9 files changed, 62 insertions, 23 deletions

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index e5eaa62fd17f..e3fe9918faaf 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -274,6 +274,7 @@ __sync_single_inode(struct inode *inode, struct writeback_control *wbc)
         int ret;
 
         BUG_ON(inode->i_state & I_SYNC);
+        WARN_ON(inode->i_state & I_NEW);
 
         /* Set I_SYNC, reset I_DIRTY */
         dirty = inode->i_state & I_DIRTY;
@@ -298,6 +299,7 @@ __sync_single_inode(struct inode *inode, struct writeback_control *wbc)
         }
 
         spin_lock(&inode_lock);
+        WARN_ON(inode->i_state & I_NEW);
         inode->i_state &= ~I_SYNC;
         if (!(inode->i_state & I_FREEING)) {
                 if (!(inode->i_state & I_DIRTY) &&
@@ -470,6 +472,11 @@ void generic_sync_sb_inodes(struct super_block *sb,
                         break;
                 }
 
+                if (inode->i_state & I_NEW) {
+                        requeue_io(inode);
+                        continue;
+                }
+
                 if (wbc->nonblocking && bdi_write_congested(bdi)) {
                         wbc->encountered_congestion = 1;
                         if (!sb_is_blkdev_sb(sb))
@@ -531,7 +538,7 @@ void generic_sync_sb_inodes(struct super_block *sb,
                 list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
                         struct address_space *mapping;
 
-                        if (inode->i_state & (I_FREEING|I_WILL_FREE))
+                        if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW))
                                 continue;
                         mapping = inode->i_mapping;
                         if (mapping->nrpages == 0)
diff --git a/fs/inode.c b/fs/inode.c
index 913ab2d9a5d1..826fb0b9d1c3 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -359,6 +359,7 @@ static int invalidate_list(struct list_head *head, struct list_head *dispose)
                 invalidate_inode_buffers(inode);
                 if (!atomic_read(&inode->i_count)) {
                         list_move(&inode->i_list, dispose);
+                        WARN_ON(inode->i_state & I_NEW);
                         inode->i_state |= I_FREEING;
                         count++;
                         continue;
@@ -460,6 +461,7 @@ static void prune_icache(int nr_to_scan)
                                 continue;
                 }
                 list_move(&inode->i_list, &freeable);
+                WARN_ON(inode->i_state & I_NEW);
                 inode->i_state |= I_FREEING;
                 nr_pruned++;
         }
@@ -656,6 +658,7 @@ void unlock_new_inode(struct inode *inode)
          * just created it (so there can be no old holders
          * that haven't tested I_LOCK).
          */
+        WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW));
         inode->i_state &= ~(I_LOCK|I_NEW);
         wake_up_inode(inode);
 }
@@ -1145,6 +1148,7 @@ void generic_delete_inode(struct inode *inode)
 
         list_del_init(&inode->i_list);
         list_del_init(&inode->i_sb_list);
+        WARN_ON(inode->i_state & I_NEW);
         inode->i_state |= I_FREEING;
         inodes_stat.nr_inodes--;
         spin_unlock(&inode_lock);
@@ -1186,16 +1190,19 @@ static void generic_forget_inode(struct inode *inode)
                         spin_unlock(&inode_lock);
                         return;
                 }
+                WARN_ON(inode->i_state & I_NEW);
                 inode->i_state |= I_WILL_FREE;
                 spin_unlock(&inode_lock);
                 write_inode_now(inode, 1);
                 spin_lock(&inode_lock);
+                WARN_ON(inode->i_state & I_NEW);
                 inode->i_state &= ~I_WILL_FREE;
                 inodes_stat.nr_unused--;
                 hlist_del_init(&inode->i_hash);
         }
         list_del_init(&inode->i_list);
         list_del_init(&inode->i_sb_list);
+        WARN_ON(inode->i_state & I_NEW);
         inode->i_state |= I_FREEING;
         inodes_stat.nr_inodes--;
         spin_unlock(&inode_lock);
diff --git a/fs/pipe.c b/fs/pipe.c
index 3a48ba5179d5..14f502b89cf5 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -699,12 +699,12 @@ pipe_rdwr_fasync(int fd, struct file *filp, int on)
         int retval;
 
         mutex_lock(&inode->i_mutex);
-
         retval = fasync_helper(fd, filp, on, &pipe->fasync_readers);
-
-        if (retval >= 0)
+        if (retval >= 0) {
                 retval = fasync_helper(fd, filp, on, &pipe->fasync_writers);
-
+                if (retval < 0) /* this can happen only if on == T */
+                        fasync_helper(-1, filp, 0, &pipe->fasync_readers);
+        }
         mutex_unlock(&inode->i_mutex);
 
         if (retval < 0)
diff --git a/fs/super.c b/fs/super.c
index 8349ed6b1412..6ce501447ada 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -371,8 +371,10 @@ retry:
                                 continue;
                         if (!grab_super(old))
                                 goto retry;
-                        if (s)
+                        if (s) {
+                                up_write(&s->s_umount);
                                 destroy_super(s);
+                        }
                         return old;
                 }
         }
@@ -387,6 +389,7 @@ retry:
         err = set(s, data);
         if (err) {
                 spin_unlock(&sb_lock);
+                up_write(&s->s_umount);
                 destroy_super(s);
                 return ERR_PTR(err);
         }
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index cb329edc925b..aa1016bb9134 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -34,6 +34,12 @@
 #include <linux/backing-dev.h>
 #include <linux/freezer.h>
 
+#include "xfs_sb.h"
+#include "xfs_inum.h"
+#include "xfs_ag.h"
+#include "xfs_dmapi.h"
+#include "xfs_mount.h"
+
 static kmem_zone_t *xfs_buf_zone;
 STATIC int xfsbufd(void *);
 STATIC int xfsbufd_wakeup(int, gfp_t);
@@ -1435,10 +1441,12 @@ xfs_unregister_buftarg(
 
 void
 xfs_free_buftarg(
-        xfs_buftarg_t           *btp)
+        struct xfs_mount        *mp,
+        struct xfs_buftarg      *btp)
 {
         xfs_flush_buftarg(btp, 1);
-        xfs_blkdev_issue_flush(btp);
+        if (mp->m_flags & XFS_MOUNT_BARRIER)
+                xfs_blkdev_issue_flush(btp);
         xfs_free_bufhash(btp);
         iput(btp->bt_mapping->host);
 
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index 288ae7c4c800..9b4d666ad31f 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -413,7 +413,7 @@ static inline int XFS_bwrite(xfs_buf_t *bp)
  *      Handling of buftargs.
  */
 extern xfs_buftarg_t *xfs_alloc_buftarg(struct block_device *, int);
-extern void xfs_free_buftarg(xfs_buftarg_t *);
+extern void xfs_free_buftarg(struct xfs_mount *, struct xfs_buftarg *);
 extern void xfs_wait_buftarg(xfs_buftarg_t *);
 extern int xfs_setsize_buftarg(xfs_buftarg_t *, unsigned int, unsigned int);
 extern int xfs_flush_buftarg(xfs_buftarg_t *, int);
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index c71e226da7f5..32ae5028e96b 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -734,15 +734,15 @@ xfs_close_devices(
 {
         if (mp->m_logdev_targp && mp->m_logdev_targp != mp->m_ddev_targp) {
                 struct block_device *logdev = mp->m_logdev_targp->bt_bdev;
-                xfs_free_buftarg(mp->m_logdev_targp);
+                xfs_free_buftarg(mp, mp->m_logdev_targp);
                 xfs_blkdev_put(logdev);
         }
         if (mp->m_rtdev_targp) {
                 struct block_device *rtdev = mp->m_rtdev_targp->bt_bdev;
-                xfs_free_buftarg(mp->m_rtdev_targp);
+                xfs_free_buftarg(mp, mp->m_rtdev_targp);
                 xfs_blkdev_put(rtdev);
         }
-        xfs_free_buftarg(mp->m_ddev_targp);
+        xfs_free_buftarg(mp, mp->m_ddev_targp);
 }
 
 /*
@@ -811,9 +811,9 @@ xfs_open_devices(
 
  out_free_rtdev_targ:
         if (mp->m_rtdev_targp)
-                xfs_free_buftarg(mp->m_rtdev_targp);
+                xfs_free_buftarg(mp, mp->m_rtdev_targp);
  out_free_ddev_targ:
-        xfs_free_buftarg(mp->m_ddev_targp);
+        xfs_free_buftarg(mp, mp->m_ddev_targp);
  out_close_rtdev:
         if (rtdev)
                 xfs_blkdev_put(rtdev);
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index e2fb6210d4c5..478e587087fe 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -246,9 +246,6 @@ xfs_iget_cache_miss(
                 goto out_destroy;
         }
 
-        if (lock_flags)
-                xfs_ilock(ip, lock_flags);
-
         /*
          * Preload the radix tree so we can insert safely under the
          * write spinlock. Note that we cannot sleep inside the preload
@@ -256,7 +253,16 @@ xfs_iget_cache_miss(
          */
         if (radix_tree_preload(GFP_KERNEL)) {
                 error = EAGAIN;
-                goto out_unlock;
+                goto out_destroy;
+        }
+
+        /*
+         * Because the inode hasn't been added to the radix-tree yet it can't
+         * be found by another thread, so we can do the non-sleeping lock here.
+         */
+        if (lock_flags) {
+                if (!xfs_ilock_nowait(ip, lock_flags))
+                        BUG();
         }
 
         mask = ~(((XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_inodelog)) - 1);
@@ -284,7 +290,6 @@ xfs_iget_cache_miss(
 out_preload_end:
         write_unlock(&pag->pag_ici_lock);
         radix_tree_preload_end();
-out_unlock:
         if (lock_flags)
                 xfs_iunlock(ip, lock_flags);
 out_destroy:
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index b1047de2fffd..61af610d79b3 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1455,10 +1455,19 @@ xlog_recover_add_to_trans(
         item = item->ri_prev;
 
         if (item->ri_total == 0) {              /* first region to be added */
-                item->ri_total  = in_f->ilf_size;
-                ASSERT(item->ri_total <= XLOG_MAX_REGIONS_IN_ITEM);
-                item->ri_buf = kmem_zalloc((item->ri_total *
-                                            sizeof(xfs_log_iovec_t)), KM_SLEEP);
+                if (in_f->ilf_size == 0 ||
+                    in_f->ilf_size > XLOG_MAX_REGIONS_IN_ITEM) {
+                        xlog_warn(
+        "XFS: bad number of regions (%d) in inode log format",
+                                  in_f->ilf_size);
+                        ASSERT(0);
+                        return XFS_ERROR(EIO);
+                }
+
+                item->ri_total = in_f->ilf_size;
+                item->ri_buf =
+                        kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
+                                    KM_SLEEP);
         }
         ASSERT(item->ri_total > item->ri_cnt);
         /* Description region is ri_buf[0] */