28 files changed, 245 insertions, 101 deletions

diff --git a/fs/aio.c b/fs/aio.c
index b74c567383bc..6af921940622 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -996,6 +996,14 @@ put_rq:
         /* everything turned out well, dispose of the aiocb. */
         ret = __aio_put_req(ctx, iocb);
 
+        /*
+         * We have to order our ring_info tail store above and test
+         * of the wait list below outside the wait lock.  This is
+         * like in wake_up_bit() where clearing a bit has to be
+         * ordered with the unlocked test.
+         */
+        smp_mb();
+
         if (waitqueue_active(&ctx->wait))
                 wake_up(&ctx->wait);
 
diff --git a/fs/bio.c b/fs/bio.c
index 3312fcc3c098..553b5b7960ad 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -1194,6 +1194,8 @@ EXPORT_SYMBOL(bio_hw_segments);
 EXPORT_SYMBOL(bio_add_page);
 EXPORT_SYMBOL(bio_add_pc_page);
 EXPORT_SYMBOL(bio_get_nr_vecs);
+EXPORT_SYMBOL(bio_map_user);
+EXPORT_SYMBOL(bio_unmap_user);
 EXPORT_SYMBOL(bio_map_kern);
 EXPORT_SYMBOL(bio_pair_release);
 EXPORT_SYMBOL(bio_split);
diff --git a/fs/buffer.c b/fs/buffer.c
index ddfdd2c80bf9..7ba58386beee 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -3213,7 +3213,7 @@ static int buffer_cpu_notify(struct notifier_block *self,
 }
 
 /**
- * bh_uptodate_or_lock: Test whether the buffer is uptodate
+ * bh_uptodate_or_lock - Test whether the buffer is uptodate
  * @bh: struct buffer_head
  *
  * Return true if the buffer is up-to-date and false,
@@ -3232,7 +3232,7 @@ int bh_uptodate_or_lock(struct buffer_head *bh)
 EXPORT_SYMBOL(bh_uptodate_or_lock);
 
 /**
- * bh_submit_read: Submit a locked buffer for reading
+ * bh_submit_read - Submit a locked buffer for reading
  * @bh: struct buffer_head
  *
  * Returns zero on success and -EIO on error.
diff --git a/fs/dquot.c b/fs/dquot.c
index 9c7feb62eed1..41b9dbd68b0e 100644
--- a/fs/dquot.c
+++ b/fs/dquot.c
@@ -1522,8 +1522,8 @@ int vfs_quota_off(struct super_block *sb, int type)
                                 truncate_inode_pages(&toputinode[cnt]->i_data, 0);
                                 mutex_unlock(&toputinode[cnt]->i_mutex);
                                 mark_inode_dirty(toputinode[cnt]);
-                                iput(toputinode[cnt]);
                         }
+                        iput(toputinode[cnt]);
                         mutex_unlock(&dqopt->dqonoff_mutex);
                 }
         if (sb->s_bdev)
diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
index 841a032050a7..5e596583946c 100644
--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -80,8 +80,8 @@ static void ecryptfs_d_release(struct dentry *dentry)
 {
         if (ecryptfs_dentry_to_private(dentry)) {
                 if (ecryptfs_dentry_to_lower(dentry)) {
-                        mntput(ecryptfs_dentry_to_lower_mnt(dentry));
                         dput(ecryptfs_dentry_to_lower(dentry));
+                        mntput(ecryptfs_dentry_to_lower_mnt(dentry));
                 }
                 kmem_cache_free(ecryptfs_dentry_info_cache,
                                 ecryptfs_dentry_to_private(dentry));
diff --git a/fs/ext3/acl.c b/fs/ext3/acl.c
index d34e9967430a..a754d1848173 100644
--- a/fs/ext3/acl.c
+++ b/fs/ext3/acl.c
@@ -37,7 +37,7 @@ ext3_acl_from_disk(const void *value, size_t size)
                 return ERR_PTR(-EINVAL);
         if (count == 0)
                 return NULL;
-        acl = posix_acl_alloc(count, GFP_KERNEL);
+        acl = posix_acl_alloc(count, GFP_NOFS);
         if (!acl)
                 return ERR_PTR(-ENOMEM);
         for (n=0; n < count; n++) {
@@ -91,7 +91,7 @@ ext3_acl_to_disk(const struct posix_acl *acl, size_t *size)
 
         *size = ext3_acl_size(acl->a_count);
         ext_acl = kmalloc(sizeof(ext3_acl_header) + acl->a_count *
-                        sizeof(ext3_acl_entry), GFP_KERNEL);
+                        sizeof(ext3_acl_entry), GFP_NOFS);
         if (!ext_acl)
                 return ERR_PTR(-ENOMEM);
         ext_acl->a_version = cpu_to_le32(EXT3_ACL_VERSION);
@@ -187,7 +187,7 @@ ext3_get_acl(struct inode *inode, int type)
         }
         retval = ext3_xattr_get(inode, name_index, "", NULL, 0);
         if (retval > 0) {
-                value = kmalloc(retval, GFP_KERNEL);
+                value = kmalloc(retval, GFP_NOFS);
                 if (!value)
                         return ERR_PTR(-ENOMEM);
                 retval = ext3_xattr_get(inode, name_index, "", value, retval);
@@ -335,7 +335,7 @@ ext3_init_acl(handle_t *handle, struct inode *inode, struct inode *dir)
                         if (error)
                                 goto cleanup;
                 }
-                clone = posix_acl_clone(acl, GFP_KERNEL);
+                clone = posix_acl_clone(acl, GFP_NOFS);
                 error = -ENOMEM;
                 if (!clone)
                         goto cleanup;
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 9397d779c43d..0e97b6e07cb0 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -485,7 +485,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
                 goto exit_dindj;
 
         n_group_desc = kmalloc((gdb_num + 1) * sizeof(struct buffer_head *),
-                        GFP_KERNEL);
+                        GFP_NOFS);
         if (!n_group_desc) {
                 err = -ENOMEM;
                 ext3_warning (sb, __FUNCTION__,
@@ -568,7 +568,7 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
         int res, i;
         int err;
 
-        primary = kmalloc(reserved_gdb * sizeof(*primary), GFP_KERNEL);
+        primary = kmalloc(reserved_gdb * sizeof(*primary), GFP_NOFS);
         if (!primary)
                 return -ENOMEM;
 
diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
index fb89c299bece..a6ea4d6a8bb2 100644
--- a/fs/ext3/xattr.c
+++ b/fs/ext3/xattr.c
@@ -728,7 +728,7 @@ ext3_xattr_block_set(handle_t *handle, struct inode *inode,
                                 ce = NULL;
                         }
                         ea_bdebug(bs->bh, "cloning");
-                        s->base = kmalloc(bs->bh->b_size, GFP_KERNEL);
+                        s->base = kmalloc(bs->bh->b_size, GFP_NOFS);
                         error = -ENOMEM;
                         if (s->base == NULL)
                                 goto cleanup;
@@ -740,7 +740,7 @@ ext3_xattr_block_set(handle_t *handle, struct inode *inode,
                 }
         } else {
                 /* Allocate a buffer where we construct the new block. */
-                s->base = kzalloc(sb->s_blocksize, GFP_KERNEL);
+                s->base = kzalloc(sb->s_blocksize, GFP_NOFS);
                 /* assert(header == s->base) */
                 error = -ENOMEM;
                 if (s->base == NULL)
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index c0076077d338..06557679ca41 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -751,7 +751,7 @@ int generic_osync_inode(struct inode *inode, struct address_space *mapping, int
 EXPORT_SYMBOL(generic_osync_inode);
 
 /**
- * writeback_acquire: attempt to get exclusive writeback access to a device
+ * writeback_acquire - attempt to get exclusive writeback access to a device
  * @bdi: the device's backing_dev_info structure
  *
  * It is a waste of resources to have more than one pdflush thread blocked on
@@ -768,7 +768,7 @@ int writeback_acquire(struct backing_dev_info *bdi)
 }
 
 /**
- * writeback_in_progress: determine whether there is writeback in progress
+ * writeback_in_progress - determine whether there is writeback in progress
  * @bdi: the device's backing_dev_info structure.
  *
  * Determine whether there is writeback in progress against a backing device.
@@ -779,7 +779,7 @@ int writeback_in_progress(struct backing_dev_info *bdi)
 }
 
 /**
- * writeback_release: relinquish exclusive writeback access against a device.
+ * writeback_release - relinquish exclusive writeback access against a device.
  * @bdi: the device's backing_dev_info structure
  */
 void writeback_release(struct backing_dev_info *bdi)
diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
index 878bf25dbc6a..92fb358ce824 100644
--- a/fs/hfs/brec.c
+++ b/fs/hfs/brec.c
@@ -229,7 +229,7 @@ skip:
 static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
 {
         struct hfs_btree *tree;
-        struct hfs_bnode *node, *new_node;
+        struct hfs_bnode *node, *new_node, *next_node;
         struct hfs_bnode_desc node_desc;
         int num_recs, new_rec_off, new_off, old_rec_off;
         int data_start, data_end, size;
@@ -248,6 +248,17 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
         new_node->type = node->type;
         new_node->height = node->height;
 
+        if (node->next)
+                next_node = hfs_bnode_find(tree, node->next);
+        else
+                next_node = NULL;
+
+        if (IS_ERR(next_node)) {
+                hfs_bnode_put(node);
+                hfs_bnode_put(new_node);
+                return next_node;
+        }
+
         size = tree->node_size / 2 - node->num_recs * 2 - 14;
         old_rec_off = tree->node_size - 4;
         num_recs = 1;
@@ -261,6 +272,8 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
                 /* panic? */
                 hfs_bnode_put(node);
                 hfs_bnode_put(new_node);
+                if (next_node)
+                        hfs_bnode_put(next_node);
                 return ERR_PTR(-ENOSPC);
         }
 
@@ -315,8 +328,7 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
         hfs_bnode_write(node, &node_desc, 0, sizeof(node_desc));
 
         /* update next bnode header */
-        if (new_node->next) {
-                struct hfs_bnode *next_node = hfs_bnode_find(tree, new_node->next);
+        if (next_node) {
                 next_node->prev = new_node->this;
                 hfs_bnode_read(next_node, &node_desc, 0, sizeof(node_desc));
                 node_desc.prev = cpu_to_be32(next_node->prev);
diff --git a/fs/isofs/compress.c b/fs/isofs/compress.c
index 37dbd6404787..defb932eee9a 100644
--- a/fs/isofs/compress.c
+++ b/fs/isofs/compress.c
@@ -72,6 +72,17 @@ static int zisofs_readpage(struct file *file, struct page *page)
         offset = index & ~zisofs_block_page_mask;
         blockindex = offset >> zisofs_block_page_shift;
         maxpage = (inode->i_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+
+        /*
+         * If this page is wholly outside i_size we just return zero;
+         * do_generic_file_read() will handle this for us
+         */
+        if (page->index >= maxpage) {
+                SetPageUptodate(page);
+                unlock_page(page);
+                return 0;
+        }
+
         maxpage = min(zisofs_block_pages, maxpage-offset);
 
         for ( i = 0 ; i < maxpage ; i++, offset++ ) {
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 3943a8905eb2..9816293442ab 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -697,13 +697,14 @@ fail:
  */
 
 /**
- *  journal_t * journal_init_dev() - creates an initialises a journal structure
+ *  journal_t * journal_init_dev() - creates and initialises a journal structure
  *  @bdev: Block device on which to create the journal
  *  @fs_dev: Device which hold journalled filesystem for this journal.
  *  @start: Block nr Start of journal.
  *  @len:  Length of the journal in blocks.
  *  @blocksize: blocksize of journalling device
- *  @returns: a newly created journal_t *
+ *
+ *  Returns: a newly created journal_t *
  *
  *  journal_init_dev creates a journal which maps a fixed contiguous
  *  range of blocks on an arbitrary block device.
diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
index 2b8edf4d6eaa..43bc5e5ed064 100644
--- a/fs/jbd/recovery.c
+++ b/fs/jbd/recovery.c
@@ -478,7 +478,7 @@ static int do_one_pass(journal_t *journal,
                                         memcpy(nbh->b_data, obh->b_data,
                                                         journal->j_blocksize);
                                         if (flags & JFS_FLAG_ESCAPE) {
-                                                *((__be32 *)bh->b_data) =
+                                                *((__be32 *)nbh->b_data) =
                                                 cpu_to_be32(JFS_MAGIC_NUMBER);
                                         }
 
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index c6cbb6cd59b2..2c9e8f5d13aa 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -1426,7 +1426,8 @@ int journal_stop(handle_t *handle)
         return err;
 }
 
-/**int journal_force_commit() - force any uncommitted transactions
+/**
+ * int journal_force_commit() - force any uncommitted transactions
  * @journal: journal to force
  *
  * For synchronous operations: force any uncommitted transactions
@@ -1903,13 +1904,12 @@ zap_buffer_unlocked:
 }
 
 /**
- * void journal_invalidatepage()
- * @journal: journal to use for flush...
+ * void journal_invalidatepage() - invalidate a journal page
+ * @journal: journal to use for flush
  * @page:    page to flush
  * @offset:  length of page to invalidate.
  *
  * Reap page buffers containing data after offset in page.
- *
  */
 void journal_invalidatepage(journal_t *journal,
                       struct page *page,
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 146411387ada..5d0405a9e7ca 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -535,7 +535,7 @@ static int do_one_pass(journal_t *journal,
                                         memcpy(nbh->b_data, obh->b_data,
                                                         journal->j_blocksize);
                                         if (flags & JBD2_FLAG_ESCAPE) {
-                                                *((__be32 *)bh->b_data) =
+                                                *((__be32 *)nbh->b_data) =
                                                 cpu_to_be32(JBD2_MAGIC_NUMBER);
                                         }
 
diff --git a/fs/locks.c b/fs/locks.c
index f36f0e61558d..d83fab1b77b5 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1275,13 +1275,13 @@ out:
 EXPORT_SYMBOL(__break_lease);
 
 /**
- *      lease_get_mtime
+ *      lease_get_mtime - get the last modified time of an inode
  *      @inode: the inode
  *      @time:  pointer to a timespec which will contain the last modified time
  *
  * This is to force NFS clients to flush their caches for files with
  * exclusive leases.  The justification is that if someone has an
- * exclusive lease, then they could be modifiying it.
+ * exclusive lease, then they could be modifying it.
  */
 void lease_get_mtime(struct inode *inode, struct timespec *time)
 {
diff --git a/fs/namei.c b/fs/namei.c
index 941c8e8228c0..6b7a0eef4090 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1364,13 +1364,13 @@ static int __lookup_one_len(const char *name, struct qstr *this,
 }
 
 /**
- * lookup_one_len:  filesystem helper to lookup single pathname component
+ * lookup_one_len - filesystem helper to lookup single pathname component
  * @name:       pathname component to lookup
  * @base:       base directory to lookup from
  * @len:        maximum length @len should be interpreted to
  *
- * Note that this routine is purely a helper for filesystem useage and should
- * not be called by generic code.  Also note that by using this function to
+ * Note that this routine is purely a helper for filesystem usage and should
+ * not be called by generic code.  Also note that by using this function the
  * nameidata argument is passed to the filesystem methods and a filesystem
  * using this helper needs to be prepared for that.
  */
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 3d7d9631e125..5a70be589bbe 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -533,7 +533,10 @@ readpage_async_filler(void *data, struct page *page)
 
         if (len < PAGE_CACHE_SIZE)
                 zero_user_segment(page, len, PAGE_CACHE_SIZE);
-        nfs_pageio_add_request(desc->pgio, new);
+        if (!nfs_pageio_add_request(desc->pgio, new)) {
+                error = desc->pgio->pg_error;
+                goto out_unlock;
+        }
         return 0;
 out_error:
         error = PTR_ERR(new);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 80c61fdb2720..bed63416a55b 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -39,6 +39,7 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context*,
                                             unsigned int, unsigned int);
 static void nfs_pageio_init_write(struct nfs_pageio_descriptor *desc,
                                   struct inode *inode, int ioflags);
+static void nfs_redirty_request(struct nfs_page *req);
 static const struct rpc_call_ops nfs_write_partial_ops;
 static const struct rpc_call_ops nfs_write_full_ops;
 static const struct rpc_call_ops nfs_commit_ops;
@@ -288,7 +289,12 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                 BUG();
         }
         spin_unlock(&inode->i_lock);
-        nfs_pageio_add_request(pgio, req);
+        if (!nfs_pageio_add_request(pgio, req)) {
+                nfs_redirty_request(req);
+                nfs_end_page_writeback(page);
+                nfs_clear_page_tag_locked(req);
+                return pgio->pg_error;
+        }
         return 0;
 }
 
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index 1eb771d79cca..3e6b3f41ee1f 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -232,6 +232,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                 fhp->fh_dentry = dentry;
                 fhp->fh_export = exp;
                 nfsd_nr_verified++;
+                cache_get(&exp->h);
         } else {
                 /*
                  * just rechecking permissions
@@ -241,6 +242,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                 dprintk("nfsd: fh_verify - just checking\n");
                 dentry = fhp->fh_dentry;
                 exp = fhp->fh_export;
+                cache_get(&exp->h);
                 /*
                  * Set user creds for this exportpoint; necessary even
                  * in the "just checking" case because this may be a
@@ -252,8 +254,6 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                 if (error)
                         goto out;
         }
-        cache_get(&exp->h);
-
 
         error = nfsd_mode_check(rqstp, dentry->d_inode->i_mode, type);
         if (error)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 91a1bd67ac1d..8a10f6fe24a1 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1036,6 +1036,26 @@ static const struct file_operations proc_loginuid_operations = {
         .read           = proc_loginuid_read,
         .write          = proc_loginuid_write,
 };
+
+static ssize_t proc_sessionid_read(struct file * file, char __user * buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct inode * inode = file->f_path.dentry->d_inode;
+        struct task_struct *task = get_proc_task(inode);
+        ssize_t length;
+        char tmpbuf[TMPBUFLEN];
+
+        if (!task)
+                return -ESRCH;
+        length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
+                                audit_get_sessionid(task));
+        put_task_struct(task);
+        return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
+}
+
+static const struct file_operations proc_sessionid_operations = {
+        .read           = proc_sessionid_read,
+};
 #endif
 
 #ifdef CONFIG_FAULT_INJECTION
@@ -2269,6 +2289,9 @@ static const struct pid_entry tgid_base_stuff[] = {
         DIR("task",       S_IRUGO|S_IXUGO, task),
         DIR("fd",         S_IRUSR|S_IXUSR, fd),
         DIR("fdinfo",     S_IRUSR|S_IXUSR, fdinfo),
+#ifdef CONFIG_NET
+        DIR("net",        S_IRUGO|S_IXUSR, net),
+#endif
         REG("environ",    S_IRUSR, environ),
         INF("auxv",       S_IRUSR, pid_auxv),
         ONE("status",     S_IRUGO, pid_status),
@@ -2316,6 +2339,7 @@ static const struct pid_entry tgid_base_stuff[] = {
         REG("oom_adj",    S_IRUGO|S_IWUSR, oom_adjust),
 #ifdef CONFIG_AUDITSYSCALL
         REG("loginuid",   S_IWUSR|S_IRUGO, loginuid),
+        REG("sessionid",  S_IRUSR, sessionid),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
         REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
@@ -2646,6 +2670,7 @@ static const struct pid_entry tid_base_stuff[] = {
         REG("oom_adj",   S_IRUGO|S_IWUSR, oom_adjust),
 #ifdef CONFIG_AUDITSYSCALL
         REG("loginuid",  S_IWUSR|S_IRUGO, loginuid),
+        REG("sessionid",  S_IRUSR, sessionid),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
         REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 68971e66cd41..a36ad3c75cf4 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -377,15 +377,14 @@ static struct dentry_operations proc_dentry_operations =
  * Don't create negative dentries here, return -ENOENT by hand
  * instead.
  */
-struct dentry *proc_lookup(struct inode * dir, struct dentry *dentry, struct nameidata *nd)
+struct dentry *proc_lookup_de(struct proc_dir_entry *de, struct inode *dir,
+                struct dentry *dentry)
 {
         struct inode *inode = NULL;
-        struct proc_dir_entry * de;
         int error = -ENOENT;
 
         lock_kernel();
         spin_lock(&proc_subdir_lock);
-        de = PDE(dir);
         if (de) {
                 for (de = de->subdir; de ; de = de->next) {
                         if (de->namelen != dentry->d_name.len)
@@ -393,8 +392,6 @@ struct dentry *proc_lookup(struct inode * dir, struct dentry *dentry, struct nam
                         if (!memcmp(dentry->d_name.name, de->name, de->namelen)) {
                                 unsigned int ino;
 
-                                if (de->shadow_proc)
-                                        de = de->shadow_proc(current, de);
                                 ino = de->low_ino;
                                 de_get(de);
                                 spin_unlock(&proc_subdir_lock);
@@ -417,6 +414,12 @@ out_unlock:
         return ERR_PTR(error);
 }
 
+struct dentry *proc_lookup(struct inode *dir, struct dentry *dentry,
+                struct nameidata *nd)
+{
+        return proc_lookup_de(PDE(dir), dir, dentry);
+}
+
 /*
  * This returns non-zero if at EOF, so that the /proc
  * root directory can use this and check if it should
@@ -426,10 +429,9 @@ out_unlock:
  * value of the readdir() call, as long as it's non-negative
  * for success..
  */
-int proc_readdir(struct file * filp,
-        void * dirent, filldir_t filldir)
+int proc_readdir_de(struct proc_dir_entry *de, struct file *filp, void *dirent,
+                filldir_t filldir)
 {
-        struct proc_dir_entry * de;
         unsigned int ino;
         int i;
         struct inode *inode = filp->f_path.dentry->d_inode;
@@ -438,7 +440,6 @@ int proc_readdir(struct file * filp,
         lock_kernel();
 
         ino = inode->i_ino;
-        de = PDE(inode);
         if (!de) {
                 ret = -EINVAL;
                 goto out;
@@ -499,6 +500,13 @@ out:	unlock_kernel();
         return ret;     
 }
 
+int proc_readdir(struct file *filp, void *dirent, filldir_t filldir)
+{
+        struct inode *inode = filp->f_path.dentry->d_inode;
+
+        return proc_readdir_de(PDE(inode), filp, dirent, filldir);
+}
+
 /*
  * These are the generic /proc directory operations. They
  * use the in-memory "struct proc_dir_entry" tree to parse
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 1c81c8f1aeed..bc72f5c8c47d 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -64,6 +64,8 @@ extern const struct file_operations proc_numa_maps_operations;
 extern const struct file_operations proc_smaps_operations;
 extern const struct file_operations proc_clear_refs_operations;
 extern const struct file_operations proc_pagemap_operations;
+extern const struct file_operations proc_net_operations;
+extern const struct inode_operations proc_net_inode_operations;
 
 void free_proc_entry(struct proc_dir_entry *de);
 
@@ -83,3 +85,8 @@ static inline int proc_fd(struct inode *inode)
 {
         return PROC_I(inode)->fd;
 }
+
+struct dentry *proc_lookup_de(struct proc_dir_entry *de, struct inode *ino,
+                struct dentry *dentry);
+int proc_readdir_de(struct proc_dir_entry *de, struct file *filp, void *dirent,
+                filldir_t filldir);
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index 14e9b5aaf863..4caa5f774fb7 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -63,6 +63,82 @@ int seq_release_net(struct inode *ino, struct file *f)
 }
 EXPORT_SYMBOL_GPL(seq_release_net);
 
+static struct net *get_proc_task_net(struct inode *dir)
+{
+        struct task_struct *task;
+        struct nsproxy *ns;
+        struct net *net = NULL;
+
+        rcu_read_lock();
+        task = pid_task(proc_pid(dir), PIDTYPE_PID);
+        if (task != NULL) {
+                ns = task_nsproxy(task);
+                if (ns != NULL)
+                        net = get_net(ns->net_ns);
+        }
+        rcu_read_unlock();
+
+        return net;
+}
+
+static struct dentry *proc_tgid_net_lookup(struct inode *dir,
+                struct dentry *dentry, struct nameidata *nd)
+{
+        struct dentry *de;
+        struct net *net;
+
+        de = ERR_PTR(-ENOENT);
+        net = get_proc_task_net(dir);
+        if (net != NULL) {
+                de = proc_lookup_de(net->proc_net, dir, dentry);
+                put_net(net);
+        }
+        return de;
+}
+
+static int proc_tgid_net_getattr(struct vfsmount *mnt, struct dentry *dentry,
+                struct kstat *stat)
+{
+        struct inode *inode = dentry->d_inode;
+        struct net *net;
+
+        net = get_proc_task_net(inode);
+
+        generic_fillattr(inode, stat);
+
+        if (net != NULL) {
+                stat->nlink = net->proc_net->nlink;
+                put_net(net);
+        }
+
+        return 0;
+}
+
+const struct inode_operations proc_net_inode_operations = {
+        .lookup         = proc_tgid_net_lookup,
+        .getattr        = proc_tgid_net_getattr,
+};
+
+static int proc_tgid_net_readdir(struct file *filp, void *dirent,
+                filldir_t filldir)
+{
+        int ret;
+        struct net *net;
+
+        ret = -EINVAL;
+        net = get_proc_task_net(filp->f_path.dentry->d_inode);
+        if (net != NULL) {
+                ret = proc_readdir_de(net->proc_net, filp, dirent, filldir);
+                put_net(net);
+        }
+        return ret;
+}
+
+const struct file_operations proc_net_operations = {
+        .read           = generic_read_dir,
+        .readdir        = proc_tgid_net_readdir,
+};
+
 
 struct proc_dir_entry *proc_net_fops_create(struct net *net,
         const char *name, mode_t mode, const struct file_operations *fops)
@@ -83,14 +159,6 @@ struct net *get_proc_net(const struct inode *inode)
 }
 EXPORT_SYMBOL_GPL(get_proc_net);
 
-static struct proc_dir_entry *shadow_pde;
-
-static struct proc_dir_entry *proc_net_shadow(struct task_struct *task,
-                                                struct proc_dir_entry *de)
-{
-        return task->nsproxy->net_ns->proc_net;
-}
-
 struct proc_dir_entry *proc_net_mkdir(struct net *net, const char *name,
                 struct proc_dir_entry *parent)
 {
@@ -104,45 +172,39 @@ EXPORT_SYMBOL_GPL(proc_net_mkdir);
 
 static __net_init int proc_net_ns_init(struct net *net)
 {
-        struct proc_dir_entry *root, *netd, *net_statd;
+        struct proc_dir_entry *netd, *net_statd;
         int err;
 
         err = -ENOMEM;
-        root = kzalloc(sizeof(*root), GFP_KERNEL);
-        if (!root)
+        netd = kzalloc(sizeof(*netd), GFP_KERNEL);
+        if (!netd)
                 goto out;
 
-        err = -EEXIST;
-        netd = proc_net_mkdir(net, "net", root);
-        if (!netd)
-                goto free_root;
+        netd->data = net;
+        netd->nlink = 2;
+        netd->name = "net";
+        netd->namelen = 3;
+        netd->parent = &proc_root;
 
         err = -EEXIST;
         net_statd = proc_net_mkdir(net, "stat", netd);
         if (!net_statd)
                 goto free_net;
 
-        root->data = net;
-
-        net->proc_net_root = root;
         net->proc_net = netd;
         net->proc_net_stat = net_statd;
-        err = 0;
+        return 0;
 
+free_net:
+        kfree(netd);
 out:
         return err;
-free_net:
-        remove_proc_entry("net", root);
-free_root:
-        kfree(root);
-        goto out;
 }
 
 static __net_exit void proc_net_ns_exit(struct net *net)
 {
         remove_proc_entry("stat", net->proc_net);
-        remove_proc_entry("net", net->proc_net_root);
-        kfree(net->proc_net_root);
+        kfree(net->proc_net);
 }
 
 static struct pernet_operations __net_initdata proc_net_ns_ops = {
@@ -152,8 +214,7 @@ static struct pernet_operations __net_initdata proc_net_ns_ops = {
 
 int __init proc_net_init(void)
 {
-        shadow_pde = proc_mkdir("net", NULL);
-        shadow_pde->shadow_proc = proc_net_shadow;
+        proc_symlink("net", NULL, "self/net");
 
         return register_pernet_subsys(&proc_net_ns_ops);
 }
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 6dc0334815f7..4206454734e0 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -640,17 +640,17 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
 
         ret = -EACCES;
         if (!ptrace_may_attach(task))
-                goto out;
+                goto out_task;
 
         ret = -EINVAL;
         /* file position must be aligned */
         if (*ppos % PM_ENTRY_BYTES)
-                goto out;
+                goto out_task;
 
         ret = 0;
         mm = get_task_mm(task);
         if (!mm)
-                goto out;
+                goto out_task;
 
         ret = -ENOMEM;
         uaddr = (unsigned long)buf & PAGE_MASK;
@@ -658,7 +658,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
         pagecount = (PAGE_ALIGN(uend) - uaddr) / PAGE_SIZE;
         pages = kmalloc(pagecount * sizeof(struct page *), GFP_KERNEL);
         if (!pages)
-                goto out_task;
+                goto out_mm;
 
         down_read(&current->mm->mmap_sem);
         ret = get_user_pages(current, current->mm, uaddr, pagecount,
@@ -668,6 +668,12 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
         if (ret < 0)
                 goto out_free;
 
+        if (ret != pagecount) {
+                pagecount = ret;
+                ret = -EFAULT;
+                goto out_pages;
+        }
+
         pm.out = buf;
         pm.end = buf + count;
 
@@ -699,15 +705,17 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                         ret = pm.out - buf;
         }
 
+out_pages:
         for (; pagecount; pagecount--) {
                 page = pages[pagecount-1];
                 if (!PageReserved(page))
                         SetPageDirty(page);
                 page_cache_release(page);
         }
-        mmput(mm);
 out_free:
         kfree(pages);
+out_mm:
+        mmput(mm);
 out_task:
         put_task_struct(task);
 out:
diff --git a/fs/romfs/inode.c b/fs/romfs/inode.c
index 00b6f0a518c8..3f13d491c7c7 100644
--- a/fs/romfs/inode.c
+++ b/fs/romfs/inode.c
@@ -340,8 +340,9 @@ static struct dentry *
 romfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
         unsigned long offset, maxoff;
-        int fslen, res;
-        struct inode *inode;
+        long res;
+        int fslen;
+        struct inode *inode = NULL;
         char fsname[ROMFS_MAXFN];       /* XXX dynamic? */
         struct romfs_inode ri;
         const char *name;               /* got from dentry */
@@ -351,7 +352,7 @@ romfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
         offset = dir->i_ino & ROMFH_MASK;
         lock_kernel();
         if (romfs_copyfrom(dir, &ri, offset, ROMFH_SIZE) <= 0)
-                goto out;
+                goto error;
 
         maxoff = romfs_maxsize(dir->i_sb);
         offset = be32_to_cpu(ri.spec) & ROMFH_MASK;
@@ -364,9 +365,9 @@ romfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 
         for(;;) {
                 if (!offset || offset >= maxoff)
-                        goto out0;
+                        goto success; /* negative success */
                 if (romfs_copyfrom(dir, &ri, offset, ROMFH_SIZE) <= 0)
-                        goto out;
+                        goto error;
 
                 /* try to match the first 16 bytes of name */
                 fslen = romfs_strnlen(dir, offset+ROMFH_SIZE, ROMFH_SIZE);
@@ -397,23 +398,14 @@ romfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
         inode = romfs_iget(dir->i_sb, offset);
         if (IS_ERR(inode)) {
                 res = PTR_ERR(inode);
-                goto out;
+                goto error;
         }
 
-        /*
-         * it's a bit funky, _lookup needs to return an error code
-         * (negative) or a NULL, both as a dentry.  ENOENT should not
-         * be returned, instead we need to create a negative dentry by
-         * d_add(dentry, NULL); and return 0 as no error.
-         * (Although as I see, it only matters on writable file
-         * systems).
-         */
-
-out0:   inode = NULL;
+success:
+        d_add(dentry, inode);
         res = 0;
-        d_add (dentry, inode);
-
-out:    unlock_kernel();
+error:
+        unlock_kernel();
         return ERR_PTR(res);
 }
 
diff --git a/fs/super.c b/fs/super.c
index 010446d8c40a..d0a941a4e620 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -556,11 +556,11 @@ out:
 }
 
 /**
- *      mark_files_ro
+ *      mark_files_ro - mark all files read-only
  *      @sb: superblock in question
  *
- *      All files are marked read/only.  We don't care about pending
- *      delete files so this should be used in 'force' mode only
+ *      All files are marked read-only.  We don't care about pending
+ *      delete files so this should be used in 'force' mode only.
  */
 
 static void mark_files_ro(struct super_block *sb)
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index 1fca381f0ce2..1e7598fb9787 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -315,8 +315,8 @@ static void ufs_change_blocknr(struct inode *inode, sector_t beg,
                         }
 
                         UFSD(" change from %llu to %llu, pos %u\n",
-                             (unsigned long long)pos + oldb,
-                             (unsigned long long)pos + newb, pos);
+                             (unsigned long long)(pos + oldb),
+                             (unsigned long long)(pos + newb), pos);
 
                         bh->b_blocknr = newb + pos;
                         unmap_underlying_metadata(bh->b_bdev,