42 files changed, 512 insertions, 321 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 6efb7f6cb22e..062a5f6a1448 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -244,9 +244,14 @@ static void aio_free_ring(struct kioctx *ctx)
         int i;
 
         for (i = 0; i < ctx->nr_pages; i++) {
+                struct page *page;
                 pr_debug("pid(%d) [%d] page->count=%d\n", current->pid, i,
                                 page_count(ctx->ring_pages[i]));
-                put_page(ctx->ring_pages[i]);
+                page = ctx->ring_pages[i];
+                if (!page)
+                        continue;
+                ctx->ring_pages[i] = NULL;
+                put_page(page);
         }
 
         put_aio_ring_file(ctx);
@@ -280,18 +285,38 @@ static int aio_migratepage(struct address_space *mapping, struct page *new,
         unsigned long flags;
         int rc;
 
+        rc = 0;
+
+        /* Make sure the old page hasn't already been changed */
+        spin_lock(&mapping->private_lock);
+        ctx = mapping->private_data;
+        if (ctx) {
+                pgoff_t idx;
+                spin_lock_irqsave(&ctx->completion_lock, flags);
+                idx = old->index;
+                if (idx < (pgoff_t)ctx->nr_pages) {
+                        if (ctx->ring_pages[idx] != old)
+                                rc = -EAGAIN;
+                } else
+                        rc = -EINVAL;
+                spin_unlock_irqrestore(&ctx->completion_lock, flags);
+        } else
+                rc = -EINVAL;
+        spin_unlock(&mapping->private_lock);
+
+        if (rc != 0)
+                return rc;
+
         /* Writeback must be complete */
         BUG_ON(PageWriteback(old));
-        put_page(old);
+        get_page(new);
 
-        rc = migrate_page_move_mapping(mapping, new, old, NULL, mode);
+        rc = migrate_page_move_mapping(mapping, new, old, NULL, mode, 1);
         if (rc != MIGRATEPAGE_SUCCESS) {
-                get_page(old);
+                put_page(new);
                 return rc;
         }
 
-        get_page(new);
-
         /* We can potentially race against kioctx teardown here.  Use the
          * address_space's private data lock to protect the mapping's
          * private_data.
@@ -303,13 +328,24 @@ static int aio_migratepage(struct address_space *mapping, struct page *new,
                 spin_lock_irqsave(&ctx->completion_lock, flags);
                 migrate_page_copy(new, old);
                 idx = old->index;
-                if (idx < (pgoff_t)ctx->nr_pages)
-                        ctx->ring_pages[idx] = new;
+                if (idx < (pgoff_t)ctx->nr_pages) {
+                        /* And only do the move if things haven't changed */
+                        if (ctx->ring_pages[idx] == old)
+                                ctx->ring_pages[idx] = new;
+                        else
+                                rc = -EAGAIN;
+                } else
+                        rc = -EINVAL;
                 spin_unlock_irqrestore(&ctx->completion_lock, flags);
         } else
                 rc = -EBUSY;
         spin_unlock(&mapping->private_lock);
 
+        if (rc == MIGRATEPAGE_SUCCESS)
+                put_page(old);
+        else
+                put_page(new);
+
         return rc;
 }
 #endif
@@ -326,7 +362,7 @@ static int aio_setup_ring(struct kioctx *ctx)
         struct aio_ring *ring;
         unsigned nr_events = ctx->max_reqs;
         struct mm_struct *mm = current->mm;
-        unsigned long size, populate;
+        unsigned long size, unused;
         int nr_pages;
         int i;
         struct file *file;
@@ -347,6 +383,20 @@ static int aio_setup_ring(struct kioctx *ctx)
                 return -EAGAIN;
         }
 
+        ctx->aio_ring_file = file;
+        nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring))
+                        / sizeof(struct io_event);
+
+        ctx->ring_pages = ctx->internal_pages;
+        if (nr_pages > AIO_RING_PAGES) {
+                ctx->ring_pages = kcalloc(nr_pages, sizeof(struct page *),
+                                          GFP_KERNEL);
+                if (!ctx->ring_pages) {
+                        put_aio_ring_file(ctx);
+                        return -ENOMEM;
+                }
+        }
+
         for (i = 0; i < nr_pages; i++) {
                 struct page *page;
                 page = find_or_create_page(file->f_inode->i_mapping,
@@ -358,19 +408,14 @@ static int aio_setup_ring(struct kioctx *ctx)
                 SetPageUptodate(page);
                 SetPageDirty(page);
                 unlock_page(page);
+
+                ctx->ring_pages[i] = page;
         }
-        ctx->aio_ring_file = file;
-        nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring))
-                        / sizeof(struct io_event);
+        ctx->nr_pages = i;
 
-        ctx->ring_pages = ctx->internal_pages;
-        if (nr_pages > AIO_RING_PAGES) {
-                ctx->ring_pages = kcalloc(nr_pages, sizeof(struct page *),
-                                          GFP_KERNEL);
-                if (!ctx->ring_pages) {
-                        put_aio_ring_file(ctx);
-                        return -ENOMEM;
-                }
+        if (unlikely(i != nr_pages)) {
+                aio_free_ring(ctx);
+                return -EAGAIN;
         }
 
         ctx->mmap_size = nr_pages * PAGE_SIZE;
@@ -379,9 +424,9 @@ static int aio_setup_ring(struct kioctx *ctx)
         down_write(&mm->mmap_sem);
         ctx->mmap_base = do_mmap_pgoff(ctx->aio_ring_file, 0, ctx->mmap_size,
                                        PROT_READ | PROT_WRITE,
-                                       MAP_SHARED | MAP_POPULATE, 0, &populate);
+                                       MAP_SHARED, 0, &unused);
+        up_write(&mm->mmap_sem);
         if (IS_ERR((void *)ctx->mmap_base)) {
-                up_write(&mm->mmap_sem);
                 ctx->mmap_size = 0;
                 aio_free_ring(ctx);
                 return -EAGAIN;
@@ -389,27 +434,6 @@ static int aio_setup_ring(struct kioctx *ctx)
 
         pr_debug("mmap address: 0x%08lx\n", ctx->mmap_base);
 
-        /* We must do this while still holding mmap_sem for write, as we
-         * need to be protected against userspace attempting to mremap()
-         * or munmap() the ring buffer.
-         */
-        ctx->nr_pages = get_user_pages(current, mm, ctx->mmap_base, nr_pages,
-                                       1, 0, ctx->ring_pages, NULL);
-
-        /* Dropping the reference here is safe as the page cache will hold
-         * onto the pages for us.  It is also required so that page migration
-         * can unmap the pages and get the right reference count.
-         */
-        for (i = 0; i < ctx->nr_pages; i++)
-                put_page(ctx->ring_pages[i]);
-
-        up_write(&mm->mmap_sem);
-
-        if (unlikely(ctx->nr_pages != nr_pages)) {
-                aio_free_ring(ctx);
-                return -EAGAIN;
-        }
-
         ctx->user_id = ctx->mmap_base;
         ctx->nr_events = nr_events; /* trusted copy */
 
@@ -652,7 +676,8 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
         aio_nr += ctx->max_reqs;
         spin_unlock(&aio_nr_lock);
 
-        percpu_ref_get(&ctx->users); /* io_setup() will drop this ref */
+        percpu_ref_get(&ctx->users);    /* io_setup() will drop this ref */
+        percpu_ref_get(&ctx->reqs);     /* free_ioctx_users() will drop this */
 
         err = ioctx_add_table(ctx, mm);
         if (err)
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 1e561c059539..ec3ba43b9faa 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -210,9 +210,13 @@ static int readpage_nounlock(struct file *filp, struct page *page)
         if (err < 0) {
                 SetPageError(page);
                 goto out;
-        } else if (err < PAGE_CACHE_SIZE) {
+        } else {
+                if (err < PAGE_CACHE_SIZE) {
                 /* zero fill remainder of page */
-                zero_user_segment(page, err, PAGE_CACHE_SIZE);
+                        zero_user_segment(page, err, PAGE_CACHE_SIZE);
+                } else {
+                        flush_dcache_page(page);
+                }
         }
         SetPageUptodate(page);
 
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 9a8e396aed89..278fd2891288 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -978,7 +978,6 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
         struct ceph_mds_reply_inode *ininfo;
         struct ceph_vino vino;
         struct ceph_fs_client *fsc = ceph_sb_to_client(sb);
-        int i = 0;
         int err = 0;
 
         dout("fill_trace %p is_dentry %d is_target %d\n", req,
@@ -1039,6 +1038,29 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                 }
         }
 
+        if (rinfo->head->is_target) {
+                vino.ino = le64_to_cpu(rinfo->targeti.in->ino);
+                vino.snap = le64_to_cpu(rinfo->targeti.in->snapid);
+
+                in = ceph_get_inode(sb, vino);
+                if (IS_ERR(in)) {
+                        err = PTR_ERR(in);
+                        goto done;
+                }
+                req->r_target_inode = in;
+
+                err = fill_inode(in, &rinfo->targeti, NULL,
+                                session, req->r_request_started,
+                                (le32_to_cpu(rinfo->head->result) == 0) ?
+                                req->r_fmode : -1,
+                                &req->r_caps_reservation);
+                if (err < 0) {
+                        pr_err("fill_inode badness %p %llx.%llx\n",
+                                in, ceph_vinop(in));
+                        goto done;
+                }
+        }
+
         /*
          * ignore null lease/binding on snapdir ENOENT, or else we
          * will have trouble splicing in the virtual snapdir later
@@ -1108,7 +1130,6 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                              ceph_dentry(req->r_old_dentry)->offset);
 
                         dn = req->r_old_dentry;  /* use old_dentry */
-                        in = dn->d_inode;
                 }
 
                 /* null dentry? */
@@ -1130,44 +1151,28 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                 }
 
                 /* attach proper inode */
-                ininfo = rinfo->targeti.in;
-                vino.ino = le64_to_cpu(ininfo->ino);
-                vino.snap = le64_to_cpu(ininfo->snapid);
-                in = dn->d_inode;
-                if (!in) {
-                        in = ceph_get_inode(sb, vino);
-                        if (IS_ERR(in)) {
-                                pr_err("fill_trace bad get_inode "
-                                       "%llx.%llx\n", vino.ino, vino.snap);
-                                err = PTR_ERR(in);
-                                d_drop(dn);
-                                goto done;
-                        }
+                if (!dn->d_inode) {
+                        ihold(in);
                         dn = splice_dentry(dn, in, &have_lease, true);
                         if (IS_ERR(dn)) {
                                 err = PTR_ERR(dn);
                                 goto done;
                         }
                         req->r_dentry = dn;  /* may have spliced */
-                        ihold(in);
-                } else if (ceph_ino(in) == vino.ino &&
-                           ceph_snap(in) == vino.snap) {
-                        ihold(in);
-                } else {
+                } else if (dn->d_inode && dn->d_inode != in) {
                         dout(" %p links to %p %llx.%llx, not %llx.%llx\n",
-                             dn, in, ceph_ino(in), ceph_snap(in),
-                             vino.ino, vino.snap);
+                             dn, dn->d_inode, ceph_vinop(dn->d_inode),
+                             ceph_vinop(in));
                         have_lease = false;
-                        in = NULL;
                 }
 
                 if (have_lease)
                         update_dentry_lease(dn, rinfo->dlease, session,
                                             req->r_request_started);
                 dout(" final dn %p\n", dn);
-                i++;
-        } else if ((req->r_op == CEPH_MDS_OP_LOOKUPSNAP ||
-                   req->r_op == CEPH_MDS_OP_MKSNAP) && !req->r_aborted) {
+        } else if (!req->r_aborted &&
+                   (req->r_op == CEPH_MDS_OP_LOOKUPSNAP ||
+                    req->r_op == CEPH_MDS_OP_MKSNAP)) {
                 struct dentry *dn = req->r_dentry;
 
                 /* fill out a snapdir LOOKUPSNAP dentry */
@@ -1177,52 +1182,15 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                 ininfo = rinfo->targeti.in;
                 vino.ino = le64_to_cpu(ininfo->ino);
                 vino.snap = le64_to_cpu(ininfo->snapid);
-                in = ceph_get_inode(sb, vino);
-                if (IS_ERR(in)) {
-                        pr_err("fill_inode get_inode badness %llx.%llx\n",
-                               vino.ino, vino.snap);
-                        err = PTR_ERR(in);
-                        d_delete(dn);
-                        goto done;
-                }
                 dout(" linking snapped dir %p to dn %p\n", in, dn);
+                ihold(in);
                 dn = splice_dentry(dn, in, NULL, true);
                 if (IS_ERR(dn)) {
                         err = PTR_ERR(dn);
                         goto done;
                 }
                 req->r_dentry = dn;  /* may have spliced */
-                ihold(in);
-                rinfo->head->is_dentry = 1;  /* fool notrace handlers */
-        }
-
-        if (rinfo->head->is_target) {
-                vino.ino = le64_to_cpu(rinfo->targeti.in->ino);
-                vino.snap = le64_to_cpu(rinfo->targeti.in->snapid);
-
-                if (in == NULL || ceph_ino(in) != vino.ino ||
-                    ceph_snap(in) != vino.snap) {
-                        in = ceph_get_inode(sb, vino);
-                        if (IS_ERR(in)) {
-                                err = PTR_ERR(in);
-                                goto done;
-                        }
-                }
-                req->r_target_inode = in;
-
-                err = fill_inode(in,
-                                 &rinfo->targeti, NULL,
-                                 session, req->r_request_started,
-                                 (le32_to_cpu(rinfo->head->result) == 0) ?
-                                 req->r_fmode : -1,
-                                 &req->r_caps_reservation);
-                if (err < 0) {
-                        pr_err("fill_inode badness %p %llx.%llx\n",
-                               in, ceph_vinop(in));
-                        goto done;
-                }
         }
-
 done:
         dout("fill_trace done err=%d\n", err);
         return err;
@@ -1272,7 +1240,7 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req,
         struct qstr dname;
         struct dentry *dn;
         struct inode *in;
-        int err = 0, i;
+        int err = 0, ret, i;
         struct inode *snapdir = NULL;
         struct ceph_mds_request_head *rhead = req->r_request->front.iov_base;
         struct ceph_dentry_info *di;
@@ -1305,6 +1273,7 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req,
                         ceph_fill_dirfrag(parent->d_inode, rinfo->dir_dir);
         }
 
+        /* FIXME: release caps/leases if error occurs */
         for (i = 0; i < rinfo->dir_nr; i++) {
                 struct ceph_vino vino;
 
@@ -1329,9 +1298,10 @@ retry_lookup:
                                 err = -ENOMEM;
                                 goto out;
                         }
-                        err = ceph_init_dentry(dn);
-                        if (err < 0) {
+                        ret = ceph_init_dentry(dn);
+                        if (ret < 0) {
                                 dput(dn);
+                                err = ret;
                                 goto out;
                         }
                 } else if (dn->d_inode &&
@@ -1351,9 +1321,6 @@ retry_lookup:
                         spin_unlock(&parent->d_lock);
                 }
 
-                di = dn->d_fsdata;
-                di->offset = ceph_make_fpos(frag, i + r_readdir_offset);
-
                 /* inode */
                 if (dn->d_inode) {
                         in = dn->d_inode;
@@ -1366,26 +1333,39 @@ retry_lookup:
                                 err = PTR_ERR(in);
                                 goto out;
                         }
-                        dn = splice_dentry(dn, in, NULL, false);
-                        if (IS_ERR(dn))
-                                dn = NULL;
                 }
 
                 if (fill_inode(in, &rinfo->dir_in[i], NULL, session,
                                req->r_request_started, -1,
                                &req->r_caps_reservation) < 0) {
                         pr_err("fill_inode badness on %p\n", in);
+                        if (!dn->d_inode)
+                                iput(in);
+                        d_drop(dn);
                         goto next_item;
                 }
-                if (dn)
-                        update_dentry_lease(dn, rinfo->dir_dlease[i],
-                                            req->r_session,
-                                            req->r_request_started);
+
+                if (!dn->d_inode) {
+                        dn = splice_dentry(dn, in, NULL, false);
+                        if (IS_ERR(dn)) {
+                                err = PTR_ERR(dn);
+                                dn = NULL;
+                                goto next_item;
+                        }
+                }
+
+                di = dn->d_fsdata;
+                di->offset = ceph_make_fpos(frag, i + r_readdir_offset);
+
+                update_dentry_lease(dn, rinfo->dir_dlease[i],
+                                    req->r_session,
+                                    req->r_request_started);
 next_item:
                 if (dn)
                         dput(dn);
         }
-        req->r_did_prepopulate = true;
+        if (err == 0)
+                req->r_did_prepopulate = true;
 
 out:
         if (snapdir) {
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index aa3397620342..2c29db6a247e 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -477,9 +477,10 @@ extern int CIFSGetExtAttr(const unsigned int xid, struct cifs_tcon *tcon,
                         const int netfid, __u64 *pExtAttrBits, __u64 *pMask);
 extern void cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb);
 extern bool CIFSCouldBeMFSymlink(const struct cifs_fattr *fattr);
-extern int CIFSCheckMFSymlink(struct cifs_fattr *fattr,
-                const unsigned char *path,
-                struct cifs_sb_info *cifs_sb, unsigned int xid);
+extern int CIFSCheckMFSymlink(unsigned int xid, struct cifs_tcon *tcon,
+                              struct cifs_sb_info *cifs_sb,
+                              struct cifs_fattr *fattr,
+                              const unsigned char *path);
 extern int mdfour(unsigned char *, unsigned char *, int);
 extern int E_md4hash(const unsigned char *passwd, unsigned char *p16,
                         const struct nls_table *codepage);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 124aa0230c1b..d707edb6b852 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -4010,7 +4010,7 @@ QFileInfoRetry:
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
         if (rc) {
-                cifs_dbg(FYI, "Send error in QPathInfo = %d\n", rc);
+                cifs_dbg(FYI, "Send error in QFileInfo = %d", rc);
         } else {                /* decode response */
                 rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
@@ -4179,7 +4179,7 @@ UnixQFileInfoRetry:
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
         if (rc) {
-                cifs_dbg(FYI, "Send error in QPathInfo = %d\n", rc);
+                cifs_dbg(FYI, "Send error in UnixQFileInfo = %d", rc);
         } else {                /* decode response */
                 rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
@@ -4263,7 +4263,7 @@ UnixQPathInfoRetry:
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
         if (rc) {
-                cifs_dbg(FYI, "Send error in QPathInfo = %d\n", rc);
+                cifs_dbg(FYI, "Send error in UnixQPathInfo = %d", rc);
         } else {                /* decode response */
                 rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 11ff5f116b20..a514e0a65f69 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -193,7 +193,7 @@ check_name(struct dentry *direntry)
 static int
 cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid,
                struct tcon_link *tlink, unsigned oflags, umode_t mode,
-               __u32 *oplock, struct cifs_fid *fid, int *created)
+               __u32 *oplock, struct cifs_fid *fid)
 {
         int rc = -ENOENT;
         int create_options = CREATE_NOT_DIR;
@@ -349,7 +349,6 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid,
                                 .device = 0,
                 };
 
-                *created |= FILE_CREATED;
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
                         args.uid = current_fsuid();
                         if (inode->i_mode & S_ISGID)
@@ -480,13 +479,16 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
         cifs_add_pending_open(&fid, tlink, &open);
 
         rc = cifs_do_create(inode, direntry, xid, tlink, oflags, mode,
-                            &oplock, &fid, opened);
+                            &oplock, &fid);
 
         if (rc) {
                 cifs_del_pending_open(&open);
                 goto out;
         }
 
+        if ((oflags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL))
+                *opened |= FILE_CREATED;
+
         rc = finish_open(file, direntry, generic_file_open, opened);
         if (rc) {
                 if (server->ops->close)
@@ -529,7 +531,6 @@ int cifs_create(struct inode *inode, struct dentry *direntry, umode_t mode,
         struct TCP_Server_Info *server;
         struct cifs_fid fid;
         __u32 oplock;
-        int created = FILE_CREATED;
 
         cifs_dbg(FYI, "cifs_create parent inode = 0x%p name is: %s and dentry = 0x%p\n",
                  inode, direntry->d_name.name, direntry);
@@ -546,7 +547,7 @@ int cifs_create(struct inode *inode, struct dentry *direntry, umode_t mode,
                 server->ops->new_lease_key(&fid);
 
         rc = cifs_do_create(inode, direntry, xid, tlink, oflags, mode,
-                            &oplock, &fid, &created);
+                            &oplock, &fid);
         if (!rc && server->ops->close)
                 server->ops->close(xid, tcon, &fid);
 
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 36f9ebb93ceb..49719b8228e5 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -383,7 +383,8 @@ int cifs_get_inode_info_unix(struct inode **pinode,
 
         /* check for Minshall+French symlinks */
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MF_SYMLINKS) {
-                int tmprc = CIFSCheckMFSymlink(&fattr, full_path, cifs_sb, xid);
+                int tmprc = CIFSCheckMFSymlink(xid, tcon, cifs_sb, &fattr,
+                                               full_path);
                 if (tmprc)
                         cifs_dbg(FYI, "CIFSCheckMFSymlink: %d\n", tmprc);
         }
@@ -799,7 +800,8 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
 
         /* check for Minshall+French symlinks */
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MF_SYMLINKS) {
-                tmprc = CIFSCheckMFSymlink(&fattr, full_path, cifs_sb, xid);
+                tmprc = CIFSCheckMFSymlink(xid, tcon, cifs_sb, &fattr,
+                                           full_path);
                 if (tmprc)
                         cifs_dbg(FYI, "CIFSCheckMFSymlink: %d\n", tmprc);
         }
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index cc0234710ddb..92aee08483a5 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -354,34 +354,30 @@ open_query_close_cifs_symlink(const unsigned char *path, char *pbuf,
 
 
 int
-CIFSCheckMFSymlink(struct cifs_fattr *fattr,
-                   const unsigned char *path,
-                   struct cifs_sb_info *cifs_sb, unsigned int xid)
+CIFSCheckMFSymlink(unsigned int xid, struct cifs_tcon *tcon,
+                   struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
+                   const unsigned char *path)
 {
-        int rc = 0;
+        int rc;
         u8 *buf = NULL;
         unsigned int link_len = 0;
         unsigned int bytes_read = 0;
-        struct cifs_tcon *ptcon;
 
         if (!CIFSCouldBeMFSymlink(fattr))
                 /* it's not a symlink */
                 return 0;
 
         buf = kmalloc(CIFS_MF_SYMLINK_FILE_SIZE, GFP_KERNEL);
-        if (!buf) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!buf)
+                return -ENOMEM;
 
-        ptcon = tlink_tcon(cifs_sb_tlink(cifs_sb));
-        if ((ptcon->ses) && (ptcon->ses->server->ops->query_mf_symlink))
-                rc = ptcon->ses->server->ops->query_mf_symlink(path, buf,
-                                                 &bytes_read, cifs_sb, xid);
+        if (tcon->ses->server->ops->query_mf_symlink)
+                rc = tcon->ses->server->ops->query_mf_symlink(path, buf,
+                                                &bytes_read, cifs_sb, xid);
         else
-                goto out;
+                rc = -ENOSYS;
 
-        if (rc != 0)
+        if (rc)
                 goto out;
 
         if (bytes_read == 0) /* not a symlink */
diff --git a/fs/dcache.c b/fs/dcache.c
index 6055d61811d3..cb4a10690868 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -3061,8 +3061,13 @@ char *d_path(const struct path *path, char *buf, int buflen)
          * thus don't need to be hashed.  They also don't need a name until a
          * user wants to identify the object in /proc/pid/fd/.  The little hack
          * below allows us to generate a name for these objects on demand:
+         *
+         * Some pseudo inodes are mountable.  When they are mounted
+         * path->dentry == path->mnt->mnt_root.  In that case don't call d_dname
+         * and instead have d_path return the mounted path.
          */
-        if (path->dentry->d_op && path->dentry->d_op->d_dname)
+        if (path->dentry->d_op && path->dentry->d_op->d_dname &&
+            (!IS_ROOT(path->dentry) || path->dentry != path->mnt->mnt_root))
                 return path->dentry->d_op->d_dname(path->dentry, buf, buflen);
 
         rcu_read_lock();
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 8b5e2584c840..af903128891c 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1907,10 +1907,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                         }
                 }
         }
-        if (op == EPOLL_CTL_DEL && is_file_epoll(tf.file)) {
-                tep = tf.file->private_data;
-                mutex_lock_nested(&tep->mtx, 1);
-        }
 
         /*
          * Try to lookup the file inside our RB tree, Since we grabbed "mtx"
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 288534920fe5..20d6697bd638 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1493,6 +1493,7 @@ static ssize_t ext2_quota_write(struct super_block *sb, int type,
                                 sb->s_blocksize - offset : towrite;
 
                 tmp_bh.b_state = 0;
+                tmp_bh.b_size = sb->s_blocksize;
                 err = ext2_get_block(inode, blk, &tmp_bh, 1);
                 if (err < 0)
                         goto out;
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index e6185031c1cc..ece55565b9cd 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -268,6 +268,16 @@ struct ext4_io_submit {
 /* Translate # of blks to # of clusters */
 #define EXT4_NUM_B2C(sbi, blks) (((blks) + (sbi)->s_cluster_ratio - 1) >> \
                                  (sbi)->s_cluster_bits)
+/* Mask out the low bits to get the starting block of the cluster */
+#define EXT4_PBLK_CMASK(s, pblk) ((pblk) &                              \
+                                  ~((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
+#define EXT4_LBLK_CMASK(s, lblk) ((lblk) &                              \
+                                  ~((ext4_lblk_t) (s)->s_cluster_ratio - 1))
+/* Get the cluster offset */
+#define EXT4_PBLK_COFF(s, pblk) ((pblk) &                               \
+                                 ((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
+#define EXT4_LBLK_COFF(s, lblk) ((lblk) &                               \
+                                 ((ext4_lblk_t) (s)->s_cluster_ratio - 1))
 
 /*
  * Structure of a blocks group descriptor
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index 17ac112ab101..3fe29de832c8 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -259,6 +259,15 @@ int __ext4_handle_dirty_metadata(const char *where, unsigned int line,
                 if (WARN_ON_ONCE(err)) {
                         ext4_journal_abort_handle(where, line, __func__, bh,
                                                   handle, err);
+                        ext4_error_inode(inode, where, line,
+                                         bh->b_blocknr,
+                                         "journal_dirty_metadata failed: "
+                                         "handle type %u started at line %u, "
+                                         "credits %u/%u, errcode %d",
+                                         handle->h_type,
+                                         handle->h_line_no,
+                                         handle->h_requested_credits,
+                                         handle->h_buffer_credits, err);
                 }
         } else {
                 if (inode)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 35f65cf4f318..3384dc4bed40 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -360,8 +360,10 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
 {
         ext4_fsblk_t block = ext4_ext_pblock(ext);
         int len = ext4_ext_get_actual_len(ext);
+        ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
+        ext4_lblk_t last = lblock + len - 1;
 
-        if (len == 0)
+        if (lblock > last)
                 return 0;
         return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
 }
@@ -387,11 +389,26 @@ static int ext4_valid_extent_entries(struct inode *inode,
         if (depth == 0) {
                 /* leaf entries */
                 struct ext4_extent *ext = EXT_FIRST_EXTENT(eh);
+                struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
+                ext4_fsblk_t pblock = 0;
+                ext4_lblk_t lblock = 0;
+                ext4_lblk_t prev = 0;
+                int len = 0;
                 while (entries) {
                         if (!ext4_valid_extent(inode, ext))
                                 return 0;
+
+                        /* Check for overlapping extents */
+                        lblock = le32_to_cpu(ext->ee_block);
+                        len = ext4_ext_get_actual_len(ext);
+                        if ((lblock <= prev) && prev) {
+                                pblock = ext4_ext_pblock(ext);
+                                es->s_last_error_block = cpu_to_le64(pblock);
+                                return 0;
+                        }
                         ext++;
                         entries--;
+                        prev = lblock + len - 1;
                 }
         } else {
                 struct ext4_extent_idx *ext_idx = EXT_FIRST_INDEX(eh);
@@ -1834,8 +1851,7 @@ static unsigned int ext4_ext_check_overlap(struct ext4_sb_info *sbi,
         depth = ext_depth(inode);
         if (!path[depth].p_ext)
                 goto out;
-        b2 = le32_to_cpu(path[depth].p_ext->ee_block);
-        b2 &= ~(sbi->s_cluster_ratio - 1);
+        b2 = EXT4_LBLK_CMASK(sbi, le32_to_cpu(path[depth].p_ext->ee_block));
 
         /*
          * get the next allocated block if the extent in the path
@@ -1845,7 +1861,7 @@ static unsigned int ext4_ext_check_overlap(struct ext4_sb_info *sbi,
                 b2 = ext4_ext_next_allocated_block(path);
                 if (b2 == EXT_MAX_BLOCKS)
                         goto out;
-                b2 &= ~(sbi->s_cluster_ratio - 1);
+                b2 = EXT4_LBLK_CMASK(sbi, b2);
         }
 
         /* check for wrap through zero on extent logical start block*/
@@ -2504,7 +2520,7 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
                  * extent, we have to mark the cluster as used (store negative
                  * cluster number in partial_cluster).
                  */
-                unaligned = pblk & (sbi->s_cluster_ratio - 1);
+                unaligned = EXT4_PBLK_COFF(sbi, pblk);
                 if (unaligned && (ee_len == num) &&
                     (*partial_cluster != -((long long)EXT4_B2C(sbi, pblk))))
                         *partial_cluster = EXT4_B2C(sbi, pblk);
@@ -2598,7 +2614,7 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
                          * accidentally freeing it later on
                          */
                         pblk = ext4_ext_pblock(ex);
-                        if (pblk & (sbi->s_cluster_ratio - 1))
+                        if (EXT4_PBLK_COFF(sbi, pblk))
                                 *partial_cluster =
                                         -((long long)EXT4_B2C(sbi, pblk));
                         ex--;
@@ -3753,7 +3769,7 @@ int ext4_find_delalloc_cluster(struct inode *inode, ext4_lblk_t lblk)
 {
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
         ext4_lblk_t lblk_start, lblk_end;
-        lblk_start = lblk & (~(sbi->s_cluster_ratio - 1));
+        lblk_start = EXT4_LBLK_CMASK(sbi, lblk);
         lblk_end = lblk_start + sbi->s_cluster_ratio - 1;
 
         return ext4_find_delalloc_range(inode, lblk_start, lblk_end);
@@ -3812,9 +3828,9 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
         trace_ext4_get_reserved_cluster_alloc(inode, lblk_start, num_blks);
 
         /* Check towards left side */
-        c_offset = lblk_start & (sbi->s_cluster_ratio - 1);
+        c_offset = EXT4_LBLK_COFF(sbi, lblk_start);
         if (c_offset) {
-                lblk_from = lblk_start & (~(sbi->s_cluster_ratio - 1));
+                lblk_from = EXT4_LBLK_CMASK(sbi, lblk_start);
                 lblk_to = lblk_from + c_offset - 1;
 
                 if (ext4_find_delalloc_range(inode, lblk_from, lblk_to))
@@ -3822,7 +3838,7 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
         }
 
         /* Now check towards right. */
-        c_offset = (lblk_start + num_blks) & (sbi->s_cluster_ratio - 1);
+        c_offset = EXT4_LBLK_COFF(sbi, lblk_start + num_blks);
         if (allocated_clusters && c_offset) {
                 lblk_from = lblk_start + num_blks;
                 lblk_to = lblk_from + (sbi->s_cluster_ratio - c_offset) - 1;
@@ -4030,7 +4046,7 @@ static int get_implied_cluster_alloc(struct super_block *sb,
                                      struct ext4_ext_path *path)
 {
         struct ext4_sb_info *sbi = EXT4_SB(sb);
-        ext4_lblk_t c_offset = map->m_lblk & (sbi->s_cluster_ratio-1);
+        ext4_lblk_t c_offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
         ext4_lblk_t ex_cluster_start, ex_cluster_end;
         ext4_lblk_t rr_cluster_start;
         ext4_lblk_t ee_block = le32_to_cpu(ex->ee_block);
@@ -4048,8 +4064,7 @@ static int get_implied_cluster_alloc(struct super_block *sb,
             (rr_cluster_start == ex_cluster_start)) {
                 if (rr_cluster_start == ex_cluster_end)
                         ee_start += ee_len - 1;
-                map->m_pblk = (ee_start & ~(sbi->s_cluster_ratio - 1)) +
-                        c_offset;
+                map->m_pblk = EXT4_PBLK_CMASK(sbi, ee_start) + c_offset;
                 map->m_len = min(map->m_len,
                                  (unsigned) sbi->s_cluster_ratio - c_offset);
                 /*
@@ -4203,7 +4218,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
          */
         map->m_flags &= ~EXT4_MAP_FROM_CLUSTER;
         newex.ee_block = cpu_to_le32(map->m_lblk);
-        cluster_offset = map->m_lblk & (sbi->s_cluster_ratio-1);
+        cluster_offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
 
         /*
          * If we are doing bigalloc, check to see if the extent returned
@@ -4271,7 +4286,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
          * needed so that future calls to get_implied_cluster_alloc()
          * work correctly.
          */
-        offset = map->m_lblk & (sbi->s_cluster_ratio - 1);
+        offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
         ar.len = EXT4_NUM_B2C(sbi, offset+allocated);
         ar.goal -= offset;
         ar.logical -= offset;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 075763474118..61d49ff22c81 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1206,7 +1206,6 @@ static int ext4_journalled_write_end(struct file *file,
  */
 static int ext4_da_reserve_metadata(struct inode *inode, ext4_lblk_t lblock)
 {
-        int retries = 0;
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
         struct ext4_inode_info *ei = EXT4_I(inode);
         unsigned int md_needed;
@@ -1218,7 +1217,6 @@ static int ext4_da_reserve_metadata(struct inode *inode, ext4_lblk_t lblock)
          * in order to allocate nrblocks
          * worse case is one extent per block
          */
-repeat:
         spin_lock(&ei->i_block_reservation_lock);
         /*
          * ext4_calc_metadata_amount() has side effects, which we have
@@ -1238,10 +1236,6 @@ repeat:
                 ei->i_da_metadata_calc_len = save_len;
                 ei->i_da_metadata_calc_last_lblock = save_last_lblock;
                 spin_unlock(&ei->i_block_reservation_lock);
-                if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
-                        cond_resched();
-                        goto repeat;
-                }
                 return -ENOSPC;
         }
         ei->i_reserved_meta_blocks += md_needed;
@@ -1255,7 +1249,6 @@ repeat:
  */
 static int ext4_da_reserve_space(struct inode *inode, ext4_lblk_t lblock)
 {
-        int retries = 0;
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
         struct ext4_inode_info *ei = EXT4_I(inode);
         unsigned int md_needed;
@@ -1277,7 +1270,6 @@ static int ext4_da_reserve_space(struct inode *inode, ext4_lblk_t lblock)
          * in order to allocate nrblocks
          * worse case is one extent per block
          */
-repeat:
         spin_lock(&ei->i_block_reservation_lock);
         /*
          * ext4_calc_metadata_amount() has side effects, which we have
@@ -1297,10 +1289,6 @@ repeat:
                 ei->i_da_metadata_calc_len = save_len;
                 ei->i_da_metadata_calc_last_lblock = save_last_lblock;
                 spin_unlock(&ei->i_block_reservation_lock);
-                if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
-                        cond_resched();
-                        goto repeat;
-                }
                 dquot_release_reservation_block(inode, EXT4_C2B(sbi, 1));
                 return -ENOSPC;
         }
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 4d113efa024c..04a5c7504be9 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3442,6 +3442,9 @@ static void ext4_mb_pa_callback(struct rcu_head *head)
 {
         struct ext4_prealloc_space *pa;
         pa = container_of(head, struct ext4_prealloc_space, u.pa_rcu);
+
+        BUG_ON(atomic_read(&pa->pa_count));
+        BUG_ON(pa->pa_deleted == 0);
         kmem_cache_free(ext4_pspace_cachep, pa);
 }
 
@@ -3455,11 +3458,13 @@ static void ext4_mb_put_pa(struct ext4_allocation_context *ac,
         ext4_group_t grp;
         ext4_fsblk_t grp_blk;
 
-        if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0)
-                return;
-
         /* in this short window concurrent discard can set pa_deleted */
         spin_lock(&pa->pa_lock);
+        if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0) {
+                spin_unlock(&pa->pa_lock);
+                return;
+        }
+
         if (pa->pa_deleted == 1) {
                 spin_unlock(&pa->pa_lock);
                 return;
@@ -4121,7 +4126,7 @@ ext4_mb_initialize_context(struct ext4_allocation_context *ac,
         ext4_get_group_no_and_offset(sb, goal, &group, &block);
 
         /* set up allocation goals */
-        ac->ac_b_ex.fe_logical = ar->logical & ~(sbi->s_cluster_ratio - 1);
+        ac->ac_b_ex.fe_logical = EXT4_LBLK_CMASK(sbi, ar->logical);
         ac->ac_status = AC_STATUS_CONTINUE;
         ac->ac_sb = sb;
         ac->ac_inode = ar->inode;
@@ -4663,7 +4668,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
          * blocks at the beginning or the end unless we are explicitly
          * requested to avoid doing so.
          */
-        overflow = block & (sbi->s_cluster_ratio - 1);
+        overflow = EXT4_PBLK_COFF(sbi, block);
         if (overflow) {
                 if (flags & EXT4_FREE_BLOCKS_NOFREE_FIRST_CLUSTER) {
                         overflow = sbi->s_cluster_ratio - overflow;
@@ -4677,7 +4682,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
                         count += overflow;
                 }
         }
-        overflow = count & (sbi->s_cluster_ratio - 1);
+        overflow = EXT4_LBLK_COFF(sbi, count);
         if (overflow) {
                 if (flags & EXT4_FREE_BLOCKS_NOFREE_LAST_CLUSTER) {
                         if (count > overflow)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index c977f4e4e63b..1f7784de05b6 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -792,7 +792,7 @@ static void ext4_put_super(struct super_block *sb)
         }
 
         ext4_es_unregister_shrinker(sbi);
-        del_timer(&sbi->s_err_report);
+        del_timer_sync(&sbi->s_err_report);
         ext4_release_system_zone(sb);
         ext4_mb_release(sb);
         ext4_ext_release(sb);
@@ -3316,11 +3316,19 @@ int ext4_calculate_overhead(struct super_block *sb)
 }
 
 
-static ext4_fsblk_t ext4_calculate_resv_clusters(struct ext4_sb_info *sbi)
+static ext4_fsblk_t ext4_calculate_resv_clusters(struct super_block *sb)
 {
         ext4_fsblk_t resv_clusters;
 
         /*
+         * There's no need to reserve anything when we aren't using extents.
+         * The space estimates are exact, there are no unwritten extents,
+         * hole punching doesn't need new metadata... This is needed especially
+         * to keep ext2/3 backward compatibility.
+         */
+        if (!EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_EXTENTS))
+                return 0;
+        /*
          * By default we reserve 2% or 4096 clusters, whichever is smaller.
          * This should cover the situations where we can not afford to run
          * out of space like for example punch hole, or converting
@@ -3328,7 +3336,8 @@ static ext4_fsblk_t ext4_calculate_resv_clusters(struct ext4_sb_info *sbi)
          * allocation would require 1, or 2 blocks, higher numbers are
          * very rare.
          */
-        resv_clusters = ext4_blocks_count(sbi->s_es) >> sbi->s_cluster_bits;
+        resv_clusters = ext4_blocks_count(EXT4_SB(sb)->s_es) >>
+                        EXT4_SB(sb)->s_cluster_bits;
 
         do_div(resv_clusters, 50);
         resv_clusters = min_t(ext4_fsblk_t, resv_clusters, 4096);
@@ -4071,10 +4080,10 @@ no_journal:
                          "available");
         }
 
-        err = ext4_reserve_clusters(sbi, ext4_calculate_resv_clusters(sbi));
+        err = ext4_reserve_clusters(sbi, ext4_calculate_resv_clusters(sb));
         if (err) {
                 ext4_msg(sb, KERN_ERR, "failed to reserve %llu clusters for "
-                         "reserved pool", ext4_calculate_resv_clusters(sbi));
+                         "reserved pool", ext4_calculate_resv_clusters(sb));
                 goto failed_mount4a;
         }
 
@@ -4184,7 +4193,7 @@ failed_mount_wq:
         }
 failed_mount3:
         ext4_es_unregister_shrinker(sbi);
-        del_timer(&sbi->s_err_report);
+        del_timer_sync(&sbi->s_err_report);
         if (sbi->s_flex_groups)
                 ext4_kvfree(sbi->s_flex_groups);
         percpu_counter_destroy(&sbi->s_freeclusters_counter);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 1f4a10ece2f1..e0259a163f98 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -516,13 +516,16 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb,
         }
         WARN_ON(inode->i_state & I_SYNC);
         /*
-         * Skip inode if it is clean. We don't want to mess with writeback
-         * lists in this function since flusher thread may be doing for example
-         * sync in parallel and if we move the inode, it could get skipped. So
-         * here we make sure inode is on some writeback list and leave it there
-         * unless we have completely cleaned the inode.
+         * Skip inode if it is clean and we have no outstanding writeback in
+         * WB_SYNC_ALL mode. We don't want to mess with writeback lists in this
+         * function since flusher thread may be doing for example sync in
+         * parallel and if we move the inode, it could get skipped. So here we
+         * make sure inode is on some writeback list and leave it there unless
+         * we have completely cleaned the inode.
          */
-        if (!(inode->i_state & I_DIRTY))
+        if (!(inode->i_state & I_DIRTY) &&
+            (wbc->sync_mode != WB_SYNC_ALL ||
+             !mapping_tagged(inode->i_mapping, PAGECACHE_TAG_WRITEBACK)))
                 goto out;
         inode->i_state |= I_SYNC;
         spin_unlock(&inode->i_lock);
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index b7fc035a6943..73f3e4ee4037 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -986,6 +986,7 @@ static ssize_t gfs2_direct_IO(int rw, struct kiocb *iocb,
 {
         struct file *file = iocb->ki_filp;
         struct inode *inode = file->f_mapping->host;
+        struct address_space *mapping = inode->i_mapping;
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_holder gh;
         int rv;
@@ -1006,6 +1007,35 @@ static ssize_t gfs2_direct_IO(int rw, struct kiocb *iocb,
         if (rv != 1)
                 goto out; /* dio not valid, fall back to buffered i/o */
 
+        /*
+         * Now since we are holding a deferred (CW) lock at this point, you
+         * might be wondering why this is ever needed. There is a case however
+         * where we've granted a deferred local lock against a cached exclusive
+         * glock. That is ok provided all granted local locks are deferred, but
+         * it also means that it is possible to encounter pages which are
+         * cached and possibly also mapped. So here we check for that and sort
+         * them out ahead of the dio. The glock state machine will take care of
+         * everything else.
+         *
+         * If in fact the cached glock state (gl->gl_state) is deferred (CW) in
+         * the first place, mapping->nr_pages will always be zero.
+         */
+        if (mapping->nrpages) {
+                loff_t lstart = offset & (PAGE_CACHE_SIZE - 1);
+                loff_t len = iov_length(iov, nr_segs);
+                loff_t end = PAGE_ALIGN(offset + len) - 1;
+
+                rv = 0;
+                if (len == 0)
+                        goto out;
+                if (test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
+                        unmap_shared_mapping_range(ip->i_inode.i_mapping, offset, len);
+                rv = filemap_write_and_wait_range(mapping, lstart, end);
+                if (rv)
+                        return rv;
+                truncate_inode_pages_range(mapping, lstart, end);
+        }
+
         rv = __blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
                                   offset, nr_segs, gfs2_get_block_direct,
                                   NULL, NULL, 0);
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index c8420f7e4db6..6f7a47c05259 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1655,6 +1655,7 @@ static int dump_holder(struct seq_file *seq, const struct gfs2_holder *gh)
         struct task_struct *gh_owner = NULL;
         char flags_buf[32];
 
+        rcu_read_lock();
         if (gh->gh_owner_pid)
                 gh_owner = pid_task(gh->gh_owner_pid, PIDTYPE_PID);
         gfs2_print_dbg(seq, " H: s:%s f:%s e:%d p:%ld [%s] %pS\n",
@@ -1664,6 +1665,7 @@ static int dump_holder(struct seq_file *seq, const struct gfs2_holder *gh)
                        gh->gh_owner_pid ? (long)pid_nr(gh->gh_owner_pid) : -1,
                        gh_owner ? gh_owner->comm : "(ended)",
                        (void *)gh->gh_ip);
+        rcu_read_unlock();
         return 0;
 }
 
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index db908f697139..f88dcd925010 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -192,8 +192,11 @@ static void inode_go_sync(struct gfs2_glock *gl)
 
         if (ip && !S_ISREG(ip->i_inode.i_mode))
                 ip = NULL;
-        if (ip && test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
-                unmap_shared_mapping_range(ip->i_inode.i_mapping, 0, 0);
+        if (ip) {
+                if (test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
+                        unmap_shared_mapping_range(ip->i_inode.i_mapping, 0, 0);
+                inode_dio_wait(&ip->i_inode);
+        }
         if (!test_and_clear_bit(GLF_DIRTY, &gl->gl_flags))
                 return;
 
@@ -410,6 +413,9 @@ static int inode_go_lock(struct gfs2_holder *gh)
                         return error;
         }
 
+        if (gh->gh_state != LM_ST_DEFERRED)
+                inode_dio_wait(&ip->i_inode);
+
         if ((ip->i_diskflags & GFS2_DIF_TRUNC_IN_PROG) &&
             (gl->gl_state == LM_ST_EXCLUSIVE) &&
             (gh->gh_state == LM_ST_EXCLUSIVE)) {
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 610613fb65b5..9dcb9777a5f8 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -551,10 +551,10 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
         struct buffer_head *bh = bd->bd_bh;
         struct gfs2_glock *gl = bd->bd_gl;
 
-        gfs2_remove_from_ail(bd);
-        bd->bd_bh = NULL;
         bh->b_private = NULL;
         bd->bd_blkno = bh->b_blocknr;
+        gfs2_remove_from_ail(bd); /* drops ref on bh */
+        bd->bd_bh = NULL;
         bd->bd_ops = &gfs2_revoke_lops;
         sdp->sd_log_num_revoke++;
         atomic_inc(&gl->gl_revokes);
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index 932415050540..52f177be3bf8 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -258,6 +258,7 @@ void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int
         struct address_space *mapping = bh->b_page->mapping;
         struct gfs2_sbd *sdp = gfs2_mapping2sbd(mapping);
         struct gfs2_bufdata *bd = bh->b_private;
+        int was_pinned = 0;
 
         if (test_clear_buffer_pinned(bh)) {
                 trace_gfs2_pin(bd, 0);
@@ -273,12 +274,16 @@ void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int
                         tr->tr_num_databuf_rm++;
                 }
                 tr->tr_touched = 1;
+                was_pinned = 1;
                 brelse(bh);
         }
         if (bd) {
                 spin_lock(&sdp->sd_ail_lock);
                 if (bd->bd_tr) {
                         gfs2_trans_add_revoke(sdp, bd);
+                } else if (was_pinned) {
+                        bh->b_private = NULL;
+                        kmem_cache_free(gfs2_bufdata_cachep, bd);
                 }
                 spin_unlock(&sdp->sd_ail_lock);
         }
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 82303b474958..52fa88314f5c 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1366,8 +1366,18 @@ static struct dentry *gfs2_mount(struct file_system_type *fs_type, int flags,
         if (IS_ERR(s))
                 goto error_bdev;
 
-        if (s->s_root)
+        if (s->s_root) {
+                /*
+                 * s_umount nests inside bd_mutex during
+                 * __invalidate_device().  blkdev_put() acquires
+                 * bd_mutex and can't be called under s_umount.  Drop
+                 * s_umount temporarily.  This is safe as we're
+                 * holding an active reference.
+                 */
+                up_write(&s->s_umount);
                 blkdev_put(bdev, mode);
+                down_write(&s->s_umount);
+        }
 
         memset(&args, 0, sizeof(args));
         args.ar_quota = GFS2_QUOTA_DEFAULT;
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 52032647dd4a..5fa344afb49a 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -702,7 +702,7 @@ int jbd2_log_wait_commit(journal_t *journal, tid_t tid)
         read_lock(&journal->j_state_lock);
 #ifdef CONFIG_JBD2_DEBUG
         if (!tid_geq(journal->j_commit_request, tid)) {
-                printk(KERN_EMERG
+                printk(KERN_ERR
                        "%s: error: j_commit_request=%d, tid=%d\n",
                        __func__, journal->j_commit_request, tid);
         }
@@ -718,10 +718,8 @@ int jbd2_log_wait_commit(journal_t *journal, tid_t tid)
         }
         read_unlock(&journal->j_state_lock);
 
-        if (unlikely(is_journal_aborted(journal))) {
-                printk(KERN_EMERG "journal commit I/O error\n");
+        if (unlikely(is_journal_aborted(journal)))
                 err = -EIO;
-        }
         return err;
 }
 
@@ -1527,13 +1525,13 @@ static int journal_get_superblock(journal_t *journal)
         if (JBD2_HAS_COMPAT_FEATURE(journal, JBD2_FEATURE_COMPAT_CHECKSUM) &&
             JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
                 /* Can't have checksum v1 and v2 on at the same time! */
-                printk(KERN_ERR "JBD: Can't enable checksumming v1 and v2 "
+                printk(KERN_ERR "JBD2: Can't enable checksumming v1 and v2 "
                        "at the same time!\n");
                 goto out;
         }
 
         if (!jbd2_verify_csum_type(journal, sb)) {
-                printk(KERN_ERR "JBD: Unknown checksum type\n");
+                printk(KERN_ERR "JBD2: Unknown checksum type\n");
                 goto out;
         }
 
@@ -1541,7 +1539,7 @@ static int journal_get_superblock(journal_t *journal)
         if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
                 journal->j_chksum_driver = crypto_alloc_shash("crc32c", 0, 0);
                 if (IS_ERR(journal->j_chksum_driver)) {
-                        printk(KERN_ERR "JBD: Cannot load crc32c driver.\n");
+                        printk(KERN_ERR "JBD2: Cannot load crc32c driver.\n");
                         err = PTR_ERR(journal->j_chksum_driver);
                         journal->j_chksum_driver = NULL;
                         goto out;
@@ -1550,7 +1548,7 @@ static int journal_get_superblock(journal_t *journal)
 
         /* Check superblock checksum */
         if (!jbd2_superblock_csum_verify(journal, sb)) {
-                printk(KERN_ERR "JBD: journal checksum error\n");
+                printk(KERN_ERR "JBD2: journal checksum error\n");
                 goto out;
         }
 
@@ -1836,7 +1834,7 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
                         journal->j_chksum_driver = crypto_alloc_shash("crc32c",
                                                                       0, 0);
                         if (IS_ERR(journal->j_chksum_driver)) {
-                                printk(KERN_ERR "JBD: Cannot load crc32c "
+                                printk(KERN_ERR "JBD2: Cannot load crc32c "
                                        "driver.\n");
                                 journal->j_chksum_driver = NULL;
                                 return 0;
@@ -2645,7 +2643,7 @@ static void __exit journal_exit(void)
 #ifdef CONFIG_JBD2_DEBUG
         int n = atomic_read(&nr_journal_heads);
         if (n)
-                printk(KERN_EMERG "JBD2: leaked %d journal_heads!\n", n);
+                printk(KERN_ERR "JBD2: leaked %d journal_heads!\n", n);
 #endif
         jbd2_remove_jbd_stats_proc_entry();
         jbd2_journal_destroy_caches();
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 3929c50428b1..3b6bb19d60b1 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -594,7 +594,7 @@ static int do_one_pass(journal_t *journal,
                                                 be32_to_cpu(tmp->h_sequence))) {
                                                 brelse(obh);
                                                 success = -EIO;
-                                                printk(KERN_ERR "JBD: Invalid "
+                                                printk(KERN_ERR "JBD2: Invalid "
                                                        "checksum recovering "
                                                        "block %llu in log\n",
                                                        blocknr);
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 7aa9a32573bb..8360674c85bc 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -932,7 +932,7 @@ repeat:
                                         jbd2_alloc(jh2bh(jh)->b_size,
                                                          GFP_NOFS);
                                 if (!frozen_buffer) {
-                                        printk(KERN_EMERG
+                                        printk(KERN_ERR
                                                "%s: OOM for frozen_buffer\n",
                                                __func__);
                                         JBUFFER_TRACE(jh, "oom!");
@@ -1166,7 +1166,7 @@ repeat:
         if (!jh->b_committed_data) {
                 committed_data = jbd2_alloc(jh2bh(jh)->b_size, GFP_NOFS);
                 if (!committed_data) {
-                        printk(KERN_EMERG "%s: No memory for committed data\n",
+                        printk(KERN_ERR "%s: No memory for committed data\n",
                                 __func__);
                         err = -ENOMEM;
                         goto out;
@@ -1290,7 +1290,10 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                  * once a transaction -bzzz
                  */
                 jh->b_modified = 1;
-                J_ASSERT_JH(jh, handle->h_buffer_credits > 0);
+                if (handle->h_buffer_credits <= 0) {
+                        ret = -ENOSPC;
+                        goto out_unlock_bh;
+                }
                 handle->h_buffer_credits--;
         }
 
@@ -1305,7 +1308,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                 JBUFFER_TRACE(jh, "fastpath");
                 if (unlikely(jh->b_transaction !=
                              journal->j_running_transaction)) {
-                        printk(KERN_EMERG "JBD: %s: "
+                        printk(KERN_ERR "JBD2: %s: "
                                "jh->b_transaction (%llu, %p, %u) != "
                                "journal->j_running_transaction (%p, %u)",
                                journal->j_devname,
@@ -1332,7 +1335,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                 JBUFFER_TRACE(jh, "already on other transaction");
                 if (unlikely(jh->b_transaction !=
                              journal->j_committing_transaction)) {
-                        printk(KERN_EMERG "JBD: %s: "
+                        printk(KERN_ERR "JBD2: %s: "
                                "jh->b_transaction (%llu, %p, %u) != "
                                "journal->j_committing_transaction (%p, %u)",
                                journal->j_devname,
@@ -1345,7 +1348,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                         ret = -EINVAL;
                 }
                 if (unlikely(jh->b_next_transaction != transaction)) {
-                        printk(KERN_EMERG "JBD: %s: "
+                        printk(KERN_ERR "JBD2: %s: "
                                "jh->b_next_transaction (%llu, %p, %u) != "
                                "transaction (%p, %u)",
                                journal->j_devname,
@@ -1373,7 +1376,6 @@ out_unlock_bh:
         jbd2_journal_put_journal_head(jh);
 out:
         JBUFFER_TRACE(jh, "exit");
-        WARN_ON(ret);   /* All errors are bugs, so dump the stack */
         return ret;
 }
 
diff --git a/fs/namespace.c b/fs/namespace.c
index ac2ce8a766e1..be32ebccdeb1 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2886,7 +2886,7 @@ bool fs_fully_visible(struct file_system_type *type)
                         struct inode *inode = child->mnt_mountpoint->d_inode;
                         if (!S_ISDIR(inode->i_mode))
                                 goto next;
-                        if (inode->i_nlink != 2)
+                        if (inode->i_nlink > 2)
                                 goto next;
                 }
                 visible = true;
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 9f6b486b6c01..a1a191634abc 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1440,17 +1440,19 @@ static int nilfs_segctor_collect(struct nilfs_sc_info *sci,
 
                 nilfs_clear_logs(&sci->sc_segbufs);
 
-                err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
-                if (unlikely(err))
-                        return err;
-
                 if (sci->sc_stage.flags & NILFS_CF_SUFREED) {
                         err = nilfs_sufile_cancel_freev(nilfs->ns_sufile,
                                                         sci->sc_freesegs,
                                                         sci->sc_nfreesegs,
                                                         NULL);
                         WARN_ON(err); /* do not happen */
+                        sci->sc_stage.flags &= ~NILFS_CF_SUFREED;
                 }
+
+                err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
+                if (unlikely(err))
+                        return err;
+
                 nadd = min_t(int, nadd << 1, SC_MAX_SEGDELTA);
                 sci->sc_stage = prev_stage;
         }
diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index b8e93a40a5d3..78c3c2097787 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -443,8 +443,11 @@ int pstore_register(struct pstore_info *psi)
                 pstore_get_records(0);
 
         kmsg_dump_register(&pstore_dumper);
-        pstore_register_console();
-        pstore_register_ftrace();
+
+        if ((psi->flags & PSTORE_FLAGS_FRAGILE) == 0) {
+                pstore_register_console();
+                pstore_register_ftrace();
+        }
 
         if (pstore_update_ms >= 0) {
                 pstore_timer.expires = jiffies +
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index b94f93685093..35e7d08fe629 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -609,7 +609,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
         struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
         struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
         struct sysfs_open_file *of;
-        bool has_read, has_write, has_mmap;
+        bool has_read, has_write;
         int error = -EACCES;
 
         /* need attr_sd for attr and ops, its parent for kobj */
@@ -621,7 +621,6 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
 
                 has_read = battr->read || battr->mmap;
                 has_write = battr->write || battr->mmap;
-                has_mmap = battr->mmap;
         } else {
                 const struct sysfs_ops *ops = sysfs_file_ops(attr_sd);
 
@@ -633,7 +632,6 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
 
                 has_read = ops->show;
                 has_write = ops->store;
-                has_mmap = false;
         }
 
         /* check perms and supported operations */
@@ -661,9 +659,9 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
          * open file has a separate mutex, it's okay as long as those don't
          * happen on the same file.  At this point, we can't easily give
          * each file a separate locking class.  Let's differentiate on
-         * whether the file has mmap or not for now.
+         * whether the file is bin or not for now.
          */
-        if (has_mmap)
+        if (sysfs_is_bin(attr_sd))
                 mutex_init(&of->mutex);
         else
                 mutex_init(&of->mutex);
diff --git a/fs/xfs/xfs_attr_remote.c b/fs/xfs/xfs_attr_remote.c
index 739e0a52deda..5549d69ddb45 100644
--- a/fs/xfs/xfs_attr_remote.c
+++ b/fs/xfs/xfs_attr_remote.c
@@ -110,7 +110,7 @@ xfs_attr3_rmt_verify(
         if (be32_to_cpu(rmt->rm_bytes) > fsbsize - sizeof(*rmt))
                 return false;
         if (be32_to_cpu(rmt->rm_offset) +
-                                be32_to_cpu(rmt->rm_bytes) >= XATTR_SIZE_MAX)
+                                be32_to_cpu(rmt->rm_bytes) > XATTR_SIZE_MAX)
                 return false;
         if (rmt->rm_owner == 0)
                 return false;
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 3ef11b22e750..3b2c14b6f0fb 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -1635,7 +1635,7 @@ xfs_bmap_last_extent(
  * blocks at the end of the file which do not start at the previous data block,
  * we will try to align the new blocks at stripe unit boundaries.
  *
- * Returns 0 in bma->aeof if the file (fork) is empty as any new write will be
+ * Returns 1 in bma->aeof if the file (fork) is empty as any new write will be
  * at, or past the EOF.
  */
 STATIC int
@@ -1650,9 +1650,14 @@ xfs_bmap_isaeof(
         bma->aeof = 0;
         error = xfs_bmap_last_extent(NULL, bma->ip, whichfork, &rec,
                                      &is_empty);
-        if (error || is_empty)
+        if (error)
                 return error;
 
+        if (is_empty) {
+                bma->aeof = 1;
+                return 0;
+        }
+
         /*
          * Check if we are allocation or past the last extent, or at least into
          * the last delayed allocated extent.
@@ -3643,10 +3648,19 @@ xfs_bmap_btalloc(
         int             isaligned;
         int             tryagain;
         int             error;
+        int             stripe_align;
 
         ASSERT(ap->length);
 
         mp = ap->ip->i_mount;
+
+        /* stripe alignment for allocation is determined by mount parameters */
+        stripe_align = 0;
+        if (mp->m_swidth && (mp->m_flags & XFS_MOUNT_SWALLOC))
+                stripe_align = mp->m_swidth;
+        else if (mp->m_dalign)
+                stripe_align = mp->m_dalign;
+
         align = ap->userdata ? xfs_get_extsz_hint(ap->ip) : 0;
         if (unlikely(align)) {
                 error = xfs_bmap_extsize_align(mp, &ap->got, &ap->prev,
@@ -3655,6 +3669,8 @@ xfs_bmap_btalloc(
                 ASSERT(!error);
                 ASSERT(ap->length);
         }
+
+
         nullfb = *ap->firstblock == NULLFSBLOCK;
         fb_agno = nullfb ? NULLAGNUMBER : XFS_FSB_TO_AGNO(mp, *ap->firstblock);
         if (nullfb) {
@@ -3730,7 +3746,7 @@ xfs_bmap_btalloc(
          */
         if (!ap->flist->xbf_low && ap->aeof) {
                 if (!ap->offset) {
-                        args.alignment = mp->m_dalign;
+                        args.alignment = stripe_align;
                         atype = args.type;
                         isaligned = 1;
                         /*
@@ -3755,13 +3771,13 @@ xfs_bmap_btalloc(
                          * of minlen+alignment+slop doesn't go up
                          * between the calls.
                          */
-                        if (blen > mp->m_dalign && blen <= args.maxlen)
-                                nextminlen = blen - mp->m_dalign;
+                        if (blen > stripe_align && blen <= args.maxlen)
+                                nextminlen = blen - stripe_align;
                         else
                                 nextminlen = args.minlen;
-                        if (nextminlen + mp->m_dalign > args.minlen + 1)
+                        if (nextminlen + stripe_align > args.minlen + 1)
                                 args.minalignslop =
-                                        nextminlen + mp->m_dalign -
+                                        nextminlen + stripe_align -
                                         args.minlen - 1;
                         else
                                 args.minalignslop = 0;
@@ -3783,7 +3799,7 @@ xfs_bmap_btalloc(
                  */
                 args.type = atype;
                 args.fsbno = ap->blkno;
-                args.alignment = mp->m_dalign;
+                args.alignment = stripe_align;
                 args.minlen = nextminlen;
                 args.minalignslop = 0;
                 isaligned = 1;
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 5887e41c0323..82e0dab46ee5 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -287,6 +287,7 @@ xfs_bmapi_allocate(
         INIT_WORK_ONSTACK(&args->work, xfs_bmapi_allocate_worker);
         queue_work(xfs_alloc_wq, &args->work);
         wait_for_completion(&done);
+        destroy_work_on_stack(&args->work);
         return args->result;
 }
 
@@ -1187,7 +1188,12 @@ xfs_zero_remaining_bytes(
                 XFS_BUF_UNWRITE(bp);
                 XFS_BUF_READ(bp);
                 XFS_BUF_SET_ADDR(bp, xfs_fsb_to_db(ip, imap.br_startblock));
-                xfsbdstrat(mp, bp);
+
+                if (XFS_FORCED_SHUTDOWN(mp)) {
+                        error = XFS_ERROR(EIO);
+                        break;
+                }
+                xfs_buf_iorequest(bp);
                 error = xfs_buf_iowait(bp);
                 if (error) {
                         xfs_buf_ioerror_alert(bp,
@@ -1200,7 +1206,12 @@ xfs_zero_remaining_bytes(
                 XFS_BUF_UNDONE(bp);
                 XFS_BUF_UNREAD(bp);
                 XFS_BUF_WRITE(bp);
-                xfsbdstrat(mp, bp);
+
+                if (XFS_FORCED_SHUTDOWN(mp)) {
+                        error = XFS_ERROR(EIO);
+                        break;
+                }
+                xfs_buf_iorequest(bp);
                 error = xfs_buf_iowait(bp);
                 if (error) {
                         xfs_buf_ioerror_alert(bp,
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index c7f0b77dcb00..afe7645e4b2b 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -698,7 +698,11 @@ xfs_buf_read_uncached(
         bp->b_flags |= XBF_READ;
         bp->b_ops = ops;
 
-        xfsbdstrat(target->bt_mount, bp);
+        if (XFS_FORCED_SHUTDOWN(target->bt_mount)) {
+                xfs_buf_relse(bp);
+                return NULL;
+        }
+        xfs_buf_iorequest(bp);
         xfs_buf_iowait(bp);
         return bp;
 }
@@ -1089,7 +1093,7 @@ xfs_bioerror(
  * This is meant for userdata errors; metadata bufs come with
  * iodone functions attached, so that we can track down errors.
  */
-STATIC int
+int
 xfs_bioerror_relse(
         struct xfs_buf  *bp)
 {
@@ -1152,7 +1156,7 @@ xfs_bwrite(
         ASSERT(xfs_buf_islocked(bp));
 
         bp->b_flags |= XBF_WRITE;
-        bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q);
+        bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q | XBF_WRITE_FAIL);
 
         xfs_bdstrat_cb(bp);
 
@@ -1164,25 +1168,6 @@ xfs_bwrite(
         return error;
 }
 
-/*
- * Wrapper around bdstrat so that we can stop data from going to disk in case
- * we are shutting down the filesystem.  Typically user data goes thru this
- * path; one of the exceptions is the superblock.
- */
-void
-xfsbdstrat(
-        struct xfs_mount        *mp,
-        struct xfs_buf          *bp)
-{
-        if (XFS_FORCED_SHUTDOWN(mp)) {
-                trace_xfs_bdstrat_shut(bp, _RET_IP_);
-                xfs_bioerror_relse(bp);
-                return;
-        }
-
-        xfs_buf_iorequest(bp);
-}
-
 STATIC void
 _xfs_buf_ioend(
         xfs_buf_t               *bp,
@@ -1516,6 +1501,12 @@ xfs_wait_buftarg(
                         struct xfs_buf *bp;
                         bp = list_first_entry(&dispose, struct xfs_buf, b_lru);
                         list_del_init(&bp->b_lru);
+                        if (bp->b_flags & XBF_WRITE_FAIL) {
+                                xfs_alert(btp->bt_mount,
+"Corruption Alert: Buffer at block 0x%llx had permanent write failures!\n"
+"Please run xfs_repair to determine the extent of the problem.",
+                                        (long long)bp->b_bn);
+                        }
                         xfs_buf_rele(bp);
                 }
                 if (loop++ != 0)
@@ -1799,7 +1790,7 @@ __xfs_buf_delwri_submit(
 
         blk_start_plug(&plug);
         list_for_each_entry_safe(bp, n, io_list, b_list) {
-                bp->b_flags &= ~(_XBF_DELWRI_Q | XBF_ASYNC);
+                bp->b_flags &= ~(_XBF_DELWRI_Q | XBF_ASYNC | XBF_WRITE_FAIL);
                 bp->b_flags |= XBF_WRITE;
 
                 if (!wait) {
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index e65683361017..1cf21a4a9f22 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -45,6 +45,7 @@ typedef enum {
 #define XBF_ASYNC        (1 << 4) /* initiator will not wait for completion */
 #define XBF_DONE         (1 << 5) /* all pages in the buffer uptodate */
 #define XBF_STALE        (1 << 6) /* buffer has been staled, do not find it */
+#define XBF_WRITE_FAIL   (1 << 24)/* async writes have failed on this buffer */
 
 /* I/O hints for the BIO layer */
 #define XBF_SYNCIO       (1 << 10)/* treat this buffer as synchronous I/O */
@@ -70,6 +71,7 @@ typedef unsigned int xfs_buf_flags_t;
         { XBF_ASYNC,            "ASYNC" }, \
         { XBF_DONE,             "DONE" }, \
         { XBF_STALE,            "STALE" }, \
+        { XBF_WRITE_FAIL,       "WRITE_FAIL" }, \
         { XBF_SYNCIO,           "SYNCIO" }, \
         { XBF_FUA,              "FUA" }, \
         { XBF_FLUSH,            "FLUSH" }, \
@@ -80,6 +82,7 @@ typedef unsigned int xfs_buf_flags_t;
         { _XBF_DELWRI_Q,        "DELWRI_Q" }, \
         { _XBF_COMPOUND,        "COMPOUND" }
 
+
 /*
  * Internal state flags.
  */
@@ -269,9 +272,6 @@ extern void xfs_buf_unlock(xfs_buf_t *);
 
 /* Buffer Read and Write Routines */
 extern int xfs_bwrite(struct xfs_buf *bp);
-
-extern void xfsbdstrat(struct xfs_mount *, struct xfs_buf *);
-
 extern void xfs_buf_ioend(xfs_buf_t *,  int);
 extern void xfs_buf_ioerror(xfs_buf_t *, int);
 extern void xfs_buf_ioerror_alert(struct xfs_buf *, const char *func);
@@ -282,6 +282,8 @@ extern void xfs_buf_iomove(xfs_buf_t *, size_t, size_t, void *,
 #define xfs_buf_zero(bp, off, len) \
             xfs_buf_iomove((bp), (off), (len), NULL, XBRW_ZERO)
 
+extern int xfs_bioerror_relse(struct xfs_buf *);
+
 static inline int xfs_buf_geterror(xfs_buf_t *bp)
 {
         return bp ? bp->b_error : ENOMEM;
@@ -301,7 +303,8 @@ extern void xfs_buf_terminate(void);
 
 #define XFS_BUF_ZEROFLAGS(bp) \
         ((bp)->b_flags &= ~(XBF_READ|XBF_WRITE|XBF_ASYNC| \
-                            XBF_SYNCIO|XBF_FUA|XBF_FLUSH))
+                            XBF_SYNCIO|XBF_FUA|XBF_FLUSH| \
+                            XBF_WRITE_FAIL))
 
 void xfs_buf_stale(struct xfs_buf *bp);
 #define XFS_BUF_UNSTALE(bp)     ((bp)->b_flags &= ~XBF_STALE)
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index a64f67ba25d3..2227b9b050bb 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -496,6 +496,14 @@ xfs_buf_item_unpin(
         }
 }
 
+/*
+ * Buffer IO error rate limiting. Limit it to no more than 10 messages per 30
+ * seconds so as to not spam logs too much on repeated detection of the same
+ * buffer being bad..
+ */
+
+DEFINE_RATELIMIT_STATE(xfs_buf_write_fail_rl_state, 30 * HZ, 10);
+
 STATIC uint
 xfs_buf_item_push(
         struct xfs_log_item     *lip,
@@ -524,6 +532,14 @@ xfs_buf_item_push(
 
         trace_xfs_buf_item_push(bip);
 
+        /* has a previous flush failed due to IO errors? */
+        if ((bp->b_flags & XBF_WRITE_FAIL) &&
+            ___ratelimit(&xfs_buf_write_fail_rl_state, "XFS:")) {
+                xfs_warn(bp->b_target->bt_mount,
+"Detected failing async write on buffer block 0x%llx. Retrying async write.\n",
+                         (long long)bp->b_bn);
+        }
+
         if (!xfs_buf_delwri_queue(bp, buffer_list))
                 rval = XFS_ITEM_FLUSHING;
         xfs_buf_unlock(bp);
@@ -1096,8 +1112,9 @@ xfs_buf_iodone_callbacks(
 
                 xfs_buf_ioerror(bp, 0); /* errno of 0 unsets the flag */
 
-                if (!XFS_BUF_ISSTALE(bp)) {
-                        bp->b_flags |= XBF_WRITE | XBF_ASYNC | XBF_DONE;
+                if (!(bp->b_flags & (XBF_STALE|XBF_WRITE_FAIL))) {
+                        bp->b_flags |= XBF_WRITE | XBF_ASYNC |
+                                       XBF_DONE | XBF_WRITE_FAIL;
                         xfs_buf_iorequest(bp);
                 } else {
                         xfs_buf_relse(bp);
diff --git a/fs/xfs/xfs_dir2_node.c b/fs/xfs/xfs_dir2_node.c
index 56369d4509d5..48c7d18f68c3 100644
--- a/fs/xfs/xfs_dir2_node.c
+++ b/fs/xfs/xfs_dir2_node.c
@@ -2067,12 +2067,12 @@ xfs_dir2_node_lookup(
  */
 int                                             /* error */
 xfs_dir2_node_removename(
-        xfs_da_args_t           *args)          /* operation arguments */
+        struct xfs_da_args      *args)          /* operation arguments */
 {
-        xfs_da_state_blk_t      *blk;           /* leaf block */
+        struct xfs_da_state_blk *blk;           /* leaf block */
         int                     error;          /* error return value */
         int                     rval;           /* operation return value */
-        xfs_da_state_t          *state;         /* btree cursor */
+        struct xfs_da_state     *state;         /* btree cursor */
 
         trace_xfs_dir2_node_removename(args);
 
@@ -2084,19 +2084,18 @@ xfs_dir2_node_removename(
         state->mp = args->dp->i_mount;
         state->blocksize = state->mp->m_dirblksize;
         state->node_ents = state->mp->m_dir_node_ents;
-        /*
-         * Look up the entry we're deleting, set up the cursor.
-         */
+
+        /* Look up the entry we're deleting, set up the cursor. */
         error = xfs_da3_node_lookup_int(state, &rval);
         if (error)
-                rval = error;
-        /*
-         * Didn't find it, upper layer screwed up.
-         */
+                goto out_free;
+
+        /* Didn't find it, upper layer screwed up. */
         if (rval != EEXIST) {
-                xfs_da_state_free(state);
-                return rval;
+                error = rval;
+                goto out_free;
         }
+
         blk = &state->path.blk[state->path.active - 1];
         ASSERT(blk->magic == XFS_DIR2_LEAFN_MAGIC);
         ASSERT(state->extravalid);
@@ -2107,7 +2106,7 @@ xfs_dir2_node_removename(
         error = xfs_dir2_leafn_remove(args, blk->bp, blk->index,
                 &state->extrablk, &rval);
         if (error)
-                return error;
+                goto out_free;
         /*
          * Fix the hash values up the btree.
          */
@@ -2122,6 +2121,7 @@ xfs_dir2_node_removename(
          */
         if (!error)
                 error = xfs_dir2_node_to_leaf(state);
+out_free:
         xfs_da_state_free(state);
         return error;
 }
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 27e0e544e963..104455b8046c 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -618,7 +618,8 @@ xfs_setattr_nonsize(
                 }
                 if (!gid_eq(igid, gid)) {
                         if (XFS_IS_QUOTA_RUNNING(mp) && XFS_IS_GQUOTA_ON(mp)) {
-                                ASSERT(!XFS_IS_PQUOTA_ON(mp));
+                                ASSERT(xfs_sb_version_has_pquotino(&mp->m_sb) ||
+                                       !XFS_IS_PQUOTA_ON(mp));
                                 ASSERT(mask & ATTR_GID);
                                 ASSERT(gdqp);
                                 olddquot2 = xfs_qm_vop_chown(tp, ip,
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index b6b669df40f3..eae16920655b 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -193,7 +193,10 @@ xlog_bread_noalign(
         bp->b_io_length = nbblks;
         bp->b_error = 0;
 
-        xfsbdstrat(log->l_mp, bp);
+        if (XFS_FORCED_SHUTDOWN(log->l_mp))
+                return XFS_ERROR(EIO);
+
+        xfs_buf_iorequest(bp);
         error = xfs_buf_iowait(bp);
         if (error)
                 xfs_buf_ioerror_alert(bp, __func__);
@@ -4397,7 +4400,13 @@ xlog_do_recover(
         XFS_BUF_READ(bp);
         XFS_BUF_UNASYNC(bp);
         bp->b_ops = &xfs_sb_buf_ops;
-        xfsbdstrat(log->l_mp, bp);
+
+        if (XFS_FORCED_SHUTDOWN(log->l_mp)) {
+                xfs_buf_relse(bp);
+                return XFS_ERROR(EIO);
+        }
+
+        xfs_buf_iorequest(bp);
         error = xfs_buf_iowait(bp);
         if (error) {
                 xfs_buf_ioerror_alert(bp, __func__);
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 14a4996cfec6..dd88f0e27bd8 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -134,8 +134,6 @@ xfs_qm_dqpurge(
 {
         struct xfs_mount        *mp = dqp->q_mount;
         struct xfs_quotainfo    *qi = mp->m_quotainfo;
-        struct xfs_dquot        *gdqp = NULL;
-        struct xfs_dquot        *pdqp = NULL;
 
         xfs_dqlock(dqp);
         if ((dqp->dq_flags & XFS_DQ_FREEING) || dqp->q_nrefs != 0) {
@@ -143,21 +141,6 @@ xfs_qm_dqpurge(
                 return EAGAIN;
         }
 
-        /*
-         * If this quota has a hint attached, prepare for releasing it now.
-         */
-        gdqp = dqp->q_gdquot;
-        if (gdqp) {
-                xfs_dqlock(gdqp);
-                dqp->q_gdquot = NULL;
-        }
-
-        pdqp = dqp->q_pdquot;
-        if (pdqp) {
-                xfs_dqlock(pdqp);
-                dqp->q_pdquot = NULL;
-        }
-
         dqp->dq_flags |= XFS_DQ_FREEING;
 
         xfs_dqflock(dqp);
@@ -206,11 +189,47 @@ xfs_qm_dqpurge(
         XFS_STATS_DEC(xs_qm_dquot_unused);
 
         xfs_qm_dqdestroy(dqp);
+        return 0;
+}
+
+/*
+ * Release the group or project dquot pointers the user dquots maybe carrying
+ * around as a hint, and proceed to purge the user dquot cache if requested.
+*/
+STATIC int
+xfs_qm_dqpurge_hints(
+        struct xfs_dquot        *dqp,
+        void                    *data)
+{
+        struct xfs_dquot        *gdqp = NULL;
+        struct xfs_dquot        *pdqp = NULL;
+        uint                    flags = *((uint *)data);
+
+        xfs_dqlock(dqp);
+        if (dqp->dq_flags & XFS_DQ_FREEING) {
+                xfs_dqunlock(dqp);
+                return EAGAIN;
+        }
+
+        /* If this quota has a hint attached, prepare for releasing it now */
+        gdqp = dqp->q_gdquot;
+        if (gdqp)
+                dqp->q_gdquot = NULL;
+
+        pdqp = dqp->q_pdquot;
+        if (pdqp)
+                dqp->q_pdquot = NULL;
+
+        xfs_dqunlock(dqp);
 
         if (gdqp)
-                xfs_qm_dqput(gdqp);
+                xfs_qm_dqrele(gdqp);
         if (pdqp)
-                xfs_qm_dqput(pdqp);
+                xfs_qm_dqrele(pdqp);
+
+        if (flags & XFS_QMOPT_UQUOTA)
+                return xfs_qm_dqpurge(dqp, NULL);
+
         return 0;
 }
 
@@ -222,8 +241,18 @@ xfs_qm_dqpurge_all(
         struct xfs_mount        *mp,
         uint                    flags)
 {
-        if (flags & XFS_QMOPT_UQUOTA)
-                xfs_qm_dquot_walk(mp, XFS_DQ_USER, xfs_qm_dqpurge, NULL);
+        /*
+         * We have to release group/project dquot hint(s) from the user dquot
+         * at first if they are there, otherwise we would run into an infinite
+         * loop while walking through radix tree to purge other type of dquots
+         * since their refcount is not zero if the user dquot refers to them
+         * as hint.
+         *
+         * Call the special xfs_qm_dqpurge_hints() will end up go through the
+         * general xfs_qm_dqpurge() against user dquot cache if requested.
+         */
+        xfs_qm_dquot_walk(mp, XFS_DQ_USER, xfs_qm_dqpurge_hints, &flags);
+
         if (flags & XFS_QMOPT_GQUOTA)
                 xfs_qm_dquot_walk(mp, XFS_DQ_GROUP, xfs_qm_dqpurge, NULL);
         if (flags & XFS_QMOPT_PQUOTA)
@@ -2082,24 +2111,21 @@ xfs_qm_vop_create_dqattach(
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
         ASSERT(XFS_IS_QUOTA_RUNNING(mp));
 
-        if (udqp) {
+        if (udqp && XFS_IS_UQUOTA_ON(mp)) {
                 ASSERT(ip->i_udquot == NULL);
-                ASSERT(XFS_IS_UQUOTA_ON(mp));
                 ASSERT(ip->i_d.di_uid == be32_to_cpu(udqp->q_core.d_id));
 
                 ip->i_udquot = xfs_qm_dqhold(udqp);
                 xfs_trans_mod_dquot(tp, udqp, XFS_TRANS_DQ_ICOUNT, 1);
         }
-        if (gdqp) {
+        if (gdqp && XFS_IS_GQUOTA_ON(mp)) {
                 ASSERT(ip->i_gdquot == NULL);
-                ASSERT(XFS_IS_GQUOTA_ON(mp));
                 ASSERT(ip->i_d.di_gid == be32_to_cpu(gdqp->q_core.d_id));
                 ip->i_gdquot = xfs_qm_dqhold(gdqp);
                 xfs_trans_mod_dquot(tp, gdqp, XFS_TRANS_DQ_ICOUNT, 1);
         }
-        if (pdqp) {
+        if (pdqp && XFS_IS_PQUOTA_ON(mp)) {
                 ASSERT(ip->i_pdquot == NULL);
-                ASSERT(XFS_IS_PQUOTA_ON(mp));
                 ASSERT(xfs_get_projid(ip) == be32_to_cpu(pdqp->q_core.d_id));
 
                 ip->i_pdquot = xfs_qm_dqhold(pdqp);
diff --git a/fs/xfs/xfs_trans_buf.c b/fs/xfs/xfs_trans_buf.c
index c035d11b7734..647b6f1d8923 100644
--- a/fs/xfs/xfs_trans_buf.c
+++ b/fs/xfs/xfs_trans_buf.c
@@ -314,7 +314,18 @@ xfs_trans_read_buf_map(
                         ASSERT(bp->b_iodone == NULL);
                         XFS_BUF_READ(bp);
                         bp->b_ops = ops;
-                        xfsbdstrat(tp->t_mountp, bp);
+
+                        /*
+                         * XXX(hch): clean up the error handling here to be less
+                         * of a mess..
+                         */
+                        if (XFS_FORCED_SHUTDOWN(mp)) {
+                                trace_xfs_bdstrat_shut(bp, _RET_IP_);
+                                xfs_bioerror_relse(bp);
+                        } else {
+                                xfs_buf_iorequest(bp);
+                        }
+
                         error = xfs_buf_iowait(bp);
                         if (error) {
                                 xfs_buf_ioerror_alert(bp, __func__);