11 files changed, 102 insertions, 59 deletions

diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 6f0444473594..659f532d26a0 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -166,7 +166,7 @@ static struct dentry *btrfs_fh_to_dentry(struct super_block *sb, struct fid *fh,
 static struct dentry *btrfs_get_parent(struct dentry *child)
 {
         struct inode *dir = child->d_inode;
-        static struct dentry *dentry;
+        struct dentry *dentry;
         struct btrfs_root *root = BTRFS_I(dir)->root;
         struct btrfs_path *path;
         struct extent_buffer *leaf;
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 158c700fdca5..d902948a90d8 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -40,7 +40,8 @@ int ceph_init_dentry(struct dentry *dentry)
         if (dentry->d_fsdata)
                 return 0;
 
-        if (ceph_snap(dentry->d_parent->d_inode) == CEPH_NOSNAP)
+        if (dentry->d_parent == NULL ||   /* nfs fh_to_dentry */
+            ceph_snap(dentry->d_parent->d_inode) == CEPH_NOSNAP)
                 dentry->d_op = &ceph_dentry_ops;
         else if (ceph_snap(dentry->d_parent->d_inode) == CEPH_SNAPDIR)
                 dentry->d_op = &ceph_snapdir_dentry_ops;
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 8d79b8912e31..7d0e4a82d898 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -282,7 +282,8 @@ int ceph_release(struct inode *inode, struct file *file)
 static int striped_read(struct inode *inode,
                         u64 off, u64 len,
                         struct page **pages, int num_pages,
-                        int *checkeof, bool align_to_pages)
+                        int *checkeof, bool align_to_pages,
+                        unsigned long buf_align)
 {
         struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
         struct ceph_inode_info *ci = ceph_inode(inode);
@@ -307,7 +308,7 @@ static int striped_read(struct inode *inode,
 
 more:
         if (align_to_pages)
-                page_align = (pos - io_align) & ~PAGE_MASK;
+                page_align = (pos - io_align + buf_align) & ~PAGE_MASK;
         else
                 page_align = pos & ~PAGE_MASK;
         this_len = left;
@@ -376,16 +377,18 @@ static ssize_t ceph_sync_read(struct file *file, char __user *data,
         struct inode *inode = file->f_dentry->d_inode;
         struct page **pages;
         u64 off = *poff;
-        int num_pages = calc_pages_for(off, len);
-        int ret;
+        int num_pages, ret;
 
         dout("sync_read on file %p %llu~%u %s\n", file, off, len,
              (file->f_flags & O_DIRECT) ? "O_DIRECT" : "");
 
-        if (file->f_flags & O_DIRECT)
-                pages = ceph_get_direct_page_vector(data, num_pages);
-        else
+        if (file->f_flags & O_DIRECT) {
+                num_pages = calc_pages_for((unsigned long)data, len);
+                pages = ceph_get_direct_page_vector(data, num_pages, true);
+        } else {
+                num_pages = calc_pages_for(off, len);
                 pages = ceph_alloc_page_vector(num_pages, GFP_NOFS);
+        }
         if (IS_ERR(pages))
                 return PTR_ERR(pages);
 
@@ -400,7 +403,8 @@ static ssize_t ceph_sync_read(struct file *file, char __user *data,
                 goto done;
 
         ret = striped_read(inode, off, len, pages, num_pages, checkeof,
-                           file->f_flags & O_DIRECT);
+                           file->f_flags & O_DIRECT,
+                           (unsigned long)data & ~PAGE_MASK);
 
         if (ret >= 0 && (file->f_flags & O_DIRECT) == 0)
                 ret = ceph_copy_page_vector_to_user(pages, data, off, ret);
@@ -409,7 +413,7 @@ static ssize_t ceph_sync_read(struct file *file, char __user *data,
 
 done:
         if (file->f_flags & O_DIRECT)
-                ceph_put_page_vector(pages, num_pages);
+                ceph_put_page_vector(pages, num_pages, true);
         else
                 ceph_release_page_vector(pages, num_pages);
         dout("sync_read result %d\n", ret);
@@ -456,6 +460,7 @@ static ssize_t ceph_sync_write(struct file *file, const char __user *data,
         int do_sync = 0;
         int check_caps = 0;
         int page_align, io_align;
+        unsigned long buf_align;
         int ret;
         struct timespec mtime = CURRENT_TIME;
 
@@ -471,6 +476,7 @@ static ssize_t ceph_sync_write(struct file *file, const char __user *data,
                 pos = *offset;
 
         io_align = pos & ~PAGE_MASK;
+        buf_align = (unsigned long)data & ~PAGE_MASK;
 
         ret = filemap_write_and_wait_range(inode->i_mapping, pos, pos + left);
         if (ret < 0)
@@ -496,12 +502,15 @@ static ssize_t ceph_sync_write(struct file *file, const char __user *data,
          */
 more:
         len = left;
-        if (file->f_flags & O_DIRECT)
+        if (file->f_flags & O_DIRECT) {
                 /* write from beginning of first page, regardless of
                    io alignment */
-                page_align = (pos - io_align) & ~PAGE_MASK;
-        else
+                page_align = (pos - io_align + buf_align) & ~PAGE_MASK;
+                num_pages = calc_pages_for((unsigned long)data, len);
+        } else {
                 page_align = pos & ~PAGE_MASK;
+                num_pages = calc_pages_for(pos, len);
+        }
         req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
                                     ceph_vino(inode), pos, &len,
                                     CEPH_OSD_OP_WRITE, flags,
@@ -512,10 +521,8 @@ more:
         if (!req)
                 return -ENOMEM;
 
-        num_pages = calc_pages_for(pos, len);
-
         if (file->f_flags & O_DIRECT) {
-                pages = ceph_get_direct_page_vector(data, num_pages);
+                pages = ceph_get_direct_page_vector(data, num_pages, false);
                 if (IS_ERR(pages)) {
                         ret = PTR_ERR(pages);
                         goto out;
@@ -565,7 +572,7 @@ more:
         }
 
         if (file->f_flags & O_DIRECT)
-                ceph_put_page_vector(pages, num_pages);
+                ceph_put_page_vector(pages, num_pages, false);
         else if (file->f_flags & O_SYNC)
                 ceph_release_page_vector(pages, num_pages);
 
diff --git a/fs/logfs/journal.c b/fs/logfs/journal.c
index f46ee8b0e135..9da29706f91c 100644
--- a/fs/logfs/journal.c
+++ b/fs/logfs/journal.c
@@ -828,7 +828,7 @@ void do_logfs_journal_wl_pass(struct super_block *sb)
                 super->s_journal_seg[i] = segno;
                 super->s_journal_ec[i] = ec;
                 logfs_set_segment_reserved(sb, segno);
-                err = btree_insert32(head, segno, (void *)1, GFP_KERNEL);
+                err = btree_insert32(head, segno, (void *)1, GFP_NOFS);
                 BUG_ON(err); /* mempool should prevent this */
                 err = logfs_erase_segment(sb, segno, 1);
                 BUG_ON(err); /* FIXME: remount-ro would be nicer */
diff --git a/fs/logfs/readwrite.c b/fs/logfs/readwrite.c
index 6127baf0e188..ee99a9f5dfd3 100644
--- a/fs/logfs/readwrite.c
+++ b/fs/logfs/readwrite.c
@@ -1994,6 +1994,9 @@ static int do_write_inode(struct inode *inode)
 
         /* FIXME: transaction is part of logfs_block now.  Is that enough? */
         err = logfs_write_buf(master_inode, page, 0);
+        if (err)
+                move_page_to_inode(inode, page);
+
         logfs_put_write_page(page);
         return err;
 }
diff --git a/fs/namei.c b/fs/namei.c
index 5362af9b7372..4ff7ca530533 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1748,6 +1748,9 @@ struct file *do_filp_open(int dfd, const char *pathname,
         if (!(open_flag & O_CREAT))
                 mode = 0;
 
+        /* Must never be set by userspace */
+        open_flag &= ~FMODE_NONOTIFY;
+
         /*
          * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
          * check for O_DSYNC if the need any syncing at all we enforce it's
diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c
index 33ad25ddd5c4..caf9a6a3fb54 100644
--- a/fs/nilfs2/gcinode.c
+++ b/fs/nilfs2/gcinode.c
@@ -176,7 +176,6 @@ int nilfs_gccache_wait_and_mark_dirty(struct buffer_head *bh)
 int nilfs_init_gcinode(struct inode *inode)
 {
         struct nilfs_inode_info *ii = NILFS_I(inode);
-        struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
 
         inode->i_mode = S_IFREG;
         mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
@@ -186,14 +185,6 @@ int nilfs_init_gcinode(struct inode *inode)
         ii->i_flags = 0;
         nilfs_bmap_init_gc(ii->i_bmap);
 
-        /*
-         * Add the inode to GC inode list. Garbage Collection
-         * is serialized and no two processes manipulate the
-         * list simultaneously.
-         */
-        igrab(inode);
-        list_add(&NILFS_I(inode)->i_dirty, &nilfs->ns_gc_inodes);
-
         return 0;
 }
 
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index e00d9457c256..b185e937a335 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -337,6 +337,7 @@ static int nilfs_ioctl_move_blocks(struct super_block *sb,
                                    struct nilfs_argv *argv, void *buf)
 {
         size_t nmembs = argv->v_nmembs;
+        struct the_nilfs *nilfs = NILFS_SB(sb)->s_nilfs;
         struct inode *inode;
         struct nilfs_vdesc *vdesc;
         struct buffer_head *bh, *n;
@@ -353,6 +354,17 @@ static int nilfs_ioctl_move_blocks(struct super_block *sb,
                         ret = PTR_ERR(inode);
                         goto failed;
                 }
+                if (list_empty(&NILFS_I(inode)->i_dirty)) {
+                        /*
+                         * Add the inode to GC inode list. Garbage Collection
+                         * is serialized and no two processes manipulate the
+                         * list simultaneously.
+                         */
+                        igrab(inode);
+                        list_add(&NILFS_I(inode)->i_dirty,
+                                 &nilfs->ns_gc_inodes);
+                }
+
                 do {
                         ret = nilfs_ioctl_move_inode_block(inode, vdesc,
                                                            &buffers);
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index b04f88eed09e..f35794b97e8e 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -92,7 +92,11 @@ static int fanotify_get_response_from_access(struct fsnotify_group *group,
 
         pr_debug("%s: group=%p event=%p\n", __func__, group, event);
 
-        wait_event(group->fanotify_data.access_waitq, event->response);
+        wait_event(group->fanotify_data.access_waitq, event->response ||
+                                atomic_read(&group->fanotify_data.bypass_perm));
+
+        if (!event->response) /* bypass_perm set */
+                return 0;
 
         /* userspace responded, convert to something usable */
         spin_lock(&event->lock);
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 063224812b7e..8b61220cffc5 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -106,20 +106,29 @@ static int create_fd(struct fsnotify_group *group, struct fsnotify_event *event)
         return client_fd;
 }
 
-static ssize_t fill_event_metadata(struct fsnotify_group *group,
+static int fill_event_metadata(struct fsnotify_group *group,
                                    struct fanotify_event_metadata *metadata,
                                    struct fsnotify_event *event)
 {
+        int ret = 0;
+
         pr_debug("%s: group=%p metadata=%p event=%p\n", __func__,
                  group, metadata, event);
 
         metadata->event_len = FAN_EVENT_METADATA_LEN;
+        metadata->metadata_len = FAN_EVENT_METADATA_LEN;
         metadata->vers = FANOTIFY_METADATA_VERSION;
         metadata->mask = event->mask & FAN_ALL_OUTGOING_EVENTS;
         metadata->pid = pid_vnr(event->tgid);
-        metadata->fd = create_fd(group, event);
+        if (unlikely(event->mask & FAN_Q_OVERFLOW))
+                metadata->fd = FAN_NOFD;
+        else {
+                metadata->fd = create_fd(group, event);
+                if (metadata->fd < 0)
+                        ret = metadata->fd;
+        }
 
-        return metadata->fd;
+        return ret;
 }
 
 #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
@@ -200,7 +209,7 @@ static int prepare_for_access_response(struct fsnotify_group *group,
 
         mutex_lock(&group->fanotify_data.access_mutex);
 
-        if (group->fanotify_data.bypass_perm) {
+        if (atomic_read(&group->fanotify_data.bypass_perm)) {
                 mutex_unlock(&group->fanotify_data.access_mutex);
                 kmem_cache_free(fanotify_response_event_cache, re);
                 event->response = FAN_ALLOW;
@@ -257,24 +266,34 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
 
         pr_debug("%s: group=%p event=%p\n", __func__, group, event);
 
-        fd = fill_event_metadata(group, &fanotify_event_metadata, event);
-        if (fd < 0)
-                return fd;
+        ret = fill_event_metadata(group, &fanotify_event_metadata, event);
+        if (ret < 0)
+                goto out;
 
+        fd = fanotify_event_metadata.fd;
         ret = prepare_for_access_response(group, event, fd);
         if (ret)
                 goto out_close_fd;
 
         ret = -EFAULT;
-        if (copy_to_user(buf, &fanotify_event_metadata, FAN_EVENT_METADATA_LEN))
+        if (copy_to_user(buf, &fanotify_event_metadata,
+                         fanotify_event_metadata.event_len))
                 goto out_kill_access_response;
 
-        return FAN_EVENT_METADATA_LEN;
+        return fanotify_event_metadata.event_len;
 
 out_kill_access_response:
         remove_access_response(group, event, fd);
 out_close_fd:
-        sys_close(fd);
+        if (fd != FAN_NOFD)
+                sys_close(fd);
+out:
+#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
+        if (event->mask & FAN_ALL_PERM_EVENTS) {
+                event->response = FAN_DENY;
+                wake_up(&group->fanotify_data.access_waitq);
+        }
+#endif
         return ret;
 }
 
@@ -382,7 +401,7 @@ static int fanotify_release(struct inode *ignored, struct file *file)
 
         mutex_lock(&group->fanotify_data.access_mutex);
 
-        group->fanotify_data.bypass_perm = true;
+        atomic_inc(&group->fanotify_data.bypass_perm);
 
         list_for_each_entry_safe(re, lre, &group->fanotify_data.access_list, list) {
                 pr_debug("%s: found group=%p re=%p event=%p\n", __func__, group,
@@ -586,11 +605,10 @@ static int fanotify_add_vfsmount_mark(struct fsnotify_group *group,
 {
         struct fsnotify_mark *fsn_mark;
         __u32 added;
+        int ret = 0;
 
         fsn_mark = fsnotify_find_vfsmount_mark(group, mnt);
         if (!fsn_mark) {
-                int ret;
-
                 if (atomic_read(&group->num_marks) > group->fanotify_data.max_marks)
                         return -ENOSPC;
 
@@ -600,17 +618,16 @@ static int fanotify_add_vfsmount_mark(struct fsnotify_group *group,
 
                 fsnotify_init_mark(fsn_mark, fanotify_free_mark);
                 ret = fsnotify_add_mark(fsn_mark, group, NULL, mnt, 0);
-                if (ret) {
-                        fanotify_free_mark(fsn_mark);
-                        return ret;
-                }
+                if (ret)
+                        goto err;
         }
         added = fanotify_mark_add_to_mask(fsn_mark, mask, flags);
-        fsnotify_put_mark(fsn_mark);
+
         if (added & ~mnt->mnt_fsnotify_mask)
                 fsnotify_recalc_vfsmount_mask(mnt);
-
-        return 0;
+err:
+        fsnotify_put_mark(fsn_mark);
+        return ret;
 }
 
 static int fanotify_add_inode_mark(struct fsnotify_group *group,
@@ -619,6 +636,7 @@ static int fanotify_add_inode_mark(struct fsnotify_group *group,
 {
         struct fsnotify_mark *fsn_mark;
         __u32 added;
+        int ret = 0;
 
         pr_debug("%s: group=%p inode=%p\n", __func__, group, inode);
 
@@ -634,8 +652,6 @@ static int fanotify_add_inode_mark(struct fsnotify_group *group,
 
         fsn_mark = fsnotify_find_inode_mark(group, inode);
         if (!fsn_mark) {
-                int ret;
-
                 if (atomic_read(&group->num_marks) > group->fanotify_data.max_marks)
                         return -ENOSPC;
 
@@ -645,16 +661,16 @@ static int fanotify_add_inode_mark(struct fsnotify_group *group,
 
                 fsnotify_init_mark(fsn_mark, fanotify_free_mark);
                 ret = fsnotify_add_mark(fsn_mark, group, inode, NULL, 0);
-                if (ret) {
-                        fanotify_free_mark(fsn_mark);
-                        return ret;
-                }
+                if (ret)
+                        goto err;
         }
         added = fanotify_mark_add_to_mask(fsn_mark, mask, flags);
-        fsnotify_put_mark(fsn_mark);
+
         if (added & ~inode->i_fsnotify_mask)
                 fsnotify_recalc_inode_mask(inode);
-        return 0;
+err:
+        fsnotify_put_mark(fsn_mark);
+        return ret;
 }
 
 /* fanotify syscalls */
@@ -687,8 +703,10 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
 
         /* fsnotify_alloc_group takes a ref.  Dropped in fanotify_release */
         group = fsnotify_alloc_group(&fanotify_fsnotify_ops);
-        if (IS_ERR(group))
+        if (IS_ERR(group)) {
+                free_uid(user);
                 return PTR_ERR(group);
+        }
 
         group->fanotify_data.user = user;
         atomic_inc(&user->fanotify_listeners);
@@ -698,6 +716,7 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
         mutex_init(&group->fanotify_data.access_mutex);
         init_waitqueue_head(&group->fanotify_data.access_waitq);
         INIT_LIST_HEAD(&group->fanotify_data.access_list);
+        atomic_set(&group->fanotify_data.bypass_perm, 0);
 #endif
         switch (flags & FAN_ALL_CLASS_BITS) {
         case FAN_CLASS_NOTIF:
@@ -764,8 +783,10 @@ SYSCALL_DEFINE(fanotify_mark)(int fanotify_fd, unsigned int flags,
         if (flags & ~FAN_ALL_MARK_FLAGS)
                 return -EINVAL;
         switch (flags & (FAN_MARK_ADD | FAN_MARK_REMOVE | FAN_MARK_FLUSH)) {
-        case FAN_MARK_ADD:
+        case FAN_MARK_ADD:              /* fallthrough */
         case FAN_MARK_REMOVE:
+                if (!mask)
+                        return -EINVAL;
         case FAN_MARK_FLUSH:
                 break;
         default:
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 444c305a468c..4cd5d5d78f9f 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -752,6 +752,7 @@ SYSCALL_DEFINE1(inotify_init1, int, flags)
         if (ret >= 0)
                 return ret;
 
+        fsnotify_put_group(group);
         atomic_dec(&user->inotify_devs);
 out_free_uid:
         free_uid(user);