36 files changed, 413 insertions, 231 deletions

diff --git a/fs/block_dev.c b/fs/block_dev.c
index b3c1d3dae77d..1a1e5e3b1eaf 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1661,6 +1661,39 @@ static int blkdev_mmap(struct file *file, struct vm_area_struct *vma)
         return ret;
 }
 
+static ssize_t blkdev_splice_read(struct file *file, loff_t *ppos,
+                                  struct pipe_inode_info *pipe, size_t len,
+                                  unsigned int flags)
+{
+        ssize_t ret;
+        struct block_device *bdev = I_BDEV(file->f_mapping->host);
+
+        percpu_down_read(&bdev->bd_block_size_semaphore);
+
+        ret = generic_file_splice_read(file, ppos, pipe, len, flags);
+
+        percpu_up_read(&bdev->bd_block_size_semaphore);
+
+        return ret;
+}
+
+static ssize_t blkdev_splice_write(struct pipe_inode_info *pipe,
+                                   struct file *file, loff_t *ppos, size_t len,
+                                   unsigned int flags)
+{
+        ssize_t ret;
+        struct block_device *bdev = I_BDEV(file->f_mapping->host);
+
+        percpu_down_read(&bdev->bd_block_size_semaphore);
+
+        ret = generic_file_splice_write(pipe, file, ppos, len, flags);
+
+        percpu_up_read(&bdev->bd_block_size_semaphore);
+
+        return ret;
+}
+
+
 /*
  * Try to release a page associated with block device when the system
  * is under memory pressure.
@@ -1699,8 +1732,8 @@ const struct file_operations def_blk_fops = {
 #ifdef CONFIG_COMPAT
         .compat_ioctl   = compat_blkdev_ioctl,
 #endif
-        .splice_read    = generic_file_splice_read,
-        .splice_write   = generic_file_splice_write,
+        .splice_read    = blkdev_splice_read,
+        .splice_write   = blkdev_splice_write,
 };
 
 int ioctl_by_bdev(struct block_device *bdev, unsigned cmd, unsigned long arg)
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index f3187938e081..208d8aa5b07e 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -283,9 +283,7 @@ static int __resolve_indirect_ref(struct btrfs_fs_info *fs_info,
                 goto out;
         }
 
-        rcu_read_lock();
-        root_level = btrfs_header_level(root->node);
-        rcu_read_unlock();
+        root_level = btrfs_old_root_level(root, time_seq);
 
         if (root_level + 1 == level)
                 goto out;
@@ -1177,16 +1175,15 @@ int btrfs_find_one_extref(struct btrfs_root *root, u64 inode_objectid,
         return ret;
 }
 
-static char *ref_to_path(struct btrfs_root *fs_root,
-                         struct btrfs_path *path,
-                         u32 name_len, unsigned long name_off,
-                         struct extent_buffer *eb_in, u64 parent,
-                         char *dest, u32 size)
+char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
+                        u32 name_len, unsigned long name_off,
+                        struct extent_buffer *eb_in, u64 parent,
+                        char *dest, u32 size)
 {
         int slot;
         u64 next_inum;
         int ret;
-        s64 bytes_left = size - 1;
+        s64 bytes_left = ((s64)size) - 1;
         struct extent_buffer *eb = eb_in;
         struct btrfs_key found_key;
         int leave_spinning = path->leave_spinning;
@@ -1266,10 +1263,10 @@ char *btrfs_iref_to_path(struct btrfs_root *fs_root,
                          struct extent_buffer *eb_in, u64 parent,
                          char *dest, u32 size)
 {
-        return ref_to_path(fs_root, path,
-                           btrfs_inode_ref_name_len(eb_in, iref),
-                           (unsigned long)(iref + 1),
-                           eb_in, parent, dest, size);
+        return btrfs_ref_to_path(fs_root, path,
+                                 btrfs_inode_ref_name_len(eb_in, iref),
+                                 (unsigned long)(iref + 1),
+                                 eb_in, parent, dest, size);
 }
 
 /*
@@ -1715,9 +1712,8 @@ static int inode_to_path(u64 inum, u32 name_len, unsigned long name_off,
                                         ipath->fspath->bytes_left - s_ptr : 0;
 
         fspath_min = (char *)ipath->fspath->val + (i + 1) * s_ptr;
-        fspath = ref_to_path(ipath->fs_root, ipath->btrfs_path, name_len,
-                             name_off, eb, inum, fspath_min,
-                             bytes_left);
+        fspath = btrfs_ref_to_path(ipath->fs_root, ipath->btrfs_path, name_len,
+                                   name_off, eb, inum, fspath_min, bytes_left);
         if (IS_ERR(fspath))
                 return PTR_ERR(fspath);
 
diff --git a/fs/btrfs/backref.h b/fs/btrfs/backref.h
index e75533043a5f..d61feca79455 100644
--- a/fs/btrfs/backref.h
+++ b/fs/btrfs/backref.h
@@ -62,6 +62,10 @@ int btrfs_find_all_roots(struct btrfs_trans_handle *trans,
 char *btrfs_iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                          struct btrfs_inode_ref *iref, struct extent_buffer *eb,
                          u64 parent, char *dest, u32 size);
+char *btrfs_ref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
+                        u32 name_len, unsigned long name_off,
+                        struct extent_buffer *eb_in, u64 parent,
+                        char *dest, u32 size);
 
 struct btrfs_data_container *init_data_container(u32 total_bytes);
 struct inode_fs_paths *init_ipath(s32 total_bytes, struct btrfs_root *fs_root,
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index b33436211000..cdfb4c49a806 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -596,6 +596,11 @@ tree_mod_log_insert_move(struct btrfs_fs_info *fs_info,
         if (tree_mod_dont_log(fs_info, eb))
                 return 0;
 
+        /*
+         * When we override something during the move, we log these removals.
+         * This can only happen when we move towards the beginning of the
+         * buffer, i.e. dst_slot < src_slot.
+         */
         for (i = 0; i + dst_slot < src_slot && i < nr_items; i++) {
                 ret = tree_mod_log_insert_key_locked(fs_info, eb, i + dst_slot,
                                               MOD_LOG_KEY_REMOVE_WHILE_MOVING);
@@ -647,8 +652,6 @@ tree_mod_log_insert_root(struct btrfs_fs_info *fs_info,
         if (tree_mod_dont_log(fs_info, NULL))
                 return 0;
 
-        __tree_mod_log_free_eb(fs_info, old_root);
-
         ret = tree_mod_alloc(fs_info, flags, &tm);
         if (ret < 0)
                 goto out;
@@ -926,12 +929,7 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
                         ret = btrfs_dec_ref(trans, root, buf, 1, 1);
                         BUG_ON(ret); /* -ENOMEM */
                 }
-                /*
-                 * don't log freeing in case we're freeing the root node, this
-                 * is done by tree_mod_log_set_root_pointer later
-                 */
-                if (buf != root->node && btrfs_header_level(buf) != 0)
-                        tree_mod_log_free_eb(root->fs_info, buf);
+                tree_mod_log_free_eb(root->fs_info, buf);
                 clean_tree_block(trans, root, buf);
                 *last_ref = 1;
         }
@@ -1225,6 +1223,8 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,
         free_extent_buffer(eb);
 
         __tree_mod_log_rewind(eb_rewin, time_seq, tm);
+        WARN_ON(btrfs_header_nritems(eb_rewin) >
+                BTRFS_NODEPTRS_PER_BLOCK(fs_info->fs_root));
 
         return eb_rewin;
 }
@@ -1241,9 +1241,11 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
 {
         struct tree_mod_elem *tm;
         struct extent_buffer *eb;
+        struct extent_buffer *old;
         struct tree_mod_root *old_root = NULL;
         u64 old_generation = 0;
         u64 logical;
+        u32 blocksize;
 
         eb = btrfs_read_lock_root_node(root);
         tm = __tree_mod_log_oldest_root(root->fs_info, root, time_seq);
@@ -1259,14 +1261,32 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
         }
 
         tm = tree_mod_log_search(root->fs_info, logical, time_seq);
-        if (old_root)
+        if (old_root && tm && tm->op != MOD_LOG_KEY_REMOVE_WHILE_FREEING) {
+                btrfs_tree_read_unlock(root->node);
+                free_extent_buffer(root->node);
+                blocksize = btrfs_level_size(root, old_root->level);
+                old = read_tree_block(root, logical, blocksize, 0);
+                if (!old) {
+                        pr_warn("btrfs: failed to read tree block %llu from get_old_root\n",
+                                logical);
+                        WARN_ON(1);
+                } else {
+                        eb = btrfs_clone_extent_buffer(old);
+                        free_extent_buffer(old);
+                }
+        } else if (old_root) {
+                btrfs_tree_read_unlock(root->node);
+                free_extent_buffer(root->node);
                 eb = alloc_dummy_extent_buffer(logical, root->nodesize);
-        else
+        } else {
                 eb = btrfs_clone_extent_buffer(root->node);
-        btrfs_tree_read_unlock(root->node);
-        free_extent_buffer(root->node);
+                btrfs_tree_read_unlock(root->node);
+                free_extent_buffer(root->node);
+        }
+
         if (!eb)
                 return NULL;
+        extent_buffer_get(eb);
         btrfs_tree_read_lock(eb);
         if (old_root) {
                 btrfs_set_header_bytenr(eb, eb->start);
@@ -1279,11 +1299,28 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
                 __tree_mod_log_rewind(eb, time_seq, tm);
         else
                 WARN_ON(btrfs_header_level(eb) != 0);
-        extent_buffer_get(eb);
+        WARN_ON(btrfs_header_nritems(eb) > BTRFS_NODEPTRS_PER_BLOCK(root));
 
         return eb;
 }
 
+int btrfs_old_root_level(struct btrfs_root *root, u64 time_seq)
+{
+        struct tree_mod_elem *tm;
+        int level;
+
+        tm = __tree_mod_log_oldest_root(root->fs_info, root, time_seq);
+        if (tm && tm->op == MOD_LOG_ROOT_REPLACE) {
+                level = tm->old_root.level;
+        } else {
+                rcu_read_lock();
+                level = btrfs_header_level(root->node);
+                rcu_read_unlock();
+        }
+
+        return level;
+}
+
 static inline int should_cow_block(struct btrfs_trans_handle *trans,
                                    struct btrfs_root *root,
                                    struct extent_buffer *buf)
@@ -1725,6 +1762,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                         goto enospc;
                 }
 
+                tree_mod_log_free_eb(root->fs_info, root->node);
                 tree_mod_log_set_root_pointer(root, child);
                 rcu_assign_pointer(root->node, child);
 
@@ -2970,8 +3008,10 @@ static int push_node_left(struct btrfs_trans_handle *trans,
                            push_items * sizeof(struct btrfs_key_ptr));
 
         if (push_items < src_nritems) {
-                tree_mod_log_eb_move(root->fs_info, src, 0, push_items,
-                                     src_nritems - push_items);
+                /*
+                 * don't call tree_mod_log_eb_move here, key removal was already
+                 * fully logged by tree_mod_log_eb_copy above.
+                 */
                 memmove_extent_buffer(src, btrfs_node_key_ptr_offset(0),
                                       btrfs_node_key_ptr_offset(push_items),
                                       (src_nritems - push_items) *
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 926c9ffc66d9..c72ead869507 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3120,6 +3120,7 @@ static inline u64 btrfs_inc_tree_mod_seq(struct btrfs_fs_info *fs_info)
 {
         return atomic_inc_return(&fs_info->tree_mod_seq);
 }
+int btrfs_old_root_level(struct btrfs_root *root, u64 time_seq);
 
 /* root-item.c */
 int btrfs_find_root_ref(struct btrfs_root *tree_root,
@@ -3338,6 +3339,8 @@ struct extent_map *btrfs_get_extent(struct inode *inode, struct page *page,
 int btrfs_update_inode(struct btrfs_trans_handle *trans,
                               struct btrfs_root *root,
                               struct inode *inode);
+int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
+                                struct btrfs_root *root, struct inode *inode);
 int btrfs_orphan_add(struct btrfs_trans_handle *trans, struct inode *inode);
 int btrfs_orphan_del(struct btrfs_trans_handle *trans, struct inode *inode);
 int btrfs_orphan_cleanup(struct btrfs_root *root);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 8036d3a84853..472873a94d96 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4110,8 +4110,8 @@ struct extent_buffer *alloc_dummy_extent_buffer(u64 start, unsigned long len)
 
         return eb;
 err:
-        for (i--; i >= 0; i--)
-                __free_page(eb->pages[i]);
+        for (; i > 0; i--)
+                __free_page(eb->pages[i - 1]);
         __free_extent_buffer(eb);
         return NULL;
 }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 85a1e5053fe6..95542a1b3dfc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -94,8 +94,6 @@ static noinline int cow_file_range(struct inode *inode,
                                    struct page *locked_page,
                                    u64 start, u64 end, int *page_started,
                                    unsigned long *nr_written, int unlock);
-static noinline int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
-                                struct btrfs_root *root, struct inode *inode);
 
 static int btrfs_init_inode_security(struct btrfs_trans_handle *trans,
                                      struct inode *inode,  struct inode *dir,
@@ -2746,8 +2744,9 @@ noinline int btrfs_update_inode(struct btrfs_trans_handle *trans,
         return btrfs_update_inode_item(trans, root, inode);
 }
 
-static noinline int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
-                                struct btrfs_root *root, struct inode *inode)
+noinline int btrfs_update_inode_fallback(struct btrfs_trans_handle *trans,
+                                         struct btrfs_root *root,
+                                         struct inode *inode)
 {
         int ret;
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 61168805f175..8fcf9a59c28d 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -343,7 +343,8 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
                 return -EOPNOTSUPP;
         if (copy_from_user(&range, arg, sizeof(range)))
                 return -EFAULT;
-        if (range.start > total_bytes)
+        if (range.start > total_bytes ||
+            range.len < fs_info->sb->s_blocksize)
                 return -EINVAL;
 
         range.len = min(range.len, total_bytes - range.start);
@@ -570,7 +571,8 @@ static int create_snapshot(struct btrfs_root *root, struct dentry *dentry,
                 ret = btrfs_commit_transaction(trans,
                                                root->fs_info->extent_root);
         }
-        BUG_ON(ret);
+        if (ret)
+                goto fail;
 
         ret = pending_snapshot->error;
         if (ret)
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 5039686df6ae..fe9d02c45f8e 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -790,8 +790,10 @@ int btrfs_quota_enable(struct btrfs_trans_handle *trans,
         }
 
         path = btrfs_alloc_path();
-        if (!path)
-                return -ENOMEM;
+        if (!path) {
+                ret = -ENOMEM;
+                goto out_free_root;
+        }
 
         key.objectid = 0;
         key.type = BTRFS_QGROUP_STATUS_KEY;
@@ -800,7 +802,7 @@ int btrfs_quota_enable(struct btrfs_trans_handle *trans,
         ret = btrfs_insert_empty_item(trans, quota_root, path, &key,
                                       sizeof(*ptr));
         if (ret)
-                goto out;
+                goto out_free_path;
 
         leaf = path->nodes[0];
         ptr = btrfs_item_ptr(leaf, path->slots[0],
@@ -818,8 +820,15 @@ int btrfs_quota_enable(struct btrfs_trans_handle *trans,
         fs_info->quota_root = quota_root;
         fs_info->pending_quota_state = 1;
         spin_unlock(&fs_info->qgroup_lock);
-out:
+out_free_path:
         btrfs_free_path(path);
+out_free_root:
+        if (ret) {
+                free_extent_buffer(quota_root->node);
+                free_extent_buffer(quota_root->commit_root);
+                kfree(quota_root);
+        }
+out:
         return ret;
 }
 
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index c7beb543a4a8..e78b297b0b00 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -745,31 +745,36 @@ typedef int (*iterate_inode_ref_t)(int num, u64 dir, int index,
                                    void *ctx);
 
 /*
- * Helper function to iterate the entries in ONE btrfs_inode_ref.
+ * Helper function to iterate the entries in ONE btrfs_inode_ref or
+ * btrfs_inode_extref.
  * The iterate callback may return a non zero value to stop iteration. This can
  * be a negative value for error codes or 1 to simply stop it.
  *
- * path must point to the INODE_REF when called.
+ * path must point to the INODE_REF or INODE_EXTREF when called.
  */
 static int iterate_inode_ref(struct send_ctx *sctx,
                              struct btrfs_root *root, struct btrfs_path *path,
                              struct btrfs_key *found_key, int resolve,
                              iterate_inode_ref_t iterate, void *ctx)
 {
-        struct extent_buffer *eb;
+        struct extent_buffer *eb = path->nodes[0];
         struct btrfs_item *item;
         struct btrfs_inode_ref *iref;
+        struct btrfs_inode_extref *extref;
         struct btrfs_path *tmp_path;
         struct fs_path *p;
-        u32 cur;
-        u32 len;
+        u32 cur = 0;
         u32 total;
-        int slot;
+        int slot = path->slots[0];
         u32 name_len;
         char *start;
         int ret = 0;
-        int num;
+        int num = 0;
         int index;
+        u64 dir;
+        unsigned long name_off;
+        unsigned long elem_size;
+        unsigned long ptr;
 
         p = fs_path_alloc_reversed(sctx);
         if (!p)
@@ -781,24 +786,40 @@ static int iterate_inode_ref(struct send_ctx *sctx,
                 return -ENOMEM;
         }
 
-        eb = path->nodes[0];
-        slot = path->slots[0];
-        item = btrfs_item_nr(eb, slot);
-        iref = btrfs_item_ptr(eb, slot, struct btrfs_inode_ref);
-        cur = 0;
-        len = 0;
-        total = btrfs_item_size(eb, item);
 
-        num = 0;
+        if (found_key->type == BTRFS_INODE_REF_KEY) {
+                ptr = (unsigned long)btrfs_item_ptr(eb, slot,
+                                                    struct btrfs_inode_ref);
+                item = btrfs_item_nr(eb, slot);
+                total = btrfs_item_size(eb, item);
+                elem_size = sizeof(*iref);
+        } else {
+                ptr = btrfs_item_ptr_offset(eb, slot);
+                total = btrfs_item_size_nr(eb, slot);
+                elem_size = sizeof(*extref);
+        }
+
         while (cur < total) {
                 fs_path_reset(p);
 
-                name_len = btrfs_inode_ref_name_len(eb, iref);
-                index = btrfs_inode_ref_index(eb, iref);
+                if (found_key->type == BTRFS_INODE_REF_KEY) {
+                        iref = (struct btrfs_inode_ref *)(ptr + cur);
+                        name_len = btrfs_inode_ref_name_len(eb, iref);
+                        name_off = (unsigned long)(iref + 1);
+                        index = btrfs_inode_ref_index(eb, iref);
+                        dir = found_key->offset;
+                } else {
+                        extref = (struct btrfs_inode_extref *)(ptr + cur);
+                        name_len = btrfs_inode_extref_name_len(eb, extref);
+                        name_off = (unsigned long)&extref->name;
+                        index = btrfs_inode_extref_index(eb, extref);
+                        dir = btrfs_inode_extref_parent(eb, extref);
+                }
+
                 if (resolve) {
-                        start = btrfs_iref_to_path(root, tmp_path, iref, eb,
-                                                found_key->offset, p->buf,
-                                                p->buf_len);
+                        start = btrfs_ref_to_path(root, tmp_path, name_len,
+                                                  name_off, eb, dir,
+                                                  p->buf, p->buf_len);
                         if (IS_ERR(start)) {
                                 ret = PTR_ERR(start);
                                 goto out;
@@ -809,9 +830,10 @@ static int iterate_inode_ref(struct send_ctx *sctx,
                                                 p->buf_len + p->buf - start);
                                 if (ret < 0)
                                         goto out;
-                                start = btrfs_iref_to_path(root, tmp_path, iref,
-                                                eb, found_key->offset, p->buf,
-                                                p->buf_len);
+                                start = btrfs_ref_to_path(root, tmp_path,
+                                                          name_len, name_off,
+                                                          eb, dir,
+                                                          p->buf, p->buf_len);
                                 if (IS_ERR(start)) {
                                         ret = PTR_ERR(start);
                                         goto out;
@@ -820,21 +842,16 @@ static int iterate_inode_ref(struct send_ctx *sctx,
                         }
                         p->start = start;
                 } else {
-                        ret = fs_path_add_from_extent_buffer(p, eb,
-                                        (unsigned long)(iref + 1), name_len);
+                        ret = fs_path_add_from_extent_buffer(p, eb, name_off,
+                                                             name_len);
                         if (ret < 0)
                                 goto out;
                 }
 
-
-                len = sizeof(*iref) + name_len;
-                iref = (struct btrfs_inode_ref *)((char *)iref + len);
-                cur += len;
-
-                ret = iterate(num, found_key->offset, index, p, ctx);
+                cur += elem_size + name_len;
+                ret = iterate(num, dir, index, p, ctx);
                 if (ret)
                         goto out;
-
                 num++;
         }
 
@@ -998,7 +1015,8 @@ static int get_inode_path(struct send_ctx *sctx, struct btrfs_root *root,
         }
         btrfs_item_key_to_cpu(p->nodes[0], &found_key, p->slots[0]);
         if (found_key.objectid != ino ||
-                found_key.type != BTRFS_INODE_REF_KEY) {
+            (found_key.type != BTRFS_INODE_REF_KEY &&
+             found_key.type != BTRFS_INODE_EXTREF_KEY)) {
                 ret = -ENOENT;
                 goto out;
         }
@@ -1551,8 +1569,8 @@ static int get_first_ref(struct send_ctx *sctx,
         struct btrfs_key key;
         struct btrfs_key found_key;
         struct btrfs_path *path;
-        struct btrfs_inode_ref *iref;
         int len;
+        u64 parent_dir;
 
         path = alloc_path_for_send();
         if (!path)
@@ -1568,27 +1586,41 @@ static int get_first_ref(struct send_ctx *sctx,
         if (!ret)
                 btrfs_item_key_to_cpu(path->nodes[0], &found_key,
                                 path->slots[0]);
-        if (ret || found_key.objectid != key.objectid ||
-            found_key.type != key.type) {
+        if (ret || found_key.objectid != ino ||
+            (found_key.type != BTRFS_INODE_REF_KEY &&
+             found_key.type != BTRFS_INODE_EXTREF_KEY)) {
                 ret = -ENOENT;
                 goto out;
         }
 
-        iref = btrfs_item_ptr(path->nodes[0], path->slots[0],
-                        struct btrfs_inode_ref);
-        len = btrfs_inode_ref_name_len(path->nodes[0], iref);
-        ret = fs_path_add_from_extent_buffer(name, path->nodes[0],
-                        (unsigned long)(iref + 1), len);
+        if (key.type == BTRFS_INODE_REF_KEY) {
+                struct btrfs_inode_ref *iref;
+                iref = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                      struct btrfs_inode_ref);
+                len = btrfs_inode_ref_name_len(path->nodes[0], iref);
+                ret = fs_path_add_from_extent_buffer(name, path->nodes[0],
+                                                     (unsigned long)(iref + 1),
+                                                     len);
+                parent_dir = found_key.offset;
+        } else {
+                struct btrfs_inode_extref *extref;
+                extref = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                        struct btrfs_inode_extref);
+                len = btrfs_inode_extref_name_len(path->nodes[0], extref);
+                ret = fs_path_add_from_extent_buffer(name, path->nodes[0],
+                                        (unsigned long)&extref->name, len);
+                parent_dir = btrfs_inode_extref_parent(path->nodes[0], extref);
+        }
         if (ret < 0)
                 goto out;
         btrfs_release_path(path);
 
-        ret = get_inode_info(root, found_key.offset, NULL, dir_gen, NULL, NULL,
+        ret = get_inode_info(root, parent_dir, NULL, dir_gen, NULL, NULL,
                         NULL, NULL);
         if (ret < 0)
                 goto out;
 
-        *dir = found_key.offset;
+        *dir = parent_dir;
 
 out:
         btrfs_free_path(path);
@@ -2430,7 +2462,8 @@ verbose_printk("btrfs: send_create_inode %llu\n", ino);
                 TLV_PUT_PATH(sctx, BTRFS_SEND_A_PATH_LINK, p);
         } else if (S_ISCHR(mode) || S_ISBLK(mode) ||
                    S_ISFIFO(mode) || S_ISSOCK(mode)) {
-                TLV_PUT_U64(sctx, BTRFS_SEND_A_RDEV, rdev);
+                TLV_PUT_U64(sctx, BTRFS_SEND_A_RDEV, new_encode_dev(rdev));
+                TLV_PUT_U64(sctx, BTRFS_SEND_A_MODE, mode);
         }
 
         ret = send_cmd(sctx);
@@ -3226,7 +3259,8 @@ static int process_all_refs(struct send_ctx *sctx,
                 btrfs_item_key_to_cpu(eb, &found_key, slot);
 
                 if (found_key.objectid != key.objectid ||
-                    found_key.type != key.type)
+                    (found_key.type != BTRFS_INODE_REF_KEY &&
+                     found_key.type != BTRFS_INODE_EXTREF_KEY))
                         break;
 
                 ret = iterate_inode_ref(sctx, root, path, &found_key, 0, cb,
@@ -3987,7 +4021,7 @@ static int process_recorded_refs_if_needed(struct send_ctx *sctx, int at_end)
         if (sctx->cur_ino == 0)
                 goto out;
         if (!at_end && sctx->cur_ino == sctx->cmp_key->objectid &&
-            sctx->cmp_key->type <= BTRFS_INODE_REF_KEY)
+            sctx->cmp_key->type <= BTRFS_INODE_EXTREF_KEY)
                 goto out;
         if (list_empty(&sctx->new_refs) && list_empty(&sctx->deleted_refs))
                 goto out;
@@ -4033,22 +4067,21 @@ static int finish_inode_if_needed(struct send_ctx *sctx, int at_end)
         if (ret < 0)
                 goto out;
 
-        if (!S_ISLNK(sctx->cur_inode_mode)) {
-                if (!sctx->parent_root || sctx->cur_inode_new) {
+        if (!sctx->parent_root || sctx->cur_inode_new) {
+                need_chown = 1;
+                if (!S_ISLNK(sctx->cur_inode_mode))
                         need_chmod = 1;
-                        need_chown = 1;
-                } else {
-                        ret = get_inode_info(sctx->parent_root, sctx->cur_ino,
-                                        NULL, NULL, &right_mode, &right_uid,
-                                        &right_gid, NULL);
-                        if (ret < 0)
-                                goto out;
+        } else {
+                ret = get_inode_info(sctx->parent_root, sctx->cur_ino,
+                                NULL, NULL, &right_mode, &right_uid,
+                                &right_gid, NULL);
+                if (ret < 0)
+                        goto out;
 
-                        if (left_uid != right_uid || left_gid != right_gid)
-                                need_chown = 1;
-                        if (left_mode != right_mode)
-                                need_chmod = 1;
-                }
+                if (left_uid != right_uid || left_gid != right_gid)
+                        need_chown = 1;
+                if (!S_ISLNK(sctx->cur_inode_mode) && left_mode != right_mode)
+                        need_chmod = 1;
         }
 
         if (S_ISREG(sctx->cur_inode_mode)) {
@@ -4335,7 +4368,8 @@ static int changed_cb(struct btrfs_root *left_root,
 
         if (key->type == BTRFS_INODE_ITEM_KEY)
                 ret = changed_inode(sctx, result);
-        else if (key->type == BTRFS_INODE_REF_KEY)
+        else if (key->type == BTRFS_INODE_REF_KEY ||
+                 key->type == BTRFS_INODE_EXTREF_KEY)
                 ret = changed_ref(sctx, result);
         else if (key->type == BTRFS_XATTR_ITEM_KEY)
                 ret = changed_xattr(sctx, result);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 77db875b5116..04bbfb1052eb 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1200,7 +1200,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
         btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                          dentry->d_name.len * 2);
         parent_inode->i_mtime = parent_inode->i_ctime = CURRENT_TIME;
-        ret = btrfs_update_inode(trans, parent_root, parent_inode);
+        ret = btrfs_update_inode_fallback(trans, parent_root, parent_inode);
         if (ret)
                 btrfs_abort_transaction(trans, root, ret);
 fail:
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 029b903a4ae3..0f5ebb72a5ea 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1819,6 +1819,13 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
                                     "Failed to relocate sys chunks after "
                                     "device initialization. This can be fixed "
                                     "using the \"btrfs balance\" command.");
+                trans = btrfs_attach_transaction(root);
+                if (IS_ERR(trans)) {
+                        if (PTR_ERR(trans) == -ENOENT)
+                                return 0;
+                        return PTR_ERR(trans);
+                }
+                ret = btrfs_commit_transaction(trans, root);
         }
 
         return ret;
diff --git a/fs/char_dev.c b/fs/char_dev.c
index 3f152b92a94a..afc2bb691780 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -471,9 +471,19 @@ static int exact_lock(dev_t dev, void *data)
  */
 int cdev_add(struct cdev *p, dev_t dev, unsigned count)
 {
+        int error;
+
         p->dev = dev;
         p->count = count;
-        return kobj_map(cdev_map, dev, count, NULL, exact_match, exact_lock, p);
+
+        error = kobj_map(cdev_map, dev, count, NULL,
+                         exact_match, exact_lock, p);
+        if (error)
+                return error;
+
+        kobject_get(p->kobj.parent);
+
+        return 0;
 }
 
 static void cdev_unmap(dev_t dev, unsigned count)
@@ -498,14 +508,20 @@ void cdev_del(struct cdev *p)
 static void cdev_default_release(struct kobject *kobj)
 {
         struct cdev *p = container_of(kobj, struct cdev, kobj);
+        struct kobject *parent = kobj->parent;
+
         cdev_purge(p);
+        kobject_put(parent);
 }
 
 static void cdev_dynamic_release(struct kobject *kobj)
 {
         struct cdev *p = container_of(kobj, struct cdev, kobj);
+        struct kobject *parent = kobj->parent;
+
         cdev_purge(p);
         kfree(p);
+        kobject_put(parent);
 }
 
 static struct kobj_type ktype_cdev_default = {
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index f5054025f9da..4c6285fff598 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,
 
         err  = get_user(palp, &up->palette);
         err |= get_user(length, &up->length);
+        if (err)
+                return -EFAULT;
 
         up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
         err  = put_user(compat_ptr(palp), &up_native->palette);
diff --git a/fs/exec.c b/fs/exec.c
index 8b9011b67041..0039055b1fc6 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1083,7 +1083,8 @@ int flush_old_exec(struct linux_binprm * bprm)
         bprm->mm = NULL;                /* We're using it now */
 
         set_fs(USER_DS);
-        current->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD);
+        current->flags &=
+                ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD | PF_NOFREEZE);
         flush_thread();
         current->personality &= ~bprm->per_clear;
 
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 1b5089067d01..cf1821784a16 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -174,8 +174,7 @@ void ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
                 ext4_free_inodes_set(sb, gdp, 0);
                 ext4_itable_unused_set(sb, gdp, 0);
                 memset(bh->b_data, 0xff, sb->s_blocksize);
-                ext4_block_bitmap_csum_set(sb, block_group, gdp, bh,
-                                           EXT4_BLOCKS_PER_GROUP(sb) / 8);
+                ext4_block_bitmap_csum_set(sb, block_group, gdp, bh);
                 return;
         }
         memset(bh->b_data, 0, sb->s_blocksize);
@@ -212,8 +211,7 @@ void ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
          */
         ext4_mark_bitmap_end(num_clusters_in_group(sb, block_group),
                              sb->s_blocksize * 8, bh->b_data);
-        ext4_block_bitmap_csum_set(sb, block_group, gdp, bh,
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
+        ext4_block_bitmap_csum_set(sb, block_group, gdp, bh);
         ext4_group_desc_csum_set(sb, block_group, gdp);
 }
 
@@ -350,7 +348,7 @@ void ext4_validate_block_bitmap(struct super_block *sb,
                 return;
         }
         if (unlikely(!ext4_block_bitmap_csum_verify(sb, block_group,
-                        desc, bh, EXT4_BLOCKS_PER_GROUP(sb) / 8))) {
+                        desc, bh))) {
                 ext4_unlock_group(sb, block_group);
                 ext4_error(sb, "bg %u: bad block bitmap checksum", block_group);
                 return;
diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c
index 5c2d1813ebe9..3285aa5a706a 100644
--- a/fs/ext4/bitmap.c
+++ b/fs/ext4/bitmap.c
@@ -58,11 +58,12 @@ void ext4_inode_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
 
 int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
                                   struct ext4_group_desc *gdp,
-                                  struct buffer_head *bh, int sz)
+                                  struct buffer_head *bh)
 {
         __u32 hi;
         __u32 provided, calculated;
         struct ext4_sb_info *sbi = EXT4_SB(sb);
+        int sz = EXT4_CLUSTERS_PER_GROUP(sb) / 8;
 
         if (!EXT4_HAS_RO_COMPAT_FEATURE(sb,
                                         EXT4_FEATURE_RO_COMPAT_METADATA_CSUM))
@@ -84,8 +85,9 @@ int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
 
 void ext4_block_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
                                 struct ext4_group_desc *gdp,
-                                struct buffer_head *bh, int sz)
+                                struct buffer_head *bh)
 {
+        int sz = EXT4_CLUSTERS_PER_GROUP(sb) / 8;
         __u32 csum;
         struct ext4_sb_info *sbi = EXT4_SB(sb);
 
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 3ab2539b7b2e..3c20de1d59d0 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1882,10 +1882,10 @@ int ext4_inode_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
                                   struct buffer_head *bh, int sz);
 void ext4_block_bitmap_csum_set(struct super_block *sb, ext4_group_t group,
                                 struct ext4_group_desc *gdp,
-                                struct buffer_head *bh, int sz);
+                                struct buffer_head *bh);
 int ext4_block_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
                                   struct ext4_group_desc *gdp,
-                                  struct buffer_head *bh, int sz);
+                                  struct buffer_head *bh);
 
 /* balloc.c */
 extern void ext4_validate_block_bitmap(struct super_block *sb,
@@ -2063,8 +2063,7 @@ extern int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count);
 extern int ext4_calculate_overhead(struct super_block *sb);
 extern int ext4_superblock_csum_verify(struct super_block *sb,
                                        struct ext4_super_block *es);
-extern void ext4_superblock_csum_set(struct super_block *sb,
-                                     struct ext4_super_block *es);
+extern void ext4_superblock_csum_set(struct super_block *sb);
 extern void *ext4_kvmalloc(size_t size, gfp_t flags);
 extern void *ext4_kvzalloc(size_t size, gfp_t flags);
 extern void ext4_kvfree(void *ptr);
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index bfa65b49d424..b4323ba846b5 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -143,17 +143,13 @@ int __ext4_handle_dirty_super(const char *where, unsigned int line,
         struct buffer_head *bh = EXT4_SB(sb)->s_sbh;
         int err = 0;
 
+        ext4_superblock_csum_set(sb);
         if (ext4_handle_valid(handle)) {
-                ext4_superblock_csum_set(sb,
-                                (struct ext4_super_block *)bh->b_data);
                 err = jbd2_journal_dirty_metadata(handle, bh);
                 if (err)
                         ext4_journal_abort_handle(where, line, __func__,
                                                   bh, handle, err);
-        } else {
-                ext4_superblock_csum_set(sb,
-                                (struct ext4_super_block *)bh->b_data);
+        } else
                 mark_buffer_dirty(bh);
-        }
         return err;
 }
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 1c94cca35ed1..7011ac967208 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -52,6 +52,9 @@
 #define EXT4_EXT_MARK_UNINIT1   0x2  /* mark first half uninitialized */
 #define EXT4_EXT_MARK_UNINIT2   0x4  /* mark second half uninitialized */
 
+#define EXT4_EXT_DATA_VALID1    0x8  /* first half contains valid data */
+#define EXT4_EXT_DATA_VALID2    0x10 /* second half contains valid data */
+
 static __le32 ext4_extent_block_csum(struct inode *inode,
                                      struct ext4_extent_header *eh)
 {
@@ -2914,6 +2917,9 @@ static int ext4_split_extent_at(handle_t *handle,
         unsigned int ee_len, depth;
         int err = 0;
 
+        BUG_ON((split_flag & (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2)) ==
+               (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2));
+
         ext_debug("ext4_split_extents_at: inode %lu, logical"
                 "block %llu\n", inode->i_ino, (unsigned long long)split);
 
@@ -2972,7 +2978,14 @@ static int ext4_split_extent_at(handle_t *handle,
 
         err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
         if (err == -ENOSPC && (EXT4_EXT_MAY_ZEROOUT & split_flag)) {
-                err = ext4_ext_zeroout(inode, &orig_ex);
+                if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) {
+                        if (split_flag & EXT4_EXT_DATA_VALID1)
+                                err = ext4_ext_zeroout(inode, ex2);
+                        else
+                                err = ext4_ext_zeroout(inode, ex);
+                } else
+                        err = ext4_ext_zeroout(inode, &orig_ex);
+
                 if (err)
                         goto fix_extent_len;
                 /* update the extent length and mark as initialized */
@@ -3025,12 +3038,13 @@ static int ext4_split_extent(handle_t *handle,
         uninitialized = ext4_ext_is_uninitialized(ex);
 
         if (map->m_lblk + map->m_len < ee_block + ee_len) {
-                split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ?
-                              EXT4_EXT_MAY_ZEROOUT : 0;
+                split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT;
                 flags1 = flags | EXT4_GET_BLOCKS_PRE_IO;
                 if (uninitialized)
                         split_flag1 |= EXT4_EXT_MARK_UNINIT1 |
                                        EXT4_EXT_MARK_UNINIT2;
+                if (split_flag & EXT4_EXT_DATA_VALID2)
+                        split_flag1 |= EXT4_EXT_DATA_VALID1;
                 err = ext4_split_extent_at(handle, inode, path,
                                 map->m_lblk + map->m_len, split_flag1, flags1);
                 if (err)
@@ -3043,8 +3057,8 @@ static int ext4_split_extent(handle_t *handle,
                 return PTR_ERR(path);
 
         if (map->m_lblk >= ee_block) {
-                split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ?
-                              EXT4_EXT_MAY_ZEROOUT : 0;
+                split_flag1 = split_flag & (EXT4_EXT_MAY_ZEROOUT |
+                                            EXT4_EXT_DATA_VALID2);
                 if (uninitialized)
                         split_flag1 |= EXT4_EXT_MARK_UNINIT1;
                 if (split_flag & EXT4_EXT_MARK_UNINIT2)
@@ -3323,26 +3337,47 @@ static int ext4_split_unwritten_extents(handle_t *handle,
 
         split_flag |= ee_block + ee_len <= eof_block ? EXT4_EXT_MAY_ZEROOUT : 0;
         split_flag |= EXT4_EXT_MARK_UNINIT2;
-
+        if (flags & EXT4_GET_BLOCKS_CONVERT)
+                split_flag |= EXT4_EXT_DATA_VALID2;
         flags |= EXT4_GET_BLOCKS_PRE_IO;
         return ext4_split_extent(handle, inode, path, map, split_flag, flags);
 }
 
 static int ext4_convert_unwritten_extents_endio(handle_t *handle,
-                                              struct inode *inode,
-                                              struct ext4_ext_path *path)
+                                                struct inode *inode,
+                                                struct ext4_map_blocks *map,
+                                                struct ext4_ext_path *path)
 {
         struct ext4_extent *ex;
+        ext4_lblk_t ee_block;
+        unsigned int ee_len;
         int depth;
         int err = 0;
 
         depth = ext_depth(inode);
         ex = path[depth].p_ext;
+        ee_block = le32_to_cpu(ex->ee_block);
+        ee_len = ext4_ext_get_actual_len(ex);
 
         ext_debug("ext4_convert_unwritten_extents_endio: inode %lu, logical"
                 "block %llu, max_blocks %u\n", inode->i_ino,
-                (unsigned long long)le32_to_cpu(ex->ee_block),
-                ext4_ext_get_actual_len(ex));
+                  (unsigned long long)ee_block, ee_len);
+
+        /* If extent is larger than requested then split is required */
+        if (ee_block != map->m_lblk || ee_len > map->m_len) {
+                err = ext4_split_unwritten_extents(handle, inode, map, path,
+                                                   EXT4_GET_BLOCKS_CONVERT);
+                if (err < 0)
+                        goto out;
+                ext4_ext_drop_refs(path);
+                path = ext4_ext_find_extent(inode, map->m_lblk, path);
+                if (IS_ERR(path)) {
+                        err = PTR_ERR(path);
+                        goto out;
+                }
+                depth = ext_depth(inode);
+                ex = path[depth].p_ext;
+        }
 
         err = ext4_ext_get_access(handle, inode, path + depth);
         if (err)
@@ -3652,7 +3687,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
         }
         /* IO end_io complete, convert the filled extent to written */
         if ((flags & EXT4_GET_BLOCKS_CONVERT)) {
-                ret = ext4_convert_unwritten_extents_endio(handle, inode,
+                ret = ext4_convert_unwritten_extents_endio(handle, inode, map,
                                                         path);
                 if (ret >= 0) {
                         ext4_update_inode_fsync_trans(handle, inode, 1);
@@ -4428,6 +4463,9 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
          */
         if (len <= EXT_UNINIT_MAX_LEN << blkbits)
                 flags |= EXT4_GET_BLOCKS_NO_NORMALIZE;
+
+        /* Prevent race condition between unwritten */
+        ext4_flush_unwritten_io(inode);
 retry:
         while (ret >= 0 && ret < max_blocks) {
                 map.m_lblk = map.m_lblk + ret;
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index fa36372f3fdf..4facdd29a350 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -762,9 +762,7 @@ got:
                         ext4_free_group_clusters_set(sb, gdp,
                                 ext4_free_clusters_after_init(sb, group, gdp));
                         ext4_block_bitmap_csum_set(sb, group, gdp,
-                                                   block_bitmap_bh,
-                                                   EXT4_BLOCKS_PER_GROUP(sb) /
-                                                   8);
+                                                   block_bitmap_bh);
                         ext4_group_desc_csum_set(sb, group, gdp);
                 }
                 ext4_unlock_group(sb, group);
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index f8b27bf80aca..526e55358606 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2805,8 +2805,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
         }
         len = ext4_free_group_clusters(sb, gdp) - ac->ac_b_ex.fe_len;
         ext4_free_group_clusters_set(sb, gdp, len);
-        ext4_block_bitmap_csum_set(sb, ac->ac_b_ex.fe_group, gdp, bitmap_bh,
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
+        ext4_block_bitmap_csum_set(sb, ac->ac_b_ex.fe_group, gdp, bitmap_bh);
         ext4_group_desc_csum_set(sb, ac->ac_b_ex.fe_group, gdp);
 
         ext4_unlock_group(sb, ac->ac_b_ex.fe_group);
@@ -4666,8 +4665,7 @@ do_more:
 
         ret = ext4_free_group_clusters(sb, gdp) + count_clusters;
         ext4_free_group_clusters_set(sb, gdp, ret);
-        ext4_block_bitmap_csum_set(sb, block_group, gdp, bitmap_bh,
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
+        ext4_block_bitmap_csum_set(sb, block_group, gdp, bitmap_bh);
         ext4_group_desc_csum_set(sb, block_group, gdp);
         ext4_unlock_group(sb, block_group);
         percpu_counter_add(&sbi->s_freeclusters_counter, count_clusters);
@@ -4811,8 +4809,7 @@ int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,
         mb_free_blocks(NULL, &e4b, bit, count);
         blk_free_count = blocks_freed + ext4_free_group_clusters(sb, desc);
         ext4_free_group_clusters_set(sb, desc, blk_free_count);
-        ext4_block_bitmap_csum_set(sb, block_group, desc, bitmap_bh,
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
+        ext4_block_bitmap_csum_set(sb, block_group, desc, bitmap_bh);
         ext4_group_desc_csum_set(sb, block_group, desc);
         ext4_unlock_group(sb, block_group);
         percpu_counter_add(&sbi->s_freeclusters_counter,
@@ -4993,8 +4990,9 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)
         minlen = EXT4_NUM_B2C(EXT4_SB(sb),
                               range->minlen >> sb->s_blocksize_bits);
 
-        if (unlikely(minlen > EXT4_CLUSTERS_PER_GROUP(sb)) ||
-            unlikely(start >= max_blks))
+        if (minlen > EXT4_CLUSTERS_PER_GROUP(sb) ||
+            start >= max_blks ||
+            range->len < sb->s_blocksize)
                 return -EINVAL;
         if (end >= max_blks)
                 end = max_blks - 1;
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 7a75e1086961..47bf06a2765d 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1212,8 +1212,7 @@ static int ext4_set_bitmap_checksums(struct super_block *sb,
         bh = ext4_get_bitmap(sb, group_data->block_bitmap);
         if (!bh)
                 return -EIO;
-        ext4_block_bitmap_csum_set(sb, group, gdp, bh,
-                                   EXT4_BLOCKS_PER_GROUP(sb) / 8);
+        ext4_block_bitmap_csum_set(sb, group, gdp, bh);
         brelse(bh);
 
         return 0;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 7265a0367476..80928f716850 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -143,9 +143,10 @@ int ext4_superblock_csum_verify(struct super_block *sb,
         return es->s_checksum == ext4_superblock_csum(sb, es);
 }
 
-void ext4_superblock_csum_set(struct super_block *sb,
-                              struct ext4_super_block *es)
+void ext4_superblock_csum_set(struct super_block *sb)
 {
+        struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+
         if (!EXT4_HAS_RO_COMPAT_FEATURE(sb,
                 EXT4_FEATURE_RO_COMPAT_METADATA_CSUM))
                 return;
@@ -1963,7 +1964,7 @@ static int ext4_fill_flex_info(struct super_block *sb)
                 sbi->s_log_groups_per_flex = 0;
                 return 1;
         }
-        groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+        groups_per_flex = 1U << sbi->s_log_groups_per_flex;
 
         err = ext4_alloc_flex_bg_array(sb, sbi->s_groups_count);
         if (err)
@@ -4381,7 +4382,7 @@ static int ext4_commit_super(struct super_block *sb, int sync)
                 cpu_to_le32(percpu_counter_sum_positive(
                                 &EXT4_SB(sb)->s_freeinodes_counter));
         BUFFER_TRACE(sbh, "marking dirty");
-        ext4_superblock_csum_set(sb, es);
+        ext4_superblock_csum_set(sb);
         mark_buffer_dirty(sbh);
         if (sync) {
                 error = sync_dirty_buffer(sbh);
diff --git a/fs/jfs/jfs_discard.c b/fs/jfs/jfs_discard.c
index 9947563e4175..dfcd50304559 100644
--- a/fs/jfs/jfs_discard.c
+++ b/fs/jfs/jfs_discard.c
@@ -83,7 +83,7 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)
         struct bmap *bmp = JFS_SBI(ip->i_sb)->bmap;
         struct super_block *sb = ipbmap->i_sb;
         int agno, agno_end;
-        s64 start, end, minlen;
+        u64 start, end, minlen;
         u64 trimmed = 0;
 
         /**
@@ -93,15 +93,19 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)
          * minlen:      minimum extent length in Bytes
          */
         start = range->start >> sb->s_blocksize_bits;
-        if (start < 0)
-                start = 0;
         end = start + (range->len >> sb->s_blocksize_bits) - 1;
-        if (end >= bmp->db_mapsize)
-                end = bmp->db_mapsize - 1;
         minlen = range->minlen >> sb->s_blocksize_bits;
-        if (minlen <= 0)
+        if (minlen == 0)
                 minlen = 1;
 
+        if (minlen > bmp->db_agsize ||
+            start >= bmp->db_mapsize ||
+            range->len < sb->s_blocksize)
+                return -EINVAL;
+
+        if (end >= bmp->db_mapsize)
+                end = bmp->db_mapsize - 1;
+
         /**
          * we trim all ag's within the range
          */
diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
index e4fb3ba5a58a..3d7e09bcc0e9 100644
--- a/fs/lockd/mon.c
+++ b/fs/lockd/mon.c
@@ -85,29 +85,38 @@ static struct rpc_clnt *nsm_create(struct net *net)
         return rpc_create(&args);
 }
 
+static struct rpc_clnt *nsm_client_set(struct lockd_net *ln,
+                struct rpc_clnt *clnt)
+{
+        spin_lock(&ln->nsm_clnt_lock);
+        if (ln->nsm_users == 0) {
+                if (clnt == NULL)
+                        goto out;
+                ln->nsm_clnt = clnt;
+        }
+        clnt = ln->nsm_clnt;
+        ln->nsm_users++;
+out:
+        spin_unlock(&ln->nsm_clnt_lock);
+        return clnt;
+}
+
 static struct rpc_clnt *nsm_client_get(struct net *net)
 {
-        static DEFINE_MUTEX(nsm_create_mutex);
-        struct rpc_clnt *clnt;
+        struct rpc_clnt *clnt, *new;
         struct lockd_net *ln = net_generic(net, lockd_net_id);
 
-        spin_lock(&ln->nsm_clnt_lock);
-        if (ln->nsm_users) {
-                ln->nsm_users++;
-                clnt = ln->nsm_clnt;
-                spin_unlock(&ln->nsm_clnt_lock);
+        clnt = nsm_client_set(ln, NULL);
+        if (clnt != NULL)
                 goto out;
-        }
-        spin_unlock(&ln->nsm_clnt_lock);
 
-        mutex_lock(&nsm_create_mutex);
-        clnt = nsm_create(net);
-        if (!IS_ERR(clnt)) {
-                ln->nsm_clnt = clnt;
-                smp_wmb();
-                ln->nsm_users = 1;
-        }
-        mutex_unlock(&nsm_create_mutex);
+        clnt = new = nsm_create(net);
+        if (IS_ERR(clnt))
+                goto out;
+
+        clnt = nsm_client_set(ln, new);
+        if (clnt != new)
+                rpc_shutdown_client(new);
 out:
         return clnt;
 }
@@ -115,18 +124,16 @@ out:
 static void nsm_client_put(struct net *net)
 {
         struct lockd_net *ln = net_generic(net, lockd_net_id);
-        struct rpc_clnt *clnt = ln->nsm_clnt;
-        int shutdown = 0;
+        struct rpc_clnt *clnt = NULL;
 
         spin_lock(&ln->nsm_clnt_lock);
-        if (ln->nsm_users) {
-                if (--ln->nsm_users)
-                        ln->nsm_clnt = NULL;
-                shutdown = !ln->nsm_users;
+        ln->nsm_users--;
+        if (ln->nsm_users == 0) {
+                clnt = ln->nsm_clnt;
+                ln->nsm_clnt = NULL;
         }
         spin_unlock(&ln->nsm_clnt_lock);
-
-        if (shutdown)
+        if (clnt != NULL)
                 rpc_shutdown_client(clnt);
 }
 
diff --git a/fs/namei.c b/fs/namei.c
index d1895f308156..937f9d50c84b 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -705,8 +705,8 @@ static inline void put_link(struct nameidata *nd, struct path *link, void *cooki
         path_put(link);
 }
 
-int sysctl_protected_symlinks __read_mostly = 1;
-int sysctl_protected_hardlinks __read_mostly = 1;
+int sysctl_protected_symlinks __read_mostly = 0;
+int sysctl_protected_hardlinks __read_mostly = 0;
 
 /**
  * may_follow_link - Check symlink following for unsafe situations
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 9a521fb39869..5088b57b078a 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -241,7 +241,7 @@ static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt,
                 svc_exit_thread(cb_info->rqst);
                 cb_info->rqst = NULL;
                 cb_info->task = NULL;
-                return PTR_ERR(cb_info->task);
+                return ret;
         }
         dprintk("nfs_callback_up: service started\n");
         return 0;
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 52d847212066..2e45fd9c02a3 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -122,12 +122,21 @@ static void filelayout_reset_read(struct nfs_read_data *data)
         }
 }
 
+static void filelayout_fenceme(struct inode *inode, struct pnfs_layout_hdr *lo)
+{
+        if (!test_and_clear_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
+                return;
+        clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(inode)->flags);
+        pnfs_return_layout(inode);
+}
+
 static int filelayout_async_handle_error(struct rpc_task *task,
                                          struct nfs4_state *state,
                                          struct nfs_client *clp,
                                          struct pnfs_layout_segment *lseg)
 {
-        struct inode *inode = lseg->pls_layout->plh_inode;
+        struct pnfs_layout_hdr *lo = lseg->pls_layout;
+        struct inode *inode = lo->plh_inode;
         struct nfs_server *mds_server = NFS_SERVER(inode);
         struct nfs4_deviceid_node *devid = FILELAYOUT_DEVID_NODE(lseg);
         struct nfs_client *mds_client = mds_server->nfs_client;
@@ -204,10 +213,8 @@ static int filelayout_async_handle_error(struct rpc_task *task,
                 dprintk("%s DS connection error %d\n", __func__,
                         task->tk_status);
                 nfs4_mark_deviceid_unavailable(devid);
-                clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(inode)->flags);
-                _pnfs_return_layout(inode);
+                set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags);
                 rpc_wake_up(&tbl->slot_tbl_waitq);
-                nfs4_ds_disconnect(clp);
                 /* fall through */
         default:
 reset:
@@ -331,7 +338,9 @@ static void filelayout_read_count_stats(struct rpc_task *task, void *data)
 static void filelayout_read_release(void *data)
 {
         struct nfs_read_data *rdata = data;
+        struct pnfs_layout_hdr *lo = rdata->header->lseg->pls_layout;
 
+        filelayout_fenceme(lo->plh_inode, lo);
         nfs_put_client(rdata->ds_clp);
         rdata->header->mds_ops->rpc_release(data);
 }
@@ -429,7 +438,9 @@ static void filelayout_write_count_stats(struct rpc_task *task, void *data)
 static void filelayout_write_release(void *data)
 {
         struct nfs_write_data *wdata = data;
+        struct pnfs_layout_hdr *lo = wdata->header->lseg->pls_layout;
 
+        filelayout_fenceme(lo->plh_inode, lo);
         nfs_put_client(wdata->ds_clp);
         wdata->header->mds_ops->rpc_release(data);
 }
@@ -739,7 +750,7 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
                 goto out_err;
 
         if (fl->num_fh > 0) {
-                fl->fh_array = kzalloc(fl->num_fh * sizeof(struct nfs_fh *),
+                fl->fh_array = kcalloc(fl->num_fh, sizeof(fl->fh_array[0]),
                                        gfp_flags);
                 if (!fl->fh_array)
                         goto out_err;
diff --git a/fs/nfs/nfs4filelayout.h b/fs/nfs/nfs4filelayout.h
index dca47d786710..8c07241fe52b 100644
--- a/fs/nfs/nfs4filelayout.h
+++ b/fs/nfs/nfs4filelayout.h
@@ -149,6 +149,5 @@ extern void nfs4_fl_put_deviceid(struct nfs4_file_layout_dsaddr *dsaddr);
 extern void nfs4_fl_free_deviceid(struct nfs4_file_layout_dsaddr *dsaddr);
 struct nfs4_file_layout_dsaddr *
 filelayout_get_device_info(struct inode *inode, struct nfs4_deviceid *dev_id, gfp_t gfp_flags);
-void nfs4_ds_disconnect(struct nfs_client *clp);
 
 #endif /* FS_NFS_NFS4FILELAYOUT_H */
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index 3336d5eaf879..a8eaa9b7bb0f 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -149,28 +149,6 @@ _data_server_lookup_locked(const struct list_head *dsaddrs)
 }
 
 /*
- * Lookup DS by nfs_client pointer. Zero data server client pointer
- */
-void nfs4_ds_disconnect(struct nfs_client *clp)
-{
-        struct nfs4_pnfs_ds *ds;
-        struct nfs_client *found = NULL;
-
-        dprintk("%s clp %p\n", __func__, clp);
-        spin_lock(&nfs4_ds_cache_lock);
-        list_for_each_entry(ds, &nfs4_data_server_cache, ds_node)
-                if (ds->ds_clp && ds->ds_clp == clp) {
-                        found = ds->ds_clp;
-                        ds->ds_clp = NULL;
-                }
-        spin_unlock(&nfs4_ds_cache_lock);
-        if (found) {
-                set_bit(NFS_CS_STOP_RENEW, &clp->cl_res_state);
-                nfs_put_client(clp);
-        }
-}
-
-/*
  * Create an rpc connection to the nfs4_pnfs_ds data server
  * Currently only supports IPv4 and IPv6 addresses
  */
diff --git a/fs/nfs/nfs4getroot.c b/fs/nfs/nfs4getroot.c
index 6a83780e0ce6..549462e5b9b0 100644
--- a/fs/nfs/nfs4getroot.c
+++ b/fs/nfs/nfs4getroot.c
@@ -5,6 +5,7 @@
 
 #include <linux/nfs_fs.h>
 #include "nfs4_fs.h"
+#include "internal.h"
 
 #define NFSDBG_FACILITY         NFSDBG_CLIENT
 
diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
index be731e6b7b9c..c6f990656f89 100644
--- a/fs/nfs/objlayout/objio_osd.c
+++ b/fs/nfs/objlayout/objio_osd.c
@@ -369,7 +369,7 @@ void objio_free_result(struct objlayout_io_res *oir)
         kfree(objios);
 }
 
-enum pnfs_osd_errno osd_pri_2_pnfs_err(enum osd_err_priority oep)
+static enum pnfs_osd_errno osd_pri_2_pnfs_err(enum osd_err_priority oep)
 {
         switch (oep) {
         case OSD_ERR_PRI_NO_ERROR:
@@ -574,7 +574,7 @@ static bool objio_pg_test(struct nfs_pageio_descriptor *pgio,
                         (unsigned long)pgio->pg_layout_private;
 }
 
-void objio_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+static void objio_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
 {
         pnfs_generic_pg_init_read(pgio, req);
         if (unlikely(pgio->pg_lseg == NULL))
@@ -604,7 +604,7 @@ static bool aligned_on_raid_stripe(u64 offset, struct ore_layout *layout,
         return false;
 }
 
-void objio_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+static void objio_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
 {
         unsigned long stripe_end = 0;
         u64 wb_size;
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 2d722dba1111..dbf7bba52da0 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -62,6 +62,7 @@ enum {
         NFS_LAYOUT_RW_FAILED,           /* get rw layout failed stop trying */
         NFS_LAYOUT_BULK_RECALL,         /* bulk recall affecting layout */
         NFS_LAYOUT_ROC,                 /* some lseg had roc bit set */
+        NFS_LAYOUT_RETURN,              /* Return this layout ASAP */
 };
 
 enum layoutdriver_policy_flags {
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index 64c3b3172367..e296572c73ed 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -45,10 +45,13 @@ static cputime64_t get_iowait_time(int cpu)
 
 static u64 get_idle_time(int cpu)
 {
-        u64 idle, idle_time = get_cpu_idle_time_us(cpu, NULL);
+        u64 idle, idle_time = -1ULL;
+
+        if (cpu_online(cpu))
+                idle_time = get_cpu_idle_time_us(cpu, NULL);
 
         if (idle_time == -1ULL)
-                /* !NO_HZ so we can rely on cpustat.idle */
+                /* !NO_HZ or cpu offline so we can rely on cpustat.idle */
                 idle = kcpustat_cpu(cpu).cpustat[CPUTIME_IDLE];
         else
                 idle = usecs_to_cputime64(idle_time);
@@ -58,10 +61,13 @@ static u64 get_idle_time(int cpu)
 
 static u64 get_iowait_time(int cpu)
 {
-        u64 iowait, iowait_time = get_cpu_iowait_time_us(cpu, NULL);
+        u64 iowait, iowait_time = -1ULL;
+
+        if (cpu_online(cpu))
+                iowait_time = get_cpu_iowait_time_us(cpu, NULL);
 
         if (iowait_time == -1ULL)
-                /* !NO_HZ so we can rely on cpustat.iowait */
+                /* !NO_HZ or cpu offline so we can rely on cpustat.iowait */
                 iowait = kcpustat_cpu(cpu).cpustat[CPUTIME_IOWAIT];
         else
                 iowait = usecs_to_cputime64(iowait_time);
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 6b0bb00d4d2b..2fbdff6be25c 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -485,20 +485,18 @@ int __sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
 /**
  *      sysfs_pathname - return full path to sysfs dirent
  *      @sd: sysfs_dirent whose path we want
- *      @path: caller allocated buffer
+ *      @path: caller allocated buffer of size PATH_MAX
  *
  *      Gives the name "/" to the sysfs_root entry; any path returned
  *      is relative to wherever sysfs is mounted.
- *
- *      XXX: does no error checking on @path size
  */
 static char *sysfs_pathname(struct sysfs_dirent *sd, char *path)
 {
         if (sd->s_parent) {
                 sysfs_pathname(sd->s_parent, path);
-                strcat(path, "/");
+                strlcat(path, "/", PATH_MAX);
         }
-        strcat(path, sd->s_name);
+        strlcat(path, sd->s_name, PATH_MAX);
         return path;
 }
 
@@ -531,9 +529,11 @@ int sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
                 char *path = kzalloc(PATH_MAX, GFP_KERNEL);
                 WARN(1, KERN_WARNING
                      "sysfs: cannot create duplicate filename '%s'\n",
-                     (path == NULL) ? sd->s_name :
-                     strcat(strcat(sysfs_pathname(acxt->parent_sd, path), "/"),
-                            sd->s_name));
+                     (path == NULL) ? sd->s_name
+                                    : (sysfs_pathname(acxt->parent_sd, path),
+                                       strlcat(path, "/", PATH_MAX),
+                                       strlcat(path, sd->s_name, PATH_MAX),
+                                       path));
                 kfree(path);
         }