22 files changed, 99 insertions, 54 deletions

diff --git a/fs/aio.c b/fs/aio.c
index b74c567383bc..6af921940622 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -996,6 +996,14 @@ put_rq:
         /* everything turned out well, dispose of the aiocb. */
         ret = __aio_put_req(ctx, iocb);
 
+        /*
+         * We have to order our ring_info tail store above and test
+         * of the wait list below outside the wait lock.  This is
+         * like in wake_up_bit() where clearing a bit has to be
+         * ordered with the unlocked test.
+         */
+        smp_mb();
+
         if (waitqueue_active(&ctx->wait))
                 wake_up(&ctx->wait);
 
diff --git a/fs/bio.c b/fs/bio.c
index 3312fcc3c098..553b5b7960ad 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -1194,6 +1194,8 @@ EXPORT_SYMBOL(bio_hw_segments);
 EXPORT_SYMBOL(bio_add_page);
 EXPORT_SYMBOL(bio_add_pc_page);
 EXPORT_SYMBOL(bio_get_nr_vecs);
+EXPORT_SYMBOL(bio_map_user);
+EXPORT_SYMBOL(bio_unmap_user);
 EXPORT_SYMBOL(bio_map_kern);
 EXPORT_SYMBOL(bio_pair_release);
 EXPORT_SYMBOL(bio_split);
diff --git a/fs/buffer.c b/fs/buffer.c
index ddfdd2c80bf9..7ba58386beee 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -3213,7 +3213,7 @@ static int buffer_cpu_notify(struct notifier_block *self,
 }
 
 /**
- * bh_uptodate_or_lock: Test whether the buffer is uptodate
+ * bh_uptodate_or_lock - Test whether the buffer is uptodate
  * @bh: struct buffer_head
  *
  * Return true if the buffer is up-to-date and false,
@@ -3232,7 +3232,7 @@ int bh_uptodate_or_lock(struct buffer_head *bh)
 EXPORT_SYMBOL(bh_uptodate_or_lock);
 
 /**
- * bh_submit_read: Submit a locked buffer for reading
+ * bh_submit_read - Submit a locked buffer for reading
  * @bh: struct buffer_head
  *
  * Returns zero on success and -EIO on error.
diff --git a/fs/dquot.c b/fs/dquot.c
index 9c7feb62eed1..41b9dbd68b0e 100644
--- a/fs/dquot.c
+++ b/fs/dquot.c
@@ -1522,8 +1522,8 @@ int vfs_quota_off(struct super_block *sb, int type)
                                 truncate_inode_pages(&toputinode[cnt]->i_data, 0);
                                 mutex_unlock(&toputinode[cnt]->i_mutex);
                                 mark_inode_dirty(toputinode[cnt]);
-                                iput(toputinode[cnt]);
                         }
+                        iput(toputinode[cnt]);
                         mutex_unlock(&dqopt->dqonoff_mutex);
                 }
         if (sb->s_bdev)
diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
index 841a032050a7..5e596583946c 100644
--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -80,8 +80,8 @@ static void ecryptfs_d_release(struct dentry *dentry)
 {
         if (ecryptfs_dentry_to_private(dentry)) {
                 if (ecryptfs_dentry_to_lower(dentry)) {
-                        mntput(ecryptfs_dentry_to_lower_mnt(dentry));
                         dput(ecryptfs_dentry_to_lower(dentry));
+                        mntput(ecryptfs_dentry_to_lower_mnt(dentry));
                 }
                 kmem_cache_free(ecryptfs_dentry_info_cache,
                                 ecryptfs_dentry_to_private(dentry));
diff --git a/fs/ext3/acl.c b/fs/ext3/acl.c
index d34e9967430a..a754d1848173 100644
--- a/fs/ext3/acl.c
+++ b/fs/ext3/acl.c
@@ -37,7 +37,7 @@ ext3_acl_from_disk(const void *value, size_t size)
                 return ERR_PTR(-EINVAL);
         if (count == 0)
                 return NULL;
-        acl = posix_acl_alloc(count, GFP_KERNEL);
+        acl = posix_acl_alloc(count, GFP_NOFS);
         if (!acl)
                 return ERR_PTR(-ENOMEM);
         for (n=0; n < count; n++) {
@@ -91,7 +91,7 @@ ext3_acl_to_disk(const struct posix_acl *acl, size_t *size)
 
         *size = ext3_acl_size(acl->a_count);
         ext_acl = kmalloc(sizeof(ext3_acl_header) + acl->a_count *
-                        sizeof(ext3_acl_entry), GFP_KERNEL);
+                        sizeof(ext3_acl_entry), GFP_NOFS);
         if (!ext_acl)
                 return ERR_PTR(-ENOMEM);
         ext_acl->a_version = cpu_to_le32(EXT3_ACL_VERSION);
@@ -187,7 +187,7 @@ ext3_get_acl(struct inode *inode, int type)
         }
         retval = ext3_xattr_get(inode, name_index, "", NULL, 0);
         if (retval > 0) {
-                value = kmalloc(retval, GFP_KERNEL);
+                value = kmalloc(retval, GFP_NOFS);
                 if (!value)
                         return ERR_PTR(-ENOMEM);
                 retval = ext3_xattr_get(inode, name_index, "", value, retval);
@@ -335,7 +335,7 @@ ext3_init_acl(handle_t *handle, struct inode *inode, struct inode *dir)
                         if (error)
                                 goto cleanup;
                 }
-                clone = posix_acl_clone(acl, GFP_KERNEL);
+                clone = posix_acl_clone(acl, GFP_NOFS);
                 error = -ENOMEM;
                 if (!clone)
                         goto cleanup;
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 9397d779c43d..0e97b6e07cb0 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -485,7 +485,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
                 goto exit_dindj;
 
         n_group_desc = kmalloc((gdb_num + 1) * sizeof(struct buffer_head *),
-                        GFP_KERNEL);
+                        GFP_NOFS);
         if (!n_group_desc) {
                 err = -ENOMEM;
                 ext3_warning (sb, __FUNCTION__,
@@ -568,7 +568,7 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
         int res, i;
         int err;
 
-        primary = kmalloc(reserved_gdb * sizeof(*primary), GFP_KERNEL);
+        primary = kmalloc(reserved_gdb * sizeof(*primary), GFP_NOFS);
         if (!primary)
                 return -ENOMEM;
 
diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
index fb89c299bece..a6ea4d6a8bb2 100644
--- a/fs/ext3/xattr.c
+++ b/fs/ext3/xattr.c
@@ -728,7 +728,7 @@ ext3_xattr_block_set(handle_t *handle, struct inode *inode,
                                 ce = NULL;
                         }
                         ea_bdebug(bs->bh, "cloning");
-                        s->base = kmalloc(bs->bh->b_size, GFP_KERNEL);
+                        s->base = kmalloc(bs->bh->b_size, GFP_NOFS);
                         error = -ENOMEM;
                         if (s->base == NULL)
                                 goto cleanup;
@@ -740,7 +740,7 @@ ext3_xattr_block_set(handle_t *handle, struct inode *inode,
                 }
         } else {
                 /* Allocate a buffer where we construct the new block. */
-                s->base = kzalloc(sb->s_blocksize, GFP_KERNEL);
+                s->base = kzalloc(sb->s_blocksize, GFP_NOFS);
                 /* assert(header == s->base) */
                 error = -ENOMEM;
                 if (s->base == NULL)
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index c0076077d338..06557679ca41 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -751,7 +751,7 @@ int generic_osync_inode(struct inode *inode, struct address_space *mapping, int
 EXPORT_SYMBOL(generic_osync_inode);
 
 /**
- * writeback_acquire: attempt to get exclusive writeback access to a device
+ * writeback_acquire - attempt to get exclusive writeback access to a device
  * @bdi: the device's backing_dev_info structure
  *
  * It is a waste of resources to have more than one pdflush thread blocked on
@@ -768,7 +768,7 @@ int writeback_acquire(struct backing_dev_info *bdi)
 }
 
 /**
- * writeback_in_progress: determine whether there is writeback in progress
+ * writeback_in_progress - determine whether there is writeback in progress
  * @bdi: the device's backing_dev_info structure.
  *
  * Determine whether there is writeback in progress against a backing device.
@@ -779,7 +779,7 @@ int writeback_in_progress(struct backing_dev_info *bdi)
 }
 
 /**
- * writeback_release: relinquish exclusive writeback access against a device.
+ * writeback_release - relinquish exclusive writeback access against a device.
  * @bdi: the device's backing_dev_info structure
  */
 void writeback_release(struct backing_dev_info *bdi)
diff --git a/fs/isofs/compress.c b/fs/isofs/compress.c
index 37dbd6404787..defb932eee9a 100644
--- a/fs/isofs/compress.c
+++ b/fs/isofs/compress.c
@@ -72,6 +72,17 @@ static int zisofs_readpage(struct file *file, struct page *page)
         offset = index & ~zisofs_block_page_mask;
         blockindex = offset >> zisofs_block_page_shift;
         maxpage = (inode->i_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+
+        /*
+         * If this page is wholly outside i_size we just return zero;
+         * do_generic_file_read() will handle this for us
+         */
+        if (page->index >= maxpage) {
+                SetPageUptodate(page);
+                unlock_page(page);
+                return 0;
+        }
+
         maxpage = min(zisofs_block_pages, maxpage-offset);
 
         for ( i = 0 ; i < maxpage ; i++, offset++ ) {
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 3943a8905eb2..9816293442ab 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -697,13 +697,14 @@ fail:
  */
 
 /**
- *  journal_t * journal_init_dev() - creates an initialises a journal structure
+ *  journal_t * journal_init_dev() - creates and initialises a journal structure
  *  @bdev: Block device on which to create the journal
  *  @fs_dev: Device which hold journalled filesystem for this journal.
  *  @start: Block nr Start of journal.
  *  @len:  Length of the journal in blocks.
  *  @blocksize: blocksize of journalling device
- *  @returns: a newly created journal_t *
+ *
+ *  Returns: a newly created journal_t *
  *
  *  journal_init_dev creates a journal which maps a fixed contiguous
  *  range of blocks on an arbitrary block device.
diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
index 2b8edf4d6eaa..43bc5e5ed064 100644
--- a/fs/jbd/recovery.c
+++ b/fs/jbd/recovery.c
@@ -478,7 +478,7 @@ static int do_one_pass(journal_t *journal,
                                         memcpy(nbh->b_data, obh->b_data,
                                                         journal->j_blocksize);
                                         if (flags & JFS_FLAG_ESCAPE) {
-                                                *((__be32 *)bh->b_data) =
+                                                *((__be32 *)nbh->b_data) =
                                                 cpu_to_be32(JFS_MAGIC_NUMBER);
                                         }
 
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index c6cbb6cd59b2..2c9e8f5d13aa 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -1426,7 +1426,8 @@ int journal_stop(handle_t *handle)
         return err;
 }
 
-/**int journal_force_commit() - force any uncommitted transactions
+/**
+ * int journal_force_commit() - force any uncommitted transactions
  * @journal: journal to force
  *
  * For synchronous operations: force any uncommitted transactions
@@ -1903,13 +1904,12 @@ zap_buffer_unlocked:
 }
 
 /**
- * void journal_invalidatepage()
- * @journal: journal to use for flush...
+ * void journal_invalidatepage() - invalidate a journal page
+ * @journal: journal to use for flush
  * @page:    page to flush
  * @offset:  length of page to invalidate.
  *
  * Reap page buffers containing data after offset in page.
- *
  */
 void journal_invalidatepage(journal_t *journal,
                       struct page *page,
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 146411387ada..5d0405a9e7ca 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -535,7 +535,7 @@ static int do_one_pass(journal_t *journal,
                                         memcpy(nbh->b_data, obh->b_data,
                                                         journal->j_blocksize);
                                         if (flags & JBD2_FLAG_ESCAPE) {
-                                                *((__be32 *)bh->b_data) =
+                                                *((__be32 *)nbh->b_data) =
                                                 cpu_to_be32(JBD2_MAGIC_NUMBER);
                                         }
 
diff --git a/fs/locks.c b/fs/locks.c
index f36f0e61558d..d83fab1b77b5 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1275,13 +1275,13 @@ out:
 EXPORT_SYMBOL(__break_lease);
 
 /**
- *      lease_get_mtime
+ *      lease_get_mtime - get the last modified time of an inode
  *      @inode: the inode
  *      @time:  pointer to a timespec which will contain the last modified time
  *
  * This is to force NFS clients to flush their caches for files with
  * exclusive leases.  The justification is that if someone has an
- * exclusive lease, then they could be modifiying it.
+ * exclusive lease, then they could be modifying it.
  */
 void lease_get_mtime(struct inode *inode, struct timespec *time)
 {
diff --git a/fs/namei.c b/fs/namei.c
index 941c8e8228c0..6b7a0eef4090 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1364,13 +1364,13 @@ static int __lookup_one_len(const char *name, struct qstr *this,
 }
 
 /**
- * lookup_one_len:  filesystem helper to lookup single pathname component
+ * lookup_one_len - filesystem helper to lookup single pathname component
  * @name:       pathname component to lookup
  * @base:       base directory to lookup from
  * @len:        maximum length @len should be interpreted to
  *
- * Note that this routine is purely a helper for filesystem useage and should
- * not be called by generic code.  Also note that by using this function to
+ * Note that this routine is purely a helper for filesystem usage and should
+ * not be called by generic code.  Also note that by using this function the
  * nameidata argument is passed to the filesystem methods and a filesystem
  * using this helper needs to be prepared for that.
  */
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 3d7d9631e125..5a70be589bbe 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -533,7 +533,10 @@ readpage_async_filler(void *data, struct page *page)
 
         if (len < PAGE_CACHE_SIZE)
                 zero_user_segment(page, len, PAGE_CACHE_SIZE);
-        nfs_pageio_add_request(desc->pgio, new);
+        if (!nfs_pageio_add_request(desc->pgio, new)) {
+                error = desc->pgio->pg_error;
+                goto out_unlock;
+        }
         return 0;
 out_error:
         error = PTR_ERR(new);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 80c61fdb2720..bed63416a55b 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -39,6 +39,7 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context*,
                                             unsigned int, unsigned int);
 static void nfs_pageio_init_write(struct nfs_pageio_descriptor *desc,
                                   struct inode *inode, int ioflags);
+static void nfs_redirty_request(struct nfs_page *req);
 static const struct rpc_call_ops nfs_write_partial_ops;
 static const struct rpc_call_ops nfs_write_full_ops;
 static const struct rpc_call_ops nfs_commit_ops;
@@ -288,7 +289,12 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                 BUG();
         }
         spin_unlock(&inode->i_lock);
-        nfs_pageio_add_request(pgio, req);
+        if (!nfs_pageio_add_request(pgio, req)) {
+                nfs_redirty_request(req);
+                nfs_end_page_writeback(page);
+                nfs_clear_page_tag_locked(req);
+                return pgio->pg_error;
+        }
         return 0;
 }
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 770de444eba0..81d7d145292a 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1036,6 +1036,26 @@ static const struct file_operations proc_loginuid_operations = {
         .read           = proc_loginuid_read,
         .write          = proc_loginuid_write,
 };
+
+static ssize_t proc_sessionid_read(struct file * file, char __user * buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct inode * inode = file->f_path.dentry->d_inode;
+        struct task_struct *task = get_proc_task(inode);
+        ssize_t length;
+        char tmpbuf[TMPBUFLEN];
+
+        if (!task)
+                return -ESRCH;
+        length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
+                                audit_get_sessionid(task));
+        put_task_struct(task);
+        return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
+}
+
+static const struct file_operations proc_sessionid_operations = {
+        .read           = proc_sessionid_read,
+};
 #endif
 
 #ifdef CONFIG_FAULT_INJECTION
@@ -2319,6 +2339,7 @@ static const struct pid_entry tgid_base_stuff[] = {
         REG("oom_adj",    S_IRUGO|S_IWUSR, oom_adjust),
 #ifdef CONFIG_AUDITSYSCALL
         REG("loginuid",   S_IWUSR|S_IRUGO, loginuid),
+        REG("sessionid",  S_IRUSR, sessionid),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
         REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
@@ -2649,6 +2670,7 @@ static const struct pid_entry tid_base_stuff[] = {
         REG("oom_adj",   S_IRUGO|S_IWUSR, oom_adjust),
 #ifdef CONFIG_AUDITSYSCALL
         REG("loginuid",  S_IWUSR|S_IRUGO, loginuid),
+        REG("sessionid",  S_IRUSR, sessionid),
 #endif
 #ifdef CONFIG_FAULT_INJECTION
         REG("make-it-fail", S_IRUGO|S_IWUSR, fault_inject),
diff --git a/fs/romfs/inode.c b/fs/romfs/inode.c
index 00b6f0a518c8..3f13d491c7c7 100644
--- a/fs/romfs/inode.c
+++ b/fs/romfs/inode.c
@@ -340,8 +340,9 @@ static struct dentry *
 romfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
         unsigned long offset, maxoff;
-        int fslen, res;
-        struct inode *inode;
+        long res;
+        int fslen;
+        struct inode *inode = NULL;
         char fsname[ROMFS_MAXFN];       /* XXX dynamic? */
         struct romfs_inode ri;
         const char *name;               /* got from dentry */
@@ -351,7 +352,7 @@ romfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
         offset = dir->i_ino & ROMFH_MASK;
         lock_kernel();
         if (romfs_copyfrom(dir, &ri, offset, ROMFH_SIZE) <= 0)
-                goto out;
+                goto error;
 
         maxoff = romfs_maxsize(dir->i_sb);
         offset = be32_to_cpu(ri.spec) & ROMFH_MASK;
@@ -364,9 +365,9 @@ romfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 
         for(;;) {
                 if (!offset || offset >= maxoff)
-                        goto out0;
+                        goto success; /* negative success */
                 if (romfs_copyfrom(dir, &ri, offset, ROMFH_SIZE) <= 0)
-                        goto out;
+                        goto error;
 
                 /* try to match the first 16 bytes of name */
                 fslen = romfs_strnlen(dir, offset+ROMFH_SIZE, ROMFH_SIZE);
@@ -397,23 +398,14 @@ romfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
         inode = romfs_iget(dir->i_sb, offset);
         if (IS_ERR(inode)) {
                 res = PTR_ERR(inode);
-                goto out;
+                goto error;
         }
 
-        /*
-         * it's a bit funky, _lookup needs to return an error code
-         * (negative) or a NULL, both as a dentry.  ENOENT should not
-         * be returned, instead we need to create a negative dentry by
-         * d_add(dentry, NULL); and return 0 as no error.
-         * (Although as I see, it only matters on writable file
-         * systems).
-         */
-
-out0:   inode = NULL;
+success:
+        d_add(dentry, inode);
         res = 0;
-        d_add (dentry, inode);
-
-out:    unlock_kernel();
+error:
+        unlock_kernel();
         return ERR_PTR(res);
 }
 
diff --git a/fs/super.c b/fs/super.c
index 010446d8c40a..d0a941a4e620 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -556,11 +556,11 @@ out:
 }
 
 /**
- *      mark_files_ro
+ *      mark_files_ro - mark all files read-only
  *      @sb: superblock in question
  *
- *      All files are marked read/only.  We don't care about pending
- *      delete files so this should be used in 'force' mode only
+ *      All files are marked read-only.  We don't care about pending
+ *      delete files so this should be used in 'force' mode only.
  */
 
 static void mark_files_ro(struct super_block *sb)
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index 1fca381f0ce2..1e7598fb9787 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -315,8 +315,8 @@ static void ufs_change_blocknr(struct inode *inode, sector_t beg,
                         }
 
                         UFSD(" change from %llu to %llu, pos %u\n",
-                             (unsigned long long)pos + oldb,
-                             (unsigned long long)pos + newb, pos);
+                             (unsigned long long)(pos + oldb),
+                             (unsigned long long)(pos + newb), pos);
 
                         bh->b_blocknr = newb + pos;
                         unmap_underlying_metadata(bh->b_bdev,