4 files changed, 33 insertions, 28 deletions

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 4c878476bb91..b08ea4717e9d 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -107,6 +107,12 @@ void extent_io_exit(void)
                 list_del(&eb->leak_list);
                 kmem_cache_free(extent_buffer_cache, eb);
         }
+
+        /*
+         * Make sure all delayed rcu free are flushed before we
+         * destroy caches.
+         */
+        rcu_barrier();
         if (extent_state_cache)
                 kmem_cache_destroy(extent_state_cache);
         if (extent_buffer_cache)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 2a028a58619c..a6ed6944e50c 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -7076,6 +7076,11 @@ static void init_once(void *foo)
 
 void btrfs_destroy_cachep(void)
 {
+        /*
+         * Make sure all delayed rcu free inodes are flushed before we
+         * destroy cache.
+         */
+        rcu_barrier();
         if (btrfs_inode_cachep)
                 kmem_cache_destroy(btrfs_inode_cachep);
         if (btrfs_trans_handle_cachep)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 27bfce58da3b..47127c1bd290 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1397,7 +1397,6 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
                                 u64 *transid, bool readonly,
                                 struct btrfs_qgroup_inherit **inherit)
 {
-        struct file *src_file;
         int namelen;
         int ret = 0;
 
@@ -1421,25 +1420,24 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
                 ret = btrfs_mksubvol(&file->f_path, name, namelen,
                                      NULL, transid, readonly, inherit);
         } else {
+                struct fd src = fdget(fd);
                 struct inode *src_inode;
-                src_file = fget(fd);
-                if (!src_file) {
+                if (!src.file) {
                         ret = -EINVAL;
                         goto out_drop_write;
                 }
 
-                src_inode = src_file->f_path.dentry->d_inode;
+                src_inode = src.file->f_path.dentry->d_inode;
                 if (src_inode->i_sb != file->f_path.dentry->d_inode->i_sb) {
                         printk(KERN_INFO "btrfs: Snapshot src from "
                                "another FS\n");
                         ret = -EINVAL;
-                        fput(src_file);
-                        goto out_drop_write;
+                } else {
+                        ret = btrfs_mksubvol(&file->f_path, name, namelen,
+                                             BTRFS_I(src_inode)->root,
+                                             transid, readonly, inherit);
                 }
-                ret = btrfs_mksubvol(&file->f_path, name, namelen,
-                                     BTRFS_I(src_inode)->root,
-                                     transid, readonly, inherit);
-                fput(src_file);
+                fdput(src);
         }
 out_drop_write:
         mnt_drop_write_file(file);
@@ -2341,7 +2339,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
 {
         struct inode *inode = fdentry(file)->d_inode;
         struct btrfs_root *root = BTRFS_I(inode)->root;
-        struct file *src_file;
+        struct fd src_file;
         struct inode *src;
         struct btrfs_trans_handle *trans;
         struct btrfs_path *path;
@@ -2376,24 +2374,24 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
         if (ret)
                 return ret;
 
-        src_file = fget(srcfd);
-        if (!src_file) {
+        src_file = fdget(srcfd);
+        if (!src_file.file) {
                 ret = -EBADF;
                 goto out_drop_write;
         }
 
         ret = -EXDEV;
-        if (src_file->f_path.mnt != file->f_path.mnt)
+        if (src_file.file->f_path.mnt != file->f_path.mnt)
                 goto out_fput;
 
-        src = src_file->f_dentry->d_inode;
+        src = src_file.file->f_dentry->d_inode;
 
         ret = -EINVAL;
         if (src == inode)
                 goto out_fput;
 
         /* the src must be open for reading */
-        if (!(src_file->f_mode & FMODE_READ))
+        if (!(src_file.file->f_mode & FMODE_READ))
                 goto out_fput;
 
         /* don't make the dst file partly checksummed */
@@ -2724,7 +2722,7 @@ out_unlock:
         vfree(buf);
         btrfs_free_path(path);
 out_fput:
-        fput(src_file);
+        fdput(src_file);
 out_drop_write:
         mnt_drop_write_file(file);
         return ret;
diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
index 48a4882d8ad5..a955669519a2 100644
--- a/fs/btrfs/reada.c
+++ b/fs/btrfs/reada.c
@@ -68,7 +68,7 @@ struct reada_extent {
         u32                     blocksize;
         int                     err;
         struct list_head        extctl;
-        struct kref             refcnt;
+        int                     refcnt;
         spinlock_t              lock;
         struct reada_zone       *zones[BTRFS_MAX_MIRRORS];
         int                     nzones;
@@ -126,7 +126,7 @@ static int __readahead_hook(struct btrfs_root *root, struct extent_buffer *eb,
         spin_lock(&fs_info->reada_lock);
         re = radix_tree_lookup(&fs_info->reada_tree, index);
         if (re)
-                kref_get(&re->refcnt);
+                re->refcnt++;
         spin_unlock(&fs_info->reada_lock);
 
         if (!re)
@@ -336,7 +336,7 @@ static struct reada_extent *reada_find_extent(struct btrfs_root *root,
         spin_lock(&fs_info->reada_lock);
         re = radix_tree_lookup(&fs_info->reada_tree, index);
         if (re)
-                kref_get(&re->refcnt);
+                re->refcnt++;
         spin_unlock(&fs_info->reada_lock);
 
         if (re)
@@ -352,7 +352,7 @@ static struct reada_extent *reada_find_extent(struct btrfs_root *root,
         re->top = *top;
         INIT_LIST_HEAD(&re->extctl);
         spin_lock_init(&re->lock);
-        kref_init(&re->refcnt);
+        re->refcnt = 1;
 
         /*
          * map block
@@ -398,7 +398,7 @@ static struct reada_extent *reada_find_extent(struct btrfs_root *root,
         if (ret == -EEXIST) {
                 re_exist = radix_tree_lookup(&fs_info->reada_tree, index);
                 BUG_ON(!re_exist);
-                kref_get(&re_exist->refcnt);
+                re_exist->refcnt++;
                 spin_unlock(&fs_info->reada_lock);
                 goto error;
         }
@@ -465,10 +465,6 @@ error:
         return re_exist;
 }
 
-static void reada_kref_dummy(struct kref *kr)
-{
-}
-
 static void reada_extent_put(struct btrfs_fs_info *fs_info,
                              struct reada_extent *re)
 {
@@ -476,7 +472,7 @@ static void reada_extent_put(struct btrfs_fs_info *fs_info,
         unsigned long index = re->logical >> PAGE_CACHE_SHIFT;
 
         spin_lock(&fs_info->reada_lock);
-        if (!kref_put(&re->refcnt, reada_kref_dummy)) {
+        if (--re->refcnt) {
                 spin_unlock(&fs_info->reada_lock);
                 return;
         }
@@ -671,7 +667,7 @@ static int reada_start_machine_dev(struct btrfs_fs_info *fs_info,
                 return 0;
         }
         dev->reada_next = re->logical + re->blocksize;
-        kref_get(&re->refcnt);
+        re->refcnt++;
 
         spin_unlock(&fs_info->reada_lock);