
 
-        req = fuse_get_req(fc, fuse_iter_npages(&ii));
+        if (io->async)
+                req = fuse_get_req_for_background(fc, fuse_iter_npages(&ii));
+        else
+                req = fuse_get_req(fc, fuse_iter_npages(&ii));
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
@@ -1314,7 +1318,11 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, const struct iovec *iov,
                         break;
                 if (count) {
                         fuse_put_request(fc, req);
-                        req = fuse_get_req(fc, fuse_iter_npages(&ii));
+                        if (io->async)
+                                req = fuse_get_req_for_background(fc,
+                                        fuse_iter_npages(&ii));
+                        else
+                                req = fuse_get_req(fc, fuse_iter_npages(&ii));
                         if (IS_ERR(req))
                                 break;
                 }
@@ -2365,6 +2373,11 @@ static void fuse_do_truncate(struct file *file)
         fuse_do_setattr(inode, &attr, file);
 }
 
+static inline loff_t fuse_round_up(loff_t off)
+{
+        return round_up(off, FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT);
+}
+
 static ssize_t
 fuse_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
                         loff_t offset, unsigned long nr_segs)
@@ -2372,6 +2385,7 @@ fuse_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
         ssize_t ret = 0;
         struct file *file = iocb->ki_filp;
         struct fuse_file *ff = file->private_data;
+        bool async_dio = ff->fc->async_dio;
         loff_t pos = 0;
         struct inode *inode;
         loff_t i_size;
@@ -2383,10 +2397,10 @@ fuse_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
         i_size = i_size_read(inode);
 
         /* optimization for short read */
-        if (rw != WRITE && offset + count > i_size) {
+        if (async_dio && rw != WRITE && offset + count > i_size) {
                 if (offset >= i_size)
                         return 0;
-                count = i_size - offset;
+                count = min_t(loff_t, count, fuse_round_up(i_size - offset));
         }
 
         io = kmalloc(sizeof(struct fuse_io_priv), GFP_KERNEL);
@@ -2404,7 +2418,7 @@ fuse_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
          * By default, we want to optimize all I/Os with async request
          * submission to the client filesystem if supported.
          */
-        io->async = ff->fc->async_dio;
+        io->async = async_dio;
         io->iocb = iocb;
 
         /*
@@ -2412,7 +2426,7 @@ fuse_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
          * to wait on real async I/O requests, so we must submit this request
          * synchronously.
          */
-        if (!is_sync_kiocb(iocb) && (offset + count > i_size))
+        if (!is_sync_kiocb(iocb) && (offset + count > i_size) && rw == WRITE)
                 io->async = false;
 
         if (rw == WRITE)
@@ -2424,7 +2438,7 @@ fuse_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
                 fuse_aio_complete(io, ret < 0 ? ret : 0, -1);
 
                 /* we have a non-extending, async request, so return */
-                if (ret > 0 && !is_sync_kiocb(iocb))
+                if (!is_sync_kiocb(iocb))
                         return -EIOCBQUEUED;
 
                 ret = wait_on_sync_kiocb(iocb);
@@ -2446,6 +2460,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
                                 loff_t length)
 {
         struct fuse_file *ff = file->private_data;
+        struct inode *inode = file->f_inode;
         struct fuse_conn *fc = ff->fc;
         struct fuse_req *req;
         struct fuse_fallocate_in inarg = {
@@ -2455,13 +2470,23 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
                 .mode = mode
         };
         int err;
+        bool lock_inode = !(mode & FALLOC_FL_KEEP_SIZE) ||
+                           (mode & FALLOC_FL_PUNCH_HOLE);
 
         if (fc->no_fallocate)
                 return -EOPNOTSUPP;
 
+        if (lock_inode) {
+                mutex_lock(&inode->i_mutex);
+                if (mode & FALLOC_FL_PUNCH_HOLE)
+                        fuse_set_nowrite(inode);
+        }
+
         req = fuse_get_req_nopages(fc);
-        if (IS_ERR(req))
-                return PTR_ERR(req);
+        if (IS_ERR(req)) {
+                err = PTR_ERR(req);
+                goto out;
+        }
 
         req->in.h.opcode = FUSE_FALLOCATE;
         req->in.h.nodeid = ff->nodeid;
@@ -2476,6 +2501,25 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
         }
         fuse_put_request(fc, req);
 
+        if (err)
+                goto out;
+
+        /* we could have extended the file */
+        if (!(mode & FALLOC_FL_KEEP_SIZE))
+                fuse_write_update_size(inode, offset + length);
+
+        if (mode & FALLOC_FL_PUNCH_HOLE)
+                truncate_pagecache_range(inode, offset, offset + length - 1);
+
+        fuse_invalidate_attr(inode);
+
+out:
+        if (lock_inode) {
+                if (mode & FALLOC_FL_PUNCH_HOLE)
+                        fuse_release_nowrite(inode);
+                mutex_unlock(&inode->i_mutex);
+        }
+
         return err;
 }
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 6201f81e4d3a..9a0cdde14a08 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -867,10 +867,11 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                                 fc->dont_mask = 1;
                         if (arg->flags & FUSE_AUTO_INVAL_DATA)
                                 fc->auto_inval_data = 1;
-                        if (arg->flags & FUSE_DO_READDIRPLUS)
+                        if (arg->flags & FUSE_DO_READDIRPLUS) {
                                 fc->do_readdirplus = 1;
-                        if (arg->flags & FUSE_READDIRPLUS_AUTO)
-                                fc->readdirplus_auto = 1;
+                                if (arg->flags & FUSE_READDIRPLUS_AUTO)
+                                        fc->readdirplus_auto = 1;
+                        }
                         if (arg->flags & FUSE_ASYNC_DIO)
                                 fc->async_dio = 1;
                 } else {
diff --git a/fs/gfs2/Kconfig b/fs/gfs2/Kconfig
index eb08c9e43c2a..5a376ab81feb 100644
--- a/fs/gfs2/Kconfig
+++ b/fs/gfs2/Kconfig
@@ -26,7 +26,7 @@ config GFS2_FS
 config GFS2_FS_LOCKING_DLM
         bool "GFS2 DLM locking"
         depends on (GFS2_FS!=n) && NET && INET && (IPV6 || IPV6=n) && \
-                HOTPLUG && DLM && CONFIGFS_FS && SYSFS
+                HOTPLUG && CONFIGFS_FS && SYSFS && (DLM=y || DLM=GFS2_FS)
         help
           Multiple node locking module for GFS2
 
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 1dc9a13ce6bb..93b5809c20bb 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -1286,17 +1286,26 @@ int gfs2_setattr_size(struct inode *inode, u64 newsize)
         if (ret)
                 return ret;
 
+        ret = get_write_access(inode);
+        if (ret)
+                return ret;
+
         inode_dio_wait(inode);
 
         ret = gfs2_rs_alloc(GFS2_I(inode));
         if (ret)
-                return ret;
+                goto out;
 
         oldsize = inode->i_size;
-        if (newsize >= oldsize)
-                return do_grow(inode, newsize);
+        if (newsize >= oldsize) {
+                ret = do_grow(inode, newsize);
+                goto out;
+        }
 
-        return do_shrink(inode, oldsize, newsize);
+        ret = do_shrink(inode, oldsize, newsize);
+out:
+        put_write_access(inode);
+        return ret;
 }
 
 int gfs2_truncatei_resume(struct gfs2_inode *ip)
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index c3e82bd23179..b631c9043460 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -354,22 +354,31 @@ static __be64 *gfs2_dir_get_hash_table(struct gfs2_inode *ip)
                 return ERR_PTR(-EIO);
         }
 
-        hc = kmalloc(hsize, GFP_NOFS);
-        ret = -ENOMEM;
+        hc = kmalloc(hsize, GFP_NOFS | __GFP_NOWARN);
+        if (hc == NULL)
+                hc = __vmalloc(hsize, GFP_NOFS, PAGE_KERNEL);
+
         if (hc == NULL)
                 return ERR_PTR(-ENOMEM);
 
         ret = gfs2_dir_read_data(ip, hc, hsize);
         if (ret < 0) {
-                kfree(hc);
+                if (is_vmalloc_addr(hc))
+                        vfree(hc);
+                else
+                        kfree(hc);
                 return ERR_PTR(ret);
         }
 
         spin_lock(&inode->i_lock);
-        if (ip->i_hash_cache)
-                kfree(hc);
-        else
+        if (ip->i_hash_cache) {
+                if (is_vmalloc_addr(hc))
+                        vfree(hc);
+                else
+                        kfree(hc);
+        } else {
                 ip->i_hash_cache = hc;
+        }
         spin_unlock(&inode->i_lock);
 
         return ip->i_hash_cache;
@@ -385,7 +394,10 @@ void gfs2_dir_hash_inval(struct gfs2_inode *ip)
 {
         __be64 *hc = ip->i_hash_cache;
         ip->i_hash_cache = NULL;
-        kfree(hc);
+        if (is_vmalloc_addr(hc))
+                vfree(hc);
+        else
+                kfree(hc);
 }
 
 static inline int gfs2_dirent_sentinel(const struct gfs2_dirent *dent)
@@ -1113,7 +1125,10 @@ static int dir_double_exhash(struct gfs2_inode *dip)
         if (IS_ERR(hc))
                 return PTR_ERR(hc);
 
-        h = hc2 = kmalloc(hsize_bytes * 2, GFP_NOFS);
+        h = hc2 = kmalloc(hsize_bytes * 2, GFP_NOFS | __GFP_NOWARN);
+        if (hc2 == NULL)
+                hc2 = __vmalloc(hsize_bytes * 2, GFP_NOFS, PAGE_KERNEL);
+
         if (!hc2)
                 return -ENOMEM;
 
@@ -1145,7 +1160,10 @@ fail:
         gfs2_dinode_out(dip, dibh->b_data);
         brelse(dibh);
 out_kfree:
-        kfree(hc2);
+        if (is_vmalloc_addr(hc2))
+                vfree(hc2);
+        else
+                kfree(hc2);
         return error;
 }
 
@@ -1846,6 +1864,8 @@ static int leaf_dealloc(struct gfs2_inode *dip, u32 index, u32 len,
         memset(&rlist, 0, sizeof(struct gfs2_rgrp_list));
 
         ht = kzalloc(size, GFP_NOFS);
+        if (ht == NULL)
+                ht = vzalloc(size);
         if (!ht)
                 return -ENOMEM;
 
@@ -1933,7 +1953,10 @@ out_rlist:
         gfs2_rlist_free(&rlist);
         gfs2_quota_unhold(dip);
 out:
-        kfree(ht);
+        if (is_vmalloc_addr(ht))
+                vfree(ht);
+        else
+                kfree(ht);
         return error;
 }
 
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index acd16764b133..ad0dc38d87ab 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -402,16 +402,20 @@ static int gfs2_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
         /* Update file times before taking page lock */
         file_update_time(vma->vm_file);
 
+        ret = get_write_access(inode);
+        if (ret)
+                goto out;
+
         ret = gfs2_rs_alloc(ip);
         if (ret)
-                return ret;
+                goto out_write_access;
 
         gfs2_size_hint(vma->vm_file, pos, PAGE_CACHE_SIZE);
 
         gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
         ret = gfs2_glock_nq(&gh);
         if (ret)
-                goto out;
+                goto out_uninit;
 
         set_bit(GLF_DIRTY, &ip->i_gl->gl_flags);
         set_bit(GIF_SW_PAGED, &ip->i_flags);
@@ -480,12 +484,15 @@ out_quota_unlock:
         gfs2_quota_unlock(ip);
 out_unlock:
         gfs2_glock_dq(&gh);
-out:
+out_uninit:
         gfs2_holder_uninit(&gh);
         if (ret == 0) {
                 set_page_dirty(page);
                 wait_for_stable_page(page);
         }
+out_write_access:
+        put_write_access(inode);
+out:
         sb_end_pagefault(inode->i_sb);
         return block_page_mkwrite_return(ret);
 }
@@ -594,10 +601,10 @@ static int gfs2_release(struct inode *inode, struct file *file)
         kfree(file->private_data);
         file->private_data = NULL;
 
-        if ((file->f_mode & FMODE_WRITE) &&
-            (atomic_read(&inode->i_writecount) == 1))
-                gfs2_rs_delete(ip);
+        if (!(file->f_mode & FMODE_WRITE))
+                return 0;
 
+        gfs2_rs_delete(ip);
         return 0;
 }
 
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 8833a4f264e3..62b484e4a9e4 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -189,6 +189,7 @@ struct inode *gfs2_inode_lookup(struct super_block *sb, unsigned int type,
         return inode;
 
 fail_refresh:
+        ip->i_iopen_gh.gh_flags |= GL_NOCACHE;
         ip->i_iopen_gh.gh_gl->gl_object = NULL;
         gfs2_glock_dq_uninit(&ip->i_iopen_gh);
 fail_iopen:
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index c5fa758fd844..6c33d7b6e0c4 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -212,7 +212,7 @@ static void gfs2_end_log_write(struct bio *bio, int error)
                 fs_err(sdp, "Error %d writing to log\n", error);
         }
 
-        bio_for_each_segment(bvec, bio, i) {
+        bio_for_each_segment_all(bvec, bio, i) {
                 page = bvec->bv_page;
                 if (page_has_buffers(page))
                         gfs2_end_log_write_bh(sdp, bvec, error);
@@ -419,7 +419,9 @@ static void gfs2_before_commit(struct gfs2_sbd *sdp, unsigned int limit,
                 if (total > limit)
                         num = limit;
                 gfs2_log_unlock(sdp);
-                page = gfs2_get_log_desc(sdp, GFS2_LOG_DESC_METADATA, num + 1, num);
+                page = gfs2_get_log_desc(sdp,
+                                         is_databuf ? GFS2_LOG_DESC_JDATA :
+                                         GFS2_LOG_DESC_METADATA, num + 1, num);
                 ld = page_address(page);
                 gfs2_log_lock(sdp);
                 ptr = (__be64 *)(ld + 1);
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index c7c840e916f8..c253b13722e8 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -121,7 +121,7 @@ static u64 qd2index(struct gfs2_quota_data *qd)
 {
         struct kqid qid = qd->qd_id;
         return (2 * (u64)from_kqid(&init_user_ns, qid)) +
-                (qid.type == USRQUOTA) ? 0 : 1;
+                ((qid.type == USRQUOTA) ? 0 : 1);
 }
 
 static u64 qd2offset(struct gfs2_quota_data *qd)
@@ -721,7 +721,7 @@ get_a_page:
                         goto unlock_out;
         }
 
-        gfs2_trans_add_meta(ip->i_gl, bh);
+        gfs2_trans_add_data(ip->i_gl, bh);
 
         kaddr = kmap_atomic(page);
         if (offset + sizeof(struct gfs2_quota) > PAGE_CACHE_SIZE)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 0c5a575b513e..9809156e3d04 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -638,8 +638,10 @@ void gfs2_rs_deltree(struct gfs2_blkreserv *rs)
  */
 void gfs2_rs_delete(struct gfs2_inode *ip)
 {
+        struct inode *inode = &ip->i_inode;
+
         down_write(&ip->i_rw_mutex);
-        if (ip->i_res) {
+        if (ip->i_res && atomic_read(&inode->i_writecount) <= 1) {
                 gfs2_rs_deltree(ip->i_res);
                 BUG_ON(ip->i_res->rs_free);
                 kmem_cache_free(gfs2_rsrv_cachep, ip->i_res);
@@ -1401,9 +1403,14 @@ static void rg_mblk_search(struct gfs2_rgrpd *rgd, struct gfs2_inode *ip,
         u32 extlen;
         u32 free_blocks = rgd->rd_free_clone - rgd->rd_reserved;
         int ret;
+        struct inode *inode = &ip->i_inode;
 
-        extlen = max_t(u32, atomic_read(&rs->rs_sizehint), requested);
-        extlen = clamp(extlen, RGRP_RSRV_MINBLKS, free_blocks);
+        if (S_ISDIR(inode->i_mode))
+                extlen = 1;
+        else {
+                extlen = max_t(u32, atomic_read(&rs->rs_sizehint), requested);
+                extlen = clamp(extlen, RGRP_RSRV_MINBLKS, free_blocks);
+        }
         if ((rgd->rd_free_clone < rgd->rd_reserved) || (free_blocks < extlen))
                 return;
 
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 917c8e1eb4ae..e5639dec66c4 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1444,6 +1444,7 @@ static void gfs2_evict_inode(struct inode *inode)
         /* Must not read inode block until block type has been verified */
         error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, GL_SKIP, &gh);
         if (unlikely(error)) {
+                ip->i_iopen_gh.gh_flags |= GL_NOCACHE;
                 gfs2_glock_dq_uninit(&ip->i_iopen_gh);
                 goto out;
         }
@@ -1514,8 +1515,10 @@ out_unlock:
         if (gfs2_rs_active(ip->i_res))
                 gfs2_rs_deltree(ip->i_res);
 
-        if (test_bit(HIF_HOLDER, &ip->i_iopen_gh.gh_iflags))
+        if (test_bit(HIF_HOLDER, &ip->i_iopen_gh.gh_iflags)) {
+                ip->i_iopen_gh.gh_flags |= GL_NOCACHE;
                 gfs2_glock_dq(&ip->i_iopen_gh);
+        }
         gfs2_holder_uninit(&ip->i_iopen_gh);
         gfs2_glock_dq_uninit(&gh);
         if (error && error != GLR_TRYFAILED && error != -EROFS)
@@ -1534,6 +1537,7 @@ out:
         ip->i_gl = NULL;
         if (ip->i_iopen_gh.gh_gl) {
                 ip->i_iopen_gh.gh_gl->gl_object = NULL;
+                ip->i_iopen_gh.gh_flags |= GL_NOCACHE;
                 gfs2_glock_dq_uninit(&ip->i_iopen_gh);
         }
 }
diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index f3b1a15ccd59..d3fa6bd9503e 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -415,7 +415,11 @@ struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
         spin_lock(&tree->hash_lock);
         node = hfs_bnode_findhash(tree, num);
         spin_unlock(&tree->hash_lock);
-        BUG_ON(node);
+        if (node) {
+                pr_crit("new node %u already hashed?\n", num);
+                WARN_ON(1);
+                return node;
+        }
         node = __hfs_bnode_create(tree, num);
         if (!node)
                 return ERR_PTR(-ENOMEM);
diff --git a/fs/hpfs/dir.c b/fs/hpfs/dir.c
index 546f6d39713a..834ac13c04b7 100644
--- a/fs/hpfs/dir.c
+++ b/fs/hpfs/dir.c
@@ -33,25 +33,27 @@ static loff_t hpfs_dir_lseek(struct file *filp, loff_t off, int whence)
         if (whence == SEEK_DATA || whence == SEEK_HOLE)
                 return -EINVAL;
 
+        mutex_lock(&i->i_mutex);
         hpfs_lock(s);
 
         /*printk("dir lseek\n");*/
         if (new_off == 0 || new_off == 1 || new_off == 11 || new_off == 12 || new_off == 13) goto ok;
-        mutex_lock(&i->i_mutex);
         pos = ((loff_t) hpfs_de_as_down_as_possible(s, hpfs_inode->i_dno) << 4) + 1;
         while (pos != new_off) {
                 if (map_pos_dirent(i, &pos, &qbh)) hpfs_brelse4(&qbh);
                 else goto fail;
                 if (pos == 12) goto fail;
         }
-        mutex_unlock(&i->i_mutex);
+        hpfs_add_pos(i, &filp->f_pos);
 ok:
+        filp->f_pos = new_off;
         hpfs_unlock(s);
-        return filp->f_pos = new_off;
-fail:
         mutex_unlock(&i->i_mutex);
+        return new_off;
+fail:
         /*printk("illegal lseek: %016llx\n", new_off);*/
         hpfs_unlock(s);
+        mutex_unlock(&i->i_mutex);
         return -ESPIPE;
 }
 
diff --git a/fs/hpfs/file.c b/fs/hpfs/file.c
index 3027f4dbbab5..e4ba5fe4c3b5 100644
--- a/fs/hpfs/file.c
+++ b/fs/hpfs/file.c
@@ -109,10 +109,14 @@ static void hpfs_write_failed(struct address_space *mapping, loff_t to)
 {
         struct inode *inode = mapping->host;
 
+        hpfs_lock(inode->i_sb);
+
         if (to > inode->i_size) {
                 truncate_pagecache(inode, to, inode->i_size);
                 hpfs_truncate(inode);
         }
+
+        hpfs_unlock(inode->i_sb);
 }
 
 static int hpfs_write_begin(struct file *file, struct address_space *mapping,
diff --git a/fs/internal.h b/fs/internal.h
index eaa75f75b625..68121584ae37 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -132,6 +132,12 @@ extern struct dentry *__d_alloc(struct super_block *, const struct qstr *);
 extern ssize_t __kernel_write(struct file *, const char *, size_t, loff_t *);
 
 /*
+ * splice.c
+ */
+extern long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
+                loff_t *opos, size_t len, unsigned int flags);
+
+/*
  * pipe.c
  */
 extern const struct file_operations pipefifo_fops;
diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index c57499dca89c..360d27c48887 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -2009,7 +2009,13 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 
         bio->bi_end_io = lbmIODone;
         bio->bi_private = bp;
-        submit_bio(READ_SYNC, bio);
+        /*check if journaling to disk has been disabled*/
+        if (log->no_integrity) {
+                bio->bi_size = 0;
+                lbmIODone(bio, 0);
+        } else {
+                submit_bio(READ_SYNC, bio);
+        }
 
         wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
 
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 2003e830ed1c..788e0a9c1fb0 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -611,11 +611,28 @@ static int jfs_freeze(struct super_block *sb)
 {
         struct jfs_sb_info *sbi = JFS_SBI(sb);
         struct jfs_log *log = sbi->log;
+        int rc = 0;
 
         if (!(sb->s_flags & MS_RDONLY)) {
                 txQuiesce(sb);
-                lmLogShutdown(log);
-                updateSuper(sb, FM_CLEAN);
+                rc = lmLogShutdown(log);
+                if (rc) {
+                        jfs_error(sb, "jfs_freeze: lmLogShutdown failed");
+
+                        /* let operations fail rather than hang */
+                        txResume(sb);
+
+                        return rc;
+                }
+                rc = updateSuper(sb, FM_CLEAN);
+                if (rc) {
+                        jfs_err("jfs_freeze: updateSuper failed\n");
+                        /*
+                         * Don't fail here. Everything succeeded except
+                         * marking the superblock clean, so there's really
+                         * no harm in leaving it frozen for now.
+                         */
+                }
         }
         return 0;
 }
@@ -627,13 +644,18 @@ static int jfs_unfreeze(struct super_block *sb)
         int rc = 0;
 
         if (!(sb->s_flags & MS_RDONLY)) {
-                updateSuper(sb, FM_MOUNT);
-                if ((rc = lmLogInit(log)))
-                        jfs_err("jfs_unlock failed with return code %d", rc);
-                else
-                        txResume(sb);
+                rc = updateSuper(sb, FM_MOUNT);
+                if (rc) {
+                        jfs_error(sb, "jfs_unfreeze: updateSuper failed");
+                        goto out;
+                }
+                rc = lmLogInit(log);
+                if (rc)
+                        jfs_error(sb, "jfs_unfreeze: lmLogInit failed");
+out:
+                txResume(sb);
         }
-        return 0;
+        return rc;
 }
 
 static struct dentry *jfs_do_mount(struct file_system_type *fs_type,
diff --git a/fs/namei.c b/fs/namei.c
index 85e40d1c0a8f..9ed9361223c0 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1976,7 +1976,7 @@ static int path_lookupat(int dfd, const char *name,
                 err = complete_walk(nd);
 
         if (!err && nd->flags & LOOKUP_DIRECTORY) {
-                if (!nd->inode->i_op->lookup) {
+                if (!can_lookup(nd->inode)) {
                         path_put(&nd->path);
                         err = -ENOTDIR;
                 }
@@ -2850,7 +2850,7 @@ finish_lookup:
         if ((open_flag & O_CREAT) && S_ISDIR(nd->inode->i_mode))
                 goto out;
         error = -ENOTDIR;
-        if ((nd->flags & LOOKUP_DIRECTORY) && !nd->inode->i_op->lookup)
+        if ((nd->flags & LOOKUP_DIRECTORY) && !can_lookup(nd->inode))
                 goto out;
         audit_inode(name, nd->path.dentry, 0);
 finish_open:
diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
index 816326093656..6792ce11f2bf 100644
--- a/fs/ncpfs/dir.c
+++ b/fs/ncpfs/dir.c
@@ -1029,15 +1029,6 @@ static int ncp_rmdir(struct inode *dir, struct dentry *dentry)
         DPRINTK("ncp_rmdir: removing %s/%s\n",
                 dentry->d_parent->d_name.name, dentry->d_name.name);
 
-        /*
-         * fail with EBUSY if there are still references to this
-         * directory.
-         */
-        dentry_unhash(dentry);
-        error = -EBUSY;
-        if (!d_unhashed(dentry))
-                goto out;
-
         len = sizeof(__name);
         error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
                            dentry->d_name.len, !ncp_preserve_case(dir));
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index a13d26ede254..0bc27684ebfa 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -414,7 +414,7 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
 
         spin_lock(&tbl->slot_tbl_lock);
         /* state manager is resetting the session */
-        if (test_bit(NFS4_SESSION_DRAINING, &clp->cl_session->session_state)) {
+        if (test_bit(NFS4_SLOT_TBL_DRAINING, &tbl->slot_tbl_state)) {
                 spin_unlock(&tbl->slot_tbl_lock);
                 status = htonl(NFS4ERR_DELAY);
                 /* Return NFS4ERR_BADSESSION if we're draining the session
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 59461c957d9d..a35582c9d444 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -763,7 +763,7 @@ static void nfs4_callback_free_slot(struct nfs4_session *session)
          * A single slot, so highest used slotid is either 0 or -1
          */
         tbl->highest_used_slotid = NFS4_NO_SLOT;
-        nfs4_session_drain_complete(session, tbl);
+        nfs4_slot_tbl_drain_complete(tbl);
         spin_unlock(&tbl->slot_tbl_lock);
 }
 
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 947b0c908aa9..4cbad5d6b276 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -203,7 +203,7 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
         __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags);
         error = nfs_create_rpc_client(clp, timeparms, RPC_AUTH_GSS_KRB5I);
         if (error == -EINVAL)
-                error = nfs_create_rpc_client(clp, timeparms, RPC_AUTH_NULL);
+                error = nfs_create_rpc_client(clp, timeparms, RPC_AUTH_UNIX);
         if (error < 0)
                 goto error;
 
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 8fbc10054115..d7ba5616989c 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -572,7 +572,7 @@ int nfs41_setup_sequence(struct nfs4_session *session,
         task->tk_timeout = 0;
 
         spin_lock(&tbl->slot_tbl_lock);
-        if (test_bit(NFS4_SESSION_DRAINING, &session->session_state) &&
+        if (test_bit(NFS4_SLOT_TBL_DRAINING, &tbl->slot_tbl_state) &&
             !args->sa_privileged) {
                 /* The state manager will wait until the slot table is empty */
                 dprintk("%s session is draining\n", __func__);
@@ -1078,7 +1078,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
         struct nfs4_state *state = opendata->state;
         struct nfs_inode *nfsi = NFS_I(state->inode);
         struct nfs_delegation *delegation;
-        int open_mode = opendata->o_arg.open_flags & (O_EXCL|O_TRUNC);
+        int open_mode = opendata->o_arg.open_flags;
         fmode_t fmode = opendata->o_arg.fmode;
         nfs4_stateid stateid;
         int ret = -EAGAIN;
diff --git a/fs/nfs/nfs4session.c b/fs/nfs/nfs4session.c
index ebda5f4a031b..c4e225e4a9af 100644
--- a/fs/nfs/nfs4session.c
+++ b/fs/nfs/nfs4session.c
@@ -73,7 +73,7 @@ void nfs4_free_slot(struct nfs4_slot_table *tbl, struct nfs4_slot *slot)
                         tbl->highest_used_slotid = new_max;
                 else {
                         tbl->highest_used_slotid = NFS4_NO_SLOT;
-                        nfs4_session_drain_complete(tbl->session, tbl);
+                        nfs4_slot_tbl_drain_complete(tbl);
                 }
         }
         dprintk("%s: slotid %u highest_used_slotid %d\n", __func__,
@@ -226,7 +226,7 @@ static bool nfs41_assign_slot(struct rpc_task *task, void *pslot)
         struct nfs4_slot *slot = pslot;
         struct nfs4_slot_table *tbl = slot->table;
 
-        if (nfs4_session_draining(tbl->session) && !args->sa_privileged)
+        if (nfs4_slot_tbl_draining(tbl) && !args->sa_privileged)
                 return false;
         slot->generation = tbl->generation;
         args->sa_slot = slot;
diff --git a/fs/nfs/nfs4session.h b/fs/nfs/nfs4session.h
index 6f3cb39386d4..ff7d9f0f8a65 100644
--- a/fs/nfs/nfs4session.h
+++ b/fs/nfs/nfs4session.h
@@ -25,6 +25,10 @@ struct nfs4_slot {
 };
 
 /* Sessions */
+enum nfs4_slot_tbl_state {
+        NFS4_SLOT_TBL_DRAINING,
+};
+
 #define SLOT_TABLE_SZ DIV_ROUND_UP(NFS4_MAX_SLOT_TABLE, 8*sizeof(long))
 struct nfs4_slot_table {
         struct nfs4_session *session;           /* Parent session */
@@ -43,6 +47,7 @@ struct nfs4_slot_table {
         unsigned long   generation;             /* Generation counter for
                                                    target_highest_slotid */
         struct completion complete;
+        unsigned long   slot_tbl_state;
 };
 
 /*
@@ -68,7 +73,6 @@ struct nfs4_session {
 
 enum nfs4_session_state {
         NFS4_SESSION_INITING,
-        NFS4_SESSION_DRAINING,
 };
 
 #if defined(CONFIG_NFS_V4_1)
@@ -88,12 +92,11 @@ extern void nfs4_destroy_session(struct nfs4_session *session);
 extern int nfs4_init_session(struct nfs_server *server);
 extern int nfs4_init_ds_session(struct nfs_client *, unsigned long);
 
-extern void nfs4_session_drain_complete(struct nfs4_session *session,
-                struct nfs4_slot_table *tbl);
+extern void nfs4_slot_tbl_drain_complete(struct nfs4_slot_table *tbl);
 
-static inline bool nfs4_session_draining(struct nfs4_session *session)
+static inline bool nfs4_slot_tbl_draining(struct nfs4_slot_table *tbl)
 {
-        return !!test_bit(NFS4_SESSION_DRAINING, &session->session_state);
+        return !!test_bit(NFS4_SLOT_TBL_DRAINING, &tbl->slot_tbl_state);
 }
 
 bool nfs41_wake_and_assign_slot(struct nfs4_slot_table *tbl,
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 300d17d85c0e..1fab140764c4 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -241,7 +241,7 @@ static void nfs4_end_drain_session(struct nfs_client *clp)
         if (ses == NULL)
                 return;
         tbl = &ses->fc_slot_table;
-        if (test_and_clear_bit(NFS4_SESSION_DRAINING, &ses->session_state)) {
+        if (test_and_clear_bit(NFS4_SLOT_TBL_DRAINING, &tbl->slot_tbl_state)) {
                 spin_lock(&tbl->slot_tbl_lock);
                 nfs41_wake_slot_table(tbl);
                 spin_unlock(&tbl->slot_tbl_lock);
@@ -251,15 +251,15 @@ static void nfs4_end_drain_session(struct nfs_client *clp)
 /*
  * Signal state manager thread if session fore channel is drained
  */
-void nfs4_session_drain_complete(struct nfs4_session *session,
-                struct nfs4_slot_table *tbl)
+void nfs4_slot_tbl_drain_complete(struct nfs4_slot_table *tbl)
 {
-        if (nfs4_session_draining(session))
+        if (nfs4_slot_tbl_draining(tbl))
                 complete(&tbl->complete);
 }
 
-static int nfs4_wait_on_slot_tbl(struct nfs4_slot_table *tbl)
+static int nfs4_drain_slot_tbl(struct nfs4_slot_table *tbl)
 {
+        set_bit(NFS4_SLOT_TBL_DRAINING, &tbl->slot_tbl_state);
         spin_lock(&tbl->slot_tbl_lock);
         if (tbl->highest_used_slotid != NFS4_NO_SLOT) {
                 INIT_COMPLETION(tbl->complete);
@@ -275,13 +275,12 @@ static int nfs4_begin_drain_session(struct nfs_client *clp)
         struct nfs4_session *ses = clp->cl_session;
         int ret = 0;
 
-        set_bit(NFS4_SESSION_DRAINING, &ses->session_state);
         /* back channel */
-        ret = nfs4_wait_on_slot_tbl(&ses->bc_slot_table);
+        ret = nfs4_drain_slot_tbl(&ses->bc_slot_table);
         if (ret)
                 return ret;
         /* fore channel */
-        return nfs4_wait_on_slot_tbl(&ses->fc_slot_table);
+        return nfs4_drain_slot_tbl(&ses->fc_slot_table);
 }
 
 static void nfs41_finish_session_reset(struct nfs_client *clp)
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index a366107a7331..2d7525fbcf25 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1942,6 +1942,7 @@ static int nfs23_validate_mount_data(void *options,
                 args->namlen            = data->namlen;
                 args->bsize             = data->bsize;
 
+                args->auth_flavors[0] = RPC_AUTH_UNIX;
                 if (data->flags & NFS_MOUNT_SECFLAVOUR)
                         args->auth_flavors[0] = data->pseudoflavor;
                 if (!args->nfs_server.hostname)
@@ -2637,6 +2638,7 @@ static int nfs4_validate_mount_data(void *options,
                         goto out_no_address;
                 args->nfs_server.port = ntohs(((struct sockaddr_in *)sap)->sin_port);
 
+                args->auth_flavors[0] = RPC_AUTH_UNIX;
                 if (data->auth_flavourlen) {
                         if (data->auth_flavourlen > 1)
                                 goto out_inval_auth;
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 689fb608648e..bccfec8343c5 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -219,13 +219,32 @@ static int nilfs_writepage(struct page *page, struct writeback_control *wbc)
 
 static int nilfs_set_page_dirty(struct page *page)
 {
-        int ret = __set_page_dirty_buffers(page);
+        int ret = __set_page_dirty_nobuffers(page);
 
-        if (ret) {
+        if (page_has_buffers(page)) {
                 struct inode *inode = page->mapping->host;
-                unsigned nr_dirty = 1 << (PAGE_SHIFT - inode->i_blkbits);
+                unsigned nr_dirty = 0;
+                struct buffer_head *bh, *head;
 
-                nilfs_set_file_dirty(inode, nr_dirty);
+                /*
+                 * This page is locked by callers, and no other thread
+                 * concurrently marks its buffers dirty since they are
+                 * only dirtied through routines in fs/buffer.c in
+                 * which call sites of mark_buffer_dirty are protected
+                 * by page lock.
+                 */
+                bh = head = page_buffers(page);
+                do {
+                        /* Do not mark hole blocks dirty */
+                        if (buffer_dirty(bh) || !buffer_mapped(bh))
+                                continue;
+
+                        set_buffer_dirty(bh);
+                        nr_dirty++;
+                } while (bh = bh->b_this_page, bh != head);
+
+                if (nr_dirty)
+                        nilfs_set_file_dirty(inode, nr_dirty);
         }
         return ret;
 }
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index b3fdd1a323d6..e68588e6b1e8 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1408,6 +1408,7 @@ int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
                                      mres->lockname_len, mres->lockname);
                                 ret = -EFAULT;
                                 spin_unlock(&res->spinlock);
+                                dlm_lockres_put(res);
                                 goto leave;
                         }
                         res->state |= DLM_LOCK_RES_MIGRATING;
diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
index 1c39efb71bab..2487116d0d33 100644
--- a/fs/ocfs2/extent_map.c
+++ b/fs/ocfs2/extent_map.c
@@ -790,7 +790,7 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                                                  &hole_size, &rec, &is_last);
                 if (ret) {
                         mlog_errno(ret);
-                        goto out;
+                        goto out_unlock;
                 }
 
                 if (rec.e_blkno == 0ULL) {
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 8a7509f9e6f5..ff54014a24ec 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -2288,7 +2288,7 @@ relock:
                 ret = ocfs2_inode_lock(inode, NULL, 1);
                 if (ret < 0) {
                         mlog_errno(ret);
-                        goto out_sems;
+                        goto out;
                 }
 
                 ocfs2_inode_unlock(inode, 1);
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 04ee1b57c243..b4a5cdf9dbc5 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -947,7 +947,7 @@ leave:
         ocfs2_free_dir_lookup_result(&orphan_insert);
         ocfs2_free_dir_lookup_result(&lookup);
 
-        if (status)
+        if (status && (status != -ENOTEMPTY))
                 mlog_errno(status);
 
         return status;
@@ -2216,7 +2216,7 @@ out:
 
         brelse(orphan_dir_bh);
 
-        return 0;
+        return ret;
 }
 
 int ocfs2_create_inode_in_orphan(struct inode *dir,
diff --git a/fs/pnode.c b/fs/pnode.c
index 3d2a7141b87a..9af0df15256e 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -83,7 +83,8 @@ static int do_make_slave(struct mount *mnt)
                 if (peer_mnt == mnt)
                         peer_mnt = NULL;
         }
-        if (IS_MNT_SHARED(mnt) && list_empty(&mnt->mnt_share))
+        if (mnt->mnt_group_id && IS_MNT_SHARED(mnt) &&
+            list_empty(&mnt->mnt_share))
                 mnt_release_group_id(mnt);
 
         list_del_init(&mnt->mnt_share);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index dd51e50001fe..c3834dad09b3 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2118,6 +2118,7 @@ static int show_timer(struct seq_file *m, void *v)
                 nstr[notify & ~SIGEV_THREAD_ID],
                 (notify & SIGEV_THREAD_ID) ? "tid" : "pid",
                 pid_nr_ns(timer->it_pid, tp->ns));
+        seq_printf(m, "ClockID: %d\n", timer->it_clock);
 
         return 0;
 }
diff --git a/fs/proc/kmsg.c b/fs/proc/kmsg.c
index bd4b5a740ff1..bdfabdaefdce 100644
--- a/fs/proc/kmsg.c
+++ b/fs/proc/kmsg.c
@@ -21,12 +21,12 @@ extern wait_queue_head_t log_wait;
 
 static int kmsg_open(struct inode * inode, struct file * file)
 {
-        return do_syslog(SYSLOG_ACTION_OPEN, NULL, 0, SYSLOG_FROM_FILE);
+        return do_syslog(SYSLOG_ACTION_OPEN, NULL, 0, SYSLOG_FROM_PROC);
 }
 
 static int kmsg_release(struct inode * inode, struct file * file)
 {
-        (void) do_syslog(SYSLOG_ACTION_CLOSE, NULL, 0, SYSLOG_FROM_FILE);
+        (void) do_syslog(SYSLOG_ACTION_CLOSE, NULL, 0, SYSLOG_FROM_PROC);
         return 0;
 }
 
@@ -34,15 +34,15 @@ static ssize_t kmsg_read(struct file *file, char __user *buf,
                          size_t count, loff_t *ppos)
 {
         if ((file->f_flags & O_NONBLOCK) &&
-            !do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
+            !do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_PROC))
                 return -EAGAIN;
-        return do_syslog(SYSLOG_ACTION_READ, buf, count, SYSLOG_FROM_FILE);
+        return do_syslog(SYSLOG_ACTION_READ, buf, count, SYSLOG_FROM_PROC);
 }
 
 static unsigned int kmsg_poll(struct file *file, poll_table *wait)
 {
         poll_wait(file, &log_wait, wait);
-        if (do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
+        if (do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_PROC))
                 return POLLIN | POLLRDNORM;
         return 0;
 }
diff --git a/fs/qnx6/dir.c b/fs/qnx6/dir.c
index 8798d065e400..afa6be6fc397 100644
--- a/fs/qnx6/dir.c
+++ b/fs/qnx6/dir.c
@@ -120,7 +120,7 @@ static int qnx6_readdir(struct file *filp, void *dirent, filldir_t filldir)
         struct inode *inode = file_inode(filp);
         struct super_block *s = inode->i_sb;
         struct qnx6_sb_info *sbi = QNX6_SB(s);
-        loff_t pos = filp->f_pos & (QNX6_DIR_ENTRY_SIZE - 1);
+        loff_t pos = filp->f_pos & ~(QNX6_DIR_ENTRY_SIZE - 1);
         unsigned long npages = dir_pages(inode);
         unsigned long n = pos >> PAGE_CACHE_SHIFT;
         unsigned start = (pos & ~PAGE_CACHE_MASK) / QNX6_DIR_ENTRY_SIZE;
diff --git a/fs/read_write.c b/fs/read_write.c
index 03430008704e..2cefa417be34 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1064,6 +1064,7 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
         struct fd in, out;
         struct inode *in_inode, *out_inode;
         loff_t pos;
+        loff_t out_pos;
         ssize_t retval;
         int fl;
 
@@ -1077,12 +1078,14 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
         if (!(in.file->f_mode & FMODE_READ))
                 goto fput_in;
         retval = -ESPIPE;
-        if (!ppos)
-                ppos = &in.file->f_pos;
-        else
+        if (!ppos) {
+                pos = in.file->f_pos;
+        } else {
+                pos = *ppos;
                 if (!(in.file->f_mode & FMODE_PREAD))
                         goto fput_in;
-        retval = rw_verify_area(READ, in.file, ppos, count);
+        }
+        retval = rw_verify_area(READ, in.file, &pos, count);
         if (retval < 0)
                 goto fput_in;
         count = retval;
@@ -1099,7 +1102,8 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
         retval = -EINVAL;
         in_inode = file_inode(in.file);
         out_inode = file_inode(out.file);
-        retval = rw_verify_area(WRITE, out.file, &out.file->f_pos, count);
+        out_pos = out.file->f_pos;
+        retval = rw_verify_area(WRITE, out.file, &out_pos, count);
         if (retval < 0)
                 goto fput_out;
         count = retval;
@@ -1107,7 +1111,6 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
         if (!max)
                 max = min(in_inode->i_sb->s_maxbytes, out_inode->i_sb->s_maxbytes);
 
-        pos = *ppos;
         if (unlikely(pos + count > max)) {
                 retval = -EOVERFLOW;
                 if (pos >= max)
@@ -1126,18 +1129,23 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
         if (in.file->f_flags & O_NONBLOCK)
                 fl = SPLICE_F_NONBLOCK;
 #endif
-        retval = do_splice_direct(in.file, ppos, out.file, count, fl);
+        retval = do_splice_direct(in.file, &pos, out.file, &out_pos, count, fl);
 
         if (retval > 0) {
                 add_rchar(current, retval);
                 add_wchar(current, retval);
                 fsnotify_access(in.file);
                 fsnotify_modify(out.file);
+                out.file->f_pos = out_pos;
+                if (ppos)
+                        *ppos = pos;
+                else
+                        in.file->f_pos = pos;
         }
 
         inc_syscr(current);
         inc_syscw(current);
-        if (*ppos > max)
+        if (pos > max)
                 retval = -EOVERFLOW;
 
 fput_out:
diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
index 66c53b642a88..6c2d136561cb 100644
--- a/fs/reiserfs/dir.c
+++ b/fs/reiserfs/dir.c
@@ -204,6 +204,8 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent,
                                 next_pos = deh_offset(deh) + 1;
 
                                 if (item_moved(&tmp_ih, &path_to_entry)) {
+                                        set_cpu_key_k_offset(&pos_key,
+                                                             next_pos);
                                         goto research;
                                 }
                         }       /* for */
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 77d6d47abc83..f844533792ee 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -1811,11 +1811,16 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
                                   TYPE_STAT_DATA, SD_SIZE, MAX_US_INT);
         memcpy(INODE_PKEY(inode), &(ih.ih_key), KEY_SIZE);
         args.dirid = le32_to_cpu(ih.ih_key.k_dir_id);
-        if (insert_inode_locked4(inode, args.objectid,
-                             reiserfs_find_actor, &args) < 0) {
+
+        reiserfs_write_unlock(inode->i_sb);
+        err = insert_inode_locked4(inode, args.objectid,
+                             reiserfs_find_actor, &args);
+        reiserfs_write_lock(inode->i_sb);
+        if (err) {
                 err = -EINVAL;
                 goto out_bad_inode;
         }
+
         if (old_format_only(sb))
                 /* not a perfect generation count, as object ids can be reused, but
                  ** this is as good as reiserfs can do right now.
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index 4cce1d9552fb..821bcf70e467 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -318,7 +318,19 @@ static int delete_one_xattr(struct dentry *dentry, void *data)
 static int chown_one_xattr(struct dentry *dentry, void *data)
 {
         struct iattr *attrs = data;
-        return reiserfs_setattr(dentry, attrs);
+        int ia_valid = attrs->ia_valid;
+        int err;
+
+        /*
+         * We only want the ownership bits. Otherwise, we'll do
+         * things like change a directory to a regular file if
+         * ATTR_MODE is set.
+         */
+        attrs->ia_valid &= (ATTR_UID|ATTR_GID);
+        err = reiserfs_setattr(dentry, attrs);
+        attrs->ia_valid = ia_valid;
+
+        return err;
 }
 
 /* No i_mutex, but the inode is unconnected. */
diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
index d7c01ef64eda..6c8767fdfc6a 100644
--- a/fs/reiserfs/xattr_acl.c
+++ b/fs/reiserfs/xattr_acl.c
@@ -443,6 +443,9 @@ int reiserfs_acl_chmod(struct inode *inode)
         int depth;
         int error;
 
+        if (IS_PRIVATE(inode))
+                return 0;
+
         if (S_ISLNK(inode->i_mode))
                 return -EOPNOTSUPP;
 
diff --git a/fs/splice.c b/fs/splice.c
index e6b25598c8c4..d37431dd60a1 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1274,7 +1274,7 @@ static int direct_splice_actor(struct pipe_inode_info *pipe,
 {
         struct file *file = sd->u.file;
 
-        return do_splice_from(pipe, file, &file->f_pos, sd->total_len,
+        return do_splice_from(pipe, file, sd->opos, sd->total_len,
                               sd->flags);
 }
 
@@ -1283,6 +1283,7 @@ static int direct_splice_actor(struct pipe_inode_info *pipe,
  * @in:         file to splice from
  * @ppos:       input file offset
  * @out:        file to splice to
+ * @opos:       output file offset
  * @len:        number of bytes to splice
  * @flags:      splice modifier flags
  *
@@ -1294,7 +1295,7 @@ static int direct_splice_actor(struct pipe_inode_info *pipe,
  *
  */
 long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
-                      size_t len, unsigned int flags)
+                      loff_t *opos, size_t len, unsigned int flags)
 {
         struct splice_desc sd = {
                 .len            = len,
@@ -1302,6 +1303,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
                 .flags          = flags,
                 .pos            = *ppos,
                 .u.file         = out,
+                .opos           = opos,
         };
         long ret;
 
@@ -1325,7 +1327,7 @@ static long do_splice(struct file *in, loff_t __user *off_in,
 {
         struct pipe_inode_info *ipipe;
         struct pipe_inode_info *opipe;
-        loff_t offset, *off;
+        loff_t offset;
         long ret;
 
         ipipe = get_pipe_info(in);
@@ -1356,13 +1358,15 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                                 return -EINVAL;
                         if (copy_from_user(&offset, off_out, sizeof(loff_t)))
                                 return -EFAULT;
-                        off = &offset;
-                } else
-                        off = &out->f_pos;
+                } else {
+                        offset = out->f_pos;
+                }
 
-                ret = do_splice_from(ipipe, out, off, len, flags);
+                ret = do_splice_from(ipipe, out, &offset, len, flags);
 
-                if (off_out && copy_to_user(off_out, off, sizeof(loff_t)))
+                if (!off_out)
+                        out->f_pos = offset;
+                else if (copy_to_user(off_out, &offset, sizeof(loff_t)))
                         ret = -EFAULT;
 
                 return ret;
@@ -1376,13 +1380,15 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                                 return -EINVAL;
                         if (copy_from_user(&offset, off_in, sizeof(loff_t)))
                                 return -EFAULT;
-                        off = &offset;
-                } else
-                        off = &in->f_pos;
+                } else {
+                        offset = in->f_pos;
+                }
 
-                ret = do_splice_to(in, off, opipe, len, flags);
+                ret = do_splice_to(in, &offset, opipe, len, flags);
 
-                if (off_in && copy_to_user(off_in, off, sizeof(loff_t)))
+                if (!off_in)
+                        in->f_pos = offset;
+                else if (copy_to_user(off_in, &offset, sizeof(loff_t)))
                         ret = -EFAULT;
 
                 return ret;
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index de08c92f2e23..605af512aec2 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -349,31 +349,50 @@ static unsigned int vfs_dent_type(uint8_t type)
 static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
 {
         int err, over = 0;
+        loff_t pos = file->f_pos;
         struct qstr nm;
         union ubifs_key key;
         struct ubifs_dent_node *dent;
         struct inode *dir = file_inode(file);
         struct ubifs_info *c = dir->i_sb->s_fs_info;
 
-        dbg_gen("dir ino %lu, f_pos %#llx", dir->i_ino, file->f_pos);
+        dbg_gen("dir ino %lu, f_pos %#llx", dir->i_ino, pos);
 
-        if (file->f_pos > UBIFS_S_KEY_HASH_MASK || file->f_pos == 2)
+        if (pos > UBIFS_S_KEY_HASH_MASK || pos == 2)
                 /*
                  * The directory was seek'ed to a senseless position or there
                  * are no more entries.
                  */
                 return 0;
 
+        if (file->f_version == 0) {
+                /*
+                 * The file was seek'ed, which means that @file->private_data
+                 * is now invalid. This may also be just the first
+                 * 'ubifs_readdir()' invocation, in which case
+                 * @file->private_data is NULL, and the below code is
+                 * basically a no-op.
+                 */
+                kfree(file->private_data);
+                file->private_data = NULL;
+        }
+
+        /*
+         * 'generic_file_llseek()' unconditionally sets @file->f_version to
+         * zero, and we use this for detecting whether the file was seek'ed.
+         */
+        file->f_version = 1;
+
         /* File positions 0 and 1 correspond to "." and ".." */
-        if (file->f_pos == 0) {
+        if (pos == 0) {
                 ubifs_assert(!file->private_data);
                 over = filldir(dirent, ".", 1, 0, dir->i_ino, DT_DIR);
                 if (over)
                         return 0;
-                file->f_pos = 1;
+                file->f_pos = pos = 1;
         }
 
-        if (file->f_pos == 1) {
+        if (pos == 1) {
                 ubifs_assert(!file->private_data);
                 over = filldir(dirent, "..", 2, 1,
                                parent_ino(file->f_path.dentry), DT_DIR);
@@ -389,7 +408,7 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
                         goto out;
                 }
 
-                file->f_pos = key_hash_flash(c, &dent->key);
+                file->f_pos = pos = key_hash_flash(c, &dent->key);
                 file->private_data = dent;
         }
 
@@ -397,17 +416,16 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
         if (!dent) {
                 /*
                  * The directory was seek'ed to and is now readdir'ed.
-                 * Find the entry corresponding to @file->f_pos or the
-                 * closest one.
+                 * Find the entry corresponding to @pos or the closest one.
                  */
-                dent_key_init_hash(c, &key, dir->i_ino, file->f_pos);
+                dent_key_init_hash(c, &key, dir->i_ino, pos);
                 nm.name = NULL;
                 dent = ubifs_tnc_next_ent(c, &key, &nm);
                 if (IS_ERR(dent)) {
                         err = PTR_ERR(dent);
                         goto out;
                 }
-                file->f_pos = key_hash_flash(c, &dent->key);
+                file->f_pos = pos = key_hash_flash(c, &dent->key);
                 file->private_data = dent;
         }
 
@@ -419,7 +437,7 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
                              ubifs_inode(dir)->creat_sqnum);
 
                 nm.len = le16_to_cpu(dent->nlen);
-                over = filldir(dirent, dent->name, nm.len, file->f_pos,
+                over = filldir(dirent, dent->name, nm.len, pos,
                                le64_to_cpu(dent->inum),
                                vfs_dent_type(dent->type));
                 if (over)
@@ -435,9 +453,17 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
                 }
 
                 kfree(file->private_data);
-                file->f_pos = key_hash_flash(c, &dent->key);
+                file->f_pos = pos = key_hash_flash(c, &dent->key);
                 file->private_data = dent;
                 cond_resched();
+
+                if (file->f_version == 0)
+                        /*
+                         * The file was seek'ed meanwhile, lets return and start
+                         * reading direntries from the new position on the next
+                         * invocation.
+                         */
+                        return 0;
         }
 
 out:
@@ -448,15 +474,13 @@ out:
 
         kfree(file->private_data);
         file->private_data = NULL;
+        /* 2 is a special value indicating that there are no more direntries */
         file->f_pos = 2;
         return 0;
 }
 
-/* If a directory is seeked, we have to free saved readdir() state */
 static loff_t ubifs_dir_llseek(struct file *file, loff_t offset, int whence)
 {
-        kfree(file->private_data);
-        file->private_data = NULL;
         return generic_file_llseek(file, offset, whence);
 }
 
diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
index 1d32f1d52763..306d883d89bc 100644
--- a/fs/xfs/xfs_acl.c
+++ b/fs/xfs/xfs_acl.c
@@ -21,6 +21,8 @@
 #include "xfs_bmap_btree.h"
 #include "xfs_inode.h"
 #include "xfs_vnodeops.h"
+#include "xfs_sb.h"
+#include "xfs_mount.h"
 #include "xfs_trace.h"
 #include <linux/slab.h>
 #include <linux/xattr.h>
@@ -34,7 +36,9 @@
  */
 
 STATIC struct posix_acl *
-xfs_acl_from_disk(struct xfs_acl *aclp)
+xfs_acl_from_disk(
+        struct xfs_acl  *aclp,
+        int             max_entries)
 {
         struct posix_acl_entry *acl_e;
         struct posix_acl *acl;
@@ -42,7 +46,7 @@ xfs_acl_from_disk(struct xfs_acl *aclp)
         unsigned int count, i;
 
         count = be32_to_cpu(aclp->acl_cnt);
-        if (count > XFS_ACL_MAX_ENTRIES)
+        if (count > max_entries)
                 return ERR_PTR(-EFSCORRUPTED);
 
         acl = posix_acl_alloc(count, GFP_KERNEL);
@@ -108,9 +112,9 @@ xfs_get_acl(struct inode *inode, int type)
         struct xfs_inode *ip = XFS_I(inode);
         struct posix_acl *acl;
         struct xfs_acl *xfs_acl;
-        int len = sizeof(struct xfs_acl);
         unsigned char *ea_name;
         int error;
+        int len;
 
         acl = get_cached_acl(inode, type);
         if (acl != ACL_NOT_CACHED)
@@ -133,8 +137,8 @@ xfs_get_acl(struct inode *inode, int type)
          * If we have a cached ACLs value just return it, not need to
          * go out to the disk.
          */
-
-        xfs_acl = kzalloc(sizeof(struct xfs_acl), GFP_KERNEL);
+        len = XFS_ACL_MAX_SIZE(ip->i_mount);
+        xfs_acl = kzalloc(len, GFP_KERNEL);
         if (!xfs_acl)
                 return ERR_PTR(-ENOMEM);
 
@@ -153,7 +157,7 @@ xfs_get_acl(struct inode *inode, int type)
                 goto out;
         }
 
-        acl = xfs_acl_from_disk(xfs_acl);
+        acl = xfs_acl_from_disk(xfs_acl, XFS_ACL_MAX_ENTRIES(ip->i_mount));
         if (IS_ERR(acl))
                 goto out;
 
@@ -189,16 +193,17 @@ xfs_set_acl(struct inode *inode, int type, struct posix_acl *acl)
 
         if (acl) {
                 struct xfs_acl *xfs_acl;
-                int len;
+                int len = XFS_ACL_MAX_SIZE(ip->i_mount);
 
-                xfs_acl = kzalloc(sizeof(struct xfs_acl), GFP_KERNEL);
+                xfs_acl = kzalloc(len, GFP_KERNEL);
                 if (!xfs_acl)
                         return -ENOMEM;
 
                 xfs_acl_to_disk(xfs_acl, acl);
-                len = sizeof(struct xfs_acl) -
-                        (sizeof(struct xfs_acl_entry) *
-                         (XFS_ACL_MAX_ENTRIES - acl->a_count));
+
+                /* subtract away the unused acl entries */
+                len -= sizeof(struct xfs_acl_entry) *
+                         (XFS_ACL_MAX_ENTRIES(ip->i_mount) - acl->a_count);
 
                 error = -xfs_attr_set(ip, ea_name, (unsigned char *)xfs_acl,
                                 len, ATTR_ROOT);
@@ -243,7 +248,7 @@ xfs_set_mode(struct inode *inode, umode_t mode)
 static int
 xfs_acl_exists(struct inode *inode, unsigned char *name)
 {
-        int len = sizeof(struct xfs_acl);
+        int len = XFS_ACL_MAX_SIZE(XFS_M(inode->i_sb));
 
         return (xfs_attr_get(XFS_I(inode), name, NULL, &len,
                             ATTR_ROOT|ATTR_KERNOVAL) == 0);
@@ -379,7 +384,7 @@ xfs_xattr_acl_set(struct dentry *dentry, const char *name,
                 goto out_release;
 
         error = -EINVAL;
-        if (acl->a_count > XFS_ACL_MAX_ENTRIES)
+        if (acl->a_count > XFS_ACL_MAX_ENTRIES(XFS_M(inode->i_sb)))
                 goto out_release;
 
         if (type == ACL_TYPE_ACCESS) {
diff --git a/fs/xfs/xfs_acl.h b/fs/xfs/xfs_acl.h
index 39632d941354..4016a567b83c 100644
--- a/fs/xfs/xfs_acl.h
+++ b/fs/xfs/xfs_acl.h
@@ -22,19 +22,36 @@ struct inode;
 struct posix_acl;
 struct xfs_inode;
 
-#define XFS_ACL_MAX_ENTRIES 25
 #define XFS_ACL_NOT_PRESENT (-1)
 
 /* On-disk XFS access control list structure */
+struct xfs_acl_entry {
+        __be32  ae_tag;
+        __be32  ae_id;
+        __be16  ae_perm;
+        __be16  ae_pad;         /* fill the implicit hole in the structure */
+};
+
 struct xfs_acl {
-        __be32          acl_cnt;
-        struct xfs_acl_entry {
-                __be32  ae_tag;
-                __be32  ae_id;
-                __be16  ae_perm;
-        } acl_entry[XFS_ACL_MAX_ENTRIES];
+        __be32                  acl_cnt;
+        struct xfs_acl_entry    acl_entry[0];
 };
 
+/*
+ * The number of ACL entries allowed is defined by the on-disk format.
+ * For v4 superblocks, that is limited to 25 entries. For v5 superblocks, it is
+ * limited only by the maximum size of the xattr that stores the information.
+ */
+#define XFS_ACL_MAX_ENTRIES(mp) \
+        (xfs_sb_version_hascrc(&mp->m_sb) \
+                ?  (XATTR_SIZE_MAX - sizeof(struct xfs_acl)) / \
+                                                sizeof(struct xfs_acl_entry) \
+                : 25)
+
+#define XFS_ACL_MAX_SIZE(mp) \
+        (sizeof(struct xfs_acl) + \
+                sizeof(struct xfs_acl_entry) * XFS_ACL_MAX_ENTRIES((mp)))
+
 /* On-disk XFS extended attribute names */
 #define SGI_ACL_FILE            (unsigned char *)"SGI_ACL_FILE"
 #define SGI_ACL_DEFAULT         (unsigned char *)"SGI_ACL_DEFAULT"
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 2b2691b73428..41a695048be7 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -725,6 +725,25 @@ xfs_convert_page(
                         (xfs_off_t)(page->index + 1) << PAGE_CACHE_SHIFT,
                         i_size_read(inode));
 
+        /*
+         * If the current map does not span the entire page we are about to try
+         * to write, then give up. The only way we can write a page that spans
+         * multiple mappings in a single writeback iteration is via the
+         * xfs_vm_writepage() function. Data integrity writeback requires the
+         * entire page to be written in a single attempt, otherwise the part of
+         * the page we don't write here doesn't get written as part of the data
+         * integrity sync.
+         *
+         * For normal writeback, we also don't attempt to write partial pages
+         * here as it simply means that write_cache_pages() will see it under
+         * writeback and ignore the page until some point in the future, at
+         * which time this will be the only page in the file that needs
+         * writeback.  Hence for more optimal IO patterns, we should always
+         * avoid partial page writeback due to multiple mappings on a page here.
+         */
+        if (!xfs_imap_valid(inode, imap, end_offset))
+                goto fail_unlock_page;
+
         len = 1 << inode->i_blkbits;
         p_offset = min_t(unsigned long, end_offset & (PAGE_CACHE_SIZE - 1),
                                         PAGE_CACHE_SIZE);
diff --git a/fs/xfs/xfs_attr_leaf.c b/fs/xfs/xfs_attr_leaf.c
index 08d5457c948e..31d3cd129269 100644
--- a/fs/xfs/xfs_attr_leaf.c
+++ b/fs/xfs/xfs_attr_leaf.c
@@ -931,20 +931,22 @@ xfs_attr_shortform_list(xfs_attr_list_context_t *context)
  */
 int
 xfs_attr_shortform_allfit(
-        struct xfs_buf  *bp,
-        struct xfs_inode *dp)
+        struct xfs_buf          *bp,
+        struct xfs_inode        *dp)
 {
-        xfs_attr_leafblock_t *leaf;
-        xfs_attr_leaf_entry_t *entry;
+        struct xfs_attr_leafblock *leaf;
+        struct xfs_attr_leaf_entry *entry;
         xfs_attr_leaf_name_local_t *name_loc;
-        int bytes, i;
+        struct xfs_attr3_icleaf_hdr leafhdr;
+        int                     bytes;
+        int                     i;
 
         leaf = bp->b_addr;
-        ASSERT(leaf->hdr.info.magic == cpu_to_be16(XFS_ATTR_LEAF_MAGIC));
+        xfs_attr3_leaf_hdr_from_disk(&leafhdr, leaf);
+        entry = xfs_attr3_leaf_entryp(leaf);
 
-        entry = &leaf->entries[0];
         bytes = sizeof(struct xfs_attr_sf_hdr);
-        for (i = 0; i < be16_to_cpu(leaf->hdr.count); entry++, i++) {
+        for (i = 0; i < leafhdr.count; entry++, i++) {
                 if (entry->flags & XFS_ATTR_INCOMPLETE)
                         continue;               /* don't copy partial entries */
                 if (!(entry->flags & XFS_ATTR_LOCAL))
@@ -954,15 +956,15 @@ xfs_attr_shortform_allfit(
                         return(0);
                 if (be16_to_cpu(name_loc->valuelen) >= XFS_ATTR_SF_ENTSIZE_MAX)
                         return(0);
-                bytes += sizeof(struct xfs_attr_sf_entry)-1
+                bytes += sizeof(struct xfs_attr_sf_entry) - 1
                                 + name_loc->namelen
                                 + be16_to_cpu(name_loc->valuelen);
         }
         if ((dp->i_mount->m_flags & XFS_MOUNT_ATTR2) &&
             (dp->i_d.di_format != XFS_DINODE_FMT_BTREE) &&
             (bytes == sizeof(struct xfs_attr_sf_hdr)))
-                return(-1);
-        return(xfs_attr_shortform_bytesfit(dp, bytes));
+                return -1;
+        return xfs_attr_shortform_bytesfit(dp, bytes);
 }
 
 /*
@@ -1410,7 +1412,7 @@ xfs_attr3_leaf_add_work(
                 name_rmt->valuelen = 0;
                 name_rmt->valueblk = 0;
                 args->rmtblkno = 1;
-                args->rmtblkcnt = XFS_B_TO_FSB(mp, args->valuelen);
+                args->rmtblkcnt = xfs_attr3_rmt_blocks(mp, args->valuelen);
         }
         xfs_trans_log_buf(args->trans, bp,
              XFS_DA_LOGRANGE(leaf, xfs_attr3_leaf_name(leaf, args->index),
@@ -1443,11 +1445,12 @@ xfs_attr3_leaf_add_work(
 STATIC void
 xfs_attr3_leaf_compact(
         struct xfs_da_args      *args,
-        struct xfs_attr3_icleaf_hdr *ichdr_d,
+        struct xfs_attr3_icleaf_hdr *ichdr_dst,
         struct xfs_buf          *bp)
 {
-        xfs_attr_leafblock_t    *leaf_s, *leaf_d;
-        struct xfs_attr3_icleaf_hdr ichdr_s;
+        struct xfs_attr_leafblock *leaf_src;
+        struct xfs_attr_leafblock *leaf_dst;
+        struct xfs_attr3_icleaf_hdr ichdr_src;
         struct xfs_trans        *trans = args->trans;
         struct xfs_mount        *mp = trans->t_mountp;
         char                    *tmpbuffer;
@@ -1455,29 +1458,38 @@ xfs_attr3_leaf_compact(
         trace_xfs_attr_leaf_compact(args);
 
         tmpbuffer = kmem_alloc(XFS_LBSIZE(mp), KM_SLEEP);
-        ASSERT(tmpbuffer != NULL);
         memcpy(tmpbuffer, bp->b_addr, XFS_LBSIZE(mp));
         memset(bp->b_addr, 0, XFS_LBSIZE(mp));
+        leaf_src = (xfs_attr_leafblock_t *)tmpbuffer;
+        leaf_dst = bp->b_addr;
 
         /*
-         * Copy basic information
+         * Copy the on-disk header back into the destination buffer to ensure
+         * all the information in the header that is not part of the incore
+         * header structure is preserved.
          */
-        leaf_s = (xfs_attr_leafblock_t *)tmpbuffer;
-        leaf_d = bp->b_addr;
-        ichdr_s = *ichdr_d;     /* struct copy */
-        ichdr_d->firstused = XFS_LBSIZE(mp);
-        ichdr_d->usedbytes = 0;
-        ichdr_d->count = 0;
-        ichdr_d->holes = 0;
-        ichdr_d->freemap[0].base = xfs_attr3_leaf_hdr_size(leaf_s);
-        ichdr_d->freemap[0].size = ichdr_d->firstused - ichdr_d->freemap[0].base;
+        memcpy(bp->b_addr, tmpbuffer, xfs_attr3_leaf_hdr_size(leaf_src));
+
+        /* Initialise the incore headers */
+        ichdr_src = *ichdr_dst; /* struct copy */
+        ichdr_dst->firstused = XFS_LBSIZE(mp);
+        ichdr_dst->usedbytes = 0;
+        ichdr_dst->count = 0;
+        ichdr_dst->holes = 0;
+        ichdr_dst->freemap[0].base = xfs_attr3_leaf_hdr_size(leaf_src);
+        ichdr_dst->freemap[0].size = ichdr_dst->firstused -
+                                                ichdr_dst->freemap[0].base;
+
+
+        /* write the header back to initialise the underlying buffer */
+        xfs_attr3_leaf_hdr_to_disk(leaf_dst, ichdr_dst);
 
         /*
          * Copy all entry's in the same (sorted) order,
          * but allocate name/value pairs packed and in sequence.
          */
-        xfs_attr3_leaf_moveents(leaf_s, &ichdr_s, 0, leaf_d, ichdr_d, 0,
-                                ichdr_s.count, mp);
+        xfs_attr3_leaf_moveents(leaf_src, &ichdr_src, 0, leaf_dst, ichdr_dst, 0,
+                                ichdr_src.count, mp);
         /*
          * this logs the entire buffer, but the caller must write the header
          * back to the buffer when it is finished modifying it.
@@ -2179,14 +2191,24 @@ xfs_attr3_leaf_unbalance(
                 struct xfs_attr_leafblock *tmp_leaf;
                 struct xfs_attr3_icleaf_hdr tmphdr;
 
-                tmp_leaf = kmem_alloc(state->blocksize, KM_SLEEP);
-                memset(tmp_leaf, 0, state->blocksize);
-                memset(&tmphdr, 0, sizeof(tmphdr));
+                tmp_leaf = kmem_zalloc(state->blocksize, KM_SLEEP);
+
+                /*
+                 * Copy the header into the temp leaf so that all the stuff
+                 * not in the incore header is present and gets copied back in
+                 * once we've moved all the entries.
+                 */
+                memcpy(tmp_leaf, save_leaf, xfs_attr3_leaf_hdr_size(save_leaf));
 
+                memset(&tmphdr, 0, sizeof(tmphdr));
                 tmphdr.magic = savehdr.magic;
                 tmphdr.forw = savehdr.forw;
                 tmphdr.back = savehdr.back;
                 tmphdr.firstused = state->blocksize;
+
+                /* write the header to the temp buffer to initialise it */
+                xfs_attr3_leaf_hdr_to_disk(tmp_leaf, &tmphdr);
+
                 if (xfs_attr3_leaf_order(save_blk->bp, &savehdr,
                                          drop_blk->bp, &drophdr)) {
                         xfs_attr3_leaf_moveents(drop_leaf, &drophdr, 0,
@@ -2330,9 +2352,11 @@ xfs_attr3_leaf_lookup_int(
                         if (!xfs_attr_namesp_match(args->flags, entry->flags))
                                 continue;
                         args->index = probe;
+                        args->valuelen = be32_to_cpu(name_rmt->valuelen);
                         args->rmtblkno = be32_to_cpu(name_rmt->valueblk);
-                        args->rmtblkcnt = XFS_B_TO_FSB(args->dp->i_mount,
-                                                   be32_to_cpu(name_rmt->valuelen));
+                        args->rmtblkcnt = xfs_attr3_rmt_blocks(
+                                                        args->dp->i_mount,
+                                                        args->valuelen);
                         return XFS_ERROR(EEXIST);
                 }
         }
@@ -2383,7 +2407,8 @@ xfs_attr3_leaf_getvalue(
                 ASSERT(memcmp(args->name, name_rmt->name, args->namelen) == 0);
                 valuelen = be32_to_cpu(name_rmt->valuelen);
                 args->rmtblkno = be32_to_cpu(name_rmt->valueblk);
-                args->rmtblkcnt = XFS_B_TO_FSB(args->dp->i_mount, valuelen);
+                args->rmtblkcnt = xfs_attr3_rmt_blocks(args->dp->i_mount,
+                                                       valuelen);
                 if (args->flags & ATTR_KERNOVAL) {
                         args->valuelen = valuelen;
                         return 0;
@@ -2709,7 +2734,8 @@ xfs_attr3_leaf_list_int(
                                 args.valuelen = valuelen;
                                 args.value = kmem_alloc(valuelen, KM_SLEEP | KM_NOFS);
                                 args.rmtblkno = be32_to_cpu(name_rmt->valueblk);
-                                args.rmtblkcnt = XFS_B_TO_FSB(args.dp->i_mount, valuelen);
+                                args.rmtblkcnt = xfs_attr3_rmt_blocks(
+                                                        args.dp->i_mount, valuelen);
                                 retval = xfs_attr_rmtval_get(&args);
                                 if (retval)
                                         return retval;
@@ -3232,7 +3258,7 @@ xfs_attr3_leaf_inactive(
                         name_rmt = xfs_attr3_leaf_name_remote(leaf, i);
                         if (name_rmt->valueblk) {
                                 lp->valueblk = be32_to_cpu(name_rmt->valueblk);
-                                lp->valuelen = XFS_B_TO_FSB(dp->i_mount,
+                                lp->valuelen = xfs_attr3_rmt_blocks(dp->i_mount,
                                                     be32_to_cpu(name_rmt->valuelen));
                                 lp++;
                         }
diff --git a/fs/xfs/xfs_attr_leaf.h b/fs/xfs/xfs_attr_leaf.h
index f9d7846097e2..444a7704596c 100644
--- a/fs/xfs/xfs_attr_leaf.h
+++ b/fs/xfs/xfs_attr_leaf.h
@@ -128,6 +128,7 @@ struct xfs_attr3_leaf_hdr {
         __u8                    holes;
         __u8                    pad1;
         struct xfs_attr_leaf_map freemap[XFS_ATTR_LEAF_MAPSIZE];
+        __be32                  pad2;           /* 64 bit alignment */
 };
 
 #define XFS_ATTR3_LEAF_CRC_OFF  (offsetof(struct xfs_attr3_leaf_hdr, info.crc))
diff --git a/fs/xfs/xfs_attr_remote.c b/fs/xfs/xfs_attr_remote.c
index dee84466dcc9..ef6b0c124528 100644
--- a/fs/xfs/xfs_attr_remote.c
+++ b/fs/xfs/xfs_attr_remote.c
@@ -47,22 +47,55 @@
  * Each contiguous block has a header, so it is not just a simple attribute
  * length to FSB conversion.
  */
-static int
+int
 xfs_attr3_rmt_blocks(
         struct xfs_mount *mp,
         int             attrlen)
 {
-        int             buflen = XFS_ATTR3_RMT_BUF_SPACE(mp,
-                                                         mp->m_sb.sb_blocksize);
-        return (attrlen + buflen - 1) / buflen;
+        if (xfs_sb_version_hascrc(&mp->m_sb)) {
+                int buflen = XFS_ATTR3_RMT_BUF_SPACE(mp, mp->m_sb.sb_blocksize);
+                return (attrlen + buflen - 1) / buflen;
+        }
+        return XFS_B_TO_FSB(mp, attrlen);
+}
+
+/*
+ * Checking of the remote attribute header is split into two parts. The verifier
+ * does CRC, location and bounds checking, the unpacking function checks the
+ * attribute parameters and owner.
+ */
+static bool
+xfs_attr3_rmt_hdr_ok(
+        struct xfs_mount        *mp,
+        void                    *ptr,
+        xfs_ino_t               ino,
+        uint32_t                offset,
+        uint32_t                size,
+        xfs_daddr_t             bno)
+{
+        struct xfs_attr3_rmt_hdr *rmt = ptr;
+
+        if (bno != be64_to_cpu(rmt->rm_blkno))
+                return false;
+        if (offset != be32_to_cpu(rmt->rm_offset))
+                return false;
+        if (size != be32_to_cpu(rmt->rm_bytes))
+                return false;
+        if (ino != be64_to_cpu(rmt->rm_owner))
+                return false;
+
+        /* ok */
+        return true;
 }
 
 static bool
 xfs_attr3_rmt_verify(
-        struct xfs_buf          *bp)
+        struct xfs_mount        *mp,
+        void                    *ptr,
+        int                     fsbsize,
+        xfs_daddr_t             bno)
 {
-        struct xfs_mount        *mp = bp->b_target->bt_mount;
-        struct xfs_attr3_rmt_hdr *rmt = bp->b_addr;
+        struct xfs_attr3_rmt_hdr *rmt = ptr;
 
         if (!xfs_sb_version_hascrc(&mp->m_sb))
                 return false;
@@ -70,7 +103,9 @@ xfs_attr3_rmt_verify(
                 return false;
         if (!uuid_equal(&rmt->rm_uuid, &mp->m_sb.sb_uuid))
                 return false;
-        if (bp->b_bn != be64_to_cpu(rmt->rm_blkno))
+        if (be64_to_cpu(rmt->rm_blkno) != bno)
+                return false;
+        if (be32_to_cpu(rmt->rm_bytes) > fsbsize - sizeof(*rmt))
                 return false;
         if (be32_to_cpu(rmt->rm_offset) +
                                 be32_to_cpu(rmt->rm_bytes) >= XATTR_SIZE_MAX)
@@ -86,17 +121,40 @@ xfs_attr3_rmt_read_verify(
         struct xfs_buf  *bp)
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
+        char            *ptr;
+        int             len;
+        bool            corrupt = false;
+        xfs_daddr_t     bno;
 
         /* no verification of non-crc buffers */
         if (!xfs_sb_version_hascrc(&mp->m_sb))
                 return;
 
-        if (!xfs_verify_cksum(bp->b_addr, BBTOB(bp->b_length),
-                              XFS_ATTR3_RMT_CRC_OFF) ||
-            !xfs_attr3_rmt_verify(bp)) {
+        ptr = bp->b_addr;
+        bno = bp->b_bn;
+        len = BBTOB(bp->b_length);
+        ASSERT(len >= XFS_LBSIZE(mp));
+
+        while (len > 0) {
+                if (!xfs_verify_cksum(ptr, XFS_LBSIZE(mp),
+                                      XFS_ATTR3_RMT_CRC_OFF)) {
+                        corrupt = true;
+                        break;
+                }
+                if (!xfs_attr3_rmt_verify(mp, ptr, XFS_LBSIZE(mp), bno)) {
+                        corrupt = true;
+                        break;
+                }
+                len -= XFS_LBSIZE(mp);
+                ptr += XFS_LBSIZE(mp);
+                bno += mp->m_bsize;
+        }
+
+        if (corrupt) {
                 XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, bp->b_addr);
                 xfs_buf_ioerror(bp, EFSCORRUPTED);
-        }
+        } else
+                ASSERT(len == 0);
 }
 
 static void
@@ -105,23 +163,39 @@ xfs_attr3_rmt_write_verify(
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
         struct xfs_buf_log_item *bip = bp->b_fspriv;
+        char            *ptr;
+        int             len;
+        xfs_daddr_t     bno;
 
         /* no verification of non-crc buffers */
         if (!xfs_sb_version_hascrc(&mp->m_sb))
                 return;
 
-        if (!xfs_attr3_rmt_verify(bp)) {
-                XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, bp->b_addr);
-                xfs_buf_ioerror(bp, EFSCORRUPTED);
-                return;
-        }
+        ptr = bp->b_addr;
+        bno = bp->b_bn;
+        len = BBTOB(bp->b_length);
+        ASSERT(len >= XFS_LBSIZE(mp));
+
+        while (len > 0) {
+                if (!xfs_attr3_rmt_verify(mp, ptr, XFS_LBSIZE(mp), bno)) {
+                        XFS_CORRUPTION_ERROR(__func__,
+                                            XFS_ERRLEVEL_LOW, mp, bp->b_addr);
+                        xfs_buf_ioerror(bp, EFSCORRUPTED);
+                        return;
+                }
+                if (bip) {
+                        struct xfs_attr3_rmt_hdr *rmt;
+
+                        rmt = (struct xfs_attr3_rmt_hdr *)ptr;
+                        rmt->rm_lsn = cpu_to_be64(bip->bli_item.li_lsn);
+                }
+                xfs_update_cksum(ptr, XFS_LBSIZE(mp), XFS_ATTR3_RMT_CRC_OFF);
 
-        if (bip) {
-                struct xfs_attr3_rmt_hdr *rmt = bp->b_addr;
-                rmt->rm_lsn = cpu_to_be64(bip->bli_item.li_lsn);
+                len -= XFS_LBSIZE(mp);
+                ptr += XFS_LBSIZE(mp);
+                bno += mp->m_bsize;
         }
-        xfs_update_cksum(bp->b_addr, BBTOB(bp->b_length),
-                         XFS_ATTR3_RMT_CRC_OFF);
+        ASSERT(len == 0);
 }
 
 const struct xfs_buf_ops xfs_attr3_rmt_buf_ops = {
@@ -129,15 +203,16 @@ const struct xfs_buf_ops xfs_attr3_rmt_buf_ops = {
         .verify_write = xfs_attr3_rmt_write_verify,
 };
 
-static int
+STATIC int
 xfs_attr3_rmt_hdr_set(
         struct xfs_mount        *mp,
+        void                    *ptr,
         xfs_ino_t               ino,
         uint32_t                offset,
         uint32_t                size,
-        struct xfs_buf          *bp)
+        xfs_daddr_t             bno)
 {
-        struct xfs_attr3_rmt_hdr *rmt = bp->b_addr;
+        struct xfs_attr3_rmt_hdr *rmt = ptr;
 
         if (!xfs_sb_version_hascrc(&mp->m_sb))
                 return 0;
@@ -147,36 +222,107 @@ xfs_attr3_rmt_hdr_set(
         rmt->rm_bytes = cpu_to_be32(size);
         uuid_copy(&rmt->rm_uuid, &mp->m_sb.sb_uuid);
         rmt->rm_owner = cpu_to_be64(ino);
-        rmt->rm_blkno = cpu_to_be64(bp->b_bn);
-        bp->b_ops = &xfs_attr3_rmt_buf_ops;
+        rmt->rm_blkno = cpu_to_be64(bno);
 
         return sizeof(struct xfs_attr3_rmt_hdr);
 }
 
 /*
- * Checking of the remote attribute header is split into two parts. the verifier
- * does CRC, location and bounds checking, the unpacking function checks the
- * attribute parameters and owner.
+ * Helper functions to copy attribute data in and out of the one disk extents
  */
-static bool
-xfs_attr3_rmt_hdr_ok(
-        struct xfs_mount        *mp,
-        xfs_ino_t               ino,
-        uint32_t                offset,
-        uint32_t                size,
-        struct xfs_buf          *bp)
+STATIC int
+xfs_attr_rmtval_copyout(
+        struct xfs_mount *mp,
+        struct xfs_buf  *bp,
+        xfs_ino_t       ino,
+        int             *offset,
+        int             *valuelen,
+        char            **dst)
 {
-        struct xfs_attr3_rmt_hdr *rmt = bp->b_addr;
+        char            *src = bp->b_addr;
+        xfs_daddr_t     bno = bp->b_bn;
+        int             len = BBTOB(bp->b_length);
 
-        if (offset != be32_to_cpu(rmt->rm_offset))
-                return false;
-        if (size != be32_to_cpu(rmt->rm_bytes))
-                return false;
-        if (ino != be64_to_cpu(rmt->rm_owner))
-                return false;
+        ASSERT(len >= XFS_LBSIZE(mp));
 
-        /* ok */
-        return true;
+        while (len > 0 && *valuelen > 0) {
+                int hdr_size = 0;
+                int byte_cnt = XFS_ATTR3_RMT_BUF_SPACE(mp, XFS_LBSIZE(mp));
+
+                byte_cnt = min_t(int, *valuelen, byte_cnt);
+
+                if (xfs_sb_version_hascrc(&mp->m_sb)) {
+                        if (!xfs_attr3_rmt_hdr_ok(mp, src, ino, *offset,
+                                                  byte_cnt, bno)) {
+                                xfs_alert(mp,
+"remote attribute header mismatch bno/off/len/owner (0x%llx/0x%x/Ox%x/0x%llx)",
+                                        bno, *offset, byte_cnt, ino);
+                                return EFSCORRUPTED;
+                        }
+                        hdr_size = sizeof(struct xfs_attr3_rmt_hdr);
+                }
+
+                memcpy(*dst, src + hdr_size, byte_cnt);
+
+                /* roll buffer forwards */
+                len -= XFS_LBSIZE(mp);
+                src += XFS_LBSIZE(mp);
+                bno += mp->m_bsize;
+
+                /* roll attribute data forwards */
+                *valuelen -= byte_cnt;
+                *dst += byte_cnt;
+                *offset += byte_cnt;
+        }
+        return 0;
+}
+
+STATIC void
+xfs_attr_rmtval_copyin(
+        struct xfs_mount *mp,
+        struct xfs_buf  *bp,
+        xfs_ino_t       ino,
+        int             *offset,
+        int             *valuelen,
+        char            **src)
+{
+        char            *dst = bp->b_addr;
+        xfs_daddr_t     bno = bp->b_bn;
+        int             len = BBTOB(bp->b_length);
+
+        ASSERT(len >= XFS_LBSIZE(mp));
+
+        while (len > 0 && *valuelen > 0) {
+                int hdr_size;
+                int byte_cnt = XFS_ATTR3_RMT_BUF_SPACE(mp, XFS_LBSIZE(mp));
+
+                byte_cnt = min(*valuelen, byte_cnt);
+                hdr_size = xfs_attr3_rmt_hdr_set(mp, dst, ino, *offset,
+                                                 byte_cnt, bno);
+
+                memcpy(dst + hdr_size, *src, byte_cnt);
+
+                /*
+                 * If this is the last block, zero the remainder of it.
+                 * Check that we are actually the last block, too.
+                 */
+                if (byte_cnt + hdr_size < XFS_LBSIZE(mp)) {
+                        ASSERT(*valuelen - byte_cnt == 0);
+                        ASSERT(len == XFS_LBSIZE(mp));
+                        memset(dst + hdr_size + byte_cnt, 0,
+                                        XFS_LBSIZE(mp) - hdr_size - byte_cnt);
+                }
+
+                /* roll buffer forwards */
+                len -= XFS_LBSIZE(mp);
+                dst += XFS_LBSIZE(mp);
+                bno += mp->m_bsize;
+
+                /* roll attribute data forwards */
+                *valuelen -= byte_cnt;
+                *src += byte_cnt;
+                *offset += byte_cnt;
+        }
 }
 
 /*
@@ -190,13 +336,12 @@ xfs_attr_rmtval_get(
         struct xfs_bmbt_irec    map[ATTR_RMTVALUE_MAPSIZE];
         struct xfs_mount        *mp = args->dp->i_mount;
         struct xfs_buf          *bp;
-        xfs_daddr_t             dblkno;
         xfs_dablk_t             lblkno = args->rmtblkno;
-        void                    *dst = args->value;
+        char                    *dst = args->value;
         int                     valuelen = args->valuelen;
         int                     nmap;
         int                     error;
-        int                     blkcnt;
+        int                     blkcnt = args->rmtblkcnt;
         int                     i;
         int                     offset = 0;
 
@@ -207,52 +352,36 @@ xfs_attr_rmtval_get(
         while (valuelen > 0) {
                 nmap = ATTR_RMTVALUE_MAPSIZE;
                 error = xfs_bmapi_read(args->dp, (xfs_fileoff_t)lblkno,
-                                       args->rmtblkcnt, map, &nmap,
+                                       blkcnt, map, &nmap,
                                        XFS_BMAPI_ATTRFORK);
                 if (error)
                         return error;
                 ASSERT(nmap >= 1);
 
                 for (i = 0; (i < nmap) && (valuelen > 0); i++) {
-                        int     byte_cnt;
-                        char    *src;
+                        xfs_daddr_t     dblkno;
+                        int             dblkcnt;
 
                         ASSERT((map[i].br_startblock != DELAYSTARTBLOCK) &&
                                (map[i].br_startblock != HOLESTARTBLOCK));
                         dblkno = XFS_FSB_TO_DADDR(mp, map[i].br_startblock);
-                        blkcnt = XFS_FSB_TO_BB(mp, map[i].br_blockcount);
+                        dblkcnt = XFS_FSB_TO_BB(mp, map[i].br_blockcount);
                         error = xfs_trans_read_buf(mp, NULL, mp->m_ddev_targp,
-                                                   dblkno, blkcnt, 0, &bp,
+                                                   dblkno, dblkcnt, 0, &bp,
                                                    &xfs_attr3_rmt_buf_ops);
                         if (error)
                                 return error;
 
-                        byte_cnt = min_t(int, valuelen, BBTOB(bp->b_length));
-                        byte_cnt = XFS_ATTR3_RMT_BUF_SPACE(mp, byte_cnt);
-
-                        src = bp->b_addr;
-                        if (xfs_sb_version_hascrc(&mp->m_sb)) {
-                                if (!xfs_attr3_rmt_hdr_ok(mp, args->dp->i_ino,
-                                                        offset, byte_cnt, bp)) {
-                                        xfs_alert(mp,
-"remote attribute header does not match required off/len/owner (0x%x/Ox%x,0x%llx)",
-                                                offset, byte_cnt, args->dp->i_ino);
-                                        xfs_buf_relse(bp);
-                                        return EFSCORRUPTED;
-
-                                }
-
-                                src += sizeof(struct xfs_attr3_rmt_hdr);
-                        }
-
-                        memcpy(dst, src, byte_cnt);
+                        error = xfs_attr_rmtval_copyout(mp, bp, args->dp->i_ino,
+                                                        &offset, &valuelen,
+                                                        &dst);
                         xfs_buf_relse(bp);
+                        if (error)
+                                return error;
 
-                        offset += byte_cnt;
-                        dst += byte_cnt;
-                        valuelen -= byte_cnt;
-
+                        /* roll attribute extent map forwards */
                         lblkno += map[i].br_blockcount;
+                        blkcnt -= map[i].br_blockcount;
                 }
         }
         ASSERT(valuelen == 0);
@@ -270,17 +399,13 @@ xfs_attr_rmtval_set(
         struct xfs_inode        *dp = args->dp;
         struct xfs_mount        *mp = dp->i_mount;
         struct xfs_bmbt_irec    map;
-        struct xfs_buf          *bp;
-        xfs_daddr_t             dblkno;
         xfs_dablk_t             lblkno;
         xfs_fileoff_t           lfileoff = 0;
-        void                    *src = args->value;
+        char                    *src = args->value;
         int                     blkcnt;
         int                     valuelen;
         int                     nmap;
         int                     error;
-        int                     hdrcnt = 0;
-        bool                    crcs = xfs_sb_version_hascrc(&mp->m_sb);
         int                     offset = 0;
 
         trace_xfs_attr_rmtval_set(args);
@@ -289,24 +414,14 @@ xfs_attr_rmtval_set(
          * Find a "hole" in the attribute address space large enough for
          * us to drop the new attribute's value into. Because CRC enable
          * attributes have headers, we can't just do a straight byte to FSB
-         * conversion. We calculate the worst case block count in this case
-         * and we may not need that many, so we have to handle this when
-         * allocating the blocks below. 
+         * conversion and have to take the header space into account.
          */
-        if (!crcs)
-                blkcnt = XFS_B_TO_FSB(mp, args->valuelen);
-        else
-                blkcnt = xfs_attr3_rmt_blocks(mp, args->valuelen);
-
+        blkcnt = xfs_attr3_rmt_blocks(mp, args->valuelen);
         error = xfs_bmap_first_unused(args->trans, args->dp, blkcnt, &lfileoff,
                                                    XFS_ATTR_FORK);
         if (error)
                 return error;
 
-        /* Start with the attribute data. We'll allocate the rest afterwards. */
-        if (crcs)
-                blkcnt = XFS_B_TO_FSB(mp, args->valuelen);
-
         args->rmtblkno = lblkno = (xfs_dablk_t)lfileoff;
         args->rmtblkcnt = blkcnt;
 
@@ -349,26 +464,6 @@ xfs_attr_rmtval_set(
                        (map.br_startblock != HOLESTARTBLOCK));
                 lblkno += map.br_blockcount;
                 blkcnt -= map.br_blockcount;
-                hdrcnt++;
-
-                /*
-                 * If we have enough blocks for the attribute data, calculate
-                 * how many extra blocks we need for headers. We might run
-                 * through this multiple times in the case that the additional
-                 * headers in the blocks needed for the data fragments spills
-                 * into requiring more blocks. e.g. for 512 byte blocks, we'll
-                 * spill for another block every 9 headers we require in this
-                 * loop.
-                 */
-                if (crcs && blkcnt == 0) {
-                        int total_len;
-
-                        total_len = args->valuelen +
-                                    hdrcnt * sizeof(struct xfs_attr3_rmt_hdr);
-                        blkcnt = XFS_B_TO_FSB(mp, total_len);
-                        blkcnt -= args->rmtblkcnt;
-                        args->rmtblkcnt += blkcnt;
-                }
 
                 /*
                  * Start the next trans in the chain.
@@ -385,18 +480,19 @@ xfs_attr_rmtval_set(
          * the INCOMPLETE flag.
          */
         lblkno = args->rmtblkno;
+        blkcnt = args->rmtblkcnt;
         valuelen = args->valuelen;
         while (valuelen > 0) {
-                int     byte_cnt;
-                char    *buf;
+                struct xfs_buf  *bp;
+                xfs_daddr_t     dblkno;
+                int             dblkcnt;
+
+                ASSERT(blkcnt > 0);
 
-                /*
-                 * Try to remember where we decided to put the value.
-                 */
                 xfs_bmap_init(args->flist, args->firstblock);
                 nmap = 1;
                 error = xfs_bmapi_read(dp, (xfs_fileoff_t)lblkno,
-                                       args->rmtblkcnt, &map, &nmap,
+                                       blkcnt, &map, &nmap,
                                        XFS_BMAPI_ATTRFORK);
                 if (error)
                         return(error);
@@ -405,41 +501,27 @@ xfs_attr_rmtval_set(
                        (map.br_startblock != HOLESTARTBLOCK));
 
                 dblkno = XFS_FSB_TO_DADDR(mp, map.br_startblock),
-                blkcnt = XFS_FSB_TO_BB(mp, map.br_blockcount);
+                dblkcnt = XFS_FSB_TO_BB(mp, map.br_blockcount);
 
-                bp = xfs_buf_get(mp->m_ddev_targp, dblkno, blkcnt, 0);
+                bp = xfs_buf_get(mp->m_ddev_targp, dblkno, dblkcnt, 0);
                 if (!bp)
                         return ENOMEM;
                 bp->b_ops = &xfs_attr3_rmt_buf_ops;
 
-                byte_cnt = BBTOB(bp->b_length);
-                byte_cnt = XFS_ATTR3_RMT_BUF_SPACE(mp, byte_cnt);
-                if (valuelen < byte_cnt)
-                        byte_cnt = valuelen;
-
-                buf = bp->b_addr;
-                buf += xfs_attr3_rmt_hdr_set(mp, dp->i_ino, offset,
-                                             byte_cnt, bp);
-                memcpy(buf, src, byte_cnt);
-
-                if (byte_cnt < BBTOB(bp->b_length))
-                        xfs_buf_zero(bp, byte_cnt,
-                                     BBTOB(bp->b_length) - byte_cnt);
+                xfs_attr_rmtval_copyin(mp, bp, args->dp->i_ino, &offset,
+                                       &valuelen, &src);
 
                 error = xfs_bwrite(bp); /* GROT: NOTE: synchronous write */
                 xfs_buf_relse(bp);
                 if (error)
                         return error;
 
-                src += byte_cnt;
-                valuelen -= byte_cnt;
-                offset += byte_cnt;
-                hdrcnt--;
 
+                /* roll attribute extent map forwards */
                 lblkno += map.br_blockcount;
+                blkcnt -= map.br_blockcount;
         }
         ASSERT(valuelen == 0);
-        ASSERT(hdrcnt == 0);
         return 0;
 }
 
@@ -448,33 +530,40 @@ xfs_attr_rmtval_set(
  * out-of-line buffer that it is stored on.
  */
 int
-xfs_attr_rmtval_remove(xfs_da_args_t *args)
+xfs_attr_rmtval_remove(
+        struct xfs_da_args      *args)
 {
-        xfs_mount_t *mp;
-        xfs_bmbt_irec_t map;
-        xfs_buf_t *bp;
-        xfs_daddr_t dblkno;
-        xfs_dablk_t lblkno;
-        int valuelen, blkcnt, nmap, error, done, committed;
+        struct xfs_mount        *mp = args->dp->i_mount;
+        xfs_dablk_t             lblkno;
+        int                     blkcnt;
+        int                     error;
+        int                     done;
 
         trace_xfs_attr_rmtval_remove(args);
 
-        mp = args->dp->i_mount;
-
         /*
-         * Roll through the "value", invalidating the attribute value's
-         * blocks.
+         * Roll through the "value", invalidating the attribute value's blocks.
+         * Note that args->rmtblkcnt is the minimum number of data blocks we'll
+         * see for a CRC enabled remote attribute. Each extent will have a
+         * header, and so we may have more blocks than we realise here.  If we
+         * fail to map the blocks correctly, we'll have problems with the buffer
+         * lookups.
          */
         lblkno = args->rmtblkno;
-        valuelen = args->rmtblkcnt;
-        while (valuelen > 0) {
+        blkcnt = args->rmtblkcnt;
+        while (blkcnt > 0) {
+                struct xfs_bmbt_irec    map;
+                struct xfs_buf          *bp;
+                xfs_daddr_t             dblkno;
+                int                     dblkcnt;
+                int                     nmap;
+
                 /*
                  * Try to remember where we decided to put the value.
                  */
                 nmap = 1;
                 error = xfs_bmapi_read(args->dp, (xfs_fileoff_t)lblkno,
-                                       args->rmtblkcnt, &map, &nmap,
-                                       XFS_BMAPI_ATTRFORK);
+                                       blkcnt, &map, &nmap, XFS_BMAPI_ATTRFORK);
                 if (error)
                         return(error);
                 ASSERT(nmap == 1);
@@ -482,21 +571,20 @@ xfs_attr_rmtval_remove(xfs_da_args_t *args)
                        (map.br_startblock != HOLESTARTBLOCK));
 
                 dblkno = XFS_FSB_TO_DADDR(mp, map.br_startblock),
-                blkcnt = XFS_FSB_TO_BB(mp, map.br_blockcount);
+                dblkcnt = XFS_FSB_TO_BB(mp, map.br_blockcount);
 
                 /*
                  * If the "remote" value is in the cache, remove it.
                  */
-                bp = xfs_incore(mp->m_ddev_targp, dblkno, blkcnt, XBF_TRYLOCK);
+                bp = xfs_incore(mp->m_ddev_targp, dblkno, dblkcnt, XBF_TRYLOCK);
                 if (bp) {
                         xfs_buf_stale(bp);
                         xfs_buf_relse(bp);
                         bp = NULL;
                 }
 
-                valuelen -= map.br_blockcount;
-
                 lblkno += map.br_blockcount;
+                blkcnt -= map.br_blockcount;
         }
 
         /*
@@ -506,6 +594,8 @@ xfs_attr_rmtval_remove(xfs_da_args_t *args)
         blkcnt = args->rmtblkcnt;
         done = 0;
         while (!done) {
+                int committed;
+
                 xfs_bmap_init(args->flist, args->firstblock);
                 error = xfs_bunmapi(args->trans, args->dp, lblkno, blkcnt,
                                     XFS_BMAPI_ATTRFORK | XFS_BMAPI_METADATA,
diff --git a/fs/xfs/xfs_attr_remote.h b/fs/xfs/xfs_attr_remote.h
index c7cca60a062a..92a8fd7977cc 100644
--- a/fs/xfs/xfs_attr_remote.h
+++ b/fs/xfs/xfs_attr_remote.h
@@ -20,6 +20,14 @@
 
 #define XFS_ATTR3_RMT_MAGIC     0x5841524d      /* XARM */
 
+/*
+ * There is one of these headers per filesystem block in a remote attribute.
+ * This is done to ensure there is a 1:1 mapping between the attribute value
+ * length and the number of blocks needed to store the attribute. This makes the
+ * verification of a buffer a little more complex, but greatly simplifies the
+ * allocation, reading and writing of these attributes as we don't have to guess
+ * the number of blocks needed to store the attribute data.
+ */
 struct xfs_attr3_rmt_hdr {
         __be32  rm_magic;
         __be32  rm_offset;
@@ -39,6 +47,8 @@ struct xfs_attr3_rmt_hdr {
 
 extern const struct xfs_buf_ops xfs_attr3_rmt_buf_ops;
 
+int xfs_attr3_rmt_blocks(struct xfs_mount *mp, int attrlen);
+
 int xfs_attr_rmtval_get(struct xfs_da_args *args);
 int xfs_attr_rmtval_set(struct xfs_da_args *args);
 int xfs_attr_rmtval_remove(struct xfs_da_args *args);
diff --git a/fs/xfs/xfs_btree.c b/fs/xfs/xfs_btree.c
index 8804b8a3c310..0903960410a2 100644
--- a/fs/xfs/xfs_btree.c
+++ b/fs/xfs/xfs_btree.c
@@ -2544,7 +2544,17 @@ xfs_btree_new_iroot(
         if (error)
                 goto error0;
 
+        /*
+         * we can't just memcpy() the root in for CRC enabled btree blocks.
+         * In that case have to also ensure the blkno remains correct
+         */
         memcpy(cblock, block, xfs_btree_block_len(cur));
+        if (cur->bc_flags & XFS_BTREE_CRC_BLOCKS) {
+                if (cur->bc_flags & XFS_BTREE_LONG_PTRS)
+                        cblock->bb_u.l.bb_blkno = cpu_to_be64(cbp->b_bn);
+                else
+                        cblock->bb_u.s.bb_blkno = cpu_to_be64(cbp->b_bn);
+        }
 
         be16_add_cpu(&block->bb_level, 1);
         xfs_btree_set_numrecs(block, 1);
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 82b70bda9f47..1b2472a46e46 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -513,6 +513,7 @@ _xfs_buf_find(
                 xfs_alert(btp->bt_mount,
                           "%s: Block out of range: block 0x%llx, EOFS 0x%llx ",
                           __func__, blkno, eofs);
+                WARN_ON(1);
                 return NULL;
         }
 
@@ -1649,7 +1650,7 @@ xfs_alloc_buftarg(
 {
         xfs_buftarg_t           *btp;
 
-        btp = kmem_zalloc(sizeof(*btp), KM_SLEEP);
+        btp = kmem_zalloc(sizeof(*btp), KM_SLEEP | KM_NOFS);
 
         btp->bt_mount = mp;
         btp->bt_dev =  bdev->bd_dev;
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index cf263476d6b4..4ec431777048 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -262,12 +262,7 @@ xfs_buf_item_format_segment(
                         vecp->i_addr = xfs_buf_offset(bp, buffer_offset);
                         vecp->i_len = nbits * XFS_BLF_CHUNK;
                         vecp->i_type = XLOG_REG_TYPE_BCHUNK;
-/*
- * You would think we need to bump the nvecs here too, but we do not
- * this number is used by recovery, and it gets confused by the boundary
- * split here
- *                      nvecs++;
- */
+                        nvecs++;
                         vecp++;
                         first_bit = next_bit;
                         last_bit = next_bit;
diff --git a/fs/xfs/xfs_da_btree.c b/fs/xfs/xfs_da_btree.c
index 9b26a99ebfe9..0b8b2a13cd24 100644
--- a/fs/xfs/xfs_da_btree.c
+++ b/fs/xfs/xfs_da_btree.c
@@ -270,6 +270,7 @@ xfs_da3_node_read_verify(
                                 break;
                         return;
                 case XFS_ATTR_LEAF_MAGIC:
+                case XFS_ATTR3_LEAF_MAGIC:
                         bp->b_ops = &xfs_attr3_leaf_buf_ops;
                         bp->b_ops->verify_read(bp);
                         return;
@@ -2464,7 +2465,8 @@ xfs_buf_map_from_irec(
         ASSERT(nirecs >= 1);
 
         if (nirecs > 1) {
-                map = kmem_zalloc(nirecs * sizeof(struct xfs_buf_map), KM_SLEEP);
+                map = kmem_zalloc(nirecs * sizeof(struct xfs_buf_map),
+                                  KM_SLEEP | KM_NOFS);
                 if (!map)
                         return ENOMEM;
                 *mapp = map;
@@ -2520,7 +2522,8 @@ xfs_dabuf_map(
                  * Optimize the one-block case.
                  */
                 if (nfsb != 1)
-                        irecs = kmem_zalloc(sizeof(irec) * nfsb, KM_SLEEP);
+                        irecs = kmem_zalloc(sizeof(irec) * nfsb,
+                                            KM_SLEEP | KM_NOFS);
 
                 nirecs = nfsb;
                 error = xfs_bmapi_read(dp, (xfs_fileoff_t)bno, nfsb, irecs,
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index f852b082a084..c407e1ccff43 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -219,6 +219,14 @@ xfs_swap_extents(
         int             taforkblks = 0;
         __uint64_t      tmp;
 
+        /*
+         * We have no way of updating owner information in the BMBT blocks for
+         * each inode on CRC enabled filesystems, so to avoid corrupting the
+         * this metadata we simply don't allow extent swaps to occur.
+         */
+        if (xfs_sb_version_hascrc(&mp->m_sb))
+                return XFS_ERROR(EINVAL);
+
         tempifp = kmem_alloc(sizeof(xfs_ifork_t), KM_MAYFAIL);
         if (!tempifp) {
                 error = XFS_ERROR(ENOMEM);
diff --git a/fs/xfs/xfs_dir2_format.h b/fs/xfs/xfs_dir2_format.h
index a3b1bd841a80..7826782b8d78 100644
--- a/fs/xfs/xfs_dir2_format.h
+++ b/fs/xfs/xfs_dir2_format.h
@@ -266,6 +266,7 @@ struct xfs_dir3_blk_hdr {
 struct xfs_dir3_data_hdr {
         struct xfs_dir3_blk_hdr hdr;
         xfs_dir2_data_free_t    best_free[XFS_DIR2_DATA_FD_COUNT];
+        __be32                  pad;    /* 64 bit alignment */
 };
 
 #define XFS_DIR3_DATA_CRC_OFF  offsetof(struct xfs_dir3_data_hdr, hdr.crc)
@@ -477,7 +478,7 @@ struct xfs_dir3_leaf_hdr {
         struct xfs_da3_blkinfo  info;           /* header for da routines */
         __be16                  count;          /* count of entries */
         __be16                  stale;          /* count of stale entries */
-        __be32                  pad;
+        __be32                  pad;            /* 64 bit alignment */
 };
 
 struct xfs_dir3_icleaf_hdr {
@@ -715,6 +716,7 @@ struct xfs_dir3_free_hdr {
         __be32                  firstdb;        /* db of first entry */
         __be32                  nvalid;         /* count of valid entries */
         __be32                  nused;          /* count of used entries */
+        __be32                  pad;            /* 64 bit alignment */
 };
 
 struct xfs_dir3_free {
diff --git a/fs/xfs/xfs_dir2_leaf.c b/fs/xfs/xfs_dir2_leaf.c
index 721ba2fe8e54..da71a1819d78 100644
--- a/fs/xfs/xfs_dir2_leaf.c
+++ b/fs/xfs/xfs_dir2_leaf.c
@@ -1336,7 +1336,7 @@ xfs_dir2_leaf_getdents(
                                      mp->m_sb.sb_blocksize);
         map_info = kmem_zalloc(offsetof(struct xfs_dir2_leaf_map_info, map) +
                                 (length * sizeof(struct xfs_bmbt_irec)),
-                               KM_SLEEP);
+                               KM_SLEEP | KM_NOFS);
         map_info->map_size = length;
 
         /*
diff --git a/fs/xfs/xfs_dir2_node.c b/fs/xfs/xfs_dir2_node.c
index 5246de4912d4..2226a00acd15 100644
--- a/fs/xfs/xfs_dir2_node.c
+++ b/fs/xfs/xfs_dir2_node.c
@@ -263,18 +263,19 @@ xfs_dir3_free_get_buf(
          * Initialize the new block to be empty, and remember
          * its first slot as our empty slot.
          */
-        hdr.magic = XFS_DIR2_FREE_MAGIC;
-        hdr.firstdb = 0;
-        hdr.nused = 0;
-        hdr.nvalid = 0;
+        memset(bp->b_addr, 0, sizeof(struct xfs_dir3_free_hdr));
+        memset(&hdr, 0, sizeof(hdr));
+
         if (xfs_sb_version_hascrc(&mp->m_sb)) {
                 struct xfs_dir3_free_hdr *hdr3 = bp->b_addr;
 
                 hdr.magic = XFS_DIR3_FREE_MAGIC;
+
                 hdr3->hdr.blkno = cpu_to_be64(bp->b_bn);
                 hdr3->hdr.owner = cpu_to_be64(dp->i_ino);
                 uuid_copy(&hdr3->hdr.uuid, &mp->m_sb.sb_uuid);
-        }
+        } else
+                hdr.magic = XFS_DIR2_FREE_MAGIC;
         xfs_dir3_free_hdr_to_disk(bp->b_addr, &hdr);
         *bpp = bp;
         return 0;
@@ -1921,8 +1922,6 @@ xfs_dir2_node_addname_int(
                          */
                         freehdr.firstdb = (fbno - XFS_DIR2_FREE_FIRSTDB(mp)) *
                                         xfs_dir3_free_max_bests(mp);
-                        free->hdr.nvalid = 0;
-                        free->hdr.nused = 0;
                 } else {
                         free = fbp->b_addr;
                         bests = xfs_dir3_free_bests_p(mp, free);
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index a41f8bf1da37..044e97a33c8d 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -249,8 +249,11 @@ xfs_qm_init_dquot_blk(
                 d->dd_diskdq.d_version = XFS_DQUOT_VERSION;
                 d->dd_diskdq.d_id = cpu_to_be32(curid);
                 d->dd_diskdq.d_flags = type;
-                if (xfs_sb_version_hascrc(&mp->m_sb))
+                if (xfs_sb_version_hascrc(&mp->m_sb)) {
                         uuid_copy(&d->dd_uuid, &mp->m_sb.sb_uuid);
+                        xfs_update_cksum((char *)d, sizeof(struct xfs_dqblk),
+                                         XFS_DQUOT_CRC_OFF);
+                }
         }
 
         xfs_trans_dquot_buf(tp, bp,
@@ -286,23 +289,6 @@ xfs_dquot_set_prealloc_limits(struct xfs_dquot *dqp)
         dqp->q_low_space[XFS_QLOWSP_5_PCNT] = space * 5;
 }
 
-STATIC void
-xfs_dquot_buf_calc_crc(
-        struct xfs_mount        *mp,
-        struct xfs_buf          *bp)
-{
-        struct xfs_dqblk        *d = (struct xfs_dqblk *)bp->b_addr;
-        int                     i;
-
-        if (!xfs_sb_version_hascrc(&mp->m_sb))
-                return;
-
-        for (i = 0; i < mp->m_quotainfo->qi_dqperchunk; i++, d++) {
-                xfs_update_cksum((char *)d, sizeof(struct xfs_dqblk),
-                                 offsetof(struct xfs_dqblk, dd_crc));
-        }
-}
-
 STATIC bool
 xfs_dquot_buf_verify_crc(
         struct xfs_mount        *mp,
@@ -328,12 +314,11 @@ xfs_dquot_buf_verify_crc(
 
         for (i = 0; i < ndquots; i++, d++) {
                 if (!xfs_verify_cksum((char *)d, sizeof(struct xfs_dqblk),
-                                 offsetof(struct xfs_dqblk, dd_crc)))
+                                 XFS_DQUOT_CRC_OFF))
                         return false;
                 if (!uuid_equal(&d->dd_uuid, &mp->m_sb.sb_uuid))
                         return false;
         }
-
         return true;
 }
 
@@ -393,6 +378,11 @@ xfs_dquot_buf_read_verify(
         }
 }
 
+/*
+ * we don't calculate the CRC here as that is done when the dquot is flushed to
+ * the buffer after the update is done. This ensures that the dquot in the
+ * buffer always has an up-to-date CRC value.
+ */
 void
 xfs_dquot_buf_write_verify(
         struct xfs_buf  *bp)
@@ -404,7 +394,6 @@ xfs_dquot_buf_write_verify(
                 xfs_buf_ioerror(bp, EFSCORRUPTED);
                 return;
         }
-        xfs_dquot_buf_calc_crc(mp, bp);
 }
 
 const struct xfs_buf_ops xfs_dquot_buf_ops = {
@@ -1151,11 +1140,17 @@ xfs_qm_dqflush(
          * copy the lsn into the on-disk dquot now while we have the in memory
          * dquot here. This can't be done later in the write verifier as we
          * can't get access to the log item at that point in time.
+         *
+         * We also calculate the CRC here so that the on-disk dquot in the
+         * buffer always has a valid CRC. This ensures there is no possibility
+         * of a dquot without an up-to-date CRC getting to disk.
          */
         if (xfs_sb_version_hascrc(&mp->m_sb)) {
                 struct xfs_dqblk *dqb = (struct xfs_dqblk *)ddqp;
 
                 dqb->dd_lsn = cpu_to_be64(dqp->q_logitem.qli_item.li_lsn);
+                xfs_update_cksum((char *)dqb, sizeof(struct xfs_dqblk),
+                                 XFS_DQUOT_CRC_OFF);
         }
 
         /*
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index c0f375087efc..452920a3f03f 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -305,11 +305,12 @@ xfs_efi_release(xfs_efi_log_item_t	*efip,
 {
         ASSERT(atomic_read(&efip->efi_next_extent) >= nextents);
         if (atomic_sub_and_test(nextents, &efip->efi_next_extent)) {
-                __xfs_efi_release(efip);
-
                 /* recovery needs us to drop the EFI reference, too */
                 if (test_bit(XFS_EFI_RECOVERED, &efip->efi_flags))
                         __xfs_efi_release(efip);
+
+                __xfs_efi_release(efip);
+                /* efip may now have been freed, do not reference it again. */
         }
 }
 
diff --git a/fs/xfs/xfs_fs.h b/fs/xfs/xfs_fs.h
index 6dda3f949b04..d04695545397 100644
--- a/fs/xfs/xfs_fs.h
+++ b/fs/xfs/xfs_fs.h
@@ -236,6 +236,7 @@ typedef struct xfs_fsop_resblks {
 #define XFS_FSOP_GEOM_FLAGS_PROJID32    0x0800  /* 32-bit project IDs   */
 #define XFS_FSOP_GEOM_FLAGS_DIRV2CI     0x1000  /* ASCII only CI names  */
 #define XFS_FSOP_GEOM_FLAGS_LAZYSB      0x4000  /* lazy superblock counters */
+#define XFS_FSOP_GEOM_FLAGS_V5SB        0x8000  /* version 5 superblock */
 
 
 /*
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 87595b211da1..3c3644ea825b 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -99,7 +99,9 @@ xfs_fs_geometry(
                         (xfs_sb_version_hasattr2(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_ATTR2 : 0) |
                         (xfs_sb_version_hasprojid32bit(&mp->m_sb) ?
-                                XFS_FSOP_GEOM_FLAGS_PROJID32 : 0);
+                                XFS_FSOP_GEOM_FLAGS_PROJID32 : 0) |
+                        (xfs_sb_version_hascrc(&mp->m_sb) ?
+                                XFS_FSOP_GEOM_FLAGS_V5SB : 0);
                 geo->logsectsize = xfs_sb_version_hassector(&mp->m_sb) ?
                                 mp->m_sb.sb_logsectsize : BBSIZE;
                 geo->rtsectsize = mp->m_sb.sb_blocksize;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index efbe1accb6ca..7f7be5f98f52 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1638,6 +1638,10 @@ xfs_iunlink(
                 dip->di_next_unlinked = agi->agi_unlinked[bucket_index];
                 offset = ip->i_imap.im_boffset +
                         offsetof(xfs_dinode_t, di_next_unlinked);
+
+                /* need to recalc the inode CRC if appropriate */
+                xfs_dinode_calc_crc(mp, dip);
+
                 xfs_trans_inode_buf(tp, ibp);
                 xfs_trans_log_buf(tp, ibp, offset,
                                   (offset + sizeof(xfs_agino_t) - 1));
@@ -1723,6 +1727,10 @@ xfs_iunlink_remove(
                         dip->di_next_unlinked = cpu_to_be32(NULLAGINO);
                         offset = ip->i_imap.im_boffset +
                                 offsetof(xfs_dinode_t, di_next_unlinked);
+
+                        /* need to recalc the inode CRC if appropriate */
+                        xfs_dinode_calc_crc(mp, dip);
+
                         xfs_trans_inode_buf(tp, ibp);
                         xfs_trans_log_buf(tp, ibp, offset,
                                           (offset + sizeof(xfs_agino_t) - 1));
@@ -1796,6 +1804,10 @@ xfs_iunlink_remove(
                         dip->di_next_unlinked = cpu_to_be32(NULLAGINO);
                         offset = ip->i_imap.im_boffset +
                                 offsetof(xfs_dinode_t, di_next_unlinked);
+
+                        /* need to recalc the inode CRC if appropriate */
+                        xfs_dinode_calc_crc(mp, dip);
+
                         xfs_trans_inode_buf(tp, ibp);
                         xfs_trans_log_buf(tp, ibp, offset,
                                           (offset + sizeof(xfs_agino_t) - 1));
@@ -1809,6 +1821,10 @@ xfs_iunlink_remove(
                 last_dip->di_next_unlinked = cpu_to_be32(next_agino);
                 ASSERT(next_agino != 0);
                 offset = last_offset + offsetof(xfs_dinode_t, di_next_unlinked);
+
+                /* need to recalc the inode CRC if appropriate */
+                xfs_dinode_calc_crc(mp, last_dip);
+
                 xfs_trans_inode_buf(tp, last_ibp);
                 xfs_trans_log_buf(tp, last_ibp, offset,
                                   (offset + sizeof(xfs_agino_t) - 1));
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index d82efaa2ac73..ca9ecaa81112 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -455,6 +455,28 @@ xfs_vn_getattr(
         return 0;
 }
 
+static void
+xfs_setattr_mode(
+        struct xfs_trans        *tp,
+        struct xfs_inode        *ip,
+        struct iattr            *iattr)
+{
+        struct inode    *inode = VFS_I(ip);
+        umode_t         mode = iattr->ia_mode;
+
+        ASSERT(tp);
+        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
+
+        if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
+                mode &= ~S_ISGID;
+
+        ip->i_d.di_mode &= S_IFMT;
+        ip->i_d.di_mode |= mode & ~S_IFMT;
+
+        inode->i_mode &= S_IFMT;
+        inode->i_mode |= mode & ~S_IFMT;
+}
+
 int
 xfs_setattr_nonsize(
         struct xfs_inode        *ip,
@@ -606,18 +628,8 @@ xfs_setattr_nonsize(
         /*
          * Change file access modes.
          */
-        if (mask & ATTR_MODE) {
-                umode_t mode = iattr->ia_mode;
-
-                if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
-                        mode &= ~S_ISGID;
-
-                ip->i_d.di_mode &= S_IFMT;
-                ip->i_d.di_mode |= mode & ~S_IFMT;
-
-                inode->i_mode &= S_IFMT;
-                inode->i_mode |= mode & ~S_IFMT;
-        }
+        if (mask & ATTR_MODE)
+                xfs_setattr_mode(tp, ip, iattr);
 
         /*
          * Change file access or modified times.
@@ -714,9 +726,8 @@ xfs_setattr_size(
                 return XFS_ERROR(error);
 
         ASSERT(S_ISREG(ip->i_d.di_mode));
-        ASSERT((mask & (ATTR_MODE|ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET|
-                        ATTR_MTIME_SET|ATTR_KILL_SUID|ATTR_KILL_SGID|
-                        ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0);
+        ASSERT((mask & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET|
+                        ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0);
 
         if (!(flags & XFS_ATTR_NOLOCK)) {
                 lock_flags |= XFS_IOLOCK_EXCL;
@@ -860,6 +871,12 @@ xfs_setattr_size(
                 xfs_inode_clear_eofblocks_tag(ip);
         }
 
+        /*
+         * Change file access modes.
+         */
+        if (mask & ATTR_MODE)
+                xfs_setattr_mode(tp, ip, iattr);
+
         if (mask & ATTR_CTIME) {
                 inode->i_ctime = iattr->ia_ctime;
                 ip->i_d.di_ctime.t_sec = iattr->ia_ctime.tv_sec;
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index e3d0b85d852b..d0833b54e55d 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -139,7 +139,7 @@ xlog_cil_prepare_log_vecs(
 
                 new_lv = kmem_zalloc(sizeof(*new_lv) +
                                 niovecs * sizeof(struct xfs_log_iovec),
-                                KM_SLEEP);
+                                KM_SLEEP|KM_NOFS);
 
                 /* The allocated iovec region lies beyond the log vector. */
                 new_lv->lv_iovecp = (struct xfs_log_iovec *)&new_lv[1];
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 93f03ec17eec..7cf5e4eafe28 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1599,10 +1599,43 @@ xlog_recover_add_to_trans(
 }
 
 /*
- * Sort the log items in the transaction. Cancelled buffers need
- * to be put first so they are processed before any items that might
- * modify the buffers. If they are cancelled, then the modifications
- * don't need to be replayed.
+ * Sort the log items in the transaction.
+ *
+ * The ordering constraints are defined by the inode allocation and unlink
+ * behaviour. The rules are:
+ *
+ *      1. Every item is only logged once in a given transaction. Hence it
+ *         represents the last logged state of the item. Hence ordering is
+ *         dependent on the order in which operations need to be performed so
+ *         required initial conditions are always met.
+ *
+ *      2. Cancelled buffers are recorded in pass 1 in a separate table and
+ *         there's nothing to replay from them so we can simply cull them
+ *         from the transaction. However, we can't do that until after we've
+ *         replayed all the other items because they may be dependent on the
+ *         cancelled buffer and replaying the cancelled buffer can remove it
+ *         form the cancelled buffer table. Hence they have tobe done last.
+ *
+ *      3. Inode allocation buffers must be replayed before inode items that
+ *         read the buffer and replay changes into it.
+ *
+ *      4. Inode unlink buffers must be replayed after inode items are replayed.
+ *         This ensures that inodes are completely flushed to the inode buffer
+ *         in a "free" state before we remove the unlinked inode list pointer.
+ *
+ * Hence the ordering needs to be inode allocation buffers first, inode items
+ * second, inode unlink buffers third and cancelled buffers last.
+ *
+ * But there's a problem with that - we can't tell an inode allocation buffer
+ * apart from a regular buffer, so we can't separate them. We can, however,
+ * tell an inode unlink buffer from the others, and so we can separate them out
+ * from all the other buffers and move them to last.
+ *
+ * Hence, 4 lists, in order from head to tail:
+ *      - buffer_list for all buffers except cancelled/inode unlink buffers
+ *      - item_list for all non-buffer items
+ *      - inode_buffer_list for inode unlink buffers
+ *      - cancel_list for the cancelled buffers
  */
 STATIC int
 xlog_recover_reorder_trans(
@@ -1612,6 +1645,10 @@ xlog_recover_reorder_trans(
 {
         xlog_recover_item_t     *item, *n;
         LIST_HEAD(sort_list);
+        LIST_HEAD(cancel_list);
+        LIST_HEAD(buffer_list);
+        LIST_HEAD(inode_buffer_list);
+        LIST_HEAD(inode_list);
 
         list_splice_init(&trans->r_itemq, &sort_list);
         list_for_each_entry_safe(item, n, &sort_list, ri_list) {
@@ -1619,12 +1656,18 @@ xlog_recover_reorder_trans(
 
                 switch (ITEM_TYPE(item)) {
                 case XFS_LI_BUF:
-                        if (!(buf_f->blf_flags & XFS_BLF_CANCEL)) {
+                        if (buf_f->blf_flags & XFS_BLF_CANCEL) {
                                 trace_xfs_log_recover_item_reorder_head(log,
                                                         trans, item, pass);
-                                list_move(&item->ri_list, &trans->r_itemq);
+                                list_move(&item->ri_list, &cancel_list);
+                                break;
+                        }
+                        if (buf_f->blf_flags & XFS_BLF_INODE_BUF) {
+                                list_move(&item->ri_list, &inode_buffer_list);
                                 break;
                         }
+                        list_move_tail(&item->ri_list, &buffer_list);
+                        break;
                 case XFS_LI_INODE:
                 case XFS_LI_DQUOT:
                 case XFS_LI_QUOTAOFF:
@@ -1632,7 +1675,7 @@ xlog_recover_reorder_trans(
                 case XFS_LI_EFI:
                         trace_xfs_log_recover_item_reorder_tail(log,
                                                         trans, item, pass);
-                        list_move_tail(&item->ri_list, &trans->r_itemq);
+                        list_move_tail(&item->ri_list, &inode_list);
                         break;
                 default:
                         xfs_warn(log->l_mp,
@@ -1643,6 +1686,14 @@ xlog_recover_reorder_trans(
                 }
         }
         ASSERT(list_empty(&sort_list));
+        if (!list_empty(&buffer_list))
+                list_splice(&buffer_list, &trans->r_itemq);
+        if (!list_empty(&inode_list))
+                list_splice_tail(&inode_list, &trans->r_itemq);
+        if (!list_empty(&inode_buffer_list))
+                list_splice_tail(&inode_buffer_list, &trans->r_itemq);
+        if (!list_empty(&cancel_list))
+                list_splice_tail(&cancel_list, &trans->r_itemq);
         return 0;
 }
 
@@ -1794,7 +1845,13 @@ xlog_recover_do_inode_buffer(
         xfs_agino_t             *buffer_nextp;
 
         trace_xfs_log_recover_buf_inode_buf(mp->m_log, buf_f);
-        bp->b_ops = &xfs_inode_buf_ops;
+
+        /*
+         * Post recovery validation only works properly on CRC enabled
+         * filesystems.
+         */
+        if (xfs_sb_version_hascrc(&mp->m_sb))
+                bp->b_ops = &xfs_inode_buf_ops;
 
         inodes_per_buf = BBTOB(bp->b_io_length) >> mp->m_sb.sb_inodelog;
         for (i = 0; i < inodes_per_buf; i++) {
@@ -1861,6 +1918,15 @@ xlog_recover_do_inode_buffer(
                 buffer_nextp = (xfs_agino_t *)xfs_buf_offset(bp,
                                               next_unlinked_offset);
                 *buffer_nextp = *logged_nextp;
+
+                /*
+                 * If necessary, recalculate the CRC in the on-disk inode. We
+                 * have to leave the inode in a consistent state for whoever
+                 * reads it next....
+                 */
+                xfs_dinode_calc_crc(mp, (struct xfs_dinode *)
+                                xfs_buf_offset(bp, i * mp->m_sb.sb_inodesize));
+
         }
 
         return 0;
@@ -2097,6 +2163,17 @@ xlog_recover_do_reg_buffer(
                        ((uint)bit << XFS_BLF_SHIFT) + (nbits << XFS_BLF_SHIFT));
 
                 /*
+                 * The dirty regions logged in the buffer, even though
+                 * contiguous, may span multiple chunks. This is because the
+                 * dirty region may span a physical page boundary in a buffer
+                 * and hence be split into two separate vectors for writing into
+                 * the log. Hence we need to trim nbits back to the length of
+                 * the current region being copied out of the log.
+                 */
+                if (item->ri_buf[i].i_len < (nbits << XFS_BLF_SHIFT))
+                        nbits = item->ri_buf[i].i_len >> XFS_BLF_SHIFT;
+
+                /*
                  * Do a sanity check if this is a dquot buffer. Just checking
                  * the first dquot in the buffer should do. XXXThis is
                  * probably a good thing to do for other buf types also.
@@ -2134,7 +2211,16 @@ xlog_recover_do_reg_buffer(
         /* Shouldn't be any more regions */
         ASSERT(i == item->ri_total);
 
-        xlog_recovery_validate_buf_type(mp, bp, buf_f);
+        /*
+         * We can only do post recovery validation on items on CRC enabled
+         * fielsystems as we need to know when the buffer was written to be able
+         * to determine if we should have replayed the item. If we replay old
+         * metadata over a newer buffer, then it will enter a temporarily
+         * inconsistent state resulting in verification failures. Hence for now
+         * just avoid the verification stage for non-crc filesystems
+         */
+        if (xfs_sb_version_hascrc(&mp->m_sb))
+                xlog_recovery_validate_buf_type(mp, bp, buf_f);
 }
 
 /*
@@ -2255,6 +2341,12 @@ xfs_qm_dqcheck(
         d->dd_diskdq.d_flags = type;
         d->dd_diskdq.d_id = cpu_to_be32(id);
 
+        if (xfs_sb_version_hascrc(&mp->m_sb)) {
+                uuid_copy(&d->dd_uuid, &mp->m_sb.sb_uuid);
+                xfs_update_cksum((char *)d, sizeof(struct xfs_dqblk),
+                                 XFS_DQUOT_CRC_OFF);
+        }
+
         return errs;
 }
 
@@ -2782,6 +2874,10 @@ xlog_recover_dquot_pass2(
         }
 
         memcpy(ddq, recddq, item->ri_buf[1].i_len);
+        if (xfs_sb_version_hascrc(&mp->m_sb)) {
+                xfs_update_cksum((char *)ddq, sizeof(struct xfs_dqblk),
+                                 XFS_DQUOT_CRC_OFF);
+        }
 
         ASSERT(dq_f->qlf_size == 2);
         ASSERT(bp->b_target->bt_mount == mp);
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index f6bfbd734669..e8e310c05097 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -314,7 +314,8 @@ STATIC int
 xfs_mount_validate_sb(
         xfs_mount_t     *mp,
         xfs_sb_t        *sbp,
-        bool            check_inprogress)
+        bool            check_inprogress,
+        bool            check_version)
 {
 
         /*
@@ -337,9 +338,10 @@ xfs_mount_validate_sb(
 
         /*
          * Version 5 superblock feature mask validation. Reject combinations the
-         * kernel cannot support up front before checking anything else.
+         * kernel cannot support up front before checking anything else. For
+         * write validation, we don't need to check feature masks.
          */
-        if (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5) {
+        if (check_version && XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_5) {
                 xfs_alert(mp,
 "Version 5 superblock detected. This kernel has EXPERIMENTAL support enabled!\n"
 "Use of these features in this kernel is at your own risk!");
@@ -675,7 +677,8 @@ xfs_sb_to_disk(
 
 static int
 xfs_sb_verify(
-        struct xfs_buf  *bp)
+        struct xfs_buf  *bp,
+        bool            check_version)
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
         struct xfs_sb   sb;
@@ -686,7 +689,8 @@ xfs_sb_verify(
          * Only check the in progress field for the primary superblock as
          * mkfs.xfs doesn't clear it from secondary superblocks.
          */
-        return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR);
+        return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR,
+                                     check_version);
 }
 
 /*
@@ -719,7 +723,7 @@ xfs_sb_read_verify(
                         goto out_error;
                 }
         }
-        error = xfs_sb_verify(bp);
+        error = xfs_sb_verify(bp, true);
 
 out_error:
         if (error) {
@@ -758,7 +762,7 @@ xfs_sb_write_verify(
         struct xfs_buf_log_item *bip = bp->b_fspriv;
         int                     error;
 
-        error = xfs_sb_verify(bp);
+        error = xfs_sb_verify(bp, false);
         if (error) {
                 XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, bp->b_addr);
                 xfs_buf_ioerror(bp, error);
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index f41702b43003..b75c9bb6e71e 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -41,6 +41,7 @@
 #include "xfs_qm.h"
 #include "xfs_trace.h"
 #include "xfs_icache.h"
+#include "xfs_cksum.h"
 
 /*
  * The global quota manager. There is only one of these for the entire
@@ -839,7 +840,7 @@ xfs_qm_reset_dqcounts(
         xfs_dqid_t      id,
         uint            type)
 {
-        xfs_disk_dquot_t        *ddq;
+        struct xfs_dqblk        *dqb;
         int                     j;
 
         trace_xfs_reset_dqcounts(bp, _RET_IP_);
@@ -853,8 +854,12 @@ xfs_qm_reset_dqcounts(
         do_div(j, sizeof(xfs_dqblk_t));
         ASSERT(mp->m_quotainfo->qi_dqperchunk == j);
 #endif
-        ddq = bp->b_addr;
+        dqb = bp->b_addr;
         for (j = 0; j < mp->m_quotainfo->qi_dqperchunk; j++) {
+                struct xfs_disk_dquot   *ddq;
+
+                ddq = (struct xfs_disk_dquot *)&dqb[j];
+
                 /*
                  * Do a sanity check, and if needed, repair the dqblk. Don't
                  * output any warnings because it's perfectly possible to
@@ -871,7 +876,12 @@ xfs_qm_reset_dqcounts(
                 ddq->d_bwarns = 0;
                 ddq->d_iwarns = 0;
                 ddq->d_rtbwarns = 0;
-                ddq = (xfs_disk_dquot_t *) ((xfs_dqblk_t *)ddq + 1);
+
+                if (xfs_sb_version_hascrc(&mp->m_sb)) {
+                        xfs_update_cksum((char *)&dqb[j],
+                                         sizeof(struct xfs_dqblk),
+                                         XFS_DQUOT_CRC_OFF);
+                }
         }
 }
 
@@ -907,19 +917,29 @@ xfs_qm_dqiter_bufs(
                               XFS_FSB_TO_DADDR(mp, bno),
                               mp->m_quotainfo->qi_dqchunklen, 0, &bp,
                               &xfs_dquot_buf_ops);
-                if (error)
-                        break;
 
                 /*
-                 * XXX(hch): need to figure out if it makes sense to validate
-                 *           the CRC here.
+                 * CRC and validation errors will return a EFSCORRUPTED here. If
+                 * this occurs, re-read without CRC validation so that we can
+                 * repair the damage via xfs_qm_reset_dqcounts(). This process
+                 * will leave a trace in the log indicating corruption has
+                 * been detected.
                  */
+                if (error == EFSCORRUPTED) {
+                        error = xfs_trans_read_buf(mp, NULL, mp->m_ddev_targp,
+                                      XFS_FSB_TO_DADDR(mp, bno),
+                                      mp->m_quotainfo->qi_dqchunklen, 0, &bp,
+                                      NULL);
+                }
+
+                if (error)
+                        break;
+
                 xfs_qm_reset_dqcounts(mp, bp, firstid, type);
                 xfs_buf_delwri_queue(bp, buffer_list);
                 xfs_buf_relse(bp);
-                /*
-                 * goto the next block.
-                 */
+
+                /* goto the next block. */
                 bno++;
                 firstid += mp->m_quotainfo->qi_dqperchunk;
         }
diff --git a/fs/xfs/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c
index c41190cad6e9..6cdf6ffc36a1 100644
--- a/fs/xfs/xfs_qm_syscalls.c
+++ b/fs/xfs/xfs_qm_syscalls.c
@@ -489,31 +489,36 @@ xfs_qm_scall_setqlim(
         if ((newlim->d_fieldmask & XFS_DQ_MASK) == 0)
                 return 0;
 
-        tp = xfs_trans_alloc(mp, XFS_TRANS_QM_SETQLIM);
-        error = xfs_trans_reserve(tp, 0, XFS_QM_SETQLIM_LOG_RES(mp),
-                                  0, 0, XFS_DEFAULT_LOG_COUNT);
-        if (error) {
-                xfs_trans_cancel(tp, 0);
-                return (error);
-        }
-
         /*
          * We don't want to race with a quotaoff so take the quotaoff lock.
-         * (We don't hold an inode lock, so there's nothing else to stop
-         * a quotaoff from happening). (XXXThis doesn't currently happen
-         * because we take the vfslock before calling xfs_qm_sysent).
+         * We don't hold an inode lock, so there's nothing else to stop
+         * a quotaoff from happening.
          */
         mutex_lock(&q->qi_quotaofflock);
 
         /*
-         * Get the dquot (locked), and join it to the transaction.
-         * Allocate the dquot if this doesn't exist.
+         * Get the dquot (locked) before we start, as we need to do a
+         * transaction to allocate it if it doesn't exist. Once we have the
+         * dquot, unlock it so we can start the next transaction safely. We hold
+         * a reference to the dquot, so it's safe to do this unlock/lock without
+         * it being reclaimed in the mean time.
          */
-        if ((error = xfs_qm_dqget(mp, NULL, id, type, XFS_QMOPT_DQALLOC, &dqp))) {
-                xfs_trans_cancel(tp, XFS_TRANS_ABORT);
+        error = xfs_qm_dqget(mp, NULL, id, type, XFS_QMOPT_DQALLOC, &dqp);
+        if (error) {
                 ASSERT(error != ENOENT);
                 goto out_unlock;
         }
+        xfs_dqunlock(dqp);
+
+        tp = xfs_trans_alloc(mp, XFS_TRANS_QM_SETQLIM);
+        error = xfs_trans_reserve(tp, 0, XFS_QM_SETQLIM_LOG_RES(mp),
+                                  0, 0, XFS_DEFAULT_LOG_COUNT);
+        if (error) {
+                xfs_trans_cancel(tp, 0);
+                goto out_rele;
+        }
+
+        xfs_dqlock(dqp);
         xfs_trans_dqjoin(tp, dqp);
         ddq = &dqp->q_core;
 
@@ -621,9 +626,10 @@ xfs_qm_scall_setqlim(
         xfs_trans_log_dquot(tp, dqp);
 
         error = xfs_trans_commit(tp, 0);
-        xfs_qm_dqrele(dqp);
 
- out_unlock:
+out_rele:
+        xfs_qm_dqrele(dqp);
+out_unlock:
         mutex_unlock(&q->qi_quotaofflock);
         return error;
 }
diff --git a/fs/xfs/xfs_quota.h b/fs/xfs/xfs_quota.h
index c61e31c7d997..c38068f26c55 100644
--- a/fs/xfs/xfs_quota.h
+++ b/fs/xfs/xfs_quota.h
@@ -87,6 +87,8 @@ typedef struct xfs_dqblk {
         uuid_t            dd_uuid;      /* location information */
 } xfs_dqblk_t;
 
+#define XFS_DQUOT_CRC_OFF       offsetof(struct xfs_dqblk, dd_crc)
+
 /*
  * flags for q_flags field in the dquot.
  */
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index ea341cea68cb..3033ba5e9762 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1373,6 +1373,17 @@ xfs_finish_flags(
         }
 
         /*
+         * V5 filesystems always use attr2 format for attributes.
+         */
+        if (xfs_sb_version_hascrc(&mp->m_sb) &&
+            (mp->m_flags & XFS_MOUNT_NOATTR2)) {
+                xfs_warn(mp,
+"Cannot mount a V5 filesystem as %s. %s is always enabled for V5 filesystems.",
+                        MNTOPT_NOATTR2, MNTOPT_ATTR2);
+                return XFS_ERROR(EINVAL);
+        }
+
+        /*
          * mkfs'ed attr2 will turn on attr2 mount unless explicitly
          * told by noattr2 to turn it off
          */
diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
index 5f234389327c..195a403e1522 100644
--- a/fs/xfs/xfs_symlink.c
+++ b/fs/xfs/xfs_symlink.c
@@ -56,16 +56,9 @@ xfs_symlink_blocks(
         struct xfs_mount *mp,
         int             pathlen)
 {
-        int             fsblocks = 0;
-        int             len = pathlen;
+        int buflen = XFS_SYMLINK_BUF_SPACE(mp, mp->m_sb.sb_blocksize);
 
-        do {
-                fsblocks++;
-                len -= XFS_SYMLINK_BUF_SPACE(mp, mp->m_sb.sb_blocksize);
-        } while (len > 0);
-
-        ASSERT(fsblocks <= XFS_SYMLINK_MAPS);
-        return fsblocks;
+        return (pathlen + buflen - 1) / buflen;
 }
 
 static int
@@ -405,7 +398,7 @@ xfs_symlink(
         if (pathlen <= XFS_LITINO(mp, dp->i_d.di_version))
                 fs_blocks = 0;
         else
-                fs_blocks = XFS_B_TO_FSB(mp, pathlen);
+                fs_blocks = xfs_symlink_blocks(mp, pathlen);
         resblks = XFS_SYMLINK_SPACE_RES(mp, link_name->len, fs_blocks);
         error = xfs_trans_reserve(tp, resblks, XFS_SYMLINK_LOG_RES(mp), 0,
                         XFS_TRANS_PERM_LOG_RES, XFS_SYMLINK_LOG_COUNT);
@@ -512,7 +505,7 @@ xfs_symlink(
                 cur_chunk = target_path;
                 offset = 0;
                 for (n = 0; n < nmaps; n++) {
-                        char *buf;
+                        char    *buf;
 
                         d = XFS_FSB_TO_DADDR(mp, mval[n].br_startblock);
                         byte_cnt = XFS_FSB_TO_B(mp, mval[n].br_blockcount);
@@ -525,9 +518,7 @@ xfs_symlink(
                         bp->b_ops = &xfs_symlink_buf_ops;
 
                         byte_cnt = XFS_SYMLINK_BUF_SPACE(mp, byte_cnt);
-                        if (pathlen < byte_cnt) {
-                                byte_cnt = pathlen;
-                        }
+                        byte_cnt = min(byte_cnt, pathlen);
 
                         buf = bp->b_addr;
                         buf += xfs_symlink_hdr_set(mp, ip->i_ino, offset,
@@ -542,6 +533,7 @@ xfs_symlink(
                         xfs_trans_log_buf(tp, bp, 0, (buf + byte_cnt - 1) -
                                                         (char *)bp->b_addr);
                 }
+                ASSERT(pathlen == 0);
         }
 
         /*
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 1501f4fa51a6..0176bb21f09a 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -1453,7 +1453,7 @@ xfs_free_file_space(
         xfs_mount_t             *mp;
         int                     nimap;
         uint                    resblks;
-        uint                    rounding;
+        xfs_off_t               rounding;
         int                     rt;
         xfs_fileoff_t           startoffset_fsb;
         xfs_trans_t             *tp;
@@ -1482,7 +1482,7 @@ xfs_free_file_space(
                 inode_dio_wait(VFS_I(ip));
         }
 
-        rounding = max_t(uint, 1 << mp->m_sb.sb_blocklog, PAGE_CACHE_SIZE);
+        rounding = max_t(xfs_off_t, 1 << mp->m_sb.sb_blocklog, PAGE_CACHE_SIZE);
         ioffset = offset & ~(rounding - 1);
         error = -filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
                                               ioffset, -1);