Merge tag 'xtensa-for-next-20140406' of git://github.com/jcmvbkbc/linux-xtensa into for_next

Merging from Max' tree. Xtensa fixes for 3.15: - add missing cache manipulation symbol exports to fix build failures; - sort extable at build time; - clean up sysmem code, support memmap boot parameter; - add highmem support for cores with non-aliasing caches; - add DTS for xtfpga on KC705. Signed-off-by: Chris Zankel <chris@zankel.net>
author: Chris Zankel <chris@zankel.net> 2014-04-09 17:49:29 -0400
committer: Chris Zankel <chris@zankel.net> 2014-04-09 17:49:29 -0400
commit: e86c4b67feb2c984314eef71314f26cfe39fef36 (patch)
tree: 3c5a7e2216cdcd1d06b8729bf94eba6dc74a7959 /fs
parent: b3fdfc1b4b641d372e35ced98814289bc60bc5d1 (diff)
parent: 9c602629e34bad88a464e08de08118e80beee0d8 (diff)
82 files changed, 991 insertions, 1115 deletions
diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c
index 24084732b1d0..80ef38c73e5a 100644
--- a/fs/anon_inodes.c
+++ b/fs/anon_inodes.c
@@ -41,19 +41,8 @@ static const struct dentry_operations anon_inodefs_dentry_operations = {
 static struct dentry *anon_inodefs_mount(struct file_system_type *fs_type,
                                int flags, const char *dev_name, void *data)
 {
-        struct dentry *root;
+        return mount_pseudo(fs_type, "anon_inode:", NULL,
-        root = mount_pseudo(fs_type, "anon_inode:", NULL,
                        &anon_inodefs_dentry_operations, ANON_INODE_FS_MAGIC);
-        if (!IS_ERR(root)) {
-                struct super_block *s = root->d_sb;
-                anon_inode_inode = alloc_anon_inode(s);
-                if (IS_ERR(anon_inode_inode)) {
-                        dput(root);
-                        deactivate_locked_super(s);
-                        root = ERR_CAST(anon_inode_inode);
-                }
-        }
-        return root;
 }
 static struct file_system_type anon_inode_fs_type = {
@@ -175,22 +164,15 @@ EXPORT_SYMBOL_GPL(anon_inode_getfd);
 static int __init anon_inode_init(void)
 {
-        int error;
-        error = register_filesystem(&anon_inode_fs_type);
-        if (error)
-                goto err_exit;
        anon_inode_mnt = kern_mount(&anon_inode_fs_type);
-        if (IS_ERR(anon_inode_mnt)) {
+        if (IS_ERR(anon_inode_mnt))
-                error = PTR_ERR(anon_inode_mnt);
+                panic("anon_inode_init() kernel mount failed (%ld)\n", PTR_ERR(anon_inode_mnt));
-                goto err_unregister_filesystem;
-        }
-        return 0;
-err_unregister_filesystem:
+        anon_inode_inode = alloc_anon_inode(anon_inode_mnt->mnt_sb);
-        unregister_filesystem(&anon_inode_fs_type);
+        if (IS_ERR(anon_inode_inode))
-err_exit:
+                panic("anon_inode_init() inode allocation failed (%ld)\n", PTR_ERR(anon_inode_inode));
-        panic(KERN_ERR "anon_inode_init() failed (%d)\n", error);
+        return 0;
 }
 fs_initcall(anon_inode_init);
diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 0129b78a6908..4f70f383132c 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -458,11 +458,10 @@ static int bio_integrity_verify(struct bio *bio)
        struct blk_integrity_exchg bix;
        struct bio_vec *bv;
        sector_t sector = bio->bi_integrity->bip_iter.bi_sector;
-        unsigned int sectors, total, ret;
+        unsigned int sectors, ret = 0;
        void *prot_buf = bio->bi_integrity->bip_buf;
        int i;
-        ret = total = 0;
        bix.disk_name = bio->bi_bdev->bd_disk->disk_name;
        bix.sector_size = bi->sector_size;
@@ -484,8 +483,6 @@ static int bio_integrity_verify(struct bio *bio)
                sectors = bv->bv_len / bi->sector_size;
                sector += sectors;
                prot_buf += sectors * bi->tuple_size;
-                total += sectors * bi->tuple_size;
-                BUG_ON(total > bio->bi_integrity->bip_iter.bi_size);
                kunmap_atomic(kaddr);
        }
diff --git a/fs/ceph/acl.c b/fs/ceph/acl.c
index 4c2d452c4bfc..21887d63dad5 100644
--- a/fs/ceph/acl.c
+++ b/fs/ceph/acl.c
@@ -54,11 +54,6 @@ static inline struct posix_acl *ceph_get_cached_acl(struct inode *inode,
        return acl;
 }
-void ceph_forget_all_cached_acls(struct inode *inode)
-{
-        forget_all_cached_acls(inode);
-}
 struct posix_acl *ceph_get_acl(struct inode *inode, int type)
 {
        int size;
@@ -160,11 +155,7 @@ int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type)
                        goto out_dput;
        }
-        if (value)
+        ret = __ceph_setxattr(dentry, name, value, size, 0);
-                ret = __ceph_setxattr(dentry, name, value, size, 0);
-        else
-                ret = __ceph_removexattr(dentry, name);
        if (ret) {
                if (new_mode != old_mode) {
                        newattrs.ia_mode = old_mode;
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 6da4df84ba30..45eda6d7a40c 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -100,6 +100,14 @@ static unsigned fpos_off(loff_t p)
        return p & 0xffffffff;
 }
+static int fpos_cmp(loff_t l, loff_t r)
+{
+        int v = ceph_frag_compare(fpos_frag(l), fpos_frag(r));
+        if (v)
+                return v;
+        return (int)(fpos_off(l) - fpos_off(r));
+}
 /*
 * When possible, we try to satisfy a readdir by peeking at the
 * dcache.  We make this work by carefully ordering dentries on
@@ -156,7 +164,7 @@ more:
                if (!d_unhashed(dentry) && dentry->d_inode &&
                    ceph_snap(dentry->d_inode) != CEPH_SNAPDIR &&
                    ceph_ino(dentry->d_inode) != CEPH_INO_CEPH &&
-                    ctx->pos <= di->offset)
+                    fpos_cmp(ctx->pos, di->offset) <= 0)
                        break;
                dout(" skipping %p %.*s at %llu (%llu)%s%s\n", dentry,
                     dentry->d_name.len, dentry->d_name.name, di->offset,
@@ -695,9 +703,8 @@ static int ceph_mknod(struct inode *dir, struct dentry *dentry,
        ceph_mdsc_put_request(req);
        if (!err)
-                err = ceph_init_acl(dentry, dentry->d_inode, dir);
+                ceph_init_acl(dentry, dentry->d_inode, dir);
+        else
-        if (err)
                d_drop(dentry);
        return err;
 }
@@ -735,7 +742,9 @@ static int ceph_symlink(struct inode *dir, struct dentry *dentry,
        if (!err && !req->r_reply_info.head->is_dentry)
                err = ceph_handle_notrace_create(dir, dentry);
        ceph_mdsc_put_request(req);
-        if (err)
+        if (!err)
+                ceph_init_acl(dentry, dentry->d_inode, dir);
+        else
                d_drop(dentry);
        return err;
 }
@@ -776,7 +785,9 @@ static int ceph_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
                err = ceph_handle_notrace_create(dir, dentry);
        ceph_mdsc_put_request(req);
 out:
-        if (err < 0)
+        if (!err)
+                ceph_init_acl(dentry, dentry->d_inode, dir);
+        else
                d_drop(dentry);
        return err;
 }
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index dfd2ce3419f8..09c7afe32e49 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -286,6 +286,7 @@ int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
        } else {
                dout("atomic_open finish_open on dn %p\n", dn);
                if (req->r_op == CEPH_MDS_OP_CREATE && req->r_reply_info.has_create_ino) {
+                        ceph_init_acl(dentry, dentry->d_inode, dir);
                        *opened |= FILE_CREATED;
                }
                err = finish_open(file, dentry, ceph_open, opened);
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 2df963f1cf5a..10a4ccbf38da 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -144,7 +144,11 @@ enum {
        Opt_ino32,
        Opt_noino32,
        Opt_fscache,
-        Opt_nofscache
+        Opt_nofscache,
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        Opt_acl,
+#endif
+        Opt_noacl
 };
 static match_table_t fsopt_tokens = {
@@ -172,6 +176,10 @@ static match_table_t fsopt_tokens = {
        {Opt_noino32, "noino32"},
        {Opt_fscache, "fsc"},
        {Opt_nofscache, "nofsc"},
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        {Opt_acl, "acl"},
+#endif
+        {Opt_noacl, "noacl"},
        {-1, NULL}
 };
@@ -271,6 +279,14 @@ static int parse_fsopt_token(char *c, void *private)
        case Opt_nofscache:
                fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE;
                break;
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        case Opt_acl:
+                fsopt->sb_flags |= MS_POSIXACL;
+                break;
+#endif
+        case Opt_noacl:
+                fsopt->sb_flags &= ~MS_POSIXACL;
+                break;
        default:
                BUG_ON(token);
        }
@@ -438,6 +454,13 @@ static int ceph_show_options(struct seq_file *m, struct dentry *root)
        else
                seq_puts(m, ",nofsc");
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        if (fsopt->sb_flags & MS_POSIXACL)
+                seq_puts(m, ",acl");
+        else
+                seq_puts(m, ",noacl");
+#endif
        if (fsopt->wsize)
                seq_printf(m, ",wsize=%d", fsopt->wsize);
        if (fsopt->rsize != CEPH_RSIZE_DEFAULT)
@@ -819,9 +842,6 @@ static int ceph_set_super(struct super_block *s, void *data)
        s->s_flags = fsc->mount_options->sb_flags;
        s->s_maxbytes = 1ULL << 40;  /* temp value until we get mdsmap */
-#ifdef CONFIG_CEPH_FS_POSIX_ACL
-        s->s_flags |= MS_POSIXACL;
-#endif
        s->s_xattr = ceph_xattr_handlers;
        s->s_fs_info = fsc;
@@ -911,6 +931,10 @@ static struct dentry *ceph_mount(struct file_system_type *fs_type,
        struct ceph_options *opt = NULL;
        dout("ceph_mount\n");
+#ifdef CONFIG_CEPH_FS_POSIX_ACL
+        flags |= MS_POSIXACL;
+#endif
        err = parse_mount_options(&fsopt, &opt, flags, data, dev_name, &path);
        if (err < 0) {
                res = ERR_PTR(err);
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 19793b56d0a7..d8801a95b685 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -13,6 +13,7 @@
 #include <linux/wait.h>
 #include <linux/writeback.h>
 #include <linux/slab.h>
+#include <linux/posix_acl.h>
 #include <linux/ceph/libceph.h>
@@ -743,7 +744,11 @@ extern const struct xattr_handler *ceph_xattr_handlers[];
 struct posix_acl *ceph_get_acl(struct inode *, int);
 int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type);
 int ceph_init_acl(struct dentry *, struct inode *, struct inode *);
-void ceph_forget_all_cached_acls(struct inode *inode);
+static inline void ceph_forget_all_cached_acls(struct inode *inode)
+{
+       forget_all_cached_acls(inode);
+}
 #else
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 898b6565ad3e..a55ec37378c6 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -12,6 +12,9 @@
 #define XATTR_CEPH_PREFIX "ceph."
 #define XATTR_CEPH_PREFIX_LEN (sizeof (XATTR_CEPH_PREFIX) - 1)
+static int __remove_xattr(struct ceph_inode_info *ci,
+                          struct ceph_inode_xattr *xattr);
 /*
 * List of handlers for synthetic system.* attributes. Other
 * attributes are handled directly.
@@ -319,8 +322,7 @@ static struct ceph_vxattr *ceph_match_vxattr(struct inode *inode,
 static int __set_xattr(struct ceph_inode_info *ci,
                           const char *name, int name_len,
                           const char *val, int val_len,
-                           int dirty,
+                           int flags, int update_xattr,
-                           int should_free_name, int should_free_val,
                           struct ceph_inode_xattr **newxattr)
 {
        struct rb_node **p;
@@ -349,12 +351,31 @@ static int __set_xattr(struct ceph_inode_info *ci,
                xattr = NULL;
        }
+        if (update_xattr) {
+                int err = 0;
+                if (xattr && (flags & XATTR_CREATE))
+                        err = -EEXIST;
+                else if (!xattr && (flags & XATTR_REPLACE))
+                        err = -ENODATA;
+                if (err) {
+                        kfree(name);
+                        kfree(val);
+                        return err;
+                }
+                if (update_xattr < 0) {
+                        if (xattr)
+                                __remove_xattr(ci, xattr);
+                        kfree(name);
+                        return 0;
+                }
+        }
        if (!xattr) {
                new = 1;
                xattr = *newxattr;
                xattr->name = name;
                xattr->name_len = name_len;
-                xattr->should_free_name = should_free_name;
+                xattr->should_free_name = update_xattr;
                ci->i_xattrs.count++;
                dout("__set_xattr count=%d\n", ci->i_xattrs.count);
@@ -364,7 +385,7 @@ static int __set_xattr(struct ceph_inode_info *ci,
                if (xattr->should_free_val)
                        kfree((void *)xattr->val);
-                if (should_free_name) {
+                if (update_xattr) {
                        kfree((void *)name);
                        name = xattr->name;
                }
@@ -379,8 +400,8 @@ static int __set_xattr(struct ceph_inode_info *ci,
                xattr->val = "";
        xattr->val_len = val_len;
-        xattr->dirty = dirty;
+        xattr->dirty = update_xattr;
-        xattr->should_free_val = (val && should_free_val);
+        xattr->should_free_val = (val && update_xattr);
        if (new) {
                rb_link_node(&xattr->node, parent, p);
@@ -442,7 +463,7 @@ static int __remove_xattr(struct ceph_inode_info *ci,
                          struct ceph_inode_xattr *xattr)
 {
        if (!xattr)
-                return -EOPNOTSUPP;
+                return -ENODATA;
        rb_erase(&xattr->node, &ci->i_xattrs.index);
@@ -588,7 +609,7 @@ start:
                        p += len;
                        err = __set_xattr(ci, name, namelen, val, len,
-                                          0, 0, 0, &xattrs[numattr]);
+                                          0, 0, &xattrs[numattr]);
                        if (err < 0)
                                goto bad;
@@ -850,6 +871,9 @@ static int ceph_sync_setxattr(struct dentry *dentry, const char *name,
        dout("setxattr value=%.*s\n", (int)size, value);
+        if (!value)
+                flags |= CEPH_XATTR_REMOVE;
        /* do request */
        req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_SETXATTR,
                                       USE_AUTH_MDS);
@@ -892,7 +916,7 @@ int __ceph_setxattr(struct dentry *dentry, const char *name,
        struct ceph_inode_info *ci = ceph_inode(inode);
        int issued;
        int err;
-        int dirty;
+        int dirty = 0;
        int name_len = strlen(name);
        int val_len = size;
        char *newname = NULL;
@@ -953,12 +977,14 @@ retry:
                goto retry;
        }
-        err = __set_xattr(ci, newname, name_len, newval,
+        err = __set_xattr(ci, newname, name_len, newval, val_len,
-                          val_len, 1, 1, 1, &xattr);
+                          flags, value ? 1 : -1, &xattr);
-        dirty = __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
+        if (!err) {
-        ci->i_xattrs.dirty = true;
+                dirty = __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
-        inode->i_ctime = CURRENT_TIME;
+                ci->i_xattrs.dirty = true;
+                inode->i_ctime = CURRENT_TIME;
+        }
        spin_unlock(&ci->i_ceph_lock);
        if (dirty)
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index c819b0bd491a..7ff866dbb89e 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -865,8 +865,8 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd,
        return rc;
 }
-static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
+struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
-                __u16 fid, u32 *pacllen)
+                const struct cifs_fid *cifsfid, u32 *pacllen)
 {
        struct cifs_ntsd *pntsd = NULL;
        unsigned int xid;
@@ -877,7 +877,8 @@ static struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,
                return ERR_CAST(tlink);
        xid = get_xid();
-        rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), fid, &pntsd, pacllen);
+        rc = CIFSSMBGetCIFSACL(xid, tlink_tcon(tlink), cifsfid->netfid, &pntsd,
+                                pacllen);
        free_xid(xid);
        cifs_put_tlink(tlink);
@@ -946,7 +947,7 @@ struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
        if (!open_file)
                return get_cifs_acl_by_path(cifs_sb, path, pacllen);
-        pntsd = get_cifs_acl_by_fid(cifs_sb, open_file->fid.netfid, pacllen);
+        pntsd = get_cifs_acl_by_fid(cifs_sb, &open_file->fid, pacllen);
        cifsFileInfo_put(open_file);
        return pntsd;
 }
@@ -1006,19 +1007,31 @@ out:
 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
 int
 cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
-                  struct inode *inode, const char *path, const __u16 *pfid)
+                  struct inode *inode, const char *path,
+                  const struct cifs_fid *pfid)
 {
        struct cifs_ntsd *pntsd = NULL;
        u32 acllen = 0;
        int rc = 0;
+        struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
+        struct cifs_tcon *tcon;
        cifs_dbg(NOISY, "converting ACL to mode for %s\n", path);
-        if (pfid)
+        if (IS_ERR(tlink))
-                pntsd = get_cifs_acl_by_fid(cifs_sb, *pfid, &acllen);
+                return PTR_ERR(tlink);
-        else
+        tcon = tlink_tcon(tlink);
-                pntsd = get_cifs_acl(cifs_sb, inode, path, &acllen);
+        if (pfid && (tcon->ses->server->ops->get_acl_by_fid))
+                pntsd = tcon->ses->server->ops->get_acl_by_fid(cifs_sb, pfid,
+                                                          &acllen);
+        else if (tcon->ses->server->ops->get_acl)
+                pntsd = tcon->ses->server->ops->get_acl(cifs_sb, inode, path,
+                                                        &acllen);
+        else {
+                cifs_put_tlink(tlink);
+                return -EOPNOTSUPP;
+        }
        /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
        if (IS_ERR(pntsd)) {
                rc = PTR_ERR(pntsd);
@@ -1030,6 +1043,8 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
                        cifs_dbg(VFS, "parse sec desc failed rc = %d\n", rc);
        }
+        cifs_put_tlink(tlink);
        return rc;
 }
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 86dc28c7aa5c..c0f3718b77a8 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -398,6 +398,8 @@ struct smb_version_operations {
                        const struct nls_table *, int);
        struct cifs_ntsd * (*get_acl)(struct cifs_sb_info *, struct inode *,
                        const char *, u32 *);
+        struct cifs_ntsd * (*get_acl_by_fid)(struct cifs_sb_info *,
+                        const struct cifs_fid *, u32 *);
        int (*set_acl)(struct cifs_ntsd *, __u32, struct inode *, const char *,
                        int);
 };
@@ -511,7 +513,7 @@ struct cifs_mnt_data {
 static inline unsigned int
 get_rfc1002_length(void *buf)
 {
-        return be32_to_cpu(*((__be32 *)buf));
+        return be32_to_cpu(*((__be32 *)buf)) & 0xffffff;
 }
 static inline void
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index d00e09dfc452..acc4ee8ed075 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -151,7 +151,7 @@ extern struct inode *cifs_iget(struct super_block *sb,
 extern int cifs_get_inode_info(struct inode **inode, const char *full_path,
                               FILE_ALL_INFO *data, struct super_block *sb,
-                               int xid, const __u16 *fid);
+                               int xid, const struct cifs_fid *fid);
 extern int cifs_get_inode_info_unix(struct inode **pinode,
                        const unsigned char *search_path,
                        struct super_block *sb, unsigned int xid);
@@ -162,11 +162,13 @@ extern int cifs_rename_pending_delete(const char *full_path,
                                      const unsigned int xid);
 extern int cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb,
                              struct cifs_fattr *fattr, struct inode *inode,
-                              const char *path, const __u16 *pfid);
+                              const char *path, const struct cifs_fid *pfid);
 extern int id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64,
                                        kuid_t, kgid_t);
 extern struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *, struct inode *,
                                        const char *, u32 *);
+extern struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *,
+                                                const struct cifs_fid *, u32 *);
 extern int set_cifs_acl(struct cifs_ntsd *, __u32, struct inode *,
                                const char *, int);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index d3a6796caa5a..3db0c5fd9a11 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -378,7 +378,7 @@ cifs_create_get_file_info:
                                              xid);
        else {
                rc = cifs_get_inode_info(&newinode, full_path, buf, inode->i_sb,
-                                         xid, &fid->netfid);
+                                         xid, fid);
                if (newinode) {
                        if (server->ops->set_lease_key)
                                server->ops->set_lease_key(newinode, fid);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 755584684f6c..834fce759d80 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -244,7 +244,7 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb,
                                              xid);
        else
                rc = cifs_get_inode_info(&inode, full_path, buf, inode->i_sb,
-                                         xid, &fid->netfid);
+                                         xid, fid);
 out:
        kfree(buf);
@@ -2389,7 +2389,7 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
                 unsigned long nr_segs, loff_t *poffset)
 {
        unsigned long nr_pages, i;
-        size_t copied, len, cur_len;
+        size_t bytes, copied, len, cur_len;
        ssize_t total_written = 0;
        loff_t offset;
        struct iov_iter it;
@@ -2444,14 +2444,45 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
                save_len = cur_len;
                for (i = 0; i < nr_pages; i++) {
-                        copied = min_t(const size_t, cur_len, PAGE_SIZE);
+                        bytes = min_t(const size_t, cur_len, PAGE_SIZE);
                        copied = iov_iter_copy_from_user(wdata->pages[i], &it,
-                                                         0, copied);
+                                                         0, bytes);
                        cur_len -= copied;
                        iov_iter_advance(&it, copied);
+                        /*
+                         * If we didn't copy as much as we expected, then that
+                         * may mean we trod into an unmapped area. Stop copying
+                         * at that point. On the next pass through the big
+                         * loop, we'll likely end up getting a zero-length
+                         * write and bailing out of it.
+                         */
+                        if (copied < bytes)
+                                break;
                }
                cur_len = save_len - cur_len;
+                /*
+                 * If we have no data to send, then that probably means that
+                 * the copy above failed altogether. That's most likely because
+                 * the address in the iovec was bogus. Set the rc to -EFAULT,
+                 * free anything we allocated and bail out.
+                 */
+                if (!cur_len) {
+                        for (i = 0; i < nr_pages; i++)
+                                put_page(wdata->pages[i]);
+                        kfree(wdata);
+                        rc = -EFAULT;
+                        break;
+                }
+                /*
+                 * i + 1 now represents the number of pages we actually used in
+                 * the copy phase above. Bring nr_pages down to that, and free
+                 * any pages that we didn't use.
+                 */
+                for ( ; nr_pages > i + 1; nr_pages--)
+                        put_page(wdata->pages[nr_pages - 1]);
                wdata->sync_mode = WB_SYNC_ALL;
                wdata->nr_pages = nr_pages;
                wdata->offset = (__u64)offset;
@@ -2548,31 +2579,19 @@ cifs_writev(struct kiocb *iocb, const struct iovec *iov,
        struct cifsInodeInfo *cinode = CIFS_I(inode);
        struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server;
        ssize_t rc = -EACCES;
+        loff_t lock_pos = pos;
-        BUG_ON(iocb->ki_pos != pos);
+        if (file->f_flags & O_APPEND)
+                lock_pos = i_size_read(inode);
        /*
         * We need to hold the sem to be sure nobody modifies lock list
         * with a brlock that prevents writing.
         */
        down_read(&cinode->lock_sem);
-        if (!cifs_find_lock_conflict(cfile, pos, iov_length(iov, nr_segs),
+        if (!cifs_find_lock_conflict(cfile, lock_pos, iov_length(iov, nr_segs),
                                     server->vals->exclusive_lock_type, NULL,
-                                     CIFS_WRITE_OP)) {
+                                     CIFS_WRITE_OP))
-                mutex_lock(&inode->i_mutex);
+                rc = generic_file_aio_write(iocb, iov, nr_segs, pos);
-                rc = __generic_file_aio_write(iocb, iov, nr_segs,
-                                               &iocb->ki_pos);
-                mutex_unlock(&inode->i_mutex);
-        }
-        if (rc > 0) {
-                ssize_t err;
-                err = generic_write_sync(file, iocb->ki_pos - rc, rc);
-                if (err < 0)
-                        rc = err;
-        }
        up_read(&cinode->lock_sem);
        return rc;
 }
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index be58b8fcdb3c..aadc2b68678b 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -677,7 +677,7 @@ cgfi_exit:
 int
 cifs_get_inode_info(struct inode **inode, const char *full_path,
                    FILE_ALL_INFO *data, struct super_block *sb, int xid,
-                    const __u16 *fid)
+                    const struct cifs_fid *fid)
 {
        bool validinum = false;
        __u16 srchflgs;
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index bfd66d84831e..526fb89f9230 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -1073,6 +1073,7 @@ struct smb_version_operations smb1_operations = {
 #endif /* CIFS_XATTR */
 #ifdef CONFIG_CIFS_ACL
        .get_acl = get_cifs_acl,
+        .get_acl_by_fid = get_cifs_acl_by_fid,
        .set_acl = set_cifs_acl,
 #endif /* CIFS_ACL */
 };
diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h
index c38350851b08..bc0bb9c34f72 100644
--- a/fs/cifs/smb2glob.h
+++ b/fs/cifs/smb2glob.h
@@ -57,4 +57,7 @@
 #define SMB2_CMACAES_SIZE (16)
 #define SMB3_SIGNKEY_SIZE (16)
+/* Maximum buffer size value we can send with 1 credit */
+#define SMB2_MAX_BUFFER_SIZE 65536
 #endif  /* _SMB2_GLOB_H */
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 757da3e54d3d..192f51a12cf1 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -182,11 +182,8 @@ smb2_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
        /* start with specified wsize, or default */
        wsize = volume_info->wsize ? volume_info->wsize : CIFS_DEFAULT_IOSIZE;
        wsize = min_t(unsigned int, wsize, server->max_write);
-        /*
+        /* set it to the maximum buffer size value we can send with 1 credit */
-         * limit write size to 2 ** 16, because we don't support multicredit
+        wsize = min_t(unsigned int, wsize, SMB2_MAX_BUFFER_SIZE);
-         * requests now.
-         */
-        wsize = min_t(unsigned int, wsize, 2 << 15);
        return wsize;
 }
@@ -200,11 +197,8 @@ smb2_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
        /* start with specified rsize, or default */
        rsize = volume_info->rsize ? volume_info->rsize : CIFS_DEFAULT_IOSIZE;
        rsize = min_t(unsigned int, rsize, server->max_read);
-        /*
+        /* set it to the maximum buffer size value we can send with 1 credit */
-         * limit write size to 2 ** 16, because we don't support multicredit
+        rsize = min_t(unsigned int, rsize, SMB2_MAX_BUFFER_SIZE);
-         * requests now.
-         */
-        rsize = min_t(unsigned int, rsize, 2 << 15);
        return rsize;
 }
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index a3f7a9c3cc69..860344701067 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -413,7 +413,9 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
        /* SMB2 only has an extended negflavor */
        server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
-        server->maxBuf = le32_to_cpu(rsp->MaxTransactSize);
+        /* set it to the maximum buffer size value we can send with 1 credit */
+        server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize),
+                               SMB2_MAX_BUFFER_SIZE);
        server->max_read = le32_to_cpu(rsp->MaxReadSize);
        server->max_write = le32_to_cpu(rsp->MaxWriteSize);
        /* BB Do we need to validate the SecurityMode? */
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index b37570952846..18cd5650a5fc 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -270,6 +270,26 @@ cifs_rqst_page_to_kvec(struct smb_rqst *rqst, unsigned int idx,
                iov->iov_len = rqst->rq_pagesz;
 }
+static unsigned long
+rqst_len(struct smb_rqst *rqst)
+{
+        unsigned int i;
+        struct kvec *iov = rqst->rq_iov;
+        unsigned long buflen = 0;
+        /* total up iov array first */
+        for (i = 0; i < rqst->rq_nvec; i++)
+                buflen += iov[i].iov_len;
+        /* add in the page array if there is one */
+        if (rqst->rq_npages) {
+                buflen += rqst->rq_pagesz * (rqst->rq_npages - 1);
+                buflen += rqst->rq_tailsz;
+        }
+        return buflen;
+}
 static int
 smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 {
@@ -277,6 +297,7 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
        struct kvec *iov = rqst->rq_iov;
        int n_vec = rqst->rq_nvec;
        unsigned int smb_buf_length = get_rfc1002_length(iov[0].iov_base);
+        unsigned long send_length;
        unsigned int i;
        size_t total_len = 0, sent;
        struct socket *ssocket = server->ssocket;
@@ -285,6 +306,14 @@ smb_send_rqst(struct TCP_Server_Info *server, struct smb_rqst *rqst)
        if (ssocket == NULL)
                return -ENOTSOCK;
+        /* sanity check send length */
+        send_length = rqst_len(rqst);
+        if (send_length != smb_buf_length + 4) {
+                WARN(1, "Send length mismatch(send_length=%lu smb_buf_length=%u)\n",
+                        send_length, smb_buf_length);
+                return -EIO;
+        }
        cifs_dbg(FYI, "Sending smb: smb_len=%u\n", smb_buf_length);
        dump_smb(iov[0].iov_base, iov[0].iov_len);
diff --git a/fs/dcache.c b/fs/dcache.c
index 265e0ce9769c..ca02c13a84aa 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2833,9 +2833,9 @@ static int prepend_name(char **buffer, int *buflen, struct qstr *name)
        u32 dlen = ACCESS_ONCE(name->len);
        char *p;
-        if (*buflen < dlen + 1)
-                return -ENAMETOOLONG;
        *buflen -= dlen + 1;
+        if (*buflen < 0)
+                return -ENAMETOOLONG;
        p = *buffer -= dlen + 1;
        *p++ = '/';
        while (dlen--) {
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index ece55565b9cd..d3a534fdc5ff 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -771,6 +771,8 @@ do {									       \
        if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime))                      \
                (einode)->xtime.tv_sec =                                       \
                        (signed)le32_to_cpu((raw_inode)->xtime);               \
+        else                                                                   \
+                (einode)->xtime.tv_sec = 0;                                    \
        if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime ## _extra))            \
                ext4_decode_extra_time(&(einode)->xtime,                       \
                                       raw_inode->xtime ## _extra);            \
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 10cff4736b11..74bc2d549c58 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3906,6 +3906,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                } else
                        err = ret;
                map->m_flags |= EXT4_MAP_MAPPED;
+                map->m_pblk = newblock;
                if (allocated > map->m_len)
                        allocated = map->m_len;
                map->m_len = allocated;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 6e39895a91b8..24bfd7ff3049 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -38,6 +38,7 @@
 #include <linux/slab.h>
 #include <linux/ratelimit.h>
 #include <linux/aio.h>
+#include <linux/bitops.h>
 #include "ext4_jbd2.h"
 #include "xattr.h"
@@ -3921,18 +3922,20 @@ int ext4_get_inode_loc(struct inode *inode, struct ext4_iloc *iloc)
 void ext4_set_inode_flags(struct inode *inode)
 {
        unsigned int flags = EXT4_I(inode)->i_flags;
+        unsigned int new_fl = 0;
-        inode->i_flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC);
        if (flags & EXT4_SYNC_FL)
-                inode->i_flags |= S_SYNC;
+                new_fl |= S_SYNC;
        if (flags & EXT4_APPEND_FL)
-                inode->i_flags |= S_APPEND;
+                new_fl |= S_APPEND;
        if (flags & EXT4_IMMUTABLE_FL)
-                inode->i_flags |= S_IMMUTABLE;
+                new_fl |= S_IMMUTABLE;
        if (flags & EXT4_NOATIME_FL)
-                inode->i_flags |= S_NOATIME;
+                new_fl |= S_NOATIME;
        if (flags & EXT4_DIRSYNC_FL)
-                inode->i_flags |= S_DIRSYNC;
+                new_fl |= S_DIRSYNC;
+        set_mask_bits(&inode->i_flags,
+                      S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC, new_fl);
 }
 /* Propagate flags from i_flags to EXT4_I(inode)->i_flags */
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 6bea80614d77..a2a837f00407 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -140,7 +140,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
        handle = ext4_journal_start(inode_bl, EXT4_HT_MOVE_EXTENTS, 2);
        if (IS_ERR(handle)) {
                err = -EINVAL;
-                goto swap_boot_out;
+                goto journal_err_out;
        }
        /* Protect extent tree against block allocations via delalloc */
@@ -198,6 +198,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
        ext4_double_up_write_data_sem(inode, inode_bl);
+journal_err_out:
        ext4_inode_resume_unlocked_dio(inode);
        ext4_inode_resume_unlocked_dio(inode_bl);
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index c5adbb318a90..f3b84cd9de56 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -243,6 +243,7 @@ static int ext4_alloc_group_tables(struct super_block *sb,
        ext4_group_t group;
        ext4_group_t last_group;
        unsigned overhead;
+        __u16 uninit_mask = (flexbg_size > 1) ? ~EXT4_BG_BLOCK_UNINIT : ~0;
        BUG_ON(flex_gd->count == 0 || group_data == NULL);
@@ -266,7 +267,7 @@ next_group:
        src_group++;
        for (; src_group <= last_group; src_group++) {
                overhead = ext4_group_overhead_blocks(sb, src_group);
-                if (overhead != 0)
+                if (overhead == 0)
                        last_blk += group_data[src_group - group].blocks_count;
                else
                        break;
@@ -280,8 +281,7 @@ next_group:
                group = ext4_get_group_number(sb, start_blk - 1);
                group -= group_data[0].group;
                group_data[group].free_blocks_count--;
-                if (flexbg_size > 1)
+                flex_gd->bg_flags[group] &= uninit_mask;
-                        flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT;
        }
        /* Allocate inode bitmaps */
@@ -292,22 +292,30 @@ next_group:
                group = ext4_get_group_number(sb, start_blk - 1);
                group -= group_data[0].group;
                group_data[group].free_blocks_count--;
-                if (flexbg_size > 1)
+                flex_gd->bg_flags[group] &= uninit_mask;
-                        flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT;
        }
        /* Allocate inode tables */
        for (; it_index < flex_gd->count; it_index++) {
-                if (start_blk + EXT4_SB(sb)->s_itb_per_group > last_blk)
+                unsigned int itb = EXT4_SB(sb)->s_itb_per_group;
+                ext4_fsblk_t next_group_start;
+                if (start_blk + itb > last_blk)
                        goto next_group;
                group_data[it_index].inode_table = start_blk;
-                group = ext4_get_group_number(sb, start_blk - 1);
+                group = ext4_get_group_number(sb, start_blk);
+                next_group_start = ext4_group_first_block_no(sb, group + 1);
                group -= group_data[0].group;
-                group_data[group].free_blocks_count -=
-                                        EXT4_SB(sb)->s_itb_per_group;
-                if (flexbg_size > 1)
-                        flex_gd->bg_flags[group] &= ~EXT4_BG_BLOCK_UNINIT;
+                if (start_blk + itb > next_group_start) {
+                        flex_gd->bg_flags[group + 1] &= uninit_mask;
+                        overhead = start_blk + itb - next_group_start;
+                        group_data[group + 1].free_blocks_count -= overhead;
+                        itb -= overhead;
+                }
+                group_data[group].free_blocks_count -= itb;
+                flex_gd->bg_flags[group] &= uninit_mask;
                start_blk += EXT4_SB(sb)->s_itb_per_group;
        }
@@ -401,7 +409,7 @@ static int set_flexbg_block_bitmap(struct super_block *sb, handle_t *handle,
                start = ext4_group_first_block_no(sb, group);
                group -= flex_gd->groups[0].group;
-                count2 = sb->s_blocksize * 8 - (block - start);
+                count2 = EXT4_BLOCKS_PER_GROUP(sb) - (block - start);
                if (count2 > count)
                        count2 = count;
@@ -620,7 +628,7 @@ handle_ib:
                        if (err)
                                goto out;
                        count = group_table_count[j];
-                        start = group_data[i].block_bitmap;
+                        start = (&group_data[i].block_bitmap)[j];
                        block = start;
                }
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 1f7784de05b6..710fed2377d4 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3695,16 +3695,22 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
        for (i = 0; i < 4; i++)
                sbi->s_hash_seed[i] = le32_to_cpu(es->s_hash_seed[i]);
        sbi->s_def_hash_version = es->s_def_hash_version;
-        i = le32_to_cpu(es->s_flags);
+        if (EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
-        if (i & EXT2_FLAGS_UNSIGNED_HASH)
+                i = le32_to_cpu(es->s_flags);
-                sbi->s_hash_unsigned = 3;
+                if (i & EXT2_FLAGS_UNSIGNED_HASH)
-        else if ((i & EXT2_FLAGS_SIGNED_HASH) == 0) {
+                        sbi->s_hash_unsigned = 3;
+                else if ((i & EXT2_FLAGS_SIGNED_HASH) == 0) {
 #ifdef __CHAR_UNSIGNED__
-                es->s_flags |= cpu_to_le32(EXT2_FLAGS_UNSIGNED_HASH);
+                        if (!(sb->s_flags & MS_RDONLY))
-                sbi->s_hash_unsigned = 3;
+                                es->s_flags |=
+                                        cpu_to_le32(EXT2_FLAGS_UNSIGNED_HASH);
+                        sbi->s_hash_unsigned = 3;
 #else
-                es->s_flags |= cpu_to_le32(EXT2_FLAGS_SIGNED_HASH);
+                        if (!(sb->s_flags & MS_RDONLY))
+                                es->s_flags |=
+                                        cpu_to_le32(EXT2_FLAGS_SIGNED_HASH);
 #endif
+                }
        }
        /* Handle clustersize */
diff --git a/fs/file.c b/fs/file.c
index db25c2bdfe46..eb56a13dab3e 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -683,35 +683,54 @@ EXPORT_SYMBOL(fget_raw);
 * The fput_needed flag returned by fget_light should be passed to the
 * corresponding fput_light.
 */
-struct file *__fget_light(unsigned int fd, fmode_t mask, int *fput_needed)
+static unsigned long __fget_light(unsigned int fd, fmode_t mask)
 {
        struct files_struct *files = current->files;
        struct file *file;
-        *fput_needed = 0;
        if (atomic_read(&files->count) == 1) {
                file = __fcheck_files(files, fd);
-                if (file && (file->f_mode & mask))
+                if (!file || unlikely(file->f_mode & mask))
-                        file = NULL;
+                        return 0;
+                return (unsigned long)file;
        } else {
                file = __fget(fd, mask);
-                if (file)
+                if (!file)
-                        *fput_needed = 1;
+                        return 0;
+                return FDPUT_FPUT | (unsigned long)file;
        }
-        return file;
 }
-struct file *fget_light(unsigned int fd, int *fput_needed)
+unsigned long __fdget(unsigned int fd)
 {
-        return __fget_light(fd, FMODE_PATH, fput_needed);
+        return __fget_light(fd, FMODE_PATH);
 }
-EXPORT_SYMBOL(fget_light);
+EXPORT_SYMBOL(__fdget);
-struct file *fget_raw_light(unsigned int fd, int *fput_needed)
+unsigned long __fdget_raw(unsigned int fd)
 {
-        return __fget_light(fd, 0, fput_needed);
+        return __fget_light(fd, 0);
 }
+unsigned long __fdget_pos(unsigned int fd)
+{
+        unsigned long v = __fdget(fd);
+        struct file *file = (struct file *)(v & ~3);
+        if (file && (file->f_mode & FMODE_ATOMIC_POS)) {
+                if (file_count(file) > 1) {
+                        v |= FDPUT_POS_UNLOCK;
+                        mutex_lock(&file->f_pos_lock);
+                }
+        }
+        return v;
+}
+/*
+ * We only lock f_pos if we have threads or if the file might be
+ * shared with another process. In both cases we'll have an elevated
+ * file count (done either by fdget() or by fork()).
+ */
 void set_close_on_exec(unsigned int fd, int flag)
 {
        struct files_struct *files = current->files;
diff --git a/fs/file_table.c b/fs/file_table.c
index 5fff9030be34..5b24008ea4f6 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -135,6 +135,7 @@ struct file *get_empty_filp(void)
        atomic_long_set(&f->f_count, 1);
        rwlock_init(&f->f_owner.lock);
        spin_lock_init(&f->f_lock);
+        mutex_init(&f->f_pos_lock);
        eventpoll_init_file(f);
        /* f->f_version: 0 */
        return f;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index e0259a163f98..d754e3cf99a8 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -40,18 +40,13 @@
 struct wb_writeback_work {
        long nr_pages;
        struct super_block *sb;
-        /*
+        unsigned long *older_than_this;
-         * Write only inodes dirtied before this time. Don't forget to set
-         * older_than_this_is_set when you set this.
-         */
-        unsigned long older_than_this;
        enum writeback_sync_modes sync_mode;
        unsigned int tagged_writepages:1;
        unsigned int for_kupdate:1;
        unsigned int range_cyclic:1;
        unsigned int for_background:1;
        unsigned int for_sync:1;        /* sync(2) WB_SYNC_ALL writeback */
-        unsigned int older_than_this_is_set:1;
        enum wb_reason reason;          /* why was writeback initiated? */
        struct list_head list;          /* pending work list */
@@ -252,10 +247,10 @@ static int move_expired_inodes(struct list_head *delaying_queue,
        int do_sb_sort = 0;
        int moved = 0;
-        WARN_ON_ONCE(!work->older_than_this_is_set);
        while (!list_empty(delaying_queue)) {
                inode = wb_inode(delaying_queue->prev);
-                if (inode_dirtied_after(inode, work->older_than_this))
+                if (work->older_than_this &&
+                    inode_dirtied_after(inode, *work->older_than_this))
                        break;
                list_move(&inode->i_wb_list, &tmp);
                moved++;
@@ -742,8 +737,6 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages,
                .sync_mode      = WB_SYNC_NONE,
                .range_cyclic   = 1,
                .reason         = reason,
-                .older_than_this = jiffies,
-                .older_than_this_is_set = 1,
        };
        spin_lock(&wb->list_lock);
@@ -802,13 +795,12 @@ static long wb_writeback(struct bdi_writeback *wb,
 {
        unsigned long wb_start = jiffies;
        long nr_pages = work->nr_pages;
+        unsigned long oldest_jif;
        struct inode *inode;
        long progress;
-        if (!work->older_than_this_is_set) {
+        oldest_jif = jiffies;
-                work->older_than_this = jiffies;
+        work->older_than_this = &oldest_jif;
-                work->older_than_this_is_set = 1;
-        }
        spin_lock(&wb->list_lock);
        for (;;) {
@@ -842,10 +834,10 @@ static long wb_writeback(struct bdi_writeback *wb,
                 * safe.
                 */
                if (work->for_kupdate) {
-                        work->older_than_this = jiffies -
+                        oldest_jif = jiffies -
                                msecs_to_jiffies(dirty_expire_interval * 10);
                } else if (work->for_background)
-                        work->older_than_this = jiffies;
+                        oldest_jif = jiffies;
                trace_writeback_start(wb->bdi, work);
                if (list_empty(&wb->b_io))
@@ -1357,21 +1349,18 @@ EXPORT_SYMBOL(try_to_writeback_inodes_sb);
 /**
 * sync_inodes_sb       -       sync sb inode pages
- * @sb:                 the superblock
+ * @sb: the superblock
- * @older_than_this:    timestamp
 *
 * This function writes and waits on any dirty inode belonging to this
- * superblock that has been dirtied before given timestamp.
+ * super_block.
 */
-void sync_inodes_sb(struct super_block *sb, unsigned long older_than_this)
+void sync_inodes_sb(struct super_block *sb)
 {
        DECLARE_COMPLETION_ONSTACK(done);
        struct wb_writeback_work work = {
                .sb             = sb,
                .sync_mode      = WB_SYNC_ALL,
                .nr_pages       = LONG_MAX,
-                .older_than_this = older_than_this,
-                .older_than_this_is_set = 1,
                .range_cyclic   = 0,
                .done           = &done,
                .reason         = WB_REASON_SYNC,
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
index e1959efad64f..b5ebc2d7d80d 100644
--- a/fs/fscache/object-list.c
+++ b/fs/fscache/object-list.c
@@ -50,6 +50,8 @@ void fscache_objlist_add(struct fscache_object *obj)
        struct fscache_object *xobj;
        struct rb_node **p = &fscache_object_list.rb_node, *parent = NULL;
+        ASSERT(RB_EMPTY_NODE(&obj->objlist_link));
        write_lock(&fscache_object_list_lock);
        while (*p) {
@@ -75,6 +77,9 @@ void fscache_objlist_add(struct fscache_object *obj)
 */
 void fscache_objlist_remove(struct fscache_object *obj)
 {
+        if (RB_EMPTY_NODE(&obj->objlist_link))
+                return;
        write_lock(&fscache_object_list_lock);
        BUG_ON(RB_EMPTY_ROOT(&fscache_object_list));
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 53d35c504240..d3b4539f1651 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -314,6 +314,9 @@ void fscache_object_init(struct fscache_object *object,
        object->cache = cache;
        object->cookie = cookie;
        object->parent = NULL;
+#ifdef CONFIG_FSCACHE_OBJECT_LIST
+        RB_CLEAR_NODE(&object->objlist_link);
+#endif
        object->oob_event_mask = 0;
        for (t = object->oob_table; t->events; t++)
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index 968ce411db53..32602c667b4a 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -103,6 +103,8 @@ static int hfsplus_cat_build_record(hfsplus_cat_entry *entry,
                folder = &entry->folder;
                memset(folder, 0, sizeof(*folder));
                folder->type = cpu_to_be16(HFSPLUS_FOLDER);
+                if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags))
+                        folder->flags |= cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT);
                folder->id = cpu_to_be32(inode->i_ino);
                HFSPLUS_I(inode)->create_date =
                        folder->create_date =
@@ -203,6 +205,36 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,
        return hfs_brec_find(fd, hfs_find_rec_by_key);
 }
+static void hfsplus_subfolders_inc(struct inode *dir)
+{
+        struct hfsplus_sb_info *sbi = HFSPLUS_SB(dir->i_sb);
+        if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags)) {
+                /*
+                 * Increment subfolder count. Note, the value is only meaningful
+                 * for folders with HFSPLUS_HAS_FOLDER_COUNT flag set.
+                 */
+                HFSPLUS_I(dir)->subfolders++;
+        }
+}
+static void hfsplus_subfolders_dec(struct inode *dir)
+{
+        struct hfsplus_sb_info *sbi = HFSPLUS_SB(dir->i_sb);
+        if (test_bit(HFSPLUS_SB_HFSX, &sbi->flags)) {
+                /*
+                 * Decrement subfolder count. Note, the value is only meaningful
+                 * for folders with HFSPLUS_HAS_FOLDER_COUNT flag set.
+                 *
+                 * Check for zero. Some subfolders may have been created
+                 * by an implementation ignorant of this counter.
+                 */
+                if (HFSPLUS_I(dir)->subfolders)
+                        HFSPLUS_I(dir)->subfolders--;
+        }
+}
 int hfsplus_create_cat(u32 cnid, struct inode *dir,
                struct qstr *str, struct inode *inode)
 {
@@ -247,6 +279,8 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
                goto err1;
        dir->i_size++;
+        if (S_ISDIR(inode->i_mode))
+                hfsplus_subfolders_inc(dir);
        dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
        hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
@@ -336,6 +370,8 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
                goto out;
        dir->i_size--;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_dec(dir);
        dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
        hfsplus_mark_inode_dirty(dir, HFSPLUS_I_CAT_DIRTY);
@@ -380,6 +416,7 @@ int hfsplus_rename_cat(u32 cnid,
        hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
                                src_fd.entrylength);
+        type = be16_to_cpu(entry.type);
        /* create new dir entry with the data from the old entry */
        hfsplus_cat_build_key(sb, dst_fd.search_key, dst_dir->i_ino, dst_name);
@@ -394,6 +431,8 @@ int hfsplus_rename_cat(u32 cnid,
        if (err)
                goto out;
        dst_dir->i_size++;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_inc(dst_dir);
        dst_dir->i_mtime = dst_dir->i_ctime = CURRENT_TIME_SEC;
        /* finally remove the old entry */
@@ -405,6 +444,8 @@ int hfsplus_rename_cat(u32 cnid,
        if (err)
                goto out;
        src_dir->i_size--;
+        if (type == HFSPLUS_FOLDER)
+                hfsplus_subfolders_dec(src_dir);
        src_dir->i_mtime = src_dir->i_ctime = CURRENT_TIME_SEC;
        /* remove old thread entry */
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index 08846425b67f..62d571eb69ba 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -242,6 +242,7 @@ struct hfsplus_inode_info {
         */
        sector_t fs_blocks;
        u8 userflags;           /* BSD user file flags */
+        u32 subfolders;         /* Subfolder count (HFSX only) */
        struct list_head open_dir_list;
        loff_t phys_size;
diff --git a/fs/hfsplus/hfsplus_raw.h b/fs/hfsplus/hfsplus_raw.h
index 8ffb3a8ffe75..5a126828d85e 100644
--- a/fs/hfsplus/hfsplus_raw.h
+++ b/fs/hfsplus/hfsplus_raw.h
@@ -261,7 +261,7 @@ struct hfsplus_cat_folder {
        struct DInfo user_info;
        struct DXInfo finder_info;
        __be32 text_encoding;
-        u32 reserved;
+        __be32 subfolders;      /* Subfolder count in HFSX. Reserved in HFS+. */
 } __packed;
 /* HFS file info (stolen from hfs.h) */
@@ -301,11 +301,13 @@ struct hfsplus_cat_file {
        struct hfsplus_fork_raw rsrc_fork;
 } __packed;
-/* File attribute bits */
+/* File and folder flag bits */
 #define HFSPLUS_FILE_LOCKED             0x0001
 #define HFSPLUS_FILE_THREAD_EXISTS      0x0002
 #define HFSPLUS_XATTR_EXISTS            0x0004
 #define HFSPLUS_ACL_EXISTS              0x0008
+#define HFSPLUS_HAS_FOLDER_COUNT        0x0010  /* Folder has subfolder count
+                                                 * (HFSX only) */
 /* HFS+ catalog thread (part of a cat_entry) */
 struct hfsplus_cat_thread {
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index fa929f325f87..a4f45bd88a63 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -375,6 +375,7 @@ struct inode *hfsplus_new_inode(struct super_block *sb, umode_t mode)
        hip->extent_state = 0;
        hip->flags = 0;
        hip->userflags = 0;
+        hip->subfolders = 0;
        memset(hip->first_extents, 0, sizeof(hfsplus_extent_rec));
        memset(hip->cached_extents, 0, sizeof(hfsplus_extent_rec));
        hip->alloc_blocks = 0;
@@ -494,6 +495,10 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
                inode->i_ctime = hfsp_mt2ut(folder->attribute_mod_date);
                HFSPLUS_I(inode)->create_date = folder->create_date;
                HFSPLUS_I(inode)->fs_blocks = 0;
+                if (folder->flags & cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT)) {
+                        HFSPLUS_I(inode)->subfolders =
+                                be32_to_cpu(folder->subfolders);
+                }
                inode->i_op = &hfsplus_dir_inode_operations;
                inode->i_fop = &hfsplus_dir_operations;
        } else if (type == HFSPLUS_FILE) {
@@ -566,6 +571,10 @@ int hfsplus_cat_write_inode(struct inode *inode)
                folder->content_mod_date = hfsp_ut2mt(inode->i_mtime);
                folder->attribute_mod_date = hfsp_ut2mt(inode->i_ctime);
                folder->valence = cpu_to_be32(inode->i_size - 2);
+                if (folder->flags & cpu_to_be16(HFSPLUS_HAS_FOLDER_COUNT)) {
+                        folder->subfolders =
+                                cpu_to_be32(HFSPLUS_I(inode)->subfolders);
+                }
                hfs_bnode_write(fd.bnode, &entry, fd.entryoffset,
                                         sizeof(struct hfsplus_cat_folder));
        } else if (HFSPLUS_IS_RSRC(inode)) {
diff --git a/fs/hfsplus/options.c b/fs/hfsplus/options.c
index 968eab5bc1f5..68537e8b7a09 100644
--- a/fs/hfsplus/options.c
+++ b/fs/hfsplus/options.c
@@ -75,7 +75,7 @@ int hfsplus_parse_options_remount(char *input, int *force)
        int token;
        if (!input)
-                return 0;
+                return 1;
        while ((p = strsep(&input, ",")) != NULL) {
                if (!*p)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 8360674c85bc..60bb365f54a5 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -514,11 +514,13 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
         * similarly constrained call sites
         */
        ret = start_this_handle(journal, handle, GFP_NOFS);
-        if (ret < 0)
+        if (ret < 0) {
                jbd2_journal_free_reserved(handle);
+                return ret;
+        }
        handle->h_type = type;
        handle->h_line_no = line_no;
-        return ret;
+        return 0;
 }
 EXPORT_SYMBOL(jbd2_journal_start_reserved);
diff --git a/fs/jfs/acl.c b/fs/jfs/acl.c
index e973b85d6afd..5a8ea16eedbc 100644
--- a/fs/jfs/acl.c
+++ b/fs/jfs/acl.c
@@ -86,6 +86,8 @@ static int __jfs_set_acl(tid_t tid, struct inode *inode, int type,
                rc = posix_acl_equiv_mode(acl, &inode->i_mode);
                if (rc < 0)
                        return rc;
+                inode->i_ctime = CURRENT_TIME;
+                mark_inode_dirty(inode);
                if (rc == 0)
                        acl = NULL;
                break;
diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c
index 0d6ce895a9ee..0f4152defe7b 100644
--- a/fs/kernfs/mount.c
+++ b/fs/kernfs/mount.c
@@ -94,6 +94,7 @@ const void *kernfs_super_ns(struct super_block *sb)
 * @fs_type: file_system_type of the fs being mounted
 * @flags: mount flags specified for the mount
 * @root: kernfs_root of the hierarchy being mounted
+ * @new_sb_created: tell the caller if we allocated a new superblock
 * @ns: optional namespace tag of the mount
 *
 * This is to be called from each kernfs user's file_system_type->mount()
@@ -104,7 +105,8 @@ const void *kernfs_super_ns(struct super_block *sb)
 * The return value can be passed to the vfs layer verbatim.
 */
 struct dentry *kernfs_mount_ns(struct file_system_type *fs_type, int flags,
-                               struct kernfs_root *root, const void *ns)
+                               struct kernfs_root *root, bool *new_sb_created,
+                               const void *ns)
 {
        struct super_block *sb;
        struct kernfs_super_info *info;
@@ -122,6 +124,10 @@ struct dentry *kernfs_mount_ns(struct file_system_type *fs_type, int flags,
                kfree(info);
        if (IS_ERR(sb))
                return ERR_CAST(sb);
+        if (new_sb_created)
+                *new_sb_created = !sb->s_root;
        if (!sb->s_root) {
                error = kernfs_fill_super(sb);
                if (error) {
diff --git a/fs/mount.h b/fs/mount.h
index a17458ca6f29..b29e42f05f34 100644
--- a/fs/mount.h
+++ b/fs/mount.h
@@ -19,13 +19,13 @@ struct mnt_pcp {
 };
 struct mountpoint {
-        struct list_head m_hash;
+        struct hlist_node m_hash;
        struct dentry *m_dentry;
        int m_count;
 };
 struct mount {
-        struct list_head mnt_hash;
+        struct hlist_node mnt_hash;
        struct mount *mnt_parent;
        struct dentry *mnt_mountpoint;
        struct vfsmount mnt;
diff --git a/fs/namei.c b/fs/namei.c
index 385f7817bfcc..4b491b431990 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1109,7 +1109,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                        return false;
                if (!d_mountpoint(path->dentry))
-                        break;
+                        return true;
                mounted = __lookup_mnt(path->mnt, path->dentry);
                if (!mounted)
@@ -1125,20 +1125,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                 */
                *inode = path->dentry->d_inode;
        }
-        return true;
+        return read_seqretry(&mount_lock, nd->m_seq);
-}
-static void follow_mount_rcu(struct nameidata *nd)
-{
-        while (d_mountpoint(nd->path.dentry)) {
-                struct mount *mounted;
-                mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
-                if (!mounted)
-                        break;
-                nd->path.mnt = &mounted->mnt;
-                nd->path.dentry = mounted->mnt.mnt_root;
-                nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
-        }
 }
 static int follow_dotdot_rcu(struct nameidata *nd)
@@ -1166,7 +1153,17 @@ static int follow_dotdot_rcu(struct nameidata *nd)
                        break;
                nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
        }
-        follow_mount_rcu(nd);
+        while (d_mountpoint(nd->path.dentry)) {
+                struct mount *mounted;
+                mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
+                if (!mounted)
+                        break;
+                nd->path.mnt = &mounted->mnt;
+                nd->path.dentry = mounted->mnt.mnt_root;
+                nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
+                if (!read_seqretry(&mount_lock, nd->m_seq))
+                        goto failed;
+        }
        nd->inode = nd->path.dentry->d_inode;
        return 0;
@@ -1884,7 +1881,7 @@ static int path_init(int dfd, const char *name, unsigned int flags,
                nd->path = f.file->f_path;
                if (flags & LOOKUP_RCU) {
-                        if (f.need_put)
+                        if (f.flags & FDPUT_FPUT)
                                *fp = f.file;
                        nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
                        rcu_read_lock();
diff --git a/fs/namespace.c b/fs/namespace.c
index 22e536705c45..2ffc5a2905d4 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -23,11 +23,34 @@
 #include <linux/uaccess.h>
 #include <linux/proc_ns.h>
 #include <linux/magic.h>
+#include <linux/bootmem.h>
 #include "pnode.h"
 #include "internal.h"
-#define HASH_SHIFT ilog2(PAGE_SIZE / sizeof(struct list_head))
+static unsigned int m_hash_mask __read_mostly;
-#define HASH_SIZE (1UL << HASH_SHIFT)
+static unsigned int m_hash_shift __read_mostly;
+static unsigned int mp_hash_mask __read_mostly;
+static unsigned int mp_hash_shift __read_mostly;
+static __initdata unsigned long mhash_entries;
+static int __init set_mhash_entries(char *str)
+{
+        if (!str)
+                return 0;
+        mhash_entries = simple_strtoul(str, &str, 0);
+        return 1;
+}
+__setup("mhash_entries=", set_mhash_entries);
+static __initdata unsigned long mphash_entries;
+static int __init set_mphash_entries(char *str)
+{
+        if (!str)
+                return 0;
+        mphash_entries = simple_strtoul(str, &str, 0);
+        return 1;
+}
+__setup("mphash_entries=", set_mphash_entries);
 static int event;
 static DEFINE_IDA(mnt_id_ida);
@@ -36,8 +59,8 @@ static DEFINE_SPINLOCK(mnt_id_lock);
 static int mnt_id_start = 0;
 static int mnt_group_start = 1;
-static struct list_head *mount_hashtable __read_mostly;
+static struct hlist_head *mount_hashtable __read_mostly;
-static struct list_head *mountpoint_hashtable __read_mostly;
+static struct hlist_head *mountpoint_hashtable __read_mostly;
 static struct kmem_cache *mnt_cache __read_mostly;
 static DECLARE_RWSEM(namespace_sem);
@@ -55,12 +78,19 @@ EXPORT_SYMBOL_GPL(fs_kobj);
 */
 __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock);
-static inline unsigned long hash(struct vfsmount *mnt, struct dentry *dentry)
+static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry)
 {
        unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES);
        tmp += ((unsigned long)dentry / L1_CACHE_BYTES);
-        tmp = tmp + (tmp >> HASH_SHIFT);
+        tmp = tmp + (tmp >> m_hash_shift);
-        return tmp & (HASH_SIZE - 1);
+        return &mount_hashtable[tmp & m_hash_mask];
+}
+static inline struct hlist_head *mp_hash(struct dentry *dentry)
+{
+        unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES);
+        tmp = tmp + (tmp >> mp_hash_shift);
+        return &mountpoint_hashtable[tmp & mp_hash_mask];
 }
 /*
@@ -187,7 +217,7 @@ static struct mount *alloc_vfsmnt(const char *name)
                mnt->mnt_writers = 0;
 #endif
-                INIT_LIST_HEAD(&mnt->mnt_hash);
+                INIT_HLIST_NODE(&mnt->mnt_hash);
                INIT_LIST_HEAD(&mnt->mnt_child);
                INIT_LIST_HEAD(&mnt->mnt_mounts);
                INIT_LIST_HEAD(&mnt->mnt_list);
@@ -575,10 +605,10 @@ bool legitimize_mnt(struct vfsmount *bastard, unsigned seq)
 */
 struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
 {
-        struct list_head *head = mount_hashtable + hash(mnt, dentry);
+        struct hlist_head *head = m_hash(mnt, dentry);
        struct mount *p;
-        list_for_each_entry_rcu(p, head, mnt_hash)
+        hlist_for_each_entry_rcu(p, head, mnt_hash)
                if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry)
                        return p;
        return NULL;
@@ -590,13 +620,17 @@ struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
 */
 struct mount *__lookup_mnt_last(struct vfsmount *mnt, struct dentry *dentry)
 {
-        struct list_head *head = mount_hashtable + hash(mnt, dentry);
+        struct mount *p, *res;
-        struct mount *p;
+        res = p = __lookup_mnt(mnt, dentry);
+        if (!p)
-        list_for_each_entry_reverse(p, head, mnt_hash)
+                goto out;
-                if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry)
+        hlist_for_each_entry_continue(p, mnt_hash) {
-                        return p;
+                if (&p->mnt_parent->mnt != mnt || p->mnt_mountpoint != dentry)
-        return NULL;
+                        break;
+                res = p;
+        }
+out:
+        return res;
 }
 /*
@@ -633,11 +667,11 @@ struct vfsmount *lookup_mnt(struct path *path)
 static struct mountpoint *new_mountpoint(struct dentry *dentry)
 {
-        struct list_head *chain = mountpoint_hashtable + hash(NULL, dentry);
+        struct hlist_head *chain = mp_hash(dentry);
        struct mountpoint *mp;
        int ret;
-        list_for_each_entry(mp, chain, m_hash) {
+        hlist_for_each_entry(mp, chain, m_hash) {
                if (mp->m_dentry == dentry) {
                        /* might be worth a WARN_ON() */
                        if (d_unlinked(dentry))
@@ -659,7 +693,7 @@ static struct mountpoint *new_mountpoint(struct dentry *dentry)
        mp->m_dentry = dentry;
        mp->m_count = 1;
-        list_add(&mp->m_hash, chain);
+        hlist_add_head(&mp->m_hash, chain);
        return mp;
 }
@@ -670,7 +704,7 @@ static void put_mountpoint(struct mountpoint *mp)
                spin_lock(&dentry->d_lock);
                dentry->d_flags &= ~DCACHE_MOUNTED;
                spin_unlock(&dentry->d_lock);
-                list_del(&mp->m_hash);
+                hlist_del(&mp->m_hash);
                kfree(mp);
        }
 }
@@ -712,7 +746,7 @@ static void detach_mnt(struct mount *mnt, struct path *old_path)
        mnt->mnt_parent = mnt;
        mnt->mnt_mountpoint = mnt->mnt.mnt_root;
        list_del_init(&mnt->mnt_child);
-        list_del_init(&mnt->mnt_hash);
+        hlist_del_init_rcu(&mnt->mnt_hash);
        put_mountpoint(mnt->mnt_mp);
        mnt->mnt_mp = NULL;
 }
@@ -739,15 +773,14 @@ static void attach_mnt(struct mount *mnt,
                        struct mountpoint *mp)
 {
        mnt_set_mountpoint(parent, mp, mnt);
-        list_add_tail(&mnt->mnt_hash, mount_hashtable +
+        hlist_add_head_rcu(&mnt->mnt_hash, m_hash(&parent->mnt, mp->m_dentry));
-                        hash(&parent->mnt, mp->m_dentry));
        list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
 }
 /*
 * vfsmount lock must be held for write
 */
-static void commit_tree(struct mount *mnt)
+static void commit_tree(struct mount *mnt, struct mount *shadows)
 {
        struct mount *parent = mnt->mnt_parent;
        struct mount *m;
@@ -762,8 +795,11 @@ static void commit_tree(struct mount *mnt)
        list_splice(&head, n->list.prev);
-        list_add_tail(&mnt->mnt_hash, mount_hashtable +
+        if (shadows)
-                                hash(&parent->mnt, mnt->mnt_mountpoint));
+                hlist_add_after_rcu(&shadows->mnt_hash, &mnt->mnt_hash);
+        else
+                hlist_add_head_rcu(&mnt->mnt_hash,
+                                m_hash(&parent->mnt, mnt->mnt_mountpoint));
        list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
        touch_mnt_namespace(n);
 }
@@ -1153,26 +1189,28 @@ int may_umount(struct vfsmount *mnt)
 EXPORT_SYMBOL(may_umount);
-static LIST_HEAD(unmounted);    /* protected by namespace_sem */
+static HLIST_HEAD(unmounted);   /* protected by namespace_sem */
 static void namespace_unlock(void)
 {
        struct mount *mnt;
-        LIST_HEAD(head);
+        struct hlist_head head = unmounted;
-        if (likely(list_empty(&unmounted))) {
+        if (likely(hlist_empty(&head))) {
                up_write(&namespace_sem);
                return;
        }
-        list_splice_init(&unmounted, &head);
+        head.first->pprev = &head.first;
+        INIT_HLIST_HEAD(&unmounted);
        up_write(&namespace_sem);
        synchronize_rcu();
-        while (!list_empty(&head)) {
+        while (!hlist_empty(&head)) {
-                mnt = list_first_entry(&head, struct mount, mnt_hash);
+                mnt = hlist_entry(head.first, struct mount, mnt_hash);
-                list_del_init(&mnt->mnt_hash);
+                hlist_del_init(&mnt->mnt_hash);
                if (mnt->mnt_ex_mountpoint.mnt)
                        path_put(&mnt->mnt_ex_mountpoint);
                mntput(&mnt->mnt);
@@ -1193,16 +1231,19 @@ static inline void namespace_lock(void)
 */
 void umount_tree(struct mount *mnt, int how)
 {
-        LIST_HEAD(tmp_list);
+        HLIST_HEAD(tmp_list);
        struct mount *p;
+        struct mount *last = NULL;
-        for (p = mnt; p; p = next_mnt(p, mnt))
+        for (p = mnt; p; p = next_mnt(p, mnt)) {
-                list_move(&p->mnt_hash, &tmp_list);
+                hlist_del_init_rcu(&p->mnt_hash);
+                hlist_add_head(&p->mnt_hash, &tmp_list);
+        }
        if (how)
                propagate_umount(&tmp_list);
-        list_for_each_entry(p, &tmp_list, mnt_hash) {
+        hlist_for_each_entry(p, &tmp_list, mnt_hash) {
                list_del_init(&p->mnt_expire);
                list_del_init(&p->mnt_list);
                __touch_mnt_namespace(p->mnt_ns);
@@ -1220,8 +1261,13 @@ void umount_tree(struct mount *mnt, int how)
                        p->mnt_mp = NULL;
                }
                change_mnt_propagation(p, MS_PRIVATE);
+                last = p;
+        }
+        if (last) {
+                last->mnt_hash.next = unmounted.first;
+                unmounted.first = tmp_list.first;
+                unmounted.first->pprev = &unmounted.first;
        }
-        list_splice(&tmp_list, &unmounted);
 }
 static void shrink_submounts(struct mount *mnt);
@@ -1605,24 +1651,23 @@ static int attach_recursive_mnt(struct mount *source_mnt,
                        struct mountpoint *dest_mp,
                        struct path *parent_path)
 {
-        LIST_HEAD(tree_list);
+        HLIST_HEAD(tree_list);
        struct mount *child, *p;
+        struct hlist_node *n;
        int err;
        if (IS_MNT_SHARED(dest_mnt)) {
                err = invent_group_ids(source_mnt, true);
                if (err)
                        goto out;
-        }
+                err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
-        err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
+                if (err)
-        if (err)
+                        goto out_cleanup_ids;
-                goto out_cleanup_ids;
+                lock_mount_hash();
-        lock_mount_hash();
-        if (IS_MNT_SHARED(dest_mnt)) {
                for (p = source_mnt; p; p = next_mnt(p, source_mnt))
                        set_mnt_shared(p);
+        } else {
+                lock_mount_hash();
        }
        if (parent_path) {
                detach_mnt(source_mnt, parent_path);
@@ -1630,20 +1675,22 @@ static int attach_recursive_mnt(struct mount *source_mnt,
                touch_mnt_namespace(source_mnt->mnt_ns);
        } else {
                mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt);
-                commit_tree(source_mnt);
+                commit_tree(source_mnt, NULL);
        }
-        list_for_each_entry_safe(child, p, &tree_list, mnt_hash) {
+        hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
-                list_del_init(&child->mnt_hash);
+                struct mount *q;
-                commit_tree(child);
+                hlist_del_init(&child->mnt_hash);
+                q = __lookup_mnt_last(&child->mnt_parent->mnt,
+                                      child->mnt_mountpoint);
+                commit_tree(child, q);
        }
        unlock_mount_hash();
        return 0;
 out_cleanup_ids:
-        if (IS_MNT_SHARED(dest_mnt))
+        cleanup_group_ids(source_mnt, NULL);
-                cleanup_group_ids(source_mnt, NULL);
 out:
        return err;
 }
@@ -2777,18 +2824,24 @@ void __init mnt_init(void)
        mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount),
                        0, SLAB_HWCACHE_ALIGN | SLAB_PANIC, NULL);
-        mount_hashtable = (struct list_head *)__get_free_page(GFP_ATOMIC);
+        mount_hashtable = alloc_large_system_hash("Mount-cache",
-        mountpoint_hashtable = (struct list_head *)__get_free_page(GFP_ATOMIC);
+                                sizeof(struct hlist_head),
+                                mhash_entries, 19,
+                                0,
+                                &m_hash_shift, &m_hash_mask, 0, 0);
+        mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache",
+                                sizeof(struct hlist_head),
+                                mphash_entries, 19,
+                                0,
+                                &mp_hash_shift, &mp_hash_mask, 0, 0);
        if (!mount_hashtable || !mountpoint_hashtable)
                panic("Failed to allocate mount hash table\n");
-        printk(KERN_INFO "Mount-cache hash table entries: %lu\n", HASH_SIZE);
+        for (u = 0; u <= m_hash_mask; u++)
+                INIT_HLIST_HEAD(&mount_hashtable[u]);
-        for (u = 0; u < HASH_SIZE; u++)
+        for (u = 0; u <= mp_hash_mask; u++)
-                INIT_LIST_HEAD(&mount_hashtable[u]);
+                INIT_HLIST_HEAD(&mountpoint_hashtable[u]);
-        for (u = 0; u < HASH_SIZE; u++)
-                INIT_LIST_HEAD(&mountpoint_hashtable[u]);
        kernfs_init();
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index ef792f29f831..5d8ccecf5f5c 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -659,16 +659,19 @@ int nfs_async_inode_return_delegation(struct inode *inode,
        rcu_read_lock();
        delegation = rcu_dereference(NFS_I(inode)->delegation);
+        if (delegation == NULL)
+                goto out_enoent;
-        if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid)) {
+        if (!clp->cl_mvops->match_stateid(&delegation->stateid, stateid))
-                rcu_read_unlock();
+                goto out_enoent;
-                return -ENOENT;
-        }
        nfs_mark_return_delegation(server, delegation);
        rcu_read_unlock();
        nfs_delegation_run_state_manager(clp);
        return 0;
+out_enoent:
+        rcu_read_unlock();
+        return -ENOENT;
 }
 static struct inode *
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 28a0a3cbd3b7..360114ae8b82 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -164,17 +164,16 @@ static void nfs_zap_caches_locked(struct inode *inode)
        if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) {
                nfs_fscache_invalidate(inode);
                nfsi->cache_validity |= NFS_INO_INVALID_ATTR
-                                        | NFS_INO_INVALID_LABEL
                                        | NFS_INO_INVALID_DATA
                                        | NFS_INO_INVALID_ACCESS
                                        | NFS_INO_INVALID_ACL
                                        | NFS_INO_REVAL_PAGECACHE;
        } else
                nfsi->cache_validity |= NFS_INO_INVALID_ATTR
-                                        | NFS_INO_INVALID_LABEL
                                        | NFS_INO_INVALID_ACCESS
                                        | NFS_INO_INVALID_ACL
                                        | NFS_INO_REVAL_PAGECACHE;
+        nfs_zap_label_cache_locked(nfsi);
 }
 void nfs_zap_caches(struct inode *inode)
@@ -266,6 +265,13 @@ nfs_init_locked(struct inode *inode, void *opaque)
 }
 #ifdef CONFIG_NFS_V4_SECURITY_LABEL
+static void nfs_clear_label_invalid(struct inode *inode)
+{
+        spin_lock(&inode->i_lock);
+        NFS_I(inode)->cache_validity &= ~NFS_INO_INVALID_LABEL;
+        spin_unlock(&inode->i_lock);
+}
 void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
                                        struct nfs4_label *label)
 {
@@ -283,6 +289,7 @@ void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
                                        __func__,
                                        (char *)label->label,
                                        label->len, error);
+                nfs_clear_label_invalid(inode);
        }
 }
@@ -1648,7 +1655,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                inode->i_blocks = fattr->du.nfs2.blocks;
        /* Update attrtimeo value if we're out of the unstable period */
-        if (invalid & (NFS_INO_INVALID_ATTR|NFS_INO_INVALID_LABEL)) {
+        if (invalid & NFS_INO_INVALID_ATTR) {
                nfs_inc_stats(inode, NFSIOS_ATTRINVALIDATE);
                nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
                nfsi->attrtimeo_timestamp = now;
@@ -1661,7 +1668,6 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                }
        }
        invalid &= ~NFS_INO_INVALID_ATTR;
-        invalid &= ~NFS_INO_INVALID_LABEL;
        /* Don't invalidate the data if we were to blame */
        if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)
                                || S_ISLNK(inode->i_mode)))
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 8b5cc04a8611..b46cf5a67329 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -176,7 +176,8 @@ extern struct nfs_server *nfs4_create_server(
 extern struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *,
                                                      struct nfs_fh *);
 extern int nfs4_update_server(struct nfs_server *server, const char *hostname,
-                                        struct sockaddr *sap, size_t salen);
+                                        struct sockaddr *sap, size_t salen,
+                                        struct net *net);
 extern void nfs_free_server(struct nfs_server *server);
 extern struct nfs_server *nfs_clone_server(struct nfs_server *,
                                           struct nfs_fh *,
@@ -279,9 +280,18 @@ static inline void nfs4_label_free(struct nfs4_label *label)
        }
        return;
 }
+static inline void nfs_zap_label_cache_locked(struct nfs_inode *nfsi)
+{
+        if (nfs_server_capable(&nfsi->vfs_inode, NFS_CAP_SECURITY_LABEL))
+                nfsi->cache_validity |= NFS_INO_INVALID_LABEL;
+}
 #else
 static inline struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags) { return NULL; }
 static inline void nfs4_label_free(void *label) {}
+static inline void nfs_zap_label_cache_locked(struct nfs_inode *nfsi)
+{
+}
 #endif /* CONFIG_NFS_V4_SECURITY_LABEL */
 /* proc.c */
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index aa9bc973f36a..a462ef0fb5d6 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -18,6 +18,7 @@
 #include <linux/lockd/bind.h>
 #include <linux/nfs_mount.h>
 #include <linux/freezer.h>
+#include <linux/xattr.h>
 #include "iostat.h"
 #include "internal.h"
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 860ad26a5590..0e46d3d1b6cc 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -1135,6 +1135,7 @@ static int nfs_probe_destination(struct nfs_server *server)
 * @hostname: new end-point's hostname
 * @sap: new end-point's socket address
 * @salen: size of "sap"
+ * @net: net namespace
 *
 * The nfs_server must be quiescent before this function is invoked.
 * Either its session is drained (NFSv4.1+), or its transport is
@@ -1143,13 +1144,13 @@ static int nfs_probe_destination(struct nfs_server *server)
 * Returns zero on success, or a negative errno value.
 */
 int nfs4_update_server(struct nfs_server *server, const char *hostname,
-                       struct sockaddr *sap, size_t salen)
+                       struct sockaddr *sap, size_t salen, struct net *net)
 {
        struct nfs_client *clp = server->nfs_client;
        struct rpc_clnt *clnt = server->client;
        struct xprt_create xargs = {
                .ident          = clp->cl_proto,
-                .net            = &init_net,
+                .net            = net,
                .dstaddr        = sap,
                .addrlen        = salen,
                .servername     = hostname,
@@ -1189,7 +1190,7 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname,
        error = nfs4_set_client(server, hostname, sap, salen, buf,
                                clp->cl_rpcclient->cl_auth->au_flavor,
                                clp->cl_proto, clnt->cl_timeout,
-                                clp->cl_minorversion, clp->cl_net);
+                                clp->cl_minorversion, net);
        nfs_put_client(clp);
        if (error != 0) {
                nfs_server_insert_lists(server);
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 12c8132ad408..b9a35c05b60f 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -324,8 +324,9 @@ static void filelayout_read_prepare(struct rpc_task *task, void *data)
                        &rdata->res.seq_res,
                        task))
                return;
-        nfs4_set_rw_stateid(&rdata->args.stateid, rdata->args.context,
+        if (nfs4_set_rw_stateid(&rdata->args.stateid, rdata->args.context,
-                        rdata->args.lock_context, FMODE_READ);
+                        rdata->args.lock_context, FMODE_READ) == -EIO)
+                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
 }
 static void filelayout_read_call_done(struct rpc_task *task, void *data)
@@ -435,8 +436,9 @@ static void filelayout_write_prepare(struct rpc_task *task, void *data)
                        &wdata->res.seq_res,
                        task))
                return;
-        nfs4_set_rw_stateid(&wdata->args.stateid, wdata->args.context,
+        if (nfs4_set_rw_stateid(&wdata->args.stateid, wdata->args.context,
-                        wdata->args.lock_context, FMODE_WRITE);
+                        wdata->args.lock_context, FMODE_WRITE) == -EIO)
+                rpc_exit(task, -EIO); /* lost lock, terminate I/O */
 }
 static void filelayout_write_call_done(struct rpc_task *task, void *data)
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 4e7f05d3e9db..3d5dbf80d46a 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -121,9 +121,8 @@ static int nfs4_validate_fspath(struct dentry *dentry,
 }
 static size_t nfs_parse_server_name(char *string, size_t len,
-                struct sockaddr *sa, size_t salen, struct nfs_server *server)
+                struct sockaddr *sa, size_t salen, struct net *net)
 {
-        struct net *net = rpc_net_ns(server->client);
        ssize_t ret;
        ret = rpc_pton(net, string, len, sa, salen);
@@ -223,6 +222,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                                     const struct nfs4_fs_location *location)
 {
        const size_t addr_bufsize = sizeof(struct sockaddr_storage);
+        struct net *net = rpc_net_ns(NFS_SB(mountdata->sb)->client);
        struct vfsmount *mnt = ERR_PTR(-ENOENT);
        char *mnt_path;
        unsigned int maxbuflen;
@@ -248,8 +248,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                        continue;
                mountdata->addrlen = nfs_parse_server_name(buf->data, buf->len,
-                                mountdata->addr, addr_bufsize,
+                                mountdata->addr, addr_bufsize, net);
-                                NFS_SB(mountdata->sb));
                if (mountdata->addrlen == 0)
                        continue;
@@ -419,6 +418,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
                const struct nfs4_fs_location *location)
 {
        const size_t addr_bufsize = sizeof(struct sockaddr_storage);
+        struct net *net = rpc_net_ns(server->client);
        struct sockaddr *sap;
        unsigned int s;
        size_t salen;
@@ -440,7 +440,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
                        continue;
                salen = nfs_parse_server_name(buf->data, buf->len,
-                                                sap, addr_bufsize, server);
+                                                sap, addr_bufsize, net);
                if (salen == 0)
                        continue;
                rpc_set_port(sap, NFS_PORT);
@@ -450,7 +450,7 @@ static int nfs4_try_replacing_one_location(struct nfs_server *server,
                if (hostname == NULL)
                        break;
-                error = nfs4_update_server(server, hostname, sap, salen);
+                error = nfs4_update_server(server, hostname, sap, salen, net);
                kfree(hostname);
                if (error == 0)
                        break;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 2da6a698b8f7..450bfedbe2f4 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2398,13 +2398,16 @@ static int _nfs4_do_setattr(struct inode *inode, struct rpc_cred *cred,
        if (nfs4_copy_delegation_stateid(&arg.stateid, inode, fmode)) {
                /* Use that stateid */
-        } else if (truncate && state != NULL && nfs4_valid_open_stateid(state)) {
+        } else if (truncate && state != NULL) {
                struct nfs_lockowner lockowner = {
                        .l_owner = current->files,
                        .l_pid = current->tgid,
                };
-                nfs4_select_rw_stateid(&arg.stateid, state, FMODE_WRITE,
+                if (!nfs4_valid_open_stateid(state))
-                                &lockowner);
+                        return -EBADF;
+                if (nfs4_select_rw_stateid(&arg.stateid, state, FMODE_WRITE,
+                                &lockowner) == -EIO)
+                        return -EBADF;
        } else
                nfs4_stateid_copy(&arg.stateid, &zero_stateid);
@@ -4011,8 +4014,9 @@ static bool nfs4_stateid_is_current(nfs4_stateid *stateid,
 {
        nfs4_stateid current_stateid;
-        if (nfs4_set_rw_stateid(&current_stateid, ctx, l_ctx, fmode))
+        /* If the current stateid represents a lost lock, then exit */
-                return false;
+        if (nfs4_set_rw_stateid(&current_stateid, ctx, l_ctx, fmode) == -EIO)
+                return true;
        return nfs4_stateid_match(stateid, &current_stateid);
 }
@@ -5828,8 +5832,7 @@ struct nfs_release_lockowner_data {
        struct nfs4_lock_state *lsp;
        struct nfs_server *server;
        struct nfs_release_lockowner_args args;
-        struct nfs4_sequence_args seq_args;
+        struct nfs_release_lockowner_res res;
-        struct nfs4_sequence_res seq_res;
        unsigned long timestamp;
 };
@@ -5837,7 +5840,7 @@ static void nfs4_release_lockowner_prepare(struct rpc_task *task, void *calldata
 {
        struct nfs_release_lockowner_data *data = calldata;
        nfs40_setup_sequence(data->server,
-                                &data->seq_args, &data->seq_res, task);
+                                &data->args.seq_args, &data->res.seq_res, task);
        data->timestamp = jiffies;
 }
@@ -5846,7 +5849,7 @@ static void nfs4_release_lockowner_done(struct rpc_task *task, void *calldata)
        struct nfs_release_lockowner_data *data = calldata;
        struct nfs_server *server = data->server;
-        nfs40_sequence_done(task, &data->seq_res);
+        nfs40_sequence_done(task, &data->res.seq_res);
        switch (task->tk_status) {
        case 0:
@@ -5887,7 +5890,6 @@ static int nfs4_release_lockowner(struct nfs_server *server, struct nfs4_lock_st
        data = kmalloc(sizeof(*data), GFP_NOFS);
        if (!data)
                return -ENOMEM;
-        nfs4_init_sequence(&data->seq_args, &data->seq_res, 0);
        data->lsp = lsp;
        data->server = server;
        data->args.lock_owner.clientid = server->nfs_client->cl_clientid;
@@ -5895,6 +5897,8 @@ static int nfs4_release_lockowner(struct nfs_server *server, struct nfs4_lock_st
        data->args.lock_owner.s_dev = server->s_dev;
        msg.rpc_argp = &data->args;
+        msg.rpc_resp = &data->res;
+        nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 0);
        rpc_call_async(server->client, &msg, 0, &nfs4_release_lockowner_ops, data);
        return 0;
 }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index e5be72518bd7..0deb32105ccf 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -974,9 +974,6 @@ static int nfs4_copy_lock_stateid(nfs4_stateid *dst,
        else if (lsp != NULL && test_bit(NFS_LOCK_INITIALIZED, &lsp->ls_flags) != 0) {
                nfs4_stateid_copy(dst, &lsp->ls_stateid);
                ret = 0;
-                smp_rmb();
-                if (!list_empty(&lsp->ls_seqid.list))
-                        ret = -EWOULDBLOCK;
        }
        spin_unlock(&state->state_lock);
        nfs4_put_lock_state(lsp);
@@ -984,10 +981,9 @@ out:
        return ret;
 }
-static int nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
+static void nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
 {
        const nfs4_stateid *src;
-        int ret;
        int seq;
        do {
@@ -996,12 +992,7 @@ static int nfs4_copy_open_stateid(nfs4_stateid *dst, struct nfs4_state *state)
                if (test_bit(NFS_OPEN_STATE, &state->flags))
                        src = &state->open_stateid;
                nfs4_stateid_copy(dst, src);
-                ret = 0;
-                smp_rmb();
-                if (!list_empty(&state->owner->so_seqid.list))
-                        ret = -EWOULDBLOCK;
        } while (read_seqretry(&state->seqlock, seq));
-        return ret;
 }
 /*
@@ -1015,15 +1006,19 @@ int nfs4_select_rw_stateid(nfs4_stateid *dst, struct nfs4_state *state,
        if (ret == -EIO)
                /* A lost lock - don't even consider delegations */
                goto out;
-        if (nfs4_copy_delegation_stateid(dst, state->inode, fmode))
+        /* returns true if delegation stateid found and copied */
+        if (nfs4_copy_delegation_stateid(dst, state->inode, fmode)) {
+                ret = 0;
                goto out;
+        }
        if (ret != -ENOENT)
                /* nfs4_copy_delegation_stateid() didn't over-write
                 * dst, so it still has the lock stateid which we now
                 * choose to use.
                 */
                goto out;
-        ret = nfs4_copy_open_stateid(dst, state);
+        nfs4_copy_open_stateid(dst, state);
+        ret = 0;
 out:
        if (nfs_server_capable(state->inode, NFS_CAP_STATEID_NFSV41))
                dst->seqid = 0;
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 017d3cb5e99b..6d7be3f80356 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -449,6 +449,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
        fh_lock(fhp);
        host_err = notify_change(dentry, iap, NULL);
        fh_unlock(fhp);
+        err = nfserrno(host_err);
 out_put_write_access:
        if (size_change)
diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
index 0b9ff4395e6a..abc8cbcfe90e 100644
--- a/fs/notify/dnotify/dnotify.c
+++ b/fs/notify/dnotify/dnotify.c
@@ -86,7 +86,7 @@ static int dnotify_handle_event(struct fsnotify_group *group,
                                struct fsnotify_mark *inode_mark,
                                struct fsnotify_mark *vfsmount_mark,
                                u32 mask, void *data, int data_type,
-                                const unsigned char *file_name)
+                                const unsigned char *file_name, u32 cookie)
 {
        struct dnotify_mark *dn_mark;
        struct dnotify_struct *dn;
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 0e792f5e3147..dc638f786d5c 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -147,7 +147,7 @@ static int fanotify_handle_event(struct fsnotify_group *group,
                                 struct fsnotify_mark *inode_mark,
                                 struct fsnotify_mark *fanotify_mark,
                                 u32 mask, void *data, int data_type,
-                                 const unsigned char *file_name)
+                                 const unsigned char *file_name, u32 cookie)
 {
        int ret = 0;
        struct fanotify_event_info *event;
@@ -192,10 +192,12 @@ static int fanotify_handle_event(struct fsnotify_group *group,
        ret = fsnotify_add_notify_event(group, fsn_event, fanotify_merge);
        if (ret) {
-                BUG_ON(mask & FAN_ALL_PERM_EVENTS);
+                /* Permission events shouldn't be merged */
+                BUG_ON(ret == 1 && mask & FAN_ALL_PERM_EVENTS);
                /* Our event wasn't used in the end. Free it. */
                fsnotify_destroy_event(group, fsn_event);
-                ret = 0;
+                return 0;
        }
 #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index b6175fa11bf8..287a22c04149 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -698,6 +698,7 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
        struct fsnotify_group *group;
        int f_flags, fd;
        struct user_struct *user;
+        struct fanotify_event_info *oevent;
        pr_debug("%s: flags=%d event_f_flags=%d\n",
                __func__, flags, event_f_flags);
@@ -730,8 +731,20 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
        group->fanotify_data.user = user;
        atomic_inc(&user->fanotify_listeners);
+        oevent = kmem_cache_alloc(fanotify_event_cachep, GFP_KERNEL);
+        if (unlikely(!oevent)) {
+                fd = -ENOMEM;
+                goto out_destroy_group;
+        }
+        group->overflow_event = &oevent->fse;
+        fsnotify_init_event(group->overflow_event, NULL, FS_Q_OVERFLOW);
+        oevent->tgid = get_pid(task_tgid(current));
+        oevent->path.mnt = NULL;
+        oevent->path.dentry = NULL;
        group->fanotify_data.f_flags = event_f_flags;
 #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
+        oevent->response = 0;
        mutex_init(&group->fanotify_data.access_mutex);
        init_waitqueue_head(&group->fanotify_data.access_waitq);
        INIT_LIST_HEAD(&group->fanotify_data.access_list);
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index 1d4e1ea2f37c..9d3e9c50066a 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -179,7 +179,7 @@ static int send_to_group(struct inode *to_tell,
        return group->ops->handle_event(group, to_tell, inode_mark,
                                        vfsmount_mark, mask, data, data_is,
-                                        file_name);
+                                        file_name, cookie);
 }
 /*
diff --git a/fs/notify/group.c b/fs/notify/group.c
index ee674fe2cec7..ad1995980456 100644
--- a/fs/notify/group.c
+++ b/fs/notify/group.c
@@ -55,6 +55,13 @@ void fsnotify_destroy_group(struct fsnotify_group *group)
        /* clear the notification queue of all events */
        fsnotify_flush_notify(group);
+        /*
+         * Destroy overflow event (we cannot use fsnotify_destroy_event() as
+         * that deliberately ignores overflow events.
+         */
+        if (group->overflow_event)
+                group->ops->free_event(group->overflow_event);
        fsnotify_put_group(group);
 }
@@ -99,7 +106,6 @@ struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *ops)
        INIT_LIST_HEAD(&group->marks_list);
        group->ops = ops;
-        fsnotify_init_event(&group->overflow_event, NULL, FS_Q_OVERFLOW);
        return group;
 }
diff --git a/fs/notify/inotify/inotify.h b/fs/notify/inotify/inotify.h
index 485eef3f4407..ed855ef6f077 100644
--- a/fs/notify/inotify/inotify.h
+++ b/fs/notify/inotify/inotify.h
@@ -27,6 +27,6 @@ extern int inotify_handle_event(struct fsnotify_group *group,
                                struct fsnotify_mark *inode_mark,
                                struct fsnotify_mark *vfsmount_mark,
                                u32 mask, void *data, int data_type,
-                                const unsigned char *file_name);
+                                const unsigned char *file_name, u32 cookie);
 extern const struct fsnotify_ops inotify_fsnotify_ops;
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index d5ee56348bb8..43ab1e1a07a2 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -67,7 +67,7 @@ int inotify_handle_event(struct fsnotify_group *group,
                         struct fsnotify_mark *inode_mark,
                         struct fsnotify_mark *vfsmount_mark,
                         u32 mask, void *data, int data_type,
-                         const unsigned char *file_name)
+                         const unsigned char *file_name, u32 cookie)
 {
        struct inotify_inode_mark *i_mark;
        struct inotify_event_info *event;
@@ -103,6 +103,7 @@ int inotify_handle_event(struct fsnotify_group *group,
        fsn_event = &event->fse;
        fsnotify_init_event(fsn_event, inode, mask);
        event->wd = i_mark->wd;
+        event->sync_cookie = cookie;
        event->name_len = len;
        if (len)
                strcpy(event->name, file_name);
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 497395c8274b..78a2ca3966c3 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -495,7 +495,7 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark *fsn_mark,
        /* Queue ignore event for the watch */
        inotify_handle_event(group, NULL, fsn_mark, NULL, FS_IN_IGNORED,
-                             NULL, FSNOTIFY_EVENT_NONE, NULL);
+                             NULL, FSNOTIFY_EVENT_NONE, NULL, 0);
        i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
        /* remove this mark from the idr */
@@ -633,11 +633,23 @@ static int inotify_update_watch(struct fsnotify_group *group, struct inode *inod
 static struct fsnotify_group *inotify_new_group(unsigned int max_events)
 {
        struct fsnotify_group *group;
+        struct inotify_event_info *oevent;
        group = fsnotify_alloc_group(&inotify_fsnotify_ops);
        if (IS_ERR(group))
                return group;
+        oevent = kmalloc(sizeof(struct inotify_event_info), GFP_KERNEL);
+        if (unlikely(!oevent)) {
+                fsnotify_destroy_group(group);
+                return ERR_PTR(-ENOMEM);
+        }
+        group->overflow_event = &oevent->fse;
+        fsnotify_init_event(group->overflow_event, NULL, FS_Q_OVERFLOW);
+        oevent->wd = -1;
+        oevent->sync_cookie = 0;
+        oevent->name_len = 0;
        group->max_events = max_events;
        spin_lock_init(&group->inotify_data.idr_lock);
diff --git a/fs/notify/notification.c b/fs/notify/notification.c
index 18b3c4427dca..1e58402171a5 100644
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -80,7 +80,8 @@ void fsnotify_destroy_event(struct fsnotify_group *group,
 /*
 * Add an event to the group notification queue.  The group can later pull this
 * event off the queue to deal with.  The function returns 0 if the event was
- * added to the queue, 1 if the event was merged with some other queued event.
+ * added to the queue, 1 if the event was merged with some other queued event,
+ * 2 if the queue of events has overflown.
 */
 int fsnotify_add_notify_event(struct fsnotify_group *group,
                              struct fsnotify_event *event,
@@ -95,10 +96,14 @@ int fsnotify_add_notify_event(struct fsnotify_group *group,
        mutex_lock(&group->notification_mutex);
        if (group->q_len >= group->max_events) {
+                ret = 2;
                /* Queue overflow event only if it isn't already queued */
-                if (list_empty(&group->overflow_event.list))
+                if (!list_empty(&group->overflow_event->list)) {
-                        event = &group->overflow_event;
+                        mutex_unlock(&group->notification_mutex);
-                ret = 1;
+                        return ret;
+                }
+                event = group->overflow_event;
+                goto queue;
        }
        if (!list_empty(list) && merge) {
@@ -109,6 +114,7 @@ int fsnotify_add_notify_event(struct fsnotify_group *group,
                }
        }
+queue:
        group->q_len++;
        list_add_tail(&event->list, list);
        mutex_unlock(&group->notification_mutex);
@@ -132,7 +138,11 @@ struct fsnotify_event *fsnotify_remove_notify_event(struct fsnotify_group *group
        event = list_first_entry(&group->notification_list,
                                 struct fsnotify_event, list);
-        list_del(&event->list);
+        /*
+         * We need to init list head for the case of overflow event so that
+         * check in fsnotify_add_notify_events() works
+         */
+        list_del_init(&event->list);
        group->q_len--;
        return event;
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 8450262bcf2a..51632c40e896 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -2393,8 +2393,8 @@ out_dio:
        if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
            ((file->f_flags & O_DIRECT) && !direct_io)) {
-                ret = filemap_fdatawrite_range(file->f_mapping, pos,
+                ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
-                                               pos + count - 1);
+                                               *ppos + count - 1);
                if (ret < 0)
                        written = ret;
@@ -2407,8 +2407,8 @@ out_dio:
                }
                if (!ret)
-                        ret = filemap_fdatawait_range(file->f_mapping, pos,
+                        ret = filemap_fdatawait_range(file->f_mapping, *ppos,
-                                                      pos + count - 1);
+                                                      *ppos + count - 1);
        }
        /*
diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index aaa50611ec66..d7b5108789e2 100644
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -717,6 +717,12 @@ static int ocfs2_release_dquot(struct dquot *dquot)
         */
        if (status < 0)
                mlog_errno(status);
+        /*
+         * Clear dq_off so that we search for the structure in quota file next
+         * time we acquire it. The structure might be deleted and reallocated
+         * elsewhere by another node while our dquot structure is on freelist.
+         */
+        dquot->dq_off = 0;
        clear_bit(DQ_ACTIVE_B, &dquot->dq_flags);
 out_trans:
        ocfs2_commit_trans(osb, handle);
@@ -756,16 +762,17 @@ static int ocfs2_acquire_dquot(struct dquot *dquot)
        status = ocfs2_lock_global_qf(info, 1);
        if (status < 0)
                goto out;
-        if (!test_bit(DQ_READ_B, &dquot->dq_flags)) {
+        status = ocfs2_qinfo_lock(info, 0);
-                status = ocfs2_qinfo_lock(info, 0);
+        if (status < 0)
-                if (status < 0)
+                goto out_dq;
-                        goto out_dq;
+        /*
-                status = qtree_read_dquot(&info->dqi_gi, dquot);
+         * We always want to read dquot structure from disk because we don't
-                ocfs2_qinfo_unlock(info, 0);
+         * know what happened with it while it was on freelist.
-                if (status < 0)
+         */
-                        goto out_dq;
+        status = qtree_read_dquot(&info->dqi_gi, dquot);
-        }
+        ocfs2_qinfo_unlock(info, 0);
-        set_bit(DQ_READ_B, &dquot->dq_flags);
+        if (status < 0)
+                goto out_dq;
        OCFS2_DQUOT(dquot)->dq_use_count++;
        OCFS2_DQUOT(dquot)->dq_origspace = dquot->dq_dqb.dqb_curspace;
diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index 2e4344be3b96..2001862bf2b1 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -1303,10 +1303,6 @@ int ocfs2_local_release_dquot(handle_t *handle, struct dquot *dquot)
        ocfs2_journal_dirty(handle, od->dq_chunk->qc_headerbh);
 out:
-        /* Clear the read bit so that next time someone uses this
-         * dquot he reads fresh info from disk and allocates local
-         * dquot structure */
-        clear_bit(DQ_READ_B, &dquot->dq_flags);
        return status;
 }
diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
index 1324e6600e57..ca5ce14cbddc 100644
--- a/fs/ocfs2/stackglue.c
+++ b/fs/ocfs2/stackglue.c
@@ -346,7 +346,9 @@ int ocfs2_cluster_connect(const char *stack_name,
        strlcpy(new_conn->cc_name, group, GROUP_NAME_MAX + 1);
        new_conn->cc_namelen = grouplen;
-        strlcpy(new_conn->cc_cluster_name, cluster_name, CLUSTER_NAME_MAX + 1);
+        if (cluster_name_len)
+                strlcpy(new_conn->cc_cluster_name, cluster_name,
+                        CLUSTER_NAME_MAX + 1);
        new_conn->cc_cluster_name_len = cluster_name_len;
        new_conn->cc_recovery_handler = recovery_handler;
        new_conn->cc_recovery_data = recovery_data;
diff --git a/fs/open.c b/fs/open.c
index 4b3e1edf2fe4..b9ed8b25c108 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -705,6 +705,10 @@ static int do_dentry_open(struct file *f,
                return 0;
        }
+        /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
+        if (S_ISREG(inode->i_mode))
+                f->f_mode |= FMODE_ATOMIC_POS;
        f->f_op = fops_get(inode->i_fop);
        if (unlikely(WARN_ON(!f->f_op))) {
                error = -ENODEV;
diff --git a/fs/pnode.c b/fs/pnode.c
index c7221bb19801..88396df725b4 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -220,14 +220,14 @@ static struct mount *get_source(struct mount *dest,
 * @tree_list : list of heads of trees to be attached.
 */
 int propagate_mnt(struct mount *dest_mnt, struct mountpoint *dest_mp,
-                    struct mount *source_mnt, struct list_head *tree_list)
+                    struct mount *source_mnt, struct hlist_head *tree_list)
 {
        struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
        struct mount *m, *child;
        int ret = 0;
        struct mount *prev_dest_mnt = dest_mnt;
        struct mount *prev_src_mnt  = source_mnt;
-        LIST_HEAD(tmp_list);
+        HLIST_HEAD(tmp_list);
        for (m = propagation_next(dest_mnt, dest_mnt); m;
                        m = propagation_next(m, dest_mnt)) {
@@ -246,27 +246,29 @@ int propagate_mnt(struct mount *dest_mnt, struct mountpoint *dest_mp,
                child = copy_tree(source, source->mnt.mnt_root, type);
                if (IS_ERR(child)) {
                        ret = PTR_ERR(child);
-                        list_splice(tree_list, tmp_list.prev);
+                        tmp_list = *tree_list;
+                        tmp_list.first->pprev = &tmp_list.first;
+                        INIT_HLIST_HEAD(tree_list);
                        goto out;
                }
                if (is_subdir(dest_mp->m_dentry, m->mnt.mnt_root)) {
                        mnt_set_mountpoint(m, dest_mp, child);
-                        list_add_tail(&child->mnt_hash, tree_list);
+                        hlist_add_head(&child->mnt_hash, tree_list);
                } else {
                        /*
                         * This can happen if the parent mount was bind mounted
                         * on some subdirectory of a shared/slave mount.
                         */
-                        list_add_tail(&child->mnt_hash, &tmp_list);
+                        hlist_add_head(&child->mnt_hash, &tmp_list);
                }
                prev_dest_mnt = m;
                prev_src_mnt  = child;
        }
 out:
        lock_mount_hash();
-        while (!list_empty(&tmp_list)) {
+        while (!hlist_empty(&tmp_list)) {
-                child = list_first_entry(&tmp_list, struct mount, mnt_hash);
+                child = hlist_entry(tmp_list.first, struct mount, mnt_hash);
                umount_tree(child, 0);
        }
        unlock_mount_hash();
@@ -338,8 +340,10 @@ static void __propagate_umount(struct mount *mnt)
                 * umount the child only if the child has no
                 * other children
                 */
-                if (child && list_empty(&child->mnt_mounts))
+                if (child && list_empty(&child->mnt_mounts)) {
-                        list_move_tail(&child->mnt_hash, &mnt->mnt_hash);
+                        hlist_del_init_rcu(&child->mnt_hash);
+                        hlist_add_before_rcu(&child->mnt_hash, &mnt->mnt_hash);
+                }
        }
 }
@@ -350,11 +354,11 @@ static void __propagate_umount(struct mount *mnt)
 *
 * vfsmount lock must be held for write
 */
-int propagate_umount(struct list_head *list)
+int propagate_umount(struct hlist_head *list)
 {
        struct mount *mnt;
-        list_for_each_entry(mnt, list, mnt_hash)
+        hlist_for_each_entry(mnt, list, mnt_hash)
                __propagate_umount(mnt);
        return 0;
 }
diff --git a/fs/pnode.h b/fs/pnode.h
index 59e7eda1851e..fc28a27fa892 100644
--- a/fs/pnode.h
+++ b/fs/pnode.h
@@ -36,8 +36,8 @@ static inline void set_mnt_shared(struct mount *mnt)
 void change_mnt_propagation(struct mount *, int);
 int propagate_mnt(struct mount *, struct mountpoint *, struct mount *,
-                struct list_head *);
+                struct hlist_head *);
-int propagate_umount(struct list_head *);
+int propagate_umount(struct hlist_head *);
 int propagate_mount_busy(struct mount *, int);
 void mnt_release_group_id(struct mount *);
 int get_dominating_id(struct mount *mnt, const struct path *root);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 51507065263b..b9760628e1fd 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1824,6 +1824,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path)
        if (rc)
                goto out_mmput;
+        rc = -ENOENT;
        down_read(&mm->mmap_sem);
        vma = find_exact_vma(mm, vm_start, vm_end);
        if (vma && vma->vm_file) {
diff --git a/fs/proc/page.c b/fs/proc/page.c
index 02174a610315..e647c55275d9 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -121,9 +121,8 @@ u64 stable_page_flags(struct page *page)
         * just checks PG_head/PG_tail, so we need to check PageLRU/PageAnon
         * to make sure a given page is a thp, not a non-huge compound page.
         */
-        else if (PageTransCompound(page) &&
+        else if (PageTransCompound(page) && (PageLRU(compound_head(page)) ||
-                 (PageLRU(compound_trans_head(page)) ||
+                                             PageAnon(compound_head(page))))
-                  PageAnon(compound_trans_head(page))))
                u |= 1 << KPF_THP;
        /*
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 831d49a4111f..cfc8dcc16043 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -581,9 +581,17 @@ int dquot_scan_active(struct super_block *sb,
                dqstats_inc(DQST_LOOKUPS);
                dqput(old_dquot);
                old_dquot = dquot;
-                ret = fn(dquot, priv);
+                /*
-                if (ret < 0)
+                 * ->release_dquot() can be racing with us. Our reference
-                        goto out;
+                 * protects us from new calls to it so just wait for any
+                 * outstanding call and recheck the DQ_ACTIVE_B after that.
+                 */
+                wait_on_dquot(dquot);
+                if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
+                        ret = fn(dquot, priv);
+                        if (ret < 0)
+                                goto out;
+                }
                spin_lock(&dq_list_lock);
                /* We are safe to continue now because our dquot could not
                 * be moved out of the inuse list while we hold the reference */
diff --git a/fs/read_write.c b/fs/read_write.c
index edc5746a902a..28cc9c810744 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -264,10 +264,22 @@ loff_t vfs_llseek(struct file *file, loff_t offset, int whence)
 }
 EXPORT_SYMBOL(vfs_llseek);
+static inline struct fd fdget_pos(int fd)
+{
+        return __to_fd(__fdget_pos(fd));
+}
+static inline void fdput_pos(struct fd f)
+{
+        if (f.flags & FDPUT_POS_UNLOCK)
+                mutex_unlock(&f.file->f_pos_lock);
+        fdput(f);
+}
 SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, whence)
 {
        off_t retval;
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        if (!f.file)
                return -EBADF;
@@ -278,7 +290,7 @@ SYSCALL_DEFINE3(lseek, unsigned int, fd, off_t, offset, unsigned int, whence)
                if (res != (loff_t)retval)
                        retval = -EOVERFLOW;    /* LFS: should only happen on 32 bit platforms */
        }
-        fdput(f);
+        fdput_pos(f);
        return retval;
 }
@@ -295,7 +307,7 @@ SYSCALL_DEFINE5(llseek, unsigned int, fd, unsigned long, offset_high,
                unsigned int, whence)
 {
        int retval;
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        loff_t offset;
        if (!f.file)
@@ -315,7 +327,7 @@ SYSCALL_DEFINE5(llseek, unsigned int, fd, unsigned long, offset_high,
                        retval = 0;
        }
 out_putf:
-        fdput(f);
+        fdput_pos(f);
        return retval;
 }
 #endif
@@ -498,7 +510,7 @@ static inline void file_pos_write(struct file *file, loff_t pos)
 SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -506,7 +518,7 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
                ret = vfs_read(f.file, buf, count, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        return ret;
 }
@@ -514,7 +526,7 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
 SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
                size_t, count)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -522,7 +534,7 @@ SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
                ret = vfs_write(f.file, buf, count, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        return ret;
@@ -797,7 +809,7 @@ EXPORT_SYMBOL(vfs_writev);
 SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
                unsigned long, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -805,7 +817,7 @@ SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
                ret = vfs_readv(f.file, vec, vlen, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        if (ret > 0)
@@ -817,7 +829,7 @@ SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
 SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
                unsigned long, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret = -EBADF;
        if (f.file) {
@@ -825,7 +837,7 @@ SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
                ret = vfs_writev(f.file, vec, vlen, &pos);
                if (ret >= 0)
                        file_pos_write(f.file, pos);
-                fdput(f);
+                fdput_pos(f);
        }
        if (ret > 0)
@@ -968,7 +980,7 @@ COMPAT_SYSCALL_DEFINE3(readv, compat_ulong_t, fd,
                const struct compat_iovec __user *,vec,
                compat_ulong_t, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret;
        loff_t pos;
@@ -978,7 +990,7 @@ COMPAT_SYSCALL_DEFINE3(readv, compat_ulong_t, fd,
        ret = compat_readv(f.file, vec, vlen, &pos);
        if (ret >= 0)
                f.file->f_pos = pos;
-        fdput(f);
+        fdput_pos(f);
        return ret;
 }
@@ -1035,7 +1047,7 @@ COMPAT_SYSCALL_DEFINE3(writev, compat_ulong_t, fd,
                const struct compat_iovec __user *, vec,
                compat_ulong_t, vlen)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_pos(fd);
        ssize_t ret;
        loff_t pos;
@@ -1045,7 +1057,7 @@ COMPAT_SYSCALL_DEFINE3(writev, compat_ulong_t, fd,
        ret = compat_writev(f.file, vec, vlen, &pos);
        if (ret >= 0)
                f.file->f_pos = pos;
-        fdput(f);
+        fdput_pos(f);
        return ret;
 }
diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
index 2b7882b508db..9a3c68cf6026 100644
--- a/fs/reiserfs/do_balan.c
+++ b/fs/reiserfs/do_balan.c
@@ -324,23 +324,17 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                        switch (flag) {
                        case M_INSERT:  /* insert item into L[0] */
-                                if (item_pos == tb->lnum[0] - 1
+                                if (item_pos == tb->lnum[0] - 1 && tb->lbytes != -1) {
-                                    && tb->lbytes != -1) {
                                        /* part of new item falls into L[0] */
                                        int new_item_len;
                                        int version;
-                                        ret_val =
+                                        ret_val = leaf_shift_left(tb, tb->lnum[0] - 1, -1);
-                                            leaf_shift_left(tb, tb->lnum[0] - 1,
-                                                            -1);
                                        /* Calculate item length to insert to S[0] */
-                                        new_item_len =
+                                        new_item_len = ih_item_len(ih) - tb->lbytes;
-                                            ih_item_len(ih) - tb->lbytes;
                                        /* Calculate and check item length to insert to L[0] */
-                                        put_ih_item_len(ih,
+                                        put_ih_item_len(ih, ih_item_len(ih) - new_item_len);
-                                                        ih_item_len(ih) -
-                                                        new_item_len);
                                        RFALSE(ih_item_len(ih) <= 0,
                                               "PAP-12080: there is nothing to insert into L[0]: ih_item_len=%d",
@@ -349,30 +343,18 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                        /* Insert new item into L[0] */
                                        buffer_info_init_left(tb, &bi);
                                        leaf_insert_into_buf(&bi,
-                                                             n + item_pos -
+                                                        n + item_pos - ret_val, ih, body,
-                                                             ret_val, ih, body,
+                                                        zeros_num > ih_item_len(ih) ? ih_item_len(ih) : zeros_num);
-                                                             zeros_num >
-                                                             ih_item_len(ih) ?
-                                                             ih_item_len(ih) :
-                                                             zeros_num);
                                        version = ih_version(ih);
                                        /* Calculate key component, item length and body to insert into S[0] */
-                                        set_le_ih_k_offset(ih,
+                                        set_le_ih_k_offset(ih, le_ih_k_offset(ih) +
-                                                           le_ih_k_offset(ih) +
+                                                        (tb-> lbytes << (is_indirect_le_ih(ih) ? tb->tb_sb-> s_blocksize_bits - UNFM_P_SHIFT : 0)));
-                                                           (tb->
-                                                            lbytes <<
-                                                            (is_indirect_le_ih
-                                                             (ih) ? tb->tb_sb->
-                                                             s_blocksize_bits -
-                                                             UNFM_P_SHIFT :
-                                                             0)));
                                        put_ih_item_len(ih, new_item_len);
                                        if (tb->lbytes > zeros_num) {
-                                                body +=
+                                                body += (tb->lbytes - zeros_num);
-                                                    (tb->lbytes - zeros_num);
                                                zeros_num = 0;
                                        } else
                                                zeros_num -= tb->lbytes;
@@ -383,15 +365,10 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                } else {
                                        /* new item in whole falls into L[0] */
                                        /* Shift lnum[0]-1 items to L[0] */
-                                        ret_val =
+                                        ret_val = leaf_shift_left(tb, tb->lnum[0] - 1, tb->lbytes);
-                                            leaf_shift_left(tb, tb->lnum[0] - 1,
-                                                            tb->lbytes);
                                        /* Insert new item into L[0] */
                                        buffer_info_init_left(tb, &bi);
-                                        leaf_insert_into_buf(&bi,
+                                        leaf_insert_into_buf(&bi, n + item_pos - ret_val, ih, body, zeros_num);
-                                                             n + item_pos -
-                                                             ret_val, ih, body,
-                                                             zeros_num);
                                        tb->insert_size[0] = 0;
                                        zeros_num = 0;
                                }
@@ -399,264 +376,117 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                        case M_PASTE:   /* append item in L[0] */
-                                if (item_pos == tb->lnum[0] - 1
+                                if (item_pos == tb->lnum[0] - 1 && tb->lbytes != -1) {
-                                    && tb->lbytes != -1) {
                                        /* we must shift the part of the appended item */
-                                        if (is_direntry_le_ih
+                                        if (is_direntry_le_ih(B_N_PITEM_HEAD(tbS0, item_pos))) {
-                                            (B_N_PITEM_HEAD(tbS0, item_pos))) {
                                                RFALSE(zeros_num,
                                                       "PAP-12090: invalid parameter in case of a directory");
                                                /* directory item */
                                                if (tb->lbytes > pos_in_item) {
                                                        /* new directory entry falls into L[0] */
-                                                        struct item_head
+                                                        struct item_head *pasted;
-                                                            *pasted;
+                                                        int l_pos_in_item = pos_in_item;
-                                                        int l_pos_in_item =
-                                                            pos_in_item;
                                                        /* Shift lnum[0] - 1 items in whole. Shift lbytes - 1 entries from given directory item */
-                                                        ret_val =
+                                                        ret_val = leaf_shift_left(tb, tb->lnum[0], tb->lbytes-1);
-                                                            leaf_shift_left(tb,
+                                                        if (ret_val && !item_pos) {
-                                                                            tb->
+                                                                pasted = B_N_PITEM_HEAD(tb->L[0], B_NR_ITEMS(tb->L[0]) - 1);
-                                                                            lnum
+                                                                l_pos_in_item += I_ENTRY_COUNT(pasted) - (tb->lbytes -1);
-                                                                            [0],
-                                                                            tb->
-                                                                            lbytes
-                                                                            -
-                                                                            1);
-                                                        if (ret_val
-                                                            && !item_pos) {
-                                                                pasted =
-                                                                    B_N_PITEM_HEAD
-                                                                    (tb->L[0],
-                                                                     B_NR_ITEMS
-                                                                     (tb->
-                                                                      L[0]) -
-                                                                     1);
-                                                                l_pos_in_item +=
-                                                                    I_ENTRY_COUNT
-                                                                    (pasted) -
-                                                                    (tb->
-                                                                     lbytes -
-                                                                     1);
                                                        }
                                                        /* Append given directory entry to directory item */
                                                        buffer_info_init_left(tb, &bi);
-                                                        leaf_paste_in_buffer
+                                                        leaf_paste_in_buffer(&bi, n + item_pos - ret_val, l_pos_in_item, tb->insert_size[0], body, zeros_num);
-                                                            (&bi,
-                                                             n + item_pos -
-                                                             ret_val,
-                                                             l_pos_in_item,
-                                                             tb->insert_size[0],
-                                                             body, zeros_num);
                                                        /* previous string prepared space for pasting new entry, following string pastes this entry */
                                                        /* when we have merge directory item, pos_in_item has been changed too */
                                                        /* paste new directory entry. 1 is entry number */
-                                                        leaf_paste_entries(&bi,
+                                                        leaf_paste_entries(&bi, n + item_pos - ret_val, l_pos_in_item,
-                                                                           n +
+                                                                           1, (struct reiserfs_de_head *) body,
-                                                                           item_pos
+                                                                           body + DEH_SIZE, tb->insert_size[0]);
-                                                                           -
-                                                                           ret_val,
-                                                                           l_pos_in_item,
-                                                                           1,
-                                                                           (struct
-                                                                            reiserfs_de_head
-                                                                            *)
-                                                                           body,
-                                                                           body
-                                                                           +
-                                                                           DEH_SIZE,
-                                                                           tb->
-                                                                           insert_size
-                                                                           [0]
-                                                            );
                                                        tb->insert_size[0] = 0;
                                                } else {
                                                        /* new directory item doesn't fall into L[0] */
                                                        /* Shift lnum[0]-1 items in whole. Shift lbytes directory entries from directory item number lnum[0] */
-                                                        leaf_shift_left(tb,
+                                                        leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
-                                                                        tb->
-                                                                        lnum[0],
-                                                                        tb->
-                                                                        lbytes);
                                                }
                                                /* Calculate new position to append in item body */
                                                pos_in_item -= tb->lbytes;
                                        } else {
                                                /* regular object */
-                                                RFALSE(tb->lbytes <= 0,
+                                                RFALSE(tb->lbytes <= 0, "PAP-12095: there is nothing to shift to L[0]. lbytes=%d", tb->lbytes);
-                                                       "PAP-12095: there is nothing to shift to L[0]. lbytes=%d",
+                                                RFALSE(pos_in_item != ih_item_len(B_N_PITEM_HEAD(tbS0, item_pos)),
-                                                       tb->lbytes);
-                                                RFALSE(pos_in_item !=
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)),
                                                       "PAP-12100: incorrect position to paste: item_len=%d, pos_in_item=%d",
-                                                       ih_item_len
+                                                       ih_item_len(B_N_PITEM_HEAD(tbS0, item_pos)),pos_in_item);
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)),
-                                                       pos_in_item);
                                                if (tb->lbytes >= pos_in_item) {
                                                        /* appended item will be in L[0] in whole */
                                                        int l_n;
                                                        /* this bytes number must be appended to the last item of L[h] */
-                                                        l_n =
+                                                        l_n = tb->lbytes - pos_in_item;
-                                                            tb->lbytes -
-                                                            pos_in_item;
                                                        /* Calculate new insert_size[0] */
-                                                        tb->insert_size[0] -=
+                                                        tb->insert_size[0] -= l_n;
-                                                            l_n;
-                                                        RFALSE(tb->
+                                                        RFALSE(tb->insert_size[0] <= 0,
-                                                               insert_size[0] <=
-                                                               0,
                                                               "PAP-12105: there is nothing to paste into L[0]. insert_size=%d",
-                                                               tb->
+                                                               tb->insert_size[0]);
-                                                               insert_size[0]);
+                                                        ret_val = leaf_shift_left(tb, tb->lnum[0], ih_item_len
-                                                        ret_val =
+                                                                            (B_N_PITEM_HEAD(tbS0, item_pos)));
-                                                            leaf_shift_left(tb,
-                                                                            tb->
-                                                                            lnum
-                                                                            [0],
-                                                                            ih_item_len
-                                                                            (B_N_PITEM_HEAD
-                                                                             (tbS0,
-                                                                              item_pos)));
                                                        /* Append to body of item in L[0] */
                                                        buffer_info_init_left(tb, &bi);
                                                        leaf_paste_in_buffer
-                                                            (&bi,
+                                                            (&bi, n + item_pos - ret_val, ih_item_len
-                                                             n + item_pos -
+                                                             (B_N_PITEM_HEAD(tb->L[0], n + item_pos - ret_val)),
-                                                             ret_val,
+                                                             l_n, body,
-                                                             ih_item_len
+                                                             zeros_num > l_n ? l_n : zeros_num);
-                                                             (B_N_PITEM_HEAD
-                                                              (tb->L[0],
-                                                               n + item_pos -
-                                                               ret_val)), l_n,
-                                                             body,
-                                                             zeros_num >
-                                                             l_n ? l_n :
-                                                             zeros_num);
                                                        /* 0-th item in S0 can be only of DIRECT type when l_n != 0 */
                                                        {
                                                                int version;
-                                                                int temp_l =
+                                                                int temp_l = l_n;
-                                                                    l_n;
+                                                                RFALSE(ih_item_len(B_N_PITEM_HEAD(tbS0, 0)),
-                                                                RFALSE
-                                                                    (ih_item_len
-                                                                     (B_N_PITEM_HEAD
-                                                                      (tbS0,
-                                                                       0)),
                                                                     "PAP-12106: item length must be 0");
-                                                                RFALSE
+                                                                RFALSE(comp_short_le_keys(B_N_PKEY(tbS0, 0), B_N_PKEY
-                                                                    (comp_short_le_keys
+                                                                      (tb->L[0], n + item_pos - ret_val)),
-                                                                     (B_N_PKEY
-                                                                      (tbS0, 0),
-                                                                      B_N_PKEY
-                                                                      (tb->L[0],
-                                                                       n +
-                                                                       item_pos
-                                                                       -
-                                                                       ret_val)),
                                                                     "PAP-12107: items must be of the same file");
                                                                if (is_indirect_le_ih(B_N_PITEM_HEAD(tb->L[0], n + item_pos - ret_val))) {
-                                                                        temp_l =
+                                                                        temp_l = l_n << (tb->tb_sb-> s_blocksize_bits - UNFM_P_SHIFT);
-                                                                            l_n
-                                                                            <<
-                                                                            (tb->
-                                                                             tb_sb->
-                                                                             s_blocksize_bits
-                                                                             -
-                                                                             UNFM_P_SHIFT);
                                                                }
                                                                /* update key of first item in S0 */
-                                                                version =
+                                                                version = ih_version(B_N_PITEM_HEAD(tbS0, 0));
-                                                                    ih_version
+                                                                set_le_key_k_offset(version, B_N_PKEY(tbS0, 0),
-                                                                    (B_N_PITEM_HEAD
+                                                                     le_key_k_offset(version,B_N_PKEY(tbS0, 0)) + temp_l);
-                                                                     (tbS0, 0));
-                                                                set_le_key_k_offset
-                                                                    (version,
-                                                                     B_N_PKEY
-                                                                     (tbS0, 0),
-                                                                     le_key_k_offset
-                                                                     (version,
-                                                                      B_N_PKEY
-                                                                      (tbS0,
-                                                                       0)) +
-                                                                     temp_l);
                                                                /* update left delimiting key */
-                                                                set_le_key_k_offset
+                                                                set_le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFL[0], tb->lkey[0]),
-                                                                    (version,
+                                                                     le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFL[0], tb->lkey[0])) + temp_l);
-                                                                     B_N_PDELIM_KEY
-                                                                     (tb->
-                                                                      CFL[0],
-                                                                      tb->
-                                                                      lkey[0]),
-                                                                     le_key_k_offset
-                                                                     (version,
-                                                                      B_N_PDELIM_KEY
-                                                                      (tb->
-                                                                       CFL[0],
-                                                                       tb->
-                                                                       lkey[0]))
-                                                                     + temp_l);
                                                        }
                                                        /* Calculate new body, position in item and insert_size[0] */
                                                        if (l_n > zeros_num) {
-                                                                body +=
+                                                                body += (l_n - zeros_num);
-                                                                    (l_n -
-                                                                     zeros_num);
                                                                zeros_num = 0;
                                                        } else
-                                                                zeros_num -=
+                                                                zeros_num -= l_n;
-                                                                    l_n;
                                                        pos_in_item = 0;
-                                                        RFALSE
+                                                        RFALSE(comp_short_le_keys(B_N_PKEY(tbS0, 0), B_N_PKEY(tb->L[0], B_NR_ITEMS(tb->L[0]) - 1))
-                                                            (comp_short_le_keys
+                                                             || !op_is_left_mergeable(B_N_PKEY(tbS0, 0), tbS0->b_size)
-                                                             (B_N_PKEY(tbS0, 0),
+                                                             || !op_is_left_mergeable(B_N_PDELIM_KEY(tb->CFL[0], tb->lkey[0]), tbS0->b_size),
-                                                              B_N_PKEY(tb->L[0],
-                                                                       B_NR_ITEMS
-                                                                       (tb->
-                                                                        L[0]) -
-                                                                       1))
-                                                             ||
-                                                             !op_is_left_mergeable
-                                                             (B_N_PKEY(tbS0, 0),
-                                                              tbS0->b_size)
-                                                             ||
-                                                             !op_is_left_mergeable
-                                                             (B_N_PDELIM_KEY
-                                                              (tb->CFL[0],
-                                                               tb->lkey[0]),
-                                                              tbS0->b_size),
                                                             "PAP-12120: item must be merge-able with left neighboring item");
                                                } else {        /* only part of the appended item will be in L[0] */
                                                        /* Calculate position in item for append in S[0] */
-                                                        pos_in_item -=
+                                                        pos_in_item -= tb->lbytes;
-                                                            tb->lbytes;
-                                                        RFALSE(pos_in_item <= 0,
+                                                        RFALSE(pos_in_item <= 0, "PAP-12125: no place for paste. pos_in_item=%d", pos_in_item);
-                                                               "PAP-12125: no place for paste. pos_in_item=%d",
-                                                               pos_in_item);
                                                        /* Shift lnum[0] - 1 items in whole. Shift lbytes - 1 byte from item number lnum[0] */
-                                                        leaf_shift_left(tb,
+                                                        leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
-                                                                        tb->
-                                                                        lnum[0],
-                                                                        tb->
-                                                                        lbytes);
                                                }
                                        }
                                } else {        /* appended item will be in L[0] in whole */
@@ -665,52 +495,30 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                        if (!item_pos && op_is_left_mergeable(B_N_PKEY(tbS0, 0), tbS0->b_size)) {       /* if we paste into first item of S[0] and it is left mergable */
                                                /* then increment pos_in_item by the size of the last item in L[0] */
-                                                pasted =
+                                                pasted = B_N_PITEM_HEAD(tb->L[0], n - 1);
-                                                    B_N_PITEM_HEAD(tb->L[0],
-                                                                   n - 1);
                                                if (is_direntry_le_ih(pasted))
-                                                        pos_in_item +=
+                                                        pos_in_item += ih_entry_count(pasted);
-                                                            ih_entry_count
-                                                            (pasted);
                                                else
-                                                        pos_in_item +=
+                                                        pos_in_item += ih_item_len(pasted);
-                                                            ih_item_len(pasted);
                                        }
                                        /* Shift lnum[0] - 1 items in whole. Shift lbytes - 1 byte from item number lnum[0] */
-                                        ret_val =
+                                        ret_val = leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
-                                            leaf_shift_left(tb, tb->lnum[0],
-                                                            tb->lbytes);
                                        /* Append to body of item in L[0] */
                                        buffer_info_init_left(tb, &bi);
-                                        leaf_paste_in_buffer(&bi,
+                                        leaf_paste_in_buffer(&bi, n + item_pos - ret_val,
-                                                             n + item_pos -
-                                                             ret_val,
                                                             pos_in_item,
                                                             tb->insert_size[0],
                                                             body, zeros_num);
                                        /* if appended item is directory, paste entry */
-                                        pasted =
+                                        pasted = B_N_PITEM_HEAD(tb->L[0], n + item_pos - ret_val);
-                                            B_N_PITEM_HEAD(tb->L[0],
-                                                           n + item_pos -
-                                                           ret_val);
                                        if (is_direntry_le_ih(pasted))
-                                                leaf_paste_entries(&bi,
+                                                leaf_paste_entries(&bi, n + item_pos - ret_val,
-                                                                   n +
+                                                                   pos_in_item, 1,
-                                                                   item_pos -
+                                                                   (struct reiserfs_de_head *) body,
-                                                                   ret_val,
+                                                                   body + DEH_SIZE,
-                                                                   pos_in_item,
+                                                                   tb->insert_size[0]);
-                                                                   1,
-                                                                   (struct
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
-                                                    );
                                        /* if appended item is indirect item, put unformatted node into un list */
                                        if (is_indirect_le_ih(pasted))
                                                set_ih_free_space(pasted, 0);
@@ -722,13 +530,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                reiserfs_panic(tb->tb_sb, "PAP-12130",
                                               "lnum > 0: unexpected mode: "
                                               " %s(%d)",
-                                               (flag ==
+                                               (flag == M_DELETE) ? "DELETE" : ((flag == M_CUT) ? "CUT" : "UNKNOWN"), flag);
-                                                M_DELETE) ? "DELETE" : ((flag ==
-                                                                         M_CUT)
-                                                                        ? "CUT"
-                                                                        :
-                                                                        "UNKNOWN"),
-                                               flag);
                        }
                } else {
                        /* new item doesn't fall into L[0] */
@@ -748,14 +550,12 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                case M_INSERT:  /* insert item */
                        if (n - tb->rnum[0] < item_pos) {       /* new item or its part falls to R[0] */
                                if (item_pos == n - tb->rnum[0] + 1 && tb->rbytes != -1) {      /* part of new item falls into R[0] */
-                                        loff_t old_key_comp, old_len,
+                                        loff_t old_key_comp, old_len, r_zeros_number;
-                                            r_zeros_number;
                                        const char *r_body;
                                        int version;
                                        loff_t offset;
-                                        leaf_shift_right(tb, tb->rnum[0] - 1,
+                                        leaf_shift_right(tb, tb->rnum[0] - 1, -1);
-                                                         -1);
                                        version = ih_version(ih);
                                        /* Remember key component and item length */
@@ -763,29 +563,17 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                        old_len = ih_item_len(ih);
                                        /* Calculate key component and item length to insert into R[0] */
-                                        offset =
+                                        offset = le_ih_k_offset(ih) + ((old_len - tb->rbytes) << (is_indirect_le_ih(ih) ? tb->tb_sb->s_blocksize_bits - UNFM_P_SHIFT : 0));
-                                            le_ih_k_offset(ih) +
-                                            ((old_len -
-                                              tb->
-                                              rbytes) << (is_indirect_le_ih(ih)
-                                                          ? tb->tb_sb->
-                                                          s_blocksize_bits -
-                                                          UNFM_P_SHIFT : 0));
                                        set_le_ih_k_offset(ih, offset);
                                        put_ih_item_len(ih, tb->rbytes);
                                        /* Insert part of the item into R[0] */
                                        buffer_info_init_right(tb, &bi);
                                        if ((old_len - tb->rbytes) > zeros_num) {
                                                r_zeros_number = 0;
-                                                r_body =
+                                                r_body = body + (old_len - tb->rbytes) - zeros_num;
-                                                    body + (old_len -
-                                                            tb->rbytes) -
-                                                    zeros_num;
                                        } else {
                                                r_body = body;
-                                                r_zeros_number =
+                                                r_zeros_number = zeros_num - (old_len - tb->rbytes);
-                                                    zeros_num - (old_len -
-                                                                 tb->rbytes);
                                                zeros_num -= r_zeros_number;
                                        }
@@ -798,25 +586,18 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                        /* Calculate key component and item length to insert into S[0] */
                                        set_le_ih_k_offset(ih, old_key_comp);
-                                        put_ih_item_len(ih,
+                                        put_ih_item_len(ih, old_len - tb->rbytes);
-                                                        old_len - tb->rbytes);
                                        tb->insert_size[0] -= tb->rbytes;
                                } else {        /* whole new item falls into R[0] */
                                        /* Shift rnum[0]-1 items to R[0] */
-                                        ret_val =
+                                        ret_val = leaf_shift_right(tb, tb->rnum[0] - 1, tb->rbytes);
-                                            leaf_shift_right(tb,
-                                                             tb->rnum[0] - 1,
-                                                             tb->rbytes);
                                        /* Insert new item into R[0] */
                                        buffer_info_init_right(tb, &bi);
-                                        leaf_insert_into_buf(&bi,
+                                        leaf_insert_into_buf(&bi, item_pos - n + tb->rnum[0] - 1,
-                                                             item_pos - n +
+                                                             ih, body, zeros_num);
-                                                             tb->rnum[0] - 1,
-                                                             ih, body,
-                                                             zeros_num);
                                        if (item_pos - n + tb->rnum[0] - 1 == 0) {
                                                replace_key(tb, tb->CFR[0],
@@ -841,200 +622,97 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                                RFALSE(zeros_num,
                                                       "PAP-12145: invalid parameter in case of a directory");
-                                                entry_count =
+                                                entry_count = I_ENTRY_COUNT(B_N_PITEM_HEAD
-                                                    I_ENTRY_COUNT(B_N_PITEM_HEAD
+                                                                  (tbS0, item_pos));
-                                                                  (tbS0,
-                                                                   item_pos));
                                                if (entry_count - tb->rbytes <
                                                    pos_in_item)
                                                        /* new directory entry falls into R[0] */
                                                {
                                                        int paste_entry_position;
-                                                        RFALSE(tb->rbytes - 1 >=
+                                                        RFALSE(tb->rbytes - 1 >= entry_count || !tb-> insert_size[0],
-                                                               entry_count
-                                                               || !tb->
-                                                               insert_size[0],
                                                               "PAP-12150: no enough of entries to shift to R[0]: rbytes=%d, entry_count=%d",
-                                                               tb->rbytes,
+                                                               tb->rbytes, entry_count);
-                                                               entry_count);
                                                        /* Shift rnum[0]-1 items in whole. Shift rbytes-1 directory entries from directory item number rnum[0] */
-                                                        leaf_shift_right(tb,
+                                                        leaf_shift_right(tb, tb->rnum[0], tb->rbytes - 1);
-                                                                         tb->
-                                                                         rnum
-                                                                         [0],
-                                                                         tb->
-                                                                         rbytes
-                                                                         - 1);
                                                        /* Paste given directory entry to directory item */
-                                                        paste_entry_position =
+                                                        paste_entry_position = pos_in_item - entry_count + tb->rbytes - 1;
-                                                            pos_in_item -
-                                                            entry_count +
-                                                            tb->rbytes - 1;
                                                        buffer_info_init_right(tb, &bi);
-                                                        leaf_paste_in_buffer
+                                                        leaf_paste_in_buffer(&bi, 0, paste_entry_position, tb->insert_size[0], body, zeros_num);
-                                                            (&bi, 0,
-                                                             paste_entry_position,
-                                                             tb->insert_size[0],
-                                                             body, zeros_num);
                                                        /* paste entry */
-                                                        leaf_paste_entries(&bi,
+                                                        leaf_paste_entries(&bi, 0, paste_entry_position, 1,
-                                                                           0,
+                                                                           (struct reiserfs_de_head *) body,
-                                                                           paste_entry_position,
+                                                                           body + DEH_SIZE, tb->insert_size[0]);
-                                                                           1,
-                                                                           (struct
+                                                        if (paste_entry_position == 0) {
-                                                                            reiserfs_de_head
-                                                                            *)
-                                                                           body,
-                                                                           body
-                                                                           +
-                                                                           DEH_SIZE,
-                                                                           tb->
-                                                                           insert_size
-                                                                           [0]
-                                                            );
-                                                        if (paste_entry_position
-                                                            == 0) {
                                                                /* change delimiting keys */
-                                                                replace_key(tb,
+                                                                replace_key(tb, tb->CFR[0], tb->rkey[0], tb->R[0],0);
-                                                                            tb->
-                                                                            CFR
-                                                                            [0],
-                                                                            tb->
-                                                                            rkey
-                                                                            [0],
-                                                                            tb->
-                                                                            R
-                                                                            [0],
-                                                                            0);
                                                        }
                                                        tb->insert_size[0] = 0;
                                                        pos_in_item++;
                                                } else {        /* new directory entry doesn't fall into R[0] */
-                                                        leaf_shift_right(tb,
+                                                        leaf_shift_right(tb, tb->rnum[0], tb->rbytes);
-                                                                         tb->
-                                                                         rnum
-                                                                         [0],
-                                                                         tb->
-                                                                         rbytes);
                                                }
                                        } else {        /* regular object */
-                                                int n_shift, n_rem,
+                                                int n_shift, n_rem, r_zeros_number;
-                                                    r_zeros_number;
                                                const char *r_body;
                                                /* Calculate number of bytes which must be shifted from appended item */
-                                                if ((n_shift =
+                                                if ((n_shift = tb->rbytes - tb->insert_size[0]) < 0)
-                                                     tb->rbytes -
-                                                     tb->insert_size[0]) < 0)
                                                        n_shift = 0;
-                                                RFALSE(pos_in_item !=
+                                                RFALSE(pos_in_item != ih_item_len
-                                                       ih_item_len
+                                                       (B_N_PITEM_HEAD(tbS0, item_pos)),
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)),
                                                       "PAP-12155: invalid position to paste. ih_item_len=%d, pos_in_item=%d",
-                                                       pos_in_item,
+                                                       pos_in_item, ih_item_len
-                                                       ih_item_len
+                                                       (B_N_PITEM_HEAD(tbS0, item_pos)));
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos)));
+                                                leaf_shift_right(tb, tb->rnum[0], n_shift);
-                                                leaf_shift_right(tb,
-                                                                 tb->rnum[0],
-                                                                 n_shift);
                                                /* Calculate number of bytes which must remain in body after appending to R[0] */
-                                                if ((n_rem =
+                                                if ((n_rem = tb->insert_size[0] - tb->rbytes) < 0)
-                                                     tb->insert_size[0] -
-                                                     tb->rbytes) < 0)
                                                        n_rem = 0;
                                                {
                                                        int version;
-                                                        unsigned long temp_rem =
+                                                        unsigned long temp_rem = n_rem;
-                                                            n_rem;
+                                                        version = ih_version(B_N_PITEM_HEAD(tb->R[0], 0));
-                                                        version =
+                                                        if (is_indirect_le_key(version, B_N_PKEY(tb->R[0], 0))) {
-                                                            ih_version
+                                                                temp_rem = n_rem << (tb->tb_sb->s_blocksize_bits - UNFM_P_SHIFT);
-                                                            (B_N_PITEM_HEAD
-                                                             (tb->R[0], 0));
-                                                        if (is_indirect_le_key
-                                                            (version,
-                                                             B_N_PKEY(tb->R[0],
-                                                                      0))) {
-                                                                temp_rem =
-                                                                    n_rem <<
-                                                                    (tb->tb_sb->
-                                                                     s_blocksize_bits
-                                                                     -
-                                                                     UNFM_P_SHIFT);
                                                        }
-                                                        set_le_key_k_offset
+                                                        set_le_key_k_offset(version, B_N_PKEY(tb->R[0], 0),
-                                                            (version,
+                                                             le_key_k_offset(version, B_N_PKEY(tb->R[0], 0)) + temp_rem);
-                                                             B_N_PKEY(tb->R[0],
+                                                        set_le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFR[0], tb->rkey[0]),
-                                                                      0),
+                                                             le_key_k_offset(version, B_N_PDELIM_KEY(tb->CFR[0], tb->rkey[0])) + temp_rem);
-                                                             le_key_k_offset
-                                                             (version,
-                                                              B_N_PKEY(tb->R[0],
-                                                                       0)) +
-                                                             temp_rem);
-                                                        set_le_key_k_offset
-                                                            (version,
-                                                             B_N_PDELIM_KEY(tb->
-                                                                            CFR
-                                                                            [0],
-                                                                            tb->
-                                                                            rkey
-                                                                            [0]),
-                                                             le_key_k_offset
-                                                             (version,
-                                                              B_N_PDELIM_KEY
-                                                              (tb->CFR[0],
-                                                               tb->rkey[0])) +
-                                                             temp_rem);
                                                }
 /*                k_offset (B_N_PKEY(tb->R[0],0)) += n_rem;
                  k_offset (B_N_PDELIM_KEY(tb->CFR[0],tb->rkey[0])) += n_rem;*/
-                                                do_balance_mark_internal_dirty
+                                                do_balance_mark_internal_dirty(tb, tb->CFR[0], 0);
-                                                    (tb, tb->CFR[0], 0);
                                                /* Append part of body into R[0] */
                                                buffer_info_init_right(tb, &bi);
                                                if (n_rem > zeros_num) {
                                                        r_zeros_number = 0;
-                                                        r_body =
+                                                        r_body = body + n_rem - zeros_num;
-                                                            body + n_rem -
-                                                            zeros_num;
                                                } else {
                                                        r_body = body;
-                                                        r_zeros_number =
+                                                        r_zeros_number = zeros_num - n_rem;
-                                                            zeros_num - n_rem;
+                                                        zeros_num -= r_zeros_number;
-                                                        zeros_num -=
-                                                            r_zeros_number;
                                                }
-                                                leaf_paste_in_buffer(&bi, 0,
+                                                leaf_paste_in_buffer(&bi, 0, n_shift,
-                                                                     n_shift,
+                                                                     tb->insert_size[0] - n_rem,
-                                                                     tb->
+                                                                     r_body, r_zeros_number);
-                                                                     insert_size
-                                                                     [0] -
+                                                if (is_indirect_le_ih(B_N_PITEM_HEAD(tb->R[0], 0))) {
-                                                                     n_rem,
-                                                                     r_body,
-                                                                     r_zeros_number);
-                                                if (is_indirect_le_ih
-                                                    (B_N_PITEM_HEAD
-                                                     (tb->R[0], 0))) {
 #if 0
                                                        RFALSE(n_rem,
                                                               "PAP-12160: paste more than one unformatted node pointer");
 #endif
-                                                        set_ih_free_space
+                                                        set_ih_free_space(B_N_PITEM_HEAD(tb->R[0], 0), 0);
-                                                            (B_N_PITEM_HEAD
-                                                             (tb->R[0], 0), 0);
                                                }
                                                tb->insert_size[0] = n_rem;
                                                if (!n_rem)
@@ -1044,58 +722,28 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                        struct item_head *pasted;
-                                        ret_val =
+                                        ret_val = leaf_shift_right(tb, tb->rnum[0], tb->rbytes);
-                                            leaf_shift_right(tb, tb->rnum[0],
-                                                             tb->rbytes);
                                        /* append item in R[0] */
                                        if (pos_in_item >= 0) {
                                                buffer_info_init_right(tb, &bi);
-                                                leaf_paste_in_buffer(&bi,
+                                                leaf_paste_in_buffer(&bi, item_pos - n + tb->rnum[0], pos_in_item,
-                                                                     item_pos -
+                                                                     tb->insert_size[0], body, zeros_num);
-                                                                     n +
-                                                                     tb->
-                                                                     rnum[0],
-                                                                     pos_in_item,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0], body,
-                                                                     zeros_num);
                                        }
                                        /* paste new entry, if item is directory item */
-                                        pasted =
+                                        pasted = B_N_PITEM_HEAD(tb->R[0], item_pos - n + tb->rnum[0]);
-                                            B_N_PITEM_HEAD(tb->R[0],
+                                        if (is_direntry_le_ih(pasted) && pos_in_item >= 0) {
-                                                           item_pos - n +
+                                                leaf_paste_entries(&bi, item_pos - n + tb->rnum[0],
-                                                           tb->rnum[0]);
+                                                                   pos_in_item, 1,
-                                        if (is_direntry_le_ih(pasted)
+                                                                   (struct reiserfs_de_head *) body,
-                                            && pos_in_item >= 0) {
+                                                                   body + DEH_SIZE, tb->insert_size[0]);
-                                                leaf_paste_entries(&bi,
-                                                                   item_pos -
-                                                                   n +
-                                                                   tb->rnum[0],
-                                                                   pos_in_item,
-                                                                   1,
-                                                                   (struct
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
-                                                    );
                                                if (!pos_in_item) {
-                                                        RFALSE(item_pos - n +
+                                                        RFALSE(item_pos - n + tb->rnum[0],
-                                                               tb->rnum[0],
                                                               "PAP-12165: directory item must be first item of node when pasting is in 0th position");
                                                        /* update delimiting keys */
-                                                        replace_key(tb,
+                                                        replace_key(tb, tb->CFR[0], tb->rkey[0], tb->R[0], 0);
-                                                                    tb->CFR[0],
-                                                                    tb->rkey[0],
-                                                                    tb->R[0],
-                                                                    0);
                                                }
                                        }
@@ -1111,22 +759,16 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                default:        /* cases d and t */
                        reiserfs_panic(tb->tb_sb, "PAP-12175",
                                       "rnum > 0: unexpected mode: %s(%d)",
-                                       (flag ==
+                                       (flag == M_DELETE) ? "DELETE" : ((flag == M_CUT) ? "CUT" : "UNKNOWN"), flag);
-                                        M_DELETE) ? "DELETE" : ((flag ==
-                                                                 M_CUT) ? "CUT"
-                                                                : "UNKNOWN"),
-                                       flag);
                }
        }
        /* tb->rnum[0] > 0 */
        RFALSE(tb->blknum[0] > 3,
-               "PAP-12180: blknum can not be %d. It must be <= 3",
+               "PAP-12180: blknum can not be %d. It must be <= 3", tb->blknum[0]);
-               tb->blknum[0]);
        RFALSE(tb->blknum[0] < 0,
-               "PAP-12185: blknum can not be %d. It must be >= 0",
+               "PAP-12185: blknum can not be %d. It must be >= 0", tb->blknum[0]);
-               tb->blknum[0]);
        /* if while adding to a node we discover that it is possible to split
           it in two, and merge the left part into the left neighbor and the
@@ -1177,8 +819,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                        if (n - snum[i] < item_pos) {   /* new item or it's part falls to first new node S_new[i] */
                                if (item_pos == n - snum[i] + 1 && sbytes[i] != -1) {   /* part of new item falls into S_new[i] */
-                                        int old_key_comp, old_len,
+                                        int old_key_comp, old_len, r_zeros_number;
-                                            r_zeros_number;
                                        const char *r_body;
                                        int version;
@@ -1192,15 +833,8 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                        old_len = ih_item_len(ih);
                                        /* Calculate key component and item length to insert into S_new[i] */
-                                        set_le_ih_k_offset(ih,
+                                        set_le_ih_k_offset(ih, le_ih_k_offset(ih) +
-                                                           le_ih_k_offset(ih) +
+                                                           ((old_len - sbytes[i]) << (is_indirect_le_ih(ih) ? tb->tb_sb-> s_blocksize_bits - UNFM_P_SHIFT : 0)));
-                                                           ((old_len -
-                                                             sbytes[i]) <<
-                                                            (is_indirect_le_ih
-                                                             (ih) ? tb->tb_sb->
-                                                             s_blocksize_bits -
-                                                             UNFM_P_SHIFT :
-                                                             0)));
                                        put_ih_item_len(ih, sbytes[i]);
@@ -1209,39 +843,29 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                        if ((old_len - sbytes[i]) > zeros_num) {
                                                r_zeros_number = 0;
-                                                r_body =
+                                                r_body = body + (old_len - sbytes[i]) - zeros_num;
-                                                    body + (old_len -
-                                                            sbytes[i]) -
-                                                    zeros_num;
                                        } else {
                                                r_body = body;
-                                                r_zeros_number =
+                                                r_zeros_number = zeros_num - (old_len - sbytes[i]);
-                                                    zeros_num - (old_len -
-                                                                 sbytes[i]);
                                                zeros_num -= r_zeros_number;
                                        }
-                                        leaf_insert_into_buf(&bi, 0, ih, r_body,
+                                        leaf_insert_into_buf(&bi, 0, ih, r_body, r_zeros_number);
-                                                             r_zeros_number);
                                        /* Calculate key component and item length to insert into S[i] */
                                        set_le_ih_k_offset(ih, old_key_comp);
-                                        put_ih_item_len(ih,
+                                        put_ih_item_len(ih, old_len - sbytes[i]);
-                                                        old_len - sbytes[i]);
                                        tb->insert_size[0] -= sbytes[i];
                                } else {        /* whole new item falls into S_new[i] */
                                        /* Shift snum[0] - 1 items to S_new[i] (sbytes[i] of split item) */
                                        leaf_move_items(LEAF_FROM_S_TO_SNEW, tb,
-                                                        snum[i] - 1, sbytes[i],
+                                                        snum[i] - 1, sbytes[i], S_new[i]);
-                                                        S_new[i]);
                                        /* Insert new item into S_new[i] */
                                        buffer_info_init_bh(tb, &bi, S_new[i]);
-                                        leaf_insert_into_buf(&bi,
+                                        leaf_insert_into_buf(&bi, item_pos - n + snum[i] - 1,
-                                                             item_pos - n +
+                                                             ih, body, zeros_num);
-                                                             snum[i] - 1, ih,
-                                                             body, zeros_num);
                                        zeros_num = tb->insert_size[0] = 0;
                                }
@@ -1268,150 +892,73 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                                int entry_count;
-                                                entry_count =
+                                                entry_count = ih_entry_count(aux_ih);
-                                                    ih_entry_count(aux_ih);
-                                                if (entry_count - sbytes[i] <
+                                                if (entry_count - sbytes[i] < pos_in_item && pos_in_item <= entry_count) {
-                                                    pos_in_item
-                                                    && pos_in_item <=
-                                                    entry_count) {
                                                        /* new directory entry falls into S_new[i] */
-                                                        RFALSE(!tb->
+                                                        RFALSE(!tb->insert_size[0], "PAP-12215: insert_size is already 0");
-                                                               insert_size[0],
+                                                        RFALSE(sbytes[i] - 1 >= entry_count,
-                                                               "PAP-12215: insert_size is already 0");
-                                                        RFALSE(sbytes[i] - 1 >=
-                                                               entry_count,
                                                               "PAP-12220: there are no so much entries (%d), only %d",
-                                                               sbytes[i] - 1,
+                                                               sbytes[i] - 1, entry_count);
-                                                               entry_count);
                                                        /* Shift snum[i]-1 items in whole. Shift sbytes[i] directory entries from directory item number snum[i] */
-                                                        leaf_move_items
+                                                        leaf_move_items(LEAF_FROM_S_TO_SNEW, tb, snum[i], sbytes[i] - 1, S_new[i]);
-                                                            (LEAF_FROM_S_TO_SNEW,
-                                                             tb, snum[i],
-                                                             sbytes[i] - 1,
-                                                             S_new[i]);
                                                        /* Paste given directory entry to directory item */
                                                        buffer_info_init_bh(tb, &bi, S_new[i]);
-                                                        leaf_paste_in_buffer
+                                                        leaf_paste_in_buffer(&bi, 0, pos_in_item - entry_count + sbytes[i] - 1,
-                                                            (&bi, 0,
+                                                             tb->insert_size[0], body, zeros_num);
-                                                             pos_in_item -
-                                                             entry_count +
-                                                             sbytes[i] - 1,
-                                                             tb->insert_size[0],
-                                                             body, zeros_num);
                                                        /* paste new directory entry */
-                                                        leaf_paste_entries(&bi,
+                                                        leaf_paste_entries(&bi, 0, pos_in_item - entry_count + sbytes[i] - 1, 1,
-                                                                           0,
+                                                                           (struct reiserfs_de_head *) body,
-                                                                           pos_in_item
+                                                                           body + DEH_SIZE, tb->insert_size[0]);
-                                                                           -
-                                                                           entry_count
-                                                                           +
-                                                                           sbytes
-                                                                           [i] -
-                                                                           1, 1,
-                                                                           (struct
-                                                                            reiserfs_de_head
-                                                                            *)
-                                                                           body,
-                                                                           body
-                                                                           +
-                                                                           DEH_SIZE,
-                                                                           tb->
-                                                                           insert_size
-                                                                           [0]
-                                                            );
                                                        tb->insert_size[0] = 0;
                                                        pos_in_item++;
                                                } else {        /* new directory entry doesn't fall into S_new[i] */
-                                                        leaf_move_items
+                                                        leaf_move_items(LEAF_FROM_S_TO_SNEW,tb, snum[i], sbytes[i], S_new[i]);
-                                                            (LEAF_FROM_S_TO_SNEW,
-                                                             tb, snum[i],
-                                                             sbytes[i],
-                                                             S_new[i]);
                                                }
                                        } else {        /* regular object */
-                                                int n_shift, n_rem,
+                                                int n_shift, n_rem, r_zeros_number;
-                                                    r_zeros_number;
                                                const char *r_body;
-                                                RFALSE(pos_in_item !=
+                                                RFALSE(pos_in_item != ih_item_len(B_N_PITEM_HEAD(tbS0, item_pos)) || tb->insert_size[0] <= 0,
-                                                       ih_item_len
-                                                       (B_N_PITEM_HEAD
-                                                        (tbS0, item_pos))
-                                                       || tb->insert_size[0] <=
-                                                       0,
                                                       "PAP-12225: item too short or insert_size <= 0");
                                                /* Calculate number of bytes which must be shifted from appended item */
-                                                n_shift =
+                                                n_shift = sbytes[i] - tb->insert_size[0];
-                                                    sbytes[i] -
-                                                    tb->insert_size[0];
                                                if (n_shift < 0)
                                                        n_shift = 0;
-                                                leaf_move_items
+                                                leaf_move_items(LEAF_FROM_S_TO_SNEW, tb, snum[i], n_shift, S_new[i]);
-                                                    (LEAF_FROM_S_TO_SNEW, tb,
-                                                     snum[i], n_shift,
-                                                     S_new[i]);
                                                /* Calculate number of bytes which must remain in body after append to S_new[i] */
-                                                n_rem =
+                                                n_rem = tb->insert_size[0] - sbytes[i];
-                                                    tb->insert_size[0] -
-                                                    sbytes[i];
                                                if (n_rem < 0)
                                                        n_rem = 0;
                                                /* Append part of body into S_new[0] */
                                                buffer_info_init_bh(tb, &bi, S_new[i]);
                                                if (n_rem > zeros_num) {
                                                        r_zeros_number = 0;
-                                                        r_body =
+                                                        r_body = body + n_rem - zeros_num;
-                                                            body + n_rem -
-                                                            zeros_num;
                                                } else {
                                                        r_body = body;
-                                                        r_zeros_number =
+                                                        r_zeros_number = zeros_num - n_rem;
-                                                            zeros_num - n_rem;
+                                                        zeros_num -= r_zeros_number;
-                                                        zeros_num -=
-                                                            r_zeros_number;
                                                }
-                                                leaf_paste_in_buffer(&bi, 0,
+                                                leaf_paste_in_buffer(&bi, 0, n_shift,
-                                                                     n_shift,
+                                                                     tb->insert_size[0] - n_rem,
-                                                                     tb->
+                                                                     r_body, r_zeros_number);
-                                                                     insert_size
-                                                                     [0] -
-                                                                     n_rem,
-                                                                     r_body,
-                                                                     r_zeros_number);
                                                {
                                                        struct item_head *tmp;
-                                                        tmp =
+                                                        tmp = B_N_PITEM_HEAD(S_new[i], 0);
-                                                            B_N_PITEM_HEAD(S_new
-                                                                           [i],
-                                                                           0);
                                                        if (is_indirect_le_ih
                                                            (tmp)) {
-                                                                set_ih_free_space
+                                                                set_ih_free_space(tmp, 0);
-                                                                    (tmp, 0);
+                                                                set_le_ih_k_offset(tmp, le_ih_k_offset(tmp) + (n_rem << (tb->tb_sb->s_blocksize_bits - UNFM_P_SHIFT)));
-                                                                set_le_ih_k_offset
-                                                                    (tmp,
-                                                                     le_ih_k_offset
-                                                                     (tmp) +
-                                                                     (n_rem <<
-                                                                      (tb->
-                                                                       tb_sb->
-                                                                       s_blocksize_bits
-                                                                       -
-                                                                       UNFM_P_SHIFT)));
                                                        } else {
-                                                                set_le_ih_k_offset
+                                                                set_le_ih_k_offset(tmp, le_ih_k_offset(tmp) + n_rem);
-                                                                    (tmp,
-                                                                     le_ih_k_offset
-                                                                     (tmp) +
-                                                                     n_rem);
                                                        }
                                                }
@@ -1426,8 +973,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                        struct item_head *pasted;
 #ifdef CONFIG_REISERFS_CHECK
-                                        struct item_head *ih_check =
+                                        struct item_head *ih_check = B_N_PITEM_HEAD(tbS0, item_pos);
-                                            B_N_PITEM_HEAD(tbS0, item_pos);
                                        if (!is_direntry_le_ih(ih_check)
                                            && (pos_in_item != ih_item_len(ih_check)
@@ -1439,8 +985,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                                             "to ih_item_len");
 #endif                          /* CONFIG_REISERFS_CHECK */
-                                        leaf_mi =
+                                        leaf_mi = leaf_move_items(LEAF_FROM_S_TO_SNEW,
-                                            leaf_move_items(LEAF_FROM_S_TO_SNEW,
                                                            tb, snum[i],
                                                            sbytes[i],
                                                            S_new[i]);
@@ -1452,30 +997,19 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                        /* paste into item */
                                        buffer_info_init_bh(tb, &bi, S_new[i]);
                                        leaf_paste_in_buffer(&bi,
-                                                             item_pos - n +
+                                                             item_pos - n + snum[i],
-                                                             snum[i],
                                                             pos_in_item,
                                                             tb->insert_size[0],
                                                             body, zeros_num);
-                                        pasted =
+                                        pasted = B_N_PITEM_HEAD(S_new[i], item_pos - n + snum[i]);
-                                            B_N_PITEM_HEAD(S_new[i],
-                                                           item_pos - n +
-                                                           snum[i]);
                                        if (is_direntry_le_ih(pasted)) {
                                                leaf_paste_entries(&bi,
-                                                                   item_pos -
+                                                                   item_pos - n + snum[i],
-                                                                   n + snum[i],
+                                                                   pos_in_item, 1,
-                                                                   pos_in_item,
+                                                                   (struct reiserfs_de_head *)body,
-                                                                   1,
+                                                                   body + DEH_SIZE,
-                                                                   (struct
+                                                                   tb->insert_size[0]
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
                                                    );
                                        }
@@ -1495,11 +1029,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                default:        /* cases d and t */
                        reiserfs_panic(tb->tb_sb, "PAP-12245",
                                       "blknum > 2: unexpected mode: %s(%d)",
-                                       (flag ==
+                                       (flag == M_DELETE) ? "DELETE" : ((flag == M_CUT) ? "CUT" : "UNKNOWN"), flag);
-                                        M_DELETE) ? "DELETE" : ((flag ==
-                                                                 M_CUT) ? "CUT"
-                                                                : "UNKNOWN"),
-                                       flag);
                }
                memcpy(insert_key + i, B_N_PKEY(S_new[i], 0), KEY_SIZE);
@@ -1524,9 +1054,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                        /* If we insert the first key change the delimiting key */
                        if (item_pos == 0) {
                                if (tb->CFL[0]) /* can be 0 in reiserfsck */
-                                        replace_key(tb, tb->CFL[0], tb->lkey[0],
+                                        replace_key(tb, tb->CFL[0], tb->lkey[0], tbS0, 0);
-                                                    tbS0, 0);
                        }
                        break;
@@ -1536,53 +1064,27 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                pasted = B_N_PITEM_HEAD(tbS0, item_pos);
                                /* when directory, may be new entry already pasted */
                                if (is_direntry_le_ih(pasted)) {
-                                        if (pos_in_item >= 0 &&
+                                        if (pos_in_item >= 0 && pos_in_item <= ih_entry_count(pasted)) {
-                                            pos_in_item <=
-                                            ih_entry_count(pasted)) {
                                                RFALSE(!tb->insert_size[0],
                                                       "PAP-12260: insert_size is 0 already");
                                                /* prepare space */
                                                buffer_info_init_tbS0(tb, &bi);
-                                                leaf_paste_in_buffer(&bi,
+                                                leaf_paste_in_buffer(&bi, item_pos, pos_in_item,
-                                                                     item_pos,
+                                                                     tb->insert_size[0], body,
-                                                                     pos_in_item,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0], body,
                                                                     zeros_num);
                                                /* paste entry */
-                                                leaf_paste_entries(&bi,
+                                                leaf_paste_entries(&bi, item_pos, pos_in_item, 1,
-                                                                   item_pos,
+                                                                   (struct reiserfs_de_head *)body,
-                                                                   pos_in_item,
+                                                                   body + DEH_SIZE,
-                                                                   1,
+                                                                   tb->insert_size[0]);
-                                                                   (struct
-                                                                    reiserfs_de_head
-                                                                    *)body,
-                                                                   body +
-                                                                   DEH_SIZE,
-                                                                   tb->
-                                                                   insert_size
-                                                                   [0]
-                                                    );
                                                if (!item_pos && !pos_in_item) {
-                                                        RFALSE(!tb->CFL[0]
+                                                        RFALSE(!tb->CFL[0] || !tb->L[0],
-                                                               || !tb->L[0],
                                                               "PAP-12270: CFL[0]/L[0] must be specified");
-                                                        if (tb->CFL[0]) {
+                                                        if (tb->CFL[0])
-                                                                replace_key(tb,
+                                                                replace_key(tb, tb->CFL[0], tb->lkey[0], tbS0, 0);
-                                                                            tb->
-                                                                            CFL
-                                                                            [0],
-                                                                            tb->
-                                                                            lkey
-                                                                            [0],
-                                                                            tbS0,
-                                                                            0);
-                                                        }
                                                }
                                                tb->insert_size[0] = 0;
                                        }
@@ -1593,13 +1095,8 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                                       "PAP-12275: insert size must not be %d",
                                                       tb->insert_size[0]);
                                                buffer_info_init_tbS0(tb, &bi);
-                                                leaf_paste_in_buffer(&bi,
+                                                leaf_paste_in_buffer(&bi, item_pos, pos_in_item,
-                                                                     item_pos,
+                                                                     tb->insert_size[0], body, zeros_num);
-                                                                     pos_in_item,
-                                                                     tb->
-                                                                     insert_size
-                                                                     [0], body,
-                                                                     zeros_num);
                                                if (is_indirect_le_ih(pasted)) {
 #if 0
@@ -1611,8 +1108,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                                               tb->
                                                               insert_size[0]);
 #endif
-                                                        set_ih_free_space
+                                                        set_ih_free_space(pasted, 0);
-                                                            (pasted, 0);
                                                }
                                                tb->insert_size[0] = 0;
                                        }
@@ -1620,8 +1116,7 @@ static int balance_leaf(struct tree_balance *tb, struct item_head *ih,	/* item h
                                        else {
                                                if (tb->insert_size[0]) {
                                                        print_cur_tb("12285");
-                                                        reiserfs_panic(tb->
+                                                        reiserfs_panic(tb->tb_sb,
-                                                                       tb_sb,
                                                            "PAP-12285",
                                                            "insert_size "
                                                            "must be 0 "
diff --git a/fs/sync.c b/fs/sync.c
index e8ba024a055b..b28d1dd10e8b 100644
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -27,11 +27,10 @@
 * wait == 1 case since in that case write_inode() functions do
 * sync_dirty_buffer() and thus effectively write one block at a time.
 */
-static int __sync_filesystem(struct super_block *sb, int wait,
+static int __sync_filesystem(struct super_block *sb, int wait)
-                             unsigned long start)
 {
        if (wait)
-                sync_inodes_sb(sb, start);
+                sync_inodes_sb(sb);
        else
                writeback_inodes_sb(sb, WB_REASON_SYNC);
@@ -48,7 +47,6 @@ static int __sync_filesystem(struct super_block *sb, int wait,
 int sync_filesystem(struct super_block *sb)
 {
        int ret;
-        unsigned long start = jiffies;
        /*
         * We need to be protected against the filesystem going from
@@ -62,17 +60,17 @@ int sync_filesystem(struct super_block *sb)
        if (sb->s_flags & MS_RDONLY)
                return 0;
-        ret = __sync_filesystem(sb, 0, start);
+        ret = __sync_filesystem(sb, 0);
        if (ret < 0)
                return ret;
-        return __sync_filesystem(sb, 1, start);
+        return __sync_filesystem(sb, 1);
 }
 EXPORT_SYMBOL_GPL(sync_filesystem);
 static void sync_inodes_one_sb(struct super_block *sb, void *arg)
 {
        if (!(sb->s_flags & MS_RDONLY))
-                sync_inodes_sb(sb, *((unsigned long *)arg));
+                sync_inodes_sb(sb);
 }
 static void sync_fs_one_sb(struct super_block *sb, void *arg)
@@ -104,10 +102,9 @@ static void fdatawait_one_bdev(struct block_device *bdev, void *arg)
 SYSCALL_DEFINE0(sync)
 {
        int nowait = 0, wait = 1;
-        unsigned long start = jiffies;
        wakeup_flusher_threads(0, WB_REASON_SYNC);
-        iterate_supers(sync_inodes_one_sb, &start);
+        iterate_supers(sync_inodes_one_sb, NULL);
        iterate_supers(sync_fs_one_sb, &nowait);
        iterate_supers(sync_fs_one_sb, &wait);
        iterate_bdevs(fdatawrite_one_bdev, NULL);
diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index 6211230814fd..3eaf5c6622eb 100644
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -27,6 +27,7 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
 {
        struct dentry *root;
        void *ns;
+        bool new_sb;
        if (!(flags & MS_KERNMOUNT)) {
                if (!capable(CAP_SYS_ADMIN) && !fs_fully_visible(fs_type))
@@ -37,8 +38,8 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
        }
        ns = kobj_ns_grab_current(KOBJ_NS_TYPE_NET);
-        root = kernfs_mount_ns(fs_type, flags, sysfs_root, ns);
+        root = kernfs_mount_ns(fs_type, flags, sysfs_root, &new_sb, ns);
-        if (IS_ERR(root))
+        if (IS_ERR(root) || !new_sb)
                kobj_ns_drop(KOBJ_NS_TYPE_NET, ns);
        return root;
 }
diff --git a/fs/udf/file.c b/fs/udf/file.c
index c02a27a19c6d..1037637957c7 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -144,6 +144,7 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
        size_t count = iocb->ki_nbytes;
        struct udf_inode_info *iinfo = UDF_I(inode);
+        mutex_lock(&inode->i_mutex);
        down_write(&iinfo->i_data_sem);
        if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
                if (file->f_flags & O_APPEND)
@@ -156,6 +157,7 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
                                                pos + count)) {
                        err = udf_expand_file_adinicb(inode);
                        if (err) {
+                                mutex_unlock(&inode->i_mutex);
                                udf_debug("udf_expand_adinicb: err=%d\n", err);
                                return err;
                        }
@@ -169,9 +171,17 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
        } else
                up_write(&iinfo->i_data_sem);
-        retval = generic_file_aio_write(iocb, iov, nr_segs, ppos);
+        retval = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos);
-        if (retval > 0)
+        mutex_unlock(&inode->i_mutex);
+        if (retval > 0) {
+                ssize_t err;
                mark_inode_dirty(inode);
+                err = generic_write_sync(file, iocb->ki_pos - retval, retval);
+                if (err < 0)
+                        retval = err;
+        }
        return retval;
 }
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 062b7925bca0..982ce05c87ed 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -265,6 +265,7 @@ int udf_expand_file_adinicb(struct inode *inode)
                .nr_to_write = 1,
        };
+        WARN_ON_ONCE(!mutex_is_locked(&inode->i_mutex));
        if (!iinfo->i_lenAlloc) {
                if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_USE_SHORT_AD))
                        iinfo->i_alloc_type = ICBTAG_FLAG_AD_SHORT;
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index f35d5c953ff9..9ddfb8190ca1 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -705,7 +705,6 @@ xfs_setattr_size(
 {
        struct xfs_mount        *mp = ip->i_mount;
        struct inode            *inode = VFS_I(ip);
-        int                     mask = iattr->ia_valid;
        xfs_off_t               oldsize, newsize;
        struct xfs_trans        *tp;
        int                     error;
@@ -726,8 +725,8 @@ xfs_setattr_size(
        ASSERT(xfs_isilocked(ip, XFS_IOLOCK_EXCL));
        ASSERT(S_ISREG(ip->i_d.di_mode));
-        ASSERT((mask & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET|
+        ASSERT((iattr->ia_valid & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET|
-                        ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0);
+                ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0);
        oldsize = inode->i_size;
        newsize = iattr->ia_size;
@@ -736,7 +735,7 @@ xfs_setattr_size(
         * Short circuit the truncate case for zero length files.
         */
        if (newsize == 0 && oldsize == 0 && ip->i_d.di_nextents == 0) {
-                if (!(mask & (ATTR_CTIME|ATTR_MTIME)))
+                if (!(iattr->ia_valid & (ATTR_CTIME|ATTR_MTIME)))
                        return 0;
                /*
@@ -824,10 +823,11 @@ xfs_setattr_size(
         * these flags set.  For all other operations the VFS set these flags
         * explicitly if it wants a timestamp update.
         */
-        if (newsize != oldsize && (!(mask & (ATTR_CTIME | ATTR_MTIME)))) {
+        if (newsize != oldsize &&
+            !(iattr->ia_valid & (ATTR_CTIME | ATTR_MTIME))) {
                iattr->ia_ctime = iattr->ia_mtime =
                        current_fs_time(inode->i_sb);
-                mask |= ATTR_CTIME | ATTR_MTIME;
+                iattr->ia_valid |= ATTR_CTIME | ATTR_MTIME;
        }
        /*
@@ -863,9 +863,9 @@ xfs_setattr_size(
                xfs_inode_clear_eofblocks_tag(ip);
        }
-        if (mask & ATTR_MODE)
+        if (iattr->ia_valid & ATTR_MODE)
                xfs_setattr_mode(ip, iattr);
-        if (mask & (ATTR_ATIME|ATTR_CTIME|ATTR_MTIME))
+        if (iattr->ia_valid & (ATTR_ATIME|ATTR_CTIME|ATTR_MTIME))
                xfs_setattr_time(ip, iattr);
        xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index cdebd832c3db..4ef6fdbced78 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -205,16 +205,25 @@ xlog_cil_insert_format_items(
                /*
                 * We 64-bit align the length of each iovec so that the start
                 * of the next one is naturally aligned.  We'll need to
-                 * account for that slack space here.
+                 * account for that slack space here. Then round nbytes up
+                 * to 64-bit alignment so that the initial buffer alignment is
+                 * easy to calculate and verify.
                 */
                nbytes += niovecs * sizeof(uint64_t);
+                nbytes = round_up(nbytes, sizeof(uint64_t));
                /* grab the old item if it exists for reservation accounting */
                old_lv = lip->li_lv;
-                /* calc buffer size */
+                /*
-                buf_size = sizeof(struct xfs_log_vec) + nbytes +
+                 * The data buffer needs to start 64-bit aligned, so round up
-                                niovecs * sizeof(struct xfs_log_iovec);
+                 * that space to ensure we can align it appropriately and not
+                 * overrun the buffer.
+                 */
+                buf_size = nbytes +
+                           round_up((sizeof(struct xfs_log_vec) +
+                                     niovecs * sizeof(struct xfs_log_iovec)),
+                                    sizeof(uint64_t));
                /* compare to existing item size */
                if (lip->li_lv && buf_size <= lip->li_lv->lv_size) {
@@ -251,6 +260,8 @@ xlog_cil_insert_format_items(
                /* The allocated data region lies beyond the iovec region */
                lv->lv_buf_len = 0;
                lv->lv_buf = (char *)lv + buf_size - nbytes;
+                ASSERT(IS_ALIGNED((unsigned long)lv->lv_buf, sizeof(uint64_t)));
                lip->li_ops->iop_format(lip, lv);
 insert:
                ASSERT(lv->lv_buf_len <= nbytes);
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 02df7b408a26..f96c05669a9e 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -282,22 +282,29 @@ xfs_readsb(
        struct xfs_sb   *sbp = &mp->m_sb;
        int             error;
        int             loud = !(flags & XFS_MFSI_QUIET);
+        const struct xfs_buf_ops *buf_ops;
        ASSERT(mp->m_sb_bp == NULL);
        ASSERT(mp->m_ddev_targp != NULL);
        /*
+         * For the initial read, we must guess at the sector
+         * size based on the block device.  It's enough to
+         * get the sb_sectsize out of the superblock and
+         * then reread with the proper length.
+         * We don't verify it yet, because it may not be complete.
+         */
+        sector_size = xfs_getsize_buftarg(mp->m_ddev_targp);
+        buf_ops = NULL;
+        /*
         * Allocate a (locked) buffer to hold the superblock.
         * This will be kept around at all times to optimize
         * access to the superblock.
         */
-        sector_size = xfs_getsize_buftarg(mp->m_ddev_targp);
 reread:
        bp = xfs_buf_read_uncached(mp->m_ddev_targp, XFS_SB_DADDR,
-                                   BTOBB(sector_size), 0,
+                                   BTOBB(sector_size), 0, buf_ops);
-                                   loud ? &xfs_sb_buf_ops
-                                        : &xfs_sb_quiet_buf_ops);
        if (!bp) {
                if (loud)
                        xfs_warn(mp, "SB buffer read failed");
@@ -328,12 +335,13 @@ reread:
        }
        /*
-         * If device sector size is smaller than the superblock size,
+         * Re-read the superblock so the buffer is correctly sized,
-         * re-read the superblock so the buffer is correctly sized.
+         * and properly verified.
         */
-        if (sector_size < sbp->sb_sectsize) {
+        if (buf_ops == NULL) {
                xfs_buf_relse(bp);
                sector_size = sbp->sb_sectsize;
+                buf_ops = loud ? &xfs_sb_buf_ops : &xfs_sb_quiet_buf_ops;
                goto reread;
        }
diff --git a/fs/xfs/xfs_sb.c b/fs/xfs/xfs_sb.c
index b7c9aea77f8f..1e116794bb66 100644
--- a/fs/xfs/xfs_sb.c
+++ b/fs/xfs/xfs_sb.c
@@ -295,8 +295,7 @@ xfs_mount_validate_sb(
            sbp->sb_dblocks == 0                                        ||
            sbp->sb_dblocks > XFS_MAX_DBLOCKS(sbp)                      ||
            sbp->sb_dblocks < XFS_MIN_DBLOCKS(sbp))) {
-                XFS_CORRUPTION_ERROR("SB sanity check failed",
+                xfs_notice(mp, "SB sanity check failed");
-                                XFS_ERRLEVEL_LOW, mp, sbp);
                return XFS_ERROR(EFSCORRUPTED);
        }
@@ -611,10 +610,10 @@ xfs_sb_read_verify(
                                                XFS_SB_VERSION_5) ||
             dsb->sb_crc != 0)) {
-                if (!xfs_verify_cksum(bp->b_addr, be16_to_cpu(dsb->sb_sectsize),
+                if (!xfs_verify_cksum(bp->b_addr, BBTOB(bp->b_length),
                                      offsetof(struct xfs_sb, sb_crc))) {
                        /* Only fail bad secondaries on a known V5 filesystem */
-                        if (bp->b_bn != XFS_SB_DADDR &&
+                        if (bp->b_bn == XFS_SB_DADDR ||
                            xfs_sb_version_hascrc(&mp->m_sb)) {
                                error = EFSCORRUPTED;
                                goto out_error;
@@ -625,7 +624,7 @@ xfs_sb_read_verify(
 out_error:
        if (error) {
-                if (error != EWRONGFS)
+                if (error == EFSCORRUPTED)
                        XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW,
                                             mp, bp->b_addr);
                xfs_buf_ioerror(bp, error);
@@ -644,7 +643,6 @@ xfs_sb_quiet_read_verify(
 {
        struct xfs_dsb  *dsb = XFS_BUF_TO_SBP(bp);
        if (dsb->sb_magicnum == cpu_to_be32(XFS_SB_MAGIC)) {
                /* XFS filesystem, verify noisily! */
                xfs_sb_read_verify(bp);
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index f317488263dd..d971f4932b5d 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -913,7 +913,7 @@ xfs_flush_inodes(
        struct super_block      *sb = mp->m_super;
        if (down_read_trylock(&sb->s_umount)) {
-                sync_inodes_sb(sb, jiffies);
+                sync_inodes_sb(sb);
                up_read(&sb->s_umount);
        }
 }
author	Chris Zankel <chris@zankel.net>	2014-04-09 17:49:29 -0400
committer	Chris Zankel <chris@zankel.net>	2014-04-09 17:49:29 -0400
commit	e86c4b67feb2c984314eef71314f26cfe39fef36 (patch)
tree	3c5a7e2216cdcd1d06b8729bf94eba6dc74a7959 /fs
parent	b3fdfc1b4b641d372e35ced98814289bc60bc5d1 (diff)
parent	9c602629e34bad88a464e08de08118e80beee0d8 (diff)