20 files changed, 212 insertions, 121 deletions
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 5cebf0b37798..697f6b5f1313 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -41,6 +41,7 @@
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
 #include <asm/cacheflush.h>
+#include <asm/page.h>
 /****************************************************************************/
@@ -54,6 +55,18 @@
 #define DBG_FLT(a...)
 #endif
+/*
+ * User data (stack, data section and bss) needs to be aligned
+ * for the same reasons as SLAB memory is, and to the same amount.
+ * Avoid duplicating architecture specific code by using the same
+ * macro as with SLAB allocation:
+ */
+#ifdef ARCH_SLAB_MINALIGN
+#define FLAT_DATA_ALIGN (ARCH_SLAB_MINALIGN)
+#else
+#define FLAT_DATA_ALIGN (sizeof(void *))
+#endif
 #define RELOC_FAILED 0xff00ff01         /* Relocation incorrect somewhere */
 #define UNLOADED_LIB 0x7ff000ff         /* Placeholder for unused library */
@@ -114,20 +127,18 @@ static unsigned long create_flat_tables(
        int envc = bprm->envc;
        char uninitialized_var(dummy);
-        sp = (unsigned long *) ((-(unsigned long)sizeof(char *))&(unsigned long) p);
+        sp = (unsigned long *)p;
+        sp -= (envc + argc + 2) + 1 + (flat_argvp_envp_on_stack() ? 2 : 0);
+        sp = (unsigned long *) ((unsigned long)sp & -FLAT_DATA_ALIGN);
+        argv = sp + 1 + (flat_argvp_envp_on_stack() ? 2 : 0);
+        envp = argv + (argc + 1);
-        sp -= envc+1;
-        envp = sp;
-        sp -= argc+1;
-        argv = sp;
-        flat_stack_align(sp);
        if (flat_argvp_envp_on_stack()) {
-                --sp; put_user((unsigned long) envp, sp);
+                put_user((unsigned long) envp, sp + 2);
-                --sp; put_user((unsigned long) argv, sp);
+                put_user((unsigned long) argv, sp + 1);
        }
-        put_user(argc,--sp);
+        put_user(argc, sp);
        current->mm->arg_start = (unsigned long) p;
        while (argc-->0) {
                put_user((unsigned long) p, argv++);
@@ -558,7 +569,9 @@ static int load_flat_file(struct linux_binprm * bprm,
                        ret = realdatastart;
                        goto err;
                }
-                datapos = realdatastart + MAX_SHARED_LIBS * sizeof(unsigned long);
+                datapos = ALIGN(realdatastart +
+                                MAX_SHARED_LIBS * sizeof(unsigned long),
+                                FLAT_DATA_ALIGN);
                DBG_FLT("BINFMT_FLAT: Allocated data+bss+stack (%d bytes): %x\n",
                                (int)(data_len + bss_len + stack_len), (int)datapos);
@@ -604,9 +617,12 @@ static int load_flat_file(struct linux_binprm * bprm,
                }
                realdatastart = textpos + ntohl(hdr->data_start);
-                datapos = realdatastart + MAX_SHARED_LIBS * sizeof(unsigned long);
+                datapos = ALIGN(realdatastart +
-                reloc = (unsigned long *) (textpos + ntohl(hdr->reloc_start) +
+                                MAX_SHARED_LIBS * sizeof(unsigned long),
-                                MAX_SHARED_LIBS * sizeof(unsigned long));
+                                FLAT_DATA_ALIGN);
+                reloc = (unsigned long *)
+                        (datapos + (ntohl(hdr->reloc_start) - text_len));
                memp = textpos;
                memp_size = len;
 #ifdef CONFIG_BINFMT_ZFLAT
@@ -854,7 +870,7 @@ static int load_flat_binary(struct linux_binprm * bprm, struct pt_regs * regs)
        stack_len = TOP_OF_ARGS - bprm->p;             /* the strings */
        stack_len += (bprm->argc + 1) * sizeof(char *); /* the argv array */
        stack_len += (bprm->envc + 1) * sizeof(char *); /* the envp array */
+        stack_len += FLAT_DATA_ALIGN - 1;  /* reserve for upcoming alignment */
        
        res = load_flat_file(bprm, &libinfo, 0, &stack_len);
        if (res > (unsigned long)-4096)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 3e2c7c738f23..35af93355063 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2622,7 +2622,18 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
                                                       search_start);
                if (block_group && block_group_bits(block_group, data)) {
                        down_read(&space_info->groups_sem);
-                        goto have_block_group;
+                        if (list_empty(&block_group->list) ||
+                            block_group->ro) {
+                                /*
+                                 * someone is removing this block group,
+                                 * we can't jump into the have_block_group
+                                 * target because our list pointers are not
+                                 * valid
+                                 */
+                                btrfs_put_block_group(block_group);
+                                up_read(&space_info->groups_sem);
+                        } else
+                                goto have_block_group;
                } else if (block_group) {
                        btrfs_put_block_group(block_group);
                }
@@ -2656,6 +2667,13 @@ have_block_group:
                         * people trying to start a new cluster
                         */
                        spin_lock(&last_ptr->refill_lock);
+                        if (last_ptr->block_group &&
+                            (last_ptr->block_group->ro ||
+                            !block_group_bits(last_ptr->block_group, data))) {
+                                offset = 0;
+                                goto refill_cluster;
+                        }
                        offset = btrfs_alloc_from_cluster(block_group, last_ptr,
                                                 num_bytes, search_start);
                        if (offset) {
@@ -2681,10 +2699,17 @@ have_block_group:
                                last_ptr_loop = 1;
                                search_start = block_group->key.objectid;
+                                /*
+                                 * we know this block group is properly
+                                 * in the list because
+                                 * btrfs_remove_block_group, drops the
+                                 * cluster before it removes the block
+                                 * group from the list
+                                 */
                                goto have_block_group;
                        }
                        spin_unlock(&last_ptr->lock);
+refill_cluster:
                        /*
                         * this cluster didn't work out, free it and
                         * start over
@@ -5968,6 +5993,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
 {
        struct btrfs_path *path;
        struct btrfs_block_group_cache *block_group;
+        struct btrfs_free_cluster *cluster;
        struct btrfs_key key;
        int ret;
@@ -5979,6 +6005,21 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
        memcpy(&key, &block_group->key, sizeof(key));
+        /* make sure this block group isn't part of an allocation cluster */
+        cluster = &root->fs_info->data_alloc_cluster;
+        spin_lock(&cluster->refill_lock);
+        btrfs_return_cluster_to_free_space(block_group, cluster);
+        spin_unlock(&cluster->refill_lock);
+        /*
+         * make sure this block group isn't part of a metadata
+         * allocation cluster
+         */
+        cluster = &root->fs_info->meta_alloc_cluster;
+        spin_lock(&cluster->refill_lock);
+        btrfs_return_cluster_to_free_space(block_group, cluster);
+        spin_unlock(&cluster->refill_lock);
        path = btrfs_alloc_path();
        BUG_ON(!path);
@@ -5988,7 +6029,11 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
        spin_unlock(&root->fs_info->block_group_cache_lock);
        btrfs_remove_free_space_cache(block_group);
        down_write(&block_group->space_info->groups_sem);
-        list_del(&block_group->list);
+        /*
+         * we must use list_del_init so people can check to see if they
+         * are still on the list after taking the semaphore
+         */
+        list_del_init(&block_group->list);
        up_write(&block_group->space_info->groups_sem);
        spin_lock(&block_group->space_info->lock);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 5f01dad4b696..a6d35b0054ca 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1440,6 +1440,7 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
        device->io_align = root->sectorsize;
        device->sector_size = root->sectorsize;
        device->total_bytes = i_size_read(bdev->bd_inode);
+        device->disk_total_bytes = device->total_bytes;
        device->dev_root = root->fs_info->dev_root;
        device->bdev = bdev;
        device->in_fs_metadata = 1;
diff --git a/fs/buffer.c b/fs/buffer.c
index aed297739eb0..49106127a4aa 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2736,6 +2736,8 @@ has_buffers:
                pos += blocksize;
        }
+        map_bh.b_size = blocksize;
+        map_bh.b_state = 0;
        err = get_block(inode, iblock, &map_bh, 0);
        if (err)
                goto unlock;
diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
index 19218e1463d6..f7c255f9c624 100644
--- a/fs/cachefiles/internal.h
+++ b/fs/cachefiles/internal.h
@@ -122,13 +122,13 @@ static inline void cachefiles_state_changed(struct cachefiles_cache *cache)
 }
 /*
- * cf-bind.c
+ * bind.c
 */
 extern int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args);
 extern void cachefiles_daemon_unbind(struct cachefiles_cache *cache);
 /*
- * cf-daemon.c
+ * daemon.c
 */
 extern const struct file_operations cachefiles_daemon_fops;
@@ -136,17 +136,17 @@ extern int cachefiles_has_space(struct cachefiles_cache *cache,
                                unsigned fnr, unsigned bnr);
 /*
- * cf-interface.c
+ * interface.c
 */
 extern const struct fscache_cache_ops cachefiles_cache_ops;
 /*
- * cf-key.c
+ * key.c
 */
 extern char *cachefiles_cook_key(const u8 *raw, int keylen, uint8_t type);
 /*
- * cf-namei.c
+ * namei.c
 */
 extern int cachefiles_delete_object(struct cachefiles_cache *cache,
                                    struct cachefiles_object *object);
@@ -165,7 +165,7 @@ extern int cachefiles_check_in_use(struct cachefiles_cache *cache,
                                   struct dentry *dir, char *filename);
 /*
- * cf-proc.c
+ * proc.c
 */
 #ifdef CONFIG_CACHEFILES_HISTOGRAM
 extern atomic_t cachefiles_lookup_histogram[HZ];
@@ -190,7 +190,7 @@ void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
 #endif
 /*
- * cf-rdwr.c
+ * rdwr.c
 */
 extern int cachefiles_read_or_alloc_page(struct fscache_retrieval *,
                                         struct page *, gfp_t);
@@ -205,7 +205,7 @@ extern int cachefiles_write_page(struct fscache_storage *, struct page *);
 extern void cachefiles_uncache_page(struct fscache_object *, struct page *);
 /*
- * cf-security.c
+ * security.c
 */
 extern int cachefiles_get_security_ID(struct cachefiles_cache *cache);
 extern int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
@@ -225,7 +225,7 @@ static inline void cachefiles_end_secure(struct cachefiles_cache *cache,
 }
 /*
- * cf-xattr.c
+ * xattr.c
 */
 extern int cachefiles_check_object_type(struct cachefiles_object *object);
 extern int cachefiles_set_object_xattr(struct cachefiles_object *object,
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 11431ed72a7f..3758965d73d5 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -225,6 +225,7 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
        if (!(oflags & FMODE_READ))
                write_only = true;
+        mode &= ~current_umask();
        rc = CIFSPOSIXCreate(xid, cifs_sb->tcon, posix_flags, mode,
                        pnetfid, presp_data, &oplock, full_path,
                        cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
@@ -310,7 +311,6 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                return -ENOMEM;
        }
-        mode &= ~current_umask();
        if (oplockEnabled)
                oplock = REQ_OPLOCK;
@@ -336,7 +336,7 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                        else /* success, no need to query */
                                goto cifs_create_set_dentry;
                } else if ((rc != -EIO) && (rc != -EREMOTE) &&
-                         (rc != -EOPNOTSUPP)) /* path not found or net err */
+                         (rc != -EOPNOTSUPP) && (rc != -EINVAL))
                        goto cifs_create_out;
                /* else fallthrough to retry, using older open call, this is
                   case where server does not support this SMB level, and
@@ -609,7 +609,6 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
        int xid;
        int rc = 0; /* to get around spurious gcc warning, set to zero here */
        int oplock = 0;
-        int mode;
        __u16 fileHandle = 0;
        bool posix_open = false;
        struct cifs_sb_info *cifs_sb;
@@ -658,30 +657,36 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
        }
        cFYI(1, ("Full path: %s inode = 0x%p", full_path, direntry->d_inode));
+        /* Posix open is only called (at lookup time) for file create now.
+         * For opens (rather than creates), because we do not know if it
+         * is a file or directory yet, and current Samba no longer allows
+         * us to do posix open on dirs, we could end up wasting an open call
+         * on what turns out to be a dir. For file opens, we wait to call posix
+         * open till cifs_open.  It could be added here (lookup) in the future
+         * but the performance tradeoff of the extra network request when EISDIR
+         * or EACCES is returned would have to be weighed against the 50%
+         * reduction in network traffic in the other paths.
+         */
        if (pTcon->unix_ext) {
                if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
-                                (nd->flags & LOOKUP_OPEN)) {
+                     (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open &&
-                        if (!((nd->intent.open.flags & O_CREAT) &&
+                     (nd->intent.open.flags & O_CREAT)) {
-                                        (nd->intent.open.flags & O_EXCL))) {
+                        rc = cifs_posix_open(full_path, &newInode,
-                                mode = nd->intent.open.create_mode &
+                                        parent_dir_inode->i_sb,
-                                                ~current_umask();
+                                        nd->intent.open.create_mode,
-                                rc = cifs_posix_open(full_path, &newInode,
-                                        parent_dir_inode->i_sb, mode,
                                        nd->intent.open.flags, &oplock,
                                        &fileHandle, xid);
-                                /*
+                        /*
-                                 * This code works around a bug in
+                         * The check below works around a bug in POSIX
-                                 * samba posix open in samba versions 3.3.1
+                         * open in samba versions 3.3.1 and earlier where
-                                 * and earlier where create works
+                         * open could incorrectly fail with invalid parameter.
-                                 * but open fails with invalid parameter.
+                         * If either that or op not supported returned, follow
-                                 * If either of these error codes are
+                         * the normal lookup.
-                                 * returned, follow the normal lookup.
+                         */
-                                 * Otherwise, the error during posix open
+                        if ((rc == 0) || (rc == -ENOENT))
-                                 * is handled.
+                                posix_open = true;
-                                 */
+                        else if ((rc == -EINVAL) || (rc != -EOPNOTSUPP))
-                                if ((rc != -EINVAL) && (rc != -EOPNOTSUPP))
+                                pTcon->broken_posix_open = true;
-                                        posix_open = true;
-                        }
                }
                if (!posix_open)
                        rc = cifs_get_inode_info_unix(&newInode, full_path,
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 38c06f826575..302ea15f02e6 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -130,10 +130,6 @@ static inline int cifs_posix_open_inode_helper(struct inode *inode,
                        struct cifsFileInfo *pCifsFile, int oplock, u16 netfid)
 {
-        file->private_data = kmalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
-        if (file->private_data == NULL)
-                return -ENOMEM;
-        pCifsFile = cifs_init_private(file->private_data, inode, file, netfid);
        write_lock(&GlobalSMBSeslock);
        pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
@@ -184,6 +180,38 @@ psx_client_can_cache:
        return 0;
 }
+static struct cifsFileInfo *
+cifs_fill_filedata(struct file *file)
+{
+        struct list_head *tmp;
+        struct cifsFileInfo *pCifsFile = NULL;
+        struct cifsInodeInfo *pCifsInode = NULL;
+        /* search inode for this file and fill in file->private_data */
+        pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
+        read_lock(&GlobalSMBSeslock);
+        list_for_each(tmp, &pCifsInode->openFileList) {
+                pCifsFile = list_entry(tmp, struct cifsFileInfo, flist);
+                if ((pCifsFile->pfile == NULL) &&
+                    (pCifsFile->pid == current->tgid)) {
+                        /* mode set in cifs_create */
+                        /* needed for writepage */
+                        pCifsFile->pfile = file;
+                        file->private_data = pCifsFile;
+                        break;
+                }
+        }
+        read_unlock(&GlobalSMBSeslock);
+        if (file->private_data != NULL) {
+                return pCifsFile;
+        } else if ((file->f_flags & O_CREAT) && (file->f_flags & O_EXCL))
+                        cERROR(1, ("could not find file instance for "
+                                   "new file %p", file));
+        return NULL;
+}
 /* all arguments to this function must be checked for validity in caller */
 static inline int cifs_open_inode_helper(struct inode *inode, struct file *file,
        struct cifsInodeInfo *pCifsInode, struct cifsFileInfo *pCifsFile,
@@ -258,7 +286,6 @@ int cifs_open(struct inode *inode, struct file *file)
        struct cifsTconInfo *tcon;
        struct cifsFileInfo *pCifsFile;
        struct cifsInodeInfo *pCifsInode;
-        struct list_head *tmp;
        char *full_path = NULL;
        int desiredAccess;
        int disposition;
@@ -270,32 +297,12 @@ int cifs_open(struct inode *inode, struct file *file)
        cifs_sb = CIFS_SB(inode->i_sb);
        tcon = cifs_sb->tcon;
-        /* search inode for this file and fill in file->private_data */
        pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
-        read_lock(&GlobalSMBSeslock);
+        pCifsFile = cifs_fill_filedata(file);
-        list_for_each(tmp, &pCifsInode->openFileList) {
+        if (pCifsFile) {
-                pCifsFile = list_entry(tmp, struct cifsFileInfo,
-                                       flist);
-                if ((pCifsFile->pfile == NULL) &&
-                    (pCifsFile->pid == current->tgid)) {
-                        /* mode set in cifs_create */
-                        /* needed for writepage */
-                        pCifsFile->pfile = file;
-                        file->private_data = pCifsFile;
-                        break;
-                }
-        }
-        read_unlock(&GlobalSMBSeslock);
-        if (file->private_data != NULL) {
-                rc = 0;
                FreeXid(xid);
-                return rc;
+                return 0;
-        } else if ((file->f_flags & O_CREAT) && (file->f_flags & O_EXCL))
+        }
-                        cERROR(1, ("could not find file instance for "
-                                   "new file %p", file));
        full_path = build_path_from_dentry(file->f_path.dentry);
        if (full_path == NULL) {
@@ -325,6 +332,7 @@ int cifs_open(struct inode *inode, struct file *file)
                        /* no need for special case handling of setting mode
                           on read only files needed here */
+                        pCifsFile = cifs_fill_filedata(file);
                        cifs_posix_open_inode_helper(inode, file, pCifsInode,
                                                     pCifsFile, oplock, netfid);
                        goto out;
diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
index e0cbd16f6dc9..1c341304621f 100644
--- a/fs/fscache/internal.h
+++ b/fs/fscache/internal.h
@@ -28,7 +28,7 @@
 #define FSCACHE_MAX_THREADS     32
 /*
- * fsc-cache.c
+ * cache.c
 */
 extern struct list_head fscache_cache_list;
 extern struct rw_semaphore fscache_addremove_sem;
@@ -37,7 +37,7 @@ extern struct fscache_cache *fscache_select_cache_for_object(
        struct fscache_cookie *);
 /*
- * fsc-cookie.c
+ * cookie.c
 */
 extern struct kmem_cache *fscache_cookie_jar;
@@ -45,13 +45,13 @@ extern void fscache_cookie_init_once(void *);
 extern void __fscache_cookie_put(struct fscache_cookie *);
 /*
- * fsc-fsdef.c
+ * fsdef.c
 */
 extern struct fscache_cookie fscache_fsdef_index;
 extern struct fscache_cookie_def fscache_fsdef_netfs_def;
 /*
- * fsc-histogram.c
+ * histogram.c
 */
 #ifdef CONFIG_FSCACHE_HISTOGRAM
 extern atomic_t fscache_obj_instantiate_histogram[HZ];
@@ -75,7 +75,7 @@ extern const struct file_operations fscache_histogram_fops;
 #endif
 /*
- * fsc-main.c
+ * main.c
 */
 extern unsigned fscache_defer_lookup;
 extern unsigned fscache_defer_create;
@@ -86,14 +86,14 @@ extern int fscache_wait_bit(void *);
 extern int fscache_wait_bit_interruptible(void *);
 /*
- * fsc-object.c
+ * object.c
 */
 extern void fscache_withdrawing_object(struct fscache_cache *,
                                       struct fscache_object *);
 extern void fscache_enqueue_object(struct fscache_object *);
 /*
- * fsc-operation.c
+ * operation.c
 */
 extern int fscache_submit_exclusive_op(struct fscache_object *,
                                       struct fscache_operation *);
@@ -104,7 +104,7 @@ extern void fscache_start_operations(struct fscache_object *);
 extern void fscache_operation_gc(struct work_struct *);
 /*
- * fsc-proc.c
+ * proc.c
 */
 #ifdef CONFIG_PROC_FS
 extern int __init fscache_proc_init(void);
@@ -115,7 +115,7 @@ extern void fscache_proc_cleanup(void);
 #endif
 /*
- * fsc-stats.c
+ * stats.c
 */
 #ifdef CONFIG_FSCACHE_STATS
 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
diff --git a/fs/inode.c b/fs/inode.c
index 0571983755dc..bca0c618fdb3 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -219,6 +219,7 @@ static struct inode *alloc_inode(struct super_block *sb)
 void destroy_inode(struct inode *inode)
 {
        BUG_ON(inode_has_buffers(inode));
+        ima_inode_free(inode);
        security_inode_free(inode);
        if (inode->i_sb->s_op->destroy_inode)
                inode->i_sb->s_op->destroy_inode(inode);
@@ -1053,13 +1054,22 @@ int insert_inode_locked(struct inode *inode)
        struct super_block *sb = inode->i_sb;
        ino_t ino = inode->i_ino;
        struct hlist_head *head = inode_hashtable + hash(sb, ino);
-        struct inode *old;
        inode->i_state |= I_LOCK|I_NEW;
        while (1) {
+                struct hlist_node *node;
+                struct inode *old = NULL;
                spin_lock(&inode_lock);
-                old = find_inode_fast(sb, head, ino);
+                hlist_for_each_entry(old, node, head, i_hash) {
-                if (likely(!old)) {
+                        if (old->i_ino != ino)
+                                continue;
+                        if (old->i_sb != sb)
+                                continue;
+                        if (old->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE))
+                                continue;
+                        break;
+                }
+                if (likely(!node)) {
                        hlist_add_head(&inode->i_hash, head);
                        spin_unlock(&inode_lock);
                        return 0;
@@ -1081,14 +1091,24 @@ int insert_inode_locked4(struct inode *inode, unsigned long hashval,
 {
        struct super_block *sb = inode->i_sb;
        struct hlist_head *head = inode_hashtable + hash(sb, hashval);
-        struct inode *old;
        inode->i_state |= I_LOCK|I_NEW;
        while (1) {
+                struct hlist_node *node;
+                struct inode *old = NULL;
                spin_lock(&inode_lock);
-                old = find_inode(sb, head, test, data);
+                hlist_for_each_entry(old, node, head, i_hash) {
-                if (likely(!old)) {
+                        if (old->i_sb != sb)
+                                continue;
+                        if (!test(old, data))
+                                continue;
+                        if (old->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE))
+                                continue;
+                        break;
+                }
+                if (likely(!node)) {
                        hlist_add_head(&inode->i_hash, head);
                        spin_unlock(&inode_lock);
                        return 0;
diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
index c32b4a1ad6cf..a0244740b75a 100644
--- a/fs/jffs2/erase.c
+++ b/fs/jffs2/erase.c
@@ -480,13 +480,6 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
        return;
 filebad:
-        mutex_lock(&c->erase_free_sem);
-        spin_lock(&c->erase_completion_lock);
-        /* Stick it on a list (any list) so erase_failed can take it
-           right off again.  Silly, but shouldn't happen often. */
-        list_move(&jeb->list, &c->erasing_list);
-        spin_unlock(&c->erase_completion_lock);
-        mutex_unlock(&c->erase_free_sem);
        jffs2_erase_failed(c, jeb, bad_offset);
        return;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index a4d242680299..4674f8092da8 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2594,12 +2594,9 @@ static void nfs4_renew_done(struct rpc_task *task, void *data)
        unsigned long timestamp = (unsigned long)data;
        if (task->tk_status < 0) {
-                switch (task->tk_status) {
+                /* Unless we're shutting down, schedule state recovery! */
-                        case -NFS4ERR_STALE_CLIENTID:
+                if (test_bit(NFS_CS_RENEWD, &clp->cl_res_state) != 0)
-                        case -NFS4ERR_EXPIRED:
+                        nfs4_schedule_state_recovery(clp);
-                        case -NFS4ERR_CB_PATH_DOWN:
-                                nfs4_schedule_state_recovery(clp);
-                }
                return;
        }
        spin_lock(&clp->cl_lock);
diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c
index d9ef602fbc5a..e3ed5908820b 100644
--- a/fs/nfs/nfsroot.c
+++ b/fs/nfs/nfsroot.c
@@ -129,7 +129,7 @@ enum {
        Opt_err
 };
-static match_table_t __initconst tokens = {
+static const match_table_t tokens __initconst = {
        {Opt_port, "port=%u"},
        {Opt_rsize, "rsize=%u"},
        {Opt_wsize, "wsize=%u"},
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 81ff0f4de4b7..bd584bcf1d9f 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1018,6 +1018,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
        host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
        set_fs(oldfs);
        if (host_err >= 0) {
+                *cnt = host_err;
                nfsdstats.io_write += host_err;
                fsnotify_modify(file->f_path.dentry);
        }
@@ -1063,10 +1064,9 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
        }
        dprintk("nfsd: write complete host_err=%d\n", host_err);
-        if (host_err >= 0) {
+        if (host_err >= 0)
                err = 0;
-                *cnt = host_err;
+        else
-        } else
                err = nfserrno(host_err);
 out:
        return err;
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index e90b60dfced9..300f1cdfa862 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -311,7 +311,7 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
                ret = nilfs_cpfile_get_checkpoint_block(cpfile, cno, 0, &cp_bh);
                if (ret < 0) {
                        if (ret != -ENOENT)
-                                goto out_sem;
+                                goto out_header;
                        /* skip hole */
                        ret = 0;
                        continue;
@@ -344,7 +344,7 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
                                        continue;
                                printk(KERN_ERR "%s: cannot delete block\n",
                                       __func__);
-                                goto out_sem;
+                                goto out_header;
                        }
                }
@@ -361,6 +361,8 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
                nilfs_mdt_mark_dirty(cpfile);
                kunmap_atomic(kaddr, KM_USER0);
        }
+ out_header:
        brelse(header_bh);
 out_sem:
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 50ff3f2cdf24..d6759b92006f 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -576,7 +576,7 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
        ret = nilfs_clean_segments(inode->i_sb, argv, kbufs);
 out_free:
-        while (--n > 0)
+        while (--n >= 0)
                vfree(kbufs[n]);
        kfree(kbufs[4]);
        return ret;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 23342e188a66..1539e630c47d 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1956,7 +1956,7 @@ static struct dentry *proc_pident_instantiate(struct inode *dir,
        const struct pid_entry *p = ptr;
        struct inode *inode;
        struct proc_inode *ei;
-        struct dentry *error = ERR_PTR(-EINVAL);
+        struct dentry *error = ERR_PTR(-ENOENT);
        inode = proc_pid_make_inode(dir->i_sb, task);
        if (!inode)
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index b1606e07b7a3..561a9c050cef 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -723,7 +723,7 @@ int sysfs_schedule_callback(struct kobject *kobj, void (*func)(void *),
        mutex_unlock(&sysfs_workq_mutex);
        if (sysfs_workqueue == NULL) {
-                sysfs_workqueue = create_workqueue("sysfsd");
+                sysfs_workqueue = create_singlethread_workqueue("sysfsd");
                if (sysfs_workqueue == NULL) {
                        module_put(owner);
                        return -ENOMEM;
diff --git a/fs/xfs/linux-2.6/kmem.h b/fs/xfs/linux-2.6/kmem.h
index af6843c7ee4b..179cbd630f69 100644
--- a/fs/xfs/linux-2.6/kmem.h
+++ b/fs/xfs/linux-2.6/kmem.h
@@ -103,7 +103,7 @@ extern void *kmem_zone_zalloc(kmem_zone_t *, unsigned int __nocast);
 static inline int
 kmem_shake_allow(gfp_t gfp_mask)
 {
-        return (gfp_mask & __GFP_WAIT) != 0;
+        return ((gfp_mask & __GFP_WAIT) && (gfp_mask & __GFP_FS));
 }
 #endif /* __XFS_SUPPORT_KMEM_H__ */
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index e6d839bddbf0..7465f9ee125f 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -347,13 +347,15 @@ xfs_swap_extents(
        error = xfs_trans_commit(tp, XFS_TRANS_SWAPEXT);
-out_unlock:
-        xfs_iunlock(ip,  XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
-        xfs_iunlock(tip, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
 out:
        kmem_free(tempifp);
        return error;
+out_unlock:
+        xfs_iunlock(ip,  XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
+        xfs_iunlock(tip, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
+        goto out;
 out_trans_cancel:
        xfs_trans_cancel(tp, 0);
        goto out_unlock;
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 8379e3bca26c..cbd451bb4848 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -160,7 +160,7 @@ xfs_growfs_data_private(
        nagcount = new + (nb_mod != 0);
        if (nb_mod && nb_mod < XFS_MIN_AG_BLOCKS) {
                nagcount--;
-                nb = nagcount * mp->m_sb.sb_agblocks;
+                nb = (xfs_rfsblock_t)nagcount * mp->m_sb.sb_agblocks;
                if (nb < mp->m_sb.sb_dblocks)
                        return XFS_ERROR(EINVAL);
        }