36 files changed, 645 insertions, 465 deletions

diff --git a/Documentation/filesystems/nfs/Exporting b/Documentation/filesystems/nfs/Exporting
index e543b1a619cc..c8f036a9b13f 100644
--- a/Documentation/filesystems/nfs/Exporting
+++ b/Documentation/filesystems/nfs/Exporting
@@ -66,23 +66,31 @@ b/ A per-superblock list "s_anon" of dentries which are the roots of
 
 c/ Helper routines to allocate anonymous dentries, and to help attach
    loose directory dentries at lookup time. They are:
-    d_alloc_anon(inode) will return a dentry for the given inode.
+    d_obtain_alias(inode) will return a dentry for the given inode.
       If the inode already has a dentry, one of those is returned.
       If it doesn't, a new anonymous (IS_ROOT and
         DCACHE_DISCONNECTED) dentry is allocated and attached.
       In the case of a directory, care is taken that only one dentry
       can ever be attached.
-    d_splice_alias(inode, dentry) will make sure that there is a
-      dentry with the same name and parent as the given dentry, and
-      which refers to the given inode.
-      If the inode is a directory and already has a dentry, then that
-      dentry is d_moved over the given dentry.
-      If the passed dentry gets attached, care is taken that this is
-      mutually exclusive to a d_alloc_anon operation.
-      If the passed dentry is used, NULL is returned, else the used
-      dentry is returned.  This corresponds to the calling pattern of
-      ->lookup.
-  
+    d_splice_alias(inode, dentry) or d_materialise_unique(dentry, inode)
+      will introduce a new dentry into the tree; either the passed-in
+      dentry or a preexisting alias for the given inode (such as an
+      anonymous one created by d_obtain_alias), if appropriate.  The two
+      functions differ in their handling of directories with preexisting
+      aliases:
+        d_splice_alias will use any existing IS_ROOT dentry, but it will
+          return -EIO rather than try to move a dentry with a different
+          parent.  This is appropriate for local filesystems, which
+          should never see such an alias unless the filesystem is
+          corrupted somehow (for example, if two on-disk directory
+          entries refer to the same directory.)
+        d_materialise_unique will attempt to move any dentry.  This is
+          appropriate for distributed filesystems, where finding a
+          directory other than where we last cached it may be a normal
+          consequence of concurrent operations on other hosts.
+      Both functions return NULL when the passed-in dentry is used,
+      following the calling convention of ->lookup.
+
  
 Filesystem Issues
 -----------------
@@ -120,12 +128,12 @@ struct which has the following members:
 
   fh_to_dentry (mandatory)
     Given a filehandle fragment, this should find the implied object and
-    create a dentry for it (possibly with d_alloc_anon).
+    create a dentry for it (possibly with d_obtain_alias).
 
   fh_to_parent (optional but strongly recommended)
     Given a filehandle fragment, this should find the parent of the
-    implied object and create a dentry for it (possibly with d_alloc_anon).
-    May fail if the filehandle fragment is too small.
+    implied object and create a dentry for it (possibly with
+    d_obtain_alias).  May fail if the filehandle fragment is too small.
 
   get_parent (optional but strongly recommended)
     When given a dentry for a directory, this should return  a dentry for
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index a1d0d7a30165..61d65cc65c54 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -1053,7 +1053,8 @@ struct dentry_operations {
         If the 'rcu_walk' parameter is true, then the caller is doing a
         pathwalk in RCU-walk mode.  Sleeping is not permitted in this mode,
         and the caller can be asked to leave it and call again by returning
-        -ECHILD.
+        -ECHILD.  -EISDIR may also be returned to tell pathwalk to
+        ignore d_automount or any mounts.
 
         This function is only used if DCACHE_MANAGE_TRANSIT is set on the
         dentry being transited from.
diff --git a/fs/Makefile b/fs/Makefile
index 4030cbfbc9af..90c88529892b 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -11,7 +11,7 @@ obj-y :=	open.o read_write.o file_table.o super.o \
                 attr.o bad_inode.o file.o filesystems.o namespace.o \
                 seq_file.o xattr.o libfs.o fs-writeback.o \
                 pnode.o splice.o sync.o utimes.o \
-                stack.o fs_struct.o statfs.o
+                stack.o fs_struct.o statfs.o fs_pin.o
 
 ifeq ($(CONFIG_BLOCK),y)
 obj-y +=        buffer.o block_dev.o direct-io.o mpage.o
diff --git a/fs/bad_inode.c b/fs/bad_inode.c
index 7c93953030fb..afd2b4408adf 100644
--- a/fs/bad_inode.c
+++ b/fs/bad_inode.c
@@ -218,8 +218,9 @@ static int bad_inode_mknod (struct inode *dir, struct dentry *dentry,
         return -EIO;
 }
 
-static int bad_inode_rename (struct inode *old_dir, struct dentry *old_dentry,
-                struct inode *new_dir, struct dentry *new_dentry)
+static int bad_inode_rename2(struct inode *old_dir, struct dentry *old_dentry,
+                             struct inode *new_dir, struct dentry *new_dentry,
+                             unsigned int flags)
 {
         return -EIO;
 }
@@ -279,7 +280,7 @@ static const struct inode_operations bad_inode_ops =
         .mkdir          = bad_inode_mkdir,
         .rmdir          = bad_inode_rmdir,
         .mknod          = bad_inode_mknod,
-        .rename         = bad_inode_rename,
+        .rename2        = bad_inode_rename2,
         .readlink       = bad_inode_readlink,
         /* follow_link must be no-op, otherwise unmounting this inode
            won't work */
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 3668048e16f8..3183742d6f0d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -8476,6 +8476,16 @@ out_notrans:
         return ret;
 }
 
+static int btrfs_rename2(struct inode *old_dir, struct dentry *old_dentry,
+                         struct inode *new_dir, struct dentry *new_dentry,
+                         unsigned int flags)
+{
+        if (flags & ~RENAME_NOREPLACE)
+                return -EINVAL;
+
+        return btrfs_rename(old_dir, old_dentry, new_dir, new_dentry);
+}
+
 static void btrfs_run_delalloc_work(struct btrfs_work *work)
 {
         struct btrfs_delalloc_work *delalloc_work;
@@ -9019,7 +9029,7 @@ static const struct inode_operations btrfs_dir_inode_operations = {
         .link           = btrfs_link,
         .mkdir          = btrfs_mkdir,
         .rmdir          = btrfs_rmdir,
-        .rename         = btrfs_rename,
+        .rename2        = btrfs_rename2,
         .symlink        = btrfs_symlink,
         .setattr        = btrfs_setattr,
         .mknod          = btrfs_mknod,
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 8e16bca69c56..67b48b9a03e0 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -851,7 +851,6 @@ static struct dentry *get_default_root(struct super_block *sb,
         struct btrfs_path *path;
         struct btrfs_key location;
         struct inode *inode;
-        struct dentry *dentry;
         u64 dir_id;
         int new = 0;
 
@@ -922,13 +921,7 @@ setup_root:
                 return dget(sb->s_root);
         }
 
-        dentry = d_obtain_alias(inode);
-        if (!IS_ERR(dentry)) {
-                spin_lock(&dentry->d_lock);
-                dentry->d_flags &= ~DCACHE_DISCONNECTED;
-                spin_unlock(&dentry->d_lock);
-        }
-        return dentry;
+        return d_obtain_root(inode);
 }
 
 static int btrfs_fill_super(struct super_block *sb,
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 06150fd745ac..f6e12377335c 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -755,7 +755,7 @@ static struct dentry *open_root_dentry(struct ceph_fs_client *fsc,
                                 goto out;
                         }
                 } else {
-                        root = d_obtain_alias(inode);
+                        root = d_obtain_root(inode);
                 }
                 ceph_init_dentry(root);
                 dout("open_root_inode success, root dentry is %p\n", root);
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 888398067420..ac4f260155c8 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -848,7 +848,7 @@ const struct inode_operations cifs_dir_inode_ops = {
         .link = cifs_hardlink,
         .mkdir = cifs_mkdir,
         .rmdir = cifs_rmdir,
-        .rename = cifs_rename,
+        .rename2 = cifs_rename2,
         .permission = cifs_permission,
 /*      revalidate:cifs_revalidate,   */
         .setattr = cifs_setattr,
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 560480263336..b0fafa499505 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -68,8 +68,8 @@ extern int cifs_hardlink(struct dentry *, struct inode *, struct dentry *);
 extern int cifs_mknod(struct inode *, struct dentry *, umode_t, dev_t);
 extern int cifs_mkdir(struct inode *, struct dentry *, umode_t);
 extern int cifs_rmdir(struct inode *, struct dentry *);
-extern int cifs_rename(struct inode *, struct dentry *, struct inode *,
-                       struct dentry *);
+extern int cifs_rename2(struct inode *, struct dentry *, struct inode *,
+                        struct dentry *, unsigned int);
 extern int cifs_revalidate_file_attr(struct file *filp);
 extern int cifs_revalidate_dentry_attr(struct dentry *);
 extern int cifs_revalidate_file(struct file *filp);
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 41de3935caa0..426d6c6ad8bf 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1627,8 +1627,9 @@ do_rename_exit:
 }
 
 int
-cifs_rename(struct inode *source_dir, struct dentry *source_dentry,
-            struct inode *target_dir, struct dentry *target_dentry)
+cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
+             struct inode *target_dir, struct dentry *target_dentry,
+             unsigned int flags)
 {
         char *from_name = NULL;
         char *to_name = NULL;
@@ -1640,6 +1641,9 @@ cifs_rename(struct inode *source_dir, struct dentry *source_dentry,
         unsigned int xid;
         int rc, tmprc;
 
+        if (flags & ~RENAME_NOREPLACE)
+                return -EINVAL;
+
         cifs_sb = CIFS_SB(source_dir->i_sb);
         tlink = cifs_sb_tlink(cifs_sb);
         if (IS_ERR(tlink))
@@ -1667,6 +1671,12 @@ cifs_rename(struct inode *source_dir, struct dentry *source_dentry,
         rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry,
                             to_name);
 
+        /*
+         * No-replace is the natural behavior for CIFS, so skip unlink hacks.
+         */
+        if (flags & RENAME_NOREPLACE)
+                goto cifs_rename_exit;
+
         if (rc == -EEXIST && tcon->unix_ext) {
                 /*
                  * Are src and dst hardlinks of same inode? We can only tell
diff --git a/fs/dcache.c b/fs/dcache.c
index 06f65857a855..d30ce699ae4b 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -731,8 +731,6 @@ EXPORT_SYMBOL(dget_parent);
 /**
  * d_find_alias - grab a hashed alias of inode
  * @inode: inode in question
- * @want_discon:  flag, used by d_splice_alias, to request
- *          that only a DISCONNECTED alias be returned.
  *
  * If inode has a hashed alias, or is a directory and has any alias,
  * acquire the reference to alias and return it. Otherwise return NULL.
@@ -741,10 +739,9 @@ EXPORT_SYMBOL(dget_parent);
  * of a filesystem.
  *
  * If the inode has an IS_ROOT, DCACHE_DISCONNECTED alias, then prefer
- * any other hashed alias over that one unless @want_discon is set,
- * in which case only return an IS_ROOT, DCACHE_DISCONNECTED alias.
+ * any other hashed alias over that one.
  */
-static struct dentry *__d_find_alias(struct inode *inode, int want_discon)
+static struct dentry *__d_find_alias(struct inode *inode)
 {
         struct dentry *alias, *discon_alias;
 
@@ -756,7 +753,7 @@ again:
                         if (IS_ROOT(alias) &&
                             (alias->d_flags & DCACHE_DISCONNECTED)) {
                                 discon_alias = alias;
-                        } else if (!want_discon) {
+                        } else {
                                 __dget_dlock(alias);
                                 spin_unlock(&alias->d_lock);
                                 return alias;
@@ -768,12 +765,9 @@ again:
                 alias = discon_alias;
                 spin_lock(&alias->d_lock);
                 if (S_ISDIR(inode->i_mode) || !d_unhashed(alias)) {
-                        if (IS_ROOT(alias) &&
-                            (alias->d_flags & DCACHE_DISCONNECTED)) {
-                                __dget_dlock(alias);
-                                spin_unlock(&alias->d_lock);
-                                return alias;
-                        }
+                        __dget_dlock(alias);
+                        spin_unlock(&alias->d_lock);
+                        return alias;
                 }
                 spin_unlock(&alias->d_lock);
                 goto again;
@@ -787,7 +781,7 @@ struct dentry *d_find_alias(struct inode *inode)
 
         if (!hlist_empty(&inode->i_dentry)) {
                 spin_lock(&inode->i_lock);
-                de = __d_find_alias(inode, 0);
+                de = __d_find_alias(inode);
                 spin_unlock(&inode->i_lock);
         }
         return de;
@@ -1781,25 +1775,7 @@ struct dentry *d_find_any_alias(struct inode *inode)
 }
 EXPORT_SYMBOL(d_find_any_alias);
 
-/**
- * d_obtain_alias - find or allocate a dentry for a given inode
- * @inode: inode to allocate the dentry for
- *
- * Obtain a dentry for an inode resulting from NFS filehandle conversion or
- * similar open by handle operations.  The returned dentry may be anonymous,
- * or may have a full name (if the inode was already in the cache).
- *
- * When called on a directory inode, we must ensure that the inode only ever
- * has one dentry.  If a dentry is found, that is returned instead of
- * allocating a new one.
- *
- * On successful return, the reference to the inode has been transferred
- * to the dentry.  In case of an error the reference on the inode is released.
- * To make it easier to use in export operations a %NULL or IS_ERR inode may
- * be passed in and will be the error will be propagate to the return value,
- * with a %NULL @inode replaced by ERR_PTR(-ESTALE).
- */
-struct dentry *d_obtain_alias(struct inode *inode)
+static struct dentry *__d_obtain_alias(struct inode *inode, int disconnected)
 {
         static const struct qstr anonstring = QSTR_INIT("/", 1);
         struct dentry *tmp;
@@ -1830,7 +1806,10 @@ struct dentry *d_obtain_alias(struct inode *inode)
         }
 
         /* attach a disconnected dentry */
-        add_flags = d_flags_for_inode(inode) | DCACHE_DISCONNECTED;
+        add_flags = d_flags_for_inode(inode);
+
+        if (disconnected)
+                add_flags |= DCACHE_DISCONNECTED;
 
         spin_lock(&tmp->d_lock);
         tmp->d_inode = inode;
@@ -1851,59 +1830,51 @@ struct dentry *d_obtain_alias(struct inode *inode)
         iput(inode);
         return res;
 }
-EXPORT_SYMBOL(d_obtain_alias);
 
 /**
- * d_splice_alias - splice a disconnected dentry into the tree if one exists
- * @inode:  the inode which may have a disconnected dentry
- * @dentry: a negative dentry which we want to point to the inode.
- *
- * If inode is a directory and has a 'disconnected' dentry (i.e. IS_ROOT and
- * DCACHE_DISCONNECTED), then d_move that in place of the given dentry
- * and return it, else simply d_add the inode to the dentry and return NULL.
+ * d_obtain_alias - find or allocate a DISCONNECTED dentry for a given inode
+ * @inode: inode to allocate the dentry for
  *
- * This is needed in the lookup routine of any filesystem that is exportable
- * (via knfsd) so that we can build dcache paths to directories effectively.
+ * Obtain a dentry for an inode resulting from NFS filehandle conversion or
+ * similar open by handle operations.  The returned dentry may be anonymous,
+ * or may have a full name (if the inode was already in the cache).
  *
- * If a dentry was found and moved, then it is returned.  Otherwise NULL
- * is returned.  This matches the expected return value of ->lookup.
+ * When called on a directory inode, we must ensure that the inode only ever
+ * has one dentry.  If a dentry is found, that is returned instead of
+ * allocating a new one.
  *
- * Cluster filesystems may call this function with a negative, hashed dentry.
- * In that case, we know that the inode will be a regular file, and also this
- * will only occur during atomic_open. So we need to check for the dentry
- * being already hashed only in the final case.
+ * On successful return, the reference to the inode has been transferred
+ * to the dentry.  In case of an error the reference on the inode is released.
+ * To make it easier to use in export operations a %NULL or IS_ERR inode may
+ * be passed in and the error will be propagated to the return value,
+ * with a %NULL @inode replaced by ERR_PTR(-ESTALE).
  */
-struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
+struct dentry *d_obtain_alias(struct inode *inode)
 {
-        struct dentry *new = NULL;
-
-        if (IS_ERR(inode))
-                return ERR_CAST(inode);
+        return __d_obtain_alias(inode, 1);
+}
+EXPORT_SYMBOL(d_obtain_alias);
 
-        if (inode && S_ISDIR(inode->i_mode)) {
-                spin_lock(&inode->i_lock);
-                new = __d_find_alias(inode, 1);
-                if (new) {
-                        BUG_ON(!(new->d_flags & DCACHE_DISCONNECTED));
-                        spin_unlock(&inode->i_lock);
-                        security_d_instantiate(new, inode);
-                        d_move(new, dentry);
-                        iput(inode);
-                } else {
-                        /* already taking inode->i_lock, so d_add() by hand */
-                        __d_instantiate(dentry, inode);
-                        spin_unlock(&inode->i_lock);
-                        security_d_instantiate(dentry, inode);
-                        d_rehash(dentry);
-                }
-        } else {
-                d_instantiate(dentry, inode);
-                if (d_unhashed(dentry))
-                        d_rehash(dentry);
-        }
-        return new;
+/**
+ * d_obtain_root - find or allocate a dentry for a given inode
+ * @inode: inode to allocate the dentry for
+ *
+ * Obtain an IS_ROOT dentry for the root of a filesystem.
+ *
+ * We must ensure that directory inodes only ever have one dentry.  If a
+ * dentry is found, that is returned instead of allocating a new one.
+ *
+ * On successful return, the reference to the inode has been transferred
+ * to the dentry.  In case of an error the reference on the inode is
+ * released.  A %NULL or IS_ERR inode may be passed in and will be the
+ * error will be propagate to the return value, with a %NULL @inode
+ * replaced by ERR_PTR(-ESTALE).
+ */
+struct dentry *d_obtain_root(struct inode *inode)
+{
+        return __d_obtain_alias(inode, 0);
 }
-EXPORT_SYMBOL(d_splice_alias);
+EXPORT_SYMBOL(d_obtain_root);
 
 /**
  * d_add_ci - lookup or allocate new dentry with case-exact name
@@ -2697,6 +2668,75 @@ static void __d_materialise_dentry(struct dentry *dentry, struct dentry *anon)
 }
 
 /**
+ * d_splice_alias - splice a disconnected dentry into the tree if one exists
+ * @inode:  the inode which may have a disconnected dentry
+ * @dentry: a negative dentry which we want to point to the inode.
+ *
+ * If inode is a directory and has an IS_ROOT alias, then d_move that in
+ * place of the given dentry and return it, else simply d_add the inode
+ * to the dentry and return NULL.
+ *
+ * If a non-IS_ROOT directory is found, the filesystem is corrupt, and
+ * we should error out: directories can't have multiple aliases.
+ *
+ * This is needed in the lookup routine of any filesystem that is exportable
+ * (via knfsd) so that we can build dcache paths to directories effectively.
+ *
+ * If a dentry was found and moved, then it is returned.  Otherwise NULL
+ * is returned.  This matches the expected return value of ->lookup.
+ *
+ * Cluster filesystems may call this function with a negative, hashed dentry.
+ * In that case, we know that the inode will be a regular file, and also this
+ * will only occur during atomic_open. So we need to check for the dentry
+ * being already hashed only in the final case.
+ */
+struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
+{
+        struct dentry *new = NULL;
+
+        if (IS_ERR(inode))
+                return ERR_CAST(inode);
+
+        if (inode && S_ISDIR(inode->i_mode)) {
+                spin_lock(&inode->i_lock);
+                new = __d_find_any_alias(inode);
+                if (new) {
+                        if (!IS_ROOT(new)) {
+                                spin_unlock(&inode->i_lock);
+                                dput(new);
+                                return ERR_PTR(-EIO);
+                        }
+                        if (d_ancestor(new, dentry)) {
+                                spin_unlock(&inode->i_lock);
+                                dput(new);
+                                return ERR_PTR(-EIO);
+                        }
+                        write_seqlock(&rename_lock);
+                        __d_materialise_dentry(dentry, new);
+                        write_sequnlock(&rename_lock);
+                        __d_drop(new);
+                        _d_rehash(new);
+                        spin_unlock(&new->d_lock);
+                        spin_unlock(&inode->i_lock);
+                        security_d_instantiate(new, inode);
+                        iput(inode);
+                } else {
+                        /* already taking inode->i_lock, so d_add() by hand */
+                        __d_instantiate(dentry, inode);
+                        spin_unlock(&inode->i_lock);
+                        security_d_instantiate(dentry, inode);
+                        d_rehash(dentry);
+                }
+        } else {
+                d_instantiate(dentry, inode);
+                if (d_unhashed(dentry))
+                        d_rehash(dentry);
+        }
+        return new;
+}
+EXPORT_SYMBOL(d_splice_alias);
+
+/**
  * d_materialise_unique - introduce an inode into the tree
  * @dentry: candidate dentry
  * @inode: inode to bind to the dentry, to which aliases may be attached
@@ -2724,7 +2764,7 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
                 struct dentry *alias;
 
                 /* Does an aliased dentry already exist? */
-                alias = __d_find_alias(inode, 0);
+                alias = __d_find_alias(inode);
                 if (alias) {
                         actual = alias;
                         write_seqlock(&rename_lock);
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 17e39b047de5..c3116404ab49 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -158,7 +158,7 @@ static inline int dio_refill_pages(struct dio *dio, struct dio_submit *sdio)
 {
         ssize_t ret;
 
-        ret = iov_iter_get_pages(sdio->iter, dio->pages, DIO_PAGES * PAGE_SIZE,
+        ret = iov_iter_get_pages(sdio->iter, dio->pages, DIO_PAGES,
                                 &sdio->from);
 
         if (ret < 0 && sdio->blocks_available && (dio->rw & WRITE)) {
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 3520ab8a6639..b147a67baa0d 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3455,7 +3455,6 @@ const struct inode_operations ext4_dir_inode_operations = {
         .rmdir          = ext4_rmdir,
         .mknod          = ext4_mknod,
         .tmpfile        = ext4_tmpfile,
-        .rename         = ext4_rename,
         .rename2        = ext4_rename2,
         .setattr        = ext4_setattr,
         .setxattr       = generic_setxattr,
diff --git a/fs/fs_pin.c b/fs/fs_pin.c
new file mode 100644
index 000000000000..9368236ca100
--- /dev/null
+++ b/fs/fs_pin.c
@@ -0,0 +1,78 @@
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include <linux/fs_pin.h>
+#include "internal.h"
+#include "mount.h"
+
+static void pin_free_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct fs_pin, rcu));
+}
+
+static DEFINE_SPINLOCK(pin_lock);
+
+void pin_put(struct fs_pin *p)
+{
+        if (atomic_long_dec_and_test(&p->count))
+                call_rcu(&p->rcu, pin_free_rcu);
+}
+
+void pin_remove(struct fs_pin *pin)
+{
+        spin_lock(&pin_lock);
+        hlist_del(&pin->m_list);
+        hlist_del(&pin->s_list);
+        spin_unlock(&pin_lock);
+}
+
+void pin_insert(struct fs_pin *pin, struct vfsmount *m)
+{
+        spin_lock(&pin_lock);
+        hlist_add_head(&pin->s_list, &m->mnt_sb->s_pins);
+        hlist_add_head(&pin->m_list, &real_mount(m)->mnt_pins);
+        spin_unlock(&pin_lock);
+}
+
+void mnt_pin_kill(struct mount *m)
+{
+        while (1) {
+                struct hlist_node *p;
+                struct fs_pin *pin;
+                rcu_read_lock();
+                p = ACCESS_ONCE(m->mnt_pins.first);
+                if (!p) {
+                        rcu_read_unlock();
+                        break;
+                }
+                pin = hlist_entry(p, struct fs_pin, m_list);
+                if (!atomic_long_inc_not_zero(&pin->count)) {
+                        rcu_read_unlock();
+                        cpu_relax();
+                        continue;
+                }
+                rcu_read_unlock();
+                pin->kill(pin);
+        }
+}
+
+void sb_pin_kill(struct super_block *sb)
+{
+        while (1) {
+                struct hlist_node *p;
+                struct fs_pin *pin;
+                rcu_read_lock();
+                p = ACCESS_ONCE(sb->s_pins.first);
+                if (!p) {
+                        rcu_read_unlock();
+                        break;
+                }
+                pin = hlist_entry(p, struct fs_pin, s_list);
+                if (!atomic_long_inc_not_zero(&pin->count)) {
+                        rcu_read_unlock();
+                        cpu_relax();
+                        continue;
+                }
+                rcu_read_unlock();
+                pin->kill(pin);
+        }
+}
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 0c6048247a34..de1d84af9f7c 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -845,12 +845,6 @@ static int fuse_rename2(struct inode *olddir, struct dentry *oldent,
         return err;
 }
 
-static int fuse_rename(struct inode *olddir, struct dentry *oldent,
-                       struct inode *newdir, struct dentry *newent)
-{
-        return fuse_rename2(olddir, oldent, newdir, newent, 0);
-}
-
 static int fuse_link(struct dentry *entry, struct inode *newdir,
                      struct dentry *newent)
 {
@@ -2024,7 +2018,6 @@ static const struct inode_operations fuse_dir_inode_operations = {
         .symlink        = fuse_symlink,
         .unlink         = fuse_unlink,
         .rmdir          = fuse_rmdir,
-        .rename         = fuse_rename,
         .rename2        = fuse_rename2,
         .link           = fuse_link,
         .setattr        = fuse_setattr,
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 40ac2628ddcf..912061ac4baf 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1303,10 +1303,10 @@ static int fuse_get_user_pages(struct fuse_req *req, struct iov_iter *ii,
         while (nbytes < *nbytesp && req->num_pages < req->max_pages) {
                 unsigned npages;
                 size_t start;
-                unsigned n = req->max_pages - req->num_pages;
                 ssize_t ret = iov_iter_get_pages(ii,
                                         &req->pages[req->num_pages],
-                                        n * PAGE_SIZE, &start);
+                                        req->max_pages - req->num_pages,
+                                        &start);
                 if (ret < 0)
                         return ret;
 
diff --git a/fs/hostfs/hostfs.h b/fs/hostfs/hostfs.h
index 9c88da0e855a..4fcd40d6f308 100644
--- a/fs/hostfs/hostfs.h
+++ b/fs/hostfs/hostfs.h
@@ -89,6 +89,7 @@ extern int do_mknod(const char *file, int mode, unsigned int major,
 extern int link_file(const char *from, const char *to);
 extern int hostfs_do_readlink(char *file, char *buf, int size);
 extern int rename_file(char *from, char *to);
+extern int rename2_file(char *from, char *to, unsigned int flags);
 extern int do_statfs(char *root, long *bsize_out, long long *blocks_out,
                      long long *bfree_out, long long *bavail_out,
                      long long *files_out, long long *ffree_out,
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index bb529f3b7f2b..fd62cae0fdcb 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -741,21 +741,31 @@ static int hostfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode,
         return err;
 }
 
-static int hostfs_rename(struct inode *from_ino, struct dentry *from,
-                         struct inode *to_ino, struct dentry *to)
+static int hostfs_rename2(struct inode *old_dir, struct dentry *old_dentry,
+                          struct inode *new_dir, struct dentry *new_dentry,
+                          unsigned int flags)
 {
-        char *from_name, *to_name;
+        char *old_name, *new_name;
         int err;
 
-        if ((from_name = dentry_name(from)) == NULL)
+        if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE))
+                return -EINVAL;
+
+        old_name = dentry_name(old_dentry);
+        if (old_name == NULL)
                 return -ENOMEM;
-        if ((to_name = dentry_name(to)) == NULL) {
-                __putname(from_name);
+        new_name = dentry_name(new_dentry);
+        if (new_name == NULL) {
+                __putname(old_name);
                 return -ENOMEM;
         }
-        err = rename_file(from_name, to_name);
-        __putname(from_name);
-        __putname(to_name);
+        if (!flags)
+                err = rename_file(old_name, new_name);
+        else
+                err = rename2_file(old_name, new_name, flags);
+
+        __putname(old_name);
+        __putname(new_name);
         return err;
 }
 
@@ -867,7 +877,7 @@ static const struct inode_operations hostfs_dir_iops = {
         .mkdir          = hostfs_mkdir,
         .rmdir          = hostfs_rmdir,
         .mknod          = hostfs_mknod,
-        .rename         = hostfs_rename,
+        .rename2        = hostfs_rename2,
         .permission     = hostfs_permission,
         .setattr        = hostfs_setattr,
 };
diff --git a/fs/hostfs/hostfs_user.c b/fs/hostfs/hostfs_user.c
index 67838f3aa20a..9765dab95cbd 100644
--- a/fs/hostfs/hostfs_user.c
+++ b/fs/hostfs/hostfs_user.c
@@ -14,6 +14,7 @@
 #include <sys/time.h>
 #include <sys/types.h>
 #include <sys/vfs.h>
+#include <sys/syscall.h>
 #include "hostfs.h"
 #include <utime.h>
 
@@ -360,6 +361,33 @@ int rename_file(char *from, char *to)
         return 0;
 }
 
+int rename2_file(char *from, char *to, unsigned int flags)
+{
+        int err;
+
+#ifndef SYS_renameat2
+#  ifdef __x86_64__
+#    define SYS_renameat2 316
+#  endif
+#  ifdef __i386__
+#    define SYS_renameat2 353
+#  endif
+#endif
+
+#ifdef SYS_renameat2
+        err = syscall(SYS_renameat2, AT_FDCWD, from, AT_FDCWD, to, flags);
+        if (err < 0) {
+                if (errno != ENOSYS)
+                        return -errno;
+                else
+                        return -EINVAL;
+        }
+        return 0;
+#else
+        return -EINVAL;
+#endif
+}
+
 int do_statfs(char *root, long *bsize_out, long long *blocks_out,
               long long *bfree_out, long long *bavail_out,
               long long *files_out, long long *ffree_out,
diff --git a/fs/internal.h b/fs/internal.h
index 465742407466..e325b4f9c799 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -131,7 +131,6 @@ extern long prune_dcache_sb(struct super_block *sb, unsigned long nr_to_scan,
 /*
  * read_write.c
  */
-extern ssize_t __kernel_write(struct file *, const char *, size_t, loff_t *);
 extern int rw_verify_area(int, struct file *, const loff_t *, size_t);
 
 /*
@@ -144,3 +143,9 @@ extern long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
  * pipe.c
  */
 extern const struct file_operations pipefifo_fops;
+
+/*
+ * fs_pin.c
+ */
+extern void sb_pin_kill(struct super_block *sb);
+extern void mnt_pin_kill(struct mount *m);
diff --git a/fs/mount.h b/fs/mount.h
index d55297f2fa05..6740a6215529 100644
--- a/fs/mount.h
+++ b/fs/mount.h
@@ -55,7 +55,7 @@ struct mount {
         int mnt_id;                     /* mount identifier */
         int mnt_group_id;               /* peer group identifier */
         int mnt_expiry_mark;            /* true if marked for expiry */
-        int mnt_pinned;
+        struct hlist_head mnt_pins;
         struct path mnt_ex_mountpoint;
 };
 
diff --git a/fs/namei.c b/fs/namei.c
index 9eb787e5c167..a996bb48dfab 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1091,10 +1091,10 @@ int follow_down_one(struct path *path)
 }
 EXPORT_SYMBOL(follow_down_one);
 
-static inline bool managed_dentry_might_block(struct dentry *dentry)
+static inline int managed_dentry_rcu(struct dentry *dentry)
 {
-        return (dentry->d_flags & DCACHE_MANAGE_TRANSIT &&
-                dentry->d_op->d_manage(dentry, true) < 0);
+        return (dentry->d_flags & DCACHE_MANAGE_TRANSIT) ?
+                dentry->d_op->d_manage(dentry, true) : 0;
 }
 
 /*
@@ -1110,11 +1110,18 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                  * Don't forget we might have a non-mountpoint managed dentry
                  * that wants to block transit.
                  */
-                if (unlikely(managed_dentry_might_block(path->dentry)))
+                switch (managed_dentry_rcu(path->dentry)) {
+                case -ECHILD:
+                default:
                         return false;
+                case -EISDIR:
+                        return true;
+                case 0:
+                        break;
+                }
 
                 if (!d_mountpoint(path->dentry))
-                        return true;
+                        return !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
 
                 mounted = __lookup_mnt(path->mnt, path->dentry);
                 if (!mounted)
@@ -1130,7 +1137,8 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                  */
                 *inode = path->dentry->d_inode;
         }
-        return read_seqretry(&mount_lock, nd->m_seq);
+        return read_seqretry(&mount_lock, nd->m_seq) &&
+                !(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT);
 }
 
 static int follow_dotdot_rcu(struct nameidata *nd)
@@ -1402,11 +1410,8 @@ static int lookup_fast(struct nameidata *nd,
                 }
                 path->mnt = mnt;
                 path->dentry = dentry;
-                if (unlikely(!__follow_mount_rcu(nd, path, inode)))
-                        goto unlazy;
-                if (unlikely(path->dentry->d_flags & DCACHE_NEED_AUTOMOUNT))
-                        goto unlazy;
-                return 0;
+                if (likely(__follow_mount_rcu(nd, path, inode)))
+                        return 0;
 unlazy:
                 if (unlazy_walk(nd, dentry))
                         return -ECHILD;
@@ -4019,7 +4024,7 @@ SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname
  * The worst of all namespace operations - renaming directory. "Perverted"
  * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
  * Problems:
- *      a) we can get into loop creation. Check is done in is_subdir().
+ *      a) we can get into loop creation.
  *      b) race potential - two innocent renames can create a loop together.
  *         That's where 4.4 screws up. Current fix: serialization on
  *         sb->s_vfs_rename_mutex. We might be more accurate, but that's another
@@ -4075,7 +4080,7 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (error)
                 return error;
 
-        if (!old_dir->i_op->rename)
+        if (!old_dir->i_op->rename && !old_dir->i_op->rename2)
                 return -EPERM;
 
         if (flags && !old_dir->i_op->rename2)
@@ -4134,10 +4139,11 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 if (error)
                         goto out;
         }
-        if (!flags) {
+        if (!old_dir->i_op->rename2) {
                 error = old_dir->i_op->rename(old_dir, old_dentry,
                                               new_dir, new_dentry);
         } else {
+                WARN_ON(old_dir->i_op->rename != NULL);
                 error = old_dir->i_op->rename2(old_dir, old_dentry,
                                                new_dir, new_dentry, flags);
         }
diff --git a/fs/namespace.c b/fs/namespace.c
index 0acabea58319..a01c7730e9af 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -16,7 +16,6 @@
 #include <linux/namei.h>
 #include <linux/security.h>
 #include <linux/idr.h>
-#include <linux/acct.h>         /* acct_auto_close_mnt */
 #include <linux/init.h>         /* init_rootfs */
 #include <linux/fs_struct.h>    /* get_fs_root et.al. */
 #include <linux/fsnotify.h>     /* fsnotify_vfsmount_delete */
@@ -779,6 +778,20 @@ static void attach_mnt(struct mount *mnt,
         list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
 }
 
+static void attach_shadowed(struct mount *mnt,
+                        struct mount *parent,
+                        struct mount *shadows)
+{
+        if (shadows) {
+                hlist_add_behind_rcu(&mnt->mnt_hash, &shadows->mnt_hash);
+                list_add(&mnt->mnt_child, &shadows->mnt_child);
+        } else {
+                hlist_add_head_rcu(&mnt->mnt_hash,
+                                m_hash(&parent->mnt, mnt->mnt_mountpoint));
+                list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
+        }
+}
+
 /*
  * vfsmount lock must be held for write
  */
@@ -797,12 +810,7 @@ static void commit_tree(struct mount *mnt, struct mount *shadows)
 
         list_splice(&head, n->list.prev);
 
-        if (shadows)
-                hlist_add_behind_rcu(&mnt->mnt_hash, &shadows->mnt_hash);
-        else
-                hlist_add_head_rcu(&mnt->mnt_hash,
-                                m_hash(&parent->mnt, mnt->mnt_mountpoint));
-        list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
+        attach_shadowed(mnt, parent, shadows);
         touch_mnt_namespace(n);
 }
 
@@ -951,7 +959,6 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
 
 static void mntput_no_expire(struct mount *mnt)
 {
-put_again:
         rcu_read_lock();
         mnt_add_count(mnt, -1);
         if (likely(mnt->mnt_ns)) { /* shouldn't be the last one */
@@ -964,14 +971,6 @@ put_again:
                 unlock_mount_hash();
                 return;
         }
-        if (unlikely(mnt->mnt_pinned)) {
-                mnt_add_count(mnt, mnt->mnt_pinned + 1);
-                mnt->mnt_pinned = 0;
-                rcu_read_unlock();
-                unlock_mount_hash();
-                acct_auto_close_mnt(&mnt->mnt);
-                goto put_again;
-        }
         if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) {
                 rcu_read_unlock();
                 unlock_mount_hash();
@@ -994,6 +993,8 @@ put_again:
          * so mnt_get_writers() below is safe.
          */
         WARN_ON(mnt_get_writers(mnt));
+        if (unlikely(mnt->mnt_pins.first))
+                mnt_pin_kill(mnt);
         fsnotify_vfsmount_delete(&mnt->mnt);
         dput(mnt->mnt.mnt_root);
         deactivate_super(mnt->mnt.mnt_sb);
@@ -1021,25 +1022,15 @@ struct vfsmount *mntget(struct vfsmount *mnt)
 }
 EXPORT_SYMBOL(mntget);
 
-void mnt_pin(struct vfsmount *mnt)
-{
-        lock_mount_hash();
-        real_mount(mnt)->mnt_pinned++;
-        unlock_mount_hash();
-}
-EXPORT_SYMBOL(mnt_pin);
-
-void mnt_unpin(struct vfsmount *m)
+struct vfsmount *mnt_clone_internal(struct path *path)
 {
-        struct mount *mnt = real_mount(m);
-        lock_mount_hash();
-        if (mnt->mnt_pinned) {
-                mnt_add_count(mnt, 1);
-                mnt->mnt_pinned--;
-        }
-        unlock_mount_hash();
+        struct mount *p;
+        p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE);
+        if (IS_ERR(p))
+                return ERR_CAST(p);
+        p->mnt.mnt_flags |= MNT_INTERNAL;
+        return &p->mnt;
 }
-EXPORT_SYMBOL(mnt_unpin);
 
 static inline void mangle(struct seq_file *m, const char *s)
 {
@@ -1505,6 +1496,7 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
                         continue;
 
                 for (s = r; s; s = next_mnt(s, r)) {
+                        struct mount *t = NULL;
                         if (!(flag & CL_COPY_UNBINDABLE) &&
                             IS_MNT_UNBINDABLE(s)) {
                                 s = skip_mnt_tree(s);
@@ -1526,7 +1518,14 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
                                 goto out;
                         lock_mount_hash();
                         list_add_tail(&q->mnt_list, &res->mnt_list);
-                        attach_mnt(q, parent, p->mnt_mp);
+                        mnt_set_mountpoint(parent, p->mnt_mp, q);
+                        if (!list_empty(&parent->mnt_mounts)) {
+                                t = list_last_entry(&parent->mnt_mounts,
+                                        struct mount, mnt_child);
+                                if (t->mnt_mp != p->mnt_mp)
+                                        t = NULL;
+                        }
+                        attach_shadowed(q, parent, t);
                         unlock_mount_hash();
                 }
         }
diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
index b94f80420a58..880618a8b048 100644
--- a/fs/nfs/getroot.c
+++ b/fs/nfs/getroot.c
@@ -112,7 +112,7 @@ struct dentry *nfs_get_root(struct super_block *sb, struct nfs_fh *mntfh,
          * if the dentry tree reaches them; however if the dentry already
          * exists, we'll pick it up at this point and use it as the root
          */
-        ret = d_obtain_alias(inode);
+        ret = d_obtain_root(inode);
         if (IS_ERR(ret)) {
                 dprintk("nfs_get_root: get root dentry failed\n");
                 goto out;
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index c519927b7b5e..228f5bdf0772 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -942,7 +942,7 @@ static int nilfs_get_root_dentry(struct super_block *sb,
                         iput(inode);
                 }
         } else {
-                dentry = d_obtain_alias(inode);
+                dentry = d_obtain_root(inode);
                 if (IS_ERR(dentry)) {
                         ret = PTR_ERR(dentry);
                         goto failed_dentry;
diff --git a/fs/super.c b/fs/super.c
index d20d5b11dedf..a371ce6aa919 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -22,7 +22,6 @@
 
 #include <linux/export.h>
 #include <linux/slab.h>
-#include <linux/acct.h>
 #include <linux/blkdev.h>
 #include <linux/mount.h>
 #include <linux/security.h>
@@ -702,12 +701,22 @@ int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
                 return -EACCES;
 #endif
 
-        if (flags & MS_RDONLY)
-                acct_auto_close(sb);
-        shrink_dcache_sb(sb);
-
         remount_ro = (flags & MS_RDONLY) && !(sb->s_flags & MS_RDONLY);
 
+        if (remount_ro) {
+                if (sb->s_pins.first) {
+                        up_write(&sb->s_umount);
+                        sb_pin_kill(sb);
+                        down_write(&sb->s_umount);
+                        if (!sb->s_root)
+                                return 0;
+                        if (sb->s_writers.frozen != SB_UNFROZEN)
+                                return -EBUSY;
+                        remount_ro = (flags & MS_RDONLY) && !(sb->s_flags & MS_RDONLY);
+                }
+        }
+        shrink_dcache_sb(sb);
+
         /* If we are remounting RDONLY and current sb is read/write,
            make sure there are no rw files opened */
         if (remount_ro) {
diff --git a/include/linux/acct.h b/include/linux/acct.h
index 4a5b7cb56079..dccc2d4fe7de 100644
--- a/include/linux/acct.h
+++ b/include/linux/acct.h
@@ -24,14 +24,10 @@ struct super_block;
 struct pacct_struct;
 struct pid_namespace;
 extern int acct_parm[]; /* for sysctl */
-extern void acct_auto_close_mnt(struct vfsmount *m);
-extern void acct_auto_close(struct super_block *sb);
 extern void acct_collect(long exitcode, int group_dead);
 extern void acct_process(void);
 extern void acct_exit_ns(struct pid_namespace *);
 #else
-#define acct_auto_close_mnt(x)  do { } while (0)
-#define acct_auto_close(x)      do { } while (0)
 #define acct_collect(x,y)       do { } while (0)
 #define acct_process()          do { } while (0)
 #define acct_exit_ns(ns)        do { } while (0)
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 3c7ec327ebd2..e4ae2ad48d07 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -249,6 +249,7 @@ extern struct dentry * d_splice_alias(struct inode *, struct dentry *);
 extern struct dentry * d_add_ci(struct dentry *, struct inode *, struct qstr *);
 extern struct dentry *d_find_any_alias(struct inode *inode);
 extern struct dentry * d_obtain_alias(struct inode *);
+extern struct dentry * d_obtain_root(struct inode *);
 extern void shrink_dcache_sb(struct super_block *);
 extern void shrink_dcache_parent(struct dentry *);
 extern void shrink_dcache_for_umount(struct super_block *);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index f0890e4a7c25..94187721ad41 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1275,6 +1275,7 @@ struct super_block {
 
         /* AIO completions deferred from interrupt context */
         struct workqueue_struct *s_dio_done_wq;
+        struct hlist_head s_pins;
 
         /*
          * Keep the lru lists last in the structure so they always sit on their
@@ -2360,6 +2361,7 @@ extern int do_pipe_flags(int *, int);
 
 extern int kernel_read(struct file *, loff_t, char *, unsigned long);
 extern ssize_t kernel_write(struct file *, const char *, size_t, loff_t);
+extern ssize_t __kernel_write(struct file *, const char *, size_t, loff_t *);
 extern struct file * open_exec(const char *);
  
 /* fs/dcache.c -- generic fs support functions */
diff --git a/include/linux/fs_pin.h b/include/linux/fs_pin.h
new file mode 100644
index 000000000000..f66525e72ccf
--- /dev/null
+++ b/include/linux/fs_pin.h
@@ -0,0 +1,17 @@
+#include <linux/fs.h>
+
+struct fs_pin {
+        atomic_long_t           count;
+        union {
+                struct {
+                        struct hlist_node       s_list;
+                        struct hlist_node       m_list;
+                };
+                struct rcu_head rcu;
+        };
+        void (*kill)(struct fs_pin *);
+};
+
+void pin_put(struct fs_pin *);
+void pin_remove(struct fs_pin *);
+void pin_insert(struct fs_pin *, struct vfsmount *);
diff --git a/include/linux/mount.h b/include/linux/mount.h
index b0c1e6574e7f..9262e4bf0cc3 100644
--- a/include/linux/mount.h
+++ b/include/linux/mount.h
@@ -69,6 +69,7 @@ struct vfsmount {
 };
 
 struct file; /* forward dec */
+struct path;
 
 extern int mnt_want_write(struct vfsmount *mnt);
 extern int mnt_want_write_file(struct file *file);
@@ -77,8 +78,7 @@ extern void mnt_drop_write(struct vfsmount *mnt);
 extern void mnt_drop_write_file(struct file *file);
 extern void mntput(struct vfsmount *mnt);
 extern struct vfsmount *mntget(struct vfsmount *mnt);
-extern void mnt_pin(struct vfsmount *mnt);
-extern void mnt_unpin(struct vfsmount *mnt);
+extern struct vfsmount *mnt_clone_internal(struct path *path);
 extern int __mnt_is_readonly(struct vfsmount *mnt);
 
 struct file_system_type;
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 09a7cffc224e..48d64e6ab292 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -84,7 +84,7 @@ unsigned long iov_iter_alignment(const struct iov_iter *i);
 void iov_iter_init(struct iov_iter *i, int direction, const struct iovec *iov,
                         unsigned long nr_segs, size_t count);
 ssize_t iov_iter_get_pages(struct iov_iter *i, struct page **pages,
-                        size_t maxsize, size_t *start);
+                        unsigned maxpages, size_t *start);
 ssize_t iov_iter_get_pages_alloc(struct iov_iter *i, struct page ***pages,
                         size_t maxsize, size_t *start);
 int iov_iter_npages(const struct iov_iter *i, int maxpages);
diff --git a/kernel/acct.c b/kernel/acct.c
index 51793520566f..b4c667d22e79 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -59,6 +59,7 @@
 #include <asm/div64.h>
 #include <linux/blkdev.h> /* sector_div */
 #include <linux/pid_namespace.h>
+#include <linux/fs_pin.h>
 
 /*
  * These constants control the amount of freespace that suspend and
@@ -75,172 +76,190 @@ int acct_parm[3] = {4, 2, 30};
 /*
  * External references and all of the globals.
  */
-static void do_acct_process(struct bsd_acct_struct *acct,
-                struct pid_namespace *ns, struct file *);
+static void do_acct_process(struct bsd_acct_struct *acct);
 
-/*
- * This structure is used so that all the data protected by lock
- * can be placed in the same cache line as the lock.  This primes
- * the cache line to have the data after getting the lock.
- */
 struct bsd_acct_struct {
+        struct fs_pin           pin;
+        struct mutex            lock;
         int                     active;
         unsigned long           needcheck;
         struct file             *file;
         struct pid_namespace    *ns;
-        struct list_head        list;
+        struct work_struct      work;
+        struct completion       done;
 };
 
-static DEFINE_SPINLOCK(acct_lock);
-static LIST_HEAD(acct_list);
-
 /*
  * Check the amount of free space and suspend/resume accordingly.
  */
-static int check_free_space(struct bsd_acct_struct *acct, struct file *file)
+static int check_free_space(struct bsd_acct_struct *acct)
 {
         struct kstatfs sbuf;
-        int res;
-        int act;
-        u64 resume;
-        u64 suspend;
-
-        spin_lock(&acct_lock);
-        res = acct->active;
-        if (!file || time_is_before_jiffies(acct->needcheck))
+
+        if (time_is_before_jiffies(acct->needcheck))
                 goto out;
-        spin_unlock(&acct_lock);
 
         /* May block */
-        if (vfs_statfs(&file->f_path, &sbuf))
-                return res;
-        suspend = sbuf.f_blocks * SUSPEND;
-        resume = sbuf.f_blocks * RESUME;
-
-        do_div(suspend, 100);
-        do_div(resume, 100);
-
-        if (sbuf.f_bavail <= suspend)
-                act = -1;
-        else if (sbuf.f_bavail >= resume)
-                act = 1;
-        else
-                act = 0;
-
-        /*
-         * If some joker switched acct->file under us we'ld better be
-         * silent and _not_ touch anything.
-         */
-        spin_lock(&acct_lock);
-        if (file != acct->file) {
-                if (act)
-                        res = act > 0;
+        if (vfs_statfs(&acct->file->f_path, &sbuf))
                 goto out;
-        }
 
         if (acct->active) {
-                if (act < 0) {
+                u64 suspend = sbuf.f_blocks * SUSPEND;
+                do_div(suspend, 100);
+                if (sbuf.f_bavail <= suspend) {
                         acct->active = 0;
                         pr_info("Process accounting paused\n");
                 }
         } else {
-                if (act > 0) {
+                u64 resume = sbuf.f_blocks * RESUME;
+                do_div(resume, 100);
+                if (sbuf.f_bavail >= resume) {
                         acct->active = 1;
                         pr_info("Process accounting resumed\n");
                 }
         }
 
         acct->needcheck = jiffies + ACCT_TIMEOUT*HZ;
-        res = acct->active;
 out:
-        spin_unlock(&acct_lock);
+        return acct->active;
+}
+
+static struct bsd_acct_struct *acct_get(struct pid_namespace *ns)
+{
+        struct bsd_acct_struct *res;
+again:
+        smp_rmb();
+        rcu_read_lock();
+        res = ACCESS_ONCE(ns->bacct);
+        if (!res) {
+                rcu_read_unlock();
+                return NULL;
+        }
+        if (!atomic_long_inc_not_zero(&res->pin.count)) {
+                rcu_read_unlock();
+                cpu_relax();
+                goto again;
+        }
+        rcu_read_unlock();
+        mutex_lock(&res->lock);
+        if (!res->ns) {
+                mutex_unlock(&res->lock);
+                pin_put(&res->pin);
+                goto again;
+        }
         return res;
 }
 
-/*
- * Close the old accounting file (if currently open) and then replace
- * it with file (if non-NULL).
- *
- * NOTE: acct_lock MUST be held on entry and exit.
- */
-static void acct_file_reopen(struct bsd_acct_struct *acct, struct file *file,
-                struct pid_namespace *ns)
+static void close_work(struct work_struct *work)
 {
-        struct file *old_acct = NULL;
-        struct pid_namespace *old_ns = NULL;
-
-        if (acct->file) {
-                old_acct = acct->file;
-                old_ns = acct->ns;
-                acct->active = 0;
-                acct->file = NULL;
+        struct bsd_acct_struct *acct = container_of(work, struct bsd_acct_struct, work);
+        struct file *file = acct->file;
+        if (file->f_op->flush)
+                file->f_op->flush(file, NULL);
+        __fput_sync(file);
+        complete(&acct->done);
+}
+
+static void acct_kill(struct bsd_acct_struct *acct,
+                      struct bsd_acct_struct *new)
+{
+        if (acct) {
+                struct pid_namespace *ns = acct->ns;
+                do_acct_process(acct);
+                INIT_WORK(&acct->work, close_work);
+                init_completion(&acct->done);
+                schedule_work(&acct->work);
+                wait_for_completion(&acct->done);
+                pin_remove(&acct->pin);
+                ns->bacct = new;
                 acct->ns = NULL;
-                list_del(&acct->list);
-        }
-        if (file) {
-                acct->file = file;
-                acct->ns = ns;
-                acct->needcheck = jiffies + ACCT_TIMEOUT*HZ;
-                acct->active = 1;
-                list_add(&acct->list, &acct_list);
+                atomic_long_dec(&acct->pin.count);
+                mutex_unlock(&acct->lock);
+                pin_put(&acct->pin);
         }
-        if (old_acct) {
-                mnt_unpin(old_acct->f_path.mnt);
-                spin_unlock(&acct_lock);
-                do_acct_process(acct, old_ns, old_acct);
-                filp_close(old_acct, NULL);
-                spin_lock(&acct_lock);
+}
+
+static void acct_pin_kill(struct fs_pin *pin)
+{
+        struct bsd_acct_struct *acct;
+        acct = container_of(pin, struct bsd_acct_struct, pin);
+        mutex_lock(&acct->lock);
+        if (!acct->ns) {
+                mutex_unlock(&acct->lock);
+                pin_put(pin);
+                acct = NULL;
         }
+        acct_kill(acct, NULL);
 }
 
 static int acct_on(struct filename *pathname)
 {
         struct file *file;
-        struct vfsmount *mnt;
-        struct pid_namespace *ns;
-        struct bsd_acct_struct *acct = NULL;
+        struct vfsmount *mnt, *internal;
+        struct pid_namespace *ns = task_active_pid_ns(current);
+        struct bsd_acct_struct *acct, *old;
+        int err;
+
+        acct = kzalloc(sizeof(struct bsd_acct_struct), GFP_KERNEL);
+        if (!acct)
+                return -ENOMEM;
 
         /* Difference from BSD - they don't do O_APPEND */
         file = file_open_name(pathname, O_WRONLY|O_APPEND|O_LARGEFILE, 0);
-        if (IS_ERR(file))
+        if (IS_ERR(file)) {
+                kfree(acct);
                 return PTR_ERR(file);
+        }
 
         if (!S_ISREG(file_inode(file)->i_mode)) {
+                kfree(acct);
                 filp_close(file, NULL);
                 return -EACCES;
         }
 
         if (!file->f_op->write) {
+                kfree(acct);
                 filp_close(file, NULL);
                 return -EIO;
         }
-
-        ns = task_active_pid_ns(current);
-        if (ns->bacct == NULL) {
-                acct = kzalloc(sizeof(struct bsd_acct_struct), GFP_KERNEL);
-                if (acct == NULL) {
-                        filp_close(file, NULL);
-                        return -ENOMEM;
-                }
+        internal = mnt_clone_internal(&file->f_path);
+        if (IS_ERR(internal)) {
+                kfree(acct);
+                filp_close(file, NULL);
+                return PTR_ERR(internal);
         }
-
-        spin_lock(&acct_lock);
-        if (ns->bacct == NULL) {
-                ns->bacct = acct;
-                acct = NULL;
+        err = mnt_want_write(internal);
+        if (err) {
+                mntput(internal);
+                kfree(acct);
+                filp_close(file, NULL);
+                return err;
         }
-
         mnt = file->f_path.mnt;
-        mnt_pin(mnt);
-        acct_file_reopen(ns->bacct, file, ns);
-        spin_unlock(&acct_lock);
-
-        mntput(mnt); /* it's pinned, now give up active reference */
-        kfree(acct);
-
+        file->f_path.mnt = internal;
+
+        atomic_long_set(&acct->pin.count, 1);
+        acct->pin.kill = acct_pin_kill;
+        acct->file = file;
+        acct->needcheck = jiffies;
+        acct->ns = ns;
+        mutex_init(&acct->lock);
+        mutex_lock_nested(&acct->lock, 1);      /* nobody has seen it yet */
+        pin_insert(&acct->pin, mnt);
+
+        old = acct_get(ns);
+        if (old)
+                acct_kill(old, acct);
+        else
+                ns->bacct = acct;
+        mutex_unlock(&acct->lock);
+        mnt_drop_write(mnt);
+        mntput(mnt);
         return 0;
 }
 
+static DEFINE_MUTEX(acct_on_mutex);
+
 /**
  * sys_acct - enable/disable process accounting
  * @name: file name for accounting records or NULL to shutdown accounting
@@ -264,78 +283,20 @@ SYSCALL_DEFINE1(acct, const char __user *, name)
 
                 if (IS_ERR(tmp))
                         return PTR_ERR(tmp);
+                mutex_lock(&acct_on_mutex);
                 error = acct_on(tmp);
+                mutex_unlock(&acct_on_mutex);
                 putname(tmp);
         } else {
-                struct bsd_acct_struct *acct;
-
-                acct = task_active_pid_ns(current)->bacct;
-                if (acct == NULL)
-                        return 0;
-
-                spin_lock(&acct_lock);
-                acct_file_reopen(acct, NULL, NULL);
-                spin_unlock(&acct_lock);
+                acct_kill(acct_get(task_active_pid_ns(current)), NULL);
         }
 
         return error;
 }
 
-/**
- * acct_auto_close - turn off a filesystem's accounting if it is on
- * @m: vfsmount being shut down
- *
- * If the accounting is turned on for a file in the subtree pointed to
- * to by m, turn accounting off.  Done when m is about to die.
- */
-void acct_auto_close_mnt(struct vfsmount *m)
-{
-        struct bsd_acct_struct *acct;
-
-        spin_lock(&acct_lock);
-restart:
-        list_for_each_entry(acct, &acct_list, list)
-                if (acct->file && acct->file->f_path.mnt == m) {
-                        acct_file_reopen(acct, NULL, NULL);
-                        goto restart;
-                }
-        spin_unlock(&acct_lock);
-}
-
-/**
- * acct_auto_close - turn off a filesystem's accounting if it is on
- * @sb: super block for the filesystem
- *
- * If the accounting is turned on for a file in the filesystem pointed
- * to by sb, turn accounting off.
- */
-void acct_auto_close(struct super_block *sb)
-{
-        struct bsd_acct_struct *acct;
-
-        spin_lock(&acct_lock);
-restart:
-        list_for_each_entry(acct, &acct_list, list)
-                if (acct->file && acct->file->f_path.dentry->d_sb == sb) {
-                        acct_file_reopen(acct, NULL, NULL);
-                        goto restart;
-                }
-        spin_unlock(&acct_lock);
-}
-
 void acct_exit_ns(struct pid_namespace *ns)
 {
-        struct bsd_acct_struct *acct = ns->bacct;
-
-        if (acct == NULL)
-                return;
-
-        spin_lock(&acct_lock);
-        if (acct->file != NULL)
-                acct_file_reopen(acct, NULL, NULL);
-        spin_unlock(&acct_lock);
-
-        kfree(acct);
+        acct_kill(acct_get(ns), NULL);
 }
 
 /*
@@ -450,38 +411,20 @@ static u32 encode_float(u64 value)
  *  do_exit() or when switching to a different output file.
  */
 
-/*
- *  do_acct_process does all actual work. Caller holds the reference to file.
- */
-static void do_acct_process(struct bsd_acct_struct *acct,
-                struct pid_namespace *ns, struct file *file)
+static void fill_ac(acct_t *ac)
 {
         struct pacct_struct *pacct = &current->signal->pacct;
-        acct_t ac;
-        mm_segment_t fs;
-        unsigned long flim;
         u64 elapsed, run_time;
         struct tty_struct *tty;
-        const struct cred *orig_cred;
-
-        /* Perform file operations on behalf of whoever enabled accounting */
-        orig_cred = override_creds(file->f_cred);
-
-        /*
-         * First check to see if there is enough free_space to continue
-         * the process accounting system.
-         */
-        if (!check_free_space(acct, file))
-                goto out;
 
         /*
          * Fill the accounting struct with the needed info as recorded
          * by the different kernel functions.
          */
-        memset(&ac, 0, sizeof(acct_t));
+        memset(ac, 0, sizeof(acct_t));
 
-        ac.ac_version = ACCT_VERSION | ACCT_BYTEORDER;
-        strlcpy(ac.ac_comm, current->comm, sizeof(ac.ac_comm));
+        ac->ac_version = ACCT_VERSION | ACCT_BYTEORDER;
+        strlcpy(ac->ac_comm, current->comm, sizeof(ac->ac_comm));
 
         /* calculate run_time in nsec*/
         run_time = ktime_get_ns();
@@ -489,9 +432,9 @@ static void do_acct_process(struct bsd_acct_struct *acct,
         /* convert nsec -> AHZ */
         elapsed = nsec_to_AHZ(run_time);
 #if ACCT_VERSION == 3
-        ac.ac_etime = encode_float(elapsed);
+        ac->ac_etime = encode_float(elapsed);
 #else
-        ac.ac_etime = encode_comp_t(elapsed < (unsigned long) -1l ?
+        ac->ac_etime = encode_comp_t(elapsed < (unsigned long) -1l ?
                                 (unsigned long) elapsed : (unsigned long) -1l);
 #endif
 #if ACCT_VERSION == 1 || ACCT_VERSION == 2
@@ -499,18 +442,58 @@ static void do_acct_process(struct bsd_acct_struct *acct,
                 /* new enlarged etime field */
                 comp2_t etime = encode_comp2_t(elapsed);
 
-                ac.ac_etime_hi = etime >> 16;
-                ac.ac_etime_lo = (u16) etime;
+                ac->ac_etime_hi = etime >> 16;
+                ac->ac_etime_lo = (u16) etime;
         }
 #endif
         do_div(elapsed, AHZ);
-        ac.ac_btime = get_seconds() - elapsed;
+        ac->ac_btime = get_seconds() - elapsed;
+#if ACCT_VERSION==2
+        ac->ac_ahz = AHZ;
+#endif
+
+        spin_lock_irq(&current->sighand->siglock);
+        tty = current->signal->tty;     /* Safe as we hold the siglock */
+        ac->ac_tty = tty ? old_encode_dev(tty_devnum(tty)) : 0;
+        ac->ac_utime = encode_comp_t(jiffies_to_AHZ(cputime_to_jiffies(pacct->ac_utime)));
+        ac->ac_stime = encode_comp_t(jiffies_to_AHZ(cputime_to_jiffies(pacct->ac_stime)));
+        ac->ac_flag = pacct->ac_flag;
+        ac->ac_mem = encode_comp_t(pacct->ac_mem);
+        ac->ac_minflt = encode_comp_t(pacct->ac_minflt);
+        ac->ac_majflt = encode_comp_t(pacct->ac_majflt);
+        ac->ac_exitcode = pacct->ac_exitcode;
+        spin_unlock_irq(&current->sighand->siglock);
+}
+/*
+ *  do_acct_process does all actual work. Caller holds the reference to file.
+ */
+static void do_acct_process(struct bsd_acct_struct *acct)
+{
+        acct_t ac;
+        unsigned long flim;
+        const struct cred *orig_cred;
+        struct pid_namespace *ns = acct->ns;
+        struct file *file = acct->file;
+
+        /*
+         * Accounting records are not subject to resource limits.
+         */
+        flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
+        current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
+        /* Perform file operations on behalf of whoever enabled accounting */
+        orig_cred = override_creds(file->f_cred);
+
+        /*
+         * First check to see if there is enough free_space to continue
+         * the process accounting system.
+         */
+        if (!check_free_space(acct))
+                goto out;
+
+        fill_ac(&ac);
         /* we really need to bite the bullet and change layout */
         ac.ac_uid = from_kuid_munged(file->f_cred->user_ns, orig_cred->uid);
         ac.ac_gid = from_kgid_munged(file->f_cred->user_ns, orig_cred->gid);
-#if ACCT_VERSION == 2
-        ac.ac_ahz = AHZ;
-#endif
 #if ACCT_VERSION == 1 || ACCT_VERSION == 2
         /* backward-compatible 16 bit fields */
         ac.ac_uid16 = ac.ac_uid;
@@ -522,45 +505,18 @@ static void do_acct_process(struct bsd_acct_struct *acct,
         ac.ac_ppid = task_tgid_nr_ns(rcu_dereference(current->real_parent), ns);
         rcu_read_unlock();
 #endif
-
-        spin_lock_irq(&current->sighand->siglock);
-        tty = current->signal->tty;     /* Safe as we hold the siglock */
-        ac.ac_tty = tty ? old_encode_dev(tty_devnum(tty)) : 0;
-        ac.ac_utime = encode_comp_t(jiffies_to_AHZ(cputime_to_jiffies(pacct->ac_utime)));
-        ac.ac_stime = encode_comp_t(jiffies_to_AHZ(cputime_to_jiffies(pacct->ac_stime)));
-        ac.ac_flag = pacct->ac_flag;
-        ac.ac_mem = encode_comp_t(pacct->ac_mem);
-        ac.ac_minflt = encode_comp_t(pacct->ac_minflt);
-        ac.ac_majflt = encode_comp_t(pacct->ac_majflt);
-        ac.ac_exitcode = pacct->ac_exitcode;
-        spin_unlock_irq(&current->sighand->siglock);
-        ac.ac_io = encode_comp_t(0 /* current->io_usage */);    /* %% */
-        ac.ac_rw = encode_comp_t(ac.ac_io / 1024);
-        ac.ac_swaps = encode_comp_t(0);
-
         /*
          * Get freeze protection. If the fs is frozen, just skip the write
          * as we could deadlock the system otherwise.
          */
-        if (!file_start_write_trylock(file))
-                goto out;
-        /*
-         * Kernel segment override to datasegment and write it
-         * to the accounting file.
-         */
-        fs = get_fs();
-        set_fs(KERNEL_DS);
-        /*
-         * Accounting records are not subject to resource limits.
-         */
-        flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
-        current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
-        file->f_op->write(file, (char *)&ac,
-                               sizeof(acct_t), &file->f_pos);
-        current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
-        set_fs(fs);
-        file_end_write(file);
+        if (file_start_write_trylock(file)) {
+                /* it's been opened O_APPEND, so position is irrelevant */
+                loff_t pos = 0;
+                __kernel_write(file, (char *)&ac, sizeof(acct_t), &pos);
+                file_end_write(file);
+        }
 out:
+        current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
         revert_creds(orig_cred);
 }
 
@@ -609,34 +565,20 @@ void acct_collect(long exitcode, int group_dead)
         spin_unlock_irq(&current->sighand->siglock);
 }
 
-static void acct_process_in_ns(struct pid_namespace *ns)
+static void slow_acct_process(struct pid_namespace *ns)
 {
-        struct file *file = NULL;
-        struct bsd_acct_struct *acct;
-
-        acct = ns->bacct;
-        /*
-         * accelerate the common fastpath:
-         */
-        if (!acct || !acct->file)
-                return;
-
-        spin_lock(&acct_lock);
-        file = acct->file;
-        if (unlikely(!file)) {
-                spin_unlock(&acct_lock);
-                return;
+        for ( ; ns; ns = ns->parent) {
+                struct bsd_acct_struct *acct = acct_get(ns);
+                if (acct) {
+                        do_acct_process(acct);
+                        mutex_unlock(&acct->lock);
+                        pin_put(&acct->pin);
+                }
         }
-        get_file(file);
-        spin_unlock(&acct_lock);
-
-        do_acct_process(acct, ns, file);
-        fput(file);
 }
 
 /**
- * acct_process - now just a wrapper around acct_process_in_ns,
- * which in turn is a wrapper around do_acct_process.
+ * acct_process
  *
  * handles process accounting for an exiting task
  */
@@ -649,6 +591,10 @@ void acct_process(void)
          * alive and holds its namespace, which in turn holds
          * its parent.
          */
-        for (ns = task_active_pid_ns(current); ns != NULL; ns = ns->parent)
-                acct_process_in_ns(ns);
+        for (ns = task_active_pid_ns(current); ns != NULL; ns = ns->parent) {
+                if (ns->bacct)
+                        break;
+        }
+        if (unlikely(ns))
+                slow_acct_process(ns);
 }
diff --git a/mm/filemap.c b/mm/filemap.c
index f501b56ec2c6..90effcdf948d 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2602,7 +2602,7 @@ ssize_t __generic_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
                  * that this differs from normal direct-io semantics, which
                  * will return -EFOO even if some bytes were written.
                  */
-                if (unlikely(status < 0) && !written) {
+                if (unlikely(status < 0)) {
                         err = status;
                         goto out;
                 }
diff --git a/mm/iov_iter.c b/mm/iov_iter.c
index 7b5dbd1517b5..ab88dc0ea1d3 100644
--- a/mm/iov_iter.c
+++ b/mm/iov_iter.c
@@ -310,7 +310,7 @@ void iov_iter_init(struct iov_iter *i, int direction,
 EXPORT_SYMBOL(iov_iter_init);
 
 static ssize_t get_pages_iovec(struct iov_iter *i,
-                   struct page **pages, size_t maxsize,
+                   struct page **pages, unsigned maxpages,
                    size_t *start)
 {
         size_t offset = i->iov_offset;
@@ -323,10 +323,10 @@ static ssize_t get_pages_iovec(struct iov_iter *i,
         len = iov->iov_len - offset;
         if (len > i->count)
                 len = i->count;
-        if (len > maxsize)
-                len = maxsize;
         addr = (unsigned long)iov->iov_base + offset;
         len += *start = addr & (PAGE_SIZE - 1);
+        if (len > maxpages * PAGE_SIZE)
+                len = maxpages * PAGE_SIZE;
         addr &= ~(PAGE_SIZE - 1);
         n = (len + PAGE_SIZE - 1) / PAGE_SIZE;
         res = get_user_pages_fast(addr, n, (i->type & WRITE) != WRITE, pages);
@@ -588,15 +588,14 @@ static unsigned long alignment_bvec(const struct iov_iter *i)
 }
 
 static ssize_t get_pages_bvec(struct iov_iter *i,
-                   struct page **pages, size_t maxsize,
+                   struct page **pages, unsigned maxpages,
                    size_t *start)
 {
         const struct bio_vec *bvec = i->bvec;
         size_t len = bvec->bv_len - i->iov_offset;
         if (len > i->count)
                 len = i->count;
-        if (len > maxsize)
-                len = maxsize;
+        /* can't be more than PAGE_SIZE */
         *start = bvec->bv_offset + i->iov_offset;
 
         get_page(*pages = bvec->bv_page);
@@ -712,13 +711,13 @@ unsigned long iov_iter_alignment(const struct iov_iter *i)
 EXPORT_SYMBOL(iov_iter_alignment);
 
 ssize_t iov_iter_get_pages(struct iov_iter *i,
-                   struct page **pages, size_t maxsize,
+                   struct page **pages, unsigned maxpages,
                    size_t *start)
 {
         if (i->type & ITER_BVEC)
-                return get_pages_bvec(i, pages, maxsize, start);
+                return get_pages_bvec(i, pages, maxpages, start);
         else
-                return get_pages_iovec(i, pages, maxsize, start);
+                return get_pages_iovec(i, pages, maxpages, start);
 }
 EXPORT_SYMBOL(iov_iter_get_pages);
 
diff --git a/mm/shmem.c b/mm/shmem.c
index a42add14331c..0e5fb225007c 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2323,17 +2323,45 @@ static int shmem_rmdir(struct inode *dir, struct dentry *dentry)
         return shmem_unlink(dir, dentry);
 }
 
+static int shmem_exchange(struct inode *old_dir, struct dentry *old_dentry, struct inode *new_dir, struct dentry *new_dentry)
+{
+        bool old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
+        bool new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
+
+        if (old_dir != new_dir && old_is_dir != new_is_dir) {
+                if (old_is_dir) {
+                        drop_nlink(old_dir);
+                        inc_nlink(new_dir);
+                } else {
+                        drop_nlink(new_dir);
+                        inc_nlink(old_dir);
+                }
+        }
+        old_dir->i_ctime = old_dir->i_mtime =
+        new_dir->i_ctime = new_dir->i_mtime =
+        old_dentry->d_inode->i_ctime =
+        new_dentry->d_inode->i_ctime = CURRENT_TIME;
+
+        return 0;
+}
+
 /*
  * The VFS layer already does all the dentry stuff for rename,
  * we just have to decrement the usage count for the target if
  * it exists so that the VFS layer correctly free's it when it
  * gets overwritten.
  */
-static int shmem_rename(struct inode *old_dir, struct dentry *old_dentry, struct inode *new_dir, struct dentry *new_dentry)
+static int shmem_rename2(struct inode *old_dir, struct dentry *old_dentry, struct inode *new_dir, struct dentry *new_dentry, unsigned int flags)
 {
         struct inode *inode = old_dentry->d_inode;
         int they_are_dirs = S_ISDIR(inode->i_mode);
 
+        if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE))
+                return -EINVAL;
+
+        if (flags & RENAME_EXCHANGE)
+                return shmem_exchange(old_dir, old_dentry, new_dir, new_dentry);
+
         if (!simple_empty(new_dentry))
                 return -ENOTEMPTY;
 
@@ -3087,7 +3115,7 @@ static const struct inode_operations shmem_dir_inode_operations = {
         .mkdir          = shmem_mkdir,
         .rmdir          = shmem_rmdir,
         .mknod          = shmem_mknod,
-        .rename         = shmem_rename,
+        .rename2        = shmem_rename2,
         .tmpfile        = shmem_tmpfile,
 #endif
 #ifdef CONFIG_TMPFS_XATTR