29 files changed, 204 insertions, 136 deletions

diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 3c3abff731a7..a381cd22f518 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1817,6 +1817,11 @@ static loff_t btrfs_file_llseek(struct file *file, loff_t offset, int origin)
                 goto out;
         case SEEK_DATA:
         case SEEK_HOLE:
+                if (offset >= i_size_read(inode)) {
+                        mutex_unlock(&inode->i_mutex);
+                        return -ENXIO;
+                }
+
                 ret = find_desired_extent(inode, &offset, origin);
                 if (ret) {
                         mutex_unlock(&inode->i_mutex);
@@ -1825,11 +1830,11 @@ static loff_t btrfs_file_llseek(struct file *file, loff_t offset, int origin)
         }
 
         if (offset < 0 && !(file->f_mode & FMODE_UNSIGNED_OFFSET)) {
-                ret = -EINVAL;
+                offset = -EINVAL;
                 goto out;
         }
         if (offset > inode->i_sb->s_maxbytes) {
-                ret = -EINVAL;
+                offset = -EINVAL;
                 goto out;
         }
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 4d14de6d121b..b2d004ad66a0 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4018,7 +4018,8 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
                 memcpy(&location, dentry->d_fsdata, sizeof(struct btrfs_key));
                 kfree(dentry->d_fsdata);
                 dentry->d_fsdata = NULL;
-                d_clear_need_lookup(dentry);
+                /* This thing is hashed, drop it for now */
+                d_drop(dentry);
         } else {
                 ret = btrfs_inode_by_name(dir, dentry, &location);
         }
@@ -4085,7 +4086,15 @@ static void btrfs_dentry_release(struct dentry *dentry)
 static struct dentry *btrfs_lookup(struct inode *dir, struct dentry *dentry,
                                    struct nameidata *nd)
 {
-        return d_splice_alias(btrfs_lookup_dentry(dir, dentry), dentry);
+        struct dentry *ret;
+
+        ret = d_splice_alias(btrfs_lookup_dentry(dir, dentry), dentry);
+        if (unlikely(d_need_lookup(dentry))) {
+                spin_lock(&dentry->d_lock);
+                dentry->d_flags &= ~DCACHE_NEED_LOOKUP;
+                spin_unlock(&dentry->d_lock);
+        }
+        return ret;
 }
 
 unsigned char btrfs_filetype_table[] = {
@@ -4125,7 +4134,8 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
 
         /* special case for "." */
         if (filp->f_pos == 0) {
-                over = filldir(dirent, ".", 1, 1, btrfs_ino(inode), DT_DIR);
+                over = filldir(dirent, ".", 1,
+                               filp->f_pos, btrfs_ino(inode), DT_DIR);
                 if (over)
                         return 0;
                 filp->f_pos = 1;
@@ -4134,7 +4144,7 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
         if (filp->f_pos == 1) {
                 u64 pino = parent_ino(filp->f_path.dentry);
                 over = filldir(dirent, "..", 2,
-                               2, pino, DT_DIR);
+                               filp->f_pos, pino, DT_DIR);
                 if (over)
                         return 0;
                 filp->f_pos = 2;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 3351b1b24574..538f65a79ec5 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2177,6 +2177,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
         if (!(src_file->f_mode & FMODE_READ))
                 goto out_fput;
 
+        /* don't make the dst file partly checksummed */
+        if ((BTRFS_I(src)->flags & BTRFS_INODE_NODATASUM) !=
+            (BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM))
+                goto out_fput;
+
         ret = -EISDIR;
         if (S_ISDIR(src->i_mode) || S_ISDIR(inode->i_mode))
                 goto out_fput;
@@ -2226,6 +2231,10 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                         goto out_unlock;
         }
 
+        /* truncate page cache pages from target inode range */
+        truncate_inode_pages_range(&inode->i_data, destoff,
+                                   PAGE_CACHE_ALIGN(destoff + len) - 1);
+
         /* do any pending delalloc/csum calc on src, one way or
            another, and lock file content */
         while (1) {
@@ -2242,10 +2251,6 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                 btrfs_wait_ordered_range(src, off, len);
         }
 
-        /* truncate page cache pages from target inode range */
-        truncate_inode_pages_range(&inode->i_data, off,
-                                   ALIGN(off + len, PAGE_CACHE_SIZE) - 1);
-
         /* clone data */
         key.objectid = btrfs_ino(src);
         key.type = BTRFS_EXTENT_DATA_KEY;
@@ -2323,7 +2328,12 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                         else
                                 new_key.offset = destoff;
 
-                        trans = btrfs_start_transaction(root, 1);
+                        /*
+                         * 1 - adjusting old extent (we may have to split it)
+                         * 1 - add new extent
+                         * 1 - inode update
+                         */
+                        trans = btrfs_start_transaction(root, 3);
                         if (IS_ERR(trans)) {
                                 ret = PTR_ERR(trans);
                                 goto out;
@@ -2442,7 +2452,6 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                         if (endoff > inode->i_size)
                                 btrfs_i_size_write(inode, endoff);
 
-                        BTRFS_I(inode)->flags = BTRFS_I(src)->flags;
                         ret = btrfs_update_inode(trans, root, inode);
                         BUG_ON(ret);
                         btrfs_end_transaction(trans, root);
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index e76bfeb68267..30acd22147e1 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -351,9 +351,7 @@ static int
 build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
 {
         unsigned int dlen;
-        unsigned int wlen;
-        unsigned int size = 6 * sizeof(struct ntlmssp2_name);
-        __le64  curtime;
+        unsigned int size = 2 * sizeof(struct ntlmssp2_name);
         char *defdmname = "WORKGROUP";
         unsigned char *blobptr;
         struct ntlmssp2_name *attrptr;
@@ -365,15 +363,14 @@ build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
         }
 
         dlen = strlen(ses->domainName);
-        wlen = strlen(ses->server->hostname);
 
-        /* The length of this blob is a size which is
-         * six times the size of a structure which holds name/size +
-         * two times the unicode length of a domain name +
-         * two times the unicode length of a server name +
-         * size of a timestamp (which is 8 bytes).
+        /*
+         * The length of this blob is two times the size of a
+         * structure (av pair) which holds name/size
+         * ( for NTLMSSP_AV_NB_DOMAIN_NAME followed by NTLMSSP_AV_EOL ) +
+         * unicode length of a netbios domain name
          */
-        ses->auth_key.len = size + 2 * (2 * dlen) + 2 * (2 * wlen) + 8;
+        ses->auth_key.len = size + 2 * dlen;
         ses->auth_key.response = kzalloc(ses->auth_key.len, GFP_KERNEL);
         if (!ses->auth_key.response) {
                 ses->auth_key.len = 0;
@@ -384,44 +381,15 @@ build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
         blobptr = ses->auth_key.response;
         attrptr = (struct ntlmssp2_name *) blobptr;
 
+        /*
+         * As defined in MS-NTLM 3.3.2, just this av pair field
+         * is sufficient as part of the temp
+         */
         attrptr->type = cpu_to_le16(NTLMSSP_AV_NB_DOMAIN_NAME);
         attrptr->length = cpu_to_le16(2 * dlen);
         blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
         cifs_strtoUCS((__le16 *)blobptr, ses->domainName, dlen, nls_cp);
 
-        blobptr += 2 * dlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_NB_COMPUTER_NAME);
-        attrptr->length = cpu_to_le16(2 * wlen);
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        cifs_strtoUCS((__le16 *)blobptr, ses->server->hostname, wlen, nls_cp);
-
-        blobptr += 2 * wlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_DNS_DOMAIN_NAME);
-        attrptr->length = cpu_to_le16(2 * dlen);
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        cifs_strtoUCS((__le16 *)blobptr, ses->domainName, dlen, nls_cp);
-
-        blobptr += 2 * dlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_DNS_COMPUTER_NAME);
-        attrptr->length = cpu_to_le16(2 * wlen);
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        cifs_strtoUCS((__le16 *)blobptr, ses->server->hostname, wlen, nls_cp);
-
-        blobptr += 2 * wlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_TIMESTAMP);
-        attrptr->length = cpu_to_le16(sizeof(__le64));
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        curtime = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
-        memcpy(blobptr, &curtime, sizeof(__le64));
-
         return 0;
 }
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f93eb948d071..54b8f1e7da94 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -548,6 +548,12 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
                 struct inode *dir = dentry->d_inode;
                 struct dentry *child;
 
+                if (!dir) {
+                        dput(dentry);
+                        dentry = ERR_PTR(-ENOENT);
+                        break;
+                }
+
                 /* skip separators */
                 while (*s == sep)
                         s++;
@@ -563,10 +569,6 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
                 mutex_unlock(&dir->i_mutex);
                 dput(dentry);
                 dentry = child;
-                if (!dentry->d_inode) {
-                        dput(dentry);
-                        dentry = ERR_PTR(-ENOENT);
-                }
         } while (!IS_ERR(dentry));
         _FreeXid(xid);
         kfree(full_path);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index aac37d99a487..a80f7bd97b90 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -4079,7 +4079,8 @@ int CIFSFindNext(const int xid, struct cifs_tcon *tcon,
         T2_FNEXT_RSP_PARMS *parms;
         char *response_data;
         int rc = 0;
-        int bytes_returned, name_len;
+        int bytes_returned;
+        unsigned int name_len;
         __u16 params, byte_count;
 
         cFYI(1, "In FindNext");
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 633c246b6775..f4af4cc37500 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1298,7 +1298,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         /* ignore */
                 } else if (strnicmp(data, "guest", 5) == 0) {
                         /* ignore */
-                } else if (strnicmp(data, "rw", 2) == 0) {
+                } else if (strnicmp(data, "rw", 2) == 0 && strlen(data) == 2) {
                         /* ignore */
                 } else if (strnicmp(data, "ro", 2) == 0) {
                         /* ignore */
@@ -1401,7 +1401,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         vol->server_ino = 1;
                 } else if (strnicmp(data, "noserverino", 9) == 0) {
                         vol->server_ino = 0;
-                } else if (strnicmp(data, "rwpidforward", 4) == 0) {
+                } else if (strnicmp(data, "rwpidforward", 12) == 0) {
                         vol->rwpidforward = 1;
                 } else if (strnicmp(data, "cifsacl", 7) == 0) {
                         vol->cifs_acl = 1;
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 04da6acde85d..12661e1deedd 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1134,7 +1134,7 @@ struct buffer_head *ext3_bread(handle_t *handle, struct inode *inode,
                 return bh;
         if (buffer_uptodate(bh))
                 return bh;
-        ll_rw_block(READ_META, 1, &bh);
+        ll_rw_block(READ | REQ_META | REQ_PRIO, 1, &bh);
         wait_on_buffer(bh);
         if (buffer_uptodate(bh))
                 return bh;
@@ -2807,7 +2807,7 @@ make_io:
                 trace_ext3_load_inode(inode);
                 get_bh(bh);
                 bh->b_end_io = end_buffer_read_sync;
-                submit_bh(READ_META, bh);
+                submit_bh(READ | REQ_META | REQ_PRIO, bh);
                 wait_on_buffer(bh);
                 if (!buffer_uptodate(bh)) {
                         ext3_error(inode->i_sb, "ext3_get_inode_loc",
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 5571708b6a58..0629e09f6511 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -922,7 +922,8 @@ restart:
                                 bh = ext3_getblk(NULL, dir, b++, 0, &err);
                                 bh_use[ra_max] = bh;
                                 if (bh)
-                                        ll_rw_block(READ_META, 1, &bh);
+                                        ll_rw_block(READ | REQ_META | REQ_PRIO,
+                                                    1, &bh);
                         }
                 }
                 if ((bh = bh_use[ra_ptr++]) == NULL)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 18d2558b7624..986e2388f031 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -647,7 +647,7 @@ struct buffer_head *ext4_bread(handle_t *handle, struct inode *inode,
                 return bh;
         if (buffer_uptodate(bh))
                 return bh;
-        ll_rw_block(READ_META, 1, &bh);
+        ll_rw_block(READ | REQ_META | REQ_PRIO, 1, &bh);
         wait_on_buffer(bh);
         if (buffer_uptodate(bh))
                 return bh;
@@ -3298,7 +3298,7 @@ make_io:
                 trace_ext4_load_inode(inode);
                 get_bh(bh);
                 bh->b_end_io = end_buffer_read_sync;
-                submit_bh(READ_META, bh);
+                submit_bh(READ | REQ_META | REQ_PRIO, bh);
                 wait_on_buffer(bh);
                 if (!buffer_uptodate(bh)) {
                         EXT4_ERROR_INODE_BLOCK(inode, block,
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index f8068c7bae9f..1c924faeb6c8 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -922,7 +922,8 @@ restart:
                                 bh = ext4_getblk(NULL, dir, b++, 0, &err);
                                 bh_use[ra_max] = bh;
                                 if (bh)
-                                        ll_rw_block(READ_META, 1, &bh);
+                                        ll_rw_block(READ | REQ_META | REQ_PRIO,
+                                                    1, &bh);
                         }
                 }
                 if ((bh = bh_use[ra_ptr++]) == NULL)
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 85c62923ee29..598646434362 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -624,9 +624,9 @@ static void log_write_header(struct gfs2_sbd *sdp, u32 flags, int pull)
         bh->b_end_io = end_buffer_write_sync;
         get_bh(bh);
         if (test_bit(SDF_NOBARRIERS, &sdp->sd_flags))
-                submit_bh(WRITE_SYNC | REQ_META, bh);
+                submit_bh(WRITE_SYNC | REQ_META | REQ_PRIO, bh);
         else
-                submit_bh(WRITE_FLUSH_FUA | REQ_META, bh);
+                submit_bh(WRITE_FLUSH_FUA | REQ_META | REQ_PRIO, bh);
         wait_on_buffer(bh);
 
         if (!buffer_uptodate(bh))
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index 747238cd9f96..be29858900f6 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -37,7 +37,7 @@ static int gfs2_aspace_writepage(struct page *page, struct writeback_control *wb
 {
         struct buffer_head *bh, *head;
         int nr_underway = 0;
-        int write_op = REQ_META |
+        int write_op = REQ_META | REQ_PRIO |
                 (wbc->sync_mode == WB_SYNC_ALL ? WRITE_SYNC : WRITE);
 
         BUG_ON(!PageLocked(page));
@@ -225,7 +225,7 @@ int gfs2_meta_read(struct gfs2_glock *gl, u64 blkno, int flags,
         }
         bh->b_end_io = end_buffer_read_sync;
         get_bh(bh);
-        submit_bh(READ_SYNC | REQ_META, bh);
+        submit_bh(READ_SYNC | REQ_META | REQ_PRIO, bh);
         if (!(flags & DIO_WAIT))
                 return 0;
 
@@ -435,7 +435,7 @@ struct buffer_head *gfs2_meta_ra(struct gfs2_glock *gl, u64 dblock, u32 extlen)
         if (buffer_uptodate(first_bh))
                 goto out;
         if (!buffer_locked(first_bh))
-                ll_rw_block(READ_SYNC | REQ_META, 1, &first_bh);
+                ll_rw_block(READ_SYNC | REQ_META | REQ_PRIO, 1, &first_bh);
 
         dblock++;
         extlen--;
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 3bc073a4cf82..079587e53849 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -224,7 +224,7 @@ static int gfs2_read_super(struct gfs2_sbd *sdp, sector_t sector, int silent)
 
         bio->bi_end_io = end_bio_io_page;
         bio->bi_private = page;
-        submit_bio(READ_SYNC | REQ_META, bio);
+        submit_bio(READ_SYNC | REQ_META | REQ_PRIO, bio);
         wait_on_page_locked(page);
         bio_put(bio);
         if (!PageUptodate(page)) {
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 42e8d23bc047..0e8bb13381e4 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -709,7 +709,7 @@ get_a_page:
                 set_buffer_uptodate(bh);
 
         if (!buffer_uptodate(bh)) {
-                ll_rw_block(READ_META, 1, &bh);
+                ll_rw_block(READ | REQ_META | REQ_PRIO, 1, &bh);
                 wait_on_buffer(bh);
                 if (!buffer_uptodate(bh))
                         goto unlock_out;
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index c106ca22e812..d24a9b666a23 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -344,6 +344,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         struct inode *root, *inode;
         struct qstr str;
         struct nls_table *nls = NULL;
+        u64 last_fs_block, last_fs_page;
         int err;
 
         err = -EINVAL;
@@ -399,9 +400,13 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         if (!sbi->rsrc_clump_blocks)
                 sbi->rsrc_clump_blocks = 1;
 
-        err = generic_check_addressable(sbi->alloc_blksz_shift,
-                                        sbi->total_blocks);
-        if (err) {
+        err = -EFBIG;
+        last_fs_block = sbi->total_blocks - 1;
+        last_fs_page = (last_fs_block << sbi->alloc_blksz_shift) >>
+                        PAGE_CACHE_SHIFT;
+
+        if ((last_fs_block > (sector_t)(~0ULL) >> (sbi->alloc_blksz_shift - 9)) ||
+            (last_fs_page > (pgoff_t)(~0ULL))) {
                 printk(KERN_ERR "hfs: filesystem size too large.\n");
                 goto out_free_vhdr;
         }
@@ -525,8 +530,8 @@ out_close_cat_tree:
 out_close_ext_tree:
         hfs_btree_close(sbi->ext_tree);
 out_free_vhdr:
-        kfree(sbi->s_vhdr);
-        kfree(sbi->s_backup_vhdr);
+        kfree(sbi->s_vhdr_buf);
+        kfree(sbi->s_backup_vhdr_buf);
 out_unload_nls:
         unload_nls(sbi->nls);
         unload_nls(nls);
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 10e515a0d452..7daf4b852d1c 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -272,9 +272,9 @@ reread:
         return 0;
 
 out_free_backup_vhdr:
-        kfree(sbi->s_backup_vhdr);
+        kfree(sbi->s_backup_vhdr_buf);
 out_free_vhdr:
-        kfree(sbi->s_vhdr);
+        kfree(sbi->s_vhdr_buf);
 out:
         return error;
 }
diff --git a/fs/namei.c b/fs/namei.c
index b52bc685465f..0b3138de2a3b 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -721,12 +721,6 @@ static int follow_automount(struct path *path, unsigned flags,
         if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
                 return -EREMOTE;
 
-        /* We don't want to mount if someone supplied AT_NO_AUTOMOUNT
-         * and this is the terminal part of the path.
-         */
-        if ((flags & LOOKUP_NO_AUTOMOUNT) && !(flags & LOOKUP_PARENT))
-                return -EISDIR; /* we actually want to stop here */
-
         /* We don't want to mount if someone's just doing a stat -
          * unless they're stat'ing a directory and appended a '/' to
          * the name.
@@ -739,7 +733,7 @@ static int follow_automount(struct path *path, unsigned flags,
          * of the daemon to instantiate them before they can be used.
          */
         if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
-                     LOOKUP_OPEN | LOOKUP_CREATE)) &&
+                     LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
             path->dentry->d_inode)
                 return -EISDIR;
 
@@ -2616,6 +2610,7 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
         if (!dir->i_op->rmdir)
                 return -EPERM;
 
+        dget(dentry);
         mutex_lock(&dentry->d_inode->i_mutex);
 
         error = -EBUSY;
@@ -2636,6 +2631,7 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
 
 out:
         mutex_unlock(&dentry->d_inode->i_mutex);
+        dput(dentry);
         if (!error)
                 d_delete(dentry);
         return error;
@@ -3025,6 +3021,7 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
         if (error)
                 return error;
 
+        dget(new_dentry);
         if (target)
                 mutex_lock(&target->i_mutex);
 
@@ -3045,6 +3042,7 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
 out:
         if (target)
                 mutex_unlock(&target->i_mutex);
+        dput(new_dentry);
         if (!error)
                 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
                         d_move(old_dentry,new_dentry);
diff --git a/fs/namespace.c b/fs/namespace.c
index 22bfe8273c68..b4febb29d3bb 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1757,7 +1757,7 @@ static int do_loopback(struct path *path, char *old_name,
                 return err;
         if (!old_name || !*old_name)
                 return -EINVAL;
-        err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
+        err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
         if (err)
                 return err;
 
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 1ec1a85fa71c..3e93e9a1bee1 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -56,6 +56,9 @@ enum nfs4_session_state {
         NFS4_SESSION_DRAINING,
 };
 
+#define NFS4_RENEW_TIMEOUT              0x01
+#define NFS4_RENEW_DELEGATION_CB        0x02
+
 struct nfs4_minor_version_ops {
         u32     minor_version;
 
@@ -225,7 +228,7 @@ struct nfs4_state_recovery_ops {
 };
 
 struct nfs4_state_maintenance_ops {
-        int (*sched_state_renewal)(struct nfs_client *, struct rpc_cred *);
+        int (*sched_state_renewal)(struct nfs_client *, struct rpc_cred *, unsigned);
         struct rpc_cred * (*get_state_renewal_cred_locked)(struct nfs_client *);
         int (*renew_lease)(struct nfs_client *, struct rpc_cred *);
 };
@@ -237,8 +240,6 @@ extern const struct inode_operations nfs4_dir_inode_operations;
 extern int nfs4_proc_setclientid(struct nfs_client *, u32, unsigned short, struct rpc_cred *, struct nfs4_setclientid_res *);
 extern int nfs4_proc_setclientid_confirm(struct nfs_client *, struct nfs4_setclientid_res *arg, struct rpc_cred *);
 extern int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred);
-extern int nfs4_proc_async_renew(struct nfs_client *, struct rpc_cred *);
-extern int nfs4_proc_renew(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_init_clientid(struct nfs_client *, struct rpc_cred *);
 extern int nfs41_init_clientid(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_do_close(struct nfs4_state *state, gfp_t gfp_mask, int wait, bool roc);
@@ -349,6 +350,7 @@ extern void nfs4_close_sync(struct nfs4_state *, fmode_t);
 extern void nfs4_state_set_mode_locked(struct nfs4_state *, fmode_t);
 extern void nfs4_schedule_lease_recovery(struct nfs_client *);
 extern void nfs4_schedule_state_manager(struct nfs_client *);
+extern void nfs4_schedule_path_down_recovery(struct nfs_client *clp);
 extern void nfs4_schedule_stateid_recovery(const struct nfs_server *, struct nfs4_state *);
 extern void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags);
 extern void nfs41_handle_recall_slot(struct nfs_client *clp);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 8c77039e7a81..4700fae1ada0 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3374,9 +3374,13 @@ static void nfs4_renew_done(struct rpc_task *task, void *calldata)
 
         if (task->tk_status < 0) {
                 /* Unless we're shutting down, schedule state recovery! */
-                if (test_bit(NFS_CS_RENEWD, &clp->cl_res_state) != 0)
+                if (test_bit(NFS_CS_RENEWD, &clp->cl_res_state) == 0)
+                        return;
+                if (task->tk_status != NFS4ERR_CB_PATH_DOWN) {
                         nfs4_schedule_lease_recovery(clp);
-                return;
+                        return;
+                }
+                nfs4_schedule_path_down_recovery(clp);
         }
         do_renew_lease(clp, timestamp);
 }
@@ -3386,7 +3390,7 @@ static const struct rpc_call_ops nfs4_renew_ops = {
         .rpc_release = nfs4_renew_release,
 };
 
-int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
+static int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred, unsigned renew_flags)
 {
         struct rpc_message msg = {
                 .rpc_proc       = &nfs4_procedures[NFSPROC4_CLNT_RENEW],
@@ -3395,9 +3399,11 @@ int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
         };
         struct nfs4_renewdata *data;
 
+        if (renew_flags == 0)
+                return 0;
         if (!atomic_inc_not_zero(&clp->cl_count))
                 return -EIO;
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
+        data = kmalloc(sizeof(*data), GFP_NOFS);
         if (data == NULL)
                 return -ENOMEM;
         data->client = clp;
@@ -3406,7 +3412,7 @@ int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
                         &nfs4_renew_ops, data);
 }
 
-int nfs4_proc_renew(struct nfs_client *clp, struct rpc_cred *cred)
+static int nfs4_proc_renew(struct nfs_client *clp, struct rpc_cred *cred)
 {
         struct rpc_message msg = {
                 .rpc_proc       = &nfs4_procedures[NFSPROC4_CLNT_RENEW],
@@ -5504,11 +5510,13 @@ static struct rpc_task *_nfs41_proc_sequence(struct nfs_client *clp, struct rpc_
         return rpc_run_task(&task_setup_data);
 }
 
-static int nfs41_proc_async_sequence(struct nfs_client *clp, struct rpc_cred *cred)
+static int nfs41_proc_async_sequence(struct nfs_client *clp, struct rpc_cred *cred, unsigned renew_flags)
 {
         struct rpc_task *task;
         int ret = 0;
 
+        if ((renew_flags & NFS4_RENEW_TIMEOUT) == 0)
+                return 0;
         task = _nfs41_proc_sequence(clp, cred);
         if (IS_ERR(task))
                 ret = PTR_ERR(task);
diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
index df8e7f3ca56d..dc484c0eae7f 100644
--- a/fs/nfs/nfs4renewd.c
+++ b/fs/nfs/nfs4renewd.c
@@ -60,6 +60,7 @@ nfs4_renew_state(struct work_struct *work)
         struct rpc_cred *cred;
         long lease;
         unsigned long last, now;
+        unsigned renew_flags = 0;
 
         ops = clp->cl_mvops->state_renewal_ops;
         dprintk("%s: start\n", __func__);
@@ -72,18 +73,23 @@ nfs4_renew_state(struct work_struct *work)
         last = clp->cl_last_renewal;
         now = jiffies;
         /* Are we close to a lease timeout? */
-        if (time_after(now, last + lease/3)) {
+        if (time_after(now, last + lease/3))
+                renew_flags |= NFS4_RENEW_TIMEOUT;
+        if (nfs_delegations_present(clp))
+                renew_flags |= NFS4_RENEW_DELEGATION_CB;
+
+        if (renew_flags != 0) {
                 cred = ops->get_state_renewal_cred_locked(clp);
                 spin_unlock(&clp->cl_lock);
                 if (cred == NULL) {
-                        if (!nfs_delegations_present(clp)) {
+                        if (!(renew_flags & NFS4_RENEW_DELEGATION_CB)) {
                                 set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
                                 goto out;
                         }
                         nfs_expire_all_delegations(clp);
                 } else {
                         /* Queue an asynchronous RENEW. */
-                        ops->sched_state_renewal(clp, cred);
+                        ops->sched_state_renewal(clp, cred, renew_flags);
                         put_rpccred(cred);
                         goto out_exp;
                 }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 72ab97ef3d61..39914be40b03 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1038,6 +1038,12 @@ void nfs4_schedule_lease_recovery(struct nfs_client *clp)
         nfs4_schedule_state_manager(clp);
 }
 
+void nfs4_schedule_path_down_recovery(struct nfs_client *clp)
+{
+        nfs_handle_cb_pathdown(clp);
+        nfs4_schedule_state_manager(clp);
+}
+
 static int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
 {
 
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index b961ceac66b4..5b19b6aabe18 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2035,9 +2035,6 @@ static inline void nfs_initialise_sb(struct super_block *sb)
                 sb->s_blocksize = nfs_block_bits(server->wsize,
                                                  &sb->s_blocksize_bits);
 
-        if (server->flags & NFS_MOUNT_NOAC)
-                sb->s_flags |= MS_SYNCHRONOUS;
-
         sb->s_bdi = &server->backing_dev_info;
 
         nfs_super_set_maxbytes(sb, server->maxfilesize);
@@ -2249,6 +2246,10 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
         if (server->flags & NFS_MOUNT_UNSHARED)
                 compare_super = NULL;
 
+        /* -o noac implies -o sync */
+        if (server->flags & NFS_MOUNT_NOAC)
+                sb_mntdata.mntflags |= MS_SYNCHRONOUS;
+
         /* Get a superblock - note that we may end up sharing one that already exists */
         s = sget(fs_type, compare_super, nfs_set_super, &sb_mntdata);
         if (IS_ERR(s)) {
@@ -2361,6 +2362,10 @@ nfs_xdev_mount(struct file_system_type *fs_type, int flags,
         if (server->flags & NFS_MOUNT_UNSHARED)
                 compare_super = NULL;
 
+        /* -o noac implies -o sync */
+        if (server->flags & NFS_MOUNT_NOAC)
+                sb_mntdata.mntflags |= MS_SYNCHRONOUS;
+
         /* Get a superblock - note that we may end up sharing one that already exists */
         s = sget(&nfs_fs_type, compare_super, nfs_set_super, &sb_mntdata);
         if (IS_ERR(s)) {
@@ -2628,6 +2633,10 @@ nfs4_remote_mount(struct file_system_type *fs_type, int flags,
         if (server->flags & NFS4_MOUNT_UNSHARED)
                 compare_super = NULL;
 
+        /* -o noac implies -o sync */
+        if (server->flags & NFS_MOUNT_NOAC)
+                sb_mntdata.mntflags |= MS_SYNCHRONOUS;
+
         /* Get a superblock - note that we may end up sharing one that already exists */
         s = sget(&nfs4_fs_type, compare_super, nfs_set_super, &sb_mntdata);
         if (IS_ERR(s)) {
@@ -2789,7 +2798,7 @@ static struct dentry *nfs_follow_remote_path(struct vfsmount *root_mnt,
                 goto out_put_mnt_ns;
 
         ret = vfs_path_lookup(root_mnt->mnt_root, root_mnt,
-                        export_path, LOOKUP_FOLLOW, &path);
+                        export_path, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
 
         nfs_referral_loop_unprotect();
         put_mnt_ns(ns_private);
@@ -2916,6 +2925,10 @@ nfs4_xdev_mount(struct file_system_type *fs_type, int flags,
         if (server->flags & NFS4_MOUNT_UNSHARED)
                 compare_super = NULL;
 
+        /* -o noac implies -o sync */
+        if (server->flags & NFS_MOUNT_NOAC)
+                sb_mntdata.mntflags |= MS_SYNCHRONOUS;
+
         /* Get a superblock - note that we may end up sharing one that already exists */
         s = sget(&nfs4_fs_type, compare_super, nfs_set_super, &sb_mntdata);
         if (IS_ERR(s)) {
@@ -3003,6 +3016,10 @@ nfs4_remote_referral_mount(struct file_system_type *fs_type, int flags,
         if (server->flags & NFS4_MOUNT_UNSHARED)
                 compare_super = NULL;
 
+        /* -o noac implies -o sync */
+        if (server->flags & NFS_MOUNT_NOAC)
+                sb_mntdata.mntflags |= MS_SYNCHRONOUS;
+
         /* Get a superblock - note that we may end up sharing one that already exists */
         s = sget(&nfs4_fs_type, compare_super, nfs_set_super, &sb_mntdata);
         if (IS_ERR(s)) {
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index b39b37f80913..c9bd2a6b7d4b 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -958,7 +958,7 @@ static int nfs_flush_multi(struct nfs_pageio_descriptor *desc, struct list_head
                 if (!data)
                         goto out_bad;
                 data->pagevec[0] = page;
-                nfs_write_rpcsetup(req, data, wsize, offset, desc->pg_ioflags);
+                nfs_write_rpcsetup(req, data, len, offset, desc->pg_ioflags);
                 list_add(&data->list, res);
                 requests++;
                 nbytes -= len;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 25b6a887adb9..5afaa58a8630 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -877,30 +877,54 @@ struct numa_maps_private {
         struct numa_maps md;
 };
 
-static void gather_stats(struct page *page, struct numa_maps *md, int pte_dirty)
+static void gather_stats(struct page *page, struct numa_maps *md, int pte_dirty,
+                        unsigned long nr_pages)
 {
         int count = page_mapcount(page);
 
-        md->pages++;
+        md->pages += nr_pages;
         if (pte_dirty || PageDirty(page))
-                md->dirty++;
+                md->dirty += nr_pages;
 
         if (PageSwapCache(page))
-                md->swapcache++;
+                md->swapcache += nr_pages;
 
         if (PageActive(page) || PageUnevictable(page))
-                md->active++;
+                md->active += nr_pages;
 
         if (PageWriteback(page))
-                md->writeback++;
+                md->writeback += nr_pages;
 
         if (PageAnon(page))
-                md->anon++;
+                md->anon += nr_pages;
 
         if (count > md->mapcount_max)
                 md->mapcount_max = count;
 
-        md->node[page_to_nid(page)]++;
+        md->node[page_to_nid(page)] += nr_pages;
+}
+
+static struct page *can_gather_numa_stats(pte_t pte, struct vm_area_struct *vma,
+                unsigned long addr)
+{
+        struct page *page;
+        int nid;
+
+        if (!pte_present(pte))
+                return NULL;
+
+        page = vm_normal_page(vma, addr, pte);
+        if (!page)
+                return NULL;
+
+        if (PageReserved(page))
+                return NULL;
+
+        nid = page_to_nid(page);
+        if (!node_isset(nid, node_states[N_HIGH_MEMORY]))
+                return NULL;
+
+        return page;
 }
 
 static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
@@ -912,26 +936,32 @@ static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
         pte_t *pte;
 
         md = walk->private;
-        orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
-        do {
-                struct page *page;
-                int nid;
+        spin_lock(&walk->mm->page_table_lock);
+        if (pmd_trans_huge(*pmd)) {
+                if (pmd_trans_splitting(*pmd)) {
+                        spin_unlock(&walk->mm->page_table_lock);
+                        wait_split_huge_page(md->vma->anon_vma, pmd);
+                } else {
+                        pte_t huge_pte = *(pte_t *)pmd;
+                        struct page *page;
 
-                if (!pte_present(*pte))
-                        continue;
+                        page = can_gather_numa_stats(huge_pte, md->vma, addr);
+                        if (page)
+                                gather_stats(page, md, pte_dirty(huge_pte),
+                                                HPAGE_PMD_SIZE/PAGE_SIZE);
+                        spin_unlock(&walk->mm->page_table_lock);
+                        return 0;
+                }
+        } else {
+                spin_unlock(&walk->mm->page_table_lock);
+        }
 
-                page = vm_normal_page(md->vma, addr, *pte);
+        orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+        do {
+                struct page *page = can_gather_numa_stats(*pte, md->vma, addr);
                 if (!page)
                         continue;
-
-                if (PageReserved(page))
-                        continue;
-
-                nid = page_to_nid(page);
-                if (!node_isset(nid, node_states[N_HIGH_MEMORY]))
-                        continue;
-
-                gather_stats(page, md, pte_dirty(*pte));
+                gather_stats(page, md, pte_dirty(*pte), 1);
 
         } while (pte++, addr += PAGE_SIZE, addr != end);
         pte_unmap_unlock(orig_pte, ptl);
@@ -952,7 +982,7 @@ static int gather_hugetbl_stats(pte_t *pte, unsigned long hmask,
                 return 0;
 
         md = walk->private;
-        gather_stats(page, md, pte_dirty(*pte));
+        gather_stats(page, md, pte_dirty(*pte), 1);
         return 0;
 }
 
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index b34bdb25490c..10b6be3ca280 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -355,7 +355,7 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
          * resolution (think about autofs) and thus deadlocks could arise.
          */
         if (cmds == Q_QUOTAON) {
-                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW, &path);
+                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
                 if (ret)
                         pathp = ERR_PTR(ret);
                 else
diff --git a/fs/stat.c b/fs/stat.c
index ba5316ffac61..78a3aa83c7ea 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -81,8 +81,6 @@ int vfs_fstatat(int dfd, const char __user *filename, struct kstat *stat,
 
         if (!(flag & AT_SYMLINK_NOFOLLOW))
                 lookup_flags |= LOOKUP_FOLLOW;
-        if (flag & AT_NO_AUTOMOUNT)
-                lookup_flags |= LOOKUP_NO_AUTOMOUNT;
         if (flag & AT_EMPTY_PATH)
                 lookup_flags |= LOOKUP_EMPTY;
 
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 63e971e2b837..8c37dde4c521 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -1300,6 +1300,7 @@ xfs_end_io_direct_write(
         bool                    is_async)
 {
         struct xfs_ioend        *ioend = iocb->private;
+        struct inode            *inode = ioend->io_inode;
 
         /*
          * blockdev_direct_IO can return an error even after the I/O
@@ -1331,7 +1332,7 @@ xfs_end_io_direct_write(
         }
 
         /* XXX: probably should move into the real I/O completion handler */
-        inode_dio_done(ioend->io_inode);
+        inode_dio_done(inode);
 }
 
 STATIC ssize_t