18 files changed, 138 insertions, 78 deletions

diff --git a/fs/buffer.c b/fs/buffer.c
index 838a9cf246bd..c7062c896d7c 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1036,6 +1036,9 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
 static struct buffer_head *
 __getblk_slow(struct block_device *bdev, sector_t block, int size)
 {
+        int ret;
+        struct buffer_head *bh;
+
         /* Size must be multiple of hard sectorsize */
         if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
                         (size < 512 || size > PAGE_SIZE))) {
@@ -1048,20 +1051,21 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
                 return NULL;
         }
 
-        for (;;) {
-                struct buffer_head * bh;
-                int ret;
+retry:
+        bh = __find_get_block(bdev, block, size);
+        if (bh)
+                return bh;
 
+        ret = grow_buffers(bdev, block, size);
+        if (ret == 0) {
+                free_more_memory();
+                goto retry;
+        } else if (ret > 0) {
                 bh = __find_get_block(bdev, block, size);
                 if (bh)
                         return bh;
-
-                ret = grow_buffers(bdev, block, size);
-                if (ret < 0)
-                        return NULL;
-                if (ret == 0)
-                        free_more_memory();
         }
+        return NULL;
 }
 
 /*
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 5b400730c213..4ee522b3f66f 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -86,7 +86,31 @@ static struct {
 #endif /* CONFIG_CIFS_WEAK_PW_HASH */
 #endif /* CIFS_POSIX */
 
-/* Forward declarations */
+#ifdef CONFIG_HIGHMEM
+/*
+ * On arches that have high memory, kmap address space is limited. By
+ * serializing the kmap operations on those arches, we ensure that we don't
+ * end up with a bunch of threads in writeback with partially mapped page
+ * arrays, stuck waiting for kmap to come back. That situation prevents
+ * progress and can deadlock.
+ */
+static DEFINE_MUTEX(cifs_kmap_mutex);
+
+static inline void
+cifs_kmap_lock(void)
+{
+        mutex_lock(&cifs_kmap_mutex);
+}
+
+static inline void
+cifs_kmap_unlock(void)
+{
+        mutex_unlock(&cifs_kmap_mutex);
+}
+#else /* !CONFIG_HIGHMEM */
+#define cifs_kmap_lock() do { ; } while(0)
+#define cifs_kmap_unlock() do { ; } while(0)
+#endif /* CONFIG_HIGHMEM */
 
 /* Mark as invalid, all open files on tree connections since they
    were closed when session to server was lost */
@@ -1503,7 +1527,9 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
         }
 
         /* marshal up the page array */
+        cifs_kmap_lock();
         len = rdata->marshal_iov(rdata, data_len);
+        cifs_kmap_unlock();
         data_len -= len;
 
         /* issue the read if we have any iovecs left to fill */
@@ -2069,7 +2095,9 @@ cifs_async_writev(struct cifs_writedata *wdata)
          * and set the iov_len properly for each one. It may also set
          * wdata->bytes too.
          */
+        cifs_kmap_lock();
         wdata->marshal_iov(iov, wdata);
+        cifs_kmap_unlock();
 
         cFYI(1, "async write at %llu %u bytes", wdata->offset, wdata->bytes);
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 0ae86ddf2213..94b7788c3189 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -3445,6 +3445,18 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 #define CIFS_DEFAULT_NON_POSIX_RSIZE (60 * 1024)
 #define CIFS_DEFAULT_NON_POSIX_WSIZE (65536)
 
+/*
+ * On hosts with high memory, we can't currently support wsize/rsize that are
+ * larger than we can kmap at once. Cap the rsize/wsize at
+ * LAST_PKMAP * PAGE_SIZE. We'll never be able to fill a read or write request
+ * larger than that anyway.
+ */
+#ifdef CONFIG_HIGHMEM
+#define CIFS_KMAP_SIZE_LIMIT    (LAST_PKMAP * PAGE_CACHE_SIZE)
+#else /* CONFIG_HIGHMEM */
+#define CIFS_KMAP_SIZE_LIMIT    (1<<24)
+#endif /* CONFIG_HIGHMEM */
+
 static unsigned int
 cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
 {
@@ -3475,6 +3487,9 @@ cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
                 wsize = min_t(unsigned int, wsize,
                                 server->maxBuf - sizeof(WRITE_REQ) + 4);
 
+        /* limit to the amount that we can kmap at once */
+        wsize = min_t(unsigned int, wsize, CIFS_KMAP_SIZE_LIMIT);
+
         /* hard limit of CIFS_MAX_WSIZE */
         wsize = min_t(unsigned int, wsize, CIFS_MAX_WSIZE);
 
@@ -3516,6 +3531,9 @@ cifs_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
         if (!(server->capabilities & CAP_LARGE_READ_X))
                 rsize = min_t(unsigned int, CIFSMaxBufSize, rsize);
 
+        /* limit to the amount that we can kmap at once */
+        rsize = min_t(unsigned int, rsize, CIFS_KMAP_SIZE_LIMIT);
+
         /* hard limit of CIFS_MAX_RSIZE */
         rsize = min_t(unsigned int, rsize, CIFS_MAX_RSIZE);
 
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 0a8224d1c4c5..a4217f02fab2 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -86,9 +86,12 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name,
 
         dentry = d_lookup(parent, name);
         if (dentry) {
-                /* FIXME: check for inode number changes? */
-                if (dentry->d_inode != NULL)
+                inode = dentry->d_inode;
+                /* update inode in place if i_ino didn't change */
+                if (inode && CIFS_I(inode)->uniqueid == fattr->cf_uniqueid) {
+                        cifs_fattr_to_inode(inode, fattr);
                         return dentry;
+                }
                 d_drop(dentry);
                 dput(dentry);
         }
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 3097ee58fd7d..f25d4ea14be4 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -365,16 +365,14 @@ cifs_setup_async_request(struct TCP_Server_Info *server, struct kvec *iov,
         if (mid == NULL)
                 return -ENOMEM;
 
-        /* put it on the pending_mid_q */
-        spin_lock(&GlobalMid_Lock);
-        list_add_tail(&mid->qhead, &server->pending_mid_q);
-        spin_unlock(&GlobalMid_Lock);
-
         rc = cifs_sign_smb2(iov, nvec, server, &mid->sequence_number);
-        if (rc)
-                delete_mid(mid);
+        if (rc) {
+                DeleteMidQEntry(mid);
+                return rc;
+        }
+
         *ret_mid = mid;
-        return rc;
+        return 0;
 }
 
 /*
@@ -407,17 +405,21 @@ cifs_call_async(struct TCP_Server_Info *server, struct kvec *iov,
         mid->callback_data = cbdata;
         mid->mid_state = MID_REQUEST_SUBMITTED;
 
+        /* put it on the pending_mid_q */
+        spin_lock(&GlobalMid_Lock);
+        list_add_tail(&mid->qhead, &server->pending_mid_q);
+        spin_unlock(&GlobalMid_Lock);
+
+
         cifs_in_send_inc(server);
         rc = smb_sendv(server, iov, nvec);
         cifs_in_send_dec(server);
         cifs_save_when_sent(mid);
         mutex_unlock(&server->srv_mutex);
 
-        if (rc)
-                goto out_err;
+        if (rc == 0)
+                return 0;
 
-        return rc;
-out_err:
         delete_mid(mid);
         add_credits(server, 1);
         wake_up(&server->request_q);
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 74598f67efeb..1c8b55670804 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1710,7 +1710,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                 goto error_tgt_fput;
 
         /* Check if EPOLLWAKEUP is allowed */
-        if ((epds.events & EPOLLWAKEUP) && !capable(CAP_EPOLLWAKEUP))
+        if ((epds.events & EPOLLWAKEUP) && !capable(CAP_BLOCK_SUSPEND))
                 epds.events &= ~EPOLLWAKEUP;
 
         /*
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index e34deac3f366..6ec6f9ee2fec 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -268,7 +268,6 @@ group_extend_out:
                 err = ext4_move_extents(filp, donor_filp, me.orig_start,
                                         me.donor_start, me.len, &me.moved_len);
                 mnt_drop_write_file(filp);
-                mnt_drop_write(filp->f_path.mnt);
 
                 if (copy_to_user((struct move_extent __user *)arg,
                                  &me, sizeof(me)))
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index a3d81ebf6d86..0038b32cb362 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -738,22 +738,21 @@ static int
 fat_encode_fh(struct inode *inode, __u32 *fh, int *lenp, struct inode *parent)
 {
         int len = *lenp;
-        u32 ipos_h, ipos_m, ipos_l;
+        struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);
+        loff_t i_pos;
 
         if (len < 5) {
                 *lenp = 5;
                 return 255; /* no room */
         }
 
-        ipos_h = MSDOS_I(inode)->i_pos >> 8;
-        ipos_m = (MSDOS_I(inode)->i_pos & 0xf0) << 24;
-        ipos_l = (MSDOS_I(inode)->i_pos & 0x0f) << 28;
+        i_pos = fat_i_pos_read(sbi, inode);
         *lenp = 5;
         fh[0] = inode->i_ino;
         fh[1] = inode->i_generation;
-        fh[2] = ipos_h;
-        fh[3] = ipos_m | MSDOS_I(inode)->i_logstart;
-        fh[4] = ipos_l;
+        fh[2] = i_pos >> 8;
+        fh[3] = ((i_pos & 0xf0) << 24) | MSDOS_I(inode)->i_logstart;
+        fh[4] = (i_pos & 0x0f) << 28;
         if (parent)
                 fh[4] |= MSDOS_I(parent)->i_logstart;
         return 3;
diff --git a/fs/fifo.c b/fs/fifo.c
index b1a524d798e7..cf6f4345ceb0 100644
--- a/fs/fifo.c
+++ b/fs/fifo.c
@@ -14,7 +14,7 @@
 #include <linux/sched.h>
 #include <linux/pipe_fs_i.h>
 
-static void wait_for_partner(struct inode* inode, unsigned int *cnt)
+static int wait_for_partner(struct inode* inode, unsigned int *cnt)
 {
         int cur = *cnt; 
 
@@ -23,6 +23,7 @@ static void wait_for_partner(struct inode* inode, unsigned int *cnt)
                 if (signal_pending(current))
                         break;
         }
+        return cur == *cnt ? -ERESTARTSYS : 0;
 }
 
 static void wake_up_partner(struct inode* inode)
@@ -67,8 +68,7 @@ static int fifo_open(struct inode *inode, struct file *filp)
                                  * seen a writer */
                                 filp->f_version = pipe->w_counter;
                         } else {
-                                wait_for_partner(inode, &pipe->w_counter);
-                                if(signal_pending(current))
+                                if (wait_for_partner(inode, &pipe->w_counter))
                                         goto err_rd;
                         }
                 }
@@ -90,8 +90,7 @@ static int fifo_open(struct inode *inode, struct file *filp)
                         wake_up_partner(inode);
 
                 if (!pipe->readers) {
-                        wait_for_partner(inode, &pipe->r_counter);
-                        if (signal_pending(current))
+                        if (wait_for_partner(inode, &pipe->r_counter))
                                 goto err_wr;
                 }
                 break;
diff --git a/fs/locks.c b/fs/locks.c
index 814c51d0de47..fce6238d52c1 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1465,7 +1465,7 @@ int generic_setlease(struct file *filp, long arg, struct file_lock **flp)
         case F_WRLCK:
                 return generic_add_lease(filp, arg, flp);
         default:
-                BUG();
+                return -EINVAL;
         }
 }
 EXPORT_SYMBOL(generic_setlease);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 9a4cbfc85d81..48253372ab1d 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -484,6 +484,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
 
         list_for_each_entry_safe(req, tmp, &reqs, wb_list) {
                 if (!nfs_pageio_add_request(&desc, req)) {
+                        nfs_list_remove_request(req);
                         nfs_list_add_request(req, &failed);
                         spin_lock(cinfo.lock);
                         dreq->flags = 0;
@@ -494,8 +495,11 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
         }
         nfs_pageio_complete(&desc);
 
-        while (!list_empty(&failed))
+        while (!list_empty(&failed)) {
+                req = nfs_list_entry(failed.next);
+                nfs_list_remove_request(req);
                 nfs_unlock_and_release_request(req);
+        }
 
         if (put_dreq(dreq))
                 nfs_direct_write_complete(dreq, dreq->inode);
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 906f09c7d842..06228192f64e 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2860,6 +2860,8 @@ static struct dentry *nfs4_try_mount(int flags, const char *dev_name,
 
         dfprintk(MOUNT, "--> nfs4_try_mount()\n");
 
+        mount_info->fill_super = nfs4_fill_super;
+
         export_path = data->nfs_server.export_path;
         data->nfs_server.export_path = "/";
         root_mnt = nfs_do_root_mount(&nfs4_remote_fs_type, flags, mount_info,
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 98513c8ed589..7602783d7f41 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1950,7 +1950,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
         if (ret < 0)
                 mlog_errno(ret);
 
-        if (file->f_flags & O_SYNC)
+        if (file && (file->f_flags & O_SYNC))
                 handle->h_sync = 1;
 
         ocfs2_commit_trans(osb, handle);
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index fbb0b478a346..d5378d028589 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -110,6 +110,7 @@ int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
 
                 /* prevent the page from being discarded on memory pressure */
                 SetPageDirty(page);
+                SetPageUptodate(page);
 
                 unlock_page(page);
                 put_page(page);
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 9d1aeb7e2734..4f33c32affe3 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -1074,13 +1074,13 @@ restart:
          * If we couldn't get anything, give up.
          */
         if (bno_cur_lt == NULL && bno_cur_gt == NULL) {
+                xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
+
                 if (!forced++) {
                         trace_xfs_alloc_near_busy(args);
                         xfs_log_force(args->mp, XFS_LOG_SYNC);
                         goto restart;
                 }
-
-                xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
                 trace_xfs_alloc_size_neither(args);
                 args->agbno = NULLAGBLOCK;
                 return 0;
@@ -2434,13 +2434,22 @@ xfs_alloc_vextent_worker(
         current_restore_flags_nested(&pflags, PF_FSTRANS);
 }
 
-
-int                             /* error */
+/*
+ * Data allocation requests often come in with little stack to work on. Push
+ * them off to a worker thread so there is lots of stack to use. Metadata
+ * requests, OTOH, are generally from low stack usage paths, so avoid the
+ * context switch overhead here.
+ */
+int
 xfs_alloc_vextent(
-        xfs_alloc_arg_t *args)  /* allocation argument structure */
+        struct xfs_alloc_arg    *args)
 {
         DECLARE_COMPLETION_ONSTACK(done);
 
+        if (!args->userdata)
+                return __xfs_alloc_vextent(args);
+
+
         args->done = &done;
         INIT_WORK_ONSTACK(&args->work, xfs_alloc_vextent_worker);
         queue_work(xfs_alloc_wq, &args->work);
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index a4beb421018a..269b35c084da 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -989,27 +989,6 @@ xfs_buf_ioerror_alert(
                 (__uint64_t)XFS_BUF_ADDR(bp), func, bp->b_error, bp->b_length);
 }
 
-int
-xfs_bwrite(
-        struct xfs_buf          *bp)
-{
-        int                     error;
-
-        ASSERT(xfs_buf_islocked(bp));
-
-        bp->b_flags |= XBF_WRITE;
-        bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q);
-
-        xfs_bdstrat_cb(bp);
-
-        error = xfs_buf_iowait(bp);
-        if (error) {
-                xfs_force_shutdown(bp->b_target->bt_mount,
-                                   SHUTDOWN_META_IO_ERROR);
-        }
-        return error;
-}
-
 /*
  * Called when we want to stop a buffer from getting written or read.
  * We attach the EIO error, muck with its flags, and call xfs_buf_ioend
@@ -1079,14 +1058,7 @@ xfs_bioerror_relse(
         return EIO;
 }
 
-
-/*
- * All xfs metadata buffers except log state machine buffers
- * get this attached as their b_bdstrat callback function.
- * This is so that we can catch a buffer
- * after prematurely unpinning it to forcibly shutdown the filesystem.
- */
-int
+STATIC int
 xfs_bdstrat_cb(
         struct xfs_buf  *bp)
 {
@@ -1107,6 +1079,27 @@ xfs_bdstrat_cb(
         return 0;
 }
 
+int
+xfs_bwrite(
+        struct xfs_buf          *bp)
+{
+        int                     error;
+
+        ASSERT(xfs_buf_islocked(bp));
+
+        bp->b_flags |= XBF_WRITE;
+        bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q);
+
+        xfs_bdstrat_cb(bp);
+
+        error = xfs_buf_iowait(bp);
+        if (error) {
+                xfs_force_shutdown(bp->b_target->bt_mount,
+                                   SHUTDOWN_META_IO_ERROR);
+        }
+        return error;
+}
+
 /*
  * Wrapper around bdstrat so that we can stop data from going to disk in case
  * we are shutting down the filesystem.  Typically user data goes thru this
@@ -1243,7 +1236,7 @@ xfs_buf_iorequest(
          */
         atomic_set(&bp->b_io_remaining, 1);
         _xfs_buf_ioapply(bp);
-        _xfs_buf_ioend(bp, 0);
+        _xfs_buf_ioend(bp, 1);
 
         xfs_buf_rele(bp);
 }
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index 7f1d1392ce37..79344c48008e 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -180,7 +180,6 @@ extern void xfs_buf_unlock(xfs_buf_t *);
 extern int xfs_bwrite(struct xfs_buf *bp);
 
 extern void xfsbdstrat(struct xfs_mount *, struct xfs_buf *);
-extern int xfs_bdstrat_cb(struct xfs_buf *);
 
 extern void xfs_buf_ioend(xfs_buf_t *,  int);
 extern void xfs_buf_ioerror(xfs_buf_t *, int);
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 45df2b857d48..d9e451115f98 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -954,7 +954,7 @@ xfs_buf_iodone_callbacks(
 
                 if (!XFS_BUF_ISSTALE(bp)) {
                         bp->b_flags |= XBF_WRITE | XBF_ASYNC | XBF_DONE;
-                        xfs_bdstrat_cb(bp);
+                        xfs_buf_iorequest(bp);
                 } else {
                         xfs_buf_relse(bp);
                 }