33 files changed, 812 insertions, 567 deletions

diff --git a/fs/afs/file.c b/fs/afs/file.c
index 7a1d942ef68..0149dab365e 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -102,6 +102,7 @@ int afs_release(struct inode *inode, struct file *file)
         return 0;
 }
 
+#ifdef CONFIG_AFS_FSCACHE
 /*
  * deal with notification that a page was read from the cache
  */
@@ -117,6 +118,7 @@ static void afs_file_readpage_read_complete(struct page *page,
                 SetPageUptodate(page);
         unlock_page(page);
 }
+#endif
 
 /*
  * AFS read page from file, directory or symlink
diff --git a/fs/bio.c b/fs/bio.c
index e0c9e545bbf..cd42bb882f3 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -348,6 +348,24 @@ err:
         return NULL;
 }
 
+/**
+ * bio_alloc - allocate a bio for I/O
+ * @gfp_mask:   the GFP_ mask given to the slab allocator
+ * @nr_iovecs:  number of iovecs to pre-allocate
+ *
+ * Description:
+ *   bio_alloc will allocate a bio and associated bio_vec array that can hold
+ *   at least @nr_iovecs entries. Allocations will be done from the
+ *   fs_bio_set. Also see @bio_alloc_bioset.
+ *
+ *   If %__GFP_WAIT is set, then bio_alloc will always be able to allocate
+ *   a bio. This is due to the mempool guarantees. To make this work, callers
+ *   must never allocate more than 1 bio at the time from this pool. Callers
+ *   that need to allocate more than 1 bio must always submit the previously
+ *   allocate bio for IO before attempting to allocate a new one. Failure to
+ *   do so can cause livelocks under memory pressure.
+ *
+ **/
 struct bio *bio_alloc(gfp_t gfp_mask, int nr_iovecs)
 {
         struct bio *bio = bio_alloc_bioset(gfp_mask, nr_iovecs, fs_bio_set);
diff --git a/fs/buffer.c b/fs/buffer.c
index 13edf7ad3ff..b3e5be7514f 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -360,7 +360,7 @@ still_busy:
  * Completion handler for block_write_full_page() - pages which are unlocked
  * during I/O, and which have PageWriteback cleared upon I/O completion.
  */
-static void end_buffer_async_write(struct buffer_head *bh, int uptodate)
+void end_buffer_async_write(struct buffer_head *bh, int uptodate)
 {
         char b[BDEVNAME_SIZE];
         unsigned long flags;
@@ -438,11 +438,17 @@ static void mark_buffer_async_read(struct buffer_head *bh)
         set_buffer_async_read(bh);
 }
 
-void mark_buffer_async_write(struct buffer_head *bh)
+void mark_buffer_async_write_endio(struct buffer_head *bh,
+                                   bh_end_io_t *handler)
 {
-        bh->b_end_io = end_buffer_async_write;
+        bh->b_end_io = handler;
         set_buffer_async_write(bh);
 }
+
+void mark_buffer_async_write(struct buffer_head *bh)
+{
+        mark_buffer_async_write_endio(bh, end_buffer_async_write);
+}
 EXPORT_SYMBOL(mark_buffer_async_write);
 
 
@@ -547,7 +553,7 @@ repeat:
         return err;
 }
 
-void do_thaw_all(unsigned long unused)
+void do_thaw_all(struct work_struct *work)
 {
         struct super_block *sb;
         char b[BDEVNAME_SIZE];
@@ -567,6 +573,7 @@ restart:
                         goto restart;
         }
         spin_unlock(&sb_lock);
+        kfree(work);
         printk(KERN_WARNING "Emergency Thaw complete\n");
 }
 
@@ -577,7 +584,13 @@ restart:
  */
 void emergency_thaw_all(void)
 {
-        pdflush_operation(do_thaw_all, 0);
+        struct work_struct *work;
+
+        work = kmalloc(sizeof(*work), GFP_ATOMIC);
+        if (work) {
+                INIT_WORK(work, do_thaw_all);
+                schedule_work(work);
+        }
 }
 
 /**
@@ -1608,7 +1621,8 @@ EXPORT_SYMBOL(unmap_underlying_metadata);
  * unplugging the device queue.
  */
 static int __block_write_full_page(struct inode *inode, struct page *page,
-                        get_block_t *get_block, struct writeback_control *wbc)
+                        get_block_t *get_block, struct writeback_control *wbc,
+                        bh_end_io_t *handler)
 {
         int err;
         sector_t block;
@@ -1693,7 +1707,7 @@ static int __block_write_full_page(struct inode *inode, struct page *page,
                         continue;
                 }
                 if (test_clear_buffer_dirty(bh)) {
-                        mark_buffer_async_write(bh);
+                        mark_buffer_async_write_endio(bh, handler);
                 } else {
                         unlock_buffer(bh);
                 }
@@ -1746,7 +1760,7 @@ recover:
                 if (buffer_mapped(bh) && buffer_dirty(bh) &&
                     !buffer_delay(bh)) {
                         lock_buffer(bh);
-                        mark_buffer_async_write(bh);
+                        mark_buffer_async_write_endio(bh, handler);
                 } else {
                         /*
                          * The buffer may have been set dirty during
@@ -2672,7 +2686,8 @@ int nobh_writepage(struct page *page, get_block_t *get_block,
 out:
         ret = mpage_writepage(page, get_block, wbc);
         if (ret == -EAGAIN)
-                ret = __block_write_full_page(inode, page, get_block, wbc);
+                ret = __block_write_full_page(inode, page, get_block, wbc,
+                                              end_buffer_async_write);
         return ret;
 }
 EXPORT_SYMBOL(nobh_writepage);
@@ -2830,9 +2845,10 @@ out:
 
 /*
  * The generic ->writepage function for buffer-backed address_spaces
+ * this form passes in the end_io handler used to finish the IO.
  */
-int block_write_full_page(struct page *page, get_block_t *get_block,
-                        struct writeback_control *wbc)
+int block_write_full_page_endio(struct page *page, get_block_t *get_block,
+                        struct writeback_control *wbc, bh_end_io_t *handler)
 {
         struct inode * const inode = page->mapping->host;
         loff_t i_size = i_size_read(inode);
@@ -2841,7 +2857,8 @@ int block_write_full_page(struct page *page, get_block_t *get_block,
 
         /* Is the page fully inside i_size? */
         if (page->index < end_index)
-                return __block_write_full_page(inode, page, get_block, wbc);
+                return __block_write_full_page(inode, page, get_block, wbc,
+                                               handler);
 
         /* Is the page fully outside i_size? (truncate in progress) */
         offset = i_size & (PAGE_CACHE_SIZE-1);
@@ -2864,9 +2881,20 @@ int block_write_full_page(struct page *page, get_block_t *get_block,
          * writes to that region are not written out to the file."
          */
         zero_user_segment(page, offset, PAGE_CACHE_SIZE);
-        return __block_write_full_page(inode, page, get_block, wbc);
+        return __block_write_full_page(inode, page, get_block, wbc, handler);
 }
 
+/*
+ * The generic ->writepage function for buffer-backed address_spaces
+ */
+int block_write_full_page(struct page *page, get_block_t *get_block,
+                        struct writeback_control *wbc)
+{
+        return block_write_full_page_endio(page, get_block, wbc,
+                                           end_buffer_async_write);
+}
+
+
 sector_t generic_block_bmap(struct address_space *mapping, sector_t block,
                             get_block_t *get_block)
 {
@@ -3335,9 +3363,11 @@ EXPORT_SYMBOL(block_read_full_page);
 EXPORT_SYMBOL(block_sync_page);
 EXPORT_SYMBOL(block_truncate_page);
 EXPORT_SYMBOL(block_write_full_page);
+EXPORT_SYMBOL(block_write_full_page_endio);
 EXPORT_SYMBOL(cont_write_begin);
 EXPORT_SYMBOL(end_buffer_read_sync);
 EXPORT_SYMBOL(end_buffer_write_sync);
+EXPORT_SYMBOL(end_buffer_async_write);
 EXPORT_SYMBOL(file_fsync);
 EXPORT_SYMBOL(generic_block_bmap);
 EXPORT_SYMBOL(generic_cont_expand_simple);
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 65984006192..9d1fb6ec8a5 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -15,7 +15,8 @@ Posix file open support added (turned off after one attempt if server
 fails to support it properly, as with Samba server versions prior to 3.3.2)
 Fix "redzone overwritten" bug in cifs_put_tcon (CIFSTcon may allocate too
 little memory for the "nativeFileSystem" field returned by the server
-during mount). 
+during mount).  Endian convert inode numbers if necessary (makes it easier
+to compare inode numbers on network files from big endian systems). 
 
 Version 1.56
 ------------
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 3fd3a9df043..67bf93a40d2 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -41,7 +41,7 @@ cifs_spnego_key_instantiate(struct key *key, const void *data, size_t datalen)
 
         /* attach the data */
         memcpy(payload, data, datalen);
-        rcu_assign_pointer(key->payload.data, payload);
+        key->payload.data = payload;
         ret = 0;
 
 error:
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 38491fd3871..0d6d8b57365 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -66,9 +66,6 @@ unsigned int sign_CIFS_PDUs = 1;
 extern struct task_struct *oplockThread; /* remove sparse warning */
 struct task_struct *oplockThread = NULL;
 /* extern struct task_struct * dnotifyThread; remove sparse warning */
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-static struct task_struct *dnotifyThread = NULL;
-#endif
 static const struct super_operations cifs_super_ops;
 unsigned int CIFSMaxBufSize = CIFS_MAX_MSGSIZE;
 module_param(CIFSMaxBufSize, int, 0);
@@ -316,6 +313,7 @@ cifs_alloc_inode(struct super_block *sb)
         cifs_inode->clientCanCacheAll = false;
         cifs_inode->delete_pending = false;
         cifs_inode->vfs_inode.i_blkbits = 14;  /* 2**14 = CIFS_MAX_MSGSIZE */
+        cifs_inode->server_eof = 0;
 
         /* Can not set i_flags here - they get immediately overwritten
            to zero by the VFS */
@@ -1040,34 +1038,6 @@ static int cifs_oplock_thread(void *dummyarg)
         return 0;
 }
 
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-static int cifs_dnotify_thread(void *dummyarg)
-{
-        struct list_head *tmp;
-        struct TCP_Server_Info *server;
-
-        do {
-                if (try_to_freeze())
-                        continue;
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(15*HZ);
-                /* check if any stuck requests that need
-                   to be woken up and wakeq so the
-                   thread can wake up and error out */
-                read_lock(&cifs_tcp_ses_lock);
-                list_for_each(tmp, &cifs_tcp_ses_list) {
-                        server = list_entry(tmp, struct TCP_Server_Info,
-                                         tcp_ses_list);
-                        if (atomic_read(&server->inFlight))
-                                wake_up_all(&server->response_q);
-                }
-                read_unlock(&cifs_tcp_ses_lock);
-        } while (!kthread_should_stop());
-
-        return 0;
-}
-#endif
-
 static int __init
 init_cifs(void)
 {
@@ -1144,21 +1114,8 @@ init_cifs(void)
                 goto out_unregister_dfs_key_type;
         }
 
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-        dnotifyThread = kthread_run(cifs_dnotify_thread, NULL, "cifsdnotifyd");
-        if (IS_ERR(dnotifyThread)) {
-                rc = PTR_ERR(dnotifyThread);
-                cERROR(1, ("error %d create dnotify thread", rc));
-                goto out_stop_oplock_thread;
-        }
-#endif
-
         return 0;
 
-#ifdef CONFIG_CIFS_EXPERIMENTAL
- out_stop_oplock_thread:
-#endif
-        kthread_stop(oplockThread);
  out_unregister_dfs_key_type:
 #ifdef CONFIG_CIFS_DFS_UPCALL
         unregister_key_type(&key_type_dns_resolver);
@@ -1196,9 +1153,6 @@ exit_cifs(void)
         cifs_destroy_inodecache();
         cifs_destroy_mids();
         cifs_destroy_request_bufs();
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-        kthread_stop(dnotifyThread);
-#endif
         kthread_stop(oplockThread);
 }
 
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 9fbf4dff5da..df40ab64cd9 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -350,7 +350,7 @@ struct cifsFileInfo {
         bool invalidHandle:1;   /* file closed via session abend */
         bool messageMode:1;     /* for pipes: message vs byte mode */
         atomic_t wrtPending;   /* handle in use - defer close */
-        struct semaphore fh_sem; /* prevents reopen race after dead ses*/
+        struct mutex fh_mutex; /* prevents reopen race after dead ses*/
         struct cifs_search_info srch_inf;
 };
 
@@ -370,6 +370,7 @@ struct cifsInodeInfo {
         bool clientCanCacheAll:1;       /* read and writebehind oplock */
         bool oplockPending:1;
         bool delete_pending:1;          /* DELETE_ON_CLOSE is set */
+        u64  server_eof;                /* current file size on server */
         struct inode vfs_inode;
 };
 
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index b370489c8da..a785f69dbc9 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -2163,7 +2163,7 @@ typedef struct {
         __le32 Type;
         __le64 DevMajor;
         __le64 DevMinor;
-        __u64 UniqueId;
+        __le64 UniqueId;
         __le64 Permissions;
         __le64 Nlinks;
 } __attribute__((packed)) FILE_UNIX_BASIC_INFO; /* level 0x200 QPathInfo */
@@ -2308,7 +2308,7 @@ struct unlink_psx_rq { /* level 0x20a SetPathInfo */
 } __attribute__((packed));
 
 struct file_internal_info {
-        __u64  UniqueId; /* inode number */
+        __le64  UniqueId; /* inode number */
 } __attribute__((packed));      /* level 0x3ee */
 
 struct file_mode_info {
@@ -2338,7 +2338,7 @@ typedef struct {
         __le32 Type;
         __le64 DevMajor;
         __le64 DevMinor;
-        __u64 UniqueId;
+        __le64 UniqueId;
         __le64 Permissions;
         __le64 Nlinks;
         char FileName[1];
@@ -2386,7 +2386,7 @@ typedef struct {
         __le32 FileNameLength;
         __le32 EaSize; /* EA size */
         __le32 Reserved;
-        __u64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/
+        __le64 UniqueId; /* inode num - le since Samba puts ino in low 32 bit*/
         char FileName[1];
 } __attribute__((packed)) SEARCH_ID_FULL_DIR_INFO; /* level 0x105 FF rsp data */
 
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index bc09c998631..a0845dc7b8a 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1626,6 +1626,8 @@ CIFSSMBWrite2(const int xid, struct cifsTconInfo *tcon,
         int smb_hdr_len;
         int resp_buf_type = 0;
 
+        *nbytes = 0;
+
         cFYI(1, ("write2 at %lld %d bytes", (long long)offset, count));
 
         if (tcon->ses->capabilities & CAP_LARGE_FILES) {
@@ -1682,11 +1684,9 @@ CIFSSMBWrite2(const int xid, struct cifsTconInfo *tcon,
         cifs_stats_inc(&tcon->num_writes);
         if (rc) {
                 cFYI(1, ("Send error Write2 = %d", rc));
-                *nbytes = 0;
         } else if (resp_buf_type == 0) {
                 /* presumably this can not happen, but best to be safe */
                 rc = -EIO;
-                *nbytes = 0;
         } else {
                 WRITE_RSP *pSMBr = (WRITE_RSP *)iov[0].iov_base;
                 *nbytes = le16_to_cpu(pSMBr->CountHigh);
@@ -3918,7 +3918,7 @@ GetInodeNumberRetry:
                         }
                         pfinfo = (struct file_internal_info *)
                                 (data_offset + (char *) &pSMBr->hdr.Protocol);
-                        *inode_number = pfinfo->UniqueId;
+                        *inode_number = le64_to_cpu(pfinfo->UniqueId);
                 }
         }
 GetInodeNumOut:
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 0de3b5615a2..bacdef1546b 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2214,9 +2214,58 @@ is_path_accessible(int xid, struct cifsTconInfo *tcon,
         return rc;
 }
 
+static void
+cleanup_volume_info(struct smb_vol **pvolume_info)
+{
+        struct smb_vol *volume_info;
+
+        if (!pvolume_info && !*pvolume_info)
+                return;
+
+        volume_info = *pvolume_info;
+        kzfree(volume_info->password);
+        kfree(volume_info->UNC);
+        kfree(volume_info->prepath);
+        kfree(volume_info);
+        *pvolume_info = NULL;
+        return;
+}
+
+#ifdef CONFIG_CIFS_DFS_UPCALL
+/* build_path_to_root returns full path to root when
+ * we do not have an exiting connection (tcon) */
+static char *
+build_unc_path_to_root(const struct smb_vol *volume_info,
+                const struct cifs_sb_info *cifs_sb)
+{
+        char *full_path;
+
+        int unc_len = strnlen(volume_info->UNC, MAX_TREE_SIZE + 1);
+        full_path = kmalloc(unc_len + cifs_sb->prepathlen + 1, GFP_KERNEL);
+        if (full_path == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        strncpy(full_path, volume_info->UNC, unc_len);
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
+                int i;
+                for (i = 0; i < unc_len; i++) {
+                        if (full_path[i] == '\\')
+                                full_path[i] = '/';
+                }
+        }
+
+        if (cifs_sb->prepathlen)
+                strncpy(full_path + unc_len, cifs_sb->prepath,
+                                cifs_sb->prepathlen);
+
+        full_path[unc_len + cifs_sb->prepathlen] = 0; /* add trailing null */
+        return full_path;
+}
+#endif
+
 int
 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
-           char *mount_data, const char *devname)
+                char *mount_data_global, const char *devname)
 {
         int rc = 0;
         int xid;
@@ -2225,6 +2274,13 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         struct cifsTconInfo *tcon = NULL;
         struct TCP_Server_Info *srvTcp = NULL;
         char   *full_path;
+        char *mount_data = mount_data_global;
+#ifdef CONFIG_CIFS_DFS_UPCALL
+        struct dfs_info3_param *referrals = NULL;
+        unsigned int num_referrals = 0;
+try_mount_again:
+#endif
+        full_path = NULL;
 
         xid = GetXid();
 
@@ -2371,11 +2427,9 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                 }
                         }
 
-                        /* check for null share name ie connect to dfs root */
                         if ((strchr(volume_info->UNC + 3, '\\') == NULL)
                             && (strchr(volume_info->UNC + 3, '/') == NULL)) {
-                                /* rc = connect_to_dfs_path(...) */
-                                cFYI(1, ("DFS root not supported"));
+                                cERROR(1, ("Missing share name"));
                                 rc = -ENODEV;
                                 goto mount_fail_check;
                         } else {
@@ -2392,7 +2446,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                 }
                         }
                         if (rc)
-                                goto mount_fail_check;
+                                goto remote_path_check;
                         tcon->seal = volume_info->seal;
                         write_lock(&cifs_tcp_ses_lock);
                         list_add(&tcon->tcon_list, &pSesInfo->tcon_list);
@@ -2417,19 +2471,9 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         /* BB FIXME fix time_gran to be larger for LANMAN sessions */
         sb->s_time_gran = 100;
 
-mount_fail_check:
-        /* on error free sesinfo and tcon struct if needed */
-        if (rc) {
-                /* If find_unc succeeded then rc == 0 so we can not end */
-                /* up accidently freeing someone elses tcon struct */
-                if (tcon)
-                        cifs_put_tcon(tcon);
-                else if (pSesInfo)
-                        cifs_put_smb_ses(pSesInfo);
-                else
-                        cifs_put_tcp_session(srvTcp);
-                goto out;
-        }
+        if (rc)
+                goto remote_path_check;
+
         cifs_sb->tcon = tcon;
 
         /* do not care if following two calls succeed - informational */
@@ -2461,7 +2505,9 @@ mount_fail_check:
                 cifs_sb->rsize = min(cifs_sb->rsize,
                                (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
 
-        if (!rc && cifs_sb->prepathlen) {
+remote_path_check:
+        /* check if a whole path (including prepath) is not remote */
+        if (!rc && cifs_sb->prepathlen && tcon) {
                 /* build_path_to_root works only when we have a valid tcon */
                 full_path = cifs_build_path_to_root(cifs_sb);
                 if (full_path == NULL) {
@@ -2469,31 +2515,79 @@ mount_fail_check:
                         goto mount_fail_check;
                 }
                 rc = is_path_accessible(xid, tcon, cifs_sb, full_path);
-                if (rc) {
-                        cERROR(1, ("Path %s in not accessible: %d",
-                                                full_path, rc));
+                if (rc != -EREMOTE) {
                         kfree(full_path);
                         goto mount_fail_check;
                 }
                 kfree(full_path);
         }
 
+        /* get referral if needed */
+        if (rc == -EREMOTE) {
+#ifdef CONFIG_CIFS_DFS_UPCALL
+                /* convert forward to back slashes in prepath here if needed */
+                if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
+                        convert_delimiter(cifs_sb->prepath,
+                                        CIFS_DIR_SEP(cifs_sb));
+                full_path = build_unc_path_to_root(volume_info, cifs_sb);
+                if (IS_ERR(full_path)) {
+                        rc = PTR_ERR(full_path);
+                        goto mount_fail_check;
+                }
+
+                cFYI(1, ("Getting referral for: %s", full_path));
+                rc = get_dfs_path(xid, pSesInfo , full_path + 1,
+                        cifs_sb->local_nls, &num_referrals, &referrals,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
+                if (!rc && num_referrals > 0) {
+                        char *fake_devname = NULL;
+
+                        if (mount_data != mount_data_global)
+                                kfree(mount_data);
+                        mount_data = cifs_compose_mount_options(
+                                        cifs_sb->mountdata, full_path + 1,
+                                        referrals, &fake_devname);
+                        kfree(fake_devname);
+                        free_dfs_info_array(referrals, num_referrals);
+
+                        if (tcon)
+                                cifs_put_tcon(tcon);
+                        else if (pSesInfo)
+                                cifs_put_smb_ses(pSesInfo);
+
+                        cleanup_volume_info(&volume_info);
+                        FreeXid(xid);
+                        kfree(full_path);
+                        goto try_mount_again;
+                }
+#else /* No DFS support, return error on mount */
+                rc = -EOPNOTSUPP;
+#endif
+        }
+
+mount_fail_check:
+        /* on error free sesinfo and tcon struct if needed */
+        if (rc) {
+                if (mount_data != mount_data_global)
+                        kfree(mount_data);
+                /* If find_unc succeeded then rc == 0 so we can not end */
+                /* up accidently freeing someone elses tcon struct */
+                if (tcon)
+                        cifs_put_tcon(tcon);
+                else if (pSesInfo)
+                        cifs_put_smb_ses(pSesInfo);
+                else
+                        cifs_put_tcp_session(srvTcp);
+                goto out;
+        }
+
         /* volume_info->password is freed above when existing session found
         (in which case it is not needed anymore) but when new sesion is created
         the password ptr is put in the new session structure (in which case the
         password will be freed at unmount time) */
 out:
         /* zero out password before freeing */
-        if (volume_info) {
-                if (volume_info->password != NULL) {
-                        memset(volume_info->password, 0,
-                                strlen(volume_info->password));
-                        kfree(volume_info->password);
-                }
-                kfree(volume_info->UNC);
-                kfree(volume_info->prepath);
-                kfree(volume_info);
-        }
+        cleanup_volume_info(&volume_info);
         FreeXid(xid);
         return rc;
 }
@@ -2673,8 +2767,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
 /* We look for obvious messed up bcc or strings in response so we do not go off
    the end since (at least) WIN2K and Windows XP have a major bug in not null
    terminating last Unicode string in response  */
-                                if (ses->serverOS)
-                                        kfree(ses->serverOS);
+                                kfree(ses->serverOS);
                                 ses->serverOS = kzalloc(2 * (len + 1),
                                                         GFP_KERNEL);
                                 if (ses->serverOS == NULL)
@@ -2710,8 +2803,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
                                 /* last string is not always null terminated
                                    (for e.g. for Windows XP & 2000) */
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain =
                                                     kzalloc(2*(len+1),
                                                             GFP_KERNEL);
@@ -2725,8 +2817,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 ses->serverDomain[1+(2*len)] = 0;
                                         } else { /* else no more room so create
                                                   dummy domain string */
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain =
                                                         kzalloc(2, GFP_KERNEL);
                                         }
@@ -2772,8 +2863,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                         bcc_ptr++;
 
                                         len = strnlen(bcc_ptr, 1024);
-                                        if (ses->serverDomain)
-                                                kfree(ses->serverDomain);
+                                        kfree(ses->serverDomain);
                                         ses->serverDomain = kzalloc(len + 1,
                                                                     GFP_KERNEL);
                                         if (ses->serverDomain == NULL)
@@ -3013,8 +3103,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
 /* We look for obvious messed up bcc or strings in response so we do not go off
    the end since (at least) WIN2K and Windows XP have a major bug in not null
    terminating last Unicode string in response  */
-                                        if (ses->serverOS)
-                                                kfree(ses->serverOS);
+                                        kfree(ses->serverOS);
                                         ses->serverOS =
                                             kzalloc(2 * (len + 1), GFP_KERNEL);
                                         cifs_strfromUCS_le(ses->serverOS,
@@ -3086,8 +3175,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                         if (((long) bcc_ptr + len) - (long)
                                             pByteArea(smb_buffer_response)
                                             <= BCC(smb_buffer_response)) {
-                                                if (ses->serverOS)
-                                                        kfree(ses->serverOS);
+                                                kfree(ses->serverOS);
                                                 ses->serverOS =
                                                     kzalloc(len + 1,
                                                             GFP_KERNEL);
@@ -3414,8 +3502,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
 /* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
-                                        if (ses->serverOS)
-                                                kfree(ses->serverOS);
+                                        kfree(ses->serverOS);
                                         ses->serverOS =
                                             kzalloc(2 * (len + 1), GFP_KERNEL);
                                         cifs_strfromUCS_le(ses->serverOS,
@@ -3448,8 +3535,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 if (remaining_words > 0) {
                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
      /* last string not always null terminated (e.g. for Windows XP & 2000) */
-                                                        if (ses->serverDomain)
-                                                                kfree(ses->serverDomain);
+                                                        kfree(ses->serverDomain);
                                                         ses->serverDomain =
                                                             kzalloc(2 *
                                                                     (len +
@@ -3476,13 +3562,11 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                             = 0;
                                                 } /* else no more room so create dummy domain string */
                                                 else {
-                                                        if (ses->serverDomain)
-                                                                kfree(ses->serverDomain);
+                                                        kfree(ses->serverDomain);
                                                         ses->serverDomain = kzalloc(2,GFP_KERNEL);
                                                 }
                                         } else {  /* no room so create dummy domain and NOS string */
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain = kzalloc(2, GFP_KERNEL);
                                                 kfree(ses->serverNOS);
                                                 ses->serverNOS = kzalloc(2, GFP_KERNEL);
@@ -3492,8 +3576,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                         if (((long) bcc_ptr + len) -
                                            (long) pByteArea(smb_buffer_response)
                                                 <= BCC(smb_buffer_response)) {
-                                                if (ses->serverOS)
-                                                        kfree(ses->serverOS);
+                                                kfree(ses->serverOS);
                                                 ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
                                                 strncpy(ses->serverOS,bcc_ptr, len);
 
@@ -3512,8 +3595,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 bcc_ptr++;
 
                                                 len = strnlen(bcc_ptr, 1024);
-                                                if (ses->serverDomain)
-                                                        kfree(ses->serverDomain);
+                                                kfree(ses->serverDomain);
                                                 ses->serverDomain =
                                                                 kzalloc(len+1,
                                                                     GFP_KERNEL);
@@ -3674,16 +3756,15 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                             BCC(smb_buffer_response)) {
                                 kfree(tcon->nativeFileSystem);
                                 tcon->nativeFileSystem =
-                                    kzalloc(2*(length + 1), GFP_KERNEL);
-                                if (tcon->nativeFileSystem)
+                                    kzalloc((4 * length) + 2, GFP_KERNEL);
+                                if (tcon->nativeFileSystem) {
                                         cifs_strfromUCS_le(
                                                 tcon->nativeFileSystem,
                                                 (__le16 *) bcc_ptr,
                                                 length, nls_codepage);
-                                bcc_ptr += 2 * length;
-                                bcc_ptr[0] = 0; /* null terminate the string */
-                                bcc_ptr[1] = 0;
-                                bcc_ptr += 2;
+                                        cFYI(1, ("nativeFileSystem=%s",
+                                                tcon->nativeFileSystem));
+                                }
                         }
                         /* else do not bother copying these information fields*/
                 } else {
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 54dce78fbb7..461750e0136 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -129,12 +129,62 @@ cifs_bp_rename_retry:
         return full_path;
 }
 
+static void
+cifs_fill_fileinfo(struct inode *newinode, __u16 fileHandle,
+                        struct cifsTconInfo *tcon, bool write_only)
+{
+        int oplock = 0;
+        struct cifsFileInfo *pCifsFile;
+        struct cifsInodeInfo *pCifsInode;
+
+        pCifsFile = kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
+
+        if (pCifsFile == NULL)
+                return;
+
+        if (oplockEnabled)
+                oplock = REQ_OPLOCK;
+
+        pCifsFile->netfid = fileHandle;
+        pCifsFile->pid = current->tgid;
+        pCifsFile->pInode = newinode;
+        pCifsFile->invalidHandle = false;
+        pCifsFile->closePend = false;
+        mutex_init(&pCifsFile->fh_mutex);
+        mutex_init(&pCifsFile->lock_mutex);
+        INIT_LIST_HEAD(&pCifsFile->llist);
+        atomic_set(&pCifsFile->wrtPending, 0);
+
+        /* set the following in open now
+                        pCifsFile->pfile = file; */
+        write_lock(&GlobalSMBSeslock);
+        list_add(&pCifsFile->tlist, &tcon->openFileList);
+        pCifsInode = CIFS_I(newinode);
+        if (pCifsInode) {
+                /* if readable file instance put first in list*/
+                if (write_only)
+                        list_add_tail(&pCifsFile->flist,
+                                      &pCifsInode->openFileList);
+                else
+                        list_add(&pCifsFile->flist, &pCifsInode->openFileList);
+
+                if ((oplock & 0xF) == OPLOCK_EXCLUSIVE) {
+                        pCifsInode->clientCanCacheAll = true;
+                        pCifsInode->clientCanCacheRead = true;
+                        cFYI(1, ("Exclusive Oplock inode %p", newinode));
+                } else if ((oplock & 0xF) == OPLOCK_READ)
+                                pCifsInode->clientCanCacheRead = true;
+        }
+        write_unlock(&GlobalSMBSeslock);
+}
+
 int cifs_posix_open(char *full_path, struct inode **pinode,
                     struct super_block *sb, int mode, int oflags,
                     int *poplock, __u16 *pnetfid, int xid)
 {
         int rc;
         __u32 oplock;
+        bool write_only = false;
         FILE_UNIX_BASIC_INFO *presp_data;
         __u32 posix_flags = 0;
         struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
@@ -172,6 +222,8 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
         if (oflags & O_DIRECT)
                 posix_flags |= SMB_O_DIRECT;
 
+        if (!(oflags & FMODE_READ))
+                write_only = true;
 
         rc = CIFSPOSIXCreate(xid, cifs_sb->tcon, posix_flags, mode,
                         pnetfid, presp_data, &oplock, full_path,
@@ -187,8 +239,10 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
         if (!pinode)
                 goto posix_open_ret; /* caller does not need info */
 
-        if (*pinode == NULL)
-                *pinode = cifs_new_inode(sb, &presp_data->UniqueId);
+        if (*pinode == NULL) {
+                __u64 unique_id = le64_to_cpu(presp_data->UniqueId);
+                *pinode = cifs_new_inode(sb, &unique_id);
+        }
         /* else an inode was passed in. Update its info, don't create one */
 
         /* We do not need to close the file if new_inode fails since
@@ -198,6 +252,8 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
 
         posix_fill_in_inode(*pinode, presp_data, 1);
 
+        cifs_fill_fileinfo(*pinode, *pnetfid, cifs_sb->tcon, write_only);
+
 posix_open_ret:
         kfree(presp_data);
         return rc;
@@ -239,7 +295,6 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
         char *full_path = NULL;
         FILE_ALL_INFO *buf = NULL;
         struct inode *newinode = NULL;
-        struct cifsInodeInfo *pCifsInode;
         int disposition = FILE_OVERWRITE_IF;
         bool write_only = false;
 
@@ -410,44 +465,8 @@ cifs_create_set_dentry:
                 /* mknod case - do not leave file open */
                 CIFSSMBClose(xid, tcon, fileHandle);
         } else if (newinode) {
-                struct cifsFileInfo *pCifsFile =
-                        kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
-
-                if (pCifsFile == NULL)
-                        goto cifs_create_out;
-                pCifsFile->netfid = fileHandle;
-                pCifsFile->pid = current->tgid;
-                pCifsFile->pInode = newinode;
-                pCifsFile->invalidHandle = false;
-                pCifsFile->closePend     = false;
-                init_MUTEX(&pCifsFile->fh_sem);
-                mutex_init(&pCifsFile->lock_mutex);
-                INIT_LIST_HEAD(&pCifsFile->llist);
-                atomic_set(&pCifsFile->wrtPending, 0);
-
-                /* set the following in open now
-                                pCifsFile->pfile = file; */
-                write_lock(&GlobalSMBSeslock);
-                list_add(&pCifsFile->tlist, &tcon->openFileList);
-                pCifsInode = CIFS_I(newinode);
-                if (pCifsInode) {
-                        /* if readable file instance put first in list*/
-                        if (write_only) {
-                                list_add_tail(&pCifsFile->flist,
-                                              &pCifsInode->openFileList);
-                        } else {
-                                list_add(&pCifsFile->flist,
-                                         &pCifsInode->openFileList);
-                        }
-                        if ((oplock & 0xF) == OPLOCK_EXCLUSIVE) {
-                                pCifsInode->clientCanCacheAll = true;
-                                pCifsInode->clientCanCacheRead = true;
-                                cFYI(1, ("Exclusive Oplock inode %p",
-                                        newinode));
-                        } else if ((oplock & 0xF) == OPLOCK_READ)
-                                pCifsInode->clientCanCacheRead = true;
-                }
-                write_unlock(&GlobalSMBSeslock);
+                        cifs_fill_fileinfo(newinode, fileHandle,
+                                        cifs_sb->tcon, write_only);
         }
 cifs_create_out:
         kfree(buf);
@@ -580,17 +599,21 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, int mode,
         return rc;
 }
 
-
 struct dentry *
 cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
             struct nameidata *nd)
 {
         int xid;
         int rc = 0; /* to get around spurious gcc warning, set to zero here */
+        int oplock = 0;
+        int mode;
+        __u16 fileHandle = 0;
+        bool posix_open = false;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
         struct inode *newInode = NULL;
         char *full_path = NULL;
+        struct file *filp;
 
         xid = GetXid();
 
@@ -632,12 +655,37 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
         }
         cFYI(1, ("Full path: %s inode = 0x%p", full_path, direntry->d_inode));
 
-        if (pTcon->unix_ext)
-                rc = cifs_get_inode_info_unix(&newInode, full_path,
-                                              parent_dir_inode->i_sb, xid);
-        else
+        if (pTcon->unix_ext) {
+                if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
+                                (nd->flags & LOOKUP_OPEN)) {
+                        if (!((nd->intent.open.flags & O_CREAT) &&
+                                        (nd->intent.open.flags & O_EXCL))) {
+                                mode = nd->intent.open.create_mode &
+                                                ~current_umask();
+                                rc = cifs_posix_open(full_path, &newInode,
+                                        parent_dir_inode->i_sb, mode,
+                                        nd->intent.open.flags, &oplock,
+                                        &fileHandle, xid);
+                                /*
+                                 * This code works around a bug in
+                                 * samba posix open in samba versions 3.3.1
+                                 * and earlier where create works
+                                 * but open fails with invalid parameter.
+                                 * If either of these error codes are
+                                 * returned, follow the normal lookup.
+                                 * Otherwise, the error during posix open
+                                 * is handled.
+                                 */
+                                if ((rc != -EINVAL) && (rc != -EOPNOTSUPP))
+                                        posix_open = true;
+                        }
+                }
+                if (!posix_open)
+                        rc = cifs_get_inode_info_unix(&newInode, full_path,
+                                                parent_dir_inode->i_sb, xid);
+        } else
                 rc = cifs_get_inode_info(&newInode, full_path, NULL,
-                                         parent_dir_inode->i_sb, xid, NULL);
+                                parent_dir_inode->i_sb, xid, NULL);
 
         if ((rc == 0) && (newInode != NULL)) {
                 if (pTcon->nocase)
@@ -645,7 +693,8 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
                 else
                         direntry->d_op = &cifs_dentry_ops;
                 d_add(direntry, newInode);
-
+                if (posix_open)
+                        filp = lookup_instantiate_filp(nd, direntry, NULL);
                 /* since paths are not looked up by component - the parent
                    directories are presumed to be good here */
                 renew_parental_timestamps(direntry);
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 1e0c1bd8f2e..df4a306f697 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -78,7 +78,7 @@ dns_resolver_instantiate(struct key *key, const void *data,
         }
 
         key->type_data.x[0] = datalen;
-        rcu_assign_pointer(key->payload.data, ip);
+        key->payload.data = ip;
 
         return rc;
 }
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 81747acca4c..50ca088d886 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -46,7 +46,7 @@ static inline struct cifsFileInfo *cifs_init_private(
         memset(private_data, 0, sizeof(struct cifsFileInfo));
         private_data->netfid = netfid;
         private_data->pid = current->tgid;
-        init_MUTEX(&private_data->fh_sem);
+        mutex_init(&private_data->fh_mutex);
         mutex_init(&private_data->lock_mutex);
         INIT_LIST_HEAD(&private_data->llist);
         private_data->pfile = file; /* needed for writepage */
@@ -284,35 +284,32 @@ int cifs_open(struct inode *inode, struct file *file)
         cifs_sb = CIFS_SB(inode->i_sb);
         tcon = cifs_sb->tcon;
 
-        if (file->f_flags & O_CREAT) {
-                /* search inode for this file and fill in file->private_data */
-                pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
-                read_lock(&GlobalSMBSeslock);
-                list_for_each(tmp, &pCifsInode->openFileList) {
-                        pCifsFile = list_entry(tmp, struct cifsFileInfo,
-                                               flist);
-                        if ((pCifsFile->pfile == NULL) &&
-                            (pCifsFile->pid == current->tgid)) {
-                                /* mode set in cifs_create */
-
-                                /* needed for writepage */
-                                pCifsFile->pfile = file;
-
-                                file->private_data = pCifsFile;
-                                break;
-                        }
-                }
-                read_unlock(&GlobalSMBSeslock);
-                if (file->private_data != NULL) {
-                        rc = 0;
-                        FreeXid(xid);
-                        return rc;
-                } else {
-                        if (file->f_flags & O_EXCL)
-                                cERROR(1, ("could not find file instance for "
-                                           "new file %p", file));
+        /* search inode for this file and fill in file->private_data */
+        pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
+        read_lock(&GlobalSMBSeslock);
+        list_for_each(tmp, &pCifsInode->openFileList) {
+                pCifsFile = list_entry(tmp, struct cifsFileInfo,
+                                       flist);
+                if ((pCifsFile->pfile == NULL) &&
+                    (pCifsFile->pid == current->tgid)) {
+                        /* mode set in cifs_create */
+
+                        /* needed for writepage */
+                        pCifsFile->pfile = file;
+
+                        file->private_data = pCifsFile;
+                        break;
                 }
         }
+        read_unlock(&GlobalSMBSeslock);
+
+        if (file->private_data != NULL) {
+                rc = 0;
+                FreeXid(xid);
+                return rc;
+        } else if ((file->f_flags & O_CREAT) && (file->f_flags & O_EXCL))
+                        cERROR(1, ("could not find file instance for "
+                                   "new file %p", file));
 
         full_path = build_path_from_dentry(file->f_path.dentry);
         if (full_path == NULL) {
@@ -500,9 +497,9 @@ static int cifs_reopen_file(struct file *file, bool can_flush)
                 return -EBADF;
 
         xid = GetXid();
-        down(&pCifsFile->fh_sem);
+        mutex_unlock(&pCifsFile->fh_mutex);
         if (!pCifsFile->invalidHandle) {
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 FreeXid(xid);
                 return 0;
         }
@@ -533,7 +530,7 @@ static int cifs_reopen_file(struct file *file, bool can_flush)
         if (full_path == NULL) {
                 rc = -ENOMEM;
 reopen_error_exit:
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 FreeXid(xid);
                 return rc;
         }
@@ -575,14 +572,14 @@ reopen_error_exit:
                          cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
         if (rc) {
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 cFYI(1, ("cifs_open returned 0x%x", rc));
                 cFYI(1, ("oplock: %d", oplock));
         } else {
 reopen_success:
                 pCifsFile->netfid = netfid;
                 pCifsFile->invalidHandle = false;
-                up(&pCifsFile->fh_sem);
+                mutex_lock(&pCifsFile->fh_mutex);
                 pCifsInode = CIFS_I(inode);
                 if (pCifsInode) {
                         if (can_flush) {
@@ -971,6 +968,40 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
         return rc;
 }
 
+/*
+ * Set the timeout on write requests past EOF. For some servers (Windows)
+ * these calls can be very long.
+ *
+ * If we're writing >10M past the EOF we give a 180s timeout. Anything less
+ * than that gets a 45s timeout. Writes not past EOF get 15s timeouts.
+ * The 10M cutoff is totally arbitrary. A better scheme for this would be
+ * welcome if someone wants to suggest one.
+ *
+ * We may be able to do a better job with this if there were some way to
+ * declare that a file should be sparse.
+ */
+static int
+cifs_write_timeout(struct cifsInodeInfo *cifsi, loff_t offset)
+{
+        if (offset <= cifsi->server_eof)
+                return CIFS_STD_OP;
+        else if (offset > (cifsi->server_eof + (10 * 1024 * 1024)))
+                return CIFS_VLONG_OP;
+        else
+                return CIFS_LONG_OP;
+}
+
+/* update the file size (if needed) after a write */
+static void
+cifs_update_eof(struct cifsInodeInfo *cifsi, loff_t offset,
+                      unsigned int bytes_written)
+{
+        loff_t end_of_write = offset + bytes_written;
+
+        if (end_of_write > cifsi->server_eof)
+                cifsi->server_eof = end_of_write;
+}
+
 ssize_t cifs_user_write(struct file *file, const char __user *write_data,
         size_t write_size, loff_t *poffset)
 {
@@ -981,6 +1012,7 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
         struct cifsTconInfo *pTcon;
         int xid, long_op;
         struct cifsFileInfo *open_file;
+        struct cifsInodeInfo *cifsi = CIFS_I(file->f_path.dentry->d_inode);
 
         cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
 
@@ -1000,11 +1032,7 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
 
         xid = GetXid();
 
-        if (*poffset > file->f_path.dentry->d_inode->i_size)
-                long_op = CIFS_VLONG_OP; /* writes past EOF take long time */
-        else
-                long_op = CIFS_LONG_OP;
-
+        long_op = cifs_write_timeout(cifsi, *poffset);
         for (total_written = 0; write_size > total_written;
              total_written += bytes_written) {
                 rc = -EAGAIN;
@@ -1048,8 +1076,10 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
                                 FreeXid(xid);
                                 return rc;
                         }
-                } else
+                } else {
+                        cifs_update_eof(cifsi, *poffset, bytes_written);
                         *poffset += bytes_written;
+                }
                 long_op = CIFS_STD_OP; /* subsequent writes fast -
                                     15 seconds is plenty */
         }
@@ -1085,6 +1115,7 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
         struct cifsTconInfo *pTcon;
         int xid, long_op;
         struct cifsFileInfo *open_file;
+        struct cifsInodeInfo *cifsi = CIFS_I(file->f_path.dentry->d_inode);
 
         cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
 
@@ -1099,11 +1130,7 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
 
         xid = GetXid();
 
-        if (*poffset > file->f_path.dentry->d_inode->i_size)
-                long_op = CIFS_VLONG_OP; /* writes past EOF can be slow */
-        else
-                long_op = CIFS_LONG_OP;
-
+        long_op = cifs_write_timeout(cifsi, *poffset);
         for (total_written = 0; write_size > total_written;
              total_written += bytes_written) {
                 rc = -EAGAIN;
@@ -1166,8 +1193,10 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
                                 FreeXid(xid);
                                 return rc;
                         }
-                } else
+                } else {
+                        cifs_update_eof(cifsi, *poffset, bytes_written);
                         *poffset += bytes_written;
+                }
                 long_op = CIFS_STD_OP; /* subsequent writes fast -
                                     15 seconds is plenty */
         }
@@ -1380,11 +1409,12 @@ static int cifs_writepages(struct address_space *mapping,
         int nr_pages;
         __u64 offset = 0;
         struct cifsFileInfo *open_file;
+        struct cifsInodeInfo *cifsi = CIFS_I(mapping->host);
         struct page *page;
         struct pagevec pvec;
         int rc = 0;
         int scanned = 0;
-        int xid;
+        int xid, long_op;
 
         cifs_sb = CIFS_SB(mapping->host->i_sb);
 
@@ -1528,12 +1558,15 @@ retry:
                                 cERROR(1, ("No writable handles for inode"));
                                 rc = -EBADF;
                         } else {
+                                long_op = cifs_write_timeout(cifsi, offset);
                                 rc = CIFSSMBWrite2(xid, cifs_sb->tcon,
                                                    open_file->netfid,
                                                    bytes_to_write, offset,
                                                    &bytes_written, iov, n_iov,
-                                                   CIFS_LONG_OP);
+                                                   long_op);
                                 atomic_dec(&open_file->wrtPending);
+                                cifs_update_eof(cifsi, offset, bytes_written);
+
                                 if (rc || bytes_written < bytes_to_write) {
                                         cERROR(1, ("Write2 ret %d, wrote %d",
                                                   rc, bytes_written));
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index f121a80fdd6..f36b4e40e44 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -143,6 +143,7 @@ static void cifs_unix_info_to_inode(struct inode *inode,
 
         inode->i_nlink = le64_to_cpu(info->Nlinks);
 
+        cifsInfo->server_eof = end_of_file;
         spin_lock(&inode->i_lock);
         if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                 /*
@@ -276,7 +277,8 @@ int cifs_get_inode_info_unix(struct inode **pinode,
 
         /* get new inode */
         if (*pinode == NULL) {
-                *pinode = cifs_new_inode(sb, &find_data.UniqueId);
+                __u64 unique_id = le64_to_cpu(find_data.UniqueId);
+                *pinode = cifs_new_inode(sb, &unique_id);
                 if (*pinode == NULL) {
                         rc = -ENOMEM;
                         goto cgiiu_exit;
@@ -605,12 +607,12 @@ int cifs_get_inode_info(struct inode **pinode,
                         inode->i_mode |= S_IFREG;
         }
 
+        cifsInfo->server_eof = le64_to_cpu(pfindData->EndOfFile);
         spin_lock(&inode->i_lock);
-        if (is_size_safe_to_change(cifsInfo,
-                                   le64_to_cpu(pfindData->EndOfFile))) {
+        if (is_size_safe_to_change(cifsInfo, cifsInfo->server_eof)) {
                 /* can not safely shrink the file size here if the
                    client is writing to it due to potential races */
-                i_size_write(inode, le64_to_cpu(pfindData->EndOfFile));
+                i_size_write(inode, cifsInfo->server_eof);
 
                 /* 512 bytes (2**9) is the fake blocksize that must be
                    used for this calculation */
@@ -1138,6 +1140,7 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                         cFYI(1, ("posix mkdir returned 0x%x", rc));
                         d_drop(direntry);
                 } else {
+                        __u64 unique_id;
                         if (pInfo->Type == cpu_to_le32(-1)) {
                                 /* no return info, go query for it */
                                 kfree(pInfo);
@@ -1151,8 +1154,8 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                         else
                                 direntry->d_op = &cifs_dentry_ops;
 
-                        newinode = cifs_new_inode(inode->i_sb,
-                                                  &pInfo->UniqueId);
+                        unique_id = le64_to_cpu(pInfo->UniqueId);
+                        newinode = cifs_new_inode(inode->i_sb, &unique_id);
                         if (newinode == NULL) {
                                 kfree(pInfo);
                                 goto mkdir_get_info;
@@ -1450,7 +1453,8 @@ int cifs_rename(struct inode *source_dir, struct dentry *source_dentry,
                      checking the UniqueId via FILE_INTERNAL_INFO */
 
 unlink_target:
-        if ((rc == -EACCES) || (rc == -EEXIST)) {
+        /* Try unlinking the target dentry if it's not negative */
+        if (target_dentry->d_inode && (rc == -EACCES || rc == -EEXIST)) {
                 tmprc = cifs_unlink(target_dir, target_dentry);
                 if (tmprc)
                         goto cifs_rename_exit;
@@ -1753,6 +1757,7 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
         }
 
         if (rc == 0) {
+                cifsInode->server_eof = attrs->ia_size;
                 rc = cifs_vmtruncate(inode, attrs->ia_size);
                 cifs_truncate_page(inode->i_mapping, inode->i_size);
         }
@@ -1792,20 +1797,21 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs)
                 goto out;
         }
 
-        if ((attrs->ia_valid & ATTR_MTIME) || (attrs->ia_valid & ATTR_SIZE)) {
-                /*
-                   Flush data before changing file size or changing the last
-                   write time of the file on the server. If the
-                   flush returns error, store it to report later and continue.
-                   BB: This should be smarter. Why bother flushing pages that
-                   will be truncated anyway? Also, should we error out here if
-                   the flush returns error?
-                 */
-                rc = filemap_write_and_wait(inode->i_mapping);
-                if (rc != 0) {
-                        cifsInode->write_behind_rc = rc;
-                        rc = 0;
-                }
+        /*
+         * Attempt to flush data before changing attributes. We need to do
+         * this for ATTR_SIZE and ATTR_MTIME for sure, and if we change the
+         * ownership or mode then we may also need to do this. Here, we take
+         * the safe way out and just do the flush on all setattr requests. If
+         * the flush returns error, store it to report later and continue.
+         *
+         * BB: This should be smarter. Why bother flushing pages that
+         * will be truncated anyway? Also, should we error out here if
+         * the flush returns error?
+         */
+        rc = filemap_write_and_wait(inode->i_mapping);
+        if (rc != 0) {
+                cifsInode->write_behind_rc = rc;
+                rc = 0;
         }
 
         if (attrs->ia_valid & ATTR_SIZE) {
@@ -1903,20 +1909,21 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs)
                 return -ENOMEM;
         }
 
-        if ((attrs->ia_valid & ATTR_MTIME) || (attrs->ia_valid & ATTR_SIZE)) {
-                /*
-                   Flush data before changing file size or changing the last
-                   write time of the file on the server. If the
-                   flush returns error, store it to report later and continue.
-                   BB: This should be smarter. Why bother flushing pages that
-                   will be truncated anyway? Also, should we error out here if
-                   the flush returns error?
-                 */
-                rc = filemap_write_and_wait(inode->i_mapping);
-                if (rc != 0) {
-                        cifsInode->write_behind_rc = rc;
-                        rc = 0;
-                }
+        /*
+         * Attempt to flush data before changing attributes. We need to do
+         * this for ATTR_SIZE and ATTR_MTIME for sure, and if we change the
+         * ownership or mode then we may also need to do this. Here, we take
+         * the safe way out and just do the flush on all setattr requests. If
+         * the flush returns error, store it to report later and continue.
+         *
+         * BB: This should be smarter. Why bother flushing pages that
+         * will be truncated anyway? Also, should we error out here if
+         * the flush returns error?
+         */
+        rc = filemap_write_and_wait(inode->i_mapping);
+        if (rc != 0) {
+                cifsInode->write_behind_rc = rc;
+                rc = 0;
         }
 
         if (attrs->ia_valid & ATTR_SIZE) {
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index c2c01ff4c32..1a8be622833 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -239,6 +239,7 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
         if (atomic_read(&cifsInfo->inUse) == 0)
                 atomic_set(&cifsInfo->inUse, 1);
 
+        cifsInfo->server_eof = end_of_file;
         spin_lock(&tmp_inode->i_lock);
         if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                 /* can not safely change the file size here if the
@@ -375,6 +376,7 @@ static void unix_fill_in_inode(struct inode *tmp_inode,
                 tmp_inode->i_gid = le64_to_cpu(pfindData->Gid);
         tmp_inode->i_nlink = le64_to_cpu(pfindData->Nlinks);
 
+        cifsInfo->server_eof = end_of_file;
         spin_lock(&tmp_inode->i_lock);
         if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                 /* can not safely change the file size here if the
@@ -840,7 +842,7 @@ static int cifs_get_name_from_search_buf(struct qstr *pqst,
                         len = strnlen(filename, PATH_MAX);
                 }
 
-                *pinum = pFindData->UniqueId;
+                *pinum = le64_to_cpu(pFindData->UniqueId);
         } else if (level == SMB_FIND_FILE_DIRECTORY_INFO) {
                 FILE_DIRECTORY_INFO *pFindData =
                         (FILE_DIRECTORY_INFO *)current_entry;
@@ -856,7 +858,7 @@ static int cifs_get_name_from_search_buf(struct qstr *pqst,
                         (SEARCH_ID_FULL_DIR_INFO *)current_entry;
                 filename = &pFindData->FileName[0];
                 len = le32_to_cpu(pFindData->FileNameLength);
-                *pinum = pFindData->UniqueId;
+                *pinum = le64_to_cpu(pFindData->UniqueId);
         } else if (level == SMB_FIND_FILE_BOTH_DIRECTORY_INFO) {
                 FILE_BOTH_DIRECTORY_INFO *pFindData =
                         (FILE_BOTH_DIRECTORY_INFO *)current_entry;
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 5c68b4282be..c652c73760d 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -285,35 +285,36 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
         int words_left, len;
         char *data = *pbcc_area;
 
-
-
         cFYI(1, ("bleft %d", bleft));
 
-
-        /* SMB header is unaligned, so cifs servers word align start of
-           Unicode strings */
-        data++;
-        bleft--; /* Windows servers do not always double null terminate
-                    their final Unicode string - in which case we
-                    now will not attempt to decode the byte of junk
-                    which follows it */
+        /*
+         * Windows servers do not always double null terminate their final
+         * Unicode string. Check to see if there are an uneven number of bytes
+         * left. If so, then add an extra NULL pad byte to the end of the
+         * response.
+         *
+         * See section 2.7.2 in "Implementing CIFS" for details
+         */
+        if (bleft % 2) {
+                data[bleft] = 0;
+                ++bleft;
+        }
 
         words_left = bleft / 2;
 
         /* save off server operating system */
         len = UniStrnlen((wchar_t *) data, words_left);
 
-/* We look for obvious messed up bcc or strings in response so we do not go off
-   the end since (at least) WIN2K and Windows XP have a major bug in not null
-   terminating last Unicode string in response  */
         if (len >= words_left)
                 return rc;
 
         kfree(ses->serverOS);
         /* UTF-8 string will not grow more than four times as big as UCS-16 */
         ses->serverOS = kzalloc((4 * len) + 2 /* trailing null */, GFP_KERNEL);
-        if (ses->serverOS != NULL)
+        if (ses->serverOS != NULL) {
                 cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len, nls_cp);
+                cFYI(1, ("serverOS=%s", ses->serverOS));
+        }
         data += 2 * (len + 1);
         words_left -= len + 1;
 
@@ -328,6 +329,7 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
         if (ses->serverNOS != NULL) {
                 cifs_strfromUCS_le(ses->serverNOS, (__le16 *)data, len,
                                    nls_cp);
+                cFYI(1, ("serverNOS=%s", ses->serverNOS));
                 if (strncmp(ses->serverNOS, "NT LAN Manager 4", 16) == 0) {
                         cFYI(1, ("NT4 server"));
                         ses->flags |= CIFS_SES_NT4;
@@ -343,12 +345,11 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
                 return rc;
 
         kfree(ses->serverDomain);
-        ses->serverDomain = kzalloc(2 * (len + 1), GFP_KERNEL); /* BB FIXME wrong length */
+        ses->serverDomain = kzalloc((4 * len) + 2, GFP_KERNEL);
         if (ses->serverDomain != NULL) {
                 cifs_strfromUCS_le(ses->serverDomain, (__le16 *)data, len,
                                    nls_cp);
-                ses->serverDomain[2*len] = 0;
-                ses->serverDomain[(2*len) + 1] = 0;
+                cFYI(1, ("serverDomain=%s", ses->serverDomain));
         }
         data += 2 * (len + 1);
         words_left -= len + 1;
@@ -702,12 +703,18 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
         }
 
         /* BB check if Unicode and decode strings */
-        if (smb_buf->Flags2 & SMBFLG2_UNICODE)
+        if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
+                /* unicode string area must be word-aligned */
+                if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
+                        ++bcc_ptr;
+                        --bytes_remaining;
+                }
                 rc = decode_unicode_ssetup(&bcc_ptr, bytes_remaining,
-                                                   ses, nls_cp);
-        else
+                                           ses, nls_cp);
+        } else {
                 rc = decode_ascii_ssetup(&bcc_ptr, bytes_remaining,
                                          ses, nls_cp);
+        }
 
 ssetup_exit:
         if (spnego_key) {
diff --git a/fs/direct-io.c b/fs/direct-io.c
index da258e7249c..05763bbc205 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -307,8 +307,6 @@ dio_bio_alloc(struct dio *dio, struct block_device *bdev,
         struct bio *bio;
 
         bio = bio_alloc(GFP_KERNEL, nr_vecs);
-        if (bio == NULL)
-                return -ENOMEM;
 
         bio->bi_bdev = bdev;
         bio->bi_sector = first_sector;
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 6132353dcf6..2a1cb097976 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2416,8 +2416,6 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
                         len = ee_len;
 
                 bio = bio_alloc(GFP_NOIO, len);
-                if (!bio)
-                        return -ENOMEM;
                 bio->bi_sector = ee_pblock;
                 bio->bi_bdev   = inode->i_sb->s_bdev;
 
diff --git a/fs/fat/Kconfig b/fs/fat/Kconfig
index d0a69ff2537..182f9ffe2b5 100644
--- a/fs/fat/Kconfig
+++ b/fs/fat/Kconfig
@@ -95,3 +95,6 @@ config FAT_DEFAULT_IOCHARSET
           Note that "utf8" is not recommended for FAT filesystems.
           If unsure, you shouldn't set "utf8" here.
           See <file:Documentation/filesystems/vfat.txt> for more information.
+
+          Enable any character sets you need in File Systems/Native Language
+          Support.
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 3984e47d1d3..1afd9f26bcb 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -597,7 +597,6 @@ __acquires(&gl->gl_spin)
 
         GLOCK_BUG_ON(gl, test_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags));
 
-        down_read(&gfs2_umount_flush_sem);
         if (test_bit(GLF_DEMOTE, &gl->gl_flags) &&
             gl->gl_demote_state != gl->gl_state) {
                 if (find_first_holder(gl))
@@ -614,15 +613,14 @@ __acquires(&gl->gl_spin)
                 if (ret == 0)
                         goto out_unlock;
                 if (ret == 2)
-                        goto out_sem;
+                        goto out;
                 gh = find_first_waiter(gl);
                 gl->gl_target = gh->gh_state;
                 if (!(gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)))
                         do_error(gl, 0); /* Fail queued try locks */
         }
         do_xmote(gl, gh, gl->gl_target);
-out_sem:
-        up_read(&gfs2_umount_flush_sem);
+out:
         return;
 
 out_sched:
@@ -631,7 +629,7 @@ out_sched:
                 gfs2_glock_put(gl);
 out_unlock:
         clear_bit(GLF_LOCK, &gl->gl_flags);
-        goto out_sem;
+        goto out;
 }
 
 static void glock_work_func(struct work_struct *work)
@@ -641,6 +639,7 @@ static void glock_work_func(struct work_struct *work)
 
         if (test_and_clear_bit(GLF_REPLY_PENDING, &gl->gl_flags))
                 finish_xmote(gl, gl->gl_reply);
+        down_read(&gfs2_umount_flush_sem);
         spin_lock(&gl->gl_spin);
         if (test_and_clear_bit(GLF_PENDING_DEMOTE, &gl->gl_flags) &&
             gl->gl_state != LM_ST_UNLOCKED &&
@@ -653,6 +652,7 @@ static void glock_work_func(struct work_struct *work)
         }
         run_queue(gl, 0);
         spin_unlock(&gl->gl_spin);
+        up_read(&gfs2_umount_flush_sem);
         if (!delay ||
             queue_delayed_work(glock_workqueue, &gl->gl_work, delay) == 0)
                 gfs2_glock_put(gl);
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 7b277d44915..5a31d426116 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -137,15 +137,15 @@ void gfs2_set_iop(struct inode *inode)
         if (S_ISREG(mode)) {
                 inode->i_op = &gfs2_file_iops;
                 if (gfs2_localflocks(sdp))
-                        inode->i_fop = gfs2_file_fops_nolock;
+                        inode->i_fop = &gfs2_file_fops_nolock;
                 else
-                        inode->i_fop = gfs2_file_fops;
+                        inode->i_fop = &gfs2_file_fops;
         } else if (S_ISDIR(mode)) {
                 inode->i_op = &gfs2_dir_iops;
                 if (gfs2_localflocks(sdp))
-                        inode->i_fop = gfs2_dir_fops_nolock;
+                        inode->i_fop = &gfs2_dir_fops_nolock;
                 else
-                        inode->i_fop = gfs2_dir_fops;
+                        inode->i_fop = &gfs2_dir_fops;
         } else if (S_ISLNK(mode)) {
                 inode->i_op = &gfs2_symlink_iops;
         } else {
diff --git a/fs/gfs2/inode.h b/fs/gfs2/inode.h
index dca4fee3078..c30be2b6658 100644
--- a/fs/gfs2/inode.h
+++ b/fs/gfs2/inode.h
@@ -101,21 +101,23 @@ void gfs2_dinode_print(const struct gfs2_inode *ip);
 extern const struct inode_operations gfs2_file_iops;
 extern const struct inode_operations gfs2_dir_iops;
 extern const struct inode_operations gfs2_symlink_iops;
-extern const struct file_operations *gfs2_file_fops_nolock;
-extern const struct file_operations *gfs2_dir_fops_nolock;
+extern const struct file_operations gfs2_file_fops_nolock;
+extern const struct file_operations gfs2_dir_fops_nolock;
 
 extern void gfs2_set_inode_flags(struct inode *inode);
  
 #ifdef CONFIG_GFS2_FS_LOCKING_DLM
-extern const struct file_operations *gfs2_file_fops;
-extern const struct file_operations *gfs2_dir_fops;
+extern const struct file_operations gfs2_file_fops;
+extern const struct file_operations gfs2_dir_fops;
+
 static inline int gfs2_localflocks(const struct gfs2_sbd *sdp)
 {
         return sdp->sd_args.ar_localflocks;
 }
 #else /* Single node only */
-#define gfs2_file_fops NULL
-#define gfs2_dir_fops NULL
+#define gfs2_file_fops gfs2_file_fops_nolock
+#define gfs2_dir_fops gfs2_dir_fops_nolock
+
 static inline int gfs2_localflocks(const struct gfs2_sbd *sdp)
 {
         return 1;
diff --git a/fs/gfs2/ops_file.c b/fs/gfs2/ops_file.c
index 70b9b854894..101caf3ee86 100644
--- a/fs/gfs2/ops_file.c
+++ b/fs/gfs2/ops_file.c
@@ -705,7 +705,7 @@ static int gfs2_flock(struct file *file, int cmd, struct file_lock *fl)
         }
 }
 
-const struct file_operations *gfs2_file_fops = &(const struct file_operations){
+const struct file_operations gfs2_file_fops = {
         .llseek         = gfs2_llseek,
         .read           = do_sync_read,
         .aio_read       = generic_file_aio_read,
@@ -723,7 +723,7 @@ const struct file_operations *gfs2_file_fops = &(const struct file_operations){
         .setlease       = gfs2_setlease,
 };
 
-const struct file_operations *gfs2_dir_fops = &(const struct file_operations){
+const struct file_operations gfs2_dir_fops = {
         .readdir        = gfs2_readdir,
         .unlocked_ioctl = gfs2_ioctl,
         .open           = gfs2_open,
@@ -735,7 +735,7 @@ const struct file_operations *gfs2_dir_fops = &(const struct file_operations){
 
 #endif /* CONFIG_GFS2_FS_LOCKING_DLM */
 
-const struct file_operations *gfs2_file_fops_nolock = &(const struct file_operations){
+const struct file_operations gfs2_file_fops_nolock = {
         .llseek         = gfs2_llseek,
         .read           = do_sync_read,
         .aio_read       = generic_file_aio_read,
@@ -751,7 +751,7 @@ const struct file_operations *gfs2_file_fops_nolock = &(const struct file_operat
         .setlease       = generic_setlease,
 };
 
-const struct file_operations *gfs2_dir_fops_nolock = &(const struct file_operations){
+const struct file_operations gfs2_dir_fops_nolock = {
         .readdir        = gfs2_readdir,
         .unlocked_ioctl = gfs2_ioctl,
         .open           = gfs2_open,
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 51883b3ad89..650a730707b 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -272,11 +272,6 @@ static int gfs2_read_super(struct gfs2_sbd *sdp, sector_t sector)
         lock_page(page);
 
         bio = bio_alloc(GFP_NOFS, 1);
-        if (unlikely(!bio)) {
-                __free_page(page);
-                return -ENOBUFS;
-        }
-
         bio->bi_sector = sector * (sb->s_blocksize >> 9);
         bio->bi_bdev = sb->s_bdev;
         bio_add_page(bio, page, PAGE_SIZE, 0);
diff --git a/fs/gfs2/ops_inode.c b/fs/gfs2/ops_inode.c
index abd5429ae28..1c70fa5168d 100644
--- a/fs/gfs2/ops_inode.c
+++ b/fs/gfs2/ops_inode.c
@@ -371,6 +371,7 @@ static int gfs2_symlink(struct inode *dir, struct dentry *dentry,
         ip = ghs[1].gh_gl->gl_object;
 
         ip->i_disksize = size;
+        i_size_write(inode, size);
 
         error = gfs2_meta_inode_buffer(ip, &dibh);
 
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 8d53f66b5bc..152e6c4a0dc 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -81,7 +81,7 @@ struct gfs2_quota_change_host {
 
 static LIST_HEAD(qd_lru_list);
 static atomic_t qd_lru_count = ATOMIC_INIT(0);
-static spinlock_t qd_lru_lock = SPIN_LOCK_UNLOCKED;
+static DEFINE_SPINLOCK(qd_lru_lock);
 
 int gfs2_shrink_qd_memory(int nr, gfp_t gfp_mask)
 {
@@ -1364,7 +1364,7 @@ int gfs2_quotad(void *data)
                         refrigerator();
                 t = min(quotad_timeo, statfs_timeo);
 
-                prepare_to_wait(&sdp->sd_quota_wait, &wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(&sdp->sd_quota_wait, &wait, TASK_INTERRUPTIBLE);
                 spin_lock(&sdp->sd_trunc_lock);
                 empty = list_empty(&sdp->sd_trunc_list);
                 spin_unlock(&sdp->sd_trunc_lock);
diff --git a/fs/inode.c b/fs/inode.c
index d06d6d268de..6ad14a1cd8c 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1470,42 +1470,6 @@ static void __wait_on_freeing_inode(struct inode *inode)
         spin_lock(&inode_lock);
 }
 
-/*
- * We rarely want to lock two inodes that do not have a parent/child
- * relationship (such as directory, child inode) simultaneously. The
- * vast majority of file systems should be able to get along fine
- * without this. Do not use these functions except as a last resort.
- */
-void inode_double_lock(struct inode *inode1, struct inode *inode2)
-{
-        if (inode1 == NULL || inode2 == NULL || inode1 == inode2) {
-                if (inode1)
-                        mutex_lock(&inode1->i_mutex);
-                else if (inode2)
-                        mutex_lock(&inode2->i_mutex);
-                return;
-        }
-
-        if (inode1 < inode2) {
-                mutex_lock_nested(&inode1->i_mutex, I_MUTEX_PARENT);
-                mutex_lock_nested(&inode2->i_mutex, I_MUTEX_CHILD);
-        } else {
-                mutex_lock_nested(&inode2->i_mutex, I_MUTEX_PARENT);
-                mutex_lock_nested(&inode1->i_mutex, I_MUTEX_CHILD);
-        }
-}
-EXPORT_SYMBOL(inode_double_lock);
-
-void inode_double_unlock(struct inode *inode1, struct inode *inode2)
-{
-        if (inode1)
-                mutex_unlock(&inode1->i_mutex);
-
-        if (inode2 && inode2 != inode1)
-                mutex_unlock(&inode2->i_mutex);
-}
-EXPORT_SYMBOL(inode_double_unlock);
-
 static __initdata unsigned long ihash_entries;
 static int __init set_ihash_entries(char *str)
 {
diff --git a/fs/namespace.c b/fs/namespace.c
index c6f54e4c429..d9138f81ec1 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1920,8 +1920,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
         if (data_page)
                 ((char *)data_page)[PAGE_SIZE - 1] = 0;
 
-        /* Default to relatime */
-        mnt_flags |= MNT_RELATIME;
+        /* Default to relatime unless overriden */
+        if (!(flags & MS_NOATIME))
+                mnt_flags |= MNT_RELATIME;
 
         /* Separate the per-mountpoint flags */
         if (flags & MS_NOSUID)
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 8672b953603..c2a87c885b7 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1912,6 +1912,22 @@ out_sems:
         return written ? written : ret;
 }
 
+static int ocfs2_splice_to_file(struct pipe_inode_info *pipe,
+                                struct file *out,
+                                struct splice_desc *sd)
+{
+        int ret;
+
+        ret = ocfs2_prepare_inode_for_write(out->f_path.dentry, &sd->pos,
+                                            sd->total_len, 0, NULL);
+        if (ret < 0) {
+                mlog_errno(ret);
+                return ret;
+        }
+
+        return splice_from_pipe_feed(pipe, sd, pipe_to_file);
+}
+
 static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
                                        struct file *out,
                                        loff_t *ppos,
@@ -1919,38 +1935,76 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
                                        unsigned int flags)
 {
         int ret;
-        struct inode *inode = out->f_path.dentry->d_inode;
+        struct address_space *mapping = out->f_mapping;
+        struct inode *inode = mapping->host;
+        struct splice_desc sd = {
+                .total_len = len,
+                .flags = flags,
+                .pos = *ppos,
+                .u.file = out,
+        };
 
         mlog_entry("(0x%p, 0x%p, %u, '%.*s')\n", out, pipe,
                    (unsigned int)len,
                    out->f_path.dentry->d_name.len,
                    out->f_path.dentry->d_name.name);
 
-        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
+        if (pipe->inode)
+                mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT);
 
-        ret = ocfs2_rw_lock(inode, 1);
-        if (ret < 0) {
-                mlog_errno(ret);
-                goto out;
-        }
+        splice_from_pipe_begin(&sd);
+        do {
+                ret = splice_from_pipe_next(pipe, &sd);
+                if (ret <= 0)
+                        break;
 
-        ret = ocfs2_prepare_inode_for_write(out->f_path.dentry, ppos, len, 0,
-                                            NULL);
-        if (ret < 0) {
-                mlog_errno(ret);
-                goto out_unlock;
-        }
+                mutex_lock_nested(&inode->i_mutex, I_MUTEX_CHILD);
+                ret = ocfs2_rw_lock(inode, 1);
+                if (ret < 0)
+                        mlog_errno(ret);
+                else {
+                        ret = ocfs2_splice_to_file(pipe, out, &sd);
+                        ocfs2_rw_unlock(inode, 1);
+                }
+                mutex_unlock(&inode->i_mutex);
+        } while (ret > 0);
+        splice_from_pipe_end(pipe, &sd);
 
         if (pipe->inode)
-                mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
-        ret = generic_file_splice_write_nolock(pipe, out, ppos, len, flags);
-        if (pipe->inode)
                 mutex_unlock(&pipe->inode->i_mutex);
 
-out_unlock:
-        ocfs2_rw_unlock(inode, 1);
-out:
-        mutex_unlock(&inode->i_mutex);
+        if (sd.num_spliced)
+                ret = sd.num_spliced;
+
+        if (ret > 0) {
+                unsigned long nr_pages;
+
+                *ppos += ret;
+                nr_pages = (ret + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+
+                /*
+                 * If file or inode is SYNC and we actually wrote some data,
+                 * sync it.
+                 */
+                if (unlikely((out->f_flags & O_SYNC) || IS_SYNC(inode))) {
+                        int err;
+
+                        mutex_lock(&inode->i_mutex);
+                        err = ocfs2_rw_lock(inode, 1);
+                        if (err < 0) {
+                                mlog_errno(err);
+                        } else {
+                                err = generic_osync_inode(inode, mapping,
+                                                  OSYNC_METADATA|OSYNC_DATA);
+                                ocfs2_rw_unlock(inode, 1);
+                        }
+                        mutex_unlock(&inode->i_mutex);
+
+                        if (err)
+                                ret = err;
+                }
+                balance_dirty_pages_ratelimited_nr(mapping, nr_pages);
+        }
 
         mlog_exit(ret);
         return ret;
diff --git a/fs/pipe.c b/fs/pipe.c
index 4af7aa52181..13414ec45b8 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -37,6 +37,42 @@
  * -- Manfred Spraul <manfred@colorfullife.com> 2002-05-09
  */
 
+static void pipe_lock_nested(struct pipe_inode_info *pipe, int subclass)
+{
+        if (pipe->inode)
+                mutex_lock_nested(&pipe->inode->i_mutex, subclass);
+}
+
+void pipe_lock(struct pipe_inode_info *pipe)
+{
+        /*
+         * pipe_lock() nests non-pipe inode locks (for writing to a file)
+         */
+        pipe_lock_nested(pipe, I_MUTEX_PARENT);
+}
+EXPORT_SYMBOL(pipe_lock);
+
+void pipe_unlock(struct pipe_inode_info *pipe)
+{
+        if (pipe->inode)
+                mutex_unlock(&pipe->inode->i_mutex);
+}
+EXPORT_SYMBOL(pipe_unlock);
+
+void pipe_double_lock(struct pipe_inode_info *pipe1,
+                      struct pipe_inode_info *pipe2)
+{
+        BUG_ON(pipe1 == pipe2);
+
+        if (pipe1 < pipe2) {
+                pipe_lock_nested(pipe1, I_MUTEX_PARENT);
+                pipe_lock_nested(pipe2, I_MUTEX_CHILD);
+        } else {
+                pipe_lock_nested(pipe2, I_MUTEX_CHILD);
+                pipe_lock_nested(pipe1, I_MUTEX_PARENT);
+        }
+}
+
 /* Drop the inode semaphore and wait for a pipe event, atomically */
 void pipe_wait(struct pipe_inode_info *pipe)
 {
@@ -47,12 +83,10 @@ void pipe_wait(struct pipe_inode_info *pipe)
          * is considered a noninteractive wait:
          */
         prepare_to_wait(&pipe->wait, &wait, TASK_INTERRUPTIBLE);
-        if (pipe->inode)
-                mutex_unlock(&pipe->inode->i_mutex);
+        pipe_unlock(pipe);
         schedule();
         finish_wait(&pipe->wait, &wait);
-        if (pipe->inode)
-                mutex_lock(&pipe->inode->i_mutex);
+        pipe_lock(pipe);
 }
 
 static int
diff --git a/fs/proc/base.c b/fs/proc/base.c
index f71559784bf..aa763ab0077 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -648,14 +648,14 @@ static unsigned mounts_poll(struct file *file, poll_table *wait)
 {
         struct proc_mounts *p = file->private_data;
         struct mnt_namespace *ns = p->ns;
-        unsigned res = 0;
+        unsigned res = POLLIN | POLLRDNORM;
 
         poll_wait(file, &ns->poll, wait);
 
         spin_lock(&vfsmount_lock);
         if (p->event != ns->event) {
                 p->event = ns->event;
-                res = POLLERR;
+                res |= POLLERR | POLLPRI;
         }
         spin_unlock(&vfsmount_lock);
 
diff --git a/fs/splice.c b/fs/splice.c
index c18aa7e03e2..666953d59a3 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -182,8 +182,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
         do_wakeup = 0;
         page_nr = 0;
 
-        if (pipe->inode)
-                mutex_lock(&pipe->inode->i_mutex);
+        pipe_lock(pipe);
 
         for (;;) {
                 if (!pipe->readers) {
@@ -245,15 +244,13 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
                 pipe->waiting_writers--;
         }
 
-        if (pipe->inode) {
-                mutex_unlock(&pipe->inode->i_mutex);
+        pipe_unlock(pipe);
 
-                if (do_wakeup) {
-                        smp_mb();
-                        if (waitqueue_active(&pipe->wait))
-                                wake_up_interruptible(&pipe->wait);
-                        kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
-                }
+        if (do_wakeup) {
+                smp_mb();
+                if (waitqueue_active(&pipe->wait))
+                        wake_up_interruptible(&pipe->wait);
+                kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
         }
 
         while (page_nr < spd_pages)
@@ -555,8 +552,8 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
  * SPLICE_F_MOVE isn't set, or we cannot move the page, we simply create
  * a new page in the output file page cache and fill/dirty that.
  */
-static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
-                        struct splice_desc *sd)
+int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
+                 struct splice_desc *sd)
 {
         struct file *file = sd->u.file;
         struct address_space *mapping = file->f_mapping;
@@ -600,108 +597,177 @@ static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
 out:
         return ret;
 }
+EXPORT_SYMBOL(pipe_to_file);
+
+static void wakeup_pipe_writers(struct pipe_inode_info *pipe)
+{
+        smp_mb();
+        if (waitqueue_active(&pipe->wait))
+                wake_up_interruptible(&pipe->wait);
+        kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
+}
 
 /**
- * __splice_from_pipe - splice data from a pipe to given actor
+ * splice_from_pipe_feed - feed available data from a pipe to a file
  * @pipe:       pipe to splice from
  * @sd:         information to @actor
  * @actor:      handler that splices the data
  *
  * Description:
- *    This function does little more than loop over the pipe and call
- *    @actor to do the actual moving of a single struct pipe_buffer to
- *    the desired destination. See pipe_to_file, pipe_to_sendpage, or
- *    pipe_to_user.
+ *    This function loops over the pipe and calls @actor to do the
+ *    actual moving of a single struct pipe_buffer to the desired
+ *    destination.  It returns when there's no more buffers left in
+ *    the pipe or if the requested number of bytes (@sd->total_len)
+ *    have been copied.  It returns a positive number (one) if the
+ *    pipe needs to be filled with more data, zero if the required
+ *    number of bytes have been copied and -errno on error.
  *
+ *    This, together with splice_from_pipe_{begin,end,next}, may be
+ *    used to implement the functionality of __splice_from_pipe() when
+ *    locking is required around copying the pipe buffers to the
+ *    destination.
  */
-ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd,
-                           splice_actor *actor)
+int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_desc *sd,
+                          splice_actor *actor)
 {
-        int ret, do_wakeup, err;
-
-        ret = 0;
-        do_wakeup = 0;
-
-        for (;;) {
-                if (pipe->nrbufs) {
-                        struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
-                        const struct pipe_buf_operations *ops = buf->ops;
+        int ret;
 
-                        sd->len = buf->len;
-                        if (sd->len > sd->total_len)
-                                sd->len = sd->total_len;
+        while (pipe->nrbufs) {
+                struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
+                const struct pipe_buf_operations *ops = buf->ops;
 
-                        err = actor(pipe, buf, sd);
-                        if (err <= 0) {
-                                if (!ret && err != -ENODATA)
-                                        ret = err;
+                sd->len = buf->len;
+                if (sd->len > sd->total_len)
+                        sd->len = sd->total_len;
 
-                                break;
-                        }
+                ret = actor(pipe, buf, sd);
+                if (ret <= 0) {
+                        if (ret == -ENODATA)
+                                ret = 0;
+                        return ret;
+                }
+                buf->offset += ret;
+                buf->len -= ret;
 
-                        ret += err;
-                        buf->offset += err;
-                        buf->len -= err;
+                sd->num_spliced += ret;
+                sd->len -= ret;
+                sd->pos += ret;
+                sd->total_len -= ret;
 
-                        sd->len -= err;
-                        sd->pos += err;
-                        sd->total_len -= err;
-                        if (sd->len)
-                                continue;
+                if (!buf->len) {
+                        buf->ops = NULL;
+                        ops->release(pipe, buf);
+                        pipe->curbuf = (pipe->curbuf + 1) & (PIPE_BUFFERS - 1);
+                        pipe->nrbufs--;
+                        if (pipe->inode)
+                                sd->need_wakeup = true;
+                }
 
-                        if (!buf->len) {
-                                buf->ops = NULL;
-                                ops->release(pipe, buf);
-                                pipe->curbuf = (pipe->curbuf + 1) & (PIPE_BUFFERS - 1);
-                                pipe->nrbufs--;
-                                if (pipe->inode)
-                                        do_wakeup = 1;
-                        }
+                if (!sd->total_len)
+                        return 0;
+        }
 
-                        if (!sd->total_len)
-                                break;
-                }
+        return 1;
+}
+EXPORT_SYMBOL(splice_from_pipe_feed);
 
-                if (pipe->nrbufs)
-                        continue;
+/**
+ * splice_from_pipe_next - wait for some data to splice from
+ * @pipe:       pipe to splice from
+ * @sd:         information about the splice operation
+ *
+ * Description:
+ *    This function will wait for some data and return a positive
+ *    value (one) if pipe buffers are available.  It will return zero
+ *    or -errno if no more data needs to be spliced.
+ */
+int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
+{
+        while (!pipe->nrbufs) {
                 if (!pipe->writers)
-                        break;
-                if (!pipe->waiting_writers) {
-                        if (ret)
-                                break;
-                }
+                        return 0;
 
-                if (sd->flags & SPLICE_F_NONBLOCK) {
-                        if (!ret)
-                                ret = -EAGAIN;
-                        break;
-                }
+                if (!pipe->waiting_writers && sd->num_spliced)
+                        return 0;
 
-                if (signal_pending(current)) {
-                        if (!ret)
-                                ret = -ERESTARTSYS;
-                        break;
-                }
+                if (sd->flags & SPLICE_F_NONBLOCK)
+                        return -EAGAIN;
 
-                if (do_wakeup) {
-                        smp_mb();
-                        if (waitqueue_active(&pipe->wait))
-                                wake_up_interruptible_sync(&pipe->wait);
-                        kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
-                        do_wakeup = 0;
+                if (signal_pending(current))
+                        return -ERESTARTSYS;
+
+                if (sd->need_wakeup) {
+                        wakeup_pipe_writers(pipe);
+                        sd->need_wakeup = false;
                 }
 
                 pipe_wait(pipe);
         }
 
-        if (do_wakeup) {
-                smp_mb();
-                if (waitqueue_active(&pipe->wait))
-                        wake_up_interruptible(&pipe->wait);
-                kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
-        }
+        return 1;
+}
+EXPORT_SYMBOL(splice_from_pipe_next);
 
-        return ret;
+/**
+ * splice_from_pipe_begin - start splicing from pipe
+ * @sd:         information about the splice operation
+ *
+ * Description:
+ *    This function should be called before a loop containing
+ *    splice_from_pipe_next() and splice_from_pipe_feed() to
+ *    initialize the necessary fields of @sd.
+ */
+void splice_from_pipe_begin(struct splice_desc *sd)
+{
+        sd->num_spliced = 0;
+        sd->need_wakeup = false;
+}
+EXPORT_SYMBOL(splice_from_pipe_begin);
+
+/**
+ * splice_from_pipe_end - finish splicing from pipe
+ * @pipe:       pipe to splice from
+ * @sd:         information about the splice operation
+ *
+ * Description:
+ *    This function will wake up pipe writers if necessary.  It should
+ *    be called after a loop containing splice_from_pipe_next() and
+ *    splice_from_pipe_feed().
+ */
+void splice_from_pipe_end(struct pipe_inode_info *pipe, struct splice_desc *sd)
+{
+        if (sd->need_wakeup)
+                wakeup_pipe_writers(pipe);
+}
+EXPORT_SYMBOL(splice_from_pipe_end);
+
+/**
+ * __splice_from_pipe - splice data from a pipe to given actor
+ * @pipe:       pipe to splice from
+ * @sd:         information to @actor
+ * @actor:      handler that splices the data
+ *
+ * Description:
+ *    This function does little more than loop over the pipe and call
+ *    @actor to do the actual moving of a single struct pipe_buffer to
+ *    the desired destination. See pipe_to_file, pipe_to_sendpage, or
+ *    pipe_to_user.
+ *
+ */
+ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd,
+                           splice_actor *actor)
+{
+        int ret;
+
+        splice_from_pipe_begin(sd);
+        do {
+                ret = splice_from_pipe_next(pipe, sd);
+                if (ret > 0)
+                        ret = splice_from_pipe_feed(pipe, sd, actor);
+        } while (ret > 0);
+        splice_from_pipe_end(pipe, sd);
+
+        return sd->num_spliced ? sd->num_spliced : ret;
 }
 EXPORT_SYMBOL(__splice_from_pipe);
 
@@ -715,7 +781,7 @@ EXPORT_SYMBOL(__splice_from_pipe);
  * @actor:      handler that splices the data
  *
  * Description:
- *    See __splice_from_pipe. This function locks the input and output inodes,
+ *    See __splice_from_pipe. This function locks the pipe inode,
  *    otherwise it's identical to __splice_from_pipe().
  *
  */
@@ -724,7 +790,6 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                          splice_actor *actor)
 {
         ssize_t ret;
-        struct inode *inode = out->f_mapping->host;
         struct splice_desc sd = {
                 .total_len = len,
                 .flags = flags,
@@ -732,30 +797,15 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                 .u.file = out,
         };
 
-        /*
-         * The actor worker might be calling ->write_begin and
-         * ->write_end. Most of the time, these expect i_mutex to
-         * be held. Since this may result in an ABBA deadlock with
-         * pipe->inode, we have to order lock acquiry here.
-         *
-         * Outer lock must be inode->i_mutex, as pipe_wait() will
-         * release and reacquire pipe->inode->i_mutex, AND inode must
-         * never be a pipe.
-         */
-        WARN_ON(S_ISFIFO(inode->i_mode));
-        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
-        if (pipe->inode)
-                mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
+        pipe_lock(pipe);
         ret = __splice_from_pipe(pipe, &sd, actor);
-        if (pipe->inode)
-                mutex_unlock(&pipe->inode->i_mutex);
-        mutex_unlock(&inode->i_mutex);
+        pipe_unlock(pipe);
 
         return ret;
 }
 
 /**
- * generic_file_splice_write_nolock - generic_file_splice_write without mutexes
+ * generic_file_splice_write - splice data from a pipe to a file
  * @pipe:       pipe info
  * @out:        file to write to
  * @ppos:       position in @out
@@ -764,13 +814,12 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
  *
  * Description:
  *    Will either move or copy pages (determined by @flags options) from
- *    the given pipe inode to the given file. The caller is responsible
- *    for acquiring i_mutex on both inodes.
+ *    the given pipe inode to the given file.
  *
  */
 ssize_t
-generic_file_splice_write_nolock(struct pipe_inode_info *pipe, struct file *out,
-                                 loff_t *ppos, size_t len, unsigned int flags)
+generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
+                          loff_t *ppos, size_t len, unsigned int flags)
 {
         struct address_space *mapping = out->f_mapping;
         struct inode *inode = mapping->host;
@@ -781,76 +830,28 @@ generic_file_splice_write_nolock(struct pipe_inode_info *pipe, struct file *out,
                 .u.file = out,
         };
         ssize_t ret;
-        int err;
-
-        err = file_remove_suid(out);
-        if (unlikely(err))
-                return err;
-
-        ret = __splice_from_pipe(pipe, &sd, pipe_to_file);
-        if (ret > 0) {
-                unsigned long nr_pages;
 
-                *ppos += ret;
-                nr_pages = (ret + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-
-                /*
-                 * If file or inode is SYNC and we actually wrote some data,
-                 * sync it.
-                 */
-                if (unlikely((out->f_flags & O_SYNC) || IS_SYNC(inode))) {
-                        err = generic_osync_inode(inode, mapping,
-                                                  OSYNC_METADATA|OSYNC_DATA);
+        pipe_lock(pipe);
 
-                        if (err)
-                                ret = err;
-                }
-                balance_dirty_pages_ratelimited_nr(mapping, nr_pages);
-        }
+        splice_from_pipe_begin(&sd);
+        do {
+                ret = splice_from_pipe_next(pipe, &sd);
+                if (ret <= 0)
+                        break;
 
-        return ret;
-}
+                mutex_lock_nested(&inode->i_mutex, I_MUTEX_CHILD);
+                ret = file_remove_suid(out);
+                if (!ret)
+                        ret = splice_from_pipe_feed(pipe, &sd, pipe_to_file);
+                mutex_unlock(&inode->i_mutex);
+        } while (ret > 0);
+        splice_from_pipe_end(pipe, &sd);
 
-EXPORT_SYMBOL(generic_file_splice_write_nolock);
+        pipe_unlock(pipe);
 
-/**
- * generic_file_splice_write - splice data from a pipe to a file
- * @pipe:       pipe info
- * @out:        file to write to
- * @ppos:       position in @out
- * @len:        number of bytes to splice
- * @flags:      splice modifier flags
- *
- * Description:
- *    Will either move or copy pages (determined by @flags options) from
- *    the given pipe inode to the given file.
- *
- */
-ssize_t
-generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
-                          loff_t *ppos, size_t len, unsigned int flags)
-{
-        struct address_space *mapping = out->f_mapping;
-        struct inode *inode = mapping->host;
-        struct splice_desc sd = {
-                .total_len = len,
-                .flags = flags,
-                .pos = *ppos,
-                .u.file = out,
-        };
-        ssize_t ret;
+        if (sd.num_spliced)
+                ret = sd.num_spliced;
 
-        WARN_ON(S_ISFIFO(inode->i_mode));
-        mutex_lock_nested(&inode->i_mutex, I_MUTEX_PARENT);
-        ret = file_remove_suid(out);
-        if (likely(!ret)) {
-                if (pipe->inode)
-                        mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_CHILD);
-                ret = __splice_from_pipe(pipe, &sd, pipe_to_file);
-                if (pipe->inode)
-                        mutex_unlock(&pipe->inode->i_mutex);
-        }
-        mutex_unlock(&inode->i_mutex);
         if (ret > 0) {
                 unsigned long nr_pages;
 
@@ -1339,8 +1340,7 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
         if (!pipe)
                 return -EBADF;
 
-        if (pipe->inode)
-                mutex_lock(&pipe->inode->i_mutex);
+        pipe_lock(pipe);
 
         error = ret = 0;
         while (nr_segs) {
@@ -1395,8 +1395,7 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
                 iov++;
         }
 
-        if (pipe->inode)
-                mutex_unlock(&pipe->inode->i_mutex);
+        pipe_unlock(pipe);
 
         if (!ret)
                 ret = error;
@@ -1524,7 +1523,7 @@ static int link_ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                 return 0;
 
         ret = 0;
-        mutex_lock(&pipe->inode->i_mutex);
+        pipe_lock(pipe);
 
         while (!pipe->nrbufs) {
                 if (signal_pending(current)) {
@@ -1542,7 +1541,7 @@ static int link_ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                 pipe_wait(pipe);
         }
 
-        mutex_unlock(&pipe->inode->i_mutex);
+        pipe_unlock(pipe);
         return ret;
 }
 
@@ -1562,7 +1561,7 @@ static int link_opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                 return 0;
 
         ret = 0;
-        mutex_lock(&pipe->inode->i_mutex);
+        pipe_lock(pipe);
 
         while (pipe->nrbufs >= PIPE_BUFFERS) {
                 if (!pipe->readers) {
@@ -1583,7 +1582,7 @@ static int link_opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
                 pipe->waiting_writers--;
         }
 
-        mutex_unlock(&pipe->inode->i_mutex);
+        pipe_unlock(pipe);
         return ret;
 }
 
@@ -1599,10 +1598,10 @@ static int link_pipe(struct pipe_inode_info *ipipe,
 
         /*
          * Potential ABBA deadlock, work around it by ordering lock
-         * grabbing by inode address. Otherwise two different processes
+         * grabbing by pipe info address. Otherwise two different processes
          * could deadlock (one doing tee from A -> B, the other from B -> A).
          */
-        inode_double_lock(ipipe->inode, opipe->inode);
+        pipe_double_lock(ipipe, opipe);
 
         do {
                 if (!opipe->readers) {
@@ -1653,7 +1652,8 @@ static int link_pipe(struct pipe_inode_info *ipipe,
         if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
                 ret = -EAGAIN;
 
-        inode_double_unlock(ipipe->inode, opipe->inode);
+        pipe_unlock(ipipe);
+        pipe_unlock(opipe);
 
         /*
          * If we put data in the output pipe, wakeup any potential readers.
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 289c43a4726..b1606e07b7a 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -446,11 +446,11 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
         if (buffer->event != atomic_read(&od->event))
                 goto trigger;
 
-        return 0;
+        return DEFAULT_POLLMASK;
 
  trigger:
         buffer->needs_read_fill = 1;
-        return POLLERR|POLLPRI;
+        return DEFAULT_POLLMASK|POLLERR|POLLPRI;
 }
 
 void sysfs_notify_dirent(struct sysfs_dirent *sd)
@@ -667,6 +667,7 @@ struct sysfs_schedule_callback_struct {
         struct work_struct      work;
 };
 
+static struct workqueue_struct *sysfs_workqueue;
 static DEFINE_MUTEX(sysfs_workq_mutex);
 static LIST_HEAD(sysfs_workq);
 static void sysfs_schedule_callback_work(struct work_struct *work)
@@ -715,11 +716,20 @@ int sysfs_schedule_callback(struct kobject *kobj, void (*func)(void *),
         mutex_lock(&sysfs_workq_mutex);
         list_for_each_entry_safe(ss, tmp, &sysfs_workq, workq_list)
                 if (ss->kobj == kobj) {
+                        module_put(owner);
                         mutex_unlock(&sysfs_workq_mutex);
                         return -EAGAIN;
                 }
         mutex_unlock(&sysfs_workq_mutex);
 
+        if (sysfs_workqueue == NULL) {
+                sysfs_workqueue = create_workqueue("sysfsd");
+                if (sysfs_workqueue == NULL) {
+                        module_put(owner);
+                        return -ENOMEM;
+                }
+        }
+
         ss = kmalloc(sizeof(*ss), GFP_KERNEL);
         if (!ss) {
                 module_put(owner);
@@ -735,7 +745,7 @@ int sysfs_schedule_callback(struct kobject *kobj, void (*func)(void *),
         mutex_lock(&sysfs_workq_mutex);
         list_add_tail(&ss->workq_list, &sysfs_workq);
         mutex_unlock(&sysfs_workq_mutex);
-        schedule_work(&ss->work);
+        queue_work(sysfs_workqueue, &ss->work);
         return 0;
 }
 EXPORT_SYMBOL_GPL(sysfs_schedule_callback);