52 files changed, 492 insertions, 208 deletions
diff --git a/fs/aio.c b/fs/aio.c
index 8fa77e233944..76da12537956 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -443,7 +443,7 @@ static struct kiocb *__aio_get_req(struct kioctx *ctx)
        req->private = NULL;
        req->ki_iovec = NULL;
        INIT_LIST_HEAD(&req->ki_run_list);
-        req->ki_eventfd = ERR_PTR(-EINVAL);
+        req->ki_eventfd = NULL;
        /* Check if the completion queue has enough free space to
         * accept an event from this io.
@@ -485,8 +485,6 @@ static inline void really_put_req(struct kioctx *ctx, struct kiocb *req)
 {
        assert_spin_locked(&ctx->ctx_lock);
-        if (!IS_ERR(req->ki_eventfd))
-                fput(req->ki_eventfd);
        if (req->ki_dtor)
                req->ki_dtor(req);
        if (req->ki_iovec != &req->ki_inline_vec)
@@ -508,8 +506,11 @@ static void aio_fput_routine(struct work_struct *data)
                list_del(&req->ki_list);
                spin_unlock_irq(&fput_lock);
-                /* Complete the fput */
+                /* Complete the fput(s) */
-                __fput(req->ki_filp);
+                if (req->ki_filp != NULL)
+                        __fput(req->ki_filp);
+                if (req->ki_eventfd != NULL)
+                        __fput(req->ki_eventfd);
                /* Link the iocb into the context's free list */
                spin_lock_irq(&ctx->ctx_lock);
@@ -527,12 +528,14 @@ static void aio_fput_routine(struct work_struct *data)
 */
 static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
 {
+        int schedule_putreq = 0;
        dprintk(KERN_DEBUG "aio_put(%p): f_count=%ld\n",
                req, atomic_long_read(&req->ki_filp->f_count));
        assert_spin_locked(&ctx->ctx_lock);
-        req->ki_users --;
+        req->ki_users--;
        BUG_ON(req->ki_users < 0);
        if (likely(req->ki_users))
                return 0;
@@ -540,10 +543,23 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
        req->ki_cancel = NULL;
        req->ki_retry = NULL;
-        /* Must be done under the lock to serialise against cancellation.
+        /*
-         * Call this aio_fput as it duplicates fput via the fput_work.
+         * Try to optimize the aio and eventfd file* puts, by avoiding to
+         * schedule work in case it is not __fput() time. In normal cases,
+         * we would not be holding the last reference to the file*, so
+         * this function will be executed w/out any aio kthread wakeup.
         */
-        if (unlikely(atomic_long_dec_and_test(&req->ki_filp->f_count))) {
+        if (unlikely(atomic_long_dec_and_test(&req->ki_filp->f_count)))
+                schedule_putreq++;
+        else
+                req->ki_filp = NULL;
+        if (req->ki_eventfd != NULL) {
+                if (unlikely(atomic_long_dec_and_test(&req->ki_eventfd->f_count)))
+                        schedule_putreq++;
+                else
+                        req->ki_eventfd = NULL;
+        }
+        if (unlikely(schedule_putreq)) {
                get_ioctx(ctx);
                spin_lock(&fput_lock);
                list_add(&req->ki_list, &fput_head);
@@ -571,7 +587,7 @@ int aio_put_req(struct kiocb *req)
 static struct kioctx *lookup_ioctx(unsigned long ctx_id)
 {
        struct mm_struct *mm = current->mm;
-        struct kioctx *ctx = NULL;
+        struct kioctx *ctx, *ret = NULL;
        struct hlist_node *n;
        rcu_read_lock();
@@ -579,12 +595,13 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
        hlist_for_each_entry_rcu(ctx, n, &mm->ioctx_list, list) {
                if (ctx->user_id == ctx_id && !ctx->dead) {
                        get_ioctx(ctx);
+                        ret = ctx;
                        break;
                }
        }
        rcu_read_unlock();
-        return ctx;
+        return ret;
 }
 /*
@@ -1009,7 +1026,7 @@ int aio_complete(struct kiocb *iocb, long res, long res2)
         * eventfd. The eventfd_signal() function is safe to be called
         * from IRQ context.
         */
-        if (!IS_ERR(iocb->ki_eventfd))
+        if (iocb->ki_eventfd != NULL)
                eventfd_signal(iocb->ki_eventfd, 1);
 put_rq:
@@ -1608,6 +1625,7 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
                req->ki_eventfd = eventfd_fget((int) iocb->aio_resfd);
                if (IS_ERR(req->ki_eventfd)) {
                        ret = PTR_ERR(req->ki_eventfd);
+                        req->ki_eventfd = NULL;
                        goto out_put_req;
                }
        }
diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 549b0144da11..fe2b1aa2464e 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -685,19 +685,20 @@ EXPORT_SYMBOL(bio_integrity_split);
 * bio_integrity_clone - Callback for cloning bios with integrity metadata
 * @bio:        New bio
 * @bio_src:    Original bio
+ * @gfp_mask:   Memory allocation mask
 * @bs:         bio_set to allocate bip from
 *
 * Description: Called to allocate a bip when cloning a bio
 */
 int bio_integrity_clone(struct bio *bio, struct bio *bio_src,
-                        struct bio_set *bs)
+                        gfp_t gfp_mask, struct bio_set *bs)
 {
        struct bio_integrity_payload *bip_src = bio_src->bi_integrity;
        struct bio_integrity_payload *bip;
        BUG_ON(bip_src == NULL);
-        bip = bio_integrity_alloc_bioset(bio, GFP_NOIO, bip_src->bip_vcnt, bs);
+        bip = bio_integrity_alloc_bioset(bio, gfp_mask, bip_src->bip_vcnt, bs);
        if (bip == NULL)
                return -EIO;
diff --git a/fs/bio.c b/fs/bio.c
index 124b95c4d582..d4f06327c810 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -463,10 +463,12 @@ struct bio *bio_clone(struct bio *bio, gfp_t gfp_mask)
        if (bio_integrity(bio)) {
                int ret;
-                ret = bio_integrity_clone(b, bio, fs_bio_set);
+                ret = bio_integrity_clone(b, bio, gfp_mask, fs_bio_set);
-                if (ret < 0)
+                if (ret < 0) {
+                        bio_put(b);
                        return NULL;
+                }
        }
        return b;
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 42491d728e99..37f31b5529aa 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -277,7 +277,7 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
        if (*cow_ret == buf)
                unlock_orig = 1;
-        WARN_ON(!btrfs_tree_locked(buf));
+        btrfs_assert_tree_locked(buf);
        if (parent)
                parent_start = parent->start;
@@ -2365,7 +2365,7 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
        if (slot >= btrfs_header_nritems(upper) - 1)
                return 1;
-        WARN_ON(!btrfs_tree_locked(path->nodes[1]));
+        btrfs_assert_tree_locked(path->nodes[1]);
        right = read_node_slot(root, upper, slot + 1);
        btrfs_tree_lock(right);
@@ -2562,7 +2562,7 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
        if (right_nritems == 0)
                return 1;
-        WARN_ON(!btrfs_tree_locked(path->nodes[1]));
+        btrfs_assert_tree_locked(path->nodes[1]);
        left = read_node_slot(root, path->nodes[1], slot - 1);
        btrfs_tree_lock(left);
@@ -4101,7 +4101,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
                next = read_node_slot(root, c, slot);
                if (!path->skip_locking) {
-                        WARN_ON(!btrfs_tree_locked(c));
+                        btrfs_assert_tree_locked(c);
                        btrfs_tree_lock(next);
                        btrfs_set_lock_blocking(next);
                }
@@ -4126,7 +4126,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
                        reada_for_search(root, path, level, slot, 0);
                next = read_node_slot(root, next, 0);
                if (!path->skip_locking) {
-                        WARN_ON(!btrfs_tree_locked(path->nodes[level]));
+                        btrfs_assert_tree_locked(path->nodes[level]);
                        btrfs_tree_lock(next);
                        btrfs_set_lock_blocking(next);
                }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 82491ba8fa40..5e1d4e30e9d8 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -784,7 +784,14 @@ struct btrfs_fs_info {
        struct list_head dirty_cowonly_roots;
        struct btrfs_fs_devices *fs_devices;
+        /*
+         * the space_info list is almost entirely read only.  It only changes
+         * when we add a new raid type to the FS, and that happens
+         * very rarely.  RCU is used to protect it.
+         */
        struct list_head space_info;
        spinlock_t delalloc_lock;
        spinlock_t new_trans_lock;
        u64 delalloc_bytes;
@@ -1797,6 +1804,8 @@ int btrfs_cleanup_reloc_trees(struct btrfs_root *root);
 int btrfs_reloc_clone_csums(struct inode *inode, u64 file_pos, u64 len);
 u64 btrfs_reduce_alloc_profile(struct btrfs_root *root, u64 flags);
 void btrfs_set_inode_space_info(struct btrfs_root *root, struct inode *ionde);
+void btrfs_clear_space_info_full(struct btrfs_fs_info *info);
 int btrfs_check_metadata_free_space(struct btrfs_root *root);
 int btrfs_check_data_free_space(struct btrfs_root *root, struct inode *inode,
                                u64 bytes);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index adda739a0215..3e18175248e0 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -857,7 +857,7 @@ int clean_tree_block(struct btrfs_trans_handle *trans, struct btrfs_root *root,
        struct inode *btree_inode = root->fs_info->btree_inode;
        if (btrfs_header_generation(buf) ==
            root->fs_info->running_transaction->transid) {
-                WARN_ON(!btrfs_tree_locked(buf));
+                btrfs_assert_tree_locked(buf);
                /* ugh, clear_extent_buffer_dirty can be expensive */
                btrfs_set_lock_blocking(buf);
@@ -2361,7 +2361,7 @@ void btrfs_mark_buffer_dirty(struct extent_buffer *buf)
        btrfs_set_lock_blocking(buf);
-        WARN_ON(!btrfs_tree_locked(buf));
+        btrfs_assert_tree_locked(buf);
        if (transid != root->fs_info->generation) {
                printk(KERN_CRIT "btrfs transid mismatch buffer %llu, "
                       "found %llu running %llu\n",
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 6b5966aacf44..fefe83ad2059 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -20,6 +20,7 @@
 #include <linux/writeback.h>
 #include <linux/blkdev.h>
 #include <linux/sort.h>
+#include <linux/rcupdate.h>
 #include "compat.h"
 #include "hash.h"
 #include "crc32c.h"
@@ -330,13 +331,33 @@ static struct btrfs_space_info *__find_space_info(struct btrfs_fs_info *info,
 {
        struct list_head *head = &info->space_info;
        struct btrfs_space_info *found;
-        list_for_each_entry(found, head, list) {
-                if (found->flags == flags)
+        rcu_read_lock();
+        list_for_each_entry_rcu(found, head, list) {
+                if (found->flags == flags) {
+                        rcu_read_unlock();
                        return found;
+                }
        }
+        rcu_read_unlock();
        return NULL;
 }
+/*
+ * after adding space to the filesystem, we need to clear the full flags
+ * on all the space infos.
+ */
+void btrfs_clear_space_info_full(struct btrfs_fs_info *info)
+{
+        struct list_head *head = &info->space_info;
+        struct btrfs_space_info *found;
+        rcu_read_lock();
+        list_for_each_entry_rcu(found, head, list)
+                found->full = 0;
+        rcu_read_unlock();
+}
 static u64 div_factor(u64 num, int factor)
 {
        if (factor == 10)
@@ -1903,7 +1924,6 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
        if (!found)
                return -ENOMEM;
-        list_add(&found->list, &info->space_info);
        INIT_LIST_HEAD(&found->block_groups);
        init_rwsem(&found->groups_sem);
        spin_lock_init(&found->lock);
@@ -1917,6 +1937,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
        found->full = 0;
        found->force_alloc = 0;
        *space_info = found;
+        list_add_rcu(&found->list, &info->space_info);
        return 0;
 }
@@ -4418,13 +4439,13 @@ int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
        path = btrfs_alloc_path();
        BUG_ON(!path);
-        BUG_ON(!btrfs_tree_locked(parent));
+        btrfs_assert_tree_locked(parent);
        parent_level = btrfs_header_level(parent);
        extent_buffer_get(parent);
        path->nodes[parent_level] = parent;
        path->slots[parent_level] = btrfs_header_nritems(parent);
-        BUG_ON(!btrfs_tree_locked(node));
+        btrfs_assert_tree_locked(node);
        level = btrfs_header_level(node);
        extent_buffer_get(node);
        path->nodes[level] = node;
@@ -6320,6 +6341,7 @@ out:
 int btrfs_free_block_groups(struct btrfs_fs_info *info)
 {
        struct btrfs_block_group_cache *block_group;
+        struct btrfs_space_info *space_info;
        struct rb_node *n;
        spin_lock(&info->block_group_cache_lock);
@@ -6341,6 +6363,23 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
                spin_lock(&info->block_group_cache_lock);
        }
        spin_unlock(&info->block_group_cache_lock);
+        /* now that all the block groups are freed, go through and
+         * free all the space_info structs.  This is only called during
+         * the final stages of unmount, and so we know nobody is
+         * using them.  We call synchronize_rcu() once before we start,
+         * just to be on the safe side.
+         */
+        synchronize_rcu();
+        while(!list_empty(&info->space_info)) {
+                space_info = list_entry(info->space_info.next,
+                                        struct btrfs_space_info,
+                                        list);
+                list_del(&space_info->list);
+                kfree(space_info);
+        }
        return 0;
 }
diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
index 85506c4a3af7..47b0a88c12a2 100644
--- a/fs/btrfs/locking.c
+++ b/fs/btrfs/locking.c
@@ -220,8 +220,8 @@ int btrfs_tree_unlock(struct extent_buffer *eb)
        return 0;
 }
-int btrfs_tree_locked(struct extent_buffer *eb)
+void btrfs_assert_tree_locked(struct extent_buffer *eb)
 {
-        return test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags) ||
+        if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
-                        spin_is_locked(&eb->lock);
+                assert_spin_locked(&eb->lock);
 }
diff --git a/fs/btrfs/locking.h b/fs/btrfs/locking.h
index 6bb0afbff928..6c4ce457168c 100644
--- a/fs/btrfs/locking.h
+++ b/fs/btrfs/locking.h
@@ -21,11 +21,11 @@
 int btrfs_tree_lock(struct extent_buffer *eb);
 int btrfs_tree_unlock(struct extent_buffer *eb);
-int btrfs_tree_locked(struct extent_buffer *eb);
 int btrfs_try_tree_lock(struct extent_buffer *eb);
 int btrfs_try_spin_lock(struct extent_buffer *eb);
 void btrfs_set_lock_blocking(struct extent_buffer *eb);
 void btrfs_clear_lock_blocking(struct extent_buffer *eb);
+void btrfs_assert_tree_locked(struct extent_buffer *eb);
 #endif
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 1316139bf9e8..dd06e18e5aac 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1374,6 +1374,12 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
                ret = btrfs_add_device(trans, root, device);
        }
+        /*
+         * we've got more storage, clear any full flags on the space
+         * infos
+         */
+        btrfs_clear_space_info_full(root->fs_info);
        unlock_chunks(root);
        btrfs_commit_transaction(trans, root);
@@ -1459,6 +1465,8 @@ static int __btrfs_grow_device(struct btrfs_trans_handle *trans,
        device->fs_devices->total_rw_bytes += diff;
        device->total_bytes = new_size;
+        btrfs_clear_space_info_full(device->dev_root->fs_info);
        return btrfs_update_device(trans, device);
 }
diff --git a/fs/buffer.c b/fs/buffer.c
index 9f697419ed8e..891e1c78e4f1 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -760,15 +760,9 @@ EXPORT_SYMBOL(mark_buffer_dirty_inode);
 * If warn is true, then emit a warning if the page is not uptodate and has
 * not been truncated.
 */
-static int __set_page_dirty(struct page *page,
+static void __set_page_dirty(struct page *page,
                struct address_space *mapping, int warn)
 {
-        if (unlikely(!mapping))
-                return !TestSetPageDirty(page);
-        if (TestSetPageDirty(page))
-                return 0;
        spin_lock_irq(&mapping->tree_lock);
        if (page->mapping) {    /* Race with truncate? */
                WARN_ON_ONCE(warn && !PageUptodate(page));
@@ -785,8 +779,6 @@ static int __set_page_dirty(struct page *page,
        }
        spin_unlock_irq(&mapping->tree_lock);
        __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
-        return 1;
 }
 /*
@@ -816,6 +808,7 @@ static int __set_page_dirty(struct page *page,
 */
 int __set_page_dirty_buffers(struct page *page)
 {
+        int newly_dirty;
        struct address_space *mapping = page_mapping(page);
        if (unlikely(!mapping))
@@ -831,9 +824,12 @@ int __set_page_dirty_buffers(struct page *page)
                        bh = bh->b_this_page;
                } while (bh != head);
        }
+        newly_dirty = !TestSetPageDirty(page);
        spin_unlock(&mapping->private_lock);
-        return __set_page_dirty(page, mapping, 1);
+        if (newly_dirty)
+                __set_page_dirty(page, mapping, 1);
+        return newly_dirty;
 }
 EXPORT_SYMBOL(__set_page_dirty_buffers);
@@ -1262,8 +1258,11 @@ void mark_buffer_dirty(struct buffer_head *bh)
                        return;
        }
-        if (!test_set_buffer_dirty(bh))
+        if (!test_set_buffer_dirty(bh)) {
-                __set_page_dirty(bh->b_page, page_mapping(bh->b_page), 0);
+                struct page *page = bh->b_page;
+                if (!TestSetPageDirty(page))
+                        __set_page_dirty(page, page_mapping(page), 0);
+        }
 }
 /*
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 5f3231b9633f..bff4052b05e7 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -198,9 +198,6 @@ static int mknod_ptmx(struct super_block *sb)
        fsi->ptmx_dentry = dentry;
        rc = 0;
-        printk(KERN_DEBUG "Created ptmx node in devpts ino %lu\n",
-                        inode->i_ino);
 out:
        mutex_unlock(&root->d_inode->i_mutex);
        return rc;
@@ -369,8 +366,6 @@ static int new_pts_mount(struct file_system_type *fs_type, int flags,
        struct pts_fs_info *fsi;
        struct pts_mount_opts *opts;
-        printk(KERN_NOTICE "devpts: newinstance mount\n");
        err = get_sb_nodev(fs_type, flags, data, devpts_fill_super, mnt);
        if (err)
                return err;
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index f6caeb1d1106..8b65f289ee00 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -946,6 +946,8 @@ static int ecryptfs_copy_mount_wide_sigs_to_inode_sigs(
        list_for_each_entry(global_auth_tok,
                            &mount_crypt_stat->global_auth_tok_list,
                            mount_crypt_stat_list) {
+                if (global_auth_tok->flags & ECRYPTFS_AUTH_TOK_FNEK)
+                        continue;
                rc = ecryptfs_add_keysig(crypt_stat, global_auth_tok->sig);
                if (rc) {
                        printk(KERN_ERR "Error adding keysig; rc = [%d]\n", rc);
@@ -1322,14 +1324,13 @@ static int ecryptfs_write_headers_virt(char *page_virt, size_t max,
 }
 static int
-ecryptfs_write_metadata_to_contents(struct ecryptfs_crypt_stat *crypt_stat,
+ecryptfs_write_metadata_to_contents(struct dentry *ecryptfs_dentry,
-                                    struct dentry *ecryptfs_dentry,
+                                    char *virt, size_t virt_len)
-                                    char *virt)
 {
        int rc;
        rc = ecryptfs_write_lower(ecryptfs_dentry->d_inode, virt,
-                                  0, crypt_stat->num_header_bytes_at_front);
+                                  0, virt_len);
        if (rc)
                printk(KERN_ERR "%s: Error attempting to write header "
                       "information to lower file; rc = [%d]\n", __func__,
@@ -1339,7 +1340,6 @@ ecryptfs_write_metadata_to_contents(struct ecryptfs_crypt_stat *crypt_stat,
 static int
 ecryptfs_write_metadata_to_xattr(struct dentry *ecryptfs_dentry,
-                                 struct ecryptfs_crypt_stat *crypt_stat,
                                 char *page_virt, size_t size)
 {
        int rc;
@@ -1349,6 +1349,17 @@ ecryptfs_write_metadata_to_xattr(struct dentry *ecryptfs_dentry,
        return rc;
 }
+static unsigned long ecryptfs_get_zeroed_pages(gfp_t gfp_mask,
+                                               unsigned int order)
+{
+        struct page *page;
+        page = alloc_pages(gfp_mask | __GFP_ZERO, order);
+        if (page)
+                return (unsigned long) page_address(page);
+        return 0;
+}
 /**
 * ecryptfs_write_metadata
 * @ecryptfs_dentry: The eCryptfs dentry
@@ -1365,7 +1376,9 @@ int ecryptfs_write_metadata(struct dentry *ecryptfs_dentry)
 {
        struct ecryptfs_crypt_stat *crypt_stat =
                &ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->crypt_stat;
+        unsigned int order;
        char *virt;
+        size_t virt_len;
        size_t size = 0;
        int rc = 0;
@@ -1381,33 +1394,35 @@ int ecryptfs_write_metadata(struct dentry *ecryptfs_dentry)
                rc = -EINVAL;
                goto out;
        }
+        virt_len = crypt_stat->num_header_bytes_at_front;
+        order = get_order(virt_len);
        /* Released in this function */
-        virt = (char *)get_zeroed_page(GFP_KERNEL);
+        virt = (char *)ecryptfs_get_zeroed_pages(GFP_KERNEL, order);
        if (!virt) {
                printk(KERN_ERR "%s: Out of memory\n", __func__);
                rc = -ENOMEM;
                goto out;
        }
-        rc = ecryptfs_write_headers_virt(virt, PAGE_CACHE_SIZE, &size,
+        rc = ecryptfs_write_headers_virt(virt, virt_len, &size, crypt_stat,
-                                         crypt_stat, ecryptfs_dentry);
+                                         ecryptfs_dentry);
        if (unlikely(rc)) {
                printk(KERN_ERR "%s: Error whilst writing headers; rc = [%d]\n",
                       __func__, rc);
                goto out_free;
        }
        if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
-                rc = ecryptfs_write_metadata_to_xattr(ecryptfs_dentry,
+                rc = ecryptfs_write_metadata_to_xattr(ecryptfs_dentry, virt,
-                                                      crypt_stat, virt, size);
+                                                      size);
        else
-                rc = ecryptfs_write_metadata_to_contents(crypt_stat,
+                rc = ecryptfs_write_metadata_to_contents(ecryptfs_dentry, virt,
-                                                         ecryptfs_dentry, virt);
+                                                         virt_len);
        if (rc) {
                printk(KERN_ERR "%s: Error writing metadata out to lower file; "
                       "rc = [%d]\n", __func__, rc);
                goto out_free;
        }
 out_free:
-        free_page((unsigned long)virt);
+        free_pages((unsigned long)virt, order);
 out:
        return rc;
 }
@@ -2206,17 +2221,19 @@ int ecryptfs_decode_and_decrypt_filename(char **plaintext_name,
                                         struct dentry *ecryptfs_dir_dentry,
                                         const char *name, size_t name_size)
 {
+        struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
+                &ecryptfs_superblock_to_private(
+                        ecryptfs_dir_dentry->d_sb)->mount_crypt_stat;
        char *decoded_name;
        size_t decoded_name_size;
        size_t packet_size;
        int rc = 0;
-        if ((name_size > ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE)
+        if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
+            && !(mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
+            && (name_size > ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE)
            && (strncmp(name, ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX,
                        ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE) == 0)) {
-                struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
-                        &ecryptfs_superblock_to_private(
-                                ecryptfs_dir_dentry->d_sb)->mount_crypt_stat;
                const char *orig_name = name;
                size_t orig_name_size = name_size;
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index c11fc95714ab..ac749d4d644f 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -328,6 +328,7 @@ struct ecryptfs_dentry_info {
 */
 struct ecryptfs_global_auth_tok {
 #define ECRYPTFS_AUTH_TOK_INVALID 0x00000001
+#define ECRYPTFS_AUTH_TOK_FNEK    0x00000002
        u32 flags;
        struct list_head mount_crypt_stat_list;
        struct key *global_auth_tok_key;
@@ -619,7 +620,6 @@ int ecryptfs_interpose(struct dentry *hidden_dentry,
                       u32 flags);
 int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                                        struct dentry *lower_dentry,
-                                        struct ecryptfs_crypt_stat *crypt_stat,
                                        struct inode *ecryptfs_dir_inode,
                                        struct nameidata *ecryptfs_nd);
 int ecryptfs_decode_and_decrypt_filename(char **decrypted_name,
@@ -696,7 +696,7 @@ ecryptfs_write_header_metadata(char *virt,
 int ecryptfs_add_keysig(struct ecryptfs_crypt_stat *crypt_stat, char *sig);
 int
 ecryptfs_add_global_auth_tok(struct ecryptfs_mount_crypt_stat *mount_crypt_stat,
-                           char *sig);
+                           char *sig, u32 global_auth_tok_flags);
 int ecryptfs_get_global_auth_tok_for_sig(
        struct ecryptfs_global_auth_tok **global_auth_tok,
        struct ecryptfs_mount_crypt_stat *mount_crypt_stat, char *sig);
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 5697899a168d..55b3145b8072 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -246,7 +246,6 @@ out:
 */
 int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                                        struct dentry *lower_dentry,
-                                        struct ecryptfs_crypt_stat *crypt_stat,
                                        struct inode *ecryptfs_dir_inode,
                                        struct nameidata *ecryptfs_nd)
 {
@@ -254,6 +253,7 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
        struct vfsmount *lower_mnt;
        struct inode *lower_inode;
        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
+        struct ecryptfs_crypt_stat *crypt_stat;
        char *page_virt = NULL;
        u64 file_size;
        int rc = 0;
@@ -314,6 +314,11 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                        goto out_free_kmem;
                }
        }
+        crypt_stat = &ecryptfs_inode_to_private(
+                                        ecryptfs_dentry->d_inode)->crypt_stat;
+        /* TODO: lock for crypt_stat comparison */
+        if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
+                        ecryptfs_set_default_sizes(crypt_stat);
        rc = ecryptfs_read_and_validate_header_region(page_virt,
                                                      ecryptfs_dentry->d_inode);
        if (rc) {
@@ -362,9 +367,7 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
 {
        char *encrypted_and_encoded_name = NULL;
        size_t encrypted_and_encoded_name_size;
-        struct ecryptfs_crypt_stat *crypt_stat = NULL;
        struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
-        struct ecryptfs_inode_info *inode_info;
        struct dentry *lower_dir_dentry, *lower_dentry;
        int rc = 0;
@@ -388,26 +391,15 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
        }
        if (lower_dentry->d_inode)
                goto lookup_and_interpose;
-        inode_info =  ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
+        mount_crypt_stat = &ecryptfs_superblock_to_private(
-        if (inode_info) {
+                                ecryptfs_dentry->d_sb)->mount_crypt_stat;
-                crypt_stat = &inode_info->crypt_stat;
+        if (!(mount_crypt_stat
-                /* TODO: lock for crypt_stat comparison */
+            && (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)))
-                if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
-                        ecryptfs_set_default_sizes(crypt_stat);
-        }
-        if (crypt_stat)
-                mount_crypt_stat = crypt_stat->mount_crypt_stat;
-        else
-                mount_crypt_stat = &ecryptfs_superblock_to_private(
-                        ecryptfs_dentry->d_sb)->mount_crypt_stat;
-        if (!(crypt_stat && (crypt_stat->flags & ECRYPTFS_ENCRYPT_FILENAMES))
-            && !(mount_crypt_stat && (mount_crypt_stat->flags
-                                     & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)))
                goto lookup_and_interpose;
        dput(lower_dentry);
        rc = ecryptfs_encrypt_and_encode_filename(
                &encrypted_and_encoded_name, &encrypted_and_encoded_name_size,
-                crypt_stat, mount_crypt_stat, ecryptfs_dentry->d_name.name,
+                NULL, mount_crypt_stat, ecryptfs_dentry->d_name.name,
                ecryptfs_dentry->d_name.len);
        if (rc) {
                printk(KERN_ERR "%s: Error attempting to encrypt and encode "
@@ -426,7 +418,7 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
        }
 lookup_and_interpose:
        rc = ecryptfs_lookup_and_interpose_lower(ecryptfs_dentry, lower_dentry,
-                                                 crypt_stat, ecryptfs_dir_inode,
+                                                 ecryptfs_dir_inode,
                                                 ecryptfs_nd);
        goto out;
 out_d_drop:
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index ff539420cc6f..e4a6223c3145 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -2375,7 +2375,7 @@ struct kmem_cache *ecryptfs_global_auth_tok_cache;
 int
 ecryptfs_add_global_auth_tok(struct ecryptfs_mount_crypt_stat *mount_crypt_stat,
-                             char *sig)
+                             char *sig, u32 global_auth_tok_flags)
 {
        struct ecryptfs_global_auth_tok *new_auth_tok;
        int rc = 0;
@@ -2389,6 +2389,7 @@ ecryptfs_add_global_auth_tok(struct ecryptfs_mount_crypt_stat *mount_crypt_stat,
                goto out;
        }
        memcpy(new_auth_tok->sig, sig, ECRYPTFS_SIG_SIZE_HEX);
+        new_auth_tok->flags = global_auth_tok_flags;
        new_auth_tok->sig[ECRYPTFS_SIG_SIZE_HEX] = '\0';
        mutex_lock(&mount_crypt_stat->global_auth_tok_list_mutex);
        list_add(&new_auth_tok->mount_crypt_stat_list,
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 789cf2e1be1e..aed56c25539b 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -319,7 +319,7 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
                case ecryptfs_opt_ecryptfs_sig:
                        sig_src = args[0].from;
                        rc = ecryptfs_add_global_auth_tok(mount_crypt_stat,
-                                                          sig_src);
+                                                          sig_src, 0);
                        if (rc) {
                                printk(KERN_ERR "Error attempting to register "
                                       "global sig; rc = [%d]\n", rc);
@@ -370,7 +370,8 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
                                ECRYPTFS_SIG_SIZE_HEX] = '\0';
                        rc = ecryptfs_add_global_auth_tok(
                                mount_crypt_stat,
-                                mount_crypt_stat->global_default_fnek_sig);
+                                mount_crypt_stat->global_default_fnek_sig,
+                                ECRYPTFS_AUTH_TOK_FNEK);
                        if (rc) {
                                printk(KERN_ERR "Error attempting to register "
                                       "global fnek sig [%s]; rc = [%d]\n",
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index e2eab196875f..e0aa4fe4f596 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -1122,7 +1122,8 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
        struct ext4_extent_idx *ix;
        struct ext4_extent *ex;
        ext4_fsblk_t block;
-        int depth, ee_len;
+        int depth;      /* Note, NOT eh_depth; depth from top of tree */
+        int ee_len;
        BUG_ON(path == NULL);
        depth = path->p_depth;
@@ -1179,7 +1180,8 @@ got_index:
                if (bh == NULL)
                        return -EIO;
                eh = ext_block_hdr(bh);
-                if (ext4_ext_check_header(inode, eh, depth)) {
+                /* subtract from p_depth to get proper eh_depth */
+                if (ext4_ext_check_header(inode, eh, path->p_depth - depth)) {
                        put_bh(bh);
                        return -EIO;
                }
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index f18a919be70b..2d2b3585ee91 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -188,7 +188,7 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
        struct ext4_group_desc *gdp;
        struct ext4_super_block *es;
        struct ext4_sb_info *sbi;
-        int fatal = 0, err, count;
+        int fatal = 0, err, count, cleared;
        ext4_group_t flex_group;
        if (atomic_read(&inode->i_count) > 1) {
@@ -248,8 +248,10 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
                goto error_return;
        /* Ok, now we can actually update the inode bitmaps.. */
-        if (!ext4_clear_bit_atomic(sb_bgl_lock(sbi, block_group),
+        spin_lock(sb_bgl_lock(sbi, block_group));
-                                        bit, bitmap_bh->b_data))
+        cleared = ext4_clear_bit(bit, bitmap_bh->b_data);
+        spin_unlock(sb_bgl_lock(sbi, block_group));
+        if (!cleared)
                ext4_error(sb, "ext4_free_inode",
                           "bit already cleared for inode %lu", ino);
        else {
@@ -696,6 +698,7 @@ struct inode *ext4_new_inode(handle_t *handle, struct inode *dir, int mode)
        struct inode *ret;
        ext4_group_t i;
        int free = 0;
+        static int once = 1;
        ext4_group_t flex_group;
        /* Cannot create files in a deleted directory */
@@ -717,7 +720,8 @@ struct inode *ext4_new_inode(handle_t *handle, struct inode *dir, int mode)
                ret2 = find_group_flex(sb, dir, &group);
                if (ret2 == -1) {
                        ret2 = find_group_other(sb, dir, &group);
-                        if (ret2 == 0 && printk_ratelimit())
+                        if (ret2 == 0 && once)
+                                once = 0;
                                printk(KERN_NOTICE "ext4: find_group_flex "
                                       "failed, fallback succeeded dir %lu\n",
                                       dir->i_ino);
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 4415beeb0b62..9f61e62f435f 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1447,7 +1447,7 @@ static void ext4_mb_measure_extent(struct ext4_allocation_context *ac,
        struct ext4_free_extent *gex = &ac->ac_g_ex;
        BUG_ON(ex->fe_len <= 0);
-        BUG_ON(ex->fe_len >= EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
+        BUG_ON(ex->fe_len > EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
        BUG_ON(ex->fe_start >= EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
        BUG_ON(ac->ac_status != AC_STATUS_CONTINUE);
@@ -3292,7 +3292,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
        }
        BUG_ON(start + size <= ac->ac_o_ex.fe_logical &&
                        start > ac->ac_o_ex.fe_logical);
-        BUG_ON(size <= 0 || size >= EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
+        BUG_ON(size <= 0 || size > EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
        /* now prepare goal request */
@@ -3589,6 +3589,7 @@ static void ext4_mb_put_pa(struct ext4_allocation_context *ac,
                        struct super_block *sb, struct ext4_prealloc_space *pa)
 {
        ext4_group_t grp;
+        ext4_fsblk_t grp_blk;
        if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0)
                return;
@@ -3603,8 +3604,12 @@ static void ext4_mb_put_pa(struct ext4_allocation_context *ac,
        pa->pa_deleted = 1;
        spin_unlock(&pa->pa_lock);
-        /* -1 is to protect from crossing allocation group */
+        grp_blk = pa->pa_pstart;
-        ext4_get_group_no_and_offset(sb, pa->pa_pstart - 1, &grp, NULL);
+        /* If linear, pa_pstart may be in the next group when pa is used up */
+        if (pa->pa_linear)
+                grp_blk--;
+        ext4_get_group_no_and_offset(sb, grp_blk, &grp, NULL);
        /*
         * possible race:
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 6b74d09adbe5..de0004fe6e00 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -202,9 +202,9 @@ static sector_t _fat_bmap(struct address_space *mapping, sector_t block)
        sector_t blocknr;
        /* fat_get_cluster() assumes the requested blocknr isn't truncated. */
-        mutex_lock(&mapping->host->i_mutex);
+        down_read(&mapping->host->i_alloc_sem);
        blocknr = generic_block_bmap(mapping, block, fat_get_block);
-        mutex_unlock(&mapping->host->i_mutex);
+        up_read(&mapping->host->i_alloc_sem);
        return blocknr;
 }
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index e5eaa62fd17f..e3fe9918faaf 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -274,6 +274,7 @@ __sync_single_inode(struct inode *inode, struct writeback_control *wbc)
        int ret;
        BUG_ON(inode->i_state & I_SYNC);
+        WARN_ON(inode->i_state & I_NEW);
        /* Set I_SYNC, reset I_DIRTY */
        dirty = inode->i_state & I_DIRTY;
@@ -298,6 +299,7 @@ __sync_single_inode(struct inode *inode, struct writeback_control *wbc)
        }
        spin_lock(&inode_lock);
+        WARN_ON(inode->i_state & I_NEW);
        inode->i_state &= ~I_SYNC;
        if (!(inode->i_state & I_FREEING)) {
                if (!(inode->i_state & I_DIRTY) &&
@@ -470,6 +472,11 @@ void generic_sync_sb_inodes(struct super_block *sb,
                        break;
                }
+                if (inode->i_state & I_NEW) {
+                        requeue_io(inode);
+                        continue;
+                }
                if (wbc->nonblocking && bdi_write_congested(bdi)) {
                        wbc->encountered_congestion = 1;
                        if (!sb_is_blkdev_sb(sb))
@@ -531,7 +538,7 @@ void generic_sync_sb_inodes(struct super_block *sb,
                list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
                        struct address_space *mapping;
-                        if (inode->i_state & (I_FREEING|I_WILL_FREE))
+                        if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW))
                                continue;
                        mapping = inode->i_mapping;
                        if (mapping->nrpages == 0)
diff --git a/fs/inode.c b/fs/inode.c
index 913ab2d9a5d1..826fb0b9d1c3 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -359,6 +359,7 @@ static int invalidate_list(struct list_head *head, struct list_head *dispose)
                invalidate_inode_buffers(inode);
                if (!atomic_read(&inode->i_count)) {
                        list_move(&inode->i_list, dispose);
+                        WARN_ON(inode->i_state & I_NEW);
                        inode->i_state |= I_FREEING;
                        count++;
                        continue;
@@ -460,6 +461,7 @@ static void prune_icache(int nr_to_scan)
                                continue;
                }
                list_move(&inode->i_list, &freeable);
+                WARN_ON(inode->i_state & I_NEW);
                inode->i_state |= I_FREEING;
                nr_pruned++;
        }
@@ -656,6 +658,7 @@ void unlock_new_inode(struct inode *inode)
         * just created it (so there can be no old holders
         * that haven't tested I_LOCK).
         */
+        WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW));
        inode->i_state &= ~(I_LOCK|I_NEW);
        wake_up_inode(inode);
 }
@@ -1145,6 +1148,7 @@ void generic_delete_inode(struct inode *inode)
        list_del_init(&inode->i_list);
        list_del_init(&inode->i_sb_list);
+        WARN_ON(inode->i_state & I_NEW);
        inode->i_state |= I_FREEING;
        inodes_stat.nr_inodes--;
        spin_unlock(&inode_lock);
@@ -1186,16 +1190,19 @@ static void generic_forget_inode(struct inode *inode)
                        spin_unlock(&inode_lock);
                        return;
                }
+                WARN_ON(inode->i_state & I_NEW);
                inode->i_state |= I_WILL_FREE;
                spin_unlock(&inode_lock);
                write_inode_now(inode, 1);
                spin_lock(&inode_lock);
+                WARN_ON(inode->i_state & I_NEW);
                inode->i_state &= ~I_WILL_FREE;
                inodes_stat.nr_unused--;
                hlist_del_init(&inode->i_hash);
        }
        list_del_init(&inode->i_list);
        list_del_init(&inode->i_sb_list);
+        WARN_ON(inode->i_state & I_NEW);
        inode->i_state |= I_FREEING;
        inodes_stat.nr_inodes--;
        spin_unlock(&inode_lock);
diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
index 1f3b0fc0d351..aedc47a264c1 100644
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -139,6 +139,55 @@ int nlmclnt_block(struct nlm_wait *block, struct nlm_rqst *req, long timeout)
        return 0;
 }
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static const struct in6_addr *nlmclnt_map_v4addr(const struct sockaddr *sap,
+                                                 struct in6_addr *addr_mapped)
+{
+        const struct sockaddr_in *sin = (const struct sockaddr_in *)sap;
+        switch (sap->sa_family) {
+        case AF_INET6:
+                return &((const struct sockaddr_in6 *)sap)->sin6_addr;
+        case AF_INET:
+                ipv6_addr_set_v4mapped(sin->sin_addr.s_addr, addr_mapped);
+                return addr_mapped;
+        }
+        return NULL;
+}
+/*
+ * If lockd is using a PF_INET6 listener, all incoming requests appear
+ * to come from AF_INET6 remotes.  The address of AF_INET remotes are
+ * mapped to AF_INET6 automatically by the network layer.  In case the
+ * user passed an AF_INET server address at mount time, ensure both
+ * addresses are AF_INET6 before comparing them.
+ */
+static int nlmclnt_cmp_addr(const struct nlm_host *host,
+                            const struct sockaddr *sap)
+{
+        const struct in6_addr *addr1;
+        const struct in6_addr *addr2;
+        struct in6_addr addr1_mapped;
+        struct in6_addr addr2_mapped;
+        addr1 = nlmclnt_map_v4addr(nlm_addr(host), &addr1_mapped);
+        if (likely(addr1 != NULL)) {
+                addr2 = nlmclnt_map_v4addr(sap, &addr2_mapped);
+                if (likely(addr2 != NULL))
+                        return ipv6_addr_equal(addr1, addr2);
+        }
+        return 0;
+}
+#else   /* !(CONFIG_IPV6 || CONFIG_IPV6_MODULE) */
+static int nlmclnt_cmp_addr(const struct nlm_host *host,
+                            const struct sockaddr *sap)
+{
+        return nlm_cmp_addr(nlm_addr(host), sap);
+}
+#endif  /* !(CONFIG_IPV6 || CONFIG_IPV6_MODULE) */
 /*
 * The server lockd has called us back to tell us the lock was granted
 */
@@ -166,7 +215,7 @@ __be32 nlmclnt_grant(const struct sockaddr *addr, const struct nlm_lock *lock)
                 */
                if (fl_blocked->fl_u.nfs_fl.owner->pid != lock->svid)
                        continue;
-                if (!nlm_cmp_addr(nlm_addr(block->b_host), addr))
+                if (!nlmclnt_cmp_addr(block->b_host, addr))
                        continue;
                if (nfs_compare_fh(NFS_FH(fl_blocked->fl_file->f_path.dentry->d_inode) ,fh) != 0)
                        continue;
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index d1d1eb84679d..618865b3128b 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -3,7 +3,7 @@
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 *
- *  Copyright (C) 1996  Gertjan van Wingerde    (gertjan@cs.vu.nl)
+ *  Copyright (C) 1996  Gertjan van Wingerde
 *      Minix V2 fs support.
 *
 *  Modified for 680x0 by Andreas Schwab
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 9b728f3565a1..574158ae2398 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -255,6 +255,32 @@ static int nfs_sockaddr_match_ipaddr(const struct sockaddr *sa1,
        }
        return 0;
 }
+/*
+ * Test if two ip6 socket addresses refer to the same socket by
+ * comparing relevant fields. The padding bytes specifically, are not
+ * compared. sin6_flowinfo is not compared because it only affects QoS
+ * and sin6_scope_id is only compared if the address is "link local"
+ * because "link local" addresses need only be unique to a specific
+ * link. Conversely, ordinary unicast addresses might have different
+ * sin6_scope_id.
+ *
+ * The caller should ensure both socket addresses are AF_INET6.
+ */
+static int nfs_sockaddr_cmp_ip6(const struct sockaddr *sa1,
+                                const struct sockaddr *sa2)
+{
+        const struct sockaddr_in6 *saddr1 = (const struct sockaddr_in6 *)sa1;
+        const struct sockaddr_in6 *saddr2 = (const struct sockaddr_in6 *)sa2;
+        if (!ipv6_addr_equal(&saddr1->sin6_addr,
+                             &saddr1->sin6_addr))
+                return 0;
+        if (ipv6_addr_scope(&saddr1->sin6_addr) == IPV6_ADDR_SCOPE_LINKLOCAL &&
+            saddr1->sin6_scope_id != saddr2->sin6_scope_id)
+                return 0;
+        return saddr1->sin6_port == saddr2->sin6_port;
+}
 #else
 static int nfs_sockaddr_match_ipaddr4(const struct sockaddr_in *sa1,
                                 const struct sockaddr_in *sa2)
@@ -270,9 +296,52 @@ static int nfs_sockaddr_match_ipaddr(const struct sockaddr *sa1,
        return nfs_sockaddr_match_ipaddr4((const struct sockaddr_in *)sa1,
                        (const struct sockaddr_in *)sa2);
 }
+static int nfs_sockaddr_cmp_ip6(const struct sockaddr * sa1,
+                                const struct sockaddr * sa2)
+{
+        return 0;
+}
 #endif
 /*
+ * Test if two ip4 socket addresses refer to the same socket, by
+ * comparing relevant fields. The padding bytes specifically, are
+ * not compared.
+ *
+ * The caller should ensure both socket addresses are AF_INET.
+ */
+static int nfs_sockaddr_cmp_ip4(const struct sockaddr *sa1,
+                                const struct sockaddr *sa2)
+{
+        const struct sockaddr_in *saddr1 = (const struct sockaddr_in *)sa1;
+        const struct sockaddr_in *saddr2 = (const struct sockaddr_in *)sa2;
+        if (saddr1->sin_addr.s_addr != saddr2->sin_addr.s_addr)
+                return 0;
+        return saddr1->sin_port == saddr2->sin_port;
+}
+/*
+ * Test if two socket addresses represent the same actual socket,
+ * by comparing (only) relevant fields.
+ */
+static int nfs_sockaddr_cmp(const struct sockaddr *sa1,
+                            const struct sockaddr *sa2)
+{
+        if (sa1->sa_family != sa2->sa_family)
+                return 0;
+        switch (sa1->sa_family) {
+        case AF_INET:
+                return nfs_sockaddr_cmp_ip4(sa1, sa2);
+        case AF_INET6:
+                return nfs_sockaddr_cmp_ip6(sa1, sa2);
+        }
+        return 0;
+}
+/*
 * Find a client by IP address and protocol version
 * - returns NULL if no such client
 */
@@ -344,8 +413,10 @@ struct nfs_client *nfs_find_client_next(struct nfs_client *clp)
 static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *data)
 {
        struct nfs_client *clp;
+        const struct sockaddr *sap = data->addr;
        list_for_each_entry(clp, &nfs_client_list, cl_share_link) {
+                const struct sockaddr *clap = (struct sockaddr *)&clp->cl_addr;
                /* Don't match clients that failed to initialise properly */
                if (clp->cl_cons_state < 0)
                        continue;
@@ -358,7 +429,7 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *dat
                        continue;
                /* Match the full socket address */
-                if (memcmp(&clp->cl_addr, data->addr, sizeof(clp->cl_addr)) != 0)
+                if (!nfs_sockaddr_cmp(sap, clap))
                        continue;
                atomic_inc(&clp->cl_count);
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index e35c8199f82f..672368f865ca 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1892,8 +1892,14 @@ static int nfs_do_access(struct inode *inode, struct rpc_cred *cred, int mask)
        cache.cred = cred;
        cache.jiffies = jiffies;
        status = NFS_PROTO(inode)->access(inode, &cache);
-        if (status != 0)
+        if (status != 0) {
+                if (status == -ESTALE) {
+                        nfs_zap_caches(inode);
+                        if (!S_ISDIR(inode->i_mode))
+                                set_bit(NFS_INO_STALE, &NFS_I(inode)->flags);
+                }
                return status;
+        }
        nfs_access_add_cache(inode, &cache);
 out:
        if ((mask & ~cache.mask & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index cef62557c87d..6bbf0e6daad2 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -292,7 +292,7 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
 {
        struct nfs_server *server = NFS_SERVER(inode);
        struct nfs_fattr fattr;
-        struct page *pages[NFSACL_MAXPAGES] = { };
+        struct page *pages[NFSACL_MAXPAGES];
        struct nfs3_setaclargs args = {
                .inode = inode,
                .mask = NFS_ACL,
@@ -303,7 +303,7 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
                .rpc_argp       = &args,
                .rpc_resp       = &fattr,
        };
-        int status, count;
+        int status;
        status = -EOPNOTSUPP;
        if (!nfs_server_capable(inode, NFS_CAP_ACLS))
@@ -319,6 +319,20 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
        if (S_ISDIR(inode->i_mode)) {
                args.mask |= NFS_DFACL;
                args.acl_default = dfacl;
+                args.len = nfsacl_size(acl, dfacl);
+        } else
+                args.len = nfsacl_size(acl, NULL);
+        if (args.len > NFS_ACL_INLINE_BUFSIZE) {
+                unsigned int npages = 1 + ((args.len - 1) >> PAGE_SHIFT);
+                status = -ENOMEM;
+                do {
+                        args.pages[args.npages] = alloc_page(GFP_KERNEL);
+                        if (args.pages[args.npages] == NULL)
+                                goto out_freepages;
+                        args.npages++;
+                } while (args.npages < npages);
        }
        dprintk("NFS call setacl\n");
@@ -329,10 +343,6 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
        nfs_zap_acl_cache(inode);
        dprintk("NFS reply setacl: %d\n", status);
-        /* pages may have been allocated at the xdr layer. */
-        for (count = 0; count < NFSACL_MAXPAGES && args.pages[count]; count++)
-                __free_page(args.pages[count]);
        switch (status) {
                case 0:
                        status = nfs_refresh_inode(inode, &fattr);
@@ -346,6 +356,11 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
                case -ENOTSUPP:
                        status = -EOPNOTSUPP;
        }
+out_freepages:
+        while (args.npages != 0) {
+                args.npages--;
+                __free_page(args.pages[args.npages]);
+        }
 out:
        return status;
 }
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 11cdddec1432..6cdeacffde46 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -82,8 +82,10 @@
 #define NFS3_commitres_sz       (1+NFS3_wcc_data_sz+2)
 #define ACL3_getaclargs_sz      (NFS3_fh_sz+1)
-#define ACL3_setaclargs_sz      (NFS3_fh_sz+1+2*(2+5*3))
+#define ACL3_setaclargs_sz      (NFS3_fh_sz+1+ \
-#define ACL3_getaclres_sz       (1+NFS3_post_op_attr_sz+1+2*(2+5*3))
+                                XDR_QUADLEN(NFS_ACL_INLINE_BUFSIZE))
+#define ACL3_getaclres_sz       (1+NFS3_post_op_attr_sz+1+ \
+                                XDR_QUADLEN(NFS_ACL_INLINE_BUFSIZE))
 #define ACL3_setaclres_sz       (1+NFS3_post_op_attr_sz)
 /*
@@ -703,28 +705,18 @@ nfs3_xdr_setaclargs(struct rpc_rqst *req, __be32 *p,
                   struct nfs3_setaclargs *args)
 {
        struct xdr_buf *buf = &req->rq_snd_buf;
-        unsigned int base, len_in_head, len = nfsacl_size(
+        unsigned int base;
-                (args->mask & NFS_ACL)   ? args->acl_access  : NULL,
+        int err;
-                (args->mask & NFS_DFACL) ? args->acl_default : NULL);
-        int count, err;
        p = xdr_encode_fhandle(p, NFS_FH(args->inode));
        *p++ = htonl(args->mask);
-        base = (char *)p - (char *)buf->head->iov_base;
+        req->rq_slen = xdr_adjust_iovec(req->rq_svec, p);
-        /* put as much of the acls into head as possible. */
+        base = req->rq_slen;
-        len_in_head = min_t(unsigned int, buf->head->iov_len - base, len);
-        len -= len_in_head;
+        if (args->npages != 0)
-        req->rq_slen = xdr_adjust_iovec(req->rq_svec, p + (len_in_head >> 2));
+                xdr_encode_pages(buf, args->pages, 0, args->len);
+        else
-        for (count = 0; (count << PAGE_SHIFT) < len; count++) {
+                req->rq_slen += args->len;
-                args->pages[count] = alloc_page(GFP_KERNEL);
-                if (!args->pages[count]) {
-                        while (count)
-                                __free_page(args->pages[--count]);
-                        return -ENOMEM;
-                }
-        }
-        xdr_encode_pages(buf, args->pages, 0, len);
        err = nfsacl_encode(buf, base, args->inode,
                            (args->mask & NFS_ACL) ?
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 30befc39b3c6..2a2a0a7143ad 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -21,7 +21,9 @@
 #define NFSDBG_FACILITY         NFSDBG_VFS
 /*
- * Check if fs_root is valid
+ * Convert the NFSv4 pathname components into a standard posix path.
+ *
+ * Note that the resulting string will be placed at the end of the buffer
 */
 static inline char *nfs4_pathname_string(const struct nfs4_pathname *pathname,
                                         char *buffer, ssize_t buflen)
@@ -99,21 +101,20 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
 {
        struct vfsmount *mnt = ERR_PTR(-ENOENT);
        char *mnt_path;
-        int page2len;
+        unsigned int maxbuflen;
        unsigned int s;
        mnt_path = nfs4_pathname_string(&location->rootpath, page2, PAGE_SIZE);
        if (IS_ERR(mnt_path))
                return mnt;
        mountdata->mnt_path = mnt_path;
-        page2 += strlen(mnt_path) + 1;
+        maxbuflen = mnt_path - 1 - page2;
-        page2len = PAGE_SIZE - strlen(mnt_path) - 1;
        for (s = 0; s < location->nservers; s++) {
                const struct nfs4_string *buf = &location->servers[s];
                struct sockaddr_storage addr;
-                if (buf->len <= 0 || buf->len >= PAGE_SIZE)
+                if (buf->len <= 0 || buf->len >= maxbuflen)
                        continue;
                mountdata->addr = (struct sockaddr *)&addr;
@@ -126,8 +127,8 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                        continue;
                nfs_set_port(mountdata->addr, NFS_PORT);
-                strncpy(page2, buf->data, page2len);
+                memcpy(page2, buf->data, buf->len);
-                page2[page2len] = '\0';
+                page2[buf->len] = '\0';
                mountdata->hostname = page2;
                snprintf(page, PAGE_SIZE, "%s:%s",
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index f65953be39c0..9250067943d8 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2596,6 +2596,7 @@ static nfsd4_enc nfsd4_enc_ops[] = {
        [OP_LOOKUPP]            = (nfsd4_enc)nfsd4_encode_noop,
        [OP_NVERIFY]            = (nfsd4_enc)nfsd4_encode_noop,
        [OP_OPEN]               = (nfsd4_enc)nfsd4_encode_open,
+        [OP_OPENATTR]           = (nfsd4_enc)nfsd4_encode_noop,
        [OP_OPEN_CONFIRM]       = (nfsd4_enc)nfsd4_encode_open_confirm,
        [OP_OPEN_DOWNGRADE]     = (nfsd4_enc)nfsd4_encode_open_downgrade,
        [OP_PUTFH]              = (nfsd4_enc)nfsd4_encode_noop,
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 3a9e5deed74d..19e3a96aa02c 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -176,7 +176,8 @@ static int ocfs2_dinode_insert_check(struct inode *inode,
        BUG_ON(OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL);
        mlog_bug_on_msg(!ocfs2_sparse_alloc(osb) &&
-                        (OCFS2_I(inode)->ip_clusters != rec->e_cpos),
+                        (OCFS2_I(inode)->ip_clusters !=
+                         le32_to_cpu(rec->e_cpos)),
                        "Device %s, asking for sparse allocation: inode %llu, "
                        "cpos %u, clusters %u\n",
                        osb->dev_str,
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index a067a6cffb01..8e1709a679b7 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -227,7 +227,7 @@ int ocfs2_read_inline_data(struct inode *inode, struct page *page,
        size = i_size_read(inode);
        if (size > PAGE_CACHE_SIZE ||
-            size > ocfs2_max_inline_data(inode->i_sb)) {
+            size > ocfs2_max_inline_data_with_xattr(inode->i_sb, di)) {
                ocfs2_error(inode->i_sb,
                            "Inode %llu has with inline data has bad size: %Lu",
                            (unsigned long long)OCFS2_I(inode)->ip_blkno,
@@ -1555,6 +1555,7 @@ static int ocfs2_try_to_write_inline_data(struct address_space *mapping,
        int ret, written = 0;
        loff_t end = pos + len;
        struct ocfs2_inode_info *oi = OCFS2_I(inode);
+        struct ocfs2_dinode *di = NULL;
        mlog(0, "Inode %llu, write of %u bytes at off %llu. features: 0x%x\n",
             (unsigned long long)oi->ip_blkno, len, (unsigned long long)pos,
@@ -1587,7 +1588,9 @@ static int ocfs2_try_to_write_inline_data(struct address_space *mapping,
        /*
         * Check whether the write can fit.
         */
-        if (mmap_page || end > ocfs2_max_inline_data(inode->i_sb))
+        di = (struct ocfs2_dinode *)wc->w_di_bh->b_data;
+        if (mmap_page ||
+            end > ocfs2_max_inline_data_with_xattr(inode->i_sb, di))
                return 0;
 do_inline_write:
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 084aba86c3b2..4b11762f249e 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -532,7 +532,8 @@ static int ocfs2_mknod_locked(struct ocfs2_super *osb,
                fe->i_dyn_features = cpu_to_le16(feat | OCFS2_INLINE_DATA_FL);
-                fe->id2.i_data.id_count = cpu_to_le16(ocfs2_max_inline_data(osb->sb));
+                fe->id2.i_data.id_count = cpu_to_le16(
+                                ocfs2_max_inline_data_with_xattr(osb->sb, fe));
        } else {
                fel = &fe->id2.i_list;
                fel->l_tree_depth = 0;
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index c7ae45aaa36c..2332ef740f4f 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -1070,12 +1070,6 @@ static inline int ocfs2_fast_symlink_chars(struct super_block *sb)
                 offsetof(struct ocfs2_dinode, id2.i_symlink);
 }
-static inline int ocfs2_max_inline_data(struct super_block *sb)
-{
-        return sb->s_blocksize -
-                offsetof(struct ocfs2_dinode, id2.i_data.id_data);
-}
 static inline int ocfs2_max_inline_data_with_xattr(struct super_block *sb,
                                                   struct ocfs2_dinode *di)
 {
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 4ddd788add67..2563df89fc2a 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -547,8 +547,12 @@ int ocfs2_calc_xattr_init(struct inode *dir,
         * when blocksize = 512, may reserve one more cluser for
         * xattr bucket, otherwise reserve one metadata block
         * for them is ok.
+         * If this is a new directory with inline data,
+         * we choose to reserve the entire inline area for
+         * directory contents and force an external xattr block.
         */
        if (dir->i_sb->s_blocksize == OCFS2_MIN_BLOCKSIZE ||
+            (S_ISDIR(mode) && ocfs2_supports_inline_data(osb)) ||
            (s_size + a_size) > OCFS2_XATTR_FREE_IN_IBODY) {
                ret = ocfs2_reserve_new_metadata_blocks(osb, 1, xattr_ac);
                if (ret) {
@@ -4791,19 +4795,33 @@ static int ocfs2_xattr_bucket_set_value_outside(struct inode *inode,
                                                char *val,
                                                int value_len)
 {
-        int offset;
+        int ret, offset, block_off;
        struct ocfs2_xattr_value_root *xv;
        struct ocfs2_xattr_entry *xe = xs->here;
+        struct ocfs2_xattr_header *xh = bucket_xh(xs->bucket);
+        void *base;
        BUG_ON(!xs->base || !xe || ocfs2_xattr_is_local(xe));
-        offset = le16_to_cpu(xe->xe_name_offset) +
+        ret = ocfs2_xattr_bucket_get_name_value(inode, xh,
-                 OCFS2_XATTR_SIZE(xe->xe_name_len);
+                                                xe - xh->xh_entries,
+                                                &block_off,
+                                                &offset);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
-        xv = (struct ocfs2_xattr_value_root *)(xs->base + offset);
+        base = bucket_block(xs->bucket, block_off);
+        xv = (struct ocfs2_xattr_value_root *)(base + offset +
+                 OCFS2_XATTR_SIZE(xe->xe_name_len));
-        return __ocfs2_xattr_set_value_outside(inode, handle,
+        ret = __ocfs2_xattr_set_value_outside(inode, handle,
-                                               xv, val, value_len);
+                                              xv, val, value_len);
+        if (ret)
+                mlog_errno(ret);
+out:
+        return ret;
 }
 static int ocfs2_rm_xattr_cluster(struct inode *inode,
diff --git a/fs/pipe.c b/fs/pipe.c
index 3a48ba5179d5..14f502b89cf5 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -699,12 +699,12 @@ pipe_rdwr_fasync(int fd, struct file *filp, int on)
        int retval;
        mutex_lock(&inode->i_mutex);
        retval = fasync_helper(fd, filp, on, &pipe->fasync_readers);
+        if (retval >= 0) {
-        if (retval >= 0)
                retval = fasync_helper(fd, filp, on, &pipe->fasync_writers);
+                if (retval < 0) /* this can happen only if on == T */
+                        fasync_helper(-1, filp, 0, &pipe->fasync_readers);
+        }
        mutex_unlock(&inode->i_mutex);
        if (retval < 0)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 0c9de19a1633..beaa0ce3b82e 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -3066,7 +3066,6 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
        int retval = -ENOENT;
        ino_t ino;
        int tid;
-        unsigned long pos = filp->f_pos;  /* avoiding "long long" filp->f_pos */
        struct pid_namespace *ns;
        task = get_proc_task(inode);
@@ -3083,18 +3082,18 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
                goto out_no_task;
        retval = 0;
-        switch (pos) {
+        switch ((unsigned long)filp->f_pos) {
        case 0:
                ino = inode->i_ino;
-                if (filldir(dirent, ".", 1, pos, ino, DT_DIR) < 0)
+                if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) < 0)
                        goto out;
-                pos++;
+                filp->f_pos++;
                /* fall through */
        case 1:
                ino = parent_ino(dentry);
-                if (filldir(dirent, "..", 2, pos, ino, DT_DIR) < 0)
+                if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) < 0)
                        goto out;
-                pos++;
+                filp->f_pos++;
                /* fall through */
        }
@@ -3104,9 +3103,9 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
        ns = filp->f_dentry->d_sb->s_fs_info;
        tid = (int)filp->f_version;
        filp->f_version = 0;
-        for (task = first_tid(leader, tid, pos - 2, ns);
+        for (task = first_tid(leader, tid, filp->f_pos - 2, ns);
             task;
-             task = next_tid(task), pos++) {
+             task = next_tid(task), filp->f_pos++) {
                tid = task_pid_nr_ns(task, ns);
                if (proc_task_fill_cache(filp, dirent, filldir, task, tid) < 0) {
                        /* returning this tgid failed, save it as the first
@@ -3117,7 +3116,6 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
                }
        }
 out:
-        filp->f_pos = pos;
        put_task_struct(leader);
 out_no_task:
        return retval;
diff --git a/fs/proc/page.c b/fs/proc/page.c
index 2d1345112a42..e9983837d08d 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -80,7 +80,7 @@ static const struct file_operations proc_kpagecount_operations = {
 #define KPF_RECLAIM    9
 #define KPF_BUDDY     10
-#define kpf_copy_bit(flags, srcpos, dstpos) (((flags >> srcpos) & 1) << dstpos)
+#define kpf_copy_bit(flags, dstpos, srcpos) (((flags >> srcpos) & 1) << dstpos)
 static ssize_t kpageflags_read(struct file *file, char __user *buf,
                             size_t count, loff_t *ppos)
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index b9b567a28376..5d7c7ececa64 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -114,6 +114,9 @@ int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
                if (!pagevec_add(&lru_pvec, page))
                        __pagevec_lru_add_file(&lru_pvec);
+                /* prevent the page from being discarded on memory pressure */
+                SetPageDirty(page);
                unlock_page(page);
        }
@@ -126,6 +129,7 @@ int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
        return -EFBIG;
 add_error:
+        pagevec_lru_add_file(&lru_pvec);
        page_cache_release(pages + loop);
        for (loop++; loop < npages; loop++)
                __free_page(pages + loop);
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index c837dfc2b3c6..2a7960310349 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -80,7 +80,7 @@ static struct buffer_head *get_block_length(struct super_block *sb,
 * generated a larger block - this does occasionally happen with zlib).
 */
 int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
-                        int length, u64 *next_index, int srclength)
+                        int length, u64 *next_index, int srclength, int pages)
 {
        struct squashfs_sb_info *msblk = sb->s_fs_info;
        struct buffer_head **bh;
@@ -184,7 +184,7 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                                offset = 0;
                        }
-                        if (msblk->stream.avail_out == 0) {
+                        if (msblk->stream.avail_out == 0 && page < pages) {
                                msblk->stream.next_out = buffer[page++];
                                msblk->stream.avail_out = PAGE_CACHE_SIZE;
                        }
@@ -201,25 +201,20 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                                zlib_init = 1;
                        }
-                        zlib_err = zlib_inflate(&msblk->stream, Z_NO_FLUSH);
+                        zlib_err = zlib_inflate(&msblk->stream, Z_SYNC_FLUSH);
                        if (msblk->stream.avail_in == 0 && k < b)
                                put_bh(bh[k++]);
                } while (zlib_err == Z_OK);
                if (zlib_err != Z_STREAM_END) {
-                        ERROR("zlib_inflate returned unexpected result"
+                        ERROR("zlib_inflate error, data probably corrupt\n");
-                                " 0x%x, srclength %d, avail_in %d,"
-                                " avail_out %d\n", zlib_err, srclength,
-                                msblk->stream.avail_in,
-                                msblk->stream.avail_out);
                        goto release_mutex;
                }
                zlib_err = zlib_inflateEnd(&msblk->stream);
                if (zlib_err != Z_OK) {
-                        ERROR("zlib_inflateEnd returned unexpected result 0x%x,"
+                        ERROR("zlib_inflate error, data probably corrupt\n");
-                                " srclength %d\n", zlib_err, srclength);
                        goto release_mutex;
                }
                length = msblk->stream.total_out;
@@ -268,7 +263,8 @@ block_release:
                put_bh(bh[k]);
 read_failure:
-        ERROR("sb_bread failed reading block 0x%llx\n", cur_index);
+        ERROR("squashfs_read_data failed to read block 0x%llx\n",
+                                        (unsigned long long) index);
        kfree(bh);
        return -EIO;
 }
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index f29eda16d25e..1c4739e33af6 100644
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -119,7 +119,7 @@ struct squashfs_cache_entry *squashfs_cache_get(struct super_block *sb,
                        entry->length = squashfs_read_data(sb, entry->data,
                                block, length, &entry->next_index,
-                                cache->block_size);
+                                cache->block_size, cache->pages);
                        spin_lock(&cache->lock);
@@ -406,7 +406,7 @@ int squashfs_read_table(struct super_block *sb, void *buffer, u64 block,
        for (i = 0; i < pages; i++, buffer += PAGE_CACHE_SIZE)
                data[i] = buffer;
        res = squashfs_read_data(sb, data, block, length |
-                SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, length);
+                SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, length, pages);
        kfree(data);
        return res;
 }
diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c
index 7a63398bb855..9101dbde39ec 100644
--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -133,7 +133,8 @@ int squashfs_read_inode(struct inode *inode, long long ino)
        type = le16_to_cpu(sqshb_ino->inode_type);
        switch (type) {
        case SQUASHFS_REG_TYPE: {
-                unsigned int frag_offset, frag_size, frag;
+                unsigned int frag_offset, frag;
+                int frag_size;
                u64 frag_blk;
                struct squashfs_reg_inode *sqsh_ino = &squashfs_ino.reg;
@@ -175,7 +176,8 @@ int squashfs_read_inode(struct inode *inode, long long ino)
                break;
        }
        case SQUASHFS_LREG_TYPE: {
-                unsigned int frag_offset, frag_size, frag;
+                unsigned int frag_offset, frag;
+                int frag_size;
                u64 frag_blk;
                struct squashfs_lreg_inode *sqsh_ino = &squashfs_ino.lreg;
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 6b2515d027d5..0e9feb6adf7e 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -34,7 +34,7 @@ static inline struct squashfs_inode_info *squashfs_i(struct inode *inode)
 /* block.c */
 extern int squashfs_read_data(struct super_block *, void **, u64, int, u64 *,
-                                int);
+                                int, int);
 /* cache.c */
 extern struct squashfs_cache *squashfs_cache_init(char *, int, int);
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 071df5b5b491..681ec0d83799 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -389,7 +389,7 @@ static int __init init_squashfs_fs(void)
                return err;
        }
-        printk(KERN_INFO "squashfs: version 4.0 (2009/01/03) "
+        printk(KERN_INFO "squashfs: version 4.0 (2009/01/31) "
                "Phillip Lougher\n");
        return 0;
diff --git a/fs/super.c b/fs/super.c
index 8349ed6b1412..6ce501447ada 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -371,8 +371,10 @@ retry:
                                continue;
                        if (!grab_super(old))
                                goto retry;
-                        if (s)
+                        if (s) {
+                                up_write(&s->s_umount);
                                destroy_super(s);
+                        }
                        return old;
                }
        }
@@ -387,6 +389,7 @@ retry:
        err = set(s, data);
        if (err) {
                spin_unlock(&sb_lock);
+                up_write(&s->s_umount);
                destroy_super(s);
                return ERR_PTR(err);
        }
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index e65212dfb60e..261a1c2f22dd 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -41,7 +41,7 @@
 * Stefan Reinauer <stepan@home.culture.mipt.ru>
 *
 * Module usage counts added on 96/04/29 by
- * Gertjan van Wingerde <gertjan@cs.vu.nl>
+ * Gertjan van Wingerde <gwingerde@gmail.com>
 *
 * Clean swab support on 19970406 by
 * Francois-Rene Rideau <fare@tunes.org>
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index cb329edc925b..aa1016bb9134 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -34,6 +34,12 @@
 #include <linux/backing-dev.h>
 #include <linux/freezer.h>
+#include "xfs_sb.h"
+#include "xfs_inum.h"
+#include "xfs_ag.h"
+#include "xfs_dmapi.h"
+#include "xfs_mount.h"
 static kmem_zone_t *xfs_buf_zone;
 STATIC int xfsbufd(void *);
 STATIC int xfsbufd_wakeup(int, gfp_t);
@@ -1435,10 +1441,12 @@ xfs_unregister_buftarg(
 void
 xfs_free_buftarg(
-        xfs_buftarg_t           *btp)
+        struct xfs_mount        *mp,
+        struct xfs_buftarg      *btp)
 {
        xfs_flush_buftarg(btp, 1);
-        xfs_blkdev_issue_flush(btp);
+        if (mp->m_flags & XFS_MOUNT_BARRIER)
+                xfs_blkdev_issue_flush(btp);
        xfs_free_bufhash(btp);
        iput(btp->bt_mapping->host);
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index 288ae7c4c800..9b4d666ad31f 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -413,7 +413,7 @@ static inline int XFS_bwrite(xfs_buf_t *bp)
 *      Handling of buftargs.
 */
 extern xfs_buftarg_t *xfs_alloc_buftarg(struct block_device *, int);
-extern void xfs_free_buftarg(xfs_buftarg_t *);
+extern void xfs_free_buftarg(struct xfs_mount *, struct xfs_buftarg *);
 extern void xfs_wait_buftarg(xfs_buftarg_t *);
 extern int xfs_setsize_buftarg(xfs_buftarg_t *, unsigned int, unsigned int);
 extern int xfs_flush_buftarg(xfs_buftarg_t *, int);
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index c71e226da7f5..32ae5028e96b 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -734,15 +734,15 @@ xfs_close_devices(
 {
        if (mp->m_logdev_targp && mp->m_logdev_targp != mp->m_ddev_targp) {
                struct block_device *logdev = mp->m_logdev_targp->bt_bdev;
-                xfs_free_buftarg(mp->m_logdev_targp);
+                xfs_free_buftarg(mp, mp->m_logdev_targp);
                xfs_blkdev_put(logdev);
        }
        if (mp->m_rtdev_targp) {
                struct block_device *rtdev = mp->m_rtdev_targp->bt_bdev;
-                xfs_free_buftarg(mp->m_rtdev_targp);
+                xfs_free_buftarg(mp, mp->m_rtdev_targp);
                xfs_blkdev_put(rtdev);
        }
-        xfs_free_buftarg(mp->m_ddev_targp);
+        xfs_free_buftarg(mp, mp->m_ddev_targp);
 }
 /*
@@ -811,9 +811,9 @@ xfs_open_devices(
 out_free_rtdev_targ:
        if (mp->m_rtdev_targp)
-                xfs_free_buftarg(mp->m_rtdev_targp);
+                xfs_free_buftarg(mp, mp->m_rtdev_targp);
 out_free_ddev_targ:
-        xfs_free_buftarg(mp->m_ddev_targp);
+        xfs_free_buftarg(mp, mp->m_ddev_targp);
 out_close_rtdev:
        if (rtdev)
                xfs_blkdev_put(rtdev);
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index e2fb6210d4c5..478e587087fe 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -246,9 +246,6 @@ xfs_iget_cache_miss(
                goto out_destroy;
        }
-        if (lock_flags)
-                xfs_ilock(ip, lock_flags);
        /*
         * Preload the radix tree so we can insert safely under the
         * write spinlock. Note that we cannot sleep inside the preload
@@ -256,7 +253,16 @@ xfs_iget_cache_miss(
         */
        if (radix_tree_preload(GFP_KERNEL)) {
                error = EAGAIN;
-                goto out_unlock;
+                goto out_destroy;
+        }
+        /*
+         * Because the inode hasn't been added to the radix-tree yet it can't
+         * be found by another thread, so we can do the non-sleeping lock here.
+         */
+        if (lock_flags) {
+                if (!xfs_ilock_nowait(ip, lock_flags))
+                        BUG();
        }
        mask = ~(((XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_inodelog)) - 1);
@@ -284,7 +290,6 @@ xfs_iget_cache_miss(
 out_preload_end:
        write_unlock(&pag->pag_ici_lock);
        radix_tree_preload_end();
-out_unlock:
        if (lock_flags)
                xfs_iunlock(ip, lock_flags);
 out_destroy:
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index b1047de2fffd..61af610d79b3 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1455,10 +1455,19 @@ xlog_recover_add_to_trans(
        item = item->ri_prev;
        if (item->ri_total == 0) {              /* first region to be added */
-                item->ri_total  = in_f->ilf_size;
+                if (in_f->ilf_size == 0 ||
-                ASSERT(item->ri_total <= XLOG_MAX_REGIONS_IN_ITEM);
+                    in_f->ilf_size > XLOG_MAX_REGIONS_IN_ITEM) {
-                item->ri_buf = kmem_zalloc((item->ri_total *
+                        xlog_warn(
-                                            sizeof(xfs_log_iovec_t)), KM_SLEEP);
+        "XFS: bad number of regions (%d) in inode log format",
+                                  in_f->ilf_size);
+                        ASSERT(0);
+                        return XFS_ERROR(EIO);
+                }
+                item->ri_total = in_f->ilf_size;
+                item->ri_buf =
+                        kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
+                                    KM_SLEEP);
        }
        ASSERT(item->ri_total > item->ri_cnt);
        /* Description region is ri_buf[0] */