38 files changed, 267 insertions, 214 deletions

diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index eb1cc92cd67d..d8d8e7ba6a1e 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -110,7 +110,6 @@ struct autofs_sb_info {
         int sub_version;
         int min_proto;
         int max_proto;
-        int compat_daemon;
         unsigned long exp_timeout;
         unsigned int type;
         int reghost_enabled;
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 9dacb8586701..3dfd615afb6b 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -385,7 +385,6 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
                 sbi->pipefd = pipefd;
                 sbi->pipe = pipe;
                 sbi->catatonic = 0;
-                sbi->compat_daemon = is_compat_task();
         }
 out:
         mutex_unlock(&sbi->wq_mutex);
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index d8dc002e9cc3..14c7bc02349e 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -19,7 +19,6 @@
 #include <linux/parser.h>
 #include <linux/bitops.h>
 #include <linux/magic.h>
-#include <linux/compat.h>
 #include "autofs_i.h"
 #include <linux/module.h>
 
@@ -225,7 +224,6 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
         set_autofs_type_indirect(&sbi->type);
         sbi->min_proto = 0;
         sbi->max_proto = 0;
-        sbi->compat_daemon = is_compat_task();
         mutex_init(&sbi->wq_mutex);
         mutex_init(&sbi->pipe_mutex);
         spin_lock_init(&sbi->fs_lock);
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 9c098db43344..da8876d38a7b 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -91,24 +91,7 @@ static int autofs4_write(struct autofs_sb_info *sbi,
 
         return (bytes > 0);
 }
-
-/*
- * The autofs_v5 packet was misdesigned.
- *
- * The packets are identical on x86-32 and x86-64, but have different
- * alignment. Which means that 'sizeof()' will give different results.
- * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
- */
-static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
-{
-        size_t pktsz = sizeof(struct autofs_v5_packet);
-#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
-        if (sbi->compat_daemon > 0)
-                pktsz -= 4;
-#endif
-        return pktsz;
-}
-
+        
 static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
                                  struct autofs_wait_queue *wq,
                                  int type)
@@ -172,7 +155,8 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
         {
                 struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
 
-                pktsz = autofs_v5_packet_size(sbi);
+                pktsz = sizeof(*packet);
+
                 packet->wait_queue_token = wq->wait_queue_token;
                 packet->len = wq->name.len;
                 memcpy(packet->name, wq->name.name, wq->name.len);
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index f4e90748940a..bcec06750232 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -22,6 +22,7 @@
 #include "ulist.h"
 #include "transaction.h"
 #include "delayed-ref.h"
+#include "locking.h"
 
 /*
  * this structure records all encountered refs on the way up to the root
@@ -893,18 +894,22 @@ static char *iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
         s64 bytes_left = size - 1;
         struct extent_buffer *eb = eb_in;
         struct btrfs_key found_key;
+        int leave_spinning = path->leave_spinning;
 
         if (bytes_left >= 0)
                 dest[bytes_left] = '\0';
 
+        path->leave_spinning = 1;
         while (1) {
                 len = btrfs_inode_ref_name_len(eb, iref);
                 bytes_left -= len;
                 if (bytes_left >= 0)
                         read_extent_buffer(eb, dest + bytes_left,
                                                 (unsigned long)(iref + 1), len);
-                if (eb != eb_in)
+                if (eb != eb_in) {
+                        btrfs_tree_read_unlock_blocking(eb);
                         free_extent_buffer(eb);
+                }
                 ret = inode_ref_info(parent, 0, fs_root, path, &found_key);
                 if (ret > 0)
                         ret = -ENOENT;
@@ -919,8 +924,11 @@ static char *iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                 slot = path->slots[0];
                 eb = path->nodes[0];
                 /* make sure we can use eb after releasing the path */
-                if (eb != eb_in)
+                if (eb != eb_in) {
                         atomic_inc(&eb->refs);
+                        btrfs_tree_read_lock(eb);
+                        btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
+                }
                 btrfs_release_path(path);
 
                 iref = btrfs_item_ptr(eb, slot, struct btrfs_inode_ref);
@@ -931,6 +939,7 @@ static char *iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
         }
 
         btrfs_release_path(path);
+        path->leave_spinning = leave_spinning;
 
         if (ret)
                 return ERR_PTR(ret);
@@ -1247,7 +1256,7 @@ static int iterate_irefs(u64 inum, struct btrfs_root *fs_root,
                                 struct btrfs_path *path,
                                 iterate_irefs_t *iterate, void *ctx)
 {
-        int ret;
+        int ret = 0;
         int slot;
         u32 cur;
         u32 len;
@@ -1259,7 +1268,8 @@ static int iterate_irefs(u64 inum, struct btrfs_root *fs_root,
         struct btrfs_inode_ref *iref;
         struct btrfs_key found_key;
 
-        while (1) {
+        while (!ret) {
+                path->leave_spinning = 1;
                 ret = inode_ref_info(inum, parent ? parent+1 : 0, fs_root, path,
                                         &found_key);
                 if (ret < 0)
@@ -1275,6 +1285,8 @@ static int iterate_irefs(u64 inum, struct btrfs_root *fs_root,
                 eb = path->nodes[0];
                 /* make sure we can use eb after releasing the path */
                 atomic_inc(&eb->refs);
+                btrfs_tree_read_lock(eb);
+                btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
                 btrfs_release_path(path);
 
                 item = btrfs_item_nr(eb, slot);
@@ -1288,13 +1300,12 @@ static int iterate_irefs(u64 inum, struct btrfs_root *fs_root,
                                  (unsigned long long)found_key.objectid,
                                  (unsigned long long)fs_root->objectid);
                         ret = iterate(parent, iref, eb, ctx);
-                        if (ret) {
-                                free_extent_buffer(eb);
+                        if (ret)
                                 break;
-                        }
                         len = sizeof(*iref) + name_len;
                         iref = (struct btrfs_inode_ref *)((char *)iref + len);
                 }
+                btrfs_tree_read_unlock_blocking(eb);
                 free_extent_buffer(eb);
         }
 
@@ -1414,6 +1425,8 @@ struct inode_fs_paths *init_ipath(s32 total_bytes, struct btrfs_root *fs_root,
 
 void free_ipath(struct inode_fs_paths *ipath)
 {
+        if (!ipath)
+                return;
         kfree(ipath->fspath);
         kfree(ipath);
 }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 3f65a812e282..8fd72331d600 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1078,7 +1078,7 @@ struct btrfs_fs_info {
          * is required instead of the faster short fsync log commits
          */
         u64 last_trans_log_full_commit;
-        unsigned long mount_opt:21;
+        unsigned long mount_opt;
         unsigned long compress_type:4;
         u64 max_inline;
         u64 alloc_start;
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 20196f411206..d0c969beaad4 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -383,17 +383,16 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root,
                 if (test_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags))
                         break;
 
-                if (!failed_mirror) {
-                        failed = 1;
-                        printk(KERN_ERR "failed mirror was %d\n", eb->failed_mirror);
-                        failed_mirror = eb->failed_mirror;
-                }
-
                 num_copies = btrfs_num_copies(&root->fs_info->mapping_tree,
                                               eb->start, eb->len);
                 if (num_copies == 1)
                         break;
 
+                if (!failed_mirror) {
+                        failed = 1;
+                        failed_mirror = eb->read_mirror;
+                }
+
                 mirror_num++;
                 if (mirror_num == failed_mirror)
                         mirror_num++;
@@ -564,7 +563,7 @@ struct extent_buffer *find_eb_for_page(struct extent_io_tree *tree,
 }
 
 static int btree_readpage_end_io_hook(struct page *page, u64 start, u64 end,
-                               struct extent_state *state)
+                               struct extent_state *state, int mirror)
 {
         struct extent_io_tree *tree;
         u64 found_start;
@@ -589,6 +588,7 @@ static int btree_readpage_end_io_hook(struct page *page, u64 start, u64 end,
         if (!reads_done)
                 goto err;
 
+        eb->read_mirror = mirror;
         if (test_bit(EXTENT_BUFFER_IOERR, &eb->bflags)) {
                 ret = -EIO;
                 goto err;
@@ -652,7 +652,7 @@ static int btree_io_failed_hook(struct page *page, int failed_mirror)
 
         eb = (struct extent_buffer *)page->private;
         set_bit(EXTENT_BUFFER_IOERR, &eb->bflags);
-        eb->failed_mirror = failed_mirror;
+        eb->read_mirror = failed_mirror;
         if (test_and_clear_bit(EXTENT_BUFFER_READAHEAD, &eb->bflags))
                 btree_readahead_hook(root, eb, eb->start, -EIO);
         return -EIO;    /* we fixed nothing */
@@ -2254,9 +2254,9 @@ int open_ctree(struct super_block *sb,
                 goto fail_sb_buffer;
         }
 
-        if (sectorsize < PAGE_SIZE) {
-                printk(KERN_WARNING "btrfs: Incompatible sector size "
-                       "found on %s\n", sb->s_id);
+        if (sectorsize != PAGE_SIZE) {
+                printk(KERN_WARNING "btrfs: Incompatible sector size(%lu) "
+                       "found on %s\n", (unsigned long)sectorsize, sb->s_id);
                 goto fail_sb_buffer;
         }
 
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 2b35f8d14bb9..6fc2e6f5aab8 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2301,6 +2301,7 @@ static noinline int run_clustered_refs(struct btrfs_trans_handle *trans,
 
                                 if (ret) {
                                         printk(KERN_DEBUG "btrfs: run_delayed_extent_op returned %d\n", ret);
+                                        spin_lock(&delayed_refs->lock);
                                         return ret;
                                 }
 
@@ -2331,6 +2332,7 @@ static noinline int run_clustered_refs(struct btrfs_trans_handle *trans,
 
                 if (ret) {
                         printk(KERN_DEBUG "btrfs: run_one_delayed_ref returned %d\n", ret);
+                        spin_lock(&delayed_refs->lock);
                         return ret;
                 }
 
@@ -3769,13 +3771,10 @@ again:
                  */
                 if (current->journal_info)
                         return -EAGAIN;
-                ret = wait_event_interruptible(space_info->wait,
-                                               !space_info->flush);
-                /* Must have been interrupted, return */
-                if (ret) {
-                        printk(KERN_DEBUG "btrfs: %s returning -EINTR\n", __func__);
+                ret = wait_event_killable(space_info->wait, !space_info->flush);
+                /* Must have been killed, return */
+                if (ret)
                         return -EINTR;
-                }
 
                 spin_lock(&space_info->lock);
         }
@@ -4215,8 +4214,8 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
 
         num_bytes = calc_global_metadata_size(fs_info);
 
-        spin_lock(&block_rsv->lock);
         spin_lock(&sinfo->lock);
+        spin_lock(&block_rsv->lock);
 
         block_rsv->size = num_bytes;
 
@@ -4242,8 +4241,8 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
                 block_rsv->full = 1;
         }
 
-        spin_unlock(&sinfo->lock);
         spin_unlock(&block_rsv->lock);
+        spin_unlock(&sinfo->lock);
 }
 
 static void init_global_block_rsv(struct btrfs_fs_info *fs_info)
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index cd4b5e400221..198c2ba2fa40 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -402,20 +402,28 @@ static int split_state(struct extent_io_tree *tree, struct extent_state *orig,
         return 0;
 }
 
+static struct extent_state *next_state(struct extent_state *state)
+{
+        struct rb_node *next = rb_next(&state->rb_node);
+        if (next)
+                return rb_entry(next, struct extent_state, rb_node);
+        else
+                return NULL;
+}
+
 /*
  * utility function to clear some bits in an extent state struct.
- * it will optionally wake up any one waiting on this state (wake == 1), or
- * forcibly remove the state from the tree (delete == 1).
+ * it will optionally wake up any one waiting on this state (wake == 1)
  *
  * If no bits are set on the state struct after clearing things, the
  * struct is freed and removed from the tree
  */
-static int clear_state_bit(struct extent_io_tree *tree,
-                            struct extent_state *state,
-                            int *bits, int wake)
+static struct extent_state *clear_state_bit(struct extent_io_tree *tree,
+                                            struct extent_state *state,
+                                            int *bits, int wake)
 {
+        struct extent_state *next;
         int bits_to_clear = *bits & ~EXTENT_CTLBITS;
-        int ret = state->state & bits_to_clear;
 
         if ((bits_to_clear & EXTENT_DIRTY) && (state->state & EXTENT_DIRTY)) {
                 u64 range = state->end - state->start + 1;
@@ -427,6 +435,7 @@ static int clear_state_bit(struct extent_io_tree *tree,
         if (wake)
                 wake_up(&state->wq);
         if (state->state == 0) {
+                next = next_state(state);
                 if (state->tree) {
                         rb_erase(&state->rb_node, &tree->state);
                         state->tree = NULL;
@@ -436,8 +445,9 @@ static int clear_state_bit(struct extent_io_tree *tree,
                 }
         } else {
                 merge_state(tree, state);
+                next = next_state(state);
         }
-        return ret;
+        return next;
 }
 
 static struct extent_state *
@@ -476,7 +486,6 @@ int clear_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,
         struct extent_state *state;
         struct extent_state *cached;
         struct extent_state *prealloc = NULL;
-        struct rb_node *next_node;
         struct rb_node *node;
         u64 last_end;
         int err;
@@ -528,14 +537,11 @@ hit_next:
         WARN_ON(state->end < start);
         last_end = state->end;
 
-        if (state->end < end && !need_resched())
-                next_node = rb_next(&state->rb_node);
-        else
-                next_node = NULL;
-
         /* the state doesn't have the wanted bits, go ahead */
-        if (!(state->state & bits))
+        if (!(state->state & bits)) {
+                state = next_state(state);
                 goto next;
+        }
 
         /*
          *     | ---- desired range ---- |
@@ -593,16 +599,13 @@ hit_next:
                 goto out;
         }
 
-        clear_state_bit(tree, state, &bits, wake);
+        state = clear_state_bit(tree, state, &bits, wake);
 next:
         if (last_end == (u64)-1)
                 goto out;
         start = last_end + 1;
-        if (start <= end && next_node) {
-                state = rb_entry(next_node, struct extent_state,
-                                 rb_node);
+        if (start <= end && state && !need_resched())
                 goto hit_next;
-        }
         goto search_again;
 
 out:
@@ -2301,7 +2304,7 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
         u64 start;
         u64 end;
         int whole_page;
-        int failed_mirror;
+        int mirror;
         int ret;
 
         if (err)
@@ -2340,20 +2343,18 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                 }
                 spin_unlock(&tree->lock);
 
+                mirror = (int)(unsigned long)bio->bi_bdev;
                 if (uptodate && tree->ops && tree->ops->readpage_end_io_hook) {
                         ret = tree->ops->readpage_end_io_hook(page, start, end,
-                                                              state);
+                                                              state, mirror);
                         if (ret)
                                 uptodate = 0;
                         else
                                 clean_io_failure(start, page);
                 }
 
-                if (!uptodate)
-                        failed_mirror = (int)(unsigned long)bio->bi_bdev;
-
                 if (!uptodate && tree->ops && tree->ops->readpage_io_failed_hook) {
-                        ret = tree->ops->readpage_io_failed_hook(page, failed_mirror);
+                        ret = tree->ops->readpage_io_failed_hook(page, mirror);
                         if (!ret && !err &&
                             test_bit(BIO_UPTODATE, &bio->bi_flags))
                                 uptodate = 1;
@@ -2368,8 +2369,7 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                          * can't handle the error it will return -EIO and we
                          * remain responsible for that page.
                          */
-                        ret = bio_readpage_error(bio, page, start, end,
-                                                        failed_mirror, NULL);
+                        ret = bio_readpage_error(bio, page, start, end, mirror, NULL);
                         if (ret == 0) {
                                 uptodate =
                                         test_bit(BIO_UPTODATE, &bio->bi_flags);
@@ -4462,7 +4462,7 @@ int read_extent_buffer_pages(struct extent_io_tree *tree,
         }
 
         clear_bit(EXTENT_BUFFER_IOERR, &eb->bflags);
-        eb->failed_mirror = 0;
+        eb->read_mirror = 0;
         atomic_set(&eb->io_pages, num_reads);
         for (i = start_i; i < num_pages; i++) {
                 page = extent_buffer_page(eb, i);
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index faf10eb57f75..b516c3b8dec6 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -79,7 +79,7 @@ struct extent_io_ops {
                                         u64 start, u64 end,
                                        struct extent_state *state);
         int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
-                                    struct extent_state *state);
+                                    struct extent_state *state, int mirror);
         int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
                                       struct extent_state *state, int uptodate);
         void (*set_bit_hook)(struct inode *inode, struct extent_state *state,
@@ -135,7 +135,7 @@ struct extent_buffer {
         spinlock_t refs_lock;
         atomic_t refs;
         atomic_t io_pages;
-        int failed_mirror;
+        int read_mirror;
         struct list_head leak_list;
         struct rcu_head rcu_head;
         pid_t lock_owner;
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index d83260d7498f..53bf2d764bbc 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -567,6 +567,7 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans, struct inode *inode,
         int extent_type;
         int recow;
         int ret;
+        int modify_tree = -1;
 
         if (drop_cache)
                 btrfs_drop_extent_cache(inode, start, end - 1, 0);
@@ -575,10 +576,13 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans, struct inode *inode,
         if (!path)
                 return -ENOMEM;
 
+        if (start >= BTRFS_I(inode)->disk_i_size)
+                modify_tree = 0;
+
         while (1) {
                 recow = 0;
                 ret = btrfs_lookup_file_extent(trans, root, path, ino,
-                                               search_start, -1);
+                                               search_start, modify_tree);
                 if (ret < 0)
                         break;
                 if (ret > 0 && path->slots[0] > 0 && search_start == start) {
@@ -634,7 +638,8 @@ next_slot:
                 }
 
                 search_start = max(key.offset, start);
-                if (recow) {
+                if (recow || !modify_tree) {
+                        modify_tree = -1;
                         btrfs_release_path(path);
                         continue;
                 }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 115bc05e42b0..61b16c641ce0 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1947,7 +1947,7 @@ static int btrfs_writepage_end_io_hook(struct page *page, u64 start, u64 end,
  * extent_io.c will try to find good copies for us.
  */
 static int btrfs_readpage_end_io_hook(struct page *page, u64 start, u64 end,
-                               struct extent_state *state)
+                               struct extent_state *state, int mirror)
 {
         size_t offset = start - ((u64)page->index << PAGE_CACHE_SHIFT);
         struct inode *inode = page->mapping->host;
@@ -4069,7 +4069,7 @@ static struct inode *new_simple_dir(struct super_block *s,
         BTRFS_I(inode)->dummy_inode = 1;
 
         inode->i_ino = BTRFS_EMPTY_SUBVOL_DIR_OBJECTID;
-        inode->i_op = &simple_dir_inode_operations;
+        inode->i_op = &btrfs_dir_ro_inode_operations;
         inode->i_fop = &simple_dir_operations;
         inode->i_mode = S_IFDIR | S_IRUGO | S_IWUSR | S_IXUGO;
         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
@@ -4140,14 +4140,18 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
 static int btrfs_dentry_delete(const struct dentry *dentry)
 {
         struct btrfs_root *root;
+        struct inode *inode = dentry->d_inode;
 
-        if (!dentry->d_inode && !IS_ROOT(dentry))
-                dentry = dentry->d_parent;
+        if (!inode && !IS_ROOT(dentry))
+                inode = dentry->d_parent->d_inode;
 
-        if (dentry->d_inode) {
-                root = BTRFS_I(dentry->d_inode)->root;
+        if (inode) {
+                root = BTRFS_I(inode)->root;
                 if (btrfs_root_refs(&root->root_item) == 0)
                         return 1;
+
+                if (btrfs_ino(inode) == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID)
+                        return 1;
         }
         return 0;
 }
@@ -4188,7 +4192,6 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
         struct btrfs_path *path;
         struct list_head ins_list;
         struct list_head del_list;
-        struct qstr q;
         int ret;
         struct extent_buffer *leaf;
         int slot;
@@ -4279,7 +4282,6 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
 
                 while (di_cur < di_total) {
                         struct btrfs_key location;
-                        struct dentry *tmp;
 
                         if (verify_dir_item(root, leaf, di))
                                 break;
@@ -4300,35 +4302,15 @@ static int btrfs_real_readdir(struct file *filp, void *dirent,
                         d_type = btrfs_filetype_table[btrfs_dir_type(leaf, di)];
                         btrfs_dir_item_key_to_cpu(leaf, di, &location);
 
-                        q.name = name_ptr;
-                        q.len = name_len;
-                        q.hash = full_name_hash(q.name, q.len);
-                        tmp = d_lookup(filp->f_dentry, &q);
-                        if (!tmp) {
-                                struct btrfs_key *newkey;
-
-                                newkey = kzalloc(sizeof(struct btrfs_key),
-                                                 GFP_NOFS);
-                                if (!newkey)
-                                        goto no_dentry;
-                                tmp = d_alloc(filp->f_dentry, &q);
-                                if (!tmp) {
-                                        kfree(newkey);
-                                        dput(tmp);
-                                        goto no_dentry;
-                                }
-                                memcpy(newkey, &location,
-                                       sizeof(struct btrfs_key));
-                                tmp->d_fsdata = newkey;
-                                tmp->d_flags |= DCACHE_NEED_LOOKUP;
-                                d_rehash(tmp);
-                                dput(tmp);
-                        } else {
-                                dput(tmp);
-                        }
-no_dentry:
+
                         /* is this a reference to our own snapshot? If so
-                         * skip it
+                         * skip it.
+                         *
+                         * In contrast to old kernels, we insert the snapshot's
+                         * dir item and dir index after it has been created, so
+                         * we won't find a reference to our own snapshot. We
+                         * still keep the following code for backward
+                         * compatibility.
                          */
                         if (location.type == BTRFS_ROOT_ITEM_KEY &&
                             location.objectid == root->root_key.objectid) {
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 18cc23d164a8..14f8e1faa46e 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2262,7 +2262,10 @@ static long btrfs_ioctl_dev_info(struct btrfs_root *root, void __user *arg)
         di_args->bytes_used = dev->bytes_used;
         di_args->total_bytes = dev->total_bytes;
         memcpy(di_args->uuid, dev->uuid, sizeof(di_args->uuid));
-        strncpy(di_args->path, dev->name, sizeof(di_args->path));
+        if (dev->name)
+                strncpy(di_args->path, dev->name, sizeof(di_args->path));
+        else
+                di_args->path[0] = '\0';
 
 out:
         if (ret == 0 && copy_to_user(arg, di_args, sizeof(*di_args)))
diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
index dc5d33146fdb..ac5d01085884 100644
--- a/fs/btrfs/reada.c
+++ b/fs/btrfs/reada.c
@@ -250,14 +250,12 @@ static struct reada_zone *reada_find_zone(struct btrfs_fs_info *fs_info,
                                           struct btrfs_bio *bbio)
 {
         int ret;
-        int looped = 0;
         struct reada_zone *zone;
         struct btrfs_block_group_cache *cache = NULL;
         u64 start;
         u64 end;
         int i;
 
-again:
         zone = NULL;
         spin_lock(&fs_info->reada_lock);
         ret = radix_tree_gang_lookup(&dev->reada_zones, (void **)&zone,
@@ -274,9 +272,6 @@ again:
                 spin_unlock(&fs_info->reada_lock);
         }
 
-        if (looped)
-                return NULL;
-
         cache = btrfs_lookup_block_group(fs_info, logical);
         if (!cache)
                 return NULL;
@@ -307,13 +302,15 @@ again:
         ret = radix_tree_insert(&dev->reada_zones,
                                 (unsigned long)(zone->end >> PAGE_CACHE_SHIFT),
                                 zone);
-        spin_unlock(&fs_info->reada_lock);
 
-        if (ret) {
+        if (ret == -EEXIST) {
                 kfree(zone);
-                looped = 1;
-                goto again;
+                ret = radix_tree_gang_lookup(&dev->reada_zones, (void **)&zone,
+                                             logical >> PAGE_CACHE_SHIFT, 1);
+                if (ret == 1)
+                        kref_get(&zone->refcnt);
         }
+        spin_unlock(&fs_info->reada_lock);
 
         return zone;
 }
@@ -323,26 +320,26 @@ static struct reada_extent *reada_find_extent(struct btrfs_root *root,
                                               struct btrfs_key *top, int level)
 {
         int ret;
-        int looped = 0;
         struct reada_extent *re = NULL;
+        struct reada_extent *re_exist = NULL;
         struct btrfs_fs_info *fs_info = root->fs_info;
         struct btrfs_mapping_tree *map_tree = &fs_info->mapping_tree;
         struct btrfs_bio *bbio = NULL;
         struct btrfs_device *dev;
+        struct btrfs_device *prev_dev;
         u32 blocksize;
         u64 length;
         int nzones = 0;
         int i;
         unsigned long index = logical >> PAGE_CACHE_SHIFT;
 
-again:
         spin_lock(&fs_info->reada_lock);
         re = radix_tree_lookup(&fs_info->reada_tree, index);
         if (re)
                 kref_get(&re->refcnt);
         spin_unlock(&fs_info->reada_lock);
 
-        if (re || looped)
+        if (re)
                 return re;
 
         re = kzalloc(sizeof(*re), GFP_NOFS);
@@ -398,16 +395,31 @@ again:
         /* insert extent in reada_tree + all per-device trees, all or nothing */
         spin_lock(&fs_info->reada_lock);
         ret = radix_tree_insert(&fs_info->reada_tree, index, re);
+        if (ret == -EEXIST) {
+                re_exist = radix_tree_lookup(&fs_info->reada_tree, index);
+                BUG_ON(!re_exist);
+                kref_get(&re_exist->refcnt);
+                spin_unlock(&fs_info->reada_lock);
+                goto error;
+        }
         if (ret) {
                 spin_unlock(&fs_info->reada_lock);
-                if (ret != -ENOMEM) {
-                        /* someone inserted the extent in the meantime */
-                        looped = 1;
-                }
                 goto error;
         }
+        prev_dev = NULL;
         for (i = 0; i < nzones; ++i) {
                 dev = bbio->stripes[i].dev;
+                if (dev == prev_dev) {
+                        /*
+                         * in case of DUP, just add the first zone. As both
+                         * are on the same device, there's nothing to gain
+                         * from adding both.
+                         * Also, it wouldn't work, as the tree is per device
+                         * and adding would fail with EEXIST
+                         */
+                        continue;
+                }
+                prev_dev = dev;
                 ret = radix_tree_insert(&dev->reada_extents, index, re);
                 if (ret) {
                         while (--i >= 0) {
@@ -450,9 +462,7 @@ error:
         }
         kfree(bbio);
         kfree(re);
-        if (looped)
-                goto again;
-        return NULL;
+        return re_exist;
 }
 
 static void reada_kref_dummy(struct kref *kr)
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 017281dbb2a7..646ee21bb035 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1279,7 +1279,9 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
                 if (rb_node)
                         backref_tree_panic(rb_node, -EEXIST, node->bytenr);
         } else {
+                spin_lock(&root->fs_info->trans_lock);
                 list_del_init(&root->root_list);
+                spin_unlock(&root->fs_info->trans_lock);
                 kfree(node);
         }
         return 0;
@@ -3811,7 +3813,7 @@ restart:
 
                 ret = btrfs_block_rsv_check(rc->extent_root, rc->block_rsv, 5);
                 if (ret < 0) {
-                        if (ret != -EAGAIN) {
+                        if (ret != -ENOSPC) {
                                 err = ret;
                                 WARN_ON(1);
                                 break;
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index bc015f77f3ea..4f76fc3f8e89 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -1257,12 +1257,6 @@ static int scrub_checksum_data(struct scrub_block *sblock)
         if (memcmp(csum, on_disk_csum, sdev->csum_size))
                 fail = 1;
 
-        if (fail) {
-                spin_lock(&sdev->stat_lock);
-                ++sdev->stat.csum_errors;
-                spin_unlock(&sdev->stat_lock);
-        }
-
         return fail;
 }
 
@@ -1335,15 +1329,6 @@ static int scrub_checksum_tree_block(struct scrub_block *sblock)
         if (memcmp(calculated_csum, on_disk_csum, sdev->csum_size))
                 ++crc_fail;
 
-        if (crc_fail || fail) {
-                spin_lock(&sdev->stat_lock);
-                if (crc_fail)
-                        ++sdev->stat.csum_errors;
-                if (fail)
-                        ++sdev->stat.verify_errors;
-                spin_unlock(&sdev->stat_lock);
-        }
-
         return fail || crc_fail;
 }
 
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 8d5d380f7bdb..c5f8fca4195f 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -815,7 +815,6 @@ int btrfs_sync_fs(struct super_block *sb, int wait)
                 return 0;
         }
 
-        btrfs_start_delalloc_inodes(root, 0);
         btrfs_wait_ordered_extents(root, 0, 0);
 
         trans = btrfs_start_transaction(root, 0);
@@ -1148,13 +1147,15 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
                 if (ret)
                         goto restore;
         } else {
-                if (fs_info->fs_devices->rw_devices == 0)
+                if (fs_info->fs_devices->rw_devices == 0) {
                         ret = -EACCES;
                         goto restore;
+                }
 
-                if (btrfs_super_log_root(fs_info->super_copy) != 0)
+                if (btrfs_super_log_root(fs_info->super_copy) != 0) {
                         ret = -EINVAL;
                         goto restore;
+                }
 
                 ret = btrfs_cleanup_fs_roots(fs_info);
                 if (ret)
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 11b77a59db62..36422254ef67 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -73,8 +73,10 @@ loop:
 
         cur_trans = root->fs_info->running_transaction;
         if (cur_trans) {
-                if (cur_trans->aborted)
+                if (cur_trans->aborted) {
+                        spin_unlock(&root->fs_info->trans_lock);
                         return cur_trans->aborted;
+                }
                 atomic_inc(&cur_trans->use_count);
                 atomic_inc(&cur_trans->num_writers);
                 cur_trans->num_joined++;
@@ -1400,6 +1402,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
         ret = commit_fs_roots(trans, root);
         if (ret) {
                 mutex_unlock(&root->fs_info->tree_log_mutex);
+                mutex_unlock(&root->fs_info->reloc_mutex);
                 goto cleanup_transaction;
         }
 
@@ -1411,6 +1414,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
         ret = commit_cowonly_roots(trans, root);
         if (ret) {
                 mutex_unlock(&root->fs_info->tree_log_mutex);
+                mutex_unlock(&root->fs_info->reloc_mutex);
                 goto cleanup_transaction;
         }
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 759d02486d7c..1411b99555a4 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3324,12 +3324,14 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
         stripe_size = devices_info[ndevs-1].max_avail;
         num_stripes = ndevs * dev_stripes;
 
-        if (stripe_size * num_stripes > max_chunk_size * ncopies) {
+        if (stripe_size * ndevs > max_chunk_size * ncopies) {
                 stripe_size = max_chunk_size * ncopies;
-                do_div(stripe_size, num_stripes);
+                do_div(stripe_size, ndevs);
         }
 
         do_div(stripe_size, dev_stripes);
+
+        /* align to BTRFS_STRIPE_LEN */
         do_div(stripe_size, BTRFS_STRIPE_LEN);
         stripe_size *= BTRFS_STRIPE_LEN;
 
@@ -3805,10 +3807,11 @@ static int __btrfs_map_block(struct btrfs_mapping_tree *map_tree, int rw,
                 else if (mirror_num)
                         stripe_index += mirror_num - 1;
                 else {
+                        int old_stripe_index = stripe_index;
                         stripe_index = find_live_mirror(map, stripe_index,
                                               map->sub_stripes, stripe_index +
                                               current->pid % map->sub_stripes);
-                        mirror_num = stripe_index + 1;
+                        mirror_num = stripe_index - old_stripe_index + 1;
                 }
         } else {
                 /*
@@ -4350,8 +4353,10 @@ static int open_seed_devices(struct btrfs_root *root, u8 *fsid)
 
         ret = __btrfs_open_devices(fs_devices, FMODE_READ,
                                    root->fs_info->bdev_holder);
-        if (ret)
+        if (ret) {
+                free_fs_devices(fs_devices);
                 goto out;
+        }
 
         if (!fs_devices->seeding) {
                 __btrfs_close_devices(fs_devices);
diff --git a/fs/buffer.c b/fs/buffer.c
index 36d66653b931..351e18ea2e53 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -985,7 +985,6 @@ grow_dev_page(struct block_device *bdev, sector_t block,
         return page;
 
 failed:
-        BUG();
         unlock_page(page);
         page_cache_release(page);
         return NULL;
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index d34212822444..811245b1ff2e 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -370,13 +370,13 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
                                    (int)(srcaddr->sa_family));
         }
 
-        seq_printf(s, ",uid=%d", cifs_sb->mnt_uid);
+        seq_printf(s, ",uid=%u", cifs_sb->mnt_uid);
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_UID)
                 seq_printf(s, ",forceuid");
         else
                 seq_printf(s, ",noforceuid");
 
-        seq_printf(s, ",gid=%d", cifs_sb->mnt_gid);
+        seq_printf(s, ",gid=%u", cifs_sb->mnt_gid);
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID)
                 seq_printf(s, ",forcegid");
         else
@@ -434,9 +434,13 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
                 seq_printf(s, ",noperm");
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_STRICT_IO)
                 seq_printf(s, ",strictcache");
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_BACKUPUID)
+                seq_printf(s, ",backupuid=%u", cifs_sb->mnt_backupuid);
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_BACKUPGID)
+                seq_printf(s, ",backupgid=%u", cifs_sb->mnt_backupgid);
 
-        seq_printf(s, ",rsize=%d", cifs_sb->rsize);
-        seq_printf(s, ",wsize=%d", cifs_sb->wsize);
+        seq_printf(s, ",rsize=%u", cifs_sb->rsize);
+        seq_printf(s, ",wsize=%u", cifs_sb->wsize);
         /* convert actimeo and display it in seconds */
                 seq_printf(s, ",actimeo=%lu", cifs_sb->actimeo / HZ);
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index f31dc9ac37b7..f4d381e331ce 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -3228,10 +3228,6 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 
         cifs_sb->mnt_uid = pvolume_info->linux_uid;
         cifs_sb->mnt_gid = pvolume_info->linux_gid;
-        if (pvolume_info->backupuid_specified)
-                cifs_sb->mnt_backupuid = pvolume_info->backupuid;
-        if (pvolume_info->backupgid_specified)
-                cifs_sb->mnt_backupgid = pvolume_info->backupgid;
         cifs_sb->mnt_file_mode = pvolume_info->file_mode;
         cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
         cFYI(1, "file mode: 0x%hx  dir mode: 0x%hx",
@@ -3262,10 +3258,14 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_RWPIDFORWARD;
         if (pvolume_info->cifs_acl)
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_ACL;
-        if (pvolume_info->backupuid_specified)
+        if (pvolume_info->backupuid_specified) {
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_BACKUPUID;
-        if (pvolume_info->backupgid_specified)
+                cifs_sb->mnt_backupuid = pvolume_info->backupuid;
+        }
+        if (pvolume_info->backupgid_specified) {
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_CIFS_BACKUPGID;
+                cifs_sb->mnt_backupgid = pvolume_info->backupgid;
+        }
         if (pvolume_info->override_uid)
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
         if (pvolume_info->override_gid)
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index fae765dac934..81725e9286e9 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2178,7 +2178,7 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
         unsigned long nr_pages, i;
         size_t copied, len, cur_len;
         ssize_t total_written = 0;
-        loff_t offset = *poffset;
+        loff_t offset;
         struct iov_iter it;
         struct cifsFileInfo *open_file;
         struct cifs_tcon *tcon;
@@ -2200,6 +2200,7 @@ cifs_iovec_write(struct file *file, const struct iovec *iov,
         cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
         open_file = file->private_data;
         tcon = tlink_tcon(open_file->tlink);
+        offset = *poffset;
 
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_RWPIDFORWARD)
                 pid = open_file->pid;
diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
index fa5c07d51dcc..4c58d4a3adc4 100644
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@ -1737,6 +1737,18 @@ static int _can_be_granted(struct dlm_rsb *r, struct dlm_lkb *lkb, int now)
                 return 1;
 
         /*
+         * Even if the convert is compat with all granted locks,
+         * QUECVT forces it behind other locks on the convert queue.
+         */
+
+        if (now && conv && (lkb->lkb_exflags & DLM_LKF_QUECVT)) {
+                if (list_empty(&r->res_convertqueue))
+                        return 1;
+                else
+                        goto out;
+        }
+
+        /*
          * The NOORDER flag is set to avoid the standard vms rules on grant
          * order.
          */
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 739b0985b398..c0b3c70ee87a 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1663,8 +1663,10 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
         if (op == EPOLL_CTL_ADD) {
                 if (is_file_epoll(tfile)) {
                         error = -ELOOP;
-                        if (ep_loop_check(ep, tfile) != 0)
+                        if (ep_loop_check(ep, tfile) != 0) {
+                                clear_tfile_check_list();
                                 goto error_tgt_fput;
+                        }
                 } else
                         list_add(&tfile->f_tfile_llink, &tfile_check_list);
         }
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 6da193564e43..e1fb1d5de58e 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1597,7 +1597,9 @@ static int parse_options(char *options, struct super_block *sb,
                          unsigned int *journal_ioprio,
                          int is_remount)
 {
+#ifdef CONFIG_QUOTA
         struct ext4_sb_info *sbi = EXT4_SB(sb);
+#endif
         char *p;
         substring_t args[MAX_OPT_ARGS];
         int token;
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index f8411bd1b805..5f5e70e047dc 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -200,10 +200,11 @@ static int make_mode(const unsigned int lmstate)
         return -1;
 }
 
-static u32 make_flags(const u32 lkid, const unsigned int gfs_flags,
+static u32 make_flags(struct gfs2_glock *gl, const unsigned int gfs_flags,
                       const int req)
 {
         u32 lkf = DLM_LKF_VALBLK;
+        u32 lkid = gl->gl_lksb.sb_lkid;
 
         if (gfs_flags & LM_FLAG_TRY)
                 lkf |= DLM_LKF_NOQUEUE;
@@ -227,8 +228,11 @@ static u32 make_flags(const u32 lkid, const unsigned int gfs_flags,
                         BUG();
         }
 
-        if (lkid != 0) 
+        if (lkid != 0) {
                 lkf |= DLM_LKF_CONVERT;
+                if (test_bit(GLF_BLOCKING, &gl->gl_flags))
+                        lkf |= DLM_LKF_QUECVT;
+        }
 
         return lkf;
 }
@@ -250,7 +254,7 @@ static int gdlm_lock(struct gfs2_glock *gl, unsigned int req_state,
         char strname[GDLM_STRNAME_BYTES] = "";
 
         req = make_mode(req_state);
-        lkf = make_flags(gl->gl_lksb.sb_lkid, flags, req);
+        lkf = make_flags(gl, flags, req);
         gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT);
         gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
         if (gl->gl_lksb.sb_lkid) {
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 28cf06e4ec84..001ef01d2fe2 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -485,6 +485,7 @@ static struct inode *hugetlbfs_get_root(struct super_block *sb,
                 inode->i_fop = &simple_dir_operations;
                 /* directory inodes start off with i_nlink == 2 (for "." entry) */
                 inc_nlink(inode);
+                lockdep_annotate_inode_mutex_key(inode);
         }
         return inode;
 }
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 806525a7269c..840f70f50792 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -723,7 +723,7 @@ start_journal_io:
         if (commit_transaction->t_need_data_flush &&
             (journal->j_fs_dev != journal->j_dev) &&
             (journal->j_flags & JBD2_BARRIER))
-                blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+                blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
 
         /* Done it all: now write the commit record asynchronously. */
         if (JBD2_HAS_INCOMPAT_FEATURE(journal,
@@ -859,7 +859,7 @@ wait_for_iobuf:
         if (JBD2_HAS_INCOMPAT_FEATURE(journal,
                                       JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT) &&
             journal->j_flags & JBD2_BARRIER) {
-                blkdev_issue_flush(journal->j_dev, GFP_KERNEL, NULL);
+                blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL);
         }
 
         if (err)
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 4aaf0316d76a..8789210c6905 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1429,7 +1429,7 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
         }
 
         open_flags = nd->intent.open.flags;
-        attr.ia_valid = 0;
+        attr.ia_valid = ATTR_OPEN;
 
         ctx = create_nfs_open_context(dentry, open_flags);
         res = ERR_CAST(ctx);
@@ -1536,7 +1536,7 @@ static int nfs_open_revalidate(struct dentry *dentry, struct nameidata *nd)
         if (IS_ERR(ctx))
                 goto out;
 
-        attr.ia_valid = 0;
+        attr.ia_valid = ATTR_OPEN;
         if (openflags & O_TRUNC) {
                 attr.ia_valid |= ATTR_SIZE;
                 attr.ia_size = 0;
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 97ecc863dd76..b6db9e33fb7b 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -59,6 +59,7 @@ struct nfs_unique_id {
 
 #define NFS_SEQID_CONFIRMED 1
 struct nfs_seqid_counter {
+        ktime_t create_time;
         int owner_id;
         int flags;
         u32 counter;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f82bde005a82..60d5f4c26dda 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -838,7 +838,8 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
         p->o_arg.open_flags = flags;
         p->o_arg.fmode = fmode & (FMODE_READ|FMODE_WRITE);
         p->o_arg.clientid = server->nfs_client->cl_clientid;
-        p->o_arg.id = sp->so_seqid.owner_id;
+        p->o_arg.id.create_time = ktime_to_ns(sp->so_seqid.create_time);
+        p->o_arg.id.uniquifier = sp->so_seqid.owner_id;
         p->o_arg.name = &dentry->d_name;
         p->o_arg.server = server;
         p->o_arg.bitmask = server->attr_bitmask;
@@ -1466,8 +1467,7 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata)
                         goto unlock_no_action;
                 rcu_read_unlock();
         }
-        /* Update sequence id. */
-        data->o_arg.id = sp->so_seqid.owner_id;
+        /* Update client id. */
         data->o_arg.clientid = sp->so_server->nfs_client->cl_clientid;
         if (data->o_arg.claim == NFS4_OPEN_CLAIM_PREVIOUS) {
                 task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_NOATTR];
@@ -1954,10 +1954,19 @@ static int nfs4_do_setattr(struct inode *inode, struct rpc_cred *cred,
         };
         int err;
         do {
-                err = nfs4_handle_exception(server,
-                                _nfs4_do_setattr(inode, cred, fattr, sattr, state),
-                                &exception);
+                err = _nfs4_do_setattr(inode, cred, fattr, sattr, state);
+                switch (err) {
+                case -NFS4ERR_OPENMODE:
+                        if (state && !(state->state & FMODE_WRITE)) {
+                                err = -EBADF;
+                                if (sattr->ia_valid & ATTR_OPEN)
+                                        err = -EACCES;
+                                goto out;
+                        }
+                }
+                err = nfs4_handle_exception(server, err, &exception);
         } while (exception.retry);
+out:
         return err;
 }
 
@@ -4558,7 +4567,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
 static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
 {
         struct nfs_server *server = NFS_SERVER(state->inode);
-        struct nfs4_exception exception = { };
+        struct nfs4_exception exception = {
+                .inode = state->inode,
+        };
         int err;
 
         do {
@@ -4576,7 +4587,9 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request
 static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
 {
         struct nfs_server *server = NFS_SERVER(state->inode);
-        struct nfs4_exception exception = { };
+        struct nfs4_exception exception = {
+                .inode = state->inode,
+        };
         int err;
 
         err = nfs4_set_lock_state(state, request);
@@ -4676,6 +4689,7 @@ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *
 {
         struct nfs4_exception exception = {
                 .state = state,
+                .inode = state->inode,
         };
         int err;
 
@@ -4721,6 +4735,20 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
 
         if (state == NULL)
                 return -ENOLCK;
+        /*
+         * Don't rely on the VFS having checked the file open mode,
+         * since it won't do this for flock() locks.
+         */
+        switch (request->fl_type & (F_RDLCK|F_WRLCK|F_UNLCK)) {
+        case F_RDLCK:
+                if (!(filp->f_mode & FMODE_READ))
+                        return -EBADF;
+                break;
+        case F_WRLCK:
+                if (!(filp->f_mode & FMODE_WRITE))
+                        return -EBADF;
+        }
+
         do {
                 status = nfs4_proc_setlk(state, cmd, request);
                 if ((status != -EAGAIN) || IS_SETLK(cmd))
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 0f43414eb25a..7f0fcfc1fe9d 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -393,6 +393,7 @@ nfs4_remove_state_owner_locked(struct nfs4_state_owner *sp)
 static void
 nfs4_init_seqid_counter(struct nfs_seqid_counter *sc)
 {
+        sc->create_time = ktime_get();
         sc->flags = 0;
         sc->counter = 0;
         spin_lock_init(&sc->lock);
@@ -434,13 +435,17 @@ nfs4_alloc_state_owner(struct nfs_server *server,
 static void
 nfs4_drop_state_owner(struct nfs4_state_owner *sp)
 {
-        if (!RB_EMPTY_NODE(&sp->so_server_node)) {
+        struct rb_node *rb_node = &sp->so_server_node;
+
+        if (!RB_EMPTY_NODE(rb_node)) {
                 struct nfs_server *server = sp->so_server;
                 struct nfs_client *clp = server->nfs_client;
 
                 spin_lock(&clp->cl_lock);
-                rb_erase(&sp->so_server_node, &server->state_owners);
-                RB_CLEAR_NODE(&sp->so_server_node);
+                if (!RB_EMPTY_NODE(rb_node)) {
+                        rb_erase(rb_node, &server->state_owners);
+                        RB_CLEAR_NODE(rb_node);
+                }
                 spin_unlock(&clp->cl_lock);
         }
 }
@@ -516,6 +521,14 @@ out:
 /**
  * nfs4_put_state_owner - Release a nfs4_state_owner
  * @sp: state owner data to release
+ *
+ * Note that we keep released state owners on an LRU
+ * list.
+ * This caches valid state owners so that they can be
+ * reused, to avoid the OPEN_CONFIRM on minor version 0.
+ * It also pins the uniquifier of dropped state owners for
+ * a while, to ensure that those state owner names are
+ * never reused.
  */
 void nfs4_put_state_owner(struct nfs4_state_owner *sp)
 {
@@ -525,15 +538,9 @@ void nfs4_put_state_owner(struct nfs4_state_owner *sp)
         if (!atomic_dec_and_lock(&sp->so_count, &clp->cl_lock))
                 return;
 
-        if (!RB_EMPTY_NODE(&sp->so_server_node)) {
-                sp->so_expires = jiffies;
-                list_add_tail(&sp->so_lru, &server->state_owners_lru);
-                spin_unlock(&clp->cl_lock);
-        } else {
-                nfs4_remove_state_owner_locked(sp);
-                spin_unlock(&clp->cl_lock);
-                nfs4_free_state_owner(sp);
-        }
+        sp->so_expires = jiffies;
+        list_add_tail(&sp->so_lru, &server->state_owners_lru);
+        spin_unlock(&clp->cl_lock);
 }
 
 /**
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index c74fdb114b48..77fc5f959c4e 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -74,7 +74,7 @@ static int nfs4_stat_to_errno(int);
 /* lock,open owner id:
  * we currently use size 2 (u64) out of (NFS4_OPAQUE_LIMIT  >> 2)
  */
-#define open_owner_id_maxsz     (1 + 1 + 4)
+#define open_owner_id_maxsz     (1 + 2 + 1 + 1 + 2)
 #define lock_owner_id_maxsz     (1 + 1 + 4)
 #define decode_lockowner_maxsz  (1 + XDR_QUADLEN(IDMAP_NAMESZ))
 #define compound_encode_hdr_maxsz       (3 + (NFS4_MAXTAGLEN >> 2))
@@ -1340,12 +1340,13 @@ static inline void encode_openhdr(struct xdr_stream *xdr, const struct nfs_opena
  */
         encode_nfs4_seqid(xdr, arg->seqid);
         encode_share_access(xdr, arg->fmode);
-        p = reserve_space(xdr, 32);
+        p = reserve_space(xdr, 36);
         p = xdr_encode_hyper(p, arg->clientid);
-        *p++ = cpu_to_be32(20);
+        *p++ = cpu_to_be32(24);
         p = xdr_encode_opaque_fixed(p, "open id:", 8);
         *p++ = cpu_to_be32(arg->server->s_dev);
-        xdr_encode_hyper(p, arg->id);
+        *p++ = cpu_to_be32(arg->id.uniquifier);
+        xdr_encode_hyper(p, arg->id.create_time);
 }
 
 static inline void encode_createmode(struct xdr_stream *xdr, const struct nfs_openargs *arg)
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 9a0e8ef4a409..0a4be28c2ea3 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -322,7 +322,7 @@ out_bad:
         while (!list_empty(res)) {
                 data = list_entry(res->next, struct nfs_read_data, list);
                 list_del(&data->list);
-                nfs_readdata_free(data);
+                nfs_readdata_release(data);
         }
         nfs_readpage_release(req);
         return -ENOMEM;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 37412f706b32..1e6715f0616c 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2767,11 +2767,15 @@ static struct vfsmount *nfs_do_root_mount(struct file_system_type *fs_type,
         char *root_devname;
         size_t len;
 
-        len = strlen(hostname) + 3;
+        len = strlen(hostname) + 5;
         root_devname = kmalloc(len, GFP_KERNEL);
         if (root_devname == NULL)
                 return ERR_PTR(-ENOMEM);
-        snprintf(root_devname, len, "%s:/", hostname);
+        /* Does hostname needs to be enclosed in brackets? */
+        if (strchr(hostname, ':'))
+                snprintf(root_devname, len, "[%s]:/", hostname);
+        else
+                snprintf(root_devname, len, "%s:/", hostname);
         root_mnt = vfs_kern_mount(fs_type, flags, root_devname, data);
         kfree(root_devname);
         return root_mnt;
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 2c68818f68ac..c07462320f6b 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -682,7 +682,8 @@ static struct nfs_page *nfs_try_to_update_request(struct inode *inode,
                 req->wb_bytes = rqend - req->wb_offset;
 out_unlock:
         spin_unlock(&inode->i_lock);
-        nfs_clear_request_commit(req);
+        if (req)
+                nfs_clear_request_commit(req);
         return req;
 out_flushme:
         spin_unlock(&inode->i_lock);
@@ -1018,7 +1019,7 @@ out_bad:
         while (!list_empty(res)) {
                 data = list_entry(res->next, struct nfs_write_data, list);
                 list_del(&data->list);
-                nfs_writedata_free(data);
+                nfs_writedata_release(data);
         }
         nfs_redirty_request(req);
         return -ENOMEM;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 2b9a7607cbd5..2d60492d6df8 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -597,9 +597,6 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
                 if (!page)
                         continue;
 
-                if (PageReserved(page))
-                        continue;
-
                 /* Clear accessed and referenced bits. */
                 ptep_test_and_clear_young(vma, addr, pte);
                 ClearPageReferenced(page);