10 files changed, 117 insertions, 166 deletions

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index b60fc8bfb3e9..620daad201db 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -641,10 +641,10 @@ static int __cap_is_valid(struct ceph_cap *cap)
         unsigned long ttl;
         u32 gen;
 
-        spin_lock(&cap->session->s_cap_lock);
+        spin_lock(&cap->session->s_gen_ttl_lock);
         gen = cap->session->s_cap_gen;
         ttl = cap->session->s_cap_ttl;
-        spin_unlock(&cap->session->s_cap_lock);
+        spin_unlock(&cap->session->s_gen_ttl_lock);
 
         if (cap->cap_gen < gen || time_after_eq(jiffies, ttl)) {
                 dout("__cap_is_valid %p cap %p issued %s "
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 618246bc2196..3e8094be4604 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -975,10 +975,10 @@ static int dentry_lease_is_valid(struct dentry *dentry)
         di = ceph_dentry(dentry);
         if (di->lease_session) {
                 s = di->lease_session;
-                spin_lock(&s->s_cap_lock);
+                spin_lock(&s->s_gen_ttl_lock);
                 gen = s->s_cap_gen;
                 ttl = s->s_cap_ttl;
-                spin_unlock(&s->s_cap_lock);
+                spin_unlock(&s->s_gen_ttl_lock);
 
                 if (di->lease_gen == gen &&
                     time_before(jiffies, dentry->d_time) &&
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 23ab6a3f1825..866e8d7ca37d 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -262,6 +262,7 @@ static int parse_reply_info(struct ceph_msg *msg,
         /* trace */
         ceph_decode_32_safe(&p, end, len, bad);
         if (len > 0) {
+                ceph_decode_need(&p, end, len, bad);
                 err = parse_reply_info_trace(&p, p+len, info, features);
                 if (err < 0)
                         goto out_bad;
@@ -270,6 +271,7 @@ static int parse_reply_info(struct ceph_msg *msg,
         /* extra */
         ceph_decode_32_safe(&p, end, len, bad);
         if (len > 0) {
+                ceph_decode_need(&p, end, len, bad);
                 err = parse_reply_info_extra(&p, p+len, info, features);
                 if (err < 0)
                         goto out_bad;
@@ -398,9 +400,11 @@ static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc,
         s->s_con.peer_name.type = CEPH_ENTITY_TYPE_MDS;
         s->s_con.peer_name.num = cpu_to_le64(mds);
 
-        spin_lock_init(&s->s_cap_lock);
+        spin_lock_init(&s->s_gen_ttl_lock);
         s->s_cap_gen = 0;
         s->s_cap_ttl = 0;
+
+        spin_lock_init(&s->s_cap_lock);
         s->s_renew_requested = 0;
         s->s_renew_seq = 0;
         INIT_LIST_HEAD(&s->s_caps);
@@ -2326,10 +2330,10 @@ static void handle_session(struct ceph_mds_session *session,
         case CEPH_SESSION_STALE:
                 pr_info("mds%d caps went stale, renewing\n",
                         session->s_mds);
-                spin_lock(&session->s_cap_lock);
+                spin_lock(&session->s_gen_ttl_lock);
                 session->s_cap_gen++;
                 session->s_cap_ttl = 0;
-                spin_unlock(&session->s_cap_lock);
+                spin_unlock(&session->s_gen_ttl_lock);
                 send_renew_caps(mdsc, session);
                 break;
 
diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
index a50ca0e39475..8c7c04ebb595 100644
--- a/fs/ceph/mds_client.h
+++ b/fs/ceph/mds_client.h
@@ -117,10 +117,13 @@ struct ceph_mds_session {
         void             *s_authorizer_buf, *s_authorizer_reply_buf;
         size_t            s_authorizer_buf_len, s_authorizer_reply_buf_len;
 
-        /* protected by s_cap_lock */
-        spinlock_t        s_cap_lock;
+        /* protected by s_gen_ttl_lock */
+        spinlock_t        s_gen_ttl_lock;
         u32               s_cap_gen;  /* inc each time we get mds stale msg */
         unsigned long     s_cap_ttl;  /* when session caps expire */
+
+        /* protected by s_cap_lock */
+        spinlock_t        s_cap_lock;
         struct list_head  s_caps;     /* all caps issued by this session */
         int               s_nr_caps, s_trim_caps;
         int               s_num_cap_releases;
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 857214ae8c08..a76f697303d9 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -111,8 +111,10 @@ static size_t ceph_vxattrcb_layout(struct ceph_inode_info *ci, char *val,
 }
 
 static struct ceph_vxattr_cb ceph_file_vxattrs[] = {
+        { true, "ceph.file.layout", ceph_vxattrcb_layout},
+        /* The following extended attribute name is deprecated */
         { true, "ceph.layout", ceph_vxattrcb_layout},
-        { NULL, NULL }
+        { true, NULL, NULL }
 };
 
 static struct ceph_vxattr_cb *ceph_inode_vxattrs(struct inode *inode)
diff --git a/fs/logfs/dev_mtd.c b/fs/logfs/dev_mtd.c
index e97404d611e0..9c501449450d 100644
--- a/fs/logfs/dev_mtd.c
+++ b/fs/logfs/dev_mtd.c
@@ -152,9 +152,6 @@ static struct page *logfs_mtd_find_first_sb(struct super_block *sb, u64 *ofs)
         filler_t *filler = logfs_mtd_readpage;
         struct mtd_info *mtd = super->s_mtd;
 
-        if (!mtd_can_have_bb(mtd))
-                return NULL;
-
         *ofs = 0;
         while (mtd_block_isbad(mtd, *ofs)) {
                 *ofs += mtd->erasesize;
@@ -172,9 +169,6 @@ static struct page *logfs_mtd_find_last_sb(struct super_block *sb, u64 *ofs)
         filler_t *filler = logfs_mtd_readpage;
         struct mtd_info *mtd = super->s_mtd;
 
-        if (!mtd_can_have_bb(mtd))
-                return NULL;
-
         *ofs = mtd->size - mtd->erasesize;
         while (mtd_block_isbad(mtd, *ofs)) {
                 *ofs -= mtd->erasesize;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 87b9b91f76cf..ea7adfc868c2 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3621,8 +3621,8 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
         }
         if (npages > 1) {
                 /* for decoding across pages */
-                args.acl_scratch = alloc_page(GFP_KERNEL);
-                if (!args.acl_scratch)
+                res.acl_scratch = alloc_page(GFP_KERNEL);
+                if (!res.acl_scratch)
                         goto out_free;
         }
         args.acl_len = npages * PAGE_SIZE;
@@ -3658,8 +3658,8 @@ out_free:
         for (i = 0; i < npages; i++)
                 if (pages[i])
                         __free_page(pages[i]);
-        if (args.acl_scratch)
-                __free_page(args.acl_scratch);
+        if (res.acl_scratch)
+                __free_page(res.acl_scratch);
         return ret;
 }
 
@@ -5104,37 +5104,53 @@ int nfs4_proc_get_lease_time(struct nfs_client *clp, struct nfs_fsinfo *fsinfo)
         return status;
 }
 
+static struct nfs4_slot *nfs4_alloc_slots(u32 max_slots, gfp_t gfp_flags)
+{
+        return kcalloc(max_slots, sizeof(struct nfs4_slot), gfp_flags);
+}
+
+static void nfs4_add_and_init_slots(struct nfs4_slot_table *tbl,
+                struct nfs4_slot *new,
+                u32 max_slots,
+                u32 ivalue)
+{
+        struct nfs4_slot *old = NULL;
+        u32 i;
+
+        spin_lock(&tbl->slot_tbl_lock);
+        if (new) {
+                old = tbl->slots;
+                tbl->slots = new;
+                tbl->max_slots = max_slots;
+        }
+        tbl->highest_used_slotid = -1;  /* no slot is currently used */
+        for (i = 0; i < tbl->max_slots; i++)
+                tbl->slots[i].seq_nr = ivalue;
+        spin_unlock(&tbl->slot_tbl_lock);
+        kfree(old);
+}
+
 /*
- * Reset a slot table
+ * (re)Initialise a slot table
  */
-static int nfs4_reset_slot_table(struct nfs4_slot_table *tbl, u32 max_reqs,
-                                 int ivalue)
+static int nfs4_realloc_slot_table(struct nfs4_slot_table *tbl, u32 max_reqs,
+                                 u32 ivalue)
 {
         struct nfs4_slot *new = NULL;
-        int i;
-        int ret = 0;
+        int ret = -ENOMEM;
 
         dprintk("--> %s: max_reqs=%u, tbl->max_slots %d\n", __func__,
                 max_reqs, tbl->max_slots);
 
         /* Does the newly negotiated max_reqs match the existing slot table? */
         if (max_reqs != tbl->max_slots) {
-                ret = -ENOMEM;
-                new = kmalloc(max_reqs * sizeof(struct nfs4_slot),
-                              GFP_NOFS);
+                new = nfs4_alloc_slots(max_reqs, GFP_NOFS);
                 if (!new)
                         goto out;
-                ret = 0;
-                kfree(tbl->slots);
-        }
-        spin_lock(&tbl->slot_tbl_lock);
-        if (new) {
-                tbl->slots = new;
-                tbl->max_slots = max_reqs;
         }
-        for (i = 0; i < tbl->max_slots; ++i)
-                tbl->slots[i].seq_nr = ivalue;
-        spin_unlock(&tbl->slot_tbl_lock);
+        ret = 0;
+
+        nfs4_add_and_init_slots(tbl, new, max_reqs, ivalue);
         dprintk("%s: tbl=%p slots=%p max_slots=%d\n", __func__,
                 tbl, tbl->slots, tbl->max_slots);
 out:
@@ -5157,36 +5173,6 @@ static void nfs4_destroy_slot_tables(struct nfs4_session *session)
 }
 
 /*
- * Initialize slot table
- */
-static int nfs4_init_slot_table(struct nfs4_slot_table *tbl,
-                int max_slots, int ivalue)
-{
-        struct nfs4_slot *slot;
-        int ret = -ENOMEM;
-
-        BUG_ON(max_slots > NFS4_MAX_SLOT_TABLE);
-
-        dprintk("--> %s: max_reqs=%u\n", __func__, max_slots);
-
-        slot = kcalloc(max_slots, sizeof(struct nfs4_slot), GFP_NOFS);
-        if (!slot)
-                goto out;
-        ret = 0;
-
-        spin_lock(&tbl->slot_tbl_lock);
-        tbl->max_slots = max_slots;
-        tbl->slots = slot;
-        tbl->highest_used_slotid = NFS4_NO_SLOT;  /* no slot is currently used */
-        spin_unlock(&tbl->slot_tbl_lock);
-        dprintk("%s: tbl=%p slots=%p max_slots=%d\n", __func__,
-                tbl, tbl->slots, tbl->max_slots);
-out:
-        dprintk("<-- %s: return %d\n", __func__, ret);
-        return ret;
-}
-
-/*
  * Initialize or reset the forechannel and backchannel tables
  */
 static int nfs4_setup_session_slot_tables(struct nfs4_session *ses)
@@ -5197,25 +5183,16 @@ static int nfs4_setup_session_slot_tables(struct nfs4_session *ses)
         dprintk("--> %s\n", __func__);
         /* Fore channel */
         tbl = &ses->fc_slot_table;
-        if (tbl->slots == NULL) {
-                status = nfs4_init_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
-                if (status) /* -ENOMEM */
-                        return status;
-        } else {
-                status = nfs4_reset_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
-                if (status)
-                        return status;
-        }
+        status = nfs4_realloc_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
+        if (status) /* -ENOMEM */
+                return status;
         /* Back channel */
         tbl = &ses->bc_slot_table;
-        if (tbl->slots == NULL) {
-                status = nfs4_init_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
-                if (status)
-                        /* Fore and back channel share a connection so get
-                         * both slot tables or neither */
-                        nfs4_destroy_slot_tables(ses);
-        } else
-                status = nfs4_reset_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
+        status = nfs4_realloc_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
+        if (status && tbl->slots == NULL)
+                /* Fore and back channel share a connection so get
+                 * both slot tables or neither */
+                nfs4_destroy_slot_tables(ses);
         return status;
 }
 
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index bae959e294cd..2f760604246f 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1106,6 +1106,8 @@ void nfs4_schedule_stateid_recovery(const struct nfs_server *server, struct nfs4
 {
         struct nfs_client *clp = server->nfs_client;
 
+        if (test_and_clear_bit(NFS_DELEGATED_STATE, &state->flags))
+                nfs_async_inode_return_delegation(state->inode, &state->stateid);
         nfs4_state_mark_reclaim_nograce(clp, state);
         nfs4_schedule_state_manager(clp);
 }
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 7d3ba1ff787c..bca8c77e5fe0 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -2563,7 +2563,6 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
 
         xdr_inline_pages(&req->rq_rcv_buf, replen << 2,
                 args->acl_pages, args->acl_pgbase, args->acl_len);
-        xdr_set_scratch_buffer(xdr, page_address(args->acl_scratch), PAGE_SIZE);
 
         encode_nops(&hdr);
 }
@@ -6132,6 +6131,10 @@ nfs4_xdr_dec_getacl(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
         struct compound_hdr hdr;
         int status;
 
+        if (res->acl_scratch != NULL) {
+                void *p = page_address(res->acl_scratch);
+                xdr_set_scratch_buffer(xdr, p, PAGE_SIZE);
+        }
         status = decode_compound_hdr(xdr, &hdr);
         if (status)
                 goto out;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 9cde9edf9c4d..d4548dd49b02 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -198,26 +198,6 @@ static int proc_root_link(struct dentry *dentry, struct path *path)
         return result;
 }
 
-static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
-{
-        struct mm_struct *mm;
-        int err;
-
-        err =  mutex_lock_killable(&task->signal->cred_guard_mutex);
-        if (err)
-                return ERR_PTR(err);
-
-        mm = get_task_mm(task);
-        if (mm && mm != current->mm &&
-                        !ptrace_may_access(task, mode)) {
-                mmput(mm);
-                mm = ERR_PTR(-EACCES);
-        }
-        mutex_unlock(&task->signal->cred_guard_mutex);
-
-        return mm;
-}
-
 struct mm_struct *mm_for_maps(struct task_struct *task)
 {
         return mm_access(task, PTRACE_MODE_READ);
@@ -711,6 +691,13 @@ static int mem_open(struct inode* inode, struct file* file)
         if (IS_ERR(mm))
                 return PTR_ERR(mm);
 
+        if (mm) {
+                /* ensure this mm_struct can't be freed */
+                atomic_inc(&mm->mm_count);
+                /* but do not pin its memory */
+                mmput(mm);
+        }
+
         /* OK to pass negative loff_t, we can catch out-of-range */
         file->f_mode |= FMODE_UNSIGNED_OFFSET;
         file->private_data = mm;
@@ -718,57 +705,13 @@ static int mem_open(struct inode* inode, struct file* file)
         return 0;
 }
 
-static ssize_t mem_read(struct file * file, char __user * buf,
-                        size_t count, loff_t *ppos)
+static ssize_t mem_rw(struct file *file, char __user *buf,
+                        size_t count, loff_t *ppos, int write)
 {
-        int ret;
-        char *page;
-        unsigned long src = *ppos;
         struct mm_struct *mm = file->private_data;
-
-        if (!mm)
-                return 0;
-
-        page = (char *)__get_free_page(GFP_TEMPORARY);
-        if (!page)
-                return -ENOMEM;
-
-        ret = 0;
- 
-        while (count > 0) {
-                int this_len, retval;
-
-                this_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
-                retval = access_remote_vm(mm, src, page, this_len, 0);
-                if (!retval) {
-                        if (!ret)
-                                ret = -EIO;
-                        break;
-                }
-
-                if (copy_to_user(buf, page, retval)) {
-                        ret = -EFAULT;
-                        break;
-                }
- 
-                ret += retval;
-                src += retval;
-                buf += retval;
-                count -= retval;
-        }
-        *ppos = src;
-
-        free_page((unsigned long) page);
-        return ret;
-}
-
-static ssize_t mem_write(struct file * file, const char __user *buf,
-                         size_t count, loff_t *ppos)
-{
-        int copied;
+        unsigned long addr = *ppos;
+        ssize_t copied;
         char *page;
-        unsigned long dst = *ppos;
-        struct mm_struct *mm = file->private_data;
 
         if (!mm)
                 return 0;
@@ -778,31 +721,54 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
                 return -ENOMEM;
 
         copied = 0;
+        if (!atomic_inc_not_zero(&mm->mm_users))
+                goto free;
+
         while (count > 0) {
-                int this_len, retval;
+                int this_len = min_t(int, count, PAGE_SIZE);
 
-                this_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
-                if (copy_from_user(page, buf, this_len)) {
+                if (write && copy_from_user(page, buf, this_len)) {
                         copied = -EFAULT;
                         break;
                 }
-                retval = access_remote_vm(mm, dst, page, this_len, 1);
-                if (!retval) {
+
+                this_len = access_remote_vm(mm, addr, page, this_len, write);
+                if (!this_len) {
                         if (!copied)
                                 copied = -EIO;
                         break;
                 }
-                copied += retval;
-                buf += retval;
-                dst += retval;
-                count -= retval;                        
+
+                if (!write && copy_to_user(buf, page, this_len)) {
+                        copied = -EFAULT;
+                        break;
+                }
+
+                buf += this_len;
+                addr += this_len;
+                copied += this_len;
+                count -= this_len;
         }
-        *ppos = dst;
+        *ppos = addr;
 
+        mmput(mm);
+free:
         free_page((unsigned long) page);
         return copied;
 }
 
+static ssize_t mem_read(struct file *file, char __user *buf,
+                        size_t count, loff_t *ppos)
+{
+        return mem_rw(file, buf, count, ppos, 0);
+}
+
+static ssize_t mem_write(struct file *file, const char __user *buf,
+                         size_t count, loff_t *ppos)
+{
+        return mem_rw(file, (char __user*)buf, count, ppos, 1);
+}
+
 loff_t mem_lseek(struct file *file, loff_t offset, int orig)
 {
         switch (orig) {
@@ -822,8 +788,8 @@ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
 static int mem_release(struct inode *inode, struct file *file)
 {
         struct mm_struct *mm = file->private_data;
-
-        mmput(mm);
+        if (mm)
+                mmdrop(mm);
         return 0;
 }