89 files changed, 1680 insertions, 925 deletions
diff --git a/fs/Makefile b/fs/Makefile
index 38bc735c67ad..dc20db348679 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -69,10 +69,12 @@ obj-$(CONFIG_DLM)		+= dlm/
 # Do not add any filesystems before this line
 obj-$(CONFIG_REISERFS_FS)       += reiserfs/
 obj-$(CONFIG_EXT3_FS)           += ext3/ # Before ext2 so root fs can be ext3
-obj-$(CONFIG_EXT4_FS)           += ext4/ # Before ext2 so root fs can be ext4
+obj-$(CONFIG_EXT2_FS)           += ext2/
+# We place ext4 after ext2 so plain ext2 root fs's are mounted using ext2
+# unless explicitly requested by rootfstype
+obj-$(CONFIG_EXT4_FS)           += ext4/
 obj-$(CONFIG_JBD)               += jbd/
 obj-$(CONFIG_JBD2)              += jbd2/
-obj-$(CONFIG_EXT2_FS)           += ext2/
 obj-$(CONFIG_CRAMFS)            += cramfs/
 obj-$(CONFIG_SQUASHFS)          += squashfs/
 obj-y                           += ramfs/
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index e3ff2b9e602f..33b7235f853b 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1208,9 +1208,11 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
         * check for an ELF header.  If we find one, dump the first page to
         * aid in determining what was mapped here.
         */
-        if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
+        if (FILTER(ELF_HEADERS) &&
+            vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
                u32 __user *header = (u32 __user *) vma->vm_start;
                u32 word;
+                mm_segment_t fs = get_fs();
                /*
                 * Doing it this way gets the constant folded by GCC.
                 */
@@ -1223,7 +1225,15 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
                magic.elfmag[EI_MAG1] = ELFMAG1;
                magic.elfmag[EI_MAG2] = ELFMAG2;
                magic.elfmag[EI_MAG3] = ELFMAG3;
-                if (get_user(word, header) == 0 && word == magic.cmp)
+                /*
+                 * Switch to the user "segment" for get_user(),
+                 * then put back what elf_core_dump() had in place.
+                 */
+                set_fs(USER_DS);
+                if (unlikely(get_user(word, header)))
+                        word = 0;
+                set_fs(fs);
+                if (word == magic.cmp)
                        return PAGE_SIZE;
        }
diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 77ebc3c263d6..549b0144da11 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -140,7 +140,6 @@ int bio_integrity_add_page(struct bio *bio, struct page *page,
        iv = bip_vec_idx(bip, bip->bip_vcnt);
        BUG_ON(iv == NULL);
-        BUG_ON(iv->bv_page != NULL);
        iv->bv_page = page;
        iv->bv_len = len;
@@ -465,7 +464,7 @@ static int bio_integrity_verify(struct bio *bio)
                if (ret) {
                        kunmap_atomic(kaddr, KM_USER0);
-                        break;
+                        return ret;
                }
                sectors = bv->bv_len / bi->sector_size;
@@ -493,18 +492,13 @@ static void bio_integrity_verify_fn(struct work_struct *work)
        struct bio_integrity_payload *bip =
                container_of(work, struct bio_integrity_payload, bip_work);
        struct bio *bio = bip->bip_bio;
-        int error = bip->bip_error;
+        int error;
-        if (bio_integrity_verify(bio)) {
+        error = bio_integrity_verify(bio);
-                clear_bit(BIO_UPTODATE, &bio->bi_flags);
-                error = -EIO;
-        }
        /* Restore original bio completion handler */
        bio->bi_end_io = bip->bip_end_io;
+        bio_endio(bio, error);
-        if (bio->bi_end_io)
-                bio->bi_end_io(bio, error);
 }
 /**
@@ -525,7 +519,17 @@ void bio_integrity_endio(struct bio *bio, int error)
        BUG_ON(bip->bip_bio != bio);
-        bip->bip_error = error;
+        /* In case of an I/O error there is no point in verifying the
+         * integrity metadata.  Restore original bio end_io handler
+         * and run it.
+         */
+        if (error) {
+                bio->bi_end_io = bip->bip_end_io;
+                bio_endio(bio, error);
+                return;
+        }
        INIT_WORK(&bip->bip_work, bio_integrity_verify_fn);
        queue_work(kintegrityd_wq, &bip->bip_work);
 }
diff --git a/fs/bio.c b/fs/bio.c
index 062299acbccd..124b95c4d582 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -302,9 +302,10 @@ void bio_init(struct bio *bio)
 struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs)
 {
        struct bio *bio = NULL;
+        void *uninitialized_var(p);
        if (bs) {
-                void *p = mempool_alloc(bs->bio_pool, gfp_mask);
+                p = mempool_alloc(bs->bio_pool, gfp_mask);
                if (p)
                        bio = p + bs->front_pad;
@@ -329,7 +330,7 @@ struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs)
                        }
                        if (unlikely(!bvl)) {
                                if (bs)
-                                        mempool_free(bio, bs->bio_pool);
+                                        mempool_free(p, bs->bio_pool);
                                else
                                        kfree(bio);
                                bio = NULL;
diff --git a/fs/buffer.c b/fs/buffer.c
index b58208f1640a..9f697419ed8e 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -777,6 +777,7 @@ static int __set_page_dirty(struct page *page,
                        __inc_zone_page_state(page, NR_FILE_DIRTY);
                        __inc_bdi_stat(mapping->backing_dev_info,
                                        BDI_RECLAIMABLE);
+                        task_dirty_inc(current);
                        task_io_account_write(PAGE_CACHE_SIZE);
                }
                radix_tree_tag_set(&mapping->page_tree,
@@ -2688,7 +2689,7 @@ int nobh_write_end(struct file *file, struct address_space *mapping,
        struct buffer_head *bh;
        BUG_ON(fsdata != NULL && page_has_buffers(page));
-        if (unlikely(copied < len) && !page_has_buffers(page))
+        if (unlikely(copied < len) && head)
                attach_nobh_buffers(page, head);
        if (page_has_buffers(page))
                return generic_write_end(file, mapping, pos, len,
@@ -3108,7 +3109,7 @@ int sync_dirty_buffer(struct buffer_head *bh)
        if (test_clear_buffer_dirty(bh)) {
                get_bh(bh);
                bh->b_end_io = end_buffer_write_sync;
-                ret = submit_bh(WRITE_SYNC, bh);
+                ret = submit_bh(WRITE, bh);
                wait_on_buffer(bh);
                if (buffer_eopnotsupp(bh)) {
                        clear_buffer_eopnotsupp(bh);
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 080703a15f44..851388fafc73 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,13 @@
+Version 1.57
+------------
+Improve support for multiple security contexts to the same server. We
+used to use the same "vcnumber" for all connections which could cause
+the server to treat subsequent connections, especially those that
+are authenticated as guest, as reconnections, invalidating the earlier
+user's smb session.  This fix allows cifs to mount multiple times to the
+same server with different userids without risking invalidating earlier
+established security contexts.
 Version 1.56
 ------------
 Add "forcemandatorylock" mount option to allow user to use mandatory
@@ -5,7 +15,12 @@ rather than posix (advisory) byte range locks, even though server would
 support posix byte range locks.  Fix query of root inode when prefixpath
 specified and user does not have access to query information about the
 top of the share.  Fix problem in 2.6.28 resolving DFS paths to
-Samba servers (worked to Windows).
+Samba servers (worked to Windows).  Fix rmdir so that pending search
+(readdir) requests do not get invalid results which include the now
+removed directory.  Fix oops in cifs_dfs_ref.c when prefixpath is not reachable
+when using DFS.  Add better file create support to servers which support
+the CIFS POSIX protocol extensions (this adds support for new flags
+on create, and improves semantics for write of locked ranges).
 Version 1.55
 ------------
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index d4839cf0cb2c..7c9809523f42 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -48,11 +48,11 @@ static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
        if ((cifs_pdu == NULL) || (signature == NULL) || (key == NULL))
                return -EINVAL;
-        MD5Init(&context);
+        cifs_MD5_init(&context);
-        MD5Update(&context, (char *)&key->data, key->len);
+        cifs_MD5_update(&context, (char *)&key->data, key->len);
-        MD5Update(&context, cifs_pdu->Protocol, cifs_pdu->smb_buf_length);
+        cifs_MD5_update(&context, cifs_pdu->Protocol, cifs_pdu->smb_buf_length);
-        MD5Final(signature, &context);
+        cifs_MD5_final(signature, &context);
        return 0;
 }
@@ -96,8 +96,8 @@ static int cifs_calc_signature2(const struct kvec *iov, int n_vec,
        if ((iov == NULL) || (signature == NULL) || (key == NULL))
                return -EINVAL;
-        MD5Init(&context);
+        cifs_MD5_init(&context);
-        MD5Update(&context, (char *)&key->data, key->len);
+        cifs_MD5_update(&context, (char *)&key->data, key->len);
        for (i = 0; i < n_vec; i++) {
                if (iov[i].iov_len == 0)
                        continue;
@@ -110,13 +110,13 @@ static int cifs_calc_signature2(const struct kvec *iov, int n_vec,
                if (i == 0) {
                        if (iov[0].iov_len <= 8) /* cmd field at offset 9 */
                                break; /* nothing to sign or corrupt header */
-                        MD5Update(&context, iov[0].iov_base+4,
+                        cifs_MD5_update(&context, iov[0].iov_base+4,
                                  iov[0].iov_len-4);
                } else
-                        MD5Update(&context, iov[i].iov_base, iov[i].iov_len);
+                        cifs_MD5_update(&context, iov[i].iov_base, iov[i].iov_len);
        }
-        MD5Final(signature, &context);
+        cifs_MD5_final(signature, &context);
        return 0;
 }
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 7ac481841f87..2b1d28a9ee28 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -100,5 +100,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* EXPERIMENTAL */
-#define CIFS_VERSION   "1.56"
+#define CIFS_VERSION   "1.57"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 94c1ca0ec953..e004f6db5fc8 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -164,9 +164,12 @@ struct TCP_Server_Info {
        /* multiplexed reads or writes */
        unsigned int maxBuf;    /* maxBuf specifies the maximum */
        /* message size the server can send or receive for non-raw SMBs */
-        unsigned int maxRw;     /* maxRw specifies the maximum */
+        unsigned int max_rw;    /* maxRw specifies the maximum */
        /* message size the server can send or receive for */
        /* SMB_COM_WRITE_RAW or SMB_COM_READ_RAW. */
+        unsigned int max_vcs;   /* maximum number of smb sessions, at least
+                                   those that can be specified uniquely with
+                                   vcnumbers */
        char sessid[4];         /* unique token id for this session */
        /* (returned on Negotiate */
        int capabilities; /* allow selective disabling of caps by smb sess */
@@ -210,6 +213,7 @@ struct cifsSesInfo {
        unsigned overrideSecFlg;  /* if non-zero override global sec flags */
        __u16 ipc_tid;          /* special tid for connection to IPC share */
        __u16 flags;
+        __u16 vcnum;
        char *serverOS;         /* name of operating system underlying server */
        char *serverNOS;        /* name of network operating system of server */
        char *serverDomain;     /* security realm of server */
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 06f6779988bf..083dfc57c7a3 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -35,13 +35,14 @@ extern struct smb_hdr *cifs_buf_get(void);
 extern void cifs_buf_release(void *);
 extern struct smb_hdr *cifs_small_buf_get(void);
 extern void cifs_small_buf_release(void *);
-extern int smb_send(struct socket *, struct smb_hdr *,
+extern int smb_send(struct TCP_Server_Info *, struct smb_hdr *,
-                        unsigned int /* length */ , struct sockaddr *, bool);
+                        unsigned int /* length */);
 extern unsigned int _GetXid(void);
 extern void _FreeXid(unsigned int);
 #define GetXid() (int)_GetXid(); cFYI(1,("CIFS VFS: in %s as Xid: %d with uid: %d",__func__, xid,current_fsuid()));
 #define FreeXid(curr_xid) {_FreeXid(curr_xid); cFYI(1,("CIFS VFS: leaving %s (xid = %d) rc = %d",__func__,curr_xid,(int)rc));}
 extern char *build_path_from_dentry(struct dentry *);
+extern char *cifs_build_path_to_root(struct cifs_sb_info *cifs_sb);
 extern char *build_wildcard_path_from_dentry(struct dentry *direntry);
 /* extern void renew_parental_timestamps(struct dentry *direntry);*/
 extern int SendReceive(const unsigned int /* xid */ , struct cifsSesInfo *,
@@ -91,6 +92,9 @@ extern u64 cifs_UnixTimeToNT(struct timespec);
 extern __le64 cnvrtDosCifsTm(__u16 date, __u16 time);
 extern struct timespec cnvrtDosUnixTm(__u16 date, __u16 time);
+extern void posix_fill_in_inode(struct inode *tmp_inode,
+                                FILE_UNIX_BASIC_INFO *pData, int isNewInode);
+extern struct inode *cifs_new_inode(struct super_block *sb, __u64 *inum);
 extern int cifs_get_inode_info(struct inode **pinode,
                        const unsigned char *search_path,
                        FILE_ALL_INFO *pfile_info,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 552642a507c4..939e2f76b959 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -528,14 +528,15 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                server->maxReq = le16_to_cpu(rsp->MaxMpxCount);
                server->maxBuf = min((__u32)le16_to_cpu(rsp->MaxBufSize),
                                (__u32)CIFSMaxBufSize + MAX_CIFS_HDR_SIZE);
+                server->max_vcs = le16_to_cpu(rsp->MaxNumberVcs);
                GETU32(server->sessid) = le32_to_cpu(rsp->SessionKey);
                /* even though we do not use raw we might as well set this
                accurately, in case we ever find a need for it */
                if ((le16_to_cpu(rsp->RawMode) & RAW_ENABLE) == RAW_ENABLE) {
-                        server->maxRw = 0xFF00;
+                        server->max_rw = 0xFF00;
                        server->capabilities = CAP_MPX_MODE | CAP_RAW_MODE;
                } else {
-                        server->maxRw = 0;/* we do not need to use raw anyway */
+                        server->max_rw = 0;/* do not need to use raw anyway */
                        server->capabilities = CAP_MPX_MODE;
                }
                tmp = (__s16)le16_to_cpu(rsp->ServerTimeZone);
@@ -638,7 +639,7 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
        /* probably no need to store and check maxvcs */
        server->maxBuf = min(le32_to_cpu(pSMBr->MaxBufferSize),
                        (__u32) CIFSMaxBufSize + MAX_CIFS_HDR_SIZE);
-        server->maxRw = le32_to_cpu(pSMBr->MaxRawSize);
+        server->max_rw = le32_to_cpu(pSMBr->MaxRawSize);
        cFYI(DBG2, ("Max buf = %d", ses->server->maxBuf));
        GETU32(ses->server->sessid) = le32_to_cpu(pSMBr->SessionKey);
        server->capabilities = le32_to_cpu(pSMBr->Capabilities);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index e9ea394ee075..da0f4ffa0613 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -23,7 +23,6 @@
 #include <linux/string.h>
 #include <linux/list.h>
 #include <linux/wait.h>
-#include <linux/ipv6.h>
 #include <linux/pagemap.h>
 #include <linux/ctype.h>
 #include <linux/utsname.h>
@@ -35,6 +34,7 @@
 #include <linux/freezer.h>
 #include <asm/uaccess.h>
 #include <asm/processor.h>
+#include <net/ipv6.h>
 #include "cifspdu.h"
 #include "cifsglob.h"
 #include "cifsproto.h"
@@ -1354,7 +1354,7 @@ cifs_parse_mount_options(char *options, const char *devname,
 }
 static struct TCP_Server_Info *
-cifs_find_tcp_session(struct sockaddr *addr)
+cifs_find_tcp_session(struct sockaddr_storage *addr)
 {
        struct list_head *tmp;
        struct TCP_Server_Info *server;
@@ -1374,13 +1374,13 @@ cifs_find_tcp_session(struct sockaddr *addr)
                if (server->tcpStatus == CifsNew)
                        continue;
-                if (addr->sa_family == AF_INET &&
+                if (addr->ss_family == AF_INET &&
                    (addr4->sin_addr.s_addr !=
                     server->addr.sockAddr.sin_addr.s_addr))
                        continue;
-                else if (addr->sa_family == AF_INET6 &&
+                else if (addr->ss_family == AF_INET6 &&
-                         memcmp(&server->addr.sockAddr6.sin6_addr,
+                         !ipv6_addr_equal(&server->addr.sockAddr6.sin6_addr,
-                                &addr6->sin6_addr, sizeof(addr6->sin6_addr)))
+                                          &addr6->sin6_addr))
                        continue;
                ++server->srv_count;
@@ -1419,12 +1419,12 @@ static struct TCP_Server_Info *
 cifs_get_tcp_session(struct smb_vol *volume_info)
 {
        struct TCP_Server_Info *tcp_ses = NULL;
-        struct sockaddr addr;
+        struct sockaddr_storage addr;
        struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
        struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
        int rc;
-        memset(&addr, 0, sizeof(struct sockaddr));
+        memset(&addr, 0, sizeof(struct sockaddr_storage));
        if (volume_info->UNCip && volume_info->UNC) {
                rc = cifs_inet_pton(AF_INET, volume_info->UNCip,
@@ -1435,9 +1435,9 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
                        rc = cifs_inet_pton(AF_INET6, volume_info->UNCip,
                                            &sin_server6->sin6_addr.in6_u);
                        if (rc > 0)
-                                addr.sa_family = AF_INET6;
+                                addr.ss_family = AF_INET6;
                } else {
-                        addr.sa_family = AF_INET;
+                        addr.ss_family = AF_INET;
                }
                if (rc <= 0) {
@@ -1502,7 +1502,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
        tcp_ses->tcpStatus = CifsNew;
        ++tcp_ses->srv_count;
-        if (addr.sa_family == AF_INET6) {
+        if (addr.ss_family == AF_INET6) {
                cFYI(1, ("attempting ipv6 connect"));
                /* BB should we allow ipv6 on port 139? */
                /* other OS never observed in Wild doing 139 with v6 */
@@ -1802,7 +1802,7 @@ ipv4_connect(struct TCP_Server_Info *server)
         *  user space buffer
         */
        socket->sk->sk_rcvtimeo = 7 * HZ;
-        socket->sk->sk_sndtimeo = 3 * HZ;
+        socket->sk->sk_sndtimeo = 5 * HZ;
        /* make the bufsizes depend on wsize/rsize and max requests */
        if (server->noautotune) {
@@ -1860,9 +1860,7 @@ ipv4_connect(struct TCP_Server_Info *server)
                        smb_buf = (struct smb_hdr *)ses_init_buf;
                        /* sizeof RFC1002_SESSION_REQUEST with no scope */
                        smb_buf->smb_buf_length = 0x81000044;
-                        rc = smb_send(socket, smb_buf, 0x44,
+                        rc = smb_send(server, smb_buf, 0x44);
-                                (struct sockaddr *) &server->addr.sockAddr,
-                                server->noblocksnd);
                        kfree(ses_init_buf);
                        msleep(1); /* RFC1001 layer in at least one server
                                      requires very short break before negprot
@@ -1955,7 +1953,7 @@ ipv6_connect(struct TCP_Server_Info *server)
         * user space buffer
         */
        socket->sk->sk_rcvtimeo = 7 * HZ;
-        socket->sk->sk_sndtimeo = 3 * HZ;
+        socket->sk->sk_sndtimeo = 5 * HZ;
        server->ssocket = socket;
        return rc;
@@ -2182,6 +2180,33 @@ static void setup_cifs_sb(struct smb_vol *pvolume_info,
                           "mount option supported"));
 }
+static int
+is_path_accessible(int xid, struct cifsTconInfo *tcon,
+                   struct cifs_sb_info *cifs_sb, const char *full_path)
+{
+        int rc;
+        __u64 inode_num;
+        FILE_ALL_INFO *pfile_info;
+        rc = CIFSGetSrvInodeNumber(xid, tcon, full_path, &inode_num,
+                                   cifs_sb->local_nls,
+                                   cifs_sb->mnt_cifs_flags &
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
+        if (rc != -EOPNOTSUPP)
+                return rc;
+        pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
+        if (pfile_info == NULL)
+                return -ENOMEM;
+        rc = CIFSSMBQPathInfo(xid, tcon, full_path, pfile_info,
+                              0 /* not legacy */, cifs_sb->local_nls,
+                              cifs_sb->mnt_cifs_flags &
+                                CIFS_MOUNT_MAP_SPECIAL_CHR);
+        kfree(pfile_info);
+        return rc;
+}
 int
 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
           char *mount_data, const char *devname)
@@ -2192,6 +2217,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
        struct cifsSesInfo *pSesInfo = NULL;
        struct cifsTconInfo *tcon = NULL;
        struct TCP_Server_Info *srvTcp = NULL;
+        char   *full_path;
        xid = GetXid();
@@ -2428,6 +2454,23 @@ mount_fail_check:
                cifs_sb->rsize = min(cifs_sb->rsize,
                               (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
+        if (!rc && cifs_sb->prepathlen) {
+                /* build_path_to_root works only when we have a valid tcon */
+                full_path = cifs_build_path_to_root(cifs_sb);
+                if (full_path == NULL) {
+                        rc = -ENOMEM;
+                        goto mount_fail_check;
+                }
+                rc = is_path_accessible(xid, tcon, cifs_sb, full_path);
+                if (rc) {
+                        cERROR(1, ("Path %s in not accessible: %d",
+                                                full_path, rc));
+                        kfree(full_path);
+                        goto mount_fail_check;
+                }
+                kfree(full_path);
+        }
        /* volume_info->password is freed above when existing session found
        (in which case it is not needed anymore) but when new sesion is created
        the password ptr is put in the new session structure (in which case the
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 838d9c720a5c..89fb72832652 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -3,7 +3,7 @@
 *
 *   vfs operations that deal with dentries
 *
- *   Copyright (C) International Business Machines  Corp., 2002,2008
+ *   Copyright (C) International Business Machines  Corp., 2002,2009
 *   Author(s): Steve French (sfrench@us.ibm.com)
 *
 *   This library is free software; you can redistribute it and/or modify
@@ -129,6 +129,89 @@ cifs_bp_rename_retry:
        return full_path;
 }
+static int cifs_posix_open(char *full_path, struct inode **pinode,
+                    struct super_block *sb, int mode, int oflags,
+                    int *poplock, __u16 *pnetfid, int xid)
+{
+        int rc;
+        __u32 oplock;
+        FILE_UNIX_BASIC_INFO *presp_data;
+        __u32 posix_flags = 0;
+        struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
+        cFYI(1, ("posix open %s", full_path));
+        presp_data = kzalloc(sizeof(FILE_UNIX_BASIC_INFO), GFP_KERNEL);
+        if (presp_data == NULL)
+                return -ENOMEM;
+/* So far cifs posix extensions can only map the following flags.
+   There are other valid fmode oflags such as FMODE_LSEEK, FMODE_PREAD, but
+   so far we do not seem to need them, and we can treat them as local only */
+        if ((oflags & (FMODE_READ | FMODE_WRITE)) ==
+                (FMODE_READ | FMODE_WRITE))
+                posix_flags = SMB_O_RDWR;
+        else if (oflags & FMODE_READ)
+                posix_flags = SMB_O_RDONLY;
+        else if (oflags & FMODE_WRITE)
+                posix_flags = SMB_O_WRONLY;
+        if (oflags & O_CREAT)
+                posix_flags |= SMB_O_CREAT;
+        if (oflags & O_EXCL)
+                posix_flags |= SMB_O_EXCL;
+        if (oflags & O_TRUNC)
+                posix_flags |= SMB_O_TRUNC;
+        if (oflags & O_APPEND)
+                posix_flags |= SMB_O_APPEND;
+        if (oflags & O_SYNC)
+                posix_flags |= SMB_O_SYNC;
+        if (oflags & O_DIRECTORY)
+                posix_flags |= SMB_O_DIRECTORY;
+        if (oflags & O_NOFOLLOW)
+                posix_flags |= SMB_O_NOFOLLOW;
+        if (oflags & O_DIRECT)
+                posix_flags |= SMB_O_DIRECT;
+        rc = CIFSPOSIXCreate(xid, cifs_sb->tcon, posix_flags, mode,
+                        pnetfid, presp_data, &oplock, full_path,
+                        cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
+        if (rc)
+                goto posix_open_ret;
+        if (presp_data->Type == cpu_to_le32(-1))
+                goto posix_open_ret; /* open ok, caller does qpathinfo */
+        /* get new inode and set it up */
+        if (!pinode)
+                goto posix_open_ret; /* caller does not need info */
+        *pinode = cifs_new_inode(sb, &presp_data->UniqueId);
+        /* We do not need to close the file if new_inode fails since
+           the caller will retry qpathinfo as long as inode is null */
+        if (*pinode == NULL)
+                goto posix_open_ret;
+        posix_fill_in_inode(*pinode, presp_data, 1);
+posix_open_ret:
+        kfree(presp_data);
+        return rc;
+}
+static void setup_cifs_dentry(struct cifsTconInfo *tcon,
+                              struct dentry *direntry,
+                              struct inode *newinode)
+{
+        if (tcon->nocase)
+                direntry->d_op = &cifs_ci_dentry_ops;
+        else
+                direntry->d_op = &cifs_dentry_ops;
+        d_instantiate(direntry, newinode);
+}
 /* Inode operations in similar order to how they appear in Linux file fs.h */
 int
@@ -139,14 +222,21 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
        int xid;
        int create_options = CREATE_NOT_DIR;
        int oplock = 0;
+        int oflags;
+        /*
+         * BB below access is probably too much for mknod to request
+         *    but we have to do query and setpathinfo so requesting
+         *    less could fail (unless we want to request getatr and setatr
+         *    permissions (only).  At least for POSIX we do not have to
+         *    request so much.
+         */
        int desiredAccess = GENERIC_READ | GENERIC_WRITE;
        __u16 fileHandle;
        struct cifs_sb_info *cifs_sb;
-        struct cifsTconInfo *pTcon;
+        struct cifsTconInfo *tcon;
        char *full_path = NULL;
        FILE_ALL_INFO *buf = NULL;
        struct inode *newinode = NULL;
-        struct cifsFileInfo *pCifsFile = NULL;
        struct cifsInodeInfo *pCifsInode;
        int disposition = FILE_OVERWRITE_IF;
        bool write_only = false;
@@ -154,7 +244,7 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
        xid = GetXid();
        cifs_sb = CIFS_SB(inode->i_sb);
-        pTcon = cifs_sb->tcon;
+        tcon = cifs_sb->tcon;
        full_path = build_path_from_dentry(direntry);
        if (full_path == NULL) {
@@ -162,12 +252,44 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                return -ENOMEM;
        }
-        if (nd && (nd->flags & LOOKUP_OPEN)) {
+        mode &= ~current->fs->umask;
-                int oflags = nd->intent.open.flags;
+        if (oplockEnabled)
+                oplock = REQ_OPLOCK;
+        if (nd && (nd->flags & LOOKUP_OPEN))
+                oflags = nd->intent.open.flags;
+        else
+                oflags = FMODE_READ;
+        if (tcon->unix_ext && (tcon->ses->capabilities & CAP_UNIX) &&
+            (CIFS_UNIX_POSIX_PATH_OPS_CAP &
+                        le64_to_cpu(tcon->fsUnixInfo.Capability))) {
+                rc = cifs_posix_open(full_path, &newinode, inode->i_sb,
+                                     mode, oflags, &oplock, &fileHandle, xid);
+                /* EIO could indicate that (posix open) operation is not
+                   supported, despite what server claimed in capability
+                   negotation.  EREMOTE indicates DFS junction, which is not
+                   handled in posix open */
+                if ((rc == 0) && (newinode == NULL))
+                        goto cifs_create_get_file_info; /* query inode info */
+                else if (rc == 0) /* success, no need to query */
+                        goto cifs_create_set_dentry;
+                else if ((rc != -EIO) && (rc != -EREMOTE) &&
+                         (rc != -EOPNOTSUPP)) /* path not found or net err */
+                        goto cifs_create_out;
+                /* else fallthrough to retry, using older open call, this is
+                   case where server does not support this SMB level, and
+                   falsely claims capability (also get here for DFS case
+                   which should be rare for path not covered on files) */
+        }
+        if (nd && (nd->flags & LOOKUP_OPEN)) {
+                /* if the file is going to stay open, then we
+                   need to set the desired access properly */
                desiredAccess = 0;
                if (oflags & FMODE_READ)
-                        desiredAccess |= GENERIC_READ;
+                        desiredAccess |= GENERIC_READ; /* is this too little? */
                if (oflags & FMODE_WRITE) {
                        desiredAccess |= GENERIC_WRITE;
                        if (!(oflags & FMODE_READ))
@@ -186,8 +308,6 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
        /* BB add processing to set equivalent of mode - e.g. via CreateX with
           ACLs */
-        if (oplockEnabled)
-                oplock = REQ_OPLOCK;
        buf = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
        if (buf == NULL) {
@@ -196,17 +316,15 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                return -ENOMEM;
        }
-        mode &= ~current->fs->umask;
        /*
         * if we're not using unix extensions, see if we need to set
         * ATTR_READONLY on the create call
         */
-        if (!pTcon->unix_ext && (mode & S_IWUGO) == 0)
+        if (!tcon->unix_ext && (mode & S_IWUGO) == 0)
                create_options |= CREATE_OPTION_READONLY;
        if (cifs_sb->tcon->ses->capabilities & CAP_NT_SMBS)
-                rc = CIFSSMBOpen(xid, pTcon, full_path, disposition,
+                rc = CIFSSMBOpen(xid, tcon, full_path, disposition,
                         desiredAccess, create_options,
                         &fileHandle, &oplock, buf, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
@@ -215,128 +333,119 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
        if (rc == -EIO) {
                /* old server, retry the open legacy style */
-                rc = SMBLegacyOpen(xid, pTcon, full_path, disposition,
+                rc = SMBLegacyOpen(xid, tcon, full_path, disposition,
                        desiredAccess, create_options,
                        &fileHandle, &oplock, buf, cifs_sb->local_nls,
                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
        }
        if (rc) {
                cFYI(1, ("cifs_create returned 0x%x", rc));
-        } else {
+                goto cifs_create_out;
-                /* If Open reported that we actually created a file
+        }
-                then we now have to set the mode if possible */
-                if ((pTcon->unix_ext) && (oplock & CIFS_CREATE_ACTION)) {
+        /* If Open reported that we actually created a file
-                        struct cifs_unix_set_info_args args = {
+           then we now have to set the mode if possible */
+        if ((tcon->unix_ext) && (oplock & CIFS_CREATE_ACTION)) {
+                struct cifs_unix_set_info_args args = {
                                .mode   = mode,
                                .ctime  = NO_CHANGE_64,
                                .atime  = NO_CHANGE_64,
                                .mtime  = NO_CHANGE_64,
                                .device = 0,
-                        };
+                };
-                        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
-                                args.uid = (__u64) current_fsuid();
+                        args.uid = (__u64) current_fsuid();
-                                if (inode->i_mode & S_ISGID)
+                        if (inode->i_mode & S_ISGID)
-                                        args.gid = (__u64) inode->i_gid;
+                                args.gid = (__u64) inode->i_gid;
-                                else
+                        else
-                                        args.gid = (__u64) current_fsgid();
+                                args.gid = (__u64) current_fsgid();
-                        } else {
-                                args.uid = NO_CHANGE_64;
-                                args.gid = NO_CHANGE_64;
-                        }
-                        CIFSSMBUnixSetInfo(xid, pTcon, full_path, &args,
-                                cifs_sb->local_nls,
-                                cifs_sb->mnt_cifs_flags &
-                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
                } else {
-                        /* BB implement mode setting via Windows security
+                        args.uid = NO_CHANGE_64;
-                           descriptors e.g. */
+                        args.gid = NO_CHANGE_64;
-                        /* CIFSSMBWinSetPerms(xid,pTcon,path,mode,-1,-1,nls);*/
-                        /* Could set r/o dos attribute if mode & 0222 == 0 */
                }
+                CIFSSMBUnixSetInfo(xid, tcon, full_path, &args,
+                        cifs_sb->local_nls,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
+        } else {
+                /* BB implement mode setting via Windows security
+                   descriptors e.g. */
+                /* CIFSSMBWinSetPerms(xid,tcon,path,mode,-1,-1,nls);*/
-                /* server might mask mode so we have to query for it */
+                /* Could set r/o dos attribute if mode & 0222 == 0 */
-                if (pTcon->unix_ext)
+        }
-                        rc = cifs_get_inode_info_unix(&newinode, full_path,
-                                                 inode->i_sb, xid);
+cifs_create_get_file_info:
-                else {
+        /* server might mask mode so we have to query for it */
-                        rc = cifs_get_inode_info(&newinode, full_path,
+        if (tcon->unix_ext)
-                                                 buf, inode->i_sb, xid,
+                rc = cifs_get_inode_info_unix(&newinode, full_path,
-                                                 &fileHandle);
+                                              inode->i_sb, xid);
-                        if (newinode) {
+        else {
-                                if (cifs_sb->mnt_cifs_flags &
+                rc = cifs_get_inode_info(&newinode, full_path, buf,
-                                    CIFS_MOUNT_DYNPERM)
+                                         inode->i_sb, xid, &fileHandle);
-                                        newinode->i_mode = mode;
+                if (newinode) {
-                                if ((oplock & CIFS_CREATE_ACTION) &&
+                        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)
-                                    (cifs_sb->mnt_cifs_flags &
+                                newinode->i_mode = mode;
-                                     CIFS_MOUNT_SET_UID)) {
+                        if ((oplock & CIFS_CREATE_ACTION) &&
-                                        newinode->i_uid = current_fsuid();
+                            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)) {
-                                        if (inode->i_mode & S_ISGID)
+                                newinode->i_uid = current_fsuid();
-                                                newinode->i_gid =
+                                if (inode->i_mode & S_ISGID)
-                                                        inode->i_gid;
+                                        newinode->i_gid = inode->i_gid;
-                                        else
+                                else
-                                                newinode->i_gid =
+                                        newinode->i_gid = current_fsgid();
-                                                        current_fsgid();
-                                }
                        }
                }
+        }
-                if (rc != 0) {
+cifs_create_set_dentry:
-                        cFYI(1,
+        if (rc == 0)
-                             ("Create worked but get_inode_info failed rc = %d",
+                setup_cifs_dentry(tcon, direntry, newinode);
-                              rc));
+        else
-                } else {
+                cFYI(1, ("Create worked, get_inode_info failed rc = %d", rc));
-                        if (pTcon->nocase)
-                                direntry->d_op = &cifs_ci_dentry_ops;
+        /* nfsd case - nfs srv does not set nd */
-                        else
+        if ((nd == NULL) || (!(nd->flags & LOOKUP_OPEN))) {
-                                direntry->d_op = &cifs_dentry_ops;
+                /* mknod case - do not leave file open */
-                        d_instantiate(direntry, newinode);
+                CIFSSMBClose(xid, tcon, fileHandle);
-                }
+        } else if (newinode) {
-                if ((nd == NULL /* nfsd case - nfs srv does not set nd */) ||
+                struct cifsFileInfo *pCifsFile =
-                        (!(nd->flags & LOOKUP_OPEN))) {
+                        kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
-                        /* mknod case - do not leave file open */
-                        CIFSSMBClose(xid, pTcon, fileHandle);
+                if (pCifsFile == NULL)
-                } else if (newinode) {
+                        goto cifs_create_out;
-                        pCifsFile =
+                pCifsFile->netfid = fileHandle;
-                           kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
+                pCifsFile->pid = current->tgid;
+                pCifsFile->pInode = newinode;
-                        if (pCifsFile == NULL)
+                pCifsFile->invalidHandle = false;
-                                goto cifs_create_out;
+                pCifsFile->closePend     = false;
-                        pCifsFile->netfid = fileHandle;
+                init_MUTEX(&pCifsFile->fh_sem);
-                        pCifsFile->pid = current->tgid;
+                mutex_init(&pCifsFile->lock_mutex);
-                        pCifsFile->pInode = newinode;
+                INIT_LIST_HEAD(&pCifsFile->llist);
-                        pCifsFile->invalidHandle = false;
+                atomic_set(&pCifsFile->wrtPending, 0);
-                        pCifsFile->closePend     = false;
-                        init_MUTEX(&pCifsFile->fh_sem);
+                /* set the following in open now
-                        mutex_init(&pCifsFile->lock_mutex);
-                        INIT_LIST_HEAD(&pCifsFile->llist);
-                        atomic_set(&pCifsFile->wrtPending, 0);
-                        /* set the following in open now
                                pCifsFile->pfile = file; */
-                        write_lock(&GlobalSMBSeslock);
+                write_lock(&GlobalSMBSeslock);
-                        list_add(&pCifsFile->tlist, &pTcon->openFileList);
+                list_add(&pCifsFile->tlist, &tcon->openFileList);
-                        pCifsInode = CIFS_I(newinode);
+                pCifsInode = CIFS_I(newinode);
-                        if (pCifsInode) {
+                if (pCifsInode) {
-                                /* if readable file instance put first in list*/
+                        /* if readable file instance put first in list*/
-                                if (write_only) {
+                        if (write_only) {
-                                        list_add_tail(&pCifsFile->flist,
+                                list_add_tail(&pCifsFile->flist,
-                                                &pCifsInode->openFileList);
+                                              &pCifsInode->openFileList);
-                                } else {
+                        } else {
-                                        list_add(&pCifsFile->flist,
+                                list_add(&pCifsFile->flist,
-                                                &pCifsInode->openFileList);
+                                         &pCifsInode->openFileList);
-                                }
-                                if ((oplock & 0xF) == OPLOCK_EXCLUSIVE) {
-                                        pCifsInode->clientCanCacheAll = true;
-                                        pCifsInode->clientCanCacheRead = true;
-                                        cFYI(1, ("Exclusive Oplock inode %p",
-                                                newinode));
-                                } else if ((oplock & 0xF) == OPLOCK_READ)
-                                        pCifsInode->clientCanCacheRead = true;
                        }
-                        write_unlock(&GlobalSMBSeslock);
+                        if ((oplock & 0xF) == OPLOCK_EXCLUSIVE) {
+                                pCifsInode->clientCanCacheAll = true;
+                                pCifsInode->clientCanCacheRead = true;
+                                cFYI(1, ("Exclusive Oplock inode %p",
+                                        newinode));
+                        } else if ((oplock & 0xF) == OPLOCK_READ)
+                                pCifsInode->clientCanCacheRead = true;
                }
+                write_unlock(&GlobalSMBSeslock);
        }
 cifs_create_out:
        kfree(buf);
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 5ab9896fdcb2..4690a360c855 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -199,6 +199,49 @@ static void fill_fake_finddataunix(FILE_UNIX_BASIC_INFO *pfnd_dat,
        pfnd_dat->Gid = cpu_to_le64(pinode->i_gid);
 }
+/**
+ * cifs_new inode - create new inode, initialize, and hash it
+ * @sb - pointer to superblock
+ * @inum - if valid pointer and serverino is enabled, replace i_ino with val
+ *
+ * Create a new inode, initialize it for CIFS and hash it. Returns the new
+ * inode or NULL if one couldn't be allocated.
+ *
+ * If the share isn't mounted with "serverino" or inum is a NULL pointer then
+ * we'll just use the inode number assigned by new_inode(). Note that this can
+ * mean i_ino collisions since the i_ino assigned by new_inode is not
+ * guaranteed to be unique.
+ */
+struct inode *
+cifs_new_inode(struct super_block *sb, __u64 *inum)
+{
+        struct inode *inode;
+        inode = new_inode(sb);
+        if (inode == NULL)
+                return NULL;
+        /*
+         * BB: Is i_ino == 0 legal? Here, we assume that it is. If it isn't we
+         *     stop passing inum as ptr. Are there sanity checks we can use to
+         *     ensure that the server is really filling in that field? Also,
+         *     if serverino is disabled, perhaps we should be using iunique()?
+         */
+        if (inum && (CIFS_SB(sb)->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM))
+                inode->i_ino = (unsigned long) *inum;
+        /*
+         * must set this here instead of cifs_alloc_inode since VFS will
+         * clobber i_flags
+         */
+        if (sb->s_flags & MS_NOATIME)
+                inode->i_flags |= S_NOATIME | S_NOCMTIME;
+        insert_inode_hash(inode);
+        return inode;
+}
 int cifs_get_inode_info_unix(struct inode **pinode,
        const unsigned char *full_path, struct super_block *sb, int xid)
 {
@@ -233,22 +276,11 @@ int cifs_get_inode_info_unix(struct inode **pinode,
        /* get new inode */
        if (*pinode == NULL) {
-                *pinode = new_inode(sb);
+                *pinode = cifs_new_inode(sb, &find_data.UniqueId);
                if (*pinode == NULL) {
                        rc = -ENOMEM;
                        goto cgiiu_exit;
                }
-                /* Is an i_ino of zero legal? */
-                /* note ino incremented to unique num in new_inode */
-                /* Are there sanity checks we can use to ensure that
-                   the server is really filling in that field? */
-                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)
-                        (*pinode)->i_ino = (unsigned long)find_data.UniqueId;
-                if (sb->s_flags & MS_NOATIME)
-                        (*pinode)->i_flags |= S_NOATIME | S_NOCMTIME;
-                insert_inode_hash(*pinode);
        }
        inode = *pinode;
@@ -465,11 +497,9 @@ int cifs_get_inode_info(struct inode **pinode,
        /* get new inode */
        if (*pinode == NULL) {
-                *pinode = new_inode(sb);
+                __u64 inode_num;
-                if (*pinode == NULL) {
+                __u64 *pinum = &inode_num;
-                        rc = -ENOMEM;
-                        goto cgii_exit;
-                }
                /* Is an i_ino of zero legal? Can we use that to check
                   if the server supports returning inode numbers?  Are
                   there other sanity checks we can use to ensure that
@@ -486,22 +516,26 @@ int cifs_get_inode_info(struct inode **pinode,
                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
                        int rc1 = 0;
-                        __u64 inode_num;
                        rc1 = CIFSGetSrvInodeNumber(xid, pTcon,
-                                        full_path, &inode_num,
+                                        full_path, pinum,
                                        cifs_sb->local_nls,
                                        cifs_sb->mnt_cifs_flags &
                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                        if (rc1) {
                                cFYI(1, ("GetSrvInodeNum rc %d", rc1));
+                                pinum = NULL;
                                /* BB EOPNOSUPP disable SERVER_INUM? */
-                        } else /* do we need cast or hash to ino? */
+                        }
-                                (*pinode)->i_ino = inode_num;
+                } else {
-                } /* else ino incremented to unique num in new_inode*/
+                        pinum = NULL;
-                if (sb->s_flags & MS_NOATIME)
+                }
-                        (*pinode)->i_flags |= S_NOATIME | S_NOCMTIME;
-                insert_inode_hash(*pinode);
+                *pinode = cifs_new_inode(sb, pinum);
+                if (*pinode == NULL) {
+                        rc = -ENOMEM;
+                        goto cgii_exit;
+                }
        }
        inode = *pinode;
        cifsInfo = CIFS_I(inode);
@@ -621,7 +655,7 @@ static const struct inode_operations cifs_ipc_inode_ops = {
        .lookup = cifs_lookup,
 };
-static char *build_path_to_root(struct cifs_sb_info *cifs_sb)
+char *cifs_build_path_to_root(struct cifs_sb_info *cifs_sb)
 {
        int pplen = cifs_sb->prepathlen;
        int dfsplen;
@@ -678,7 +712,7 @@ struct inode *cifs_iget(struct super_block *sb, unsigned long ino)
                return inode;
        cifs_sb = CIFS_SB(inode->i_sb);
-        full_path = build_path_to_root(cifs_sb);
+        full_path = cifs_build_path_to_root(cifs_sb);
        if (full_path == NULL)
                return ERR_PTR(-ENOMEM);
@@ -1017,7 +1051,7 @@ out_reval:
        return rc;
 }
-static void posix_fill_in_inode(struct inode *tmp_inode,
+void posix_fill_in_inode(struct inode *tmp_inode,
        FILE_UNIX_BASIC_INFO *pData, int isNewInode)
 {
        struct cifsInodeInfo *cifsInfo = CIFS_I(tmp_inode);
@@ -1114,24 +1148,14 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                        else
                                direntry->d_op = &cifs_dentry_ops;
-                        newinode = new_inode(inode->i_sb);
+                        newinode = cifs_new_inode(inode->i_sb,
+                                                  &pInfo->UniqueId);
                        if (newinode == NULL) {
                                kfree(pInfo);
                                goto mkdir_get_info;
                        }
-                        /* Is an i_ino of zero legal? */
-                        /* Are there sanity checks we can use to ensure that
-                           the server is really filling in that field? */
-                        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
-                                newinode->i_ino =
-                                        (unsigned long)pInfo->UniqueId;
-                        } /* note ino incremented to unique num in new_inode */
-                        if (inode->i_sb->s_flags & MS_NOATIME)
-                                newinode->i_flags |= S_NOATIME | S_NOCMTIME;
                        newinode->i_nlink = 2;
-                        insert_inode_hash(newinode);
                        d_instantiate(direntry, newinode);
                        /* we already checked in POSIXCreate whether
@@ -1285,6 +1309,11 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
        cifsInode = CIFS_I(direntry->d_inode);
        cifsInode->time = 0;    /* force revalidate to go get info when
                                   needed */
+        cifsInode = CIFS_I(inode);
+        cifsInode->time = 0;    /* force revalidate to get parent dir info
+                                   since cached search results now invalid */
        direntry->d_inode->i_ctime = inode->i_ctime = inode->i_mtime =
                current_fs_time(inode->i_sb);
diff --git a/fs/cifs/md5.c b/fs/cifs/md5.c
index 462bbfefd4b6..98b66a54c319 100644
--- a/fs/cifs/md5.c
+++ b/fs/cifs/md5.c
@@ -10,8 +10,8 @@
 * with every copy.
 *
 * To compute the message digest of a chunk of bytes, declare an
- * MD5Context structure, pass it to MD5Init, call MD5Update as
+ * MD5Context structure, pass it to cifs_MD5_init, call cifs_MD5_update as
- * needed on buffers full of bytes, and then call MD5Final, which
+ * needed on buffers full of bytes, and then call cifs_MD5_final, which
 * will fill a supplied 16-byte array with the digest.
 */
@@ -45,7 +45,7 @@ byteReverse(unsigned char *buf, unsigned longs)
 * initialization constants.
 */
 void
-MD5Init(struct MD5Context *ctx)
+cifs_MD5_init(struct MD5Context *ctx)
 {
        ctx->buf[0] = 0x67452301;
        ctx->buf[1] = 0xefcdab89;
@@ -61,7 +61,7 @@ MD5Init(struct MD5Context *ctx)
 * of bytes.
 */
 void
-MD5Update(struct MD5Context *ctx, unsigned char const *buf, unsigned len)
+cifs_MD5_update(struct MD5Context *ctx, unsigned char const *buf, unsigned len)
 {
        register __u32 t;
@@ -110,7 +110,7 @@ MD5Update(struct MD5Context *ctx, unsigned char const *buf, unsigned len)
 * 1 0* (64-bit count of bits processed, MSB-first)
 */
 void
-MD5Final(unsigned char digest[16], struct MD5Context *ctx)
+cifs_MD5_final(unsigned char digest[16], struct MD5Context *ctx)
 {
        unsigned int count;
        unsigned char *p;
@@ -165,7 +165,7 @@ MD5Final(unsigned char digest[16], struct MD5Context *ctx)
 /*
 * The core of the MD5 algorithm, this alters an existing MD5 hash to
- * reflect the addition of 16 longwords of new data.  MD5Update blocks
+ * reflect the addition of 16 longwords of new data.  cifs_MD5_update blocks
 * the data and converts bytes into longwords for this routine.
 */
 static void
@@ -267,9 +267,9 @@ hmac_md5_init_rfc2104(unsigned char *key, int key_len,
                unsigned char tk[16];
                struct MD5Context tctx;
-                MD5Init(&tctx);
+                cifs_MD5_init(&tctx);
-                MD5Update(&tctx, key, key_len);
+                cifs_MD5_update(&tctx, key, key_len);
-                MD5Final(tk, &tctx);
+                cifs_MD5_final(tk, &tctx);
                key = tk;
                key_len = 16;
@@ -287,8 +287,8 @@ hmac_md5_init_rfc2104(unsigned char *key, int key_len,
                ctx->k_opad[i] ^= 0x5c;
        }
-        MD5Init(&ctx->ctx);
+        cifs_MD5_init(&ctx->ctx);
-        MD5Update(&ctx->ctx, ctx->k_ipad, 64);
+        cifs_MD5_update(&ctx->ctx, ctx->k_ipad, 64);
 }
 #endif
@@ -317,8 +317,8 @@ hmac_md5_init_limK_to_64(const unsigned char *key, int key_len,
                ctx->k_opad[i] ^= 0x5c;
        }
-        MD5Init(&ctx->ctx);
+        cifs_MD5_init(&ctx->ctx);
-        MD5Update(&ctx->ctx, ctx->k_ipad, 64);
+        cifs_MD5_update(&ctx->ctx, ctx->k_ipad, 64);
 }
 /***********************************************************************
@@ -328,7 +328,7 @@ void
 hmac_md5_update(const unsigned char *text, int text_len,
                struct HMACMD5Context *ctx)
 {
-        MD5Update(&ctx->ctx, text, text_len);   /* then text of datagram */
+        cifs_MD5_update(&ctx->ctx, text, text_len);     /* then text of datagram */
 }
 /***********************************************************************
@@ -339,12 +339,12 @@ hmac_md5_final(unsigned char *digest, struct HMACMD5Context *ctx)
 {
        struct MD5Context ctx_o;
-        MD5Final(digest, &ctx->ctx);
+        cifs_MD5_final(digest, &ctx->ctx);
-        MD5Init(&ctx_o);
+        cifs_MD5_init(&ctx_o);
-        MD5Update(&ctx_o, ctx->k_opad, 64);
+        cifs_MD5_update(&ctx_o, ctx->k_opad, 64);
-        MD5Update(&ctx_o, digest, 16);
+        cifs_MD5_update(&ctx_o, digest, 16);
-        MD5Final(digest, &ctx_o);
+        cifs_MD5_final(digest, &ctx_o);
 }
 /***********************************************************
diff --git a/fs/cifs/md5.h b/fs/cifs/md5.h
index f7d4f4197bac..6fba8cb402fd 100644
--- a/fs/cifs/md5.h
+++ b/fs/cifs/md5.h
@@ -20,10 +20,10 @@ struct HMACMD5Context {
 };
 #endif                          /* _HMAC_MD5_H */
-void MD5Init(struct MD5Context *context);
+void cifs_MD5_init(struct MD5Context *context);
-void MD5Update(struct MD5Context *context, unsigned char const *buf,
+void cifs_MD5_update(struct MD5Context *context, unsigned char const *buf,
                        unsigned len);
-void MD5Final(unsigned char digest[16], struct MD5Context *context);
+void cifs_MD5_final(unsigned char digest[16], struct MD5Context *context);
 /* The following definitions come from lib/hmacmd5.c  */
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 9f51f9bf0292..c2c01ff4c32c 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -56,35 +56,34 @@ static inline void dump_cifs_file_struct(struct file *file, char *label)
 }
 #endif /* DEBUG2 */
-/* Returns one if new inode created (which therefore needs to be hashed) */
+/* Returns 1 if new inode created, 2 if both dentry and inode were */
 /* Might check in the future if inode number changed so we can rehash inode */
-static int construct_dentry(struct qstr *qstring, struct file *file,
+static int
-        struct inode **ptmp_inode, struct dentry **pnew_dentry)
+construct_dentry(struct qstr *qstring, struct file *file,
+                 struct inode **ptmp_inode, struct dentry **pnew_dentry,
+                 __u64 *inum)
 {
-        struct dentry *tmp_dentry;
+        struct dentry *tmp_dentry = NULL;
-        struct cifs_sb_info *cifs_sb;
+        struct super_block *sb = file->f_path.dentry->d_sb;
-        struct cifsTconInfo *pTcon;
        int rc = 0;
        cFYI(1, ("For %s", qstring->name));
-        cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
-        pTcon = cifs_sb->tcon;
        qstring->hash = full_name_hash(qstring->name, qstring->len);
        tmp_dentry = d_lookup(file->f_path.dentry, qstring);
        if (tmp_dentry) {
+                /* BB: overwrite old name? i.e. tmp_dentry->d_name and
+                 * tmp_dentry->d_name.len??
+                 */
                cFYI(0, ("existing dentry with inode 0x%p",
                         tmp_dentry->d_inode));
                *ptmp_inode = tmp_dentry->d_inode;
-/* BB overwrite old name? i.e. tmp_dentry->d_name and tmp_dentry->d_name.len??*/
                if (*ptmp_inode == NULL) {
-                        *ptmp_inode = new_inode(file->f_path.dentry->d_sb);
+                        *ptmp_inode = cifs_new_inode(sb, inum);
                        if (*ptmp_inode == NULL)
                                return rc;
                        rc = 1;
                }
-                if (file->f_path.dentry->d_sb->s_flags & MS_NOATIME)
-                        (*ptmp_inode)->i_flags |= S_NOATIME | S_NOCMTIME;
        } else {
                tmp_dentry = d_alloc(file->f_path.dentry, qstring);
                if (tmp_dentry == NULL) {
@@ -93,15 +92,14 @@ static int construct_dentry(struct qstr *qstring, struct file *file,
                        return rc;
                }
-                *ptmp_inode = new_inode(file->f_path.dentry->d_sb);
+                if (CIFS_SB(sb)->tcon->nocase)
-                if (pTcon->nocase)
                        tmp_dentry->d_op = &cifs_ci_dentry_ops;
                else
                        tmp_dentry->d_op = &cifs_dentry_ops;
+                *ptmp_inode = cifs_new_inode(sb, inum);
                if (*ptmp_inode == NULL)
                        return rc;
-                if (file->f_path.dentry->d_sb->s_flags & MS_NOATIME)
-                        (*ptmp_inode)->i_flags |= S_NOATIME | S_NOCMTIME;
                rc = 2;
        }
@@ -822,7 +820,7 @@ static int find_cifs_entry(const int xid, struct cifsTconInfo *pTcon,
 /* inode num, inode type and filename returned */
 static int cifs_get_name_from_search_buf(struct qstr *pqst,
        char *current_entry, __u16 level, unsigned int unicode,
-        struct cifs_sb_info *cifs_sb, int max_len, ino_t *pinum)
+        struct cifs_sb_info *cifs_sb, int max_len, __u64 *pinum)
 {
        int rc = 0;
        unsigned int len = 0;
@@ -842,9 +840,7 @@ static int cifs_get_name_from_search_buf(struct qstr *pqst,
                        len = strnlen(filename, PATH_MAX);
                }
-                /* BB fixme - hash low and high 32 bits if not 64 bit arch BB */
+                *pinum = pFindData->UniqueId;
-                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)
-                        *pinum = pFindData->UniqueId;
        } else if (level == SMB_FIND_FILE_DIRECTORY_INFO) {
                FILE_DIRECTORY_INFO *pFindData =
                        (FILE_DIRECTORY_INFO *)current_entry;
@@ -907,7 +903,7 @@ static int cifs_filldir(char *pfindEntry, struct file *file,
        struct qstr qstring;
        struct cifsFileInfo *pCifsF;
        unsigned int obj_type;
-        ino_t  inum;
+        __u64  inum;
        struct cifs_sb_info *cifs_sb;
        struct inode *tmp_inode;
        struct dentry *tmp_dentry;
@@ -940,20 +936,18 @@ static int cifs_filldir(char *pfindEntry, struct file *file,
        if (rc)
                return rc;
-        rc = construct_dentry(&qstring, file, &tmp_inode, &tmp_dentry);
+        /* only these two infolevels return valid inode numbers */
+        if (pCifsF->srch_inf.info_level == SMB_FIND_FILE_UNIX ||
+            pCifsF->srch_inf.info_level == SMB_FIND_FILE_ID_FULL_DIR_INFO)
+                rc = construct_dentry(&qstring, file, &tmp_inode, &tmp_dentry,
+                                        &inum);
+        else
+                rc = construct_dentry(&qstring, file, &tmp_inode, &tmp_dentry,
+                                        NULL);
        if ((tmp_inode == NULL) || (tmp_dentry == NULL))
                return -ENOMEM;
-        if (rc) {
-                /* inode created, we need to hash it with right inode number */
-                if (inum != 0) {
-                        /* BB fixme - hash the 2 32 quantities bits together if
-                         *  necessary BB */
-                        tmp_inode->i_ino = inum;
-                }
-                insert_inode_hash(tmp_inode);
-        }
        /* we pass in rc below, indicating whether it is a new inode,
           so we can figure out whether to invalidate the inode cached
           data if the file has changed */
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 5f22de7b79a9..5c68b4282be9 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -34,15 +34,99 @@
 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
                         unsigned char *p24);
+/* Checks if this is the first smb session to be reconnected after
+   the socket has been reestablished (so we know whether to use vc 0).
+   Called while holding the cifs_tcp_ses_lock, so do not block */
+static bool is_first_ses_reconnect(struct cifsSesInfo *ses)
+{
+        struct list_head *tmp;
+        struct cifsSesInfo *tmp_ses;
+        list_for_each(tmp, &ses->server->smb_ses_list) {
+                tmp_ses = list_entry(tmp, struct cifsSesInfo,
+                                     smb_ses_list);
+                if (tmp_ses->need_reconnect == false)
+                        return false;
+        }
+        /* could not find a session that was already connected,
+           this must be the first one we are reconnecting */
+        return true;
+}
+/*
+ *      vc number 0 is treated specially by some servers, and should be the
+ *      first one we request.  After that we can use vcnumbers up to maxvcs,
+ *      one for each smb session (some Windows versions set maxvcs incorrectly
+ *      so maxvc=1 can be ignored).  If we have too many vcs, we can reuse
+ *      any vc but zero (some servers reset the connection on vcnum zero)
+ *
+ */
+static __le16 get_next_vcnum(struct cifsSesInfo *ses)
+{
+        __u16 vcnum = 0;
+        struct list_head *tmp;
+        struct cifsSesInfo *tmp_ses;
+        __u16 max_vcs = ses->server->max_vcs;
+        __u16 i;
+        int free_vc_found = 0;
+        /* Quoting the MS-SMB specification: "Windows-based SMB servers set this
+        field to one but do not enforce this limit, which allows an SMB client
+        to establish more virtual circuits than allowed by this value ... but
+        other server implementations can enforce this limit." */
+        if (max_vcs < 2)
+                max_vcs = 0xFFFF;
+        write_lock(&cifs_tcp_ses_lock);
+        if ((ses->need_reconnect) && is_first_ses_reconnect(ses))
+                        goto get_vc_num_exit;  /* vcnum will be zero */
+        for (i = ses->server->srv_count - 1; i < max_vcs; i++) {
+                if (i == 0) /* this is the only connection, use vc 0 */
+                        break;
+                free_vc_found = 1;
+                list_for_each(tmp, &ses->server->smb_ses_list) {
+                        tmp_ses = list_entry(tmp, struct cifsSesInfo,
+                                             smb_ses_list);
+                        if (tmp_ses->vcnum == i) {
+                                free_vc_found = 0;
+                                break; /* found duplicate, try next vcnum */
+                        }
+                }
+                if (free_vc_found)
+                        break; /* we found a vcnumber that will work - use it */
+        }
+        if (i == 0)
+                vcnum = 0; /* for most common case, ie if one smb session, use
+                              vc zero.  Also for case when no free vcnum, zero
+                              is safest to send (some clients only send zero) */
+        else if (free_vc_found == 0)
+                vcnum = 1;  /* we can not reuse vc=0 safely, since some servers
+                                reset all uids on that, but 1 is ok. */
+        else
+                vcnum = i;
+        ses->vcnum = vcnum;
+get_vc_num_exit:
+        write_unlock(&cifs_tcp_ses_lock);
+        return le16_to_cpu(vcnum);
+}
 static __u32 cifs_ssetup_hdr(struct cifsSesInfo *ses, SESSION_SETUP_ANDX *pSMB)
 {
        __u32 capabilities = 0;
        /* init fields common to all four types of SessSetup */
-        /* note that header is initialized to zero in header_assemble */
+        /* Note that offsets for first seven fields in req struct are same  */
+        /*      in CIFS Specs so does not matter which of 3 forms of struct */
+        /*      that we use in next few lines                               */
+        /* Note that header is initialized to zero in header_assemble */
        pSMB->req.AndXCommand = 0xFF;
        pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
        pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
+        pSMB->req.VcNumber = get_next_vcnum(ses);
        /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
@@ -71,7 +155,6 @@ static __u32 cifs_ssetup_hdr(struct cifsSesInfo *ses, SESSION_SETUP_ANDX *pSMB)
        if (ses->capabilities & CAP_UNIX)
                capabilities |= CAP_UNIX;
-        /* BB check whether to init vcnum BB */
        return capabilities;
 }
@@ -228,7 +311,7 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
        kfree(ses->serverOS);
        /* UTF-8 string will not grow more than four times as big as UCS-16 */
-        ses->serverOS = kzalloc(4 * len, GFP_KERNEL);
+        ses->serverOS = kzalloc((4 * len) + 2 /* trailing null */, GFP_KERNEL);
        if (ses->serverOS != NULL)
                cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len, nls_cp);
        data += 2 * (len + 1);
@@ -241,7 +324,7 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
                return rc;
        kfree(ses->serverNOS);
-        ses->serverNOS = kzalloc(4 * len, GFP_KERNEL); /* BB this is wrong length FIXME BB */
+        ses->serverNOS = kzalloc((4 * len) + 2 /* trailing null */, GFP_KERNEL);
        if (ses->serverNOS != NULL) {
                cifs_strfromUCS_le(ses->serverNOS, (__le16 *)data, len,
                                   nls_cp);
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 7ebe6599ed3a..0ad3e2d116a6 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -154,81 +154,8 @@ void DeleteTconOplockQEntries(struct cifsTconInfo *tcon)
        spin_unlock(&GlobalMid_Lock);
 }
-int
-smb_send(struct socket *ssocket, struct smb_hdr *smb_buffer,
-         unsigned int smb_buf_length, struct sockaddr *sin, bool noblocksnd)
-{
-        int rc = 0;
-        int i = 0;
-        struct msghdr smb_msg;
-        struct kvec iov;
-        unsigned len = smb_buf_length + 4;
-        if (ssocket == NULL)
-                return -ENOTSOCK; /* BB eventually add reconnect code here */
-        iov.iov_base = smb_buffer;
-        iov.iov_len = len;
-        smb_msg.msg_name = sin;
-        smb_msg.msg_namelen = sizeof(struct sockaddr);
-        smb_msg.msg_control = NULL;
-        smb_msg.msg_controllen = 0;
-        if (noblocksnd)
-                smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
-        else
-                smb_msg.msg_flags = MSG_NOSIGNAL;
-        /* smb header is converted in header_assemble. bcc and rest of SMB word
-           area, and byte area if necessary, is converted to littleendian in
-           cifssmb.c and RFC1001 len is converted to bigendian in smb_send
-           Flags2 is converted in SendReceive */
-        smb_buffer->smb_buf_length = cpu_to_be32(smb_buffer->smb_buf_length);
-        cFYI(1, ("Sending smb of length %d", smb_buf_length));
-        dump_smb(smb_buffer, len);
-        while (len > 0) {
-                rc = kernel_sendmsg(ssocket, &smb_msg, &iov, 1, len);
-                if ((rc == -ENOSPC) || (rc == -EAGAIN)) {
-                        i++;
-                /* smaller timeout here than send2 since smaller size */
-                /* Although it may not be required, this also is smaller
-                   oplock break time */
-                        if (i > 12) {
-                                cERROR(1,
-                                   ("sends on sock %p stuck for 7 seconds",
-                                    ssocket));
-                                rc = -EAGAIN;
-                                break;
-                        }
-                        msleep(1 << i);
-                        continue;
-                }
-                if (rc < 0)
-                        break;
-                else
-                        i = 0; /* reset i after each successful send */
-                iov.iov_base += rc;
-                iov.iov_len -= rc;
-                len -= rc;
-        }
-        if (rc < 0) {
-                cERROR(1, ("Error %d sending data on socket to server", rc));
-        } else {
-                rc = 0;
-        }
-        /* Don't want to modify the buffer as a
-           side effect of this call. */
-        smb_buffer->smb_buf_length = smb_buf_length;
-        return rc;
-}
 static int
-smb_send2(struct TCP_Server_Info *server, struct kvec *iov, int n_vec,
+smb_sendv(struct TCP_Server_Info *server, struct kvec *iov, int n_vec)
-          struct sockaddr *sin, bool noblocksnd)
 {
        int rc = 0;
        int i = 0;
@@ -243,11 +170,11 @@ smb_send2(struct TCP_Server_Info *server, struct kvec *iov, int n_vec,
        if (ssocket == NULL)
                return -ENOTSOCK; /* BB eventually add reconnect code here */
-        smb_msg.msg_name = sin;
+        smb_msg.msg_name = (struct sockaddr *) &server->addr.sockAddr;
        smb_msg.msg_namelen = sizeof(struct sockaddr);
        smb_msg.msg_control = NULL;
        smb_msg.msg_controllen = 0;
-        if (noblocksnd)
+        if (server->noblocksnd)
                smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
        else
                smb_msg.msg_flags = MSG_NOSIGNAL;
@@ -272,7 +199,25 @@ smb_send2(struct TCP_Server_Info *server, struct kvec *iov, int n_vec,
                                    n_vec - first_vec, total_len);
                if ((rc == -ENOSPC) || (rc == -EAGAIN)) {
                        i++;
-                        if (i >= 14) {
+                        /* if blocking send we try 3 times, since each can block
+                           for 5 seconds. For nonblocking  we have to try more
+                           but wait increasing amounts of time allowing time for
+                           socket to clear.  The overall time we wait in either
+                           case to send on the socket is about 15 seconds.
+                           Similarly we wait for 15 seconds for
+                           a response from the server in SendReceive[2]
+                           for the server to send a response back for
+                           most types of requests (except SMB Write
+                           past end of file which can be slow, and
+                           blocking lock operations). NFS waits slightly longer
+                           than CIFS, but this can make it take longer for
+                           nonresponsive servers to be detected and 15 seconds
+                           is more than enough time for modern networks to
+                           send a packet.  In most cases if we fail to send
+                           after the retries we will kill the socket and
+                           reconnect which may clear the network problem.
+                        */
+                        if ((i >= 14) || (!server->noblocksnd && (i > 2))) {
                                cERROR(1,
                                   ("sends on sock %p stuck for 15 seconds",
                                    ssocket));
@@ -339,6 +284,18 @@ smb_send2(struct TCP_Server_Info *server, struct kvec *iov, int n_vec,
        return rc;
 }
+int
+smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer,
+         unsigned int smb_buf_length)
+{
+        struct kvec iov;
+        iov.iov_base = smb_buffer;
+        iov.iov_len = smb_buf_length + 4;
+        return smb_sendv(server, &iov, 1);
+}
 static int wait_for_free_request(struct cifsSesInfo *ses, const int long_op)
 {
        if (long_op == CIFS_ASYNC_OP) {
@@ -540,9 +497,7 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
 #ifdef CONFIG_CIFS_STATS2
        atomic_inc(&ses->server->inSend);
 #endif
-        rc = smb_send2(ses->server, iov, n_vec,
+        rc = smb_sendv(ses->server, iov, n_vec);
-                      (struct sockaddr *) &(ses->server->addr.sockAddr),
-                       ses->server->noblocksnd);
 #ifdef CONFIG_CIFS_STATS2
        atomic_dec(&ses->server->inSend);
        midQ->when_sent = jiffies;
@@ -736,9 +691,7 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
 #ifdef CONFIG_CIFS_STATS2
        atomic_inc(&ses->server->inSend);
 #endif
-        rc = smb_send(ses->server->ssocket, in_buf, in_buf->smb_buf_length,
+        rc = smb_send(ses->server, in_buf, in_buf->smb_buf_length);
-                      (struct sockaddr *) &(ses->server->addr.sockAddr),
-                      ses->server->noblocksnd);
 #ifdef CONFIG_CIFS_STATS2
        atomic_dec(&ses->server->inSend);
        midQ->when_sent = jiffies;
@@ -879,9 +832,7 @@ send_nt_cancel(struct cifsTconInfo *tcon, struct smb_hdr *in_buf,
                mutex_unlock(&ses->server->srv_mutex);
                return rc;
        }
-        rc = smb_send(ses->server->ssocket, in_buf, in_buf->smb_buf_length,
+        rc = smb_send(ses->server, in_buf, in_buf->smb_buf_length);
-              (struct sockaddr *) &(ses->server->addr.sockAddr),
-              ses->server->noblocksnd);
        mutex_unlock(&ses->server->srv_mutex);
        return rc;
 }
@@ -973,9 +924,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
 #ifdef CONFIG_CIFS_STATS2
        atomic_inc(&ses->server->inSend);
 #endif
-        rc = smb_send(ses->server->ssocket, in_buf, in_buf->smb_buf_length,
+        rc = smb_send(ses->server, in_buf, in_buf->smb_buf_length);
-                      (struct sockaddr *) &(ses->server->addr.sockAddr),
-                      ses->server->noblocksnd);
 #ifdef CONFIG_CIFS_STATS2
        atomic_dec(&ses->server->inSend);
        midQ->when_sent = jiffies;
diff --git a/fs/compat.c b/fs/compat.c
index 65a070e705ab..d0145ca27572 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1407,7 +1407,7 @@ int compat_do_execve(char * filename,
        bprm->cred = prepare_exec_creds();
        if (!bprm->cred)
                goto out_unlock;
-        check_unsafe_exec(bprm);
+        check_unsafe_exec(bprm, current->files);
        file = open_exec(filename);
        retval = PTR_ERR(file);
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 5235c67e7594..45e59d3c7f1f 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -538,6 +538,7 @@ static int dev_ifsioc(unsigned int fd, unsigned int cmd, unsigned long arg)
                 * cannot be fixed without breaking all existing apps.
                 */
                case TUNSETIFF:
+                case TUNGETIFF:
                case SIOCGIFFLAGS:
                case SIOCGIFMETRIC:
                case SIOCGIFMTU:
@@ -784,7 +785,7 @@ static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
        if (copy_in_user(&sgio->status, &sgio32->status,
                         (4 * sizeof(unsigned char)) +
-                         (2 * sizeof(unsigned (short))) +
+                         (2 * sizeof(unsigned short)) +
                         (3 * sizeof(int))))
                return -EFAULT;
@@ -1912,6 +1913,9 @@ COMPATIBLE_IOCTL(FIONREAD)  /* This is also TIOCINQ */
 /* 0x00 */
 COMPATIBLE_IOCTL(FIBMAP)
 COMPATIBLE_IOCTL(FIGETBSZ)
+/* 'X' - originally XFS but some now in the VFS */
+COMPATIBLE_IOCTL(FIFREEZE)
+COMPATIBLE_IOCTL(FITHAW)
 /* RAID */
 COMPATIBLE_IOCTL(RAID_VERSION)
 COMPATIBLE_IOCTL(GET_ARRAY_INFO)
@@ -1937,6 +1941,8 @@ ULONG_IOCTL(SET_BITMAP_FILE)
 /* Big K */
 COMPATIBLE_IOCTL(PIO_FONT)
 COMPATIBLE_IOCTL(GIO_FONT)
+COMPATIBLE_IOCTL(PIO_CMAP)
+COMPATIBLE_IOCTL(GIO_CMAP)
 ULONG_IOCTL(KDSIGACCEPT)
 COMPATIBLE_IOCTL(KDGETKEYCODE)
 COMPATIBLE_IOCTL(KDSETKEYCODE)
@@ -1982,6 +1988,11 @@ COMPATIBLE_IOCTL(TUNSETNOCSUM)
 COMPATIBLE_IOCTL(TUNSETDEBUG)
 COMPATIBLE_IOCTL(TUNSETPERSIST)
 COMPATIBLE_IOCTL(TUNSETOWNER)
+COMPATIBLE_IOCTL(TUNSETLINK)
+COMPATIBLE_IOCTL(TUNSETGROUP)
+COMPATIBLE_IOCTL(TUNGETFEATURES)
+COMPATIBLE_IOCTL(TUNSETOFFLOAD)
+COMPATIBLE_IOCTL(TUNSETTXFILTER)
 /* Big V */
 COMPATIBLE_IOCTL(VT_SETMODE)
 COMPATIBLE_IOCTL(VT_GETMODE)
@@ -2573,6 +2584,7 @@ HANDLE_IOCTL(SIOCGIFPFLAGS, dev_ifsioc)
 HANDLE_IOCTL(SIOCGIFTXQLEN, dev_ifsioc)
 HANDLE_IOCTL(SIOCSIFTXQLEN, dev_ifsioc)
 HANDLE_IOCTL(TUNSETIFF, dev_ifsioc)
+HANDLE_IOCTL(TUNGETIFF, dev_ifsioc)
 HANDLE_IOCTL(SIOCETHTOOL, ethtool_ioctl)
 HANDLE_IOCTL(SIOCBONDENSLAVE, bond_ioctl)
 HANDLE_IOCTL(SIOCBONDRELEASE, bond_ioctl)
diff --git a/fs/dcache.c b/fs/dcache.c
index 937df0fb0da5..07e2d4a44bda 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1180,7 +1180,7 @@ struct dentry *d_obtain_alias(struct inode *inode)
        iput(inode);
        return res;
 }
-EXPORT_SYMBOL_GPL(d_obtain_alias);
+EXPORT_SYMBOL(d_obtain_alias);
 /**
 * d_splice_alias - splice a disconnected dentry into the tree if one exists
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index c01e043670e2..f6caeb1d1106 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1716,7 +1716,7 @@ static int ecryptfs_copy_filename(char **copied_name, size_t *copied_name_size,
 {
        int rc = 0;
-        (*copied_name) = kmalloc((name_size + 2), GFP_KERNEL);
+        (*copied_name) = kmalloc((name_size + 1), GFP_KERNEL);
        if (!(*copied_name)) {
                rc = -ENOMEM;
                goto out;
@@ -1726,7 +1726,7 @@ static int ecryptfs_copy_filename(char **copied_name, size_t *copied_name_size,
                                                 * in printing out the
                                                 * string in debug
                                                 * messages */
-        (*copied_name_size) = (name_size + 1);
+        (*copied_name_size) = name_size;
 out:
        return rc;
 }
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index ba2f9ec71192..011b9b8c90c6 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -234,8 +234,6 @@ struct ep_pqueue {
 /*
 * Configuration options available inside /proc/sys/fs/epoll/
 */
-/* Maximum number of epoll devices, per user */
-static int max_user_instances __read_mostly;
 /* Maximum number of epoll watched descriptors, per user */
 static int max_user_watches __read_mostly;
@@ -261,14 +259,6 @@ static int zero;
 ctl_table epoll_table[] = {
        {
-                .procname       = "max_user_instances",
-                .data           = &max_user_instances,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .extra1         = &zero,
-        },
-        {
                .procname       = "max_user_watches",
                .data           = &max_user_watches,
                .maxlen         = sizeof(int),
@@ -491,7 +481,6 @@ static void ep_free(struct eventpoll *ep)
        mutex_unlock(&epmutex);
        mutex_destroy(&ep->mtx);
-        atomic_dec(&ep->user->epoll_devs);
        free_uid(ep->user);
        kfree(ep);
 }
@@ -581,10 +570,6 @@ static int ep_alloc(struct eventpoll **pep)
        struct eventpoll *ep;
        user = get_current_user();
-        error = -EMFILE;
-        if (unlikely(atomic_read(&user->epoll_devs) >=
-                        max_user_instances))
-                goto free_uid;
        error = -ENOMEM;
        ep = kzalloc(sizeof(*ep), GFP_KERNEL);
        if (unlikely(!ep))
@@ -1141,7 +1126,6 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
                              flags & O_CLOEXEC);
        if (fd < 0)
                ep_free(ep);
-        atomic_inc(&ep->user->epoll_devs);
 error_return:
        DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d) = %d\n",
@@ -1366,8 +1350,10 @@ static int __init eventpoll_init(void)
        struct sysinfo si;
        si_meminfo(&si);
-        max_user_instances = 128;
+        /*
-        max_user_watches = (((si.totalram - si.totalhigh) / 32) << PAGE_SHIFT) /
+         * Allows top 4% of lomem to be allocated for epoll watches (per user).
+         */
+        max_user_watches = (((si.totalram - si.totalhigh) / 25) << PAGE_SHIFT) /
                EP_ITEM_COST;
        /* Initialize the structure used to perform safe poll wait head wake ups */
diff --git a/fs/exec.c b/fs/exec.c
index 0dd60a01f1b4..929b58004b7e 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1049,16 +1049,32 @@ EXPORT_SYMBOL(install_exec_creds);
 * - the caller must hold current->cred_exec_mutex to protect against
 *   PTRACE_ATTACH
 */
-void check_unsafe_exec(struct linux_binprm *bprm)
+void check_unsafe_exec(struct linux_binprm *bprm, struct files_struct *files)
 {
-        struct task_struct *p = current;
+        struct task_struct *p = current, *t;
+        unsigned long flags;
+        unsigned n_fs, n_files, n_sighand;
        bprm->unsafe = tracehook_unsafe_exec(p);
-        if (atomic_read(&p->fs->count) > 1 ||
+        n_fs = 1;
-            atomic_read(&p->files->count) > 1 ||
+        n_files = 1;
-            atomic_read(&p->sighand->count) > 1)
+        n_sighand = 1;
+        lock_task_sighand(p, &flags);
+        for (t = next_thread(p); t != p; t = next_thread(t)) {
+                if (t->fs == p->fs)
+                        n_fs++;
+                if (t->files == files)
+                        n_files++;
+                n_sighand++;
+        }
+        if (atomic_read(&p->fs->count) > n_fs ||
+            atomic_read(&p->files->count) > n_files ||
+            atomic_read(&p->sighand->count) > n_sighand)
                bprm->unsafe |= LSM_UNSAFE_SHARE;
+        unlock_task_sighand(p, &flags);
 }
 /* 
@@ -1273,7 +1289,7 @@ int do_execve(char * filename,
        bprm->cred = prepare_exec_creds();
        if (!bprm->cred)
                goto out_unlock;
-        check_unsafe_exec(bprm);
+        check_unsafe_exec(bprm, displaced);
        file = open_exec(filename);
        retval = PTR_ERR(file);
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index da8bdeaa2e6d..7c6e3606f0ec 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1185,9 +1185,12 @@ static int ext2_remount (struct super_block * sb, int * flags, char * data)
        es = sbi->s_es;
        if (((sbi->s_mount_opt & EXT2_MOUNT_XIP) !=
            (old_mount_opt & EXT2_MOUNT_XIP)) &&
-            invalidate_inodes(sb))
+            invalidate_inodes(sb)) {
-                ext2_warning(sb, __func__, "busy inodes while remounting "\
+                ext2_warning(sb, __func__, "refusing change of xip flag "
-                             "xip remain in cache (no functional problem)");
+                             "with busy inodes while remounting");
+                sbi->s_mount_opt &= ~EXT2_MOUNT_XIP;
+                sbi->s_mount_opt |= old_mount_opt & EXT2_MOUNT_XIP;
+        }
        if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY))
                return 0;
        if (*flags & MS_RDONLY) {
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 69a3d19ca9fd..4db4ffa1edad 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -1358,7 +1358,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        struct fake_dirent *fde;
        blocksize =  dir->i_sb->s_blocksize;
-        dxtrace(printk("Creating index\n"));
+        dxtrace(printk(KERN_DEBUG "Creating index: inode %lu\n", dir->i_ino));
        retval = ext3_journal_get_write_access(handle, bh);
        if (retval) {
                ext3_std_error(dir->i_sb, retval);
@@ -1367,6 +1367,19 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        }
        root = (struct dx_root *) bh->b_data;
+        /* The 0th block becomes the root, move the dirents out */
+        fde = &root->dotdot;
+        de = (struct ext3_dir_entry_2 *)((char *)fde +
+                        ext3_rec_len_from_disk(fde->rec_len));
+        if ((char *) de >= (((char *) root) + blocksize)) {
+                ext3_error(dir->i_sb, __func__,
+                           "invalid rec_len for '..' in inode %lu",
+                           dir->i_ino);
+                brelse(bh);
+                return -EIO;
+        }
+        len = ((char *) root) + blocksize - (char *) de;
        bh2 = ext3_append (handle, dir, &block, &retval);
        if (!(bh2)) {
                brelse(bh);
@@ -1375,11 +1388,6 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        EXT3_I(dir)->i_flags |= EXT3_INDEX_FL;
        data1 = bh2->b_data;
-        /* The 0th block becomes the root, move the dirents out */
-        fde = &root->dotdot;
-        de = (struct ext3_dir_entry_2 *)((char *)fde +
-                        ext3_rec_len_from_disk(fde->rec_len));
-        len = ((char *) root) + blocksize - (char *) de;
        memcpy (data1, de, len);
        de = (struct ext3_dir_entry_2 *) data1;
        top = data1 + len;
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index b70d90e08a3c..4a970411a458 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -2428,12 +2428,13 @@ static void ext3_write_super (struct super_block * sb)
 static int ext3_sync_fs(struct super_block *sb, int wait)
 {
-        sb->s_dirt = 0;
+        tid_t target;
-        if (wait)
-                ext3_force_commit(sb);
-        else
-                journal_start_commit(EXT3_SB(sb)->s_journal, NULL);
+        sb->s_dirt = 0;
+        if (journal_start_commit(EXT3_SB(sb)->s_journal, &target)) {
+                if (wait)
+                        log_wait_commit(EXT3_SB(sb)->s_journal, target);
+        }
        return 0;
 }
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 6bba06b09dd1..de9459b4cb94 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -609,7 +609,9 @@ int ext4_claim_free_blocks(struct ext4_sb_info *sbi,
 */
 int ext4_should_retry_alloc(struct super_block *sb, int *retries)
 {
-        if (!ext4_has_free_blocks(EXT4_SB(sb), 1) || (*retries)++ > 3)
+        if (!ext4_has_free_blocks(EXT4_SB(sb), 1) ||
+            (*retries)++ > 3 ||
+            !EXT4_SB(sb)->s_journal)
                return 0;
        jbd_debug(1, "%s: retrying operation after ENOSPC\n", sb->s_id);
@@ -684,15 +686,15 @@ ext4_fsblk_t ext4_count_free_blocks(struct super_block *sb)
                gdp = ext4_get_group_desc(sb, i, NULL);
                if (!gdp)
                        continue;
-                desc_count += le16_to_cpu(gdp->bg_free_blocks_count);
+                desc_count += ext4_free_blks_count(sb, gdp);
                brelse(bitmap_bh);
                bitmap_bh = ext4_read_block_bitmap(sb, i);
                if (bitmap_bh == NULL)
                        continue;
                x = ext4_count_free(bitmap_bh, sb->s_blocksize);
-                printk(KERN_DEBUG "group %lu: stored = %d, counted = %u\n",
+                printk(KERN_DEBUG "group %u: stored = %d, counted = %u\n",
-                        i, le16_to_cpu(gdp->bg_free_blocks_count), x);
+                        i, ext4_free_blks_count(sb, gdp), x);
                bitmap_count += x;
        }
        brelse(bitmap_bh);
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index c668e4377d76..b0c87dce66a3 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -868,7 +868,7 @@ static inline unsigned ext4_rec_len_from_disk(__le16 dlen)
 {
        unsigned len = le16_to_cpu(dlen);
-        if (len == EXT4_MAX_REC_LEN)
+        if (len == EXT4_MAX_REC_LEN || len == 0)
                return 1 << 16;
        return len;
 }
@@ -1206,8 +1206,11 @@ static inline void ext4_r_blocks_count_set(struct ext4_super_block *es,
 static inline loff_t ext4_isize(struct ext4_inode *raw_inode)
 {
-        return ((loff_t)le32_to_cpu(raw_inode->i_size_high) << 32) |
+        if (S_ISREG(le16_to_cpu(raw_inode->i_mode)))
-                le32_to_cpu(raw_inode->i_size_lo);
+                return ((loff_t)le32_to_cpu(raw_inode->i_size_high) << 32) |
+                        le32_to_cpu(raw_inode->i_size_lo);
+        else
+                return (loff_t) le32_to_cpu(raw_inode->i_size_lo);
 }
 static inline void ext4_isize_set(struct ext4_inode *raw_inode, loff_t i_size)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 54bf0623a9ae..e2eab196875f 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3048,7 +3048,7 @@ retry:
                        WARN_ON(ret <= 0);
                        printk(KERN_ERR "%s: ext4_ext_get_blocks "
                                    "returned error inode#%lu, block=%u, "
-                                    "max_blocks=%lu", __func__,
+                                    "max_blocks=%u", __func__,
                                    inode->i_ino, block, max_blocks);
 #endif
                        ext4_mark_inode_dirty(handle, inode);
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 4fb86a0061d0..627f8c3337a3 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -188,7 +188,7 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
        struct ext4_group_desc *gdp;
        struct ext4_super_block *es;
        struct ext4_sb_info *sbi;
-        int fatal = 0, err, count;
+        int fatal = 0, err, count, cleared;
        ext4_group_t flex_group;
        if (atomic_read(&inode->i_count) > 1) {
@@ -248,8 +248,10 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
                goto error_return;
        /* Ok, now we can actually update the inode bitmaps.. */
-        if (!ext4_clear_bit_atomic(sb_bgl_lock(sbi, block_group),
+        spin_lock(sb_bgl_lock(sbi, block_group));
-                                        bit, bitmap_bh->b_data))
+        cleared = ext4_clear_bit(bit, bitmap_bh->b_data);
+        spin_unlock(sb_bgl_lock(sbi, block_group));
+        if (!cleared)
                ext4_error(sb, "ext4_free_inode",
                           "bit already cleared for inode %lu", ino);
        else {
@@ -715,6 +717,13 @@ struct inode *ext4_new_inode(handle_t *handle, struct inode *dir, int mode)
        if (sbi->s_log_groups_per_flex) {
                ret2 = find_group_flex(sb, dir, &group);
+                if (ret2 == -1) {
+                        ret2 = find_group_other(sb, dir, &group);
+                        if (ret2 == 0 && printk_ratelimit())
+                                printk(KERN_NOTICE "ext4: find_group_flex "
+                                       "failed, fallback succeeded dir %lu\n",
+                                       dir->i_ino);
+                }
                goto got_group;
        }
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index a6444cee0c7e..c7fed5b18745 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -47,8 +47,10 @@
 static inline int ext4_begin_ordered_truncate(struct inode *inode,
                                              loff_t new_size)
 {
-        return jbd2_journal_begin_ordered_truncate(&EXT4_I(inode)->jinode,
+        return jbd2_journal_begin_ordered_truncate(
-                                                   new_size);
+                                        EXT4_SB(inode->i_sb)->s_journal,
+                                        &EXT4_I(inode)->jinode,
+                                        new_size);
 }
 static void ext4_invalidatepage(struct page *page, unsigned long offset);
@@ -360,9 +362,9 @@ static int ext4_block_to_path(struct inode *inode,
                final = ptrs;
        } else {
                ext4_warning(inode->i_sb, "ext4_block_to_path",
-                                "block %lu > max",
+                                "block %lu > max in inode %lu",
                                i_block + direct_blocks +
-                                indirect_blocks + double_blocks);
+                                indirect_blocks + double_blocks, inode->i_ino);
        }
        if (boundary)
                *boundary = final - 1 - (i_block & (ptrs - 1));
@@ -1366,6 +1368,10 @@ retry:
                goto out;
        }
+        /* We cannot recurse into the filesystem as the transaction is already
+         * started */
+        flags |= AOP_FLAG_NOFS;
        page = grab_cache_page_write_begin(mapping, index, flags);
        if (!page) {
                ext4_journal_stop(handle);
@@ -1375,7 +1381,7 @@ retry:
        *pagep = page;
        ret = block_write_begin(file, mapping, pos, len, flags, pagep, fsdata,
-                                                        ext4_get_block);
+                                ext4_get_block);
        if (!ret && ext4_should_journal_data(inode)) {
                ret = walk_page_buffers(handle, page_buffers(page),
@@ -2437,6 +2443,7 @@ static int ext4_da_writepages(struct address_space *mapping,
        int no_nrwrite_index_update;
        int pages_written = 0;
        long pages_skipped;
+        int range_cyclic, cycled = 1, io_done = 0;
        int needed_blocks, ret = 0, nr_to_writebump = 0;
        struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb);
@@ -2488,9 +2495,15 @@ static int ext4_da_writepages(struct address_space *mapping,
        if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
                range_whole = 1;
-        if (wbc->range_cyclic)
+        range_cyclic = wbc->range_cyclic;
+        if (wbc->range_cyclic) {
                index = mapping->writeback_index;
-        else
+                if (index)
+                        cycled = 0;
+                wbc->range_start = index << PAGE_CACHE_SHIFT;
+                wbc->range_end  = LLONG_MAX;
+                wbc->range_cyclic = 0;
+        } else
                index = wbc->range_start >> PAGE_CACHE_SHIFT;
        mpd.wbc = wbc;
@@ -2504,6 +2517,7 @@ static int ext4_da_writepages(struct address_space *mapping,
        wbc->no_nrwrite_index_update = 1;
        pages_skipped = wbc->pages_skipped;
+retry:
        while (!ret && wbc->nr_to_write > 0) {
                /*
@@ -2530,7 +2544,7 @@ static int ext4_da_writepages(struct address_space *mapping,
                ext4_journal_stop(handle);
-                if (mpd.retval == -ENOSPC) {
+                if ((mpd.retval == -ENOSPC) && sbi->s_journal) {
                        /* commit the transaction which would
                         * free blocks released in the transaction
                         * and try again
@@ -2546,6 +2560,7 @@ static int ext4_da_writepages(struct address_space *mapping,
                        pages_written += mpd.pages_written;
                        wbc->pages_skipped = pages_skipped;
                        ret = 0;
+                        io_done = 1;
                } else if (wbc->nr_to_write)
                        /*
                         * There is no more writeout needed
@@ -2554,6 +2569,13 @@ static int ext4_da_writepages(struct address_space *mapping,
                         */
                        break;
        }
+        if (!io_done && !cycled) {
+                cycled = 1;
+                index = 0;
+                wbc->range_start = index << PAGE_CACHE_SHIFT;
+                wbc->range_end  = mapping->writeback_index - 1;
+                goto retry;
+        }
        if (pages_skipped != wbc->pages_skipped)
                printk(KERN_EMERG "This should not happen leaving %s "
                                "with nr_to_write = %ld ret = %d\n",
@@ -2561,6 +2583,7 @@ static int ext4_da_writepages(struct address_space *mapping,
        /* Update index */
        index += pages_written;
+        wbc->range_cyclic = range_cyclic;
        if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
                /*
                 * set the writeback_index so that range_cyclic
@@ -2648,6 +2671,9 @@ retry:
                ret = PTR_ERR(handle);
                goto out;
        }
+        /* We cannot recurse into the filesystem as the transaction is already
+         * started */
+        flags |= AOP_FLAG_NOFS;
        page = grab_cache_page_write_begin(mapping, index, flags);
        if (!page) {
@@ -2821,9 +2847,6 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
                filemap_write_and_wait(mapping);
        }
-        BUG_ON(!EXT4_JOURNAL(inode) &&
-               EXT4_I(inode)->i_state & EXT4_STATE_JDATA);
        if (EXT4_JOURNAL(inode) && EXT4_I(inode)->i_state & EXT4_STATE_JDATA) {
                /*
                 * This is a REALLY heavyweight approach, but the use of
@@ -3622,7 +3645,7 @@ static void ext4_free_data(handle_t *handle, struct inode *inode,
                 * block pointed to itself, it would have been detached when
                 * the block was cleared. Check for this instead of OOPSing.
                 */
-                if (bh2jh(this_bh))
+                if ((EXT4_JOURNAL(inode) == NULL) || bh2jh(this_bh))
                        ext4_handle_dirty_metadata(handle, inode, this_bh);
                else
                        ext4_error(inode->i_sb, __func__,
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 918aec0c8a11..4415beeb0b62 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3025,7 +3025,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
                goto out_err;
        ext4_debug("using block group %u(%d)\n", ac->ac_b_ex.fe_group,
-                        gdp->bg_free_blocks_count);
+                        ext4_free_blks_count(sb, gdp));
        err = ext4_journal_get_write_access(handle, gdp_bh);
        if (err)
@@ -3693,6 +3693,8 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
        pa->pa_free = pa->pa_len;
        atomic_set(&pa->pa_count, 1);
        spin_lock_init(&pa->pa_lock);
+        INIT_LIST_HEAD(&pa->pa_inode_list);
+        INIT_LIST_HEAD(&pa->pa_group_list);
        pa->pa_deleted = 0;
        pa->pa_linear = 0;
@@ -3755,6 +3757,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
        atomic_set(&pa->pa_count, 1);
        spin_lock_init(&pa->pa_lock);
        INIT_LIST_HEAD(&pa->pa_inode_list);
+        INIT_LIST_HEAD(&pa->pa_group_list);
        pa->pa_deleted = 0;
        pa->pa_linear = 1;
@@ -4476,23 +4479,26 @@ static int ext4_mb_release_context(struct ext4_allocation_context *ac)
                        pa->pa_free -= ac->ac_b_ex.fe_len;
                        pa->pa_len -= ac->ac_b_ex.fe_len;
                        spin_unlock(&pa->pa_lock);
-                        /*
-                         * We want to add the pa to the right bucket.
-                         * Remove it from the list and while adding
-                         * make sure the list to which we are adding
-                         * doesn't grow big.
-                         */
-                        if (likely(pa->pa_free)) {
-                                spin_lock(pa->pa_obj_lock);
-                                list_del_rcu(&pa->pa_inode_list);
-                                spin_unlock(pa->pa_obj_lock);
-                                ext4_mb_add_n_trim(ac);
-                        }
                }
-                ext4_mb_put_pa(ac, ac->ac_sb, pa);
        }
        if (ac->alloc_semp)
                up_read(ac->alloc_semp);
+        if (pa) {
+                /*
+                 * We want to add the pa to the right bucket.
+                 * Remove it from the list and while adding
+                 * make sure the list to which we are adding
+                 * doesn't grow big.  We need to release
+                 * alloc_semp before calling ext4_mb_add_n_trim()
+                 */
+                if (pa->pa_linear && likely(pa->pa_free)) {
+                        spin_lock(pa->pa_obj_lock);
+                        list_del_rcu(&pa->pa_inode_list);
+                        spin_unlock(pa->pa_obj_lock);
+                        ext4_mb_add_n_trim(ac);
+                }
+                ext4_mb_put_pa(ac, ac->ac_sb, pa);
+        }
        if (ac->ac_bitmap_page)
                page_cache_release(ac->ac_bitmap_page);
        if (ac->ac_buddy_page)
diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
index 734abca25e35..fe64d9f79852 100644
--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -481,7 +481,7 @@ int ext4_ext_migrate(struct inode *inode)
                                        + 1);
        if (IS_ERR(handle)) {
                retval = PTR_ERR(handle);
-                goto err_out;
+                return retval;
        }
        tmp_inode = ext4_new_inode(handle,
                                inode->i_sb->s_root->d_inode,
@@ -489,8 +489,7 @@ int ext4_ext_migrate(struct inode *inode)
        if (IS_ERR(tmp_inode)) {
                retval = -ENOMEM;
                ext4_journal_stop(handle);
-                tmp_inode = NULL;
+                return retval;
-                goto err_out;
        }
        i_size_write(tmp_inode, i_size_read(inode));
        /*
@@ -618,8 +617,7 @@ err_out:
        ext4_journal_stop(handle);
-        if (tmp_inode)
+        iput(tmp_inode);
-                iput(tmp_inode);
        return retval;
 }
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index fec0b4c2f5f1..ba702bd7910d 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1368,7 +1368,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        struct fake_dirent *fde;
        blocksize =  dir->i_sb->s_blocksize;
-        dxtrace(printk(KERN_DEBUG "Creating index\n"));
+        dxtrace(printk(KERN_DEBUG "Creating index: inode %lu\n", dir->i_ino));
        retval = ext4_journal_get_write_access(handle, bh);
        if (retval) {
                ext4_std_error(dir->i_sb, retval);
@@ -1377,6 +1377,20 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        }
        root = (struct dx_root *) bh->b_data;
+        /* The 0th block becomes the root, move the dirents out */
+        fde = &root->dotdot;
+        de = (struct ext4_dir_entry_2 *)((char *)fde +
+                ext4_rec_len_from_disk(fde->rec_len));
+        if ((char *) de >= (((char *) root) + blocksize)) {
+                ext4_error(dir->i_sb, __func__,
+                           "invalid rec_len for '..' in inode %lu",
+                           dir->i_ino);
+                brelse(bh);
+                return -EIO;
+        }
+        len = ((char *) root) + blocksize - (char *) de;
+        /* Allocate new block for the 0th block's dirents */
        bh2 = ext4_append(handle, dir, &block, &retval);
        if (!(bh2)) {
                brelse(bh);
@@ -1385,11 +1399,6 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        EXT4_I(dir)->i_flags |= EXT4_INDEX_FL;
        data1 = bh2->b_data;
-        /* The 0th block becomes the root, move the dirents out */
-        fde = &root->dotdot;
-        de = (struct ext4_dir_entry_2 *)((char *)fde +
-                ext4_rec_len_from_disk(fde->rec_len));
-        len = ((char *) root) + blocksize - (char *) de;
        memcpy (data1, de, len);
        de = (struct ext4_dir_entry_2 *) data1;
        top = data1 + len;
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index c328be5d6885..c06886abd658 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -861,12 +861,13 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
        gdp = (struct ext4_group_desc *)((char *)primary->b_data +
                                         gdb_off * EXT4_DESC_SIZE(sb));
+        memset(gdp, 0, EXT4_DESC_SIZE(sb));
        ext4_block_bitmap_set(sb, gdp, input->block_bitmap); /* LV FIXME */
        ext4_inode_bitmap_set(sb, gdp, input->inode_bitmap); /* LV FIXME */
        ext4_inode_table_set(sb, gdp, input->inode_table); /* LV FIXME */
        ext4_free_blks_set(sb, gdp, input->free_blocks_count);
        ext4_free_inodes_set(sb, gdp, EXT4_INODES_PER_GROUP(sb));
-        gdp->bg_flags |= cpu_to_le16(EXT4_BG_INODE_ZEROED);
+        gdp->bg_flags = cpu_to_le16(EXT4_BG_INODE_ZEROED);
        gdp->bg_checksum = ext4_group_desc_csum(sbi, input->group, gdp);
        /*
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index e5f06a5f045e..39d1993cfa13 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3046,14 +3046,17 @@ static void ext4_write_super(struct super_block *sb)
 static int ext4_sync_fs(struct super_block *sb, int wait)
 {
        int ret = 0;
+        tid_t target;
        trace_mark(ext4_sync_fs, "dev %s wait %d", sb->s_id, wait);
        sb->s_dirt = 0;
        if (EXT4_SB(sb)->s_journal) {
-                if (wait)
+                if (jbd2_journal_start_commit(EXT4_SB(sb)->s_journal,
-                        ret = ext4_force_commit(sb);
+                                              &target)) {
-                else
+                        if (wait)
-                        jbd2_journal_start_commit(EXT4_SB(sb)->s_journal, NULL);
+                                jbd2_log_wait_commit(EXT4_SB(sb)->s_journal,
+                                                     target);
+                }
        } else {
                ext4_commit_super(sb, EXT4_SB(sb)->s_es, wait);
        }
@@ -3088,7 +3091,6 @@ static int ext4_freeze(struct super_block *sb)
                /* Journal blocked and flushed, clear needs_recovery flag. */
                EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
-                ext4_commit_super(sb, EXT4_SB(sb)->s_es, 1);
                error = ext4_commit_super(sb, EXT4_SB(sb)->s_es, 1);
                if (error)
                        goto out;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 6903d37af037..9b800d97a687 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -108,7 +108,8 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
        if (hugetlb_reserve_pages(inode,
                                vma->vm_pgoff >> huge_page_order(h),
-                                len >> huge_page_shift(h), vma))
+                                len >> huge_page_shift(h), vma,
+                                vma->vm_flags))
                goto out;
        ret = 0;
@@ -947,7 +948,7 @@ static int can_do_hugetlb_shm(void)
                        can_do_mlock());
 }
-struct file *hugetlb_file_setup(const char *name, size_t size)
+struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag)
 {
        int error = -ENOMEM;
        struct file *file;
@@ -981,7 +982,8 @@ struct file *hugetlb_file_setup(const char *name, size_t size)
        error = -ENOMEM;
        if (hugetlb_reserve_pages(inode, 0,
-                        size >> huge_page_shift(hstate_inode(inode)), NULL))
+                        size >> huge_page_shift(hstate_inode(inode)), NULL,
+                        acctflag))
                goto out_inode;
        d_instantiate(dentry, inode);
diff --git a/fs/internal.h b/fs/internal.h
index 53af885f1732..0d8ac497b3d5 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -43,7 +43,7 @@ extern void __init chrdev_init(void);
 /*
 * exec.c
 */
-extern void check_unsafe_exec(struct linux_binprm *);
+extern void check_unsafe_exec(struct linux_binprm *, struct files_struct *);
 /*
 * namespace.c
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 9e4fa52d7dc8..e79c07812afa 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -427,7 +427,7 @@ int __log_space_left(journal_t *journal)
 }
 /*
- * Called under j_state_lock.  Returns true if a transaction was started.
+ * Called under j_state_lock.  Returns true if a transaction commit was started.
 */
 int __log_start_commit(journal_t *journal, tid_t target)
 {
@@ -495,7 +495,8 @@ int journal_force_commit_nested(journal_t *journal)
 /*
 * Start a commit of the current running transaction (if any).  Returns true
- * if a transaction was started, and fills its tid in at *ptid
+ * if a transaction is going to be committed (or is currently already
+ * committing), and fills its tid in at *ptid
 */
 int journal_start_commit(journal_t *journal, tid_t *ptid)
 {
@@ -505,15 +506,19 @@ int journal_start_commit(journal_t *journal, tid_t *ptid)
        if (journal->j_running_transaction) {
                tid_t tid = journal->j_running_transaction->t_tid;
-                ret = __log_start_commit(journal, tid);
+                __log_start_commit(journal, tid);
-                if (ret && ptid)
+                /* There's a running transaction and we've just made sure
+                 * it's commit has been scheduled. */
+                if (ptid)
                        *ptid = tid;
-        } else if (journal->j_committing_transaction && ptid) {
+                ret = 1;
+        } else if (journal->j_committing_transaction) {
                /*
                 * If ext3_write_super() recently started a commit, then we
                 * have to wait for completion of that transaction
                 */
-                *ptid = journal->j_committing_transaction->t_tid;
+                if (ptid)
+                        *ptid = journal->j_committing_transaction->t_tid;
                ret = 1;
        }
        spin_unlock(&journal->j_state_lock);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 56675306ed81..58144102bf25 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -37,10 +37,10 @@
 #include <linux/proc_fs.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/math64.h>
 #include <asm/uaccess.h>
 #include <asm/page.h>
-#include <asm/div64.h>
 EXPORT_SYMBOL(jbd2_journal_start);
 EXPORT_SYMBOL(jbd2_journal_restart);
@@ -450,7 +450,7 @@ int __jbd2_log_space_left(journal_t *journal)
 }
 /*
- * Called under j_state_lock.  Returns true if a transaction was started.
+ * Called under j_state_lock.  Returns true if a transaction commit was started.
 */
 int __jbd2_log_start_commit(journal_t *journal, tid_t target)
 {
@@ -518,7 +518,8 @@ int jbd2_journal_force_commit_nested(journal_t *journal)
 /*
 * Start a commit of the current running transaction (if any).  Returns true
- * if a transaction was started, and fills its tid in at *ptid
+ * if a transaction is going to be committed (or is currently already
+ * committing), and fills its tid in at *ptid
 */
 int jbd2_journal_start_commit(journal_t *journal, tid_t *ptid)
 {
@@ -528,15 +529,19 @@ int jbd2_journal_start_commit(journal_t *journal, tid_t *ptid)
        if (journal->j_running_transaction) {
                tid_t tid = journal->j_running_transaction->t_tid;
-                ret = __jbd2_log_start_commit(journal, tid);
+                __jbd2_log_start_commit(journal, tid);
-                if (ret && ptid)
+                /* There's a running transaction and we've just made sure
+                 * it's commit has been scheduled. */
+                if (ptid)
                        *ptid = tid;
-        } else if (journal->j_committing_transaction && ptid) {
+                ret = 1;
+        } else if (journal->j_committing_transaction) {
                /*
                 * If ext3_write_super() recently started a commit, then we
                 * have to wait for completion of that transaction
                 */
-                *ptid = journal->j_committing_transaction->t_tid;
+                if (ptid)
+                        *ptid = journal->j_committing_transaction->t_tid;
                ret = 1;
        }
        spin_unlock(&journal->j_state_lock);
@@ -846,8 +851,8 @@ static int jbd2_seq_info_show(struct seq_file *seq, void *v)
            jiffies_to_msecs(s->stats->u.run.rs_flushing / s->stats->ts_tid));
        seq_printf(seq, "  %ums logging transaction\n",
            jiffies_to_msecs(s->stats->u.run.rs_logging / s->stats->ts_tid));
-        seq_printf(seq, "  %luus average transaction commit time\n",
+        seq_printf(seq, "  %lluus average transaction commit time\n",
-                   do_div(s->journal->j_average_commit_time, 1000));
+                   div_u64(s->journal->j_average_commit_time, 1000));
        seq_printf(seq, "  %lu handles per transaction\n",
            s->stats->u.run.rs_handle_count / s->stats->ts_tid);
        seq_printf(seq, "  %lu blocks per transaction\n",
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 46b4e347ed7d..28ce21d8598e 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -2129,26 +2129,46 @@ done:
 }
 /*
- * This function must be called when inode is journaled in ordered mode
+ * File truncate and transaction commit interact with each other in a
- * before truncation happens. It starts writeout of truncated part in
+ * non-trivial way.  If a transaction writing data block A is
- * case it is in the committing transaction so that we stand to ordered
+ * committing, we cannot discard the data by truncate until we have
- * mode consistency guarantees.
+ * written them.  Otherwise if we crashed after the transaction with
+ * write has committed but before the transaction with truncate has
+ * committed, we could see stale data in block A.  This function is a
+ * helper to solve this problem.  It starts writeout of the truncated
+ * part in case it is in the committing transaction.
+ *
+ * Filesystem code must call this function when inode is journaled in
+ * ordered mode before truncation happens and after the inode has been
+ * placed on orphan list with the new inode size. The second condition
+ * avoids the race that someone writes new data and we start
+ * committing the transaction after this function has been called but
+ * before a transaction for truncate is started (and furthermore it
+ * allows us to optimize the case where the addition to orphan list
+ * happens in the same transaction as write --- we don't have to write
+ * any data in such case).
 */
-int jbd2_journal_begin_ordered_truncate(struct jbd2_inode *inode,
+int jbd2_journal_begin_ordered_truncate(journal_t *journal,
+                                        struct jbd2_inode *jinode,
                                        loff_t new_size)
 {
-        journal_t *journal;
+        transaction_t *inode_trans, *commit_trans;
-        transaction_t *commit_trans;
        int ret = 0;
-        if (!inode->i_transaction && !inode->i_next_transaction)
+        /* This is a quick check to avoid locking if not necessary */
+        if (!jinode->i_transaction)
                goto out;
-        journal = inode->i_transaction->t_journal;
+        /* Locks are here just to force reading of recent values, it is
+         * enough that the transaction was not committing before we started
+         * a transaction adding the inode to orphan list */
        spin_lock(&journal->j_state_lock);
        commit_trans = journal->j_committing_transaction;
        spin_unlock(&journal->j_state_lock);
-        if (inode->i_transaction == commit_trans) {
+        spin_lock(&journal->j_list_lock);
-                ret = filemap_fdatawrite_range(inode->i_vfs_inode->i_mapping,
+        inode_trans = jinode->i_transaction;
+        spin_unlock(&journal->j_list_lock);
+        if (inode_trans == commit_trans) {
+                ret = filemap_fdatawrite_range(jinode->i_vfs_inode->i_mapping,
                        new_size, LLONG_MAX);
                if (ret)
                        jbd2_journal_abort(journal, ret);
diff --git a/fs/jffs2/background.c b/fs/jffs2/background.c
index 3cceef4ad2b7..e9580104b6ba 100644
--- a/fs/jffs2/background.c
+++ b/fs/jffs2/background.c
@@ -95,13 +95,17 @@ static int jffs2_garbage_collect_thread(void *_c)
                        spin_unlock(&c->erase_completion_lock);
                        
-                /* This thread is purely an optimisation. But if it runs when
+                /* Problem - immediately after bootup, the GCD spends a lot
-                   other things could be running, it actually makes things a
+                 * of time in places like jffs2_kill_fragtree(); so much so
-                   lot worse. Use yield() and put it at the back of the runqueue
+                 * that userspace processes (like gdm and X) are starved
-                   every time. Especially during boot, pulling an inode in
+                 * despite plenty of cond_resched()s and renicing.  Yield()
-                   with read_inode() is much preferable to having the GC thread
+                 * doesn't help, either (presumably because userspace and GCD
-                   get there first. */
+                 * are generally competing for a higher latency resource -
-                yield();
+                 * disk).
+                 * This forces the GCD to slow the hell down.   Pulling an
+                 * inode in with read_inode() is much preferable to having
+                 * the GC thread get there first. */
+                schedule_timeout_interruptible(msecs_to_jiffies(50));
                /* Put_super will send a SIGKILL and then wait on the sem.
                 */
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 6ca08ad887c0..1fc1e92356ee 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -220,7 +220,7 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
                                struct jffs2_tmp_dnode_info *tn)
 {
        uint32_t fn_end = tn->fn->ofs + tn->fn->size;
-        struct jffs2_tmp_dnode_info *this;
+        struct jffs2_tmp_dnode_info *this, *ptn;
        dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
@@ -251,11 +251,18 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
        if (this) {
                /* If the node is coincident with another at a lower address,
                   back up until the other node is found. It may be relevant */
-                while (this->overlapped)
+                while (this->overlapped) {
-                        this = tn_prev(this);
+                        ptn = tn_prev(this);
+                        if (!ptn) {
-                /* First node should never be marked overlapped */
+                                /*
-                BUG_ON(!this);
+                                 * We killed a node which set the overlapped
+                                 * flags during the scan. Fix it up.
+                                 */
+                                this->overlapped = 0;
+                                break;
+                        }
+                        this = ptn;
+                }
                dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
        }
@@ -360,7 +367,17 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
                        }
                        if (!this->overlapped)
                                break;
-                        this = tn_prev(this);
+                        ptn = tn_prev(this);
+                        if (!ptn) {
+                                /*
+                                 * We killed a node which set the overlapped
+                                 * flags during the scan. Fix it up.
+                                 */
+                                this->overlapped = 0;
+                                break;
+                        }
+                        this = ptn;
                }
        }
@@ -456,8 +473,15 @@ static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
                eat_last(&rii->tn_root, &last->rb);
                ver_insert(&ver_root, last);
-                if (unlikely(last->overlapped))
+                if (unlikely(last->overlapped)) {
-                        continue;
+                        if (pen)
+                                continue;
+                        /*
+                         * We killed a node which set the overlapped
+                         * flags during the scan. Fix it up.
+                         */
+                        last->overlapped = 0;
+                }
                /* Now we have a bunch of nodes in reverse version
                   order, in the tree at ver_root. Most of the time,
diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index 6063a8e4b9f3..763b78a6e9de 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -427,7 +427,7 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file,
                        goto out;
                case -EAGAIN:
                        ret = nlm_lck_denied;
-                        goto out;
+                        break;
                case FILE_LOCK_DEFERRED:
                        if (wait)
                                break;
@@ -443,6 +443,10 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file,
                        goto out;
        }
+        ret = nlm_lck_denied;
+        if (!wait)
+                goto out;
        ret = nlm_lck_blocked;
        /* Append to list of blocked */
diff --git a/fs/namespace.c b/fs/namespace.c
index 228d8c4bfd18..06f8e63f6cb1 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -614,9 +614,11 @@ static inline void __mntput(struct vfsmount *mnt)
         */
        for_each_possible_cpu(cpu) {
                struct mnt_writer *cpu_writer = &per_cpu(mnt_writers, cpu);
-                if (cpu_writer->mnt != mnt)
-                        continue;
                spin_lock(&cpu_writer->lock);
+                if (cpu_writer->mnt != mnt) {
+                        spin_unlock(&cpu_writer->lock);
+                        continue;
+                }
                atomic_add(cpu_writer->count, &mnt->__mnt_writers);
                cpu_writer->count = 0;
                /*
diff --git a/fs/notify/inotify/inotify.c b/fs/notify/inotify/inotify.c
index dae3f28f30d4..331f2e88e284 100644
--- a/fs/notify/inotify/inotify.c
+++ b/fs/notify/inotify/inotify.c
@@ -156,7 +156,7 @@ static int inotify_handle_get_wd(struct inotify_handle *ih,
        int ret;
        do {
-                if (unlikely(!idr_pre_get(&ih->idr, GFP_KERNEL)))
+                if (unlikely(!idr_pre_get(&ih->idr, GFP_NOFS)))
                        return -ENOSPC;
                ret = idr_get_new_above(&ih->idr, watch, ih->last_wd+1, &watch->wd);
        } while (ret == -EAGAIN);
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index d861096c9d81..3a9e5deed74d 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -4796,6 +4796,29 @@ out:
        return ret;
 }
+static int ocfs2_replace_extent_rec(struct inode *inode,
+                                    handle_t *handle,
+                                    struct ocfs2_path *path,
+                                    struct ocfs2_extent_list *el,
+                                    int split_index,
+                                    struct ocfs2_extent_rec *split_rec)
+{
+        int ret;
+        ret = ocfs2_path_bh_journal_access(handle, inode, path,
+                                           path_num_items(path) - 1);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
+        el->l_recs[split_index] = *split_rec;
+        ocfs2_journal_dirty(handle, path_leaf_bh(path));
+out:
+        return ret;
+}
 /*
 * Mark part or all of the extent record at split_index in the leaf
 * pointed to by path as written. This removes the unwritten
@@ -4885,7 +4908,9 @@ static int __ocfs2_mark_extent_written(struct inode *inode,
        if (ctxt.c_contig_type == CONTIG_NONE) {
                if (ctxt.c_split_covers_rec)
-                        el->l_recs[split_index] = *split_rec;
+                        ret = ocfs2_replace_extent_rec(inode, handle,
+                                                       path, el,
+                                                       split_index, split_rec);
                else
                        ret = ocfs2_split_and_insert(inode, handle, path, et,
                                                     &last_eb_bh, split_index,
@@ -5390,6 +5415,9 @@ int ocfs2_remove_btree_range(struct inode *inode,
                goto out;
        }
+        vfs_dq_free_space_nodirty(inode,
+                                  ocfs2_clusters_to_bytes(inode->i_sb, len));
        ret = ocfs2_remove_extent(inode, et, cpos, len, handle, meta_ac,
                                  dealloc);
        if (ret) {
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index b1cc7c381e88..e9d7c2038c0f 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -38,6 +38,7 @@
 #include "dlmglue.h"
 #include "file.h"
 #include "inode.h"
+#include "super.h"
 static int ocfs2_dentry_revalidate(struct dentry *dentry,
@@ -294,6 +295,34 @@ out_attach:
        return ret;
 }
+static DEFINE_SPINLOCK(dentry_list_lock);
+/* We limit the number of dentry locks to drop in one go. We have
+ * this limit so that we don't starve other users of ocfs2_wq. */
+#define DL_INODE_DROP_COUNT 64
+/* Drop inode references from dentry locks */
+void ocfs2_drop_dl_inodes(struct work_struct *work)
+{
+        struct ocfs2_super *osb = container_of(work, struct ocfs2_super,
+                                               dentry_lock_work);
+        struct ocfs2_dentry_lock *dl;
+        int drop_count = DL_INODE_DROP_COUNT;
+        spin_lock(&dentry_list_lock);
+        while (osb->dentry_lock_list && drop_count--) {
+                dl = osb->dentry_lock_list;
+                osb->dentry_lock_list = dl->dl_next;
+                spin_unlock(&dentry_list_lock);
+                iput(dl->dl_inode);
+                kfree(dl);
+                spin_lock(&dentry_list_lock);
+        }
+        if (osb->dentry_lock_list)
+                queue_work(ocfs2_wq, &osb->dentry_lock_work);
+        spin_unlock(&dentry_list_lock);
+}
 /*
 * ocfs2_dentry_iput() and friends.
 *
@@ -318,16 +347,23 @@ out_attach:
 static void ocfs2_drop_dentry_lock(struct ocfs2_super *osb,
                                   struct ocfs2_dentry_lock *dl)
 {
-        iput(dl->dl_inode);
        ocfs2_simple_drop_lockres(osb, &dl->dl_lockres);
        ocfs2_lock_res_free(&dl->dl_lockres);
-        kfree(dl);
+        /* We leave dropping of inode reference to ocfs2_wq as that can
+         * possibly lead to inode deletion which gets tricky */
+        spin_lock(&dentry_list_lock);
+        if (!osb->dentry_lock_list)
+                queue_work(ocfs2_wq, &osb->dentry_lock_work);
+        dl->dl_next = osb->dentry_lock_list;
+        osb->dentry_lock_list = dl;
+        spin_unlock(&dentry_list_lock);
 }
 void ocfs2_dentry_lock_put(struct ocfs2_super *osb,
                           struct ocfs2_dentry_lock *dl)
 {
-        int unlock = 0;
+        int unlock;
        BUG_ON(dl->dl_count == 0);
diff --git a/fs/ocfs2/dcache.h b/fs/ocfs2/dcache.h
index c091c34d9883..d06e16c06640 100644
--- a/fs/ocfs2/dcache.h
+++ b/fs/ocfs2/dcache.h
@@ -29,8 +29,13 @@
 extern struct dentry_operations ocfs2_dentry_ops;
 struct ocfs2_dentry_lock {
+        /* Use count of dentry lock */
        unsigned int            dl_count;
-        u64                     dl_parent_blkno;
+        union {
+                /* Linked list of dentry locks to release */
+                struct ocfs2_dentry_lock *dl_next;
+                u64                     dl_parent_blkno;
+        };
        /*
         * The ocfs2_dentry_lock keeps an inode reference until
@@ -47,6 +52,8 @@ int ocfs2_dentry_attach_lock(struct dentry *dentry, struct inode *inode,
 void ocfs2_dentry_lock_put(struct ocfs2_super *osb,
                           struct ocfs2_dentry_lock *dl);
+void ocfs2_drop_dl_inodes(struct work_struct *work);
 struct dentry *ocfs2_find_local_alias(struct inode *inode, u64 parent_blkno,
                                      int skip_unhashed);
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 54e182a27caf..0a2813947853 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -1849,12 +1849,12 @@ int dlm_assert_master_handler(struct o2net_msg *msg, u32 len, void *data,
                if (!mle) {
                        if (res->owner != DLM_LOCK_RES_OWNER_UNKNOWN &&
                            res->owner != assert->node_idx) {
-                                mlog(ML_ERROR, "assert_master from "
+                                mlog(ML_ERROR, "DIE! Mastery assert from %u, "
-                                          "%u, but current owner is "
+                                     "but current owner is %u! (%.*s)\n",
-                                          "%u! (%.*s)\n",
+                                     assert->node_idx, res->owner, namelen,
-                                       assert->node_idx, res->owner,
+                                     name);
-                                       namelen, name);
+                                __dlm_print_one_lock_resource(res);
-                                goto kill;
+                                BUG();
                        }
                } else if (mle->type != DLM_MLE_MIGRATION) {
                        if (res->owner != DLM_LOCK_RES_OWNER_UNKNOWN) {
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index d1295203029f..4060bb328bc8 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -181,8 +181,7 @@ static int dlm_purge_lockres(struct dlm_ctxt *dlm,
                spin_lock(&res->spinlock);
                /* This ensures that clear refmap is sent after the set */
-                __dlm_wait_on_lockres_flags(res, (DLM_LOCK_RES_SETREF_INPROG |
+                __dlm_wait_on_lockres_flags(res, DLM_LOCK_RES_SETREF_INPROG);
-                                                  DLM_LOCK_RES_MIGRATING));
                spin_unlock(&res->spinlock);
                /* clear our bit from the master's refmap, ignore errors */
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index 86ca085ef324..fcf879ed6930 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -117,11 +117,11 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
        else
                BUG_ON(res->owner == dlm->node_num);
-        spin_lock(&dlm->spinlock);
+        spin_lock(&dlm->ast_lock);
        /* We want to be sure that we're not freeing a lock
         * that still has AST's pending... */
        in_use = !list_empty(&lock->ast_list);
-        spin_unlock(&dlm->spinlock);
+        spin_unlock(&dlm->ast_lock);
        if (in_use) {
               mlog(ML_ERROR, "lockres %.*s: Someone is calling dlmunlock "
                    "while waiting for an ast!", res->lockname.len,
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index b0c4cadd4c45..7219a86d34cc 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -320,9 +320,14 @@ static void ocfs2_schedule_blocked_lock(struct ocfs2_super *osb,
                                        struct ocfs2_lock_res *lockres);
 static inline void ocfs2_recover_from_dlm_error(struct ocfs2_lock_res *lockres,
                                                int convert);
-#define ocfs2_log_dlm_error(_func, _err, _lockres) do {                 \
+#define ocfs2_log_dlm_error(_func, _err, _lockres) do {                                 \
-        mlog(ML_ERROR, "DLM error %d while calling %s on resource %s\n", \
+        if ((_lockres)->l_type != OCFS2_LOCK_TYPE_DENTRY)                               \
-             _err, _func, _lockres->l_name);                            \
+                mlog(ML_ERROR, "DLM error %d while calling %s on resource %s\n",        \
+                     _err, _func, _lockres->l_name);                                    \
+        else                                                                            \
+                mlog(ML_ERROR, "DLM error %d while calling %s on resource %.*s%08x\n",  \
+                     _err, _func, OCFS2_DENTRY_LOCK_INO_START - 1, (_lockres)->l_name,  \
+                     (unsigned int)ocfs2_get_dentry_lock_ino(_lockres));                \
 } while (0)
 static int ocfs2_downconvert_thread(void *arg);
 static void ocfs2_downconvert_on_unlock(struct ocfs2_super *osb,
@@ -2860,6 +2865,10 @@ static void ocfs2_unlock_ast(void *opaque, int error)
        case OCFS2_UNLOCK_CANCEL_CONVERT:
                mlog(0, "Cancel convert success for %s\n", lockres->l_name);
                lockres->l_action = OCFS2_AST_INVALID;
+                /* Downconvert thread may have requeued this lock, we
+                 * need to wake it. */
+                if (lockres->l_flags & OCFS2_LOCK_BLOCKED)
+                        ocfs2_wake_downconvert_thread(ocfs2_get_lockres_osb(lockres));
                break;
        case OCFS2_UNLOCK_DROP_LOCK:
                lockres->l_level = DLM_LOCK_IV;
diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
index 3c3532e1307c..172850a9a12a 100644
--- a/fs/ocfs2/journal.h
+++ b/fs/ocfs2/journal.h
@@ -513,8 +513,10 @@ static inline int ocfs2_jbd2_file_inode(handle_t *handle, struct inode *inode)
 static inline int ocfs2_begin_ordered_truncate(struct inode *inode,
                                               loff_t new_size)
 {
-        return jbd2_journal_begin_ordered_truncate(&OCFS2_I(inode)->ip_jinode,
+        return jbd2_journal_begin_ordered_truncate(
-                                                   new_size);
+                                OCFS2_SB(inode->i_sb)->journal->j_journal,
+                                &OCFS2_I(inode)->ip_jinode,
+                                new_size);
 }
 #endif /* OCFS2_JOURNAL_H */
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index ad5c24a29edd..946d3c34b90b 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -210,6 +210,7 @@ struct ocfs2_journal;
 struct ocfs2_slot_info;
 struct ocfs2_recovery_map;
 struct ocfs2_quota_recovery;
+struct ocfs2_dentry_lock;
 struct ocfs2_super
 {
        struct task_struct *commit_task;
@@ -325,6 +326,11 @@ struct ocfs2_super
        struct list_head blocked_lock_list;
        unsigned long blocked_lock_count;
+        /* List of dentry locks to release. Anyone can add locks to
+         * the list, ocfs2_wq processes the list  */
+        struct ocfs2_dentry_lock *dentry_lock_list;
+        struct work_struct dentry_lock_work;
        wait_queue_head_t               osb_mount_event;
        /* Truncate log info */
@@ -335,6 +341,9 @@ struct ocfs2_super
        struct ocfs2_node_map           osb_recovering_orphan_dirs;
        unsigned int                    *osb_orphan_wipes;
        wait_queue_head_t               osb_wipe_event;
+        /* used to protect metaecc calculation check of xattr. */
+        spinlock_t osb_xattr_lock;
 };
 #define OCFS2_SB(sb)        ((struct ocfs2_super *)(sb)->s_fs_info)
diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index f4efa89baee5..1ed0f7c86869 100644
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -754,7 +754,9 @@ static int ocfs2_mark_dquot_dirty(struct dquot *dquot)
        if (dquot->dq_flags & mask)
                sync = 1;
        spin_unlock(&dq_data_lock);
-        if (!sync) {
+        /* This is a slight hack but we can't afford getting global quota
+         * lock if we already have a transaction started. */
+        if (!sync || journal_current_handle()) {
                status = ocfs2_write_dquot(dquot);
                goto out;
        }
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 43ed11345b59..7ac83a81ee55 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1537,6 +1537,13 @@ static int ocfs2_get_sector(struct super_block *sb,
        unlock_buffer(*bh);
        ll_rw_block(READ, 1, bh);
        wait_on_buffer(*bh);
+        if (!buffer_uptodate(*bh)) {
+                mlog_errno(-EIO);
+                brelse(*bh);
+                *bh = NULL;
+                return -EIO;
+        }
        return 0;
 }
@@ -1747,6 +1754,7 @@ static int ocfs2_initialize_super(struct super_block *sb,
        INIT_LIST_HEAD(&osb->blocked_lock_list);
        osb->blocked_lock_count = 0;
        spin_lock_init(&osb->osb_lock);
+        spin_lock_init(&osb->osb_xattr_lock);
        ocfs2_init_inode_steal_slot(osb);
        atomic_set(&osb->alloc_stats.moves, 0);
@@ -1887,6 +1895,9 @@ static int ocfs2_initialize_super(struct super_block *sb,
        INIT_WORK(&journal->j_recovery_work, ocfs2_complete_recovery);
        journal->j_state = OCFS2_JOURNAL_FREE;
+        INIT_WORK(&osb->dentry_lock_work, ocfs2_drop_dl_inodes);
+        osb->dentry_lock_list = NULL;
        /* get some pseudo constants for clustersize bits */
        osb->s_clustersize_bits =
                le32_to_cpu(di->id2.i_super.s_clustersize_bits);
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index e1d638af6ac3..4ddd788add67 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -82,13 +82,14 @@ struct ocfs2_xattr_set_ctxt {
 #define OCFS2_XATTR_ROOT_SIZE   (sizeof(struct ocfs2_xattr_def_value_root))
 #define OCFS2_XATTR_INLINE_SIZE 80
+#define OCFS2_XATTR_HEADER_GAP  4
 #define OCFS2_XATTR_FREE_IN_IBODY       (OCFS2_MIN_XATTR_INLINE_SIZE \
                                         - sizeof(struct ocfs2_xattr_header) \
-                                         - sizeof(__u32))
+                                         - OCFS2_XATTR_HEADER_GAP)
 #define OCFS2_XATTR_FREE_IN_BLOCK(ptr)  ((ptr)->i_sb->s_blocksize \
                                         - sizeof(struct ocfs2_xattr_block) \
                                         - sizeof(struct ocfs2_xattr_header) \
-                                         - sizeof(__u32))
+                                         - OCFS2_XATTR_HEADER_GAP)
 static struct ocfs2_xattr_def_value_root def_xv = {
        .xv.xr_list.l_count = cpu_to_le16(1),
@@ -274,10 +275,12 @@ static int ocfs2_read_xattr_bucket(struct ocfs2_xattr_bucket *bucket,
                               bucket->bu_blocks, bucket->bu_bhs, 0,
                               NULL);
        if (!rc) {
+                spin_lock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
                rc = ocfs2_validate_meta_ecc_bhs(bucket->bu_inode->i_sb,
                                                 bucket->bu_bhs,
                                                 bucket->bu_blocks,
                                                 &bucket_xh(bucket)->xh_check);
+                spin_unlock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
                if (rc)
                        mlog_errno(rc);
        }
@@ -310,9 +313,11 @@ static void ocfs2_xattr_bucket_journal_dirty(handle_t *handle,
 {
        int i;
+        spin_lock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
        ocfs2_compute_meta_ecc_bhs(bucket->bu_inode->i_sb,
                                   bucket->bu_bhs, bucket->bu_blocks,
                                   &bucket_xh(bucket)->xh_check);
+        spin_unlock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
        for (i = 0; i < bucket->bu_blocks; i++)
                ocfs2_journal_dirty(handle, bucket->bu_bhs[i]);
@@ -1507,7 +1512,7 @@ static int ocfs2_xattr_set_entry(struct inode *inode,
                last += 1;
        }
-        free = min_offs - ((void *)last - xs->base) - sizeof(__u32);
+        free = min_offs - ((void *)last - xs->base) - OCFS2_XATTR_HEADER_GAP;
        if (free < 0)
                return -EIO;
@@ -2190,7 +2195,7 @@ static int ocfs2_xattr_can_be_in_inode(struct inode *inode,
                last += 1;
        }
-        free = min_offs - ((void *)last - xs->base) - sizeof(__u32);
+        free = min_offs - ((void *)last - xs->base) - OCFS2_XATTR_HEADER_GAP;
        if (free < 0)
                return 0;
@@ -2592,8 +2597,9 @@ static int __ocfs2_xattr_set_handle(struct inode *inode,
        if (!ret) {
                /* Update inode ctime. */
-                ret = ocfs2_journal_access(ctxt->handle, inode, xis->inode_bh,
+                ret = ocfs2_journal_access_di(ctxt->handle, inode,
-                                           OCFS2_JOURNAL_ACCESS_WRITE);
+                                              xis->inode_bh,
+                                              OCFS2_JOURNAL_ACCESS_WRITE);
                if (ret) {
                        mlog_errno(ret);
                        goto out;
@@ -4729,13 +4735,6 @@ static int ocfs2_xattr_bucket_value_truncate(struct inode *inode,
        vb.vb_xv = (struct ocfs2_xattr_value_root *)
                (vb.vb_bh->b_data + offset % blocksize);
-        ret = ocfs2_xattr_bucket_journal_access(ctxt->handle, bucket,
-                                                OCFS2_JOURNAL_ACCESS_WRITE);
-        if (ret) {
-                mlog_errno(ret);
-                goto out;
-        }
        /*
         * From here on out we have to dirty the bucket.  The generic
         * value calls only modify one of the bucket's bhs, but we need
@@ -4748,12 +4747,18 @@ static int ocfs2_xattr_bucket_value_truncate(struct inode *inode,
        ret = ocfs2_xattr_value_truncate(inode, &vb, len, ctxt);
        if (ret) {
                mlog_errno(ret);
-                goto out_dirty;
+                goto out;
+        }
+        ret = ocfs2_xattr_bucket_journal_access(ctxt->handle, bucket,
+                                                OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
        }
        xe->xe_value_size = cpu_to_le64(len);
-out_dirty:
        ocfs2_xattr_bucket_journal_dirty(ctxt->handle, bucket);
 out:
@@ -5061,8 +5066,8 @@ try_again:
        xh_free_start = le16_to_cpu(xh->xh_free_start);
        header_size = sizeof(struct ocfs2_xattr_header) +
                        count * sizeof(struct ocfs2_xattr_entry);
-        max_free = OCFS2_XATTR_BUCKET_SIZE -
+        max_free = OCFS2_XATTR_BUCKET_SIZE - header_size -
-                le16_to_cpu(xh->xh_name_value_len) - header_size;
+                le16_to_cpu(xh->xh_name_value_len) - OCFS2_XATTR_HEADER_GAP;
        mlog_bug_on_msg(header_size > blocksize, "bucket %llu has header size "
                        "of %u which exceed block size\n",
@@ -5095,7 +5100,7 @@ try_again:
                        need = 0;
        }
-        free = xh_free_start - header_size;
+        free = xh_free_start - header_size - OCFS2_XATTR_HEADER_GAP;
        /*
         * We need to make sure the new name/value pair
         * can exist in the same block.
@@ -5128,7 +5133,8 @@ try_again:
                        }
                        xh_free_start = le16_to_cpu(xh->xh_free_start);
-                        free = xh_free_start - header_size;
+                        free = xh_free_start - header_size
+                                - OCFS2_XATTR_HEADER_GAP;
                        if (xh_free_start % blocksize < need)
                                free -= xh_free_start % blocksize;
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 3e76bb9b3ad6..d8bb5c671f42 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -485,8 +485,10 @@ struct inode *proc_get_inode(struct super_block *sb, unsigned int ino,
                        }
                }
                unlock_new_inode(inode);
-        } else
+        } else {
               module_put(de->owner);
+               de_put(de);
+        }
        return inode;
 out_ino:
diff --git a/fs/proc/page.c b/fs/proc/page.c
index 767d95a6d1b1..2d1345112a42 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -107,7 +107,7 @@ static ssize_t kpageflags_read(struct file *file, char __user *buf,
                else
                        kflags = ppage->flags;
-                uflags = kpf_copy_bit(KPF_LOCKED, PG_locked, kflags) |
+                uflags = kpf_copy_bit(kflags, KPF_LOCKED, PG_locked) |
                        kpf_copy_bit(kflags, KPF_ERROR, PG_error) |
                        kpf_copy_bit(kflags, KPF_REFERENCED, PG_referenced) |
                        kpf_copy_bit(kflags, KPF_UPTODATE, PG_uptodate) |
diff --git a/fs/seq_file.c b/fs/seq_file.c
index b569ff1c4dc8..a1a4cfe19210 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -48,12 +48,78 @@ int seq_open(struct file *file, const struct seq_operations *op)
         */
        file->f_version = 0;
-        /* SEQ files support lseek, but not pread/pwrite */
+        /*
-        file->f_mode &= ~(FMODE_PREAD | FMODE_PWRITE);
+         * seq_files support lseek() and pread().  They do not implement
+         * write() at all, but we clear FMODE_PWRITE here for historical
+         * reasons.
+         *
+         * If a client of seq_files a) implements file.write() and b) wishes to
+         * support pwrite() then that client will need to implement its own
+         * file.open() which calls seq_open() and then sets FMODE_PWRITE.
+         */
+        file->f_mode &= ~FMODE_PWRITE;
        return 0;
 }
 EXPORT_SYMBOL(seq_open);
+static int traverse(struct seq_file *m, loff_t offset)
+{
+        loff_t pos = 0, index;
+        int error = 0;
+        void *p;
+        m->version = 0;
+        index = 0;
+        m->count = m->from = 0;
+        if (!offset) {
+                m->index = index;
+                return 0;
+        }
+        if (!m->buf) {
+                m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
+                if (!m->buf)
+                        return -ENOMEM;
+        }
+        p = m->op->start(m, &index);
+        while (p) {
+                error = PTR_ERR(p);
+                if (IS_ERR(p))
+                        break;
+                error = m->op->show(m, p);
+                if (error < 0)
+                        break;
+                if (unlikely(error)) {
+                        error = 0;
+                        m->count = 0;
+                }
+                if (m->count == m->size)
+                        goto Eoverflow;
+                if (pos + m->count > offset) {
+                        m->from = offset - pos;
+                        m->count -= m->from;
+                        m->index = index;
+                        break;
+                }
+                pos += m->count;
+                m->count = 0;
+                if (pos == offset) {
+                        index++;
+                        m->index = index;
+                        break;
+                }
+                p = m->op->next(m, p, &index);
+        }
+        m->op->stop(m, p);
+        m->index = index;
+        return error;
+Eoverflow:
+        m->op->stop(m, p);
+        kfree(m->buf);
+        m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
+        return !m->buf ? -ENOMEM : -EAGAIN;
+}
 /**
 *      seq_read -      ->read() method for sequential files.
 *      @file: the file to read from
@@ -73,6 +139,22 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
        int err = 0;
        mutex_lock(&m->lock);
+        /* Don't assume *ppos is where we left it */
+        if (unlikely(*ppos != m->read_pos)) {
+                m->read_pos = *ppos;
+                while ((err = traverse(m, *ppos)) == -EAGAIN)
+                        ;
+                if (err) {
+                        /* With prejudice... */
+                        m->read_pos = 0;
+                        m->version = 0;
+                        m->index = 0;
+                        m->count = 0;
+                        goto Done;
+                }
+        }
        /*
         * seq_file->op->..m_start/m_stop/m_next may do special actions
         * or optimisations based on the file->f_version, so we want to
@@ -172,8 +254,10 @@ Fill:
 Done:
        if (!copied)
                copied = err;
-        else
+        else {
                *ppos += copied;
+                m->read_pos += copied;
+        }
        file->f_version = m->version;
        mutex_unlock(&m->lock);
        return copied;
@@ -186,63 +270,6 @@ Efault:
 }
 EXPORT_SYMBOL(seq_read);
-static int traverse(struct seq_file *m, loff_t offset)
-{
-        loff_t pos = 0, index;
-        int error = 0;
-        void *p;
-        m->version = 0;
-        index = 0;
-        m->count = m->from = 0;
-        if (!offset) {
-                m->index = index;
-                return 0;
-        }
-        if (!m->buf) {
-                m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-                if (!m->buf)
-                        return -ENOMEM;
-        }
-        p = m->op->start(m, &index);
-        while (p) {
-                error = PTR_ERR(p);
-                if (IS_ERR(p))
-                        break;
-                error = m->op->show(m, p);
-                if (error < 0)
-                        break;
-                if (unlikely(error)) {
-                        error = 0;
-                        m->count = 0;
-                }
-                if (m->count == m->size)
-                        goto Eoverflow;
-                if (pos + m->count > offset) {
-                        m->from = offset - pos;
-                        m->count -= m->from;
-                        m->index = index;
-                        break;
-                }
-                pos += m->count;
-                m->count = 0;
-                if (pos == offset) {
-                        index++;
-                        m->index = index;
-                        break;
-                }
-                p = m->op->next(m, p, &index);
-        }
-        m->op->stop(m, p);
-        return error;
-Eoverflow:
-        m->op->stop(m, p);
-        kfree(m->buf);
-        m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-        return !m->buf ? -ENOMEM : -EAGAIN;
-}
 /**
 *      seq_lseek -     ->llseek() method for sequential files.
 *      @file: the file in question
@@ -265,16 +292,18 @@ loff_t seq_lseek(struct file *file, loff_t offset, int origin)
                        if (offset < 0)
                                break;
                        retval = offset;
-                        if (offset != file->f_pos) {
+                        if (offset != m->read_pos) {
                                while ((retval=traverse(m, offset)) == -EAGAIN)
                                        ;
                                if (retval) {
                                        /* with extreme prejudice... */
                                        file->f_pos = 0;
+                                        m->read_pos = 0;
                                        m->version = 0;
                                        m->index = 0;
                                        m->count = 0;
                                } else {
+                                        m->read_pos = offset;
                                        retval = file->f_pos = offset;
                                }
                        }
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index c837dfc2b3c6..321728f48f2d 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -80,7 +80,7 @@ static struct buffer_head *get_block_length(struct super_block *sb,
 * generated a larger block - this does occasionally happen with zlib).
 */
 int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
-                        int length, u64 *next_index, int srclength)
+                        int length, u64 *next_index, int srclength, int pages)
 {
        struct squashfs_sb_info *msblk = sb->s_fs_info;
        struct buffer_head **bh;
@@ -185,6 +185,14 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                        }
                        if (msblk->stream.avail_out == 0) {
+                                if (page == pages) {
+                                        ERROR("zlib_inflate tried to "
+                                                "decompress too much data, "
+                                                "expected %d bytes.  Zlib "
+                                                "data probably corrupt\n",
+                                                srclength);
+                                        goto release_mutex;
+                                }
                                msblk->stream.next_out = buffer[page++];
                                msblk->stream.avail_out = PAGE_CACHE_SIZE;
                        }
@@ -268,7 +276,8 @@ block_release:
                put_bh(bh[k]);
 read_failure:
-        ERROR("sb_bread failed reading block 0x%llx\n", cur_index);
+        ERROR("squashfs_read_data failed to read block 0x%llx\n",
+                                        (unsigned long long) index);
        kfree(bh);
        return -EIO;
 }
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index f29eda16d25e..1c4739e33af6 100644
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -119,7 +119,7 @@ struct squashfs_cache_entry *squashfs_cache_get(struct super_block *sb,
                        entry->length = squashfs_read_data(sb, entry->data,
                                block, length, &entry->next_index,
-                                cache->block_size);
+                                cache->block_size, cache->pages);
                        spin_lock(&cache->lock);
@@ -406,7 +406,7 @@ int squashfs_read_table(struct super_block *sb, void *buffer, u64 block,
        for (i = 0; i < pages; i++, buffer += PAGE_CACHE_SIZE)
                data[i] = buffer;
        res = squashfs_read_data(sb, data, block, length |
-                SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, length);
+                SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, length, pages);
        kfree(data);
        return res;
 }
diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c
index 7a63398bb855..9101dbde39ec 100644
--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -133,7 +133,8 @@ int squashfs_read_inode(struct inode *inode, long long ino)
        type = le16_to_cpu(sqshb_ino->inode_type);
        switch (type) {
        case SQUASHFS_REG_TYPE: {
-                unsigned int frag_offset, frag_size, frag;
+                unsigned int frag_offset, frag;
+                int frag_size;
                u64 frag_blk;
                struct squashfs_reg_inode *sqsh_ino = &squashfs_ino.reg;
@@ -175,7 +176,8 @@ int squashfs_read_inode(struct inode *inode, long long ino)
                break;
        }
        case SQUASHFS_LREG_TYPE: {
-                unsigned int frag_offset, frag_size, frag;
+                unsigned int frag_offset, frag;
+                int frag_size;
                u64 frag_blk;
                struct squashfs_lreg_inode *sqsh_ino = &squashfs_ino.lreg;
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 6b2515d027d5..0e9feb6adf7e 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -34,7 +34,7 @@ static inline struct squashfs_inode_info *squashfs_i(struct inode *inode)
 /* block.c */
 extern int squashfs_read_data(struct super_block *, void **, u64, int, u64 *,
-                                int);
+                                int, int);
 /* cache.c */
 extern struct squashfs_cache *squashfs_cache_init(char *, int, int);
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 071df5b5b491..681ec0d83799 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -389,7 +389,7 @@ static int __init init_squashfs_fs(void)
                return err;
        }
-        printk(KERN_INFO "squashfs: version 4.0 (2009/01/03) "
+        printk(KERN_INFO "squashfs: version 4.0 (2009/01/31) "
                "Phillip Lougher\n");
        return 0;
diff --git a/fs/super.c b/fs/super.c
index 645e5403f2a0..8349ed6b1412 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -82,7 +82,22 @@ static struct super_block *alloc_super(struct file_system_type *type)
                 * lock ordering than usbfs:
                 */
                lockdep_set_class(&s->s_lock, &type->s_lock_key);
-                down_write(&s->s_umount);
+                /*
+                 * sget() can have s_umount recursion.
+                 *
+                 * When it cannot find a suitable sb, it allocates a new
+                 * one (this one), and tries again to find a suitable old
+                 * one.
+                 *
+                 * In case that succeeds, it will acquire the s_umount
+                 * lock of the old one. Since these are clearly distrinct
+                 * locks, and this object isn't exposed yet, there's no
+                 * risk of deadlocks.
+                 *
+                 * Annotate this by putting this lock in a different
+                 * subclass.
+                 */
+                down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING);
                s->s_count = S_BIAS;
                atomic_set(&s->s_active, 1);
                mutex_init(&s->s_vfs_rename_mutex);
@@ -301,7 +316,7 @@ void generic_shutdown_super(struct super_block *sb)
                /*
                 * wait for asynchronous fs operations to finish before going further
                 */
-                async_synchronize_full_special(&sb->s_async_list);
+                async_synchronize_full_domain(&sb->s_async_list);
                /* bad name - it should be evict_inodes() */
                invalidate_inodes(sb);
@@ -470,7 +485,7 @@ restart:
                sb->s_count++;
                spin_unlock(&sb_lock);
                down_read(&sb->s_umount);
-                async_synchronize_full_special(&sb->s_async_list);
+                async_synchronize_full_domain(&sb->s_async_list);
                if (sb->s_root && (wait || sb->s_dirt))
                        sb->s_op->sync_fs(sb, wait);
                up_read(&sb->s_umount);
diff --git a/fs/timerfd.c b/fs/timerfd.c
index 6a123b8ff3f5..b042bd7034b1 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -186,10 +186,9 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
        BUILD_BUG_ON(TFD_CLOEXEC != O_CLOEXEC);
        BUILD_BUG_ON(TFD_NONBLOCK != O_NONBLOCK);
-        if (flags & ~(TFD_CLOEXEC | TFD_NONBLOCK))
+        if ((flags & ~TFD_CREATE_FLAGS) ||
-                return -EINVAL;
+            (clockid != CLOCK_MONOTONIC &&
-        if (clockid != CLOCK_MONOTONIC &&
+             clockid != CLOCK_REALTIME))
-            clockid != CLOCK_REALTIME)
                return -EINVAL;
        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
@@ -201,7 +200,7 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
        hrtimer_init(&ctx->tmr, clockid, HRTIMER_MODE_ABS);
        ufd = anon_inode_getfd("[timerfd]", &timerfd_fops, ctx,
-                               flags & (O_CLOEXEC | O_NONBLOCK));
+                               flags & TFD_SHARED_FCNTL_FLAGS);
        if (ufd < 0)
                kfree(ctx);
@@ -219,7 +218,8 @@ SYSCALL_DEFINE4(timerfd_settime, int, ufd, int, flags,
        if (copy_from_user(&ktmr, utmr, sizeof(ktmr)))
                return -EFAULT;
-        if (!timespec_valid(&ktmr.it_value) ||
+        if ((flags & ~TFD_SETTIME_FLAGS) ||
+            !timespec_valid(&ktmr.it_value) ||
            !timespec_valid(&ktmr.it_interval))
                return -EINVAL;
diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c
index 175f9c590b77..f393620890ee 100644
--- a/fs/ubifs/budget.c
+++ b/fs/ubifs/budget.c
@@ -689,7 +689,7 @@ long long ubifs_reported_space(const struct ubifs_info *c, long long free)
 }
 /**
- * ubifs_get_free_space - return amount of free space.
+ * ubifs_get_free_space_nolock - return amount of free space.
 * @c: UBIFS file-system description object
 *
 * This function calculates amount of free space to report to user-space.
@@ -704,16 +704,14 @@ long long ubifs_reported_space(const struct ubifs_info *c, long long free)
 * traditional file-systems, because they have way less overhead than UBIFS.
 * So, to keep users happy, UBIFS tries to take the overhead into account.
 */
-long long ubifs_get_free_space(struct ubifs_info *c)
+long long ubifs_get_free_space_nolock(struct ubifs_info *c)
 {
-        int min_idx_lebs, rsvd_idx_lebs, lebs;
+        int rsvd_idx_lebs, lebs;
        long long available, outstanding, free;
-        spin_lock(&c->space_lock);
+        ubifs_assert(c->min_idx_lebs == ubifs_calc_min_idx_lebs(c));
-        min_idx_lebs = c->min_idx_lebs;
-        ubifs_assert(min_idx_lebs == ubifs_calc_min_idx_lebs(c));
        outstanding = c->budg_data_growth + c->budg_dd_growth;
-        available = ubifs_calc_available(c, min_idx_lebs);
+        available = ubifs_calc_available(c, c->min_idx_lebs);
        /*
         * When reporting free space to user-space, UBIFS guarantees that it is
@@ -726,15 +724,14 @@ long long ubifs_get_free_space(struct ubifs_info *c)
         * Note, the calculations below are similar to what we have in
         * 'do_budget_space()', so refer there for comments.
         */
-        if (min_idx_lebs > c->lst.idx_lebs)
+        if (c->min_idx_lebs > c->lst.idx_lebs)
-                rsvd_idx_lebs = min_idx_lebs - c->lst.idx_lebs;
+                rsvd_idx_lebs = c->min_idx_lebs - c->lst.idx_lebs;
        else
                rsvd_idx_lebs = 0;
        lebs = c->lst.empty_lebs + c->freeable_cnt + c->idx_gc_cnt -
               c->lst.taken_empty_lebs;
        lebs -= rsvd_idx_lebs;
        available += lebs * (c->dark_wm - c->leb_overhead);
-        spin_unlock(&c->space_lock);
        if (available > outstanding)
                free = ubifs_reported_space(c, available - outstanding);
@@ -742,3 +739,21 @@ long long ubifs_get_free_space(struct ubifs_info *c)
                free = 0;
        return free;
 }
+/**
+ * ubifs_get_free_space - return amount of free space.
+ * @c: UBIFS file-system description object
+ *
+ * This function calculates and retuns amount of free space to report to
+ * user-space.
+ */
+long long ubifs_get_free_space(struct ubifs_info *c)
+{
+        long long free;
+        spin_lock(&c->space_lock);
+        free = ubifs_get_free_space_nolock(c);
+        spin_unlock(&c->space_lock);
+        return free;
+}
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 792c5a16c182..e975bd82f38b 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -620,9 +620,11 @@ void dbg_dump_budg(struct ubifs_info *c)
               c->dark_wm, c->dead_wm, c->max_idx_node_sz);
        printk(KERN_DEBUG "\tgc_lnum %d, ihead_lnum %d\n",
               c->gc_lnum, c->ihead_lnum);
-        for (i = 0; i < c->jhead_cnt; i++)
+        /* If we are in R/O mode, journal heads do not exist */
-                printk(KERN_DEBUG "\tjhead %d\t LEB %d\n",
+        if (c->jheads)
-                       c->jheads[i].wbuf.jhead, c->jheads[i].wbuf.lnum);
+                for (i = 0; i < c->jhead_cnt; i++)
+                        printk(KERN_DEBUG "\tjhead %d\t LEB %d\n",
+                               c->jheads[i].wbuf.jhead, c->jheads[i].wbuf.lnum);
        for (rb = rb_first(&c->buds); rb; rb = rb_next(rb)) {
                bud = rb_entry(rb, struct ubifs_bud, rb);
                printk(KERN_DEBUG "\tbud LEB %d\n", bud->lnum);
@@ -637,10 +639,7 @@ void dbg_dump_budg(struct ubifs_info *c)
        /* Print budgeting predictions */
        available = ubifs_calc_available(c, c->min_idx_lebs);
        outstanding = c->budg_data_growth + c->budg_dd_growth;
-        if (available > outstanding)
+        free = ubifs_get_free_space_nolock(c);
-                free = ubifs_reported_space(c, available - outstanding);
-        else
-                free = 0;
        printk(KERN_DEBUG "Budgeting predictions:\n");
        printk(KERN_DEBUG "\tavailable: %lld, outstanding %lld, free %lld\n",
               available, outstanding, free);
@@ -861,6 +860,65 @@ void dbg_dump_index(struct ubifs_info *c)
 }
 /**
+ * dbg_save_space_info - save information about flash space.
+ * @c: UBIFS file-system description object
+ *
+ * This function saves information about UBIFS free space, dirty space, etc, in
+ * order to check it later.
+ */
+void dbg_save_space_info(struct ubifs_info *c)
+{
+        struct ubifs_debug_info *d = c->dbg;
+        ubifs_get_lp_stats(c, &d->saved_lst);
+        spin_lock(&c->space_lock);
+        d->saved_free = ubifs_get_free_space_nolock(c);
+        spin_unlock(&c->space_lock);
+}
+/**
+ * dbg_check_space_info - check flash space information.
+ * @c: UBIFS file-system description object
+ *
+ * This function compares current flash space information with the information
+ * which was saved when the 'dbg_save_space_info()' function was called.
+ * Returns zero if the information has not changed, and %-EINVAL it it has
+ * changed.
+ */
+int dbg_check_space_info(struct ubifs_info *c)
+{
+        struct ubifs_debug_info *d = c->dbg;
+        struct ubifs_lp_stats lst;
+        long long avail, free;
+        spin_lock(&c->space_lock);
+        avail = ubifs_calc_available(c, c->min_idx_lebs);
+        spin_unlock(&c->space_lock);
+        free = ubifs_get_free_space(c);
+        if (free != d->saved_free) {
+                ubifs_err("free space changed from %lld to %lld",
+                          d->saved_free, free);
+                goto out;
+        }
+        return 0;
+out:
+        ubifs_msg("saved lprops statistics dump");
+        dbg_dump_lstats(&d->saved_lst);
+        ubifs_get_lp_stats(c, &lst);
+        ubifs_msg("current lprops statistics dump");
+        dbg_dump_lstats(&d->saved_lst);
+        spin_lock(&c->space_lock);
+        dbg_dump_budg(c);
+        spin_unlock(&c->space_lock);
+        dump_stack();
+        return -EINVAL;
+}
+/**
 * dbg_check_synced_i_size - check synchronized inode size.
 * @inode: inode to check
 *
@@ -1349,7 +1407,7 @@ int dbg_check_tnc(struct ubifs_info *c, int extra)
 * @c: UBIFS file-system description object
 * @leaf_cb: called for each leaf node
 * @znode_cb: called for each indexing node
- * @priv: private date which is passed to callbacks
+ * @priv: private data which is passed to callbacks
 *
 * This function walks the UBIFS index and calls the @leaf_cb for each leaf
 * node and @znode_cb for each indexing node. Returns zero in case of success
@@ -2409,7 +2467,7 @@ void ubifs_debugging_exit(struct ubifs_info *c)
 * Root directory for UBIFS stuff in debugfs. Contains sub-directories which
 * contain the stuff specific to particular file-system mounts.
 */
-static struct dentry *debugfs_rootdir;
+static struct dentry *dfs_rootdir;
 /**
 * dbg_debugfs_init - initialize debugfs file-system.
@@ -2421,9 +2479,9 @@ static struct dentry *debugfs_rootdir;
 */
 int dbg_debugfs_init(void)
 {
-        debugfs_rootdir = debugfs_create_dir("ubifs", NULL);
+        dfs_rootdir = debugfs_create_dir("ubifs", NULL);
-        if (IS_ERR(debugfs_rootdir)) {
+        if (IS_ERR(dfs_rootdir)) {
-                int err = PTR_ERR(debugfs_rootdir);
+                int err = PTR_ERR(dfs_rootdir);
                ubifs_err("cannot create \"ubifs\" debugfs directory, "
                          "error %d\n", err);
                return err;
@@ -2437,7 +2495,7 @@ int dbg_debugfs_init(void)
 */
 void dbg_debugfs_exit(void)
 {
-        debugfs_remove(debugfs_rootdir);
+        debugfs_remove(dfs_rootdir);
 }
 static int open_debugfs_file(struct inode *inode, struct file *file)
@@ -2452,13 +2510,13 @@ static ssize_t write_debugfs_file(struct file *file, const char __user *buf,
        struct ubifs_info *c = file->private_data;
        struct ubifs_debug_info *d = c->dbg;
-        if (file->f_path.dentry == d->dump_lprops)
+        if (file->f_path.dentry == d->dfs_dump_lprops)
                dbg_dump_lprops(c);
-        else if (file->f_path.dentry == d->dump_budg) {
+        else if (file->f_path.dentry == d->dfs_dump_budg) {
                spin_lock(&c->space_lock);
                dbg_dump_budg(c);
                spin_unlock(&c->space_lock);
-        } else if (file->f_path.dentry == d->dump_tnc) {
+        } else if (file->f_path.dentry == d->dfs_dump_tnc) {
                mutex_lock(&c->tnc_mutex);
                dbg_dump_tnc(c);
                mutex_unlock(&c->tnc_mutex);
@@ -2469,7 +2527,7 @@ static ssize_t write_debugfs_file(struct file *file, const char __user *buf,
        return count;
 }
-static const struct file_operations debugfs_fops = {
+static const struct file_operations dfs_fops = {
        .open = open_debugfs_file,
        .write = write_debugfs_file,
        .owner = THIS_MODULE,
@@ -2494,36 +2552,32 @@ int dbg_debugfs_init_fs(struct ubifs_info *c)
        struct dentry *dent;
        struct ubifs_debug_info *d = c->dbg;
-        sprintf(d->debugfs_dir_name, "ubi%d_%d", c->vi.ubi_num, c->vi.vol_id);
+        sprintf(d->dfs_dir_name, "ubi%d_%d", c->vi.ubi_num, c->vi.vol_id);
-        d->debugfs_dir = debugfs_create_dir(d->debugfs_dir_name,
+        d->dfs_dir = debugfs_create_dir(d->dfs_dir_name, dfs_rootdir);
-                                              debugfs_rootdir);
+        if (IS_ERR(d->dfs_dir)) {
-        if (IS_ERR(d->debugfs_dir)) {
+                err = PTR_ERR(d->dfs_dir);
-                err = PTR_ERR(d->debugfs_dir);
                ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
-                          d->debugfs_dir_name, err);
+                          d->dfs_dir_name, err);
                goto out;
        }
        fname = "dump_lprops";
-        dent = debugfs_create_file(fname, S_IWUGO, d->debugfs_dir, c,
+        dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
-                                   &debugfs_fops);
        if (IS_ERR(dent))
                goto out_remove;
-        d->dump_lprops = dent;
+        d->dfs_dump_lprops = dent;
        fname = "dump_budg";
-        dent = debugfs_create_file(fname, S_IWUGO, d->debugfs_dir, c,
+        dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
-                                   &debugfs_fops);
        if (IS_ERR(dent))
                goto out_remove;
-        d->dump_budg = dent;
+        d->dfs_dump_budg = dent;
        fname = "dump_tnc";
-        dent = debugfs_create_file(fname, S_IWUGO, d->debugfs_dir, c,
+        dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
-                                   &debugfs_fops);
        if (IS_ERR(dent))
                goto out_remove;
-        d->dump_tnc = dent;
+        d->dfs_dump_tnc = dent;
        return 0;
@@ -2531,7 +2585,7 @@ out_remove:
        err = PTR_ERR(dent);
        ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
                  fname, err);
-        debugfs_remove_recursive(d->debugfs_dir);
+        debugfs_remove_recursive(d->dfs_dir);
 out:
        return err;
 }
@@ -2542,7 +2596,7 @@ out:
 */
 void dbg_debugfs_exit_fs(struct ubifs_info *c)
 {
-        debugfs_remove_recursive(c->dbg->debugfs_dir);
+        debugfs_remove_recursive(c->dbg->dfs_dir);
 }
 #endif /* CONFIG_UBIFS_FS_DEBUG */
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index 9820d6999f7e..c1cd73b2e06e 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -41,15 +41,17 @@
 * @chk_lpt_wastage: used by LPT tree size checker
 * @chk_lpt_lebs: used by LPT tree size checker
 * @new_nhead_offs: used by LPT tree size checker
- * @new_ihead_lnum: used by debugging to check ihead_lnum
+ * @new_ihead_lnum: used by debugging to check @c->ihead_lnum
- * @new_ihead_offs: used by debugging to check ihead_offs
+ * @new_ihead_offs: used by debugging to check @c->ihead_offs
 *
- * debugfs_dir_name: name of debugfs directory containing this file-system's
+ * @saved_lst: saved lprops statistics (used by 'dbg_save_space_info()')
- *                   files
+ * @saved_free: saved free space (used by 'dbg_save_space_info()')
- * debugfs_dir: direntry object of the file-system debugfs directory
+ *
- * dump_lprops: "dump lprops" debugfs knob
+ * dfs_dir_name: name of debugfs directory containing this file-system's files
- * dump_budg: "dump budgeting information" debugfs knob
+ * dfs_dir: direntry object of the file-system debugfs directory
- * dump_tnc: "dump TNC" debugfs knob
+ * dfs_dump_lprops: "dump lprops" debugfs knob
+ * dfs_dump_budg: "dump budgeting information" debugfs knob
+ * dfs_dump_tnc: "dump TNC" debugfs knob
 */
 struct ubifs_debug_info {
        void *buf;
@@ -69,11 +71,14 @@ struct ubifs_debug_info {
        int new_ihead_lnum;
        int new_ihead_offs;
-        char debugfs_dir_name[100];
+        struct ubifs_lp_stats saved_lst;
-        struct dentry *debugfs_dir;
+        long long saved_free;
-        struct dentry *dump_lprops;
-        struct dentry *dump_budg;
+        char dfs_dir_name[100];
-        struct dentry *dump_tnc;
+        struct dentry *dfs_dir;
+        struct dentry *dfs_dump_lprops;
+        struct dentry *dfs_dump_budg;
+        struct dentry *dfs_dump_tnc;
 };
 #define ubifs_assert(expr) do {                                                \
@@ -297,7 +302,8 @@ int dbg_walk_index(struct ubifs_info *c, dbg_leaf_callback leaf_cb,
                   dbg_znode_callback znode_cb, void *priv);
 /* Checking functions */
+void dbg_save_space_info(struct ubifs_info *c);
+int dbg_check_space_info(struct ubifs_info *c);
 int dbg_check_lprops(struct ubifs_info *c);
 int dbg_old_index_check_init(struct ubifs_info *c, struct ubifs_zbranch *zroot);
 int dbg_check_old_index(struct ubifs_info *c, struct ubifs_zbranch *zroot);
@@ -439,6 +445,8 @@ void dbg_debugfs_exit_fs(struct ubifs_info *c);
 #define dbg_walk_index(c, leaf_cb, znode_cb, priv) 0
 #define dbg_old_index_check_init(c, zroot)         0
+#define dbg_save_space_info(c)                     ({})
+#define dbg_check_space_info(c)                    0
 #define dbg_check_old_index(c, zroot)              0
 #define dbg_check_cats(c)                          0
 #define dbg_check_ltab(c)                          0
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index f448ab1f9c38..f55d523c52bb 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -482,30 +482,29 @@ static int ubifs_dir_release(struct inode *dir, struct file *file)
 }
 /**
- * lock_2_inodes - lock two UBIFS inodes.
+ * lock_2_inodes - a wrapper for locking two UBIFS inodes.
 * @inode1: first inode
 * @inode2: second inode
+ *
+ * We do not implement any tricks to guarantee strict lock ordering, because
+ * VFS has already done it for us on the @i_mutex. So this is just a simple
+ * wrapper function.
 */
 static void lock_2_inodes(struct inode *inode1, struct inode *inode2)
 {
-        if (inode1->i_ino < inode2->i_ino) {
+        mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_1);
-                mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_2);
+        mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_2);
-                mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_3);
-        } else {
-                mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_2);
-                mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_3);
-        }
 }
 /**
- * unlock_2_inodes - unlock two UBIFS inodes inodes.
+ * unlock_2_inodes - a wrapper for unlocking two UBIFS inodes.
 * @inode1: first inode
 * @inode2: second inode
 */
 static void unlock_2_inodes(struct inode *inode1, struct inode *inode2)
 {
-        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
        mutex_unlock(&ubifs_inode(inode2)->ui_mutex);
+        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
 }
 static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
@@ -527,6 +526,8 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
        dbg_gen("dent '%.*s' to ino %lu (nlink %d) in dir ino %lu",
                dentry->d_name.len, dentry->d_name.name, inode->i_ino,
                inode->i_nlink, dir->i_ino);
+        ubifs_assert(mutex_is_locked(&dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&inode->i_mutex));
        err = dbg_check_synced_i_size(inode);
        if (err)
                return err;
@@ -580,6 +581,8 @@ static int ubifs_unlink(struct inode *dir, struct dentry *dentry)
        dbg_gen("dent '%.*s' from ino %lu (nlink %d) in dir ino %lu",
                dentry->d_name.len, dentry->d_name.name, inode->i_ino,
                inode->i_nlink, dir->i_ino);
+        ubifs_assert(mutex_is_locked(&dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&inode->i_mutex));
        err = dbg_check_synced_i_size(inode);
        if (err)
                return err;
@@ -667,7 +670,8 @@ static int ubifs_rmdir(struct inode *dir, struct dentry *dentry)
        dbg_gen("directory '%.*s', ino %lu in dir ino %lu", dentry->d_name.len,
                dentry->d_name.name, inode->i_ino, dir->i_ino);
+        ubifs_assert(mutex_is_locked(&dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&inode->i_mutex));
        err = check_dir_empty(c, dentry->d_inode);
        if (err)
                return err;
@@ -922,59 +926,30 @@ out_budg:
 }
 /**
- * lock_3_inodes - lock three UBIFS inodes for rename.
+ * lock_3_inodes - a wrapper for locking three UBIFS inodes.
 * @inode1: first inode
 * @inode2: second inode
 * @inode3: third inode
 *
- * For 'ubifs_rename()', @inode1 may be the same as @inode2 whereas @inode3 may
+ * This function is used for 'ubifs_rename()' and @inode1 may be the same as
- * be null.
+ * @inode2 whereas @inode3 may be %NULL.
+ *
+ * We do not implement any tricks to guarantee strict lock ordering, because
+ * VFS has already done it for us on the @i_mutex. So this is just a simple
+ * wrapper function.
 */
 static void lock_3_inodes(struct inode *inode1, struct inode *inode2,
                          struct inode *inode3)
 {
-        struct inode *i1, *i2, *i3;
+        mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_1);
+        if (inode2 != inode1)
-        if (!inode3) {
+                mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_2);
-                if (inode1 != inode2) {
+        if (inode3)
-                        lock_2_inodes(inode1, inode2);
+                mutex_lock_nested(&ubifs_inode(inode3)->ui_mutex, WB_MUTEX_3);
-                        return;
-                }
-                mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_1);
-                return;
-        }
-        if (inode1 == inode2) {
-                lock_2_inodes(inode1, inode3);
-                return;
-        }
-        /* 3 different inodes */
-        if (inode1 < inode2) {
-                i3 = inode2;
-                if (inode1 < inode3) {
-                        i1 = inode1;
-                        i2 = inode3;
-                } else {
-                        i1 = inode3;
-                        i2 = inode1;
-                }
-        } else {
-                i3 = inode1;
-                if (inode2 < inode3) {
-                        i1 = inode2;
-                        i2 = inode3;
-                } else {
-                        i1 = inode3;
-                        i2 = inode2;
-                }
-        }
-        mutex_lock_nested(&ubifs_inode(i1)->ui_mutex, WB_MUTEX_1);
-        lock_2_inodes(i2, i3);
 }
 /**
- * unlock_3_inodes - unlock three UBIFS inodes for rename.
+ * unlock_3_inodes - a wrapper for unlocking three UBIFS inodes for rename.
 * @inode1: first inode
 * @inode2: second inode
 * @inode3: third inode
@@ -982,11 +957,11 @@ static void lock_3_inodes(struct inode *inode1, struct inode *inode2,
 static void unlock_3_inodes(struct inode *inode1, struct inode *inode2,
                            struct inode *inode3)
 {
-        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
-        if (inode1 != inode2)
-                mutex_unlock(&ubifs_inode(inode2)->ui_mutex);
        if (inode3)
                mutex_unlock(&ubifs_inode(inode3)->ui_mutex);
+        if (inode1 != inode2)
+                mutex_unlock(&ubifs_inode(inode2)->ui_mutex);
+        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
 }
 static int ubifs_rename(struct inode *old_dir, struct dentry *old_dentry,
@@ -1020,6 +995,11 @@ static int ubifs_rename(struct inode *old_dir, struct dentry *old_dentry,
                "dir ino %lu", old_dentry->d_name.len, old_dentry->d_name.name,
                old_inode->i_ino, old_dir->i_ino, new_dentry->d_name.len,
                new_dentry->d_name.name, new_dir->i_ino);
+        ubifs_assert(mutex_is_locked(&old_dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&new_dir->i_mutex));
+        if (unlink)
+                ubifs_assert(mutex_is_locked(&new_inode->i_mutex));
        if (unlink && is_dir) {
                err = check_dir_empty(c, new_inode);
@@ -1199,7 +1179,7 @@ int ubifs_getattr(struct vfsmount *mnt, struct dentry *dentry,
        return 0;
 }
-struct inode_operations ubifs_dir_inode_operations = {
+const struct inode_operations ubifs_dir_inode_operations = {
        .lookup      = ubifs_lookup,
        .create      = ubifs_create,
        .link        = ubifs_link,
@@ -1219,7 +1199,7 @@ struct inode_operations ubifs_dir_inode_operations = {
 #endif
 };
-struct file_operations ubifs_dir_operations = {
+const struct file_operations ubifs_dir_operations = {
        .llseek         = ubifs_dir_llseek,
        .release        = ubifs_dir_release,
        .read           = generic_read_dir,
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index bf37374567fa..93b6de51f261 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -432,7 +432,6 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping,
        int uninitialized_var(err), appending = !!(pos + len > inode->i_size);
        struct page *page;
        ubifs_assert(ubifs_inode(inode)->ui_size == inode->i_size);
        if (unlikely(c->ro_media))
@@ -1541,7 +1540,7 @@ static int ubifs_file_mmap(struct file *file, struct vm_area_struct *vma)
        return 0;
 }
-struct address_space_operations ubifs_file_address_operations = {
+const struct address_space_operations ubifs_file_address_operations = {
        .readpage       = ubifs_readpage,
        .writepage      = ubifs_writepage,
        .write_begin    = ubifs_write_begin,
@@ -1551,7 +1550,7 @@ struct address_space_operations ubifs_file_address_operations = {
        .releasepage    = ubifs_releasepage,
 };
-struct inode_operations ubifs_file_inode_operations = {
+const struct inode_operations ubifs_file_inode_operations = {
        .setattr     = ubifs_setattr,
        .getattr     = ubifs_getattr,
 #ifdef CONFIG_UBIFS_FS_XATTR
@@ -1562,14 +1561,14 @@ struct inode_operations ubifs_file_inode_operations = {
 #endif
 };
-struct inode_operations ubifs_symlink_inode_operations = {
+const struct inode_operations ubifs_symlink_inode_operations = {
        .readlink    = generic_readlink,
        .follow_link = ubifs_follow_link,
        .setattr     = ubifs_setattr,
        .getattr     = ubifs_getattr,
 };
-struct file_operations ubifs_file_operations = {
+const struct file_operations ubifs_file_operations = {
        .llseek         = generic_file_llseek,
        .read           = do_sync_read,
        .write          = do_sync_write,
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 9832f9abe28e..a711d33b3d3e 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -31,6 +31,26 @@
 * to be reused. Garbage collection will cause the number of dirty index nodes
 * to grow, however sufficient space is reserved for the index to ensure the
 * commit will never run out of space.
+ *
+ * Notes about dead watermark. At current UBIFS implementation we assume that
+ * LEBs which have less than @c->dead_wm bytes of free + dirty space are full
+ * and not worth garbage-collecting. The dead watermark is one min. I/O unit
+ * size, or min. UBIFS node size, depending on what is greater. Indeed, UBIFS
+ * Garbage Collector has to synchronize the GC head's write buffer before
+ * returning, so this is about wasting one min. I/O unit. However, UBIFS GC can
+ * actually reclaim even very small pieces of dirty space by garbage collecting
+ * enough dirty LEBs, but we do not bother doing this at this implementation.
+ *
+ * Notes about dark watermark. The results of GC work depends on how big are
+ * the UBIFS nodes GC deals with. Large nodes make GC waste more space. Indeed,
+ * if GC move data from LEB A to LEB B and nodes in LEB A are large, GC would
+ * have to waste large pieces of free space at the end of LEB B, because nodes
+ * from LEB A would not fit. And the worst situation is when all nodes are of
+ * maximum size. So dark watermark is the amount of free + dirty space in LEB
+ * which are guaranteed to be reclaimable. If LEB has less space, the GC migh
+ * be unable to reclaim it. So, LEBs with free + dirty greater than dark
+ * watermark are "good" LEBs from GC's point of few. The other LEBs are not so
+ * good, and GC takes extra care when moving them.
 */
 #include <linux/pagemap.h>
@@ -381,7 +401,7 @@ int ubifs_garbage_collect_leb(struct ubifs_info *c, struct ubifs_lprops *lp)
                /*
                 * Don't release the LEB until after the next commit, because
-                 * it may contain date which is needed for recovery. So
+                 * it may contain data which is needed for recovery. So
                 * although we freed this LEB, it will become usable only after
                 * the commit.
                 */
@@ -810,8 +830,9 @@ out:
 * ubifs_destroy_idx_gc - destroy idx_gc list.
 * @c: UBIFS file-system description object
 *
- * This function destroys the idx_gc list. It is called when unmounting or
+ * This function destroys the @c->idx_gc list. It is called when unmounting
- * remounting read-only so locks are not needed.
+ * so locks are not needed. Returns zero in case of success and a negative
+ * error code in case of failure.
 */
 void ubifs_destroy_idx_gc(struct ubifs_info *c)
 {
@@ -824,7 +845,6 @@ void ubifs_destroy_idx_gc(struct ubifs_info *c)
                list_del(&idx_gc->list);
                kfree(idx_gc);
        }
 }
 /**
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index 01682713af69..e8e632a1dcdf 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -29,7 +29,7 @@
 * would have been wasted for padding to the nearest minimal I/O unit boundary.
 * Instead, data first goes to the write-buffer and is flushed when the
 * buffer is full or when it is not used for some time (by timer). This is
- * similarto the mechanism is used by JFFS2.
+ * similar to the mechanism is used by JFFS2.
 *
 * Write-buffers are defined by 'struct ubifs_wbuf' objects and protected by
 * mutexes defined inside these objects. Since sometimes upper-level code
@@ -75,7 +75,7 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
 * @lnum: logical eraseblock number
 * @offs: offset within the logical eraseblock
 * @quiet: print no messages
- * @chk_crc: indicates whether to always check the CRC
+ * @must_chk_crc: indicates whether to always check the CRC
 *
 * This function checks node magic number and CRC checksum. This function also
 * validates node length to prevent UBIFS from becoming crazy when an attacker
@@ -83,11 +83,17 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
 * node length in the common header could cause UBIFS to read memory outside of
 * allocated buffer when checking the CRC checksum.
 *
- * This function returns zero in case of success %-EUCLEAN in case of bad CRC
+ * This function may skip data nodes CRC checking if @c->no_chk_data_crc is
- * or magic.
+ * true, which is controlled by corresponding UBIFS mount option. However, if
+ * @must_chk_crc is true, then @c->no_chk_data_crc is ignored and CRC is
+ * checked. Similarly, if @c->always_chk_crc is true, @c->no_chk_data_crc is
+ * ignored and CRC is checked.
+ *
+ * This function returns zero in case of success and %-EUCLEAN in case of bad
+ * CRC or magic.
 */
 int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
-                     int offs, int quiet, int chk_crc)
+                     int offs, int quiet, int must_chk_crc)
 {
        int err = -EINVAL, type, node_len;
        uint32_t crc, node_crc, magic;
@@ -123,9 +129,9 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
                   node_len > c->ranges[type].max_len)
                goto out_len;
-        if (!chk_crc && type == UBIFS_DATA_NODE && !c->always_chk_crc)
+        if (!must_chk_crc && type == UBIFS_DATA_NODE && !c->always_chk_crc &&
-                if (c->no_chk_data_crc)
+             c->no_chk_data_crc)
-                        return 0;
+                return 0;
        crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
        node_crc = le32_to_cpu(ch->crc);
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index 9b7c54e0cd2a..a11ca0958a23 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -208,7 +208,7 @@ again:
        offs = 0;
 out:
-        err = ubifs_wbuf_seek_nolock(wbuf, lnum, offs, UBI_SHORTTERM);
+        err = ubifs_wbuf_seek_nolock(wbuf, lnum, offs, wbuf->dtype);
        if (err)
                goto out_unlock;
diff --git a/fs/ubifs/lprops.c b/fs/ubifs/lprops.c
index dfd2bcece27a..4cdd284dea56 100644
--- a/fs/ubifs/lprops.c
+++ b/fs/ubifs/lprops.c
@@ -635,10 +635,10 @@ const struct ubifs_lprops *ubifs_change_lp(struct ubifs_info *c,
 * @c: UBIFS file-system description object
 * @st: return statistics
 */
-void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *st)
+void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *lst)
 {
        spin_lock(&c->space_lock);
-        memcpy(st, &c->lst, sizeof(struct ubifs_lp_stats));
+        memcpy(lst, &c->lst, sizeof(struct ubifs_lp_stats));
        spin_unlock(&c->space_lock);
 }
@@ -678,6 +678,9 @@ int ubifs_change_one_lp(struct ubifs_info *c, int lnum, int free, int dirty,
 out:
        ubifs_release_lprops(c);
+        if (err)
+                ubifs_err("cannot change properties of LEB %d, error %d",
+                          lnum, err);
        return err;
 }
@@ -714,6 +717,9 @@ int ubifs_update_one_lp(struct ubifs_info *c, int lnum, int free, int dirty,
 out:
        ubifs_release_lprops(c);
+        if (err)
+                ubifs_err("cannot update properties of LEB %d, error %d",
+                          lnum, err);
        return err;
 }
@@ -737,6 +743,8 @@ int ubifs_read_one_lp(struct ubifs_info *c, int lnum, struct ubifs_lprops *lp)
        lpp = ubifs_lpt_lookup(c, lnum);
        if (IS_ERR(lpp)) {
                err = PTR_ERR(lpp);
+                ubifs_err("cannot read properties of LEB %d, error %d",
+                          lnum, err);
                goto out;
        }
diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
index 96ca95707175..3216a1f277f8 100644
--- a/fs/ubifs/lpt_commit.c
+++ b/fs/ubifs/lpt_commit.c
@@ -556,23 +556,23 @@ no_space:
 }
 /**
- * next_pnode - find next pnode.
+ * next_pnode_to_dirty - find next pnode to dirty.
 * @c: UBIFS file-system description object
 * @pnode: pnode
 *
- * This function returns the next pnode or %NULL if there are no more pnodes.
+ * This function returns the next pnode to dirty or %NULL if there are no more
+ * pnodes.  Note that pnodes that have never been written (lnum == 0) are
+ * skipped.
 */
-static struct ubifs_pnode *next_pnode(struct ubifs_info *c,
+static struct ubifs_pnode *next_pnode_to_dirty(struct ubifs_info *c,
-                                      struct ubifs_pnode *pnode)
+                                               struct ubifs_pnode *pnode)
 {
        struct ubifs_nnode *nnode;
        int iip;
        /* Try to go right */
        nnode = pnode->parent;
-        iip = pnode->iip + 1;
+        for (iip = pnode->iip + 1; iip < UBIFS_LPT_FANOUT; iip++) {
-        if (iip < UBIFS_LPT_FANOUT) {
-                /* We assume here that LEB zero is never an LPT LEB */
                if (nnode->nbranch[iip].lnum)
                        return ubifs_get_pnode(c, nnode, iip);
        }
@@ -583,8 +583,11 @@ static struct ubifs_pnode *next_pnode(struct ubifs_info *c,
                nnode = nnode->parent;
                if (!nnode)
                        return NULL;
-                /* We assume here that LEB zero is never an LPT LEB */
+                for (; iip < UBIFS_LPT_FANOUT; iip++) {
-        } while (iip >= UBIFS_LPT_FANOUT || !nnode->nbranch[iip].lnum);
+                        if (nnode->nbranch[iip].lnum)
+                                break;
+                }
+       } while (iip >= UBIFS_LPT_FANOUT);
        /* Go right */
        nnode = ubifs_get_nnode(c, nnode, iip);
@@ -593,12 +596,29 @@ static struct ubifs_pnode *next_pnode(struct ubifs_info *c,
        /* Go down to level 1 */
        while (nnode->level > 1) {
-                nnode = ubifs_get_nnode(c, nnode, 0);
+                for (iip = 0; iip < UBIFS_LPT_FANOUT; iip++) {
+                        if (nnode->nbranch[iip].lnum)
+                                break;
+                }
+                if (iip >= UBIFS_LPT_FANOUT) {
+                        /*
+                         * Should not happen, but we need to keep going
+                         * if it does.
+                         */
+                        iip = 0;
+                }
+                nnode = ubifs_get_nnode(c, nnode, iip);
                if (IS_ERR(nnode))
                        return (void *)nnode;
        }
-        return ubifs_get_pnode(c, nnode, 0);
+        for (iip = 0; iip < UBIFS_LPT_FANOUT; iip++)
+                if (nnode->nbranch[iip].lnum)
+                        break;
+        if (iip >= UBIFS_LPT_FANOUT)
+                /* Should not happen, but we need to keep going if it does */
+                iip = 0;
+        return ubifs_get_pnode(c, nnode, iip);
 }
 /**
@@ -688,7 +708,7 @@ static int make_tree_dirty(struct ubifs_info *c)
        pnode = pnode_lookup(c, 0);
        while (pnode) {
                do_make_pnode_dirty(c, pnode);
-                pnode = next_pnode(c, pnode);
+                pnode = next_pnode_to_dirty(c, pnode);
                if (IS_ERR(pnode))
                        return PTR_ERR(pnode);
        }
diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c
index 71d5493bf565..a88f33801b98 100644
--- a/fs/ubifs/master.c
+++ b/fs/ubifs/master.c
@@ -354,7 +354,7 @@ int ubifs_write_master(struct ubifs_info *c)
        int err, lnum, offs, len;
        if (c->ro_media)
-                return -EINVAL;
+                return -EROFS;
        lnum = UBIFS_MST_LNUM;
        offs = c->mst_offs + c->mst_node_alsz;
diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c
index 9e6f403f170e..152a7b34a141 100644
--- a/fs/ubifs/orphan.c
+++ b/fs/ubifs/orphan.c
@@ -46,7 +46,7 @@
 * Orphans are accumulated in a rb-tree. When an inode's link count drops to
 * zero, the inode number is added to the rb-tree. It is removed from the tree
 * when the inode is deleted.  Any new orphans that are in the orphan tree when
- * the commit is run, are written to the orphan area in 1 or more orph nodes.
+ * the commit is run, are written to the orphan area in 1 or more orphan nodes.
 * If the orphan area is full, it is consolidated to make space.  There is
 * always enough space because validation prevents the user from creating more
 * than the maximum number of orphans allowed.
@@ -231,7 +231,7 @@ static int tot_avail_orphs(struct ubifs_info *c)
 }
 /**
- * do_write_orph_node - write a node
+ * do_write_orph_node - write a node to the orphan head.
 * @c: UBIFS file-system description object
 * @len: length of node
 * @atomic: write atomically
@@ -264,11 +264,11 @@ static int do_write_orph_node(struct ubifs_info *c, int len, int atomic)
 }
 /**
- * write_orph_node - write an orph node
+ * write_orph_node - write an orphan node.
 * @c: UBIFS file-system description object
 * @atomic: write atomically
 *
- * This function builds an orph node from the cnext list and writes it to the
+ * This function builds an orphan node from the cnext list and writes it to the
 * orphan head. On success, %0 is returned, otherwise a negative error code
 * is returned.
 */
@@ -326,11 +326,11 @@ static int write_orph_node(struct ubifs_info *c, int atomic)
 }
 /**
- * write_orph_nodes - write orph nodes until there are no more to commit
+ * write_orph_nodes - write orphan nodes until there are no more to commit.
 * @c: UBIFS file-system description object
 * @atomic: write atomically
 *
- * This function writes orph nodes for all the orphans to commit. On success,
+ * This function writes orphan nodes for all the orphans to commit. On success,
 * %0 is returned, otherwise a negative error code is returned.
 */
 static int write_orph_nodes(struct ubifs_info *c, int atomic)
@@ -478,14 +478,14 @@ int ubifs_orphan_end_commit(struct ubifs_info *c)
 }
 /**
- * clear_orphans - erase all LEBs used for orphans.
+ * ubifs_clear_orphans - erase all LEBs used for orphans.
 * @c: UBIFS file-system description object
 *
 * If recovery is not required, then the orphans from the previous session
 * are not needed. This function locates the LEBs used to record
 * orphans, and un-maps them.
 */
-static int clear_orphans(struct ubifs_info *c)
+int ubifs_clear_orphans(struct ubifs_info *c)
 {
        int lnum, err;
@@ -547,9 +547,9 @@ static int insert_dead_orphan(struct ubifs_info *c, ino_t inum)
 * do_kill_orphans - remove orphan inodes from the index.
 * @c: UBIFS file-system description object
 * @sleb: scanned LEB
- * @last_cmt_no: cmt_no of last orph node read is passed and returned here
+ * @last_cmt_no: cmt_no of last orphan node read is passed and returned here
 * @outofdate: whether the LEB is out of date is returned here
- * @last_flagged: whether the end orph node is encountered
+ * @last_flagged: whether the end orphan node is encountered
 *
 * This function is a helper to the 'kill_orphans()' function. It goes through
 * every orphan node in a LEB and for every inode number recorded, removes
@@ -580,8 +580,8 @@ static int do_kill_orphans(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
                /*
                 * The commit number on the master node may be less, because
                 * of a failed commit. If there are several failed commits in a
-                 * row, the commit number written on orph nodes will continue to
+                 * row, the commit number written on orphan nodes will continue
-                 * increase (because the commit number is adjusted here) even
+                 * to increase (because the commit number is adjusted here) even
                 * though the commit number on the master node stays the same
                 * because the master node has not been re-written.
                 */
@@ -589,9 +589,9 @@ static int do_kill_orphans(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
                        c->cmt_no = cmt_no;
                if (cmt_no < *last_cmt_no && *last_flagged) {
                        /*
-                         * The last orph node had a higher commit number and was
+                         * The last orphan node had a higher commit number and
-                         * flagged as the last written for that commit number.
+                         * was flagged as the last written for that commit
-                         * That makes this orph node, out of date.
+                         * number. That makes this orphan node, out of date.
                         */
                        if (!first) {
                                ubifs_err("out of order commit number %llu in "
@@ -658,10 +658,10 @@ static int kill_orphans(struct ubifs_info *c)
        /*
         * Orph nodes always start at c->orph_first and are written to each
         * successive LEB in turn. Generally unused LEBs will have been unmapped
-         * but may contain out of date orph nodes if the unmap didn't go
+         * but may contain out of date orphan nodes if the unmap didn't go
-         * through. In addition, the last orph node written for each commit is
+         * through. In addition, the last orphan node written for each commit is
         * marked (top bit of orph->cmt_no is set to 1). It is possible that
-         * there are orph nodes from the next commit (i.e. the commit did not
+         * there are orphan nodes from the next commit (i.e. the commit did not
         * complete successfully). In that case, no orphans will have been lost
         * due to the way that orphans are written, and any orphans added will
         * be valid orphans anyway and so can be deleted.
@@ -718,7 +718,7 @@ int ubifs_mount_orphans(struct ubifs_info *c, int unclean, int read_only)
        if (unclean)
                err = kill_orphans(c);
        else if (!read_only)
-                err = clear_orphans(c);
+                err = ubifs_clear_orphans(c);
        return err;
 }
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 89556ee72518..1182b66a5491 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -397,6 +397,7 @@ static int ubifs_statfs(struct dentry *dentry, struct kstatfs *buf)
        buf->f_namelen = UBIFS_MAX_NLEN;
        buf->f_fsid.val[0] = le32_to_cpu(uuid[0]) ^ le32_to_cpu(uuid[2]);
        buf->f_fsid.val[1] = le32_to_cpu(uuid[1]) ^ le32_to_cpu(uuid[3]);
+        ubifs_assert(buf->f_bfree <= c->block_cnt);
        return 0;
 }
@@ -432,33 +433,24 @@ static int ubifs_sync_fs(struct super_block *sb, int wait)
        int i, err;
        struct ubifs_info *c = sb->s_fs_info;
        struct writeback_control wbc = {
-                .sync_mode   = wait ? WB_SYNC_ALL : WB_SYNC_NONE,
+                .sync_mode   = WB_SYNC_ALL,
                .range_start = 0,
                .range_end   = LLONG_MAX,
                .nr_to_write = LONG_MAX,
        };
        /*
-         * Note by akpm about WB_SYNC_NONE used above: zero @wait is just an
+         * Zero @wait is just an advisory thing to help the file system shove
-         * advisory thing to help the file system shove lots of data into the
+         * lots of data into the queues, and there will be the second
-         * queues. If some gets missed then it'll be picked up on the second
         * '->sync_fs()' call, with non-zero @wait.
         */
+        if (!wait)
+                return 0;
        if (sb->s_flags & MS_RDONLY)
                return 0;
        /*
-         * Synchronize write buffers, because 'ubifs_run_commit()' does not
-         * do this if it waits for an already running commit.
-         */
-        for (i = 0; i < c->jhead_cnt; i++) {
-                err = ubifs_wbuf_sync(&c->jheads[i].wbuf);
-                if (err)
-                        return err;
-        }
-        /*
         * VFS calls '->sync_fs()' before synchronizing all dirty inodes and
         * pages, so synchronize them first, then commit the journal. Strictly
         * speaking, it is not necessary to commit the journal here,
@@ -469,6 +461,16 @@ static int ubifs_sync_fs(struct super_block *sb, int wait)
         */
        generic_sync_sb_inodes(sb, &wbc);
+        /*
+         * Synchronize write buffers, because 'ubifs_run_commit()' does not
+         * do this if it waits for an already running commit.
+         */
+        for (i = 0; i < c->jhead_cnt; i++) {
+                err = ubifs_wbuf_sync(&c->jheads[i].wbuf);
+                if (err)
+                        return err;
+        }
        err = ubifs_run_commit(c);
        if (err)
                return err;
@@ -572,15 +574,8 @@ static int init_constants_early(struct ubifs_info *c)
        c->ranges[UBIFS_IDX_NODE].max_len = INT_MAX;
        /*
-         * Initialize dead and dark LEB space watermarks.
+         * Initialize dead and dark LEB space watermarks. See gc.c for comments
-         *
+         * about these values.
-         * Dead space is the space which cannot be used. Its watermark is
-         * equivalent to min. I/O unit or minimum node size if it is greater
-         * then min. I/O unit.
-         *
-         * Dark space is the space which might be used, or might not, depending
-         * on which node should be written to the LEB. Its watermark is
-         * equivalent to maximum UBIFS node size.
         */
        c->dead_wm = ALIGN(MIN_WRITE_SZ, c->min_io_size);
        c->dark_wm = ALIGN(UBIFS_MAX_NODE_SZ, c->min_io_size);
@@ -741,12 +736,12 @@ static void init_constants_master(struct ubifs_info *c)
 * take_gc_lnum - reserve GC LEB.
 * @c: UBIFS file-system description object
 *
- * This function ensures that the LEB reserved for garbage collection is
+ * This function ensures that the LEB reserved for garbage collection is marked
- * unmapped and is marked as "taken" in lprops. We also have to set free space
+ * as "taken" in lprops. We also have to set free space to LEB size and dirty
- * to LEB size and dirty space to zero, because lprops may contain out-of-date
+ * space to zero, because lprops may contain out-of-date information if the
- * information if the file-system was un-mounted before it has been committed.
+ * file-system was un-mounted before it has been committed. This function
- * This function returns zero in case of success and a negative error code in
+ * returns zero in case of success and a negative error code in case of
- * case of failure.
+ * failure.
 */
 static int take_gc_lnum(struct ubifs_info *c)
 {
@@ -757,10 +752,6 @@ static int take_gc_lnum(struct ubifs_info *c)
                return -EINVAL;
        }
-        err = ubifs_leb_unmap(c, c->gc_lnum);
-        if (err)
-                return err;
        /* And we have to tell lprops that this LEB is taken */
        err = ubifs_change_one_lp(c, c->gc_lnum, c->leb_size, 0,
                                  LPROPS_TAKEN, 0, 0);
@@ -966,13 +957,16 @@ static int ubifs_parse_options(struct ubifs_info *c, char *options,
                token = match_token(p, tokens, args);
                switch (token) {
+                /*
+                 * %Opt_fast_unmount and %Opt_norm_unmount options are ignored.
+                 * We accepte them in order to be backware-compatible. But this
+                 * should be removed at some point.
+                 */
                case Opt_fast_unmount:
                        c->mount_opts.unmount_mode = 2;
-                        c->fast_unmount = 1;
                        break;
                case Opt_norm_unmount:
                        c->mount_opts.unmount_mode = 1;
-                        c->fast_unmount = 0;
                        break;
                case Opt_bulk_read:
                        c->mount_opts.bulk_read = 2;
@@ -1094,12 +1088,7 @@ static int check_free_space(struct ubifs_info *c)
                ubifs_err("insufficient free space to mount in read/write mode");
                dbg_dump_budg(c);
                dbg_dump_lprops(c);
-                /*
+                return -ENOSPC;
-                 * We return %-EINVAL instead of %-ENOSPC because it seems to
-                 * be the closest error code mentioned in the mount function
-                 * documentation.
-                 */
-                return -EINVAL;
        }
        return 0;
 }
@@ -1286,10 +1275,19 @@ static int mount_ubifs(struct ubifs_info *c)
                        if (err)
                                goto out_orphans;
                        err = ubifs_rcvry_gc_commit(c);
-                } else
+                } else {
                        err = take_gc_lnum(c);
-                if (err)
+                        if (err)
-                        goto out_orphans;
+                                goto out_orphans;
+                        /*
+                         * GC LEB may contain garbage if there was an unclean
+                         * reboot, and it should be un-mapped.
+                         */
+                        err = ubifs_leb_unmap(c, c->gc_lnum);
+                        if (err)
+                                return err;
+                }
                err = dbg_check_lprops(c);
                if (err)
@@ -1298,6 +1296,16 @@ static int mount_ubifs(struct ubifs_info *c)
                err = ubifs_recover_size(c);
                if (err)
                        goto out_orphans;
+        } else {
+                /*
+                 * Even if we mount read-only, we have to set space in GC LEB
+                 * to proper value because this affects UBIFS free space
+                 * reporting. We do not want to have a situation when
+                 * re-mounting from R/O to R/W changes amount of free space.
+                 */
+                err = take_gc_lnum(c);
+                if (err)
+                        goto out_orphans;
        }
        spin_lock(&ubifs_infos_lock);
@@ -1310,14 +1318,17 @@ static int mount_ubifs(struct ubifs_info *c)
                else {
                        c->need_recovery = 0;
                        ubifs_msg("recovery completed");
+                        /* GC LEB has to be empty and taken at this point */
+                        ubifs_assert(c->lst.taken_empty_lebs == 1);
                }
-        }
+        } else
+                ubifs_assert(c->lst.taken_empty_lebs == 1);
-        err = dbg_debugfs_init_fs(c);
+        err = dbg_check_filesystem(c);
        if (err)
                goto out_infos;
-        err = dbg_check_filesystem(c);
+        err = dbg_debugfs_init_fs(c);
        if (err)
                goto out_infos;
@@ -1351,7 +1362,6 @@ static int mount_ubifs(struct ubifs_info *c)
               c->uuid[4], c->uuid[5], c->uuid[6], c->uuid[7],
               c->uuid[8], c->uuid[9], c->uuid[10], c->uuid[11],
               c->uuid[12], c->uuid[13], c->uuid[14], c->uuid[15]);
-        dbg_msg("fast unmount:        %d", c->fast_unmount);
        dbg_msg("big_lpt              %d", c->big_lpt);
        dbg_msg("log LEBs:            %d (%d - %d)",
                c->log_lebs, UBIFS_LOG_LNUM, c->log_last);
@@ -1475,10 +1485,8 @@ static int ubifs_remount_rw(struct ubifs_info *c)
 {
        int err, lnum;
-        if (c->ro_media)
-                return -EINVAL;
        mutex_lock(&c->umount_mutex);
+        dbg_save_space_info(c);
        c->remounting_rw = 1;
        c->always_chk_crc = 1;
@@ -1514,6 +1522,12 @@ static int ubifs_remount_rw(struct ubifs_info *c)
                err = ubifs_recover_inl_heads(c, c->sbuf);
                if (err)
                        goto out;
+        } else {
+                /* A readonly mount is not allowed to have orphans */
+                ubifs_assert(c->tot_orphans == 0);
+                err = ubifs_clear_orphans(c);
+                if (err)
+                        goto out;
        }
        if (!(c->mst_node->flags & cpu_to_le32(UBIFS_MST_DIRTY))) {
@@ -1569,7 +1583,7 @@ static int ubifs_remount_rw(struct ubifs_info *c)
        if (c->need_recovery)
                err = ubifs_rcvry_gc_commit(c);
        else
-                err = take_gc_lnum(c);
+                err = ubifs_leb_unmap(c, c->gc_lnum);
        if (err)
                goto out;
@@ -1582,8 +1596,9 @@ static int ubifs_remount_rw(struct ubifs_info *c)
        c->vfs_sb->s_flags &= ~MS_RDONLY;
        c->remounting_rw = 0;
        c->always_chk_crc = 0;
+        err = dbg_check_space_info(c);
        mutex_unlock(&c->umount_mutex);
-        return 0;
+        return err;
 out:
        vfree(c->orph_buf);
@@ -1603,43 +1618,18 @@ out:
 }
 /**
- * commit_on_unmount - commit the journal when un-mounting.
- * @c: UBIFS file-system description object
- *
- * This function is called during un-mounting and re-mounting, and it commits
- * the journal unless the "fast unmount" mode is enabled.
- */
-static void commit_on_unmount(struct ubifs_info *c)
-{
-        struct super_block *sb = c->vfs_sb;
-        long long bud_bytes;
-        /*
-         * This function is called before the background thread is stopped, so
-         * we may race with ongoing commit, which means we have to take
-         * @c->bud_lock to access @c->bud_bytes.
-         */
-        spin_lock(&c->buds_lock);
-        bud_bytes = c->bud_bytes;
-        spin_unlock(&c->buds_lock);
-        if (!c->fast_unmount && !(sb->s_flags & MS_RDONLY) && bud_bytes)
-                ubifs_run_commit(c);
-}
-/**
 * ubifs_remount_ro - re-mount in read-only mode.
 * @c: UBIFS file-system description object
 *
- * We rely on VFS to have stopped writing. Possibly the background thread could
+ * We assume VFS has stopped writing. Possibly the background thread could be
- * be running a commit, however kthread_stop will wait in that case.
+ * running a commit, however kthread_stop will wait in that case.
 */
 static void ubifs_remount_ro(struct ubifs_info *c)
 {
        int i, err;
        ubifs_assert(!c->need_recovery);
-        commit_on_unmount(c);
+        ubifs_assert(!(c->vfs_sb->s_flags & MS_RDONLY));
        mutex_lock(&c->umount_mutex);
        if (c->bgt) {
@@ -1647,27 +1637,29 @@ static void ubifs_remount_ro(struct ubifs_info *c)
                c->bgt = NULL;
        }
+        dbg_save_space_info(c);
        for (i = 0; i < c->jhead_cnt; i++) {
                ubifs_wbuf_sync(&c->jheads[i].wbuf);
                del_timer_sync(&c->jheads[i].wbuf.timer);
        }
-        if (!c->ro_media) {
+        c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_DIRTY);
-                c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_DIRTY);
+        c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS);
-                c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS);
+        c->mst_node->gc_lnum = cpu_to_le32(c->gc_lnum);
-                c->mst_node->gc_lnum = cpu_to_le32(c->gc_lnum);
+        err = ubifs_write_master(c);
-                err = ubifs_write_master(c);
+        if (err)
-                if (err)
+                ubifs_ro_mode(c, err);
-                        ubifs_ro_mode(c, err);
-        }
-        ubifs_destroy_idx_gc(c);
        free_wbufs(c);
        vfree(c->orph_buf);
        c->orph_buf = NULL;
        vfree(c->ileb_buf);
        c->ileb_buf = NULL;
        ubifs_lpt_free(c, 1);
+        err = dbg_check_space_info(c);
+        if (err)
+                ubifs_ro_mode(c, err);
        mutex_unlock(&c->umount_mutex);
 }
@@ -1760,11 +1752,20 @@ static int ubifs_remount_fs(struct super_block *sb, int *flags, char *data)
        }
        if ((sb->s_flags & MS_RDONLY) && !(*flags & MS_RDONLY)) {
+                if (c->ro_media) {
+                        ubifs_msg("cannot re-mount due to prior errors");
+                        return -EROFS;
+                }
                err = ubifs_remount_rw(c);
                if (err)
                        return err;
-        } else if (!(sb->s_flags & MS_RDONLY) && (*flags & MS_RDONLY))
+        } else if (!(sb->s_flags & MS_RDONLY) && (*flags & MS_RDONLY)) {
+                if (c->ro_media) {
+                        ubifs_msg("cannot re-mount due to prior errors");
+                        return -EROFS;
+                }
                ubifs_remount_ro(c);
+        }
        if (c->bulk_read == 1)
                bu_init(c);
@@ -1774,10 +1775,11 @@ static int ubifs_remount_fs(struct super_block *sb, int *flags, char *data)
                c->bu.buf = NULL;
        }
+        ubifs_assert(c->lst.taken_empty_lebs == 1);
        return 0;
 }
-struct super_operations ubifs_super_operations = {
+const struct super_operations ubifs_super_operations = {
        .alloc_inode   = ubifs_alloc_inode,
        .destroy_inode = ubifs_destroy_inode,
        .put_super     = ubifs_put_super,
@@ -2044,15 +2046,6 @@ out_close:
 static void ubifs_kill_sb(struct super_block *sb)
 {
-        struct ubifs_info *c = sb->s_fs_info;
-        /*
-         * We do 'commit_on_unmount()' here instead of 'ubifs_put_super()'
-         * in order to be outside BKL.
-         */
-        if (sb->s_root)
-                commit_on_unmount(c);
-        /* The un-mount routine is actually done in put_super() */
        generic_shutdown_super(sb);
 }
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index f7e36f545527..fa28a84c6a1b 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -443,6 +443,11 @@ static int tnc_read_node_nm(struct ubifs_info *c, struct ubifs_zbranch *zbr,
 * This function performs that same function as ubifs_read_node except that
 * it does not require that there is actually a node present and instead
 * the return code indicates if a node was read.
+ *
+ * Note, this function does not check CRC of data nodes if @c->no_chk_data_crc
+ * is true (it is controlled by corresponding mount option). However, if
+ * @c->always_chk_crc is true, @c->no_chk_data_crc is ignored and CRC is always
+ * checked.
 */
 static int try_read_node(const struct ubifs_info *c, void *buf, int type,
                         int len, int lnum, int offs)
@@ -470,9 +475,8 @@ static int try_read_node(const struct ubifs_info *c, void *buf, int type,
        if (node_len != len)
                return 0;
-        if (type == UBIFS_DATA_NODE && !c->always_chk_crc)
+        if (type == UBIFS_DATA_NODE && !c->always_chk_crc && c->no_chk_data_crc)
-                if (c->no_chk_data_crc)
+                return 1;
-                        return 0;
        crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
        node_crc = le32_to_cpu(ch->crc);
@@ -1506,7 +1510,7 @@ out:
 *
 * Note, if the bulk-read buffer length (@bu->buf_len) is known, this function
 * makes sure bulk-read nodes fit the buffer. Otherwise, this function prepares
- * maxumum possible amount of nodes for bulk-read.
+ * maximum possible amount of nodes for bulk-read.
 */
 int ubifs_tnc_get_bu_keys(struct ubifs_info *c, struct bu_info *bu)
 {
diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
index fc2a4cc66d03..039a68bee29a 100644
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -426,9 +426,9 @@ struct ubifs_unclean_leb {
 * LEB properties flags.
 *
 * LPROPS_UNCAT: not categorized
- * LPROPS_DIRTY: dirty > 0, not index
+ * LPROPS_DIRTY: dirty > free, dirty >= @c->dead_wm, not index
 * LPROPS_DIRTY_IDX: dirty + free > @c->min_idx_node_sze and index
- * LPROPS_FREE: free > 0, not empty, not index
+ * LPROPS_FREE: free > 0, dirty < @c->dead_wm, not empty, not index
 * LPROPS_HEAP_CNT: number of heaps used for storing categorized LEBs
 * LPROPS_EMPTY: LEB is empty, not taken
 * LPROPS_FREEABLE: free + dirty == leb_size, not index, not taken
@@ -961,7 +961,6 @@ struct ubifs_debug_info;
 * @cs_lock: commit state lock
 * @cmt_wq: wait queue to sleep on if the log is full and a commit is running
 *
- * @fast_unmount: do not run journal commit before un-mounting
 * @big_lpt: flag that LPT is too big to write whole during commit
 * @no_chk_data_crc: do not check CRCs when reading data nodes (except during
 *                   recovery)
@@ -1202,7 +1201,6 @@ struct ubifs_info {
        spinlock_t cs_lock;
        wait_queue_head_t cmt_wq;
-        unsigned int fast_unmount:1;
        unsigned int big_lpt:1;
        unsigned int no_chk_data_crc:1;
        unsigned int bulk_read:1;
@@ -1405,13 +1403,13 @@ extern struct list_head ubifs_infos;
 extern spinlock_t ubifs_infos_lock;
 extern atomic_long_t ubifs_clean_zn_cnt;
 extern struct kmem_cache *ubifs_inode_slab;
-extern struct super_operations ubifs_super_operations;
+extern const struct super_operations ubifs_super_operations;
-extern struct address_space_operations ubifs_file_address_operations;
+extern const struct address_space_operations ubifs_file_address_operations;
-extern struct file_operations ubifs_file_operations;
+extern const struct file_operations ubifs_file_operations;
-extern struct inode_operations ubifs_file_inode_operations;
+extern const struct inode_operations ubifs_file_inode_operations;
-extern struct file_operations ubifs_dir_operations;
+extern const struct file_operations ubifs_dir_operations;
-extern struct inode_operations ubifs_dir_inode_operations;
+extern const struct inode_operations ubifs_dir_inode_operations;
-extern struct inode_operations ubifs_symlink_inode_operations;
+extern const struct inode_operations ubifs_symlink_inode_operations;
 extern struct backing_dev_info ubifs_backing_dev_info;
 extern struct ubifs_compressor *ubifs_compressors[UBIFS_COMPR_TYPES_CNT];
@@ -1428,7 +1426,7 @@ int ubifs_read_node_wbuf(struct ubifs_wbuf *wbuf, void *buf, int type, int len,
 int ubifs_write_node(struct ubifs_info *c, void *node, int len, int lnum,
                     int offs, int dtype);
 int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
-                     int offs, int quiet, int chk_crc);
+                     int offs, int quiet, int must_chk_crc);
 void ubifs_prepare_node(struct ubifs_info *c, void *buf, int len, int pad);
 void ubifs_prep_grp_node(struct ubifs_info *c, void *node, int len, int last);
 int ubifs_io_init(struct ubifs_info *c);
@@ -1495,6 +1493,7 @@ void ubifs_release_ino_dirty(struct ubifs_info *c, struct inode *inode,
 void ubifs_cancel_ino_op(struct ubifs_info *c, struct inode *inode,
                         struct ubifs_budget_req *req);
 long long ubifs_get_free_space(struct ubifs_info *c);
+long long ubifs_get_free_space_nolock(struct ubifs_info *c);
 int ubifs_calc_min_idx_lebs(struct ubifs_info *c);
 void ubifs_convert_page_budget(struct ubifs_info *c);
 long long ubifs_reported_space(const struct ubifs_info *c, long long free);
@@ -1603,6 +1602,7 @@ void ubifs_delete_orphan(struct ubifs_info *c, ino_t inum);
 int ubifs_orphan_start_commit(struct ubifs_info *c);
 int ubifs_orphan_end_commit(struct ubifs_info *c);
 int ubifs_mount_orphans(struct ubifs_info *c, int unclean, int read_only);
+int ubifs_clear_orphans(struct ubifs_info *c);
 /* lpt.c */
 int ubifs_calc_lpt_geom(struct ubifs_info *c);
@@ -1646,7 +1646,7 @@ const struct ubifs_lprops *ubifs_change_lp(struct ubifs_info *c,
                                           const struct ubifs_lprops *lp,
                                           int free, int dirty, int flags,
                                           int idx_gc_cnt);
-void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *stats);
+void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *lst);
 void ubifs_add_to_cat(struct ubifs_info *c, struct ubifs_lprops *lprops,
                      int cat);
 void ubifs_replace_cat(struct ubifs_info *c, struct ubifs_lprops *old_lprops,
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index d71dc44e21ed..cb329edc925b 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -166,6 +166,75 @@ test_page_region(
 }
 /*
+ *      Mapping of multi-page buffers into contiguous virtual space
+ */
+typedef struct a_list {
+        void            *vm_addr;
+        struct a_list   *next;
+} a_list_t;
+static a_list_t         *as_free_head;
+static int              as_list_len;
+static DEFINE_SPINLOCK(as_lock);
+/*
+ *      Try to batch vunmaps because they are costly.
+ */
+STATIC void
+free_address(
+        void            *addr)
+{
+        a_list_t        *aentry;
+#ifdef CONFIG_XEN
+        /*
+         * Xen needs to be able to make sure it can get an exclusive
+         * RO mapping of pages it wants to turn into a pagetable.  If
+         * a newly allocated page is also still being vmap()ed by xfs,
+         * it will cause pagetable construction to fail.  This is a
+         * quick workaround to always eagerly unmap pages so that Xen
+         * is happy.
+         */
+        vunmap(addr);
+        return;
+#endif
+        aentry = kmalloc(sizeof(a_list_t), GFP_NOWAIT);
+        if (likely(aentry)) {
+                spin_lock(&as_lock);
+                aentry->next = as_free_head;
+                aentry->vm_addr = addr;
+                as_free_head = aentry;
+                as_list_len++;
+                spin_unlock(&as_lock);
+        } else {
+                vunmap(addr);
+        }
+}
+STATIC void
+purge_addresses(void)
+{
+        a_list_t        *aentry, *old;
+        if (as_free_head == NULL)
+                return;
+        spin_lock(&as_lock);
+        aentry = as_free_head;
+        as_free_head = NULL;
+        as_list_len = 0;
+        spin_unlock(&as_lock);
+        while ((old = aentry) != NULL) {
+                vunmap(aentry->vm_addr);
+                aentry = aentry->next;
+                kfree(old);
+        }
+}
+/*
 *      Internal xfs_buf_t object manipulation
 */
@@ -264,7 +333,7 @@ xfs_buf_free(
                uint            i;
                if ((bp->b_flags & XBF_MAPPED) && (bp->b_page_count > 1))
-                       vm_unmap_ram(bp->b_addr - bp->b_offset, bp->b_page_count);
+                        free_address(bp->b_addr - bp->b_offset);
                for (i = 0; i < bp->b_page_count; i++) {
                        struct page     *page = bp->b_pages[i];
@@ -386,8 +455,10 @@ _xfs_buf_map_pages(
                bp->b_addr = page_address(bp->b_pages[0]) + bp->b_offset;
                bp->b_flags |= XBF_MAPPED;
        } else if (flags & XBF_MAPPED) {
-               bp->b_addr = vm_map_ram(bp->b_pages, bp->b_page_count,
+                if (as_list_len > 64)
-                                       -1, PAGE_KERNEL);
+                        purge_addresses();
+                bp->b_addr = vmap(bp->b_pages, bp->b_page_count,
+                                        VM_MAP, PAGE_KERNEL);
                if (unlikely(bp->b_addr == NULL))
                        return -ENOMEM;
                bp->b_addr += bp->b_offset;
@@ -1672,6 +1743,8 @@ xfsbufd(
                        count++;
                }
+                if (as_list_len > 0)
+                        purge_addresses();
                if (count)
                        blk_run_address_space(target->bt_mapping);
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 2ed035354c26..a608e72fa405 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -371,7 +371,11 @@ xfs_quiesce_attr(
        /* flush inodes and push all remaining buffers out to disk */
        xfs_quiesce_fs(mp);
-        ASSERT_ALWAYS(atomic_read(&mp->m_active_trans) == 0);
+        /*
+         * Just warn here till VFS can correctly support
+         * read-only remount without racing.
+         */
+        WARN_ON(atomic_read(&mp->m_active_trans) != 0);
        /* Push the superblock and write an unmount record */
        error = xfs_log_sbcount(mp, 1);
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index b4c1ee713492..f8278cfcc1d3 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -55,17 +55,11 @@ xfs_swapext(
        struct file     *file, *target_file;
        int             error = 0;
-        sxp = kmem_alloc(sizeof(xfs_swapext_t), KM_MAYFAIL);
-        if (!sxp) {
-                error = XFS_ERROR(ENOMEM);
-                goto out;
-        }
        /* Pull information for the target fd */
        file = fget((int)sxp->sx_fdtarget);
        if (!file) {
                error = XFS_ERROR(EINVAL);
-                goto out_free_sxp;
+                goto out;
        }
        if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) {
@@ -109,8 +103,6 @@ xfs_swapext(
        fput(target_file);
 out_put_file:
        fput(file);
- out_free_sxp:
-        kmem_free(sxp);
 out:
        return error;
 }
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 35cca98bd94c..b1047de2fffd 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -70,16 +70,21 @@ STATIC void	xlog_recover_check_summary(xlog_t *);
 xfs_buf_t *
 xlog_get_bp(
        xlog_t          *log,
-        int             num_bblks)
+        int             nbblks)
 {
-        ASSERT(num_bblks > 0);
+        if (nbblks <= 0 || nbblks > log->l_logBBsize) {
+                xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);
+                XFS_ERROR_REPORT("xlog_get_bp(1)",
+                                 XFS_ERRLEVEL_HIGH, log->l_mp);
+                return NULL;
+        }
        if (log->l_sectbb_log) {
-                if (num_bblks > 1)
+                if (nbblks > 1)
-                        num_bblks += XLOG_SECTOR_ROUNDUP_BBCOUNT(log, 1);
+                        nbblks += XLOG_SECTOR_ROUNDUP_BBCOUNT(log, 1);
-                num_bblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, num_bblks);
+                nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);
        }
-        return xfs_buf_get_noaddr(BBTOB(num_bblks), log->l_mp->m_logdev_targp);
+        return xfs_buf_get_noaddr(BBTOB(nbblks), log->l_mp->m_logdev_targp);
 }
 void
@@ -102,6 +107,13 @@ xlog_bread(
 {
        int             error;
+        if (nbblks <= 0 || nbblks > log->l_logBBsize) {
+                xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);
+                XFS_ERROR_REPORT("xlog_bread(1)",
+                                 XFS_ERRLEVEL_HIGH, log->l_mp);
+                return EFSCORRUPTED;
+        }
        if (log->l_sectbb_log) {
                blk_no = XLOG_SECTOR_ROUNDDOWN_BLKNO(log, blk_no);
                nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);
@@ -139,6 +151,13 @@ xlog_bwrite(
 {
        int             error;
+        if (nbblks <= 0 || nbblks > log->l_logBBsize) {
+                xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);
+                XFS_ERROR_REPORT("xlog_bwrite(1)",
+                                 XFS_ERRLEVEL_HIGH, log->l_mp);
+                return EFSCORRUPTED;
+        }
        if (log->l_sectbb_log) {
                blk_no = XLOG_SECTOR_ROUNDDOWN_BLKNO(log, blk_no);
                nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);