13 files changed, 250 insertions, 83 deletions

diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index a6c9078af124..5a5b7116cefb 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -2311,8 +2311,10 @@ static int do_wireless_ioctl(unsigned int fd, unsigned int cmd, unsigned long ar
         struct iwreq __user *iwr_u;
         struct iw_point __user *iwp;
         struct compat_iw_point __user *iwp_u;
-        compat_caddr_t pointer;
+        compat_caddr_t pointer_u;
+        void __user *pointer;
         __u16 length, flags;
+        int ret;
 
         iwr_u = compat_ptr(arg);
         iwp_u = (struct compat_iw_point __user *) &iwr_u->u.data;
@@ -2330,17 +2332,29 @@ static int do_wireless_ioctl(unsigned int fd, unsigned int cmd, unsigned long ar
                            sizeof(iwr->ifr_ifrn.ifrn_name)))
                 return -EFAULT;
 
-        if (__get_user(pointer, &iwp_u->pointer) ||
+        if (__get_user(pointer_u, &iwp_u->pointer) ||
             __get_user(length, &iwp_u->length) ||
             __get_user(flags, &iwp_u->flags))
                 return -EFAULT;
 
-        if (__put_user(compat_ptr(pointer), &iwp->pointer) ||
+        if (__put_user(compat_ptr(pointer_u), &iwp->pointer) ||
             __put_user(length, &iwp->length) ||
             __put_user(flags, &iwp->flags))
                 return -EFAULT;
 
-        return sys_ioctl(fd, cmd, (unsigned long) iwr);
+        ret = sys_ioctl(fd, cmd, (unsigned long) iwr);
+
+        if (__get_user(pointer, &iwp->pointer) ||
+            __get_user(length, &iwp->length) ||
+            __get_user(flags, &iwp->flags))
+                return -EFAULT;
+
+        if (__put_user(ptr_to_compat(pointer), &iwp_u->pointer) ||
+            __put_user(length, &iwp_u->length) ||
+            __put_user(flags, &iwp_u->flags))
+                return -EFAULT;
+
+        return ret;
 }
 
 /* Since old style bridge ioctl's endup using SIOCDEVPRIVATE
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 1586807b8177..c1fa1908dba0 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -140,7 +140,8 @@ struct dx_frame
 struct dx_map_entry
 {
         u32 hash;
-        u32 offs;
+        u16 offs;
+        u16 size;
 };
 
 #ifdef CONFIG_EXT3_INDEX
@@ -379,13 +380,28 @@ dx_probe(struct dentry *dentry, struct inode *dir,
 
         entries = (struct dx_entry *) (((char *)&root->info) +
                                        root->info.info_length);
-        assert(dx_get_limit(entries) == dx_root_limit(dir,
-                                                      root->info.info_length));
+
+        if (dx_get_limit(entries) != dx_root_limit(dir,
+                                                   root->info.info_length)) {
+                ext3_warning(dir->i_sb, __FUNCTION__,
+                             "dx entry: limit != root limit");
+                brelse(bh);
+                *err = ERR_BAD_DX_DIR;
+                goto fail;
+        }
+
         dxtrace (printk("Look up %x", hash));
         while (1)
         {
                 count = dx_get_count(entries);
-                assert (count && count <= dx_get_limit(entries));
+                if (!count || count > dx_get_limit(entries)) {
+                        ext3_warning(dir->i_sb, __FUNCTION__,
+                                     "dx entry: no count or count > limit");
+                        brelse(bh);
+                        *err = ERR_BAD_DX_DIR;
+                        goto fail2;
+                }
+
                 p = entries + 1;
                 q = entries + count - 1;
                 while (p <= q)
@@ -423,8 +439,15 @@ dx_probe(struct dentry *dentry, struct inode *dir,
                 if (!(bh = ext3_bread (NULL,dir, dx_get_block(at), 0, err)))
                         goto fail2;
                 at = entries = ((struct dx_node *) bh->b_data)->entries;
-                assert (dx_get_limit(entries) == dx_node_limit (dir));
+                if (dx_get_limit(entries) != dx_node_limit (dir)) {
+                        ext3_warning(dir->i_sb, __FUNCTION__,
+                                     "dx entry: limit != node limit");
+                        brelse(bh);
+                        *err = ERR_BAD_DX_DIR;
+                        goto fail2;
+                }
                 frame++;
+                frame->bh = NULL;
         }
 fail2:
         while (frame >= frame_in) {
@@ -432,6 +455,10 @@ fail2:
                 frame--;
         }
 fail:
+        if (*err == ERR_BAD_DX_DIR)
+                ext3_warning(dir->i_sb, __FUNCTION__,
+                             "Corrupt dir inode %ld, running e2fsck is "
+                             "recommended.", dir->i_ino);
         return NULL;
 }
 
@@ -671,6 +698,10 @@ errout:
  * Directory block splitting, compacting
  */
 
+/*
+ * Create map of hash values, offsets, and sizes, stored at end of block.
+ * Returns number of entries mapped.
+ */
 static int dx_make_map (struct ext3_dir_entry_2 *de, int size,
                         struct dx_hash_info *hinfo, struct dx_map_entry *map_tail)
 {
@@ -684,7 +715,8 @@ static int dx_make_map (struct ext3_dir_entry_2 *de, int size,
                         ext3fs_dirhash(de->name, de->name_len, &h);
                         map_tail--;
                         map_tail->hash = h.hash;
-                        map_tail->offs = (u32) ((char *) de - base);
+                        map_tail->offs = (u16) ((char *) de - base);
+                        map_tail->size = le16_to_cpu(de->rec_len);
                         count++;
                         cond_resched();
                 }
@@ -694,6 +726,7 @@ static int dx_make_map (struct ext3_dir_entry_2 *de, int size,
         return count;
 }
 
+/* Sort map by hash value */
 static void dx_sort_map (struct dx_map_entry *map, unsigned count)
 {
         struct dx_map_entry *p, *q, *top = map + count - 1;
@@ -1091,6 +1124,10 @@ static inline void ext3_set_de_type(struct super_block *sb,
 }
 
 #ifdef CONFIG_EXT3_INDEX
+/*
+ * Move count entries from end of map between two memory locations.
+ * Returns pointer to last entry moved.
+ */
 static struct ext3_dir_entry_2 *
 dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
 {
@@ -1109,6 +1146,10 @@ dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
         return (struct ext3_dir_entry_2 *) (to - rec_len);
 }
 
+/*
+ * Compact each dir entry in the range to the minimal rec_len.
+ * Returns pointer to last entry in range.
+ */
 static struct ext3_dir_entry_2* dx_pack_dirents(char *base, int size)
 {
         struct ext3_dir_entry_2 *next, *to, *prev, *de = (struct ext3_dir_entry_2 *) base;
@@ -1131,6 +1172,11 @@ static struct ext3_dir_entry_2* dx_pack_dirents(char *base, int size)
         return prev;
 }
 
+/*
+ * Split a full leaf block to make room for a new dir entry.
+ * Allocate a new block, and move entries so that they are approx. equally full.
+ * Returns pointer to de in block into which the new entry will be inserted.
+ */
 static struct ext3_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
                         struct buffer_head **bh,struct dx_frame *frame,
                         struct dx_hash_info *hinfo, int *error)
@@ -1142,7 +1188,7 @@ static struct ext3_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
         u32 hash2;
         struct dx_map_entry *map;
         char *data1 = (*bh)->b_data, *data2;
-        unsigned split;
+        unsigned split, move, size, i;
         struct ext3_dir_entry_2 *de = NULL, *de2;
         int     err = 0;
 
@@ -1170,8 +1216,19 @@ static struct ext3_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
         count = dx_make_map ((struct ext3_dir_entry_2 *) data1,
                              blocksize, hinfo, map);
         map -= count;
-        split = count/2; // need to adjust to actual middle
         dx_sort_map (map, count);
+        /* Split the existing block in the middle, size-wise */
+        size = 0;
+        move = 0;
+        for (i = count-1; i >= 0; i--) {
+                /* is more than half of this entry in 2nd half of the block? */
+                if (size + map[i].size/2 > blocksize/2)
+                        break;
+                size += map[i].size;
+                move++;
+        }
+        /* map index at which we will split */
+        split = count - move;
         hash2 = map[split].hash;
         continued = hash2 == map[split - 1].hash;
         dxtrace(printk("Split block %i at %x, %i/%i\n",
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index da224974af78..5fdb862e71c4 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -140,7 +140,8 @@ struct dx_frame
 struct dx_map_entry
 {
         u32 hash;
-        u32 offs;
+        u16 offs;
+        u16 size;
 };
 
 #ifdef CONFIG_EXT4_INDEX
@@ -379,13 +380,28 @@ dx_probe(struct dentry *dentry, struct inode *dir,
 
         entries = (struct dx_entry *) (((char *)&root->info) +
                                        root->info.info_length);
-        assert(dx_get_limit(entries) == dx_root_limit(dir,
-                                                      root->info.info_length));
+
+        if (dx_get_limit(entries) != dx_root_limit(dir,
+                                                   root->info.info_length)) {
+                ext4_warning(dir->i_sb, __FUNCTION__,
+                             "dx entry: limit != root limit");
+                brelse(bh);
+                *err = ERR_BAD_DX_DIR;
+                goto fail;
+        }
+
         dxtrace (printk("Look up %x", hash));
         while (1)
         {
                 count = dx_get_count(entries);
-                assert (count && count <= dx_get_limit(entries));
+                if (!count || count > dx_get_limit(entries)) {
+                        ext4_warning(dir->i_sb, __FUNCTION__,
+                                     "dx entry: no count or count > limit");
+                        brelse(bh);
+                        *err = ERR_BAD_DX_DIR;
+                        goto fail2;
+                }
+
                 p = entries + 1;
                 q = entries + count - 1;
                 while (p <= q)
@@ -423,8 +439,15 @@ dx_probe(struct dentry *dentry, struct inode *dir,
                 if (!(bh = ext4_bread (NULL,dir, dx_get_block(at), 0, err)))
                         goto fail2;
                 at = entries = ((struct dx_node *) bh->b_data)->entries;
-                assert (dx_get_limit(entries) == dx_node_limit (dir));
+                if (dx_get_limit(entries) != dx_node_limit (dir)) {
+                        ext4_warning(dir->i_sb, __FUNCTION__,
+                                     "dx entry: limit != node limit");
+                        brelse(bh);
+                        *err = ERR_BAD_DX_DIR;
+                        goto fail2;
+                }
                 frame++;
+                frame->bh = NULL;
         }
 fail2:
         while (frame >= frame_in) {
@@ -432,6 +455,10 @@ fail2:
                 frame--;
         }
 fail:
+        if (*err == ERR_BAD_DX_DIR)
+                ext4_warning(dir->i_sb, __FUNCTION__,
+                             "Corrupt dir inode %ld, running e2fsck is "
+                             "recommended.", dir->i_ino);
         return NULL;
 }
 
@@ -671,6 +698,10 @@ errout:
  * Directory block splitting, compacting
  */
 
+/*
+ * Create map of hash values, offsets, and sizes, stored at end of block.
+ * Returns number of entries mapped.
+ */
 static int dx_make_map (struct ext4_dir_entry_2 *de, int size,
                         struct dx_hash_info *hinfo, struct dx_map_entry *map_tail)
 {
@@ -684,7 +715,8 @@ static int dx_make_map (struct ext4_dir_entry_2 *de, int size,
                         ext4fs_dirhash(de->name, de->name_len, &h);
                         map_tail--;
                         map_tail->hash = h.hash;
-                        map_tail->offs = (u32) ((char *) de - base);
+                        map_tail->offs = (u16) ((char *) de - base);
+                        map_tail->size = le16_to_cpu(de->rec_len);
                         count++;
                         cond_resched();
                 }
@@ -694,6 +726,7 @@ static int dx_make_map (struct ext4_dir_entry_2 *de, int size,
         return count;
 }
 
+/* Sort map by hash value */
 static void dx_sort_map (struct dx_map_entry *map, unsigned count)
 {
         struct dx_map_entry *p, *q, *top = map + count - 1;
@@ -1089,6 +1122,10 @@ static inline void ext4_set_de_type(struct super_block *sb,
 }
 
 #ifdef CONFIG_EXT4_INDEX
+/*
+ * Move count entries from end of map between two memory locations.
+ * Returns pointer to last entry moved.
+ */
 static struct ext4_dir_entry_2 *
 dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
 {
@@ -1107,6 +1144,10 @@ dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
         return (struct ext4_dir_entry_2 *) (to - rec_len);
 }
 
+/*
+ * Compact each dir entry in the range to the minimal rec_len.
+ * Returns pointer to last entry in range.
+ */
 static struct ext4_dir_entry_2* dx_pack_dirents(char *base, int size)
 {
         struct ext4_dir_entry_2 *next, *to, *prev, *de = (struct ext4_dir_entry_2 *) base;
@@ -1129,6 +1170,11 @@ static struct ext4_dir_entry_2* dx_pack_dirents(char *base, int size)
         return prev;
 }
 
+/*
+ * Split a full leaf block to make room for a new dir entry.
+ * Allocate a new block, and move entries so that they are approx. equally full.
+ * Returns pointer to de in block into which the new entry will be inserted.
+ */
 static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
                         struct buffer_head **bh,struct dx_frame *frame,
                         struct dx_hash_info *hinfo, int *error)
@@ -1140,7 +1186,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
         u32 hash2;
         struct dx_map_entry *map;
         char *data1 = (*bh)->b_data, *data2;
-        unsigned split;
+        unsigned split, move, size, i;
         struct ext4_dir_entry_2 *de = NULL, *de2;
         int     err = 0;
 
@@ -1168,8 +1214,19 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
         count = dx_make_map ((struct ext4_dir_entry_2 *) data1,
                              blocksize, hinfo, map);
         map -= count;
-        split = count/2; // need to adjust to actual middle
         dx_sort_map (map, count);
+        /* Split the existing block in the middle, size-wise */
+        size = 0;
+        move = 0;
+        for (i = count-1; i >= 0; i--) {
+                /* is more than half of this entry in 2nd half of the block? */
+                if (size + map[i].size/2 > blocksize/2)
+                        break;
+                size += map[i].size;
+                move++;
+        }
+        /* map index at which we will split */
+        split = count - move;
         hash2 = map[split].hash;
         continued = hash2 == map[split - 1].hash;
         dxtrace(printk("Split block %i at %x, %i/%i\n",
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 8ed593766f16..b878528b64c1 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -345,8 +345,8 @@ void __exit unregister_nfs_fs(void)
         unregister_shrinker(&acl_shrinker);
 #ifdef CONFIG_NFS_V4
         unregister_filesystem(&nfs4_fs_type);
-        nfs_unregister_sysctl();
 #endif
+        nfs_unregister_sysctl();
         unregister_filesystem(&nfs_fs_type);
 }
 
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index d9c40fe64195..5f152f60d74d 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -181,6 +181,7 @@ xfs_setfilesize(
                 ip->i_d.di_size = isize;
                 ip->i_update_core = 1;
                 ip->i_update_size = 1;
+                mark_inode_dirty_sync(vn_to_inode(ioend->io_vnode));
         }
 
         xfs_iunlock(ip, XFS_ILOCK_EXCL);
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 4528f9a3f304..491d1f4f202d 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -415,8 +415,10 @@ xfs_fs_write_inode(
 
         if (vp) {
                 vn_trace_entry(vp, __FUNCTION__, (inst_t *)__return_address);
-                if (sync)
+                if (sync) {
+                        filemap_fdatawait(inode->i_mapping);
                         flags |= FLUSH_SYNC;
+                }
                 error = bhv_vop_iflush(vp, flags);
                 if (error == EAGAIN)
                         error = sync? bhv_vop_iflush(vp, flags | FLUSH_LOG) : 0;
diff --git a/fs/xfs/xfs_buf_item.h b/fs/xfs/xfs_buf_item.h
index d7e136143066..fa25b7dcc6c3 100644
--- a/fs/xfs/xfs_buf_item.h
+++ b/fs/xfs/xfs_buf_item.h
@@ -52,6 +52,11 @@ typedef struct xfs_buf_log_format_t {
 #define XFS_BLI_UDQUOT_BUF      0x4
 #define XFS_BLI_PDQUOT_BUF      0x8
 #define XFS_BLI_GDQUOT_BUF      0x10
+/*
+ * This flag indicates that the buffer contains newly allocated
+ * inodes.
+ */
+#define XFS_BLI_INODE_NEW_BUF   0x20
 
 #define XFS_BLI_CHUNK           128
 #define XFS_BLI_SHIFT           7
diff --git a/fs/xfs/xfs_filestream.c b/fs/xfs/xfs_filestream.c
index ce2278611bb7..16f8e175167d 100644
--- a/fs/xfs/xfs_filestream.c
+++ b/fs/xfs/xfs_filestream.c
@@ -467,8 +467,7 @@ void
 xfs_filestream_flush(
         xfs_mount_t     *mp)
 {
-        /* point in time flush, so keep the reaper running */
-        xfs_mru_cache_flush(mp->m_filestream, 1);
+        xfs_mru_cache_flush(mp->m_filestream);
 }
 
 /*
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 8ae6e8e5f3db..dacb19739cc2 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1874,6 +1874,7 @@ xlog_recover_do_inode_buffer(
 /*ARGSUSED*/
 STATIC void
 xlog_recover_do_reg_buffer(
+        xfs_mount_t             *mp,
         xlog_recover_item_t     *item,
         xfs_buf_t               *bp,
         xfs_buf_log_format_t    *buf_f)
@@ -1884,6 +1885,50 @@ xlog_recover_do_reg_buffer(
         unsigned int            *data_map = NULL;
         unsigned int            map_size = 0;
         int                     error;
+        int                     stale_buf = 1;
+
+        /*
+         * Scan through the on-disk inode buffer and attempt to
+         * determine if it has been written to since it was logged.
+         *
+         * - If any of the magic numbers are incorrect then the buffer is stale
+         * - If any of the modes are non-zero then the buffer is not stale
+         * - If all of the modes are zero and at least one of the generation
+         *   counts is non-zero then the buffer is stale
+         *
+         * If the end result is a stale buffer then the log buffer is replayed
+         * otherwise it is skipped.
+         *
+         * This heuristic is not perfect.  It can be improved by scanning the
+         * entire inode chunk for evidence that any of the inode clusters have
+         * been updated.  To fix this problem completely we will need a major
+         * architectural change to the logging system.
+         */
+        if (buf_f->blf_flags & XFS_BLI_INODE_NEW_BUF) {
+                xfs_dinode_t    *dip;
+                int             inodes_per_buf;
+                int             mode_count = 0;
+                int             gen_count = 0;
+
+                stale_buf = 0;
+                inodes_per_buf = XFS_BUF_COUNT(bp) >> mp->m_sb.sb_inodelog;
+                for (i = 0; i < inodes_per_buf; i++) {
+                        dip = (xfs_dinode_t *)xfs_buf_offset(bp,
+                                i * mp->m_sb.sb_inodesize);
+                        if (be16_to_cpu(dip->di_core.di_magic) !=
+                                        XFS_DINODE_MAGIC) {
+                                stale_buf = 1;
+                                break;
+                        }
+                        if (be16_to_cpu(dip->di_core.di_mode))
+                                mode_count++;
+                        if (be16_to_cpu(dip->di_core.di_gen))
+                                gen_count++;
+                }
+
+                if (!mode_count && gen_count)
+                        stale_buf = 1;
+        }
 
         switch (buf_f->blf_type) {
         case XFS_LI_BUF:
@@ -1917,7 +1962,7 @@ xlog_recover_do_reg_buffer(
                                                -1, 0, XFS_QMOPT_DOWARN,
                                                "dquot_buf_recover");
                 }
-                if (!error)
+                if (!error && stale_buf)
                         memcpy(xfs_buf_offset(bp,
                                 (uint)bit << XFS_BLI_SHIFT),    /* dest */
                                 item->ri_buf[i].i_addr,         /* source */
@@ -2089,7 +2134,7 @@ xlog_recover_do_dquot_buffer(
         if (log->l_quotaoffs_flag & type)
                 return;
 
-        xlog_recover_do_reg_buffer(item, bp, buf_f);
+        xlog_recover_do_reg_buffer(mp, item, bp, buf_f);
 }
 
 /*
@@ -2190,7 +2235,7 @@ xlog_recover_do_buffer_trans(
                   (XFS_BLI_UDQUOT_BUF|XFS_BLI_PDQUOT_BUF|XFS_BLI_GDQUOT_BUF)) {
                 xlog_recover_do_dquot_buffer(mp, log, item, bp, buf_f);
         } else {
-                xlog_recover_do_reg_buffer(item, bp, buf_f);
+                xlog_recover_do_reg_buffer(mp, item, bp, buf_f);
         }
         if (error)
                 return XFS_ERROR(error);
diff --git a/fs/xfs/xfs_mru_cache.c b/fs/xfs/xfs_mru_cache.c
index 7deb9e3cbbd3..e0b358c1c533 100644
--- a/fs/xfs/xfs_mru_cache.c
+++ b/fs/xfs/xfs_mru_cache.c
@@ -206,8 +206,11 @@ _xfs_mru_cache_list_insert(
          */
         if (!_xfs_mru_cache_migrate(mru, now)) {
                 mru->time_zero = now;
-                if (!mru->next_reap)
-                        mru->next_reap = mru->grp_count * mru->grp_time;
+                if (!mru->queued) {
+                        mru->queued = 1;
+                        queue_delayed_work(xfs_mru_reap_wq, &mru->work,
+                                           mru->grp_count * mru->grp_time);
+                }
         } else {
                 grp = (now - mru->time_zero) / mru->grp_time;
                 grp = (mru->lru_grp + grp) % mru->grp_count;
@@ -271,29 +274,26 @@ _xfs_mru_cache_reap(
         struct work_struct      *work)
 {
         xfs_mru_cache_t         *mru = container_of(work, xfs_mru_cache_t, work.work);
-        unsigned long           now;
+        unsigned long           now, next;
 
         ASSERT(mru && mru->lists);
         if (!mru || !mru->lists)
                 return;
 
         mutex_spinlock(&mru->lock);
-        now = jiffies;
-        if (mru->reap_all ||
-            (mru->next_reap && time_after(now, mru->next_reap))) {
-                if (mru->reap_all)
-                        now += mru->grp_count * mru->grp_time * 2;
-                mru->next_reap = _xfs_mru_cache_migrate(mru, now);
-                _xfs_mru_cache_clear_reap_list(mru);
+        next = _xfs_mru_cache_migrate(mru, jiffies);
+        _xfs_mru_cache_clear_reap_list(mru);
+
+        mru->queued = next;
+        if ((mru->queued > 0)) {
+                now = jiffies;
+                if (next <= now)
+                        next = 0;
+                else
+                        next -= now;
+                queue_delayed_work(xfs_mru_reap_wq, &mru->work, next);
         }
 
-        /*
-         * the process that triggered the reap_all is responsible
-         * for restating the periodic reap if it is required.
-         */
-        if (!mru->reap_all)
-                queue_delayed_work(xfs_mru_reap_wq, &mru->work, mru->grp_time);
-        mru->reap_all = 0;
         mutex_spinunlock(&mru->lock, 0);
 }
 
@@ -352,7 +352,7 @@ xfs_mru_cache_create(
 
         /* An extra list is needed to avoid reaping up to a grp_time early. */
         mru->grp_count = grp_count + 1;
-        mru->lists = kmem_alloc(mru->grp_count * sizeof(*mru->lists), KM_SLEEP);
+        mru->lists = kmem_zalloc(mru->grp_count * sizeof(*mru->lists), KM_SLEEP);
 
         if (!mru->lists) {
                 err = ENOMEM;
@@ -374,11 +374,6 @@ xfs_mru_cache_create(
         mru->grp_time  = grp_time;
         mru->free_func = free_func;
 
-        /* start up the reaper event */
-        mru->next_reap = 0;
-        mru->reap_all = 0;
-        queue_delayed_work(xfs_mru_reap_wq, &mru->work, mru->grp_time);
-
         *mrup = mru;
 
 exit:
@@ -394,35 +389,25 @@ exit:
  * Call xfs_mru_cache_flush() to flush out all cached entries, calling their
  * free functions as they're deleted.  When this function returns, the caller is
  * guaranteed that all the free functions for all the elements have finished
- * executing.
- *
- * While we are flushing, we stop the periodic reaper event from triggering.
- * Normally, we want to restart this periodic event, but if we are shutting
- * down the cache we do not want it restarted. hence the restart parameter
- * where 0 = do not restart reaper and 1 = restart reaper.
+ * executing and the reaper is not running.
  */
 void
 xfs_mru_cache_flush(
-        xfs_mru_cache_t         *mru,
-        int                     restart)
+        xfs_mru_cache_t         *mru)
 {
         if (!mru || !mru->lists)
                 return;
 
-        cancel_rearming_delayed_workqueue(xfs_mru_reap_wq, &mru->work);
-
         mutex_spinlock(&mru->lock);
-        mru->reap_all = 1;
-        mutex_spinunlock(&mru->lock, 0);
+        if (mru->queued) {
+                mutex_spinunlock(&mru->lock, 0);
+                cancel_rearming_delayed_workqueue(xfs_mru_reap_wq, &mru->work);
+                mutex_spinlock(&mru->lock);
+        }
 
-        queue_work(xfs_mru_reap_wq, &mru->work.work);
-        flush_workqueue(xfs_mru_reap_wq);
+        _xfs_mru_cache_migrate(mru, jiffies + mru->grp_count * mru->grp_time);
+        _xfs_mru_cache_clear_reap_list(mru);
 
-        mutex_spinlock(&mru->lock);
-        WARN_ON_ONCE(mru->reap_all != 0);
-        mru->reap_all = 0;
-        if (restart)
-                queue_delayed_work(xfs_mru_reap_wq, &mru->work, mru->grp_time);
         mutex_spinunlock(&mru->lock, 0);
 }
 
@@ -433,8 +418,7 @@ xfs_mru_cache_destroy(
         if (!mru || !mru->lists)
                 return;
 
-        /* we don't want the reaper to restart here */
-        xfs_mru_cache_flush(mru, 0);
+        xfs_mru_cache_flush(mru);
 
         kmem_free(mru->lists, mru->grp_count * sizeof(*mru->lists));
         kmem_free(mru, sizeof(*mru));
diff --git a/fs/xfs/xfs_mru_cache.h b/fs/xfs/xfs_mru_cache.h
index 624fd10ee8e5..dd58ea1bbebe 100644
--- a/fs/xfs/xfs_mru_cache.h
+++ b/fs/xfs/xfs_mru_cache.h
@@ -32,11 +32,9 @@ typedef struct xfs_mru_cache
         unsigned int            grp_time;  /* Time period spanned by grps.  */
         unsigned int            lru_grp;   /* Group containing time zero.   */
         unsigned long           time_zero; /* Time first element was added. */
-        unsigned long           next_reap; /* Time that the reaper should
-                                              next do something. */
-        unsigned int            reap_all;  /* if set, reap all lists */
         xfs_mru_cache_free_func_t free_func; /* Function pointer for freeing. */
         struct delayed_work     work;      /* Workqueue data for reaping.   */
+        unsigned int            queued;    /* work has been queued */
 } xfs_mru_cache_t;
 
 int xfs_mru_cache_init(void);
@@ -44,7 +42,7 @@ void xfs_mru_cache_uninit(void);
 int xfs_mru_cache_create(struct xfs_mru_cache **mrup, unsigned int lifetime_ms,
                              unsigned int grp_count,
                              xfs_mru_cache_free_func_t free_func);
-void xfs_mru_cache_flush(xfs_mru_cache_t *mru, int restart);
+void xfs_mru_cache_flush(xfs_mru_cache_t *mru);
 void xfs_mru_cache_destroy(struct xfs_mru_cache *mru);
 int xfs_mru_cache_insert(struct xfs_mru_cache *mru, unsigned long key,
                                 void *value);
diff --git a/fs/xfs/xfs_trans_buf.c b/fs/xfs/xfs_trans_buf.c
index 60b6b898022b..95fff6872a2f 100644
--- a/fs/xfs/xfs_trans_buf.c
+++ b/fs/xfs/xfs_trans_buf.c
@@ -966,6 +966,7 @@ xfs_trans_inode_alloc_buf(
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
 
         bip->bli_flags |= XFS_BLI_INODE_ALLOC_BUF;
+        bip->bli_format.blf_flags |= XFS_BLI_INODE_NEW_BUF;
 }
 
 
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 1a5ad8cd97b0..603459229904 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -1082,6 +1082,9 @@ xfs_fsync(
         if (XFS_FORCED_SHUTDOWN(ip->i_mount))
                 return XFS_ERROR(EIO);
 
+        if (flag & FSYNC_DATA)
+                filemap_fdatawait(vn_to_inode(XFS_ITOV(ip))->i_mapping);
+
         /*
          * We always need to make sure that the required inode state
          * is safe on disk.  The vnode might be clean but because
@@ -3769,12 +3772,16 @@ xfs_inode_flush(
                         sync_lsn = log->l_last_sync_lsn;
                         GRANT_UNLOCK(log, s);
 
-                        if ((XFS_LSN_CMP(iip->ili_last_lsn, sync_lsn) <= 0))
-                                return 0;
+                        if ((XFS_LSN_CMP(iip->ili_last_lsn, sync_lsn) > 0)) {
+                                if (flags & FLUSH_SYNC)
+                                        log_flags |= XFS_LOG_SYNC;
+                                error = xfs_log_force(mp, iip->ili_last_lsn, log_flags);
+                                if (error)
+                                        return error;
+                        }
 
-                        if (flags & FLUSH_SYNC)
-                                log_flags |= XFS_LOG_SYNC;
-                        return xfs_log_force(mp, iip->ili_last_lsn, log_flags);
+                        if (ip->i_update_core == 0)
+                                return 0;
                 }
         }
 
@@ -3788,9 +3795,6 @@ xfs_inode_flush(
         if (flags & FLUSH_INODE) {
                 int     flush_flags;
 
-                if (xfs_ipincount(ip))
-                        return EAGAIN;
-
                 if (flags & FLUSH_SYNC) {
                         xfs_ilock(ip, XFS_ILOCK_SHARED);
                         xfs_iflock(ip);