13 files changed, 87 insertions, 38 deletions

diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index aa3397620342..2c29db6a247e 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -477,9 +477,10 @@ extern int CIFSGetExtAttr(const unsigned int xid, struct cifs_tcon *tcon,
                         const int netfid, __u64 *pExtAttrBits, __u64 *pMask);
 extern void cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb);
 extern bool CIFSCouldBeMFSymlink(const struct cifs_fattr *fattr);
-extern int CIFSCheckMFSymlink(struct cifs_fattr *fattr,
-                const unsigned char *path,
-                struct cifs_sb_info *cifs_sb, unsigned int xid);
+extern int CIFSCheckMFSymlink(unsigned int xid, struct cifs_tcon *tcon,
+                              struct cifs_sb_info *cifs_sb,
+                              struct cifs_fattr *fattr,
+                              const unsigned char *path);
 extern int mdfour(unsigned char *, unsigned char *, int);
 extern int E_md4hash(const unsigned char *passwd, unsigned char *p16,
                         const struct nls_table *codepage);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 124aa0230c1b..d707edb6b852 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -4010,7 +4010,7 @@ QFileInfoRetry:
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
         if (rc) {
-                cifs_dbg(FYI, "Send error in QPathInfo = %d\n", rc);
+                cifs_dbg(FYI, "Send error in QFileInfo = %d", rc);
         } else {                /* decode response */
                 rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
@@ -4179,7 +4179,7 @@ UnixQFileInfoRetry:
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
         if (rc) {
-                cifs_dbg(FYI, "Send error in QPathInfo = %d\n", rc);
+                cifs_dbg(FYI, "Send error in UnixQFileInfo = %d", rc);
         } else {                /* decode response */
                 rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
@@ -4263,7 +4263,7 @@ UnixQPathInfoRetry:
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
         if (rc) {
-                cifs_dbg(FYI, "Send error in QPathInfo = %d\n", rc);
+                cifs_dbg(FYI, "Send error in UnixQPathInfo = %d", rc);
         } else {                /* decode response */
                 rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 11ff5f116b20..a514e0a65f69 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -193,7 +193,7 @@ check_name(struct dentry *direntry)
 static int
 cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid,
                struct tcon_link *tlink, unsigned oflags, umode_t mode,
-               __u32 *oplock, struct cifs_fid *fid, int *created)
+               __u32 *oplock, struct cifs_fid *fid)
 {
         int rc = -ENOENT;
         int create_options = CREATE_NOT_DIR;
@@ -349,7 +349,6 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid,
                                 .device = 0,
                 };
 
-                *created |= FILE_CREATED;
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
                         args.uid = current_fsuid();
                         if (inode->i_mode & S_ISGID)
@@ -480,13 +479,16 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
         cifs_add_pending_open(&fid, tlink, &open);
 
         rc = cifs_do_create(inode, direntry, xid, tlink, oflags, mode,
-                            &oplock, &fid, opened);
+                            &oplock, &fid);
 
         if (rc) {
                 cifs_del_pending_open(&open);
                 goto out;
         }
 
+        if ((oflags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL))
+                *opened |= FILE_CREATED;
+
         rc = finish_open(file, direntry, generic_file_open, opened);
         if (rc) {
                 if (server->ops->close)
@@ -529,7 +531,6 @@ int cifs_create(struct inode *inode, struct dentry *direntry, umode_t mode,
         struct TCP_Server_Info *server;
         struct cifs_fid fid;
         __u32 oplock;
-        int created = FILE_CREATED;
 
         cifs_dbg(FYI, "cifs_create parent inode = 0x%p name is: %s and dentry = 0x%p\n",
                  inode, direntry->d_name.name, direntry);
@@ -546,7 +547,7 @@ int cifs_create(struct inode *inode, struct dentry *direntry, umode_t mode,
                 server->ops->new_lease_key(&fid);
 
         rc = cifs_do_create(inode, direntry, xid, tlink, oflags, mode,
-                            &oplock, &fid, &created);
+                            &oplock, &fid);
         if (!rc && server->ops->close)
                 server->ops->close(xid, tcon, &fid);
 
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 36f9ebb93ceb..49719b8228e5 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -383,7 +383,8 @@ int cifs_get_inode_info_unix(struct inode **pinode,
 
         /* check for Minshall+French symlinks */
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MF_SYMLINKS) {
-                int tmprc = CIFSCheckMFSymlink(&fattr, full_path, cifs_sb, xid);
+                int tmprc = CIFSCheckMFSymlink(xid, tcon, cifs_sb, &fattr,
+                                               full_path);
                 if (tmprc)
                         cifs_dbg(FYI, "CIFSCheckMFSymlink: %d\n", tmprc);
         }
@@ -799,7 +800,8 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
 
         /* check for Minshall+French symlinks */
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MF_SYMLINKS) {
-                tmprc = CIFSCheckMFSymlink(&fattr, full_path, cifs_sb, xid);
+                tmprc = CIFSCheckMFSymlink(xid, tcon, cifs_sb, &fattr,
+                                           full_path);
                 if (tmprc)
                         cifs_dbg(FYI, "CIFSCheckMFSymlink: %d\n", tmprc);
         }
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index cc0234710ddb..92aee08483a5 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -354,34 +354,30 @@ open_query_close_cifs_symlink(const unsigned char *path, char *pbuf,
 
 
 int
-CIFSCheckMFSymlink(struct cifs_fattr *fattr,
-                   const unsigned char *path,
-                   struct cifs_sb_info *cifs_sb, unsigned int xid)
+CIFSCheckMFSymlink(unsigned int xid, struct cifs_tcon *tcon,
+                   struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
+                   const unsigned char *path)
 {
-        int rc = 0;
+        int rc;
         u8 *buf = NULL;
         unsigned int link_len = 0;
         unsigned int bytes_read = 0;
-        struct cifs_tcon *ptcon;
 
         if (!CIFSCouldBeMFSymlink(fattr))
                 /* it's not a symlink */
                 return 0;
 
         buf = kmalloc(CIFS_MF_SYMLINK_FILE_SIZE, GFP_KERNEL);
-        if (!buf) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!buf)
+                return -ENOMEM;
 
-        ptcon = tlink_tcon(cifs_sb_tlink(cifs_sb));
-        if ((ptcon->ses) && (ptcon->ses->server->ops->query_mf_symlink))
-                rc = ptcon->ses->server->ops->query_mf_symlink(path, buf,
-                                                 &bytes_read, cifs_sb, xid);
+        if (tcon->ses->server->ops->query_mf_symlink)
+                rc = tcon->ses->server->ops->query_mf_symlink(path, buf,
+                                                &bytes_read, cifs_sb, xid);
         else
-                goto out;
+                rc = -ENOSYS;
 
-        if (rc != 0)
+        if (rc)
                 goto out;
 
         if (bytes_read == 0) /* not a symlink */
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 8b5e2584c840..af903128891c 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1907,10 +1907,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                         }
                 }
         }
-        if (op == EPOLL_CTL_DEL && is_file_epoll(tf.file)) {
-                tep = tf.file->private_data;
-                mutex_lock_nested(&tep->mtx, 1);
-        }
 
         /*
          * Try to lookup the file inside our RB tree, Since we grabbed "mtx"
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 4410cc3d6ee2..3384dc4bed40 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4218,7 +4218,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
          */
         map->m_flags &= ~EXT4_MAP_FROM_CLUSTER;
         newex.ee_block = cpu_to_le32(map->m_lblk);
-        cluster_offset = EXT4_LBLK_CMASK(sbi, map->m_lblk);
+        cluster_offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
 
         /*
          * If we are doing bigalloc, check to see if the extent returned
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index b7fc035a6943..73f3e4ee4037 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -986,6 +986,7 @@ static ssize_t gfs2_direct_IO(int rw, struct kiocb *iocb,
 {
         struct file *file = iocb->ki_filp;
         struct inode *inode = file->f_mapping->host;
+        struct address_space *mapping = inode->i_mapping;
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_holder gh;
         int rv;
@@ -1006,6 +1007,35 @@ static ssize_t gfs2_direct_IO(int rw, struct kiocb *iocb,
         if (rv != 1)
                 goto out; /* dio not valid, fall back to buffered i/o */
 
+        /*
+         * Now since we are holding a deferred (CW) lock at this point, you
+         * might be wondering why this is ever needed. There is a case however
+         * where we've granted a deferred local lock against a cached exclusive
+         * glock. That is ok provided all granted local locks are deferred, but
+         * it also means that it is possible to encounter pages which are
+         * cached and possibly also mapped. So here we check for that and sort
+         * them out ahead of the dio. The glock state machine will take care of
+         * everything else.
+         *
+         * If in fact the cached glock state (gl->gl_state) is deferred (CW) in
+         * the first place, mapping->nr_pages will always be zero.
+         */
+        if (mapping->nrpages) {
+                loff_t lstart = offset & (PAGE_CACHE_SIZE - 1);
+                loff_t len = iov_length(iov, nr_segs);
+                loff_t end = PAGE_ALIGN(offset + len) - 1;
+
+                rv = 0;
+                if (len == 0)
+                        goto out;
+                if (test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
+                        unmap_shared_mapping_range(ip->i_inode.i_mapping, offset, len);
+                rv = filemap_write_and_wait_range(mapping, lstart, end);
+                if (rv)
+                        return rv;
+                truncate_inode_pages_range(mapping, lstart, end);
+        }
+
         rv = __blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
                                   offset, nr_segs, gfs2_get_block_direct,
                                   NULL, NULL, 0);
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index c8420f7e4db6..6f7a47c05259 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1655,6 +1655,7 @@ static int dump_holder(struct seq_file *seq, const struct gfs2_holder *gh)
         struct task_struct *gh_owner = NULL;
         char flags_buf[32];
 
+        rcu_read_lock();
         if (gh->gh_owner_pid)
                 gh_owner = pid_task(gh->gh_owner_pid, PIDTYPE_PID);
         gfs2_print_dbg(seq, " H: s:%s f:%s e:%d p:%ld [%s] %pS\n",
@@ -1664,6 +1665,7 @@ static int dump_holder(struct seq_file *seq, const struct gfs2_holder *gh)
                        gh->gh_owner_pid ? (long)pid_nr(gh->gh_owner_pid) : -1,
                        gh_owner ? gh_owner->comm : "(ended)",
                        (void *)gh->gh_ip);
+        rcu_read_unlock();
         return 0;
 }
 
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index db908f697139..f88dcd925010 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -192,8 +192,11 @@ static void inode_go_sync(struct gfs2_glock *gl)
 
         if (ip && !S_ISREG(ip->i_inode.i_mode))
                 ip = NULL;
-        if (ip && test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
-                unmap_shared_mapping_range(ip->i_inode.i_mapping, 0, 0);
+        if (ip) {
+                if (test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
+                        unmap_shared_mapping_range(ip->i_inode.i_mapping, 0, 0);
+                inode_dio_wait(&ip->i_inode);
+        }
         if (!test_and_clear_bit(GLF_DIRTY, &gl->gl_flags))
                 return;
 
@@ -410,6 +413,9 @@ static int inode_go_lock(struct gfs2_holder *gh)
                         return error;
         }
 
+        if (gh->gh_state != LM_ST_DEFERRED)
+                inode_dio_wait(&ip->i_inode);
+
         if ((ip->i_diskflags & GFS2_DIF_TRUNC_IN_PROG) &&
             (gl->gl_state == LM_ST_EXCLUSIVE) &&
             (gh->gh_state == LM_ST_EXCLUSIVE)) {
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 610613fb65b5..9dcb9777a5f8 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -551,10 +551,10 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
         struct buffer_head *bh = bd->bd_bh;
         struct gfs2_glock *gl = bd->bd_gl;
 
-        gfs2_remove_from_ail(bd);
-        bd->bd_bh = NULL;
         bh->b_private = NULL;
         bd->bd_blkno = bh->b_blocknr;
+        gfs2_remove_from_ail(bd); /* drops ref on bh */
+        bd->bd_bh = NULL;
         bd->bd_ops = &gfs2_revoke_lops;
         sdp->sd_log_num_revoke++;
         atomic_inc(&gl->gl_revokes);
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index 932415050540..52f177be3bf8 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -258,6 +258,7 @@ void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int
         struct address_space *mapping = bh->b_page->mapping;
         struct gfs2_sbd *sdp = gfs2_mapping2sbd(mapping);
         struct gfs2_bufdata *bd = bh->b_private;
+        int was_pinned = 0;
 
         if (test_clear_buffer_pinned(bh)) {
                 trace_gfs2_pin(bd, 0);
@@ -273,12 +274,16 @@ void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int
                         tr->tr_num_databuf_rm++;
                 }
                 tr->tr_touched = 1;
+                was_pinned = 1;
                 brelse(bh);
         }
         if (bd) {
                 spin_lock(&sdp->sd_ail_lock);
                 if (bd->bd_tr) {
                         gfs2_trans_add_revoke(sdp, bd);
+                } else if (was_pinned) {
+                        bh->b_private = NULL;
+                        kmem_cache_free(gfs2_bufdata_cachep, bd);
                 }
                 spin_unlock(&sdp->sd_ail_lock);
         }
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 82303b474958..52fa88314f5c 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1366,8 +1366,18 @@ static struct dentry *gfs2_mount(struct file_system_type *fs_type, int flags,
         if (IS_ERR(s))
                 goto error_bdev;
 
-        if (s->s_root)
+        if (s->s_root) {
+                /*
+                 * s_umount nests inside bd_mutex during
+                 * __invalidate_device().  blkdev_put() acquires
+                 * bd_mutex and can't be called under s_umount.  Drop
+                 * s_umount temporarily.  This is safe as we're
+                 * holding an active reference.
+                 */
+                up_write(&s->s_umount);
                 blkdev_put(bdev, mode);
+                down_write(&s->s_umount);
+        }
 
         memset(&args, 0, sizeof(args));
         args.ar_quota = GFS2_QUOTA_DEFAULT;