31 files changed, 300 insertions, 113 deletions

diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 549b0144da11..fe2b1aa2464e 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -685,19 +685,20 @@ EXPORT_SYMBOL(bio_integrity_split);
  * bio_integrity_clone - Callback for cloning bios with integrity metadata
  * @bio:        New bio
  * @bio_src:    Original bio
+ * @gfp_mask:   Memory allocation mask
  * @bs:         bio_set to allocate bip from
  *
  * Description: Called to allocate a bip when cloning a bio
  */
 int bio_integrity_clone(struct bio *bio, struct bio *bio_src,
-                        struct bio_set *bs)
+                        gfp_t gfp_mask, struct bio_set *bs)
 {
         struct bio_integrity_payload *bip_src = bio_src->bi_integrity;
         struct bio_integrity_payload *bip;
 
         BUG_ON(bip_src == NULL);
 
-        bip = bio_integrity_alloc_bioset(bio, GFP_NOIO, bip_src->bip_vcnt, bs);
+        bip = bio_integrity_alloc_bioset(bio, gfp_mask, bip_src->bip_vcnt, bs);
 
         if (bip == NULL)
                 return -EIO;
diff --git a/fs/bio.c b/fs/bio.c
index 124b95c4d582..d4f06327c810 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -463,10 +463,12 @@ struct bio *bio_clone(struct bio *bio, gfp_t gfp_mask)
         if (bio_integrity(bio)) {
                 int ret;
 
-                ret = bio_integrity_clone(b, bio, fs_bio_set);
+                ret = bio_integrity_clone(b, bio, gfp_mask, fs_bio_set);
 
-                if (ret < 0)
+                if (ret < 0) {
+                        bio_put(b);
                         return NULL;
+                }
         }
 
         return b;
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index f6caeb1d1106..bdca1f4b3a3e 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -946,6 +946,8 @@ static int ecryptfs_copy_mount_wide_sigs_to_inode_sigs(
         list_for_each_entry(global_auth_tok,
                             &mount_crypt_stat->global_auth_tok_list,
                             mount_crypt_stat_list) {
+                if (global_auth_tok->flags & ECRYPTFS_AUTH_TOK_FNEK)
+                        continue;
                 rc = ecryptfs_add_keysig(crypt_stat, global_auth_tok->sig);
                 if (rc) {
                         printk(KERN_ERR "Error adding keysig; rc = [%d]\n", rc);
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index c11fc95714ab..eb2267eca1fe 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -328,6 +328,7 @@ struct ecryptfs_dentry_info {
  */
 struct ecryptfs_global_auth_tok {
 #define ECRYPTFS_AUTH_TOK_INVALID 0x00000001
+#define ECRYPTFS_AUTH_TOK_FNEK    0x00000002
         u32 flags;
         struct list_head mount_crypt_stat_list;
         struct key *global_auth_tok_key;
@@ -696,7 +697,7 @@ ecryptfs_write_header_metadata(char *virt,
 int ecryptfs_add_keysig(struct ecryptfs_crypt_stat *crypt_stat, char *sig);
 int
 ecryptfs_add_global_auth_tok(struct ecryptfs_mount_crypt_stat *mount_crypt_stat,
-                           char *sig);
+                           char *sig, u32 global_auth_tok_flags);
 int ecryptfs_get_global_auth_tok_for_sig(
         struct ecryptfs_global_auth_tok **global_auth_tok,
         struct ecryptfs_mount_crypt_stat *mount_crypt_stat, char *sig);
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index ff539420cc6f..e4a6223c3145 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -2375,7 +2375,7 @@ struct kmem_cache *ecryptfs_global_auth_tok_cache;
 
 int
 ecryptfs_add_global_auth_tok(struct ecryptfs_mount_crypt_stat *mount_crypt_stat,
-                             char *sig)
+                             char *sig, u32 global_auth_tok_flags)
 {
         struct ecryptfs_global_auth_tok *new_auth_tok;
         int rc = 0;
@@ -2389,6 +2389,7 @@ ecryptfs_add_global_auth_tok(struct ecryptfs_mount_crypt_stat *mount_crypt_stat,
                 goto out;
         }
         memcpy(new_auth_tok->sig, sig, ECRYPTFS_SIG_SIZE_HEX);
+        new_auth_tok->flags = global_auth_tok_flags;
         new_auth_tok->sig[ECRYPTFS_SIG_SIZE_HEX] = '\0';
         mutex_lock(&mount_crypt_stat->global_auth_tok_list_mutex);
         list_add(&new_auth_tok->mount_crypt_stat_list,
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 789cf2e1be1e..aed56c25539b 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -319,7 +319,7 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
                 case ecryptfs_opt_ecryptfs_sig:
                         sig_src = args[0].from;
                         rc = ecryptfs_add_global_auth_tok(mount_crypt_stat,
-                                                          sig_src);
+                                                          sig_src, 0);
                         if (rc) {
                                 printk(KERN_ERR "Error attempting to register "
                                        "global sig; rc = [%d]\n", rc);
@@ -370,7 +370,8 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
                                 ECRYPTFS_SIG_SIZE_HEX] = '\0';
                         rc = ecryptfs_add_global_auth_tok(
                                 mount_crypt_stat,
-                                mount_crypt_stat->global_default_fnek_sig);
+                                mount_crypt_stat->global_default_fnek_sig,
+                                ECRYPTFS_AUTH_TOK_FNEK);
                         if (rc) {
                                 printk(KERN_ERR "Error attempting to register "
                                        "global fnek sig [%s]; rc = [%d]\n",
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 6b74d09adbe5..de0004fe6e00 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -202,9 +202,9 @@ static sector_t _fat_bmap(struct address_space *mapping, sector_t block)
         sector_t blocknr;
 
         /* fat_get_cluster() assumes the requested blocknr isn't truncated. */
-        mutex_lock(&mapping->host->i_mutex);
+        down_read(&mapping->host->i_alloc_sem);
         blocknr = generic_block_bmap(mapping, block, fat_get_block);
-        mutex_unlock(&mapping->host->i_mutex);
+        up_read(&mapping->host->i_alloc_sem);
 
         return blocknr;
 }
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index e5eaa62fd17f..e3fe9918faaf 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -274,6 +274,7 @@ __sync_single_inode(struct inode *inode, struct writeback_control *wbc)
         int ret;
 
         BUG_ON(inode->i_state & I_SYNC);
+        WARN_ON(inode->i_state & I_NEW);
 
         /* Set I_SYNC, reset I_DIRTY */
         dirty = inode->i_state & I_DIRTY;
@@ -298,6 +299,7 @@ __sync_single_inode(struct inode *inode, struct writeback_control *wbc)
         }
 
         spin_lock(&inode_lock);
+        WARN_ON(inode->i_state & I_NEW);
         inode->i_state &= ~I_SYNC;
         if (!(inode->i_state & I_FREEING)) {
                 if (!(inode->i_state & I_DIRTY) &&
@@ -470,6 +472,11 @@ void generic_sync_sb_inodes(struct super_block *sb,
                         break;
                 }
 
+                if (inode->i_state & I_NEW) {
+                        requeue_io(inode);
+                        continue;
+                }
+
                 if (wbc->nonblocking && bdi_write_congested(bdi)) {
                         wbc->encountered_congestion = 1;
                         if (!sb_is_blkdev_sb(sb))
@@ -531,7 +538,7 @@ void generic_sync_sb_inodes(struct super_block *sb,
                 list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
                         struct address_space *mapping;
 
-                        if (inode->i_state & (I_FREEING|I_WILL_FREE))
+                        if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW))
                                 continue;
                         mapping = inode->i_mapping;
                         if (mapping->nrpages == 0)
diff --git a/fs/inode.c b/fs/inode.c
index 913ab2d9a5d1..826fb0b9d1c3 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -359,6 +359,7 @@ static int invalidate_list(struct list_head *head, struct list_head *dispose)
                 invalidate_inode_buffers(inode);
                 if (!atomic_read(&inode->i_count)) {
                         list_move(&inode->i_list, dispose);
+                        WARN_ON(inode->i_state & I_NEW);
                         inode->i_state |= I_FREEING;
                         count++;
                         continue;
@@ -460,6 +461,7 @@ static void prune_icache(int nr_to_scan)
                                 continue;
                 }
                 list_move(&inode->i_list, &freeable);
+                WARN_ON(inode->i_state & I_NEW);
                 inode->i_state |= I_FREEING;
                 nr_pruned++;
         }
@@ -656,6 +658,7 @@ void unlock_new_inode(struct inode *inode)
          * just created it (so there can be no old holders
          * that haven't tested I_LOCK).
          */
+        WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW));
         inode->i_state &= ~(I_LOCK|I_NEW);
         wake_up_inode(inode);
 }
@@ -1145,6 +1148,7 @@ void generic_delete_inode(struct inode *inode)
 
         list_del_init(&inode->i_list);
         list_del_init(&inode->i_sb_list);
+        WARN_ON(inode->i_state & I_NEW);
         inode->i_state |= I_FREEING;
         inodes_stat.nr_inodes--;
         spin_unlock(&inode_lock);
@@ -1186,16 +1190,19 @@ static void generic_forget_inode(struct inode *inode)
                         spin_unlock(&inode_lock);
                         return;
                 }
+                WARN_ON(inode->i_state & I_NEW);
                 inode->i_state |= I_WILL_FREE;
                 spin_unlock(&inode_lock);
                 write_inode_now(inode, 1);
                 spin_lock(&inode_lock);
+                WARN_ON(inode->i_state & I_NEW);
                 inode->i_state &= ~I_WILL_FREE;
                 inodes_stat.nr_unused--;
                 hlist_del_init(&inode->i_hash);
         }
         list_del_init(&inode->i_list);
         list_del_init(&inode->i_sb_list);
+        WARN_ON(inode->i_state & I_NEW);
         inode->i_state |= I_FREEING;
         inodes_stat.nr_inodes--;
         spin_unlock(&inode_lock);
diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
index 1f3b0fc0d351..aedc47a264c1 100644
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -139,6 +139,55 @@ int nlmclnt_block(struct nlm_wait *block, struct nlm_rqst *req, long timeout)
         return 0;
 }
 
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static const struct in6_addr *nlmclnt_map_v4addr(const struct sockaddr *sap,
+                                                 struct in6_addr *addr_mapped)
+{
+        const struct sockaddr_in *sin = (const struct sockaddr_in *)sap;
+
+        switch (sap->sa_family) {
+        case AF_INET6:
+                return &((const struct sockaddr_in6 *)sap)->sin6_addr;
+        case AF_INET:
+                ipv6_addr_set_v4mapped(sin->sin_addr.s_addr, addr_mapped);
+                return addr_mapped;
+        }
+
+        return NULL;
+}
+
+/*
+ * If lockd is using a PF_INET6 listener, all incoming requests appear
+ * to come from AF_INET6 remotes.  The address of AF_INET remotes are
+ * mapped to AF_INET6 automatically by the network layer.  In case the
+ * user passed an AF_INET server address at mount time, ensure both
+ * addresses are AF_INET6 before comparing them.
+ */
+static int nlmclnt_cmp_addr(const struct nlm_host *host,
+                            const struct sockaddr *sap)
+{
+        const struct in6_addr *addr1;
+        const struct in6_addr *addr2;
+        struct in6_addr addr1_mapped;
+        struct in6_addr addr2_mapped;
+
+        addr1 = nlmclnt_map_v4addr(nlm_addr(host), &addr1_mapped);
+        if (likely(addr1 != NULL)) {
+                addr2 = nlmclnt_map_v4addr(sap, &addr2_mapped);
+                if (likely(addr2 != NULL))
+                        return ipv6_addr_equal(addr1, addr2);
+        }
+
+        return 0;
+}
+#else   /* !(CONFIG_IPV6 || CONFIG_IPV6_MODULE) */
+static int nlmclnt_cmp_addr(const struct nlm_host *host,
+                            const struct sockaddr *sap)
+{
+        return nlm_cmp_addr(nlm_addr(host), sap);
+}
+#endif  /* !(CONFIG_IPV6 || CONFIG_IPV6_MODULE) */
+
 /*
  * The server lockd has called us back to tell us the lock was granted
  */
@@ -166,7 +215,7 @@ __be32 nlmclnt_grant(const struct sockaddr *addr, const struct nlm_lock *lock)
                  */
                 if (fl_blocked->fl_u.nfs_fl.owner->pid != lock->svid)
                         continue;
-                if (!nlm_cmp_addr(nlm_addr(block->b_host), addr))
+                if (!nlmclnt_cmp_addr(block->b_host, addr))
                         continue;
                 if (nfs_compare_fh(NFS_FH(fl_blocked->fl_file->f_path.dentry->d_inode) ,fh) != 0)
                         continue;
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 9b728f3565a1..574158ae2398 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -255,6 +255,32 @@ static int nfs_sockaddr_match_ipaddr(const struct sockaddr *sa1,
         }
         return 0;
 }
+
+/*
+ * Test if two ip6 socket addresses refer to the same socket by
+ * comparing relevant fields. The padding bytes specifically, are not
+ * compared. sin6_flowinfo is not compared because it only affects QoS
+ * and sin6_scope_id is only compared if the address is "link local"
+ * because "link local" addresses need only be unique to a specific
+ * link. Conversely, ordinary unicast addresses might have different
+ * sin6_scope_id.
+ *
+ * The caller should ensure both socket addresses are AF_INET6.
+ */
+static int nfs_sockaddr_cmp_ip6(const struct sockaddr *sa1,
+                                const struct sockaddr *sa2)
+{
+        const struct sockaddr_in6 *saddr1 = (const struct sockaddr_in6 *)sa1;
+        const struct sockaddr_in6 *saddr2 = (const struct sockaddr_in6 *)sa2;
+
+        if (!ipv6_addr_equal(&saddr1->sin6_addr,
+                             &saddr1->sin6_addr))
+                return 0;
+        if (ipv6_addr_scope(&saddr1->sin6_addr) == IPV6_ADDR_SCOPE_LINKLOCAL &&
+            saddr1->sin6_scope_id != saddr2->sin6_scope_id)
+                return 0;
+        return saddr1->sin6_port == saddr2->sin6_port;
+}
 #else
 static int nfs_sockaddr_match_ipaddr4(const struct sockaddr_in *sa1,
                                  const struct sockaddr_in *sa2)
@@ -270,9 +296,52 @@ static int nfs_sockaddr_match_ipaddr(const struct sockaddr *sa1,
         return nfs_sockaddr_match_ipaddr4((const struct sockaddr_in *)sa1,
                         (const struct sockaddr_in *)sa2);
 }
+
+static int nfs_sockaddr_cmp_ip6(const struct sockaddr * sa1,
+                                const struct sockaddr * sa2)
+{
+        return 0;
+}
 #endif
 
 /*
+ * Test if two ip4 socket addresses refer to the same socket, by
+ * comparing relevant fields. The padding bytes specifically, are
+ * not compared.
+ *
+ * The caller should ensure both socket addresses are AF_INET.
+ */
+static int nfs_sockaddr_cmp_ip4(const struct sockaddr *sa1,
+                                const struct sockaddr *sa2)
+{
+        const struct sockaddr_in *saddr1 = (const struct sockaddr_in *)sa1;
+        const struct sockaddr_in *saddr2 = (const struct sockaddr_in *)sa2;
+
+        if (saddr1->sin_addr.s_addr != saddr2->sin_addr.s_addr)
+                return 0;
+        return saddr1->sin_port == saddr2->sin_port;
+}
+
+/*
+ * Test if two socket addresses represent the same actual socket,
+ * by comparing (only) relevant fields.
+ */
+static int nfs_sockaddr_cmp(const struct sockaddr *sa1,
+                            const struct sockaddr *sa2)
+{
+        if (sa1->sa_family != sa2->sa_family)
+                return 0;
+
+        switch (sa1->sa_family) {
+        case AF_INET:
+                return nfs_sockaddr_cmp_ip4(sa1, sa2);
+        case AF_INET6:
+                return nfs_sockaddr_cmp_ip6(sa1, sa2);
+        }
+        return 0;
+}
+
+/*
  * Find a client by IP address and protocol version
  * - returns NULL if no such client
  */
@@ -344,8 +413,10 @@ struct nfs_client *nfs_find_client_next(struct nfs_client *clp)
 static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *data)
 {
         struct nfs_client *clp;
+        const struct sockaddr *sap = data->addr;
 
         list_for_each_entry(clp, &nfs_client_list, cl_share_link) {
+                const struct sockaddr *clap = (struct sockaddr *)&clp->cl_addr;
                 /* Don't match clients that failed to initialise properly */
                 if (clp->cl_cons_state < 0)
                         continue;
@@ -358,7 +429,7 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *dat
                         continue;
 
                 /* Match the full socket address */
-                if (memcmp(&clp->cl_addr, data->addr, sizeof(clp->cl_addr)) != 0)
+                if (!nfs_sockaddr_cmp(sap, clap))
                         continue;
 
                 atomic_inc(&clp->cl_count);
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index e35c8199f82f..672368f865ca 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1892,8 +1892,14 @@ static int nfs_do_access(struct inode *inode, struct rpc_cred *cred, int mask)
         cache.cred = cred;
         cache.jiffies = jiffies;
         status = NFS_PROTO(inode)->access(inode, &cache);
-        if (status != 0)
+        if (status != 0) {
+                if (status == -ESTALE) {
+                        nfs_zap_caches(inode);
+                        if (!S_ISDIR(inode->i_mode))
+                                set_bit(NFS_INO_STALE, &NFS_I(inode)->flags);
+                }
                 return status;
+        }
         nfs_access_add_cache(inode, &cache);
 out:
         if ((mask & ~cache.mask & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index cef62557c87d..6bbf0e6daad2 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -292,7 +292,7 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
 {
         struct nfs_server *server = NFS_SERVER(inode);
         struct nfs_fattr fattr;
-        struct page *pages[NFSACL_MAXPAGES] = { };
+        struct page *pages[NFSACL_MAXPAGES];
         struct nfs3_setaclargs args = {
                 .inode = inode,
                 .mask = NFS_ACL,
@@ -303,7 +303,7 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
                 .rpc_argp       = &args,
                 .rpc_resp       = &fattr,
         };
-        int status, count;
+        int status;
 
         status = -EOPNOTSUPP;
         if (!nfs_server_capable(inode, NFS_CAP_ACLS))
@@ -319,6 +319,20 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
         if (S_ISDIR(inode->i_mode)) {
                 args.mask |= NFS_DFACL;
                 args.acl_default = dfacl;
+                args.len = nfsacl_size(acl, dfacl);
+        } else
+                args.len = nfsacl_size(acl, NULL);
+
+        if (args.len > NFS_ACL_INLINE_BUFSIZE) {
+                unsigned int npages = 1 + ((args.len - 1) >> PAGE_SHIFT);
+
+                status = -ENOMEM;
+                do {
+                        args.pages[args.npages] = alloc_page(GFP_KERNEL);
+                        if (args.pages[args.npages] == NULL)
+                                goto out_freepages;
+                        args.npages++;
+                } while (args.npages < npages);
         }
 
         dprintk("NFS call setacl\n");
@@ -329,10 +343,6 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
         nfs_zap_acl_cache(inode);
         dprintk("NFS reply setacl: %d\n", status);
 
-        /* pages may have been allocated at the xdr layer. */
-        for (count = 0; count < NFSACL_MAXPAGES && args.pages[count]; count++)
-                __free_page(args.pages[count]);
-
         switch (status) {
                 case 0:
                         status = nfs_refresh_inode(inode, &fattr);
@@ -346,6 +356,11 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
                 case -ENOTSUPP:
                         status = -EOPNOTSUPP;
         }
+out_freepages:
+        while (args.npages != 0) {
+                args.npages--;
+                __free_page(args.pages[args.npages]);
+        }
 out:
         return status;
 }
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 11cdddec1432..6cdeacffde46 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -82,8 +82,10 @@
 #define NFS3_commitres_sz       (1+NFS3_wcc_data_sz+2)
 
 #define ACL3_getaclargs_sz      (NFS3_fh_sz+1)
-#define ACL3_setaclargs_sz      (NFS3_fh_sz+1+2*(2+5*3))
-#define ACL3_getaclres_sz       (1+NFS3_post_op_attr_sz+1+2*(2+5*3))
+#define ACL3_setaclargs_sz      (NFS3_fh_sz+1+ \
+                                XDR_QUADLEN(NFS_ACL_INLINE_BUFSIZE))
+#define ACL3_getaclres_sz       (1+NFS3_post_op_attr_sz+1+ \
+                                XDR_QUADLEN(NFS_ACL_INLINE_BUFSIZE))
 #define ACL3_setaclres_sz       (1+NFS3_post_op_attr_sz)
 
 /*
@@ -703,28 +705,18 @@ nfs3_xdr_setaclargs(struct rpc_rqst *req, __be32 *p,
                    struct nfs3_setaclargs *args)
 {
         struct xdr_buf *buf = &req->rq_snd_buf;
-        unsigned int base, len_in_head, len = nfsacl_size(
-                (args->mask & NFS_ACL)   ? args->acl_access  : NULL,
-                (args->mask & NFS_DFACL) ? args->acl_default : NULL);
-        int count, err;
+        unsigned int base;
+        int err;
 
         p = xdr_encode_fhandle(p, NFS_FH(args->inode));
         *p++ = htonl(args->mask);
-        base = (char *)p - (char *)buf->head->iov_base;
-        /* put as much of the acls into head as possible. */
-        len_in_head = min_t(unsigned int, buf->head->iov_len - base, len);
-        len -= len_in_head;
-        req->rq_slen = xdr_adjust_iovec(req->rq_svec, p + (len_in_head >> 2));
-
-        for (count = 0; (count << PAGE_SHIFT) < len; count++) {
-                args->pages[count] = alloc_page(GFP_KERNEL);
-                if (!args->pages[count]) {
-                        while (count)
-                                __free_page(args->pages[--count]);
-                        return -ENOMEM;
-                }
-        }
-        xdr_encode_pages(buf, args->pages, 0, len);
+        req->rq_slen = xdr_adjust_iovec(req->rq_svec, p);
+        base = req->rq_slen;
+
+        if (args->npages != 0)
+                xdr_encode_pages(buf, args->pages, 0, args->len);
+        else
+                req->rq_slen += args->len;
 
         err = nfsacl_encode(buf, base, args->inode,
                             (args->mask & NFS_ACL) ?
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 30befc39b3c6..2a2a0a7143ad 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -21,7 +21,9 @@
 #define NFSDBG_FACILITY         NFSDBG_VFS
 
 /*
- * Check if fs_root is valid
+ * Convert the NFSv4 pathname components into a standard posix path.
+ *
+ * Note that the resulting string will be placed at the end of the buffer
  */
 static inline char *nfs4_pathname_string(const struct nfs4_pathname *pathname,
                                          char *buffer, ssize_t buflen)
@@ -99,21 +101,20 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
 {
         struct vfsmount *mnt = ERR_PTR(-ENOENT);
         char *mnt_path;
-        int page2len;
+        unsigned int maxbuflen;
         unsigned int s;
 
         mnt_path = nfs4_pathname_string(&location->rootpath, page2, PAGE_SIZE);
         if (IS_ERR(mnt_path))
                 return mnt;
         mountdata->mnt_path = mnt_path;
-        page2 += strlen(mnt_path) + 1;
-        page2len = PAGE_SIZE - strlen(mnt_path) - 1;
+        maxbuflen = mnt_path - 1 - page2;
 
         for (s = 0; s < location->nservers; s++) {
                 const struct nfs4_string *buf = &location->servers[s];
                 struct sockaddr_storage addr;
 
-                if (buf->len <= 0 || buf->len >= PAGE_SIZE)
+                if (buf->len <= 0 || buf->len >= maxbuflen)
                         continue;
 
                 mountdata->addr = (struct sockaddr *)&addr;
@@ -126,8 +127,8 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                         continue;
                 nfs_set_port(mountdata->addr, NFS_PORT);
 
-                strncpy(page2, buf->data, page2len);
-                page2[page2len] = '\0';
+                memcpy(page2, buf->data, buf->len);
+                page2[buf->len] = '\0';
                 mountdata->hostname = page2;
 
                 snprintf(page, PAGE_SIZE, "%s:%s",
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 3a9e5deed74d..19e3a96aa02c 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -176,7 +176,8 @@ static int ocfs2_dinode_insert_check(struct inode *inode,
 
         BUG_ON(OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL);
         mlog_bug_on_msg(!ocfs2_sparse_alloc(osb) &&
-                        (OCFS2_I(inode)->ip_clusters != rec->e_cpos),
+                        (OCFS2_I(inode)->ip_clusters !=
+                         le32_to_cpu(rec->e_cpos)),
                         "Device %s, asking for sparse allocation: inode %llu, "
                         "cpos %u, clusters %u\n",
                         osb->dev_str,
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index a067a6cffb01..8e1709a679b7 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -227,7 +227,7 @@ int ocfs2_read_inline_data(struct inode *inode, struct page *page,
         size = i_size_read(inode);
 
         if (size > PAGE_CACHE_SIZE ||
-            size > ocfs2_max_inline_data(inode->i_sb)) {
+            size > ocfs2_max_inline_data_with_xattr(inode->i_sb, di)) {
                 ocfs2_error(inode->i_sb,
                             "Inode %llu has with inline data has bad size: %Lu",
                             (unsigned long long)OCFS2_I(inode)->ip_blkno,
@@ -1555,6 +1555,7 @@ static int ocfs2_try_to_write_inline_data(struct address_space *mapping,
         int ret, written = 0;
         loff_t end = pos + len;
         struct ocfs2_inode_info *oi = OCFS2_I(inode);
+        struct ocfs2_dinode *di = NULL;
 
         mlog(0, "Inode %llu, write of %u bytes at off %llu. features: 0x%x\n",
              (unsigned long long)oi->ip_blkno, len, (unsigned long long)pos,
@@ -1587,7 +1588,9 @@ static int ocfs2_try_to_write_inline_data(struct address_space *mapping,
         /*
          * Check whether the write can fit.
          */
-        if (mmap_page || end > ocfs2_max_inline_data(inode->i_sb))
+        di = (struct ocfs2_dinode *)wc->w_di_bh->b_data;
+        if (mmap_page ||
+            end > ocfs2_max_inline_data_with_xattr(inode->i_sb, di))
                 return 0;
 
 do_inline_write:
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 084aba86c3b2..4b11762f249e 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -532,7 +532,8 @@ static int ocfs2_mknod_locked(struct ocfs2_super *osb,
 
                 fe->i_dyn_features = cpu_to_le16(feat | OCFS2_INLINE_DATA_FL);
 
-                fe->id2.i_data.id_count = cpu_to_le16(ocfs2_max_inline_data(osb->sb));
+                fe->id2.i_data.id_count = cpu_to_le16(
+                                ocfs2_max_inline_data_with_xattr(osb->sb, fe));
         } else {
                 fel = &fe->id2.i_list;
                 fel->l_tree_depth = 0;
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index c7ae45aaa36c..2332ef740f4f 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -1070,12 +1070,6 @@ static inline int ocfs2_fast_symlink_chars(struct super_block *sb)
                  offsetof(struct ocfs2_dinode, id2.i_symlink);
 }
 
-static inline int ocfs2_max_inline_data(struct super_block *sb)
-{
-        return sb->s_blocksize -
-                offsetof(struct ocfs2_dinode, id2.i_data.id_data);
-}
-
 static inline int ocfs2_max_inline_data_with_xattr(struct super_block *sb,
                                                    struct ocfs2_dinode *di)
 {
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 4ddd788add67..2563df89fc2a 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -547,8 +547,12 @@ int ocfs2_calc_xattr_init(struct inode *dir,
          * when blocksize = 512, may reserve one more cluser for
          * xattr bucket, otherwise reserve one metadata block
          * for them is ok.
+         * If this is a new directory with inline data,
+         * we choose to reserve the entire inline area for
+         * directory contents and force an external xattr block.
          */
         if (dir->i_sb->s_blocksize == OCFS2_MIN_BLOCKSIZE ||
+            (S_ISDIR(mode) && ocfs2_supports_inline_data(osb)) ||
             (s_size + a_size) > OCFS2_XATTR_FREE_IN_IBODY) {
                 ret = ocfs2_reserve_new_metadata_blocks(osb, 1, xattr_ac);
                 if (ret) {
@@ -4791,19 +4795,33 @@ static int ocfs2_xattr_bucket_set_value_outside(struct inode *inode,
                                                 char *val,
                                                 int value_len)
 {
-        int offset;
+        int ret, offset, block_off;
         struct ocfs2_xattr_value_root *xv;
         struct ocfs2_xattr_entry *xe = xs->here;
+        struct ocfs2_xattr_header *xh = bucket_xh(xs->bucket);
+        void *base;
 
         BUG_ON(!xs->base || !xe || ocfs2_xattr_is_local(xe));
 
-        offset = le16_to_cpu(xe->xe_name_offset) +
-                 OCFS2_XATTR_SIZE(xe->xe_name_len);
+        ret = ocfs2_xattr_bucket_get_name_value(inode, xh,
+                                                xe - xh->xh_entries,
+                                                &block_off,
+                                                &offset);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
 
-        xv = (struct ocfs2_xattr_value_root *)(xs->base + offset);
+        base = bucket_block(xs->bucket, block_off);
+        xv = (struct ocfs2_xattr_value_root *)(base + offset +
+                 OCFS2_XATTR_SIZE(xe->xe_name_len));
 
-        return __ocfs2_xattr_set_value_outside(inode, handle,
-                                               xv, val, value_len);
+        ret = __ocfs2_xattr_set_value_outside(inode, handle,
+                                              xv, val, value_len);
+        if (ret)
+                mlog_errno(ret);
+out:
+        return ret;
 }
 
 static int ocfs2_rm_xattr_cluster(struct inode *inode,
diff --git a/fs/pipe.c b/fs/pipe.c
index 3a48ba5179d5..14f502b89cf5 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -699,12 +699,12 @@ pipe_rdwr_fasync(int fd, struct file *filp, int on)
         int retval;
 
         mutex_lock(&inode->i_mutex);
-
         retval = fasync_helper(fd, filp, on, &pipe->fasync_readers);
-
-        if (retval >= 0)
+        if (retval >= 0) {
                 retval = fasync_helper(fd, filp, on, &pipe->fasync_writers);
-
+                if (retval < 0) /* this can happen only if on == T */
+                        fasync_helper(-1, filp, 0, &pipe->fasync_readers);
+        }
         mutex_unlock(&inode->i_mutex);
 
         if (retval < 0)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 0c9de19a1633..beaa0ce3b82e 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -3066,7 +3066,6 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
         int retval = -ENOENT;
         ino_t ino;
         int tid;
-        unsigned long pos = filp->f_pos;  /* avoiding "long long" filp->f_pos */
         struct pid_namespace *ns;
 
         task = get_proc_task(inode);
@@ -3083,18 +3082,18 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
                 goto out_no_task;
         retval = 0;
 
-        switch (pos) {
+        switch ((unsigned long)filp->f_pos) {
         case 0:
                 ino = inode->i_ino;
-                if (filldir(dirent, ".", 1, pos, ino, DT_DIR) < 0)
+                if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) < 0)
                         goto out;
-                pos++;
+                filp->f_pos++;
                 /* fall through */
         case 1:
                 ino = parent_ino(dentry);
-                if (filldir(dirent, "..", 2, pos, ino, DT_DIR) < 0)
+                if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) < 0)
                         goto out;
-                pos++;
+                filp->f_pos++;
                 /* fall through */
         }
 
@@ -3104,9 +3103,9 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
         ns = filp->f_dentry->d_sb->s_fs_info;
         tid = (int)filp->f_version;
         filp->f_version = 0;
-        for (task = first_tid(leader, tid, pos - 2, ns);
+        for (task = first_tid(leader, tid, filp->f_pos - 2, ns);
              task;
-             task = next_tid(task), pos++) {
+             task = next_tid(task), filp->f_pos++) {
                 tid = task_pid_nr_ns(task, ns);
                 if (proc_task_fill_cache(filp, dirent, filldir, task, tid) < 0) {
                         /* returning this tgid failed, save it as the first
@@ -3117,7 +3116,6 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
                 }
         }
 out:
-        filp->f_pos = pos;
         put_task_struct(leader);
 out_no_task:
         return retval;
diff --git a/fs/proc/page.c b/fs/proc/page.c
index 2d1345112a42..e9983837d08d 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -80,7 +80,7 @@ static const struct file_operations proc_kpagecount_operations = {
 #define KPF_RECLAIM    9
 #define KPF_BUDDY     10
 
-#define kpf_copy_bit(flags, srcpos, dstpos) (((flags >> srcpos) & 1) << dstpos)
+#define kpf_copy_bit(flags, dstpos, srcpos) (((flags >> srcpos) & 1) << dstpos)
 
 static ssize_t kpageflags_read(struct file *file, char __user *buf,
                              size_t count, loff_t *ppos)
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index b9b567a28376..5d7c7ececa64 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -114,6 +114,9 @@ int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
                 if (!pagevec_add(&lru_pvec, page))
                         __pagevec_lru_add_file(&lru_pvec);
 
+                /* prevent the page from being discarded on memory pressure */
+                SetPageDirty(page);
+
                 unlock_page(page);
         }
 
@@ -126,6 +129,7 @@ int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
         return -EFBIG;
 
  add_error:
+        pagevec_lru_add_file(&lru_pvec);
         page_cache_release(pages + loop);
         for (loop++; loop < npages; loop++)
                 __free_page(pages + loop);
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 321728f48f2d..2a7960310349 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -184,15 +184,7 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                                 offset = 0;
                         }
 
-                        if (msblk->stream.avail_out == 0) {
-                                if (page == pages) {
-                                        ERROR("zlib_inflate tried to "
-                                                "decompress too much data, "
-                                                "expected %d bytes.  Zlib "
-                                                "data probably corrupt\n",
-                                                srclength);
-                                        goto release_mutex;
-                                }
+                        if (msblk->stream.avail_out == 0 && page < pages) {
                                 msblk->stream.next_out = buffer[page++];
                                 msblk->stream.avail_out = PAGE_CACHE_SIZE;
                         }
@@ -209,25 +201,20 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                                 zlib_init = 1;
                         }
 
-                        zlib_err = zlib_inflate(&msblk->stream, Z_NO_FLUSH);
+                        zlib_err = zlib_inflate(&msblk->stream, Z_SYNC_FLUSH);
 
                         if (msblk->stream.avail_in == 0 && k < b)
                                 put_bh(bh[k++]);
                 } while (zlib_err == Z_OK);
 
                 if (zlib_err != Z_STREAM_END) {
-                        ERROR("zlib_inflate returned unexpected result"
-                                " 0x%x, srclength %d, avail_in %d,"
-                                " avail_out %d\n", zlib_err, srclength,
-                                msblk->stream.avail_in,
-                                msblk->stream.avail_out);
+                        ERROR("zlib_inflate error, data probably corrupt\n");
                         goto release_mutex;
                 }
 
                 zlib_err = zlib_inflateEnd(&msblk->stream);
                 if (zlib_err != Z_OK) {
-                        ERROR("zlib_inflateEnd returned unexpected result 0x%x,"
-                                " srclength %d\n", zlib_err, srclength);
+                        ERROR("zlib_inflate error, data probably corrupt\n");
                         goto release_mutex;
                 }
                 length = msblk->stream.total_out;
diff --git a/fs/super.c b/fs/super.c
index 8349ed6b1412..6ce501447ada 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -371,8 +371,10 @@ retry:
                                 continue;
                         if (!grab_super(old))
                                 goto retry;
-                        if (s)
+                        if (s) {
+                                up_write(&s->s_umount);
                                 destroy_super(s);
+                        }
                         return old;
                 }
         }
@@ -387,6 +389,7 @@ retry:
         err = set(s, data);
         if (err) {
                 spin_unlock(&sb_lock);
+                up_write(&s->s_umount);
                 destroy_super(s);
                 return ERR_PTR(err);
         }
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index cb329edc925b..aa1016bb9134 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -34,6 +34,12 @@
 #include <linux/backing-dev.h>
 #include <linux/freezer.h>
 
+#include "xfs_sb.h"
+#include "xfs_inum.h"
+#include "xfs_ag.h"
+#include "xfs_dmapi.h"
+#include "xfs_mount.h"
+
 static kmem_zone_t *xfs_buf_zone;
 STATIC int xfsbufd(void *);
 STATIC int xfsbufd_wakeup(int, gfp_t);
@@ -1435,10 +1441,12 @@ xfs_unregister_buftarg(
 
 void
 xfs_free_buftarg(
-        xfs_buftarg_t           *btp)
+        struct xfs_mount        *mp,
+        struct xfs_buftarg      *btp)
 {
         xfs_flush_buftarg(btp, 1);
-        xfs_blkdev_issue_flush(btp);
+        if (mp->m_flags & XFS_MOUNT_BARRIER)
+                xfs_blkdev_issue_flush(btp);
         xfs_free_bufhash(btp);
         iput(btp->bt_mapping->host);
 
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index 288ae7c4c800..9b4d666ad31f 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -413,7 +413,7 @@ static inline int XFS_bwrite(xfs_buf_t *bp)
  *      Handling of buftargs.
  */
 extern xfs_buftarg_t *xfs_alloc_buftarg(struct block_device *, int);
-extern void xfs_free_buftarg(xfs_buftarg_t *);
+extern void xfs_free_buftarg(struct xfs_mount *, struct xfs_buftarg *);
 extern void xfs_wait_buftarg(xfs_buftarg_t *);
 extern int xfs_setsize_buftarg(xfs_buftarg_t *, unsigned int, unsigned int);
 extern int xfs_flush_buftarg(xfs_buftarg_t *, int);
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index c71e226da7f5..32ae5028e96b 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -734,15 +734,15 @@ xfs_close_devices(
 {
         if (mp->m_logdev_targp && mp->m_logdev_targp != mp->m_ddev_targp) {
                 struct block_device *logdev = mp->m_logdev_targp->bt_bdev;
-                xfs_free_buftarg(mp->m_logdev_targp);
+                xfs_free_buftarg(mp, mp->m_logdev_targp);
                 xfs_blkdev_put(logdev);
         }
         if (mp->m_rtdev_targp) {
                 struct block_device *rtdev = mp->m_rtdev_targp->bt_bdev;
-                xfs_free_buftarg(mp->m_rtdev_targp);
+                xfs_free_buftarg(mp, mp->m_rtdev_targp);
                 xfs_blkdev_put(rtdev);
         }
-        xfs_free_buftarg(mp->m_ddev_targp);
+        xfs_free_buftarg(mp, mp->m_ddev_targp);
 }
 
 /*
@@ -811,9 +811,9 @@ xfs_open_devices(
 
  out_free_rtdev_targ:
         if (mp->m_rtdev_targp)
-                xfs_free_buftarg(mp->m_rtdev_targp);
+                xfs_free_buftarg(mp, mp->m_rtdev_targp);
  out_free_ddev_targ:
-        xfs_free_buftarg(mp->m_ddev_targp);
+        xfs_free_buftarg(mp, mp->m_ddev_targp);
  out_close_rtdev:
         if (rtdev)
                 xfs_blkdev_put(rtdev);
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index e2fb6210d4c5..478e587087fe 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -246,9 +246,6 @@ xfs_iget_cache_miss(
                 goto out_destroy;
         }
 
-        if (lock_flags)
-                xfs_ilock(ip, lock_flags);
-
         /*
          * Preload the radix tree so we can insert safely under the
          * write spinlock. Note that we cannot sleep inside the preload
@@ -256,7 +253,16 @@ xfs_iget_cache_miss(
          */
         if (radix_tree_preload(GFP_KERNEL)) {
                 error = EAGAIN;
-                goto out_unlock;
+                goto out_destroy;
+        }
+
+        /*
+         * Because the inode hasn't been added to the radix-tree yet it can't
+         * be found by another thread, so we can do the non-sleeping lock here.
+         */
+        if (lock_flags) {
+                if (!xfs_ilock_nowait(ip, lock_flags))
+                        BUG();
         }
 
         mask = ~(((XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_inodelog)) - 1);
@@ -284,7 +290,6 @@ xfs_iget_cache_miss(
 out_preload_end:
         write_unlock(&pag->pag_ici_lock);
         radix_tree_preload_end();
-out_unlock:
         if (lock_flags)
                 xfs_iunlock(ip, lock_flags);
 out_destroy:
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index b1047de2fffd..61af610d79b3 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1455,10 +1455,19 @@ xlog_recover_add_to_trans(
         item = item->ri_prev;
 
         if (item->ri_total == 0) {              /* first region to be added */
-                item->ri_total  = in_f->ilf_size;
-                ASSERT(item->ri_total <= XLOG_MAX_REGIONS_IN_ITEM);
-                item->ri_buf = kmem_zalloc((item->ri_total *
-                                            sizeof(xfs_log_iovec_t)), KM_SLEEP);
+                if (in_f->ilf_size == 0 ||
+                    in_f->ilf_size > XLOG_MAX_REGIONS_IN_ITEM) {
+                        xlog_warn(
+        "XFS: bad number of regions (%d) in inode log format",
+                                  in_f->ilf_size);
+                        ASSERT(0);
+                        return XFS_ERROR(EIO);
+                }
+
+                item->ri_total = in_f->ilf_size;
+                item->ri_buf =
+                        kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
+                                    KM_SLEEP);
         }
         ASSERT(item->ri_total > item->ri_cnt);
         /* Description region is ri_buf[0] */