28 files changed, 325 insertions, 127 deletions

diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index e238a0cdac67..94627c4cc193 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2977,10 +2977,10 @@ static int maybe_allocate_chunk(struct btrfs_root *root,
 
         free_space = btrfs_super_total_bytes(disk_super);
         /*
-         * we allow the metadata to grow to a max of either 5gb or 5% of the
+         * we allow the metadata to grow to a max of either 10gb or 5% of the
          * space in the volume.
          */
-        min_metadata = min((u64)5 * 1024 * 1024 * 1024,
+        min_metadata = min((u64)10 * 1024 * 1024 * 1024,
                              div64_u64(free_space * 5, 100));
         if (info->total_bytes >= min_metadata) {
                 spin_unlock(&info->lock);
@@ -4102,7 +4102,7 @@ wait_block_group_cache_done(struct btrfs_block_group_cache *cache)
 }
 
 enum btrfs_loop_type {
-        LOOP_CACHED_ONLY = 0,
+        LOOP_FIND_IDEAL = 0,
         LOOP_CACHING_NOWAIT = 1,
         LOOP_CACHING_WAIT = 2,
         LOOP_ALLOC_CHUNK = 3,
@@ -4131,12 +4131,15 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
         struct btrfs_block_group_cache *block_group = NULL;
         int empty_cluster = 2 * 1024 * 1024;
         int allowed_chunk_alloc = 0;
+        int done_chunk_alloc = 0;
         struct btrfs_space_info *space_info;
         int last_ptr_loop = 0;
         int loop = 0;
         bool found_uncached_bg = false;
         bool failed_cluster_refill = false;
         bool failed_alloc = false;
+        u64 ideal_cache_percent = 0;
+        u64 ideal_cache_offset = 0;
 
         WARN_ON(num_bytes < root->sectorsize);
         btrfs_set_key_type(ins, BTRFS_EXTENT_ITEM_KEY);
@@ -4172,14 +4175,19 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
                 empty_cluster = 0;
 
         if (search_start == hint_byte) {
+ideal_cache:
                 block_group = btrfs_lookup_block_group(root->fs_info,
                                                        search_start);
                 /*
                  * we don't want to use the block group if it doesn't match our
                  * allocation bits, or if its not cached.
+                 *
+                 * However if we are re-searching with an ideal block group
+                 * picked out then we don't care that the block group is cached.
                  */
                 if (block_group && block_group_bits(block_group, data) &&
-                    block_group_cache_done(block_group)) {
+                    (block_group->cached != BTRFS_CACHE_NO ||
+                     search_start == ideal_cache_offset)) {
                         down_read(&space_info->groups_sem);
                         if (list_empty(&block_group->list) ||
                             block_group->ro) {
@@ -4191,13 +4199,13 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
                                  */
                                 btrfs_put_block_group(block_group);
                                 up_read(&space_info->groups_sem);
-                        } else
+                        } else {
                                 goto have_block_group;
+                        }
                 } else if (block_group) {
                         btrfs_put_block_group(block_group);
                 }
         }
-
 search:
         down_read(&space_info->groups_sem);
         list_for_each_entry(block_group, &space_info->block_groups, list) {
@@ -4209,28 +4217,45 @@ search:
 
 have_block_group:
                 if (unlikely(block_group->cached == BTRFS_CACHE_NO)) {
+                        u64 free_percent;
+
+                        free_percent = btrfs_block_group_used(&block_group->item);
+                        free_percent *= 100;
+                        free_percent = div64_u64(free_percent,
+                                                 block_group->key.offset);
+                        free_percent = 100 - free_percent;
+                        if (free_percent > ideal_cache_percent &&
+                            likely(!block_group->ro)) {
+                                ideal_cache_offset = block_group->key.objectid;
+                                ideal_cache_percent = free_percent;
+                        }
+
                         /*
-                         * we want to start caching kthreads, but not too many
-                         * right off the bat so we don't overwhelm the system,
-                         * so only start them if there are less than 2 and we're
-                         * in the initial allocation phase.
+                         * We only want to start kthread caching if we are at
+                         * the point where we will wait for caching to make
+                         * progress, or if our ideal search is over and we've
+                         * found somebody to start caching.
                          */
                         if (loop > LOOP_CACHING_NOWAIT ||
-                            atomic_read(&space_info->caching_threads) < 2) {
+                            (loop > LOOP_FIND_IDEAL &&
+                             atomic_read(&space_info->caching_threads) < 2)) {
                                 ret = cache_block_group(block_group);
                                 BUG_ON(ret);
                         }
-                }
-
-                cached = block_group_cache_done(block_group);
-                if (unlikely(!cached)) {
                         found_uncached_bg = true;
 
-                        /* if we only want cached bgs, loop */
-                        if (loop == LOOP_CACHED_ONLY)
+                        /*
+                         * If loop is set for cached only, try the next block
+                         * group.
+                         */
+                        if (loop == LOOP_FIND_IDEAL)
                                 goto loop;
                 }
 
+                cached = block_group_cache_done(block_group);
+                if (unlikely(!cached))
+                        found_uncached_bg = true;
+
                 if (unlikely(block_group->ro))
                         goto loop;
 
@@ -4410,9 +4435,11 @@ loop:
         }
         up_read(&space_info->groups_sem);
 
-        /* LOOP_CACHED_ONLY, only search fully cached block groups
-         * LOOP_CACHING_NOWAIT, search partially cached block groups, but
-         *                      dont wait foR them to finish caching
+        /* LOOP_FIND_IDEAL, only search caching/cached bg's, and don't wait for
+         *                      for them to make caching progress.  Also
+         *                      determine the best possible bg to cache
+         * LOOP_CACHING_NOWAIT, search partially cached block groups, kicking
+         *                      caching kthreads as we move along
          * LOOP_CACHING_WAIT, search everything, and wait if our bg is caching
          * LOOP_ALLOC_CHUNK, force a chunk allocation and try again
          * LOOP_NO_EMPTY_SIZE, set empty_size and empty_cluster to 0 and try
@@ -4421,12 +4448,47 @@ loop:
         if (!ins->objectid && loop < LOOP_NO_EMPTY_SIZE &&
             (found_uncached_bg || empty_size || empty_cluster ||
              allowed_chunk_alloc)) {
-                if (found_uncached_bg) {
+                if (loop == LOOP_FIND_IDEAL && found_uncached_bg) {
                         found_uncached_bg = false;
-                        if (loop < LOOP_CACHING_WAIT) {
-                                loop++;
+                        loop++;
+                        if (!ideal_cache_percent &&
+                            atomic_read(&space_info->caching_threads))
                                 goto search;
-                        }
+
+                        /*
+                         * 1 of the following 2 things have happened so far
+                         *
+                         * 1) We found an ideal block group for caching that
+                         * is mostly full and will cache quickly, so we might
+                         * as well wait for it.
+                         *
+                         * 2) We searched for cached only and we didn't find
+                         * anything, and we didn't start any caching kthreads
+                         * either, so chances are we will loop through and
+                         * start a couple caching kthreads, and then come back
+                         * around and just wait for them.  This will be slower
+                         * because we will have 2 caching kthreads reading at
+                         * the same time when we could have just started one
+                         * and waited for it to get far enough to give us an
+                         * allocation, so go ahead and go to the wait caching
+                         * loop.
+                         */
+                        loop = LOOP_CACHING_WAIT;
+                        search_start = ideal_cache_offset;
+                        ideal_cache_percent = 0;
+                        goto ideal_cache;
+                } else if (loop == LOOP_FIND_IDEAL) {
+                        /*
+                         * Didn't find a uncached bg, wait on anything we find
+                         * next.
+                         */
+                        loop = LOOP_CACHING_WAIT;
+                        goto search;
+                }
+
+                if (loop < LOOP_CACHING_WAIT) {
+                        loop++;
+                        goto search;
                 }
 
                 if (loop == LOOP_ALLOC_CHUNK) {
@@ -4438,7 +4500,8 @@ loop:
                         ret = do_chunk_alloc(trans, root, num_bytes +
                                              2 * 1024 * 1024, data, 1);
                         allowed_chunk_alloc = 0;
-                } else {
+                        done_chunk_alloc = 1;
+                } else if (!done_chunk_alloc) {
                         space_info->force_alloc = 1;
                 }
 
diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 2c726b7b9faa..ccbdcb54ec5d 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -208,7 +208,7 @@ int unpin_extent_cache(struct extent_map_tree *tree, u64 start, u64 len)
         write_lock(&tree->lock);
         em = lookup_extent_mapping(tree, start, len);
 
-        WARN_ON(em->start != start || !em);
+        WARN_ON(!em || em->start != start);
 
         if (!em)
                 goto out;
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 5c2caad76212..cb2849f03251 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1296,7 +1296,7 @@ again:
                         window_start = entry->offset;
                         window_free = entry->bytes;
                         last = entry;
-                        max_extent = 0;
+                        max_extent = entry->bytes;
                 } else {
                         last = next;
                         window_free += next->bytes;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index dae12dc7e159..b3ad168a0bfc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -538,7 +538,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
         struct extent_io_tree *io_tree;
-        int ret;
+        int ret = 0;
 
         if (list_empty(&async_cow->extents))
                 return 0;
@@ -552,6 +552,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
 
                 io_tree = &BTRFS_I(inode)->io_tree;
 
+retry:
                 /* did the compression code fall back to uncompressed IO? */
                 if (!async_extent->pages) {
                         int page_started = 0;
@@ -562,11 +563,11 @@ static noinline int submit_compressed_extents(struct inode *inode,
                                     async_extent->ram_size - 1, GFP_NOFS);
 
                         /* allocate blocks */
-                        cow_file_range(inode, async_cow->locked_page,
-                                       async_extent->start,
-                                       async_extent->start +
-                                       async_extent->ram_size - 1,
-                                       &page_started, &nr_written, 0);
+                        ret = cow_file_range(inode, async_cow->locked_page,
+                                             async_extent->start,
+                                             async_extent->start +
+                                             async_extent->ram_size - 1,
+                                             &page_started, &nr_written, 0);
 
                         /*
                          * if page_started, cow_file_range inserted an
@@ -574,7 +575,7 @@ static noinline int submit_compressed_extents(struct inode *inode,
                          * and IO for us.  Otherwise, we need to submit
                          * all those pages down to the drive.
                          */
-                        if (!page_started)
+                        if (!page_started && !ret)
                                 extent_write_locked_range(io_tree,
                                                   inode, async_extent->start,
                                                   async_extent->start +
@@ -602,7 +603,21 @@ static noinline int submit_compressed_extents(struct inode *inode,
                                            async_extent->compressed_size,
                                            0, alloc_hint,
                                            (u64)-1, &ins, 1);
-                BUG_ON(ret);
+                if (ret) {
+                        int i;
+                        for (i = 0; i < async_extent->nr_pages; i++) {
+                                WARN_ON(async_extent->pages[i]->mapping);
+                                page_cache_release(async_extent->pages[i]);
+                        }
+                        kfree(async_extent->pages);
+                        async_extent->nr_pages = 0;
+                        async_extent->pages = NULL;
+                        unlock_extent(io_tree, async_extent->start,
+                                      async_extent->start +
+                                      async_extent->ram_size - 1, GFP_NOFS);
+                        goto retry;
+                }
+
                 em = alloc_extent_map(GFP_NOFS);
                 em->start = async_extent->start;
                 em->len = async_extent->ram_size;
@@ -743,8 +758,22 @@ static noinline int cow_file_range(struct inode *inode,
         em = search_extent_mapping(&BTRFS_I(inode)->extent_tree,
                                    start, num_bytes);
         if (em) {
-                alloc_hint = em->block_start;
-                free_extent_map(em);
+                /*
+                 * if block start isn't an actual block number then find the
+                 * first block in this inode and use that as a hint.  If that
+                 * block is also bogus then just don't worry about it.
+                 */
+                if (em->block_start >= EXTENT_MAP_LAST_BYTE) {
+                        free_extent_map(em);
+                        em = search_extent_mapping(em_tree, 0, 0);
+                        if (em && em->block_start < EXTENT_MAP_LAST_BYTE)
+                                alloc_hint = em->block_start;
+                        if (em)
+                                free_extent_map(em);
+                } else {
+                        alloc_hint = em->block_start;
+                        free_extent_map(em);
+                }
         }
         read_unlock(&BTRFS_I(inode)->extent_tree.lock);
         btrfs_drop_extent_cache(inode, start, start + num_bytes - 1, 0);
@@ -2474,7 +2503,19 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
 
         root = BTRFS_I(dir)->root;
 
+        /*
+         * 5 items for unlink inode
+         * 1 for orphan
+         */
+        ret = btrfs_reserve_metadata_space(root, 6);
+        if (ret)
+                return ret;
+
         trans = btrfs_start_transaction(root, 1);
+        if (IS_ERR(trans)) {
+                btrfs_unreserve_metadata_space(root, 6);
+                return PTR_ERR(trans);
+        }
 
         btrfs_set_trans_block_group(trans, dir);
 
@@ -2489,6 +2530,7 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
         nr = trans->blocks_used;
 
         btrfs_end_transaction_throttle(trans, root);
+        btrfs_unreserve_metadata_space(root, 6);
         btrfs_btree_balance_dirty(root, nr);
         return ret;
 }
@@ -2569,7 +2611,16 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
             inode->i_ino == BTRFS_FIRST_FREE_OBJECTID)
                 return -ENOTEMPTY;
 
+        ret = btrfs_reserve_metadata_space(root, 5);
+        if (ret)
+                return ret;
+
         trans = btrfs_start_transaction(root, 1);
+        if (IS_ERR(trans)) {
+                btrfs_unreserve_metadata_space(root, 5);
+                return PTR_ERR(trans);
+        }
+
         btrfs_set_trans_block_group(trans, dir);
 
         if (unlikely(inode->i_ino == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID)) {
@@ -2592,6 +2643,7 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
 out:
         nr = trans->blocks_used;
         ret = btrfs_end_transaction_throttle(trans, root);
+        btrfs_unreserve_metadata_space(root, 5);
         btrfs_btree_balance_dirty(root, nr);
 
         if (ret && !err)
@@ -5128,6 +5180,7 @@ struct inode *btrfs_alloc_inode(struct super_block *sb)
         ei->logged_trans = 0;
         ei->outstanding_extents = 0;
         ei->reserved_extents = 0;
+        ei->root = NULL;
         spin_lock_init(&ei->accounting_lock);
         btrfs_ordered_inode_tree_init(&ei->ordered_tree);
         INIT_LIST_HEAD(&ei->i_orphan);
@@ -5144,6 +5197,14 @@ void btrfs_destroy_inode(struct inode *inode)
         WARN_ON(inode->i_data.nrpages);
 
         /*
+         * This can happen where we create an inode, but somebody else also
+         * created the same inode and we need to destroy the one we already
+         * created.
+         */
+        if (!root)
+                goto free;
+
+        /*
          * Make sure we're properly removed from the ordered operation
          * lists.
          */
@@ -5178,6 +5239,7 @@ void btrfs_destroy_inode(struct inode *inode)
         }
         inode_tree_del(inode);
         btrfs_drop_extent_cache(inode, 0, (u64)-1, 0);
+free:
         kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode));
 }
 
@@ -5283,11 +5345,14 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 return -ENOTEMPTY;
 
         /*
-         * 2 items for dir items
-         * 1 item for orphan entry
-         * 1 item for ref
+         * We want to reserve the absolute worst case amount of items.  So if
+         * both inodes are subvols and we need to unlink them then that would
+         * require 4 item modifications, but if they are both normal inodes it
+         * would require 5 item modifications, so we'll assume their normal
+         * inodes.  So 5 * 2 is 10, plus 1 for the new link, so 11 total items
+         * should cover the worst case number of items we'll modify.
          */
-        ret = btrfs_reserve_metadata_space(root, 4);
+        ret = btrfs_reserve_metadata_space(root, 11);
         if (ret)
                 return ret;
 
@@ -5403,7 +5468,7 @@ out_fail:
         if (old_inode->i_ino == BTRFS_FIRST_FREE_OBJECTID)
                 up_read(&root->fs_info->subvol_sem);
 
-        btrfs_unreserve_metadata_space(root, 4);
+        btrfs_unreserve_metadata_space(root, 11);
         return ret;
 }
 
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index 9351428f30e2..67fa2d29d663 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -159,7 +159,6 @@ int btrfs_update_root(struct btrfs_trans_handle *trans, struct btrfs_root
         write_extent_buffer(l, item, ptr, sizeof(*item));
         btrfs_mark_buffer_dirty(path->nodes[0]);
 out:
-        btrfs_release_path(root, path);
         btrfs_free_path(path);
         return ret;
 }
@@ -332,7 +331,6 @@ int btrfs_del_root(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         BUG_ON(refs != 0);
         ret = btrfs_del_item(trans, root, path);
 out:
-        btrfs_release_path(root, path);
         btrfs_free_path(path);
         return ret;
 }
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index bca82a4ca8e6..c207e8c32c9b 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -163,8 +163,14 @@ static void wait_current_trans(struct btrfs_root *root)
         }
 }
 
+enum btrfs_trans_type {
+        TRANS_START,
+        TRANS_JOIN,
+        TRANS_USERSPACE,
+};
+
 static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
-                                             int num_blocks, int wait)
+                                             int num_blocks, int type)
 {
         struct btrfs_trans_handle *h =
                 kmem_cache_alloc(btrfs_trans_handle_cachep, GFP_NOFS);
@@ -172,7 +178,8 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
 
         mutex_lock(&root->fs_info->trans_mutex);
         if (!root->fs_info->log_root_recovering &&
-            ((wait == 1 && !root->fs_info->open_ioctl_trans) || wait == 2))
+            ((type == TRANS_START && !root->fs_info->open_ioctl_trans) ||
+             type == TRANS_USERSPACE))
                 wait_current_trans(root);
         ret = join_transaction(root);
         BUG_ON(ret);
@@ -186,7 +193,7 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
         h->alloc_exclude_start = 0;
         h->delayed_ref_updates = 0;
 
-        if (!current->journal_info)
+        if (!current->journal_info && type != TRANS_USERSPACE)
                 current->journal_info = h;
 
         root->fs_info->running_transaction->use_count++;
@@ -198,18 +205,18 @@ static struct btrfs_trans_handle *start_transaction(struct btrfs_root *root,
 struct btrfs_trans_handle *btrfs_start_transaction(struct btrfs_root *root,
                                                    int num_blocks)
 {
-        return start_transaction(root, num_blocks, 1);
+        return start_transaction(root, num_blocks, TRANS_START);
 }
 struct btrfs_trans_handle *btrfs_join_transaction(struct btrfs_root *root,
                                                    int num_blocks)
 {
-        return start_transaction(root, num_blocks, 0);
+        return start_transaction(root, num_blocks, TRANS_JOIN);
 }
 
 struct btrfs_trans_handle *btrfs_start_ioctl_transaction(struct btrfs_root *r,
                                                          int num_blocks)
 {
-        return start_transaction(r, num_blocks, 2);
+        return start_transaction(r, num_blocks, TRANS_USERSPACE);
 }
 
 /* wait for a transaction commit to be fully complete */
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 1e25efcb55c8..d27d4ec6579b 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -720,7 +720,7 @@ void
 cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb)
 {
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
-                cifs_sb->mnt_cifs_flags &= CIFS_MOUNT_SERVER_INUM;
+                cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM;
                 cERROR(1, ("Autodisabling the use of server inode numbers on "
                            "%s. This server doesn't seem to support them "
                            "properly. Hardlinks will not be recognized on this "
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index f91fd51b32e3..d84e7058c298 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1800,7 +1800,7 @@ struct space_resv_32 {
 /* just account for different alignment */
 static int compat_ioctl_preallocate(struct file *file, unsigned long arg)
 {
-        struct space_resv_32    __user *p32 = (void __user *)arg;
+        struct space_resv_32    __user *p32 = compat_ptr(arg);
         struct space_resv       __user *p = compat_alloc_user_space(sizeof(*p));
 
         if (copy_in_user(&p->l_type,    &p32->l_type,   sizeof(s16)) ||
@@ -2802,7 +2802,7 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
 #else
         case FS_IOC_RESVSP:
         case FS_IOC_RESVSP64:
-                error = ioctl_preallocate(filp, (void __user *)arg);
+                error = ioctl_preallocate(filp, compat_ptr(arg));
                 goto out_fput;
 #endif
 
diff --git a/fs/exec.c b/fs/exec.c
index d49be6bc1793..ba112bd4a339 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -624,10 +624,8 @@ int setup_arg_pages(struct linux_binprm *bprm,
         /* Move stack pages down in memory. */
         if (stack_shift) {
                 ret = shift_arg_pages(vma, stack_shift);
-                if (ret) {
-                        up_write(&mm->mmap_sem);
-                        return ret;
-                }
+                if (ret)
+                        goto out_unlock;
         }
 
 #ifdef CONFIG_STACK_GROWSUP
@@ -641,7 +639,7 @@ int setup_arg_pages(struct linux_binprm *bprm,
 
 out_unlock:
         up_write(&mm->mmap_sem);
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL(setup_arg_pages);
 
diff --git a/fs/ext3/fsync.c b/fs/ext3/fsync.c
index 451d166bbe93..8209f266e9ad 100644
--- a/fs/ext3/fsync.c
+++ b/fs/ext3/fsync.c
@@ -46,19 +46,21 @@
 int ext3_sync_file(struct file * file, struct dentry *dentry, int datasync)
 {
         struct inode *inode = dentry->d_inode;
+        struct ext3_inode_info *ei = EXT3_I(inode);
+        journal_t *journal = EXT3_SB(inode->i_sb)->s_journal;
         int ret = 0;
+        tid_t commit_tid;
+
+        if (inode->i_sb->s_flags & MS_RDONLY)
+                return 0;
 
         J_ASSERT(ext3_journal_current_handle() == NULL);
 
         /*
-         * data=writeback:
+         * data=writeback,ordered:
          *  The caller's filemap_fdatawrite()/wait will sync the data.
-         *  sync_inode() will sync the metadata
-         *
-         * data=ordered:
-         *  The caller's filemap_fdatawrite() will write the data and
-         *  sync_inode() will write the inode if it is dirty.  Then the caller's
-         *  filemap_fdatawait() will wait on the pages.
+         *  Metadata is in the journal, we wait for a proper transaction
+         *  to commit here.
          *
          * data=journal:
          *  filemap_fdatawrite won't do anything (the buffers are clean).
@@ -73,22 +75,16 @@ int ext3_sync_file(struct file * file, struct dentry *dentry, int datasync)
                 goto out;
         }
 
-        if (datasync && !(inode->i_state & I_DIRTY_DATASYNC))
-                goto flush;
+        if (datasync)
+                commit_tid = atomic_read(&ei->i_datasync_tid);
+        else
+                commit_tid = atomic_read(&ei->i_sync_tid);
 
-        /*
-         * The VFS has written the file data.  If the inode is unaltered
-         * then we need not start a commit.
-         */
-        if (inode->i_state & (I_DIRTY_SYNC|I_DIRTY_DATASYNC)) {
-                struct writeback_control wbc = {
-                        .sync_mode = WB_SYNC_ALL,
-                        .nr_to_write = 0, /* sys_fsync did this */
-                };
-                ret = sync_inode(inode, &wbc);
+        if (log_start_commit(journal, commit_tid)) {
+                log_wait_commit(journal, commit_tid);
                 goto out;
         }
-flush:
+
         /*
          * In case we didn't commit a transaction, we have to flush
          * disk caches manually so that data really is on persistent
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index acf1b1423327..354ed3b47b30 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -699,8 +699,9 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode,
         int err = 0;
         struct ext3_block_alloc_info *block_i;
         ext3_fsblk_t current_block;
+        struct ext3_inode_info *ei = EXT3_I(inode);
 
-        block_i = EXT3_I(inode)->i_block_alloc_info;
+        block_i = ei->i_block_alloc_info;
         /*
          * If we're splicing into a [td]indirect block (as opposed to the
          * inode) then we need to get write access to the [td]indirect block
@@ -741,6 +742,8 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode,
 
         inode->i_ctime = CURRENT_TIME_SEC;
         ext3_mark_inode_dirty(handle, inode);
+        /* ext3_mark_inode_dirty already updated i_sync_tid */
+        atomic_set(&ei->i_datasync_tid, handle->h_transaction->t_tid);
 
         /* had we spliced it onto indirect block? */
         if (where->bh) {
@@ -1735,6 +1738,7 @@ static ssize_t ext3_direct_IO(int rw, struct kiocb *iocb,
         ssize_t ret;
         int orphan = 0;
         size_t count = iov_length(iov, nr_segs);
+        int retries = 0;
 
         if (rw == WRITE) {
                 loff_t final_size = offset + count;
@@ -1757,9 +1761,12 @@ static ssize_t ext3_direct_IO(int rw, struct kiocb *iocb,
                 }
         }
 
+retry:
         ret = blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
                                  offset, nr_segs,
                                  ext3_get_block, NULL);
+        if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
+                goto retry;
 
         if (orphan) {
                 int err;
@@ -2750,6 +2757,8 @@ struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
         struct ext3_inode_info *ei;
         struct buffer_head *bh;
         struct inode *inode;
+        journal_t *journal = EXT3_SB(sb)->s_journal;
+        transaction_t *transaction;
         long ret;
         int block;
 
@@ -2827,6 +2836,30 @@ struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
                 ei->i_data[block] = raw_inode->i_block[block];
         INIT_LIST_HEAD(&ei->i_orphan);
 
+        /*
+         * Set transaction id's of transactions that have to be committed
+         * to finish f[data]sync. We set them to currently running transaction
+         * as we cannot be sure that the inode or some of its metadata isn't
+         * part of the transaction - the inode could have been reclaimed and
+         * now it is reread from disk.
+         */
+        if (journal) {
+                tid_t tid;
+
+                spin_lock(&journal->j_state_lock);
+                if (journal->j_running_transaction)
+                        transaction = journal->j_running_transaction;
+                else
+                        transaction = journal->j_committing_transaction;
+                if (transaction)
+                        tid = transaction->t_tid;
+                else
+                        tid = journal->j_commit_sequence;
+                spin_unlock(&journal->j_state_lock);
+                atomic_set(&ei->i_sync_tid, tid);
+                atomic_set(&ei->i_datasync_tid, tid);
+        }
+
         if (inode->i_ino >= EXT3_FIRST_INO(inode->i_sb) + 1 &&
             EXT3_INODE_SIZE(inode->i_sb) > EXT3_GOOD_OLD_INODE_SIZE) {
                 /*
@@ -3011,6 +3044,7 @@ again:
                 err = rc;
         ei->i_state &= ~EXT3_STATE_NEW;
 
+        atomic_set(&ei->i_sync_tid, handle->h_transaction->t_tid);
 out_brelse:
         brelse (bh);
         ext3_std_error(inode->i_sb, err);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 7a520a862f49..427496c4767c 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -466,6 +466,8 @@ static struct inode *ext3_alloc_inode(struct super_block *sb)
                 return NULL;
         ei->i_block_alloc_info = NULL;
         ei->vfs_inode.i_version = 1;
+        atomic_set(&ei->i_datasync_tid, 0);
+        atomic_set(&ei->i_sync_tid, 0);
         return &ei->vfs_inode;
 }
 
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 00d153f2f261..8825515eeddd 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -322,6 +322,7 @@ static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
 #define EXT4_STATE_NO_EXPAND            0x00000008 /* No space for expansion */
 #define EXT4_STATE_DA_ALLOC_CLOSE       0x00000010 /* Alloc DA blks on close */
 #define EXT4_STATE_EXT_MIGRATE          0x00000020 /* Inode is migrating */
+#define EXT4_STATE_DIO_UNWRITTEN        0x00000040 /* need convert on dio done*/
 
 /* Used to pass group descriptor data when online resize is done */
 struct ext4_new_group_input {
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 10539e364283..715264b4bae4 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2807,6 +2807,8 @@ fix_extent_len:
  * into three uninitialized extent(at most). After IO complete, the part
  * being filled will be convert to initialized by the end_io callback function
  * via ext4_convert_unwritten_extents().
+ *
+ * Returns the size of uninitialized extent to be written on success.
  */
 static int ext4_split_unwritten_extents(handle_t *handle,
                                         struct inode *inode,
@@ -2824,7 +2826,6 @@ static int ext4_split_unwritten_extents(handle_t *handle,
         unsigned int allocated, ee_len, depth;
         ext4_fsblk_t newblock;
         int err = 0;
-        int ret = 0;
 
         ext_debug("ext4_split_unwritten_extents: inode %lu,"
                   "iblock %llu, max_blocks %u\n", inode->i_ino,
@@ -2842,12 +2843,12 @@ static int ext4_split_unwritten_extents(handle_t *handle,
         ext4_ext_store_pblock(&orig_ex, ext_pblock(ex));
 
         /*
-         * if the entire unintialized extent length less than
-         * the size of extent to write, there is no need to split
-         * uninitialized extent
+         * If the uninitialized extent begins at the same logical
+         * block where the write begins, and the write completely
+         * covers the extent, then we don't need to split it.
          */
-        if (allocated <= max_blocks)
-                return ret;
+        if ((iblock == ee_block) && (allocated <= max_blocks))
+                return allocated;
 
         err = ext4_ext_get_access(handle, inode, path + depth);
         if (err)
@@ -3048,12 +3049,18 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                 ret = ext4_split_unwritten_extents(handle,
                                                 inode, path, iblock,
                                                 max_blocks, flags);
-                /* flag the io_end struct that we need convert when IO done */
+                /*
+                 * Flag the inode(non aio case) or end_io struct (aio case)
+                 * that this IO needs to convertion to written when IO is
+                 * completed
+                 */
                 if (io)
                         io->flag = DIO_AIO_UNWRITTEN;
+                else
+                        EXT4_I(inode)->i_state |= EXT4_STATE_DIO_UNWRITTEN;
                 goto out;
         }
-        /* DIO end_io complete, convert the filled extent to written */
+        /* async DIO end_io complete, convert the filled extent to written */
         if (flags == EXT4_GET_BLOCKS_DIO_CONVERT_EXT) {
                 ret = ext4_convert_unwritten_extents_dio(handle, inode,
                                                         path);
@@ -3295,10 +3302,16 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
                  * To avoid unecessary convertion for every aio dio rewrite
                  * to the mid of file, here we flag the IO that is really
                  * need the convertion.
-                 *
+                 * For non asycn direct IO case, flag the inode state
+                 * that we need to perform convertion when IO is done.
                  */
-                if (io && flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT)
-                        io->flag = DIO_AIO_UNWRITTEN;
+                if (flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT) {
+                        if (io)
+                                io->flag = DIO_AIO_UNWRITTEN;
+                        else
+                                EXT4_I(inode)->i_state |=
+                                        EXT4_STATE_DIO_UNWRITTEN;;
+                }
         }
         err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
         if (err) {
@@ -3519,6 +3532,7 @@ retry:
  *
  * This function is called from the direct IO end io call back
  * function, to convert the fallocated extents after IO is completed.
+ * Returns 0 on success.
  */
 int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
                                     loff_t len)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5c5bc5dafff8..2c8caa51addb 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -193,7 +193,7 @@ static int try_to_extend_transaction(handle_t *handle, struct inode *inode)
  * so before we call here everything must be consistently dirtied against
  * this transaction.
  */
- int ext4_truncate_restart_trans(handle_t *handle, struct inode *inode,
+int ext4_truncate_restart_trans(handle_t *handle, struct inode *inode,
                                  int nblocks)
 {
         int ret;
@@ -209,6 +209,7 @@ static int try_to_extend_transaction(handle_t *handle, struct inode *inode)
         up_write(&EXT4_I(inode)->i_data_sem);
         ret = ext4_journal_restart(handle, blocks_for_truncate(inode));
         down_write(&EXT4_I(inode)->i_data_sem);
+        ext4_discard_preallocations(inode);
 
         return ret;
 }
@@ -3445,8 +3446,6 @@ out:
         return ret;
 }
 
-/* Maximum number of blocks we map for direct IO at once. */
-
 static int ext4_get_block_dio_write(struct inode *inode, sector_t iblock,
                    struct buffer_head *bh_result, int create)
 {
@@ -3654,13 +3653,14 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
         ext4_io_end_t *io_end = iocb->private;
         struct workqueue_struct *wq;
 
+        /* if not async direct IO or dio with 0 bytes write, just return */
+        if (!io_end || !size)
+                return;
+
         ext_debug("ext4_end_io_dio(): io_end 0x%p"
                   "for inode %lu, iocb 0x%p, offset %llu, size %llu\n",
                   iocb->private, io_end->inode->i_ino, iocb, offset,
                   size);
-        /* if not async direct IO or dio with 0 bytes write, just return */
-        if (!io_end || !size)
-                return;
 
         /* if not aio dio with unwritten extents, just free io and return */
         if (io_end->flag != DIO_AIO_UNWRITTEN){
@@ -3771,13 +3771,19 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
                 if (ret != -EIOCBQUEUED && ret <= 0 && iocb->private) {
                         ext4_free_io_end(iocb->private);
                         iocb->private = NULL;
-                } else if (ret > 0)
+                } else if (ret > 0 && (EXT4_I(inode)->i_state &
+                                       EXT4_STATE_DIO_UNWRITTEN)) {
+                        int err;
                         /*
                          * for non AIO case, since the IO is already
                          * completed, we could do the convertion right here
                          */
-                        ret = ext4_convert_unwritten_extents(inode,
-                                                                offset, ret);
+                        err = ext4_convert_unwritten_extents(inode,
+                                                             offset, ret);
+                        if (err < 0)
+                                ret = err;
+                        EXT4_I(inode)->i_state &= ~EXT4_STATE_DIO_UNWRITTEN;
+                }
                 return ret;
         }
 
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 7c8fe80bacdd..6d2c1b897fc7 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1518,12 +1518,8 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
                         return retval;
 
                 if (blocks == 1 && !dx_fallback &&
-                    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
-                        retval = make_indexed_dir(handle, dentry, inode, bh);
-                        if (retval == -ENOSPC)
-                                brelse(bh);
-                        return retval;
-                }
+                    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+                        return make_indexed_dir(handle, dentry, inode, bh);
                 brelse(bh);
         }
         bh = ext4_append(handle, dir, &block, &retval);
@@ -1532,10 +1528,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
         de = (struct ext4_dir_entry_2 *) bh->b_data;
         de->inode = 0;
         de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
-        retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
-        if (retval == -ENOSPC)
-                brelse(bh);
-        return retval;
+        return add_dirent_to_buf(handle, dentry, inode, de, bh);
 }
 
 /*
@@ -1664,8 +1657,7 @@ static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
         if (!de)
                 goto cleanup;
         err = add_dirent_to_buf(handle, dentry, inode, de, bh);
-        if (err != -ENOSPC)
-                bh = NULL;
+        bh = NULL;
         goto cleanup;
 
 journal_error:
diff --git a/fs/fcntl.c b/fs/fcntl.c
index fc089f2f7f56..2cf93ec40a67 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -284,7 +284,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
                 type = PIDTYPE_PID;
                 break;
 
-        case F_OWNER_GID:
+        case F_OWNER_PGRP:
                 type = PIDTYPE_PGID;
                 break;
 
@@ -321,7 +321,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg)
                 break;
 
         case PIDTYPE_PGID:
-                owner.type = F_OWNER_GID;
+                owner.type = F_OWNER_PGRP;
                 break;
 
         default:
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 7b17a14396ff..6c751106c2e5 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -254,7 +254,7 @@ int __generic_block_fiemap(struct inode *inode,
                            u64 len, get_block_t *get_block)
 {
         struct buffer_head tmp;
-        unsigned int start_blk;
+        unsigned long long start_blk;
         long long length = 0, map_len = 0;
         u64 logical = 0, phys = 0, size = 0;
         u32 flags = FIEMAP_EXTENT_MERGED;
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index bd3c073b485d..4160afad6d00 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -73,6 +73,7 @@ EXPORT_SYMBOL(journal_errno);
 EXPORT_SYMBOL(journal_ack_err);
 EXPORT_SYMBOL(journal_clear_err);
 EXPORT_SYMBOL(log_wait_commit);
+EXPORT_SYMBOL(log_start_commit);
 EXPORT_SYMBOL(journal_start_commit);
 EXPORT_SYMBOL(journal_force_commit_nested);
 EXPORT_SYMBOL(journal_wipe);
@@ -756,6 +757,7 @@ journal_t * journal_init_dev(struct block_device *bdev,
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         kfree(journal);
         return NULL;
 }
@@ -820,6 +822,7 @@ journal_t * journal_init_inode (struct inode *inode)
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         kfree(journal);
         return NULL;
 }
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index b0ab5219becb..fed85388ee86 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -913,6 +913,7 @@ journal_t * jbd2_journal_init_dev(struct block_device *bdev,
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         jbd2_stats_proc_exit(journal);
         kfree(journal);
         return NULL;
@@ -986,6 +987,7 @@ journal_t * jbd2_journal_init_inode (struct inode *inode)
 
         return journal;
 out_err:
+        kfree(journal->j_wbuf);
         jbd2_stats_proc_exit(journal);
         kfree(journal);
         return NULL;
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index edf926e1062f..d0a2ce1b4324 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -958,7 +958,7 @@ encode_entry(struct readdir_cd *ccd, const char *name, int namlen,
                 p1 = encode_entry_baggage(cd, p1, name, namlen, ino);
 
                 if (plus)
-                        p = encode_entryplus_baggage(cd, p1, name, namlen);
+                        p1 = encode_entryplus_baggage(cd, p1, name, namlen);
 
                 /* determine entry word length and lengths to go in pages */
                 num_entry_words = p1 - tmp;
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index 1c6cfb59128d..3f5d5d06f53c 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -871,7 +871,6 @@ int nilfs_cpfile_change_cpmode(struct inode *cpfile, __u64 cno, int mode)
                  * exclusive with a new mount job.  Though it doesn't cover
                  * umount, it's enough for the purpose.
                  */
-                mutex_lock(&nilfs->ns_mount_mutex);
                 if (nilfs_checkpoint_is_mounted(nilfs, cno, 1)) {
                         /* Current implementation does not have to protect
                            plain read-only mounts since they are exclusive
@@ -880,7 +879,6 @@ int nilfs_cpfile_change_cpmode(struct inode *cpfile, __u64 cno, int mode)
                         ret = -EBUSY;
                 } else
                         ret = nilfs_cpfile_clear_snapshot(cpfile, cno);
-                mutex_unlock(&nilfs->ns_mount_mutex);
                 return ret;
         case NILFS_SNAPSHOT:
                 return nilfs_cpfile_set_snapshot(cpfile, cno);
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 5040220c3732..2a0a5a3ac134 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -664,7 +664,6 @@ int nilfs_load_inode_block(struct nilfs_sb_info *sbi, struct inode *inode,
         int err;
 
         spin_lock(&sbi->s_inode_lock);
-        /* Caller of this function MUST lock s_inode_lock */
         if (ii->i_bh == NULL) {
                 spin_unlock(&sbi->s_inode_lock);
                 err = nilfs_ifile_get_inode_block(sbi->s_ifile, inode->i_ino,
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index d24057d58f17..f6af76042d80 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -99,7 +99,8 @@ static int nilfs_ioctl_wrap_copy(struct the_nilfs *nilfs,
 static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
                                      unsigned int cmd, void __user *argp)
 {
-        struct inode *cpfile = NILFS_SB(inode->i_sb)->s_nilfs->ns_cpfile;
+        struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+        struct inode *cpfile = nilfs->ns_cpfile;
         struct nilfs_transaction_info ti;
         struct nilfs_cpmode cpmode;
         int ret;
@@ -109,14 +110,17 @@ static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
         if (copy_from_user(&cpmode, argp, sizeof(cpmode)))
                 return -EFAULT;
 
+        mutex_lock(&nilfs->ns_mount_mutex);
         nilfs_transaction_begin(inode->i_sb, &ti, 0);
         ret = nilfs_cpfile_change_cpmode(
                 cpfile, cpmode.cm_cno, cpmode.cm_mode);
         if (unlikely(ret < 0)) {
                 nilfs_transaction_abort(inode->i_sb);
+                mutex_unlock(&nilfs->ns_mount_mutex);
                 return ret;
         }
         nilfs_transaction_commit(inode->i_sb); /* never fails */
+        mutex_unlock(&nilfs->ns_mount_mutex);
         return ret;
 }
 
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 07f77a7945c3..822c2d506518 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -571,7 +571,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                 rsslim,
                 mm ? mm->start_code : 0,
                 mm ? mm->end_code : 0,
-                (permitted) ? task->stack_start : 0,
+                (permitted && mm) ? task->stack_start : 0,
                 esp,
                 eip,
                 /* The signal information here is obsolete.
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 837469a96598..af643b5aefe8 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2597,8 +2597,7 @@ static void proc_flush_task_mnt(struct vfsmount *mnt, pid_t pid, pid_t tgid)
         name.len = snprintf(buf, sizeof(buf), "%d", pid);
         dentry = d_hash_and_lookup(mnt->mnt_root, &name);
         if (dentry) {
-                if (!(current->flags & PF_EXITING))
-                        shrink_dcache_parent(dentry);
+                shrink_dcache_parent(dentry);
                 d_drop(dentry);
                 dput(dentry);
         }
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 1099395d7d6c..fb17f8226b09 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1980,7 +1980,7 @@ xlog_recover_do_reg_buffer(
                                         "XFS: NULL dquot in %s.", __func__);
                                 goto next;
                         }
-                        if (item->ri_buf[i].i_len < sizeof(xfs_dqblk_t)) {
+                        if (item->ri_buf[i].i_len < sizeof(xfs_disk_dquot_t)) {
                                 cmn_err(CE_ALERT,
                                         "XFS: dquot too small (%d) in %s.",
                                         item->ri_buf[i].i_len, __func__);
@@ -2635,7 +2635,7 @@ xlog_recover_do_dquot_trans(
                         "XFS: NULL dquot in %s.", __func__);
                 return XFS_ERROR(EIO);
         }
-        if (item->ri_buf[1].i_len < sizeof(xfs_dqblk_t)) {
+        if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) {
                 cmn_err(CE_ALERT,
                         "XFS: dquot too small (%d) in %s.",
                         item->ri_buf[1].i_len, __func__);
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index f31271c30de9..2ffc570679be 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -467,6 +467,7 @@ xfs_trans_ail_update(
 {
         xfs_log_item_t          *dlip = NULL;
         xfs_log_item_t          *mlip;  /* ptr to minimum lip */
+        xfs_lsn_t               tail_lsn;
 
         mlip = xfs_ail_min(ailp);
 
@@ -483,8 +484,16 @@ xfs_trans_ail_update(
 
         if (mlip == dlip) {
                 mlip = xfs_ail_min(ailp);
+                /*
+                 * It is not safe to access mlip after the AIL lock is
+                 * dropped, so we must get a copy of li_lsn before we do
+                 * so.  This is especially important on 32-bit platforms
+                 * where accessing and updating 64-bit values like li_lsn
+                 * is not atomic.
+                 */
+                tail_lsn = mlip->li_lsn;
                 spin_unlock(&ailp->xa_lock);
-                xfs_log_move_tail(ailp->xa_mount, mlip->li_lsn);
+                xfs_log_move_tail(ailp->xa_mount, tail_lsn);
         } else {
                 spin_unlock(&ailp->xa_lock);
         }
@@ -514,6 +523,7 @@ xfs_trans_ail_delete(
 {
         xfs_log_item_t          *dlip;
         xfs_log_item_t          *mlip;
+        xfs_lsn_t               tail_lsn;
 
         if (lip->li_flags & XFS_LI_IN_AIL) {
                 mlip = xfs_ail_min(ailp);
@@ -527,9 +537,16 @@ xfs_trans_ail_delete(
 
                 if (mlip == dlip) {
                         mlip = xfs_ail_min(ailp);
+                        /*
+                         * It is not safe to access mlip after the AIL lock
+                         * is dropped, so we must get a copy of li_lsn
+                         * before we do so.  This is especially important
+                         * on 32-bit platforms where accessing and updating
+                         * 64-bit values like li_lsn is not atomic.
+                         */
+                        tail_lsn = mlip ? mlip->li_lsn : 0;
                         spin_unlock(&ailp->xa_lock);
-                        xfs_log_move_tail(ailp->xa_mount,
-                                                (mlip ? mlip->li_lsn : 0));
+                        xfs_log_move_tail(ailp->xa_mount, tail_lsn);
                 } else {
                         spin_unlock(&ailp->xa_lock);
                 }