MFS of 246289:

For UFS2 i_blocks is unsigned. The current "sanity" check that it
has gone below zero after the blocks in its inode are freed is a
no-op which the compiler fails to warn about because of the use of
the DIP macro. Change the sanity check to compare the number of
blocks being freed against the value i_blocks. If the number of
blocks being freed exceeds i_blocks, just set i_blocks to zero.

Reported by: Pedro Giffuni (pfg@)
MFS of 246812:

Update fsck_ffs buffer cache manager to use TAILQ macros.
No functional changes.
MFC r246823:

Remove write only assignments and thus fix the build after struct bufarea
TAILQ conversion (r246812).
MFC r246641: fts: Use O_DIRECTORY when opening name that might be changed by
attacker.

There are uncommon cases where fts_safe_changedir() may be called with a
non-NULL name that is not "..". Do not block or worse if an attacker put (a
symlink to) a fifo or device where a directory used to be.
MFC r248252: libc: Avoid SIGPIPE when nscd closes the connection
unexpectedly.

It is almost always a bug if nscd closes the connection unexpectedly but
programs should not be killed with SIGPIPE for it.
MFC r246824,r246952: setbuf(3): Bring BUGS section up to date.
MFC of 246876 and 246877

MFC: 246876:

Add barrier write capability to the VFS buffer interface. A barrier
write is a disk write request that tells the disk that the buffer
being written must be committed to the media along with any writes
that preceeded it before any future blocks may be written to the drive.

Barrier writes are provided by adding the functions bbarrierwrite
(bwrite with barrier) and babarrierwrite (bawrite with barrier).

Following a bbarrierwrite the client knows that the requested buffer
is on the media. It does not ensure that buffers written before that
buffer are on the media. It only ensure that buffers written before
that buffer will get to the media before any buffers written after
that buffer. A flush command must be sent to the disk to ensure that
all earlier written buffers are on the media.

Reviewed by: kib
Tested by:   Peter Holm

MFC 246877:

The UFS2 filesystem allocates new blocks of inodes as they are needed.
When a cylinder group runs short of inodes, a new block for inodes is
allocated, zero'ed, and written to the disk. The zero'ed inodes must
be on the disk before the cylinder group can be updated to claim them.
If the cylinder group claiming the new inodes were written before the
zero'ed block of inodes, the system could crash with the filesystem in
an unrecoverable state.

Rather than adding a soft updates dependency to ensure that the new
inode block is written before it is claimed by the cylinder group
map, we just do a barrier write of the zero'ed inode block to ensure
that it will get written before the updated cylinder group map can
be written. This change should only slow down bulk loading of newly
created filesystems since that is the primary time that new inode
blocks need to be created.

Reported by: Robert Watson
Reviewed by: kib
Tested by:   Peter Holm
MFC r247387:
Inode block must not be read or written while cg block buffer is owned.
MFC r248422:
Remove negative name cache entry pointing to the target name, which
could be instantiated while tdvp was unlocked.
MFC r248446: find: Include nanoseconds when comparing timestamps of files.

When comparing to the timestamp of a given file using -newer, -Xnewer and
-newerXY (where X and Y are one of m, c, a, B), include nanoseconds in the
comparison.

The primaries that compare a timestamp of a file to a given value (-Xmin,
-Xtime, -newerXt) continue to compare times in whole seconds.

Note that the default value 0 of vfs.timestamp_precision almost always
causes the nanoseconds part to be 0. However, touch -d can set a timestamp
to the microsecond regardless of that sysctl.
Merge remote-tracking branch 'upstream/stable/9' into stable/9