29 files changed, 272 insertions, 130 deletions
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index d7bd395ab586..1c55388ae633 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -210,7 +210,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
        int pipefd;
        struct autofs_sb_info *sbi;
        struct autofs_info *ino;
-        int pgrp;
+        int pgrp = 0;
        bool pgrp_set = false;
        int ret = -EINVAL;
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 92371c414228..1daea0b47187 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -821,7 +821,7 @@ static void free_workspace(int type, struct list_head *workspace)
        spin_lock(workspace_lock);
        if (*num_workspace < num_online_cpus()) {
-                list_add_tail(workspace, idle_workspace);
+                list_add(workspace, idle_workspace);
                (*num_workspace)++;
                spin_unlock(workspace_lock);
                goto wake;
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 2af6e66fe788..eea26e1b2fda 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -36,6 +36,7 @@
 #include "check-integrity.h"
 #include "rcu-string.h"
 #include "dev-replace.h"
+#include "sysfs.h"
 static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
                                       int scrub_ret);
@@ -562,6 +563,10 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
                fs_info->fs_devices->latest_bdev = tgt_device->bdev;
        list_add(&tgt_device->dev_alloc_list, &fs_info->fs_devices->alloc_list);
+        /* replace the sysfs entry */
+        btrfs_kobj_rm_device(fs_info, src_device);
+        btrfs_kobj_add_device(fs_info, tgt_device);
        btrfs_rm_dev_replace_blocked(fs_info);
        btrfs_rm_dev_replace_srcdev(fs_info, src_device);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8bb4aa19898f..08e65e9cf2aa 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -369,7 +369,8 @@ static int verify_parent_transid(struct extent_io_tree *io_tree,
 out:
        unlock_extent_cached(io_tree, eb->start, eb->start + eb->len - 1,
                             &cached_state, GFP_NOFS);
-        btrfs_tree_read_unlock_blocking(eb);
+        if (need_lock)
+                btrfs_tree_read_unlock_blocking(eb);
        return ret;
 }
@@ -2904,7 +2905,9 @@ retry_root_backup:
                if (ret)
                        goto fail_qgroup;
+                mutex_lock(&fs_info->cleaner_mutex);
                ret = btrfs_recover_relocation(tree_root);
+                mutex_unlock(&fs_info->cleaner_mutex);
                if (ret < 0) {
                        printk(KERN_WARNING
                               "BTRFS: failed to recover relocation\n");
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 99c253918208..813537f362f9 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -5678,7 +5678,6 @@ void btrfs_prepare_extent_commit(struct btrfs_trans_handle *trans,
        struct btrfs_caching_control *next;
        struct btrfs_caching_control *caching_ctl;
        struct btrfs_block_group_cache *cache;
-        struct btrfs_space_info *space_info;
        down_write(&fs_info->commit_root_sem);
@@ -5701,9 +5700,6 @@ void btrfs_prepare_extent_commit(struct btrfs_trans_handle *trans,
        up_write(&fs_info->commit_root_sem);
-        list_for_each_entry_rcu(space_info, &fs_info->space_info, list)
-                percpu_counter_set(&space_info->total_bytes_pinned, 0);
        update_global_block_rsv(fs_info);
 }
@@ -5741,6 +5737,7 @@ static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
                spin_lock(&cache->lock);
                cache->pinned -= len;
                space_info->bytes_pinned -= len;
+                percpu_counter_add(&space_info->total_bytes_pinned, -len);
                if (cache->ro) {
                        space_info->bytes_readonly += len;
                        readonly = true;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 0d321c23069a..47aceb494d1d 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -136,19 +136,22 @@ static unsigned int btrfs_flags_to_ioctl(unsigned int flags)
 void btrfs_update_iflags(struct inode *inode)
 {
        struct btrfs_inode *ip = BTRFS_I(inode);
+        unsigned int new_fl = 0;
-        inode->i_flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC);
        if (ip->flags & BTRFS_INODE_SYNC)
-                inode->i_flags |= S_SYNC;
+                new_fl |= S_SYNC;
        if (ip->flags & BTRFS_INODE_IMMUTABLE)
-                inode->i_flags |= S_IMMUTABLE;
+                new_fl |= S_IMMUTABLE;
        if (ip->flags & BTRFS_INODE_APPEND)
-                inode->i_flags |= S_APPEND;
+                new_fl |= S_APPEND;
        if (ip->flags & BTRFS_INODE_NOATIME)
-                inode->i_flags |= S_NOATIME;
+                new_fl |= S_NOATIME;
        if (ip->flags & BTRFS_INODE_DIRSYNC)
-                inode->i_flags |= S_DIRSYNC;
+                new_fl |= S_DIRSYNC;
+        set_mask_bits(&inode->i_flags,
+                      S_SYNC | S_APPEND | S_IMMUTABLE | S_NOATIME | S_DIRSYNC,
+                      new_fl);
 }
 /*
@@ -3139,7 +3142,6 @@ out:
 static void clone_update_extent_map(struct inode *inode,
                                    const struct btrfs_trans_handle *trans,
                                    const struct btrfs_path *path,
-                                    struct btrfs_file_extent_item *fi,
                                    const u64 hole_offset,
                                    const u64 hole_len)
 {
@@ -3154,7 +3156,11 @@ static void clone_update_extent_map(struct inode *inode,
                return;
        }
-        if (fi) {
+        if (path) {
+                struct btrfs_file_extent_item *fi;
+                fi = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                    struct btrfs_file_extent_item);
                btrfs_extent_item_to_extent_map(inode, path, fi, false, em);
                em->generation = -1;
                if (btrfs_file_extent_type(path->nodes[0], fi) ==
@@ -3508,18 +3514,15 @@ process_slot:
                                            btrfs_item_ptr_offset(leaf, slot),
                                            size);
                                inode_add_bytes(inode, datal);
-                                extent = btrfs_item_ptr(leaf, slot,
-                                                struct btrfs_file_extent_item);
                        }
                        /* If we have an implicit hole (NO_HOLES feature). */
                        if (drop_start < new_key.offset)
                                clone_update_extent_map(inode, trans,
-                                                path, NULL, drop_start,
+                                                NULL, drop_start,
                                                new_key.offset - drop_start);
-                        clone_update_extent_map(inode, trans, path,
+                        clone_update_extent_map(inode, trans, path, 0, 0);
-                                                extent, 0, 0);
                        btrfs_mark_buffer_dirty(leaf);
                        btrfs_release_path(path);
@@ -3562,12 +3565,10 @@ process_slot:
                        btrfs_end_transaction(trans, root);
                        goto out;
                }
+                clone_update_extent_map(inode, trans, NULL, last_dest_end,
+                                        destoff + len - last_dest_end);
                ret = clone_finish_inode_update(trans, inode, destoff + len,
                                                destoff, olen);
-                if (ret)
-                        goto out;
-                clone_update_extent_map(inode, trans, path, NULL, last_dest_end,
-                                        destoff + len - last_dest_end);
        }
 out:
diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
index 6efd70d3b64f..9626b4ad3b9a 100644
--- a/fs/btrfs/print-tree.c
+++ b/fs/btrfs/print-tree.c
@@ -54,7 +54,7 @@ static void print_extent_data_ref(struct extent_buffer *eb,
               btrfs_extent_data_ref_count(eb, ref));
 }
-static void print_extent_item(struct extent_buffer *eb, int slot)
+static void print_extent_item(struct extent_buffer *eb, int slot, int type)
 {
        struct btrfs_extent_item *ei;
        struct btrfs_extent_inline_ref *iref;
@@ -63,7 +63,6 @@ static void print_extent_item(struct extent_buffer *eb, int slot)
        struct btrfs_disk_key key;
        unsigned long end;
        unsigned long ptr;
-        int type;
        u32 item_size = btrfs_item_size_nr(eb, slot);
        u64 flags;
        u64 offset;
@@ -88,7 +87,8 @@ static void print_extent_item(struct extent_buffer *eb, int slot)
               btrfs_extent_refs(eb, ei), btrfs_extent_generation(eb, ei),
               flags);
-        if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) {
+        if ((type == BTRFS_EXTENT_ITEM_KEY) &&
+            flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) {
                struct btrfs_tree_block_info *info;
                info = (struct btrfs_tree_block_info *)(ei + 1);
                btrfs_tree_block_key(eb, info, &key);
@@ -223,7 +223,8 @@ void btrfs_print_leaf(struct btrfs_root *root, struct extent_buffer *l)
                                btrfs_disk_root_refs(l, ri));
                        break;
                case BTRFS_EXTENT_ITEM_KEY:
-                        print_extent_item(l, i);
+                case BTRFS_METADATA_ITEM_KEY:
+                        print_extent_item(l, i, type);
                        break;
                case BTRFS_TREE_BLOCK_REF_KEY:
                        printk(KERN_INFO "\t\ttree block backref\n");
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index 4055291a523e..4a88f073fdd7 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -1956,9 +1956,10 @@ static int __raid56_parity_recover(struct btrfs_raid_bio *rbio)
         * pages are going to be uptodate.
         */
        for (stripe = 0; stripe < bbio->num_stripes; stripe++) {
-                if (rbio->faila == stripe ||
+                if (rbio->faila == stripe || rbio->failb == stripe) {
-                    rbio->failb == stripe)
+                        atomic_inc(&rbio->bbio->error);
                        continue;
+                }
                for (pagenr = 0; pagenr < nr_pages; pagenr++) {
                        struct page *p;
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 4662d92a4b73..8e16bca69c56 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -522,9 +522,10 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                case Opt_ssd_spread:
                        btrfs_set_and_info(root, SSD_SPREAD,
                                           "use spread ssd allocation scheme");
+                        btrfs_set_opt(info->mount_opt, SSD);
                        break;
                case Opt_nossd:
-                        btrfs_clear_and_info(root, NOSSD,
+                        btrfs_set_and_info(root, NOSSD,
                                             "not using ssd allocation scheme");
                        btrfs_clear_opt(info->mount_opt, SSD);
                        break;
@@ -1467,7 +1468,9 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
                        goto restore;
                /* recover relocation */
+                mutex_lock(&fs_info->cleaner_mutex);
                ret = btrfs_recover_relocation(root);
+                mutex_unlock(&fs_info->cleaner_mutex);
                if (ret)
                        goto restore;
@@ -1808,6 +1811,8 @@ static int btrfs_show_devname(struct seq_file *m, struct dentry *root)
                list_for_each_entry(dev, head, dev_list) {
                        if (dev->missing)
                                continue;
+                        if (!dev->name)
+                                continue;
                        if (!first_dev || dev->devid < first_dev->devid)
                                first_dev = dev;
                }
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index df39458f1487..78699364f537 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -605,14 +605,37 @@ static void init_feature_attrs(void)
        }
 }
-static int add_device_membership(struct btrfs_fs_info *fs_info)
+int btrfs_kobj_rm_device(struct btrfs_fs_info *fs_info,
+                struct btrfs_device *one_device)
+{
+        struct hd_struct *disk;
+        struct kobject *disk_kobj;
+        if (!fs_info->device_dir_kobj)
+                return -EINVAL;
+        if (one_device) {
+                disk = one_device->bdev->bd_part;
+                disk_kobj = &part_to_dev(disk)->kobj;
+                sysfs_remove_link(fs_info->device_dir_kobj,
+                                                disk_kobj->name);
+        }
+        return 0;
+}
+int btrfs_kobj_add_device(struct btrfs_fs_info *fs_info,
+                struct btrfs_device *one_device)
 {
        int error = 0;
        struct btrfs_fs_devices *fs_devices = fs_info->fs_devices;
        struct btrfs_device *dev;
-        fs_info->device_dir_kobj = kobject_create_and_add("devices",
+        if (!fs_info->device_dir_kobj)
+                fs_info->device_dir_kobj = kobject_create_and_add("devices",
                                                &fs_info->super_kobj);
        if (!fs_info->device_dir_kobj)
                return -ENOMEM;
@@ -623,6 +646,9 @@ static int add_device_membership(struct btrfs_fs_info *fs_info)
                if (!dev->bdev)
                        continue;
+                if (one_device && one_device != dev)
+                        continue;
                disk = dev->bdev->bd_part;
                disk_kobj = &part_to_dev(disk)->kobj;
@@ -666,7 +692,7 @@ int btrfs_sysfs_add_one(struct btrfs_fs_info *fs_info)
        if (error)
                goto failure;
-        error = add_device_membership(fs_info);
+        error = btrfs_kobj_add_device(fs_info, NULL);
        if (error)
                goto failure;
diff --git a/fs/btrfs/sysfs.h b/fs/btrfs/sysfs.h
index 9ab576318a84..ac46df37504c 100644
--- a/fs/btrfs/sysfs.h
+++ b/fs/btrfs/sysfs.h
@@ -66,4 +66,8 @@ char *btrfs_printable_features(enum btrfs_feature_set set, u64 flags);
 extern const char * const btrfs_feature_set_names[3];
 extern struct kobj_type space_info_ktype;
 extern struct kobj_type btrfs_raid_ktype;
+int btrfs_kobj_add_device(struct btrfs_fs_info *fs_info,
+                struct btrfs_device *one_device);
+int btrfs_kobj_rm_device(struct btrfs_fs_info *fs_info,
+                struct btrfs_device *one_device);
 #endif /* _BTRFS_SYSFS_H_ */
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 511839c04f11..5f379affdf23 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -386,11 +386,13 @@ start_transaction(struct btrfs_root *root, u64 num_items, unsigned int type,
        bool reloc_reserved = false;
        int ret;
+        /* Send isn't supposed to start transactions. */
+        ASSERT(current->journal_info != (void *)BTRFS_SEND_TRANS_STUB);
        if (test_bit(BTRFS_FS_STATE_ERROR, &root->fs_info->fs_state))
                return ERR_PTR(-EROFS);
-        if (current->journal_info &&
+        if (current->journal_info) {
-            current->journal_info != (void *)BTRFS_SEND_TRANS_STUB) {
                WARN_ON(type & TRANS_EXTWRITERS);
                h = current->journal_info;
                h->use_count++;
@@ -491,6 +493,7 @@ again:
        smp_mb();
        if (cur_trans->state >= TRANS_STATE_BLOCKED &&
            may_wait_transaction(root, type)) {
+                current->journal_info = h;
                btrfs_commit_transaction(h, root);
                goto again;
        }
@@ -1615,11 +1618,6 @@ static int btrfs_flush_all_pending_stuffs(struct btrfs_trans_handle *trans,
        int ret;
        ret = btrfs_run_delayed_items(trans, root);
-        /*
-         * running the delayed items may have added new refs. account
-         * them now so that they hinder processing of more delayed refs
-         * as little as possible.
-         */
        if (ret)
                return ret;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index c83b24251e53..6104676857f5 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -40,6 +40,7 @@
 #include "rcu-string.h"
 #include "math.h"
 #include "dev-replace.h"
+#include "sysfs.h"
 static int init_first_rw_device(struct btrfs_trans_handle *trans,
                                struct btrfs_root *root,
@@ -554,12 +555,14 @@ static struct btrfs_fs_devices *clone_fs_devices(struct btrfs_fs_devices *orig)
                 * This is ok to do without rcu read locked because we hold the
                 * uuid mutex so nothing we touch in here is going to disappear.
                 */
-                name = rcu_string_strdup(orig_dev->name->str, GFP_NOFS);
+                if (orig_dev->name) {
-                if (!name) {
+                        name = rcu_string_strdup(orig_dev->name->str, GFP_NOFS);
-                        kfree(device);
+                        if (!name) {
-                        goto error;
+                                kfree(device);
+                                goto error;
+                        }
+                        rcu_assign_pointer(device->name, name);
                }
-                rcu_assign_pointer(device->name, name);
                list_add(&device->dev_list, &fs_devices->devices);
                device->fs_devices = fs_devices;
@@ -1680,6 +1683,9 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
        if (device->bdev)
                device->fs_devices->open_devices--;
+        /* remove sysfs entry */
+        btrfs_kobj_rm_device(root->fs_info, device);
        call_rcu(&device->rcu, free_device);
        num_devices = btrfs_super_num_devices(root->fs_info->super_copy) - 1;
@@ -2143,9 +2149,14 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
        total_bytes = btrfs_super_num_devices(root->fs_info->super_copy);
        btrfs_set_super_num_devices(root->fs_info->super_copy,
                                    total_bytes + 1);
+        /* add sysfs device entry */
+        btrfs_kobj_add_device(root->fs_info, device);
        mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
        if (seeding_dev) {
+                char fsid_buf[BTRFS_UUID_UNPARSED_SIZE];
                ret = init_first_rw_device(trans, root, device);
                if (ret) {
                        btrfs_abort_transaction(trans, root, ret);
@@ -2156,6 +2167,14 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
                        btrfs_abort_transaction(trans, root, ret);
                        goto error_trans;
                }
+                /* Sprouting would change fsid of the mounted root,
+                 * so rename the fsid on the sysfs
+                 */
+                snprintf(fsid_buf, BTRFS_UUID_UNPARSED_SIZE, "%pU",
+                                                root->fs_info->fsid);
+                if (kobject_rename(&root->fs_info->super_kobj, fsid_buf))
+                        goto error_trans;
        } else {
                ret = btrfs_add_device(trans, root, device);
                if (ret) {
@@ -2205,6 +2224,7 @@ error_trans:
        unlock_chunks(root);
        btrfs_end_transaction(trans, root);
        rcu_string_free(device->name);
+        btrfs_kobj_rm_device(root->fs_info, device);
        kfree(device);
 error:
        blkdev_put(bdev, FMODE_EXCL);
diff --git a/fs/btrfs/zlib.c b/fs/btrfs/zlib.c
index 4f196314c0c1..b67d8fc81277 100644
--- a/fs/btrfs/zlib.c
+++ b/fs/btrfs/zlib.c
@@ -136,7 +136,7 @@ static int zlib_compress_pages(struct list_head *ws,
                if (workspace->def_strm.total_in > 8192 &&
                    workspace->def_strm.total_in <
                    workspace->def_strm.total_out) {
-                        ret = -EIO;
+                        ret = -E2BIG;
                        goto out;
                }
                /* we need another page for writing out.  Test this
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 0924521306b4..f8cf619edb5f 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -608,8 +608,8 @@ static int __allocate_data_block(struct dnode_of_data *dn)
 *     b. do not use extent cache for better performance
 *     c. give the block addresses to blockdev
 */
-static int get_data_block(struct inode *inode, sector_t iblock,
+static int __get_data_block(struct inode *inode, sector_t iblock,
-                        struct buffer_head *bh_result, int create)
+                        struct buffer_head *bh_result, int create, bool fiemap)
 {
        struct f2fs_sb_info *sbi = F2FS_SB(inode->i_sb);
        unsigned int blkbits = inode->i_sb->s_blocksize_bits;
@@ -637,7 +637,7 @@ static int get_data_block(struct inode *inode, sector_t iblock,
                        err = 0;
                goto unlock_out;
        }
-        if (dn.data_blkaddr == NEW_ADDR)
+        if (dn.data_blkaddr == NEW_ADDR && !fiemap)
                goto put_out;
        if (dn.data_blkaddr != NULL_ADDR) {
@@ -671,7 +671,7 @@ get_next:
                                err = 0;
                        goto unlock_out;
                }
-                if (dn.data_blkaddr == NEW_ADDR)
+                if (dn.data_blkaddr == NEW_ADDR && !fiemap)
                        goto put_out;
                end_offset = ADDRS_PER_PAGE(dn.node_page, F2FS_I(inode));
@@ -708,10 +708,23 @@ out:
        return err;
 }
+static int get_data_block(struct inode *inode, sector_t iblock,
+                        struct buffer_head *bh_result, int create)
+{
+        return __get_data_block(inode, iblock, bh_result, create, false);
+}
+static int get_data_block_fiemap(struct inode *inode, sector_t iblock,
+                        struct buffer_head *bh_result, int create)
+{
+        return __get_data_block(inode, iblock, bh_result, create, true);
+}
 int f2fs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                u64 start, u64 len)
 {
-        return generic_block_fiemap(inode, fieinfo, start, len, get_data_block);
+        return generic_block_fiemap(inode, fieinfo,
+                                start, len, get_data_block_fiemap);
 }
 static int f2fs_read_data_page(struct file *file, struct page *page)
diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 966acb039e3b..a4addd72ebbd 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -376,11 +376,11 @@ static struct page *init_inode_metadata(struct inode *inode,
 put_error:
        f2fs_put_page(page, 1);
+error:
        /* once the failed inode becomes a bad inode, i_mode is S_IFREG */
        truncate_inode_pages(&inode->i_data, 0);
        truncate_blocks(inode, 0);
        remove_dirty_dir_inode(inode);
-error:
        remove_inode_page(inode);
        return ERR_PTR(err);
 }
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index e51c732b0dd9..58df97e174d0 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -342,9 +342,6 @@ struct f2fs_sm_info {
        struct dirty_seglist_info *dirty_info;  /* dirty segment information */
        struct curseg_info *curseg_array;       /* active segment information */
-        struct list_head wblist_head;   /* list of under-writeback pages */
-        spinlock_t wblist_lock;         /* lock for checkpoint */
        block_t seg0_blkaddr;           /* block address of 0'th segment */
        block_t main_blkaddr;           /* start block address of main area */
        block_t ssa_blkaddr;            /* start block address of SSA area */
@@ -644,7 +641,8 @@ static inline void f2fs_unlock_all(struct f2fs_sb_info *sbi)
 */
 static inline int check_nid_range(struct f2fs_sb_info *sbi, nid_t nid)
 {
-        WARN_ON((nid >= NM_I(sbi)->max_nid));
+        if (unlikely(nid < F2FS_ROOT_INO(sbi)))
+                return -EINVAL;
        if (unlikely(nid >= NM_I(sbi)->max_nid))
                return -EINVAL;
        return 0;
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index c58e33075719..7d8b96275092 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -659,16 +659,19 @@ static int expand_inode_data(struct inode *inode, loff_t offset,
        off_start = offset & (PAGE_CACHE_SIZE - 1);
        off_end = (offset + len) & (PAGE_CACHE_SIZE - 1);
+        f2fs_lock_op(sbi);
        for (index = pg_start; index <= pg_end; index++) {
                struct dnode_of_data dn;
-                f2fs_lock_op(sbi);
+                if (index == pg_end && !off_end)
+                        goto noalloc;
                set_new_dnode(&dn, inode, NULL, NULL, 0);
                ret = f2fs_reserve_block(&dn, index);
-                f2fs_unlock_op(sbi);
                if (ret)
                        break;
+noalloc:
                if (pg_start == pg_end)
                        new_size = offset + len;
                else if (index == pg_start && off_start)
@@ -683,8 +686,9 @@ static int expand_inode_data(struct inode *inode, loff_t offset,
                i_size_read(inode) < new_size) {
                i_size_write(inode, new_size);
                mark_inode_dirty(inode);
-                f2fs_write_inode(inode, NULL);
+                update_inode_page(inode);
        }
+        f2fs_unlock_op(sbi);
        return ret;
 }
diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index adc622c6bdce..2cf6962f6cc8 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -78,6 +78,7 @@ static int do_read_inode(struct inode *inode)
        if (check_nid_range(sbi, inode->i_ino)) {
                f2fs_msg(inode->i_sb, KERN_ERR, "bad inode number: %lu",
                         (unsigned long) inode->i_ino);
+                WARN_ON(1);
                return -EINVAL;
        }
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index 9138c32aa698..a6bdddc33ce2 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -417,9 +417,6 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
                }
                f2fs_set_link(new_dir, new_entry, new_page, old_inode);
-                down_write(&F2FS_I(old_inode)->i_sem);
-                F2FS_I(old_inode)->i_pino = new_dir->i_ino;
-                up_write(&F2FS_I(old_inode)->i_sem);
                new_inode->i_ctime = CURRENT_TIME;
                down_write(&F2FS_I(new_inode)->i_sem);
@@ -448,6 +445,10 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
                }
        }
+        down_write(&F2FS_I(old_inode)->i_sem);
+        file_lost_pino(old_inode);
+        up_write(&F2FS_I(old_inode)->i_sem);
        old_inode->i_ctime = CURRENT_TIME;
        mark_inode_dirty(old_inode);
@@ -457,9 +458,6 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
                if (old_dir != new_dir) {
                        f2fs_set_link(old_inode, old_dir_entry,
                                                old_dir_page, new_dir);
-                        down_write(&F2FS_I(old_inode)->i_sem);
-                        F2FS_I(old_inode)->i_pino = new_dir->i_ino;
-                        up_write(&F2FS_I(old_inode)->i_sem);
                        update_inode_page(old_inode);
                } else {
                        kunmap(old_dir_page);
@@ -474,7 +472,8 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
        return 0;
 put_out_dir:
-        f2fs_put_page(new_page, 1);
+        kunmap(new_page);
+        f2fs_put_page(new_page, 0);
 out_dir:
        if (old_dir_entry) {
                kunmap(old_dir_page);
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 9dfb9a042fd2..4b697ccc9b0c 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -42,6 +42,8 @@ bool available_free_memory(struct f2fs_sb_info *sbi, int type)
                mem_size = (nm_i->nat_cnt * sizeof(struct nat_entry)) >> 12;
                res = mem_size < ((val.totalram * nm_i->ram_thresh / 100) >> 2);
        } else if (type == DIRTY_DENTS) {
+                if (sbi->sb->s_bdi->dirty_exceeded)
+                        return false;
                mem_size = get_pages(sbi, F2FS_DIRTY_DENTS);
                res = mem_size < ((val.totalram * nm_i->ram_thresh / 100) >> 1);
        }
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index f25f0e07e26f..d04613df710a 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -272,14 +272,15 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
                return -ENOMEM;
        spin_lock_init(&fcc->issue_lock);
        init_waitqueue_head(&fcc->flush_wait_queue);
+        sbi->sm_info->cmd_control_info = fcc;
        fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,
                                "f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
        if (IS_ERR(fcc->f2fs_issue_flush)) {
                err = PTR_ERR(fcc->f2fs_issue_flush);
                kfree(fcc);
+                sbi->sm_info->cmd_control_info = NULL;
                return err;
        }
-        sbi->sm_info->cmd_control_info = fcc;
        return err;
 }
@@ -1885,8 +1886,6 @@ int build_segment_manager(struct f2fs_sb_info *sbi)
        /* init sm info */
        sbi->sm_info = sm_info;
-        INIT_LIST_HEAD(&sm_info->wblist_head);
-        spin_lock_init(&sm_info->wblist_lock);
        sm_info->seg0_blkaddr = le32_to_cpu(raw_super->segment0_blkaddr);
        sm_info->main_blkaddr = le32_to_cpu(raw_super->main_blkaddr);
        sm_info->segment_count = le32_to_cpu(raw_super->segment_count);
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index b2b18637cb9e..8f96d9372ade 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -689,9 +689,7 @@ static struct inode *f2fs_nfs_get_inode(struct super_block *sb,
        struct f2fs_sb_info *sbi = F2FS_SB(sb);
        struct inode *inode;
-        if (unlikely(ino < F2FS_ROOT_INO(sbi)))
+        if (check_nid_range(sbi, ino))
-                return ERR_PTR(-ESTALE);
-        if (unlikely(ino >= NM_I(sbi)->max_nid))
                return ERR_PTR(-ESTALE);
        /*
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index e3d37f607f97..d895b4b7b661 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -39,6 +39,19 @@ struct kernfs_open_node {
        struct list_head        files; /* goes through kernfs_open_file.list */
 };
+/*
+ * kernfs_notify() may be called from any context and bounces notifications
+ * through a work item.  To minimize space overhead in kernfs_node, the
+ * pending queue is implemented as a singly linked list of kernfs_nodes.
+ * The list is terminated with the self pointer so that whether a
+ * kernfs_node is on the list or not can be determined by testing the next
+ * pointer for NULL.
+ */
+#define KERNFS_NOTIFY_EOL                       ((void *)&kernfs_notify_list)
+static DEFINE_SPINLOCK(kernfs_notify_lock);
+static struct kernfs_node *kernfs_notify_list = KERNFS_NOTIFY_EOL;
 static struct kernfs_open_file *kernfs_of(struct file *file)
 {
        return ((struct seq_file *)file->private_data)->private;
@@ -783,24 +796,25 @@ static unsigned int kernfs_fop_poll(struct file *filp, poll_table *wait)
        return DEFAULT_POLLMASK|POLLERR|POLLPRI;
 }
-/**
+static void kernfs_notify_workfn(struct work_struct *work)
- * kernfs_notify - notify a kernfs file
- * @kn: file to notify
- *
- * Notify @kn such that poll(2) on @kn wakes up.
- */
-void kernfs_notify(struct kernfs_node *kn)
 {
-        struct kernfs_root *root = kernfs_root(kn);
+        struct kernfs_node *kn;
        struct kernfs_open_node *on;
        struct kernfs_super_info *info;
-        unsigned long flags;
+repeat:
+        /* pop one off the notify_list */
-        if (WARN_ON(kernfs_type(kn) != KERNFS_FILE))
+        spin_lock_irq(&kernfs_notify_lock);
+        kn = kernfs_notify_list;
+        if (kn == KERNFS_NOTIFY_EOL) {
+                spin_unlock_irq(&kernfs_notify_lock);
                return;
+        }
+        kernfs_notify_list = kn->attr.notify_next;
+        kn->attr.notify_next = NULL;
+        spin_unlock_irq(&kernfs_notify_lock);
        /* kick poll */
-        spin_lock_irqsave(&kernfs_open_node_lock, flags);
+        spin_lock_irq(&kernfs_open_node_lock);
        on = kn->attr.open;
        if (on) {
@@ -808,12 +822,12 @@ void kernfs_notify(struct kernfs_node *kn)
                wake_up_interruptible(&on->poll);
        }
-        spin_unlock_irqrestore(&kernfs_open_node_lock, flags);
+        spin_unlock_irq(&kernfs_open_node_lock);
        /* kick fsnotify */
        mutex_lock(&kernfs_mutex);
-        list_for_each_entry(info, &root->supers, node) {
+        list_for_each_entry(info, &kernfs_root(kn)->supers, node) {
                struct inode *inode;
                struct dentry *dentry;
@@ -833,6 +847,33 @@ void kernfs_notify(struct kernfs_node *kn)
        }
        mutex_unlock(&kernfs_mutex);
+        kernfs_put(kn);
+        goto repeat;
+}
+/**
+ * kernfs_notify - notify a kernfs file
+ * @kn: file to notify
+ *
+ * Notify @kn such that poll(2) on @kn wakes up.  Maybe be called from any
+ * context.
+ */
+void kernfs_notify(struct kernfs_node *kn)
+{
+        static DECLARE_WORK(kernfs_notify_work, kernfs_notify_workfn);
+        unsigned long flags;
+        if (WARN_ON(kernfs_type(kn) != KERNFS_FILE))
+                return;
+        spin_lock_irqsave(&kernfs_notify_lock, flags);
+        if (!kn->attr.notify_next) {
+                kernfs_get(kn);
+                kn->attr.notify_next = kernfs_notify_list;
+                kernfs_notify_list = kn;
+                schedule_work(&kernfs_notify_work);
+        }
+        spin_unlock_irqrestore(&kernfs_notify_lock, flags);
 }
 EXPORT_SYMBOL_GPL(kernfs_notify);
diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c
index d171b98a6cdd..f973ae9b05f1 100644
--- a/fs/kernfs/mount.c
+++ b/fs/kernfs/mount.c
@@ -211,6 +211,36 @@ void kernfs_kill_sb(struct super_block *sb)
        kernfs_put(root_kn);
 }
+/**
+ * kernfs_pin_sb: try to pin the superblock associated with a kernfs_root
+ * @kernfs_root: the kernfs_root in question
+ * @ns: the namespace tag
+ *
+ * Pin the superblock so the superblock won't be destroyed in subsequent
+ * operations.  This can be used to block ->kill_sb() which may be useful
+ * for kernfs users which dynamically manage superblocks.
+ *
+ * Returns NULL if there's no superblock associated to this kernfs_root, or
+ * -EINVAL if the superblock is being freed.
+ */
+struct super_block *kernfs_pin_sb(struct kernfs_root *root, const void *ns)
+{
+        struct kernfs_super_info *info;
+        struct super_block *sb = NULL;
+        mutex_lock(&kernfs_mutex);
+        list_for_each_entry(info, &root->supers, node) {
+                if (info->ns == ns) {
+                        sb = info->sb;
+                        if (!atomic_inc_not_zero(&info->sb->s_active))
+                                sb = ERR_PTR(-EINVAL);
+                        break;
+                }
+        }
+        mutex_unlock(&kernfs_mutex);
+        return sb;
+}
 void __init kernfs_init(void)
 {
        kernfs_node_cache = kmem_cache_create("kernfs_node_cache",
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 6851b003f2a4..8f029db5d271 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -617,15 +617,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
        switch (create->cr_type) {
        case NF4LNK:
-                /* ugh! we have to null-terminate the linktext, or
-                 * vfs_symlink() will choke.  it is always safe to
-                 * null-terminate by brute force, since at worst we
-                 * will overwrite the first byte of the create namelen
-                 * in the XDR buffer, which has already been extracted
-                 * during XDR decode.
-                 */
-                create->cr_linkname[create->cr_linklen] = 0;
                status = nfsd_symlink(rqstp, &cstate->current_fh,
                                      create->cr_name, create->cr_namelen,
                                      create->cr_linkname, create->cr_linklen,
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 83baf2bfe9e9..b56b1cc02718 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -600,7 +600,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create
                READ_BUF(4);
                create->cr_linklen = be32_to_cpup(p++);
                READ_BUF(create->cr_linklen);
-                SAVEMEM(create->cr_linkname, create->cr_linklen);
+                /*
+                 * The VFS will want a null-terminated string, and
+                 * null-terminating in place isn't safe since this might
+                 * end on a page boundary:
+                 */
+                create->cr_linkname =
+                                kmalloc(create->cr_linklen + 1, GFP_KERNEL);
+                if (!create->cr_linkname)
+                        return nfserr_jukebox;
+                memcpy(create->cr_linkname, p, create->cr_linklen);
+                create->cr_linkname[create->cr_linklen] = '\0';
+                defer_free(argp, kfree, create->cr_linkname);
                break;
        case NF4BLK:
        case NF4CHR:
@@ -2630,7 +2641,7 @@ nfsd4_encode_rdattr_error(struct xdr_stream *xdr, __be32 nfserr)
 {
        __be32 *p;
-        p = xdr_reserve_space(xdr, 6);
+        p = xdr_reserve_space(xdr, 20);
        if (!p)
                return NULL;
        *p++ = htonl(2);
@@ -3267,7 +3278,7 @@ nfsd4_encode_readlink(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd
        wire_count = htonl(maxcount);
        write_bytes_to_xdr_buf(xdr->buf, length_offset, &wire_count, 4);
-        xdr_truncate_encode(xdr, length_offset + 4 + maxcount);
+        xdr_truncate_encode(xdr, length_offset + 4 + ALIGN(maxcount, 4));
        if (maxcount & 3)
                write_bytes_to_xdr_buf(xdr->buf, length_offset + 4 + maxcount,
                                                &zero, 4 - (maxcount&3));
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index 9d231e9e5f0e..bf2d03f8fd3e 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -184,29 +184,11 @@ static int show_stat(struct seq_file *p, void *v)
 static int stat_open(struct inode *inode, struct file *file)
 {
-        size_t size = 1024 + 128 * num_possible_cpus();
+        size_t size = 1024 + 128 * num_online_cpus();
-        char *buf;
-        struct seq_file *m;
-        int res;
        /* minimum size to display an interrupt count : 2 bytes */
        size += 2 * nr_irqs;
+        return single_open_size(file, show_stat, NULL, size);
-        /* don't ask for more than the kmalloc() max size */
-        if (size > KMALLOC_MAX_SIZE)
-                size = KMALLOC_MAX_SIZE;
-        buf = kmalloc(size, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-        res = single_open(file, show_stat, NULL);
-        if (!res) {
-                m = file->private_data;
-                m->buf = buf;
-                m->size = ksize(buf);
-        } else
-                kfree(buf);
-        return res;
 }
 static const struct file_operations proc_stat_operations = {
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 1d641bb108d2..3857b720cb1b 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -8,8 +8,10 @@
 #include <linux/fs.h>
 #include <linux/export.h>
 #include <linux/seq_file.h>
+#include <linux/vmalloc.h>
 #include <linux/slab.h>
 #include <linux/cred.h>
+#include <linux/mm.h>
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -30,6 +32,16 @@ static void seq_set_overflow(struct seq_file *m)
        m->count = m->size;
 }
+static void *seq_buf_alloc(unsigned long size)
+{
+        void *buf;
+        buf = kmalloc(size, GFP_KERNEL | __GFP_NOWARN);
+        if (!buf && size > PAGE_SIZE)
+                buf = vmalloc(size);
+        return buf;
+}
 /**
 *      seq_open -      initialize sequential file
 *      @file: file we initialize
@@ -96,7 +108,7 @@ static int traverse(struct seq_file *m, loff_t offset)
                return 0;
        }
        if (!m->buf) {
-                m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
+                m->buf = seq_buf_alloc(m->size = PAGE_SIZE);
                if (!m->buf)
                        return -ENOMEM;
        }
@@ -135,9 +147,9 @@ static int traverse(struct seq_file *m, loff_t offset)
 Eoverflow:
        m->op->stop(m, p);
-        kfree(m->buf);
+        kvfree(m->buf);
        m->count = 0;
-        m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
+        m->buf = seq_buf_alloc(m->size <<= 1);
        return !m->buf ? -ENOMEM : -EAGAIN;
 }
@@ -192,7 +204,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
        /* grab buffer if we didn't have one */
        if (!m->buf) {
-                m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
+                m->buf = seq_buf_alloc(m->size = PAGE_SIZE);
                if (!m->buf)
                        goto Enomem;
        }
@@ -232,9 +244,9 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
                if (m->count < m->size)
                        goto Fill;
                m->op->stop(m, p);
-                kfree(m->buf);
+                kvfree(m->buf);
                m->count = 0;
-                m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
+                m->buf = seq_buf_alloc(m->size <<= 1);
                if (!m->buf)
                        goto Enomem;
                m->version = 0;
@@ -350,7 +362,7 @@ EXPORT_SYMBOL(seq_lseek);
 int seq_release(struct inode *inode, struct file *file)
 {
        struct seq_file *m = file->private_data;
-        kfree(m->buf);
+        kvfree(m->buf);
        kfree(m);
        return 0;
 }
@@ -605,13 +617,13 @@ EXPORT_SYMBOL(single_open);
 int single_open_size(struct file *file, int (*show)(struct seq_file *, void *),
                void *data, size_t size)
 {
-        char *buf = kmalloc(size, GFP_KERNEL);
+        char *buf = seq_buf_alloc(size);
        int ret;
        if (!buf)
                return -ENOMEM;
        ret = single_open(file, show, data);
        if (ret) {
-                kfree(buf);
+                kvfree(buf);
                return ret;
        }
        ((struct seq_file *)file->private_data)->buf = buf;