19 files changed, 125 insertions, 58 deletions

diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index 873cd31baa47..15cce53bf61e 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -40,6 +40,24 @@
 #include "fid.h"
 
 /**
+ * struct p9_rdir - readdir accounting
+ * @mutex: mutex protecting readdir
+ * @head: start offset of current dirread buffer
+ * @tail: end offset of current dirread buffer
+ * @buf: dirread buffer
+ *
+ * private structure for keeping track of readdir
+ * allocated on demand
+ */
+
+struct p9_rdir {
+        struct mutex mutex;
+        int head;
+        int tail;
+        uint8_t *buf;
+};
+
+/**
  * dt_type - return file type
  * @mistat: mistat structure
  *
@@ -70,56 +88,79 @@ static int v9fs_dir_readdir(struct file *filp, void *dirent, filldir_t filldir)
 {
         int over;
         struct p9_wstat st;
-        int err;
+        int err = 0;
         struct p9_fid *fid;
         int buflen;
-        char *statbuf;
-        int n, i = 0;
+        int reclen = 0;
+        struct p9_rdir *rdir;
 
         P9_DPRINTK(P9_DEBUG_VFS, "name %s\n", filp->f_path.dentry->d_name.name);
         fid = filp->private_data;
 
         buflen = fid->clnt->msize - P9_IOHDRSZ;
-        statbuf = kmalloc(buflen, GFP_KERNEL);
-        if (!statbuf)
-                return -ENOMEM;
-
-        while (1) {
-                err = v9fs_file_readn(filp, statbuf, NULL, buflen,
-                                                                fid->rdir_fpos);
-                if (err <= 0)
-                        break;
-
-                n = err;
-                while (i < n) {
-                        err = p9stat_read(statbuf + i, buflen-i, &st,
-                                                        fid->clnt->dotu);
+
+        /* allocate rdir on demand */
+        if (!fid->rdir) {
+                rdir = kmalloc(sizeof(struct p9_rdir) + buflen, GFP_KERNEL);
+
+                if (rdir == NULL) {
+                        err = -ENOMEM;
+                        goto exit;
+                }
+                spin_lock(&filp->f_dentry->d_lock);
+                if (!fid->rdir) {
+                        rdir->buf = (uint8_t *)rdir + sizeof(struct p9_rdir);
+                        mutex_init(&rdir->mutex);
+                        rdir->head = rdir->tail = 0;
+                        fid->rdir = (void *) rdir;
+                        rdir = NULL;
+                }
+                spin_unlock(&filp->f_dentry->d_lock);
+                kfree(rdir);
+        }
+        rdir = (struct p9_rdir *) fid->rdir;
+
+        err = mutex_lock_interruptible(&rdir->mutex);
+        while (err == 0) {
+                if (rdir->tail == rdir->head) {
+                        err = v9fs_file_readn(filp, rdir->buf, NULL,
+                                                        buflen, filp->f_pos);
+                        if (err <= 0)
+                                goto unlock_and_exit;
+
+                        rdir->head = 0;
+                        rdir->tail = err;
+                }
+
+                while (rdir->head < rdir->tail) {
+                        err = p9stat_read(rdir->buf + rdir->head,
+                                                buflen - rdir->head, &st,
+                                                fid->clnt->dotu);
                         if (err) {
                                 P9_DPRINTK(P9_DEBUG_VFS, "returned %d\n", err);
                                 err = -EIO;
                                 p9stat_free(&st);
-                                goto free_and_exit;
+                                goto unlock_and_exit;
                         }
-
-                        i += st.size+2;
-                        fid->rdir_fpos += st.size+2;
+                        reclen = st.size+2;
 
                         over = filldir(dirent, st.name, strlen(st.name),
                             filp->f_pos, v9fs_qid2ino(&st.qid), dt_type(&st));
 
-                        filp->f_pos += st.size+2;
-
                         p9stat_free(&st);
 
                         if (over) {
                                 err = 0;
-                                goto free_and_exit;
+                                goto unlock_and_exit;
                         }
+                        rdir->head += reclen;
+                        filp->f_pos += reclen;
                 }
         }
 
-free_and_exit:
-        kfree(statbuf);
+unlock_and_exit:
+        mutex_unlock(&rdir->mutex);
+exit:
         return err;
 }
 
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 5947628aefef..18f74ec4dce9 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -994,8 +994,7 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
         P9_DPRINTK(P9_DEBUG_VFS,
                 "%s -> %s (%s)\n", dentry->d_name.name, st->extension, buffer);
 
-        retval = buflen;
-
+        retval = strnlen(buffer, buflen);
 done:
         kfree(st);
         return retval;
@@ -1062,7 +1061,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
                         __putname(link);
                         link = ERR_PTR(len);
                 } else
-                        link[len] = 0;
+                        link[min(len, PATH_MAX-1)] = 0;
         }
         nd_set_link(nd, link);
 
diff --git a/fs/Kconfig b/fs/Kconfig
index d4bf8caad8d0..2126078a38ed 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -135,8 +135,8 @@ config TMPFS_POSIX_ACL
 
 config HUGETLBFS
         bool "HugeTLB file system support"
-        depends on X86 || IA64 || PPC64 || SPARC64 || (SUPERH && MMU) || \
-                   (S390 && 64BIT) || SYS_SUPPORTS_HUGETLBFS || BROKEN
+        depends on X86 || IA64 || PPC_BOOK3S_64 || SPARC64 || (S390 && 64BIT) || \
+                   SYS_SUPPORTS_HUGETLBFS || BROKEN
         help
           hugetlbfs is a filesystem backing for HugeTLB pages, based on
           ramfs. For architectures that support it, say Y here and read
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 9cf4b926f8e4..8bed0557d88c 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1248,8 +1248,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                         bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9);
                 }
         } else {
-                put_disk(disk);
                 module_put(disk->fops->owner);
+                put_disk(disk);
                 disk = NULL;
                 if (bdev->bd_contains == bdev) {
                         if (bdev->bd_disk->fops->open) {
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 43003e0bef18..b09098079916 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1577,7 +1577,8 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
 
 out_err:
         if (tcp_ses) {
-                kfree(tcp_ses->hostname);
+                if (!IS_ERR(tcp_ses->hostname))
+                        kfree(tcp_ses->hostname);
                 if (tcp_ses->ssocket)
                         sock_release(tcp_ses->ssocket);
                 kfree(tcp_ses);
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 984ca0cb38c3..00d153f2f261 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -743,6 +743,7 @@ struct ext4_inode_info {
 #define EXT4_MOUNT_QUOTA                0x80000 /* Some quota option set */
 #define EXT4_MOUNT_USRQUOTA             0x100000 /* "old" user quota */
 #define EXT4_MOUNT_GRPQUOTA             0x200000 /* "old" group quota */
+#define EXT4_MOUNT_JOURNAL_CHECKSUM     0x800000 /* Journal checksums */
 #define EXT4_MOUNT_JOURNAL_ASYNC_COMMIT 0x1000000 /* Journal Async Commit */
 #define EXT4_MOUNT_I_VERSION            0x2000000 /* i_version support */
 #define EXT4_MOUNT_DELALLOC             0x8000000 /* Delalloc support */
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 312211ee05af..d4ca92aab514 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1300,9 +1300,11 @@ static int parse_options(char *options, struct super_block *sb,
                         *journal_devnum = option;
                         break;
                 case Opt_journal_checksum:
-                        break;  /* Kept for backwards compatibility */
+                        set_opt(sbi->s_mount_opt, JOURNAL_CHECKSUM);
+                        break;
                 case Opt_journal_async_commit:
                         set_opt(sbi->s_mount_opt, JOURNAL_ASYNC_COMMIT);
+                        set_opt(sbi->s_mount_opt, JOURNAL_CHECKSUM);
                         break;
                 case Opt_noload:
                         set_opt(sbi->s_mount_opt, NOLOAD);
@@ -2759,14 +2761,20 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                 goto failed_mount4;
         }
 
-        jbd2_journal_set_features(sbi->s_journal,
-                                  JBD2_FEATURE_COMPAT_CHECKSUM, 0, 0);
-        if (test_opt(sb, JOURNAL_ASYNC_COMMIT))
-                jbd2_journal_set_features(sbi->s_journal, 0, 0,
+        if (test_opt(sb, JOURNAL_ASYNC_COMMIT)) {
+                jbd2_journal_set_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0,
                                 JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
-        else
+        } else if (test_opt(sb, JOURNAL_CHECKSUM)) {
+                jbd2_journal_set_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0, 0);
                 jbd2_journal_clear_features(sbi->s_journal, 0, 0,
                                 JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
+        } else {
+                jbd2_journal_clear_features(sbi->s_journal,
+                                JBD2_FEATURE_COMPAT_CHECKSUM, 0,
+                                JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT);
+        }
 
         /* We have now updated the journal if required, so we can
          * validate the data journaling mode. */
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 9b9d6395bad3..052f214ea6f0 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -58,6 +58,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         }
         unlock_new_inode(tree->inode);
 
+        if (!HFS_I(tree->inode)->first_blocks) {
+                printk(KERN_ERR "hfs: invalid btree extent records (0 size).\n");
+                goto free_inode;
+        }
+
         mapping = tree->inode->i_mapping;
         page = read_mapping_page(mapping, 0, NULL);
         if (IS_ERR(page))
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 175d08eacc86..bed78ac8f6d1 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -99,6 +99,10 @@ int hfsplus_read_wrapper(struct super_block *sb)
 
         if (hfsplus_get_last_session(sb, &part_start, &part_size))
                 return -EINVAL;
+        if ((u64)part_start + part_size > 0x100000000ULL) {
+                pr_err("hfs: volumes larger than 2TB are not supported yet\n");
+                return -EINVAL;
+        }
         while (1) {
                 bh = sb_bread512(sb, part_start + HFSPLUS_VOLHEAD_SECTOR, vhdr);
                 if (!bh)
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 32062c33c859..7cb298525eef 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1536,6 +1536,8 @@ nfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry)
                 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
                 dentry->d_parent->d_name.name, dentry->d_name.name);
 
+        nfs_inode_return_delegation(inode);
+
         d_drop(dentry);
         error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name);
         if (error == 0) {
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 6c3210099d51..e1d415e97849 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -457,6 +457,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
         };
         struct rpc_task_setup task_setup_data = {
                 .rpc_client = NFS_CLIENT(inode),
+                .rpc_message = &msg,
                 .callback_ops = &nfs_write_direct_ops,
                 .workqueue = nfsiod_workqueue,
                 .flags = RPC_TASK_ASYNC,
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ed7c269e2514..ff37454fa783 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -72,12 +72,17 @@ static int _nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle,
 /* Prevent leaks of NFSv4 errors into userland */
 static int nfs4_map_errors(int err)
 {
-        if (err < -1000) {
+        if (err >= -1000)
+                return err;
+        switch (err) {
+        case -NFS4ERR_RESOURCE:
+                return -EREMOTEIO;
+        default:
                 dprintk("%s could not handle NFSv4 error %d\n",
                                 __func__, -err);
-                return -EIO;
+                break;
         }
-        return err;
+        return -EIO;
 }
 
 /*
@@ -3060,9 +3065,6 @@ static void nfs4_renew_done(struct rpc_task *task, void *data)
         if (time_before(clp->cl_last_renewal,timestamp))
                 clp->cl_last_renewal = timestamp;
         spin_unlock(&clp->cl_lock);
-        dprintk("%s calling put_rpccred on rpc_cred %p\n", __func__,
-                                task->tk_msg.rpc_cred);
-        put_rpccred(task->tk_msg.rpc_cred);
 }
 
 static const struct rpc_call_ops nfs4_renew_ops = {
@@ -4877,7 +4879,6 @@ void nfs41_sequence_call_done(struct rpc_task *task, void *data)
         nfs41_sequence_free_slot(clp, task->tk_msg.rpc_resp);
         dprintk("%s rpc_cred %p\n", __func__, task->tk_msg.rpc_cred);
 
-        put_rpccred(task->tk_msg.rpc_cred);
         kfree(task->tk_msg.rpc_argp);
         kfree(task->tk_msg.rpc_resp);
 
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 83ad47cbdd8a..20b4e30e6c82 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -5681,7 +5681,6 @@ static struct {
         { NFS4ERR_SERVERFAULT,  -ESERVERFAULT   },
         { NFS4ERR_BADTYPE,      -EBADTYPE       },
         { NFS4ERR_LOCKED,       -EAGAIN         },
-        { NFS4ERR_RESOURCE,     -EREMOTEIO      },
         { NFS4ERR_SYMLINK,      -ELOOP          },
         { NFS4ERR_OP_ILLEGAL,   -EOPNOTSUPP     },
         { NFS4ERR_DEADLOCK,     -EDEADLK        },
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index 5941958f1e47..84c25382f8e3 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -87,6 +87,7 @@ int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,
                         brelse(bh);
                         BUG();
                 }
+                memset(bh->b_data, 0, 1 << inode->i_blkbits);
                 bh->b_bdev = NILFS_I_NILFS(inode)->ns_bdev;
                 bh->b_blocknr = blocknr;
                 set_buffer_mapped(bh);
@@ -276,8 +277,7 @@ void nilfs_btnode_commit_change_key(struct address_space *btnc,
                                        "invalid oldkey %lld (newkey=%lld)",
                                        (unsigned long long)oldkey,
                                        (unsigned long long)newkey);
-                if (!test_set_buffer_dirty(obh) && TestSetPageDirty(opage))
-                        BUG();
+                nilfs_btnode_mark_dirty(obh);
 
                 spin_lock_irq(&btnc->tree_lock);
                 radix_tree_delete(&btnc->page_tree, oldkey);
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 683df89dbae5..6eff66a070d5 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2468,17 +2468,22 @@ static void nilfs_segctor_notify(struct nilfs_sc_info *sci,
         /* Clear requests (even when the construction failed) */
         spin_lock(&sci->sc_state_lock);
 
-        sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
-
         if (req->mode == SC_LSEG_SR) {
+                sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
                 sci->sc_seq_done = req->seq_accepted;
                 nilfs_segctor_wakeup(sci, req->sc_err ? : req->sb_err);
                 sci->sc_flush_request = 0;
-        } else if (req->mode == SC_FLUSH_FILE)
-                sci->sc_flush_request &= ~FLUSH_FILE_BIT;
-        else if (req->mode == SC_FLUSH_DAT)
-                sci->sc_flush_request &= ~FLUSH_DAT_BIT;
+        } else {
+                if (req->mode == SC_FLUSH_FILE)
+                        sci->sc_flush_request &= ~FLUSH_FILE_BIT;
+                else if (req->mode == SC_FLUSH_DAT)
+                        sci->sc_flush_request &= ~FLUSH_DAT_BIT;
 
+                /* re-enable timer if checkpoint creation was not done */
+                if (sci->sc_timer && (sci->sc_state & NILFS_SEGCTOR_COMMIT) &&
+                    time_before(jiffies, sci->sc_timer->expires))
+                        add_timer(sci->sc_timer);
+        }
         spin_unlock(&sci->sc_state_lock);
 }
 
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index c7bff4f603ff..a65239cfd97e 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -99,7 +99,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
                 "VmallocUsed:    %8lu kB\n"
                 "VmallocChunk:   %8lu kB\n"
 #ifdef CONFIG_MEMORY_FAILURE
-                "HardwareCorrupted: %8lu kB\n"
+                "HardwareCorrupted: %5lu kB\n"
 #endif
                 ,
                 K(i.totalram),
diff --git a/fs/xfs/linux-2.6/xfs_quotaops.c b/fs/xfs/linux-2.6/xfs_quotaops.c
index 9e41f91aa269..3d4a0c84d634 100644
--- a/fs/xfs/linux-2.6/xfs_quotaops.c
+++ b/fs/xfs/linux-2.6/xfs_quotaops.c
@@ -80,7 +80,7 @@ xfs_fs_set_xstate(
 
         if (sb->s_flags & MS_RDONLY)
                 return -EROFS;
-        if (!XFS_IS_QUOTA_RUNNING(mp))
+        if (op != Q_XQUOTARM && !XFS_IS_QUOTA_RUNNING(mp))
                 return -ENOSYS;
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 4e4276b956e8..5d1a3b98a6e6 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -876,7 +876,6 @@ xfs_dqrele_inode(
                 ip->i_gdquot = NULL;
         }
         xfs_iput(ip, XFS_ILOCK_EXCL);
-        IRELE(ip);
 
         return 0;
 }
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index ab64f3efb43b..0785797db828 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -880,6 +880,7 @@ nextag:
                                  * Not in range - save last search
                                  * location and allocate a new inode
                                  */
+                                xfs_btree_del_cursor(tcur, XFS_BTREE_NOERROR);
                                 pag->pagl_leftrec = trec.ir_startino;
                                 pag->pagl_rightrec = rec.ir_startino;
                                 pag->pagl_pagino = pagino;