25 files changed, 128 insertions, 168 deletions
diff --git a/fs/block_dev.c b/fs/block_dev.c
index cc9d4114cda0..1d9c9f3754f8 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1585,7 +1585,7 @@ ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)
 }
 EXPORT_SYMBOL_GPL(blkdev_write_iter);
-static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
 {
        struct file *file = iocb->ki_filp;
        struct inode *bd_inode = file->f_mapping->host;
@@ -1599,6 +1599,7 @@ static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
        iov_iter_truncate(to, size);
        return generic_file_read_iter(iocb, to);
 }
+EXPORT_SYMBOL_GPL(blkdev_read_iter);
 /*
 * Try to release a page associated with block device when the system
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index d557264ee974..fe69edda11fb 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3276,7 +3276,7 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
                           struct btrfs_root *root, unsigned long count);
 int btrfs_async_run_delayed_refs(struct btrfs_root *root,
                                 unsigned long count, int wait);
-int btrfs_lookup_extent(struct btrfs_root *root, u64 start, u64 len);
+int btrfs_lookup_data_extent(struct btrfs_root *root, u64 start, u64 len);
 int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
                             struct btrfs_root *root, u64 bytenr,
                             u64 offset, int metadata, u64 *refs, u64 *flags);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 1ad0f47ac850..1bf9f897065d 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3817,19 +3817,19 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
        struct btrfs_super_block *sb = fs_info->super_copy;
        int ret = 0;
-        if (sb->root_level > BTRFS_MAX_LEVEL) {
+        if (btrfs_super_root_level(sb) >= BTRFS_MAX_LEVEL) {
-                printk(KERN_ERR "BTRFS: tree_root level too big: %d > %d\n",
+                printk(KERN_ERR "BTRFS: tree_root level too big: %d >= %d\n",
-                                sb->root_level, BTRFS_MAX_LEVEL);
+                                btrfs_super_root_level(sb), BTRFS_MAX_LEVEL);
                ret = -EINVAL;
        }
-        if (sb->chunk_root_level > BTRFS_MAX_LEVEL) {
+        if (btrfs_super_chunk_root_level(sb) >= BTRFS_MAX_LEVEL) {
-                printk(KERN_ERR "BTRFS: chunk_root level too big: %d > %d\n",
+                printk(KERN_ERR "BTRFS: chunk_root level too big: %d >= %d\n",
-                                sb->chunk_root_level, BTRFS_MAX_LEVEL);
+                                btrfs_super_chunk_root_level(sb), BTRFS_MAX_LEVEL);
                ret = -EINVAL;
        }
-        if (sb->log_root_level > BTRFS_MAX_LEVEL) {
+        if (btrfs_super_log_root_level(sb) >= BTRFS_MAX_LEVEL) {
-                printk(KERN_ERR "BTRFS: log_root level too big: %d > %d\n",
+                printk(KERN_ERR "BTRFS: log_root level too big: %d >= %d\n",
-                                sb->log_root_level, BTRFS_MAX_LEVEL);
+                                btrfs_super_log_root_level(sb), BTRFS_MAX_LEVEL);
                ret = -EINVAL;
        }
@@ -3837,15 +3837,15 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
         * The common minimum, we don't know if we can trust the nodesize/sectorsize
         * items yet, they'll be verified later. Issue just a warning.
         */
-        if (!IS_ALIGNED(sb->root, 4096))
+        if (!IS_ALIGNED(btrfs_super_root(sb), 4096))
                printk(KERN_WARNING "BTRFS: tree_root block unaligned: %llu\n",
                                sb->root);
-        if (!IS_ALIGNED(sb->chunk_root, 4096))
+        if (!IS_ALIGNED(btrfs_super_chunk_root(sb), 4096))
                printk(KERN_WARNING "BTRFS: tree_root block unaligned: %llu\n",
                                sb->chunk_root);
-        if (!IS_ALIGNED(sb->log_root, 4096))
+        if (!IS_ALIGNED(btrfs_super_log_root(sb), 4096))
                printk(KERN_WARNING "BTRFS: tree_root block unaligned: %llu\n",
-                                sb->log_root);
+                                btrfs_super_log_root(sb));
        if (memcmp(fs_info->fsid, sb->dev_item.fsid, BTRFS_UUID_SIZE) != 0) {
                printk(KERN_ERR "BTRFS: dev_item UUID does not match fsid: %pU != %pU\n",
@@ -3857,13 +3857,13 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
         * Hint to catch really bogus numbers, bitflips or so, more exact checks are
         * done later
         */
-        if (sb->num_devices > (1UL << 31))
+        if (btrfs_super_num_devices(sb) > (1UL << 31))
                printk(KERN_WARNING "BTRFS: suspicious number of devices: %llu\n",
-                                sb->num_devices);
+                                btrfs_super_num_devices(sb));
-        if (sb->bytenr != BTRFS_SUPER_INFO_OFFSET) {
+        if (btrfs_super_bytenr(sb) != BTRFS_SUPER_INFO_OFFSET) {
                printk(KERN_ERR "BTRFS: super offset mismatch %llu != %u\n",
-                                sb->bytenr, BTRFS_SUPER_INFO_OFFSET);
+                                btrfs_super_bytenr(sb), BTRFS_SUPER_INFO_OFFSET);
                ret = -EINVAL;
        }
@@ -3871,14 +3871,15 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
         * The generation is a global counter, we'll trust it more than the others
         * but it's still possible that it's the one that's wrong.
         */
-        if (sb->generation < sb->chunk_root_generation)
+        if (btrfs_super_generation(sb) < btrfs_super_chunk_root_generation(sb))
                printk(KERN_WARNING
                        "BTRFS: suspicious: generation < chunk_root_generation: %llu < %llu\n",
-                        sb->generation, sb->chunk_root_generation);
+                        btrfs_super_generation(sb), btrfs_super_chunk_root_generation(sb));
-        if (sb->generation < sb->cache_generation && sb->cache_generation != (u64)-1)
+        if (btrfs_super_generation(sb) < btrfs_super_cache_generation(sb)
+            && btrfs_super_cache_generation(sb) != (u64)-1)
                printk(KERN_WARNING
                        "BTRFS: suspicious: generation < cache_generation: %llu < %llu\n",
-                        sb->generation, sb->cache_generation);
+                        btrfs_super_generation(sb), btrfs_super_cache_generation(sb));
        return ret;
 }
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index d56589571012..47c1ba141082 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -710,8 +710,8 @@ void btrfs_clear_space_info_full(struct btrfs_fs_info *info)
        rcu_read_unlock();
 }
-/* simple helper to search for an existing extent at a given offset */
+/* simple helper to search for an existing data extent at a given offset */
-int btrfs_lookup_extent(struct btrfs_root *root, u64 start, u64 len)
+int btrfs_lookup_data_extent(struct btrfs_root *root, u64 start, u64 len)
 {
        int ret;
        struct btrfs_key key;
@@ -726,12 +726,6 @@ int btrfs_lookup_extent(struct btrfs_root *root, u64 start, u64 len)
        key.type = BTRFS_EXTENT_ITEM_KEY;
        ret = btrfs_search_slot(NULL, root->fs_info->extent_root, &key, path,
                                0, 0);
-        if (ret > 0) {
-                btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
-                if (key.objectid == start &&
-                    key.type == BTRFS_METADATA_ITEM_KEY)
-                        ret = 0;
-        }
        btrfs_free_path(path);
        return ret;
 }
@@ -786,7 +780,6 @@ search_again:
        else
                key.type = BTRFS_EXTENT_ITEM_KEY;
-again:
        ret = btrfs_search_slot(trans, root->fs_info->extent_root,
                                &key, path, 0, 0);
        if (ret < 0)
@@ -802,13 +795,6 @@ again:
                            key.offset == root->nodesize)
                                ret = 0;
                }
-                if (ret) {
-                        key.objectid = bytenr;
-                        key.type = BTRFS_EXTENT_ITEM_KEY;
-                        key.offset = root->nodesize;
-                        btrfs_release_path(path);
-                        goto again;
-                }
        }
        if (ret == 0) {
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index a2b97ef10317..54bd91ece35b 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -2151,6 +2151,7 @@ static void __exit exit_btrfs_fs(void)
        extent_map_exit();
        extent_io_exit();
        btrfs_interface_exit();
+        btrfs_end_io_wq_exit();
        unregister_filesystem(&btrfs_fs_type);
        btrfs_exit_sysfs();
        btrfs_cleanup_fs_uuids();
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 1475979e5718..286213cec861 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -672,7 +672,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
                         * is this extent already allocated in the extent
                         * allocation tree?  If so, just add a reference
                         */
-                        ret = btrfs_lookup_extent(root, ins.objectid,
+                        ret = btrfs_lookup_data_extent(root, ins.objectid,
                                                ins.offset);
                        if (ret == 0) {
                                ret = btrfs_inc_extent_ref(trans, root,
diff --git a/fs/buffer.c b/fs/buffer.c
index 6c48f20eddd4..20805db2c987 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -128,21 +128,15 @@ __clear_page_buffers(struct page *page)
        page_cache_release(page);
 }
+static void buffer_io_error(struct buffer_head *bh, char *msg)
-static int quiet_error(struct buffer_head *bh)
-{
-        if (!test_bit(BH_Quiet, &bh->b_state) && printk_ratelimit())
-                return 0;
-        return 1;
-}
-static void buffer_io_error(struct buffer_head *bh)
 {
        char b[BDEVNAME_SIZE];
-        printk(KERN_ERR "Buffer I/O error on device %s, logical block %Lu\n",
+        if (!test_bit(BH_Quiet, &bh->b_state))
+                printk_ratelimited(KERN_ERR
+                        "Buffer I/O error on dev %s, logical block %llu%s\n",
                        bdevname(bh->b_bdev, b),
-                        (unsigned long long)bh->b_blocknr);
+                        (unsigned long long)bh->b_blocknr, msg);
 }
 /*
@@ -177,17 +171,10 @@ EXPORT_SYMBOL(end_buffer_read_sync);
 void end_buffer_write_sync(struct buffer_head *bh, int uptodate)
 {
-        char b[BDEVNAME_SIZE];
        if (uptodate) {
                set_buffer_uptodate(bh);
        } else {
-                if (!quiet_error(bh)) {
+                buffer_io_error(bh, ", lost sync page write");
-                        buffer_io_error(bh);
-                        printk(KERN_WARNING "lost page write due to "
-                                        "I/O error on %s\n",
-                                       bdevname(bh->b_bdev, b));
-                }
                set_buffer_write_io_error(bh);
                clear_buffer_uptodate(bh);
        }
@@ -304,8 +291,7 @@ static void end_buffer_async_read(struct buffer_head *bh, int uptodate)
                set_buffer_uptodate(bh);
        } else {
                clear_buffer_uptodate(bh);
-                if (!quiet_error(bh))
+                buffer_io_error(bh, ", async page read");
-                        buffer_io_error(bh);
                SetPageError(page);
        }
@@ -353,7 +339,6 @@ still_busy:
 */
 void end_buffer_async_write(struct buffer_head *bh, int uptodate)
 {
-        char b[BDEVNAME_SIZE];
        unsigned long flags;
        struct buffer_head *first;
        struct buffer_head *tmp;
@@ -365,12 +350,7 @@ void end_buffer_async_write(struct buffer_head *bh, int uptodate)
        if (uptodate) {
                set_buffer_uptodate(bh);
        } else {
-                if (!quiet_error(bh)) {
+                buffer_io_error(bh, ", lost async page write");
-                        buffer_io_error(bh);
-                        printk(KERN_WARNING "lost page write due to "
-                                        "I/O error on %s\n",
-                               bdevname(bh->b_bdev, b));
-                }
                set_bit(AS_EIO, &page->mapping->flags);
                set_buffer_write_io_error(bh);
                clear_buffer_uptodate(bh);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 7015db0bafd1..eb742d0e67ff 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -1354,13 +1354,6 @@ set_qf_format:
                                        "not specified.");
                        return 0;
                }
-        } else {
-                if (sbi->s_jquota_fmt) {
-                        ext3_msg(sb, KERN_ERR, "error: journaled quota format "
-                                        "specified with no journaling "
-                                        "enabled.");
-                        return 0;
-                }
        }
 #endif
        return 1;
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 37043d0b2be8..0b16fb4c06d3 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3603,11 +3603,10 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
                }
        }
-        allocated = ext4_split_extent(handle, inode, ppath,
+        err = ext4_split_extent(handle, inode, ppath, &split_map, split_flag,
-                                      &split_map, split_flag, flags);
+                                flags);
-        if (allocated < 0)
+        if (err > 0)
-                err = allocated;
+                err = 0;
 out:
        /* If we have gotten a failure, don't zero out status tree */
        if (!err)
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index aca7b24a4432..8131be8c0af3 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -137,10 +137,10 @@ ext4_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
                        iov_iter_truncate(from, sbi->s_bitmap_maxbytes - pos);
        }
+        iocb->private = &overwrite;
        if (o_direct) {
                blk_start_plug(&plug);
-                iocb->private = &overwrite;
                /* check whether we do a DIO overwrite or not */
                if (ext4_should_dioread_nolock(inode) && !aio_mutex &&
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 8012a5daf401..ac644c31ca67 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -887,6 +887,10 @@ got:
                struct buffer_head *block_bitmap_bh;
                block_bitmap_bh = ext4_read_block_bitmap(sb, group);
+                if (!block_bitmap_bh) {
+                        err = -EIO;
+                        goto out;
+                }
                BUFFER_TRACE(block_bitmap_bh, "get block bitmap access");
                err = ext4_journal_get_write_access(handle, block_bitmap_bh);
                if (err) {
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index e9777f93cf05..3356ab5395f4 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4959,7 +4959,12 @@ int ext4_change_inode_journal_flag(struct inode *inode, int val)
        if (val)
                ext4_set_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
        else {
-                jbd2_journal_flush(journal);
+                err = jbd2_journal_flush(journal);
+                if (err < 0) {
+                        jbd2_journal_unlock_updates(journal);
+                        ext4_inode_resume_unlocked_dio(inode);
+                        return err;
+                }
                ext4_clear_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
        }
        ext4_set_aops(inode);
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 123798c5ac31..426211882f72 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1816,31 +1816,39 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
                hinfo.hash_version += EXT4_SB(dir->i_sb)->s_hash_unsigned;
        hinfo.seed = EXT4_SB(dir->i_sb)->s_hash_seed;
        ext4fs_dirhash(name, namelen, &hinfo);
+        memset(frames, 0, sizeof(frames));
        frame = frames;
        frame->entries = entries;
        frame->at = entries;
        frame->bh = bh;
        bh = bh2;
-        ext4_handle_dirty_dx_node(handle, dir, frame->bh);
+        retval = ext4_handle_dirty_dx_node(handle, dir, frame->bh);
-        ext4_handle_dirty_dirent_node(handle, dir, bh);
+        if (retval)
+                goto out_frames;        
+        retval = ext4_handle_dirty_dirent_node(handle, dir, bh);
+        if (retval)
+                goto out_frames;        
        de = do_split(handle,dir, &bh, frame, &hinfo);
        if (IS_ERR(de)) {
-                /*
+                retval = PTR_ERR(de);
-                 * Even if the block split failed, we have to properly write
+                goto out_frames;
-                 * out all the changes we did so far. Otherwise we can end up
-                 * with corrupted filesystem.
-                 */
-                ext4_mark_inode_dirty(handle, dir);
-                dx_release(frames);
-                return PTR_ERR(de);
        }
        dx_release(frames);
        retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
        brelse(bh);
        return retval;
+out_frames:
+        /*
+         * Even if the block split failed, we have to properly write
+         * out all the changes we did so far. Otherwise we can end up
+         * with corrupted filesystem.
+         */
+        ext4_mark_inode_dirty(handle, dir);
+        dx_release(frames);
+        return retval;
 }
 /*
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index f298c60f907d..ca4588388fc3 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1081,7 +1081,7 @@ static void update_backups(struct super_block *sb, int blk_off, char *data,
                        break;
                if (meta_bg == 0)
-                        backup_block = group * bpg + blk_off;
+                        backup_block = ((ext4_fsblk_t)group) * bpg + blk_off;
                else
                        backup_block = (ext4_group_first_block_no(sb, group) +
                                        ext4_bg_has_super(sb, group));
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 1eda6ab0ef9d..2c9e6864abd9 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3526,6 +3526,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
 #ifdef CONFIG_EXT4_FS_POSIX_ACL
        set_opt(sb, POSIX_ACL);
 #endif
+        /* don't forget to enable journal_csum when metadata_csum is enabled. */
+        if (ext4_has_metadata_csum(sb))
+                set_opt(sb, JOURNAL_CHECKSUM);
        if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_DATA)
                set_opt(sb, JOURNAL_DATA);
        else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_ORDERED)
@@ -3943,7 +3947,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
        if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_MMP) &&
            !(sb->s_flags & MS_RDONLY))
                if (ext4_multi_mount_protect(sb, le64_to_cpu(es->s_mmp_block)))
-                        goto failed_mount3;
+                        goto failed_mount3a;
        /*
         * The first inode we look at is the journal inode.  Don't try
@@ -3952,7 +3956,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
        if (!test_opt(sb, NOLOAD) &&
            EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_HAS_JOURNAL)) {
                if (ext4_load_journal(sb, es, journal_devnum))
-                        goto failed_mount3;
+                        goto failed_mount3a;
        } else if (test_opt(sb, NOLOAD) && !(sb->s_flags & MS_RDONLY) &&
              EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER)) {
                ext4_msg(sb, KERN_ERR, "required journal recovery "
@@ -4240,6 +4244,7 @@ failed_mount_wq:
                jbd2_journal_destroy(sbi->s_journal);
                sbi->s_journal = NULL;
        }
+failed_mount3a:
        ext4_es_unregister_shrinker(sbi);
 failed_mount3:
        del_timer_sync(&sbi->s_err_report);
@@ -4841,6 +4846,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
                goto restore_opts;
        }
+        if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^
+            test_opt(sb, JOURNAL_CHECKSUM)) {
+                ext4_msg(sb, KERN_ERR, "changing journal_checksum "
+                         "during remount not supported");
+                err = -EINVAL;
+                goto restore_opts;
+        }
        if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
                if (test_opt2(sb, EXPLICIT_DELALLOC)) {
                        ext4_msg(sb, KERN_ERR, "can't mount with "
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 881b3bd0143f..fe839b915116 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -29,13 +29,9 @@
 #define BEQUIET
 static int isofs_hashi(const struct dentry *parent, struct qstr *qstr);
-static int isofs_hash(const struct dentry *parent, struct qstr *qstr);
 static int isofs_dentry_cmpi(const struct dentry *parent,
                const struct dentry *dentry,
                unsigned int len, const char *str, const struct qstr *name);
-static int isofs_dentry_cmp(const struct dentry *parent,
-                const struct dentry *dentry,
-                unsigned int len, const char *str, const struct qstr *name);
 #ifdef CONFIG_JOLIET
 static int isofs_hashi_ms(const struct dentry *parent, struct qstr *qstr);
@@ -135,10 +131,6 @@ static const struct super_operations isofs_sops = {
 static const struct dentry_operations isofs_dentry_ops[] = {
        {
-                .d_hash         = isofs_hash,
-                .d_compare      = isofs_dentry_cmp,
-        },
-        {
                .d_hash         = isofs_hashi,
                .d_compare      = isofs_dentry_cmpi,
        },
@@ -258,25 +250,12 @@ static int isofs_dentry_cmp_common(
 }
 static int
-isofs_hash(const struct dentry *dentry, struct qstr *qstr)
-{
-        return isofs_hash_common(qstr, 0);
-}
-static int
 isofs_hashi(const struct dentry *dentry, struct qstr *qstr)
 {
        return isofs_hashi_common(qstr, 0);
 }
 static int
-isofs_dentry_cmp(const struct dentry *parent, const struct dentry *dentry,
-                unsigned int len, const char *str, const struct qstr *name)
-{
-        return isofs_dentry_cmp_common(len, str, name, 0, 0);
-}
-static int
 isofs_dentry_cmpi(const struct dentry *parent, const struct dentry *dentry,
                unsigned int len, const char *str, const struct qstr *name)
 {
@@ -930,7 +909,8 @@ root_found:
        if (opt.check == 'r')
                table++;
-        s->s_d_op = &isofs_dentry_ops[table];
+        if (table)
+                s->s_d_op = &isofs_dentry_ops[table - 1];
        /* get the root dentry */
        s->s_root = d_make_root(inode);
diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c
index 95295640d9c8..7b543e6b6526 100644
--- a/fs/isofs/namei.c
+++ b/fs/isofs/namei.c
@@ -18,25 +18,10 @@ static int
 isofs_cmp(struct dentry *dentry, const char *compare, int dlen)
 {
        struct qstr qstr;
-        if (!compare)
-                return 1;
-        /* check special "." and ".." files */
-        if (dlen == 1) {
-                /* "." */
-                if (compare[0] == 0) {
-                        if (!dentry->d_name.len)
-                                return 0;
-                        compare = ".";
-                } else if (compare[0] == 1) {
-                        compare = "..";
-                        dlen = 2;
-                }
-        }
        qstr.name = compare;
        qstr.len = dlen;
+        if (likely(!dentry->d_op))
+                return dentry->d_name.len != dlen || memcmp(dentry->d_name.name, compare, dlen);
        return dentry->d_op->d_compare(NULL, NULL, dentry->d_name.len, dentry->d_name.name, &qstr);
 }
@@ -146,7 +131,8 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
                                (!(de->flags[-sbi->s_high_sierra] & 1))) &&
                        (sbi->s_showassoc ||
                                (!(de->flags[-sbi->s_high_sierra] & 4)))) {
-                        match = (isofs_cmp(dentry, dpnt, dlen) == 0);
+                        if (dpnt && (dlen > 1 || dpnt[0] > 1))
+                                match = (isofs_cmp(dentry, dpnt, dlen) == 0);
                }
                if (match) {
                        isofs_normalize_block_and_offset(de,
diff --git a/fs/jbd/revoke.c b/fs/jbd/revoke.c
index 8898bbd2b61e..dcead636c33b 100644
--- a/fs/jbd/revoke.c
+++ b/fs/jbd/revoke.c
@@ -93,6 +93,7 @@
 #include <linux/bio.h>
 #endif
 #include <linux/log2.h>
+#include <linux/hash.h>
 static struct kmem_cache *revoke_record_cache;
 static struct kmem_cache *revoke_table_cache;
@@ -129,15 +130,11 @@ static void flush_descriptor(journal_t *, struct journal_head *, int, int);
 /* Utility functions to maintain the revoke table */
-/* Borrowed from buffer.c: this is a tried and tested block hash function */
 static inline int hash(journal_t *journal, unsigned int block)
 {
        struct jbd_revoke_table_s *table = journal->j_revoke;
-        int hash_shift = table->hash_shift;
-        return ((block << (hash_shift - 6)) ^
+        return hash_32(block, table->hash_shift);
-                (block >> 13) ^
-                (block << (hash_shift - 12))) & (table->hash_size - 1);
 }
 static int insert_revoke_hash(journal_t *journal, unsigned int blocknr,
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index d5e95a175c92..c6cbaef2bda1 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -92,6 +92,7 @@
 #include <linux/init.h>
 #include <linux/bio.h>
 #include <linux/log2.h>
+#include <linux/hash.h>
 #endif
 static struct kmem_cache *jbd2_revoke_record_cache;
@@ -130,16 +131,9 @@ static void flush_descriptor(journal_t *, struct buffer_head *, int, int);
 /* Utility functions to maintain the revoke table */
-/* Borrowed from buffer.c: this is a tried and tested block hash function */
 static inline int hash(journal_t *journal, unsigned long long block)
 {
-        struct jbd2_revoke_table_s *table = journal->j_revoke;
+        return hash_64(block, journal->j_revoke->hash_shift);
-        int hash_shift = table->hash_shift;
-        int hash = (int)block ^ (int)((block >> 31) >> 1);
-        return ((hash << (hash_shift - 6)) ^
-                (hash >> 13) ^
-                (hash << (hash_shift - 12))) & (table->hash_size - 1);
 }
 static int insert_revoke_hash(journal_t *journal, unsigned long long blocknr,
diff --git a/fs/namei.c b/fs/namei.c
index 42df664e95e5..db5fe86319e6 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2497,7 +2497,7 @@ struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
        }
        mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
-        mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
+        mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT2);
        return NULL;
 }
 EXPORT_SYMBOL(lock_rename);
@@ -3154,7 +3154,8 @@ static int do_tmpfile(int dfd, struct filename *pathname,
        if (error)
                goto out2;
        audit_inode(pathname, nd->path.dentry, 0);
-        error = may_open(&nd->path, op->acc_mode, op->open_flag);
+        /* Don't check for other permissions, the inode was just created */
+        error = may_open(&nd->path, MAY_OPEN, op->open_flag);
        if (error)
                goto out2;
        file->f_path.mnt = nd->path.mnt;
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index cdeb3cfd6f32..0beb023f25ac 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1272,7 +1272,8 @@ static bool need_wrongsec_check(struct svc_rqst *rqstp)
         */
        if (argp->opcnt == resp->opcnt)
                return false;
+        if (next->opnum == OP_ILLEGAL)
+                return false;
        nextd = OPDESC(next);
        /*
         * Rest of 2.6.3.1.1: certain operations will return WRONGSEC
@@ -1589,7 +1590,8 @@ static inline u32 nfsd4_rename_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op
 static inline u32 nfsd4_sequence_rsize(struct svc_rqst *rqstp,
                                       struct nfsd4_op *op)
 {
-        return NFS4_MAX_SESSIONID_LEN + 20;
+        return (op_encode_hdr_size
+                + XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + 5) * sizeof(__be32);
 }
 static inline u32 nfsd4_setattr_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op)
@@ -1893,6 +1895,7 @@ static struct nfsd4_operation nfsd4_ops[] = {
                .op_func = (nfsd4op_func)nfsd4_sequence,
                .op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP,
                .op_name = "OP_SEQUENCE",
+                .op_rsize_bop = (nfsd4op_rsize)nfsd4_sequence_rsize,
        },
        [OP_DESTROY_CLIENTID] = {
                .op_func = (nfsd4op_func)nfsd4_destroy_clientid,
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index 9ce062218de9..e8497144b323 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -288,20 +288,25 @@ void fsnotify_unmount_inodes(struct list_head *list)
                spin_unlock(&inode->i_lock);
                /* In case the dropping of a reference would nuke next_i. */
-                if ((&next_i->i_sb_list != list) &&
+                while (&next_i->i_sb_list != list) {
-                    atomic_read(&next_i->i_count)) {
                        spin_lock(&next_i->i_lock);
-                        if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) {
+                        if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) &&
+                                                atomic_read(&next_i->i_count)) {
                                __iget(next_i);
                                need_iput = next_i;
+                                spin_unlock(&next_i->i_lock);
+                                break;
                        }
                        spin_unlock(&next_i->i_lock);
+                        next_i = list_entry(next_i->i_sb_list.next,
+                                                struct inode, i_sb_list);
                }
                /*
-                 * We can safely drop inode_sb_list_lock here because we hold
+                 * We can safely drop inode_sb_list_lock here because either
-                 * references on both inode and next_i.  Also no new inodes
+                 * we actually hold references on both inode and next_i or
-                 * will be added since the umount has begun.
+                 * end of list.  Also no new inodes will be added since the
+                 * umount has begun.
                 */
                spin_unlock(&inode_sb_list_lock);
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 8add6f1030d7..b931e04e3388 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -158,7 +158,7 @@ bail_add:
                 * NOTE: This dentry already has ->d_op set from
                 * ocfs2_get_parent() and ocfs2_get_dentry()
                 */
-                if (ret)
+                if (!IS_ERR_OR_NULL(ret))
                        dentry = ret;
                status = ocfs2_dentry_attach_lock(dentry, inode,
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 910553f37aca..4e9d7c1fea52 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -21,9 +21,10 @@ struct ovl_cache_entry {
        unsigned int len;
        unsigned int type;
        u64 ino;
-        bool is_whiteout;
        struct list_head l_node;
        struct rb_node node;
+        bool is_whiteout;
+        bool is_cursor;
        char name[];
 };
@@ -92,6 +93,7 @@ static struct ovl_cache_entry *ovl_cache_entry_new(const char *name, int len,
                p->type = d_type;
                p->ino = ino;
                p->is_whiteout = false;
+                p->is_cursor = false;
        }
        return p;
@@ -251,7 +253,7 @@ static int ovl_dir_mark_whiteouts(struct dentry *dir,
        mutex_lock(&dir->d_inode->i_mutex);
        list_for_each_entry(p, rdd->list, l_node) {
-                if (!p->name)
+                if (p->is_cursor)
                        continue;
                if (p->type != DT_CHR)
@@ -307,7 +309,6 @@ static inline int ovl_dir_read_merged(struct path *upperpath,
        }
 out:
        return err;
 }
 static void ovl_seek_cursor(struct ovl_dir_file *od, loff_t pos)
@@ -316,7 +317,7 @@ static void ovl_seek_cursor(struct ovl_dir_file *od, loff_t pos)
        loff_t off = 0;
        list_for_each_entry(p, &od->cache->entries, l_node) {
-                if (!p->name)
+                if (p->is_cursor)
                        continue;
                if (off >= pos)
                        break;
@@ -389,7 +390,7 @@ static int ovl_iterate(struct file *file, struct dir_context *ctx)
                p = list_entry(od->cursor.l_node.next, struct ovl_cache_entry, l_node);
                /* Skip cursors */
-                if (p->name) {
+                if (!p->is_cursor) {
                        if (!p->is_whiteout) {
                                if (!dir_emit(ctx, p->name, p->len, p->ino, p->type))
                                        break;
@@ -454,12 +455,13 @@ static int ovl_dir_fsync(struct file *file, loff_t start, loff_t end,
        if (!od->is_upper && ovl_path_type(dentry) == OVL_PATH_MERGE) {
                struct inode *inode = file_inode(file);
-                realfile = od->upperfile;
+                realfile =lockless_dereference(od->upperfile);
                if (!realfile) {
                        struct path upperpath;
                        ovl_path_upper(dentry, &upperpath);
                        realfile = ovl_path_open(&upperpath, O_RDONLY);
+                        smp_mb__before_spinlock();
                        mutex_lock(&inode->i_mutex);
                        if (!od->upperfile) {
                                if (IS_ERR(realfile)) {
@@ -518,6 +520,7 @@ static int ovl_dir_open(struct inode *inode, struct file *file)
        od->realfile = realfile;
        od->is_real = (type != OVL_PATH_MERGE);
        od->is_upper = (type != OVL_PATH_LOWER);
+        od->cursor.is_cursor = true;
        file->private_data = od;
        return 0;
@@ -569,7 +572,7 @@ void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list)
 {
        struct ovl_cache_entry *p;
-        mutex_lock_nested(&upper->d_inode->i_mutex, I_MUTEX_PARENT);
+        mutex_lock_nested(&upper->d_inode->i_mutex, I_MUTEX_CHILD);
        list_for_each_entry(p, list, l_node) {
                struct dentry *dentry;
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 8b663b2d9562..6b4527216a7f 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -634,7 +634,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type)
                        dqstats_inc(DQST_LOOKUPS);
                        err = sb->dq_op->write_dquot(dquot);
                        if (!ret && err)
-                                err = ret;
+                                ret = err;
                        dqput(dquot);
                        spin_lock(&dq_list_lock);
                }