20 files changed, 84 insertions, 69 deletions

diff --git a/fs/bio.c b/fs/bio.c
index 5eaa70c9d96e..71072ab99128 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -73,7 +73,7 @@ static struct kmem_cache *bio_find_or_create_slab(unsigned int extra_size)
 {
         unsigned int sz = sizeof(struct bio) + extra_size;
         struct kmem_cache *slab = NULL;
-        struct bio_slab *bslab;
+        struct bio_slab *bslab, *new_bio_slabs;
         unsigned int i, entry = -1;
 
         mutex_lock(&bio_slab_lock);
@@ -97,11 +97,12 @@ static struct kmem_cache *bio_find_or_create_slab(unsigned int extra_size)
 
         if (bio_slab_nr == bio_slab_max && entry == -1) {
                 bio_slab_max <<= 1;
-                bio_slabs = krealloc(bio_slabs,
-                                     bio_slab_max * sizeof(struct bio_slab),
-                                     GFP_KERNEL);
-                if (!bio_slabs)
+                new_bio_slabs = krealloc(bio_slabs,
+                                         bio_slab_max * sizeof(struct bio_slab),
+                                         GFP_KERNEL);
+                if (!new_bio_slabs)
                         goto out_unlock;
+                bio_slabs = new_bio_slabs;
         }
         if (entry == -1)
                 entry = bio_slab_nr++;
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 1e519195d45b..38e721b35d45 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1578,10 +1578,12 @@ ssize_t blkdev_aio_write(struct kiocb *iocb, const struct iovec *iov,
                          unsigned long nr_segs, loff_t pos)
 {
         struct file *file = iocb->ki_filp;
+        struct blk_plug plug;
         ssize_t ret;
 
         BUG_ON(iocb->ki_pos != pos);
 
+        blk_start_plug(&plug);
         ret = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos);
         if (ret > 0 || ret == -EIOCBQUEUED) {
                 ssize_t err;
@@ -1590,6 +1592,7 @@ ssize_t blkdev_aio_write(struct kiocb *iocb, const struct iovec *iov,
                 if (err < 0 && ret > 0)
                         ret = err;
         }
+        blk_finish_plug(&plug);
         return ret;
 }
 EXPORT_SYMBOL_GPL(blkdev_aio_write);
diff --git a/fs/buffer.c b/fs/buffer.c
index 9f6d2e41281d..58e2e7b77372 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -914,7 +914,7 @@ link_dev_buffers(struct page *page, struct buffer_head *head)
 /*
  * Initialise the state of a blockdev page's buffers.
  */ 
-static void
+static sector_t
 init_page_buffers(struct page *page, struct block_device *bdev,
                         sector_t block, int size)
 {
@@ -936,33 +936,41 @@ init_page_buffers(struct page *page, struct block_device *bdev,
                 block++;
                 bh = bh->b_this_page;
         } while (bh != head);
+
+        /*
+         * Caller needs to validate requested block against end of device.
+         */
+        return end_block;
 }
 
 /*
  * Create the page-cache page that contains the requested block.
  *
- * This is user purely for blockdev mappings.
+ * This is used purely for blockdev mappings.
  */
-static struct page *
+static int
 grow_dev_page(struct block_device *bdev, sector_t block,
-                pgoff_t index, int size)
+                pgoff_t index, int size, int sizebits)
 {
         struct inode *inode = bdev->bd_inode;
         struct page *page;
         struct buffer_head *bh;
+        sector_t end_block;
+        int ret = 0;            /* Will call free_more_memory() */
 
         page = find_or_create_page(inode->i_mapping, index,
                 (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS)|__GFP_MOVABLE);
         if (!page)
-                return NULL;
+                return ret;
 
         BUG_ON(!PageLocked(page));
 
         if (page_has_buffers(page)) {
                 bh = page_buffers(page);
                 if (bh->b_size == size) {
-                        init_page_buffers(page, bdev, block, size);
-                        return page;
+                        end_block = init_page_buffers(page, bdev,
+                                                index << sizebits, size);
+                        goto done;
                 }
                 if (!try_to_free_buffers(page))
                         goto failed;
@@ -982,14 +990,14 @@ grow_dev_page(struct block_device *bdev, sector_t block,
          */
         spin_lock(&inode->i_mapping->private_lock);
         link_dev_buffers(page, bh);
-        init_page_buffers(page, bdev, block, size);
+        end_block = init_page_buffers(page, bdev, index << sizebits, size);
         spin_unlock(&inode->i_mapping->private_lock);
-        return page;
-
+done:
+        ret = (block < end_block) ? 1 : -ENXIO;
 failed:
         unlock_page(page);
         page_cache_release(page);
-        return NULL;
+        return ret;
 }
 
 /*
@@ -999,7 +1007,6 @@ failed:
 static int
 grow_buffers(struct block_device *bdev, sector_t block, int size)
 {
-        struct page *page;
         pgoff_t index;
         int sizebits;
 
@@ -1023,22 +1030,14 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
                         bdevname(bdev, b));
                 return -EIO;
         }
-        block = index << sizebits;
+
         /* Create a page with the proper size buffers.. */
-        page = grow_dev_page(bdev, block, index, size);
-        if (!page)
-                return 0;
-        unlock_page(page);
-        page_cache_release(page);
-        return 1;
+        return grow_dev_page(bdev, block, index, size, sizebits);
 }
 
 static struct buffer_head *
 __getblk_slow(struct block_device *bdev, sector_t block, int size)
 {
-        int ret;
-        struct buffer_head *bh;
-
         /* Size must be multiple of hard sectorsize */
         if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
                         (size < 512 || size > PAGE_SIZE))) {
@@ -1051,21 +1050,20 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
                 return NULL;
         }
 
-retry:
-        bh = __find_get_block(bdev, block, size);
-        if (bh)
-                return bh;
+        for (;;) {
+                struct buffer_head *bh;
+                int ret;
 
-        ret = grow_buffers(bdev, block, size);
-        if (ret == 0) {
-                free_more_memory();
-                goto retry;
-        } else if (ret > 0) {
                 bh = __find_get_block(bdev, block, size);
                 if (bh)
                         return bh;
+
+                ret = grow_buffers(bdev, block, size);
+                if (ret < 0)
+                        return NULL;
+                if (ret == 0)
+                        free_more_memory();
         }
-        return NULL;
 }
 
 /*
@@ -1321,10 +1319,6 @@ EXPORT_SYMBOL(__find_get_block);
  * which corresponds to the passed block_device, block and size. The
  * returned buffer has its reference count incremented.
  *
- * __getblk() cannot fail - it just keeps trying.  If you pass it an
- * illegal block number, __getblk() will happily return a buffer_head
- * which represents the non-existent block.  Very weird.
- *
  * __getblk() will lock up the machine if grow_dev_page's try_to_free_buffers()
  * attempt is failing.  FIXME, perhaps?
  */
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 1faf4cb56f39..f86c720dba0e 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -1062,6 +1062,7 @@ do_blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
         unsigned long user_addr;
         size_t bytes;
         struct buffer_head map_bh = { 0, };
+        struct blk_plug plug;
 
         if (rw & WRITE)
                 rw = WRITE_ODIRECT;
@@ -1177,6 +1178,8 @@ do_blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
                                 PAGE_SIZE - user_addr / PAGE_SIZE);
         }
 
+        blk_start_plug(&plug);
+
         for (seg = 0; seg < nr_segs; seg++) {
                 user_addr = (unsigned long)iov[seg].iov_base;
                 sdio.size += bytes = iov[seg].iov_len;
@@ -1235,6 +1238,8 @@ do_blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
         if (sdio.bio)
                 dio_bio_submit(dio, &sdio);
 
+        blk_finish_plug(&plug);
+
         /*
          * It is possible that, we return short IO due to end of file.
          * In that case, we need to release all the pages we got hold on.
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 09357508ec9a..a2862339323b 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -1113,6 +1113,11 @@ static void mark_journal_empty(journal_t *journal)
 
         BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
         spin_lock(&journal->j_state_lock);
+        /* Is it already empty? */
+        if (sb->s_start == 0) {
+                spin_unlock(&journal->j_state_lock);
+                return;
+        }
         jbd_debug(1, "JBD: Marking journal as empty (seq %d)\n",
                   journal->j_tail_sequence);
 
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index cbaf4f8bb7b7..4c7bd35b1876 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -651,12 +651,12 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c
 
         if (clp->cl_minorversion == 0) {
                 if (!clp->cl_cred.cr_principal &&
-                                (clp->cl_flavor >= RPC_AUTH_GSS_KRB5))
+                                (clp->cl_cred.cr_flavor >= RPC_AUTH_GSS_KRB5))
                         return -EINVAL;
                 args.client_name = clp->cl_cred.cr_principal;
                 args.prognumber = conn->cb_prog,
                 args.protocol = XPRT_TRANSPORT_TCP;
-                args.authflavor = clp->cl_flavor;
+                args.authflavor = clp->cl_cred.cr_flavor;
                 clp->cl_cb_ident = conn->cb_ident;
         } else {
                 if (!conn->cb_xprt)
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index e6173147f982..22bd0a66c356 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -231,7 +231,6 @@ struct nfs4_client {
         nfs4_verifier           cl_verifier;    /* generated by client */
         time_t                  cl_time;        /* time of last lease renewal */
         struct sockaddr_storage cl_addr;        /* client ipaddress */
-        u32                     cl_flavor;      /* setclientid pseudoflavor */
         struct svc_cred         cl_cred;        /* setclientid principal */
         clientid_t              cl_clientid;    /* generated by server */
         nfs4_verifier           cl_confirm;     /* generated by server */
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 36a29b753c79..c495a3055e2a 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1589,10 +1589,10 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
                 goto out;
         }
 
-        down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
         for (cnt = 0; cnt < MAXQUOTAS; cnt++)
                 warn[cnt].w_type = QUOTA_NL_NOWARN;
 
+        down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
         spin_lock(&dq_data_lock);
         for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
                 if (!dquots[cnt])
diff --git a/fs/reiserfs/bitmap.c b/fs/reiserfs/bitmap.c
index 4c0c7d163d15..a98b7740a0fc 100644
--- a/fs/reiserfs/bitmap.c
+++ b/fs/reiserfs/bitmap.c
@@ -1334,9 +1334,7 @@ struct buffer_head *reiserfs_read_bitmap_block(struct super_block *sb,
         else if (bitmap == 0)
                 block = (REISERFS_DISK_OFFSET_IN_BYTES >> sb->s_blocksize_bits) + 1;
 
-        reiserfs_write_unlock(sb);
         bh = sb_bread(sb, block);
-        reiserfs_write_lock(sb);
         if (bh == NULL)
                 reiserfs_warning(sb, "sh-2029: %s: bitmap block (#%u) "
                                  "reading failed", __func__, block);
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index a6d4268fb6c1..855da58db145 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -76,10 +76,10 @@ void reiserfs_evict_inode(struct inode *inode)
                 ;
         }
       out:
+        reiserfs_write_unlock_once(inode->i_sb, depth);
         clear_inode(inode);     /* note this must go after the journal_end to prevent deadlock */
         dquot_drop(inode);
         inode->i_blocks = 0;
-        reiserfs_write_unlock_once(inode->i_sb, depth);
         return;
 
 no_delete:
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index 8b8cc4e945f4..760de723dadb 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -167,7 +167,7 @@ struct ubifs_global_debug_info {
 #define ubifs_dbg_msg(type, fmt, ...) \
         pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__)
 
-#define DBG_KEY_BUF_LEN 32
+#define DBG_KEY_BUF_LEN 48
 #define ubifs_dbg_msg_key(type, key, fmt, ...) do {                            \
         char __tmp_key_buf[DBG_KEY_BUF_LEN];                                   \
         pr_debug("UBIFS DBG " type ": " fmt "%s\n", ##__VA_ARGS__,             \
diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index ce33b2beb151..8640920766ed 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -1749,7 +1749,10 @@ int ubifs_lpt_init(struct ubifs_info *c, int rd, int wr)
         return 0;
 
 out_err:
-        ubifs_lpt_free(c, 0);
+        if (wr)
+                ubifs_lpt_free(c, 1);
+        if (rd)
+                ubifs_lpt_free(c, 0);
         return err;
 }
 
diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
index c30d976b4be8..edeec499c048 100644
--- a/fs/ubifs/recovery.c
+++ b/fs/ubifs/recovery.c
@@ -788,7 +788,7 @@ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
 
 corrupted_rescan:
         /* Re-scan the corrupted data with verbose messages */
-        ubifs_err("corruptio %d", ret);
+        ubifs_err("corruption %d", ret);
         ubifs_scan_a_node(c, buf, len, lnum, offs, 1);
 corrupted:
         ubifs_scanned_corruption(c, lnum, offs, buf);
diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
index eba46d4a7619..94d78fc5d4e0 100644
--- a/fs/ubifs/replay.c
+++ b/fs/ubifs/replay.c
@@ -1026,7 +1026,6 @@ int ubifs_replay_journal(struct ubifs_info *c)
         c->replaying = 1;
         lnum = c->ltail_lnum = c->lhead_lnum;
 
-        lnum = UBIFS_LOG_LNUM;
         do {
                 err = replay_log_leb(c, lnum, 0, c->sbuf);
                 if (err == 1)
@@ -1035,7 +1034,7 @@ int ubifs_replay_journal(struct ubifs_info *c)
                 if (err)
                         goto out;
                 lnum = ubifs_next_log_lnum(c, lnum);
-        } while (lnum != UBIFS_LOG_LNUM);
+        } while (lnum != c->ltail_lnum);
 
         err = replay_buds(c);
         if (err)
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index c3fa6c5327a3..71a197f0f93d 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1157,9 +1157,6 @@ static int check_free_space(struct ubifs_info *c)
  *
  * This function mounts UBIFS file system. Returns zero in case of success and
  * a negative error code in case of failure.
- *
- * Note, the function does not de-allocate resources it it fails half way
- * through, and the caller has to do this instead.
  */
 static int mount_ubifs(struct ubifs_info *c)
 {
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index fafaad795cd6..aa233469b3c1 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1124,14 +1124,17 @@ int udf_setsize(struct inode *inode, loff_t newsize)
                                 if (err)
                                         return err;
                                 down_write(&iinfo->i_data_sem);
-                        } else
+                        } else {
                                 iinfo->i_lenAlloc = newsize;
+                                goto set_size;
+                        }
                 }
                 err = udf_extend_file(inode, newsize);
                 if (err) {
                         up_write(&iinfo->i_data_sem);
                         return err;
                 }
+set_size:
                 truncate_setsize(inode, newsize);
                 up_write(&iinfo->i_data_sem);
         } else {
diff --git a/fs/udf/super.c b/fs/udf/super.c
index dcbf98722afc..18fc038a438d 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1344,6 +1344,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                 udf_err(sb, "error loading logical volume descriptor: "
                         "Partition table too long (%u > %lu)\n", table_len,
                         sb->s_blocksize - sizeof(*lvd));
+                ret = 1;
                 goto out_bh;
         }
 
@@ -1388,8 +1389,10 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                                                 UDF_ID_SPARABLE,
                                                 strlen(UDF_ID_SPARABLE))) {
                                 if (udf_load_sparable_map(sb, map,
-                                    (struct sparablePartitionMap *)gpm) < 0)
+                                    (struct sparablePartitionMap *)gpm) < 0) {
+                                        ret = 1;
                                         goto out_bh;
+                                }
                         } else if (!strncmp(upm2->partIdent.ident,
                                                 UDF_ID_METADATA,
                                                 strlen(UDF_ID_METADATA))) {
@@ -2000,6 +2003,8 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
                         if (!silent)
                                 pr_notice("Rescanning with blocksize %d\n",
                                           UDF_DEFAULT_BLOCKSIZE);
+                        brelse(sbi->s_lvid_bh);
+                        sbi->s_lvid_bh = NULL;
                         uopt.blocksize = UDF_DEFAULT_BLOCKSIZE;
                         ret = udf_load_vrs(sb, &uopt, silent, &fileset);
                 }
diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
index f9c3fe304a17..69cf4fcde03e 100644
--- a/fs/xfs/xfs_discard.c
+++ b/fs/xfs/xfs_discard.c
@@ -179,12 +179,14 @@ xfs_ioc_trim(
          * used by the fstrim application.  In the end it really doesn't
          * matter as trimming blocks is an advisory interface.
          */
+        if (range.start >= XFS_FSB_TO_B(mp, mp->m_sb.sb_dblocks) ||
+            range.minlen > XFS_FSB_TO_B(mp, XFS_ALLOC_AG_MAX_USABLE(mp)))
+                return -XFS_ERROR(EINVAL);
+
         start = BTOBB(range.start);
         end = start + BTOBBT(range.len) - 1;
         minlen = BTOBB(max_t(u64, granularity, range.minlen));
 
-        if (XFS_BB_TO_FSB(mp, start) >= mp->m_sb.sb_dblocks)
-                return -XFS_ERROR(EINVAL);
         if (end > XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks) - 1)
                 end = XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks)- 1;
 
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index 21e37b55f7e5..5aceb3f8ecd6 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -962,23 +962,22 @@ xfs_dialloc(
                 if (!pag->pagi_freecount && !okalloc)
                         goto nextag;
 
+                /*
+                 * Then read in the AGI buffer and recheck with the AGI buffer
+                 * lock held.
+                 */
                 error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
                 if (error)
                         goto out_error;
 
-                /*
-                 * Once the AGI has been read in we have to recheck
-                 * pagi_freecount with the AGI buffer lock held.
-                 */
                 if (pag->pagi_freecount) {
                         xfs_perag_put(pag);
                         goto out_alloc;
                 }
 
-                if (!okalloc) {
-                        xfs_trans_brelse(tp, agbp);
-                        goto nextag;
-                }
+                if (!okalloc)
+                        goto nextag_relse_buffer;
+
 
                 error = xfs_ialloc_ag_alloc(tp, agbp, &ialloced);
                 if (error) {
@@ -1007,6 +1006,8 @@ xfs_dialloc(
                         return 0;
                 }
 
+nextag_relse_buffer:
+                xfs_trans_brelse(tp, agbp);
 nextag:
                 xfs_perag_put(pag);
                 if (++agno == mp->m_sb.sb_agcount)
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 92d4331cd4f1..ca28a4ba4b54 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -857,7 +857,7 @@ xfs_rtbuf_get(
         xfs_buf_t       *bp;            /* block buffer, result */
         xfs_inode_t     *ip;            /* bitmap or summary inode */
         xfs_bmbt_irec_t map;
-        int             nmap;
+        int             nmap = 1;
         int             error;          /* error value */
 
         ip = issum ? mp->m_rsumip : mp->m_rbmip;