11 files changed, 47 insertions, 19 deletions

diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index edb25b4bbb95..70b6f4c3a0c1 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1794,7 +1794,6 @@ static int cifs_writepages(struct address_space *mapping,
         struct TCP_Server_Info *server;
         struct page *page;
         int rc = 0;
-        loff_t isize = i_size_read(mapping->host);
 
         /*
          * If wsize is smaller than the page cache size, default to writing
@@ -1899,7 +1898,7 @@ retry:
                          */
                         set_page_writeback(page);
 
-                        if (page_offset(page) >= isize) {
+                        if (page_offset(page) >= i_size_read(mapping->host)) {
                                 done = true;
                                 unlock_page(page);
                                 end_page_writeback(page);
@@ -1932,7 +1931,8 @@ retry:
                 wdata->offset = page_offset(wdata->pages[0]);
                 wdata->pagesz = PAGE_CACHE_SIZE;
                 wdata->tailsz =
-                        min(isize - page_offset(wdata->pages[nr_pages - 1]),
+                        min(i_size_read(mapping->host) -
+                            page_offset(wdata->pages[nr_pages - 1]),
                             (loff_t)PAGE_CACHE_SIZE);
                 wdata->bytes = ((nr_pages - 1) * PAGE_CACHE_SIZE) +
                                         wdata->tailsz;
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index f9b5d3d6cf33..1c576e871366 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -86,14 +86,17 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name,
 
         dentry = d_lookup(parent, name);
         if (dentry) {
+                int err;
                 inode = dentry->d_inode;
                 /* update inode in place if i_ino didn't change */
                 if (inode && CIFS_I(inode)->uniqueid == fattr->cf_uniqueid) {
                         cifs_fattr_to_inode(inode, fattr);
                         return dentry;
                 }
-                d_drop(dentry);
+                err = d_invalidate(dentry);
                 dput(dentry);
+                if (err)
+                        return NULL;
         }
 
         dentry = d_alloc(parent, name);
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index 56cc4be87807..34cea2798333 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -766,7 +766,6 @@ smb_set_file_info(struct inode *inode, const char *full_path,
         struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
         struct tcon_link *tlink = NULL;
         struct cifs_tcon *tcon;
-        FILE_BASIC_INFO info_buf;
 
         /* if the file is already open for write, just use that fileid */
         open_file = find_writable_file(cinode, true);
@@ -817,7 +816,7 @@ smb_set_file_info(struct inode *inode, const char *full_path,
         netpid = current->tgid;
 
 set_via_filehandle:
-        rc = CIFSSMBSetFileInfo(xid, tcon, &info_buf, netfid, netpid);
+        rc = CIFSSMBSetFileInfo(xid, tcon, buf, netfid, netpid);
         if (!rc)
                 cinode->cifsAttrs = le32_to_cpu(buf->Attributes);
 
diff --git a/fs/file.c b/fs/file.c
index 7cb71b992603..eff23162485f 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -994,16 +994,18 @@ int iterate_fd(struct files_struct *files, unsigned n,
                 const void *p)
 {
         struct fdtable *fdt;
-        struct file *file;
         int res = 0;
         if (!files)
                 return 0;
         spin_lock(&files->file_lock);
-        fdt = files_fdtable(files);
-        while (!res && n < fdt->max_fds) {
-                file = rcu_dereference_check_fdtable(files, fdt->fd[n++]);
-                if (file)
-                        res = f(p, file, n);
+        for (fdt = files_fdtable(files); n < fdt->max_fds; n++) {
+                struct file *file;
+                file = rcu_dereference_check_fdtable(files, fdt->fd[n]);
+                if (!file)
+                        continue;
+                res = f(p, file, n);
+                if (res)
+                        break;
         }
         spin_unlock(&files->file_lock);
         return res;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 51ea267d444c..3e3422f7f0a4 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -228,6 +228,8 @@ static void requeue_io(struct inode *inode, struct bdi_writeback *wb)
 static void inode_sync_complete(struct inode *inode)
 {
         inode->i_state &= ~I_SYNC;
+        /* If inode is clean an unused, put it into LRU now... */
+        inode_add_lru(inode);
         /* Waiters must see I_SYNC cleared before being woken up */
         smp_mb();
         wake_up_bit(&inode->i_state, __I_SYNC);
diff --git a/fs/inode.c b/fs/inode.c
index b03c71957246..64999f144153 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -408,6 +408,19 @@ static void inode_lru_list_add(struct inode *inode)
         spin_unlock(&inode->i_sb->s_inode_lru_lock);
 }
 
+/*
+ * Add inode to LRU if needed (inode is unused and clean).
+ *
+ * Needs inode->i_lock held.
+ */
+void inode_add_lru(struct inode *inode)
+{
+        if (!(inode->i_state & (I_DIRTY | I_SYNC | I_FREEING | I_WILL_FREE)) &&
+            !atomic_read(&inode->i_count) && inode->i_sb->s_flags & MS_ACTIVE)
+                inode_lru_list_add(inode);
+}
+
+
 static void inode_lru_list_del(struct inode *inode)
 {
         spin_lock(&inode->i_sb->s_inode_lru_lock);
@@ -1390,8 +1403,7 @@ static void iput_final(struct inode *inode)
 
         if (!drop && (sb->s_flags & MS_ACTIVE)) {
                 inode->i_state |= I_REFERENCED;
-                if (!(inode->i_state & (I_DIRTY|I_SYNC)))
-                        inode_lru_list_add(inode);
+                inode_add_lru(inode);
                 spin_unlock(&inode->i_lock);
                 return;
         }
diff --git a/fs/internal.h b/fs/internal.h
index 916b7cbf3e3e..2f6af7f645eb 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -110,6 +110,7 @@ extern int open_check_o_direct(struct file *f);
  * inode.c
  */
 extern spinlock_t inode_sb_list_lock;
+extern void inode_add_lru(struct inode *inode);
 
 /*
  * fs-writeback.c
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index 78b7f84241d4..7f5120bf0ec2 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -1961,7 +1961,9 @@ retry:
                         spin_unlock(&journal->j_list_lock);
                         jbd_unlock_bh_state(bh);
                         spin_unlock(&journal->j_state_lock);
+                        unlock_buffer(bh);
                         log_wait_commit(journal, tid);
+                        lock_buffer(bh);
                         goto retry;
                 }
                 /*
diff --git a/fs/namei.c b/fs/namei.c
index 937f9d50c84b..5f4cdf3ad913 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2131,6 +2131,11 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
         if (!len)
                 return ERR_PTR(-EACCES);
 
+        if (unlikely(name[0] == '.')) {
+                if (len < 2 || (len == 2 && name[1] == '.'))
+                        return ERR_PTR(-EACCES);
+        }
+
         while (len--) {
                 c = *(const unsigned char *)name++;
                 if (c == '/' || c == '\0')
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index ce8cb926526b..b9e66b7e0c14 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -450,7 +450,8 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry)
                         nfs_refresh_inode(dentry->d_inode, entry->fattr);
                         goto out;
                 } else {
-                        d_drop(dentry);
+                        if (d_invalidate(dentry) != 0)
+                                goto out;
                         dput(dentry);
                 }
         }
@@ -1100,6 +1101,8 @@ out_set_verifier:
 out_zap_parent:
         nfs_zap_caches(dir);
  out_bad:
+        nfs_free_fattr(fattr);
+        nfs_free_fhandle(fhandle);
         nfs_mark_for_revalidate(dir);
         if (inode && S_ISDIR(inode->i_mode)) {
                 /* Purge readdir caches. */
@@ -1112,8 +1115,6 @@ out_zap_parent:
                 shrink_dcache_parent(dentry);
         }
         d_drop(dentry);
-        nfs_free_fattr(fattr);
-        nfs_free_fhandle(fhandle);
         dput(parent);
         dfprintk(LOOKUPCACHE, "NFS: %s(%s/%s) is invalid\n",
                         __func__, dentry->d_parent->d_name.name,
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 3c231adf8450..9e28356a959a 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1877,8 +1877,9 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
         if (!vma)
                 goto out_no_vma;
 
-        result = proc_map_files_instantiate(dir, dentry, task,
-                        (void *)(unsigned long)vma->vm_file->f_mode);
+        if (vma->vm_file)
+                result = proc_map_files_instantiate(dir, dentry, task,
+                                (void *)(unsigned long)vma->vm_file->f_mode);
 
 out_no_vma:
         up_read(&mm->mmap_sem);