Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6

Pull CIFS fixes from Steve French:
 "This is a set of CIFS/SMB3 fixes for stable.

  There is another set of four SMB3 reconnect fixes for stable in
  progress but they are still being reviewed/tested, so didn't want to
  wait any longer to send these five below"

* 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
  Reset TreeId to zero on SMB2 TREE_CONNECT
  CIFS: Fix build failure with smb2
  Introduce cifs_copy_file_range()
  SMB3: Rename clone_range to copychunk_range
  Handle mismatched open calls

13 files changed, 268 insertions, 90 deletions

diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 15e1db8738ae..dd3f5fabfdf6 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -972,6 +972,86 @@ out:
         return rc;
 }
 
+ssize_t cifs_file_copychunk_range(unsigned int xid,
+                                struct file *src_file, loff_t off,
+                                struct file *dst_file, loff_t destoff,
+                                size_t len, unsigned int flags)
+{
+        struct inode *src_inode = file_inode(src_file);
+        struct inode *target_inode = file_inode(dst_file);
+        struct cifsFileInfo *smb_file_src;
+        struct cifsFileInfo *smb_file_target;
+        struct cifs_tcon *src_tcon;
+        struct cifs_tcon *target_tcon;
+        ssize_t rc;
+
+        cifs_dbg(FYI, "copychunk range\n");
+
+        if (src_inode == target_inode) {
+                rc = -EINVAL;
+                goto out;
+        }
+
+        if (!src_file->private_data || !dst_file->private_data) {
+                rc = -EBADF;
+                cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n");
+                goto out;
+        }
+
+        rc = -EXDEV;
+        smb_file_target = dst_file->private_data;
+        smb_file_src = src_file->private_data;
+        src_tcon = tlink_tcon(smb_file_src->tlink);
+        target_tcon = tlink_tcon(smb_file_target->tlink);
+
+        if (src_tcon->ses != target_tcon->ses) {
+                cifs_dbg(VFS, "source and target of copy not on same server\n");
+                goto out;
+        }
+
+        /*
+         * Note: cifs case is easier than btrfs since server responsible for
+         * checks for proper open modes and file type and if it wants
+         * server could even support copy of range where source = target
+         */
+        lock_two_nondirectories(target_inode, src_inode);
+
+        cifs_dbg(FYI, "about to flush pages\n");
+        /* should we flush first and last page first */
+        truncate_inode_pages(&target_inode->i_data, 0);
+
+        if (target_tcon->ses->server->ops->copychunk_range)
+                rc = target_tcon->ses->server->ops->copychunk_range(xid,
+                        smb_file_src, smb_file_target, off, len, destoff);
+        else
+                rc = -EOPNOTSUPP;
+
+        /* force revalidate of size and timestamps of target file now
+         * that target is updated on the server
+         */
+        CIFS_I(target_inode)->time = 0;
+        /* although unlocking in the reverse order from locking is not
+         * strictly necessary here it is a little cleaner to be consistent
+         */
+        unlock_two_nondirectories(src_inode, target_inode);
+
+out:
+        return rc;
+}
+
+static ssize_t cifs_copy_file_range(struct file *src_file, loff_t off,
+                                struct file *dst_file, loff_t destoff,
+                                size_t len, unsigned int flags)
+{
+        unsigned int xid = get_xid();
+        ssize_t rc;
+
+        rc = cifs_file_copychunk_range(xid, src_file, off, dst_file, destoff,
+                                        len, flags);
+        free_xid(xid);
+        return rc;
+}
+
 const struct file_operations cifs_file_ops = {
         .read_iter = cifs_loose_read_iter,
         .write_iter = cifs_file_write_iter,
@@ -984,6 +1064,7 @@ const struct file_operations cifs_file_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1001,6 +1082,7 @@ const struct file_operations cifs_file_strict_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1018,6 +1100,7 @@ const struct file_operations cifs_file_direct_ops = {
         .mmap = cifs_file_mmap,
         .splice_read = generic_file_splice_read,
         .unlocked_ioctl  = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .llseek = cifs_llseek,
         .setlease = cifs_setlease,
@@ -1035,6 +1118,7 @@ const struct file_operations cifs_file_nobrl_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1051,6 +1135,7 @@ const struct file_operations cifs_file_strict_nobrl_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1067,6 +1152,7 @@ const struct file_operations cifs_file_direct_nobrl_ops = {
         .mmap = cifs_file_mmap,
         .splice_read = generic_file_splice_read,
         .unlocked_ioctl  = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .llseek = cifs_llseek,
         .setlease = cifs_setlease,
@@ -1078,6 +1164,7 @@ const struct file_operations cifs_dir_ops = {
         .release = cifs_closedir,
         .read    = generic_read_dir,
         .unlocked_ioctl  = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .llseek = generic_file_llseek,
 };
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index da717fee3026..30bf89b1fd9a 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -139,6 +139,11 @@ extern ssize_t	cifs_listxattr(struct dentry *, char *, size_t);
 # define cifs_listxattr NULL
 #endif
 
+extern ssize_t cifs_file_copychunk_range(unsigned int xid,
+                                        struct file *src_file, loff_t off,
+                                        struct file *dst_file, loff_t destoff,
+                                        size_t len, unsigned int flags);
+
 extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 #ifdef CONFIG_CIFS_NFSD_EXPORT
 extern const struct export_operations cifs_export_ops;
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index d42dd3288647..d07f13a63369 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -243,6 +243,7 @@ struct smb_version_operations {
         /* verify the message */
         int (*check_message)(char *, unsigned int, struct TCP_Server_Info *);
         bool (*is_oplock_break)(char *, struct TCP_Server_Info *);
+        int (*handle_cancelled_mid)(char *, struct TCP_Server_Info *);
         void (*downgrade_oplock)(struct TCP_Server_Info *,
                                         struct cifsInodeInfo *, bool);
         /* process transaction2 response */
@@ -407,9 +408,10 @@ struct smb_version_operations {
         char * (*create_lease_buf)(u8 *, u8);
         /* parse lease context buffer and return oplock/epoch info */
         __u8 (*parse_lease_buf)(void *, unsigned int *);
-        int (*clone_range)(const unsigned int, struct cifsFileInfo *src_file,
-                        struct cifsFileInfo *target_file, u64 src_off, u64 len,
-                        u64 dest_off);
+        ssize_t (*copychunk_range)(const unsigned int,
+                        struct cifsFileInfo *src_file,
+                        struct cifsFileInfo *target_file,
+                        u64 src_off, u64 len, u64 dest_off);
         int (*duplicate_extents)(const unsigned int, struct cifsFileInfo *src,
                         struct cifsFileInfo *target_file, u64 src_off, u64 len,
                         u64 dest_off);
@@ -1343,6 +1345,7 @@ struct mid_q_entry {
         void *callback_data;      /* general purpose pointer for callback */
         void *resp_buf;         /* pointer to received SMB header */
         int mid_state;  /* wish this were enum but can not pass to wait_event */
+        unsigned int mid_flags;
         __le16 command;         /* smb command code */
         bool large_buf:1;       /* if valid response, is pointer to large buf */
         bool multiRsp:1;        /* multiple trans2 responses for one request  */
@@ -1350,6 +1353,12 @@ struct mid_q_entry {
         bool decrypted:1;       /* decrypted entry */
 };
 
+struct close_cancelled_open {
+        struct cifs_fid         fid;
+        struct cifs_tcon        *tcon;
+        struct work_struct      work;
+};
+
 /*      Make code in transport.c a little cleaner by moving
         update of optional stats into function below */
 #ifdef CONFIG_CIFS_STATS2
@@ -1481,6 +1490,9 @@ static inline void free_dfs_info_array(struct dfs_info3_param *param,
 #define   MID_RESPONSE_MALFORMED 0x10
 #define   MID_SHUTDOWN           0x20
 
+/* Flags */
+#define   MID_WAIT_CANCELLED     1 /* Cancelled while waiting for response */
+
 /* Types of response buffer returned from SendReceive2 */
 #define   CIFS_NO_BUFFER        0    /* Response buffer not returned */
 #define   CIFS_SMALL_BUFFER     1
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 97e5d236d265..ec5e5e514fdd 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -79,7 +79,8 @@ extern void cifs_delete_mid(struct mid_q_entry *mid);
 extern void cifs_wake_up_task(struct mid_q_entry *mid);
 extern int cifs_handle_standard(struct TCP_Server_Info *server,
                                 struct mid_q_entry *mid);
-extern int cifs_discard_remaining_data(struct TCP_Server_Info *server);
+extern int cifs_discard_remaining_data(struct TCP_Server_Info *server,
+                                       char *buf);
 extern int cifs_call_async(struct TCP_Server_Info *server,
                         struct smb_rqst *rqst,
                         mid_receive_t *receive, mid_callback_t *callback,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 066950671929..967b92631807 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1400,9 +1400,9 @@ openRetry:
  * current bigbuf.
  */
 int
-cifs_discard_remaining_data(struct TCP_Server_Info *server)
+cifs_discard_remaining_data(struct TCP_Server_Info *server, char *buf)
 {
-        unsigned int rfclen = get_rfc1002_length(server->smallbuf);
+        unsigned int rfclen = get_rfc1002_length(buf);
         int remaining = rfclen + 4 - server->total_read;
 
         while (remaining > 0) {
@@ -1426,7 +1426,7 @@ cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
         int length;
         struct cifs_readdata *rdata = mid->callback_data;
 
-        length = cifs_discard_remaining_data(server);
+        length = cifs_discard_remaining_data(server, mid->resp_buf);
         dequeue_mid(mid, rdata->result);
         return length;
 }
@@ -1459,7 +1459,7 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 
         if (server->ops->is_status_pending &&
             server->ops->is_status_pending(buf, server, 0)) {
-                cifs_discard_remaining_data(server);
+                cifs_discard_remaining_data(server, buf);
                 return -1;
         }
 
@@ -1519,6 +1519,9 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
         cifs_dbg(FYI, "0: iov_base=%p iov_len=%u\n",
                  rdata->iov[0].iov_base, server->total_read);
 
+        mid->resp_buf = server->smallbuf;
+        server->smallbuf = NULL;
+
         /* how much data is in the response? */
         data_len = server->ops->read_data_length(buf);
         if (data_offset + data_len > buflen) {
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 9ae695ae3ed7..0c7596cef4b8 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -904,10 +904,19 @@ cifs_demultiplex_thread(void *p)
 
                 server->lstrp = jiffies;
                 if (mid_entry != NULL) {
+                        if ((mid_entry->mid_flags & MID_WAIT_CANCELLED) &&
+                             mid_entry->mid_state == MID_RESPONSE_RECEIVED &&
+                                        server->ops->handle_cancelled_mid)
+                                server->ops->handle_cancelled_mid(
+                                                        mid_entry->resp_buf,
+                                                        server);
+
                         if (!mid_entry->multiRsp || mid_entry->multiEnd)
                                 mid_entry->callback(mid_entry);
-                } else if (!server->ops->is_oplock_break ||
-                           !server->ops->is_oplock_break(buf, server)) {
+                } else if (server->ops->is_oplock_break &&
+                           server->ops->is_oplock_break(buf, server)) {
+                        cifs_dbg(FYI, "Received oplock break\n");
+                } else {
                         cifs_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n",
                                  atomic_read(&midCount));
                         cifs_dump_mem("Received Data is: ", buf,
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index 001528781b6b..265c45fe4ea5 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -34,71 +34,14 @@
 #include "cifs_ioctl.h"
 #include <linux/btrfs.h>
 
-static int cifs_file_clone_range(unsigned int xid, struct file *src_file,
-                          struct file *dst_file)
-{
-        struct inode *src_inode = file_inode(src_file);
-        struct inode *target_inode = file_inode(dst_file);
-        struct cifsFileInfo *smb_file_src;
-        struct cifsFileInfo *smb_file_target;
-        struct cifs_tcon *src_tcon;
-        struct cifs_tcon *target_tcon;
-        int rc;
-
-        cifs_dbg(FYI, "ioctl clone range\n");
-
-        if (!src_file->private_data || !dst_file->private_data) {
-                rc = -EBADF;
-                cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n");
-                goto out;
-        }
-
-        rc = -EXDEV;
-        smb_file_target = dst_file->private_data;
-        smb_file_src = src_file->private_data;
-        src_tcon = tlink_tcon(smb_file_src->tlink);
-        target_tcon = tlink_tcon(smb_file_target->tlink);
-
-        if (src_tcon->ses != target_tcon->ses) {
-                cifs_dbg(VFS, "source and target of copy not on same server\n");
-                goto out;
-        }
-
-        /*
-         * Note: cifs case is easier than btrfs since server responsible for
-         * checks for proper open modes and file type and if it wants
-         * server could even support copy of range where source = target
-         */
-        lock_two_nondirectories(target_inode, src_inode);
-
-        cifs_dbg(FYI, "about to flush pages\n");
-        /* should we flush first and last page first */
-        truncate_inode_pages(&target_inode->i_data, 0);
-
-        if (target_tcon->ses->server->ops->clone_range)
-                rc = target_tcon->ses->server->ops->clone_range(xid,
-                        smb_file_src, smb_file_target, 0, src_inode->i_size, 0);
-        else
-                rc = -EOPNOTSUPP;
-
-        /* force revalidate of size and timestamps of target file now
-           that target is updated on the server */
-        CIFS_I(target_inode)->time = 0;
-        /* although unlocking in the reverse order from locking is not
-           strictly necessary here it is a little cleaner to be consistent */
-        unlock_two_nondirectories(src_inode, target_inode);
-out:
-        return rc;
-}
-
-static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
+static long cifs_ioctl_copychunk(unsigned int xid, struct file *dst_file,
                         unsigned long srcfd)
 {
         int rc;
         struct fd src_file;
         struct inode *src_inode;
 
-        cifs_dbg(FYI, "ioctl clone range\n");
+        cifs_dbg(FYI, "ioctl copychunk range\n");
         /* the destination must be opened for writing */
         if (!(dst_file->f_mode & FMODE_WRITE)) {
                 cifs_dbg(FYI, "file target not open for write\n");
@@ -129,7 +72,8 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
         if (S_ISDIR(src_inode->i_mode))
                 goto out_fput;
 
-        rc = cifs_file_clone_range(xid, src_file.file, dst_file);
+        rc = cifs_file_copychunk_range(xid, src_file.file, 0, dst_file, 0,
+                                        src_inode->i_size, 0);
 
 out_fput:
         fdput(src_file);
@@ -251,7 +195,7 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
                         }
                         break;
                 case CIFS_IOC_COPYCHUNK_FILE:
-                        rc = cifs_ioctl_clone(xid, filep, arg);
+                        rc = cifs_ioctl_copychunk(xid, filep, arg);
                         break;
                 case CIFS_IOC_SET_INTEGRITY:
                         if (pSMBFile == NULL)
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index fd516ea8b8f8..1a04b3a5beb1 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -659,3 +659,49 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
         cifs_dbg(FYI, "Can not process oplock break for non-existent connection\n");
         return false;
 }
+
+void
+smb2_cancelled_close_fid(struct work_struct *work)
+{
+        struct close_cancelled_open *cancelled = container_of(work,
+                                        struct close_cancelled_open, work);
+
+        cifs_dbg(VFS, "Close unmatched open\n");
+
+        SMB2_close(0, cancelled->tcon, cancelled->fid.persistent_fid,
+                   cancelled->fid.volatile_fid);
+        cifs_put_tcon(cancelled->tcon);
+        kfree(cancelled);
+}
+
+int
+smb2_handle_cancelled_mid(char *buffer, struct TCP_Server_Info *server)
+{
+        struct smb2_sync_hdr *sync_hdr = get_sync_hdr(buffer);
+        struct smb2_create_rsp *rsp = (struct smb2_create_rsp *)buffer;
+        struct cifs_tcon *tcon;
+        struct close_cancelled_open *cancelled;
+
+        if (sync_hdr->Command != SMB2_CREATE ||
+            sync_hdr->Status != STATUS_SUCCESS)
+                return 0;
+
+        cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL);
+        if (!cancelled)
+                return -ENOMEM;
+
+        tcon = smb2_find_smb_tcon(server, sync_hdr->SessionId,
+                                  sync_hdr->TreeId);
+        if (!tcon) {
+                kfree(cancelled);
+                return -ENOENT;
+        }
+
+        cancelled->fid.persistent_fid = rsp->PersistentFileId;
+        cancelled->fid.volatile_fid = rsp->VolatileFileId;
+        cancelled->tcon = tcon;
+        INIT_WORK(&cancelled->work, smb2_cancelled_close_fid);
+        queue_work(cifsiod_wq, &cancelled->work);
+
+        return 0;
+}
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 0231108d9387..7b12a727947e 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -21,6 +21,7 @@
 #include <linux/vfs.h>
 #include <linux/falloc.h>
 #include <linux/scatterlist.h>
+#include <linux/uuid.h>
 #include <crypto/aead.h>
 #include "cifsglob.h"
 #include "smb2pdu.h"
@@ -592,8 +593,8 @@ req_res_key_exit:
         return rc;
 }
 
-static int
-smb2_clone_range(const unsigned int xid,
+static ssize_t
+smb2_copychunk_range(const unsigned int xid,
                         struct cifsFileInfo *srcfile,
                         struct cifsFileInfo *trgtfile, u64 src_off,
                         u64 len, u64 dest_off)
@@ -605,13 +606,14 @@ smb2_clone_range(const unsigned int xid,
         struct cifs_tcon *tcon;
         int chunks_copied = 0;
         bool chunk_sizes_updated = false;
+        ssize_t bytes_written, total_bytes_written = 0;
 
         pcchunk = kmalloc(sizeof(struct copychunk_ioctl), GFP_KERNEL);
 
         if (pcchunk == NULL)
                 return -ENOMEM;
 
-        cifs_dbg(FYI, "in smb2_clone_range - about to call request res key\n");
+        cifs_dbg(FYI, "in smb2_copychunk_range - about to call request res key\n");
         /* Request a key from the server to identify the source of the copy */
         rc = SMB2_request_res_key(xid, tlink_tcon(srcfile->tlink),
                                 srcfile->fid.persistent_fid,
@@ -669,14 +671,16 @@ smb2_clone_range(const unsigned int xid,
                         }
                         chunks_copied++;
 
-                        src_off += le32_to_cpu(retbuf->TotalBytesWritten);
-                        dest_off += le32_to_cpu(retbuf->TotalBytesWritten);
-                        len -= le32_to_cpu(retbuf->TotalBytesWritten);
+                        bytes_written = le32_to_cpu(retbuf->TotalBytesWritten);
+                        src_off += bytes_written;
+                        dest_off += bytes_written;
+                        len -= bytes_written;
+                        total_bytes_written += bytes_written;
 
-                        cifs_dbg(FYI, "Chunks %d PartialChunk %d Total %d\n",
+                        cifs_dbg(FYI, "Chunks %d PartialChunk %d Total %zu\n",
                                 le32_to_cpu(retbuf->ChunksWritten),
                                 le32_to_cpu(retbuf->ChunkBytesWritten),
-                                le32_to_cpu(retbuf->TotalBytesWritten));
+                                bytes_written);
                 } else if (rc == -EINVAL) {
                         if (ret_data_len != sizeof(struct copychunk_ioctl_rsp))
                                 goto cchunk_out;
@@ -713,7 +717,10 @@ smb2_clone_range(const unsigned int xid,
 cchunk_out:
         kfree(pcchunk);
         kfree(retbuf);
-        return rc;
+        if (rc)
+                return rc;
+        else
+                return total_bytes_written;
 }
 
 static int
@@ -2188,7 +2195,7 @@ receive_encrypted_read(struct TCP_Server_Info *server, struct mid_q_entry **mid)
         if (rc)
                 goto free_pages;
 
-        rc = cifs_discard_remaining_data(server);
+        rc = cifs_discard_remaining_data(server, buf);
         if (rc)
                 goto free_pages;
 
@@ -2214,7 +2221,7 @@ free_pages:
         kfree(pages);
         return rc;
 discard_data:
-        cifs_discard_remaining_data(server);
+        cifs_discard_remaining_data(server, buf);
         goto free_pages;
 }
 
@@ -2322,6 +2329,7 @@ struct smb_version_operations smb20_operations = {
         .clear_stats = smb2_clear_stats,
         .print_stats = smb2_print_stats,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2377,7 +2385,7 @@ struct smb_version_operations smb20_operations = {
         .set_oplock_level = smb2_set_oplock_level,
         .create_lease_buf = smb2_create_lease_buf,
         .parse_lease_buf = smb2_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .wp_retry_size = smb2_wp_retry_size,
         .dir_needs_close = smb2_dir_needs_close,
         .get_dfs_refer = smb2_get_dfs_refer,
@@ -2404,6 +2412,7 @@ struct smb_version_operations smb21_operations = {
         .clear_stats = smb2_clear_stats,
         .print_stats = smb2_print_stats,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2459,7 +2468,7 @@ struct smb_version_operations smb21_operations = {
         .set_oplock_level = smb21_set_oplock_level,
         .create_lease_buf = smb2_create_lease_buf,
         .parse_lease_buf = smb2_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .wp_retry_size = smb2_wp_retry_size,
         .dir_needs_close = smb2_dir_needs_close,
         .enum_snapshots = smb3_enum_snapshots,
@@ -2488,6 +2497,7 @@ struct smb_version_operations smb30_operations = {
         .print_stats = smb2_print_stats,
         .dump_share_caps = smb2_dump_share_caps,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2545,7 +2555,7 @@ struct smb_version_operations smb30_operations = {
         .set_oplock_level = smb3_set_oplock_level,
         .create_lease_buf = smb3_create_lease_buf,
         .parse_lease_buf = smb3_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .duplicate_extents = smb2_duplicate_extents,
         .validate_negotiate = smb3_validate_negotiate,
         .wp_retry_size = smb2_wp_retry_size,
@@ -2582,6 +2592,7 @@ struct smb_version_operations smb311_operations = {
         .print_stats = smb2_print_stats,
         .dump_share_caps = smb2_dump_share_caps,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2639,7 +2650,7 @@ struct smb_version_operations smb311_operations = {
         .set_oplock_level = smb3_set_oplock_level,
         .create_lease_buf = smb3_create_lease_buf,
         .parse_lease_buf = smb3_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .duplicate_extents = smb2_duplicate_extents,
 /*      .validate_negotiate = smb3_validate_negotiate, */ /* not used in 3.11 */
         .wp_retry_size = smb2_wp_retry_size,
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 7446496850a3..66fa1b941cdf 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1185,6 +1185,10 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
                 return -EINVAL;
         }
 
+        /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */
+        if (tcon)
+                tcon->tid = 0;
+
         rc = small_smb2_init(SMB2_TREE_CONNECT, tcon, (void **) &req);
         if (rc) {
                 kfree(unc_path);
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 69e35873b1de..6853454fc871 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -48,6 +48,10 @@ extern struct mid_q_entry *smb2_setup_request(struct cifs_ses *ses,
                               struct smb_rqst *rqst);
 extern struct mid_q_entry *smb2_setup_async_request(
                         struct TCP_Server_Info *server, struct smb_rqst *rqst);
+extern struct cifs_ses *smb2_find_smb_ses(struct TCP_Server_Info *server,
+                                           __u64 ses_id);
+extern struct cifs_tcon *smb2_find_smb_tcon(struct TCP_Server_Info *server,
+                                                __u64 ses_id, __u32  tid);
 extern int smb2_calc_signature(struct smb_rqst *rqst,
                                 struct TCP_Server_Info *server);
 extern int smb3_calc_signature(struct smb_rqst *rqst,
@@ -164,6 +168,9 @@ extern int SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
 extern int SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
                              const u64 persistent_fid, const u64 volatile_fid,
                              const __u8 oplock_level);
+extern int smb2_handle_cancelled_mid(char *buffer,
+                                        struct TCP_Server_Info *server);
+void smb2_cancelled_close_fid(struct work_struct *work);
 extern int SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
                          u64 persistent_file_id, u64 volatile_file_id,
                          struct kstatfs *FSData);
diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
index 7c3bb1bd7eed..506b67fc93d9 100644
--- a/fs/cifs/smb2transport.c
+++ b/fs/cifs/smb2transport.c
@@ -115,23 +115,70 @@ smb3_crypto_shash_allocate(struct TCP_Server_Info *server)
         return 0;
 }
 
-struct cifs_ses *
-smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id)
+static struct cifs_ses *
+smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id)
 {
         struct cifs_ses *ses;
 
-        spin_lock(&cifs_tcp_ses_lock);
         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
                 if (ses->Suid != ses_id)
                         continue;
-                spin_unlock(&cifs_tcp_ses_lock);
                 return ses;
         }
+
+        return NULL;
+}
+
+struct cifs_ses *
+smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id)
+{
+        struct cifs_ses *ses;
+
+        spin_lock(&cifs_tcp_ses_lock);
+        ses = smb2_find_smb_ses_unlocked(server, ses_id);
         spin_unlock(&cifs_tcp_ses_lock);
 
+        return ses;
+}
+
+static struct cifs_tcon *
+smb2_find_smb_sess_tcon_unlocked(struct cifs_ses *ses, __u32  tid)
+{
+        struct cifs_tcon *tcon;
+
+        list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
+                if (tcon->tid != tid)
+                        continue;
+                ++tcon->tc_count;
+                return tcon;
+        }
+
         return NULL;
 }
 
+/*
+ * Obtain tcon corresponding to the tid in the given
+ * cifs_ses
+ */
+
+struct cifs_tcon *
+smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32  tid)
+{
+        struct cifs_ses *ses;
+        struct cifs_tcon *tcon;
+
+        spin_lock(&cifs_tcp_ses_lock);
+        ses = smb2_find_smb_ses_unlocked(server, ses_id);
+        if (!ses) {
+                spin_unlock(&cifs_tcp_ses_lock);
+                return NULL;
+        }
+        tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid);
+        spin_unlock(&cifs_tcp_ses_lock);
+
+        return tcon;
+}
+
 int
 smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
 {
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 526f0533cb4e..f6e13a977fc8 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -752,9 +752,11 @@ cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
 
         rc = wait_for_response(ses->server, midQ);
         if (rc != 0) {
+                cifs_dbg(FYI, "Cancelling wait for mid %llu\n", midQ->mid);
                 send_cancel(ses->server, rqst, midQ);
                 spin_lock(&GlobalMid_Lock);
                 if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+                        midQ->mid_flags |= MID_WAIT_CANCELLED;
                         midQ->callback = DeleteMidQEntry;
                         spin_unlock(&GlobalMid_Lock);
                         add_credits(ses->server, 1, optype);