75 files changed, 907 insertions, 602 deletions
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 58e6cbce4156..08f2e1e9a7e6 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -603,10 +603,11 @@ static int v9fs_cache_register(void)
        if (ret < 0)
                return ret;
 #ifdef CONFIG_9P_FSCACHE
-        return fscache_register_netfs(&v9fs_cache_netfs);
+        ret = fscache_register_netfs(&v9fs_cache_netfs);
-#else
+        if (ret < 0)
-        return ret;
+                v9fs_destroy_inode_cache();
 #endif
+        return ret;
 }
 static void v9fs_cache_unregister(void)
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index 53687bbf2296..a7c481402c46 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -267,14 +267,8 @@ v9fs_vfs_atomic_open_dotl(struct inode *dir, struct dentry *dentry,
        }
        /* Only creates */
-        if (!(flags & O_CREAT))
+        if (!(flags & O_CREAT) || dentry->d_inode)
                return  finish_no_open(file, res);
-        else if (dentry->d_inode) {
-                if ((flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL))
-                        return -EEXIST;
-                else
-                        return finish_no_open(file, res);
-        }
        v9ses = v9fs_inode2v9ses(dir);
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index 646337dc5201..529300327f45 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -600,9 +600,6 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
        /* lock down the parent dentry so we can peer at it */
        parent = dget_parent(dentry);
-        if (!parent->d_inode)
-                goto out_bad;
        dir = AFS_FS_I(parent->d_inode);
        /* validate the parent directory */
diff --git a/fs/aio.c b/fs/aio.c
index 6b868f0e0c4c..067e3d340c35 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -167,10 +167,25 @@ static int __init aio_setup(void)
 }
 __initcall(aio_setup);
+static void put_aio_ring_file(struct kioctx *ctx)
+{
+        struct file *aio_ring_file = ctx->aio_ring_file;
+        if (aio_ring_file) {
+                truncate_setsize(aio_ring_file->f_inode, 0);
+                /* Prevent further access to the kioctx from migratepages */
+                spin_lock(&aio_ring_file->f_inode->i_mapping->private_lock);
+                aio_ring_file->f_inode->i_mapping->private_data = NULL;
+                ctx->aio_ring_file = NULL;
+                spin_unlock(&aio_ring_file->f_inode->i_mapping->private_lock);
+                fput(aio_ring_file);
+        }
+}
 static void aio_free_ring(struct kioctx *ctx)
 {
        int i;
-        struct file *aio_ring_file = ctx->aio_ring_file;
        for (i = 0; i < ctx->nr_pages; i++) {
                pr_debug("pid(%d) [%d] page->count=%d\n", current->pid, i,
@@ -178,14 +193,10 @@ static void aio_free_ring(struct kioctx *ctx)
                put_page(ctx->ring_pages[i]);
        }
+        put_aio_ring_file(ctx);
        if (ctx->ring_pages && ctx->ring_pages != ctx->internal_pages)
                kfree(ctx->ring_pages);
-        if (aio_ring_file) {
-                truncate_setsize(aio_ring_file->f_inode, 0);
-                fput(aio_ring_file);
-                ctx->aio_ring_file = NULL;
-        }
 }
 static int aio_ring_mmap(struct file *file, struct vm_area_struct *vma)
@@ -207,9 +218,8 @@ static int aio_set_page_dirty(struct page *page)
 static int aio_migratepage(struct address_space *mapping, struct page *new,
                        struct page *old, enum migrate_mode mode)
 {
-        struct kioctx *ctx = mapping->private_data;
+        struct kioctx *ctx;
        unsigned long flags;
-        unsigned idx = old->index;
        int rc;
        /* Writeback must be complete */
@@ -224,10 +234,23 @@ static int aio_migratepage(struct address_space *mapping, struct page *new,
        get_page(new);
-        spin_lock_irqsave(&ctx->completion_lock, flags);
+        /* We can potentially race against kioctx teardown here.  Use the
-        migrate_page_copy(new, old);
+         * address_space's private data lock to protect the mapping's
-        ctx->ring_pages[idx] = new;
+         * private_data.
-        spin_unlock_irqrestore(&ctx->completion_lock, flags);
+         */
+        spin_lock(&mapping->private_lock);
+        ctx = mapping->private_data;
+        if (ctx) {
+                pgoff_t idx;
+                spin_lock_irqsave(&ctx->completion_lock, flags);
+                migrate_page_copy(new, old);
+                idx = old->index;
+                if (idx < (pgoff_t)ctx->nr_pages)
+                        ctx->ring_pages[idx] = new;
+                spin_unlock_irqrestore(&ctx->completion_lock, flags);
+        } else
+                rc = -EBUSY;
+        spin_unlock(&mapping->private_lock);
        return rc;
 }
@@ -617,8 +640,7 @@ out_freepcpu:
 out_freeref:
        free_percpu(ctx->users.pcpu_count);
 out_freectx:
-        if (ctx->aio_ring_file)
+        put_aio_ring_file(ctx);
-                fput(ctx->aio_ring_file);
        kmem_cache_free(kioctx_cachep, ctx);
        pr_debug("error allocating ioctx %d\n", err);
        return ERR_PTR(err);
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 3db70dae40d3..689e40d983ad 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -109,13 +109,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
        pkt.hdr.proto_version = sbi->version;
        pkt.hdr.type = type;
-        mutex_lock(&sbi->wq_mutex);
-        /* Check if we have become catatonic */
-        if (sbi->catatonic) {
-                mutex_unlock(&sbi->wq_mutex);
-                return;
-        }
        switch (type) {
        /* Kernel protocol v4 missing and expire packets */
        case autofs_ptype_missing:
@@ -427,7 +421,6 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                wq->tgid = current->tgid;
                wq->status = -EINTR; /* Status return if interrupted */
                wq->wait_ctr = 2;
-                mutex_unlock(&sbi->wq_mutex);
                if (sbi->version < 5) {
                        if (notify == NFY_MOUNT)
@@ -449,15 +442,15 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                        (unsigned long) wq->wait_queue_token, wq->name.len,
                        wq->name.name, notify);
-                /* autofs4_notify_daemon() may block */
+                /* autofs4_notify_daemon() may block; it will unlock ->wq_mutex */
                autofs4_notify_daemon(sbi, wq, type);
        } else {
                wq->wait_ctr++;
-                mutex_unlock(&sbi->wq_mutex);
-                kfree(qstr.name);
                DPRINTK("existing wait id = 0x%08lx, name = %.*s, nfy=%d",
                        (unsigned long) wq->wait_queue_token, wq->name.len,
                        wq->name.name, notify);
+                mutex_unlock(&sbi->wq_mutex);
+                kfree(qstr.name);
        }
        /*
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 100edcc5e312..4c94a79991bb 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1413,7 +1413,7 @@ static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
 *   long file_ofs
 * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
 */
-static void fill_files_note(struct memelfnote *note)
+static int fill_files_note(struct memelfnote *note)
 {
        struct vm_area_struct *vma;
        unsigned count, size, names_ofs, remaining, n;
@@ -1428,11 +1428,11 @@ static void fill_files_note(struct memelfnote *note)
        names_ofs = (2 + 3 * count) * sizeof(data[0]);
 alloc:
        if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
-                goto err;
+                return -EINVAL;
        size = round_up(size, PAGE_SIZE);
        data = vmalloc(size);
        if (!data)
-                goto err;
+                return -ENOMEM;
        start_end_ofs = data + 2;
        name_base = name_curpos = ((char *)data) + names_ofs;
@@ -1485,7 +1485,7 @@ static void fill_files_note(struct memelfnote *note)
        size = name_curpos - (char *)data;
        fill_note(note, "CORE", NT_FILE, size, data);
- err: ;
+        return 0;
 }
 #ifdef CORE_DUMP_USE_REGSET
@@ -1686,8 +1686,8 @@ static int fill_note_info(struct elfhdr *elf, int phdrs,
        fill_auxv_note(&info->auxv, current->mm);
        info->size += notesize(&info->auxv);
-        fill_files_note(&info->files);
+        if (fill_files_note(&info->files) == 0)
-        info->size += notesize(&info->files);
+                info->size += notesize(&info->files);
        return 1;
 }
@@ -1719,7 +1719,8 @@ static int write_note_info(struct elf_note_info *info,
                        return 0;
                if (first && !writenote(&info->auxv, file, foffset))
                        return 0;
-                if (first && !writenote(&info->files, file, foffset))
+                if (first && info->files.data &&
+                                !writenote(&info->files, file, foffset))
                        return 0;
                for (i = 1; i < info->thread_notes; ++i)
@@ -1806,6 +1807,7 @@ static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
 struct elf_note_info {
        struct memelfnote *notes;
+        struct memelfnote *notes_files;
        struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
        struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
        struct list_head thread_list;
@@ -1896,9 +1898,12 @@ static int fill_note_info(struct elfhdr *elf, int phdrs,
        fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo);
        fill_auxv_note(info->notes + 3, current->mm);
-        fill_files_note(info->notes + 4);
+        info->numnote = 4;
-        info->numnote = 5;
+        if (fill_files_note(info->notes + info->numnote) == 0) {
+                info->notes_files = info->notes + info->numnote;
+                info->numnote++;
+        }
        /* Try to dump the FPU. */
        info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
@@ -1960,8 +1965,9 @@ static void free_note_info(struct elf_note_info *info)
                kfree(list_entry(tmp, struct elf_thread_status, list));
        }
-        /* Free data allocated by fill_files_note(): */
+        /* Free data possibly allocated by fill_files_note(): */
-        vfree(info->notes[4].data);
+        if (info->notes_files)
+                vfree(info->notes_files->data);
        kfree(info->prstatus);
        kfree(info->psinfo);
@@ -2044,7 +2050,7 @@ static int elf_core_dump(struct coredump_params *cprm)
        struct vm_area_struct *vma, *gate_vma;
        struct elfhdr *elf = NULL;
        loff_t offset = 0, dataoff, foffset;
-        struct elf_note_info info;
+        struct elf_note_info info = { };
        struct elf_phdr *phdr4note = NULL;
        struct elf_shdr *shdr4extnum = NULL;
        Elf_Half e_phnum;
diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 60250847929f..fc60b31453ee 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -735,7 +735,7 @@ void bioset_integrity_free(struct bio_set *bs)
                mempool_destroy(bs->bio_integrity_pool);
        if (bs->bvec_integrity_pool)
-                mempool_destroy(bs->bio_integrity_pool);
+                mempool_destroy(bs->bvec_integrity_pool);
 }
 EXPORT_SYMBOL(bioset_integrity_free);
diff --git a/fs/bio.c b/fs/bio.c
index b3b20ed9510e..ea5035da4d9a 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -917,8 +917,8 @@ void bio_copy_data(struct bio *dst, struct bio *src)
                src_p = kmap_atomic(src_bv->bv_page);
                dst_p = kmap_atomic(dst_bv->bv_page);
-                memcpy(dst_p + dst_bv->bv_offset,
+                memcpy(dst_p + dst_offset,
-                       src_p + src_bv->bv_offset,
+                       src_p + src_offset,
                       bytes);
                kunmap_atomic(dst_p);
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 58b7d14b08ee..08cc08f037a6 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -107,7 +107,8 @@ static void check_idle_worker(struct btrfs_worker_thread *worker)
                worker->idle = 1;
                /* the list may be empty if the worker is just starting */
-                if (!list_empty(&worker->worker_list)) {
+                if (!list_empty(&worker->worker_list) &&
+                    !worker->workers->stopping) {
                        list_move(&worker->worker_list,
                                 &worker->workers->idle_list);
                }
@@ -127,7 +128,8 @@ static void check_busy_worker(struct btrfs_worker_thread *worker)
                spin_lock_irqsave(&worker->workers->lock, flags);
                worker->idle = 0;
-                if (!list_empty(&worker->worker_list)) {
+                if (!list_empty(&worker->worker_list) &&
+                    !worker->workers->stopping) {
                        list_move_tail(&worker->worker_list,
                                      &worker->workers->worker_list);
                }
@@ -412,6 +414,7 @@ void btrfs_stop_workers(struct btrfs_workers *workers)
        int can_stop;
        spin_lock_irq(&workers->lock);
+        workers->stopping = 1;
        list_splice_init(&workers->idle_list, &workers->worker_list);
        while (!list_empty(&workers->worker_list)) {
                cur = workers->worker_list.next;
@@ -455,6 +458,7 @@ void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max,
        workers->ordered = 0;
        workers->atomic_start_pending = 0;
        workers->atomic_worker_start = async_helper;
+        workers->stopping = 0;
 }
 /*
@@ -480,15 +484,19 @@ static int __btrfs_start_workers(struct btrfs_workers *workers)
        atomic_set(&worker->num_pending, 0);
        atomic_set(&worker->refs, 1);
        worker->workers = workers;
-        worker->task = kthread_run(worker_loop, worker,
+        worker->task = kthread_create(worker_loop, worker,
-                                   "btrfs-%s-%d", workers->name,
+                                      "btrfs-%s-%d", workers->name,
-                                   workers->num_workers + 1);
+                                      workers->num_workers + 1);
        if (IS_ERR(worker->task)) {
                ret = PTR_ERR(worker->task);
-                kfree(worker);
                goto fail;
        }
        spin_lock_irq(&workers->lock);
+        if (workers->stopping) {
+                spin_unlock_irq(&workers->lock);
+                goto fail_kthread;
+        }
        list_add_tail(&worker->worker_list, &workers->idle_list);
        worker->idle = 1;
        workers->num_workers++;
@@ -496,8 +504,13 @@ static int __btrfs_start_workers(struct btrfs_workers *workers)
        WARN_ON(workers->num_workers_starting < 0);
        spin_unlock_irq(&workers->lock);
+        wake_up_process(worker->task);
        return 0;
+fail_kthread:
+        kthread_stop(worker->task);
 fail:
+        kfree(worker);
        spin_lock_irq(&workers->lock);
        workers->num_workers_starting--;
        spin_unlock_irq(&workers->lock);
diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h
index 063698b90ce2..1f26792683ed 100644
--- a/fs/btrfs/async-thread.h
+++ b/fs/btrfs/async-thread.h
@@ -107,6 +107,8 @@ struct btrfs_workers {
        /* extra name for this worker, used for current->name */
        char *name;
+        int stopping;
 };
 void btrfs_queue_worker(struct btrfs_workers *workers, struct btrfs_work *work);
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index d0ae226926ee..71f074e1870b 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -213,7 +213,10 @@ static inline bool btrfs_is_free_space_inode(struct inode *inode)
 static inline int btrfs_inode_in_log(struct inode *inode, u64 generation)
 {
        if (BTRFS_I(inode)->logged_trans == generation &&
-            BTRFS_I(inode)->last_sub_trans <= BTRFS_I(inode)->last_log_commit)
+            BTRFS_I(inode)->last_sub_trans <=
+            BTRFS_I(inode)->last_log_commit &&
+            BTRFS_I(inode)->last_sub_trans <=
+            BTRFS_I(inode)->root->last_log_commit)
                return 1;
        return 0;
 }
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 64346721173f..61b5bcd57b7e 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1005,8 +1005,11 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
                return ret;
        }
-        if (root->ref_cows)
+        if (root->ref_cows) {
-                btrfs_reloc_cow_block(trans, root, buf, cow);
+                ret = btrfs_reloc_cow_block(trans, root, buf, cow);
+                if (ret)
+                        return ret;
+        }
        if (buf == root->node) {
                WARN_ON(parent && parent != buf);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 3c1da6f98a4d..0506f40ede83 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1118,15 +1118,6 @@ struct btrfs_space_info {
         */
        struct percpu_counter total_bytes_pinned;
-        /*
-         * we bump reservation progress every time we decrement
-         * bytes_reserved.  This way people waiting for reservations
-         * know something good has happened and they can check
-         * for progress.  The number here isn't to be trusted, it
-         * just shows reclaim activity
-         */
-        unsigned long reservation_progress;
        unsigned int full:1;    /* indicates that we cannot allocate any more
                                   chunks for this space */
        unsigned int chunk_alloc:1;     /* set if we are allocating a chunk */
@@ -3135,7 +3126,7 @@ static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_root *root,
                                                 unsigned num_items)
 {
        return (root->leafsize + root->nodesize * (BTRFS_MAX_LEVEL - 1)) *
-                3 * num_items;
+                2 * num_items;
 }
 /*
@@ -3939,9 +3930,9 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans,
                            struct btrfs_root *root);
 int btrfs_recover_relocation(struct btrfs_root *root);
 int btrfs_reloc_clone_csums(struct inode *inode, u64 file_pos, u64 len);
-void btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,
+int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,
-                           struct btrfs_root *root, struct extent_buffer *buf,
+                          struct btrfs_root *root, struct extent_buffer *buf,
-                           struct extent_buffer *cow);
+                          struct extent_buffer *cow);
 void btrfs_reloc_pre_snapshot(struct btrfs_trans_handle *trans,
                              struct btrfs_pending_snapshot *pending,
                              u64 *bytes_to_reserve);
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index a64435359385..9efb94e95858 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -400,7 +400,7 @@ int btrfs_dev_replace_start(struct btrfs_root *root,
        args->result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NO_ERROR;
        btrfs_dev_replace_unlock(dev_replace);
-        btrfs_wait_all_ordered_extents(root->fs_info, 0);
+        btrfs_wait_all_ordered_extents(root->fs_info);
        /* force writing the updated state information to disk */
        trans = btrfs_start_transaction(root, 0);
@@ -475,7 +475,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
                mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
                return ret;
        }
-        btrfs_wait_all_ordered_extents(root->fs_info, 0);
+        btrfs_wait_all_ordered_extents(root->fs_info);
        trans = btrfs_start_transaction(root, 0);
        if (IS_ERR(trans)) {
@@ -535,10 +535,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
        list_add(&tgt_device->dev_alloc_list, &fs_info->fs_devices->alloc_list);
        btrfs_rm_dev_replace_srcdev(fs_info, src_device);
-        if (src_device->bdev) {
-                /* zero out the old super */
-                btrfs_scratch_superblock(src_device);
-        }
        /*
         * this is again a consistent state where no dev_replace procedure
         * is running, the target device is part of the filesystem, the
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 4cbb00af92ff..4ae17ed13b32 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -157,6 +157,7 @@ static struct btrfs_lockdep_keyset {
        { .id = BTRFS_TREE_LOG_OBJECTID,        .name_stem = "log"      },
        { .id = BTRFS_TREE_RELOC_OBJECTID,      .name_stem = "treloc"   },
        { .id = BTRFS_DATA_RELOC_TREE_OBJECTID, .name_stem = "dreloc"   },
+        { .id = BTRFS_UUID_TREE_OBJECTID,       .name_stem = "uuid"     },
        { .id = 0,                              .name_stem = "tree"     },
 };
@@ -3415,6 +3416,7 @@ static int write_all_supers(struct btrfs_root *root, int max_mirrors)
        if (total_errors > max_errors) {
                printk(KERN_ERR "btrfs: %d errors while writing supers\n",
                       total_errors);
+                mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
                /* FUA is masked off if unsupported and can't be the reason */
                btrfs_error(root->fs_info, -EIO,
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index cfb3cf711b34..d58bef130a41 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3925,7 +3925,6 @@ static int can_overcommit(struct btrfs_root *root,
        u64 space_size;
        u64 avail;
        u64 used;
-        u64 to_add;
        used = space_info->bytes_used + space_info->bytes_reserved +
                space_info->bytes_pinned + space_info->bytes_readonly;
@@ -3959,25 +3958,17 @@ static int can_overcommit(struct btrfs_root *root,
                       BTRFS_BLOCK_GROUP_RAID10))
                avail >>= 1;
-        to_add = space_info->total_bytes;
        /*
         * If we aren't flushing all things, let us overcommit up to
         * 1/2th of the space. If we can flush, don't let us overcommit
         * too much, let it overcommit up to 1/8 of the space.
         */
        if (flush == BTRFS_RESERVE_FLUSH_ALL)
-                to_add >>= 3;
+                avail >>= 3;
        else
-                to_add >>= 1;
+                avail >>= 1;
-        /*
-         * Limit the overcommit to the amount of free space we could possibly
-         * allocate for chunks.
-         */
-        to_add = min(avail, to_add);
-        if (used + bytes < space_info->total_bytes + to_add)
+        if (used + bytes < space_info->total_bytes + avail)
                return 1;
        return 0;
 }
@@ -4000,7 +3991,7 @@ static void btrfs_writeback_inodes_sb_nr(struct btrfs_root *root,
                 */
                btrfs_start_all_delalloc_inodes(root->fs_info, 0);
                if (!current->journal_info)
-                        btrfs_wait_all_ordered_extents(root->fs_info, 0);
+                        btrfs_wait_all_ordered_extents(root->fs_info);
        }
 }
@@ -4030,7 +4021,7 @@ static void shrink_delalloc(struct btrfs_root *root, u64 to_reclaim, u64 orig,
        if (delalloc_bytes == 0) {
                if (trans)
                        return;
-                btrfs_wait_all_ordered_extents(root->fs_info, 0);
+                btrfs_wait_all_ordered_extents(root->fs_info);
                return;
        }
@@ -4058,7 +4049,7 @@ static void shrink_delalloc(struct btrfs_root *root, u64 to_reclaim, u64 orig,
                loops++;
                if (wait_ordered && !trans) {
-                        btrfs_wait_all_ordered_extents(root->fs_info, 0);
+                        btrfs_wait_all_ordered_extents(root->fs_info);
                } else {
                        time_left = schedule_timeout_killable(1);
                        if (time_left)
@@ -4465,7 +4456,6 @@ static void block_rsv_release_bytes(struct btrfs_fs_info *fs_info,
                        space_info->bytes_may_use -= num_bytes;
                        trace_btrfs_space_reservation(fs_info, "space_info",
                                        space_info->flags, num_bytes, 0);
-                        space_info->reservation_progress++;
                        spin_unlock(&space_info->lock);
                }
        }
@@ -4666,7 +4656,6 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
                sinfo->bytes_may_use -= num_bytes;
                trace_btrfs_space_reservation(fs_info, "space_info",
                                      sinfo->flags, num_bytes, 0);
-                sinfo->reservation_progress++;
                block_rsv->reserved = block_rsv->size;
                block_rsv->full = 1;
        }
@@ -5446,7 +5435,6 @@ static int btrfs_update_reserved_bytes(struct btrfs_block_group_cache *cache,
                        space_info->bytes_readonly += num_bytes;
                cache->reserved -= num_bytes;
                space_info->bytes_reserved -= num_bytes;
-                space_info->reservation_progress++;
        }
        spin_unlock(&cache->lock);
        spin_unlock(&space_info->lock);
@@ -6117,10 +6105,13 @@ enum btrfs_loop_type {
 /*
 * walks the btree of allocated extents and find a hole of a given size.
 * The key ins is changed to record the hole:
- * ins->objectid == block start
+ * ins->objectid == start position
 * ins->flags = BTRFS_EXTENT_ITEM_KEY
- * ins->offset == number of blocks
+ * ins->offset == the size of the hole.
 * Any available blocks before search_start are skipped.
+ *
+ * If there is no suitable free space, we will record the max size of
+ * the free space extent currently.
 */
 static noinline int find_free_extent(struct btrfs_root *orig_root,
                                     u64 num_bytes, u64 empty_size,
@@ -6133,6 +6124,7 @@ static noinline int find_free_extent(struct btrfs_root *orig_root,
        struct btrfs_block_group_cache *block_group = NULL;
        struct btrfs_block_group_cache *used_block_group;
        u64 search_start = 0;
+        u64 max_extent_size = 0;
        int empty_cluster = 2 * 1024 * 1024;
        struct btrfs_space_info *space_info;
        int loop = 0;
@@ -6292,7 +6284,10 @@ have_block_group:
                                btrfs_get_block_group(used_block_group);
                        offset = btrfs_alloc_from_cluster(used_block_group,
-                          last_ptr, num_bytes, used_block_group->key.objectid);
+                                                last_ptr,
+                                                num_bytes,
+                                                used_block_group->key.objectid,
+                                                &max_extent_size);
                        if (offset) {
                                /* we have a block, we're done */
                                spin_unlock(&last_ptr->refill_lock);
@@ -6355,8 +6350,10 @@ refill_cluster:
                                 * cluster
                                 */
                                offset = btrfs_alloc_from_cluster(block_group,
-                                                  last_ptr, num_bytes,
+                                                        last_ptr,
-                                                  search_start);
+                                                        num_bytes,
+                                                        search_start,
+                                                        &max_extent_size);
                                if (offset) {
                                        /* we found one, proceed */
                                        spin_unlock(&last_ptr->refill_lock);
@@ -6391,13 +6388,18 @@ unclustered_alloc:
                if (cached &&
                    block_group->free_space_ctl->free_space <
                    num_bytes + empty_cluster + empty_size) {
+                        if (block_group->free_space_ctl->free_space >
+                            max_extent_size)
+                                max_extent_size =
+                                        block_group->free_space_ctl->free_space;
                        spin_unlock(&block_group->free_space_ctl->tree_lock);
                        goto loop;
                }
                spin_unlock(&block_group->free_space_ctl->tree_lock);
                offset = btrfs_find_space_for_alloc(block_group, search_start,
-                                                    num_bytes, empty_size);
+                                                    num_bytes, empty_size,
+                                                    &max_extent_size);
                /*
                 * If we didn't find a chunk, and we haven't failed on this
                 * block group before, and this block group is in the middle of
@@ -6515,7 +6517,8 @@ loop:
                ret = 0;
        }
 out:
+        if (ret == -ENOSPC)
+                ins->offset = max_extent_size;
        return ret;
 }
@@ -6573,8 +6576,8 @@ again:
                               flags);
        if (ret == -ENOSPC) {
-                if (!final_tried) {
+                if (!final_tried && ins->offset) {
-                        num_bytes = num_bytes >> 1;
+                        num_bytes = min(num_bytes >> 1, ins->offset);
                        num_bytes = round_down(num_bytes, root->sectorsize);
                        num_bytes = max(num_bytes, min_alloc_size);
                        if (num_bytes == min_alloc_size)
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 09582b81640c..22bda32acb89 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -145,8 +145,16 @@ int __init extent_io_init(void)
                                     offsetof(struct btrfs_io_bio, bio));
        if (!btrfs_bioset)
                goto free_buffer_cache;
+        if (bioset_integrity_create(btrfs_bioset, BIO_POOL_SIZE))
+                goto free_bioset;
        return 0;
+free_bioset:
+        bioset_free(btrfs_bioset);
+        btrfs_bioset = NULL;
 free_buffer_cache:
        kmem_cache_destroy(extent_buffer_cache);
        extent_buffer_cache = NULL;
@@ -1481,10 +1489,12 @@ static noinline u64 find_delalloc_range(struct extent_io_tree *tree,
                *end = state->end;
                cur_start = state->end + 1;
                node = rb_next(node);
-                if (!node)
-                        break;
                total_bytes += state->end - state->start + 1;
-                if (total_bytes >= max_bytes)
+                if (total_bytes >= max_bytes) {
+                        *end = *start + max_bytes - 1;
+                        break;
+                }
+                if (!node)
                        break;
        }
 out:
@@ -1612,7 +1622,7 @@ again:
                *start = delalloc_start;
                *end = delalloc_end;
                free_extent_state(cached_state);
-                return found;
+                return 0;
        }
        /*
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index bc5072b2db53..72da4df53c9a 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1859,8 +1859,8 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
        ret = btrfs_log_dentry_safe(trans, root, dentry);
        if (ret < 0) {
-                mutex_unlock(&inode->i_mutex);
+                /* Fallthrough and commit/free transaction. */
-                goto out;
+                ret = 1;
        }
        /* we've logged all the items and now have a consistent
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 3f0ddfce96e6..b4f9904c4c6b 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1431,13 +1431,19 @@ static void bitmap_set_bits(struct btrfs_free_space_ctl *ctl,
        ctl->free_space += bytes;
 }
+/*
+ * If we can not find suitable extent, we will use bytes to record
+ * the size of the max extent.
+ */
 static int search_bitmap(struct btrfs_free_space_ctl *ctl,
                         struct btrfs_free_space *bitmap_info, u64 *offset,
                         u64 *bytes)
 {
        unsigned long found_bits = 0;
+        unsigned long max_bits = 0;
        unsigned long bits, i;
        unsigned long next_zero;
+        unsigned long extent_bits;
        i = offset_to_bit(bitmap_info->offset, ctl->unit,
                          max_t(u64, *offset, bitmap_info->offset));
@@ -1446,9 +1452,12 @@ static int search_bitmap(struct btrfs_free_space_ctl *ctl,
        for_each_set_bit_from(i, bitmap_info->bitmap, BITS_PER_BITMAP) {
                next_zero = find_next_zero_bit(bitmap_info->bitmap,
                                               BITS_PER_BITMAP, i);
-                if ((next_zero - i) >= bits) {
+                extent_bits = next_zero - i;
-                        found_bits = next_zero - i;
+                if (extent_bits >= bits) {
+                        found_bits = extent_bits;
                        break;
+                } else if (extent_bits > max_bits) {
+                        max_bits = extent_bits;
                }
                i = next_zero;
        }
@@ -1459,38 +1468,41 @@ static int search_bitmap(struct btrfs_free_space_ctl *ctl,
                return 0;
        }
+        *bytes = (u64)(max_bits) * ctl->unit;
        return -1;
 }
+/* Cache the size of the max extent in bytes */
 static struct btrfs_free_space *
 find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
-                unsigned long align)
+                unsigned long align, u64 *max_extent_size)
 {
        struct btrfs_free_space *entry;
        struct rb_node *node;
-        u64 ctl_off;
        u64 tmp;
        u64 align_off;
        int ret;
        if (!ctl->free_space_offset.rb_node)
-                return NULL;
+                goto out;
        entry = tree_search_offset(ctl, offset_to_bitmap(ctl, *offset), 0, 1);
        if (!entry)
-                return NULL;
+                goto out;
        for (node = &entry->offset_index; node; node = rb_next(node)) {
                entry = rb_entry(node, struct btrfs_free_space, offset_index);
-                if (entry->bytes < *bytes)
+                if (entry->bytes < *bytes) {
+                        if (entry->bytes > *max_extent_size)
+                                *max_extent_size = entry->bytes;
                        continue;
+                }
                /* make sure the space returned is big enough
                 * to match our requested alignment
                 */
                if (*bytes >= align) {
-                        ctl_off = entry->offset - ctl->start;
+                        tmp = entry->offset - ctl->start + align - 1;
-                        tmp = ctl_off + align - 1;;
                        do_div(tmp, align);
                        tmp = tmp * align + ctl->start;
                        align_off = tmp - entry->offset;
@@ -1499,14 +1511,22 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
                        tmp = entry->offset;
                }
-                if (entry->bytes < *bytes + align_off)
+                if (entry->bytes < *bytes + align_off) {
+                        if (entry->bytes > *max_extent_size)
+                                *max_extent_size = entry->bytes;
                        continue;
+                }
                if (entry->bitmap) {
-                        ret = search_bitmap(ctl, entry, &tmp, bytes);
+                        u64 size = *bytes;
+                        ret = search_bitmap(ctl, entry, &tmp, &size);
                        if (!ret) {
                                *offset = tmp;
+                                *bytes = size;
                                return entry;
+                        } else if (size > *max_extent_size) {
+                                *max_extent_size = size;
                        }
                        continue;
                }
@@ -1515,7 +1535,7 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
                *bytes = entry->bytes - align_off;
                return entry;
        }
+out:
        return NULL;
 }
@@ -2116,7 +2136,8 @@ void btrfs_remove_free_space_cache(struct btrfs_block_group_cache *block_group)
 }
 u64 btrfs_find_space_for_alloc(struct btrfs_block_group_cache *block_group,
-                               u64 offset, u64 bytes, u64 empty_size)
+                               u64 offset, u64 bytes, u64 empty_size,
+                               u64 *max_extent_size)
 {
        struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
        struct btrfs_free_space *entry = NULL;
@@ -2127,7 +2148,7 @@ u64 btrfs_find_space_for_alloc(struct btrfs_block_group_cache *block_group,
        spin_lock(&ctl->tree_lock);
        entry = find_free_space(ctl, &offset, &bytes_search,
-                                block_group->full_stripe_len);
+                                block_group->full_stripe_len, max_extent_size);
        if (!entry)
                goto out;
@@ -2137,7 +2158,6 @@ u64 btrfs_find_space_for_alloc(struct btrfs_block_group_cache *block_group,
                if (!entry->bytes)
                        free_bitmap(ctl, entry);
        } else {
                unlink_free_space(ctl, entry);
                align_gap_len = offset - entry->offset;
                align_gap = entry->offset;
@@ -2151,7 +2171,6 @@ u64 btrfs_find_space_for_alloc(struct btrfs_block_group_cache *block_group,
                else
                        link_free_space(ctl, entry);
        }
 out:
        spin_unlock(&ctl->tree_lock);
@@ -2206,7 +2225,8 @@ int btrfs_return_cluster_to_free_space(
 static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
                                   struct btrfs_free_cluster *cluster,
                                   struct btrfs_free_space *entry,
-                                   u64 bytes, u64 min_start)
+                                   u64 bytes, u64 min_start,
+                                   u64 *max_extent_size)
 {
        struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
        int err;
@@ -2218,8 +2238,11 @@ static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
        search_bytes = bytes;
        err = search_bitmap(ctl, entry, &search_start, &search_bytes);
-        if (err)
+        if (err) {
+                if (search_bytes > *max_extent_size)
+                        *max_extent_size = search_bytes;
                return 0;
+        }
        ret = search_start;
        __bitmap_clear_bits(ctl, entry, ret, bytes);
@@ -2234,7 +2257,7 @@ static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
 */
 u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
                             struct btrfs_free_cluster *cluster, u64 bytes,
-                             u64 min_start)
+                             u64 min_start, u64 *max_extent_size)
 {
        struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
        struct btrfs_free_space *entry = NULL;
@@ -2254,6 +2277,9 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
        entry = rb_entry(node, struct btrfs_free_space, offset_index);
        while(1) {
+                if (entry->bytes < bytes && entry->bytes > *max_extent_size)
+                        *max_extent_size = entry->bytes;
                if (entry->bytes < bytes ||
                    (!entry->bitmap && entry->offset < min_start)) {
                        node = rb_next(&entry->offset_index);
@@ -2267,7 +2293,8 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
                if (entry->bitmap) {
                        ret = btrfs_alloc_from_bitmap(block_group,
                                                      cluster, entry, bytes,
-                                                      cluster->window_start);
+                                                      cluster->window_start,
+                                                      max_extent_size);
                        if (ret == 0) {
                                node = rb_next(&entry->offset_index);
                                if (!node)
diff --git a/fs/btrfs/free-space-cache.h b/fs/btrfs/free-space-cache.h
index c74904167476..e737f92cf6d0 100644
--- a/fs/btrfs/free-space-cache.h
+++ b/fs/btrfs/free-space-cache.h
@@ -94,7 +94,8 @@ void __btrfs_remove_free_space_cache(struct btrfs_free_space_ctl *ctl);
 void btrfs_remove_free_space_cache(struct btrfs_block_group_cache
                                     *block_group);
 u64 btrfs_find_space_for_alloc(struct btrfs_block_group_cache *block_group,
-                               u64 offset, u64 bytes, u64 empty_size);
+                               u64 offset, u64 bytes, u64 empty_size,
+                               u64 *max_extent_size);
 u64 btrfs_find_ino_for_alloc(struct btrfs_root *fs_root);
 void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
                           u64 bytes);
@@ -105,7 +106,7 @@ int btrfs_find_space_cluster(struct btrfs_root *root,
 void btrfs_init_free_cluster(struct btrfs_free_cluster *cluster);
 u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
                             struct btrfs_free_cluster *cluster, u64 bytes,
-                             u64 min_start);
+                             u64 min_start, u64 *max_extent_size);
 int btrfs_return_cluster_to_free_space(
                               struct btrfs_block_group_cache *block_group,
                               struct btrfs_free_cluster *cluster);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index f338c5672d58..22ebc13b6c99 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4688,11 +4688,11 @@ static void inode_tree_add(struct inode *inode)
        struct btrfs_inode *entry;
        struct rb_node **p;
        struct rb_node *parent;
+        struct rb_node *new = &BTRFS_I(inode)->rb_node;
        u64 ino = btrfs_ino(inode);
        if (inode_unhashed(inode))
                return;
-again:
        parent = NULL;
        spin_lock(&root->inode_lock);
        p = &root->inode_tree.rb_node;
@@ -4707,14 +4707,14 @@ again:
                else {
                        WARN_ON(!(entry->vfs_inode.i_state &
                                  (I_WILL_FREE | I_FREEING)));
-                        rb_erase(parent, &root->inode_tree);
+                        rb_replace_node(parent, new, &root->inode_tree);
                        RB_CLEAR_NODE(parent);
                        spin_unlock(&root->inode_lock);
-                        goto again;
+                        return;
                }
        }
-        rb_link_node(&BTRFS_I(inode)->rb_node, parent, p);
+        rb_link_node(new, parent, p);
-        rb_insert_color(&BTRFS_I(inode)->rb_node, &root->inode_tree);
+        rb_insert_color(new, &root->inode_tree);
        spin_unlock(&root->inode_lock);
 }
@@ -8216,6 +8216,10 @@ static int __start_delalloc_inodes(struct btrfs_root *root, int delay_iput)
                work = btrfs_alloc_delalloc_work(inode, 0, delay_iput);
                if (unlikely(!work)) {
+                        if (delay_iput)
+                                btrfs_add_delayed_iput(inode);
+                        else
+                                iput(inode);
                        ret = -ENOMEM;
                        goto out;
                }
@@ -8613,11 +8617,13 @@ static const struct inode_operations btrfs_dir_inode_operations = {
        .removexattr    = btrfs_removexattr,
        .permission     = btrfs_permission,
        .get_acl        = btrfs_get_acl,
+        .update_time    = btrfs_update_time,
 };
 static const struct inode_operations btrfs_dir_ro_inode_operations = {
        .lookup         = btrfs_lookup,
        .permission     = btrfs_permission,
        .get_acl        = btrfs_get_acl,
+        .update_time    = btrfs_update_time,
 };
 static const struct file_operations btrfs_dir_file_operations = {
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 1a5b9462dd9a..9d46f60cb943 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -574,7 +574,7 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
        if (ret)
                return ret;
-        btrfs_wait_ordered_extents(root, 0);
+        btrfs_wait_ordered_extents(root);
        pending_snapshot = kzalloc(sizeof(*pending_snapshot), GFP_NOFS);
        if (!pending_snapshot)
@@ -2696,9 +2696,9 @@ out_unlock:
 static long btrfs_ioctl_file_extent_same(struct file *file,
                                         void __user *argp)
 {
-        struct btrfs_ioctl_same_args *args = argp;
+        struct btrfs_ioctl_same_args tmp;
-        struct btrfs_ioctl_same_args same;
+        struct btrfs_ioctl_same_args *same;
-        struct btrfs_ioctl_same_extent_info info;
+        struct btrfs_ioctl_same_extent_info *info;
        struct inode *src = file->f_dentry->d_inode;
        struct file *dst_file = NULL;
        struct inode *dst;
@@ -2706,6 +2706,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
        u64 len;
        int i;
        int ret;
+        unsigned long size;
        u64 bs = BTRFS_I(src)->root->fs_info->sb->s_blocksize;
        bool is_admin = capable(CAP_SYS_ADMIN);
@@ -2716,15 +2717,30 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
        if (ret)
                return ret;
-        if (copy_from_user(&same,
+        if (copy_from_user(&tmp,
                           (struct btrfs_ioctl_same_args __user *)argp,
-                           sizeof(same))) {
+                           sizeof(tmp))) {
                ret = -EFAULT;
                goto out;
        }
-        off = same.logical_offset;
+        size = sizeof(tmp) +
-        len = same.length;
+                tmp.dest_count * sizeof(struct btrfs_ioctl_same_extent_info);
+        same = kmalloc(size, GFP_NOFS);
+        if (!same) {
+                ret = -EFAULT;
+                goto out;
+        }
+        if (copy_from_user(same,
+                           (struct btrfs_ioctl_same_args __user *)argp, size)) {
+                ret = -EFAULT;
+                goto out;
+        }
+        off = same->logical_offset;
+        len = same->length;
        /*
         * Limit the total length we will dedupe for each operation.
@@ -2752,27 +2768,28 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
        if (!S_ISREG(src->i_mode))
                goto out;
-        ret = 0;
+        /* pre-format output fields to sane values */
-        for (i = 0; i < same.dest_count; i++) {
+        for (i = 0; i < same->dest_count; i++) {
-                if (copy_from_user(&info, &args->info[i], sizeof(info))) {
+                same->info[i].bytes_deduped = 0ULL;
-                        ret = -EFAULT;
+                same->info[i].status = 0;
-                        goto out;
+        }
-                }
-                info.bytes_deduped = 0;
+        ret = 0;
+        for (i = 0; i < same->dest_count; i++) {
+                info = &same->info[i];
-                dst_file = fget(info.fd);
+                dst_file = fget(info->fd);
                if (!dst_file) {
-                        info.status = -EBADF;
+                        info->status = -EBADF;
                        goto next;
                }
                if (!(is_admin || (dst_file->f_mode & FMODE_WRITE))) {
-                        info.status = -EINVAL;
+                        info->status = -EINVAL;
                        goto next;
                }
-                info.status = -EXDEV;
+                info->status = -EXDEV;
                if (file->f_path.mnt != dst_file->f_path.mnt)
                        goto next;
@@ -2781,32 +2798,29 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
                        goto next;
                if (S_ISDIR(dst->i_mode)) {
-                        info.status = -EISDIR;
+                        info->status = -EISDIR;
                        goto next;
                }
                if (!S_ISREG(dst->i_mode)) {
-                        info.status = -EACCES;
+                        info->status = -EACCES;
                        goto next;
                }
-                info.status = btrfs_extent_same(src, off, len, dst,
+                info->status = btrfs_extent_same(src, off, len, dst,
-                                                info.logical_offset);
+                                                info->logical_offset);
-                if (info.status == 0)
+                if (info->status == 0)
-                        info.bytes_deduped += len;
+                        info->bytes_deduped += len;
 next:
                if (dst_file)
                        fput(dst_file);
-                if (__put_user_unaligned(info.status, &args->info[i].status) ||
-                    __put_user_unaligned(info.bytes_deduped,
-                                         &args->info[i].bytes_deduped)) {
-                        ret = -EFAULT;
-                        goto out;
-                }                                                               
        }
+        ret = copy_to_user(argp, same, size);
+        if (ret)
+                ret = -EFAULT;
 out:
        mnt_drop_write_file(file);
        return ret;
@@ -3310,7 +3324,7 @@ static long btrfs_ioctl_default_subvol(struct file *file, void __user *argp)
        }
        if (!objectid)
-                objectid = root->root_key.objectid;
+                objectid = BTRFS_FS_TREE_OBJECTID;
        location.objectid = objectid;
        location.type = BTRFS_ROOT_ITEM_KEY;
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 966b413a33b8..c702cb62f78a 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -563,11 +563,10 @@ static void btrfs_run_ordered_extent_work(struct btrfs_work *work)
 * wait for all the ordered extents in a root.  This is done when balancing
 * space between drives.
 */
-void btrfs_wait_ordered_extents(struct btrfs_root *root, int delay_iput)
+void btrfs_wait_ordered_extents(struct btrfs_root *root)
 {
        struct list_head splice, works;
        struct btrfs_ordered_extent *ordered, *next;
-        struct inode *inode;
        INIT_LIST_HEAD(&splice);
        INIT_LIST_HEAD(&works);
@@ -580,15 +579,6 @@ void btrfs_wait_ordered_extents(struct btrfs_root *root, int delay_iput)
                                           root_extent_list);
                list_move_tail(&ordered->root_extent_list,
                               &root->ordered_extents);
-                /*
-                 * the inode may be getting freed (in sys_unlink path).
-                 */
-                inode = igrab(ordered->inode);
-                if (!inode) {
-                        cond_resched_lock(&root->ordered_extent_lock);
-                        continue;
-                }
                atomic_inc(&ordered->refs);
                spin_unlock(&root->ordered_extent_lock);
@@ -605,21 +595,13 @@ void btrfs_wait_ordered_extents(struct btrfs_root *root, int delay_iput)
        list_for_each_entry_safe(ordered, next, &works, work_list) {
                list_del_init(&ordered->work_list);
                wait_for_completion(&ordered->completion);
-                inode = ordered->inode;
                btrfs_put_ordered_extent(ordered);
-                if (delay_iput)
-                        btrfs_add_delayed_iput(inode);
-                else
-                        iput(inode);
                cond_resched();
        }
        mutex_unlock(&root->fs_info->ordered_operations_mutex);
 }
-void btrfs_wait_all_ordered_extents(struct btrfs_fs_info *fs_info,
+void btrfs_wait_all_ordered_extents(struct btrfs_fs_info *fs_info)
-                                    int delay_iput)
 {
        struct btrfs_root *root;
        struct list_head splice;
@@ -637,7 +619,7 @@ void btrfs_wait_all_ordered_extents(struct btrfs_fs_info *fs_info,
                               &fs_info->ordered_roots);
                spin_unlock(&fs_info->ordered_root_lock);
-                btrfs_wait_ordered_extents(root, delay_iput);
+                btrfs_wait_ordered_extents(root);
                btrfs_put_fs_root(root);
                spin_lock(&fs_info->ordered_root_lock);
diff --git a/fs/btrfs/ordered-data.h b/fs/btrfs/ordered-data.h
index d9a5aa097b4f..0c0b35612d7a 100644
--- a/fs/btrfs/ordered-data.h
+++ b/fs/btrfs/ordered-data.h
@@ -195,9 +195,8 @@ int btrfs_run_ordered_operations(struct btrfs_trans_handle *trans,
 void btrfs_add_ordered_operation(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
                                 struct inode *inode);
-void btrfs_wait_ordered_extents(struct btrfs_root *root, int delay_iput);
+void btrfs_wait_ordered_extents(struct btrfs_root *root);
-void btrfs_wait_all_ordered_extents(struct btrfs_fs_info *fs_info,
+void btrfs_wait_all_ordered_extents(struct btrfs_fs_info *fs_info);
-                                    int delay_iput);
 void btrfs_get_logged_extents(struct btrfs_root *log, struct inode *inode);
 void btrfs_wait_logged_extents(struct btrfs_root *log, u64 transid);
 void btrfs_free_logged_extents(struct btrfs_root *log, u64 transid);
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index aacc2121e87c..a5a26320503f 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1548,7 +1548,7 @@ static int get_new_location(struct inode *reloc_inode, u64 *new_bytenr,
               btrfs_file_extent_other_encoding(leaf, fi));
        if (num_bytes != btrfs_file_extent_disk_num_bytes(leaf, fi)) {
-                ret = 1;
+                ret = -EINVAL;
                goto out;
        }
@@ -1579,7 +1579,7 @@ int replace_file_extents(struct btrfs_trans_handle *trans,
        u64 end;
        u32 nritems;
        u32 i;
-        int ret;
+        int ret = 0;
        int first = 1;
        int dirty = 0;
@@ -1642,11 +1642,13 @@ int replace_file_extents(struct btrfs_trans_handle *trans,
                ret = get_new_location(rc->data_inode, &new_bytenr,
                                       bytenr, num_bytes);
-                if (ret > 0) {
+                if (ret) {
-                        WARN_ON(1);
+                        /*
-                        continue;
+                         * Don't have to abort since we've not changed anything
+                         * in the file extent yet.
+                         */
+                        break;
                }
-                BUG_ON(ret < 0);
                btrfs_set_file_extent_disk_bytenr(leaf, fi, new_bytenr);
                dirty = 1;
@@ -1656,18 +1658,24 @@ int replace_file_extents(struct btrfs_trans_handle *trans,
                                           num_bytes, parent,
                                           btrfs_header_owner(leaf),
                                           key.objectid, key.offset, 1);
-                BUG_ON(ret);
+                if (ret) {
+                        btrfs_abort_transaction(trans, root, ret);
+                        break;
+                }
                ret = btrfs_free_extent(trans, root, bytenr, num_bytes,
                                        parent, btrfs_header_owner(leaf),
                                        key.objectid, key.offset, 1);
-                BUG_ON(ret);
+                if (ret) {
+                        btrfs_abort_transaction(trans, root, ret);
+                        break;
+                }
        }
        if (dirty)
                btrfs_mark_buffer_dirty(leaf);
        if (inode)
                btrfs_add_delayed_iput(inode);
-        return 0;
+        return ret;
 }
 static noinline_for_stack
@@ -4238,7 +4246,7 @@ int btrfs_relocate_block_group(struct btrfs_root *extent_root, u64 group_start)
                err = ret;
                goto out;
        }
-        btrfs_wait_all_ordered_extents(fs_info, 0);
+        btrfs_wait_all_ordered_extents(fs_info);
        while (1) {
                mutex_lock(&fs_info->cleaner_mutex);
@@ -4499,19 +4507,19 @@ out:
        return ret;
 }
-void btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,
+int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,
-                           struct btrfs_root *root, struct extent_buffer *buf,
+                          struct btrfs_root *root, struct extent_buffer *buf,
-                           struct extent_buffer *cow)
+                          struct extent_buffer *cow)
 {
        struct reloc_control *rc;
        struct backref_node *node;
        int first_cow = 0;
        int level;
-        int ret;
+        int ret = 0;
        rc = root->fs_info->reloc_ctl;
        if (!rc)
-                return;
+                return 0;
        BUG_ON(rc->stage == UPDATE_DATA_PTRS &&
               root->root_key.objectid == BTRFS_DATA_RELOC_TREE_OBJECTID);
@@ -4547,10 +4555,9 @@ void btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,
                        rc->nodes_relocated += buf->len;
        }
-        if (level == 0 && first_cow && rc->stage == UPDATE_DATA_PTRS) {
+        if (level == 0 && first_cow && rc->stage == UPDATE_DATA_PTRS)
                ret = replace_file_extents(trans, rc, root, cow);
-                BUG_ON(ret);
+        return ret;
-        }
 }
 /*
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 0afcd452fcb3..a18e0e23f6a6 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -158,12 +158,20 @@ struct scrub_fixup_nodatasum {
        int                     mirror_num;
 };
+struct scrub_nocow_inode {
+        u64                     inum;
+        u64                     offset;
+        u64                     root;
+        struct list_head        list;
+};
 struct scrub_copy_nocow_ctx {
        struct scrub_ctx        *sctx;
        u64                     logical;
        u64                     len;
        int                     mirror_num;
        u64                     physical_for_dev_replace;
+        struct list_head        inodes;
        struct btrfs_work       work;
 };
@@ -245,7 +253,7 @@ static void scrub_wr_bio_end_io_worker(struct btrfs_work *work);
 static int write_page_nocow(struct scrub_ctx *sctx,
                            u64 physical_for_dev_replace, struct page *page);
 static int copy_nocow_pages_for_inode(u64 inum, u64 offset, u64 root,
-                                      void *ctx);
+                                      struct scrub_copy_nocow_ctx *ctx);
 static int copy_nocow_pages(struct scrub_ctx *sctx, u64 logical, u64 len,
                            int mirror_num, u64 physical_for_dev_replace);
 static void copy_nocow_pages_worker(struct btrfs_work *work);
@@ -3126,12 +3134,30 @@ static int copy_nocow_pages(struct scrub_ctx *sctx, u64 logical, u64 len,
        nocow_ctx->mirror_num = mirror_num;
        nocow_ctx->physical_for_dev_replace = physical_for_dev_replace;
        nocow_ctx->work.func = copy_nocow_pages_worker;
+        INIT_LIST_HEAD(&nocow_ctx->inodes);
        btrfs_queue_worker(&fs_info->scrub_nocow_workers,
                           &nocow_ctx->work);
        return 0;
 }
+static int record_inode_for_nocow(u64 inum, u64 offset, u64 root, void *ctx)
+{
+        struct scrub_copy_nocow_ctx *nocow_ctx = ctx;
+        struct scrub_nocow_inode *nocow_inode;
+        nocow_inode = kzalloc(sizeof(*nocow_inode), GFP_NOFS);
+        if (!nocow_inode)
+                return -ENOMEM;
+        nocow_inode->inum = inum;
+        nocow_inode->offset = offset;
+        nocow_inode->root = root;
+        list_add_tail(&nocow_inode->list, &nocow_ctx->inodes);
+        return 0;
+}
+#define COPY_COMPLETE 1
 static void copy_nocow_pages_worker(struct btrfs_work *work)
 {
        struct scrub_copy_nocow_ctx *nocow_ctx =
@@ -3167,8 +3193,7 @@ static void copy_nocow_pages_worker(struct btrfs_work *work)
        }
        ret = iterate_inodes_from_logical(logical, fs_info, path,
-                                          copy_nocow_pages_for_inode,
+                                          record_inode_for_nocow, nocow_ctx);
-                                          nocow_ctx);
        if (ret != 0 && ret != -ENOENT) {
                pr_warn("iterate_inodes_from_logical() failed: log %llu, phys %llu, len %llu, mir %u, ret %d\n",
                        logical, physical_for_dev_replace, len, mirror_num,
@@ -3177,7 +3202,33 @@ static void copy_nocow_pages_worker(struct btrfs_work *work)
                goto out;
        }
+        btrfs_end_transaction(trans, root);
+        trans = NULL;
+        while (!list_empty(&nocow_ctx->inodes)) {
+                struct scrub_nocow_inode *entry;
+                entry = list_first_entry(&nocow_ctx->inodes,
+                                         struct scrub_nocow_inode,
+                                         list);
+                list_del_init(&entry->list);
+                ret = copy_nocow_pages_for_inode(entry->inum, entry->offset,
+                                                 entry->root, nocow_ctx);
+                kfree(entry);
+                if (ret == COPY_COMPLETE) {
+                        ret = 0;
+                        break;
+                } else if (ret) {
+                        break;
+                }
+        }
 out:
+        while (!list_empty(&nocow_ctx->inodes)) {
+                struct scrub_nocow_inode *entry;
+                entry = list_first_entry(&nocow_ctx->inodes,
+                                         struct scrub_nocow_inode,
+                                         list);
+                list_del_init(&entry->list);
+                kfree(entry);
+        }
        if (trans && !IS_ERR(trans))
                btrfs_end_transaction(trans, root);
        if (not_written)
@@ -3190,20 +3241,25 @@ out:
        scrub_pending_trans_workers_dec(sctx);
 }
-static int copy_nocow_pages_for_inode(u64 inum, u64 offset, u64 root, void *ctx)
+static int copy_nocow_pages_for_inode(u64 inum, u64 offset, u64 root,
+                                      struct scrub_copy_nocow_ctx *nocow_ctx)
 {
-        struct scrub_copy_nocow_ctx *nocow_ctx = ctx;
        struct btrfs_fs_info *fs_info = nocow_ctx->sctx->dev_root->fs_info;
        struct btrfs_key key;
        struct inode *inode;
        struct page *page;
        struct btrfs_root *local_root;
+        struct btrfs_ordered_extent *ordered;
+        struct extent_map *em;
+        struct extent_state *cached_state = NULL;
+        struct extent_io_tree *io_tree;
        u64 physical_for_dev_replace;
-        u64 len;
+        u64 len = nocow_ctx->len;
+        u64 lockstart = offset, lockend = offset + len - 1;
        unsigned long index;
        int srcu_index;
-        int ret;
+        int ret = 0;
-        int err;
+        int err = 0;
        key.objectid = root;
        key.type = BTRFS_ROOT_ITEM_KEY;
@@ -3229,9 +3285,33 @@ static int copy_nocow_pages_for_inode(u64 inum, u64 offset, u64 root, void *ctx)
        mutex_lock(&inode->i_mutex);
        inode_dio_wait(inode);
-        ret = 0;
        physical_for_dev_replace = nocow_ctx->physical_for_dev_replace;
-        len = nocow_ctx->len;
+        io_tree = &BTRFS_I(inode)->io_tree;
+        lock_extent_bits(io_tree, lockstart, lockend, 0, &cached_state);
+        ordered = btrfs_lookup_ordered_range(inode, lockstart, len);
+        if (ordered) {
+                btrfs_put_ordered_extent(ordered);
+                goto out_unlock;
+        }
+        em = btrfs_get_extent(inode, NULL, 0, lockstart, len, 0);
+        if (IS_ERR(em)) {
+                ret = PTR_ERR(em);
+                goto out_unlock;
+        }
+        /*
+         * This extent does not actually cover the logical extent anymore,
+         * move on to the next inode.
+         */
+        if (em->block_start > nocow_ctx->logical ||
+            em->block_start + em->block_len < nocow_ctx->logical + len) {
+                free_extent_map(em);
+                goto out_unlock;
+        }
+        free_extent_map(em);
        while (len >= PAGE_CACHE_SIZE) {
                index = offset >> PAGE_CACHE_SHIFT;
 again:
@@ -3247,10 +3327,9 @@ again:
                                goto next_page;
                } else {
                        ClearPageError(page);
-                        err = extent_read_full_page(&BTRFS_I(inode)->
+                        err = extent_read_full_page_nolock(io_tree, page,
-                                                         io_tree,
+                                                           btrfs_get_extent,
-                                                        page, btrfs_get_extent,
+                                                           nocow_ctx->mirror_num);
-                                                        nocow_ctx->mirror_num);
                        if (err) {
                                ret = err;
                                goto next_page;
@@ -3264,6 +3343,7 @@ again:
                         * page in the page cache.
                         */
                        if (page->mapping != inode->i_mapping) {
+                                unlock_page(page);
                                page_cache_release(page);
                                goto again;
                        }
@@ -3287,6 +3367,10 @@ next_page:
                physical_for_dev_replace += PAGE_CACHE_SIZE;
                len -= PAGE_CACHE_SIZE;
        }
+        ret = COPY_COMPLETE;
+out_unlock:
+        unlock_extent_cached(io_tree, lockstart, lockend, &cached_state,
+                             GFP_NOFS);
 out:
        mutex_unlock(&inode->i_mutex);
        iput(inode);
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 3aab10ce63e8..e913328d0f2a 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -921,7 +921,7 @@ int btrfs_sync_fs(struct super_block *sb, int wait)
                return 0;
        }
-        btrfs_wait_all_ordered_extents(fs_info, 1);
+        btrfs_wait_all_ordered_extents(fs_info);
        trans = btrfs_attach_transaction_barrier(root);
        if (IS_ERR(trans)) {
@@ -1340,6 +1340,12 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
                if (ret)
                        goto restore;
        } else {
+                if (test_bit(BTRFS_FS_STATE_ERROR, &root->fs_info->fs_state)) {
+                        btrfs_err(fs_info,
+                                "Remounting read-write after error is not allowed\n");
+                        ret = -EINVAL;
+                        goto restore;
+                }
                if (fs_info->fs_devices->rw_devices == 0) {
                        ret = -EACCES;
                        goto restore;
@@ -1377,6 +1383,16 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
                        pr_warn("btrfs: failed to resume dev_replace\n");
                        goto restore;
                }
+                if (!fs_info->uuid_root) {
+                        pr_info("btrfs: creating UUID tree\n");
+                        ret = btrfs_create_uuid_tree(fs_info);
+                        if (ret) {
+                                pr_warn("btrfs: failed to create the uuid tree"
+                                        "%d\n", ret);
+                                goto restore;
+                        }
+                }
                sb->s_flags &= ~MS_RDONLY;
        }
 out:
@@ -1762,6 +1778,9 @@ static void btrfs_print_info(void)
 #ifdef CONFIG_BTRFS_DEBUG
                        ", debug=on"
 #endif
+#ifdef CONFIG_BTRFS_ASSERT
+                        ", assert=on"
+#endif
 #ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
                        ", integrity-checker=on"
 #endif
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index cac4a3f76323..8c81bdc1ef9b 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1603,7 +1603,7 @@ static inline int btrfs_start_delalloc_flush(struct btrfs_fs_info *fs_info)
 static inline void btrfs_wait_delalloc_flush(struct btrfs_fs_info *fs_info)
 {
        if (btrfs_test_opt(fs_info->tree_root, FLUSHONCOMMIT))
-                btrfs_wait_all_ordered_extents(fs_info, 1);
+                btrfs_wait_all_ordered_extents(fs_info);
 }
 int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
@@ -1838,11 +1838,8 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
        assert_qgroups_uptodate(trans);
        update_super_roots(root);
-        if (!root->fs_info->log_root_recovering) {
+        btrfs_set_super_log_root(root->fs_info->super_copy, 0);
-                btrfs_set_super_log_root(root->fs_info->super_copy, 0);
+        btrfs_set_super_log_root_level(root->fs_info->super_copy, 0);
-                btrfs_set_super_log_root_level(root->fs_info->super_copy, 0);
-        }
        memcpy(root->fs_info->super_for_commit, root->fs_info->super_copy,
               sizeof(*root->fs_info->super_copy));
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 0d9613c3f5e5..79f057c0619a 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -93,7 +93,8 @@
 */
 #define LOG_WALK_PIN_ONLY 0
 #define LOG_WALK_REPLAY_INODES 1
-#define LOG_WALK_REPLAY_ALL 2
+#define LOG_WALK_REPLAY_DIR_INDEX 2
+#define LOG_WALK_REPLAY_ALL 3
 static int btrfs_log_inode(struct btrfs_trans_handle *trans,
                             struct btrfs_root *root, struct inode *inode,
@@ -393,6 +394,7 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
                if (inode_item) {
                        struct btrfs_inode_item *item;
                        u64 nbytes;
+                        u32 mode;
                        item = btrfs_item_ptr(path->nodes[0], path->slots[0],
                                              struct btrfs_inode_item);
@@ -400,9 +402,19 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
                        item = btrfs_item_ptr(eb, slot,
                                              struct btrfs_inode_item);
                        btrfs_set_inode_nbytes(eb, item, nbytes);
+                        /*
+                         * If this is a directory we need to reset the i_size to
+                         * 0 so that we can set it up properly when replaying
+                         * the rest of the items in this log.
+                         */
+                        mode = btrfs_inode_mode(eb, item);
+                        if (S_ISDIR(mode))
+                                btrfs_set_inode_size(eb, item, 0);
                }
        } else if (inode_item) {
                struct btrfs_inode_item *item;
+                u32 mode;
                /*
                 * New inode, set nbytes to 0 so that the nbytes comes out
@@ -410,6 +422,15 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
                 */
                item = btrfs_item_ptr(eb, slot, struct btrfs_inode_item);
                btrfs_set_inode_nbytes(eb, item, 0);
+                /*
+                 * If this is a directory we need to reset the i_size to 0 so
+                 * that we can set it up properly when replaying the rest of
+                 * the items in this log.
+                 */
+                mode = btrfs_inode_mode(eb, item);
+                if (S_ISDIR(mode))
+                        btrfs_set_inode_size(eb, item, 0);
        }
 insert:
        btrfs_release_path(path);
@@ -1496,6 +1517,7 @@ static noinline int insert_one_name(struct btrfs_trans_handle *trans,
                iput(inode);
                return -EIO;
        }
        ret = btrfs_add_link(trans, dir, inode, name, name_len, 1, index);
        /* FIXME, put inode into FIXUP list */
@@ -1534,6 +1556,7 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
        u8 log_type;
        int exists;
        int ret = 0;
+        bool update_size = (key->type == BTRFS_DIR_INDEX_KEY);
        dir = read_one_inode(root, key->objectid);
        if (!dir)
@@ -1604,6 +1627,10 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
                goto insert;
 out:
        btrfs_release_path(path);
+        if (!ret && update_size) {
+                btrfs_i_size_write(dir, dir->i_size + name_len * 2);
+                ret = btrfs_update_inode(trans, root, dir);
+        }
        kfree(name);
        iput(dir);
        return ret;
@@ -1614,6 +1641,7 @@ insert:
                              name, name_len, log_type, &log_key);
        if (ret && ret != -ENOENT)
                goto out;
+        update_size = false;
        ret = 0;
        goto out;
 }
@@ -2027,6 +2055,15 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
                        if (ret)
                                break;
                }
+                if (key.type == BTRFS_DIR_INDEX_KEY &&
+                    wc->stage == LOG_WALK_REPLAY_DIR_INDEX) {
+                        ret = replay_one_dir_item(wc->trans, root, path,
+                                                  eb, i, &key);
+                        if (ret)
+                                break;
+                }
                if (wc->stage < LOG_WALK_REPLAY_ALL)
                        continue;
@@ -2048,8 +2085,7 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
                                                eb, i, &key);
                        if (ret)
                                break;
-                } else if (key.type == BTRFS_DIR_ITEM_KEY ||
+                } else if (key.type == BTRFS_DIR_ITEM_KEY) {
-                           key.type == BTRFS_DIR_INDEX_KEY) {
                        ret = replay_one_dir_item(wc->trans, root, path,
                                                  eb, i, &key);
                        if (ret)
@@ -3805,6 +3841,7 @@ static noinline int check_parent_dirs_for_sync(struct btrfs_trans_handle *trans,
        int ret = 0;
        struct btrfs_root *root;
        struct dentry *old_parent = NULL;
+        struct inode *orig_inode = inode;
        /*
         * for regular files, if its inode is already on disk, we don't
@@ -3824,7 +3861,14 @@ static noinline int check_parent_dirs_for_sync(struct btrfs_trans_handle *trans,
        }
        while (1) {
-                BTRFS_I(inode)->logged_trans = trans->transid;
+                /*
+                 * If we are logging a directory then we start with our inode,
+                 * not our parents inode, so we need to skipp setting the
+                 * logged_trans so that further down in the log code we don't
+                 * think this inode has already been logged.
+                 */
+                if (inode != orig_inode)
+                        BTRFS_I(inode)->logged_trans = trans->transid;
                smp_mb();
                if (BTRFS_I(inode)->last_unlink_trans > last_committed) {
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 0052ca8264d9..043b215769c2 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -796,7 +796,8 @@ static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                        fs_devices->rotating = 1;
                fs_devices->open_devices++;
-                if (device->writeable && !device->is_tgtdev_for_dev_replace) {
+                if (device->writeable &&
+                    device->devid != BTRFS_DEV_REPLACE_DEVID) {
                        fs_devices->rw_devices++;
                        list_add(&device->dev_alloc_list,
                                 &fs_devices->alloc_list);
@@ -911,9 +912,9 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder,
        if (disk_super->label[0]) {
                if (disk_super->label[BTRFS_LABEL_SIZE - 1])
                        disk_super->label[BTRFS_LABEL_SIZE - 1] = '\0';
-                printk(KERN_INFO "device label %s ", disk_super->label);
+                printk(KERN_INFO "btrfs: device label %s ", disk_super->label);
        } else {
-                printk(KERN_INFO "device fsid %pU ", disk_super->fsid);
+                printk(KERN_INFO "btrfs: device fsid %pU ", disk_super->fsid);
        }
        printk(KERN_CONT "devid %llu transid %llu %s\n", devid, transid, path);
@@ -1715,6 +1716,7 @@ void btrfs_rm_dev_replace_srcdev(struct btrfs_fs_info *fs_info,
                                 struct btrfs_device *srcdev)
 {
        WARN_ON(!mutex_is_locked(&fs_info->fs_devices->device_list_mutex));
        list_del_rcu(&srcdev->dev_list);
        list_del_rcu(&srcdev->dev_alloc_list);
        fs_info->fs_devices->num_devices--;
@@ -1724,9 +1726,13 @@ void btrfs_rm_dev_replace_srcdev(struct btrfs_fs_info *fs_info,
        }
        if (srcdev->can_discard)
                fs_info->fs_devices->num_can_discard--;
-        if (srcdev->bdev)
+        if (srcdev->bdev) {
                fs_info->fs_devices->open_devices--;
+                /* zero out the old super */
+                btrfs_scratch_superblock(srcdev);
+        }
        call_rcu(&srcdev->rcu, free_device);
 }
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index 25badd1aec5c..f4a08d7fa2f7 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -56,7 +56,7 @@ void __cachefiles_printk_object(struct cachefiles_object *object,
                       object->fscache.cookie->parent,
                       object->fscache.cookie->netfs_data,
                       object->fscache.cookie->flags);
-                if (keybuf)
+                if (keybuf && cookie->def)
                        keylen = cookie->def->get_key(cookie->netfs_data, keybuf,
                                                      CACHEFILES_KEYBUF_SIZE);
                else
diff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c
index 34c88b83e39f..12b0eef84183 100644
--- a/fs/cachefiles/xattr.c
+++ b/fs/cachefiles/xattr.c
@@ -162,8 +162,9 @@ int cachefiles_update_object_xattr(struct cachefiles_object *object,
 int cachefiles_check_auxdata(struct cachefiles_object *object)
 {
        struct cachefiles_xattr *auxbuf;
+        enum fscache_checkaux validity;
        struct dentry *dentry = object->dentry;
-        unsigned int dlen;
+        ssize_t xlen;
        int ret;
        ASSERT(dentry);
@@ -174,22 +175,22 @@ int cachefiles_check_auxdata(struct cachefiles_object *object)
        if (!auxbuf)
                return -ENOMEM;
-        auxbuf->len = vfs_getxattr(dentry, cachefiles_xattr_cache,
+        xlen = vfs_getxattr(dentry, cachefiles_xattr_cache,
-                                   &auxbuf->type, 512 + 1);
+                            &auxbuf->type, 512 + 1);
-        if (auxbuf->len < 1)
+        ret = -ESTALE;
-                return -ESTALE;
+        if (xlen < 1 ||
+            auxbuf->type != object->fscache.cookie->def->type)
-        if (auxbuf->type != object->fscache.cookie->def->type)
+                goto error;
-                return -ESTALE;
-        dlen = auxbuf->len - 1;
+        xlen--;
-        ret = fscache_check_aux(&object->fscache, &auxbuf->data, dlen);
+        validity = fscache_check_aux(&object->fscache, &auxbuf->data, xlen);
+        if (validity != FSCACHE_CHECKAUX_OKAY)
+                goto error;
+        ret = 0;
+error:
        kfree(auxbuf);
-        if (ret != FSCACHE_CHECKAUX_OKAY)
+        return ret;
-                return -ESTALE;
-        return 0;
 }
 /*
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index ea723a5e8226..6d0b07217ac9 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -132,5 +132,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
-#define CIFS_VERSION   "2.01"
+#define CIFS_VERSION   "2.02"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index cfa14c80ef3b..52b6f6c26bfc 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -547,9 +547,6 @@ struct TCP_Server_Info {
        unsigned int max_rw;    /* maxRw specifies the maximum */
        /* message size the server can send or receive for */
        /* SMB_COM_WRITE_RAW or SMB_COM_READ_RAW. */
-        unsigned int max_vcs;   /* maximum number of smb sessions, at least
-                                   those that can be specified uniquely with
-                                   vcnumbers */
        unsigned int capabilities; /* selective disabling of caps by smb sess */
        int timeAdj;  /* Adjust for difference in server time zone in sec */
        __u64 CurrentMid;         /* multiplex id - rotating counter */
@@ -715,7 +712,6 @@ struct cifs_ses {
        enum statusEnum status;
        unsigned overrideSecFlg;  /* if non-zero override global sec flags */
        __u16 ipc_tid;          /* special tid for connection to IPC share */
-        __u16 vcnum;
        char *serverOS;         /* name of operating system underlying server */
        char *serverNOS;        /* name of network operating system of server */
        char *serverDomain;     /* security realm of server */
@@ -1272,6 +1268,7 @@ struct dfs_info3_param {
 #define CIFS_FATTR_DELETE_PENDING       0x2
 #define CIFS_FATTR_NEED_REVAL           0x4
 #define CIFS_FATTR_INO_COLLISION        0x8
+#define CIFS_FATTR_UNKNOWN_NLINK        0x10
 struct cifs_fattr {
        u32             cf_flags;
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 948676db8e2e..a630475e421c 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -2652,26 +2652,7 @@ typedef struct file_xattr_info {
 } __attribute__((packed)) FILE_XATTR_INFO; /* extended attribute info
                                              level 0x205 */
+/* flags for lsattr and chflags commands removed arein uapi/linux/fs.h */
-/* flags for chattr command */
-#define EXT_SECURE_DELETE               0x00000001 /* EXT3_SECRM_FL */
-#define EXT_ENABLE_UNDELETE             0x00000002 /* EXT3_UNRM_FL */
-/* Reserved for compress file 0x4 */
-#define EXT_SYNCHRONOUS                 0x00000008 /* EXT3_SYNC_FL */
-#define EXT_IMMUTABLE_FL                0x00000010 /* EXT3_IMMUTABLE_FL */
-#define EXT_OPEN_APPEND_ONLY            0x00000020 /* EXT3_APPEND_FL */
-#define EXT_DO_NOT_BACKUP               0x00000040 /* EXT3_NODUMP_FL */
-#define EXT_NO_UPDATE_ATIME             0x00000080 /* EXT3_NOATIME_FL */
-/* 0x100 through 0x800 reserved for compression flags and are GET-ONLY */
-#define EXT_HASH_TREE_INDEXED_DIR       0x00001000 /* GET-ONLY EXT3_INDEX_FL */
-/* 0x2000 reserved for IMAGIC_FL */
-#define EXT_JOURNAL_THIS_FILE   0x00004000 /* GET-ONLY EXT3_JOURNAL_DATA_FL */
-/* 0x8000 reserved for EXT3_NOTAIL_FL */
-#define EXT_SYNCHRONOUS_DIR             0x00010000 /* EXT3_DIRSYNC_FL */
-#define EXT_TOPDIR                      0x00020000 /* EXT3_TOPDIR_FL */
-#define EXT_SET_MASK                    0x000300FF
-#define EXT_GET_MASK                    0x0003DFFF
 typedef struct file_chattr_info {
        __le64  mask; /* list of all possible attribute bits */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index a3d74fea1623..4baf35949b51 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -463,7 +463,6 @@ decode_lanman_negprot_rsp(struct TCP_Server_Info *server, NEGOTIATE_RSP *pSMBr)
                               cifs_max_pending);
        set_credits(server, server->maxReq);
        server->maxBuf = le16_to_cpu(rsp->MaxBufSize);
-        server->max_vcs = le16_to_cpu(rsp->MaxNumberVcs);
        /* even though we do not use raw we might as well set this
        accurately, in case we ever find a need for it */
        if ((le16_to_cpu(rsp->RawMode) & RAW_ENABLE) == RAW_ENABLE) {
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index d3e2eaa503a6..5384c2a640ca 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -500,6 +500,7 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
                if (server->ops->close)
                        server->ops->close(xid, tcon, &fid);
                cifs_del_pending_open(&open);
+                fput(file);
                rc = -ENOMEM;
        }
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index eb955b525e55..7ddddf2e2504 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -3254,6 +3254,9 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
        /*
         * Reads as many pages as possible from fscache. Returns -ENOBUFS
         * immediately if the cookie is negative
+         *
+         * After this point, every page in the list might have PG_fscache set,
+         * so we will need to clean that up off of every page we don't use.
         */
        rc = cifs_readpages_from_fscache(mapping->host, mapping, page_list,
                                         &num_pages);
@@ -3376,6 +3379,11 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                kref_put(&rdata->refcount, cifs_readdata_release);
        }
+        /* Any pages that have been shown to fscache but didn't get added to
+         * the pagecache must be uncached before they get returned to the
+         * allocator.
+         */
+        cifs_fscache_readpages_cancel(mapping->host, page_list);
        return rc;
 }
diff --git a/fs/cifs/fscache.c b/fs/cifs/fscache.c
index 2f4bc5a58054..b3258f35e88a 100644
--- a/fs/cifs/fscache.c
+++ b/fs/cifs/fscache.c
@@ -223,6 +223,13 @@ void __cifs_readpage_to_fscache(struct inode *inode, struct page *page)
                fscache_uncache_page(CIFS_I(inode)->fscache, page);
 }
+void __cifs_fscache_readpages_cancel(struct inode *inode, struct list_head *pages)
+{
+        cifs_dbg(FYI, "%s: (fsc: %p, i: %p)\n",
+                 __func__, CIFS_I(inode)->fscache, inode);
+        fscache_readpages_cancel(CIFS_I(inode)->fscache, pages);
+}
 void __cifs_fscache_invalidate_page(struct page *page, struct inode *inode)
 {
        struct cifsInodeInfo *cifsi = CIFS_I(inode);
diff --git a/fs/cifs/fscache.h b/fs/cifs/fscache.h
index 63539323e0b9..24794b6cd8ec 100644
--- a/fs/cifs/fscache.h
+++ b/fs/cifs/fscache.h
@@ -54,6 +54,7 @@ extern int __cifs_readpages_from_fscache(struct inode *,
                                         struct address_space *,
                                         struct list_head *,
                                         unsigned *);
+extern void __cifs_fscache_readpages_cancel(struct inode *, struct list_head *);
 extern void __cifs_readpage_to_fscache(struct inode *, struct page *);
@@ -91,6 +92,13 @@ static inline void cifs_readpage_to_fscache(struct inode *inode,
                __cifs_readpage_to_fscache(inode, page);
 }
+static inline void cifs_fscache_readpages_cancel(struct inode *inode,
+                                                 struct list_head *pages)
+{
+        if (CIFS_I(inode)->fscache)
+                return __cifs_fscache_readpages_cancel(inode, pages);
+}
 #else /* CONFIG_CIFS_FSCACHE */
 static inline int cifs_fscache_register(void) { return 0; }
 static inline void cifs_fscache_unregister(void) {}
@@ -131,6 +139,11 @@ static inline int cifs_readpages_from_fscache(struct inode *inode,
 static inline void cifs_readpage_to_fscache(struct inode *inode,
                        struct page *page) {}
+static inline void cifs_fscache_readpages_cancel(struct inode *inode,
+                                                 struct list_head *pages)
+{
+}
 #endif /* CONFIG_CIFS_FSCACHE */
 #endif /* _CIFS_FSCACHE_H */
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index f9ff9c173f78..867b7cdc794a 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -120,6 +120,33 @@ cifs_revalidate_cache(struct inode *inode, struct cifs_fattr *fattr)
        cifs_i->invalid_mapping = true;
 }
+/*
+ * copy nlink to the inode, unless it wasn't provided.  Provide
+ * sane values if we don't have an existing one and none was provided
+ */
+static void
+cifs_nlink_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
+{
+        /*
+         * if we're in a situation where we can't trust what we
+         * got from the server (readdir, some non-unix cases)
+         * fake reasonable values
+         */
+        if (fattr->cf_flags & CIFS_FATTR_UNKNOWN_NLINK) {
+                /* only provide fake values on a new inode */
+                if (inode->i_state & I_NEW) {
+                        if (fattr->cf_cifsattrs & ATTR_DIRECTORY)
+                                set_nlink(inode, 2);
+                        else
+                                set_nlink(inode, 1);
+                }
+                return;
+        }
+        /* we trust the server, so update it */
+        set_nlink(inode, fattr->cf_nlink);
+}
 /* populate an inode with info from a cifs_fattr struct */
 void
 cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
@@ -134,7 +161,7 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
        inode->i_mtime = fattr->cf_mtime;
        inode->i_ctime = fattr->cf_ctime;
        inode->i_rdev = fattr->cf_rdev;
-        set_nlink(inode, fattr->cf_nlink);
+        cifs_nlink_fattr_to_inode(inode, fattr);
        inode->i_uid = fattr->cf_uid;
        inode->i_gid = fattr->cf_gid;
@@ -541,6 +568,7 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
        fattr->cf_bytes = le64_to_cpu(info->AllocationSize);
        fattr->cf_createtime = le64_to_cpu(info->CreationTime);
+        fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
        if (fattr->cf_cifsattrs & ATTR_DIRECTORY) {
                fattr->cf_mode = S_IFDIR | cifs_sb->mnt_dir_mode;
                fattr->cf_dtype = DT_DIR;
@@ -548,7 +576,8 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                 * Server can return wrong NumberOfLinks value for directories
                 * when Unix extensions are disabled - fake it.
                 */
-                fattr->cf_nlink = 2;
+                if (!tcon->unix_ext)
+                        fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK;
        } else if (fattr->cf_cifsattrs & ATTR_REPARSE) {
                fattr->cf_mode = S_IFLNK;
                fattr->cf_dtype = DT_LNK;
@@ -561,11 +590,15 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                if (fattr->cf_cifsattrs & ATTR_READONLY)
                        fattr->cf_mode &= ~(S_IWUGO);
-                fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+                /*
-                if (fattr->cf_nlink < 1) {
+                 * Don't accept zero nlink from non-unix servers unless
-                        cifs_dbg(1, "replacing bogus file nlink value %u\n",
+                 * delete is pending.  Instead mark it as unknown.
+                 */
+                if ((fattr->cf_nlink < 1) && !tcon->unix_ext &&
+                    !info->DeletePending) {
+                        cifs_dbg(1, "bogus file nlink value %u\n",
                                fattr->cf_nlink);
-                        fattr->cf_nlink = 1;
+                        fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK;
                }
        }
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 42ef03be089f..53a75f3d0179 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -180,6 +180,9 @@ cifs_fill_common_info(struct cifs_fattr *fattr, struct cifs_sb_info *cifs_sb)
                fattr->cf_dtype = DT_REG;
        }
+        /* non-unix readdir doesn't provide nlink */
+        fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK;
        if (fattr->cf_cifsattrs & ATTR_READONLY)
                fattr->cf_mode &= ~S_IWUGO;
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 5f99b7f19e78..352358de1d7e 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -32,88 +32,6 @@
 #include <linux/slab.h>
 #include "cifs_spnego.h"
-/*
- * Checks if this is the first smb session to be reconnected after
- * the socket has been reestablished (so we know whether to use vc 0).
- * Called while holding the cifs_tcp_ses_lock, so do not block
- */
-static bool is_first_ses_reconnect(struct cifs_ses *ses)
-{
-        struct list_head *tmp;
-        struct cifs_ses *tmp_ses;
-        list_for_each(tmp, &ses->server->smb_ses_list) {
-                tmp_ses = list_entry(tmp, struct cifs_ses,
-                                     smb_ses_list);
-                if (tmp_ses->need_reconnect == false)
-                        return false;
-        }
-        /* could not find a session that was already connected,
-           this must be the first one we are reconnecting */
-        return true;
-}
-/*
- *      vc number 0 is treated specially by some servers, and should be the
- *      first one we request.  After that we can use vcnumbers up to maxvcs,
- *      one for each smb session (some Windows versions set maxvcs incorrectly
- *      so maxvc=1 can be ignored).  If we have too many vcs, we can reuse
- *      any vc but zero (some servers reset the connection on vcnum zero)
- *
- */
-static __le16 get_next_vcnum(struct cifs_ses *ses)
-{
-        __u16 vcnum = 0;
-        struct list_head *tmp;
-        struct cifs_ses *tmp_ses;
-        __u16 max_vcs = ses->server->max_vcs;
-        __u16 i;
-        int free_vc_found = 0;
-        /* Quoting the MS-SMB specification: "Windows-based SMB servers set this
-        field to one but do not enforce this limit, which allows an SMB client
-        to establish more virtual circuits than allowed by this value ... but
-        other server implementations can enforce this limit." */
-        if (max_vcs < 2)
-                max_vcs = 0xFFFF;
-        spin_lock(&cifs_tcp_ses_lock);
-        if ((ses->need_reconnect) && is_first_ses_reconnect(ses))
-                        goto get_vc_num_exit;  /* vcnum will be zero */
-        for (i = ses->server->srv_count - 1; i < max_vcs; i++) {
-                if (i == 0) /* this is the only connection, use vc 0 */
-                        break;
-                free_vc_found = 1;
-                list_for_each(tmp, &ses->server->smb_ses_list) {
-                        tmp_ses = list_entry(tmp, struct cifs_ses,
-                                             smb_ses_list);
-                        if (tmp_ses->vcnum == i) {
-                                free_vc_found = 0;
-                                break; /* found duplicate, try next vcnum */
-                        }
-                }
-                if (free_vc_found)
-                        break; /* we found a vcnumber that will work - use it */
-        }
-        if (i == 0)
-                vcnum = 0; /* for most common case, ie if one smb session, use
-                              vc zero.  Also for case when no free vcnum, zero
-                              is safest to send (some clients only send zero) */
-        else if (free_vc_found == 0)
-                vcnum = 1;  /* we can not reuse vc=0 safely, since some servers
-                                reset all uids on that, but 1 is ok. */
-        else
-                vcnum = i;
-        ses->vcnum = vcnum;
-get_vc_num_exit:
-        spin_unlock(&cifs_tcp_ses_lock);
-        return cpu_to_le16(vcnum);
-}
 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
 {
        __u32 capabilities = 0;
@@ -128,7 +46,7 @@ static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
                                        CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
                                        USHRT_MAX));
        pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
-        pSMB->req.VcNumber = get_next_vcnum(ses);
+        pSMB->req.VcNumber = __constant_cpu_to_le16(1);
        /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 318e8433527c..b2a86e324aac 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -586,7 +586,8 @@ int __fscache_check_consistency(struct fscache_cookie *cookie)
        fscache_operation_init(op, NULL, NULL);
        op->flags = FSCACHE_OP_MYTHREAD |
-                (1 << FSCACHE_OP_WAITING);
+                (1 << FSCACHE_OP_WAITING) |
+                (1 << FSCACHE_OP_UNUSE_COOKIE);
        spin_lock(&cookie->lock);
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 62b43b577bfc..b7989f2ab4c4 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -182,6 +182,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
        struct inode *inode;
        struct dentry *parent;
        struct fuse_conn *fc;
+        struct fuse_inode *fi;
        int ret;
        inode = ACCESS_ONCE(entry->d_inode);
@@ -228,7 +229,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
                if (!err && !outarg.nodeid)
                        err = -ENOENT;
                if (!err) {
-                        struct fuse_inode *fi = get_fuse_inode(inode);
+                        fi = get_fuse_inode(inode);
                        if (outarg.nodeid != get_node_id(inode)) {
                                fuse_queue_forget(fc, forget, outarg.nodeid, 1);
                                goto invalid;
@@ -246,8 +247,11 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
                                       attr_version);
                fuse_change_entry_timeout(entry, &outarg);
        } else if (inode) {
-                fc = get_fuse_conn(inode);
+                fi = get_fuse_inode(inode);
-                if (fc->readdirplus_auto) {
+                if (flags & LOOKUP_RCU) {
+                        if (test_bit(FUSE_I_INIT_RDPLUS, &fi->state))
+                                return -ECHILD;
+                } else if (test_and_clear_bit(FUSE_I_INIT_RDPLUS, &fi->state)) {
                        parent = dget_parent(entry);
                        fuse_advise_use_readdirplus(parent->d_inode);
                        dput(parent);
@@ -259,7 +263,8 @@ out:
 invalid:
        ret = 0;
-        if (check_submounts_and_drop(entry) != 0)
+        if (!(flags & LOOKUP_RCU) && check_submounts_and_drop(entry) != 0)
                ret = 1;
        goto out;
 }
@@ -1063,6 +1068,8 @@ static int fuse_access(struct inode *inode, int mask)
        struct fuse_access_in inarg;
        int err;
+        BUG_ON(mask & MAY_NOT_BLOCK);
        if (fc->no_access)
                return 0;
@@ -1150,9 +1157,6 @@ static int fuse_permission(struct inode *inode, int mask)
                   noticed immediately, only after the attribute
                   timeout has expired */
        } else if (mask & (MAY_ACCESS | MAY_CHDIR)) {
-                if (mask & MAY_NOT_BLOCK)
-                        return -ECHILD;
                err = fuse_access(inode, mask);
        } else if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) {
                if (!(inode->i_mode & S_IXUGO)) {
@@ -1291,6 +1295,8 @@ static int fuse_direntplus_link(struct file *file,
        }
 found:
+        if (fc->readdirplus_auto)
+                set_bit(FUSE_I_INIT_RDPLUS, &get_fuse_inode(inode)->state);
        fuse_change_entry_timeout(dentry, o);
        err = 0;
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index d409deafc67b..4598345ab87d 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2467,6 +2467,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
 {
        struct fuse_file *ff = file->private_data;
        struct inode *inode = file->f_inode;
+        struct fuse_inode *fi = get_fuse_inode(inode);
        struct fuse_conn *fc = ff->fc;
        struct fuse_req *req;
        struct fuse_fallocate_in inarg = {
@@ -2484,10 +2485,20 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
        if (lock_inode) {
                mutex_lock(&inode->i_mutex);
-                if (mode & FALLOC_FL_PUNCH_HOLE)
+                if (mode & FALLOC_FL_PUNCH_HOLE) {
-                        fuse_set_nowrite(inode);
+                        loff_t endbyte = offset + length - 1;
+                        err = filemap_write_and_wait_range(inode->i_mapping,
+                                                           offset, endbyte);
+                        if (err)
+                                goto out;
+                        fuse_sync_writes(inode);
+                }
        }
+        if (!(mode & FALLOC_FL_KEEP_SIZE))
+                set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
        req = fuse_get_req_nopages(fc);
        if (IS_ERR(req)) {
                err = PTR_ERR(req);
@@ -2520,11 +2531,11 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
        fuse_invalidate_attr(inode);
 out:
-        if (lock_inode) {
+        if (!(mode & FALLOC_FL_KEEP_SIZE))
-                if (mode & FALLOC_FL_PUNCH_HOLE)
+                clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
-                        fuse_release_nowrite(inode);
+        if (lock_inode)
                mutex_unlock(&inode->i_mutex);
-        }
        return err;
 }
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 5ced199b50bb..5b9e6f3b6aef 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -115,6 +115,8 @@ struct fuse_inode {
 enum {
        /** Advise readdirplus  */
        FUSE_I_ADVISE_RDPLUS,
+        /** Initialized with readdirplus */
+        FUSE_I_INIT_RDPLUS,
        /** An operation changing file size is in progress  */
        FUSE_I_SIZE_UNSTABLE,
 };
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 64915eeae5a7..ced3257f06e8 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -694,8 +694,10 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
        mark_inode_dirty(inode);
        d_instantiate(dentry, inode);
-        if (file)
+        if (file) {
+                *opened |= FILE_CREATED;
                error = finish_open(file, dentry, gfs2_open_common, opened);
+        }
        gfs2_glock_dq_uninit(ghs);
        gfs2_glock_dq_uninit(ghs + 1);
        return error;
diff --git a/fs/namei.c b/fs/namei.c
index 0dc4cbf21f37..645268f23eb6 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2656,6 +2656,7 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
        int acc_mode;
        int create_error = 0;
        struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
+        bool excl;
        BUG_ON(dentry->d_inode);
@@ -2669,10 +2670,9 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
        if ((open_flag & O_CREAT) && !IS_POSIXACL(dir))
                mode &= ~current_umask();
-        if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT)) {
+        excl = (open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT);
+        if (excl)
                open_flag &= ~O_TRUNC;
-                *opened |= FILE_CREATED;
-        }
        /*
         * Checking write permission is tricky, bacuse we don't know if we are
@@ -2725,12 +2725,6 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
                goto out;
        }
-        acc_mode = op->acc_mode;
-        if (*opened & FILE_CREATED) {
-                fsnotify_create(dir, dentry);
-                acc_mode = MAY_OPEN;
-        }
        if (error) {    /* returned 1, that is */
                if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
                        error = -EIO;
@@ -2740,9 +2734,19 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
                        dput(dentry);
                        dentry = file->f_path.dentry;
                }
-                if (create_error && dentry->d_inode == NULL) {
+                if (*opened & FILE_CREATED)
-                        error = create_error;
+                        fsnotify_create(dir, dentry);
-                        goto out;
+                if (!dentry->d_inode) {
+                        WARN_ON(*opened & FILE_CREATED);
+                        if (create_error) {
+                                error = create_error;
+                                goto out;
+                        }
+                } else {
+                        if (excl && !(*opened & FILE_CREATED)) {
+                                error = -EEXIST;
+                                goto out;
+                        }
                }
                goto looked_up;
        }
@@ -2751,6 +2755,12 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
         * We didn't have the inode before the open, so check open permission
         * here.
         */
+        acc_mode = op->acc_mode;
+        if (*opened & FILE_CREATED) {
+                WARN_ON(!(open_flag & O_CREAT));
+                fsnotify_create(dir, dentry);
+                acc_mode = MAY_OPEN;
+        }
        error = may_open(&file->f_path, acc_mode, open_flag);
        if (error)
                fput(file);
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index de434f309af0..02b0df769e2d 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1392,6 +1392,9 @@ static int nfs_finish_open(struct nfs_open_context *ctx,
 {
        int err;
+        if ((open_flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL))
+                *opened |= FILE_CREATED;
        err = finish_open(file, dentry, do_open, opened);
        if (err)
                goto out;
@@ -1455,7 +1458,7 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
        trace_nfs_atomic_open_enter(dir, ctx, open_flags);
        nfs_block_sillyrename(dentry->d_parent);
-        inode = NFS_PROTO(dir)->open_context(dir, ctx, open_flags, &attr);
+        inode = NFS_PROTO(dir)->open_context(dir, ctx, open_flags, &attr, opened);
        nfs_unblock_sillyrename(dentry->d_parent);
        if (IS_ERR(inode)) {
                err = PTR_ERR(inode);
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index e5b804dd944c..77efaf15ec90 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -19,6 +19,7 @@ nfs4_file_open(struct inode *inode, struct file *filp)
        struct inode *dir;
        unsigned openflags = filp->f_flags;
        struct iattr attr;
+        int opened = 0;
        int err;
        /*
@@ -55,7 +56,7 @@ nfs4_file_open(struct inode *inode, struct file *filp)
                nfs_wb_all(inode);
        }
-        inode = NFS_PROTO(dir)->open_context(dir, ctx, openflags, &attr);
+        inode = NFS_PROTO(dir)->open_context(dir, ctx, openflags, &attr, &opened);
        if (IS_ERR(inode)) {
                err = PTR_ERR(inode);
                switch (err) {
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index 95604f64cab8..c7c295e556ed 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -185,6 +185,7 @@ nfs4_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds)
        if (status)
                goto out_put;
+        smp_wmb();
        ds->ds_clp = clp;
        dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr);
 out:
@@ -801,34 +802,35 @@ nfs4_fl_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx)
        struct nfs4_file_layout_dsaddr *dsaddr = FILELAYOUT_LSEG(lseg)->dsaddr;
        struct nfs4_pnfs_ds *ds = dsaddr->ds_list[ds_idx];
        struct nfs4_deviceid_node *devid = FILELAYOUT_DEVID_NODE(lseg);
+        struct nfs4_pnfs_ds *ret = ds;
-        if (filelayout_test_devid_unavailable(devid))
-                return NULL;
        if (ds == NULL) {
                printk(KERN_ERR "NFS: %s: No data server for offset index %d\n",
                        __func__, ds_idx);
                filelayout_mark_devid_invalid(devid);
-                return NULL;
+                goto out;
        }
+        smp_rmb();
        if (ds->ds_clp)
-                return ds;
+                goto out_test_devid;
        if (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) == 0) {
                struct nfs_server *s = NFS_SERVER(lseg->pls_layout->plh_inode);
                int err;
                err = nfs4_ds_connect(s, ds);
-                if (err) {
+                if (err)
                        nfs4_mark_deviceid_unavailable(devid);
-                        ds = NULL;
-                }
                nfs4_clear_ds_conn_bit(ds);
        } else {
                /* Either ds is connected, or ds is NULL */
                nfs4_wait_ds_connect(ds);
        }
-        return ds;
+out_test_devid:
+        if (filelayout_test_devid_unavailable(devid))
+                ret = NULL;
+out:
+        return ret;
 }
 module_param(dataserver_retrans, uint, 0644);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 989bb9d3074d..d53d6785cba2 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -912,6 +912,7 @@ struct nfs4_opendata {
        struct iattr attrs;
        unsigned long timestamp;
        unsigned int rpc_done : 1;
+        unsigned int file_created : 1;
        unsigned int is_recover : 1;
        int rpc_status;
        int cancelled;
@@ -1946,8 +1947,13 @@ static int _nfs4_proc_open(struct nfs4_opendata *data)
        nfs_fattr_map_and_free_names(server, &data->f_attr);
-        if (o_arg->open_flags & O_CREAT)
+        if (o_arg->open_flags & O_CREAT) {
                update_changeattr(dir, &o_res->cinfo);
+                if (o_arg->open_flags & O_EXCL)
+                        data->file_created = 1;
+                else if (o_res->cinfo.before != o_res->cinfo.after)
+                        data->file_created = 1;
+        }
        if ((o_res->rflags & NFS4_OPEN_RESULT_LOCKTYPE_POSIX) == 0)
                server->caps &= ~NFS_CAP_POSIX_LOCK;
        if(o_res->rflags & NFS4_OPEN_RESULT_CONFIRM) {
@@ -2191,7 +2197,8 @@ static int _nfs4_do_open(struct inode *dir,
                        struct nfs_open_context *ctx,
                        int flags,
                        struct iattr *sattr,
-                        struct nfs4_label *label)
+                        struct nfs4_label *label,
+                        int *opened)
 {
        struct nfs4_state_owner  *sp;
        struct nfs4_state     *state = NULL;
@@ -2261,6 +2268,8 @@ static int _nfs4_do_open(struct inode *dir,
                        nfs_setsecurity(state->inode, opendata->o_res.f_attr, olabel);
                }
        }
+        if (opendata->file_created)
+                *opened |= FILE_CREATED;
        if (pnfs_use_threshold(ctx_th, opendata->f_attr.mdsthreshold, server))
                *ctx_th = opendata->f_attr.mdsthreshold;
@@ -2289,7 +2298,8 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir,
                                        struct nfs_open_context *ctx,
                                        int flags,
                                        struct iattr *sattr,
-                                        struct nfs4_label *label)
+                                        struct nfs4_label *label,
+                                        int *opened)
 {
        struct nfs_server *server = NFS_SERVER(dir);
        struct nfs4_exception exception = { };
@@ -2297,7 +2307,7 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir,
        int status;
        do {
-                status = _nfs4_do_open(dir, ctx, flags, sattr, label);
+                status = _nfs4_do_open(dir, ctx, flags, sattr, label, opened);
                res = ctx->state;
                trace_nfs4_open_file(ctx, flags, status);
                if (status == 0)
@@ -2659,7 +2669,8 @@ out:
 }
 static struct inode *
-nfs4_atomic_open(struct inode *dir, struct nfs_open_context *ctx, int open_flags, struct iattr *attr)
+nfs4_atomic_open(struct inode *dir, struct nfs_open_context *ctx,
+                int open_flags, struct iattr *attr, int *opened)
 {
        struct nfs4_state *state;
        struct nfs4_label l = {0, 0, 0, NULL}, *label = NULL;
@@ -2667,7 +2678,7 @@ nfs4_atomic_open(struct inode *dir, struct nfs_open_context *ctx, int open_flags
        label = nfs4_label_init_security(dir, ctx->dentry, attr, &l);
        /* Protect against concurrent sillydeletes */
-        state = nfs4_do_open(dir, ctx, open_flags, attr, label);
+        state = nfs4_do_open(dir, ctx, open_flags, attr, label, opened);
        nfs4_label_release_security(label);
@@ -3332,6 +3343,7 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
        struct nfs4_label l, *ilabel = NULL;
        struct nfs_open_context *ctx;
        struct nfs4_state *state;
+        int opened = 0;
        int status = 0;
        ctx = alloc_nfs_open_context(dentry, FMODE_READ);
@@ -3341,7 +3353,7 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
        ilabel = nfs4_label_init_security(dir, dentry, sattr, &l);
        sattr->ia_mode &= ~current_umask();
-        state = nfs4_do_open(dir, ctx, flags, sattr, ilabel);
+        state = nfs4_do_open(dir, ctx, flags, sattr, ilabel, &opened);
        if (IS_ERR(state)) {
                status = PTR_ERR(state);
                goto out;
@@ -7564,8 +7576,10 @@ nfs41_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
 {
        int err;
        struct page *page;
-        rpc_authflavor_t flavor;
+        rpc_authflavor_t flavor = RPC_AUTH_MAXFLAVOR;
        struct nfs4_secinfo_flavors *flavors;
+        struct nfs4_secinfo4 *secinfo;
+        int i;
        page = alloc_page(GFP_KERNEL);
        if (!page) {
@@ -7587,9 +7601,31 @@ nfs41_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
        if (err)
                goto out_freepage;
-        flavor = nfs_find_best_sec(flavors);
+        for (i = 0; i < flavors->num_flavors; i++) {
-        if (err == 0)
+                secinfo = &flavors->flavors[i];
-                err = nfs4_lookup_root_sec(server, fhandle, info, flavor);
+                switch (secinfo->flavor) {
+                case RPC_AUTH_NULL:
+                case RPC_AUTH_UNIX:
+                case RPC_AUTH_GSS:
+                        flavor = rpcauth_get_pseudoflavor(secinfo->flavor,
+                                        &secinfo->flavor_info);
+                        break;
+                default:
+                        flavor = RPC_AUTH_MAXFLAVOR;
+                        break;
+                }
+                if (flavor != RPC_AUTH_MAXFLAVOR) {
+                        err = nfs4_lookup_root_sec(server, fhandle,
+                                                   info, flavor);
+                        if (!err)
+                                break;
+                }
+        }
+        if (flavor == RPC_AUTH_MAXFLAVOR)
+                err = -EPERM;
 out_freepage:
        put_page(page);
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 0ba679866e50..da276640f776 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -94,6 +94,7 @@ void nilfs_forget_buffer(struct buffer_head *bh)
        clear_buffer_nilfs_volatile(bh);
        clear_buffer_nilfs_checked(bh);
        clear_buffer_nilfs_redirected(bh);
+        clear_buffer_async_write(bh);
        clear_buffer_dirty(bh);
        if (nilfs_page_buffers_clean(page))
                __nilfs_clear_page_dirty(page);
@@ -429,6 +430,7 @@ void nilfs_clear_dirty_page(struct page *page, bool silent)
                                        "discard block %llu, size %zu",
                                        (u64)bh->b_blocknr, bh->b_size);
                        }
+                        clear_buffer_async_write(bh);
                        clear_buffer_dirty(bh);
                        clear_buffer_nilfs_volatile(bh);
                        clear_buffer_nilfs_checked(bh);
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index bd88a7461063..9f6b486b6c01 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -665,7 +665,7 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode,
                bh = head = page_buffers(page);
                do {
-                        if (!buffer_dirty(bh))
+                        if (!buffer_dirty(bh) || buffer_async_write(bh))
                                continue;
                        get_bh(bh);
                        list_add_tail(&bh->b_assoc_buffers, listp);
@@ -699,7 +699,8 @@ static void nilfs_lookup_dirty_node_buffers(struct inode *inode,
                for (i = 0; i < pagevec_count(&pvec); i++) {
                        bh = head = page_buffers(pvec.pages[i]);
                        do {
-                                if (buffer_dirty(bh)) {
+                                if (buffer_dirty(bh) &&
+                                                !buffer_async_write(bh)) {
                                        get_bh(bh);
                                        list_add_tail(&bh->b_assoc_buffers,
                                                      listp);
@@ -1579,6 +1580,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
                list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
                                    b_assoc_buffers) {
+                        set_buffer_async_write(bh);
                        if (bh->b_page != bd_page) {
                                if (bd_page) {
                                        lock_page(bd_page);
@@ -1592,6 +1594,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
                list_for_each_entry(bh, &segbuf->sb_payload_buffers,
                                    b_assoc_buffers) {
+                        set_buffer_async_write(bh);
                        if (bh == segbuf->sb_super_root) {
                                if (bh->b_page != bd_page) {
                                        lock_page(bd_page);
@@ -1677,6 +1680,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
        list_for_each_entry(segbuf, logs, sb_list) {
                list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
                                    b_assoc_buffers) {
+                        clear_buffer_async_write(bh);
                        if (bh->b_page != bd_page) {
                                if (bd_page)
                                        end_page_writeback(bd_page);
@@ -1686,6 +1690,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
                list_for_each_entry(bh, &segbuf->sb_payload_buffers,
                                    b_assoc_buffers) {
+                        clear_buffer_async_write(bh);
                        if (bh == segbuf->sb_super_root) {
                                if (bh->b_page != bd_page) {
                                        end_page_writeback(bd_page);
@@ -1755,6 +1760,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
                                    b_assoc_buffers) {
                        set_buffer_uptodate(bh);
                        clear_buffer_dirty(bh);
+                        clear_buffer_async_write(bh);
                        if (bh->b_page != bd_page) {
                                if (bd_page)
                                        end_page_writeback(bd_page);
@@ -1776,6 +1782,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
                                    b_assoc_buffers) {
                        set_buffer_uptodate(bh);
                        clear_buffer_dirty(bh);
+                        clear_buffer_async_write(bh);
                        clear_buffer_delay(bh);
                        clear_buffer_nilfs_volatile(bh);
                        clear_buffer_nilfs_redirected(bh);
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index ef999729e274..0d3a97d2d5f6 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -70,9 +70,10 @@ static int ocfs2_dentry_revalidate(struct dentry *dentry, unsigned int flags)
         */
        if (inode == NULL) {
                unsigned long gen = (unsigned long) dentry->d_fsdata;
-                unsigned long pgen =
+                unsigned long pgen;
-                        OCFS2_I(dentry->d_parent->d_inode)->ip_dir_lock_gen;
+                spin_lock(&dentry->d_lock);
+                pgen = OCFS2_I(dentry->d_parent->d_inode)->ip_dir_lock_gen;
+                spin_unlock(&dentry->d_lock);
                trace_ocfs2_dentry_revalidate_negative(dentry->d_name.len,
                                                       dentry->d_name.name,
                                                       pgen, gen);
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 121da2dc3be8..d4e81e4a9b04 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1924,7 +1924,7 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err)
 {
        int tmp, hangup_needed = 0;
        struct ocfs2_super *osb = NULL;
-        char nodestr[8];
+        char nodestr[12];
        trace_ocfs2_dismount_volume(sb);
diff --git a/fs/open.c b/fs/open.c
index 2a731b0d08bc..d420331ca32a 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -744,14 +744,24 @@ cleanup_file:
 /**
 * finish_open - finish opening a file
- * @od: opaque open data
+ * @file: file pointer
 * @dentry: pointer to dentry
 * @open: open callback
+ * @opened: state of open
 *
 * This can be used to finish opening a file passed to i_op->atomic_open().
 *
 * If the open callback is set to NULL, then the standard f_op->open()
 * filesystem callback is substituted.
+ *
+ * NB: the dentry reference is _not_ consumed.  If, for example, the dentry is
+ * the return value of d_splice_alias(), then the caller needs to perform dput()
+ * on it after finish_open().
+ *
+ * On successful return @file is a fully instantiated open file.  After this, if
+ * an error occurs in ->atomic_open(), it needs to clean up with fput().
+ *
+ * Returns zero on success or -errno if the open failed.
 */
 int finish_open(struct file *file, struct dentry *dentry,
                int (*open)(struct inode *, struct file *),
@@ -772,11 +782,16 @@ EXPORT_SYMBOL(finish_open);
 /**
 * finish_no_open - finish ->atomic_open() without opening the file
 *
- * @od: opaque open data
+ * @file: file pointer
 * @dentry: dentry or NULL (as returned from ->lookup())
 *
 * This can be used to set the result of a successful lookup in ->atomic_open().
- * The filesystem's atomic_open() method shall return NULL after calling this.
+ *
+ * NB: unlike finish_open() this function does consume the dentry reference and
+ * the caller need not dput() it.
+ *
+ * Returns "1" which must be the return value of ->atomic_open() after having
+ * called this function.
 */
 int finish_no_open(struct file *file, struct dentry *dentry)
 {
diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index 4ffb7ab5e397..b8e93a40a5d3 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -168,7 +168,7 @@ static int pstore_decompress(void *in, void *out, size_t inlen, size_t outlen)
        int err, ret;
        ret = -EIO;
-        err = zlib_inflateInit(&stream);
+        err = zlib_inflateInit2(&stream, WINDOW_BITS);
        if (err != Z_OK)
                goto error;
@@ -195,8 +195,29 @@ error:
 static void allocate_buf_for_compression(void)
 {
        size_t size;
+        size_t cmpr;
+        switch (psinfo->bufsize) {
+        /* buffer range for efivars */
+        case 1000 ... 2000:
+                cmpr = 56;
+                break;
+        case 2001 ... 3000:
+                cmpr = 54;
+                break;
+        case 3001 ... 3999:
+                cmpr = 52;
+                break;
+        /* buffer range for nvram, erst */
+        case 4000 ... 10000:
+                cmpr = 45;
+                break;
+        default:
+                cmpr = 60;
+                break;
+        }
-        big_oops_buf_sz = (psinfo->bufsize * 100) / 45;
+        big_oops_buf_sz = (psinfo->bufsize * 100) / cmpr;
        big_oops_buf = kmalloc(big_oops_buf_sz, GFP_KERNEL);
        if (big_oops_buf) {
                size = max(zlib_deflate_workspacesize(WINDOW_BITS, MEM_LEVEL),
@@ -295,10 +316,6 @@ static void pstore_dump(struct kmsg_dumper *dumper,
                                compressed = true;
                                total_len = zipped_len;
                        } else {
-                                pr_err("pstore: compression failed for Part %d"
-                                        " returned %d\n", part, zipped_len);
-                                pr_err("pstore: Capture uncompressed"
-                                        " oops/panic report of Part %d\n", part);
                                compressed = false;
                                total_len = copy_kmsg_to_buffer(hsize, len);
                        }
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 73feacc49b2e..fd777032c2ba 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -1163,21 +1163,6 @@ static struct reiserfs_journal_list *find_newer_jl_for_cn(struct
        return NULL;
 }
-static int newer_jl_done(struct reiserfs_journal_cnode *cn)
-{
-        struct super_block *sb = cn->sb;
-        b_blocknr_t blocknr = cn->blocknr;
-        cn = cn->hprev;
-        while (cn) {
-                if (cn->sb == sb && cn->blocknr == blocknr && cn->jlist &&
-                    atomic_read(&cn->jlist->j_commit_left) != 0)
-                                    return 0;
-                cn = cn->hprev;
-        }
-        return 1;
-}
 static void remove_journal_hash(struct super_block *,
                                struct reiserfs_journal_cnode **,
                                struct reiserfs_journal_list *, unsigned long,
@@ -1353,7 +1338,6 @@ static int flush_journal_list(struct super_block *s,
                reiserfs_warning(s, "clm-2048", "called with wcount %d",
                                 atomic_read(&journal->j_wcount));
        }
-        BUG_ON(jl->j_trans_id == 0);
        /* if flushall == 0, the lock is already held */
        if (flushall) {
@@ -1593,31 +1577,6 @@ static int flush_journal_list(struct super_block *s,
        return err;
 }
-static int test_transaction(struct super_block *s,
-                            struct reiserfs_journal_list *jl)
-{
-        struct reiserfs_journal_cnode *cn;
-        if (jl->j_len == 0 || atomic_read(&jl->j_nonzerolen) == 0)
-                return 1;
-        cn = jl->j_realblock;
-        while (cn) {
-                /* if the blocknr == 0, this has been cleared from the hash,
-                 ** skip it
-                 */
-                if (cn->blocknr == 0) {
-                        goto next;
-                }
-                if (cn->bh && !newer_jl_done(cn))
-                        return 0;
-              next:
-                cn = cn->next;
-                cond_resched();
-        }
-        return 0;
-}
 static int write_one_transaction(struct super_block *s,
                                 struct reiserfs_journal_list *jl,
                                 struct buffer_chunk *chunk)
@@ -1805,6 +1764,8 @@ static int flush_used_journal_lists(struct super_block *s,
                        break;
                tjl = JOURNAL_LIST_ENTRY(tjl->j_list.next);
        }
+        get_journal_list(jl);
+        get_journal_list(flush_jl);
        /* try to find a group of blocks we can flush across all the
         ** transactions, but only bother if we've actually spanned
         ** across multiple lists
@@ -1813,6 +1774,8 @@ static int flush_used_journal_lists(struct super_block *s,
                ret = kupdate_transactions(s, jl, &tjl, &trans_id, len, i);
        }
        flush_journal_list(s, flush_jl, 1);
+        put_journal_list(s, flush_jl);
+        put_journal_list(s, jl);
        return 0;
 }
@@ -3868,27 +3831,6 @@ int reiserfs_prepare_for_journal(struct super_block *sb,
        return 1;
 }
-static void flush_old_journal_lists(struct super_block *s)
-{
-        struct reiserfs_journal *journal = SB_JOURNAL(s);
-        struct reiserfs_journal_list *jl;
-        struct list_head *entry;
-        time_t now = get_seconds();
-        while (!list_empty(&journal->j_journal_list)) {
-                entry = journal->j_journal_list.next;
-                jl = JOURNAL_LIST_ENTRY(entry);
-                /* this check should always be run, to send old lists to disk */
-                if (jl->j_timestamp < (now - (JOURNAL_MAX_TRANS_AGE * 4)) &&
-                    atomic_read(&jl->j_commit_left) == 0 &&
-                    test_transaction(s, jl)) {
-                        flush_used_journal_lists(s, jl);
-                } else {
-                        break;
-                }
-        }
-}
 /*
 ** long and ugly.  If flush, will not return until all commit
 ** blocks and all real buffers in the trans are on disk.
@@ -4232,7 +4174,6 @@ static int do_journal_end(struct reiserfs_transaction_handle *th,
                        }
                }
        }
-        flush_old_journal_lists(sb);
        journal->j_current_jl->j_list_bitmap =
            get_list_bitmap(sb, journal->j_current_jl);
diff --git a/fs/super.c b/fs/super.c
index 3a96c9783a8b..0225c20f8770 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -264,6 +264,8 @@ out_free_sb:
 */
 static inline void destroy_super(struct super_block *s)
 {
+        list_lru_destroy(&s->s_dentry_lru);
+        list_lru_destroy(&s->s_inode_lru);
 #ifdef CONFIG_SMP
        free_percpu(s->s_files);
 #endif
@@ -323,8 +325,6 @@ void deactivate_locked_super(struct super_block *s)
                /* caches are now gone, we can safely kill the shrinker now */
                unregister_shrinker(&s->s_shrink);
-                list_lru_destroy(&s->s_dentry_lru);
-                list_lru_destroy(&s->s_inode_lru);
                put_filesystem(fs);
                put_super(s);
diff --git a/fs/sysv/super.c b/fs/sysv/super.c
index d0c6a007ce83..eda10959714f 100644
--- a/fs/sysv/super.c
+++ b/fs/sysv/super.c
@@ -487,6 +487,7 @@ static int v7_fill_super(struct super_block *sb, void *data, int silent)
        sbi->s_sb = sb;
        sbi->s_block_base = 0;
        sbi->s_type = FSTYPE_V7;
+        mutex_init(&sbi->s_lock);
        sb->s_fs_info = sbi;
        
        sb_set_blocksize(sb, 512);
diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c
index 7e5aae4bf46f..6eaf5edf1ea1 100644
--- a/fs/udf/ialloc.c
+++ b/fs/udf/ialloc.c
@@ -30,18 +30,17 @@ void udf_free_inode(struct inode *inode)
 {
        struct super_block *sb = inode->i_sb;
        struct udf_sb_info *sbi = UDF_SB(sb);
+        struct logicalVolIntegrityDescImpUse *lvidiu = udf_sb_lvidiu(sb);
-        mutex_lock(&sbi->s_alloc_mutex);
+        if (lvidiu) {
-        if (sbi->s_lvid_bh) {
+                mutex_lock(&sbi->s_alloc_mutex);
-                struct logicalVolIntegrityDescImpUse *lvidiu =
-                                                        udf_sb_lvidiu(sbi);
                if (S_ISDIR(inode->i_mode))
                        le32_add_cpu(&lvidiu->numDirs, -1);
                else
                        le32_add_cpu(&lvidiu->numFiles, -1);
                udf_updated_lvid(sb);
+                mutex_unlock(&sbi->s_alloc_mutex);
        }
-        mutex_unlock(&sbi->s_alloc_mutex);
        udf_free_blocks(sb, NULL, &UDF_I(inode)->i_location, 0, 1);
 }
@@ -55,6 +54,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode, int *err)
        uint32_t start = UDF_I(dir)->i_location.logicalBlockNum;
        struct udf_inode_info *iinfo;
        struct udf_inode_info *dinfo = UDF_I(dir);
+        struct logicalVolIntegrityDescImpUse *lvidiu;
        inode = new_inode(sb);
@@ -92,12 +92,10 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode, int *err)
                return NULL;
        }
-        if (sbi->s_lvid_bh) {
+        lvidiu = udf_sb_lvidiu(sb);
-                struct logicalVolIntegrityDescImpUse *lvidiu;
+        if (lvidiu) {
                iinfo->i_unique = lvid_get_unique_id(sb);
                mutex_lock(&sbi->s_alloc_mutex);
-                lvidiu = udf_sb_lvidiu(sbi);
                if (S_ISDIR(mode))
                        le32_add_cpu(&lvidiu->numDirs, 1);
                else
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 839a2bad7f45..91219385691d 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -94,13 +94,25 @@ static unsigned int udf_count_free(struct super_block *);
 static int udf_statfs(struct dentry *, struct kstatfs *);
 static int udf_show_options(struct seq_file *, struct dentry *);
-struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct udf_sb_info *sbi)
+struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb)
 {
-        struct logicalVolIntegrityDesc *lvid =
+        struct logicalVolIntegrityDesc *lvid;
-                (struct logicalVolIntegrityDesc *)sbi->s_lvid_bh->b_data;
+        unsigned int partnum;
-        __u32 number_of_partitions = le32_to_cpu(lvid->numOfPartitions);
+        unsigned int offset;
-        __u32 offset = number_of_partitions * 2 *
-                                sizeof(uint32_t)/sizeof(uint8_t);
+        if (!UDF_SB(sb)->s_lvid_bh)
+                return NULL;
+        lvid = (struct logicalVolIntegrityDesc *)UDF_SB(sb)->s_lvid_bh->b_data;
+        partnum = le32_to_cpu(lvid->numOfPartitions);
+        if ((sb->s_blocksize - sizeof(struct logicalVolIntegrityDescImpUse) -
+             offsetof(struct logicalVolIntegrityDesc, impUse)) /
+             (2 * sizeof(uint32_t)) < partnum) {
+                udf_err(sb, "Logical volume integrity descriptor corrupted "
+                        "(numOfPartitions = %u)!\n", partnum);
+                return NULL;
+        }
+        /* The offset is to skip freeSpaceTable and sizeTable arrays */
+        offset = partnum * 2 * sizeof(uint32_t);
        return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]);
 }
@@ -629,9 +641,10 @@ static int udf_remount_fs(struct super_block *sb, int *flags, char *options)
        struct udf_options uopt;
        struct udf_sb_info *sbi = UDF_SB(sb);
        int error = 0;
+        struct logicalVolIntegrityDescImpUse *lvidiu = udf_sb_lvidiu(sb);
-        if (sbi->s_lvid_bh) {
+        if (lvidiu) {
-                int write_rev = le16_to_cpu(udf_sb_lvidiu(sbi)->minUDFWriteRev);
+                int write_rev = le16_to_cpu(lvidiu->minUDFWriteRev);
                if (write_rev > UDF_MAX_WRITE_VERSION && !(*flags & MS_RDONLY))
                        return -EACCES;
        }
@@ -1905,11 +1918,12 @@ static void udf_open_lvid(struct super_block *sb)
        if (!bh)
                return;
-        mutex_lock(&sbi->s_alloc_mutex);
        lvid = (struct logicalVolIntegrityDesc *)bh->b_data;
-        lvidiu = udf_sb_lvidiu(sbi);
+        lvidiu = udf_sb_lvidiu(sb);
+        if (!lvidiu)
+                return;
+        mutex_lock(&sbi->s_alloc_mutex);
        lvidiu->impIdent.identSuffix[0] = UDF_OS_CLASS_UNIX;
        lvidiu->impIdent.identSuffix[1] = UDF_OS_ID_LINUX;
        udf_time_to_disk_stamp(&lvid->recordingDateAndTime,
@@ -1937,10 +1951,12 @@ static void udf_close_lvid(struct super_block *sb)
        if (!bh)
                return;
+        lvid = (struct logicalVolIntegrityDesc *)bh->b_data;
+        lvidiu = udf_sb_lvidiu(sb);
+        if (!lvidiu)
+                return;
        mutex_lock(&sbi->s_alloc_mutex);
-        lvid = (struct logicalVolIntegrityDesc *)bh->b_data;
-        lvidiu = udf_sb_lvidiu(sbi);
        lvidiu->impIdent.identSuffix[0] = UDF_OS_CLASS_UNIX;
        lvidiu->impIdent.identSuffix[1] = UDF_OS_ID_LINUX;
        udf_time_to_disk_stamp(&lvid->recordingDateAndTime, CURRENT_TIME);
@@ -2093,15 +2109,19 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
        if (sbi->s_lvid_bh) {
                struct logicalVolIntegrityDescImpUse *lvidiu =
-                                                        udf_sb_lvidiu(sbi);
+                                                        udf_sb_lvidiu(sb);
-                uint16_t minUDFReadRev = le16_to_cpu(lvidiu->minUDFReadRev);
+                uint16_t minUDFReadRev;
-                uint16_t minUDFWriteRev = le16_to_cpu(lvidiu->minUDFWriteRev);
+                uint16_t minUDFWriteRev;
-                /* uint16_t maxUDFWriteRev =
-                                le16_to_cpu(lvidiu->maxUDFWriteRev); */
+                if (!lvidiu) {
+                        ret = -EINVAL;
+                        goto error_out;
+                }
+                minUDFReadRev = le16_to_cpu(lvidiu->minUDFReadRev);
+                minUDFWriteRev = le16_to_cpu(lvidiu->minUDFWriteRev);
                if (minUDFReadRev > UDF_MAX_READ_VERSION) {
                        udf_err(sb, "minUDFReadRev=%x (max is %x)\n",
-                                le16_to_cpu(lvidiu->minUDFReadRev),
+                                minUDFReadRev,
                                UDF_MAX_READ_VERSION);
                        ret = -EINVAL;
                        goto error_out;
@@ -2265,11 +2285,7 @@ static int udf_statfs(struct dentry *dentry, struct kstatfs *buf)
        struct logicalVolIntegrityDescImpUse *lvidiu;
        u64 id = huge_encode_dev(sb->s_bdev->bd_dev);
-        if (sbi->s_lvid_bh != NULL)
+        lvidiu = udf_sb_lvidiu(sb);
-                lvidiu = udf_sb_lvidiu(sbi);
-        else
-                lvidiu = NULL;
        buf->f_type = UDF_SUPER_MAGIC;
        buf->f_bsize = sb->s_blocksize;
        buf->f_blocks = sbi->s_partmaps[sbi->s_partition].s_partition_len;
diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
index ed401e94aa8c..1f32c7bd9f57 100644
--- a/fs/udf/udf_sb.h
+++ b/fs/udf/udf_sb.h
@@ -162,7 +162,7 @@ static inline struct udf_sb_info *UDF_SB(struct super_block *sb)
        return sb->s_fs_info;
 }
-struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct udf_sb_info *sbi);
+struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb);
 int udf_compute_nr_groups(struct super_block *sb, u32 partition);
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 88c5ea75ebf6..f1d85cfc0a54 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -628,6 +628,7 @@ xfs_buf_item_unlock(
                else if (aborted) {
                        ASSERT(XFS_FORCED_SHUTDOWN(lip->li_mountp));
                        if (lip->li_flags & XFS_LI_IN_AIL) {
+                                spin_lock(&lip->li_ailp->xa_lock);
                                xfs_trans_ail_delete(lip->li_ailp, lip,
                                                     SHUTDOWN_LOG_IO_ERROR);
                        }
diff --git a/fs/xfs/xfs_da_btree.c b/fs/xfs/xfs_da_btree.c
index 069537c845e5..20bf8e8002d6 100644
--- a/fs/xfs/xfs_da_btree.c
+++ b/fs/xfs/xfs_da_btree.c
@@ -1224,6 +1224,7 @@ xfs_da3_node_toosmall(
        /* start with smaller blk num */
        forward = nodehdr.forw < nodehdr.back;
        for (i = 0; i < 2; forward = !forward, i++) {
+                struct xfs_da3_icnode_hdr thdr;
                if (forward)
                        blkno = nodehdr.forw;
                else
@@ -1236,10 +1237,10 @@ xfs_da3_node_toosmall(
                        return(error);
                node = bp->b_addr;
-                xfs_da3_node_hdr_from_disk(&nodehdr, node);
+                xfs_da3_node_hdr_from_disk(&thdr, node);
                xfs_trans_brelse(state->args->trans, bp);
-                if (count - nodehdr.count >= 0)
+                if (count - thdr.count >= 0)
                        break;  /* fits with at least 25% to spare */
        }
        if (i >= 2) {
diff --git a/fs/xfs/xfs_dir2_block.c b/fs/xfs/xfs_dir2_block.c
index 0957aa98b6c0..12dad188939d 100644
--- a/fs/xfs/xfs_dir2_block.c
+++ b/fs/xfs/xfs_dir2_block.c
@@ -1158,7 +1158,7 @@ xfs_dir2_sf_to_block(
        /*
         * Create entry for .
         */
-        dep = xfs_dir3_data_dot_entry_p(hdr);
+        dep = xfs_dir3_data_dot_entry_p(mp, hdr);
        dep->inumber = cpu_to_be64(dp->i_ino);
        dep->namelen = 1;
        dep->name[0] = '.';
@@ -1172,7 +1172,7 @@ xfs_dir2_sf_to_block(
        /*
         * Create entry for ..
         */
-        dep = xfs_dir3_data_dotdot_entry_p(hdr);
+        dep = xfs_dir3_data_dotdot_entry_p(mp, hdr);
        dep->inumber = cpu_to_be64(xfs_dir2_sf_get_parent_ino(sfp));
        dep->namelen = 2;
        dep->name[0] = dep->name[1] = '.';
@@ -1183,7 +1183,7 @@ xfs_dir2_sf_to_block(
        blp[1].hashval = cpu_to_be32(xfs_dir_hash_dotdot);
        blp[1].address = cpu_to_be32(xfs_dir2_byte_to_dataptr(mp,
                                (char *)dep - (char *)hdr));
-        offset = xfs_dir3_data_first_offset(hdr);
+        offset = xfs_dir3_data_first_offset(mp);
        /*
         * Loop over existing entries, stuff them in.
         */
diff --git a/fs/xfs/xfs_dir2_format.h b/fs/xfs/xfs_dir2_format.h
index a0961a61ac1a..9cf67381adf6 100644
--- a/fs/xfs/xfs_dir2_format.h
+++ b/fs/xfs/xfs_dir2_format.h
@@ -497,69 +497,58 @@ xfs_dir3_data_unused_p(struct xfs_dir2_data_hdr *hdr)
 /*
 * Offsets of . and .. in data space (always block 0)
 *
- * The macros are used for shortform directories as they have no headers to read
- * the magic number out of. Shortform directories need to know the size of the
- * data block header because the sfe embeds the block offset of the entry into
- * it so that it doesn't change when format conversion occurs. Bad Things Happen
- * if we don't follow this rule.
- *
 * XXX: there is scope for significant optimisation of the logic here. Right
 * now we are checking for "dir3 format" over and over again. Ideally we should
 * only do it once for each operation.
 */
-#define XFS_DIR3_DATA_DOT_OFFSET(mp)    \
-        xfs_dir3_data_hdr_size(xfs_sb_version_hascrc(&(mp)->m_sb))
-#define XFS_DIR3_DATA_DOTDOT_OFFSET(mp) \
-        (XFS_DIR3_DATA_DOT_OFFSET(mp) + xfs_dir3_data_entsize(mp, 1))
-#define XFS_DIR3_DATA_FIRST_OFFSET(mp)          \
-        (XFS_DIR3_DATA_DOTDOT_OFFSET(mp) + xfs_dir3_data_entsize(mp, 2))
 static inline xfs_dir2_data_aoff_t
-xfs_dir3_data_dot_offset(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dot_offset(struct xfs_mount *mp)
 {
-        return xfs_dir3_data_entry_offset(hdr);
+        return xfs_dir3_data_hdr_size(xfs_sb_version_hascrc(&mp->m_sb));
 }
 static inline xfs_dir2_data_aoff_t
-xfs_dir3_data_dotdot_offset(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dotdot_offset(struct xfs_mount *mp)
 {
-        bool dir3 = hdr->magic == cpu_to_be32(XFS_DIR3_DATA_MAGIC) ||
+        return xfs_dir3_data_dot_offset(mp) +
-                    hdr->magic == cpu_to_be32(XFS_DIR3_BLOCK_MAGIC);
+                xfs_dir3_data_entsize(mp, 1);
-        return xfs_dir3_data_dot_offset(hdr) +
-                __xfs_dir3_data_entsize(dir3, 1);
 }
 static inline xfs_dir2_data_aoff_t
-xfs_dir3_data_first_offset(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_first_offset(struct xfs_mount *mp)
 {
-        bool dir3 = hdr->magic == cpu_to_be32(XFS_DIR3_DATA_MAGIC) ||
+        return xfs_dir3_data_dotdot_offset(mp) +
-                    hdr->magic == cpu_to_be32(XFS_DIR3_BLOCK_MAGIC);
+                xfs_dir3_data_entsize(mp, 2);
-        return xfs_dir3_data_dotdot_offset(hdr) +
-                __xfs_dir3_data_entsize(dir3, 2);
 }
 /*
 * location of . and .. in data space (always block 0)
 */
 static inline struct xfs_dir2_data_entry *
-xfs_dir3_data_dot_entry_p(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dot_entry_p(
+        struct xfs_mount        *mp,
+        struct xfs_dir2_data_hdr *hdr)
 {
        return (struct xfs_dir2_data_entry *)
-                ((char *)hdr + xfs_dir3_data_dot_offset(hdr));
+                ((char *)hdr + xfs_dir3_data_dot_offset(mp));
 }
 static inline struct xfs_dir2_data_entry *
-xfs_dir3_data_dotdot_entry_p(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dotdot_entry_p(
+        struct xfs_mount        *mp,
+        struct xfs_dir2_data_hdr *hdr)
 {
        return (struct xfs_dir2_data_entry *)
-                ((char *)hdr + xfs_dir3_data_dotdot_offset(hdr));
+                ((char *)hdr + xfs_dir3_data_dotdot_offset(mp));
 }
 static inline struct xfs_dir2_data_entry *
-xfs_dir3_data_first_entry_p(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_first_entry_p(
+        struct xfs_mount        *mp,
+        struct xfs_dir2_data_hdr *hdr)
 {
        return (struct xfs_dir2_data_entry *)
-                ((char *)hdr + xfs_dir3_data_first_offset(hdr));
+                ((char *)hdr + xfs_dir3_data_first_offset(mp));
 }
 /*
diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c
index 8993ec17452c..8f84153e98a8 100644
--- a/fs/xfs/xfs_dir2_readdir.c
+++ b/fs/xfs/xfs_dir2_readdir.c
@@ -119,9 +119,9 @@ xfs_dir2_sf_getdents(
         * mp->m_dirdatablk.
         */
        dot_offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk,
-                                             XFS_DIR3_DATA_DOT_OFFSET(mp));
+                                             xfs_dir3_data_dot_offset(mp));
        dotdot_offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk,
-                                                XFS_DIR3_DATA_DOTDOT_OFFSET(mp));
+                                                xfs_dir3_data_dotdot_offset(mp));
        /*
         * Put . entry unless we're starting past it.
diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
index bb6e2848f473..3ef6d402084c 100644
--- a/fs/xfs/xfs_dir2_sf.c
+++ b/fs/xfs/xfs_dir2_sf.c
@@ -557,7 +557,7 @@ xfs_dir2_sf_addname_hard(
         * to insert the new entry.
         * If it's going to end up at the end then oldsfep will point there.
         */
-        for (offset = XFS_DIR3_DATA_FIRST_OFFSET(mp),
+        for (offset = xfs_dir3_data_first_offset(mp),
              oldsfep = xfs_dir2_sf_firstentry(oldsfp),
              add_datasize = xfs_dir3_data_entsize(mp, args->namelen),
              eof = (char *)oldsfep == &buf[old_isize];
@@ -640,7 +640,7 @@ xfs_dir2_sf_addname_pick(
        sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
        size = xfs_dir3_data_entsize(mp, args->namelen);
-        offset = XFS_DIR3_DATA_FIRST_OFFSET(mp);
+        offset = xfs_dir3_data_first_offset(mp);
        sfep = xfs_dir2_sf_firstentry(sfp);
        holefit = 0;
        /*
@@ -713,7 +713,7 @@ xfs_dir2_sf_check(
        mp = dp->i_mount;
        sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
-        offset = XFS_DIR3_DATA_FIRST_OFFSET(mp);
+        offset = xfs_dir3_data_first_offset(mp);
        ino = xfs_dir2_sf_get_parent_ino(sfp);
        i8count = ino > XFS_DIR2_MAX_SHORT_INUM;
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index 71520e6e5d65..1ee776d477c3 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -64,7 +64,8 @@ int xfs_dqerror_mod = 33;
 struct kmem_zone                *xfs_qm_dqtrxzone;
 static struct kmem_zone         *xfs_qm_dqzone;
-static struct lock_class_key xfs_dquot_other_class;
+static struct lock_class_key xfs_dquot_group_class;
+static struct lock_class_key xfs_dquot_project_class;
 /*
 * This is called to free all the memory associated with a dquot
@@ -703,8 +704,20 @@ xfs_qm_dqread(
         * Make sure group quotas have a different lock class than user
         * quotas.
         */
-        if (!(type & XFS_DQ_USER))
+        switch (type) {
-                lockdep_set_class(&dqp->q_qlock, &xfs_dquot_other_class);
+        case XFS_DQ_USER:
+                /* uses the default lock class */
+                break;
+        case XFS_DQ_GROUP:
+                lockdep_set_class(&dqp->q_qlock, &xfs_dquot_group_class);
+                break;
+        case XFS_DQ_PROJ:
+                lockdep_set_class(&dqp->q_qlock, &xfs_dquot_project_class);
+                break;
+        default:
+                ASSERT(0);
+                break;
+        }
        XFS_STATS_INC(xs_qm_dquot);
diff --git a/fs/xfs/xfs_fs.h b/fs/xfs/xfs_fs.h
index 1edb5cc3e5f4..18272c766a50 100644
--- a/fs/xfs/xfs_fs.h
+++ b/fs/xfs/xfs_fs.h
@@ -515,7 +515,7 @@ typedef struct xfs_swapext
 /*      XFS_IOC_GETBIOSIZE ---- deprecated 47      */
 #define XFS_IOC_GETBMAPX        _IOWR('X', 56, struct getbmap)
 #define XFS_IOC_ZERO_RANGE      _IOW ('X', 57, struct xfs_flock64)
-#define XFS_IOC_FREE_EOFBLOCKS  _IOR ('X', 58, struct xfs_eofblocks)
+#define XFS_IOC_FREE_EOFBLOCKS  _IOR ('X', 58, struct xfs_fs_eofblocks)
 /*
 * ioctl commands that replace IRIX syssgi()'s
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index 193206ba4358..474807a401c8 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -119,11 +119,6 @@ xfs_inode_free(
                ip->i_itemp = NULL;
        }
-        /* asserts to verify all state is correct here */
-        ASSERT(atomic_read(&ip->i_pincount) == 0);
-        ASSERT(!spin_is_locked(&ip->i_flags_lock));
-        ASSERT(!xfs_isiflocked(ip));
        /*
         * Because we use RCU freeing we need to ensure the inode always
         * appears to be reclaimed with an invalid inode number when in the
@@ -135,6 +130,10 @@ xfs_inode_free(
        ip->i_ino = 0;
        spin_unlock(&ip->i_flags_lock);
+        /* asserts to verify all state is correct here */
+        ASSERT(atomic_read(&ip->i_pincount) == 0);
+        ASSERT(!xfs_isiflocked(ip));
        call_rcu(&VFS_I(ip)->i_rcu, xfs_inode_free_callback);
 }
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index dabda9521b4b..39797490a1f1 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1585,6 +1585,7 @@ xlog_recover_add_to_trans(
                "bad number of regions (%d) in inode log format",
                                  in_f->ilf_size);
                        ASSERT(0);
+                        kmem_free(ptr);
                        return XFS_ERROR(EIO);
                }
@@ -1970,6 +1971,13 @@ xlog_recover_do_inode_buffer(
 * magic number.  If we don't recognise the magic number in the buffer, then
 * return a LSN of -1 so that the caller knows it was an unrecognised block and
 * so can recover the buffer.
+ *
+ * Note: we cannot rely solely on magic number matches to determine that the
+ * buffer has a valid LSN - we also need to verify that it belongs to this
+ * filesystem, so we need to extract the object's LSN and compare it to that
+ * which we read from the superblock. If the UUIDs don't match, then we've got a
+ * stale metadata block from an old filesystem instance that we need to recover
+ * over the top of.
 */
 static xfs_lsn_t
 xlog_recover_get_buf_lsn(
@@ -1980,6 +1988,8 @@ xlog_recover_get_buf_lsn(
        __uint16_t              magic16;
        __uint16_t              magicda;
        void                    *blk = bp->b_addr;
+        uuid_t                  *uuid;
+        xfs_lsn_t               lsn = -1;
        /* v4 filesystems always recover immediately */
        if (!xfs_sb_version_hascrc(&mp->m_sb))
@@ -1992,43 +2002,79 @@ xlog_recover_get_buf_lsn(
        case XFS_ABTB_MAGIC:
        case XFS_ABTC_MAGIC:
        case XFS_IBT_CRC_MAGIC:
-        case XFS_IBT_MAGIC:
+        case XFS_IBT_MAGIC: {
-                return be64_to_cpu(
+                struct xfs_btree_block *btb = blk;
-                                ((struct xfs_btree_block *)blk)->bb_u.s.bb_lsn);
+                lsn = be64_to_cpu(btb->bb_u.s.bb_lsn);
+                uuid = &btb->bb_u.s.bb_uuid;
+                break;
+        }
        case XFS_BMAP_CRC_MAGIC:
-        case XFS_BMAP_MAGIC:
+        case XFS_BMAP_MAGIC: {
-                return be64_to_cpu(
+                struct xfs_btree_block *btb = blk;
-                                ((struct xfs_btree_block *)blk)->bb_u.l.bb_lsn);
+                lsn = be64_to_cpu(btb->bb_u.l.bb_lsn);
+                uuid = &btb->bb_u.l.bb_uuid;
+                break;
+        }
        case XFS_AGF_MAGIC:
-                return be64_to_cpu(((struct xfs_agf *)blk)->agf_lsn);
+                lsn = be64_to_cpu(((struct xfs_agf *)blk)->agf_lsn);
+                uuid = &((struct xfs_agf *)blk)->agf_uuid;
+                break;
        case XFS_AGFL_MAGIC:
-                return be64_to_cpu(((struct xfs_agfl *)blk)->agfl_lsn);
+                lsn = be64_to_cpu(((struct xfs_agfl *)blk)->agfl_lsn);
+                uuid = &((struct xfs_agfl *)blk)->agfl_uuid;
+                break;
        case XFS_AGI_MAGIC:
-                return be64_to_cpu(((struct xfs_agi *)blk)->agi_lsn);
+                lsn = be64_to_cpu(((struct xfs_agi *)blk)->agi_lsn);
+                uuid = &((struct xfs_agi *)blk)->agi_uuid;
+                break;
        case XFS_SYMLINK_MAGIC:
-                return be64_to_cpu(((struct xfs_dsymlink_hdr *)blk)->sl_lsn);
+                lsn = be64_to_cpu(((struct xfs_dsymlink_hdr *)blk)->sl_lsn);
+                uuid = &((struct xfs_dsymlink_hdr *)blk)->sl_uuid;
+                break;
        case XFS_DIR3_BLOCK_MAGIC:
        case XFS_DIR3_DATA_MAGIC:
        case XFS_DIR3_FREE_MAGIC:
-                return be64_to_cpu(((struct xfs_dir3_blk_hdr *)blk)->lsn);
+                lsn = be64_to_cpu(((struct xfs_dir3_blk_hdr *)blk)->lsn);
+                uuid = &((struct xfs_dir3_blk_hdr *)blk)->uuid;
+                break;
        case XFS_ATTR3_RMT_MAGIC:
-                return be64_to_cpu(((struct xfs_attr3_rmt_hdr *)blk)->rm_lsn);
+                lsn = be64_to_cpu(((struct xfs_attr3_rmt_hdr *)blk)->rm_lsn);
+                uuid = &((struct xfs_attr3_rmt_hdr *)blk)->rm_uuid;
+                break;
        case XFS_SB_MAGIC:
-                return be64_to_cpu(((struct xfs_dsb *)blk)->sb_lsn);
+                lsn = be64_to_cpu(((struct xfs_dsb *)blk)->sb_lsn);
+                uuid = &((struct xfs_dsb *)blk)->sb_uuid;
+                break;
        default:
                break;
        }
+        if (lsn != (xfs_lsn_t)-1) {
+                if (!uuid_equal(&mp->m_sb.sb_uuid, uuid))
+                        goto recover_immediately;
+                return lsn;
+        }
        magicda = be16_to_cpu(((struct xfs_da_blkinfo *)blk)->magic);
        switch (magicda) {
        case XFS_DIR3_LEAF1_MAGIC:
        case XFS_DIR3_LEAFN_MAGIC:
        case XFS_DA3_NODE_MAGIC:
-                return be64_to_cpu(((struct xfs_da3_blkinfo *)blk)->lsn);
+                lsn = be64_to_cpu(((struct xfs_da3_blkinfo *)blk)->lsn);
+                uuid = &((struct xfs_da3_blkinfo *)blk)->uuid;
+                break;
        default:
                break;
        }
+        if (lsn != (xfs_lsn_t)-1) {
+                if (!uuid_equal(&mp->m_sb.sb_uuid, uuid))
+                        goto recover_immediately;
+                return lsn;
+        }
        /*
         * We do individual object checks on dquot and inode buffers as they
         * have their own individual LSN records. Also, we could have a stale