15 files changed, 92 insertions, 101 deletions

diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 8fecc99be344..f52c5ab78f9d 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -3892,13 +3892,12 @@ CIFSSMBSetCIFSACL(const int xid, struct cifs_tcon *tcon, __u16 fid,
         int rc = 0;
         int bytes_returned = 0;
         SET_SEC_DESC_REQ *pSMB = NULL;
-        NTRANSACT_RSP *pSMBr = NULL;
+        void *pSMBr;
 
 setCifsAclRetry:
-        rc = smb_init(SMB_COM_NT_TRANSACT, 19, tcon, (void **) &pSMB,
-                        (void **) &pSMBr);
+        rc = smb_init(SMB_COM_NT_TRANSACT, 19, tcon, (void **) &pSMB, &pSMBr);
         if (rc)
-                        return (rc);
+                return rc;
 
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
@@ -3926,9 +3925,8 @@ setCifsAclRetry:
         pSMB->AclFlags = cpu_to_le32(aclflag);
 
         if (pntsd && acllen) {
-                memcpy((char *) &pSMBr->hdr.Protocol + data_offset,
-                        (char *) pntsd,
-                        acllen);
+                memcpy((char *)pSMBr + offsetof(struct smb_hdr, Protocol) +
+                                data_offset, pntsd, acllen);
                 inc_rfc1001_len(pSMB, byte_count + data_count);
         } else
                 inc_rfc1001_len(pSMB, byte_count);
@@ -5708,7 +5706,8 @@ CIFSSMBSetFileInfo(const int xid, struct cifs_tcon *tcon,
         param_offset = offsetof(struct smb_com_transaction2_sfi_req, Fid) - 4;
         offset = param_offset + params;
 
-        data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
+        data_offset = (char *)pSMB +
+                        offsetof(struct smb_hdr, Protocol) + offset;
 
         count = sizeof(FILE_BASIC_INFO);
         pSMB->MaxParameterCount = cpu_to_le16(2);
@@ -5977,7 +5976,7 @@ CIFSSMBUnixSetFileInfo(const int xid, struct cifs_tcon *tcon,
                        u16 fid, u32 pid_of_opener)
 {
         struct smb_com_transaction2_sfi_req *pSMB  = NULL;
-        FILE_UNIX_BASIC_INFO *data_offset;
+        char *data_offset;
         int rc = 0;
         u16 params, param_offset, offset, byte_count, count;
 
@@ -5999,8 +5998,9 @@ CIFSSMBUnixSetFileInfo(const int xid, struct cifs_tcon *tcon,
         param_offset = offsetof(struct smb_com_transaction2_sfi_req, Fid) - 4;
         offset = param_offset + params;
 
-        data_offset = (FILE_UNIX_BASIC_INFO *)
-                                ((char *)(&pSMB->hdr.Protocol) + offset);
+        data_offset = (char *)pSMB +
+                        offsetof(struct smb_hdr, Protocol) + offset;
+
         count = sizeof(FILE_UNIX_BASIC_INFO);
 
         pSMB->MaxParameterCount = cpu_to_le16(2);
@@ -6022,7 +6022,7 @@ CIFSSMBUnixSetFileInfo(const int xid, struct cifs_tcon *tcon,
         inc_rfc1001_len(pSMB, byte_count);
         pSMB->ByteCount = cpu_to_le16(byte_count);
 
-        cifs_fill_unix_set_info(data_offset, args);
+        cifs_fill_unix_set_info((FILE_UNIX_BASIC_INFO *)data_offset, args);
 
         rc = SendReceiveNoRsp(xid, tcon->ses, (char *) pSMB, 0);
         if (rc)
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 302a15c505a9..d81e933a796b 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1565,8 +1565,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
 
                         /* Obtain the value string */
                         value = strchr(data, '=');
-                        if (value != NULL)
-                                *value++ = '\0';
+                        value++;
 
                         /* Set tmp_end to end of the string */
                         tmp_end = (char *) value + strlen(value);
@@ -1649,6 +1648,13 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                                 goto cifs_parse_mount_err;
                         }
 
+                        vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
+                        if (vol->UNC == NULL) {
+                                printk(KERN_WARNING "CIFS: no memory for UNC\n");
+                                goto cifs_parse_mount_err;
+                        }
+                        strcpy(vol->UNC, string);
+
                         if (strncmp(string, "//", 2) == 0) {
                                 vol->UNC[0] = '\\';
                                 vol->UNC[1] = '\\';
@@ -1658,13 +1664,6 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                                 goto cifs_parse_mount_err;
                         }
 
-                        vol->UNC = kmalloc(temp_len+1, GFP_KERNEL);
-                        if (vol->UNC == NULL) {
-                                printk(KERN_WARNING "CIFS: no memory "
-                                                    "for UNC\n");
-                                goto cifs_parse_mount_err;
-                        }
-                        strcpy(vol->UNC, string);
                         break;
                 case Opt_domain:
                         string = match_strdup(args);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 460d87b7cda0..fae765dac934 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -835,13 +835,21 @@ cifs_posix_lock_set(struct file *file, struct file_lock *flock)
         if ((flock->fl_flags & FL_POSIX) == 0)
                 return rc;
 
+try_again:
         mutex_lock(&cinode->lock_mutex);
         if (!cinode->can_cache_brlcks) {
                 mutex_unlock(&cinode->lock_mutex);
                 return rc;
         }
-        rc = posix_lock_file_wait(file, flock);
+
+        rc = posix_lock_file(file, flock, NULL);
         mutex_unlock(&cinode->lock_mutex);
+        if (rc == FILE_LOCK_DEFERRED) {
+                rc = wait_event_interruptible(flock->fl_wait, !flock->fl_next);
+                if (!rc)
+                        goto try_again;
+                locks_delete_block(flock);
+        }
         return rc;
 }
 
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index dd23a321bdda..581c225f7f50 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -197,8 +197,7 @@ cifs_convert_address(struct sockaddr *dst, const char *src, int len)
                 memcpy(scope_id, pct + 1, slen);
                 scope_id[slen] = '\0';
 
-                rc = strict_strtoul(scope_id, 0,
-                                        (unsigned long *)&s6->sin6_scope_id);
+                rc = kstrtouint(scope_id, 0, &s6->sin6_scope_id);
                 rc = (rc == 0) ? 1 : 0;
         }
 
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index 21e93605161c..5dfafdd1dbd3 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -33,18 +33,10 @@ static ssize_t default_write_file(struct file *file, const char __user *buf,
         return count;
 }
 
-static int default_open(struct inode *inode, struct file *file)
-{
-        if (inode->i_private)
-                file->private_data = inode->i_private;
-
-        return 0;
-}
-
 const struct file_operations debugfs_file_operations = {
         .read =         default_read_file,
         .write =        default_write_file,
-        .open =         default_open,
+        .open =         simple_open,
         .llseek =       noop_llseek,
 };
 
@@ -447,7 +439,7 @@ static ssize_t write_file_bool(struct file *file, const char __user *user_buf,
 static const struct file_operations fops_bool = {
         .read =         read_file_bool,
         .write =        write_file_bool,
-        .open =         default_open,
+        .open =         simple_open,
         .llseek =       default_llseek,
 };
 
@@ -492,7 +484,7 @@ static ssize_t read_file_blob(struct file *file, char __user *user_buf,
 
 static const struct file_operations fops_blob = {
         .read =         read_file_blob,
-        .open =         default_open,
+        .open =         simple_open,
         .llseek =       default_llseek,
 };
 
diff --git a/fs/dlm/debug_fs.c b/fs/dlm/debug_fs.c
index 3dca2b39e83f..1c9b08095f98 100644
--- a/fs/dlm/debug_fs.c
+++ b/fs/dlm/debug_fs.c
@@ -609,13 +609,6 @@ static const struct file_operations format3_fops = {
 /*
  * dump lkb's on the ls_waiters list
  */
-
-static int waiters_open(struct inode *inode, struct file *file)
-{
-        file->private_data = inode->i_private;
-        return 0;
-}
-
 static ssize_t waiters_read(struct file *file, char __user *userbuf,
                             size_t count, loff_t *ppos)
 {
@@ -644,7 +637,7 @@ static ssize_t waiters_read(struct file *file, char __user *userbuf,
 
 static const struct file_operations waiters_fops = {
         .owner   = THIS_MODULE,
-        .open    = waiters_open,
+        .open    = simple_open,
         .read    = waiters_read,
         .llseek  = default_llseek,
 };
diff --git a/fs/exec.c b/fs/exec.c
index 9a1d9f0a60ab..b1fd2025e59a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1371,7 +1371,7 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
         unsigned int depth = bprm->recursion_depth;
         int try,retval;
         struct linux_binfmt *fmt;
-        pid_t old_pid;
+        pid_t old_pid, old_vpid;
 
         retval = security_bprm_check(bprm);
         if (retval)
@@ -1382,8 +1382,9 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
                 return retval;
 
         /* Need to fetch pid before load_binary changes it */
+        old_pid = current->pid;
         rcu_read_lock();
-        old_pid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
+        old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
         rcu_read_unlock();
 
         retval = -ENOENT;
@@ -1406,7 +1407,7 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
                         if (retval >= 0) {
                                 if (depth == 0) {
                                         trace_sched_process_exec(current, old_pid, bprm);
-                                        ptrace_event(PTRACE_EVENT_EXEC, old_pid);
+                                        ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
                                 }
                                 put_binfmt(fmt);
                                 allow_write_access(bprm->file);
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index ea251749d9d5..28cf06e4ec84 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -1031,7 +1031,6 @@ static int __init init_hugetlbfs_fs(void)
         }
 
         error = PTR_ERR(vfsmount);
-        unregister_filesystem(&hugetlbfs_fs_type);
 
  out:
         kmem_cache_destroy(hugetlbfs_inode_cachep);
diff --git a/fs/libfs.c b/fs/libfs.c
index 4a0d1f06da57..358094f0433d 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -264,6 +264,13 @@ Enomem:
         return ERR_PTR(-ENOMEM);
 }
 
+int simple_open(struct inode *inode, struct file *file)
+{
+        if (inode->i_private)
+                file->private_data = inode->i_private;
+        return 0;
+}
+
 int simple_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry)
 {
         struct inode *inode = old_dentry->d_inode;
@@ -984,6 +991,7 @@ EXPORT_SYMBOL(simple_dir_operations);
 EXPORT_SYMBOL(simple_empty);
 EXPORT_SYMBOL(simple_fill_super);
 EXPORT_SYMBOL(simple_getattr);
+EXPORT_SYMBOL(simple_open);
 EXPORT_SYMBOL(simple_link);
 EXPORT_SYMBOL(simple_lookup);
 EXPORT_SYMBOL(simple_pin_fs);
diff --git a/fs/locks.c b/fs/locks.c
index 637694bf3a03..0d68f1f81799 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -510,12 +510,13 @@ static void __locks_delete_block(struct file_lock *waiter)
 
 /*
  */
-static void locks_delete_block(struct file_lock *waiter)
+void locks_delete_block(struct file_lock *waiter)
 {
         lock_flocks();
         __locks_delete_block(waiter);
         unlock_flocks();
 }
+EXPORT_SYMBOL(locks_delete_block);
 
 /* Insert waiter into blocker's block list.
  * We use a circular list so that processes can be easily woken up in
diff --git a/fs/namei.c b/fs/namei.c
index 1898198abc3d..0062dd17eb55 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1407,18 +1407,9 @@ static inline int can_lookup(struct inode *inode)
  */
 #ifdef CONFIG_DCACHE_WORD_ACCESS
 
-#ifdef CONFIG_64BIT
+#include <asm/word-at-a-time.h>
 
-/*
- * Jan Achrenius on G+: microoptimized version of
- * the simpler "(mask & ONEBYTES) * ONEBYTES >> 56"
- * that works for the bytemasks without having to
- * mask them first.
- */
-static inline long count_masked_bytes(unsigned long mask)
-{
-        return mask*0x0001020304050608ul >> 56;
-}
+#ifdef CONFIG_64BIT
 
 static inline unsigned int fold_hash(unsigned long hash)
 {
@@ -1428,15 +1419,6 @@ static inline unsigned int fold_hash(unsigned long hash)
 
 #else   /* 32-bit case */
 
-/* Carl Chatfield / Jan Achrenius G+ version for 32-bit */
-static inline long count_masked_bytes(long mask)
-{
-        /* (000000 0000ff 00ffff ffffff) -> ( 1 1 2 3 ) */
-        long a = (0x0ff0001+mask) >> 23;
-        /* Fix the 1 for 00 case */
-        return a & mask;
-}
-
 #define fold_hash(x) (x)
 
 #endif
@@ -1464,17 +1446,6 @@ done:
 }
 EXPORT_SYMBOL(full_name_hash);
 
-#define REPEAT_BYTE(x)  ((~0ul / 0xff) * (x))
-#define ONEBYTES        REPEAT_BYTE(0x01)
-#define SLASHBYTES      REPEAT_BYTE('/')
-#define HIGHBITS        REPEAT_BYTE(0x80)
-
-/* Return the high bit set in the first byte that is a zero */
-static inline unsigned long has_zero(unsigned long a)
-{
-        return ((a - ONEBYTES) & ~a) & HIGHBITS;
-}
-
 /*
  * Calculate the length and hash of the path component, and
  * return the length of the component;
@@ -1490,7 +1461,7 @@ static inline unsigned long hash_name(const char *name, unsigned int *hashp)
                 len += sizeof(unsigned long);
                 a = *(unsigned long *)(name+len);
                 /* Do we have any NUL or '/' bytes in this word? */
-                mask = has_zero(a) | has_zero(a ^ SLASHBYTES);
+                mask = has_zero(a) | has_zero(a ^ REPEAT_BYTE('/'));
         } while (!mask);
 
         /* The mask *below* the first high bit set */
diff --git a/fs/proc/root.c b/fs/proc/root.c
index 46a15d8a29ca..eed44bfc85db 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -115,12 +115,13 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
         if (IS_ERR(sb))
                 return ERR_CAST(sb);
 
+        if (!proc_parse_options(options, ns)) {
+                deactivate_locked_super(sb);
+                return ERR_PTR(-EINVAL);
+        }
+
         if (!sb->s_root) {
                 sb->s_flags = flags;
-                if (!proc_parse_options(options, ns)) {
-                        deactivate_locked_super(sb);
-                        return ERR_PTR(-EINVAL);
-                }
                 err = proc_fill_super(sb);
                 if (err) {
                         deactivate_locked_super(sb);
diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c
index 50952c9bd06c..19507889bb7f 100644
--- a/fs/pstore/inode.c
+++ b/fs/pstore/inode.c
@@ -52,12 +52,6 @@ struct pstore_private {
         char    data[];
 };
 
-static int pstore_file_open(struct inode *inode, struct file *file)
-{
-        file->private_data = inode->i_private;
-        return 0;
-}
-
 static ssize_t pstore_file_read(struct file *file, char __user *userbuf,
                                                 size_t count, loff_t *ppos)
 {
@@ -67,7 +61,7 @@ static ssize_t pstore_file_read(struct file *file, char __user *userbuf,
 }
 
 static const struct file_operations pstore_file_operations = {
-        .open   = pstore_file_open,
+        .open   = simple_open,
         .read   = pstore_file_read,
         .llseek = default_llseek,
 };
diff --git a/fs/splice.c b/fs/splice.c
index 5f883de7ef3a..f8476841eb04 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -30,6 +30,7 @@
 #include <linux/uio.h>
 #include <linux/security.h>
 #include <linux/gfp.h>
+#include <linux/socket.h>
 
 /*
  * Attempt to steal a page from a pipe buffer. This should perhaps go into
@@ -690,7 +691,9 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
         if (!likely(file->f_op && file->f_op->sendpage))
                 return -EINVAL;
 
-        more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
+        more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0;
+        if (sd->len < sd->total_len)
+                more |= MSG_SENDPAGE_NOTLAST;
         return file->f_op->sendpage(file, buf->page, buf->offset,
                                     sd->len, &pos, more);
 }
diff --git a/fs/xattr.c b/fs/xattr.c
index d6dfd247bb2f..3c8c1cc333c7 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -19,8 +19,9 @@
 #include <linux/export.h>
 #include <linux/fsnotify.h>
 #include <linux/audit.h>
-#include <asm/uaccess.h>
+#include <linux/vmalloc.h>
 
+#include <asm/uaccess.h>
 
 /*
  * Check permissions for extended attribute access.  This is a bit complicated
@@ -320,6 +321,7 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
 {
         int error;
         void *kvalue = NULL;
+        void *vvalue = NULL;    /* If non-NULL, we used vmalloc() */
         char kname[XATTR_NAME_MAX + 1];
 
         if (flags & ~(XATTR_CREATE|XATTR_REPLACE))
@@ -334,13 +336,25 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
         if (size) {
                 if (size > XATTR_SIZE_MAX)
                         return -E2BIG;
-                kvalue = memdup_user(value, size);
-                if (IS_ERR(kvalue))
-                        return PTR_ERR(kvalue);
+                kvalue = kmalloc(size, GFP_KERNEL | __GFP_NOWARN);
+                if (!kvalue) {
+                        vvalue = vmalloc(size);
+                        if (!vvalue)
+                                return -ENOMEM;
+                        kvalue = vvalue;
+                }
+                if (copy_from_user(kvalue, value, size)) {
+                        error = -EFAULT;
+                        goto out;
+                }
         }
 
         error = vfs_setxattr(d, kname, kvalue, size, flags);
-        kfree(kvalue);
+out:
+        if (vvalue)
+                vfree(vvalue);
+        else
+                kfree(kvalue);
         return error;
 }
 
@@ -492,13 +506,18 @@ listxattr(struct dentry *d, char __user *list, size_t size)
 {
         ssize_t error;
         char *klist = NULL;
+        char *vlist = NULL;     /* If non-NULL, we used vmalloc() */
 
         if (size) {
                 if (size > XATTR_LIST_MAX)
                         size = XATTR_LIST_MAX;
-                klist = kmalloc(size, GFP_KERNEL);
-                if (!klist)
-                        return -ENOMEM;
+                klist = kmalloc(size, __GFP_NOWARN | GFP_KERNEL);
+                if (!klist) {
+                        vlist = vmalloc(size);
+                        if (!vlist)
+                                return -ENOMEM;
+                        klist = vlist;
+                }
         }
 
         error = vfs_listxattr(d, klist, size);
@@ -510,7 +529,10 @@ listxattr(struct dentry *d, char __user *list, size_t size)
                    than XATTR_LIST_MAX bytes. Not possible. */
                 error = -E2BIG;
         }
-        kfree(klist);
+        if (vlist)
+                vfree(vlist);
+        else
+                kfree(klist);
         return error;
 }