3 files changed, 15 insertions, 19 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 2097684cf194..b303dfc7dce0 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -901,13 +901,10 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
                 mutex_unlock(&cgroup_mutex);
 
                 /*
-                 * We want to drop the active superblock reference from the
-                 * cgroup creation after all the dentry refs are gone -
-                 * kill_sb gets mighty unhappy otherwise.  Mark
-                 * dentry->d_fsdata with cgroup_diput() to tell
-                 * cgroup_d_release() to call deactivate_super().
+                 * Drop the active superblock reference that we took when we
+                 * created the cgroup
                  */
-                dentry->d_fsdata = cgroup_diput;
+                deactivate_super(cgrp->root->sb);
 
                 /*
                  * if we're getting rid of the cgroup, refcount should ensure
@@ -933,13 +930,6 @@ static int cgroup_delete(const struct dentry *d)
         return 1;
 }
 
-static void cgroup_d_release(struct dentry *dentry)
-{
-        /* did cgroup_diput() tell me to deactivate super? */
-        if (dentry->d_fsdata == cgroup_diput)
-                deactivate_super(dentry->d_sb);
-}
-
 static void remove_dir(struct dentry *d)
 {
         struct dentry *parent = dget(d->d_parent);
@@ -1547,7 +1537,6 @@ static int cgroup_get_rootdir(struct super_block *sb)
         static const struct dentry_operations cgroup_dops = {
                 .d_iput = cgroup_diput,
                 .d_delete = cgroup_delete,
-                .d_release = cgroup_d_release,
         };
 
         struct inode *inode =
@@ -3894,8 +3883,12 @@ static void css_dput_fn(struct work_struct *work)
 {
         struct cgroup_subsys_state *css =
                 container_of(work, struct cgroup_subsys_state, dput_work);
+        struct dentry *dentry = css->cgroup->dentry;
+        struct super_block *sb = dentry->d_sb;
 
-        dput(css->cgroup->dentry);
+        atomic_inc(&sb->s_active);
+        dput(dentry);
+        deactivate_super(sb);
 }
 
 static void init_cgroup_css(struct cgroup_subsys_state *css,
diff --git a/kernel/relay.c b/kernel/relay.c
index ab56a1764d4d..e8cd2027abbd 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1235,6 +1235,7 @@ static ssize_t subbuf_splice_actor(struct file *in,
         struct splice_pipe_desc spd = {
                 .pages = pages,
                 .nr_pages = 0,
+                .nr_pages_max = PIPE_DEF_BUFFERS,
                 .partial = partial,
                 .flags = flags,
                 .ops = &relay_pipe_buf_ops,
@@ -1302,8 +1303,8 @@ static ssize_t subbuf_splice_actor(struct file *in,
                 ret += padding;
 
 out:
-        splice_shrink_spd(pipe, &spd);
-        return ret;
+        splice_shrink_spd(&spd);
+        return ret;
 }
 
 static ssize_t relay_file_splice_read(struct file *in,
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 49249c28690d..a7fa0702be1c 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3609,6 +3609,7 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
                 .pages          = pages_def,
                 .partial        = partial_def,
                 .nr_pages       = 0, /* This gets updated below. */
+                .nr_pages_max   = PIPE_DEF_BUFFERS,
                 .flags          = flags,
                 .ops            = &tracing_pipe_buf_ops,
                 .spd_release    = tracing_spd_release_pipe,
@@ -3680,7 +3681,7 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
 
         ret = splice_to_pipe(pipe, &spd);
 out:
-        splice_shrink_spd(pipe, &spd);
+        splice_shrink_spd(&spd);
         return ret;
 
 out_err:
@@ -4231,6 +4232,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
         struct splice_pipe_desc spd = {
                 .pages          = pages_def,
                 .partial        = partial_def,
+                .nr_pages_max   = PIPE_DEF_BUFFERS,
                 .flags          = flags,
                 .ops            = &buffer_pipe_buf_ops,
                 .spd_release    = buffer_spd_release,
@@ -4318,7 +4320,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
         }
 
         ret = splice_to_pipe(pipe, &spd);
-        splice_shrink_spd(pipe, &spd);
+        splice_shrink_spd(&spd);
 out:
         return ret;
 }