25 files changed, 315 insertions, 329 deletions

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 0fa95b198e6e..d48ff5f370f4 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -16,7 +16,6 @@
 #include <linux/time.h>
 #include <linux/mm.h>
 #include <linux/mman.h>
-#include <linux/a.out.h>
 #include <linux/errno.h>
 #include <linux/signal.h>
 #include <linux/binfmts.h>
@@ -548,7 +547,6 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
         struct {
                 struct elfhdr elf_ex;
                 struct elfhdr interp_elf_ex;
-                struct exec interp_ex;
         } *loc;
 
         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
@@ -680,7 +678,6 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                         }
 
                         /* Get the exec headers */
-                        loc->interp_ex = *((struct exec *)bprm->buf);
                         loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
                         break;
                 }
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 470c10ceb0fb..10d8a0aa871a 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -931,8 +931,16 @@ static int do_open(struct block_device *bdev, struct file *file, int for_part)
         struct gendisk *disk;
         int ret;
         int part;
+        int perm = 0;
 
-        ret = devcgroup_inode_permission(bdev->bd_inode, file->f_mode);
+        if (file->f_mode & FMODE_READ)
+                perm |= MAY_READ;
+        if (file->f_mode & FMODE_WRITE)
+                perm |= MAY_WRITE;
+        /*
+         * hooks: /n/, see "layering violations".
+         */
+        ret = devcgroup_inode_permission(bdev->bd_inode, perm);
         if (ret != 0)
                 return ret;
 
diff --git a/fs/buffer.c b/fs/buffer.c
index a073f3f4f013..0f51c0f7c266 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -821,7 +821,7 @@ static int fsync_buffers_list(spinlock_t *lock, struct list_head *list)
                                  * contents - it is a noop if I/O is still in
                                  * flight on potentially older contents.
                                  */
-                                ll_rw_block(SWRITE, 1, &bh);
+                                ll_rw_block(SWRITE_SYNC, 1, &bh);
                                 brelse(bh);
                                 spin_lock(lock);
                         }
@@ -2940,16 +2940,19 @@ void ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
         for (i = 0; i < nr; i++) {
                 struct buffer_head *bh = bhs[i];
 
-                if (rw == SWRITE)
+                if (rw == SWRITE || rw == SWRITE_SYNC)
                         lock_buffer(bh);
                 else if (test_set_buffer_locked(bh))
                         continue;
 
-                if (rw == WRITE || rw == SWRITE) {
+                if (rw == WRITE || rw == SWRITE || rw == SWRITE_SYNC) {
                         if (test_clear_buffer_dirty(bh)) {
                                 bh->b_end_io = end_buffer_write_sync;
                                 get_bh(bh);
-                                submit_bh(WRITE, bh);
+                                if (rw == SWRITE_SYNC)
+                                        submit_bh(WRITE_SYNC, bh);
+                                else
+                                        submit_bh(WRITE, bh);
                                 continue;
                         }
                 } else {
@@ -2978,7 +2981,7 @@ int sync_dirty_buffer(struct buffer_head *bh)
         if (test_clear_buffer_dirty(bh)) {
                 get_bh(bh);
                 bh->b_end_io = end_buffer_write_sync;
-                ret = submit_bh(WRITE, bh);
+                ret = submit_bh(WRITE_SYNC, bh);
                 wait_on_buffer(bh);
                 if (buffer_eopnotsupp(bh)) {
                         clear_buffer_eopnotsupp(bh);
diff --git a/fs/dcache.c b/fs/dcache.c
index 3ee588d5f585..6068c25b393c 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -17,6 +17,7 @@
 #include <linux/syscalls.h>
 #include <linux/string.h>
 #include <linux/mm.h>
+#include <linux/fdtable.h>
 #include <linux/fs.h>
 #include <linux/fsnotify.h>
 #include <linux/slab.h>
@@ -106,9 +107,10 @@ static void dentry_lru_remove(struct dentry *dentry)
 /*
  * Release the dentry's inode, using the filesystem
  * d_iput() operation if defined.
- * Called with dcache_lock and per dentry lock held, drops both.
  */
 static void dentry_iput(struct dentry * dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
 {
         struct inode *inode = dentry->d_inode;
         if (inode) {
@@ -132,12 +134,13 @@ static void dentry_iput(struct dentry * dentry)
  * d_kill - kill dentry and return parent
  * @dentry: dentry to kill
  *
- * Called with dcache_lock and d_lock, releases both.  The dentry must
- * already be unhashed and removed from the LRU.
+ * The dentry must already be unhashed and removed from the LRU.
  *
  * If this is the root of the dentry tree, return NULL.
  */
 static struct dentry *d_kill(struct dentry *dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
 {
         struct dentry *parent;
 
@@ -383,11 +386,11 @@ restart:
  * Try to prune ancestors as well.  This is necessary to prevent
  * quadratic behavior of shrink_dcache_parent(), but is also expected
  * to be beneficial in reducing dentry cache fragmentation.
- *
- * Called with dcache_lock, drops it and then regains.
- * Called with dentry->d_lock held, drops it.
  */
 static void prune_one_dentry(struct dentry * dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
+        __acquires(dcache_lock)
 {
         __d_drop(dentry);
         dentry = d_kill(dentry);
@@ -1604,10 +1607,9 @@ static int d_isparent(struct dentry *p1, struct dentry *p2)
  *
  * Note: If ever the locking in lock_rename() changes, then please
  * remember to update this too...
- *
- * On return, dcache_lock will have been unlocked.
  */
 static struct dentry *__d_unalias(struct dentry *dentry, struct dentry *alias)
+        __releases(dcache_lock)
 {
         struct mutex *m1 = NULL, *m2 = NULL;
         struct dentry *ret;
@@ -1743,11 +1745,9 @@ out_nolock:
 shouldnt_be_hashed:
         spin_unlock(&dcache_lock);
         BUG();
-        goto shouldnt_be_hashed;
 }
 
-static int prepend(char **buffer, int *buflen, const char *str,
-                          int namelen)
+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
 {
         *buflen -= namelen;
         if (*buflen < 0)
@@ -1757,8 +1757,13 @@ static int prepend(char **buffer, int *buflen, const char *str,
         return 0;
 }
 
+static int prepend_name(char **buffer, int *buflen, struct qstr *name)
+{
+        return prepend(buffer, buflen, name->name, name->len);
+}
+
 /**
- * d_path - return the path of a dentry
+ * __d_path - return the path of a dentry
  * @path: the dentry/vfsmount to report
  * @root: root vfsmnt/dentry (may be modified by this function)
  * @buffer: buffer to return value in
@@ -1779,9 +1784,10 @@ char *__d_path(const struct path *path, struct path *root,
 {
         struct dentry *dentry = path->dentry;
         struct vfsmount *vfsmnt = path->mnt;
-        char * end = buffer+buflen;
-        char * retval;
+        char *end = buffer + buflen;
+        char *retval;
 
+        spin_lock(&vfsmount_lock);
         prepend(&end, &buflen, "\0", 1);
         if (!IS_ROOT(dentry) && d_unhashed(dentry) &&
                 (prepend(&end, &buflen, " (deleted)", 10) != 0))
@@ -1800,38 +1806,37 @@ char *__d_path(const struct path *path, struct path *root,
                         break;
                 if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
                         /* Global root? */
-                        spin_lock(&vfsmount_lock);
                         if (vfsmnt->mnt_parent == vfsmnt) {
-                                spin_unlock(&vfsmount_lock);
                                 goto global_root;
                         }
                         dentry = vfsmnt->mnt_mountpoint;
                         vfsmnt = vfsmnt->mnt_parent;
-                        spin_unlock(&vfsmount_lock);
                         continue;
                 }
                 parent = dentry->d_parent;
                 prefetch(parent);
-                if ((prepend(&end, &buflen, dentry->d_name.name,
-                                dentry->d_name.len) != 0) ||
+                if ((prepend_name(&end, &buflen, &dentry->d_name) != 0) ||
                     (prepend(&end, &buflen, "/", 1) != 0))
                         goto Elong;
                 retval = end;
                 dentry = parent;
         }
 
+out:
+        spin_unlock(&vfsmount_lock);
         return retval;
 
 global_root:
         retval += 1;    /* hit the slash */
-        if (prepend(&retval, &buflen, dentry->d_name.name,
-                    dentry->d_name.len) != 0)
+        if (prepend_name(&retval, &buflen, &dentry->d_name) != 0)
                 goto Elong;
         root->mnt = vfsmnt;
         root->dentry = dentry;
-        return retval;
+        goto out;
+
 Elong:
-        return ERR_PTR(-ENAMETOOLONG);
+        retval = ERR_PTR(-ENAMETOOLONG);
+        goto out;
 }
 
 /**
@@ -1845,9 +1850,9 @@ Elong:
  *
  * Returns the buffer or an error code if the path was too long.
  *
- * "buflen" should be positive. Caller holds the dcache_lock.
+ * "buflen" should be positive.
  */
-char *d_path(struct path *path, char *buf, int buflen)
+char *d_path(const struct path *path, char *buf, int buflen)
 {
         char *res;
         struct path root;
@@ -1915,16 +1920,11 @@ char *dentry_path(struct dentry *dentry, char *buf, int buflen)
         retval = end-1;
         *retval = '/';
 
-        for (;;) {
-                struct dentry *parent;
-                if (IS_ROOT(dentry))
-                        break;
+        while (!IS_ROOT(dentry)) {
+                struct dentry *parent = dentry->d_parent;
 
-                parent = dentry->d_parent;
                 prefetch(parent);
-
-                if ((prepend(&end, &buflen, dentry->d_name.name,
-                                dentry->d_name.len) != 0) ||
+                if ((prepend_name(&end, &buflen, &dentry->d_name) != 0) ||
                     (prepend(&end, &buflen, "/", 1) != 0))
                         goto Elong;
 
@@ -1975,7 +1975,7 @@ asmlinkage long sys_getcwd(char __user *buf, unsigned long size)
         error = -ENOENT;
         /* Has the current directory has been unlinked? */
         spin_lock(&dcache_lock);
-        if (pwd.dentry->d_parent == pwd.dentry || !d_unhashed(pwd.dentry)) {
+        if (IS_ROOT(pwd.dentry) || !d_unhashed(pwd.dentry)) {
                 unsigned long len;
                 struct path tmp = root;
                 char * cwd;
diff --git a/fs/exec.c b/fs/exec.c
index 9448f1b50b4a..da94a6f05df3 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -26,7 +26,6 @@
 #include <linux/file.h>
 #include <linux/fdtable.h>
 #include <linux/mman.h>
-#include <linux/a.out.h>
 #include <linux/stat.h>
 #include <linux/fcntl.h>
 #include <linux/smp_lock.h>
@@ -61,6 +60,11 @@
 #include <linux/kmod.h>
 #endif
 
+#ifdef __alpha__
+/* for /sbin/loader handling in search_binary_handler() */
+#include <linux/a.out.h>
+#endif
+
 int core_uses_pid;
 char core_pattern[CORENAME_MAX_SIZE] = "core";
 int suid_dumpable = 0;
@@ -1155,7 +1159,7 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 {
         int try,retval;
         struct linux_binfmt *fmt;
-#if defined(__alpha__) && defined(CONFIG_ARCH_SUPPORTS_AOUT)
+#ifdef __alpha__
         /* handle /sbin/loader.. */
         {
             struct exec * eh = (struct exec *) bprm->buf;
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 9ecb92f68543..9ff7b1c04239 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -855,7 +855,8 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
          */
 
         /* Update group descriptor block for new group */
-        gdp = (struct ext4_group_desc *)primary->b_data + gdb_off;
+        gdp = (struct ext4_group_desc *)((char *)primary->b_data +
+                                         gdb_off * EXT4_DESC_SIZE(sb));
 
         ext4_block_bitmap_set(sb, gdp, input->block_bitmap); /* LV FIXME */
         ext4_inode_bitmap_set(sb, gdp, input->inode_bitmap); /* LV FIXME */
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 43e99513334a..3141690558c8 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -591,7 +591,7 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                 fc->bdi.ra_pages = min(fc->bdi.ra_pages, ra_pages);
                 fc->minor = arg->minor;
                 fc->max_write = arg->minor < 5 ? 4096 : arg->max_write;
-                fc->max_write = min_t(unsigned, 4096, fc->max_write);
+                fc->max_write = max_t(unsigned, 4096, fc->max_write);
                 fc->conn_init = 1;
         }
         fuse_put_request(fc, req);
@@ -667,7 +667,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         fc->flags = d.flags;
         fc->user_id = d.user_id;
         fc->group_id = d.group_id;
-        fc->max_read = min_t(unsigned, 4096, d.max_read);
+        fc->max_read = max_t(unsigned, 4096, d.max_read);
 
         /* Used by get_root_inode() */
         sb->s_fs_info = fc;
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index c19184f2e70e..bec76b1c2bb0 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -246,15 +246,11 @@ static void find_metapath(const struct gfs2_sbd *sdp, u64 block,
 
 }
 
-static inline unsigned int zero_metapath_length(const struct metapath *mp,
-                                                unsigned height)
+static inline unsigned int metapath_branch_start(const struct metapath *mp)
 {
-        unsigned int i;
-        for (i = 0; i < height - 1; i++) {
-                if (mp->mp_list[i] != 0)
-                        return i;
-        }
-        return height;
+        if (mp->mp_list[0] == 0)
+                return 2;
+        return 1;
 }
 
 /**
@@ -436,7 +432,7 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
         struct gfs2_sbd *sdp = GFS2_SB(inode);
         struct buffer_head *dibh = mp->mp_bh[0];
         u64 bn, dblock = 0;
-        unsigned n, i, blks, alloced = 0, iblks = 0, zmpl = 0;
+        unsigned n, i, blks, alloced = 0, iblks = 0, branch_start = 0;
         unsigned dblks = 0;
         unsigned ptrs_per_blk;
         const unsigned end_of_metadata = height - 1;
@@ -471,9 +467,8 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
                         /* Building up tree height */
                         state = ALLOC_GROW_HEIGHT;
                         iblks = height - ip->i_height;
-                        zmpl = zero_metapath_length(mp, height);
-                        iblks -= zmpl;
-                        iblks += height;
+                        branch_start = metapath_branch_start(mp);
+                        iblks += (height - branch_start);
                 }
         }
 
@@ -509,13 +504,13 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
                                         sizeof(struct gfs2_meta_header));
                                 *ptr = zero_bn;
                                 state = ALLOC_GROW_DEPTH;
-                                for(i = zmpl; i < height; i++) {
+                                for(i = branch_start; i < height; i++) {
                                         if (mp->mp_bh[i] == NULL)
                                                 break;
                                         brelse(mp->mp_bh[i]);
                                         mp->mp_bh[i] = NULL;
                                 }
-                                i = zmpl;
+                                i = branch_start;
                         }
                         if (n == 0)
                                 break;
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 6387523a3153..3401628d742b 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -195,7 +195,7 @@ ulong_aligned:
            depending on architecture.  I've experimented with several ways
            of writing this section such as using an else before the goto
            but this one seems to be the fastest. */
-        while ((unsigned char *)plong < end - 1) {
+        while ((unsigned char *)plong < end - sizeof(unsigned long)) {
                 prefetch(plong + 1);
                 if (((*plong) & LBITMASK) != lskipval)
                         break;
diff --git a/fs/locks.c b/fs/locks.c
index 11dbf08651b7..dce8c747371c 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -561,9 +561,6 @@ static void locks_insert_lock(struct file_lock **pos, struct file_lock *fl)
         /* insert into file's list */
         fl->fl_next = *pos;
         *pos = fl;
-
-        if (fl->fl_ops && fl->fl_ops->fl_insert)
-                fl->fl_ops->fl_insert(fl);
 }
 
 /*
@@ -586,9 +583,6 @@ static void locks_delete_lock(struct file_lock **thisfl_p)
                 fl->fl_fasync = NULL;
         }
 
-        if (fl->fl_ops && fl->fl_ops->fl_remove)
-                fl->fl_ops->fl_remove(fl);
-
         if (fl->fl_nspid) {
                 put_pid(fl->fl_nspid);
                 fl->fl_nspid = NULL;
diff --git a/fs/namei.c b/fs/namei.c
index c7e43536c49a..01e67dddcc3d 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -581,15 +581,13 @@ static __always_inline int link_path_walk(const char *name, struct nameidata *nd
         int result;
 
         /* make sure the stuff we saved doesn't go away */
-        dget(save.dentry);
-        mntget(save.mnt);
+        path_get(&save);
 
         result = __link_path_walk(name, nd);
         if (result == -ESTALE) {
                 /* nd->path had been dropped */
                 nd->path = save;
-                dget(nd->path.dentry);
-                mntget(nd->path.mnt);
+                path_get(&nd->path);
                 nd->flags |= LOOKUP_REVAL;
                 result = __link_path_walk(name, nd);
         }
@@ -1216,8 +1214,9 @@ int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
         nd->flags = flags;
         nd->depth = 0;
 
-        nd->path.mnt = mntget(mnt);
-        nd->path.dentry = dget(dentry);
+        nd->path.dentry = dentry;
+        nd->path.mnt = mnt;
+        path_get(&nd->path);
 
         retval = path_walk(name, nd);
         if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
@@ -2857,16 +2856,17 @@ int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
 {
         struct nameidata nd;
         void *cookie;
+        int res;
 
         nd.depth = 0;
         cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
-        if (!IS_ERR(cookie)) {
-                int res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
-                if (dentry->d_inode->i_op->put_link)
-                        dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
-                cookie = ERR_PTR(res);
-        }
-        return PTR_ERR(cookie);
+        if (IS_ERR(cookie))
+                return PTR_ERR(cookie);
+
+        res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
+        if (dentry->d_inode->i_op->put_link)
+                dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
+        return res;
 }
 
 int vfs_follow_link(struct nameidata *nd, const char *link)
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index 49c7cd0502cc..779d2eb649c5 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -130,10 +130,11 @@ static int xdr_decode_fhstatus3(struct rpc_rqst *req, __be32 *p,
                                 struct mnt_fhstatus *res)
 {
         struct nfs_fh *fh = res->fh;
+        unsigned size;
 
         if ((res->status = ntohl(*p++)) == 0) {
-                int size = ntohl(*p++);
-                if (size <= NFS3_FHSIZE) {
+                size = ntohl(*p++);
+                if (size <= NFS3_FHSIZE && size != 0) {
                         fh->size = size;
                         memcpy(fh->data, p, size);
                 } else
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 2a4a024a4e7b..614efeed5437 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1216,8 +1216,6 @@ static int nfs_validate_mount_data(void *options,
 {
         struct nfs_mount_data *data = (struct nfs_mount_data *)options;
 
-        memset(args, 0, sizeof(*args));
-
         if (data == NULL)
                 goto out_no_data;
 
@@ -1251,13 +1249,13 @@ static int nfs_validate_mount_data(void *options,
         case 5:
                 memset(data->context, 0, sizeof(data->context));
         case 6:
-                if (data->flags & NFS_MOUNT_VER3)
+                if (data->flags & NFS_MOUNT_VER3) {
+                        if (data->root.size > NFS3_FHSIZE || data->root.size == 0)
+                                goto out_invalid_fh;
                         mntfh->size = data->root.size;
-                else
+                } else
                         mntfh->size = NFS2_FHSIZE;
 
-                if (mntfh->size > sizeof(mntfh->data))
-                        goto out_invalid_fh;
 
                 memcpy(mntfh->data, data->root.data, mntfh->size);
                 if (mntfh->size < sizeof(mntfh->data))
@@ -1585,24 +1583,29 @@ static int nfs_get_sb(struct file_system_type *fs_type,
 {
         struct nfs_server *server = NULL;
         struct super_block *s;
-        struct nfs_fh mntfh;
-        struct nfs_parsed_mount_data data;
+        struct nfs_parsed_mount_data *data;
+        struct nfs_fh *mntfh;
         struct dentry *mntroot;
         int (*compare_super)(struct super_block *, void *) = nfs_compare_super;
         struct nfs_sb_mountdata sb_mntdata = {
                 .mntflags = flags,
         };
-        int error;
+        int error = -ENOMEM;
+
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
+        if (data == NULL || mntfh == NULL)
+                goto out_free_fh;
 
-        security_init_mnt_opts(&data.lsm_opts);
+        security_init_mnt_opts(&data->lsm_opts);
 
         /* Validate the mount data */
-        error = nfs_validate_mount_data(raw_data, &data, &mntfh, dev_name);
+        error = nfs_validate_mount_data(raw_data, data, mntfh, dev_name);
         if (error < 0)
                 goto out;
 
         /* Get a volume representation */
-        server = nfs_create_server(&data, &mntfh);
+        server = nfs_create_server(data, mntfh);
         if (IS_ERR(server)) {
                 error = PTR_ERR(server);
                 goto out;
@@ -1630,16 +1633,16 @@ static int nfs_get_sb(struct file_system_type *fs_type,
 
         if (!s->s_root) {
                 /* initial superblock/root creation */
-                nfs_fill_super(s, &data);
+                nfs_fill_super(s, data);
         }
 
-        mntroot = nfs_get_root(s, &mntfh);
+        mntroot = nfs_get_root(s, mntfh);
         if (IS_ERR(mntroot)) {
                 error = PTR_ERR(mntroot);
                 goto error_splat_super;
         }
 
-        error = security_sb_set_mnt_opts(s, &data.lsm_opts);
+        error = security_sb_set_mnt_opts(s, &data->lsm_opts);
         if (error)
                 goto error_splat_root;
 
@@ -1649,9 +1652,12 @@ static int nfs_get_sb(struct file_system_type *fs_type,
         error = 0;
 
 out:
-        kfree(data.nfs_server.hostname);
-        kfree(data.mount_server.hostname);
-        security_free_mnt_opts(&data.lsm_opts);
+        kfree(data->nfs_server.hostname);
+        kfree(data->mount_server.hostname);
+        security_free_mnt_opts(&data->lsm_opts);
+out_free_fh:
+        kfree(mntfh);
+        kfree(data);
         return error;
 
 out_err_nosb:
@@ -1800,8 +1806,6 @@ static int nfs4_validate_mount_data(void *options,
         struct nfs4_mount_data *data = (struct nfs4_mount_data *)options;
         char *c;
 
-        memset(args, 0, sizeof(*args));
-
         if (data == NULL)
                 goto out_no_data;
 
@@ -1959,26 +1963,31 @@ out_no_client_address:
 static int nfs4_get_sb(struct file_system_type *fs_type,
         int flags, const char *dev_name, void *raw_data, struct vfsmount *mnt)
 {
-        struct nfs_parsed_mount_data data;
+        struct nfs_parsed_mount_data *data;
         struct super_block *s;
         struct nfs_server *server;
-        struct nfs_fh mntfh;
+        struct nfs_fh *mntfh;
         struct dentry *mntroot;
         int (*compare_super)(struct super_block *, void *) = nfs_compare_super;
         struct nfs_sb_mountdata sb_mntdata = {
                 .mntflags = flags,
         };
-        int error;
+        int error = -ENOMEM;
 
-        security_init_mnt_opts(&data.lsm_opts);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
+        if (data == NULL || mntfh == NULL)
+                goto out_free_fh;
+
+        security_init_mnt_opts(&data->lsm_opts);
 
         /* Validate the mount data */
-        error = nfs4_validate_mount_data(raw_data, &data, dev_name);
+        error = nfs4_validate_mount_data(raw_data, data, dev_name);
         if (error < 0)
                 goto out;
 
         /* Get a volume representation */
-        server = nfs4_create_server(&data, &mntfh);
+        server = nfs4_create_server(data, mntfh);
         if (IS_ERR(server)) {
                 error = PTR_ERR(server);
                 goto out;
@@ -2009,13 +2018,13 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
                 nfs4_fill_super(s);
         }
 
-        mntroot = nfs4_get_root(s, &mntfh);
+        mntroot = nfs4_get_root(s, mntfh);
         if (IS_ERR(mntroot)) {
                 error = PTR_ERR(mntroot);
                 goto error_splat_super;
         }
 
-        error = security_sb_set_mnt_opts(s, &data.lsm_opts);
+        error = security_sb_set_mnt_opts(s, &data->lsm_opts);
         if (error)
                 goto error_splat_root;
 
@@ -2025,10 +2034,13 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
         error = 0;
 
 out:
-        kfree(data.client_address);
-        kfree(data.nfs_server.export_path);
-        kfree(data.nfs_server.hostname);
-        security_free_mnt_opts(&data.lsm_opts);
+        kfree(data->client_address);
+        kfree(data->nfs_server.export_path);
+        kfree(data->nfs_server.hostname);
+        security_free_mnt_opts(&data->lsm_opts);
+out_free_fh:
+        kfree(mntfh);
+        kfree(data);
         return error;
 
 out_free:
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 6d8ace3e3259..f333848fd3be 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -739,12 +739,13 @@ int nfs_updatepage(struct file *file, struct page *page,
         }
 
         status = nfs_writepage_setup(ctx, page, offset, count);
-        __set_page_dirty_nobuffers(page);
+        if (status < 0)
+                nfs_set_pageerror(page);
+        else
+                __set_page_dirty_nobuffers(page);
 
         dprintk("NFS:      nfs_updatepage returns %d (isize %Ld)\n",
                         status, (long long)i_size_read(inode));
-        if (status < 0)
-                nfs_set_pageerror(page);
         return status;
 }
 
diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index cf9401e8cd0b..cfdb08b484ed 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -21,7 +21,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/sysctl.h>
 #include <linux/configfs.h>
 
 #include "tcp.h"
@@ -36,65 +35,6 @@
  * cluster references throughout where nodes are looked up */
 struct o2nm_cluster *o2nm_single_cluster = NULL;
 
-#define OCFS2_MAX_HB_CTL_PATH 256
-static char ocfs2_hb_ctl_path[OCFS2_MAX_HB_CTL_PATH] = "/sbin/ocfs2_hb_ctl";
-
-static ctl_table ocfs2_nm_table[] = {
-        {
-                .ctl_name       = 1,
-                .procname       = "hb_ctl_path",
-                .data           = ocfs2_hb_ctl_path,
-                .maxlen         = OCFS2_MAX_HB_CTL_PATH,
-                .mode           = 0644,
-                .proc_handler   = &proc_dostring,
-                .strategy       = &sysctl_string,
-        },
-        { .ctl_name = 0 }
-};
-
-static ctl_table ocfs2_mod_table[] = {
-        {
-                .ctl_name       = FS_OCFS2_NM,
-                .procname       = "nm",
-                .data           = NULL,
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = ocfs2_nm_table
-        },
-        { .ctl_name = 0}
-};
-
-static ctl_table ocfs2_kern_table[] = {
-        {
-                .ctl_name       = FS_OCFS2,
-                .procname       = "ocfs2",
-                .data           = NULL,
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = ocfs2_mod_table
-        },
-        { .ctl_name = 0}
-};
-
-static ctl_table ocfs2_root_table[] = {
-        {
-                .ctl_name       = CTL_FS,
-                .procname       = "fs",
-                .data           = NULL,
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = ocfs2_kern_table
-        },
-        { .ctl_name = 0 }
-};
-
-static struct ctl_table_header *ocfs2_table_header = NULL;
-
-const char *o2nm_get_hb_ctl_path(void)
-{
-        return ocfs2_hb_ctl_path;
-}
-EXPORT_SYMBOL_GPL(o2nm_get_hb_ctl_path);
 
 struct o2nm_node *o2nm_get_node_by_num(u8 node_num)
 {
@@ -941,9 +881,6 @@ void o2nm_undepend_this_node(void)
 
 static void __exit exit_o2nm(void)
 {
-        if (ocfs2_table_header)
-                unregister_sysctl_table(ocfs2_table_header);
-
         /* XXX sync with hb callbacks and shut down hb? */
         o2net_unregister_hb_callbacks();
         configfs_unregister_subsystem(&o2nm_cluster_group.cs_subsys);
@@ -964,16 +901,9 @@ static int __init init_o2nm(void)
         if (ret)
                 goto out;
 
-        ocfs2_table_header = register_sysctl_table(ocfs2_root_table);
-        if (!ocfs2_table_header) {
-                printk(KERN_ERR "nodemanager: unable to register sysctl\n");
-                ret = -ENOMEM; /* or something. */
-                goto out_o2net;
-        }
-
         ret = o2net_register_hb_callbacks();
         if (ret)
-                goto out_sysctl;
+                goto out_o2net;
 
         config_group_init(&o2nm_cluster_group.cs_subsys.su_group);
         mutex_init(&o2nm_cluster_group.cs_subsys.su_mutex);
@@ -990,8 +920,6 @@ static int __init init_o2nm(void)
         configfs_unregister_subsystem(&o2nm_cluster_group.cs_subsys);
 out_callbacks:
         o2net_unregister_hb_callbacks();
-out_sysctl:
-        unregister_sysctl_table(ocfs2_table_header);
 out_o2net:
         o2net_exit();
 out:
diff --git a/fs/ocfs2/cluster/nodemanager.h b/fs/ocfs2/cluster/nodemanager.h
index 7c860361b8dd..c992ea0da4ad 100644
--- a/fs/ocfs2/cluster/nodemanager.h
+++ b/fs/ocfs2/cluster/nodemanager.h
@@ -33,10 +33,6 @@
 #include <linux/configfs.h>
 #include <linux/rbtree.h>
 
-#define FS_OCFS2_NM             1
-
-const char *o2nm_get_hb_ctl_path(void);
-
 struct o2nm_node {
         spinlock_t              nd_lock;
         struct config_item      nd_item;
diff --git a/fs/ocfs2/stack_o2cb.c b/fs/ocfs2/stack_o2cb.c
index bbd1667aa7d3..fcd120f1493a 100644
--- a/fs/ocfs2/stack_o2cb.c
+++ b/fs/ocfs2/stack_o2cb.c
@@ -317,8 +317,7 @@ out:
         return rc;
 }
 
-static int o2cb_cluster_disconnect(struct ocfs2_cluster_connection *conn,
-                                   int hangup_pending)
+static int o2cb_cluster_disconnect(struct ocfs2_cluster_connection *conn)
 {
         struct dlm_ctxt *dlm = conn->cc_lockspace;
         struct o2dlm_private *priv = conn->cc_private;
@@ -333,43 +332,6 @@ static int o2cb_cluster_disconnect(struct ocfs2_cluster_connection *conn,
         return 0;
 }
 
-static void o2hb_stop(const char *group)
-{
-        int ret;
-        char *argv[5], *envp[3];
-
-        argv[0] = (char *)o2nm_get_hb_ctl_path();
-        argv[1] = "-K";
-        argv[2] = "-u";
-        argv[3] = (char *)group;
-        argv[4] = NULL;
-
-        mlog(0, "Run: %s %s %s %s\n", argv[0], argv[1], argv[2], argv[3]);
-
-        /* minimal command environment taken from cpu_run_sbin_hotplug */
-        envp[0] = "HOME=/";
-        envp[1] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
-        envp[2] = NULL;
-
-        ret = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
-        if (ret < 0)
-                mlog_errno(ret);
-}
-
-/*
- * Hangup is a hack for tools compatibility.  Older ocfs2-tools software
- * expects the filesystem to call "ocfs2_hb_ctl" during unmount.  This
- * happens regardless of whether the DLM got started, so we can't do it
- * in ocfs2_cluster_disconnect().  We bring the o2hb_stop() function into
- * the glue and provide a "hangup" API for super.c to call.
- *
- * Other stacks will eventually provide a NULL ->hangup() pointer.
- */
-static void o2cb_cluster_hangup(const char *group, int grouplen)
-{
-        o2hb_stop(group);
-}
-
 static int o2cb_cluster_this_node(unsigned int *node)
 {
         int node_num;
@@ -388,7 +350,6 @@ static int o2cb_cluster_this_node(unsigned int *node)
 static struct ocfs2_stack_operations o2cb_stack_ops = {
         .connect        = o2cb_cluster_connect,
         .disconnect     = o2cb_cluster_disconnect,
-        .hangup         = o2cb_cluster_hangup,
         .this_node      = o2cb_cluster_this_node,
         .dlm_lock       = o2cb_dlm_lock,
         .dlm_unlock     = o2cb_dlm_unlock,
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index 6b97d11f6bf8..c021280dd462 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -816,8 +816,7 @@ out:
         return rc;
 }
 
-static int user_cluster_disconnect(struct ocfs2_cluster_connection *conn,
-                                   int hangup_pending)
+static int user_cluster_disconnect(struct ocfs2_cluster_connection *conn)
 {
         dlm_release_lockspace(conn->cc_lockspace, 2);
         conn->cc_lockspace = NULL;
diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
index 119f60cea9cc..10e149ae5e3a 100644
--- a/fs/ocfs2/stackglue.c
+++ b/fs/ocfs2/stackglue.c
@@ -26,6 +26,7 @@
 #include <linux/fs.h>
 #include <linux/kobject.h>
 #include <linux/sysfs.h>
+#include <linux/sysctl.h>
 
 #include "ocfs2_fs.h"
 
@@ -33,11 +34,13 @@
 
 #define OCFS2_STACK_PLUGIN_O2CB         "o2cb"
 #define OCFS2_STACK_PLUGIN_USER         "user"
+#define OCFS2_MAX_HB_CTL_PATH           256
 
 static struct ocfs2_locking_protocol *lproto;
 static DEFINE_SPINLOCK(ocfs2_stack_lock);
 static LIST_HEAD(ocfs2_stack_list);
 static char cluster_stack_name[OCFS2_STACK_LABEL_LEN + 1];
+static char ocfs2_hb_ctl_path[OCFS2_MAX_HB_CTL_PATH] = "/sbin/ocfs2_hb_ctl";
 
 /*
  * The stack currently in use.  If not null, active_stack->sp_count > 0,
@@ -349,7 +352,7 @@ int ocfs2_cluster_disconnect(struct ocfs2_cluster_connection *conn,
 
         BUG_ON(conn == NULL);
 
-        ret = active_stack->sp_ops->disconnect(conn, hangup_pending);
+        ret = active_stack->sp_ops->disconnect(conn);
 
         /* XXX Should we free it anyway? */
         if (!ret) {
@@ -362,13 +365,48 @@ int ocfs2_cluster_disconnect(struct ocfs2_cluster_connection *conn,
 }
 EXPORT_SYMBOL_GPL(ocfs2_cluster_disconnect);
 
+/*
+ * Leave the group for this filesystem.  This is executed by a userspace
+ * program (stored in ocfs2_hb_ctl_path).
+ */
+static void ocfs2_leave_group(const char *group)
+{
+        int ret;
+        char *argv[5], *envp[3];
+
+        argv[0] = ocfs2_hb_ctl_path;
+        argv[1] = "-K";
+        argv[2] = "-u";
+        argv[3] = (char *)group;
+        argv[4] = NULL;
+
+        /* minimal command environment taken from cpu_run_sbin_hotplug */
+        envp[0] = "HOME=/";
+        envp[1] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
+        envp[2] = NULL;
+
+        ret = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
+        if (ret < 0) {
+                printk(KERN_ERR
+                       "ocfs2: Error %d running user helper "
+                       "\"%s %s %s %s\"\n",
+                       ret, argv[0], argv[1], argv[2], argv[3]);
+        }
+}
+
+/*
+ * Hangup is a required post-umount.  ocfs2-tools software expects the
+ * filesystem to call "ocfs2_hb_ctl" during unmount.  This happens
+ * regardless of whether the DLM got started, so we can't do it
+ * in ocfs2_cluster_disconnect().  The ocfs2_leave_group() function does
+ * the actual work.
+ */
 void ocfs2_cluster_hangup(const char *group, int grouplen)
 {
         BUG_ON(group == NULL);
         BUG_ON(group[grouplen] != '\0');
 
-        if (active_stack->sp_ops->hangup)
-                active_stack->sp_ops->hangup(group, grouplen);
+        ocfs2_leave_group(group);
 
         /* cluster_disconnect() was called with hangup_pending==1 */
         ocfs2_stack_driver_put();
@@ -548,10 +586,83 @@ error:
         return ret;
 }
 
+/*
+ * Sysctl bits
+ *
+ * The sysctl lives at /proc/sys/fs/ocfs2/nm/hb_ctl_path.  The 'nm' doesn't
+ * make as much sense in a multiple cluster stack world, but it's safer
+ * and easier to preserve the name.
+ */
+
+#define FS_OCFS2_NM             1
+
+static ctl_table ocfs2_nm_table[] = {
+        {
+                .ctl_name       = 1,
+                .procname       = "hb_ctl_path",
+                .data           = ocfs2_hb_ctl_path,
+                .maxlen         = OCFS2_MAX_HB_CTL_PATH,
+                .mode           = 0644,
+                .proc_handler   = &proc_dostring,
+                .strategy       = &sysctl_string,
+        },
+        { .ctl_name = 0 }
+};
+
+static ctl_table ocfs2_mod_table[] = {
+        {
+                .ctl_name       = FS_OCFS2_NM,
+                .procname       = "nm",
+                .data           = NULL,
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = ocfs2_nm_table
+        },
+        { .ctl_name = 0}
+};
+
+static ctl_table ocfs2_kern_table[] = {
+        {
+                .ctl_name       = FS_OCFS2,
+                .procname       = "ocfs2",
+                .data           = NULL,
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = ocfs2_mod_table
+        },
+        { .ctl_name = 0}
+};
+
+static ctl_table ocfs2_root_table[] = {
+        {
+                .ctl_name       = CTL_FS,
+                .procname       = "fs",
+                .data           = NULL,
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = ocfs2_kern_table
+        },
+        { .ctl_name = 0 }
+};
+
+static struct ctl_table_header *ocfs2_table_header = NULL;
+
+
+/*
+ * Initialization
+ */
+
 static int __init ocfs2_stack_glue_init(void)
 {
         strcpy(cluster_stack_name, OCFS2_STACK_PLUGIN_O2CB);
 
+        ocfs2_table_header = register_sysctl_table(ocfs2_root_table);
+        if (!ocfs2_table_header) {
+                printk(KERN_ERR
+                       "ocfs2 stack glue: unable to register sysctl\n");
+                return -ENOMEM; /* or something. */
+        }
+
         return ocfs2_sysfs_init();
 }
 
@@ -559,6 +670,8 @@ static void __exit ocfs2_stack_glue_exit(void)
 {
         lproto = NULL;
         ocfs2_sysfs_exit();
+        if (ocfs2_table_header)
+                unregister_sysctl_table(ocfs2_table_header);
 }
 
 MODULE_AUTHOR("Oracle");
diff --git a/fs/ocfs2/stackglue.h b/fs/ocfs2/stackglue.h
index 005e4f170e0f..db56281dd1be 100644
--- a/fs/ocfs2/stackglue.h
+++ b/fs/ocfs2/stackglue.h
@@ -134,22 +134,10 @@ struct ocfs2_stack_operations {
          * be freed.  Thus, a stack must not return from ->disconnect()
          * until it will no longer reference the conn pointer.
          *
-         * If hangup_pending is zero, ocfs2_cluster_disconnect() will also
-         * be dropping the reference on the module.
+         * Once this call returns, the stack glue will be dropping this
+         * connection's reference on the module.
          */
-        int (*disconnect)(struct ocfs2_cluster_connection *conn,
-                          int hangup_pending);
-
-        /*
-         * ocfs2_cluster_hangup() exists for compatibility with older
-         * ocfs2 tools.  Only the classic stack really needs it.  As such
-         * ->hangup() is not required of all stacks.  See the comment by
-         * ocfs2_cluster_hangup() for more details.
-         *
-         * Note that ocfs2_cluster_hangup() can only be called if
-         * hangup_pending was passed to ocfs2_cluster_disconnect().
-         */
-        void (*hangup)(const char *group, int grouplen);
+        int (*disconnect)(struct ocfs2_cluster_connection *conn);
 
         /*
          * ->this_node() returns the cluster's unique identifier for the
@@ -258,4 +246,5 @@ void ocfs2_stack_glue_set_locking_protocol(struct ocfs2_locking_protocol *proto)
 /* Used by stack plugins */
 int ocfs2_stack_glue_register(struct ocfs2_stack_plugin *plugin);
 void ocfs2_stack_glue_unregister(struct ocfs2_stack_plugin *plugin);
+
 #endif  /* STACKGLUE_H */
diff --git a/fs/pipe.c b/fs/pipe.c
index ec228bc9f882..700f4e0d9572 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1003,8 +1003,7 @@ struct file *create_write_pipe(void)
 void free_write_pipe(struct file *f)
 {
         free_pipe_info(f->f_dentry->d_inode);
-        dput(f->f_path.dentry);
-        mntput(f->f_path.mnt);
+        path_put(&f->f_path);
         put_filp(f);
 }
 
@@ -1015,8 +1014,8 @@ struct file *create_read_pipe(struct file *wrf)
                 return ERR_PTR(-ENFILE);
 
         /* Grab pipe from the writer */
-        f->f_path.mnt = mntget(wrf->f_path.mnt);
-        f->f_path.dentry = dget(wrf->f_path.dentry);
+        f->f_path = wrf->f_path;
+        path_get(&wrf->f_path);
         f->f_mapping = wrf->f_path.dentry->d_inode->i_mapping;
 
         f->f_pos = 0;
@@ -1068,8 +1067,7 @@ int do_pipe(int *fd)
  err_fdr:
         put_unused_fd(fdr);
  err_read_pipe:
-        dput(fr->f_dentry);
-        mntput(fr->f_vfsmnt);
+        path_put(&fr->f_path);
         put_filp(fr);
  err_write_pipe:
         free_write_pipe(fw);
diff --git a/fs/select.c b/fs/select.c
index 8dda969614a9..da0e88201c3a 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -249,7 +249,6 @@ int do_select(int n, fd_set_bits *fds, s64 *timeout)
                                                 retval++;
                                         }
                                 }
-                                cond_resched();
                         }
                         if (res_in)
                                 *rinp = res_in;
@@ -257,6 +256,7 @@ int do_select(int n, fd_set_bits *fds, s64 *timeout)
                                 *routp = res_out;
                         if (res_ex)
                                 *rexp = res_ex;
+                        cond_resched();
                 }
                 wait = NULL;
                 if (retval || !*timeout || signal_pending(current))
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 7a5f69be6ac2..44cc702f96cc 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -682,38 +682,26 @@ static int udf_vrs(struct super_block *sb, int silent)
 /*
  * Check whether there is an anchor block in the given block
  */
-static int udf_check_anchor_block(struct super_block *sb, sector_t block,
-                                        bool varconv)
+static int udf_check_anchor_block(struct super_block *sb, sector_t block)
 {
-        struct buffer_head *bh = NULL;
-        tag *t;
+        struct buffer_head *bh;
         uint16_t ident;
-        uint32_t location;
 
-        if (varconv) {
-                if (udf_fixed_to_variable(block) >=
-                    sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits)
-                        return 0;
-                bh = sb_bread(sb, udf_fixed_to_variable(block));
-        }
-        else
-                bh = sb_bread(sb, block);
+        if (UDF_QUERY_FLAG(sb, UDF_FLAG_VARCONV) &&
+            udf_fixed_to_variable(block) >=
+            sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits)
+                return 0;
 
+        bh = udf_read_tagged(sb, block, block, &ident);
         if (!bh)
                 return 0;
-
-        t = (tag *)bh->b_data;
-        ident = le16_to_cpu(t->tagIdent);
-        location = le32_to_cpu(t->tagLocation);
         brelse(bh);
-        if (ident != TAG_IDENT_AVDP)
-                return 0;
-        return location == block;
+
+        return ident == TAG_IDENT_AVDP;
 }
 
 /* Search for an anchor volume descriptor pointer */
-static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
-                                        sector_t lastblock)
+static sector_t udf_scan_anchors(struct super_block *sb, sector_t lastblock)
 {
         sector_t last[6];
         int i;
@@ -739,7 +727,7 @@ static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
                                 sb->s_blocksize_bits)
                         continue;
 
-                if (udf_check_anchor_block(sb, last[i], varconv)) {
+                if (udf_check_anchor_block(sb, last[i])) {
                         sbi->s_anchor[0] = last[i];
                         sbi->s_anchor[1] = last[i] - 256;
                         return last[i];
@@ -748,17 +736,17 @@ static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
                 if (last[i] < 256)
                         continue;
 
-                if (udf_check_anchor_block(sb, last[i] - 256, varconv)) {
+                if (udf_check_anchor_block(sb, last[i] - 256)) {
                         sbi->s_anchor[1] = last[i] - 256;
                         return last[i];
                 }
         }
 
-        if (udf_check_anchor_block(sb, sbi->s_session + 256, varconv)) {
+        if (udf_check_anchor_block(sb, sbi->s_session + 256)) {
                 sbi->s_anchor[0] = sbi->s_session + 256;
                 return last[0];
         }
-        if (udf_check_anchor_block(sb, sbi->s_session + 512, varconv)) {
+        if (udf_check_anchor_block(sb, sbi->s_session + 512)) {
                 sbi->s_anchor[0] = sbi->s_session + 512;
                 return last[0];
         }
@@ -780,23 +768,24 @@ static void udf_find_anchor(struct super_block *sb)
         int i;
         struct udf_sb_info *sbi = UDF_SB(sb);
 
-        lastblock = udf_scan_anchors(sb, 0, sbi->s_last_block);
+        lastblock = udf_scan_anchors(sb, sbi->s_last_block);
         if (lastblock)
                 goto check_anchor;
 
         /* No anchor found? Try VARCONV conversion of block numbers */
+        UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
         /* Firstly, we try to not convert number of the last block */
-        lastblock = udf_scan_anchors(sb, 1,
+        lastblock = udf_scan_anchors(sb,
                                 udf_variable_to_fixed(sbi->s_last_block));
-        if (lastblock) {
-                UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
+        if (lastblock)
                 goto check_anchor;
-        }
 
         /* Secondly, we try with converted number of the last block */
-        lastblock = udf_scan_anchors(sb, 1, sbi->s_last_block);
-        if (lastblock)
-                UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
+        lastblock = udf_scan_anchors(sb, sbi->s_last_block);
+        if (!lastblock) {
+                /* VARCONV didn't help. Clear it. */
+                UDF_CLEAR_FLAG(sb, UDF_FLAG_VARCONV);
+        }
 
 check_anchor:
         /*
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index 8fa9c2d70911..8ec865de5f13 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -16,7 +16,7 @@
 #define UDF_PREALLOCATE
 #define UDF_DEFAULT_PREALLOC_BLOCKS     8
 
-#define UDFFS_DEBUG
+#undef UDFFS_DEBUG
 
 #ifdef UDFFS_DEBUG
 #define udf_debug(f, a...) \
diff --git a/fs/utimes.c b/fs/utimes.c
index af059d5cb485..b6b664e7145e 100644
--- a/fs/utimes.c
+++ b/fs/utimes.c
@@ -40,14 +40,9 @@ asmlinkage long sys_utime(char __user *filename, struct utimbuf __user *times)
 
 #endif
 
-static bool nsec_special(long nsec)
-{
-        return nsec == UTIME_OMIT || nsec == UTIME_NOW;
-}
-
 static bool nsec_valid(long nsec)
 {
-        if (nsec_special(nsec))
+        if (nsec == UTIME_OMIT || nsec == UTIME_NOW)
                 return true;
 
         return nsec >= 0 && nsec <= 999999999;
@@ -102,7 +97,11 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
         if (error)
                 goto dput_and_out;
 
-        /* Don't worry, the checks are done in inode_change_ok() */
+        if (times && times[0].tv_nsec == UTIME_NOW &&
+                     times[1].tv_nsec == UTIME_NOW)
+                times = NULL;
+
+        /* In most cases, the checks are done in inode_change_ok() */
         newattrs.ia_valid = ATTR_CTIME | ATTR_MTIME | ATTR_ATIME;
         if (times) {
                 error = -EPERM;
@@ -124,28 +123,34 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
                         newattrs.ia_mtime.tv_nsec = times[1].tv_nsec;
                         newattrs.ia_valid |= ATTR_MTIME_SET;
                 }
-        }
 
-        /*
-         * If times is NULL or both times are either UTIME_OMIT or
-         * UTIME_NOW, then need to check permissions, because
-         * inode_change_ok() won't do it.
-         */
-        if (!times || (nsec_special(times[0].tv_nsec) &&
-                       nsec_special(times[1].tv_nsec))) {
+                /*
+                 * For the UTIME_OMIT/UTIME_NOW and UTIME_NOW/UTIME_OMIT
+                 * cases, we need to make an extra check that is not done by
+                 * inode_change_ok().
+                 */
+                if (((times[0].tv_nsec == UTIME_NOW &&
+                            times[1].tv_nsec == UTIME_OMIT)
+                     ||
+                     (times[0].tv_nsec == UTIME_OMIT &&
+                            times[1].tv_nsec == UTIME_NOW))
+                    && !is_owner_or_cap(inode))
+                        goto mnt_drop_write_and_out;
+        } else {
+
+                /*
+                 * If times is NULL (or both times are UTIME_NOW),
+                 * then we need to check permissions, because
+                 * inode_change_ok() won't do it.
+                 */
                 error = -EACCES;
                 if (IS_IMMUTABLE(inode))
                         goto mnt_drop_write_and_out;
 
                 if (!is_owner_or_cap(inode)) {
-                        if (f) {
-                                if (!(f->f_mode & FMODE_WRITE))
-                                        goto mnt_drop_write_and_out;
-                        } else {
-                                error = vfs_permission(&nd, MAY_WRITE);
-                                if (error)
-                                        goto mnt_drop_write_and_out;
-                        }
+                        error = permission(inode, MAY_WRITE, NULL);
+                        if (error)
+                                goto mnt_drop_write_and_out;
                 }
         }
         mutex_lock(&inode->i_mutex);
@@ -169,14 +174,6 @@ asmlinkage long sys_utimensat(int dfd, char __user *filename, struct timespec __
         if (utimes) {
                 if (copy_from_user(&tstimes, utimes, sizeof(tstimes)))
                         return -EFAULT;
-                if ((tstimes[0].tv_nsec == UTIME_OMIT ||
-                     tstimes[0].tv_nsec == UTIME_NOW) &&
-                    tstimes[0].tv_sec != 0)
-                        return -EINVAL;
-                if ((tstimes[1].tv_nsec == UTIME_OMIT ||
-                     tstimes[1].tv_nsec == UTIME_NOW) &&
-                    tstimes[1].tv_sec != 0)
-                        return -EINVAL;
 
                 /* Nothing to do, we must not even check the path.  */
                 if (tstimes[0].tv_nsec == UTIME_OMIT &&