18 files changed, 197 insertions, 107 deletions

diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 63039ed9576f..2bc5dc644b4c 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -1864,6 +1864,7 @@ cleanup:
         kfree(psinfo);
         kfree(notes);
         kfree(fpu);
+        kfree(shdr4extnum);
 #ifdef ELF_CORE_COPY_XFPREGS
         kfree(xfpu);
 #endif
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index f30ac05dbda7..3b859a3e6a0e 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1335,6 +1335,11 @@ struct btrfs_ioctl_defrag_range_args {
  */
 #define BTRFS_STRING_ITEM_KEY   253
 
+/*
+ * Flags for mount options.
+ *
+ * Note: don't forget to add new options to btrfs_show_options()
+ */
 #define BTRFS_MOUNT_NODATASUM           (1 << 0)
 #define BTRFS_MOUNT_NODATACOW           (1 << 1)
 #define BTRFS_MOUNT_NOBARRIER           (1 << 2)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index d340f63d8f07..3601f0aebddf 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2678,12 +2678,14 @@ noinline int btrfs_update_inode(struct btrfs_trans_handle *trans,
         int ret;
 
         /*
-         * If root is tree root, it means this inode is used to
-         * store free space information. And these inodes are updated
-         * when committing the transaction, so they needn't delaye to
-         * be updated, or deadlock will occured.
+         * If the inode is a free space inode, we can deadlock during commit
+         * if we put it into the delayed code.
+         *
+         * The data relocation inode should also be directly updated
+         * without delay
          */
-        if (!is_free_space_inode(root, inode)) {
+        if (!is_free_space_inode(root, inode)
+            && root->root_key.objectid != BTRFS_DATA_RELOC_TREE_OBJECTID) {
                 ret = btrfs_delayed_update_inode(trans, root, inode);
                 if (!ret)
                         btrfs_set_inode_last_trans(trans, inode);
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 0bb4ebbb71b7..15634d4648d7 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -723,6 +723,12 @@ static int btrfs_show_options(struct seq_file *seq, struct vfsmount *vfs)
                 seq_puts(seq, ",clear_cache");
         if (btrfs_test_opt(root, USER_SUBVOL_RM_ALLOWED))
                 seq_puts(seq, ",user_subvol_rm_allowed");
+        if (btrfs_test_opt(root, ENOSPC_DEBUG))
+                seq_puts(seq, ",enospc_debug");
+        if (btrfs_test_opt(root, AUTO_DEFRAG))
+                seq_puts(seq, ",autodefrag");
+        if (btrfs_test_opt(root, INODE_MAP_CACHE))
+                seq_puts(seq, ",inode_cache");
         return 0;
 }
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 1efa56e18f9b..19450bc53632 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2098,7 +2098,8 @@ int btrfs_balance(struct btrfs_root *dev_root)
                                            chunk_root->root_key.objectid,
                                            found_key.objectid,
                                            found_key.offset);
-                BUG_ON(ret && ret != -ENOSPC);
+                if (ret && ret != -ENOSPC)
+                        goto error;
                 key.offset = found_key.offset - 1;
         }
         ret = 0;
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 9542f07d0b93..4698a5c553dc 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -290,7 +290,6 @@ static int striped_read(struct inode *inode,
         struct ceph_inode_info *ci = ceph_inode(inode);
         u64 pos, this_len;
         int io_align, page_align;
-        int page_off = off & ~PAGE_CACHE_MASK; /* first byte's offset in page */
         int left, pages_left;
         int read;
         struct page **page_pos;
@@ -326,12 +325,11 @@ more:
              ret, hit_stripe ? " HITSTRIPE" : "", was_short ? " SHORT" : "");
 
         if (ret > 0) {
-                int didpages =
-                        ((pos & ~PAGE_CACHE_MASK) + ret) >> PAGE_CACHE_SHIFT;
+                int didpages = (page_align + ret) >> PAGE_CACHE_SHIFT;
 
                 if (read < pos - off) {
                         dout(" zero gap %llu to %llu\n", off + read, pos);
-                        ceph_zero_page_vector_range(page_off + read,
+                        ceph_zero_page_vector_range(page_align + read,
                                                     pos - off - read, pages);
                 }
                 pos += ret;
@@ -356,7 +354,7 @@ more:
                                 left = inode->i_size - pos;
 
                         dout("zero tail %d\n", left);
-                        ceph_zero_page_vector_range(page_off + read, left,
+                        ceph_zero_page_vector_range(page_align + read, left,
                                                     pages);
                         read += left;
                 }
@@ -478,9 +476,6 @@ static ssize_t ceph_sync_write(struct file *file, const char __user *data,
         else
                 pos = *offset;
 
-        io_align = pos & ~PAGE_MASK;
-        buf_align = (unsigned long)data & ~PAGE_MASK;
-
         ret = filemap_write_and_wait_range(inode->i_mapping, pos, pos + left);
         if (ret < 0)
                 return ret;
@@ -504,6 +499,8 @@ static ssize_t ceph_sync_write(struct file *file, const char __user *data,
          * boundary.  this isn't atomic, unfortunately.  :(
          */
 more:
+        io_align = pos & ~PAGE_MASK;
+        buf_align = (unsigned long)data & ~PAGE_MASK;
         len = left;
         if (file->f_flags & O_DIRECT) {
                 /* write from beginning of first page, regardless of
@@ -593,6 +590,7 @@ out:
                 pos += len;
                 written += len;
                 left -= len;
+                data += written;
                 if (left)
                         goto more;
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 35f9154615fa..3e2989976297 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -649,9 +649,9 @@ cifs_do_mount(struct file_system_type *fs_type,
 
         cFYI(1, "Devname: %s flags: %d ", dev_name, flags);
 
-        rc = cifs_setup_volume_info(&volume_info, (char *)data, dev_name);
-        if (rc)
-                return ERR_PTR(rc);
+        volume_info = cifs_get_volume_info((char *)data, dev_name);
+        if (IS_ERR(volume_info))
+                return ERR_CAST(volume_info);
 
         cifs_sb = kzalloc(sizeof(struct cifs_sb_info), GFP_KERNEL);
         if (cifs_sb == NULL) {
@@ -713,7 +713,7 @@ cifs_do_mount(struct file_system_type *fs_type,
 out_super:
         deactivate_locked_super(sb);
 out:
-        cifs_cleanup_volume_info(&volume_info);
+        cifs_cleanup_volume_info(volume_info);
         return root;
 
 out_mountdata:
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 257f312ede42..8df28e925e5b 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -154,9 +154,9 @@ extern int set_cifs_acl(struct cifs_ntsd *, __u32, struct inode *,
 extern void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                                struct cifs_sb_info *cifs_sb);
 extern int cifs_match_super(struct super_block *, void *);
-extern void cifs_cleanup_volume_info(struct smb_vol **pvolume_info);
-extern int cifs_setup_volume_info(struct smb_vol **pvolume_info,
-                                  char *mount_data, const char *devname);
+extern void cifs_cleanup_volume_info(struct smb_vol *pvolume_info);
+extern struct smb_vol *cifs_get_volume_info(char *mount_data,
+                                            const char *devname);
 extern int cifs_mount(struct cifs_sb_info *, struct smb_vol *);
 extern void cifs_umount(struct cifs_sb_info *);
 extern void cifs_dfs_release_automount_timer(void);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 7f540df52527..dbd669cc5bc7 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -65,6 +65,8 @@ static int ip_connect(struct TCP_Server_Info *server);
 static int generic_ip_connect(struct TCP_Server_Info *server);
 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
 static void cifs_prune_tlinks(struct work_struct *work);
+static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
+                                        const char *devname);
 
 /*
  * cifs tcp session reconnection
@@ -2240,8 +2242,8 @@ cifs_match_super(struct super_block *sb, void *data)
 
         rc = compare_mount_options(sb, mnt_data);
 out:
-        cifs_put_tlink(tlink);
         spin_unlock(&cifs_tcp_ses_lock);
+        cifs_put_tlink(tlink);
         return rc;
 }
 
@@ -2474,14 +2476,6 @@ generic_ip_connect(struct TCP_Server_Info *server)
         if (rc < 0)
                 return rc;
 
-        rc = socket->ops->connect(socket, saddr, slen, 0);
-        if (rc < 0) {
-                cFYI(1, "Error %d connecting to server", rc);
-                sock_release(socket);
-                server->ssocket = NULL;
-                return rc;
-        }
-
         /*
          * Eventually check for other socket options to change from
          * the default. sock_setsockopt not used because it expects
@@ -2510,6 +2504,14 @@ generic_ip_connect(struct TCP_Server_Info *server)
                  socket->sk->sk_sndbuf,
                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo);
 
+        rc = socket->ops->connect(socket, saddr, slen, 0);
+        if (rc < 0) {
+                cFYI(1, "Error %d connecting to server", rc);
+                sock_release(socket);
+                server->ssocket = NULL;
+                return rc;
+        }
+
         if (sport == htons(RFC1001_PORT))
                 rc = ip_rfc1001_connect(server);
 
@@ -2830,15 +2832,9 @@ is_path_accessible(int xid, struct cifs_tcon *tcon,
         return rc;
 }
 
-void
-cifs_cleanup_volume_info(struct smb_vol **pvolume_info)
+static void
+cleanup_volume_info_contents(struct smb_vol *volume_info)
 {
-        struct smb_vol *volume_info;
-
-        if (!pvolume_info || !*pvolume_info)
-                return;
-
-        volume_info = *pvolume_info;
         kfree(volume_info->username);
         kzfree(volume_info->password);
         kfree(volume_info->UNC);
@@ -2846,28 +2842,44 @@ cifs_cleanup_volume_info(struct smb_vol **pvolume_info)
         kfree(volume_info->domainname);
         kfree(volume_info->iocharset);
         kfree(volume_info->prepath);
+}
+
+void
+cifs_cleanup_volume_info(struct smb_vol *volume_info)
+{
+        if (!volume_info)
+                return;
+        cleanup_volume_info_contents(volume_info);
         kfree(volume_info);
-        *pvolume_info = NULL;
-        return;
 }
 
+
 #ifdef CONFIG_CIFS_DFS_UPCALL
 /* build_path_to_root returns full path to root when
  * we do not have an exiting connection (tcon) */
 static char *
-build_unc_path_to_root(const struct smb_vol *volume_info,
+build_unc_path_to_root(const struct smb_vol *vol,
                 const struct cifs_sb_info *cifs_sb)
 {
-        char *full_path;
+        char *full_path, *pos;
+        unsigned int pplen = vol->prepath ? strlen(vol->prepath) : 0;
+        unsigned int unc_len = strnlen(vol->UNC, MAX_TREE_SIZE + 1);
 
-        int unc_len = strnlen(volume_info->UNC, MAX_TREE_SIZE + 1);
-        full_path = kmalloc(unc_len + 1, GFP_KERNEL);
+        full_path = kmalloc(unc_len + pplen + 1, GFP_KERNEL);
         if (full_path == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        strncpy(full_path, volume_info->UNC, unc_len);
-        full_path[unc_len] = 0; /* add trailing null */
+        strncpy(full_path, vol->UNC, unc_len);
+        pos = full_path + unc_len;
+
+        if (pplen) {
+                strncpy(pos, vol->prepath, pplen);
+                pos += pplen;
+        }
+
+        *pos = '\0'; /* add trailing null */
         convert_delimiter(full_path, CIFS_DIR_SEP(cifs_sb));
+        cFYI(1, "%s: full_path=%s", __func__, full_path);
         return full_path;
 }
 
@@ -2910,15 +2922,18 @@ expand_dfs_referral(int xid, struct cifs_ses *pSesInfo,
                                                    &fake_devname);
 
                 free_dfs_info_array(referrals, num_referrals);
-                kfree(fake_devname);
-
-                if (cifs_sb->mountdata != NULL)
-                        kfree(cifs_sb->mountdata);
 
                 if (IS_ERR(mdata)) {
                         rc = PTR_ERR(mdata);
                         mdata = NULL;
+                } else {
+                        cleanup_volume_info_contents(volume_info);
+                        memset(volume_info, '\0', sizeof(*volume_info));
+                        rc = cifs_setup_volume_info(volume_info, mdata,
+                                                        fake_devname);
                 }
+                kfree(fake_devname);
+                kfree(cifs_sb->mountdata);
                 cifs_sb->mountdata = mdata;
         }
         kfree(full_path);
@@ -2926,33 +2941,20 @@ expand_dfs_referral(int xid, struct cifs_ses *pSesInfo,
 }
 #endif
 
-int cifs_setup_volume_info(struct smb_vol **pvolume_info, char *mount_data,
-                           const char *devname)
+static int
+cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
+                        const char *devname)
 {
-        struct smb_vol *volume_info;
         int rc = 0;
 
-        *pvolume_info = NULL;
-
-        volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
-        if (!volume_info) {
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        if (cifs_parse_mount_options(mount_data, devname,
-                                     volume_info)) {
-                rc = -EINVAL;
-                goto out;
-        }
+        if (cifs_parse_mount_options(mount_data, devname, volume_info))
+                return -EINVAL;
 
         if (volume_info->nullauth) {
                 cFYI(1, "null user");
                 volume_info->username = kzalloc(1, GFP_KERNEL);
-                if (volume_info->username == NULL) {
-                        rc = -ENOMEM;
-                        goto out;
-                }
+                if (volume_info->username == NULL)
+                        return -ENOMEM;
         } else if (volume_info->username) {
                 /* BB fixme parse for domain name here */
                 cFYI(1, "Username: %s", volume_info->username);
@@ -2960,8 +2962,7 @@ int cifs_setup_volume_info(struct smb_vol **pvolume_info, char *mount_data,
                 cifserror("No username specified");
         /* In userspace mount helper we can get user name from alternate
            locations such as env variables and files on disk */
-                rc = -EINVAL;
-                goto out;
+                return -EINVAL;
         }
 
         /* this is needed for ASCII cp to Unicode converts */
@@ -2973,18 +2974,32 @@ int cifs_setup_volume_info(struct smb_vol **pvolume_info, char *mount_data,
                 if (volume_info->local_nls == NULL) {
                         cERROR(1, "CIFS mount error: iocharset %s not found",
                                  volume_info->iocharset);
-                        rc = -ELIBACC;
-                        goto out;
+                        return -ELIBACC;
                 }
         }
 
-        *pvolume_info = volume_info;
-        return rc;
-out:
-        cifs_cleanup_volume_info(&volume_info);
         return rc;
 }
 
+struct smb_vol *
+cifs_get_volume_info(char *mount_data, const char *devname)
+{
+        int rc;
+        struct smb_vol *volume_info;
+
+        volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
+        if (!volume_info)
+                return ERR_PTR(-ENOMEM);
+
+        rc = cifs_setup_volume_info(volume_info, mount_data, devname);
+        if (rc) {
+                cifs_cleanup_volume_info(volume_info);
+                volume_info = ERR_PTR(rc);
+        }
+
+        return volume_info;
+}
+
 int
 cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
 {
@@ -2997,6 +3012,7 @@ cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
         struct tcon_link *tlink;
 #ifdef CONFIG_CIFS_DFS_UPCALL
         int referral_walks_count = 0;
+#endif
 
         rc = bdi_setup_and_register(&cifs_sb->bdi, "cifs", BDI_CAP_MAP_COPY);
         if (rc)
@@ -3004,6 +3020,7 @@ cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
 
         cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
 
+#ifdef CONFIG_CIFS_DFS_UPCALL
 try_mount_again:
         /* cleanup activities if we're chasing a referral */
         if (referral_walks_count) {
@@ -3012,7 +3029,6 @@ try_mount_again:
                 else if (pSesInfo)
                         cifs_put_smb_ses(pSesInfo);
 
-                cifs_cleanup_volume_info(&volume_info);
                 FreeXid(xid);
         }
 #endif
diff --git a/fs/cifs/fscache.c b/fs/cifs/fscache.c
index 816696621ec9..42e5363b4102 100644
--- a/fs/cifs/fscache.c
+++ b/fs/cifs/fscache.c
@@ -92,6 +92,7 @@ static void cifs_fscache_disable_inode_cookie(struct inode *inode)
 
         if (cifsi->fscache) {
                 cFYI(1, "%s: (0x%p)", __func__, cifsi->fscache);
+                fscache_uncache_all_inode_pages(cifsi->fscache, inode);
                 fscache_relinquish_cookie(cifsi->fscache, 1);
                 cifsi->fscache = NULL;
         }
diff --git a/fs/fscache/page.c b/fs/fscache/page.c
index a2a5d19ece6a..2f343b4d7a7d 100644
--- a/fs/fscache/page.c
+++ b/fs/fscache/page.c
@@ -954,3 +954,47 @@ void fscache_mark_pages_cached(struct fscache_retrieval *op,
         pagevec_reinit(pagevec);
 }
 EXPORT_SYMBOL(fscache_mark_pages_cached);
+
+/*
+ * Uncache all the pages in an inode that are marked PG_fscache, assuming them
+ * to be associated with the given cookie.
+ */
+void __fscache_uncache_all_inode_pages(struct fscache_cookie *cookie,
+                                       struct inode *inode)
+{
+        struct address_space *mapping = inode->i_mapping;
+        struct pagevec pvec;
+        pgoff_t next;
+        int i;
+
+        _enter("%p,%p", cookie, inode);
+
+        if (!mapping || mapping->nrpages == 0) {
+                _leave(" [no pages]");
+                return;
+        }
+
+        pagevec_init(&pvec, 0);
+        next = 0;
+        while (next <= (loff_t)-1 &&
+               pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE)
+               ) {
+                for (i = 0; i < pagevec_count(&pvec); i++) {
+                        struct page *page = pvec.pages[i];
+                        pgoff_t page_index = page->index;
+
+                        ASSERTCMP(page_index, >=, next);
+                        next = page_index + 1;
+
+                        if (PageFsCache(page)) {
+                                __fscache_wait_on_page_write(cookie, page);
+                                __fscache_uncache_page(cookie, page);
+                        }
+                }
+                pagevec_release(&pvec);
+                cond_resched();
+        }
+
+        _leave("");
+}
+EXPORT_SYMBOL(__fscache_uncache_all_inode_pages);
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index b49b55584c84..84a47b709f51 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -500,7 +500,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
 out_put_hidden_dir:
         iput(sbi->hidden_dir);
 out_put_root:
-        iput(sbi->alloc_file);
+        iput(root);
 out_put_alloc_file:
         iput(sbi->alloc_file);
 out_close_cat_tree:
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 3031d81f5f0f..4ac88ff79aa6 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -36,6 +36,7 @@ int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
 {
         DECLARE_COMPLETION_ONSTACK(wait);
         struct bio *bio;
+        int ret = 0;
 
         bio = bio_alloc(GFP_NOIO, 1);
         bio->bi_sector = sector;
@@ -54,8 +55,10 @@ int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
         wait_for_completion(&wait);
 
         if (!bio_flagged(bio, BIO_UPTODATE))
-                return -EIO;
-        return 0;
+                ret = -EIO;
+
+        bio_put(bio);
+        return ret;
 }
 
 static int hfsplus_read_mdb(void *bufptr, struct hfsplus_wd *wd)
diff --git a/fs/locks.c b/fs/locks.c
index 0a4f50dfadfb..b286539d547a 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -160,10 +160,28 @@ EXPORT_SYMBOL_GPL(unlock_flocks);
 
 static struct kmem_cache *filelock_cache __read_mostly;
 
+static void locks_init_lock_always(struct file_lock *fl)
+{
+        fl->fl_next = NULL;
+        fl->fl_fasync = NULL;
+        fl->fl_owner = NULL;
+        fl->fl_pid = 0;
+        fl->fl_nspid = NULL;
+        fl->fl_file = NULL;
+        fl->fl_flags = 0;
+        fl->fl_type = 0;
+        fl->fl_start = fl->fl_end = 0;
+}
+
 /* Allocate an empty lock structure. */
 struct file_lock *locks_alloc_lock(void)
 {
-        return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
+        struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
+
+        if (fl)
+                locks_init_lock_always(fl);
+
+        return fl;
 }
 EXPORT_SYMBOL_GPL(locks_alloc_lock);
 
@@ -200,17 +218,9 @@ void locks_init_lock(struct file_lock *fl)
         INIT_LIST_HEAD(&fl->fl_link);
         INIT_LIST_HEAD(&fl->fl_block);
         init_waitqueue_head(&fl->fl_wait);
-        fl->fl_next = NULL;
-        fl->fl_fasync = NULL;
-        fl->fl_owner = NULL;
-        fl->fl_pid = 0;
-        fl->fl_nspid = NULL;
-        fl->fl_file = NULL;
-        fl->fl_flags = 0;
-        fl->fl_type = 0;
-        fl->fl_start = fl->fl_end = 0;
         fl->fl_ops = NULL;
         fl->fl_lmops = NULL;
+        locks_init_lock_always(fl);
 }
 
 EXPORT_SYMBOL(locks_init_lock);
diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
index ce153a6b3aec..419119c371bf 100644
--- a/fs/nfs/fscache.c
+++ b/fs/nfs/fscache.c
@@ -259,12 +259,10 @@ static void nfs_fscache_disable_inode_cookie(struct inode *inode)
                 dfprintk(FSCACHE,
                          "NFS: nfsi 0x%p turning cache off\n", NFS_I(inode));
 
-                /* Need to invalidate any mapped pages that were read in before
-                 * turning off the cache.
+                /* Need to uncache any pages attached to this inode that
+                 * fscache knows about before turning off the cache.
                  */
-                if (inode->i_mapping && inode->i_mapping->nrpages)
-                        invalidate_inode_pages2(inode->i_mapping);
-
+                fscache_uncache_all_inode_pages(NFS_I(inode)->fscache, inode);
                 nfs_fscache_zap_inode_cookie(inode);
         }
 }
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 8a84210ca080..fc5bc2767692 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2708,6 +2708,9 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
         struct task_io_accounting acct = task->ioac;
         unsigned long flags;
 
+        if (!ptrace_may_access(task, PTRACE_MODE_READ))
+                return -EACCES;
+
         if (whole && lock_task_sighand(task, &flags)) {
                 struct task_struct *t = task;
 
@@ -2839,7 +2842,7 @@ static const struct pid_entry tgid_base_stuff[] = {
         REG("coredump_filter", S_IRUGO|S_IWUSR, proc_coredump_filter_operations),
 #endif
 #ifdef CONFIG_TASK_IO_ACCOUNTING
-        INF("io",       S_IRUGO, proc_tgid_io_accounting),
+        INF("io",       S_IRUSR, proc_tgid_io_accounting),
 #endif
 #ifdef CONFIG_HARDWALL
         INF("hardwall",   S_IRUGO, proc_pid_hardwall),
@@ -3181,7 +3184,7 @@ static const struct pid_entry tid_base_stuff[] = {
         REG("make-it-fail", S_IRUGO|S_IWUSR, proc_fault_inject_operations),
 #endif
 #ifdef CONFIG_TASK_IO_ACCOUNTING
-        INF("io",       S_IRUGO, proc_tid_io_accounting),
+        INF("io",       S_IRUSR, proc_tid_io_accounting),
 #endif
 #ifdef CONFIG_HARDWALL
         INF("hardwall",   S_IRUGO, proc_pid_hardwall),
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 09983a3344a5..b1e88d56069c 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -681,15 +681,15 @@ xfs_inode_item_unlock(
  * where the cluster buffer may be unpinned before the inode is inserted into
  * the AIL during transaction committed processing. If the buffer is unpinned
  * before the inode item has been committed and inserted, then it is possible
- * for the buffer to be written and IO completions before the inode is inserted
+ * for the buffer to be written and IO completes before the inode is inserted
  * into the AIL. In that case, we'd be inserting a clean, stale inode into the
  * AIL which will never get removed. It will, however, get reclaimed which
  * triggers an assert in xfs_inode_free() complaining about freein an inode
  * still in the AIL.
  *
- * To avoid this, return a lower LSN than the one passed in so that the
- * transaction committed code will not move the inode forward in the AIL but
- * will still unpin it properly.
+ * To avoid this, just unpin the inode directly and return a LSN of -1 so the
+ * transaction committed code knows that it does not need to do any further
+ * processing on the item.
  */
 STATIC xfs_lsn_t
 xfs_inode_item_committed(
@@ -699,8 +699,10 @@ xfs_inode_item_committed(
         struct xfs_inode_log_item *iip = INODE_ITEM(lip);
         struct xfs_inode        *ip = iip->ili_inode;
 
-        if (xfs_iflags_test(ip, XFS_ISTALE))
-                return lsn - 1;
+        if (xfs_iflags_test(ip, XFS_ISTALE)) {
+                xfs_inode_item_unpin(lip, 0);
+                return -1;
+        }
         return lsn;
 }
 
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index 7c7bc2b786bd..c83f63b33aae 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -1361,7 +1361,7 @@ xfs_trans_item_committed(
                 lip->li_flags |= XFS_LI_ABORTED;
         item_lsn = IOP_COMMITTED(lip, commit_lsn);
 
-        /* If the committed routine returns -1, item has been freed. */
+        /* item_lsn of -1 means the item needs no further processing */
         if (XFS_LSN_CMP(item_lsn, (xfs_lsn_t)-1) == 0)
                 return;
 
@@ -1474,7 +1474,7 @@ xfs_trans_committed_bulk(
                         lip->li_flags |= XFS_LI_ABORTED;
                 item_lsn = IOP_COMMITTED(lip, commit_lsn);
 
-                /* item_lsn of -1 means the item was freed */
+                /* item_lsn of -1 means the item needs no further processing */
                 if (XFS_LSN_CMP(item_lsn, (xfs_lsn_t)-1) == 0)
                         continue;