19 files changed, 217 insertions, 126 deletions
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 105761e3ba0e..9aeb58a7d369 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -82,7 +82,6 @@ static int construct_dentry(struct qstr *qstring, struct file *file,
                        if(*ptmp_inode == NULL)
                                return rc;
                        rc = 1;
-                        d_instantiate(tmp_dentry, *ptmp_inode);
                }
        } else {
                tmp_dentry = d_alloc(file->f_dentry, qstring);
@@ -99,9 +98,7 @@ static int construct_dentry(struct qstr *qstring, struct file *file,
                        tmp_dentry->d_op = &cifs_dentry_ops;
                if(*ptmp_inode == NULL)
                        return rc;
-                rc = 1;
+                rc = 2;
-                d_instantiate(tmp_dentry, *ptmp_inode);
-                d_rehash(tmp_dentry);
        }
        tmp_dentry->d_time = jiffies;
@@ -870,6 +867,12 @@ static int cifs_filldir(char *pfindEntry, struct file *file,
                                pfindEntry, &obj_type, rc);
        else
                fill_in_inode(tmp_inode, 1 /* NT */, pfindEntry, &obj_type, rc);
+        if(rc) /* new inode - needs to be tied to dentry */ {
+                d_instantiate(tmp_dentry, tmp_inode);
+                if(rc == 2)
+                        d_rehash(tmp_dentry);
+        }
        
        
        rc = filldir(direntry,qstring.name,qstring.len,file->f_pos,
diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
index d4870432ecfc..b1981d0e95ad 100644
--- a/fs/ext2/balloc.c
+++ b/fs/ext2/balloc.c
@@ -539,7 +539,6 @@ unsigned long ext2_count_free (struct buffer_head * map, unsigned int numchars)
 #endif  /*  EXT2FS_DEBUG  */
-/* Superblock must be locked */
 unsigned long ext2_count_free_blocks (struct super_block * sb)
 {
        struct ext2_group_desc * desc;
diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
index de85c61c58c5..695f69ccf908 100644
--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -637,7 +637,6 @@ fail:
        return ERR_PTR(err);
 }
-/* Superblock must be locked */
 unsigned long ext2_count_free_inodes (struct super_block * sb)
 {
        struct ext2_group_desc *desc;
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 681dea8f9532..4286ff6330b6 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -251,6 +251,44 @@ static struct super_operations ext2_sops = {
 #endif
 };
+static struct dentry *ext2_get_dentry(struct super_block *sb, void *vobjp)
+{
+        __u32 *objp = vobjp;
+        unsigned long ino = objp[0];
+        __u32 generation = objp[1];
+        struct inode *inode;
+        struct dentry *result;
+        if (ino < EXT2_FIRST_INO(sb) && ino != EXT2_ROOT_INO)
+                return ERR_PTR(-ESTALE);
+        if (ino > le32_to_cpu(EXT2_SB(sb)->s_es->s_inodes_count))
+                return ERR_PTR(-ESTALE);
+        /* iget isn't really right if the inode is currently unallocated!!
+         * ext2_read_inode currently does appropriate checks, but
+         * it might be "neater" to call ext2_get_inode first and check
+         * if the inode is valid.....
+         */
+        inode = iget(sb, ino);
+        if (inode == NULL)
+                return ERR_PTR(-ENOMEM);
+        if (is_bad_inode(inode) ||
+            (generation && inode->i_generation != generation)) {
+                /* we didn't find the right inode.. */
+                iput(inode);
+                return ERR_PTR(-ESTALE);
+        }
+        /* now to find a dentry.
+         * If possible, get a well-connected one
+         */
+        result = d_alloc_anon(inode);
+        if (!result) {
+                iput(inode);
+                return ERR_PTR(-ENOMEM);
+        }
+        return result;
+}
 /* Yes, most of these are left as NULL!!
 * A NULL value implies the default, which works with ext2-like file
 * systems, but can be improved upon.
@@ -258,6 +296,7 @@ static struct super_operations ext2_sops = {
 */
 static struct export_operations ext2_export_ops = {
        .get_parent = ext2_get_parent,
+        .get_dentry = ext2_get_dentry,
 };
 static unsigned long get_sb_block(void **data)
@@ -1044,7 +1083,6 @@ static int ext2_statfs (struct dentry * dentry, struct kstatfs * buf)
        unsigned long overhead;
        int i;
-        lock_super(sb);
        if (test_opt (sb, MINIX_DF))
                overhead = 0;
        else {
@@ -1085,7 +1123,6 @@ static int ext2_statfs (struct dentry * dentry, struct kstatfs * buf)
        buf->f_files = le32_to_cpu(sbi->s_es->s_inodes_count);
        buf->f_ffree = ext2_count_free_inodes (sb);
        buf->f_namelen = EXT2_NAME_LEN;
-        unlock_super(sb);
        return 0;
 }
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index c5ee9f0691e3..84be02e93652 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -925,7 +925,7 @@ int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
        set_buffer_new(bh_result);
 got_it:
        map_bh(bh_result, inode->i_sb, le32_to_cpu(chain[depth-1].key));
-        if (blocks_to_boundary == 0)
+        if (count > blocks_to_boundary)
                set_buffer_boundary(bh_result);
        err = count;
        /* Clean up and exit */
@@ -1009,11 +1009,14 @@ struct buffer_head *ext3_getblk(handle_t *handle, struct inode *inode,
        buffer_trace_init(&dummy.b_history);
        err = ext3_get_blocks_handle(handle, inode, block, 1,
                                        &dummy, create, 1);
-        if (err == 1) {
+        /*
+         * ext3_get_blocks_handle() returns number of blocks
+         * mapped. 0 in case of a HOLE.
+         */
+        if (err > 0) {
+                if (err > 1)
+                        WARN_ON(1);
                err = 0;
-        } else if (err >= 0) {
-                WARN_ON(1);
-                err = -EIO;
        }
        *errp = err;
        if (!err && buffer_mapped(&dummy)) {
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 813d589cc6c0..3559086eee5f 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -554,6 +554,47 @@ static int ext3_show_options(struct seq_file *seq, struct vfsmount *vfs)
        return 0;
 }
+static struct dentry *ext3_get_dentry(struct super_block *sb, void *vobjp)
+{
+        __u32 *objp = vobjp;
+        unsigned long ino = objp[0];
+        __u32 generation = objp[1];
+        struct inode *inode;
+        struct dentry *result;
+        if (ino < EXT3_FIRST_INO(sb) && ino != EXT3_ROOT_INO)
+                return ERR_PTR(-ESTALE);
+        if (ino > le32_to_cpu(EXT3_SB(sb)->s_es->s_inodes_count))
+                return ERR_PTR(-ESTALE);
+        /* iget isn't really right if the inode is currently unallocated!!
+         *
+         * ext3_read_inode will return a bad_inode if the inode had been
+         * deleted, so we should be safe.
+         *
+         * Currently we don't know the generation for parent directory, so
+         * a generation of 0 means "accept any"
+         */
+        inode = iget(sb, ino);
+        if (inode == NULL)
+                return ERR_PTR(-ENOMEM);
+        if (is_bad_inode(inode) ||
+            (generation && inode->i_generation != generation)) {
+                iput(inode);
+                return ERR_PTR(-ESTALE);
+        }
+        /* now to find a dentry.
+         * If possible, get a well-connected one
+         */
+        result = d_alloc_anon(inode);
+        if (!result) {
+                iput(inode);
+                return ERR_PTR(-ENOMEM);
+        }
+        return result;
+}
 #ifdef CONFIG_QUOTA
 #define QTYPE2NAME(t) ((t)==USRQUOTA?"user":"group")
 #define QTYPE2MOPT(on, t) ((t)==USRQUOTA?((on)##USRJQUOTA):((on)##GRPJQUOTA))
@@ -622,6 +663,7 @@ static struct super_operations ext3_sops = {
 static struct export_operations ext3_export_ops = {
        .get_parent = ext3_get_parent,
+        .get_dentry = ext3_get_dentry,
 };
 enum {
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index de2e4cbbf79a..f5169a96260e 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -727,7 +727,7 @@ done:
 out:
        if (unlikely(frozen_buffer))    /* It's usually NULL */
-                kfree(frozen_buffer);
+                jbd_slab_free(frozen_buffer, bh->b_size);
        JBUFFER_TRACE(jh, "exit");
        return error;
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index fecd3b095deb..76ca1cbc38f9 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -100,25 +100,6 @@ static inline int put_dreq(struct nfs_direct_req *dreq)
        return atomic_dec_and_test(&dreq->io_count);
 }
-/*
- * "size" is never larger than rsize or wsize.
- */
-static inline int nfs_direct_count_pages(unsigned long user_addr, size_t size)
-{
-        int page_count;
-        page_count = (user_addr + size + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        page_count -= user_addr >> PAGE_SHIFT;
-        BUG_ON(page_count < 0);
-        return page_count;
-}
-static inline unsigned int nfs_max_pages(unsigned int size)
-{
-        return (size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-}
 /**
 * nfs_direct_IO - NFS address space operation for direct I/O
 * @rw: direction (read or write)
@@ -276,28 +257,24 @@ static ssize_t nfs_direct_read_schedule(struct nfs_direct_req *dreq, unsigned lo
        struct nfs_open_context *ctx = dreq->ctx;
        struct inode *inode = ctx->dentry->d_inode;
        size_t rsize = NFS_SERVER(inode)->rsize;
-        unsigned int rpages = nfs_max_pages(rsize);
        unsigned int pgbase;
        int result;
        ssize_t started = 0;
        get_dreq(dreq);
-        pgbase = user_addr & ~PAGE_MASK;
        do {
                struct nfs_read_data *data;
                size_t bytes;
+                pgbase = user_addr & ~PAGE_MASK;
+                bytes = min(rsize,count);
                result = -ENOMEM;
-                data = nfs_readdata_alloc(rpages);
+                data = nfs_readdata_alloc(pgbase + bytes);
                if (unlikely(!data))
                        break;
-                bytes = rsize;
-                if (count < rsize)
-                        bytes = count;
-                data->npages = nfs_direct_count_pages(user_addr, bytes);
                down_read(&current->mm->mmap_sem);
                result = get_user_pages(current, current->mm, user_addr,
                                        data->npages, 1, 0, data->pagevec, NULL);
@@ -344,8 +321,10 @@ static ssize_t nfs_direct_read_schedule(struct nfs_direct_req *dreq, unsigned lo
                started += bytes;
                user_addr += bytes;
                pos += bytes;
+                /* FIXME: Remove this unnecessary math from final patch */
                pgbase += bytes;
                pgbase &= ~PAGE_MASK;
+                BUG_ON(pgbase != (user_addr & ~PAGE_MASK));
                count -= bytes;
        } while (count != 0);
@@ -524,7 +503,7 @@ static void nfs_direct_write_complete(struct nfs_direct_req *dreq, struct inode
 static void nfs_alloc_commit_data(struct nfs_direct_req *dreq)
 {
-        dreq->commit_data = nfs_commit_alloc(0);
+        dreq->commit_data = nfs_commit_alloc();
        if (dreq->commit_data != NULL)
                dreq->commit_data->req = (struct nfs_page *) dreq;
 }
@@ -605,28 +584,24 @@ static ssize_t nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned l
        struct nfs_open_context *ctx = dreq->ctx;
        struct inode *inode = ctx->dentry->d_inode;
        size_t wsize = NFS_SERVER(inode)->wsize;
-        unsigned int wpages = nfs_max_pages(wsize);
        unsigned int pgbase;
        int result;
        ssize_t started = 0;
        get_dreq(dreq);
-        pgbase = user_addr & ~PAGE_MASK;
        do {
                struct nfs_write_data *data;
                size_t bytes;
+                pgbase = user_addr & ~PAGE_MASK;
+                bytes = min(wsize,count);
                result = -ENOMEM;
-                data = nfs_writedata_alloc(wpages);
+                data = nfs_writedata_alloc(pgbase + bytes);
                if (unlikely(!data))
                        break;
-                bytes = wsize;
-                if (count < wsize)
-                        bytes = count;
-                data->npages = nfs_direct_count_pages(user_addr, bytes);
                down_read(&current->mm->mmap_sem);
                result = get_user_pages(current, current->mm, user_addr,
                                        data->npages, 0, 0, data->pagevec, NULL);
@@ -676,8 +651,11 @@ static ssize_t nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned l
                started += bytes;
                user_addr += bytes;
                pos += bytes;
+                /* FIXME: Remove this useless math from the final patch */
                pgbase += bytes;
                pgbase &= ~PAGE_MASK;
+                BUG_ON(pgbase != (user_addr & ~PAGE_MASK));
                count -= bytes;
        } while (count != 0);
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index da9cf11c326f..7a9ee00e0c61 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -43,13 +43,15 @@ static mempool_t *nfs_rdata_mempool;
 #define MIN_POOL_READ   (32)
-struct nfs_read_data *nfs_readdata_alloc(unsigned int pagecount)
+struct nfs_read_data *nfs_readdata_alloc(size_t len)
 {
+        unsigned int pagecount = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
        struct nfs_read_data *p = mempool_alloc(nfs_rdata_mempool, SLAB_NOFS);
        if (p) {
                memset(p, 0, sizeof(*p));
                INIT_LIST_HEAD(&p->pages);
+                p->npages = pagecount;
                if (pagecount <= ARRAY_SIZE(p->page_array))
                        p->pagevec = p->page_array;
                else {
@@ -140,7 +142,7 @@ static int nfs_readpage_sync(struct nfs_open_context *ctx, struct inode *inode,
        int             result;
        struct nfs_read_data *rdata;
-        rdata = nfs_readdata_alloc(1);
+        rdata = nfs_readdata_alloc(count);
        if (!rdata)
                return -ENOMEM;
@@ -336,25 +338,25 @@ static int nfs_pagein_multi(struct list_head *head, struct inode *inode)
        struct nfs_page *req = nfs_list_entry(head->next);
        struct page *page = req->wb_page;
        struct nfs_read_data *data;
-        unsigned int rsize = NFS_SERVER(inode)->rsize;
+        size_t rsize = NFS_SERVER(inode)->rsize, nbytes;
-        unsigned int nbytes, offset;
+        unsigned int offset;
        int requests = 0;
        LIST_HEAD(list);
        nfs_list_remove_request(req);
        nbytes = req->wb_bytes;
-        for(;;) {
+        do {
-                data = nfs_readdata_alloc(1);
+                size_t len = min(nbytes,rsize);
+                data = nfs_readdata_alloc(len);
                if (!data)
                        goto out_bad;
                INIT_LIST_HEAD(&data->pages);
                list_add(&data->pages, &list);
                requests++;
-                if (nbytes <= rsize)
+                nbytes -= len;
-                        break;
+        } while(nbytes != 0);
-                nbytes -= rsize;
-        }
        atomic_set(&req->wb_complete, requests);
        ClearPageError(page);
@@ -402,7 +404,7 @@ static int nfs_pagein_one(struct list_head *head, struct inode *inode)
        if (NFS_SERVER(inode)->rsize < PAGE_CACHE_SIZE)
                return nfs_pagein_multi(head, inode);
-        data = nfs_readdata_alloc(NFS_SERVER(inode)->rpages);
+        data = nfs_readdata_alloc(NFS_SERVER(inode)->rsize);
        if (!data)
                goto out_bad;
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 50774991f8d5..8ab3cf10d792 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -90,22 +90,13 @@ static mempool_t *nfs_commit_mempool;
 static DECLARE_WAIT_QUEUE_HEAD(nfs_write_congestion);
-struct nfs_write_data *nfs_commit_alloc(unsigned int pagecount)
+struct nfs_write_data *nfs_commit_alloc(void)
 {
        struct nfs_write_data *p = mempool_alloc(nfs_commit_mempool, SLAB_NOFS);
        if (p) {
                memset(p, 0, sizeof(*p));
                INIT_LIST_HEAD(&p->pages);
-                if (pagecount <= ARRAY_SIZE(p->page_array))
-                        p->pagevec = p->page_array;
-                else {
-                        p->pagevec = kcalloc(pagecount, sizeof(struct page *), GFP_NOFS);
-                        if (!p->pagevec) {
-                                mempool_free(p, nfs_commit_mempool);
-                                p = NULL;
-                        }
-                }
        }
        return p;
 }
@@ -117,13 +108,15 @@ void nfs_commit_free(struct nfs_write_data *p)
        mempool_free(p, nfs_commit_mempool);
 }
-struct nfs_write_data *nfs_writedata_alloc(unsigned int pagecount)
+struct nfs_write_data *nfs_writedata_alloc(size_t len)
 {
+        unsigned int pagecount = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
        struct nfs_write_data *p = mempool_alloc(nfs_wdata_mempool, SLAB_NOFS);
        if (p) {
                memset(p, 0, sizeof(*p));
                INIT_LIST_HEAD(&p->pages);
+                p->npages = pagecount;
                if (pagecount <= ARRAY_SIZE(p->page_array))
                        p->pagevec = p->page_array;
                else {
@@ -208,7 +201,7 @@ static int nfs_writepage_sync(struct nfs_open_context *ctx, struct inode *inode,
        int             result, written = 0;
        struct nfs_write_data *wdata;
-        wdata = nfs_writedata_alloc(1);
+        wdata = nfs_writedata_alloc(wsize);
        if (!wdata)
                return -ENOMEM;
@@ -999,24 +992,24 @@ static int nfs_flush_multi(struct inode *inode, struct list_head *head, int how)
        struct nfs_page *req = nfs_list_entry(head->next);
        struct page *page = req->wb_page;
        struct nfs_write_data *data;
-        unsigned int wsize = NFS_SERVER(inode)->wsize;
+        size_t wsize = NFS_SERVER(inode)->wsize, nbytes;
-        unsigned int nbytes, offset;
+        unsigned int offset;
        int requests = 0;
        LIST_HEAD(list);
        nfs_list_remove_request(req);
        nbytes = req->wb_bytes;
-        for (;;) {
+        do {
-                data = nfs_writedata_alloc(1);
+                size_t len = min(nbytes, wsize);
+                data = nfs_writedata_alloc(len);
                if (!data)
                        goto out_bad;
                list_add(&data->pages, &list);
                requests++;
-                if (nbytes <= wsize)
+                nbytes -= len;
-                        break;
+        } while (nbytes != 0);
-                nbytes -= wsize;
-        }
        atomic_set(&req->wb_complete, requests);
        ClearPageError(page);
@@ -1070,7 +1063,7 @@ static int nfs_flush_one(struct inode *inode, struct list_head *head, int how)
        struct nfs_write_data   *data;
        unsigned int            count;
-        data = nfs_writedata_alloc(NFS_SERVER(inode)->wpages);
+        data = nfs_writedata_alloc(NFS_SERVER(inode)->wsize);
        if (!data)
                goto out_bad;
@@ -1378,7 +1371,7 @@ nfs_commit_list(struct inode *inode, struct list_head *head, int how)
        struct nfs_write_data   *data;
        struct nfs_page         *req;
-        data = nfs_commit_alloc(NFS_SERVER(inode)->wpages);
+        data = nfs_commit_alloc();
        if (!data)
                goto out_bad;
diff --git a/fs/super.c b/fs/super.c
index 6d4e8174b6db..5c4c94d5495e 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -49,6 +49,7 @@ DEFINE_SPINLOCK(sb_lock);
 /**
 *      alloc_super     -       create new superblock
+ *      @type:  filesystem type superblock should belong to
 *
 *      Allocates and initializes a new &struct super_block.  alloc_super()
 *      returns a pointer new superblock or %NULL if allocation had failed.
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index c40f81ba9b13..34dcb43a7837 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -1390,11 +1390,19 @@ xfs_vm_direct_IO(
        iocb->private = xfs_alloc_ioend(inode, IOMAP_UNWRITTEN);
-        ret = blockdev_direct_IO_own_locking(rw, iocb, inode,
+        if (rw == WRITE) {
-                iomap.iomap_target->bt_bdev,
+                ret = blockdev_direct_IO_own_locking(rw, iocb, inode,
-                iov, offset, nr_segs,
+                        iomap.iomap_target->bt_bdev,
-                xfs_get_blocks_direct,
+                        iov, offset, nr_segs,
-                xfs_end_io_direct);
+                        xfs_get_blocks_direct,
+                        xfs_end_io_direct);
+        } else {
+                ret = blockdev_direct_IO_no_locking(rw, iocb, inode,
+                        iomap.iomap_target->bt_bdev,
+                        iov, offset, nr_segs,
+                        xfs_get_blocks_direct,
+                        xfs_end_io_direct);
+        }
        if (unlikely(ret <= 0 && iocb->private))
                xfs_destroy_ioend(iocb->private);
diff --git a/fs/xfs/linux-2.6/xfs_lrw.c b/fs/xfs/linux-2.6/xfs_lrw.c
index 5d9cfd91ad08..ee788b1cb364 100644
--- a/fs/xfs/linux-2.6/xfs_lrw.c
+++ b/fs/xfs/linux-2.6/xfs_lrw.c
@@ -264,7 +264,9 @@ xfs_read(
                                        dmflags, &locktype);
                if (ret) {
                        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
-                        goto unlock_mutex;
+                        if (unlikely(ioflags & IO_ISDIRECT))
+                                mutex_unlock(&inode->i_mutex);
+                        return ret;
                }
        }
@@ -272,6 +274,9 @@ xfs_read(
                bhv_vop_flushinval_pages(vp, ctooff(offtoct(*offset)),
                                                -1, FI_REMAPF_LOCKED);
+        if (unlikely(ioflags & IO_ISDIRECT))
+                mutex_unlock(&inode->i_mutex);
        xfs_rw_enter_trace(XFS_READ_ENTER, &ip->i_iocore,
                                (void *)iovp, segs, *offset, ioflags);
        ret = __generic_file_aio_read(iocb, iovp, segs, offset);
@@ -281,10 +286,6 @@ xfs_read(
                XFS_STATS_ADD(xs_read_bytes, ret);
        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
-unlock_mutex:
-        if (unlikely(ioflags & IO_ISDIRECT))
-                mutex_unlock(&inode->i_mutex);
        return ret;
 }
@@ -390,6 +391,8 @@ xfs_splice_write(
        xfs_inode_t             *ip = XFS_BHVTOI(bdp);
        xfs_mount_t             *mp = ip->i_mount;
        ssize_t                 ret;
+        struct inode            *inode = outfilp->f_mapping->host;
+        xfs_fsize_t             isize;
        XFS_STATS_INC(xs_write_calls);
        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
@@ -416,6 +419,20 @@ xfs_splice_write(
        if (ret > 0)
                XFS_STATS_ADD(xs_write_bytes, ret);
+        isize = i_size_read(inode);
+        if (unlikely(ret < 0 && ret != -EFAULT && *ppos > isize))
+                *ppos = isize;
+        if (*ppos > ip->i_d.di_size) {
+                xfs_ilock(ip, XFS_ILOCK_EXCL);
+                if (*ppos > ip->i_d.di_size) {
+                        ip->i_d.di_size = *ppos;
+                        i_size_write(inode, *ppos);
+                        ip->i_update_core = 1;
+                        ip->i_update_size = 1;
+                }
+                xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        }
        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
        return ret;
 }
diff --git a/fs/xfs/quota/xfs_qm_bhv.c b/fs/xfs/quota/xfs_qm_bhv.c
index f137856c3261..db8872be8c87 100644
--- a/fs/xfs/quota/xfs_qm_bhv.c
+++ b/fs/xfs/quota/xfs_qm_bhv.c
@@ -203,7 +203,7 @@ xfs_qm_statvfs(
        if (error || !vnode)
                return error;
-        mp = XFS_BHVTOM(bhv);
+        mp = xfs_vfstom(bhvtovfs(bhv));
        ip = xfs_vtoi(vnode);
        if (!(ip->i_d.di_flags & XFS_DIFLAG_PROJINHERIT))
diff --git a/fs/xfs/xfs_alloc.h b/fs/xfs/xfs_alloc.h
index 650591f999ae..5a4256120ccc 100644
--- a/fs/xfs/xfs_alloc.h
+++ b/fs/xfs/xfs_alloc.h
@@ -44,6 +44,26 @@ typedef enum xfs_alloctype
 #define XFS_ALLOC_FLAG_FREEING  0x00000002  /* indicate caller is freeing extents*/
 /*
+ * In order to avoid ENOSPC-related deadlock caused by
+ * out-of-order locking of AGF buffer (PV 947395), we place
+ * constraints on the relationship among actual allocations for
+ * data blocks, freelist blocks, and potential file data bmap
+ * btree blocks. However, these restrictions may result in no
+ * actual space allocated for a delayed extent, for example, a data
+ * block in a certain AG is allocated but there is no additional
+ * block for the additional bmap btree block due to a split of the
+ * bmap btree of the file. The result of this may lead to an
+ * infinite loop in xfssyncd when the file gets flushed to disk and
+ * all delayed extents need to be actually allocated. To get around
+ * this, we explicitly set aside a few blocks which will not be
+ * reserved in delayed allocation. Considering the minimum number of
+ * needed freelist blocks is 4 fsbs _per AG_, a potential split of file's bmap
+ * btree requires 1 fsb, so we set the number of set-aside blocks
+ * to 4 + 4*agcount.
+ */
+#define XFS_ALLOC_SET_ASIDE(mp)  (4 + ((mp)->m_sb.sb_agcount * 4))
+/*
 * Argument structure for xfs_alloc routines.
 * This is turned into a structure to avoid having 20 arguments passed
 * down several levels of the stack.
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 3a6137539064..bf46fae303af 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -4993,7 +4993,7 @@ xfs_bmapi(
                                bma.firstblock = *firstblock;
                                bma.alen = alen;
                                bma.off = aoff;
-                                bma.conv = (flags & XFS_BMAPI_CONVERT);
+                                bma.conv = !!(flags & XFS_BMAPI_CONVERT);
                                bma.wasdel = wasdelay;
                                bma.minlen = minlen;
                                bma.low = flist->xbf_low;
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 077629bab532..c064e72ada9e 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -462,7 +462,7 @@ xfs_fs_counts(
        xfs_icsb_sync_counters_lazy(mp);
        s = XFS_SB_LOCK(mp);
-        cnt->freedata = mp->m_sb.sb_fdblocks;
+        cnt->freedata = mp->m_sb.sb_fdblocks - XFS_ALLOC_SET_ASIDE(mp);
        cnt->freertx = mp->m_sb.sb_frextents;
        cnt->freeino = mp->m_sb.sb_ifree;
        cnt->allocino = mp->m_sb.sb_icount;
@@ -519,15 +519,19 @@ xfs_reserve_blocks(
                }
                mp->m_resblks = request;
        } else {
+                __int64_t       free;
+                free =  mp->m_sb.sb_fdblocks - XFS_ALLOC_SET_ASIDE(mp);
                delta = request - mp->m_resblks;
-                lcounter = mp->m_sb.sb_fdblocks - delta;
+                lcounter = free - delta;
                if (lcounter < 0) {
                        /* We can't satisfy the request, just get what we can */
-                        mp->m_resblks += mp->m_sb.sb_fdblocks;
+                        mp->m_resblks += free;
-                        mp->m_resblks_avail += mp->m_sb.sb_fdblocks;
+                        mp->m_resblks_avail += free;
-                        mp->m_sb.sb_fdblocks = 0;
+                        mp->m_sb.sb_fdblocks = XFS_ALLOC_SET_ASIDE(mp);
                } else {
-                        mp->m_sb.sb_fdblocks = lcounter;
+                        mp->m_sb.sb_fdblocks =
+                                lcounter + XFS_ALLOC_SET_ASIDE(mp);
                        mp->m_resblks = request;
                        mp->m_resblks_avail += delta;
                }
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 4be5c0b2d296..9dfae18d995f 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1243,24 +1243,6 @@ xfs_mod_sb(xfs_trans_t *tp, __int64_t fields)
        xfs_trans_log_buf(tp, bp, first, last);
 }
-/*
- * In order to avoid ENOSPC-related deadlock caused by
- * out-of-order locking of AGF buffer (PV 947395), we place
- * constraints on the relationship among actual allocations for
- * data blocks, freelist blocks, and potential file data bmap
- * btree blocks. However, these restrictions may result in no
- * actual space allocated for a delayed extent, for example, a data
- * block in a certain AG is allocated but there is no additional
- * block for the additional bmap btree block due to a split of the
- * bmap btree of the file. The result of this may lead to an
- * infinite loop in xfssyncd when the file gets flushed to disk and
- * all delayed extents need to be actually allocated. To get around
- * this, we explicitly set aside a few blocks which will not be
- * reserved in delayed allocation. Considering the minimum number of
- * needed freelist blocks is 4 fsbs, a potential split of file's bmap
- * btree requires 1 fsb, so we set the number of set-aside blocks to 8.
-*/
-#define SET_ASIDE_BLOCKS 8
 /*
 * xfs_mod_incore_sb_unlocked() is a utility routine common used to apply
@@ -1306,7 +1288,8 @@ xfs_mod_incore_sb_unlocked(xfs_mount_t *mp, xfs_sb_field_t field,
                return 0;
        case XFS_SBS_FDBLOCKS:
-                lcounter = (long long)mp->m_sb.sb_fdblocks - SET_ASIDE_BLOCKS;
+                lcounter = (long long)
+                        mp->m_sb.sb_fdblocks - XFS_ALLOC_SET_ASIDE(mp);
                res_used = (long long)(mp->m_resblks - mp->m_resblks_avail);
                if (delta > 0) {                /* Putting blocks back */
@@ -1340,7 +1323,7 @@ xfs_mod_incore_sb_unlocked(xfs_mount_t *mp, xfs_sb_field_t field,
                        }
                }
-                mp->m_sb.sb_fdblocks = lcounter + SET_ASIDE_BLOCKS;
+                mp->m_sb.sb_fdblocks = lcounter + XFS_ALLOC_SET_ASIDE(mp);
                return 0;
        case XFS_SBS_FREXTENTS:
                lcounter = (long long)mp->m_sb.sb_frextents;
@@ -2021,7 +2004,8 @@ xfs_icsb_sync_counters_lazy(
 * when we get near ENOSPC.
 */
 #define XFS_ICSB_INO_CNTR_REENABLE      64
-#define XFS_ICSB_FDBLK_CNTR_REENABLE    512
+#define XFS_ICSB_FDBLK_CNTR_REENABLE(mp) \
+                (512 + XFS_ALLOC_SET_ASIDE(mp))
 STATIC void
 xfs_icsb_balance_counter(
        xfs_mount_t     *mp,
@@ -2055,7 +2039,7 @@ xfs_icsb_balance_counter(
        case XFS_SBS_FDBLOCKS:
                count = mp->m_sb.sb_fdblocks;
                resid = do_div(count, weight);
-                if (count < XFS_ICSB_FDBLK_CNTR_REENABLE)
+                if (count < XFS_ICSB_FDBLK_CNTR_REENABLE(mp))
                        goto out;
                break;
        default:
@@ -2110,11 +2094,11 @@ again:
        case XFS_SBS_FDBLOCKS:
                BUG_ON((mp->m_resblks - mp->m_resblks_avail) != 0);
-                lcounter = icsbp->icsb_fdblocks;
+                lcounter = icsbp->icsb_fdblocks - XFS_ALLOC_SET_ASIDE(mp);
                lcounter += delta;
                if (unlikely(lcounter < 0))
                        goto slow_path;
-                icsbp->icsb_fdblocks = lcounter;
+                icsbp->icsb_fdblocks = lcounter + XFS_ALLOC_SET_ASIDE(mp);
                break;
        default:
                BUG();
diff --git a/fs/xfs/xfs_vfsops.c b/fs/xfs/xfs_vfsops.c
index b427d220a169..a34796e57afb 100644
--- a/fs/xfs/xfs_vfsops.c
+++ b/fs/xfs/xfs_vfsops.c
@@ -811,7 +811,8 @@ xfs_statvfs(
        statp->f_bsize = sbp->sb_blocksize;
        lsize = sbp->sb_logstart ? sbp->sb_logblocks : 0;
        statp->f_blocks = sbp->sb_dblocks - lsize;
-        statp->f_bfree = statp->f_bavail = sbp->sb_fdblocks;
+        statp->f_bfree = statp->f_bavail =
+                                sbp->sb_fdblocks - XFS_ALLOC_SET_ASIDE(mp);
        fakeinos = statp->f_bfree << sbp->sb_inopblog;
 #if XFS_BIG_INUMS
        fakeinos += mp->m_inoadd;