Merge branch 'renesas/soc' into next/soc2

14 files changed, 160 insertions, 75 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 969beb0e2231..b9d64d89a043 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -228,12 +228,6 @@ static void __put_ioctx(struct kioctx *ctx)
         call_rcu(&ctx->rcu_head, ctx_rcu_free);
 }
 
-static inline void get_ioctx(struct kioctx *kioctx)
-{
-        BUG_ON(atomic_read(&kioctx->users) <= 0);
-        atomic_inc(&kioctx->users);
-}
-
 static inline int try_get_ioctx(struct kioctx *kioctx)
 {
         return atomic_inc_not_zero(&kioctx->users);
@@ -273,7 +267,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
         mm = ctx->mm = current->mm;
         atomic_inc(&mm->mm_count);
 
-        atomic_set(&ctx->users, 1);
+        atomic_set(&ctx->users, 2);
         spin_lock_init(&ctx->ctx_lock);
         spin_lock_init(&ctx->ring_info.ring_lock);
         init_waitqueue_head(&ctx->wait);
@@ -490,6 +484,8 @@ static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
                 kmem_cache_free(kiocb_cachep, req);
                 ctx->reqs_active--;
         }
+        if (unlikely(!ctx->reqs_active && ctx->dead))
+                wake_up_all(&ctx->wait);
         spin_unlock_irq(&ctx->ctx_lock);
 }
 
@@ -607,11 +603,16 @@ static void aio_fput_routine(struct work_struct *data)
                         fput(req->ki_filp);
 
                 /* Link the iocb into the context's free list */
+                rcu_read_lock();
                 spin_lock_irq(&ctx->ctx_lock);
                 really_put_req(ctx, req);
+                /*
+                 * at that point ctx might've been killed, but actual
+                 * freeing is RCU'd
+                 */
                 spin_unlock_irq(&ctx->ctx_lock);
+                rcu_read_unlock();
 
-                put_ioctx(ctx);
                 spin_lock_irq(&fput_lock);
         }
         spin_unlock_irq(&fput_lock);
@@ -642,7 +643,6 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
          * this function will be executed w/out any aio kthread wakeup.
          */
         if (unlikely(!fput_atomic(req->ki_filp))) {
-                get_ioctx(ctx);
                 spin_lock(&fput_lock);
                 list_add(&req->ki_list, &fput_head);
                 spin_unlock(&fput_lock);
@@ -1336,10 +1336,10 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
         ret = PTR_ERR(ioctx);
         if (!IS_ERR(ioctx)) {
                 ret = put_user(ioctx->user_id, ctxp);
-                if (!ret)
+                if (!ret) {
+                        put_ioctx(ioctx);
                         return 0;
-
-                get_ioctx(ioctx); /* io_destroy() expects us to hold a ref */
+                }
                 io_destroy(ioctx);
         }
 
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index a6395bdb26ae..1ff94054d35a 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -259,6 +259,13 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
         current->mm->free_area_cache = current->mm->mmap_base;
         current->mm->cached_hole_size = 0;
 
+        retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
+        if (retval < 0) {
+                /* Someone check-me: is this error path enough? */
+                send_sig(SIGKILL, current, 0);
+                return retval;
+        }
+
         install_exec_creds(bprm);
         current->flags &= ~PF_FORKNOEXEC;
 
@@ -352,13 +359,6 @@ beyond_if:
                 return retval;
         }
 
-        retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
-        if (retval < 0) { 
-                /* Someone check-me: is this error path enough? */ 
-                send_sig(SIGKILL, current, 0); 
-                return retval;
-        }
-
         current->mm->start_stack =
                 (unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
 #ifdef __alpha__
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 0e575d1304b4..5e9f198f7712 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1183,8 +1183,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                          * The latter is necessary to prevent ghost
                          * partitions on a removed medium.
                          */
-                        if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
-                                rescan_partitions(disk, bdev);
+                        if (bdev->bd_invalidated) {
+                                if (!ret)
+                                        rescan_partitions(disk, bdev);
+                                else if (ret == -ENOMEDIUM)
+                                        invalidate_partitions(disk, bdev);
+                        }
                         if (ret)
                                 goto out_clear;
                 } else {
@@ -1214,8 +1218,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                         if (bdev->bd_disk->fops->open)
                                 ret = bdev->bd_disk->fops->open(bdev, mode);
                         /* the same as first opener case, read comment there */
-                        if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
-                                rescan_partitions(bdev->bd_disk, bdev);
+                        if (bdev->bd_invalidated) {
+                                if (!ret)
+                                        rescan_partitions(bdev->bd_disk, bdev);
+                                else if (ret == -ENOMEDIUM)
+                                        invalidate_partitions(bdev->bd_disk, bdev);
+                        }
                         if (ret)
                                 goto out_unlock_bdev;
                 }
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 98f6bf10bbd4..0436c12da8c2 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -583,7 +583,7 @@ static int find_parent_nodes(struct btrfs_trans_handle *trans,
         struct btrfs_path *path;
         struct btrfs_key info_key = { 0 };
         struct btrfs_delayed_ref_root *delayed_refs = NULL;
-        struct btrfs_delayed_ref_head *head = NULL;
+        struct btrfs_delayed_ref_head *head;
         int info_level = 0;
         int ret;
         struct list_head prefs_delayed;
@@ -607,6 +607,8 @@ static int find_parent_nodes(struct btrfs_trans_handle *trans,
          * at a specified point in time
          */
 again:
+        head = NULL;
+
         ret = btrfs_search_slot(trans, fs_info->extent_root, &key, path, 0, 0);
         if (ret < 0)
                 goto out;
@@ -635,8 +637,10 @@ again:
                         goto again;
                 }
                 ret = __add_delayed_refs(head, seq, &info_key, &prefs_delayed);
-                if (ret)
+                if (ret) {
+                        spin_unlock(&delayed_refs->lock);
                         goto out;
+                }
         }
         spin_unlock(&delayed_refs->lock);
 
diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
index 2373b39a132b..22db04550f6a 100644
--- a/fs/btrfs/reada.c
+++ b/fs/btrfs/reada.c
@@ -305,7 +305,7 @@ again:
 
         spin_lock(&fs_info->reada_lock);
         ret = radix_tree_insert(&dev->reada_zones,
-                                (unsigned long)zone->end >> PAGE_CACHE_SHIFT,
+                                (unsigned long)(zone->end >> PAGE_CACHE_SHIFT),
                                 zone);
         spin_unlock(&fs_info->reada_lock);
 
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 63a196b97d50..bc7e24420ac0 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -584,10 +584,26 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
                          * If either that or op not supported returned, follow
                          * the normal lookup.
                          */
-                        if ((rc == 0) || (rc == -ENOENT))
+                        switch (rc) {
+                        case 0:
+                                /*
+                                 * The server may allow us to open things like
+                                 * FIFOs, but the client isn't set up to deal
+                                 * with that. If it's not a regular file, just
+                                 * close it and proceed as if it were a normal
+                                 * lookup.
+                                 */
+                                if (newInode && !S_ISREG(newInode->i_mode)) {
+                                        CIFSSMBClose(xid, pTcon, fileHandle);
+                                        break;
+                                }
+                        case -ENOENT:
                                 posix_open = true;
-                        else if ((rc == -EINVAL) || (rc != -EOPNOTSUPP))
+                        case -EOPNOTSUPP:
+                                break;
+                        default:
                                 pTcon->broken_posix_open = true;
+                        }
                 }
                 if (!posix_open)
                         rc = cifs_get_inode_info_unix(&newInode, full_path,
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 4dd9283885e7..5e64748a2917 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -920,16 +920,26 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
         for (lockp = &inode->i_flock; *lockp != NULL; \
              lockp = &(*lockp)->fl_next)
 
+struct lock_to_push {
+        struct list_head llist;
+        __u64 offset;
+        __u64 length;
+        __u32 pid;
+        __u16 netfid;
+        __u8 type;
+};
+
 static int
 cifs_push_posix_locks(struct cifsFileInfo *cfile)
 {
         struct cifsInodeInfo *cinode = CIFS_I(cfile->dentry->d_inode);
         struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
         struct file_lock *flock, **before;
-        struct cifsLockInfo *lck, *tmp;
+        unsigned int count = 0, i = 0;
         int rc = 0, xid, type;
+        struct list_head locks_to_send, *el;
+        struct lock_to_push *lck, *tmp;
         __u64 length;
-        struct list_head locks_to_send;
 
         xid = GetXid();
 
@@ -940,29 +950,55 @@ cifs_push_posix_locks(struct cifsFileInfo *cfile)
                 return rc;
         }
 
+        lock_flocks();
+        cifs_for_each_lock(cfile->dentry->d_inode, before) {
+                if ((*before)->fl_flags & FL_POSIX)
+                        count++;
+        }
+        unlock_flocks();
+
         INIT_LIST_HEAD(&locks_to_send);
 
+        /*
+         * Allocating count locks is enough because no locks can be added to
+         * the list while we are holding cinode->lock_mutex that protects
+         * locking operations of this inode.
+         */
+        for (; i < count; i++) {
+                lck = kmalloc(sizeof(struct lock_to_push), GFP_KERNEL);
+                if (!lck) {
+                        rc = -ENOMEM;
+                        goto err_out;
+                }
+                list_add_tail(&lck->llist, &locks_to_send);
+        }
+
+        i = 0;
+        el = locks_to_send.next;
         lock_flocks();
         cifs_for_each_lock(cfile->dentry->d_inode, before) {
+                if (el == &locks_to_send) {
+                        /* something is really wrong */
+                        cERROR(1, "Can't push all brlocks!");
+                        break;
+                }
                 flock = *before;
+                if ((flock->fl_flags & FL_POSIX) == 0)
+                        continue;
                 length = 1 + flock->fl_end - flock->fl_start;
                 if (flock->fl_type == F_RDLCK || flock->fl_type == F_SHLCK)
                         type = CIFS_RDLCK;
                 else
                         type = CIFS_WRLCK;
-
-                lck = cifs_lock_init(flock->fl_start, length, type,
-                                     cfile->netfid);
-                if (!lck) {
-                        rc = -ENOMEM;
-                        goto send_locks;
-                }
+                lck = list_entry(el, struct lock_to_push, llist);
                 lck->pid = flock->fl_pid;
-
-                list_add_tail(&lck->llist, &locks_to_send);
+                lck->netfid = cfile->netfid;
+                lck->length = length;
+                lck->type = type;
+                lck->offset = flock->fl_start;
+                i++;
+                el = el->next;
         }
-
-send_locks:
         unlock_flocks();
 
         list_for_each_entry_safe(lck, tmp, &locks_to_send, llist) {
@@ -979,11 +1015,18 @@ send_locks:
                 kfree(lck);
         }
 
+out:
         cinode->can_cache_brlcks = false;
         mutex_unlock(&cinode->lock_mutex);
 
         FreeXid(xid);
         return rc;
+err_out:
+        list_for_each_entry_safe(lck, tmp, &locks_to_send, llist) {
+                list_del(&lck->llist);
+                kfree(lck);
+        }
+        goto out;
 }
 
 static int
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index a5f54b7d9822..745da3d0653e 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -534,6 +534,11 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
         if (fattr->cf_cifsattrs & ATTR_DIRECTORY) {
                 fattr->cf_mode = S_IFDIR | cifs_sb->mnt_dir_mode;
                 fattr->cf_dtype = DT_DIR;
+                /*
+                 * Server can return wrong NumberOfLinks value for directories
+                 * when Unix extensions are disabled - fake it.
+                 */
+                fattr->cf_nlink = 2;
         } else {
                 fattr->cf_mode = S_IFREG | cifs_sb->mnt_file_mode;
                 fattr->cf_dtype = DT_REG;
@@ -541,9 +546,9 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                 /* clear write bits if ATTR_READONLY is set */
                 if (fattr->cf_cifsattrs & ATTR_READONLY)
                         fattr->cf_mode &= ~(S_IWUGO);
-        }
 
-        fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+                fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+        }
 
         fattr->cf_uid = cifs_sb->mnt_uid;
         fattr->cf_gid = cifs_sb->mnt_gid;
@@ -1322,7 +1327,6 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, umode_t mode)
                         }
 /*BB check (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID ) to see if need
         to set uid/gid */
-                        inc_nlink(inode);
 
                         cifs_unix_basic_to_fattr(&fattr, pInfo, cifs_sb);
                         cifs_fill_uniqueid(inode->i_sb, &fattr);
@@ -1355,7 +1359,6 @@ mkdir_retry_old:
                 d_drop(direntry);
         } else {
 mkdir_get_info:
-                inc_nlink(inode);
                 if (pTcon->unix_ext)
                         rc = cifs_get_inode_info_unix(&newinode, full_path,
                                                       inode->i_sb, xid);
@@ -1436,6 +1439,11 @@ mkdir_get_info:
                 }
         }
 mkdir_out:
+        /*
+         * Force revalidate to get parent dir info when needed since cached
+         * attributes are invalid now.
+         */
+        CIFS_I(inode)->time = 0;
         kfree(full_path);
         FreeXid(xid);
         cifs_put_tlink(tlink);
@@ -1475,7 +1483,6 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
         cifs_put_tlink(tlink);
 
         if (!rc) {
-                drop_nlink(inode);
                 spin_lock(&direntry->d_inode->i_lock);
                 i_size_write(direntry->d_inode, 0);
                 clear_nlink(direntry->d_inode);
@@ -1483,12 +1490,15 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
         }
 
         cifsInode = CIFS_I(direntry->d_inode);
-        cifsInode->time = 0;    /* force revalidate to go get info when
-                                   needed */
+        /* force revalidate to go get info when needed */
+        cifsInode->time = 0;
 
         cifsInode = CIFS_I(inode);
-        cifsInode->time = 0;    /* force revalidate to get parent dir info
-                                   since cached search results now invalid */
+        /*
+         * Force revalidate to get parent dir info when needed since cached
+         * attributes are invalid now.
+         */
+        cifsInode->time = 0;
 
         direntry->d_inode->i_ctime = inode->i_ctime = inode->i_mtime =
                 current_fs_time(inode->i_sb);
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index 45f07c46f3ed..10d92cf57ab6 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -105,7 +105,6 @@ int cifs_setxattr(struct dentry *direntry, const char *ea_name,
         struct cifs_tcon *pTcon;
         struct super_block *sb;
         char *full_path;
-        struct cifs_ntsd *pacl;
 
         if (direntry == NULL)
                 return -EIO;
@@ -164,23 +163,24 @@ int cifs_setxattr(struct dentry *direntry, const char *ea_name,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         } else if (strncmp(ea_name, CIFS_XATTR_CIFS_ACL,
                         strlen(CIFS_XATTR_CIFS_ACL)) == 0) {
+#ifdef CONFIG_CIFS_ACL
+                struct cifs_ntsd *pacl;
                 pacl = kmalloc(value_size, GFP_KERNEL);
                 if (!pacl) {
                         cFYI(1, "%s: Can't allocate memory for ACL",
                                         __func__);
                         rc = -ENOMEM;
                 } else {
-#ifdef CONFIG_CIFS_ACL
                         memcpy(pacl, ea_value, value_size);
                         rc = set_cifs_acl(pacl, value_size,
                                 direntry->d_inode, full_path, CIFS_ACL_DACL);
                         if (rc == 0) /* force revalidate of the inode */
                                 CIFS_I(direntry->d_inode)->time = 0;
                         kfree(pacl);
+                }
 #else
                         cFYI(1, "Set CIFS ACL not supported yet");
 #endif /* CONFIG_CIFS_ACL */
-                }
         } else {
                 int temp;
                 temp = strncmp(ea_name, POSIX_ACL_XATTR_ACCESS,
diff --git a/fs/dcache.c b/fs/dcache.c
index 138be96e25b6..bcbdb33fcc20 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -137,6 +137,26 @@ int proc_nr_dentry(ctl_table *table, int write, void __user *buffer,
 }
 #endif
 
+/*
+ * Compare 2 name strings, return 0 if they match, otherwise non-zero.
+ * The strings are both count bytes long, and count is non-zero.
+ */
+static inline int dentry_cmp(const unsigned char *cs, size_t scount,
+                                const unsigned char *ct, size_t tcount)
+{
+        if (scount != tcount)
+                return 1;
+
+        do {
+                if (*cs != *ct)
+                        return 1;
+                cs++;
+                ct++;
+                tcount--;
+        } while (tcount);
+        return 0;
+}
+
 static void __d_free(struct rcu_head *head)
 {
         struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
diff --git a/fs/exec.c b/fs/exec.c
index 92ce83a11e90..153dee14fe55 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1915,7 +1915,6 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
 {
         struct task_struct *tsk = current;
         struct mm_struct *mm = tsk->mm;
-        struct completion *vfork_done;
         int core_waiters = -EBUSY;
 
         init_completion(&core_state->startup);
@@ -1927,22 +1926,9 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
                 core_waiters = zap_threads(tsk, mm, core_state, exit_code);
         up_write(&mm->mmap_sem);
 
-        if (unlikely(core_waiters < 0))
-                goto fail;
-
-        /*
-         * Make sure nobody is waiting for us to release the VM,
-         * otherwise we can deadlock when we wait on each other
-         */
-        vfork_done = tsk->vfork_done;
-        if (vfork_done) {
-                tsk->vfork_done = NULL;
-                complete(vfork_done);
-        }
-
-        if (core_waiters)
+        if (core_waiters > 0)
                 wait_for_completion(&core_state->startup);
-fail:
+
         return core_waiters;
 }
 
diff --git a/fs/inode.c b/fs/inode.c
index d3ebdbe723d0..83ab215baab1 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -938,8 +938,7 @@ void lockdep_annotate_inode_mutex_key(struct inode *inode)
                 struct file_system_type *type = inode->i_sb->s_type;
 
                 /* Set new key only if filesystem hasn't already changed it */
-                if (!lockdep_match_class(&inode->i_mutex,
-                    &type->i_mutex_key)) {
+                if (lockdep_match_class(&inode->i_mutex, &type->i_mutex_key)) {
                         /*
                          * ensure nobody is actually holding i_mutex
                          */
@@ -966,6 +965,7 @@ void unlock_new_inode(struct inode *inode)
         spin_lock(&inode->i_lock);
         WARN_ON(!(inode->i_state & I_NEW));
         inode->i_state &= ~I_NEW;
+        smp_mb();
         wake_up_bit(&inode->i_state, __I_NEW);
         spin_unlock(&inode->i_lock);
 }
diff --git a/fs/namei.c b/fs/namei.c
index e2ba62820a0f..46ea9cc16647 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2162,7 +2162,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
                 /* sayonara */
                 error = complete_walk(nd);
                 if (error)
-                        return ERR_PTR(-ECHILD);
+                        return ERR_PTR(error);
 
                 error = -ENOTDIR;
                 if (nd->flags & LOOKUP_DIRECTORY) {
@@ -2261,7 +2261,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
         /* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
         error = complete_walk(nd);
         if (error)
-                goto exit;
+                return ERR_PTR(error);
         error = -EISDIR;
         if (S_ISDIR(nd->inode->i_mode))
                 goto exit;
diff --git a/fs/udf/file.c b/fs/udf/file.c
index dca0c3881e82..d567b8448dfc 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -201,12 +201,10 @@ out:
 static int udf_release_file(struct inode *inode, struct file *filp)
 {
         if (filp->f_mode & FMODE_WRITE) {
-                mutex_lock(&inode->i_mutex);
                 down_write(&UDF_I(inode)->i_data_sem);
                 udf_discard_prealloc(inode);
                 udf_truncate_tail_extent(inode);
                 up_write(&UDF_I(inode)->i_data_sem);
-                mutex_unlock(&inode->i_mutex);
         }
         return 0;
 }