7 files changed, 490 insertions, 147 deletions

diff --git a/fs/fuse/control.c b/fs/fuse/control.c
index 3773fd63d2f9..85542a7daf40 100644
--- a/fs/fuse/control.c
+++ b/fs/fuse/control.c
@@ -179,23 +179,27 @@ static ssize_t fuse_conn_congestion_threshold_write(struct file *file,
 static const struct file_operations fuse_ctl_abort_ops = {
         .open = nonseekable_open,
         .write = fuse_conn_abort_write,
+        .llseek = no_llseek,
 };
 
 static const struct file_operations fuse_ctl_waiting_ops = {
         .open = nonseekable_open,
         .read = fuse_conn_waiting_read,
+        .llseek = no_llseek,
 };
 
 static const struct file_operations fuse_conn_max_background_ops = {
         .open = nonseekable_open,
         .read = fuse_conn_max_background_read,
         .write = fuse_conn_max_background_write,
+        .llseek = no_llseek,
 };
 
 static const struct file_operations fuse_conn_congestion_threshold_ops = {
         .open = nonseekable_open,
         .read = fuse_conn_congestion_threshold_read,
         .write = fuse_conn_congestion_threshold_write,
+        .llseek = no_llseek,
 };
 
 static struct dentry *fuse_ctl_add_dentry(struct dentry *parent,
@@ -218,6 +222,7 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent,
         if (!inode)
                 return NULL;
 
+        inode->i_ino = get_next_ino();
         inode->i_mode = mode;
         inode->i_uid = fc->user_id;
         inode->i_gid = fc->group_id;
@@ -317,12 +322,10 @@ static int fuse_ctl_fill_super(struct super_block *sb, void *data, int silent)
         return 0;
 }
 
-static int fuse_ctl_get_sb(struct file_system_type *fs_type, int flags,
-                        const char *dev_name, void *raw_data,
-                        struct vfsmount *mnt)
+static struct dentry *fuse_ctl_mount(struct file_system_type *fs_type,
+                        int flags, const char *dev_name, void *raw_data)
 {
-        return get_sb_single(fs_type, flags, raw_data,
-                                fuse_ctl_fill_super, mnt);
+        return mount_single(fs_type, flags, raw_data, fuse_ctl_fill_super);
 }
 
 static void fuse_ctl_kill_sb(struct super_block *sb)
@@ -341,7 +344,7 @@ static void fuse_ctl_kill_sb(struct super_block *sb)
 static struct file_system_type fuse_ctl_fs_type = {
         .owner          = THIS_MODULE,
         .name           = "fusectl",
-        .get_sb         = fuse_ctl_get_sb,
+        .mount          = fuse_ctl_mount,
         .kill_sb        = fuse_ctl_kill_sb,
 };
 
diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index e1f8171278bd..b6cca47f7b07 100644
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -182,6 +182,7 @@ static const struct file_operations cuse_frontend_fops = {
         .unlocked_ioctl         = cuse_file_ioctl,
         .compat_ioctl           = cuse_file_compat_ioctl,
         .poll                   = fuse_file_poll,
+        .llseek         = noop_llseek,
 };
 
 
@@ -304,7 +305,7 @@ static void cuse_gendev_release(struct device *dev)
 static void cuse_process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
 {
         struct cuse_conn *cc = fc_to_cc(fc);
-        struct cuse_init_out *arg = &req->misc.cuse_init_out;
+        struct cuse_init_out *arg = req->out.args[0].value;
         struct page *page = req->pages[0];
         struct cuse_devinfo devinfo = { };
         struct device *dev;
@@ -383,6 +384,7 @@ static void cuse_process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
         dev_set_uevent_suppress(dev, 0);
         kobject_uevent(&dev->kobj, KOBJ_ADD);
 out:
+        kfree(arg);
         __free_page(page);
         return;
 
@@ -404,6 +406,7 @@ static int cuse_send_init(struct cuse_conn *cc)
         struct page *page;
         struct fuse_conn *fc = &cc->fc;
         struct cuse_init_in *arg;
+        void *outarg;
 
         BUILD_BUG_ON(CUSE_INIT_INFO_MAX > PAGE_SIZE);
 
@@ -418,6 +421,10 @@ static int cuse_send_init(struct cuse_conn *cc)
         if (!page)
                 goto err_put_req;
 
+        outarg = kzalloc(sizeof(struct cuse_init_out), GFP_KERNEL);
+        if (!outarg)
+                goto err_free_page;
+
         arg = &req->misc.cuse_init_in;
         arg->major = FUSE_KERNEL_VERSION;
         arg->minor = FUSE_KERNEL_MINOR_VERSION;
@@ -428,7 +435,7 @@ static int cuse_send_init(struct cuse_conn *cc)
         req->in.args[0].value = arg;
         req->out.numargs = 2;
         req->out.args[0].size = sizeof(struct cuse_init_out);
-        req->out.args[0].value = &req->misc.cuse_init_out;
+        req->out.args[0].value = outarg;
         req->out.args[1].size = CUSE_INIT_INFO_MAX;
         req->out.argvar = 1;
         req->out.argpages = 1;
@@ -439,6 +446,8 @@ static int cuse_send_init(struct cuse_conn *cc)
 
         return 0;
 
+err_free_page:
+        __free_page(page);
 err_put_req:
         fuse_put_request(fc, req);
 err:
@@ -457,7 +466,7 @@ static void cuse_fc_release(struct fuse_conn *fc)
  * @file: file struct being opened
  *
  * Userland CUSE server can create a CUSE device by opening /dev/cuse
- * and replying to the initilaization request kernel sends.  This
+ * and replying to the initialization request kernel sends.  This
  * function is responsible for handling CUSE device initialization.
  * Because the fd opened by this function is used during
  * initialization, this function only creates cuse_conn and sends
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index cde755cca564..640fc229df10 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -251,6 +251,20 @@ static void queue_request(struct fuse_conn *fc, struct fuse_req *req)
         kill_fasync(&fc->fasync, SIGIO, POLL_IN);
 }
 
+void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
+                       u64 nodeid, u64 nlookup)
+{
+        forget->forget_one.nodeid = nodeid;
+        forget->forget_one.nlookup = nlookup;
+
+        spin_lock(&fc->lock);
+        fc->forget_list_tail->next = forget;
+        fc->forget_list_tail = forget;
+        wake_up(&fc->waitq);
+        kill_fasync(&fc->fasync, SIGIO, POLL_IN);
+        spin_unlock(&fc->lock);
+}
+
 static void flush_bg_queue(struct fuse_conn *fc)
 {
         while (fc->active_background < fc->max_background &&
@@ -438,12 +452,6 @@ static void fuse_request_send_nowait(struct fuse_conn *fc, struct fuse_req *req)
         }
 }
 
-void fuse_request_send_noreply(struct fuse_conn *fc, struct fuse_req *req)
-{
-        req->isreply = 0;
-        fuse_request_send_nowait(fc, req);
-}
-
 void fuse_request_send_background(struct fuse_conn *fc, struct fuse_req *req)
 {
         req->isreply = 1;
@@ -729,14 +737,12 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
         if (WARN_ON(PageMlocked(oldpage)))
                 goto out_fallback_unlock;
 
-        remove_from_page_cache(oldpage);
-        page_cache_release(oldpage);
-
-        err = add_to_page_cache_locked(newpage, mapping, index, GFP_KERNEL);
+        err = replace_page_cache_page(oldpage, newpage, GFP_KERNEL);
         if (err) {
-                printk(KERN_WARNING "fuse_try_move_page: failed to add page");
-                goto out_fallback_unlock;
+                unlock_page(newpage);
+                return err;
         }
+
         page_cache_get(newpage);
 
         if (!(buf->flags & PIPE_BUF_FLAG_LRU))
@@ -809,11 +815,9 @@ static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep,
         int err;
         struct page *page = *pagep;
 
-        if (page && zeroing && count < PAGE_SIZE) {
-                void *mapaddr = kmap_atomic(page, KM_USER1);
-                memset(mapaddr, 0, PAGE_SIZE);
-                kunmap_atomic(mapaddr, KM_USER1);
-        }
+        if (page && zeroing && count < PAGE_SIZE)
+                clear_highpage(page);
+
         while (count) {
                 if (cs->write && cs->pipebufs && page) {
                         return fuse_ref_page(cs, page, offset, count);
@@ -830,10 +834,10 @@ static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep,
                         }
                 }
                 if (page) {
-                        void *mapaddr = kmap_atomic(page, KM_USER1);
+                        void *mapaddr = kmap_atomic(page, KM_USER0);
                         void *buf = mapaddr + offset;
                         offset += fuse_copy_do(cs, &buf, &count);
-                        kunmap_atomic(mapaddr, KM_USER1);
+                        kunmap_atomic(mapaddr, KM_USER0);
                 } else
                         offset += fuse_copy_do(cs, NULL, &count);
         }
@@ -898,9 +902,15 @@ static int fuse_copy_args(struct fuse_copy_state *cs, unsigned numargs,
         return err;
 }
 
+static int forget_pending(struct fuse_conn *fc)
+{
+        return fc->forget_list_head.next != NULL;
+}
+
 static int request_pending(struct fuse_conn *fc)
 {
-        return !list_empty(&fc->pending) || !list_empty(&fc->interrupts);
+        return !list_empty(&fc->pending) || !list_empty(&fc->interrupts) ||
+                forget_pending(fc);
 }
 
 /* Wait until a request is available on the pending list */
@@ -962,6 +972,120 @@ __releases(fc->lock)
         return err ? err : reqsize;
 }
 
+static struct fuse_forget_link *dequeue_forget(struct fuse_conn *fc,
+                                               unsigned max,
+                                               unsigned *countp)
+{
+        struct fuse_forget_link *head = fc->forget_list_head.next;
+        struct fuse_forget_link **newhead = &head;
+        unsigned count;
+
+        for (count = 0; *newhead != NULL && count < max; count++)
+                newhead = &(*newhead)->next;
+
+        fc->forget_list_head.next = *newhead;
+        *newhead = NULL;
+        if (fc->forget_list_head.next == NULL)
+                fc->forget_list_tail = &fc->forget_list_head;
+
+        if (countp != NULL)
+                *countp = count;
+
+        return head;
+}
+
+static int fuse_read_single_forget(struct fuse_conn *fc,
+                                   struct fuse_copy_state *cs,
+                                   size_t nbytes)
+__releases(fc->lock)
+{
+        int err;
+        struct fuse_forget_link *forget = dequeue_forget(fc, 1, NULL);
+        struct fuse_forget_in arg = {
+                .nlookup = forget->forget_one.nlookup,
+        };
+        struct fuse_in_header ih = {
+                .opcode = FUSE_FORGET,
+                .nodeid = forget->forget_one.nodeid,
+                .unique = fuse_get_unique(fc),
+                .len = sizeof(ih) + sizeof(arg),
+        };
+
+        spin_unlock(&fc->lock);
+        kfree(forget);
+        if (nbytes < ih.len)
+                return -EINVAL;
+
+        err = fuse_copy_one(cs, &ih, sizeof(ih));
+        if (!err)
+                err = fuse_copy_one(cs, &arg, sizeof(arg));
+        fuse_copy_finish(cs);
+
+        if (err)
+                return err;
+
+        return ih.len;
+}
+
+static int fuse_read_batch_forget(struct fuse_conn *fc,
+                                   struct fuse_copy_state *cs, size_t nbytes)
+__releases(fc->lock)
+{
+        int err;
+        unsigned max_forgets;
+        unsigned count;
+        struct fuse_forget_link *head;
+        struct fuse_batch_forget_in arg = { .count = 0 };
+        struct fuse_in_header ih = {
+                .opcode = FUSE_BATCH_FORGET,
+                .unique = fuse_get_unique(fc),
+                .len = sizeof(ih) + sizeof(arg),
+        };
+
+        if (nbytes < ih.len) {
+                spin_unlock(&fc->lock);
+                return -EINVAL;
+        }
+
+        max_forgets = (nbytes - ih.len) / sizeof(struct fuse_forget_one);
+        head = dequeue_forget(fc, max_forgets, &count);
+        spin_unlock(&fc->lock);
+
+        arg.count = count;
+        ih.len += count * sizeof(struct fuse_forget_one);
+        err = fuse_copy_one(cs, &ih, sizeof(ih));
+        if (!err)
+                err = fuse_copy_one(cs, &arg, sizeof(arg));
+
+        while (head) {
+                struct fuse_forget_link *forget = head;
+
+                if (!err) {
+                        err = fuse_copy_one(cs, &forget->forget_one,
+                                            sizeof(forget->forget_one));
+                }
+                head = forget->next;
+                kfree(forget);
+        }
+
+        fuse_copy_finish(cs);
+
+        if (err)
+                return err;
+
+        return ih.len;
+}
+
+static int fuse_read_forget(struct fuse_conn *fc, struct fuse_copy_state *cs,
+                            size_t nbytes)
+__releases(fc->lock)
+{
+        if (fc->minor < 16 || fc->forget_list_head.next->next == NULL)
+                return fuse_read_single_forget(fc, cs, nbytes);
+        else
+                return fuse_read_batch_forget(fc, cs, nbytes);
+}
+
 /*
  * Read a single request into the userspace filesystem's buffer.  This
  * function waits until a request is available, then removes it from
@@ -1000,6 +1124,14 @@ static ssize_t fuse_dev_do_read(struct fuse_conn *fc, struct file *file,
                 return fuse_read_interrupt(fc, cs, nbytes, req);
         }
 
+        if (forget_pending(fc)) {
+                if (list_empty(&fc->pending) || fc->forget_batch-- > 0)
+                        return fuse_read_forget(fc, cs, nbytes);
+
+                if (fc->forget_batch <= -8)
+                        fc->forget_batch = 16;
+        }
+
         req = list_entry(fc->pending.next, struct fuse_req, list);
         req->state = FUSE_REQ_READING;
         list_move(&req->list, &fc->io);
@@ -1092,7 +1224,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
         if (!fc)
                 return -EPERM;
 
-        bufs = kmalloc(pipe->buffers * sizeof (struct pipe_buffer), GFP_KERNEL);
+        bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
         if (!bufs)
                 return -ENOMEM;
 
@@ -1336,12 +1468,7 @@ out_finish:
 
 static void fuse_retrieve_end(struct fuse_conn *fc, struct fuse_req *req)
 {
-        int i;
-
-        for (i = 0; i < req->num_pages; i++) {
-                struct page *page = req->pages[i];
-                page_cache_release(page);
-        }
+        release_pages(req->pages, req->num_pages, 0);
 }
 
 static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
@@ -1633,7 +1760,7 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
         if (!fc)
                 return -EPERM;
 
-        bufs = kmalloc(pipe->buffers * sizeof (struct pipe_buffer), GFP_KERNEL);
+        bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
         if (!bufs)
                 return -ENOMEM;
 
@@ -1777,6 +1904,23 @@ __acquires(fc->lock)
         flush_bg_queue(fc);
         end_requests(fc, &fc->pending);
         end_requests(fc, &fc->processing);
+        while (forget_pending(fc))
+                kfree(dequeue_forget(fc, 1, NULL));
+}
+
+static void end_polls(struct fuse_conn *fc)
+{
+        struct rb_node *p;
+
+        p = rb_first(&fc->polled_files);
+
+        while (p) {
+                struct fuse_file *ff;
+                ff = rb_entry(p, struct fuse_file, polled_node);
+                wake_up_interruptible_all(&ff->poll_wait);
+
+                p = rb_next(p);
+        }
 }
 
 /*
@@ -1806,6 +1950,7 @@ void fuse_abort_conn(struct fuse_conn *fc)
                 fc->blocked = 0;
                 end_io_requests(fc);
                 end_queued_requests(fc);
+                end_polls(fc);
                 wake_up_all(&fc->waitq);
                 wake_up_all(&fc->blocked_waitq);
                 kill_fasync(&fc->fasync, SIGIO, POLL_IN);
@@ -1822,6 +1967,7 @@ int fuse_dev_release(struct inode *inode, struct file *file)
                 fc->connected = 0;
                 fc->blocked = 0;
                 end_queued_requests(fc);
+                end_polls(fc);
                 wake_up_all(&fc->blocked_waitq);
                 spin_unlock(&fc->lock);
                 fuse_conn_put(fc);
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index c9627c95482d..d50160714595 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -10,9 +10,9 @@
 
 #include <linux/pagemap.h>
 #include <linux/file.h>
-#include <linux/gfp.h>
 #include <linux/sched.h>
 #include <linux/namei.h>
+#include <linux/slab.h>
 
 #if BITS_PER_LONG >= 64
 static inline void fuse_dentry_settime(struct dentry *entry, u64 time)
@@ -156,8 +156,9 @@ u64 fuse_get_attr_version(struct fuse_conn *fc)
  */
 static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
 {
-        struct inode *inode = entry->d_inode;
+        struct inode *inode;
 
+        inode = ACCESS_ONCE(entry->d_inode);
         if (inode && is_bad_inode(inode))
                 return 0;
         else if (fuse_dentry_time(entry) < get_jiffies_64()) {
@@ -165,7 +166,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 struct fuse_entry_out outarg;
                 struct fuse_conn *fc;
                 struct fuse_req *req;
-                struct fuse_req *forget_req;
+                struct fuse_forget_link *forget;
                 struct dentry *parent;
                 u64 attr_version;
 
@@ -173,13 +174,16 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 if (!inode)
                         return 0;
 
+                if (nd && (nd->flags & LOOKUP_RCU))
+                        return -ECHILD;
+
                 fc = get_fuse_conn(inode);
                 req = fuse_get_req(fc);
                 if (IS_ERR(req))
                         return 0;
 
-                forget_req = fuse_get_req(fc);
-                if (IS_ERR(forget_req)) {
+                forget = fuse_alloc_forget();
+                if (!forget) {
                         fuse_put_request(fc, req);
                         return 0;
                 }
@@ -199,15 +203,14 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 if (!err) {
                         struct fuse_inode *fi = get_fuse_inode(inode);
                         if (outarg.nodeid != get_node_id(inode)) {
-                                fuse_send_forget(fc, forget_req,
-                                                 outarg.nodeid, 1);
+                                fuse_queue_forget(fc, forget, outarg.nodeid, 1);
                                 return 0;
                         }
                         spin_lock(&fc->lock);
                         fi->nlookup++;
                         spin_unlock(&fc->lock);
                 }
-                fuse_put_request(fc, forget_req);
+                kfree(forget);
                 if (err || (outarg.attr.mode ^ inode->i_mode) & S_IFMT)
                         return 0;
 
@@ -259,7 +262,7 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, struct qstr *name,
 {
         struct fuse_conn *fc = get_fuse_conn_super(sb);
         struct fuse_req *req;
-        struct fuse_req *forget_req;
+        struct fuse_forget_link *forget;
         u64 attr_version;
         int err;
 
@@ -273,9 +276,9 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, struct qstr *name,
         if (IS_ERR(req))
                 goto out;
 
-        forget_req = fuse_get_req(fc);
-        err = PTR_ERR(forget_req);
-        if (IS_ERR(forget_req)) {
+        forget = fuse_alloc_forget();
+        err = -ENOMEM;
+        if (!forget) {
                 fuse_put_request(fc, req);
                 goto out;
         }
@@ -301,13 +304,13 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, struct qstr *name,
                            attr_version);
         err = -ENOMEM;
         if (!*inode) {
-                fuse_send_forget(fc, forget_req, outarg->nodeid, 1);
+                fuse_queue_forget(fc, forget, outarg->nodeid, 1);
                 goto out;
         }
         err = 0;
 
  out_put_forget:
-        fuse_put_request(fc, forget_req);
+        kfree(forget);
  out:
         return err;
 }
@@ -347,7 +350,6 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         }
 
         entry = newent ? newent : entry;
-        entry->d_op = &fuse_dentry_operations;
         if (outarg_valid)
                 fuse_change_entry_timeout(entry, &outarg);
         else
@@ -374,7 +376,7 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         struct inode *inode;
         struct fuse_conn *fc = get_fuse_conn(dir);
         struct fuse_req *req;
-        struct fuse_req *forget_req;
+        struct fuse_forget_link *forget;
         struct fuse_create_in inarg;
         struct fuse_open_out outopen;
         struct fuse_entry_out outentry;
@@ -388,9 +390,9 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         if (flags & O_DIRECT)
                 return -EINVAL;
 
-        forget_req = fuse_get_req(fc);
-        if (IS_ERR(forget_req))
-                return PTR_ERR(forget_req);
+        forget = fuse_alloc_forget();
+        if (!forget)
+                return -ENOMEM;
 
         req = fuse_get_req(fc);
         err = PTR_ERR(req);
@@ -448,10 +450,10 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         if (!inode) {
                 flags &= ~(O_CREAT | O_EXCL | O_TRUNC);
                 fuse_sync_release(ff, flags);
-                fuse_send_forget(fc, forget_req, outentry.nodeid, 1);
+                fuse_queue_forget(fc, forget, outentry.nodeid, 1);
                 return -ENOMEM;
         }
-        fuse_put_request(fc, forget_req);
+        kfree(forget);
         d_instantiate(entry, inode);
         fuse_change_entry_timeout(entry, &outentry);
         fuse_invalidate_attr(dir);
@@ -469,7 +471,7 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
  out_put_request:
         fuse_put_request(fc, req);
  out_put_forget_req:
-        fuse_put_request(fc, forget_req);
+        kfree(forget);
         return err;
 }
 
@@ -483,12 +485,12 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
         struct fuse_entry_out outarg;
         struct inode *inode;
         int err;
-        struct fuse_req *forget_req;
+        struct fuse_forget_link *forget;
 
-        forget_req = fuse_get_req(fc);
-        if (IS_ERR(forget_req)) {
+        forget = fuse_alloc_forget();
+        if (!forget) {
                 fuse_put_request(fc, req);
-                return PTR_ERR(forget_req);
+                return -ENOMEM;
         }
 
         memset(&outarg, 0, sizeof(outarg));
@@ -515,10 +517,10 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
         inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
                           &outarg.attr, entry_attr_timeout(&outarg), 0);
         if (!inode) {
-                fuse_send_forget(fc, forget_req, outarg.nodeid, 1);
+                fuse_queue_forget(fc, forget, outarg.nodeid, 1);
                 return -ENOMEM;
         }
-        fuse_put_request(fc, forget_req);
+        kfree(forget);
 
         if (S_ISDIR(inode->i_mode)) {
                 struct dentry *alias;
@@ -541,7 +543,7 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
         return 0;
 
  out_put_forget_req:
-        fuse_put_request(fc, forget_req);
+        kfree(forget);
         return err;
 }
 
@@ -689,6 +691,7 @@ static int fuse_rename(struct inode *olddir, struct dentry *oldent,
         struct fuse_rename_in inarg;
         struct fuse_conn *fc = get_fuse_conn(olddir);
         struct fuse_req *req = fuse_get_req(fc);
+
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
@@ -968,6 +971,14 @@ static int fuse_access(struct inode *inode, int mask)
         return err;
 }
 
+static int fuse_perm_getattr(struct inode *inode, int flags)
+{
+        if (flags & IPERM_FLAG_RCU)
+                return -ECHILD;
+
+        return fuse_do_getattr(inode, NULL, NULL);
+}
+
 /*
  * Check permission.  The two basic access models of FUSE are:
  *
@@ -981,7 +992,7 @@ static int fuse_access(struct inode *inode, int mask)
  * access request is sent.  Execute permission is still checked
  * locally based on file mode.
  */
-static int fuse_permission(struct inode *inode, int mask)
+static int fuse_permission(struct inode *inode, int mask, unsigned int flags)
 {
         struct fuse_conn *fc = get_fuse_conn(inode);
         bool refreshed = false;
@@ -995,21 +1006,28 @@ static int fuse_permission(struct inode *inode, int mask)
          */
         if ((fc->flags & FUSE_DEFAULT_PERMISSIONS) ||
             ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))) {
-                err = fuse_update_attributes(inode, NULL, NULL, &refreshed);
-                if (err)
-                        return err;
+                struct fuse_inode *fi = get_fuse_inode(inode);
+
+                if (fi->i_time < get_jiffies_64()) {
+                        refreshed = true;
+
+                        err = fuse_perm_getattr(inode, flags);
+                        if (err)
+                                return err;
+                }
         }
 
         if (fc->flags & FUSE_DEFAULT_PERMISSIONS) {
-                err = generic_permission(inode, mask, NULL);
+                err = generic_permission(inode, mask, flags, NULL);
 
                 /* If permission is denied, try to refresh file
                    attributes.  This is also needed, because the root
                    node will at first have no permissions */
                 if (err == -EACCES && !refreshed) {
-                        err = fuse_do_getattr(inode, NULL, NULL);
+                        err = fuse_perm_getattr(inode, flags);
                         if (!err)
-                                err = generic_permission(inode, mask, NULL);
+                                err = generic_permission(inode, mask,
+                                                        flags, NULL);
                 }
 
                 /* Note: the opposite of the above test does not
@@ -1017,13 +1035,16 @@ static int fuse_permission(struct inode *inode, int mask)
                    noticed immediately, only after the attribute
                    timeout has expired */
         } else if (mask & (MAY_ACCESS | MAY_CHDIR)) {
+                if (flags & IPERM_FLAG_RCU)
+                        return -ECHILD;
+
                 err = fuse_access(inode, mask);
         } else if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) {
                 if (!(inode->i_mode & S_IXUGO)) {
                         if (refreshed)
                                 return -EACCES;
 
-                        err = fuse_do_getattr(inode, NULL, NULL);
+                        err = fuse_perm_getattr(inode, flags);
                         if (!err && !(inode->i_mode & S_IXUGO))
                                 return -EACCES;
                 }
@@ -1277,8 +1298,11 @@ static int fuse_do_setattr(struct dentry *entry, struct iattr *attr,
         if (err)
                 return err;
 
-        if ((attr->ia_valid & ATTR_OPEN) && fc->atomic_o_trunc)
-                return 0;
+        if (attr->ia_valid & ATTR_OPEN) {
+                if (fc->atomic_o_trunc)
+                        return 0;
+                file = NULL;
+        }
 
         if (attr->ia_valid & ATTR_SIZE)
                 is_truncate = true;
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index c8224587123f..82a66466a24c 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/module.h>
+#include <linux/compat.h>
 
 static const struct file_operations fuse_direct_io_file_operations;
 
@@ -85,18 +86,52 @@ struct fuse_file *fuse_file_get(struct fuse_file *ff)
         return ff;
 }
 
+static void fuse_release_async(struct work_struct *work)
+{
+        struct fuse_req *req;
+        struct fuse_conn *fc;
+        struct path path;
+
+        req = container_of(work, struct fuse_req, misc.release.work);
+        path = req->misc.release.path;
+        fc = get_fuse_conn(path.dentry->d_inode);
+
+        fuse_put_request(fc, req);
+        path_put(&path);
+}
+
 static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
 {
-        path_put(&req->misc.release.path);
+        if (fc->destroy_req) {
+                /*
+                 * If this is a fuseblk mount, then it's possible that
+                 * releasing the path will result in releasing the
+                 * super block and sending the DESTROY request.  If
+                 * the server is single threaded, this would hang.
+                 * For this reason do the path_put() in a separate
+                 * thread.
+                 */
+                atomic_inc(&req->count);
+                INIT_WORK(&req->misc.release.work, fuse_release_async);
+                schedule_work(&req->misc.release.work);
+        } else {
+                path_put(&req->misc.release.path);
+        }
 }
 
-static void fuse_file_put(struct fuse_file *ff)
+static void fuse_file_put(struct fuse_file *ff, bool sync)
 {
         if (atomic_dec_and_test(&ff->count)) {
                 struct fuse_req *req = ff->reserved_req;
 
-                req->end = fuse_release_end;
-                fuse_request_send_background(ff->fc, req);
+                if (sync) {
+                        fuse_request_send(ff->fc, req);
+                        path_put(&req->misc.release.path);
+                        fuse_put_request(ff->fc, req);
+                } else {
+                        req->end = fuse_release_end;
+                        fuse_request_send_background(ff->fc, req);
+                }
                 kfree(ff);
         }
 }
@@ -134,6 +169,7 @@ EXPORT_SYMBOL_GPL(fuse_do_open);
 void fuse_finish_open(struct inode *inode, struct file *file)
 {
         struct fuse_file *ff = file->private_data;
+        struct fuse_conn *fc = get_fuse_conn(inode);
 
         if (ff->open_flags & FOPEN_DIRECT_IO)
                 file->f_op = &fuse_direct_io_file_operations;
@@ -141,6 +177,15 @@ void fuse_finish_open(struct inode *inode, struct file *file)
                 invalidate_inode_pages2(inode->i_mapping);
         if (ff->open_flags & FOPEN_NONSEEKABLE)
                 nonseekable_open(inode, file);
+        if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) {
+                struct fuse_inode *fi = get_fuse_inode(inode);
+
+                spin_lock(&fc->lock);
+                fi->attr_version = ++fc->attr_version;
+                i_size_write(inode, 0);
+                spin_unlock(&fc->lock);
+                fuse_invalidate_attr(inode);
+        }
 }
 
 int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
@@ -177,7 +222,7 @@ static void fuse_prepare_release(struct fuse_file *ff, int flags, int opcode)
                 rb_erase(&ff->polled_node, &fc->polled_files);
         spin_unlock(&fc->lock);
 
-        wake_up_interruptible_sync(&ff->poll_wait);
+        wake_up_interruptible_all(&ff->poll_wait);
 
         inarg->fh = ff->fh;
         inarg->flags = flags;
@@ -208,8 +253,12 @@ void fuse_release_common(struct file *file, int opcode)
          * Normally this will send the RELEASE request, however if
          * some asynchronous READ or WRITE requests are outstanding,
          * the sending will be delayed.
+         *
+         * Make the release synchronous if this is a fuseblk mount,
+         * synchronous RELEASE is allowed (and desirable) in this case
+         * because the server can be trusted not to screw up.
          */
-        fuse_file_put(ff);
+        fuse_file_put(ff, ff->fc->destroy_req != NULL);
 }
 
 static int fuse_open(struct inode *inode, struct file *file)
@@ -474,7 +523,7 @@ static int fuse_readpage(struct file *file, struct page *page)
                 goto out;
 
         /*
-         * Page writeback can extend beyond the liftime of the
+         * Page writeback can extend beyond the lifetime of the
          * page-cache page, so make sure we read a properly synced
          * page.
          */
@@ -547,7 +596,7 @@ static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req)
                 page_cache_release(page);
         }
         if (req->ff)
-                fuse_file_put(req->ff);
+                fuse_file_put(req->ff, false);
 }
 
 static void fuse_send_readpages(struct fuse_req *req, struct file *file)
@@ -1126,7 +1175,7 @@ static ssize_t fuse_direct_write(struct file *file, const char __user *buf,
 static void fuse_writepage_free(struct fuse_conn *fc, struct fuse_req *req)
 {
         __free_page(req->pages[0]);
-        fuse_file_put(req->ff);
+        fuse_file_put(req->ff, false);
 }
 
 static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req)
@@ -1618,6 +1667,94 @@ static int fuse_ioctl_copy_user(struct page **pages, struct iovec *iov,
 }
 
 /*
+ * CUSE servers compiled on 32bit broke on 64bit kernels because the
+ * ABI was defined to be 'struct iovec' which is different on 32bit
+ * and 64bit.  Fortunately we can determine which structure the server
+ * used from the size of the reply.
+ */
+static int fuse_copy_ioctl_iovec_old(struct iovec *dst, void *src,
+                                     size_t transferred, unsigned count,
+                                     bool is_compat)
+{
+#ifdef CONFIG_COMPAT
+        if (count * sizeof(struct compat_iovec) == transferred) {
+                struct compat_iovec *ciov = src;
+                unsigned i;
+
+                /*
+                 * With this interface a 32bit server cannot support
+                 * non-compat (i.e. ones coming from 64bit apps) ioctl
+                 * requests
+                 */
+                if (!is_compat)
+                        return -EINVAL;
+
+                for (i = 0; i < count; i++) {
+                        dst[i].iov_base = compat_ptr(ciov[i].iov_base);
+                        dst[i].iov_len = ciov[i].iov_len;
+                }
+                return 0;
+        }
+#endif
+
+        if (count * sizeof(struct iovec) != transferred)
+                return -EIO;
+
+        memcpy(dst, src, transferred);
+        return 0;
+}
+
+/* Make sure iov_length() won't overflow */
+static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
+{
+        size_t n;
+        u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
+
+        for (n = 0; n < count; n++) {
+                if (iov->iov_len > (size_t) max)
+                        return -ENOMEM;
+                max -= iov->iov_len;
+        }
+        return 0;
+}
+
+static int fuse_copy_ioctl_iovec(struct fuse_conn *fc, struct iovec *dst,
+                                 void *src, size_t transferred, unsigned count,
+                                 bool is_compat)
+{
+        unsigned i;
+        struct fuse_ioctl_iovec *fiov = src;
+
+        if (fc->minor < 16) {
+                return fuse_copy_ioctl_iovec_old(dst, src, transferred,
+                                                 count, is_compat);
+        }
+
+        if (count * sizeof(struct fuse_ioctl_iovec) != transferred)
+                return -EIO;
+
+        for (i = 0; i < count; i++) {
+                /* Did the server supply an inappropriate value? */
+                if (fiov[i].base != (unsigned long) fiov[i].base ||
+                    fiov[i].len != (unsigned long) fiov[i].len)
+                        return -EIO;
+
+                dst[i].iov_base = (void __user *) (unsigned long) fiov[i].base;
+                dst[i].iov_len = (size_t) fiov[i].len;
+
+#ifdef CONFIG_COMPAT
+                if (is_compat &&
+                    (ptr_to_compat(dst[i].iov_base) != fiov[i].base ||
+                     (compat_size_t) dst[i].iov_len != fiov[i].len))
+                        return -EIO;
+#endif
+        }
+
+        return 0;
+}
+
+
+/*
  * For ioctls, there is no generic way to determine how much memory
  * needs to be read and/or written.  Furthermore, ioctls are allowed
  * to dereference the passed pointer, so the parameter requires deep
@@ -1677,18 +1814,25 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
         struct fuse_ioctl_out outarg;
         struct fuse_req *req = NULL;
         struct page **pages = NULL;
-        struct page *iov_page = NULL;
+        struct iovec *iov_page = NULL;
         struct iovec *in_iov = NULL, *out_iov = NULL;
         unsigned int in_iovs = 0, out_iovs = 0, num_pages = 0, max_pages;
         size_t in_size, out_size, transferred;
         int err;
 
+#if BITS_PER_LONG == 32
+        inarg.flags |= FUSE_IOCTL_32BIT;
+#else
+        if (flags & FUSE_IOCTL_COMPAT)
+                inarg.flags |= FUSE_IOCTL_32BIT;
+#endif
+
         /* assume all the iovs returned by client always fits in a page */
-        BUILD_BUG_ON(sizeof(struct iovec) * FUSE_IOCTL_MAX_IOV > PAGE_SIZE);
+        BUILD_BUG_ON(sizeof(struct fuse_ioctl_iovec) * FUSE_IOCTL_MAX_IOV > PAGE_SIZE);
 
         err = -ENOMEM;
         pages = kzalloc(sizeof(pages[0]) * FUSE_MAX_PAGES_PER_REQ, GFP_KERNEL);
-        iov_page = alloc_page(GFP_KERNEL);
+        iov_page = (struct iovec *) __get_free_page(GFP_KERNEL);
         if (!pages || !iov_page)
                 goto out;
 
@@ -1697,7 +1841,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
          * RETRY from server is not allowed.
          */
         if (!(flags & FUSE_IOCTL_UNRESTRICTED)) {
-                struct iovec *iov = page_address(iov_page);
+                struct iovec *iov = iov_page;
 
                 iov->iov_base = (void __user *)arg;
                 iov->iov_len = _IOC_SIZE(cmd);
@@ -1778,7 +1922,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
 
         /* did it ask for retry? */
         if (outarg.flags & FUSE_IOCTL_RETRY) {
-                char *vaddr;
+                void *vaddr;
 
                 /* no retry if in restricted mode */
                 err = -EIO;
@@ -1798,18 +1942,25 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
                     in_iovs + out_iovs > FUSE_IOCTL_MAX_IOV)
                         goto out;
 
-                err = -EIO;
-                if ((in_iovs + out_iovs) * sizeof(struct iovec) != transferred)
-                        goto out;
-
-                /* okay, copy in iovs and retry */
                 vaddr = kmap_atomic(pages[0], KM_USER0);
-                memcpy(page_address(iov_page), vaddr, transferred);
+                err = fuse_copy_ioctl_iovec(fc, iov_page, vaddr,
+                                            transferred, in_iovs + out_iovs,
+                                            (flags & FUSE_IOCTL_COMPAT) != 0);
                 kunmap_atomic(vaddr, KM_USER0);
+                if (err)
+                        goto out;
 
-                in_iov = page_address(iov_page);
+                in_iov = iov_page;
                 out_iov = in_iov + in_iovs;
 
+                err = fuse_verify_ioctl_iov(in_iov, in_iovs);
+                if (err)
+                        goto out;
+
+                err = fuse_verify_ioctl_iov(out_iov, out_iovs);
+                if (err)
+                        goto out;
+
                 goto retry;
         }
 
@@ -1821,8 +1972,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
  out:
         if (req)
                 fuse_put_request(fc, req);
-        if (iov_page)
-                __free_page(iov_page);
+        free_page((unsigned long) iov_page);
         while (num_pages)
                 __free_page(pages[--num_pages]);
         kfree(pages);
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 57d4a3a0f102..b788becada76 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -21,6 +21,7 @@
 #include <linux/rwsem.h>
 #include <linux/rbtree.h>
 #include <linux/poll.h>
+#include <linux/workqueue.h>
 
 /** Max number of pages that can be used in a single read request */
 #define FUSE_MAX_PAGES_PER_REQ 32
@@ -53,6 +54,12 @@ extern struct mutex fuse_mutex;
 extern unsigned max_user_bgreq;
 extern unsigned max_user_congthresh;
 
+/* One forget request */
+struct fuse_forget_link {
+        struct fuse_forget_one forget_one;
+        struct fuse_forget_link *next;
+};
+
 /** FUSE inode */
 struct fuse_inode {
         /** Inode data */
@@ -66,7 +73,7 @@ struct fuse_inode {
         u64 nlookup;
 
         /** The request used for sending the FORGET message */
-        struct fuse_req *forget_req;
+        struct fuse_forget_link *forget;
 
         /** Time in jiffies until the file attributes are valid */
         u64 i_time;
@@ -255,15 +262,16 @@ struct fuse_req {
 
         /** Data for asynchronous requests */
         union {
-                struct fuse_forget_in forget_in;
                 struct {
-                        struct fuse_release_in in;
+                        union {
+                                struct fuse_release_in in;
+                                struct work_struct work;
+                        };
                         struct path path;
                 } release;
                 struct fuse_init_in init_in;
                 struct fuse_init_out init_out;
                 struct cuse_init_in cuse_init_in;
-                struct cuse_init_out cuse_init_out;
                 struct {
                         struct fuse_read_in in;
                         u64 attr_ver;
@@ -369,6 +377,13 @@ struct fuse_conn {
         /** Pending interrupts */
         struct list_head interrupts;
 
+        /** Queue of pending forgets */
+        struct fuse_forget_link forget_list_head;
+        struct fuse_forget_link *forget_list_tail;
+
+        /** Batching of FORGET requests (positive indicates FORGET batch) */
+        int forget_batch;
+
         /** Flag indicating if connection is blocked.  This will be
             the case before the INIT reply is received, and if there
             are too many outstading backgrounds requests */
@@ -543,8 +558,10 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, struct qstr *name,
 /**
  * Send FORGET command
  */
-void fuse_send_forget(struct fuse_conn *fc, struct fuse_req *req,
-                      u64 nodeid, u64 nlookup);
+void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
+                       u64 nodeid, u64 nlookup);
+
+struct fuse_forget_link *fuse_alloc_forget(void);
 
 /**
  * Initialize READ or READDIR request
@@ -656,11 +673,6 @@ void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req);
 void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req);
 
 /**
- * Send a request with no reply
- */
-void fuse_request_send_noreply(struct fuse_conn *fc, struct fuse_req *req);
-
-/**
  * Send a request in the background
  */
 void fuse_request_send_background(struct fuse_conn *fc, struct fuse_req *req);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index da9e6e11374c..38f84cd48b67 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -71,6 +71,11 @@ struct fuse_mount_data {
         unsigned blksize;
 };
 
+struct fuse_forget_link *fuse_alloc_forget()
+{
+        return kzalloc(sizeof(struct fuse_forget_link), GFP_KERNEL);
+}
+
 static struct inode *fuse_alloc_inode(struct super_block *sb)
 {
         struct inode *inode;
@@ -90,8 +95,8 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
         INIT_LIST_HEAD(&fi->queued_writes);
         INIT_LIST_HEAD(&fi->writepages);
         init_waitqueue_head(&fi->page_waitq);
-        fi->forget_req = fuse_request_alloc();
-        if (!fi->forget_req) {
+        fi->forget = fuse_alloc_forget();
+        if (!fi->forget) {
                 kmem_cache_free(fuse_inode_cachep, inode);
                 return NULL;
         }
@@ -99,27 +104,20 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
         return inode;
 }
 
-static void fuse_destroy_inode(struct inode *inode)
+static void fuse_i_callback(struct rcu_head *head)
 {
-        struct fuse_inode *fi = get_fuse_inode(inode);
-        BUG_ON(!list_empty(&fi->write_files));
-        BUG_ON(!list_empty(&fi->queued_writes));
-        if (fi->forget_req)
-                fuse_request_free(fi->forget_req);
+        struct inode *inode = container_of(head, struct inode, i_rcu);
+        INIT_LIST_HEAD(&inode->i_dentry);
         kmem_cache_free(fuse_inode_cachep, inode);
 }
 
-void fuse_send_forget(struct fuse_conn *fc, struct fuse_req *req,
-                      u64 nodeid, u64 nlookup)
+static void fuse_destroy_inode(struct inode *inode)
 {
-        struct fuse_forget_in *inarg = &req->misc.forget_in;
-        inarg->nlookup = nlookup;
-        req->in.h.opcode = FUSE_FORGET;
-        req->in.h.nodeid = nodeid;
-        req->in.numargs = 1;
-        req->in.args[0].size = sizeof(struct fuse_forget_in);
-        req->in.args[0].value = inarg;
-        fuse_request_send_noreply(fc, req);
+        struct fuse_inode *fi = get_fuse_inode(inode);
+        BUG_ON(!list_empty(&fi->write_files));
+        BUG_ON(!list_empty(&fi->queued_writes));
+        kfree(fi->forget);
+        call_rcu(&inode->i_rcu, fuse_i_callback);
 }
 
 static void fuse_evict_inode(struct inode *inode)
@@ -129,8 +127,8 @@ static void fuse_evict_inode(struct inode *inode)
         if (inode->i_sb->s_flags & MS_ACTIVE) {
                 struct fuse_conn *fc = get_fuse_conn(inode);
                 struct fuse_inode *fi = get_fuse_inode(inode);
-                fuse_send_forget(fc, fi->forget_req, fi->nodeid, fi->nlookup);
-                fi->forget_req = NULL;
+                fuse_queue_forget(fc, fi->forget, fi->nodeid, fi->nlookup);
+                fi->forget = NULL;
         }
 }
 
@@ -534,6 +532,7 @@ void fuse_conn_init(struct fuse_conn *fc)
         INIT_LIST_HEAD(&fc->interrupts);
         INIT_LIST_HEAD(&fc->bg_queue);
         INIT_LIST_HEAD(&fc->entry);
+        fc->forget_list_tail = &fc->forget_list_head;
         atomic_set(&fc->num_waiting, 0);
         fc->max_background = FUSE_DEFAULT_MAX_BACKGROUND;
         fc->congestion_threshold = FUSE_DEFAULT_CONGESTION_THRESHOLD;
@@ -618,10 +617,8 @@ static struct dentry *fuse_get_dentry(struct super_block *sb,
                 goto out_iput;
 
         entry = d_obtain_alias(inode);
-        if (!IS_ERR(entry) && get_node_id(inode) != FUSE_ROOT_ID) {
-                entry->d_op = &fuse_dentry_operations;
+        if (!IS_ERR(entry) && get_node_id(inode) != FUSE_ROOT_ID)
                 fuse_invalidate_entry_cache(entry);
-        }
 
         return entry;
 
@@ -640,8 +637,10 @@ static int fuse_encode_fh(struct dentry *dentry, u32 *fh, int *max_len,
         u64 nodeid;
         u32 generation;
 
-        if (*max_len < len)
+        if (*max_len < len) {
+                *max_len = len;
                 return  255;
+        }
 
         nodeid = get_fuse_inode(inode)->nodeid;
         generation = inode->i_generation;
@@ -720,10 +719,8 @@ static struct dentry *fuse_get_parent(struct dentry *child)
         }
 
         parent = d_obtain_alias(inode);
-        if (!IS_ERR(parent) && get_node_id(inode) != FUSE_ROOT_ID) {
-                parent->d_op = &fuse_dentry_operations;
+        if (!IS_ERR(parent) && get_node_id(inode) != FUSE_ROOT_ID)
                 fuse_invalidate_entry_cache(parent);
-        }
 
         return parent;
 }
@@ -873,7 +870,6 @@ static int fuse_bdi_init(struct fuse_conn *fc, struct super_block *sb)
 
         fc->bdi.name = "fuse";
         fc->bdi.ra_pages = (VM_MAX_READAHEAD * 1024) / PAGE_CACHE_SIZE;
-        fc->bdi.unplug_io_fn = default_unplug_io_fn;
         /* fuse does it's own writeback accounting */
         fc->bdi.capabilities = BDI_CAP_NO_ACCT_WB;
 
@@ -925,6 +921,8 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         if (sb->s_flags & MS_MANDLOCK)
                 goto err;
 
+        sb->s_flags &= ~MS_NOSEC;
+
         if (!parse_fuse_opt((char *) data, &d, is_bdev))
                 goto err;
 
@@ -990,6 +988,8 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
                 iput(root);
                 goto err_put_conn;
         }
+        /* only now - we want root dentry with NULL ->d_op */
+        sb->s_d_op = &fuse_dentry_operations;
 
         init_req = fuse_request_alloc();
         if (!init_req)
@@ -1041,11 +1041,11 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         return err;
 }
 
-static int fuse_get_sb(struct file_system_type *fs_type,
+static struct dentry *fuse_mount(struct file_system_type *fs_type,
                        int flags, const char *dev_name,
-                       void *raw_data, struct vfsmount *mnt)
+                       void *raw_data)
 {
-        return get_sb_nodev(fs_type, flags, raw_data, fuse_fill_super, mnt);
+        return mount_nodev(fs_type, flags, raw_data, fuse_fill_super);
 }
 
 static void fuse_kill_sb_anon(struct super_block *sb)
@@ -1065,17 +1065,16 @@ static struct file_system_type fuse_fs_type = {
         .owner          = THIS_MODULE,
         .name           = "fuse",
         .fs_flags       = FS_HAS_SUBTYPE,
-        .get_sb         = fuse_get_sb,
+        .mount          = fuse_mount,
         .kill_sb        = fuse_kill_sb_anon,
 };
 
 #ifdef CONFIG_BLOCK
-static int fuse_get_sb_blk(struct file_system_type *fs_type,
+static struct dentry *fuse_mount_blk(struct file_system_type *fs_type,
                            int flags, const char *dev_name,
-                           void *raw_data, struct vfsmount *mnt)
+                           void *raw_data)
 {
-        return get_sb_bdev(fs_type, flags, dev_name, raw_data, fuse_fill_super,
-                           mnt);
+        return mount_bdev(fs_type, flags, dev_name, raw_data, fuse_fill_super);
 }
 
 static void fuse_kill_sb_blk(struct super_block *sb)
@@ -1094,7 +1093,7 @@ static void fuse_kill_sb_blk(struct super_block *sb)
 static struct file_system_type fuseblk_fs_type = {
         .owner          = THIS_MODULE,
         .name           = "fuseblk",
-        .get_sb         = fuse_get_sb_blk,
+        .mount          = fuse_mount_blk,
         .kill_sb        = fuse_kill_sb_blk,
         .fs_flags       = FS_REQUIRES_DEV | FS_HAS_SUBTYPE,
 };