Merge remote-tracking branch 'origin/master' into next

33 files changed, 406 insertions, 237 deletions

diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index d8d8e7ba6a1e..eb1cc92cd67d 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -110,6 +110,7 @@ struct autofs_sb_info {
         int sub_version;
         int min_proto;
         int max_proto;
+        int compat_daemon;
         unsigned long exp_timeout;
         unsigned int type;
         int reghost_enabled;
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 76741d8d7786..85f1fcdb30e7 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -385,6 +385,7 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
                 sbi->pipefd = pipefd;
                 sbi->pipe = pipe;
                 sbi->catatonic = 0;
+                sbi->compat_daemon = is_compat_task();
         }
 out:
         mutex_unlock(&sbi->wq_mutex);
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index e16980b00b8d..06858d955120 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -19,6 +19,7 @@
 #include <linux/parser.h>
 #include <linux/bitops.h>
 #include <linux/magic.h>
+#include <linux/compat.h>
 #include "autofs_i.h"
 #include <linux/module.h>
 
@@ -224,6 +225,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
         set_autofs_type_indirect(&sbi->type);
         sbi->min_proto = 0;
         sbi->max_proto = 0;
+        sbi->compat_daemon = is_compat_task();
         mutex_init(&sbi->wq_mutex);
         mutex_init(&sbi->pipe_mutex);
         spin_lock_init(&sbi->fs_lock);
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index da8876d38a7b..9c098db43344 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -91,7 +91,24 @@ static int autofs4_write(struct autofs_sb_info *sbi,
 
         return (bytes > 0);
 }
-        
+
+/*
+ * The autofs_v5 packet was misdesigned.
+ *
+ * The packets are identical on x86-32 and x86-64, but have different
+ * alignment. Which means that 'sizeof()' will give different results.
+ * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
+ */
+static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
+{
+        size_t pktsz = sizeof(struct autofs_v5_packet);
+#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
+        if (sbi->compat_daemon > 0)
+                pktsz -= 4;
+#endif
+        return pktsz;
+}
+
 static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
                                  struct autofs_wait_queue *wq,
                                  int type)
@@ -155,8 +172,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
         {
                 struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
 
-                pktsz = sizeof(*packet);
-
+                pktsz = autofs_v5_packet_size(sbi);
                 packet->wait_queue_token = wq->wait_queue_token;
                 packet->len = wq->name.len;
                 memcpy(packet->name, wq->name.name, wq->name.len);
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 633c701a287d..98f6bf10bbd4 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -892,6 +892,8 @@ static char *iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                 if (eb != eb_in)
                         free_extent_buffer(eb);
                 ret = inode_ref_info(parent, 0, fs_root, path, &found_key);
+                if (ret > 0)
+                        ret = -ENOENT;
                 if (ret)
                         break;
                 next_inum = found_key.offset;
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index b669a7d8e499..d986824bb2b4 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -644,7 +644,7 @@ static struct btrfsic_dev_state *btrfsic_dev_state_hashtable_lookup(
 static int btrfsic_process_superblock(struct btrfsic_state *state,
                                       struct btrfs_fs_devices *fs_devices)
 {
-        int ret;
+        int ret = 0;
         struct btrfs_super_block *selected_super;
         struct list_head *dev_head = &fs_devices->devices;
         struct btrfs_device *device;
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 14f1c5a0b2d2..d02c27cd14c7 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -588,6 +588,8 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
                                    page_offset(bio->bi_io_vec->bv_page),
                                    PAGE_CACHE_SIZE);
         read_unlock(&em_tree->lock);
+        if (!em)
+                return -EIO;
 
         compressed_len = em->block_len;
         cb = kmalloc(compressed_bio_size(root, compressed_len), GFP_NOFS);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 27ebe61d3ccc..80b6486fd5e6 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -886,7 +886,7 @@ struct btrfs_block_rsv {
         u64 reserved;
         struct btrfs_space_info *space_info;
         spinlock_t lock;
-        unsigned int full:1;
+        unsigned int full;
 };
 
 /*
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 811d9f918b1c..534266fe505f 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2260,6 +2260,12 @@ int open_ctree(struct super_block *sb,
                 goto fail_sb_buffer;
         }
 
+        if (sectorsize < PAGE_SIZE) {
+                printk(KERN_WARNING "btrfs: Incompatible sector size "
+                       "found on %s\n", sb->s_id);
+                goto fail_sb_buffer;
+        }
+
         mutex_lock(&fs_info->chunk_mutex);
         ret = btrfs_read_sys_array(tree_root);
         mutex_unlock(&fs_info->chunk_mutex);
@@ -2301,6 +2307,12 @@ int open_ctree(struct super_block *sb,
 
         btrfs_close_extra_devices(fs_devices);
 
+        if (!fs_devices->latest_bdev) {
+                printk(KERN_CRIT "btrfs: failed to read devices on %s\n",
+                       sb->s_id);
+                goto fail_tree_roots;
+        }
+
 retry_root_backup:
         blocksize = btrfs_level_size(tree_root,
                                      btrfs_super_root_level(disk_super));
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 283af7a676a3..37e0a800d34e 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3312,7 +3312,8 @@ commit_trans:
         }
         data_sinfo->bytes_may_use += bytes;
         trace_btrfs_space_reservation(root->fs_info, "space_info",
-                                      (u64)data_sinfo, bytes, 1);
+                                      (u64)(unsigned long)data_sinfo,
+                                      bytes, 1);
         spin_unlock(&data_sinfo->lock);
 
         return 0;
@@ -3333,7 +3334,8 @@ void btrfs_free_reserved_data_space(struct inode *inode, u64 bytes)
         spin_lock(&data_sinfo->lock);
         data_sinfo->bytes_may_use -= bytes;
         trace_btrfs_space_reservation(root->fs_info, "space_info",
-                                      (u64)data_sinfo, bytes, 0);
+                                      (u64)(unsigned long)data_sinfo,
+                                      bytes, 0);
         spin_unlock(&data_sinfo->lock);
 }
 
@@ -3611,12 +3613,15 @@ static int may_commit_transaction(struct btrfs_root *root,
         if (space_info != delayed_rsv->space_info)
                 return -ENOSPC;
 
+        spin_lock(&space_info->lock);
         spin_lock(&delayed_rsv->lock);
-        if (delayed_rsv->size < bytes) {
+        if (space_info->bytes_pinned + delayed_rsv->size < bytes) {
                 spin_unlock(&delayed_rsv->lock);
+                spin_unlock(&space_info->lock);
                 return -ENOSPC;
         }
         spin_unlock(&delayed_rsv->lock);
+        spin_unlock(&space_info->lock);
 
 commit:
         trans = btrfs_join_transaction(root);
@@ -3695,9 +3700,9 @@ again:
                 if (used + orig_bytes <= space_info->total_bytes) {
                         space_info->bytes_may_use += orig_bytes;
                         trace_btrfs_space_reservation(root->fs_info,
-                                                      "space_info",
-                                                      (u64)space_info,
-                                                      orig_bytes, 1);
+                                              "space_info",
+                                              (u64)(unsigned long)space_info,
+                                              orig_bytes, 1);
                         ret = 0;
                 } else {
                         /*
@@ -3766,9 +3771,9 @@ again:
                 if (used + num_bytes < space_info->total_bytes + avail) {
                         space_info->bytes_may_use += orig_bytes;
                         trace_btrfs_space_reservation(root->fs_info,
-                                                      "space_info",
-                                                      (u64)space_info,
-                                                      orig_bytes, 1);
+                                              "space_info",
+                                              (u64)(unsigned long)space_info,
+                                              orig_bytes, 1);
                         ret = 0;
                 } else {
                         wait_ordered = true;
@@ -3913,8 +3918,8 @@ static void block_rsv_release_bytes(struct btrfs_fs_info *fs_info,
                         spin_lock(&space_info->lock);
                         space_info->bytes_may_use -= num_bytes;
                         trace_btrfs_space_reservation(fs_info, "space_info",
-                                                      (u64)space_info,
-                                                      num_bytes, 0);
+                                              (u64)(unsigned long)space_info,
+                                              num_bytes, 0);
                         space_info->reservation_progress++;
                         spin_unlock(&space_info->lock);
                 }
@@ -4105,7 +4110,7 @@ static u64 calc_global_metadata_size(struct btrfs_fs_info *fs_info)
         num_bytes += div64_u64(data_used + meta_used, 50);
 
         if (num_bytes * 3 > meta_used)
-                num_bytes = div64_u64(meta_used, 3);
+                num_bytes = div64_u64(meta_used, 3) * 2;
 
         return ALIGN(num_bytes, fs_info->extent_root->leafsize << 10);
 }
@@ -4132,14 +4137,14 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
                 block_rsv->reserved += num_bytes;
                 sinfo->bytes_may_use += num_bytes;
                 trace_btrfs_space_reservation(fs_info, "space_info",
-                                              (u64)sinfo, num_bytes, 1);
+                                      (u64)(unsigned long)sinfo, num_bytes, 1);
         }
 
         if (block_rsv->reserved >= block_rsv->size) {
                 num_bytes = block_rsv->reserved - block_rsv->size;
                 sinfo->bytes_may_use -= num_bytes;
                 trace_btrfs_space_reservation(fs_info, "space_info",
-                                              (u64)sinfo, num_bytes, 0);
+                                      (u64)(unsigned long)sinfo, num_bytes, 0);
                 sinfo->reservation_progress++;
                 block_rsv->reserved = block_rsv->size;
                 block_rsv->full = 1;
@@ -4192,7 +4197,8 @@ void btrfs_trans_release_metadata(struct btrfs_trans_handle *trans,
         if (!trans->bytes_reserved)
                 return;
 
-        trace_btrfs_space_reservation(root->fs_info, "transaction", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "transaction",
+                                      (u64)(unsigned long)trans,
                                       trans->bytes_reserved, 0);
         btrfs_block_rsv_release(root, trans->block_rsv, trans->bytes_reserved);
         trans->bytes_reserved = 0;
@@ -4710,9 +4716,9 @@ static int btrfs_update_reserved_bytes(struct btrfs_block_group_cache *cache,
                         space_info->bytes_reserved += num_bytes;
                         if (reserve == RESERVE_ALLOC) {
                                 trace_btrfs_space_reservation(cache->fs_info,
-                                                              "space_info",
-                                                              (u64)space_info,
-                                                              num_bytes, 0);
+                                              "space_info",
+                                              (u64)(unsigned long)space_info,
+                                              num_bytes, 0);
                                 space_info->bytes_may_use -= num_bytes;
                         }
                 }
@@ -7886,9 +7892,16 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range)
         u64 start;
         u64 end;
         u64 trimmed = 0;
+        u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
         int ret = 0;
 
-        cache = btrfs_lookup_block_group(fs_info, range->start);
+        /*
+         * try to trim all FS space, our block group may start from non-zero.
+         */
+        if (range->len == total_bytes)
+                cache = btrfs_lookup_first_block_group(fs_info, range->start);
+        else
+                cache = btrfs_lookup_block_group(fs_info, range->start);
 
         while (cache) {
                 if (cache->key.objectid >= (range->start + range->len)) {
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index fcf77e1ded40..a55fbe6252de 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -513,6 +513,15 @@ hit_next:
         WARN_ON(state->end < start);
         last_end = state->end;
 
+        if (state->end < end && !need_resched())
+                next_node = rb_next(&state->rb_node);
+        else
+                next_node = NULL;
+
+        /* the state doesn't have the wanted bits, go ahead */
+        if (!(state->state & bits))
+                goto next;
+
         /*
          *     | ---- desired range ---- |
          *  | state | or
@@ -565,20 +574,15 @@ hit_next:
                 goto out;
         }
 
-        if (state->end < end && prealloc && !need_resched())
-                next_node = rb_next(&state->rb_node);
-        else
-                next_node = NULL;
-
         set |= clear_state_bit(tree, state, &bits, wake);
+next:
         if (last_end == (u64)-1)
                 goto out;
         start = last_end + 1;
         if (start <= end && next_node) {
                 state = rb_entry(next_node, struct extent_state,
                                  rb_node);
-                if (state->start == start)
-                        goto hit_next;
+                goto hit_next;
         }
         goto search_again;
 
@@ -961,8 +965,6 @@ hit_next:
 
                 set_state_bits(tree, state, &bits);
                 clear_state_bit(tree, state, &clear_bits, 0);
-
-                merge_state(tree, state);
                 if (last_end == (u64)-1)
                         goto out;
 
@@ -1007,7 +1009,6 @@ hit_next:
                 if (state->end <= end) {
                         set_state_bits(tree, state, &bits);
                         clear_state_bit(tree, state, &clear_bits, 0);
-                        merge_state(tree, state);
                         if (last_end == (u64)-1)
                                 goto out;
                         start = last_end + 1;
@@ -1068,8 +1069,6 @@ hit_next:
 
                 set_state_bits(tree, prealloc, &bits);
                 clear_state_bit(tree, prealloc, &clear_bits, 0);
-
-                merge_state(tree, prealloc);
                 prealloc = NULL;
                 goto out;
         }
@@ -2154,13 +2153,46 @@ static int bio_readpage_error(struct bio *failed_bio, struct page *page,
                  "this_mirror=%d, num_copies=%d, in_validation=%d\n", read_mode,
                  failrec->this_mirror, num_copies, failrec->in_validation);
 
-        tree->ops->submit_bio_hook(inode, read_mode, bio, failrec->this_mirror,
-                                        failrec->bio_flags, 0);
-        return 0;
+        ret = tree->ops->submit_bio_hook(inode, read_mode, bio,
+                                         failrec->this_mirror,
+                                         failrec->bio_flags, 0);
+        return ret;
 }
 
 /* lots and lots of room for performance fixes in the end_bio funcs */
 
+int end_extent_writepage(struct page *page, int err, u64 start, u64 end)
+{
+        int uptodate = (err == 0);
+        struct extent_io_tree *tree;
+        int ret;
+
+        tree = &BTRFS_I(page->mapping->host)->io_tree;
+
+        if (tree->ops && tree->ops->writepage_end_io_hook) {
+                ret = tree->ops->writepage_end_io_hook(page, start,
+                                               end, NULL, uptodate);
+                if (ret)
+                        uptodate = 0;
+        }
+
+        if (!uptodate && tree->ops &&
+            tree->ops->writepage_io_failed_hook) {
+                ret = tree->ops->writepage_io_failed_hook(NULL, page,
+                                                 start, end, NULL);
+                /* Writeback already completed */
+                if (ret == 0)
+                        return 1;
+        }
+
+        if (!uptodate) {
+                clear_extent_uptodate(tree, start, end, NULL, GFP_NOFS);
+                ClearPageUptodate(page);
+                SetPageError(page);
+        }
+        return 0;
+}
+
 /*
  * after a writepage IO is done, we need to:
  * clear the uptodate bits on error
@@ -2172,13 +2204,11 @@ static int bio_readpage_error(struct bio *failed_bio, struct page *page,
  */
 static void end_bio_extent_writepage(struct bio *bio, int err)
 {
-        int uptodate = err == 0;
         struct bio_vec *bvec = bio->bi_io_vec + bio->bi_vcnt - 1;
         struct extent_io_tree *tree;
         u64 start;
         u64 end;
         int whole_page;
-        int ret;
 
         do {
                 struct page *page = bvec->bv_page;
@@ -2195,28 +2225,9 @@ static void end_bio_extent_writepage(struct bio *bio, int err)
 
                 if (--bvec >= bio->bi_io_vec)
                         prefetchw(&bvec->bv_page->flags);
-                if (tree->ops && tree->ops->writepage_end_io_hook) {
-                        ret = tree->ops->writepage_end_io_hook(page, start,
-                                                       end, NULL, uptodate);
-                        if (ret)
-                                uptodate = 0;
-                }
-
-                if (!uptodate && tree->ops &&
-                    tree->ops->writepage_io_failed_hook) {
-                        ret = tree->ops->writepage_io_failed_hook(bio, page,
-                                                         start, end, NULL);
-                        if (ret == 0) {
-                                uptodate = (err == 0);
-                                continue;
-                        }
-                }
 
-                if (!uptodate) {
-                        clear_extent_uptodate(tree, start, end, NULL, GFP_NOFS);
-                        ClearPageUptodate(page);
-                        SetPageError(page);
-                }
+                if (end_extent_writepage(page, err, start, end))
+                        continue;
 
                 if (whole_page)
                         end_page_writeback(page);
@@ -2779,9 +2790,12 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
                                 delalloc_start = delalloc_end + 1;
                                 continue;
                         }
-                        tree->ops->fill_delalloc(inode, page, delalloc_start,
-                                                 delalloc_end, &page_started,
-                                                 &nr_written);
+                        ret = tree->ops->fill_delalloc(inode, page,
+                                                       delalloc_start,
+                                                       delalloc_end,
+                                                       &page_started,
+                                                       &nr_written);
+                        BUG_ON(ret);
                         /*
                          * delalloc_end is already one less than the total
                          * length, so we don't subtract one from
@@ -2818,8 +2832,12 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
         if (tree->ops && tree->ops->writepage_start_hook) {
                 ret = tree->ops->writepage_start_hook(page, start,
                                                       page_end);
-                if (ret == -EAGAIN) {
-                        redirty_page_for_writepage(wbc, page);
+                if (ret) {
+                        /* Fixup worker will requeue */
+                        if (ret == -EBUSY)
+                                wbc->pages_skipped++;
+                        else
+                                redirty_page_for_writepage(wbc, page);
                         update_nr_written(page, wbc, nr_written);
                         unlock_page(page);
                         ret = 0;
@@ -3289,7 +3307,7 @@ int try_release_extent_mapping(struct extent_map_tree *map,
                         len = end - start + 1;
                         write_lock(&map->lock);
                         em = lookup_extent_mapping(map, start, len);
-                        if (IS_ERR_OR_NULL(em)) {
+                        if (!em) {
                                 write_unlock(&map->lock);
                                 break;
                         }
@@ -3853,10 +3871,9 @@ int clear_extent_buffer_uptodate(struct extent_io_tree *tree,
         num_pages = num_extent_pages(eb->start, eb->len);
         clear_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
 
-        if (eb_straddles_pages(eb)) {
-                clear_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
-                                      cached_state, GFP_NOFS);
-        }
+        clear_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
+                              cached_state, GFP_NOFS);
+
         for (i = 0; i < num_pages; i++) {
                 page = extent_buffer_page(eb, i);
                 if (page)
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index bc6a042cb6fc..cecc3518c121 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -319,4 +319,5 @@ struct btrfs_mapping_tree;
 int repair_io_failure(struct btrfs_mapping_tree *map_tree, u64 start,
                         u64 length, u64 logical, struct page *page,
                         int mirror_num);
+int end_extent_writepage(struct page *page, int err, u64 start, u64 end);
 #endif
diff --git a/fs/btrfs/extent_map.h b/fs/btrfs/extent_map.h
index 33a7890b1f40..1195f09761fe 100644
--- a/fs/btrfs/extent_map.h
+++ b/fs/btrfs/extent_map.h
@@ -26,8 +26,8 @@ struct extent_map {
         unsigned long flags;
         struct block_device *bdev;
         atomic_t refs;
-        unsigned int in_tree:1;
-        unsigned int compress_type:4;
+        unsigned int in_tree;
+        unsigned int compress_type;
 };
 
 struct extent_map_tree {
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 859ba2dd8890..e8d06b6b9194 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1605,6 +1605,14 @@ static long btrfs_fallocate(struct file *file, int mode,
                 return -EOPNOTSUPP;
 
         /*
+         * Make sure we have enough space before we do the
+         * allocation.
+         */
+        ret = btrfs_check_data_free_space(inode, len);
+        if (ret)
+                return ret;
+
+        /*
          * wait for ordered IO before we have any locks.  We'll loop again
          * below with the locks held.
          */
@@ -1667,27 +1675,12 @@ static long btrfs_fallocate(struct file *file, int mode,
                 if (em->block_start == EXTENT_MAP_HOLE ||
                     (cur_offset >= inode->i_size &&
                      !test_bit(EXTENT_FLAG_PREALLOC, &em->flags))) {
-
-                        /*
-                         * Make sure we have enough space before we do the
-                         * allocation.
-                         */
-                        ret = btrfs_check_data_free_space(inode, last_byte -
-                                                          cur_offset);
-                        if (ret) {
-                                free_extent_map(em);
-                                break;
-                        }
-
                         ret = btrfs_prealloc_file_range(inode, mode, cur_offset,
                                                         last_byte - cur_offset,
                                                         1 << inode->i_blkbits,
                                                         offset + len,
                                                         &alloc_hint);
 
-                        /* Let go of our reservation. */
-                        btrfs_free_reserved_data_space(inode, last_byte -
-                                                       cur_offset);
                         if (ret < 0) {
                                 free_extent_map(em);
                                 break;
@@ -1715,6 +1708,8 @@ static long btrfs_fallocate(struct file *file, int mode,
                              &cached_state, GFP_NOFS);
 out:
         mutex_unlock(&inode->i_mutex);
+        /* Let go of our reservation. */
+        btrfs_free_reserved_data_space(inode, len);
         return ret;
 }
 
@@ -1761,7 +1756,7 @@ static int find_desired_extent(struct inode *inode, loff_t *offset, int origin)
                                                      start - root->sectorsize,
                                                      root->sectorsize, 0);
                 if (IS_ERR(em)) {
-                        ret = -ENXIO;
+                        ret = PTR_ERR(em);
                         goto out;
                 }
                 last_end = em->start + em->len;
@@ -1773,7 +1768,7 @@ static int find_desired_extent(struct inode *inode, loff_t *offset, int origin)
         while (1) {
                 em = btrfs_get_extent_fiemap(inode, NULL, 0, start, len, 0);
                 if (IS_ERR(em)) {
-                        ret = -ENXIO;
+                        ret = PTR_ERR(em);
                         break;
                 }
 
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index c2f20594c9f7..710ea380c7ed 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -777,6 +777,7 @@ int load_free_space_cache(struct btrfs_fs_info *fs_info,
         spin_lock(&block_group->lock);
         if (block_group->disk_cache_state != BTRFS_DC_WRITTEN) {
                 spin_unlock(&block_group->lock);
+                btrfs_free_path(path);
                 goto out;
         }
         spin_unlock(&block_group->lock);
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index 213ffa86ce1b..ee15d88b33d2 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -438,7 +438,8 @@ int btrfs_save_ino_cache(struct btrfs_root *root,
                                           trans->bytes_reserved);
         if (ret)
                 goto out;
-        trace_btrfs_space_reservation(root->fs_info, "ino_cache", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "ino_cache",
+                                      (u64)(unsigned long)trans,
                                       trans->bytes_reserved, 1);
 again:
         inode = lookup_free_ino_inode(root, path);
@@ -500,7 +501,8 @@ again:
 out_put:
         iput(inode);
 out_release:
-        trace_btrfs_space_reservation(root->fs_info, "ino_cache", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "ino_cache",
+                                      (u64)(unsigned long)trans,
                                       trans->bytes_reserved, 0);
         btrfs_block_rsv_release(root, trans->block_rsv, trans->bytes_reserved);
 out:
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 32214fe0f7e3..892b34785ccc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1555,6 +1555,7 @@ static void btrfs_writepage_fixup_worker(struct btrfs_work *work)
         struct inode *inode;
         u64 page_start;
         u64 page_end;
+        int ret;
 
         fixup = container_of(work, struct btrfs_writepage_fixup, work);
         page = fixup->page;
@@ -1582,12 +1583,21 @@ again:
                                      page_end, &cached_state, GFP_NOFS);
                 unlock_page(page);
                 btrfs_start_ordered_extent(inode, ordered, 1);
+                btrfs_put_ordered_extent(ordered);
                 goto again;
         }
 
-        BUG();
+        ret = btrfs_delalloc_reserve_space(inode, PAGE_CACHE_SIZE);
+        if (ret) {
+                mapping_set_error(page->mapping, ret);
+                end_extent_writepage(page, ret, page_start, page_end);
+                ClearPageChecked(page);
+                goto out;
+         }
+
         btrfs_set_extent_delalloc(inode, page_start, page_end, &cached_state);
         ClearPageChecked(page);
+        set_page_dirty(page);
 out:
         unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end,
                              &cached_state, GFP_NOFS);
@@ -1630,7 +1640,7 @@ static int btrfs_writepage_start_hook(struct page *page, u64 start, u64 end)
         fixup->work.func = btrfs_writepage_fixup_worker;
         fixup->page = page;
         btrfs_queue_worker(&root->fs_info->fixup_workers, &fixup->work);
-        return -EAGAIN;
+        return -EBUSY;
 }
 
 static int insert_reserved_file_extent(struct btrfs_trans_handle *trans,
@@ -4575,7 +4585,8 @@ int btrfs_add_link(struct btrfs_trans_handle *trans,
                 ret = btrfs_insert_dir_item(trans, root, name, name_len,
                                             parent_inode, &key,
                                             btrfs_inode_type(inode), index);
-                BUG_ON(ret);
+                if (ret)
+                        goto fail_dir_item;
 
                 btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                    name_len * 2);
@@ -4583,6 +4594,23 @@ int btrfs_add_link(struct btrfs_trans_handle *trans,
                 ret = btrfs_update_inode(trans, root, parent_inode);
         }
         return ret;
+
+fail_dir_item:
+        if (unlikely(ino == BTRFS_FIRST_FREE_OBJECTID)) {
+                u64 local_index;
+                int err;
+                err = btrfs_del_root_ref(trans, root->fs_info->tree_root,
+                                 key.objectid, root->root_key.objectid,
+                                 parent_ino, &local_index, name, name_len);
+
+        } else if (add_backref) {
+                u64 local_index;
+                int err;
+
+                err = btrfs_del_inode_ref(trans, root, name, name_len,
+                                          ino, parent_ino, &local_index);
+        }
+        return ret;
 }
 
 static int btrfs_add_nondir(struct btrfs_trans_handle *trans,
@@ -6696,8 +6724,10 @@ int btrfs_create_subvol_root(struct btrfs_trans_handle *trans,
         int err;
         u64 index = 0;
 
-        inode = btrfs_new_inode(trans, new_root, NULL, "..", 2, new_dirid,
-                                new_dirid, S_IFDIR | 0700, &index);
+        inode = btrfs_new_inode(trans, new_root, NULL, "..", 2,
+                                new_dirid, new_dirid,
+                                S_IFDIR | (~current_umask() & S_IRWXUGO),
+                                &index);
         if (IS_ERR(inode))
                 return PTR_ERR(inode);
         inode->i_op = &btrfs_dir_inode_operations;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 03bb62a9ee24..d8b54715c2de 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -861,6 +861,7 @@ static int cluster_pages_for_defrag(struct inode *inode,
         int i_done;
         struct btrfs_ordered_extent *ordered;
         struct extent_state *cached_state = NULL;
+        struct extent_io_tree *tree;
         gfp_t mask = btrfs_alloc_write_mask(inode->i_mapping);
 
         if (isize == 0)
@@ -871,18 +872,34 @@ static int cluster_pages_for_defrag(struct inode *inode,
                                            num_pages << PAGE_CACHE_SHIFT);
         if (ret)
                 return ret;
-again:
-        ret = 0;
         i_done = 0;
+        tree = &BTRFS_I(inode)->io_tree;
 
         /* step one, lock all the pages */
         for (i = 0; i < num_pages; i++) {
                 struct page *page;
+again:
                 page = find_or_create_page(inode->i_mapping,
-                                            start_index + i, mask);
+                                           start_index + i, mask);
                 if (!page)
                         break;
 
+                page_start = page_offset(page);
+                page_end = page_start + PAGE_CACHE_SIZE - 1;
+                while (1) {
+                        lock_extent(tree, page_start, page_end, GFP_NOFS);
+                        ordered = btrfs_lookup_ordered_extent(inode,
+                                                              page_start);
+                        unlock_extent(tree, page_start, page_end, GFP_NOFS);
+                        if (!ordered)
+                                break;
+
+                        unlock_page(page);
+                        btrfs_start_ordered_extent(inode, ordered, 1);
+                        btrfs_put_ordered_extent(ordered);
+                        lock_page(page);
+                }
+
                 if (!PageUptodate(page)) {
                         btrfs_readpage(NULL, page);
                         lock_page(page);
@@ -893,15 +910,22 @@ again:
                                 break;
                         }
                 }
+
                 isize = i_size_read(inode);
                 file_end = (isize - 1) >> PAGE_CACHE_SHIFT;
-                if (!isize || page->index > file_end ||
-                    page->mapping != inode->i_mapping) {
+                if (!isize || page->index > file_end) {
                         /* whoops, we blew past eof, skip this page */
                         unlock_page(page);
                         page_cache_release(page);
                         break;
                 }
+
+                if (page->mapping != inode->i_mapping) {
+                        unlock_page(page);
+                        page_cache_release(page);
+                        goto again;
+                }
+
                 pages[i] = page;
                 i_done++;
         }
@@ -924,25 +948,6 @@ again:
         lock_extent_bits(&BTRFS_I(inode)->io_tree,
                          page_start, page_end - 1, 0, &cached_state,
                          GFP_NOFS);
-        ordered = btrfs_lookup_first_ordered_extent(inode, page_end - 1);
-        if (ordered &&
-            ordered->file_offset + ordered->len > page_start &&
-            ordered->file_offset < page_end) {
-                btrfs_put_ordered_extent(ordered);
-                unlock_extent_cached(&BTRFS_I(inode)->io_tree,
-                                     page_start, page_end - 1,
-                                     &cached_state, GFP_NOFS);
-                for (i = 0; i < i_done; i++) {
-                        unlock_page(pages[i]);
-                        page_cache_release(pages[i]);
-                }
-                btrfs_wait_ordered_range(inode, page_start,
-                                         page_end - page_start);
-                goto again;
-        }
-        if (ordered)
-                btrfs_put_ordered_extent(ordered);
-
         clear_extent_bit(&BTRFS_I(inode)->io_tree, page_start,
                           page_end - 1, EXTENT_DIRTY | EXTENT_DELALLOC |
                           EXTENT_DO_ACCOUNTING, 0, 0, &cached_state,
@@ -1327,6 +1332,12 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
                 goto out;
         }
 
+        if (name[0] == '.' &&
+           (namelen == 1 || (name[1] == '.' && namelen == 2))) {
+                ret = -EEXIST;
+                goto out;
+        }
+
         if (subvol) {
                 ret = btrfs_mksubvol(&file->f_path, name, namelen,
                                      NULL, transid, readonly);
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 9770cc5bfb76..abc0fbffa510 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -1367,7 +1367,8 @@ out:
 }
 
 static noinline_for_stack int scrub_chunk(struct scrub_dev *sdev,
-        u64 chunk_tree, u64 chunk_objectid, u64 chunk_offset, u64 length)
+        u64 chunk_tree, u64 chunk_objectid, u64 chunk_offset, u64 length,
+        u64 dev_offset)
 {
         struct btrfs_mapping_tree *map_tree =
                 &sdev->dev->dev_root->fs_info->mapping_tree;
@@ -1391,7 +1392,8 @@ static noinline_for_stack int scrub_chunk(struct scrub_dev *sdev,
                 goto out;
 
         for (i = 0; i < map->num_stripes; ++i) {
-                if (map->stripes[i].dev == sdev->dev) {
+                if (map->stripes[i].dev == sdev->dev &&
+                    map->stripes[i].physical == dev_offset) {
                         ret = scrub_stripe(sdev, map, i, chunk_offset, length);
                         if (ret)
                                 goto out;
@@ -1487,7 +1489,7 @@ int scrub_enumerate_chunks(struct scrub_dev *sdev, u64 start, u64 end)
                         break;
                 }
                 ret = scrub_chunk(sdev, chunk_tree, chunk_objectid,
-                                  chunk_offset, length);
+                                  chunk_offset, length, found_key.offset);
                 btrfs_put_block_group(cache);
                 if (ret)
                         break;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 287a6728b1ad..04b77e3ceb7a 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -327,7 +327,8 @@ again:
 
         if (num_bytes) {
                 trace_btrfs_space_reservation(root->fs_info, "transaction",
-                                              (u64)h, num_bytes, 1);
+                                              (u64)(unsigned long)h,
+                                              num_bytes, 1);
                 h->block_rsv = &root->fs_info->trans_block_rsv;
                 h->bytes_reserved = num_bytes;
         }
@@ -915,7 +916,11 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
                                 dentry->d_name.name, dentry->d_name.len,
                                 parent_inode, &key,
                                 BTRFS_FT_DIR, index);
-        BUG_ON(ret);
+        if (ret) {
+                pending->error = -EEXIST;
+                dput(parent);
+                goto fail;
+        }
 
         btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                          dentry->d_name.len * 2);
@@ -993,12 +998,9 @@ static noinline int create_pending_snapshots(struct btrfs_trans_handle *trans,
 {
         struct btrfs_pending_snapshot *pending;
         struct list_head *head = &trans->transaction->pending_snapshots;
-        int ret;
 
-        list_for_each_entry(pending, head, list) {
-                ret = create_pending_snapshot(trans, fs_info, pending);
-                BUG_ON(ret);
-        }
+        list_for_each_entry(pending, head, list)
+                create_pending_snapshot(trans, fs_info, pending);
         return 0;
 }
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 0b4e2af7954d..ef41f285a475 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -459,12 +459,23 @@ int btrfs_close_extra_devices(struct btrfs_fs_devices *fs_devices)
 {
         struct btrfs_device *device, *next;
 
+        struct block_device *latest_bdev = NULL;
+        u64 latest_devid = 0;
+        u64 latest_transid = 0;
+
         mutex_lock(&uuid_mutex);
 again:
         /* This is the initialized path, it is safe to release the devices. */
         list_for_each_entry_safe(device, next, &fs_devices->devices, dev_list) {
-                if (device->in_fs_metadata)
+                if (device->in_fs_metadata) {
+                        if (!latest_transid ||
+                            device->generation > latest_transid) {
+                                latest_devid = device->devid;
+                                latest_transid = device->generation;
+                                latest_bdev = device->bdev;
+                        }
                         continue;
+                }
 
                 if (device->bdev) {
                         blkdev_put(device->bdev, device->mode);
@@ -487,6 +498,10 @@ again:
                 goto again;
         }
 
+        fs_devices->latest_bdev = latest_bdev;
+        fs_devices->latest_devid = latest_devid;
+        fs_devices->latest_trans = latest_transid;
+
         mutex_unlock(&uuid_mutex);
         return 0;
 }
@@ -1953,7 +1968,7 @@ static int btrfs_relocate_chunk(struct btrfs_root *root,
         em = lookup_extent_mapping(em_tree, chunk_offset, 1);
         read_unlock(&em_tree->lock);
 
-        BUG_ON(em->start > chunk_offset ||
+        BUG_ON(!em || em->start > chunk_offset ||
                em->start + em->len < chunk_offset);
         map = (struct map_lookup *)em->bdev;
 
@@ -4356,6 +4371,20 @@ int btrfs_read_sys_array(struct btrfs_root *root)
                 return -ENOMEM;
         btrfs_set_buffer_uptodate(sb);
         btrfs_set_buffer_lockdep_class(root->root_key.objectid, sb, 0);
+        /*
+         * The sb extent buffer is artifical and just used to read the system array.
+         * btrfs_set_buffer_uptodate() call does not properly mark all it's
+         * pages up-to-date when the page is larger: extent does not cover the
+         * whole page and consequently check_page_uptodate does not find all
+         * the page's extents up-to-date (the hole beyond sb),
+         * write_extent_buffer then triggers a WARN_ON.
+         *
+         * Regular short extents go through mark_extent_buffer_dirty/writeback cycle,
+         * but sb spans only this function. Add an explicit SetPageUptodate call
+         * to silence the warning eg. on PowerPC 64.
+         */
+        if (PAGE_CACHE_SIZE > BTRFS_SUPER_INFO_SIZE)
+                SetPageUptodate(sb->first_page);
 
         write_extent_buffer(sb, super_copy, 0, BTRFS_SUPER_INFO_SIZE);
         array_size = btrfs_super_sys_array_size(super_copy);
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 4a588dbd11bf..f4aadd15b613 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -173,7 +173,7 @@ void inode_dio_wait(struct inode *inode)
         if (atomic_read(&inode->i_dio_count))
                 __inode_dio_wait(inode);
 }
-EXPORT_SYMBOL_GPL(inode_dio_wait);
+EXPORT_SYMBOL(inode_dio_wait);
 
 /*
  * inode_dio_done - signal finish of a direct I/O requests
@@ -187,7 +187,7 @@ void inode_dio_done(struct inode *inode)
         if (atomic_dec_and_test(&inode->i_dio_count))
                 wake_up_bit(&inode->i_state, __I_DIO_WAKEUP);
 }
-EXPORT_SYMBOL_GPL(inode_dio_done);
+EXPORT_SYMBOL(inode_dio_done);
 
 /*
  * How many pages are in the queue?
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index aabdfc38cf24..ea54cdef04dd 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -320,6 +320,11 @@ static inline int ep_is_linked(struct list_head *p)
         return !list_empty(p);
 }
 
+static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_t *p)
+{
+        return container_of(p, struct eppoll_entry, wait);
+}
+
 /* Get the "struct epitem" from a wait queue pointer */
 static inline struct epitem *ep_item_from_wait(wait_queue_t *p)
 {
@@ -467,6 +472,18 @@ static void ep_poll_safewake(wait_queue_head_t *wq)
         put_cpu();
 }
 
+static void ep_remove_wait_queue(struct eppoll_entry *pwq)
+{
+        wait_queue_head_t *whead;
+
+        rcu_read_lock();
+        /* If it is cleared by POLLFREE, it should be rcu-safe */
+        whead = rcu_dereference(pwq->whead);
+        if (whead)
+                remove_wait_queue(whead, &pwq->wait);
+        rcu_read_unlock();
+}
+
 /*
  * This function unregisters poll callbacks from the associated file
  * descriptor.  Must be called with "mtx" held (or "epmutex" if called from
@@ -481,7 +498,7 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
                 pwq = list_first_entry(lsthead, struct eppoll_entry, llink);
 
                 list_del(&pwq->llink);
-                remove_wait_queue(pwq->whead, &pwq->wait);
+                ep_remove_wait_queue(pwq);
                 kmem_cache_free(pwq_cache, pwq);
         }
 }
@@ -842,6 +859,17 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
         struct epitem *epi = ep_item_from_wait(wait);
         struct eventpoll *ep = epi->ep;
 
+        if ((unsigned long)key & POLLFREE) {
+                ep_pwq_from_wait(wait)->whead = NULL;
+                /*
+                 * whead = NULL above can race with ep_remove_wait_queue()
+                 * which can do another remove_wait_queue() after us, so we
+                 * can't use __remove_wait_queue(). whead->lock is held by
+                 * the caller.
+                 */
+                list_del_init(&wait->task_list);
+        }
+
         spin_lock_irqsave(&ep->lock, flags);
 
         /*
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f0c849c98fe4..ec9f6ef6c5dd 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3575,8 +3575,8 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
         }
         if (npages > 1) {
                 /* for decoding across pages */
-                args.acl_scratch = alloc_page(GFP_KERNEL);
-                if (!args.acl_scratch)
+                res.acl_scratch = alloc_page(GFP_KERNEL);
+                if (!res.acl_scratch)
                         goto out_free;
         }
         args.acl_len = npages * PAGE_SIZE;
@@ -3612,8 +3612,8 @@ out_free:
         for (i = 0; i < npages; i++)
                 if (pages[i])
                         __free_page(pages[i]);
-        if (args.acl_scratch)
-                __free_page(args.acl_scratch);
+        if (res.acl_scratch)
+                __free_page(res.acl_scratch);
         return ret;
 }
 
@@ -4883,8 +4883,10 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
                                 clp->cl_rpcclient->cl_auth->au_flavor);
 
         res.server_scope = kzalloc(sizeof(struct server_scope), GFP_KERNEL);
-        if (unlikely(!res.server_scope))
-                return -ENOMEM;
+        if (unlikely(!res.server_scope)) {
+                status = -ENOMEM;
+                goto out;
+        }
 
         status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         if (!status)
@@ -4901,12 +4903,13 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
                         clp->server_scope = NULL;
                 }
 
-                if (!clp->server_scope)
+                if (!clp->server_scope) {
                         clp->server_scope = res.server_scope;
-                else
-                        kfree(res.server_scope);
+                        goto out;
+                }
         }
-
+        kfree(res.server_scope);
+out:
         dprintk("<-- %s status= %d\n", __func__, status);
         return status;
 }
@@ -5008,37 +5011,53 @@ int nfs4_proc_get_lease_time(struct nfs_client *clp, struct nfs_fsinfo *fsinfo)
         return status;
 }
 
+static struct nfs4_slot *nfs4_alloc_slots(u32 max_slots, gfp_t gfp_flags)
+{
+        return kcalloc(max_slots, sizeof(struct nfs4_slot), gfp_flags);
+}
+
+static void nfs4_add_and_init_slots(struct nfs4_slot_table *tbl,
+                struct nfs4_slot *new,
+                u32 max_slots,
+                u32 ivalue)
+{
+        struct nfs4_slot *old = NULL;
+        u32 i;
+
+        spin_lock(&tbl->slot_tbl_lock);
+        if (new) {
+                old = tbl->slots;
+                tbl->slots = new;
+                tbl->max_slots = max_slots;
+        }
+        tbl->highest_used_slotid = -1;  /* no slot is currently used */
+        for (i = 0; i < tbl->max_slots; i++)
+                tbl->slots[i].seq_nr = ivalue;
+        spin_unlock(&tbl->slot_tbl_lock);
+        kfree(old);
+}
+
 /*
- * Reset a slot table
+ * (re)Initialise a slot table
  */
-static int nfs4_reset_slot_table(struct nfs4_slot_table *tbl, u32 max_reqs,
-                                 int ivalue)
+static int nfs4_realloc_slot_table(struct nfs4_slot_table *tbl, u32 max_reqs,
+                                 u32 ivalue)
 {
         struct nfs4_slot *new = NULL;
-        int i;
-        int ret = 0;
+        int ret = -ENOMEM;
 
         dprintk("--> %s: max_reqs=%u, tbl->max_slots %d\n", __func__,
                 max_reqs, tbl->max_slots);
 
         /* Does the newly negotiated max_reqs match the existing slot table? */
         if (max_reqs != tbl->max_slots) {
-                ret = -ENOMEM;
-                new = kmalloc(max_reqs * sizeof(struct nfs4_slot),
-                              GFP_NOFS);
+                new = nfs4_alloc_slots(max_reqs, GFP_NOFS);
                 if (!new)
                         goto out;
-                ret = 0;
-                kfree(tbl->slots);
         }
-        spin_lock(&tbl->slot_tbl_lock);
-        if (new) {
-                tbl->slots = new;
-                tbl->max_slots = max_reqs;
-        }
-        for (i = 0; i < tbl->max_slots; ++i)
-                tbl->slots[i].seq_nr = ivalue;
-        spin_unlock(&tbl->slot_tbl_lock);
+        ret = 0;
+
+        nfs4_add_and_init_slots(tbl, new, max_reqs, ivalue);
         dprintk("%s: tbl=%p slots=%p max_slots=%d\n", __func__,
                 tbl, tbl->slots, tbl->max_slots);
 out:
@@ -5061,36 +5080,6 @@ static void nfs4_destroy_slot_tables(struct nfs4_session *session)
 }
 
 /*
- * Initialize slot table
- */
-static int nfs4_init_slot_table(struct nfs4_slot_table *tbl,
-                int max_slots, int ivalue)
-{
-        struct nfs4_slot *slot;
-        int ret = -ENOMEM;
-
-        BUG_ON(max_slots > NFS4_MAX_SLOT_TABLE);
-
-        dprintk("--> %s: max_reqs=%u\n", __func__, max_slots);
-
-        slot = kcalloc(max_slots, sizeof(struct nfs4_slot), GFP_NOFS);
-        if (!slot)
-                goto out;
-        ret = 0;
-
-        spin_lock(&tbl->slot_tbl_lock);
-        tbl->max_slots = max_slots;
-        tbl->slots = slot;
-        tbl->highest_used_slotid = -1;  /* no slot is currently used */
-        spin_unlock(&tbl->slot_tbl_lock);
-        dprintk("%s: tbl=%p slots=%p max_slots=%d\n", __func__,
-                tbl, tbl->slots, tbl->max_slots);
-out:
-        dprintk("<-- %s: return %d\n", __func__, ret);
-        return ret;
-}
-
-/*
  * Initialize or reset the forechannel and backchannel tables
  */
 static int nfs4_setup_session_slot_tables(struct nfs4_session *ses)
@@ -5101,25 +5090,16 @@ static int nfs4_setup_session_slot_tables(struct nfs4_session *ses)
         dprintk("--> %s\n", __func__);
         /* Fore channel */
         tbl = &ses->fc_slot_table;
-        if (tbl->slots == NULL) {
-                status = nfs4_init_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
-                if (status) /* -ENOMEM */
-                        return status;
-        } else {
-                status = nfs4_reset_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
-                if (status)
-                        return status;
-        }
+        status = nfs4_realloc_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
+        if (status) /* -ENOMEM */
+                return status;
         /* Back channel */
         tbl = &ses->bc_slot_table;
-        if (tbl->slots == NULL) {
-                status = nfs4_init_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
-                if (status)
-                        /* Fore and back channel share a connection so get
-                         * both slot tables or neither */
-                        nfs4_destroy_slot_tables(ses);
-        } else
-                status = nfs4_reset_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
+        status = nfs4_realloc_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
+        if (status && tbl->slots == NULL)
+                /* Fore and back channel share a connection so get
+                 * both slot tables or neither */
+                nfs4_destroy_slot_tables(ses);
         return status;
 }
 
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index a53f33b4ac3a..45392032e7bd 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1132,6 +1132,8 @@ void nfs4_schedule_stateid_recovery(const struct nfs_server *server, struct nfs4
 {
         struct nfs_client *clp = server->nfs_client;
 
+        if (test_and_clear_bit(NFS_DELEGATED_STATE, &state->flags))
+                nfs_async_inode_return_delegation(state->inode, &state->stateid);
         nfs4_state_mark_reclaim_nograce(clp, state);
         nfs4_schedule_state_manager(clp);
 }
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 95e92e438407..33bd8d0f745d 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -2522,7 +2522,6 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
 
         xdr_inline_pages(&req->rq_rcv_buf, replen << 2,
                 args->acl_pages, args->acl_pgbase, args->acl_len);
-        xdr_set_scratch_buffer(xdr, page_address(args->acl_scratch), PAGE_SIZE);
 
         encode_nops(&hdr);
 }
@@ -6032,6 +6031,10 @@ nfs4_xdr_dec_getacl(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
         struct compound_hdr hdr;
         int status;
 
+        if (res->acl_scratch != NULL) {
+                void *p = page_address(res->acl_scratch);
+                xdr_set_scratch_buffer(xdr, p, PAGE_SIZE);
+        }
         status = decode_compound_hdr(xdr, &hdr);
         if (status)
                 goto out;
diff --git a/fs/select.c b/fs/select.c
index d33418fdc858..e782258d0de3 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -912,7 +912,7 @@ static long do_restart_poll(struct restart_block *restart_block)
 }
 
 SYSCALL_DEFINE3(poll, struct pollfd __user *, ufds, unsigned int, nfds,
-                long, timeout_msecs)
+                int, timeout_msecs)
 {
         struct timespec end_time, *to = NULL;
         int ret;
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 492465b451dd..7ae2a574cb25 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -30,6 +30,21 @@
 #include <linux/signalfd.h>
 #include <linux/syscalls.h>
 
+void signalfd_cleanup(struct sighand_struct *sighand)
+{
+        wait_queue_head_t *wqh = &sighand->signalfd_wqh;
+        /*
+         * The lockless check can race with remove_wait_queue() in progress,
+         * but in this case its caller should run under rcu_read_lock() and
+         * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return.
+         */
+        if (likely(!waitqueue_active(wqh)))
+                return;
+
+        /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */
+        wake_up_poll(wqh, POLLHUP | POLLFREE);
+}
+
 struct signalfd_ctx {
         sigset_t sigmask;
 };
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index cbcb7bea38e2..53db20ee3e77 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -139,10 +139,10 @@ xfs_qm_adjust_dqtimers(
 
         if (!d->d_btimer) {
                 if ((d->d_blk_softlimit &&
-                     (be64_to_cpu(d->d_bcount) >=
+                     (be64_to_cpu(d->d_bcount) >
                       be64_to_cpu(d->d_blk_softlimit))) ||
                     (d->d_blk_hardlimit &&
-                     (be64_to_cpu(d->d_bcount) >=
+                     (be64_to_cpu(d->d_bcount) >
                       be64_to_cpu(d->d_blk_hardlimit)))) {
                         d->d_btimer = cpu_to_be32(get_seconds() +
                                         mp->m_quotainfo->qi_btimelimit);
@@ -151,10 +151,10 @@ xfs_qm_adjust_dqtimers(
                 }
         } else {
                 if ((!d->d_blk_softlimit ||
-                     (be64_to_cpu(d->d_bcount) <
+                     (be64_to_cpu(d->d_bcount) <=
                       be64_to_cpu(d->d_blk_softlimit))) &&
                     (!d->d_blk_hardlimit ||
-                    (be64_to_cpu(d->d_bcount) <
+                    (be64_to_cpu(d->d_bcount) <=
                      be64_to_cpu(d->d_blk_hardlimit)))) {
                         d->d_btimer = 0;
                 }
@@ -162,10 +162,10 @@ xfs_qm_adjust_dqtimers(
 
         if (!d->d_itimer) {
                 if ((d->d_ino_softlimit &&
-                     (be64_to_cpu(d->d_icount) >=
+                     (be64_to_cpu(d->d_icount) >
                       be64_to_cpu(d->d_ino_softlimit))) ||
                     (d->d_ino_hardlimit &&
-                     (be64_to_cpu(d->d_icount) >=
+                     (be64_to_cpu(d->d_icount) >
                       be64_to_cpu(d->d_ino_hardlimit)))) {
                         d->d_itimer = cpu_to_be32(get_seconds() +
                                         mp->m_quotainfo->qi_itimelimit);
@@ -174,10 +174,10 @@ xfs_qm_adjust_dqtimers(
                 }
         } else {
                 if ((!d->d_ino_softlimit ||
-                     (be64_to_cpu(d->d_icount) <
+                     (be64_to_cpu(d->d_icount) <=
                       be64_to_cpu(d->d_ino_softlimit)))  &&
                     (!d->d_ino_hardlimit ||
-                     (be64_to_cpu(d->d_icount) <
+                     (be64_to_cpu(d->d_icount) <=
                       be64_to_cpu(d->d_ino_hardlimit)))) {
                         d->d_itimer = 0;
                 }
@@ -185,10 +185,10 @@ xfs_qm_adjust_dqtimers(
 
         if (!d->d_rtbtimer) {
                 if ((d->d_rtb_softlimit &&
-                     (be64_to_cpu(d->d_rtbcount) >=
+                     (be64_to_cpu(d->d_rtbcount) >
                       be64_to_cpu(d->d_rtb_softlimit))) ||
                     (d->d_rtb_hardlimit &&
-                     (be64_to_cpu(d->d_rtbcount) >=
+                     (be64_to_cpu(d->d_rtbcount) >
                       be64_to_cpu(d->d_rtb_hardlimit)))) {
                         d->d_rtbtimer = cpu_to_be32(get_seconds() +
                                         mp->m_quotainfo->qi_rtbtimelimit);
@@ -197,10 +197,10 @@ xfs_qm_adjust_dqtimers(
                 }
         } else {
                 if ((!d->d_rtb_softlimit ||
-                     (be64_to_cpu(d->d_rtbcount) <
+                     (be64_to_cpu(d->d_rtbcount) <=
                       be64_to_cpu(d->d_rtb_softlimit))) &&
                     (!d->d_rtb_hardlimit ||
-                     (be64_to_cpu(d->d_rtbcount) <
+                     (be64_to_cpu(d->d_rtbcount) <=
                       be64_to_cpu(d->d_rtb_hardlimit)))) {
                         d->d_rtbtimer = 0;
                 }
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 15ff5392fb65..0ed9ee77937c 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1981,7 +1981,7 @@ xfs_qm_dqcheck(
 
         if (!errs && ddq->d_id) {
                 if (ddq->d_blk_softlimit &&
-                    be64_to_cpu(ddq->d_bcount) >=
+                    be64_to_cpu(ddq->d_bcount) >
                                 be64_to_cpu(ddq->d_blk_softlimit)) {
                         if (!ddq->d_btimer) {
                                 if (flags & XFS_QMOPT_DOWARN)
@@ -1992,7 +1992,7 @@ xfs_qm_dqcheck(
                         }
                 }
                 if (ddq->d_ino_softlimit &&
-                    be64_to_cpu(ddq->d_icount) >=
+                    be64_to_cpu(ddq->d_icount) >
                                 be64_to_cpu(ddq->d_ino_softlimit)) {
                         if (!ddq->d_itimer) {
                                 if (flags & XFS_QMOPT_DOWARN)
@@ -2003,7 +2003,7 @@ xfs_qm_dqcheck(
                         }
                 }
                 if (ddq->d_rtb_softlimit &&
-                    be64_to_cpu(ddq->d_rtbcount) >=
+                    be64_to_cpu(ddq->d_rtbcount) >
                                 be64_to_cpu(ddq->d_rtb_softlimit)) {
                         if (!ddq->d_rtbtimer) {
                                 if (flags & XFS_QMOPT_DOWARN)
diff --git a/fs/xfs/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c
index eafbcff81f3a..711a86e39ff0 100644
--- a/fs/xfs/xfs_qm_syscalls.c
+++ b/fs/xfs/xfs_qm_syscalls.c
@@ -813,11 +813,11 @@ xfs_qm_export_dquot(
              (XFS_IS_OQUOTA_ENFORCED(mp) &&
                         (dst->d_flags & (FS_PROJ_QUOTA | FS_GROUP_QUOTA)))) &&
             dst->d_id != 0) {
-                if (((int) dst->d_bcount >= (int) dst->d_blk_softlimit) &&
+                if (((int) dst->d_bcount > (int) dst->d_blk_softlimit) &&
                     (dst->d_blk_softlimit > 0)) {
                         ASSERT(dst->d_btimer != 0);
                 }
-                if (((int) dst->d_icount >= (int) dst->d_ino_softlimit) &&
+                if (((int) dst->d_icount > (int) dst->d_ino_softlimit) &&
                     (dst->d_ino_softlimit > 0)) {
                         ASSERT(dst->d_itimer != 0);
                 }
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index 329b06aba1c2..7adcdf15ae0c 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -1151,8 +1151,8 @@ xfs_trans_add_item(
 {
         struct xfs_log_item_desc *lidp;
 
-        ASSERT(lip->li_mountp = tp->t_mountp);
-        ASSERT(lip->li_ailp = tp->t_mountp->m_ail);
+        ASSERT(lip->li_mountp == tp->t_mountp);
+        ASSERT(lip->li_ailp == tp->t_mountp->m_ail);
 
         lidp = kmem_zone_zalloc(xfs_log_item_desc_zone, KM_SLEEP | KM_NOFS);
 
diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c
index 4d00ee67792d..c4ba366d24e6 100644
--- a/fs/xfs/xfs_trans_dquot.c
+++ b/fs/xfs/xfs_trans_dquot.c
@@ -649,12 +649,12 @@ xfs_trans_dqresv(
                          * nblks.
                          */
                         if (hardlimit > 0ULL &&
-                            hardlimit <= nblks + *resbcountp) {
+                            hardlimit < nblks + *resbcountp) {
                                 xfs_quota_warn(mp, dqp, QUOTA_NL_BHARDWARN);
                                 goto error_return;
                         }
                         if (softlimit > 0ULL &&
-                            softlimit <= nblks + *resbcountp) {
+                            softlimit < nblks + *resbcountp) {
                                 if ((timer != 0 && get_seconds() > timer) ||
                                     (warns != 0 && warns >= warnlimit)) {
                                         xfs_quota_warn(mp, dqp,
@@ -677,11 +677,13 @@ xfs_trans_dqresv(
                         if (!softlimit)
                                 softlimit = q->qi_isoftlimit;
 
-                        if (hardlimit > 0ULL && count >= hardlimit) {
+                        if (hardlimit > 0ULL &&
+                            hardlimit < ninos + count) {
                                 xfs_quota_warn(mp, dqp, QUOTA_NL_IHARDWARN);
                                 goto error_return;
                         }
-                        if (softlimit > 0ULL && count >= softlimit) {
+                        if (softlimit > 0ULL &&
+                            softlimit < ninos + count) {
                                 if  ((timer != 0 && get_seconds() > timer) ||
                                      (warns != 0 && warns >= warnlimit)) {
                                         xfs_quota_warn(mp, dqp,