25 files changed, 259 insertions, 218 deletions

diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
index fd01d90cada5..57997fa14e69 100644
--- a/fs/9p/v9fs_vfs.h
+++ b/fs/9p/v9fs_vfs.h
@@ -51,4 +51,4 @@ int v9fs_dir_release(struct inode *inode, struct file *filp);
 int v9fs_file_open(struct inode *inode, struct file *file);
 void v9fs_inode2stat(struct inode *inode, struct p9_stat *stat);
 void v9fs_dentry_release(struct dentry *);
-int v9fs_uflags2omode(int uflags);
+int v9fs_uflags2omode(int uflags, int extended);
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 0d55affe37d4..52944d2249a4 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -59,7 +59,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
 
         P9_DPRINTK(P9_DEBUG_VFS, "inode: %p file: %p \n", inode, file);
         v9ses = v9fs_inode2v9ses(inode);
-        omode = v9fs_uflags2omode(file->f_flags);
+        omode = v9fs_uflags2omode(file->f_flags, v9fs_extended(v9ses));
         fid = file->private_data;
         if (!fid) {
                 fid = v9fs_fid_clone(file->f_path.dentry);
@@ -75,6 +75,8 @@ int v9fs_file_open(struct inode *inode, struct file *file)
                         inode->i_size = 0;
                         inode->i_blocks = 0;
                 }
+                if ((file->f_flags & O_APPEND) && (!v9fs_extended(v9ses)))
+                        generic_file_llseek(file, 0, SEEK_END);
         }
 
         file->private_data = fid;
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 40fa807bd929..c95295c65045 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -132,10 +132,10 @@ static int p9mode2unixmode(struct v9fs_session_info *v9ses, int mode)
 /**
  * v9fs_uflags2omode- convert posix open flags to plan 9 mode bits
  * @uflags: flags to convert
- *
+ * @extended: if .u extensions are active
  */
 
-int v9fs_uflags2omode(int uflags)
+int v9fs_uflags2omode(int uflags, int extended)
 {
         int ret;
 
@@ -155,14 +155,16 @@ int v9fs_uflags2omode(int uflags)
                 break;
         }
 
-        if (uflags & O_EXCL)
-                ret |= P9_OEXCL;
-
         if (uflags & O_TRUNC)
                 ret |= P9_OTRUNC;
 
-        if (uflags & O_APPEND)
-                ret |= P9_OAPPEND;
+        if (extended) {
+                if (uflags & O_EXCL)
+                        ret |= P9_OEXCL;
+
+                if (uflags & O_APPEND)
+                        ret |= P9_OAPPEND;
+        }
 
         return ret;
 }
@@ -506,7 +508,7 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
                 flags = O_RDWR;
 
         fid = v9fs_create(v9ses, dir, dentry, NULL, perm,
-                                                v9fs_uflags2omode(flags));
+                                v9fs_uflags2omode(flags, v9fs_extended(v9ses)));
         if (IS_ERR(fid)) {
                 err = PTR_ERR(fid);
                 fid = NULL;
diff --git a/fs/Kconfig b/fs/Kconfig
index cf12c403b8c7..2694648cbd1b 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -830,7 +830,7 @@ config NTFS_FS
           from the project web site.
 
           For more information see <file:Documentation/filesystems/ntfs.txt>
-          and <http://linux-ntfs.sourceforge.net/>.
+          and <http://www.linux-ntfs.org/>.
 
           To compile this file system support as a module, choose M here: the
           module will be called ntfs.
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 470c10ceb0fb..10d8a0aa871a 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -931,8 +931,16 @@ static int do_open(struct block_device *bdev, struct file *file, int for_part)
         struct gendisk *disk;
         int ret;
         int part;
+        int perm = 0;
 
-        ret = devcgroup_inode_permission(bdev->bd_inode, file->f_mode);
+        if (file->f_mode & FMODE_READ)
+                perm |= MAY_READ;
+        if (file->f_mode & FMODE_WRITE)
+                perm |= MAY_WRITE;
+        /*
+         * hooks: /n/, see "layering violations".
+         */
+        ret = devcgroup_inode_permission(bdev->bd_inode, perm);
         if (ret != 0)
                 return ret;
 
diff --git a/fs/buffer.c b/fs/buffer.c
index a073f3f4f013..0f51c0f7c266 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -821,7 +821,7 @@ static int fsync_buffers_list(spinlock_t *lock, struct list_head *list)
                                  * contents - it is a noop if I/O is still in
                                  * flight on potentially older contents.
                                  */
-                                ll_rw_block(SWRITE, 1, &bh);
+                                ll_rw_block(SWRITE_SYNC, 1, &bh);
                                 brelse(bh);
                                 spin_lock(lock);
                         }
@@ -2940,16 +2940,19 @@ void ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
         for (i = 0; i < nr; i++) {
                 struct buffer_head *bh = bhs[i];
 
-                if (rw == SWRITE)
+                if (rw == SWRITE || rw == SWRITE_SYNC)
                         lock_buffer(bh);
                 else if (test_set_buffer_locked(bh))
                         continue;
 
-                if (rw == WRITE || rw == SWRITE) {
+                if (rw == WRITE || rw == SWRITE || rw == SWRITE_SYNC) {
                         if (test_clear_buffer_dirty(bh)) {
                                 bh->b_end_io = end_buffer_write_sync;
                                 get_bh(bh);
-                                submit_bh(WRITE, bh);
+                                if (rw == SWRITE_SYNC)
+                                        submit_bh(WRITE_SYNC, bh);
+                                else
+                                        submit_bh(WRITE, bh);
                                 continue;
                         }
                 } else {
@@ -2978,7 +2981,7 @@ int sync_dirty_buffer(struct buffer_head *bh)
         if (test_clear_buffer_dirty(bh)) {
                 get_bh(bh);
                 bh->b_end_io = end_buffer_write_sync;
-                ret = submit_bh(WRITE, bh);
+                ret = submit_bh(WRITE_SYNC, bh);
                 wait_on_buffer(bh);
                 if (buffer_eopnotsupp(bh)) {
                         clear_buffer_eopnotsupp(bh);
diff --git a/fs/dcache.c b/fs/dcache.c
index 3ee588d5f585..6068c25b393c 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -17,6 +17,7 @@
 #include <linux/syscalls.h>
 #include <linux/string.h>
 #include <linux/mm.h>
+#include <linux/fdtable.h>
 #include <linux/fs.h>
 #include <linux/fsnotify.h>
 #include <linux/slab.h>
@@ -106,9 +107,10 @@ static void dentry_lru_remove(struct dentry *dentry)
 /*
  * Release the dentry's inode, using the filesystem
  * d_iput() operation if defined.
- * Called with dcache_lock and per dentry lock held, drops both.
  */
 static void dentry_iput(struct dentry * dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
 {
         struct inode *inode = dentry->d_inode;
         if (inode) {
@@ -132,12 +134,13 @@ static void dentry_iput(struct dentry * dentry)
  * d_kill - kill dentry and return parent
  * @dentry: dentry to kill
  *
- * Called with dcache_lock and d_lock, releases both.  The dentry must
- * already be unhashed and removed from the LRU.
+ * The dentry must already be unhashed and removed from the LRU.
  *
  * If this is the root of the dentry tree, return NULL.
  */
 static struct dentry *d_kill(struct dentry *dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
 {
         struct dentry *parent;
 
@@ -383,11 +386,11 @@ restart:
  * Try to prune ancestors as well.  This is necessary to prevent
  * quadratic behavior of shrink_dcache_parent(), but is also expected
  * to be beneficial in reducing dentry cache fragmentation.
- *
- * Called with dcache_lock, drops it and then regains.
- * Called with dentry->d_lock held, drops it.
  */
 static void prune_one_dentry(struct dentry * dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
+        __acquires(dcache_lock)
 {
         __d_drop(dentry);
         dentry = d_kill(dentry);
@@ -1604,10 +1607,9 @@ static int d_isparent(struct dentry *p1, struct dentry *p2)
  *
  * Note: If ever the locking in lock_rename() changes, then please
  * remember to update this too...
- *
- * On return, dcache_lock will have been unlocked.
  */
 static struct dentry *__d_unalias(struct dentry *dentry, struct dentry *alias)
+        __releases(dcache_lock)
 {
         struct mutex *m1 = NULL, *m2 = NULL;
         struct dentry *ret;
@@ -1743,11 +1745,9 @@ out_nolock:
 shouldnt_be_hashed:
         spin_unlock(&dcache_lock);
         BUG();
-        goto shouldnt_be_hashed;
 }
 
-static int prepend(char **buffer, int *buflen, const char *str,
-                          int namelen)
+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
 {
         *buflen -= namelen;
         if (*buflen < 0)
@@ -1757,8 +1757,13 @@ static int prepend(char **buffer, int *buflen, const char *str,
         return 0;
 }
 
+static int prepend_name(char **buffer, int *buflen, struct qstr *name)
+{
+        return prepend(buffer, buflen, name->name, name->len);
+}
+
 /**
- * d_path - return the path of a dentry
+ * __d_path - return the path of a dentry
  * @path: the dentry/vfsmount to report
  * @root: root vfsmnt/dentry (may be modified by this function)
  * @buffer: buffer to return value in
@@ -1779,9 +1784,10 @@ char *__d_path(const struct path *path, struct path *root,
 {
         struct dentry *dentry = path->dentry;
         struct vfsmount *vfsmnt = path->mnt;
-        char * end = buffer+buflen;
-        char * retval;
+        char *end = buffer + buflen;
+        char *retval;
 
+        spin_lock(&vfsmount_lock);
         prepend(&end, &buflen, "\0", 1);
         if (!IS_ROOT(dentry) && d_unhashed(dentry) &&
                 (prepend(&end, &buflen, " (deleted)", 10) != 0))
@@ -1800,38 +1806,37 @@ char *__d_path(const struct path *path, struct path *root,
                         break;
                 if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
                         /* Global root? */
-                        spin_lock(&vfsmount_lock);
                         if (vfsmnt->mnt_parent == vfsmnt) {
-                                spin_unlock(&vfsmount_lock);
                                 goto global_root;
                         }
                         dentry = vfsmnt->mnt_mountpoint;
                         vfsmnt = vfsmnt->mnt_parent;
-                        spin_unlock(&vfsmount_lock);
                         continue;
                 }
                 parent = dentry->d_parent;
                 prefetch(parent);
-                if ((prepend(&end, &buflen, dentry->d_name.name,
-                                dentry->d_name.len) != 0) ||
+                if ((prepend_name(&end, &buflen, &dentry->d_name) != 0) ||
                     (prepend(&end, &buflen, "/", 1) != 0))
                         goto Elong;
                 retval = end;
                 dentry = parent;
         }
 
+out:
+        spin_unlock(&vfsmount_lock);
         return retval;
 
 global_root:
         retval += 1;    /* hit the slash */
-        if (prepend(&retval, &buflen, dentry->d_name.name,
-                    dentry->d_name.len) != 0)
+        if (prepend_name(&retval, &buflen, &dentry->d_name) != 0)
                 goto Elong;
         root->mnt = vfsmnt;
         root->dentry = dentry;
-        return retval;
+        goto out;
+
 Elong:
-        return ERR_PTR(-ENAMETOOLONG);
+        retval = ERR_PTR(-ENAMETOOLONG);
+        goto out;
 }
 
 /**
@@ -1845,9 +1850,9 @@ Elong:
  *
  * Returns the buffer or an error code if the path was too long.
  *
- * "buflen" should be positive. Caller holds the dcache_lock.
+ * "buflen" should be positive.
  */
-char *d_path(struct path *path, char *buf, int buflen)
+char *d_path(const struct path *path, char *buf, int buflen)
 {
         char *res;
         struct path root;
@@ -1915,16 +1920,11 @@ char *dentry_path(struct dentry *dentry, char *buf, int buflen)
         retval = end-1;
         *retval = '/';
 
-        for (;;) {
-                struct dentry *parent;
-                if (IS_ROOT(dentry))
-                        break;
+        while (!IS_ROOT(dentry)) {
+                struct dentry *parent = dentry->d_parent;
 
-                parent = dentry->d_parent;
                 prefetch(parent);
-
-                if ((prepend(&end, &buflen, dentry->d_name.name,
-                                dentry->d_name.len) != 0) ||
+                if ((prepend_name(&end, &buflen, &dentry->d_name) != 0) ||
                     (prepend(&end, &buflen, "/", 1) != 0))
                         goto Elong;
 
@@ -1975,7 +1975,7 @@ asmlinkage long sys_getcwd(char __user *buf, unsigned long size)
         error = -ENOENT;
         /* Has the current directory has been unlinked? */
         spin_lock(&dcache_lock);
-        if (pwd.dentry->d_parent == pwd.dentry || !d_unhashed(pwd.dentry)) {
+        if (IS_ROOT(pwd.dentry) || !d_unhashed(pwd.dentry)) {
                 unsigned long len;
                 struct path tmp = root;
                 char * cwd;
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 50c994a249a5..09a4522f65e6 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -575,13 +575,11 @@ int ecryptfs_init_ecryptfs_miscdev(void)
         int rc;
 
         atomic_set(&ecryptfs_num_miscdev_opens, 0);
-        mutex_lock(&ecryptfs_daemon_hash_mux);
         rc = misc_register(&ecryptfs_miscdev);
         if (rc)
                 printk(KERN_ERR "%s: Failed to register miscellaneous device "
                        "for communications with userspace daemons; rc = [%d]\n",
                        __func__, rc);
-        mutex_unlock(&ecryptfs_daemon_hash_mux);
         return rc;
 }
 
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index fe3119a71ada..2845425077e8 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -2875,8 +2875,10 @@ static ssize_t ext3_quota_write(struct super_block *sb, int type,
                 blk++;
         }
 out:
-        if (len == towrite)
+        if (len == towrite) {
+                mutex_unlock(&inode->i_mutex);
                 return err;
+        }
         if (inode->i_size < off+len-towrite) {
                 i_size_write(inode, off+len-towrite);
                 EXT3_I(inode)->i_disksize = inode->i_size;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index cb96f127c366..02bf24343979 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3337,8 +3337,10 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type,
                 blk++;
         }
 out:
-        if (len == towrite)
+        if (len == towrite) {
+                mutex_unlock(&inode->i_mutex);
                 return err;
+        }
         if (inode->i_size < off+len-towrite) {
                 i_size_write(inode, off+len-towrite);
                 EXT4_I(inode)->i_disksize = inode->i_size;
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index c19184f2e70e..bec76b1c2bb0 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -246,15 +246,11 @@ static void find_metapath(const struct gfs2_sbd *sdp, u64 block,
 
 }
 
-static inline unsigned int zero_metapath_length(const struct metapath *mp,
-                                                unsigned height)
+static inline unsigned int metapath_branch_start(const struct metapath *mp)
 {
-        unsigned int i;
-        for (i = 0; i < height - 1; i++) {
-                if (mp->mp_list[i] != 0)
-                        return i;
-        }
-        return height;
+        if (mp->mp_list[0] == 0)
+                return 2;
+        return 1;
 }
 
 /**
@@ -436,7 +432,7 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
         struct gfs2_sbd *sdp = GFS2_SB(inode);
         struct buffer_head *dibh = mp->mp_bh[0];
         u64 bn, dblock = 0;
-        unsigned n, i, blks, alloced = 0, iblks = 0, zmpl = 0;
+        unsigned n, i, blks, alloced = 0, iblks = 0, branch_start = 0;
         unsigned dblks = 0;
         unsigned ptrs_per_blk;
         const unsigned end_of_metadata = height - 1;
@@ -471,9 +467,8 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
                         /* Building up tree height */
                         state = ALLOC_GROW_HEIGHT;
                         iblks = height - ip->i_height;
-                        zmpl = zero_metapath_length(mp, height);
-                        iblks -= zmpl;
-                        iblks += height;
+                        branch_start = metapath_branch_start(mp);
+                        iblks += (height - branch_start);
                 }
         }
 
@@ -509,13 +504,13 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
                                         sizeof(struct gfs2_meta_header));
                                 *ptr = zero_bn;
                                 state = ALLOC_GROW_DEPTH;
-                                for(i = zmpl; i < height; i++) {
+                                for(i = branch_start; i < height; i++) {
                                         if (mp->mp_bh[i] == NULL)
                                                 break;
                                         brelse(mp->mp_bh[i]);
                                         mp->mp_bh[i] = NULL;
                                 }
-                                i = zmpl;
+                                i = branch_start;
                         }
                         if (n == 0)
                                 break;
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 6387523a3153..3401628d742b 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -195,7 +195,7 @@ ulong_aligned:
            depending on architecture.  I've experimented with several ways
            of writing this section such as using an else before the goto
            but this one seems to be the fastest. */
-        while ((unsigned char *)plong < end - 1) {
+        while ((unsigned char *)plong < end - sizeof(unsigned long)) {
                 prefetch(plong + 1);
                 if (((*plong) & LBITMASK) != lskipval)
                         break;
diff --git a/fs/libfs.c b/fs/libfs.c
index 892d41cb3382..baeb71ee1cde 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -512,6 +512,20 @@ void simple_release_fs(struct vfsmount **mount, int *count)
         mntput(mnt);
 }
 
+/**
+ * simple_read_from_buffer - copy data from the buffer to user space
+ * @to: the user space buffer to read to
+ * @count: the maximum number of bytes to read
+ * @ppos: the current position in the buffer
+ * @from: the buffer to read from
+ * @available: the size of the buffer
+ *
+ * The simple_read_from_buffer() function reads up to @count bytes from the
+ * buffer @from at offset @ppos into the user space address starting at @to.
+ *
+ * On success, the number of bytes read is returned and the offset @ppos is
+ * advanced by this number, or negative value is returned on error.
+ **/
 ssize_t simple_read_from_buffer(void __user *to, size_t count, loff_t *ppos,
                                 const void *from, size_t available)
 {
@@ -528,6 +542,20 @@ ssize_t simple_read_from_buffer(void __user *to, size_t count, loff_t *ppos,
         return count;
 }
 
+/**
+ * memory_read_from_buffer - copy data from the buffer
+ * @to: the kernel space buffer to read to
+ * @count: the maximum number of bytes to read
+ * @ppos: the current position in the buffer
+ * @from: the buffer to read from
+ * @available: the size of the buffer
+ *
+ * The memory_read_from_buffer() function reads up to @count bytes from the
+ * buffer @from at offset @ppos into the kernel space address starting at @to.
+ *
+ * On success, the number of bytes read is returned and the offset @ppos is
+ * advanced by this number, or negative value is returned on error.
+ **/
 ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,
                                 const void *from, size_t available)
 {
diff --git a/fs/locks.c b/fs/locks.c
index 11dbf08651b7..dce8c747371c 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -561,9 +561,6 @@ static void locks_insert_lock(struct file_lock **pos, struct file_lock *fl)
         /* insert into file's list */
         fl->fl_next = *pos;
         *pos = fl;
-
-        if (fl->fl_ops && fl->fl_ops->fl_insert)
-                fl->fl_ops->fl_insert(fl);
 }
 
 /*
@@ -586,9 +583,6 @@ static void locks_delete_lock(struct file_lock **thisfl_p)
                 fl->fl_fasync = NULL;
         }
 
-        if (fl->fl_ops && fl->fl_ops->fl_remove)
-                fl->fl_ops->fl_remove(fl);
-
         if (fl->fl_nspid) {
                 put_pid(fl->fl_nspid);
                 fl->fl_nspid = NULL;
diff --git a/fs/namei.c b/fs/namei.c
index c7e43536c49a..01e67dddcc3d 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -581,15 +581,13 @@ static __always_inline int link_path_walk(const char *name, struct nameidata *nd
         int result;
 
         /* make sure the stuff we saved doesn't go away */
-        dget(save.dentry);
-        mntget(save.mnt);
+        path_get(&save);
 
         result = __link_path_walk(name, nd);
         if (result == -ESTALE) {
                 /* nd->path had been dropped */
                 nd->path = save;
-                dget(nd->path.dentry);
-                mntget(nd->path.mnt);
+                path_get(&nd->path);
                 nd->flags |= LOOKUP_REVAL;
                 result = __link_path_walk(name, nd);
         }
@@ -1216,8 +1214,9 @@ int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
         nd->flags = flags;
         nd->depth = 0;
 
-        nd->path.mnt = mntget(mnt);
-        nd->path.dentry = dget(dentry);
+        nd->path.dentry = dentry;
+        nd->path.mnt = mnt;
+        path_get(&nd->path);
 
         retval = path_walk(name, nd);
         if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
@@ -2857,16 +2856,17 @@ int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
 {
         struct nameidata nd;
         void *cookie;
+        int res;
 
         nd.depth = 0;
         cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
-        if (!IS_ERR(cookie)) {
-                int res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
-                if (dentry->d_inode->i_op->put_link)
-                        dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
-                cookie = ERR_PTR(res);
-        }
-        return PTR_ERR(cookie);
+        if (IS_ERR(cookie))
+                return PTR_ERR(cookie);
+
+        res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
+        if (dentry->d_inode->i_op->put_link)
+                dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
+        return res;
 }
 
 int vfs_follow_link(struct nameidata *nd, const char *link)
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index 49c7cd0502cc..779d2eb649c5 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -130,10 +130,11 @@ static int xdr_decode_fhstatus3(struct rpc_rqst *req, __be32 *p,
                                 struct mnt_fhstatus *res)
 {
         struct nfs_fh *fh = res->fh;
+        unsigned size;
 
         if ((res->status = ntohl(*p++)) == 0) {
-                int size = ntohl(*p++);
-                if (size <= NFS3_FHSIZE) {
+                size = ntohl(*p++);
+                if (size <= NFS3_FHSIZE && size != 0) {
                         fh->size = size;
                         memcpy(fh->data, p, size);
                 } else
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 2a4a024a4e7b..614efeed5437 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1216,8 +1216,6 @@ static int nfs_validate_mount_data(void *options,
 {
         struct nfs_mount_data *data = (struct nfs_mount_data *)options;
 
-        memset(args, 0, sizeof(*args));
-
         if (data == NULL)
                 goto out_no_data;
 
@@ -1251,13 +1249,13 @@ static int nfs_validate_mount_data(void *options,
         case 5:
                 memset(data->context, 0, sizeof(data->context));
         case 6:
-                if (data->flags & NFS_MOUNT_VER3)
+                if (data->flags & NFS_MOUNT_VER3) {
+                        if (data->root.size > NFS3_FHSIZE || data->root.size == 0)
+                                goto out_invalid_fh;
                         mntfh->size = data->root.size;
-                else
+                } else
                         mntfh->size = NFS2_FHSIZE;
 
-                if (mntfh->size > sizeof(mntfh->data))
-                        goto out_invalid_fh;
 
                 memcpy(mntfh->data, data->root.data, mntfh->size);
                 if (mntfh->size < sizeof(mntfh->data))
@@ -1585,24 +1583,29 @@ static int nfs_get_sb(struct file_system_type *fs_type,
 {
         struct nfs_server *server = NULL;
         struct super_block *s;
-        struct nfs_fh mntfh;
-        struct nfs_parsed_mount_data data;
+        struct nfs_parsed_mount_data *data;
+        struct nfs_fh *mntfh;
         struct dentry *mntroot;
         int (*compare_super)(struct super_block *, void *) = nfs_compare_super;
         struct nfs_sb_mountdata sb_mntdata = {
                 .mntflags = flags,
         };
-        int error;
+        int error = -ENOMEM;
+
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
+        if (data == NULL || mntfh == NULL)
+                goto out_free_fh;
 
-        security_init_mnt_opts(&data.lsm_opts);
+        security_init_mnt_opts(&data->lsm_opts);
 
         /* Validate the mount data */
-        error = nfs_validate_mount_data(raw_data, &data, &mntfh, dev_name);
+        error = nfs_validate_mount_data(raw_data, data, mntfh, dev_name);
         if (error < 0)
                 goto out;
 
         /* Get a volume representation */
-        server = nfs_create_server(&data, &mntfh);
+        server = nfs_create_server(data, mntfh);
         if (IS_ERR(server)) {
                 error = PTR_ERR(server);
                 goto out;
@@ -1630,16 +1633,16 @@ static int nfs_get_sb(struct file_system_type *fs_type,
 
         if (!s->s_root) {
                 /* initial superblock/root creation */
-                nfs_fill_super(s, &data);
+                nfs_fill_super(s, data);
         }
 
-        mntroot = nfs_get_root(s, &mntfh);
+        mntroot = nfs_get_root(s, mntfh);
         if (IS_ERR(mntroot)) {
                 error = PTR_ERR(mntroot);
                 goto error_splat_super;
         }
 
-        error = security_sb_set_mnt_opts(s, &data.lsm_opts);
+        error = security_sb_set_mnt_opts(s, &data->lsm_opts);
         if (error)
                 goto error_splat_root;
 
@@ -1649,9 +1652,12 @@ static int nfs_get_sb(struct file_system_type *fs_type,
         error = 0;
 
 out:
-        kfree(data.nfs_server.hostname);
-        kfree(data.mount_server.hostname);
-        security_free_mnt_opts(&data.lsm_opts);
+        kfree(data->nfs_server.hostname);
+        kfree(data->mount_server.hostname);
+        security_free_mnt_opts(&data->lsm_opts);
+out_free_fh:
+        kfree(mntfh);
+        kfree(data);
         return error;
 
 out_err_nosb:
@@ -1800,8 +1806,6 @@ static int nfs4_validate_mount_data(void *options,
         struct nfs4_mount_data *data = (struct nfs4_mount_data *)options;
         char *c;
 
-        memset(args, 0, sizeof(*args));
-
         if (data == NULL)
                 goto out_no_data;
 
@@ -1959,26 +1963,31 @@ out_no_client_address:
 static int nfs4_get_sb(struct file_system_type *fs_type,
         int flags, const char *dev_name, void *raw_data, struct vfsmount *mnt)
 {
-        struct nfs_parsed_mount_data data;
+        struct nfs_parsed_mount_data *data;
         struct super_block *s;
         struct nfs_server *server;
-        struct nfs_fh mntfh;
+        struct nfs_fh *mntfh;
         struct dentry *mntroot;
         int (*compare_super)(struct super_block *, void *) = nfs_compare_super;
         struct nfs_sb_mountdata sb_mntdata = {
                 .mntflags = flags,
         };
-        int error;
+        int error = -ENOMEM;
 
-        security_init_mnt_opts(&data.lsm_opts);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
+        if (data == NULL || mntfh == NULL)
+                goto out_free_fh;
+
+        security_init_mnt_opts(&data->lsm_opts);
 
         /* Validate the mount data */
-        error = nfs4_validate_mount_data(raw_data, &data, dev_name);
+        error = nfs4_validate_mount_data(raw_data, data, dev_name);
         if (error < 0)
                 goto out;
 
         /* Get a volume representation */
-        server = nfs4_create_server(&data, &mntfh);
+        server = nfs4_create_server(data, mntfh);
         if (IS_ERR(server)) {
                 error = PTR_ERR(server);
                 goto out;
@@ -2009,13 +2018,13 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
                 nfs4_fill_super(s);
         }
 
-        mntroot = nfs4_get_root(s, &mntfh);
+        mntroot = nfs4_get_root(s, mntfh);
         if (IS_ERR(mntroot)) {
                 error = PTR_ERR(mntroot);
                 goto error_splat_super;
         }
 
-        error = security_sb_set_mnt_opts(s, &data.lsm_opts);
+        error = security_sb_set_mnt_opts(s, &data->lsm_opts);
         if (error)
                 goto error_splat_root;
 
@@ -2025,10 +2034,13 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
         error = 0;
 
 out:
-        kfree(data.client_address);
-        kfree(data.nfs_server.export_path);
-        kfree(data.nfs_server.hostname);
-        security_free_mnt_opts(&data.lsm_opts);
+        kfree(data->client_address);
+        kfree(data->nfs_server.export_path);
+        kfree(data->nfs_server.hostname);
+        security_free_mnt_opts(&data->lsm_opts);
+out_free_fh:
+        kfree(mntfh);
+        kfree(data);
         return error;
 
 out_free:
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 6d8ace3e3259..f333848fd3be 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -739,12 +739,13 @@ int nfs_updatepage(struct file *file, struct page *page,
         }
 
         status = nfs_writepage_setup(ctx, page, offset, count);
-        __set_page_dirty_nobuffers(page);
+        if (status < 0)
+                nfs_set_pageerror(page);
+        else
+                __set_page_dirty_nobuffers(page);
 
         dprintk("NFS:      nfs_updatepage returns %d (isize %Ld)\n",
                         status, (long long)i_size_read(inode));
-        if (status < 0)
-                nfs_set_pageerror(page);
         return status;
 }
 
diff --git a/fs/open.c b/fs/open.c
index a1450086e92f..a99ad09c3197 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -16,6 +16,7 @@
 #include <linux/namei.h>
 #include <linux/backing-dev.h>
 #include <linux/capability.h>
+#include <linux/securebits.h>
 #include <linux/security.h>
 #include <linux/mount.h>
 #include <linux/vfs.h>
@@ -425,7 +426,7 @@ asmlinkage long sys_faccessat(int dfd, const char __user *filename, int mode)
 {
         struct nameidata nd;
         int old_fsuid, old_fsgid;
-        kernel_cap_t old_cap;
+        kernel_cap_t uninitialized_var(old_cap);  /* !SECURE_NO_SETUID_FIXUP */
         int res;
 
         if (mode & ~S_IRWXO)    /* where's F_OK, X_OK, W_OK, R_OK? */
@@ -433,23 +434,27 @@ asmlinkage long sys_faccessat(int dfd, const char __user *filename, int mode)
 
         old_fsuid = current->fsuid;
         old_fsgid = current->fsgid;
-        old_cap = current->cap_effective;
 
         current->fsuid = current->uid;
         current->fsgid = current->gid;
 
-        /*
-         * Clear the capabilities if we switch to a non-root user
-         *
-         * FIXME: There is a race here against sys_capset.  The
-         * capabilities can change yet we will restore the old
-         * value below.  We should hold task_capabilities_lock,
-         * but we cannot because user_path_walk can sleep.
-         */
-        if (current->uid)
-                cap_clear(current->cap_effective);
-        else
-                current->cap_effective = current->cap_permitted;
+        if (!issecure(SECURE_NO_SETUID_FIXUP)) {
+                /*
+                 * Clear the capabilities if we switch to a non-root user
+                 */
+#ifndef CONFIG_SECURITY_FILE_CAPABILITIES
+                /*
+                 * FIXME: There is a race here against sys_capset.  The
+                 * capabilities can change yet we will restore the old
+                 * value below.  We should hold task_capabilities_lock,
+                 * but we cannot because user_path_walk can sleep.
+                 */
+#endif /* ndef CONFIG_SECURITY_FILE_CAPABILITIES */
+                if (current->uid)
+                        old_cap = cap_set_effective(__cap_empty_set);
+                else
+                        old_cap = cap_set_effective(current->cap_permitted);
+        }
 
         res = __user_walk_fd(dfd, filename, LOOKUP_FOLLOW|LOOKUP_ACCESS, &nd);
         if (res)
@@ -478,7 +483,9 @@ out_path_release:
 out:
         current->fsuid = old_fsuid;
         current->fsgid = old_fsgid;
-        current->cap_effective = old_cap;
+
+        if (!issecure(SECURE_NO_SETUID_FIXUP))
+                cap_set_effective(old_cap);
 
         return res;
 }
diff --git a/fs/pipe.c b/fs/pipe.c
index ec228bc9f882..700f4e0d9572 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1003,8 +1003,7 @@ struct file *create_write_pipe(void)
 void free_write_pipe(struct file *f)
 {
         free_pipe_info(f->f_dentry->d_inode);
-        dput(f->f_path.dentry);
-        mntput(f->f_path.mnt);
+        path_put(&f->f_path);
         put_filp(f);
 }
 
@@ -1015,8 +1014,8 @@ struct file *create_read_pipe(struct file *wrf)
                 return ERR_PTR(-ENFILE);
 
         /* Grab pipe from the writer */
-        f->f_path.mnt = mntget(wrf->f_path.mnt);
-        f->f_path.dentry = dget(wrf->f_path.dentry);
+        f->f_path = wrf->f_path;
+        path_get(&wrf->f_path);
         f->f_mapping = wrf->f_path.dentry->d_inode->i_mapping;
 
         f->f_pos = 0;
@@ -1068,8 +1067,7 @@ int do_pipe(int *fd)
  err_fdr:
         put_unused_fd(fdr);
  err_read_pipe:
-        dput(fr->f_dentry);
-        mntput(fr->f_vfsmnt);
+        path_put(&fr->f_path);
         put_filp(fr);
  err_write_pipe:
         free_write_pipe(fw);
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index ab8ccc9d14ff..05053d701ac5 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -476,10 +476,10 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
                 return -ESRCH;
         mm = get_task_mm(task);
         if (mm) {
-                static struct mm_walk clear_refs_walk;
-                memset(&clear_refs_walk, 0, sizeof(clear_refs_walk));
-                clear_refs_walk.pmd_entry = clear_refs_pte_range;
-                clear_refs_walk.mm = mm;
+                struct mm_walk clear_refs_walk = {
+                        .pmd_entry = clear_refs_pte_range,
+                        .mm = mm,
+                };
                 down_read(&mm->mmap_sem);
                 for (vma = mm->mmap; vma; vma = vma->vm_next) {
                         clear_refs_walk.private = vma;
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index ed424d708e69..1d40f2bd1970 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -2165,8 +2165,10 @@ static ssize_t reiserfs_quota_write(struct super_block *sb, int type,
                 blk++;
         }
 out:
-        if (len == towrite)
+        if (len == towrite) {
+                mutex_unlock(&inode->i_mutex);
                 return err;
+        }
         if (inode->i_size < off + len - towrite)
                 i_size_write(inode, off + len - towrite);
         inode->i_version++;
diff --git a/fs/select.c b/fs/select.c
index 8dda969614a9..da0e88201c3a 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -249,7 +249,6 @@ int do_select(int n, fd_set_bits *fds, s64 *timeout)
                                                 retval++;
                                         }
                                 }
-                                cond_resched();
                         }
                         if (res_in)
                                 *rinp = res_in;
@@ -257,6 +256,7 @@ int do_select(int n, fd_set_bits *fds, s64 *timeout)
                                 *routp = res_out;
                         if (res_ex)
                                 *rexp = res_ex;
+                        cond_resched();
                 }
                 wait = NULL;
                 if (retval || !*timeout || signal_pending(current))
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 7a5f69be6ac2..44cc702f96cc 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -682,38 +682,26 @@ static int udf_vrs(struct super_block *sb, int silent)
 /*
  * Check whether there is an anchor block in the given block
  */
-static int udf_check_anchor_block(struct super_block *sb, sector_t block,
-                                        bool varconv)
+static int udf_check_anchor_block(struct super_block *sb, sector_t block)
 {
-        struct buffer_head *bh = NULL;
-        tag *t;
+        struct buffer_head *bh;
         uint16_t ident;
-        uint32_t location;
 
-        if (varconv) {
-                if (udf_fixed_to_variable(block) >=
-                    sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits)
-                        return 0;
-                bh = sb_bread(sb, udf_fixed_to_variable(block));
-        }
-        else
-                bh = sb_bread(sb, block);
+        if (UDF_QUERY_FLAG(sb, UDF_FLAG_VARCONV) &&
+            udf_fixed_to_variable(block) >=
+            sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits)
+                return 0;
 
+        bh = udf_read_tagged(sb, block, block, &ident);
         if (!bh)
                 return 0;
-
-        t = (tag *)bh->b_data;
-        ident = le16_to_cpu(t->tagIdent);
-        location = le32_to_cpu(t->tagLocation);
         brelse(bh);
-        if (ident != TAG_IDENT_AVDP)
-                return 0;
-        return location == block;
+
+        return ident == TAG_IDENT_AVDP;
 }
 
 /* Search for an anchor volume descriptor pointer */
-static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
-                                        sector_t lastblock)
+static sector_t udf_scan_anchors(struct super_block *sb, sector_t lastblock)
 {
         sector_t last[6];
         int i;
@@ -739,7 +727,7 @@ static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
                                 sb->s_blocksize_bits)
                         continue;
 
-                if (udf_check_anchor_block(sb, last[i], varconv)) {
+                if (udf_check_anchor_block(sb, last[i])) {
                         sbi->s_anchor[0] = last[i];
                         sbi->s_anchor[1] = last[i] - 256;
                         return last[i];
@@ -748,17 +736,17 @@ static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
                 if (last[i] < 256)
                         continue;
 
-                if (udf_check_anchor_block(sb, last[i] - 256, varconv)) {
+                if (udf_check_anchor_block(sb, last[i] - 256)) {
                         sbi->s_anchor[1] = last[i] - 256;
                         return last[i];
                 }
         }
 
-        if (udf_check_anchor_block(sb, sbi->s_session + 256, varconv)) {
+        if (udf_check_anchor_block(sb, sbi->s_session + 256)) {
                 sbi->s_anchor[0] = sbi->s_session + 256;
                 return last[0];
         }
-        if (udf_check_anchor_block(sb, sbi->s_session + 512, varconv)) {
+        if (udf_check_anchor_block(sb, sbi->s_session + 512)) {
                 sbi->s_anchor[0] = sbi->s_session + 512;
                 return last[0];
         }
@@ -780,23 +768,24 @@ static void udf_find_anchor(struct super_block *sb)
         int i;
         struct udf_sb_info *sbi = UDF_SB(sb);
 
-        lastblock = udf_scan_anchors(sb, 0, sbi->s_last_block);
+        lastblock = udf_scan_anchors(sb, sbi->s_last_block);
         if (lastblock)
                 goto check_anchor;
 
         /* No anchor found? Try VARCONV conversion of block numbers */
+        UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
         /* Firstly, we try to not convert number of the last block */
-        lastblock = udf_scan_anchors(sb, 1,
+        lastblock = udf_scan_anchors(sb,
                                 udf_variable_to_fixed(sbi->s_last_block));
-        if (lastblock) {
-                UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
+        if (lastblock)
                 goto check_anchor;
-        }
 
         /* Secondly, we try with converted number of the last block */
-        lastblock = udf_scan_anchors(sb, 1, sbi->s_last_block);
-        if (lastblock)
-                UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
+        lastblock = udf_scan_anchors(sb, sbi->s_last_block);
+        if (!lastblock) {
+                /* VARCONV didn't help. Clear it. */
+                UDF_CLEAR_FLAG(sb, UDF_FLAG_VARCONV);
+        }
 
 check_anchor:
         /*
diff --git a/fs/utimes.c b/fs/utimes.c
index af059d5cb485..b6b664e7145e 100644
--- a/fs/utimes.c
+++ b/fs/utimes.c
@@ -40,14 +40,9 @@ asmlinkage long sys_utime(char __user *filename, struct utimbuf __user *times)
 
 #endif
 
-static bool nsec_special(long nsec)
-{
-        return nsec == UTIME_OMIT || nsec == UTIME_NOW;
-}
-
 static bool nsec_valid(long nsec)
 {
-        if (nsec_special(nsec))
+        if (nsec == UTIME_OMIT || nsec == UTIME_NOW)
                 return true;
 
         return nsec >= 0 && nsec <= 999999999;
@@ -102,7 +97,11 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
         if (error)
                 goto dput_and_out;
 
-        /* Don't worry, the checks are done in inode_change_ok() */
+        if (times && times[0].tv_nsec == UTIME_NOW &&
+                     times[1].tv_nsec == UTIME_NOW)
+                times = NULL;
+
+        /* In most cases, the checks are done in inode_change_ok() */
         newattrs.ia_valid = ATTR_CTIME | ATTR_MTIME | ATTR_ATIME;
         if (times) {
                 error = -EPERM;
@@ -124,28 +123,34 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
                         newattrs.ia_mtime.tv_nsec = times[1].tv_nsec;
                         newattrs.ia_valid |= ATTR_MTIME_SET;
                 }
-        }
 
-        /*
-         * If times is NULL or both times are either UTIME_OMIT or
-         * UTIME_NOW, then need to check permissions, because
-         * inode_change_ok() won't do it.
-         */
-        if (!times || (nsec_special(times[0].tv_nsec) &&
-                       nsec_special(times[1].tv_nsec))) {
+                /*
+                 * For the UTIME_OMIT/UTIME_NOW and UTIME_NOW/UTIME_OMIT
+                 * cases, we need to make an extra check that is not done by
+                 * inode_change_ok().
+                 */
+                if (((times[0].tv_nsec == UTIME_NOW &&
+                            times[1].tv_nsec == UTIME_OMIT)
+                     ||
+                     (times[0].tv_nsec == UTIME_OMIT &&
+                            times[1].tv_nsec == UTIME_NOW))
+                    && !is_owner_or_cap(inode))
+                        goto mnt_drop_write_and_out;
+        } else {
+
+                /*
+                 * If times is NULL (or both times are UTIME_NOW),
+                 * then we need to check permissions, because
+                 * inode_change_ok() won't do it.
+                 */
                 error = -EACCES;
                 if (IS_IMMUTABLE(inode))
                         goto mnt_drop_write_and_out;
 
                 if (!is_owner_or_cap(inode)) {
-                        if (f) {
-                                if (!(f->f_mode & FMODE_WRITE))
-                                        goto mnt_drop_write_and_out;
-                        } else {
-                                error = vfs_permission(&nd, MAY_WRITE);
-                                if (error)
-                                        goto mnt_drop_write_and_out;
-                        }
+                        error = permission(inode, MAY_WRITE, NULL);
+                        if (error)
+                                goto mnt_drop_write_and_out;
                 }
         }
         mutex_lock(&inode->i_mutex);
@@ -169,14 +174,6 @@ asmlinkage long sys_utimensat(int dfd, char __user *filename, struct timespec __
         if (utimes) {
                 if (copy_from_user(&tstimes, utimes, sizeof(tstimes)))
                         return -EFAULT;
-                if ((tstimes[0].tv_nsec == UTIME_OMIT ||
-                     tstimes[0].tv_nsec == UTIME_NOW) &&
-                    tstimes[0].tv_sec != 0)
-                        return -EINVAL;
-                if ((tstimes[1].tv_nsec == UTIME_OMIT ||
-                     tstimes[1].tv_nsec == UTIME_NOW) &&
-                    tstimes[1].tv_sec != 0)
-                        return -EINVAL;
 
                 /* Nothing to do, we must not even check the path.  */
                 if (tstimes[0].tv_nsec == UTIME_OMIT &&