104 files changed, 1699 insertions, 1371 deletions
diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
index fd01d90cada..57997fa14e6 100644
--- a/fs/9p/v9fs_vfs.h
+++ b/fs/9p/v9fs_vfs.h
@@ -51,4 +51,4 @@ int v9fs_dir_release(struct inode *inode, struct file *filp);
 int v9fs_file_open(struct inode *inode, struct file *file);
 void v9fs_inode2stat(struct inode *inode, struct p9_stat *stat);
 void v9fs_dentry_release(struct dentry *);
-int v9fs_uflags2omode(int uflags);
+int v9fs_uflags2omode(int uflags, int extended);
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 0d55affe37d..52944d2249a 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -59,7 +59,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
        P9_DPRINTK(P9_DEBUG_VFS, "inode: %p file: %p \n", inode, file);
        v9ses = v9fs_inode2v9ses(inode);
-        omode = v9fs_uflags2omode(file->f_flags);
+        omode = v9fs_uflags2omode(file->f_flags, v9fs_extended(v9ses));
        fid = file->private_data;
        if (!fid) {
                fid = v9fs_fid_clone(file->f_path.dentry);
@@ -75,6 +75,8 @@ int v9fs_file_open(struct inode *inode, struct file *file)
                        inode->i_size = 0;
                        inode->i_blocks = 0;
                }
+                if ((file->f_flags & O_APPEND) && (!v9fs_extended(v9ses)))
+                        generic_file_llseek(file, 0, SEEK_END);
        }
        file->private_data = fid;
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 40fa807bd92..c95295c6504 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -132,10 +132,10 @@ static int p9mode2unixmode(struct v9fs_session_info *v9ses, int mode)
 /**
 * v9fs_uflags2omode- convert posix open flags to plan 9 mode bits
 * @uflags: flags to convert
- *
+ * @extended: if .u extensions are active
 */
-int v9fs_uflags2omode(int uflags)
+int v9fs_uflags2omode(int uflags, int extended)
 {
        int ret;
@@ -155,14 +155,16 @@ int v9fs_uflags2omode(int uflags)
                break;
        }
-        if (uflags & O_EXCL)
-                ret |= P9_OEXCL;
        if (uflags & O_TRUNC)
                ret |= P9_OTRUNC;
-        if (uflags & O_APPEND)
+        if (extended) {
-                ret |= P9_OAPPEND;
+                if (uflags & O_EXCL)
+                        ret |= P9_OEXCL;
+                if (uflags & O_APPEND)
+                        ret |= P9_OAPPEND;
+        }
        return ret;
 }
@@ -506,7 +508,7 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
                flags = O_RDWR;
        fid = v9fs_create(v9ses, dir, dentry, NULL, perm,
-                                                v9fs_uflags2omode(flags));
+                                v9fs_uflags2omode(flags, v9fs_extended(v9ses)));
        if (IS_ERR(fid)) {
                err = PTR_ERR(fid);
                fid = NULL;
diff --git a/fs/Kconfig b/fs/Kconfig
index cf12c403b8c..2694648cbd1 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -830,7 +830,7 @@ config NTFS_FS
          from the project web site.
          For more information see <file:Documentation/filesystems/ntfs.txt>
-          and <http://linux-ntfs.sourceforge.net/>.
+          and <http://www.linux-ntfs.org/>.
          To compile this file system support as a module, choose M here: the
          module will be called ntfs.
diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
index 55e8ee1900a..3263084eef9 100644
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -42,7 +42,7 @@ config BINFMT_ELF_FDPIC
 config BINFMT_FLAT
        bool "Kernel support for flat binaries"
-        depends on !MMU
+        depends on !MMU && (!FRV || BROKEN)
        help
          Support uClinux FLAT format binaries.
diff --git a/fs/afs/callback.c b/fs/afs/callback.c
index a78d5b236bb..587ef5123cd 100644
--- a/fs/afs/callback.c
+++ b/fs/afs/callback.c
@@ -8,7 +8,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Authors: David Woodhouse <dwmw2@cambridge.redhat.com>
+ * Authors: David Woodhouse <dwmw2@infradead.org>
 *          David Howells <dhowells@redhat.com>
 *
 */
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 08db82e1343..bb47217f6a1 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -8,7 +8,7 @@
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
- * Authors: David Woodhouse <dwmw2@cambridge.redhat.com>
+ * Authors: David Woodhouse <dwmw2@infradead.org>
 *          David Howells <dhowells@redhat.com>
 *
 */
diff --git a/fs/afs/super.c b/fs/afs/super.c
index 4b572b801d8..7e3faeef681 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -10,7 +10,7 @@
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 *
 * Authors: David Howells <dhowells@redhat.com>
- *          David Woodhouse <dwmw2@redhat.com>
+ *          David Woodhouse <dwmw2@infradead.org>
 *
 */
diff --git a/fs/aio.c b/fs/aio.c
index b5253e77eb2..0fb3117ddd9 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -591,10 +591,6 @@ static void use_mm(struct mm_struct *mm)
        atomic_inc(&mm->mm_count);
        tsk->mm = mm;
        tsk->active_mm = mm;
-        /*
-         * Note that on UML this *requires* PF_BORROWED_MM to be set, otherwise
-         * it won't work. Update it accordingly if you change it here
-         */
        switch_mm(active_mm, mm, tsk);
        task_unlock(tsk);
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 0fa95b198e6..d48ff5f370f 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -16,7 +16,6 @@
 #include <linux/time.h>
 #include <linux/mm.h>
 #include <linux/mman.h>
-#include <linux/a.out.h>
 #include <linux/errno.h>
 #include <linux/signal.h>
 #include <linux/binfmts.h>
@@ -548,7 +547,6 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
        struct {
                struct elfhdr elf_ex;
                struct elfhdr interp_elf_ex;
-                struct exec interp_ex;
        } *loc;
        loc = kmalloc(sizeof(*loc), GFP_KERNEL);
@@ -680,7 +678,6 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                        }
                        /* Get the exec headers */
-                        loc->interp_ex = *((struct exec *)bprm->buf);
                        loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
                        break;
                }
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index ddd35d87339..d051a32e627 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -390,7 +390,7 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
        }
        /* expand the stack mapping to use up the entire allocation granule */
-        fullsize = ksize((char *) current->mm->start_brk);
+        fullsize = kobjsize((char *) current->mm->start_brk);
        if (!IS_ERR_VALUE(do_mremap(current->mm->start_brk, stack_size,
                                    fullsize, 0, 0)))
                stack_size = fullsize;
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 3b40d45a3a1..2cb1acda3a8 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -548,7 +548,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                        PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0);
                /* Remap to use all availabe slack region space */
                if (realdatastart && (realdatastart < (unsigned long)-4096)) {
-                        reallen = ksize((void *)realdatastart);
+                        reallen = kobjsize((void *)realdatastart);
                        if (reallen > len) {
                                realdatastart = do_mremap(realdatastart, len,
                                        reallen, MREMAP_FIXED, realdatastart);
@@ -600,7 +600,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                        PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0);
                /* Remap to use all availabe slack region space */
                if (textpos && (textpos < (unsigned long) -4096)) {
-                        reallen = ksize((void *)textpos);
+                        reallen = kobjsize((void *)textpos);
                        if (reallen > len) {
                                textpos = do_mremap(textpos, len, reallen,
                                        MREMAP_FIXED, textpos);
@@ -683,7 +683,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                 */
                current->mm->start_brk = datapos + data_len + bss_len;
                current->mm->brk = (current->mm->start_brk + 3) & ~3;
-                current->mm->context.end_brk = memp + ksize((void *) memp) - stack_len;
+                current->mm->context.end_brk = memp + kobjsize((void *) memp) - stack_len;
        }
        if (flags & FLAT_FLAG_KTRACE)
@@ -790,7 +790,7 @@ static int load_flat_file(struct linux_binprm * bprm,
        /* zero the BSS,  BRK and stack areas */
        memset((void*)(datapos + data_len), 0, bss_len + 
-                        (memp + ksize((void *) memp) - stack_len -      /* end brk */
+                        (memp + kobjsize((void *) memp) - stack_len -   /* end brk */
                        libinfo->lib_list[id].start_brk) +              /* start brk */
                        stack_len);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 7d822fae776..10d8a0aa871 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -12,6 +12,7 @@
 #include <linux/kmod.h>
 #include <linux/major.h>
 #include <linux/smp_lock.h>
+#include <linux/device_cgroup.h>
 #include <linux/highmem.h>
 #include <linux/blkdev.h>
 #include <linux/module.h>
@@ -928,9 +929,22 @@ static int do_open(struct block_device *bdev, struct file *file, int for_part)
 {
        struct module *owner = NULL;
        struct gendisk *disk;
-        int ret = -ENXIO;
+        int ret;
        int part;
+        int perm = 0;
+        if (file->f_mode & FMODE_READ)
+                perm |= MAY_READ;
+        if (file->f_mode & FMODE_WRITE)
+                perm |= MAY_WRITE;
+        /*
+         * hooks: /n/, see "layering violations".
+         */
+        ret = devcgroup_inode_permission(bdev->bd_inode, perm);
+        if (ret != 0)
+                return ret;
+        ret = -ENXIO;
        file->f_mapping = bdev->bd_inode->i_mapping;
        lock_kernel();
        disk = get_gendisk(bdev->bd_dev, &part);
diff --git a/fs/buffer.c b/fs/buffer.c
index a073f3f4f01..0f51c0f7c26 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -821,7 +821,7 @@ static int fsync_buffers_list(spinlock_t *lock, struct list_head *list)
                                 * contents - it is a noop if I/O is still in
                                 * flight on potentially older contents.
                                 */
-                                ll_rw_block(SWRITE, 1, &bh);
+                                ll_rw_block(SWRITE_SYNC, 1, &bh);
                                brelse(bh);
                                spin_lock(lock);
                        }
@@ -2940,16 +2940,19 @@ void ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
        for (i = 0; i < nr; i++) {
                struct buffer_head *bh = bhs[i];
-                if (rw == SWRITE)
+                if (rw == SWRITE || rw == SWRITE_SYNC)
                        lock_buffer(bh);
                else if (test_set_buffer_locked(bh))
                        continue;
-                if (rw == WRITE || rw == SWRITE) {
+                if (rw == WRITE || rw == SWRITE || rw == SWRITE_SYNC) {
                        if (test_clear_buffer_dirty(bh)) {
                                bh->b_end_io = end_buffer_write_sync;
                                get_bh(bh);
-                                submit_bh(WRITE, bh);
+                                if (rw == SWRITE_SYNC)
+                                        submit_bh(WRITE_SYNC, bh);
+                                else
+                                        submit_bh(WRITE, bh);
                                continue;
                        }
                } else {
@@ -2978,7 +2981,7 @@ int sync_dirty_buffer(struct buffer_head *bh)
        if (test_clear_buffer_dirty(bh)) {
                get_bh(bh);
                bh->b_end_io = end_buffer_write_sync;
-                ret = submit_bh(WRITE, bh);
+                ret = submit_bh(WRITE_SYNC, bh);
                wait_on_buffer(bh);
                if (buffer_eopnotsupp(bh)) {
                        clear_buffer_eopnotsupp(bh);
diff --git a/fs/cifs/AUTHORS b/fs/cifs/AUTHORS
index 8848e4dfa02..9c136d7803d 100644
--- a/fs/cifs/AUTHORS
+++ b/fs/cifs/AUTHORS
@@ -36,6 +36,7 @@ Miklos Szeredi
 Kazeon team for various fixes especially for 2.4 version.
 Asser Ferno (Change Notify support)
 Shaggy (Dave Kleikamp) for inumerable small fs suggestions and some good cleanup
+Igor Mammedov (DFS support)
 Test case and Bug Report contributors
 -------------------------------------
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 8355e918fdd..1f3465201fd 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,5 +1,12 @@
 Version 1.53
 ------------
+DFS support added (Microsoft Distributed File System client support needed
+for referrals which enable a hierarchical name space among servers).
+Disable temporary caching of mode bits to servers which do not support
+storing of mode (e.g. Windows servers, when client mounts without cifsacl
+mount option) and add new "dynperm" mount option to enable temporary caching
+of mode (enable old behavior).  Fix hang on mount caused when server crashes
+tcp session during negotiate protocol.
 Version 1.52
 ------------
@@ -12,7 +19,8 @@ Add ability to modify cifs acls for handling chmod (when mounted with
 cifsacl flag). Fix prefixpath path separator so we can handle mounts
 with prefixpaths longer than one directory (one path component) when
 mounted to Windows servers.  Fix slow file open when cifsacl
-enabled.
+enabled. Fix memory leak in FindNext when the SMB call returns -EBADF.
 Version 1.51
 ------------
diff --git a/fs/cifs/README b/fs/cifs/README
index 621aa1a8597..2bd6fe556f8 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -483,6 +483,11 @@ A partial list of the supported mount options follows:
 sign           Must use packet signing (helps avoid unwanted data modification
                by intermediate systems in the route).  Note that signing
                does not work with lanman or plaintext authentication.
+ seal           Must seal (encrypt) all data on this mounted share before
+                sending on the network.  Requires support for Unix Extensions.
+                Note that this differs from the sign mount option in that it
+                causes encryption of data sent over this mounted share but other
+                shares mounted to the same server are unaffected.
 sec            Security mode.  Allowed values are:
                        none    attempt to connection as a null user (no name)
                        krb5    Use Kerberos version 5 authentication
diff --git a/fs/cifs/TODO b/fs/cifs/TODO
index 92c9feac440..5aff46c61e5 100644
--- a/fs/cifs/TODO
+++ b/fs/cifs/TODO
@@ -1,4 +1,4 @@
-Version 1.52 January 3, 2008
+Version 1.53 May 20, 2008
 A Partial List of Missing Features
 ==================================
@@ -20,20 +20,21 @@ d) Cleanup now unneeded SessSetup code in
 fs/cifs/connect.c and add back in NTLMSSP code if any servers
 need it
-e) ms-dfs and ms-dfs host name resolution cleanup
+e) fix NTLMv2 signing when two mounts with different users to same
-f) fix NTLMv2 signing when two mounts with different users to same
 server.
-g) Directory entry caching relies on a 1 second timer, rather than 
+f) Directory entry caching relies on a 1 second timer, rather than 
 using FindNotify or equivalent.  - (started)
-h) quota support (needs minor kernel change since quota calls
+g) quota support (needs minor kernel change since quota calls
 to make it to network filesystems or deviceless filesystems)
-i) investigate sync behavior (including syncpage) and check  
+h) investigate sync behavior (including syncpage) and check  
 for proper behavior of intr/nointr
+i) improve support for very old servers (OS/2 and Win9x for example)
+Including support for changing the time remotely (utimes command).
 j) hook lower into the sockets api (as NFS/SunRPC does) to avoid the
 extra copy in/out of the socket buffers in some cases.
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index cb52cbbe45f..f58e41d3ba4 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -186,6 +186,11 @@ asn1_length_decode(struct asn1_ctx *ctx, unsigned int *def, unsigned int *len)
                        }
                }
        }
+        /* don't trust len bigger than ctx buffer */
+        if (*len > ctx->end - ctx->pointer)
+                return 0;
        return 1;
 }
@@ -203,6 +208,10 @@ asn1_header_decode(struct asn1_ctx *ctx,
        if (!asn1_length_decode(ctx, &def, &len))
                return 0;
+        /* primitive shall be definite, indefinite shall be constructed */
+        if (*con == ASN1_PRI && !def)
+                return 0;
        if (def)
                *eoc = ctx->pointer + len;
        else
@@ -389,6 +398,11 @@ asn1_oid_decode(struct asn1_ctx *ctx,
        unsigned long *optr;
        size = eoc - ctx->pointer + 1;
+        /* first subid actually encodes first two subids */
+        if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
+                return 0;
        *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
        if (*oid == NULL)
                return 0;
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index f6fdecf6598..d82374c9e32 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -219,53 +219,6 @@ static struct vfsmount *cifs_dfs_do_refmount(const struct vfsmount *mnt_parent,
 }
-static char *build_full_dfs_path_from_dentry(struct dentry *dentry)
-{
-        char *full_path = NULL;
-        char *search_path;
-        char *tmp_path;
-        size_t l_max_len;
-        struct cifs_sb_info *cifs_sb;
-        if (dentry->d_inode == NULL)
-                return NULL;
-        cifs_sb = CIFS_SB(dentry->d_inode->i_sb);
-        if (cifs_sb->tcon == NULL)
-                return NULL;
-        search_path = build_path_from_dentry(dentry);
-        if (search_path == NULL)
-                return NULL;
-        if (cifs_sb->tcon->Flags & SMB_SHARE_IS_IN_DFS) {
-                int i;
-                /* we should use full path name for correct working with DFS */
-                l_max_len = strnlen(cifs_sb->tcon->treeName, MAX_TREE_SIZE+1) +
-                                        strnlen(search_path, MAX_PATHCONF) + 1;
-                tmp_path = kmalloc(l_max_len, GFP_KERNEL);
-                if (tmp_path == NULL) {
-                        kfree(search_path);
-                        return NULL;
-                }
-                strncpy(tmp_path, cifs_sb->tcon->treeName, l_max_len);
-                tmp_path[l_max_len-1] = 0;
-                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)
-                        for (i = 0; i < l_max_len; i++) {
-                                if (tmp_path[i] == '\\')
-                                        tmp_path[i] = '/';
-                        }
-                strncat(tmp_path, search_path, l_max_len - strlen(tmp_path));
-                full_path = tmp_path;
-                kfree(search_path);
-        } else {
-                full_path = search_path;
-        }
-        return full_path;
-}
 static int add_mount_helper(struct vfsmount *newmnt, struct nameidata *nd,
                                struct list_head *mntlist)
 {
@@ -333,7 +286,7 @@ cifs_dfs_follow_mountpoint(struct dentry *dentry, struct nameidata *nd)
                goto out_err;
        }
-        full_path = build_full_dfs_path_from_dentry(dentry);
+        full_path = build_path_from_dentry(dentry);
        if (full_path == NULL) {
                rc = -ENOMEM;
                goto out_err;
diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h
index 8ad2330ba06..877c85409f1 100644
--- a/fs/cifs/cifs_fs_sb.h
+++ b/fs/cifs/cifs_fs_sb.h
@@ -30,6 +30,7 @@
 #define CIFS_MOUNT_CIFS_ACL     0x200 /* send ACL requests to non-POSIX srv   */
 #define CIFS_MOUNT_OVERR_UID    0x400 /* override uid returned from server    */
 #define CIFS_MOUNT_OVERR_GID    0x800 /* override gid returned from server    */
+#define CIFS_MOUNT_DYNPERM      0x1000 /* allow in-memory only mode setting */
 struct cifs_sb_info {
        struct cifsTconInfo *tcon;      /* primary mount */
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 6653e29637a..7013aaff6ae 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -119,6 +119,9 @@ cifs_get_spnego_key(struct cifsSesInfo *sesInfo)
        dp = description + strlen(description);
        sprintf(dp, ";uid=0x%x", sesInfo->linux_uid);
+        dp = description + strlen(description);
+        sprintf(dp, ";user=%s", sesInfo->userName);
        cFYI(1, ("key description = %s", description));
        spnego_key = request_key(&cifs_spnego_key_type, description, "");
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 427a7c69589..86b4d5f405a 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1,7 +1,7 @@
 /*
 *   fs/cifs/cifsfs.c
 *
- *   Copyright (C) International Business Machines  Corp., 2002,2007
+ *   Copyright (C) International Business Machines  Corp., 2002,2008
 *   Author(s): Steve French (sfrench@us.ibm.com)
 *
 *   Common Internet FileSystem (CIFS) client
@@ -97,9 +97,6 @@ cifs_read_super(struct super_block *sb, void *data,
 {
        struct inode *inode;
        struct cifs_sb_info *cifs_sb;
-#ifdef CONFIG_CIFS_DFS_UPCALL
-        int len;
-#endif
        int rc = 0;
        /* BB should we make this contingent on mount parm? */
@@ -117,15 +114,17 @@ cifs_read_super(struct super_block *sb, void *data,
         * complex operation (mount), and in case of fail
         * just exit instead of doing mount and attempting
         * undo it if this copy fails?*/
-        len = strlen(data);
+        if (data) {
-        cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
+                int len = strlen(data);
-        if (cifs_sb->mountdata == NULL) {
+                cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
-                kfree(sb->s_fs_info);
+                if (cifs_sb->mountdata == NULL) {
-                sb->s_fs_info = NULL;
+                        kfree(sb->s_fs_info);
-                return -ENOMEM;
+                        sb->s_fs_info = NULL;
+                        return -ENOMEM;
+                }
+                strncpy(cifs_sb->mountdata, data, len + 1);
+                cifs_sb->mountdata[len] = '\0';
        }
-        strncpy(cifs_sb->mountdata, data, len + 1);
-        cifs_sb->mountdata[len] = '\0';
 #endif
        rc = cifs_mount(sb, cifs_sb, data, devname);
@@ -353,9 +352,41 @@ cifs_show_options(struct seq_file *s, struct vfsmount *m)
                        if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID) ||
                           !(cifs_sb->tcon->unix_ext))
                                seq_printf(s, ",gid=%d", cifs_sb->mnt_gid);
+                        if (!cifs_sb->tcon->unix_ext) {
+                                seq_printf(s, ",file_mode=0%o,dir_mode=0%o",
+                                           cifs_sb->mnt_file_mode,
+                                           cifs_sb->mnt_dir_mode);
+                        }
+                        if (cifs_sb->tcon->seal)
+                                seq_printf(s, ",seal");
+                        if (cifs_sb->tcon->nocase)
+                                seq_printf(s, ",nocase");
+                        if (cifs_sb->tcon->retry)
+                                seq_printf(s, ",hard");
                }
                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)
                        seq_printf(s, ",posixpaths");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)
+                        seq_printf(s, ",setuids");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)
+                        seq_printf(s, ",serverino");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DIRECT_IO)
+                        seq_printf(s, ",directio");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
+                        seq_printf(s, ",nouser_xattr");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR)
+                        seq_printf(s, ",mapchars");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)
+                        seq_printf(s, ",sfu");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_BRL)
+                        seq_printf(s, ",nobrl");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL)
+                        seq_printf(s, ",cifsacl");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)
+                        seq_printf(s, ",dynperm");
+                if (m->mnt_sb->s_flags & MS_POSIXACL)
+                        seq_printf(s, ",acl");
                seq_printf(s, ",rsize=%d", cifs_sb->rsize);
                seq_printf(s, ",wsize=%d", cifs_sb->wsize);
        }
@@ -657,7 +688,7 @@ const struct file_operations cifs_file_ops = {
        .splice_read = generic_file_splice_read,
        .llseek = cifs_llseek,
 #ifdef CONFIG_CIFS_POSIX
-        .ioctl  = cifs_ioctl,
+        .unlocked_ioctl = cifs_ioctl,
 #endif /* CONFIG_CIFS_POSIX */
 #ifdef CONFIG_CIFS_EXPERIMENTAL
@@ -677,7 +708,7 @@ const struct file_operations cifs_file_direct_ops = {
        .flush = cifs_flush,
        .splice_read = generic_file_splice_read,
 #ifdef CONFIG_CIFS_POSIX
-        .ioctl  = cifs_ioctl,
+        .unlocked_ioctl  = cifs_ioctl,
 #endif /* CONFIG_CIFS_POSIX */
        .llseek = cifs_llseek,
 #ifdef CONFIG_CIFS_EXPERIMENTAL
@@ -697,7 +728,7 @@ const struct file_operations cifs_file_nobrl_ops = {
        .splice_read = generic_file_splice_read,
        .llseek = cifs_llseek,
 #ifdef CONFIG_CIFS_POSIX
-        .ioctl  = cifs_ioctl,
+        .unlocked_ioctl = cifs_ioctl,
 #endif /* CONFIG_CIFS_POSIX */
 #ifdef CONFIG_CIFS_EXPERIMENTAL
@@ -716,7 +747,7 @@ const struct file_operations cifs_file_direct_nobrl_ops = {
        .flush = cifs_flush,
        .splice_read = generic_file_splice_read,
 #ifdef CONFIG_CIFS_POSIX
-        .ioctl  = cifs_ioctl,
+        .unlocked_ioctl  = cifs_ioctl,
 #endif /* CONFIG_CIFS_POSIX */
        .llseek = cifs_llseek,
 #ifdef CONFIG_CIFS_EXPERIMENTAL
@@ -731,7 +762,7 @@ const struct file_operations cifs_dir_ops = {
 #ifdef CONFIG_CIFS_EXPERIMENTAL
        .dir_notify = cifs_dir_notify,
 #endif /* CONFIG_CIFS_EXPERIMENTAL */
-        .ioctl  = cifs_ioctl,
+        .unlocked_ioctl  = cifs_ioctl,
 };
 static void
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index cd1301a09b3..25a6cbd1552 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -95,8 +95,7 @@ extern int 	cifs_setxattr(struct dentry *, const char *, const void *,
                        size_t, int);
 extern ssize_t  cifs_getxattr(struct dentry *, const char *, void *, size_t);
 extern ssize_t  cifs_listxattr(struct dentry *, char *, size_t);
-extern int cifs_ioctl(struct inode *inode, struct file *filep,
+extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
-                       unsigned int command, unsigned long arg);
 #ifdef CONFIG_CIFS_EXPERIMENTAL
 extern const struct export_operations cifs_export_ops;
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index b7d9f698e63..9cfcf326ead 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -281,6 +281,7 @@ struct cifsTconInfo {
        bool ipc:1;             /* set if connection to IPC$ eg for RPC/PIPES */
        bool retry:1;
        bool nocase:1;
+        bool seal:1;      /* transport encryption for this mounted share */
        bool unix_ext:1;  /* if false disable Linux extensions to CIFS protocol
                                for this mount even if server would support */
        /* BB add field for back pointer to sb struct(s)? */
@@ -332,7 +333,6 @@ struct cifsFileInfo {
        bool messageMode:1;     /* for pipes: message vs byte mode */
        atomic_t wrtPending;   /* handle in use - defer close */
        struct semaphore fh_sem; /* prevents reopen race after dead ses*/
-        char *search_resume_name; /* BB removeme BB */
        struct cifs_search_info srch_inf;
 };
@@ -625,7 +625,7 @@ GLOBAL_EXTERN atomic_t tcpSesAllocCount;
 GLOBAL_EXTERN atomic_t tcpSesReconnectCount;
 GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
-/* Various Debug counters to remove someday (BB) */
+/* Various Debug counters */
 GLOBAL_EXTERN atomic_t bufAllocCount;    /* current number allocated  */
 #ifdef CONFIG_CIFS_STATS2
 GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index c43bf4b7a55..0f327c224da 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -79,6 +79,19 @@
 #define TRANS2_GET_DFS_REFERRAL       0x10
 #define TRANS2_REPORT_DFS_INCOSISTENCY 0x11
+/* SMB Transact (Named Pipe) subcommand codes */
+#define TRANS_SET_NMPIPE_STATE      0x0001
+#define TRANS_RAW_READ_NMPIPE       0x0011
+#define TRANS_QUERY_NMPIPE_STATE    0x0021
+#define TRANS_QUERY_NMPIPE_INFO     0x0022
+#define TRANS_PEEK_NMPIPE           0x0023
+#define TRANS_TRANSACT_NMPIPE       0x0026
+#define TRANS_RAW_WRITE_NMPIPE      0x0031
+#define TRANS_READ_NMPIPE           0x0036
+#define TRANS_WRITE_NMPIPE          0x0037
+#define TRANS_WAIT_NMPIPE           0x0053
+#define TRANS_CALL_NMPIPE           0x0054
 /* NT Transact subcommand codes */
 #define NT_TRANSACT_CREATE            0x01
 #define NT_TRANSACT_IOCTL             0x02
@@ -328,12 +341,13 @@
 #define CREATE_COMPLETE_IF_OPLK 0x00000100      /* should be zero */
 #define CREATE_NO_EA_KNOWLEDGE  0x00000200
 #define CREATE_EIGHT_DOT_THREE  0x00000400      /* doc says this is obsolete
-                                                 open for recovery flag - should
+                                                 "open for recovery" flag - should
-                                                 be zero */
+                                                 be zero in any case */
+#define CREATE_OPEN_FOR_RECOVERY 0x00000400
 #define CREATE_RANDOM_ACCESS    0x00000800
 #define CREATE_DELETE_ON_CLOSE  0x00001000
 #define CREATE_OPEN_BY_ID       0x00002000
-#define CREATE_OPEN_BACKUP_INTN 0x00004000
+#define CREATE_OPEN_BACKUP_INTENT 0x00004000
 #define CREATE_NO_COMPRESSION   0x00008000
 #define CREATE_RESERVE_OPFILTER 0x00100000      /* should be zero */
 #define OPEN_REPARSE_POINT      0x00200000
@@ -722,7 +736,6 @@ typedef struct smb_com_tconx_rsp_ext {
 #define SMB_CSC_CACHE_AUTO_REINT   0x0004
 #define SMB_CSC_CACHE_VDO          0x0008
 #define SMB_CSC_NO_CACHING         0x000C
 #define SMB_UNIQUE_FILE_NAME    0x0010
 #define SMB_EXTENDED_SIGNATURES 0x0020
@@ -806,7 +819,7 @@ typedef struct smb_com_findclose_req {
 #define ICOUNT_MASK             0x00FF
 #define PIPE_READ_MODE          0x0100
 #define NAMED_PIPE_TYPE         0x0400
-#define PIPE_END_POINT          0x0800
+#define PIPE_END_POINT          0x4000
 #define BLOCKING_NAMED_PIPE     0x8000
 typedef struct smb_com_open_req {       /* also handles create */
@@ -1904,19 +1917,26 @@ typedef struct smb_com_transaction2_get_dfs_refer_req {
        char RequestFileName[1];
 } __attribute__((packed)) TRANSACTION2_GET_DFS_REFER_REQ;
+#define DFS_VERSION cpu_to_le16(0x0003)
+/* DFS server target type */
+#define DFS_TYPE_LINK 0x0000  /* also for sysvol targets */
+#define DFS_TYPE_ROOT 0x0001
+ 
+/* Referral Entry Flags */
+#define DFS_NAME_LIST_REF 0x0200
 typedef struct dfs_referral_level_3 {
        __le16 VersionNumber;
-        __le16 ReferralSize;
+        __le16 Size;
-        __le16 ServerType;      /* 0x0001 = CIFS server */
+        __le16 ServerType; /* 0x0001 = root targets; 0x0000 = link targets */
-        __le16 ReferralFlags;   /* or proximity - not clear which since it is
+        __le16 ReferralEntryFlags; /* 0x0200 bit set only for domain
-                                   always set to zero - SNIA spec says 0x01
+                                      or DC referral responce */
-                                   means strip off PathConsumed chars before
+        __le32 TimeToLive;
-                                   submitting RequestFileName to remote node */
-        __le16 TimeToLive;
-        __le16 Proximity;
        __le16 DfsPathOffset;
        __le16 DfsAlternatePathOffset;
-        __le16 NetworkAddressOffset;
+        __le16 NetworkAddressOffset; /* offset of the link target */
+        __le16 ServiceSiteGuid;
 } __attribute__((packed)) REFERRAL3;
 typedef struct smb_com_transaction_get_dfs_refer_rsp {
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index d481f6c5a2b..b9f5e935f82 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -93,7 +93,7 @@ extern struct timespec cnvrtDosUnixTm(__u16 date, __u16 time);
 extern int cifs_get_inode_info(struct inode **pinode,
                        const unsigned char *search_path,
-                        FILE_ALL_INFO * pfile_info,
+                        FILE_ALL_INFO *pfile_info,
                        struct super_block *sb, int xid, const __u16 *pfid);
 extern int cifs_get_inode_info_unix(struct inode **pinode,
                        const unsigned char *search_path,
@@ -130,7 +130,7 @@ extern int CIFSFindClose(const int, struct cifsTconInfo *tcon,
 extern int CIFSSMBQPathInfo(const int xid, struct cifsTconInfo *tcon,
                        const unsigned char *searchName,
-                        FILE_ALL_INFO * findData,
+                        FILE_ALL_INFO *findData,
                        int legacy /* whether to use old info level */,
                        const struct nls_table *nls_codepage, int remap);
 extern int SMBQueryInformation(const int xid, struct cifsTconInfo *tcon,
@@ -141,18 +141,15 @@ extern int SMBQueryInformation(const int xid, struct cifsTconInfo *tcon,
 extern int CIFSSMBUnixQPathInfo(const int xid,
                        struct cifsTconInfo *tcon,
                        const unsigned char *searchName,
-                        FILE_UNIX_BASIC_INFO * pFindData,
+                        FILE_UNIX_BASIC_INFO *pFindData,
                        const struct nls_table *nls_codepage, int remap);
 extern int CIFSGetDFSRefer(const int xid, struct cifsSesInfo *ses,
                        const unsigned char *searchName,
-                        unsigned char **targetUNCs,
+                        struct dfs_info3_param **target_nodes,
-                        unsigned int *number_of_UNC_in_array,
+                        unsigned int *number_of_nodes_in_array,
                        const struct nls_table *nls_codepage, int remap);
-extern int connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
-                        const char *old_path,
-                        const struct nls_table *nls_codepage, int remap);
 extern int get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
                        const char *old_path,
                        const struct nls_table *nls_codepage,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 95fbba4ea7d..4511b708f0f 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -81,6 +81,40 @@ static struct {
 #endif /* CONFIG_CIFS_WEAK_PW_HASH */
 #endif /* CIFS_POSIX */
+/* Allocates buffer into dst and copies smb string from src to it.
+ * caller is responsible for freeing dst if function returned 0.
+ * returns:
+ *      on success - 0
+ *      on failure - errno
+ */
+static int
+cifs_strncpy_to_host(char **dst, const char *src, const int maxlen,
+                 const bool is_unicode, const struct nls_table *nls_codepage)
+{
+        int plen;
+        if (is_unicode) {
+                plen = UniStrnlen((wchar_t *)src, maxlen);
+                *dst = kmalloc(plen + 2, GFP_KERNEL);
+                if (!*dst)
+                        goto cifs_strncpy_to_host_ErrExit;
+                cifs_strfromUCS_le(*dst, (__le16 *)src, plen, nls_codepage);
+        } else {
+                plen = strnlen(src, maxlen);
+                *dst = kmalloc(plen + 2, GFP_KERNEL);
+                if (!*dst)
+                        goto cifs_strncpy_to_host_ErrExit;
+                strncpy(*dst, src, plen);
+        }
+        (*dst)[plen] = 0;
+        (*dst)[plen+1] = 0; /* harmless for ASCII case, needed for Unicode */
+        return 0;
+cifs_strncpy_to_host_ErrExit:
+        cERROR(1, ("Failed to allocate buffer for string\n"));
+        return -ENOMEM;
+}
 /* Mark as invalid, all open files on tree connections since they
   were closed when session to server was lost */
@@ -1166,6 +1200,20 @@ static __u16 convert_disposition(int disposition)
        return ofun;
 }
+static int
+access_flags_to_smbopen_mode(const int access_flags)
+{
+        int masked_flags = access_flags & (GENERIC_READ | GENERIC_WRITE);
+        if (masked_flags == GENERIC_READ)
+                return SMBOPEN_READ;
+        else if (masked_flags == GENERIC_WRITE)
+                return SMBOPEN_WRITE;
+        /* just go for read/write */
+        return SMBOPEN_READWRITE;
+}
 int
 SMBLegacyOpen(const int xid, struct cifsTconInfo *tcon,
            const char *fileName, const int openDisposition,
@@ -1207,13 +1255,7 @@ OldOpenRetry:
                pSMB->OpenFlags = cpu_to_le16(REQ_BATCHOPLOCK);
        pSMB->OpenFlags |= cpu_to_le16(REQ_MORE_INFO);
-        /* BB fixme add conversion for access_flags to bits 0 - 2 of mode */
+        pSMB->Mode = cpu_to_le16(access_flags_to_smbopen_mode(access_flags));
-        /* 0 = read
-           1 = write
-           2 = rw
-           3 = execute
-         */
-        pSMB->Mode = cpu_to_le16(2);
        pSMB->Mode |= cpu_to_le16(0x40); /* deny none */
        /* set file as system file if special file such
           as fifo and server expecting SFU style and
@@ -1247,7 +1289,7 @@ OldOpenRetry:
        } else {
        /* BB verify if wct == 15 */
-/*              *pOplock = pSMBr->OplockLevel; */  /* BB take from action field BB */
+/*              *pOplock = pSMBr->OplockLevel; */ /* BB take from action field*/
                *netfid = pSMBr->Fid;   /* cifs fid stays in le */
                /* Let caller know file was created so we can set the mode. */
@@ -1686,7 +1728,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
 {
        int rc = 0;
        LOCK_REQ *pSMB = NULL;
-        LOCK_RSP *pSMBr = NULL;
+/*      LOCK_RSP *pSMBr = NULL; */ /* No response data other than rc to parse */
        int bytes_returned;
        int timeout = 0;
        __u16 count;
@@ -1697,8 +1739,6 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
        if (rc)
                return rc;
-        pSMBr = (LOCK_RSP *)pSMB; /* BB removeme BB */
        if (lockType == LOCKING_ANDX_OPLOCK_RELEASE) {
                timeout = CIFS_ASYNC_OP; /* no response expected */
                pSMB->Timeout = 0;
@@ -1732,7 +1772,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
        if (waitFlag) {
                rc = SendReceiveBlockingLock(xid, tcon, (struct smb_hdr *) pSMB,
-                        (struct smb_hdr *) pSMBr, &bytes_returned);
+                        (struct smb_hdr *) pSMB, &bytes_returned);
                cifs_small_buf_release(pSMB);
        } else {
                rc = SendReceiveNoRsp(xid, tcon->ses, (struct smb_hdr *)pSMB,
@@ -1767,7 +1807,7 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
        cFYI(1, ("Posix Lock"));
        if (pLockData == NULL)
-                return EINVAL;
+                return -EINVAL;
        rc = small_smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB);
@@ -1944,7 +1984,7 @@ renameRetry:
        /* protocol requires ASCII signature byte on Unicode string */
                pSMB->OldFileName[name_len + 1] = 0x00;
                name_len2 =
-                    cifsConvertToUCS((__le16 *) &pSMB->OldFileName[name_len + 2],
+                    cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
                                     toName, PATH_MAX, nls_codepage, remap);
                name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                name_len2 *= 2; /* convert to bytes */
@@ -2117,8 +2157,7 @@ copyRetry:
                cFYI(1, ("Send error in copy = %d with %d files copied",
                        rc, le16_to_cpu(pSMBr->CopyCount)));
        }
-        if (pSMB)
+        cifs_buf_release(pSMB);
-                cifs_buf_release(pSMB);
        if (rc == -EAGAIN)
                goto copyRetry;
@@ -2207,8 +2246,7 @@ createSymLinkRetry:
        if (rc)
                cFYI(1, ("Send error in SetPathInfo create symlink = %d", rc));
-        if (pSMB)
+        cifs_buf_release(pSMB);
-                cifs_buf_release(pSMB);
        if (rc == -EAGAIN)
                goto createSymLinkRetry;
@@ -2925,7 +2963,8 @@ setAclRetry:
        }
        params = 6 + name_len;
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find max SMB size from sess */
+        /* BB find max SMB size from sess */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
@@ -3322,7 +3361,8 @@ QPathInfoRetry:
        params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
        pSMB->TotalDataCount = 0;
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(4000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(4000);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
@@ -3388,7 +3428,7 @@ QPathInfoRetry:
 int
 CIFSSMBUnixQPathInfo(const int xid, struct cifsTconInfo *tcon,
                     const unsigned char *searchName,
-                     FILE_UNIX_BASIC_INFO * pFindData,
+                     FILE_UNIX_BASIC_INFO *pFindData,
                     const struct nls_table *nls_codepage, int remap)
 {
 /* SMB_QUERY_FILE_UNIX_BASIC */
@@ -3679,6 +3719,7 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
        if (rc) {
                if (rc == -EBADF) {
                        psrch_inf->endOfSearch = true;
+                        cifs_buf_release(pSMB);
                        rc = 0; /* search probably was closed at end of search*/
                } else
                        cFYI(1, ("FindNext returned = %d", rc));
@@ -3856,25 +3897,112 @@ GetInodeNumOut:
        return rc;
 }
+/* parses DFS refferal V3 structure
+ * caller is responsible for freeing target_nodes
+ * returns:
+ *      on success - 0
+ *      on failure - errno
+ */
+static int
+parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
+                unsigned int *num_of_nodes,
+                struct dfs_info3_param **target_nodes,
+                const struct nls_table *nls_codepage)
+{
+        int i, rc = 0;
+        char *data_end;
+        bool is_unicode;
+        struct dfs_referral_level_3 *ref;
+        is_unicode = pSMBr->hdr.Flags2 & SMBFLG2_UNICODE;
+        *num_of_nodes = le16_to_cpu(pSMBr->NumberOfReferrals);
+        if (*num_of_nodes < 1) {
+                cERROR(1, ("num_referrals: must be at least > 0,"
+                        "but we get num_referrals = %d\n", *num_of_nodes));
+                rc = -EINVAL;
+                goto parse_DFS_referrals_exit;
+        }
+        ref = (struct dfs_referral_level_3 *) &(pSMBr->referrals);
+        if (ref->VersionNumber != cpu_to_le16(3)) {
+                cERROR(1, ("Referrals of V%d version are not supported,"
+                        "should be V3", le16_to_cpu(ref->VersionNumber)));
+                rc = -EINVAL;
+                goto parse_DFS_referrals_exit;
+        }
+        /* get the upper boundary of the resp buffer */
+        data_end = (char *)(&(pSMBr->PathConsumed)) +
+                                le16_to_cpu(pSMBr->t2.DataCount);
+        cFYI(1, ("num_referrals: %d dfs flags: 0x%x ... \n",
+                        *num_of_nodes,
+                        le16_to_cpu(pSMBr->DFSFlags)));
+        *target_nodes = kzalloc(sizeof(struct dfs_info3_param) *
+                        *num_of_nodes, GFP_KERNEL);
+        if (*target_nodes == NULL) {
+                cERROR(1, ("Failed to allocate buffer for target_nodes\n"));
+                rc = -ENOMEM;
+                goto parse_DFS_referrals_exit;
+        }
+        /* collect neccessary data from referrals */
+        for (i = 0; i < *num_of_nodes; i++) {
+                char *temp;
+                int max_len;
+                struct dfs_info3_param *node = (*target_nodes)+i;
+                node->flags = le16_to_cpu(pSMBr->DFSFlags);
+                node->path_consumed = le16_to_cpu(pSMBr->PathConsumed);
+                node->server_type = le16_to_cpu(ref->ServerType);
+                node->ref_flag = le16_to_cpu(ref->ReferralEntryFlags);
+                /* copy DfsPath */
+                temp = (char *)ref + le16_to_cpu(ref->DfsPathOffset);
+                max_len = data_end - temp;
+                rc = cifs_strncpy_to_host(&(node->path_name), temp,
+                                        max_len, is_unicode, nls_codepage);
+                if (rc)
+                        goto parse_DFS_referrals_exit;
+                /* copy link target UNC */
+                temp = (char *)ref + le16_to_cpu(ref->NetworkAddressOffset);
+                max_len = data_end - temp;
+                rc = cifs_strncpy_to_host(&(node->node_name), temp,
+                                        max_len, is_unicode, nls_codepage);
+                if (rc)
+                        goto parse_DFS_referrals_exit;
+                ref += le16_to_cpu(ref->Size);
+        }
+parse_DFS_referrals_exit:
+        if (rc) {
+                free_dfs_info_array(*target_nodes, *num_of_nodes);
+                *target_nodes = NULL;
+                *num_of_nodes = 0;
+        }
+        return rc;
+}
 int
 CIFSGetDFSRefer(const int xid, struct cifsSesInfo *ses,
                const unsigned char *searchName,
-                unsigned char **targetUNCs,
+                struct dfs_info3_param **target_nodes,
-                unsigned int *number_of_UNC_in_array,
+                unsigned int *num_of_nodes,
                const struct nls_table *nls_codepage, int remap)
 {
 /* TRANS2_GET_DFS_REFERRAL */
        TRANSACTION2_GET_DFS_REFER_REQ *pSMB = NULL;
        TRANSACTION2_GET_DFS_REFER_RSP *pSMBr = NULL;
-        struct dfs_referral_level_3 *referrals = NULL;
        int rc = 0;
        int bytes_returned;
        int name_len;
-        unsigned int i;
-        char *temp;
        __u16 params, byte_count;
-        *number_of_UNC_in_array = 0;
+        *num_of_nodes = 0;
-        *targetUNCs = NULL;
+        *target_nodes = NULL;
        cFYI(1, ("In GetDFSRefer the path %s", searchName));
        if (ses == NULL)
@@ -3921,7 +4049,8 @@ getDFSRetry:
        pSMB->DataCount = 0;
        pSMB->DataOffset = 0;
        pSMB->MaxParameterCount = 0;
-        pSMB->MaxDataCount = cpu_to_le16(4000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(4000);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
@@ -3943,103 +4072,26 @@ getDFSRetry:
                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
        if (rc) {
                cFYI(1, ("Send error in GetDFSRefer = %d", rc));
-        } else {                /* decode response */
+                goto GetDFSRefExit;
-/* BB Add logic to parse referrals here */
+        }
-                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
+        rc = validate_t2((struct smb_t2_rsp *)pSMBr);
-                /* BB Also check if enough total bytes returned? */
+        /* BB Also check if enough total bytes returned? */
-                if (rc || (pSMBr->ByteCount < 17))
+        if (rc || (pSMBr->ByteCount < 17)) {
-                        rc = -EIO;      /* bad smb */
+                rc = -EIO;      /* bad smb */
-                else {
+                goto GetDFSRefExit;
-                        __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
+        }
-                        __u16 data_count = le16_to_cpu(pSMBr->t2.DataCount);
-                        cFYI(1,
+        cFYI(1, ("Decoding GetDFSRefer response BCC: %d  Offset %d",
-                            ("Decoding GetDFSRefer response BCC: %d  Offset %d",
+                                pSMBr->ByteCount,
-                              pSMBr->ByteCount, data_offset));
+                                le16_to_cpu(pSMBr->t2.DataOffset)));
-                        referrals =
-                            (struct dfs_referral_level_3 *)
-                                        (8 /* sizeof start of data block */ +
-                                        data_offset +
-                                        (char *) &pSMBr->hdr.Protocol);
-                        cFYI(1, ("num_referrals: %d dfs flags: 0x%x ... \n"
-                                "for referral one refer size: 0x%x srv "
-                                "type: 0x%x refer flags: 0x%x ttl: 0x%x",
-                                le16_to_cpu(pSMBr->NumberOfReferrals),
-                                le16_to_cpu(pSMBr->DFSFlags),
-                                le16_to_cpu(referrals->ReferralSize),
-                                le16_to_cpu(referrals->ServerType),
-                                le16_to_cpu(referrals->ReferralFlags),
-                                le16_to_cpu(referrals->TimeToLive)));
-                        /* BB This field is actually two bytes in from start of
-                           data block so we could do safety check that DataBlock
-                           begins at address of pSMBr->NumberOfReferrals */
-                        *number_of_UNC_in_array =
-                                        le16_to_cpu(pSMBr->NumberOfReferrals);
-                        /* BB Fix below so can return more than one referral */
-                        if (*number_of_UNC_in_array > 1)
-                                *number_of_UNC_in_array = 1;
-                        /* get the length of the strings describing refs */
-                        name_len = 0;
-                        for (i = 0; i < *number_of_UNC_in_array; i++) {
-                                /* make sure that DfsPathOffset not past end */
-                                __u16 offset =
-                                        le16_to_cpu(referrals->DfsPathOffset);
-                                if (offset > data_count) {
-                                        /* if invalid referral, stop here and do
-                                        not try to copy any more */
-                                        *number_of_UNC_in_array = i;
-                                        break;
-                                }
-                                temp = ((char *)referrals) + offset;
-                                if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE) {
+        /* parse returned result into more usable form */
-                                        name_len += UniStrnlen((wchar_t *)temp,
+        rc = parse_DFS_referrals(pSMBr, num_of_nodes,
-                                                                data_count);
+                                 target_nodes, nls_codepage);
-                                } else {
-                                        name_len += strnlen(temp, data_count);
-                                }
-                                referrals++;
-                                /* BB add check that referral pointer does
-                                   not fall off end PDU */
-                        }
-                        /* BB add check for name_len bigger than bcc */
-                        *targetUNCs =
-                                kmalloc(name_len+1+(*number_of_UNC_in_array),
-                                        GFP_KERNEL);
-                        if (*targetUNCs == NULL) {
-                                rc = -ENOMEM;
-                                goto GetDFSRefExit;
-                        }
-                        /* copy the ref strings */
-                        referrals = (struct dfs_referral_level_3 *)
-                                        (8 /* sizeof data hdr */ + data_offset +
-                                        (char *) &pSMBr->hdr.Protocol);
-                        for (i = 0; i < *number_of_UNC_in_array; i++) {
-                                temp = ((char *)referrals) +
-                                          le16_to_cpu(referrals->DfsPathOffset);
-                                if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE) {
-                                        cifs_strfromUCS_le(*targetUNCs,
-                                                          (__le16 *) temp,
-                                                          name_len,
-                                                          nls_codepage);
-                                } else {
-                                        strncpy(*targetUNCs, temp, name_len);
-                                }
-                                /*  BB update target_uncs pointers */
-                                referrals++;
-                        }
-                        temp = *targetUNCs;
-                        temp[name_len] = 0;
-                }
-        }
 GetDFSRefExit:
-        if (pSMB)
+        cifs_buf_release(pSMB);
-                cifs_buf_release(pSMB);
        if (rc == -EAGAIN)
                goto getDFSRetry;
@@ -4229,7 +4281,8 @@ QFSAttributeRetry:
        params = 2;     /* level */
        pSMB->TotalDataCount = 0;
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
@@ -4298,7 +4351,8 @@ QFSDeviceRetry:
        params = 2;     /* level */
        pSMB->TotalDataCount = 0;
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
@@ -4369,7 +4423,8 @@ QFSUnixRetry:
        pSMB->DataCount = 0;
        pSMB->DataOffset = 0;
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(100);  /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(100);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
@@ -4444,7 +4499,8 @@ SETFSUnixRetry:
        offset = param_offset + params;
        pSMB->MaxParameterCount = cpu_to_le16(4);
-        pSMB->MaxDataCount = cpu_to_le16(100);  /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(100);
        pSMB->SetupCount = 1;
        pSMB->Reserved3 = 0;
        pSMB->SubCommand = cpu_to_le16(TRANS2_SET_FS_INFORMATION);
@@ -4512,7 +4568,8 @@ QFSPosixRetry:
        pSMB->DataCount = 0;
        pSMB->DataOffset = 0;
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(100);  /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(100);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
@@ -4702,7 +4759,8 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
        count = sizeof(struct file_end_of_file_info);
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find max SMB PDU from sess */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
        pSMB->SetupCount = 1;
        pSMB->Reserved3 = 0;
        pSMB->SubCommand = cpu_to_le16(TRANS2_SET_FILE_INFORMATION);
@@ -4789,7 +4847,8 @@ CIFSSMBSetFileTimes(const int xid, struct cifsTconInfo *tcon,
        count = sizeof(FILE_BASIC_INFO);
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find max SMB PDU from sess */
+        /* BB find max SMB PDU from sess */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
        pSMB->SetupCount = 1;
        pSMB->Reserved3 = 0;
        pSMB->SubCommand = cpu_to_le16(TRANS2_SET_FILE_INFORMATION);
@@ -4856,7 +4915,8 @@ SetTimesRetry:
        params = 6 + name_len;
        count = sizeof(FILE_BASIC_INFO);
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
@@ -4986,7 +5046,8 @@ setPermsRetry:
        params = 6 + name_len;
        count = sizeof(FILE_UNIX_BASIC_INFO);
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
@@ -5051,8 +5112,7 @@ setPermsRetry:
        if (rc)
                cFYI(1, ("SetPathInfo (perms) returned %d", rc));
-        if (pSMB)
+        cifs_buf_release(pSMB);
-                cifs_buf_release(pSMB);
        if (rc == -EAGAIN)
                goto setPermsRetry;
        return rc;
@@ -5169,7 +5229,8 @@ QAllEAsRetry:
        params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
        pSMB->TotalDataCount = 0;
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(4000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(4000);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
@@ -5273,8 +5334,7 @@ QAllEAsRetry:
                        }
                }
        }
-        if (pSMB)
+        cifs_buf_release(pSMB);
-                cifs_buf_release(pSMB);
        if (rc == -EAGAIN)
                goto QAllEAsRetry;
@@ -5317,7 +5377,8 @@ QEARetry:
        params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
        pSMB->TotalDataCount = 0;
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(4000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(4000);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
@@ -5422,8 +5483,7 @@ QEARetry:
                        }
                }
        }
-        if (pSMB)
+        cifs_buf_release(pSMB);
-                cifs_buf_release(pSMB);
        if (rc == -EAGAIN)
                goto QEARetry;
@@ -5475,7 +5535,8 @@ SetEARetry:
        count = sizeof(*parm_data) + ea_value_len + name_len;
        pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find max SMB size from sess */
+        /* BB find max SMB PDU from sess */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
        pSMB->MaxSetupCount = 0;
        pSMB->Reserved = 0;
        pSMB->Flags = 0;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index f428bf3bf1a..e8fa46c7cff 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -60,7 +60,7 @@ struct smb_vol {
        char *domainname;
        char *UNC;
        char *UNCip;
-        char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
+        char *in6_addr;   /* ipv6 address as human readable form of in6_addr */
        char *iocharset;  /* local code page for mapping to and from Unicode */
        char source_rfc1001_name[16]; /* netbios name of client */
        char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
@@ -75,19 +75,21 @@ struct smb_vol {
        bool setuids:1;
        bool override_uid:1;
        bool override_gid:1;
+        bool dynperm:1;
        bool noperm:1;
        bool no_psx_acl:1; /* set if posix acl support should be disabled */
        bool cifs_acl:1;
        bool no_xattr:1;   /* set if xattr (EA) support should be disabled*/
        bool server_ino:1; /* use inode numbers from server ie UniqueId */
        bool direct_io:1;
-        bool remap:1;     /* set to remap seven reserved chars in filenames */
+        bool remap:1;      /* set to remap seven reserved chars in filenames */
-        bool posix_paths:1;   /* unset to not ask for posix pathnames. */
+        bool posix_paths:1; /* unset to not ask for posix pathnames. */
        bool no_linux_ext:1;
        bool sfu_emul:1;
-        bool nullauth:1; /* attempt to authenticate with null user */
+        bool nullauth:1;   /* attempt to authenticate with null user */
-        unsigned nocase;     /* request case insensitive filenames */
+        bool nocase:1;     /* request case insensitive filenames */
-        unsigned nobrl;      /* disable sending byte range locks to srv */
+        bool nobrl:1;      /* disable sending byte range locks to srv */
+        bool seal:1;       /* request transport encryption on share */
        unsigned int rsize;
        unsigned int wsize;
        unsigned int sockopt;
@@ -651,6 +653,7 @@ multi_t2_fnd:
        spin_lock(&GlobalMid_Lock);
        server->tcpStatus = CifsExiting;
        spin_unlock(&GlobalMid_Lock);
+        wake_up_all(&server->response_q);
        /* don't exit until kthread_stop is called */
        set_current_state(TASK_UNINTERRUPTIBLE);
@@ -1246,6 +1249,10 @@ cifs_parse_mount_options(char *options, const char *devname,
                        vol->setuids = 1;
                } else if (strnicmp(data, "nosetuids", 9) == 0) {
                        vol->setuids = 0;
+                } else if (strnicmp(data, "dynperm", 7) == 0) {
+                        vol->dynperm = true;
+                } else if (strnicmp(data, "nodynperm", 9) == 0) {
+                        vol->dynperm = false;
                } else if (strnicmp(data, "nohard", 6) == 0) {
                        vol->retry = 0;
                } else if (strnicmp(data, "nosoft", 6) == 0) {
@@ -1268,8 +1275,12 @@ cifs_parse_mount_options(char *options, const char *devname,
                        vol->no_psx_acl = 1;
                } else if (strnicmp(data, "sign", 4) == 0) {
                        vol->secFlg |= CIFSSEC_MUST_SIGN;
-/*              } else if (strnicmp(data, "seal",4) == 0) {
+                } else if (strnicmp(data, "seal", 4) == 0) {
-                        vol->secFlg |= CIFSSEC_MUST_SEAL; */
+                        /* we do not do the following in secFlags because seal
+                           is a per tree connection (mount) not a per socket
+                           or per-smb connection option in the protocol */
+                        /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
+                        vol->seal = 1;
                } else if (strnicmp(data, "direct", 6) == 0) {
                        vol->direct_io = 1;
                } else if (strnicmp(data, "forcedirectio", 13) == 0) {
@@ -1414,34 +1425,12 @@ find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
 }
 int
-connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
-                    const char *old_path, const struct nls_table *nls_codepage,
-                    int remap)
-{
-        struct dfs_info3_param *referrals = NULL;
-        unsigned int num_referrals;
-        int rc = 0;
-        rc = get_dfs_path(xid, pSesInfo, old_path, nls_codepage,
-                        &num_referrals, &referrals, remap);
-        /* BB Add in code to: if valid refrl, if not ip address contact
-                the helper that resolves tcp names, mount to it, try to
-                tcon to it unmount it if fail */
-        kfree(referrals);
-        return rc;
-}
-int
 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
             const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
             struct dfs_info3_param **preferrals, int remap)
 {
        char *temp_unc;
        int rc = 0;
-        unsigned char *targetUNCs;
        *pnum_referrals = 0;
        *preferrals = NULL;
@@ -1464,7 +1453,7 @@ get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
                kfree(temp_unc);
        }
        if (rc == 0)
-                rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, &targetUNCs,
+                rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
                                     pnum_referrals, nls_codepage, remap);
        /* BB map targetUNCs to dfs_info3 structures, here or
                in CIFSGetDFSRefer BB */
@@ -1815,7 +1804,7 @@ convert_delimiter(char *path, char delim)
        if (path == NULL)
                return;
-        if (delim == '/') 
+        if (delim == '/')
                old_delim = '\\';
        else
                old_delim = '/';
@@ -2125,11 +2114,17 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
                if (volume_info.override_gid)
                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
+                if (volume_info.dynperm)
+                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
                if (volume_info.direct_io) {
                        cFYI(1, ("mounting share using direct i/o"));
                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
                }
+                if ((volume_info.cifs_acl) && (volume_info.dynperm))
+                        cERROR(1, ("mount option dynperm ignored if cifsacl "
+                                   "mount option supported"));
                tcon =
                    find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
                             volume_info.username);
@@ -2141,6 +2136,9 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                           for the retry flag is used */
                        tcon->retry = volume_info.retry;
                        tcon->nocase = volume_info.nocase;
+                        if (tcon->seal != volume_info.seal)
+                                cERROR(1, ("transport encryption setting "
+                                           "conflicts with existing tid"));
                } else {
                        tcon = tconInfoAlloc();
                        if (tcon == NULL)
@@ -2154,10 +2152,11 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                if ((strchr(volume_info.UNC + 3, '\\') == NULL)
                                    && (strchr(volume_info.UNC + 3, '/') ==
                                        NULL)) {
-                                        rc = connect_to_dfs_path(xid, pSesInfo,
+/*                                      rc = connect_to_dfs_path(xid, pSesInfo,
                                                "", cifs_sb->local_nls,
                                                cifs_sb->mnt_cifs_flags &
-                                                  CIFS_MOUNT_MAP_SPECIAL_CHR);
+                                                  CIFS_MOUNT_MAP_SPECIAL_CHR);*/
+                                        cFYI(1, ("DFS root not supported"));
                                        rc = -ENODEV;
                                        goto out;
                                } else {
@@ -2173,6 +2172,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                        atomic_inc(&pSesInfo->inUse);
                                        tcon->retry = volume_info.retry;
                                        tcon->nocase = volume_info.nocase;
+                                        tcon->seal = volume_info.seal;
                                }
                        }
                }
@@ -2314,9 +2314,10 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
        user = ses->userName;
        domain = ses->domainName;
        smb_buffer = cifs_buf_get();
-        if (smb_buffer == NULL) {
+        if (smb_buffer == NULL)
                return -ENOMEM;
-        }
        smb_buffer_response = smb_buffer;
        pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index e4e0078a052..fb69c1fa85c 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -49,18 +49,25 @@ build_path_from_dentry(struct dentry *direntry)
        struct dentry *temp;
        int namelen;
        int pplen;
+        int dfsplen;
        char *full_path;
        char dirsep;
+        struct cifs_sb_info *cifs_sb;
        if (direntry == NULL)
                return NULL;  /* not much we can do if dentry is freed and
                we need to reopen the file after it was closed implicitly
                when the server crashed */
-        dirsep = CIFS_DIR_SEP(CIFS_SB(direntry->d_sb));
+        cifs_sb = CIFS_SB(direntry->d_sb);
-        pplen = CIFS_SB(direntry->d_sb)->prepathlen;
+        dirsep = CIFS_DIR_SEP(cifs_sb);
+        pplen = cifs_sb->prepathlen;
+        if (cifs_sb->tcon && (cifs_sb->tcon->Flags & SMB_SHARE_IS_IN_DFS))
+                dfsplen = strnlen(cifs_sb->tcon->treeName, MAX_TREE_SIZE + 1);
+        else
+                dfsplen = 0;
 cifs_bp_rename_retry:
-        namelen = pplen;
+        namelen = pplen + dfsplen;
        for (temp = direntry; !IS_ROOT(temp);) {
                namelen += (1 + temp->d_name.len);
                temp = temp->d_parent;
@@ -91,7 +98,7 @@ cifs_bp_rename_retry:
                        return NULL;
                }
        }
-        if (namelen != pplen) {
+        if (namelen != pplen + dfsplen) {
                cERROR(1,
                       ("did not end path lookup where expected namelen is %d",
                        namelen));
@@ -107,7 +114,18 @@ cifs_bp_rename_retry:
           since the '\' is a valid posix character so we can not switch
           those safely to '/' if any are found in the middle of the prepath */
        /* BB test paths to Windows with '/' in the midst of prepath */
-        strncpy(full_path, CIFS_SB(direntry->d_sb)->prepath, pplen);
+        if (dfsplen) {
+                strncpy(full_path, cifs_sb->tcon->treeName, dfsplen);
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
+                        int i;
+                        for (i = 0; i < dfsplen; i++) {
+                                if (full_path[i] == '\\')
+                                        full_path[i] = '/';
+                        }
+                }
+        }
+        strncpy(full_path + dfsplen, CIFS_SB(direntry->d_sb)->prepath, pplen);
        return full_path;
 }
@@ -242,7 +260,9 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                                                 buf, inode->i_sb, xid,
                                                 &fileHandle);
                        if (newinode) {
-                                newinode->i_mode = mode;
+                                if (cifs_sb->mnt_cifs_flags &
+                                    CIFS_MOUNT_DYNPERM)
+                                        newinode->i_mode = mode;
                                if ((oplock & CIFS_CREATE_ACTION) &&
                                    (cifs_sb->mnt_cifs_flags &
                                     CIFS_MOUNT_SET_UID)) {
@@ -590,7 +610,7 @@ static int cifs_ci_compare(struct dentry *dentry, struct qstr *a,
                 * case take precedence.  If a is not a negative dentry, this
                 * should have no side effects
                 */
-                memcpy(a->name, b->name, a->len);
+                memcpy((void *)a->name, b->name, a->len);
                return 0;
        }
        return 1;
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 939e256f849..f730ef35499 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -134,10 +134,6 @@ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
        rkey = request_key(&key_type_dns_resolver, name, "");
        if (!IS_ERR(rkey)) {
                data = rkey->payload.data;
-                cFYI(1, ("%s: resolved: %s to %s", __func__,
-                                        rkey->description,
-                                        *ip_addr
-                                ));
        } else {
                cERROR(1, ("%s: unable to resolve: %s", __func__, name));
                goto out;
@@ -150,6 +146,11 @@ skip_upcall:
                if (*ip_addr) {
                        memcpy(*ip_addr, data, len);
                        (*ip_addr)[len] = '\0';
+                        if (!IS_ERR(rkey))
+                                cFYI(1, ("%s: resolved: %s to %s", __func__,
+                                                        name,
+                                                        *ip_addr
+                                        ));
                        rc = 0;
                } else {
                        rc = -ENOMEM;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 31a0a33b9d9..0aac824371a 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -75,7 +75,11 @@ static inline int cifs_convert_flags(unsigned int flags)
                return (GENERIC_READ | GENERIC_WRITE);
        }
-        return 0x20197;
+        return (READ_CONTROL | FILE_WRITE_ATTRIBUTES | FILE_READ_ATTRIBUTES |
+                FILE_WRITE_EA | FILE_APPEND_DATA | FILE_WRITE_DATA |
+                FILE_READ_DATA);
 }
 static inline int cifs_get_disposition(unsigned int flags)
@@ -542,7 +546,6 @@ int cifs_close(struct inode *inode, struct file *file)
                        msleep(timeout);
                        timeout *= 8;
                }
-                kfree(pSMBFile->search_resume_name);
                kfree(file->private_data);
                file->private_data = NULL;
        } else
@@ -601,12 +604,6 @@ int cifs_closedir(struct inode *inode, struct file *file)
                        else
                                cifs_buf_release(ptmp);
                }
-                ptmp = pCFileStruct->search_resume_name;
-                if (ptmp) {
-                        cFYI(1, ("closedir free resume name"));
-                        pCFileStruct->search_resume_name = NULL;
-                        kfree(ptmp);
-                }
                kfree(file->private_data);
                file->private_data = NULL;
        }
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index fcbdbb6ad7b..722be543cee 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -161,118 +161,115 @@ static void cifs_unix_info_to_inode(struct inode *inode,
        spin_unlock(&inode->i_lock);
 }
-static const unsigned char *cifs_get_search_path(struct cifs_sb_info *cifs_sb,
-                                                const char *search_path)
-{
-        int tree_len;
-        int path_len;
-        int i;
-        char *tmp_path;
-        struct cifsTconInfo *pTcon = cifs_sb->tcon;
-        if (!(pTcon->Flags & SMB_SHARE_IS_IN_DFS))
-                return search_path;
-        /* use full path name for working with DFS */
-        tree_len = strnlen(pTcon->treeName, MAX_TREE_SIZE + 1);
-        path_len = strnlen(search_path, MAX_PATHCONF);
-        tmp_path = kmalloc(tree_len+path_len+1, GFP_KERNEL);
+/*
-        if (tmp_path == NULL)
+ *      Needed to setup inode data for the directory which is the
-                return search_path;
+ *      junction to the new submount (ie to setup the fake directory
+ *      which represents a DFS referral)
+ */
+static void fill_fake_finddataunix(FILE_UNIX_BASIC_INFO *pfnd_dat,
+                               struct super_block *sb)
+{
+        struct inode *pinode = NULL;
+        memset(pfnd_dat, 0, sizeof(FILE_UNIX_BASIC_INFO));
+/*      __le64 pfnd_dat->EndOfFile = cpu_to_le64(0);
+        __le64 pfnd_dat->NumOfBytes = cpu_to_le64(0);
+        __u64 UniqueId = 0;  */
+        pfnd_dat->LastStatusChange =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->LastAccessTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->LastModificationTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->Type = cpu_to_le32(UNIX_DIR);
+        pfnd_dat->Permissions = cpu_to_le64(S_IXUGO | S_IRWXU);
+        pfnd_dat->Nlinks = cpu_to_le64(2);
+        if (sb->s_root)
+                pinode = sb->s_root->d_inode;
+        if (pinode == NULL)
+                return;
-        strncpy(tmp_path, pTcon->treeName, tree_len);
+        /* fill in default values for the remaining based on root
-        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)
+           inode since we can not query the server for this inode info */
-                for (i = 0; i < tree_len; i++) {
+        pfnd_dat->DevMajor = cpu_to_le64(MAJOR(pinode->i_rdev));
-                        if (tmp_path[i] == '\\')
+        pfnd_dat->DevMinor = cpu_to_le64(MINOR(pinode->i_rdev));
-                                tmp_path[i] = '/';
+        pfnd_dat->Uid = cpu_to_le64(pinode->i_uid);
-                }
+        pfnd_dat->Gid = cpu_to_le64(pinode->i_gid);
-        strncpy(tmp_path+tree_len, search_path, path_len);
-        tmp_path[tree_len+path_len] = 0;
-        return tmp_path;
 }
 int cifs_get_inode_info_unix(struct inode **pinode,
-        const unsigned char *search_path, struct super_block *sb, int xid)
+        const unsigned char *full_path, struct super_block *sb, int xid)
 {
        int rc = 0;
-        FILE_UNIX_BASIC_INFO findData;
+        FILE_UNIX_BASIC_INFO find_data;
        struct cifsTconInfo *pTcon;
        struct inode *inode;
        struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
-        const unsigned char *full_path;
        bool is_dfs_referral = false;
+        struct cifsInodeInfo *cifsInfo;
+        __u64 num_of_bytes;
+        __u64 end_of_file;
        pTcon = cifs_sb->tcon;
-        cFYI(1, ("Getting info on %s", search_path));
+        cFYI(1, ("Getting info on %s", full_path));
-        full_path = cifs_get_search_path(cifs_sb, search_path);
-try_again_CIFSSMBUnixQPathInfo:
        /* could have done a find first instead but this returns more info */
-        rc = CIFSSMBUnixQPathInfo(xid, pTcon, full_path, &findData,
+        rc = CIFSSMBUnixQPathInfo(xid, pTcon, full_path, &find_data,
                                  cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
-/*      dump_mem("\nUnixQPathInfo return data", &findData,
-                 sizeof(findData)); */
        if (rc) {
                if (rc == -EREMOTE && !is_dfs_referral) {
                        is_dfs_referral = true;
-                        if (full_path != search_path) {
+                        cFYI(DBG2, ("DFS ref"));
-                                kfree(full_path);
+                        /* for DFS, server does not give us real inode data */
-                                full_path = search_path;
+                        fill_fake_finddataunix(&find_data, sb);
-                        }
+                        rc = 0;
-                        goto try_again_CIFSSMBUnixQPathInfo;
                }
-                goto cgiiu_exit;
+        }
-        } else {
+        num_of_bytes = le64_to_cpu(find_data.NumOfBytes);
-                struct cifsInodeInfo *cifsInfo;
+        end_of_file = le64_to_cpu(find_data.EndOfFile);
-                __u64 num_of_bytes = le64_to_cpu(findData.NumOfBytes);
-                __u64 end_of_file = le64_to_cpu(findData.EndOfFile);
-                /* get new inode */
+        /* get new inode */
+        if (*pinode == NULL) {
+                *pinode = new_inode(sb);
                if (*pinode == NULL) {
-                        *pinode = new_inode(sb);
+                        rc = -ENOMEM;
-                        if (*pinode == NULL) {
+                goto cgiiu_exit;
-                                rc = -ENOMEM;
-                                goto cgiiu_exit;
-                        }
-                        /* Is an i_ino of zero legal? */
-                        /* Are there sanity checks we can use to ensure that
-                           the server is really filling in that field? */
-                        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
-                                (*pinode)->i_ino =
-                                        (unsigned long)findData.UniqueId;
-                        } /* note ino incremented to unique num in new_inode */
-                        if (sb->s_flags & MS_NOATIME)
-                                (*pinode)->i_flags |= S_NOATIME | S_NOCMTIME;
-                        insert_inode_hash(*pinode);
                }
+                /* Is an i_ino of zero legal? */
+                /* note ino incremented to unique num in new_inode */
+                /* Are there sanity checks we can use to ensure that
+                   the server is really filling in that field? */
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)
+                        (*pinode)->i_ino = (unsigned long)find_data.UniqueId;
-                inode = *pinode;
+                if (sb->s_flags & MS_NOATIME)
-                cifsInfo = CIFS_I(inode);
+                        (*pinode)->i_flags |= S_NOATIME | S_NOCMTIME;
-                cFYI(1, ("Old time %ld", cifsInfo->time));
+                insert_inode_hash(*pinode);
-                cifsInfo->time = jiffies;
+        }
-                cFYI(1, ("New time %ld", cifsInfo->time));
-                /* this is ok to set on every inode revalidate */
+        inode = *pinode;
-                atomic_set(&cifsInfo->inUse, 1);
+        cifsInfo = CIFS_I(inode);
-                cifs_unix_info_to_inode(inode, &findData, 0);
+        cFYI(1, ("Old time %ld", cifsInfo->time));
+        cifsInfo->time = jiffies;
+        cFYI(1, ("New time %ld", cifsInfo->time));
+        /* this is ok to set on every inode revalidate */
+        atomic_set(&cifsInfo->inUse, 1);
+        cifs_unix_info_to_inode(inode, &find_data, 0);
-                if (num_of_bytes < end_of_file)
+        if (num_of_bytes < end_of_file)
-                        cFYI(1, ("allocation size less than end of file"));
+                cFYI(1, ("allocation size less than end of file"));
-                cFYI(1, ("Size %ld and blocks %llu",
+        cFYI(1, ("Size %ld and blocks %llu",
-                        (unsigned long) inode->i_size,
+                (unsigned long) inode->i_size,
-                        (unsigned long long)inode->i_blocks));
+                (unsigned long long)inode->i_blocks));
-                cifs_set_ops(inode, is_dfs_referral);
+        cifs_set_ops(inode, is_dfs_referral);
-        }
 cgiiu_exit:
-        if (full_path != search_path)
-                kfree(full_path);
        return rc;
 }
@@ -379,21 +376,52 @@ static int get_sfu_mode(struct inode *inode,
 #endif
 }
+/*
+ *      Needed to setup inode data for the directory which is the
+ *      junction to the new submount (ie to setup the fake directory
+ *      which represents a DFS referral)
+ */
+static void fill_fake_finddata(FILE_ALL_INFO *pfnd_dat,
+                               struct super_block *sb)
+{
+        memset(pfnd_dat, 0, sizeof(FILE_ALL_INFO));
+/*      __le64 pfnd_dat->AllocationSize = cpu_to_le64(0);
+        __le64 pfnd_dat->EndOfFile = cpu_to_le64(0);
+        __u8 pfnd_dat->DeletePending = 0;
+        __u8 pfnd_data->Directory = 0;
+        __le32 pfnd_dat->EASize = 0;
+        __u64 pfnd_dat->IndexNumber = 0;
+        __u64 pfnd_dat->IndexNumber1 = 0;  */
+        pfnd_dat->CreationTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->LastAccessTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->LastWriteTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->ChangeTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->Attributes = cpu_to_le32(ATTR_DIRECTORY);
+        pfnd_dat->NumberOfLinks = cpu_to_le32(2);
+}
 int cifs_get_inode_info(struct inode **pinode,
-        const unsigned char *search_path, FILE_ALL_INFO *pfindData,
+        const unsigned char *full_path, FILE_ALL_INFO *pfindData,
        struct super_block *sb, int xid, const __u16 *pfid)
 {
        int rc = 0;
+        __u32 attr;
+        struct cifsInodeInfo *cifsInfo;
        struct cifsTconInfo *pTcon;
        struct inode *inode;
        struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
-        const unsigned char *full_path = NULL;
        char *buf = NULL;
        bool adjustTZ = false;
        bool is_dfs_referral = false;
+        umode_t default_mode;
        pTcon = cifs_sb->tcon;
-        cFYI(1, ("Getting info on %s", search_path));
+        cFYI(1, ("Getting info on %s", full_path));
        if ((pfindData == NULL) && (*pinode != NULL)) {
                if (CIFS_I(*pinode)->clientCanCacheRead) {
@@ -409,9 +437,6 @@ int cifs_get_inode_info(struct inode **pinode,
                        return -ENOMEM;
                pfindData = (FILE_ALL_INFO *)buf;
-                full_path = cifs_get_search_path(cifs_sb, search_path);
-try_again_CIFSSMBQPathInfo:
                /* could do find first instead but this returns more info */
                rc = CIFSSMBQPathInfo(xid, pTcon, full_path, pfindData,
                              0 /* not legacy */,
@@ -429,178 +454,163 @@ try_again_CIFSSMBQPathInfo:
                }
        }
        /* dump_mem("\nQPathInfo return data",&findData, sizeof(findData)); */
-        if (rc) {
+        if (rc == -EREMOTE) {
-                if (rc == -EREMOTE && !is_dfs_referral) {
+                is_dfs_referral = true;
-                        is_dfs_referral = true;
+                fill_fake_finddata(pfindData, sb);
-                        if (full_path != search_path) {
+                rc = 0;
-                                kfree(full_path);
+        } else if (rc)
-                                full_path = search_path;
-                        }
-                        goto try_again_CIFSSMBQPathInfo;
-                }
                goto cgii_exit;
-        } else {
-                struct cifsInodeInfo *cifsInfo;
-                __u32 attr = le32_to_cpu(pfindData->Attributes);
-                /* get new inode */
-                if (*pinode == NULL) {
-                        *pinode = new_inode(sb);
-                        if (*pinode == NULL) {
-                                rc = -ENOMEM;
-                                goto cgii_exit;
-                        }
-                        /* Is an i_ino of zero legal? Can we use that to check
-                           if the server supports returning inode numbers?  Are
-                           there other sanity checks we can use to ensure that
-                           the server is really filling in that field? */
-                        /* We can not use the IndexNumber field by default from
-                           Windows or Samba (in ALL_INFO buf) but we can request
-                           it explicitly.  It may not be unique presumably if
-                           the server has multiple devices mounted under one
-                           share */
-                        /* There may be higher info levels that work but are
+        attr = le32_to_cpu(pfindData->Attributes);
-                           there Windows server or network appliances for which
-                           IndexNumber field is not guaranteed unique? */
-                        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
+        /* get new inode */
-                                int rc1 = 0;
+        if (*pinode == NULL) {
-                                __u64 inode_num;
+                *pinode = new_inode(sb);
+                if (*pinode == NULL) {
-                                rc1 = CIFSGetSrvInodeNumber(xid, pTcon,
+                        rc = -ENOMEM;
-                                        search_path, &inode_num,
+                        goto cgii_exit;
+                }
+                /* Is an i_ino of zero legal? Can we use that to check
+                   if the server supports returning inode numbers?  Are
+                   there other sanity checks we can use to ensure that
+                   the server is really filling in that field? */
+                /* We can not use the IndexNumber field by default from
+                   Windows or Samba (in ALL_INFO buf) but we can request
+                   it explicitly.  It may not be unique presumably if
+                   the server has multiple devices mounted under one share */
+                /* There may be higher info levels that work but are
+                   there Windows server or network appliances for which
+                   IndexNumber field is not guaranteed unique? */
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
+                        int rc1 = 0;
+                        __u64 inode_num;
+                        rc1 = CIFSGetSrvInodeNumber(xid, pTcon,
+                                        full_path, &inode_num,
                                        cifs_sb->local_nls,
                                        cifs_sb->mnt_cifs_flags &
                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
-                                if (rc1) {
+                        if (rc1) {
-                                        cFYI(1, ("GetSrvInodeNum rc %d", rc1));
+                                cFYI(1, ("GetSrvInodeNum rc %d", rc1));
-                                        /* BB EOPNOSUPP disable SERVER_INUM? */
+                                /* BB EOPNOSUPP disable SERVER_INUM? */
-                                } else /* do we need cast or hash to ino? */
+                        } else /* do we need cast or hash to ino? */
-                                        (*pinode)->i_ino = inode_num;
+                                (*pinode)->i_ino = inode_num;
-                        } /* else ino incremented to unique num in new_inode*/
+                } /* else ino incremented to unique num in new_inode*/
-                        if (sb->s_flags & MS_NOATIME)
+                if (sb->s_flags & MS_NOATIME)
-                                (*pinode)->i_flags |= S_NOATIME | S_NOCMTIME;
+                        (*pinode)->i_flags |= S_NOATIME | S_NOCMTIME;
-                        insert_inode_hash(*pinode);
+                insert_inode_hash(*pinode);
-                }
+        }
-                inode = *pinode;
+        inode = *pinode;
-                cifsInfo = CIFS_I(inode);
+        cifsInfo = CIFS_I(inode);
-                cifsInfo->cifsAttrs = attr;
+        cifsInfo->cifsAttrs = attr;
-                cFYI(1, ("Old time %ld", cifsInfo->time));
+        cFYI(1, ("Old time %ld", cifsInfo->time));
-                cifsInfo->time = jiffies;
+        cifsInfo->time = jiffies;
-                cFYI(1, ("New time %ld", cifsInfo->time));
+        cFYI(1, ("New time %ld", cifsInfo->time));
-                /* blksize needs to be multiple of two. So safer to default to
+        /* blksize needs to be multiple of two. So safer to default to
-                blksize and blkbits set in superblock so 2**blkbits and blksize
+        blksize and blkbits set in superblock so 2**blkbits and blksize
-                will match rather than setting to:
+        will match rather than setting to:
-                (pTcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE) & 0xFFFFFE00;*/
+        (pTcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE) & 0xFFFFFE00;*/
-                /* Linux can not store file creation time so ignore it */
+        /* Linux can not store file creation time so ignore it */
-                if (pfindData->LastAccessTime)
+        if (pfindData->LastAccessTime)
-                        inode->i_atime = cifs_NTtimeToUnix
+                inode->i_atime = cifs_NTtimeToUnix
-                                (le64_to_cpu(pfindData->LastAccessTime));
+                        (le64_to_cpu(pfindData->LastAccessTime));
-                else /* do not need to use current_fs_time - time not stored */
+        else /* do not need to use current_fs_time - time not stored */
-                        inode->i_atime = CURRENT_TIME;
+                inode->i_atime = CURRENT_TIME;
-                inode->i_mtime =
+        inode->i_mtime =
                    cifs_NTtimeToUnix(le64_to_cpu(pfindData->LastWriteTime));
-                inode->i_ctime =
+        inode->i_ctime =
-                    cifs_NTtimeToUnix(le64_to_cpu(pfindData->ChangeTime));
+            cifs_NTtimeToUnix(le64_to_cpu(pfindData->ChangeTime));
-                cFYI(0, ("Attributes came in as 0x%x", attr));
+        cFYI(DBG2, ("Attributes came in as 0x%x", attr));
-                if (adjustTZ && (pTcon->ses) && (pTcon->ses->server)) {
+        if (adjustTZ && (pTcon->ses) && (pTcon->ses->server)) {
-                        inode->i_ctime.tv_sec += pTcon->ses->server->timeAdj;
+                inode->i_ctime.tv_sec += pTcon->ses->server->timeAdj;
-                        inode->i_mtime.tv_sec += pTcon->ses->server->timeAdj;
+                inode->i_mtime.tv_sec += pTcon->ses->server->timeAdj;
-                }
+        }
-                /* set default mode. will override for dirs below */
+        /* get default inode mode */
-                if (atomic_read(&cifsInfo->inUse) == 0)
+        if (attr & ATTR_DIRECTORY)
-                        /* new inode, can safely set these fields */
+                default_mode = cifs_sb->mnt_dir_mode;
-                        inode->i_mode = cifs_sb->mnt_file_mode;
+        else
-                else /* since we set the inode type below we need to mask off
+                default_mode = cifs_sb->mnt_file_mode;
-                     to avoid strange results if type changes and both
-                     get orred in */
+        /* set permission bits */
+        if (atomic_read(&cifsInfo->inUse) == 0 ||
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
+                inode->i_mode = default_mode;
+        else {
+                /* just reenable write bits if !ATTR_READONLY */
+                if ((inode->i_mode & S_IWUGO) == 0 &&
+                    (attr & ATTR_READONLY) == 0)
+                        inode->i_mode |= (S_IWUGO & default_mode);
                        inode->i_mode &= ~S_IFMT;
-/*              if (attr & ATTR_REPARSE)  */
+        }
-                /* We no longer handle these as symlinks because we could not
+        /* clear write bits if ATTR_READONLY is set */
-                   follow them due to the absolute path with drive letter */
+        if (attr & ATTR_READONLY)
-                if (attr & ATTR_DIRECTORY) {
+                inode->i_mode &= ~S_IWUGO;
-                /* override default perms since we do not do byte range locking
-                   on dirs */
+        /* set inode type */
-                        inode->i_mode = cifs_sb->mnt_dir_mode;
+        if ((attr & ATTR_SYSTEM) &&
-                        inode->i_mode |= S_IFDIR;
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)) {
-                } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
+                /* no need to fix endianness on 0 */
-                           (cifsInfo->cifsAttrs & ATTR_SYSTEM) &&
+                if (pfindData->EndOfFile == 0)
-                           /* No need to le64 convert size of zero */
-                           (pfindData->EndOfFile == 0)) {
-                        inode->i_mode = cifs_sb->mnt_file_mode;
                        inode->i_mode |= S_IFIFO;
-/* BB Finish for SFU style symlinks and devices */
+                else if (decode_sfu_inode(inode,
-                } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
+                                le64_to_cpu(pfindData->EndOfFile),
-                           (cifsInfo->cifsAttrs & ATTR_SYSTEM)) {
+                                full_path, cifs_sb, xid))
-                        if (decode_sfu_inode(inode,
+                        cFYI(1, ("unknown SFU file type\n"));
-                                         le64_to_cpu(pfindData->EndOfFile),
+        } else {
-                                         search_path,
+                if (attr & ATTR_DIRECTORY)
-                                         cifs_sb, xid))
+                        inode->i_mode |= S_IFDIR;
-                                cFYI(1, ("Unrecognized sfu inode type"));
+                else
-                        cFYI(1, ("sfu mode 0%o", inode->i_mode));
-                } else {
                        inode->i_mode |= S_IFREG;
-                        /* treat the dos attribute of read-only as read-only
+        }
-                           mode e.g. 555 */
-                        if (cifsInfo->cifsAttrs & ATTR_READONLY)
-                                inode->i_mode &= ~(S_IWUGO);
-                        else if ((inode->i_mode & S_IWUGO) == 0)
-                                /* the ATTR_READONLY flag may have been */
-                                /* changed on server -- set any w bits  */
-                                /* allowed by mnt_file_mode             */
-                                inode->i_mode |= (S_IWUGO &
-                                                  cifs_sb->mnt_file_mode);
-                /* BB add code here -
-                   validate if device or weird share or device type? */
-                }
-                spin_lock(&inode->i_lock);
+        spin_lock(&inode->i_lock);
-                if (is_size_safe_to_change(cifsInfo,
+        if (is_size_safe_to_change(cifsInfo,
-                                           le64_to_cpu(pfindData->EndOfFile))) {
+                                   le64_to_cpu(pfindData->EndOfFile))) {
-                        /* can not safely shrink the file size here if the
+                /* can not safely shrink the file size here if the
-                           client is writing to it due to potential races */
+                   client is writing to it due to potential races */
-                        i_size_write(inode, le64_to_cpu(pfindData->EndOfFile));
+                i_size_write(inode, le64_to_cpu(pfindData->EndOfFile));
-                        /* 512 bytes (2**9) is the fake blocksize that must be
+                /* 512 bytes (2**9) is the fake blocksize that must be
-                           used for this calculation */
+                   used for this calculation */
-                        inode->i_blocks = (512 - 1 + le64_to_cpu(
+                inode->i_blocks = (512 - 1 + le64_to_cpu(
-                                           pfindData->AllocationSize)) >> 9;
+                                   pfindData->AllocationSize)) >> 9;
-                }
+        }
-                spin_unlock(&inode->i_lock);
+        spin_unlock(&inode->i_lock);
-                inode->i_nlink = le32_to_cpu(pfindData->NumberOfLinks);
+        inode->i_nlink = le32_to_cpu(pfindData->NumberOfLinks);
-                /* BB fill in uid and gid here? with help from winbind?
+        /* BB fill in uid and gid here? with help from winbind?
-                   or retrieve from NTFS stream extended attribute */
+           or retrieve from NTFS stream extended attribute */
 #ifdef CONFIG_CIFS_EXPERIMENTAL
-                /* fill in 0777 bits from ACL */
+        /* fill in 0777 bits from ACL */
-                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
-                        cFYI(1, ("Getting mode bits from ACL"));
+                cFYI(1, ("Getting mode bits from ACL"));
-                        acl_to_uid_mode(inode, search_path, pfid);
+                acl_to_uid_mode(inode, full_path, pfid);
-                }
+        }
 #endif
-                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) {
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) {
-                        /* fill in remaining high mode bits e.g. SUID, VTX */
+                /* fill in remaining high mode bits e.g. SUID, VTX */
-                        get_sfu_mode(inode, search_path, cifs_sb, xid);
+                get_sfu_mode(inode, full_path, cifs_sb, xid);
-                } else if (atomic_read(&cifsInfo->inUse) == 0) {
+        } else if (atomic_read(&cifsInfo->inUse) == 0) {
-                        inode->i_uid = cifs_sb->mnt_uid;
+                inode->i_uid = cifs_sb->mnt_uid;
-                        inode->i_gid = cifs_sb->mnt_gid;
+                inode->i_gid = cifs_sb->mnt_gid;
-                        /* set so we do not keep refreshing these fields with
+                /* set so we do not keep refreshing these fields with
-                           bad data after user has changed them in memory */
+                   bad data after user has changed them in memory */
-                        atomic_set(&cifsInfo->inUse, 1);
+                atomic_set(&cifsInfo->inUse, 1);
-                }
-                cifs_set_ops(inode, is_dfs_referral);
        }
+        cifs_set_ops(inode, is_dfs_referral);
 cgii_exit:
-        if (full_path != search_path)
-                kfree(full_path);
        kfree(buf);
        return rc;
 }
@@ -1005,8 +1015,11 @@ mkdir_get_info:
                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                        }
                        if (direntry->d_inode) {
-                                direntry->d_inode->i_mode = mode;
+                                if (cifs_sb->mnt_cifs_flags &
-                                direntry->d_inode->i_mode |= S_IFDIR;
+                                     CIFS_MOUNT_DYNPERM)
+                                        direntry->d_inode->i_mode =
+                                                (mode | S_IFDIR);
                                if (cifs_sb->mnt_cifs_flags &
                                     CIFS_MOUNT_SET_UID) {
                                        direntry->d_inode->i_uid =
@@ -1502,8 +1515,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                                int oplock = 0;
                                rc = SMBLegacyOpen(xid, pTcon, full_path,
-                                        FILE_OPEN,
+                                        FILE_OPEN, GENERIC_WRITE,
-                                        SYNCHRONIZE | FILE_WRITE_ATTRIBUTES,
                                        CREATE_NOT_DIR, &netfid, &oplock,
                                        NULL, cifs_sb->local_nls,
                                        cifs_sb->mnt_cifs_flags &
@@ -1534,13 +1546,26 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                } else
                        goto cifs_setattr_exit;
        }
-        if (attrs->ia_valid & ATTR_UID) {
-                cFYI(1, ("UID changed to %d", attrs->ia_uid));
+        /*
-                uid = attrs->ia_uid;
+         * Without unix extensions we can't send ownership changes to the
-        }
+         * server, so silently ignore them. This is consistent with how
-        if (attrs->ia_valid & ATTR_GID) {
+         * local DOS/Windows filesystems behave (VFAT, NTFS, etc). With
-                cFYI(1, ("GID changed to %d", attrs->ia_gid));
+         * CIFSACL support + proper Windows to Unix idmapping, we may be
-                gid = attrs->ia_gid;
+         * able to support this in the future.
+         */
+        if (!pTcon->unix_ext &&
+            !(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)) {
+                attrs->ia_valid &= ~(ATTR_UID | ATTR_GID);
+        } else {
+                if (attrs->ia_valid & ATTR_UID) {
+                        cFYI(1, ("UID changed to %d", attrs->ia_uid));
+                        uid = attrs->ia_uid;
+                }
+                if (attrs->ia_valid & ATTR_GID) {
+                        cFYI(1, ("GID changed to %d", attrs->ia_gid));
+                        gid = attrs->ia_gid;
+                }
        }
        time_buf.Attributes = 0;
@@ -1550,7 +1575,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                attrs->ia_valid &= ~ATTR_MODE;
        if (attrs->ia_valid & ATTR_MODE) {
-                cFYI(1, ("Mode changed to 0x%x", attrs->ia_mode));
+                cFYI(1, ("Mode changed to 0%o", attrs->ia_mode));
                mode = attrs->ia_mode;
        }
@@ -1565,18 +1590,18 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
 #ifdef CONFIG_CIFS_EXPERIMENTAL
                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL)
                        rc = mode_to_acl(inode, full_path, mode);
-                else if ((mode & S_IWUGO) == 0) {
+                else
-#else
-                if ((mode & S_IWUGO) == 0) {
 #endif
-                        /* not writeable */
+                if (((mode & S_IWUGO) == 0) &&
-                        if ((cifsInode->cifsAttrs & ATTR_READONLY) == 0) {
+                    (cifsInode->cifsAttrs & ATTR_READONLY) == 0) {
-                                set_dosattr = true;
+                        set_dosattr = true;
-                                time_buf.Attributes =
+                        time_buf.Attributes = cpu_to_le32(cifsInode->cifsAttrs |
-                                        cpu_to_le32(cifsInode->cifsAttrs |
+                                                          ATTR_READONLY);
-                                                    ATTR_READONLY);
+                        /* fix up mode if we're not using dynperm */
-                        }
+                        if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
-                } else if (cifsInode->cifsAttrs & ATTR_READONLY) {
+                                attrs->ia_mode = inode->i_mode & ~S_IWUGO;
+                } else if ((mode & S_IWUGO) &&
+                           (cifsInode->cifsAttrs & ATTR_READONLY)) {
                        /* If file is readonly on server, we would
                        not be able to write to it - so if any write
                        bit is enabled for user or group or other we
@@ -1587,6 +1612,20 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                        /* Windows ignores set to zero */
                        if (time_buf.Attributes == 0)
                                time_buf.Attributes |= cpu_to_le32(ATTR_NORMAL);
+                        /* reset local inode permissions to normal */
+                        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)) {
+                                attrs->ia_mode &= ~(S_IALLUGO);
+                                if (S_ISDIR(inode->i_mode))
+                                        attrs->ia_mode |=
+                                                cifs_sb->mnt_dir_mode;
+                                else
+                                        attrs->ia_mode |=
+                                                cifs_sb->mnt_file_mode;
+                        }
+                } else if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)) {
+                        /* ignore mode change - ATTR_READONLY hasn't changed */
+                        attrs->ia_valid &= ~ATTR_MODE;
                }
        }
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index 5c792df13d6..0088a5b5256 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -30,9 +30,9 @@
 #define CIFS_IOC_CHECKUMOUNT _IO(0xCF, 2)
-int cifs_ioctl(struct inode *inode, struct file *filep,
+long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
-                unsigned int command, unsigned long arg)
 {
+        struct inode *inode = filep->f_dentry->d_inode;
        int rc = -ENOTTY; /* strange error - but the precedent */
        int xid;
        struct cifs_sb_info *cifs_sb;
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 1c2c3ce5020..63f644000ce 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -234,7 +234,6 @@ cifs_readlink(struct dentry *direntry, char __user *pBuffer, int buflen)
        struct cifs_sb_info *cifs_sb;
        struct cifsTconInfo *pTcon;
        char *full_path = NULL;
-        char *tmp_path = NULL;
        char *tmpbuffer;
        int len;
        __u16 fid;
@@ -295,45 +294,9 @@ cifs_readlink(struct dentry *direntry, char __user *pBuffer, int buflen)
                                cFYI(1, ("Error closing junction point "
                                         "(open for ioctl)"));
                        }
-                        /* BB unwind this long, nested function, or remove BB */
+                        /* If it is a DFS junction earlier we would have gotten
-                        if (rc == -EIO) {
+                           PATH_NOT_COVERED returned from server so we do
-                                /* Query if DFS Junction */
+                           not need to request the DFS info here */
-                                unsigned int num_referrals = 0;
-                                struct dfs_info3_param *refs = NULL;
-                                tmp_path =
-                                        kmalloc(MAX_TREE_SIZE + MAX_PATHCONF + 1,
-                                                GFP_KERNEL);
-                                if (tmp_path) {
-                                        strncpy(tmp_path, pTcon->treeName,
-                                                MAX_TREE_SIZE);
-                                        strncat(tmp_path, full_path,
-                                                MAX_PATHCONF);
-                                        rc = get_dfs_path(xid, pTcon->ses,
-                                                tmp_path,
-                                                cifs_sb->local_nls,
-                                                &num_referrals, &refs,
-                                                cifs_sb->mnt_cifs_flags &
-                                                    CIFS_MOUNT_MAP_SPECIAL_CHR);
-                                        cFYI(1, ("Get DFS for %s rc = %d ",
-                                                tmp_path, rc));
-                                        if ((num_referrals == 0) && (rc == 0))
-                                                rc = -EACCES;
-                                        else {
-                                                cFYI(1, ("num referral: %d",
-                                                        num_referrals));
-                                                if (refs && refs->path_name) {
-                                                        strncpy(tmpbuffer,
-                                                                refs->path_name,
-                                                                len-1);
-                                                }
-                                        }
-                                        kfree(refs);
-                                        kfree(tmp_path);
-}
-                                /* BB add code like else decode referrals
-                                then memcpy to tmpbuffer and free referrals
-                                string array BB */
-                        }
                }
        }
        /* BB Anything else to do to handle recursive links? */
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 1d69b8014e0..4b17f8fe315 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -519,8 +519,7 @@ is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
                        pnotify = (struct file_notify_information *)
                                ((char *)&pSMBr->hdr.Protocol + data_offset);
                        cFYI(1, ("dnotify on %s Action: 0x%x",
-                                 pnotify->FileName,
+                                 pnotify->FileName, pnotify->Action));
-                                pnotify->Action));  /* BB removeme BB */
                        /*   cifs_dump_mem("Rcvd notify Data: ",buf,
                                sizeof(struct smb_hdr)+60); */
                        return true;
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index 00f4cff400b..8703d68f5b2 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -141,11 +141,11 @@ cifs_inet_pton(const int address_family, const char *cp, void *dst)
        int ret = 0;
        /* calculate length by finding first slash or NULL */
-        if (address_family == AF_INET) {
+        if (address_family == AF_INET)
                ret = in4_pton(cp, -1 /* len */, dst, '\\', NULL);
-        } else if (address_family == AF_INET6) {
+        else if (address_family == AF_INET6)
                ret = in6_pton(cp, -1 /* len */, dst , '\\', NULL);
-        }
        cFYI(DBG2, ("address conversion returned %d for %s", ret, cp));
        if (ret > 0)
                ret = 1;
diff --git a/fs/cifs/ntlmssp.h b/fs/cifs/ntlmssp.h
index 7170a9b70f1..c377d8065d9 100644
--- a/fs/cifs/ntlmssp.h
+++ b/fs/cifs/ntlmssp.h
@@ -64,7 +64,7 @@ typedef struct _SECURITY_BUFFER {
 } __attribute__((packed)) SECURITY_BUFFER;
 typedef struct _NEGOTIATE_MESSAGE {
-        __u8 Signature[sizeof (NTLMSSP_SIGNATURE)];
+        __u8 Signature[sizeof(NTLMSSP_SIGNATURE)];
        __le32 MessageType;     /* 1 */
        __le32 NegotiateFlags;
        SECURITY_BUFFER DomainName;     /* RFC 1001 style and ASCII */
@@ -74,7 +74,7 @@ typedef struct _NEGOTIATE_MESSAGE {
 } __attribute__((packed)) NEGOTIATE_MESSAGE, *PNEGOTIATE_MESSAGE;
 typedef struct _CHALLENGE_MESSAGE {
-        __u8 Signature[sizeof (NTLMSSP_SIGNATURE)];
+        __u8 Signature[sizeof(NTLMSSP_SIGNATURE)];
        __le32 MessageType;   /* 2 */
        SECURITY_BUFFER TargetName;
        __le32 NegotiateFlags;
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 34ec32100c7..83f30695488 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -132,6 +132,7 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
        __u32 attr;
        __u64 allocation_size;
        __u64 end_of_file;
+        umode_t default_mode;
        /* save mtime and size */
        local_mtime = tmp_inode->i_mtime;
@@ -187,48 +188,54 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
        if (atomic_read(&cifsInfo->inUse) == 0) {
                tmp_inode->i_uid = cifs_sb->mnt_uid;
                tmp_inode->i_gid = cifs_sb->mnt_gid;
-                /* set default mode. will override for dirs below */
+        }
-                tmp_inode->i_mode = cifs_sb->mnt_file_mode;
-        } else {
+        if (attr & ATTR_DIRECTORY)
-                /* mask off the type bits since it gets set
+                default_mode = cifs_sb->mnt_dir_mode;
-                below and we do not want to get two type
+        else
-                bits set */
+                default_mode = cifs_sb->mnt_file_mode;
+        /* set initial permissions */
+        if ((atomic_read(&cifsInfo->inUse) == 0) ||
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
+                tmp_inode->i_mode = default_mode;
+        else {
+                /* just reenable write bits if !ATTR_READONLY */
+                if ((tmp_inode->i_mode & S_IWUGO) == 0 &&
+                    (attr & ATTR_READONLY) == 0)
+                        tmp_inode->i_mode |= (S_IWUGO & default_mode);
                tmp_inode->i_mode &= ~S_IFMT;
        }
-        if (attr & ATTR_DIRECTORY) {
+        /* clear write bits if ATTR_READONLY is set */
-                *pobject_type = DT_DIR;
+        if (attr & ATTR_READONLY)
-                /* override default perms since we do not lock dirs */
+                tmp_inode->i_mode &= ~S_IWUGO;
-                if (atomic_read(&cifsInfo->inUse) == 0)
-                        tmp_inode->i_mode = cifs_sb->mnt_dir_mode;
+        /* set inode type */
-                tmp_inode->i_mode |= S_IFDIR;
+        if ((attr & ATTR_SYSTEM) &&
-        } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)) {
-                   (attr & ATTR_SYSTEM)) {
                if (end_of_file == 0)  {
-                        *pobject_type = DT_FIFO;
                        tmp_inode->i_mode |= S_IFIFO;
+                        *pobject_type = DT_FIFO;
                } else {
-                        /* rather than get the type here, we mark the
+                        /*
-                        inode as needing revalidate and get the real type
+                         * trying to get the type can be slow, so just call
-                        (blk vs chr vs. symlink) later ie in lookup */
+                         * this a regular file for now, and mark for reval
-                        *pobject_type = DT_REG;
+                         */
                        tmp_inode->i_mode |= S_IFREG;
+                        *pobject_type = DT_REG;
                        cifsInfo->time = 0;
                }
-/* we no longer mark these because we could not follow them */
-/*        } else if (attr & ATTR_REPARSE) {
-                *pobject_type = DT_LNK;
-                tmp_inode->i_mode |= S_IFLNK; */
        } else {
-                *pobject_type = DT_REG;
+                if (attr & ATTR_DIRECTORY) {
-                tmp_inode->i_mode |= S_IFREG;
+                        tmp_inode->i_mode |= S_IFDIR;
-                if (attr & ATTR_READONLY)
+                        *pobject_type = DT_DIR;
-                        tmp_inode->i_mode &= ~(S_IWUGO);
+                } else {
-                else if ((tmp_inode->i_mode & S_IWUGO) == 0)
+                        tmp_inode->i_mode |= S_IFREG;
-                        /* the ATTR_READONLY flag may have been changed on   */
+                        *pobject_type = DT_REG;
-                        /* server -- set any w bits allowed by mnt_file_mode */
+                }
-                        tmp_inode->i_mode |= (S_IWUGO & cifs_sb->mnt_file_mode);
+        }
-        } /* could add code here - to validate if device or weird share type? */
        /* can not fill in nlink here as in qpathinfo version and Unx search */
        if (atomic_read(&cifsInfo->inUse) == 0)
@@ -670,10 +677,11 @@ static int find_cifs_entry(const int xid, struct cifsTconInfo *pTcon,
           (index_to_find < first_entry_in_buffer)) {
                /* close and restart search */
                cFYI(1, ("search backing up - close and restart search"));
-                cifsFile->invalidHandle = true;
+                if (!cifsFile->srch_inf.endOfSearch &&
-                CIFSFindClose(xid, pTcon, cifsFile->netfid);
+                    !cifsFile->invalidHandle) {
-                kfree(cifsFile->search_resume_name);
+                        cifsFile->invalidHandle = true;
-                cifsFile->search_resume_name = NULL;
+                        CIFSFindClose(xid, pTcon, cifsFile->netfid);
+                }
                if (cifsFile->srch_inf.ntwrk_buf_start) {
                        cFYI(1, ("freeing SMB ff cache buf on search rewind"));
                        if (cifsFile->srch_inf.smallBuf)
@@ -1040,9 +1048,7 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                } /* else {
                        cifsFile->invalidHandle = true;
                        CIFSFindClose(xid, pTcon, cifsFile->netfid);
-                }
+                } */
-                kfree(cifsFile->search_resume_name);
-                cifsFile->search_resume_name = NULL; */
                rc = find_cifs_entry(xid, pTcon, file,
                                &current_entry, &num_to_fill);
diff --git a/fs/dcache.c b/fs/dcache.c
index 3ee588d5f58..6068c25b393 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -17,6 +17,7 @@
 #include <linux/syscalls.h>
 #include <linux/string.h>
 #include <linux/mm.h>
+#include <linux/fdtable.h>
 #include <linux/fs.h>
 #include <linux/fsnotify.h>
 #include <linux/slab.h>
@@ -106,9 +107,10 @@ static void dentry_lru_remove(struct dentry *dentry)
 /*
 * Release the dentry's inode, using the filesystem
 * d_iput() operation if defined.
- * Called with dcache_lock and per dentry lock held, drops both.
 */
 static void dentry_iput(struct dentry * dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
 {
        struct inode *inode = dentry->d_inode;
        if (inode) {
@@ -132,12 +134,13 @@ static void dentry_iput(struct dentry * dentry)
 * d_kill - kill dentry and return parent
 * @dentry: dentry to kill
 *
- * Called with dcache_lock and d_lock, releases both.  The dentry must
+ * The dentry must already be unhashed and removed from the LRU.
- * already be unhashed and removed from the LRU.
 *
 * If this is the root of the dentry tree, return NULL.
 */
 static struct dentry *d_kill(struct dentry *dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
 {
        struct dentry *parent;
@@ -383,11 +386,11 @@ restart:
 * Try to prune ancestors as well.  This is necessary to prevent
 * quadratic behavior of shrink_dcache_parent(), but is also expected
 * to be beneficial in reducing dentry cache fragmentation.
- *
- * Called with dcache_lock, drops it and then regains.
- * Called with dentry->d_lock held, drops it.
 */
 static void prune_one_dentry(struct dentry * dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
+        __acquires(dcache_lock)
 {
        __d_drop(dentry);
        dentry = d_kill(dentry);
@@ -1604,10 +1607,9 @@ static int d_isparent(struct dentry *p1, struct dentry *p2)
 *
 * Note: If ever the locking in lock_rename() changes, then please
 * remember to update this too...
- *
- * On return, dcache_lock will have been unlocked.
 */
 static struct dentry *__d_unalias(struct dentry *dentry, struct dentry *alias)
+        __releases(dcache_lock)
 {
        struct mutex *m1 = NULL, *m2 = NULL;
        struct dentry *ret;
@@ -1743,11 +1745,9 @@ out_nolock:
 shouldnt_be_hashed:
        spin_unlock(&dcache_lock);
        BUG();
-        goto shouldnt_be_hashed;
 }
-static int prepend(char **buffer, int *buflen, const char *str,
+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
-                          int namelen)
 {
        *buflen -= namelen;
        if (*buflen < 0)
@@ -1757,8 +1757,13 @@ static int prepend(char **buffer, int *buflen, const char *str,
        return 0;
 }
+static int prepend_name(char **buffer, int *buflen, struct qstr *name)
+{
+        return prepend(buffer, buflen, name->name, name->len);
+}
 /**
- * d_path - return the path of a dentry
+ * __d_path - return the path of a dentry
 * @path: the dentry/vfsmount to report
 * @root: root vfsmnt/dentry (may be modified by this function)
 * @buffer: buffer to return value in
@@ -1779,9 +1784,10 @@ char *__d_path(const struct path *path, struct path *root,
 {
        struct dentry *dentry = path->dentry;
        struct vfsmount *vfsmnt = path->mnt;
-        char * end = buffer+buflen;
+        char *end = buffer + buflen;
-        char * retval;
+        char *retval;
+        spin_lock(&vfsmount_lock);
        prepend(&end, &buflen, "\0", 1);
        if (!IS_ROOT(dentry) && d_unhashed(dentry) &&
                (prepend(&end, &buflen, " (deleted)", 10) != 0))
@@ -1800,38 +1806,37 @@ char *__d_path(const struct path *path, struct path *root,
                        break;
                if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
                        /* Global root? */
-                        spin_lock(&vfsmount_lock);
                        if (vfsmnt->mnt_parent == vfsmnt) {
-                                spin_unlock(&vfsmount_lock);
                                goto global_root;
                        }
                        dentry = vfsmnt->mnt_mountpoint;
                        vfsmnt = vfsmnt->mnt_parent;
-                        spin_unlock(&vfsmount_lock);
                        continue;
                }
                parent = dentry->d_parent;
                prefetch(parent);
-                if ((prepend(&end, &buflen, dentry->d_name.name,
+                if ((prepend_name(&end, &buflen, &dentry->d_name) != 0) ||
-                                dentry->d_name.len) != 0) ||
                    (prepend(&end, &buflen, "/", 1) != 0))
                        goto Elong;
                retval = end;
                dentry = parent;
        }
+out:
+        spin_unlock(&vfsmount_lock);
        return retval;
 global_root:
        retval += 1;    /* hit the slash */
-        if (prepend(&retval, &buflen, dentry->d_name.name,
+        if (prepend_name(&retval, &buflen, &dentry->d_name) != 0)
-                    dentry->d_name.len) != 0)
                goto Elong;
        root->mnt = vfsmnt;
        root->dentry = dentry;
-        return retval;
+        goto out;
 Elong:
-        return ERR_PTR(-ENAMETOOLONG);
+        retval = ERR_PTR(-ENAMETOOLONG);
+        goto out;
 }
 /**
@@ -1845,9 +1850,9 @@ Elong:
 *
 * Returns the buffer or an error code if the path was too long.
 *
- * "buflen" should be positive. Caller holds the dcache_lock.
+ * "buflen" should be positive.
 */
-char *d_path(struct path *path, char *buf, int buflen)
+char *d_path(const struct path *path, char *buf, int buflen)
 {
        char *res;
        struct path root;
@@ -1915,16 +1920,11 @@ char *dentry_path(struct dentry *dentry, char *buf, int buflen)
        retval = end-1;
        *retval = '/';
-        for (;;) {
+        while (!IS_ROOT(dentry)) {
-                struct dentry *parent;
+                struct dentry *parent = dentry->d_parent;
-                if (IS_ROOT(dentry))
-                        break;
-                parent = dentry->d_parent;
                prefetch(parent);
+                if ((prepend_name(&end, &buflen, &dentry->d_name) != 0) ||
-                if ((prepend(&end, &buflen, dentry->d_name.name,
-                                dentry->d_name.len) != 0) ||
                    (prepend(&end, &buflen, "/", 1) != 0))
                        goto Elong;
@@ -1975,7 +1975,7 @@ asmlinkage long sys_getcwd(char __user *buf, unsigned long size)
        error = -ENOENT;
        /* Has the current directory has been unlinked? */
        spin_lock(&dcache_lock);
-        if (pwd.dentry->d_parent == pwd.dentry || !d_unhashed(pwd.dentry)) {
+        if (IS_ROOT(pwd.dentry) || !d_unhashed(pwd.dentry)) {
                unsigned long len;
                struct path tmp = root;
                char * cwd;
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index cd62d75b2cc..e2832bc7869 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1906,9 +1906,9 @@ int ecryptfs_get_tfm_and_mutex_for_cipher_name(struct crypto_blkcipher **tfm,
                        goto out;
                }
        }
-        mutex_unlock(&key_tfm_list_mutex);
        (*tfm) = key_tfm->key_tfm;
        (*tfm_mutex) = &key_tfm->key_tfm_mutex;
 out:
+        mutex_unlock(&key_tfm_list_mutex);
        return rc;
 }
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 951ee33a022..c15c25745e0 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -660,8 +660,6 @@ int ecryptfs_get_tfm_and_mutex_for_cipher_name(struct crypto_blkcipher **tfm,
 int ecryptfs_keyring_auth_tok_for_sig(struct key **auth_tok_key,
                                      struct ecryptfs_auth_tok **auth_tok,
                                      char *sig);
-int ecryptfs_write_zeros(struct file *file, pgoff_t index, int start,
-                         int num_zeros);
 int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
                         loff_t offset, size_t size);
 int ecryptfs_write_lower_page_segment(struct inode *ecryptfs_inode,
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 6560da1a58c..09a4522f65e 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -243,7 +243,6 @@ ecryptfs_miscdev_read(struct file *file, char __user *buf, size_t count,
        struct ecryptfs_daemon *daemon;
        struct ecryptfs_msg_ctx *msg_ctx;
        size_t packet_length_size;
-        u32 counter_nbo;
        char packet_length[3];
        size_t i;
        size_t total_length;
@@ -328,20 +327,18 @@ check_list:
                       "pending message\n", __func__, count, total_length);
                goto out_unlock_msg_ctx;
        }
-        i = 0;
+        rc = -EFAULT;
-        buf[i++] = msg_ctx->type;
+        if (put_user(msg_ctx->type, buf))
-        counter_nbo = cpu_to_be32(msg_ctx->counter);
+                goto out_unlock_msg_ctx;
-        memcpy(&buf[i], (char *)&counter_nbo, 4);
+        if (put_user(cpu_to_be32(msg_ctx->counter), (__be32 __user *)(buf + 1)))
-        i += 4;
+                goto out_unlock_msg_ctx;
+        i = 5;
        if (msg_ctx->msg) {
-                memcpy(&buf[i], packet_length, packet_length_size);
+                if (copy_to_user(&buf[i], packet_length, packet_length_size))
+                        goto out_unlock_msg_ctx;
                i += packet_length_size;
-                rc = copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size);
+                if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
-                if (rc) {
-                        printk(KERN_ERR "%s: copy_to_user returned error "
-                               "[%d]\n", __func__, rc);
                        goto out_unlock_msg_ctx;
-                }
                i += msg_ctx->msg_size;
        }
        rc = i;
@@ -452,7 +449,8 @@ static ssize_t
 ecryptfs_miscdev_write(struct file *file, const char __user *buf,
                       size_t count, loff_t *ppos)
 {
-        u32 counter_nbo, seq;
+        __be32 counter_nbo;
+        u32 seq;
        size_t packet_size, packet_size_length, i;
        ssize_t sz = 0;
        char *data;
@@ -485,7 +483,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
                               count);
                        goto out_free;
                }
-                memcpy((char *)&counter_nbo, &data[i], 4);
+                memcpy(&counter_nbo, &data[i], 4);
                seq = be32_to_cpu(counter_nbo);
                i += 4;
                rc = ecryptfs_parse_packet_length(&data[i], &packet_size,
@@ -577,13 +575,11 @@ int ecryptfs_init_ecryptfs_miscdev(void)
        int rc;
        atomic_set(&ecryptfs_num_miscdev_opens, 0);
-        mutex_lock(&ecryptfs_daemon_hash_mux);
        rc = misc_register(&ecryptfs_miscdev);
        if (rc)
                printk(KERN_ERR "%s: Failed to register miscellaneous device "
                       "for communications with userspace daemons; rc = [%d]\n",
                       __func__, rc);
-        mutex_unlock(&ecryptfs_daemon_hash_mux);
        return rc;
 }
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index ebf55150be5..75c2ea9fee3 100644
--- a/fs/ecryptfs/read_write.c
+++ b/fs/ecryptfs/read_write.c
@@ -157,20 +157,6 @@ int ecryptfs_write(struct file *ecryptfs_file, char *data, loff_t offset,
                               ecryptfs_page_idx, rc);
                        goto out;
                }
-                if (start_offset_in_page) {
-                        /* Read in the page from the lower
-                         * into the eCryptfs inode page cache,
-                         * decrypting */
-                        rc = ecryptfs_decrypt_page(ecryptfs_page);
-                        if (rc) {
-                                printk(KERN_ERR "%s: Error decrypting "
-                                       "page; rc = [%d]\n",
-                                       __func__, rc);
-                                ClearPageUptodate(ecryptfs_page);
-                                page_cache_release(ecryptfs_page);
-                                goto out;
-                        }
-                }
                ecryptfs_page_virt = kmap_atomic(ecryptfs_page, KM_USER0);
                /*
@@ -349,14 +335,6 @@ int ecryptfs_read(char *data, loff_t offset, size_t size,
                               ecryptfs_page_idx, rc);
                        goto out;
                }
-                rc = ecryptfs_decrypt_page(ecryptfs_page);
-                if (rc) {
-                        printk(KERN_ERR "%s: Error decrypting "
-                               "page; rc = [%d]\n", __func__, rc);
-                        ClearPageUptodate(ecryptfs_page);
-                        page_cache_release(ecryptfs_page);
-                        goto out;
-                }
                ecryptfs_page_virt = kmap_atomic(ecryptfs_page, KM_USER0);
                memcpy((data + data_offset),
                       ((char *)ecryptfs_page_virt + start_offset_in_page),
diff --git a/fs/exec.c b/fs/exec.c
index 3c2ba7ce11d..da94a6f05df 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -26,7 +26,6 @@
 #include <linux/file.h>
 #include <linux/fdtable.h>
 #include <linux/mman.h>
-#include <linux/a.out.h>
 #include <linux/stat.h>
 #include <linux/fcntl.h>
 #include <linux/smp_lock.h>
@@ -61,6 +60,11 @@
 #include <linux/kmod.h>
 #endif
+#ifdef __alpha__
+/* for /sbin/loader handling in search_binary_handler() */
+#include <linux/a.out.h>
+#endif
 int core_uses_pid;
 char core_pattern[CORENAME_MAX_SIZE] = "core";
 int suid_dumpable = 0;
@@ -860,6 +864,7 @@ static int de_thread(struct task_struct *tsk)
 no_thread_group:
        exit_itimers(sig);
+        flush_itimer_signals();
        if (leader)
                release_task(leader);
@@ -1154,7 +1159,7 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 {
        int try,retval;
        struct linux_binfmt *fmt;
-#if defined(__alpha__) && defined(CONFIG_ARCH_SUPPORTS_AOUT)
+#ifdef __alpha__
        /* handle /sbin/loader.. */
        {
            struct exec * eh = (struct exec *) bprm->buf;
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 28cfd0b4052..77278e947e9 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -580,7 +580,8 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
        }
        blk = EXT3_SB(sb)->s_sbh->b_blocknr + 1 + EXT3_SB(sb)->s_gdb_count;
-        data = (__le32 *)dind->b_data + EXT3_SB(sb)->s_gdb_count;
+        data = (__le32 *)dind->b_data + (EXT3_SB(sb)->s_gdb_count %
+                                         EXT3_ADDR_PER_BLOCK(sb));
        end = (__le32 *)dind->b_data + EXT3_ADDR_PER_BLOCK(sb);
        /* Get each reserved primary GDT block and verify it holds backups */
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index fe3119a71ad..2845425077e 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -2875,8 +2875,10 @@ static ssize_t ext3_quota_write(struct super_block *sb, int type,
                blk++;
        }
 out:
-        if (len == towrite)
+        if (len == towrite) {
+                mutex_unlock(&inode->i_mutex);
                return err;
+        }
        if (inode->i_size < off+len-towrite) {
                i_size_write(inode, off+len-towrite);
                EXT3_I(inode)->i_disksize = inode->i_size;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 30494c5da84..9cc80b9cc8d 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -43,6 +43,46 @@ void ext4_get_group_no_and_offset(struct super_block *sb, ext4_fsblk_t blocknr,
 }
+static int ext4_block_in_group(struct super_block *sb, ext4_fsblk_t block,
+                        ext4_group_t block_group)
+{
+        ext4_group_t actual_group;
+        ext4_get_group_no_and_offset(sb, block, &actual_group, 0);
+        if (actual_group == block_group)
+                return 1;
+        return 0;
+}
+static int ext4_group_used_meta_blocks(struct super_block *sb,
+                                ext4_group_t block_group)
+{
+        ext4_fsblk_t tmp;
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        /* block bitmap, inode bitmap, and inode table blocks */
+        int used_blocks = sbi->s_itb_per_group + 2;
+        if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) {
+                struct ext4_group_desc *gdp;
+                struct buffer_head *bh;
+                gdp = ext4_get_group_desc(sb, block_group, &bh);
+                if (!ext4_block_in_group(sb, ext4_block_bitmap(sb, gdp),
+                                        block_group))
+                        used_blocks--;
+                if (!ext4_block_in_group(sb, ext4_inode_bitmap(sb, gdp),
+                                        block_group))
+                        used_blocks--;
+                tmp = ext4_inode_table(sb, gdp);
+                for (; tmp < ext4_inode_table(sb, gdp) +
+                                sbi->s_itb_per_group; tmp++) {
+                        if (!ext4_block_in_group(sb, tmp, block_group))
+                                used_blocks -= 1;
+                }
+        }
+        return used_blocks;
+}
 /* Initializes an uninitialized block bitmap if given, and returns the
 * number of blocks free in the group. */
 unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
@@ -105,20 +145,34 @@ unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
        free_blocks = group_blocks - bit_max;
        if (bh) {
-                ext4_fsblk_t start;
+                ext4_fsblk_t start, tmp;
+                int flex_bg = 0;
                for (bit = 0; bit < bit_max; bit++)
                        ext4_set_bit(bit, bh->b_data);
                start = ext4_group_first_block_no(sb, block_group);
-                /* Set bits for block and inode bitmaps, and inode table */
+                if (EXT4_HAS_INCOMPAT_FEATURE(sb,
-                ext4_set_bit(ext4_block_bitmap(sb, gdp) - start, bh->b_data);
+                                              EXT4_FEATURE_INCOMPAT_FLEX_BG))
-                ext4_set_bit(ext4_inode_bitmap(sb, gdp) - start, bh->b_data);
+                        flex_bg = 1;
-                for (bit = (ext4_inode_table(sb, gdp) - start),
-                     bit_max = bit + sbi->s_itb_per_group; bit < bit_max; bit++)
-                        ext4_set_bit(bit, bh->b_data);
+                /* Set bits for block and inode bitmaps, and inode table */
+                tmp = ext4_block_bitmap(sb, gdp);
+                if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
+                        ext4_set_bit(tmp - start, bh->b_data);
+                tmp = ext4_inode_bitmap(sb, gdp);
+                if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
+                        ext4_set_bit(tmp - start, bh->b_data);
+                tmp = ext4_inode_table(sb, gdp);
+                for (; tmp < ext4_inode_table(sb, gdp) +
+                                sbi->s_itb_per_group; tmp++) {
+                        if (!flex_bg ||
+                                ext4_block_in_group(sb, tmp, block_group))
+                                ext4_set_bit(tmp - start, bh->b_data);
+                }
                /*
                 * Also if the number of blocks within the group is
                 * less than the blocksize * 8 ( which is the size
@@ -126,8 +180,7 @@ unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
                 */
                mark_bitmap_end(group_blocks, sb->s_blocksize * 8, bh->b_data);
        }
+        return free_blocks - ext4_group_used_meta_blocks(sb, block_group);
-        return free_blocks - sbi->s_itb_per_group - 2;
 }
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 873ad9b3418..c9900aade15 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2745,8 +2745,6 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
        sbi = EXT4_SB(sb);
        es = sbi->s_es;
-        ext4_debug("using block group %lu(%d)\n", ac->ac_b_ex.fe_group,
-                        gdp->bg_free_blocks_count);
        err = -EIO;
        bitmap_bh = read_block_bitmap(sb, ac->ac_b_ex.fe_group);
@@ -2762,6 +2760,9 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
        if (!gdp)
                goto out_err;
+        ext4_debug("using block group %lu(%d)\n", ac->ac_b_ex.fe_group,
+                        gdp->bg_free_blocks_count);
        err = ext4_journal_get_write_access(handle, gdp_bh);
        if (err)
                goto out_err;
@@ -3094,8 +3095,7 @@ static void ext4_mb_use_inode_pa(struct ext4_allocation_context *ac,
 static void ext4_mb_use_group_pa(struct ext4_allocation_context *ac,
                                struct ext4_prealloc_space *pa)
 {
-        unsigned len = ac->ac_o_ex.fe_len;
+        unsigned int len = ac->ac_o_ex.fe_len;
        ext4_get_group_no_and_offset(ac->ac_sb, pa->pa_pstart,
                                        &ac->ac_b_ex.fe_group,
                                        &ac->ac_b_ex.fe_start);
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 9f086a6a472..9ff7b1c0423 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -563,7 +563,8 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
        }
        blk = EXT4_SB(sb)->s_sbh->b_blocknr + 1 + EXT4_SB(sb)->s_gdb_count;
-        data = (__le32 *)dind->b_data + EXT4_SB(sb)->s_gdb_count;
+        data = (__le32 *)dind->b_data + (EXT4_SB(sb)->s_gdb_count %
+                                         EXT4_ADDR_PER_BLOCK(sb));
        end = (__le32 *)dind->b_data + EXT4_ADDR_PER_BLOCK(sb);
        /* Get each reserved primary GDT block and verify it holds backups */
@@ -854,7 +855,8 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
         */
        /* Update group descriptor block for new group */
-        gdp = (struct ext4_group_desc *)primary->b_data + gdb_off;
+        gdp = (struct ext4_group_desc *)((char *)primary->b_data +
+                                         gdb_off * EXT4_DESC_SIZE(sb));
        ext4_block_bitmap_set(sb, gdp, input->block_bitmap); /* LV FIXME */
        ext4_inode_bitmap_set(sb, gdp, input->inode_bitmap); /* LV FIXME */
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 09d9359c805..02bf2434397 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -671,6 +671,7 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
        unsigned long def_mount_opts;
        struct super_block *sb = vfs->mnt_sb;
        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        journal_t *journal = sbi->s_journal;
        struct ext4_super_block *es = sbi->s_es;
        def_mount_opts = le32_to_cpu(es->s_default_mount_opts);
@@ -729,8 +730,15 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
                seq_printf(seq, ",commit=%u",
                           (unsigned) (sbi->s_commit_interval / HZ));
        }
-        if (test_opt(sb, BARRIER))
+        /*
-                seq_puts(seq, ",barrier=1");
+         * We're changing the default of barrier mount option, so
+         * let's always display its mount state so it's clear what its
+         * status is.
+         */
+        seq_puts(seq, ",barrier=");
+        seq_puts(seq, test_opt(sb, BARRIER) ? "1" : "0");
+        if (test_opt(sb, JOURNAL_ASYNC_COMMIT))
+                seq_puts(seq, ",journal_async_commit");
        if (test_opt(sb, NOBH))
                seq_puts(seq, ",nobh");
        if (!test_opt(sb, EXTENTS))
@@ -1907,6 +1915,7 @@ static int ext4_fill_super (struct super_block *sb, void *data, int silent)
        sbi->s_resgid = le16_to_cpu(es->s_def_resgid);
        set_opt(sbi->s_mount_opt, RESERVATION);
+        set_opt(sbi->s_mount_opt, BARRIER);
        /*
         * turn on extents feature by default in ext4 filesystem
@@ -2189,6 +2198,29 @@ static int ext4_fill_super (struct super_block *sb, void *data, int silent)
            EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_HAS_JOURNAL)) {
                if (ext4_load_journal(sb, es, journal_devnum))
                        goto failed_mount3;
+                if (!(sb->s_flags & MS_RDONLY) &&
+                    EXT4_SB(sb)->s_journal->j_failed_commit) {
+                        printk(KERN_CRIT "EXT4-fs error (device %s): "
+                               "ext4_fill_super: Journal transaction "
+                               "%u is corrupt\n", sb->s_id, 
+                               EXT4_SB(sb)->s_journal->j_failed_commit);
+                        if (test_opt (sb, ERRORS_RO)) {
+                                printk (KERN_CRIT
+                                        "Mounting filesystem read-only\n");
+                                sb->s_flags |= MS_RDONLY;
+                                EXT4_SB(sb)->s_mount_state |= EXT4_ERROR_FS;
+                                es->s_state |= cpu_to_le16(EXT4_ERROR_FS);
+                        }
+                        if (test_opt(sb, ERRORS_PANIC)) {
+                                EXT4_SB(sb)->s_mount_state |= EXT4_ERROR_FS;
+                                es->s_state |= cpu_to_le16(EXT4_ERROR_FS);
+                                ext4_commit_super(sb, es, 1);
+                                printk(KERN_CRIT
+                                       "EXT4-fs (device %s): mount failed\n",
+                                      sb->s_id);
+                                goto failed_mount4;
+                        }
+                }
        } else if (journal_inum) {
                if (ext4_create_journal(sb, es, journal_inum))
                        goto failed_mount3;
@@ -3305,8 +3337,10 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type,
                blk++;
        }
 out:
-        if (len == towrite)
+        if (len == towrite) {
+                mutex_unlock(&inode->i_mutex);
                return err;
+        }
        if (inode->i_size < off+len-towrite) {
                i_size_write(inode, off+len-towrite);
                EXT4_I(inode)->i_disksize = inode->i_size;
diff --git a/fs/fat/file.c b/fs/fat/file.c
index 27cc1164ec3..771326b8047 100644
--- a/fs/fat/file.c
+++ b/fs/fat/file.c
@@ -257,26 +257,34 @@ int fat_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
 }
 EXPORT_SYMBOL_GPL(fat_getattr);
-static int fat_check_mode(const struct msdos_sb_info *sbi, struct inode *inode,
+static int fat_sanitize_mode(const struct msdos_sb_info *sbi,
-                          mode_t mode)
+                             struct inode *inode, umode_t *mode_ptr)
 {
-        mode_t mask, req = mode & ~S_IFMT;
+        mode_t mask, perm;
-        if (S_ISREG(mode))
+        /*
+         * Note, the basic check is already done by a caller of
+         * (attr->ia_mode & ~MSDOS_VALID_MODE)
+         */
+        if (S_ISREG(inode->i_mode))
                mask = sbi->options.fs_fmask;
        else
                mask = sbi->options.fs_dmask;
+        perm = *mode_ptr & ~(S_IFMT | mask);
        /*
         * Of the r and x bits, all (subject to umask) must be present. Of the
         * w bits, either all (subject to umask) or none must be present.
         */
-        req &= ~mask;
+        if ((perm & (S_IRUGO | S_IXUGO)) != (inode->i_mode & (S_IRUGO|S_IXUGO)))
-        if ((req & (S_IRUGO | S_IXUGO)) != (inode->i_mode & (S_IRUGO|S_IXUGO)))
                return -EPERM;
-        if ((req & S_IWUGO) && ((req & S_IWUGO) != (S_IWUGO & ~mask)))
+        if ((perm & S_IWUGO) && ((perm & S_IWUGO) != (S_IWUGO & ~mask)))
                return -EPERM;
+        *mode_ptr &= S_IFMT | perm;
        return 0;
 }
@@ -299,7 +307,7 @@ int fat_setattr(struct dentry *dentry, struct iattr *attr)
 {
        struct msdos_sb_info *sbi = MSDOS_SB(dentry->d_sb);
        struct inode *inode = dentry->d_inode;
-        int mask, error = 0;
+        int error = 0;
        unsigned int ia_valid;
        lock_kernel();
@@ -332,12 +340,13 @@ int fat_setattr(struct dentry *dentry, struct iattr *attr)
                        error = 0;
                goto out;
        }
        if (((attr->ia_valid & ATTR_UID) &&
             (attr->ia_uid != sbi->options.fs_uid)) ||
            ((attr->ia_valid & ATTR_GID) &&
             (attr->ia_gid != sbi->options.fs_gid)) ||
            ((attr->ia_valid & ATTR_MODE) &&
-             fat_check_mode(sbi, inode, attr->ia_mode) < 0))
+             (attr->ia_mode & ~MSDOS_VALID_MODE)))
                error = -EPERM;
        if (error) {
@@ -346,15 +355,16 @@ int fat_setattr(struct dentry *dentry, struct iattr *attr)
                goto out;
        }
-        error = inode_setattr(inode, attr);
+        /*
-        if (error)
+         * We don't return -EPERM here. Yes, strange, but this is too
-                goto out;
+         * old behavior.
+         */
+        if (attr->ia_valid & ATTR_MODE) {
+                if (fat_sanitize_mode(sbi, inode, &attr->ia_mode) < 0)
+                        attr->ia_valid &= ~ATTR_MODE;
+        }
-        if (S_ISDIR(inode->i_mode))
+        error = inode_setattr(inode, attr);
-                mask = sbi->options.fs_dmask;
-        else
-                mask = sbi->options.fs_fmask;
-        inode->i_mode &= S_IFMT | (S_IRWXUGO & ~mask);
 out:
        unlock_kernel();
        return error;
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index fb77e096213..3141690558c 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -488,7 +488,12 @@ static struct fuse_conn *new_conn(struct super_block *sb)
                err = bdi_init(&fc->bdi);
                if (err)
                        goto error_kfree;
-                err = bdi_register_dev(&fc->bdi, fc->dev);
+                if (sb->s_bdev) {
+                        err = bdi_register(&fc->bdi, NULL, "%u:%u-fuseblk",
+                                           MAJOR(fc->dev), MINOR(fc->dev));
+                } else {
+                        err = bdi_register_dev(&fc->bdi, fc->dev);
+                }
                if (err)
                        goto error_bdi_destroy;
                /*
@@ -586,7 +591,7 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                fc->bdi.ra_pages = min(fc->bdi.ra_pages, ra_pages);
                fc->minor = arg->minor;
                fc->max_write = arg->minor < 5 ? 4096 : arg->max_write;
-                fc->max_write = min_t(unsigned, 4096, fc->max_write);
+                fc->max_write = max_t(unsigned, 4096, fc->max_write);
                fc->conn_init = 1;
        }
        fuse_put_request(fc, req);
@@ -662,7 +667,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
        fc->flags = d.flags;
        fc->user_id = d.user_id;
        fc->group_id = d.group_id;
-        fc->max_read = min_t(unsigned, 4096, d.max_read);
+        fc->max_read = max_t(unsigned, 4096, d.max_read);
        /* Used by get_root_inode() */
        sb->s_fs_info = fc;
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index c19184f2e70..bec76b1c2bb 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -246,15 +246,11 @@ static void find_metapath(const struct gfs2_sbd *sdp, u64 block,
 }
-static inline unsigned int zero_metapath_length(const struct metapath *mp,
+static inline unsigned int metapath_branch_start(const struct metapath *mp)
-                                                unsigned height)
 {
-        unsigned int i;
+        if (mp->mp_list[0] == 0)
-        for (i = 0; i < height - 1; i++) {
+                return 2;
-                if (mp->mp_list[i] != 0)
+        return 1;
-                        return i;
-        }
-        return height;
 }
 /**
@@ -436,7 +432,7 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
        struct gfs2_sbd *sdp = GFS2_SB(inode);
        struct buffer_head *dibh = mp->mp_bh[0];
        u64 bn, dblock = 0;
-        unsigned n, i, blks, alloced = 0, iblks = 0, zmpl = 0;
+        unsigned n, i, blks, alloced = 0, iblks = 0, branch_start = 0;
        unsigned dblks = 0;
        unsigned ptrs_per_blk;
        const unsigned end_of_metadata = height - 1;
@@ -471,9 +467,8 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
                        /* Building up tree height */
                        state = ALLOC_GROW_HEIGHT;
                        iblks = height - ip->i_height;
-                        zmpl = zero_metapath_length(mp, height);
+                        branch_start = metapath_branch_start(mp);
-                        iblks -= zmpl;
+                        iblks += (height - branch_start);
-                        iblks += height;
                }
        }
@@ -509,13 +504,13 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
                                        sizeof(struct gfs2_meta_header));
                                *ptr = zero_bn;
                                state = ALLOC_GROW_DEPTH;
-                                for(i = zmpl; i < height; i++) {
+                                for(i = branch_start; i < height; i++) {
                                        if (mp->mp_bh[i] == NULL)
                                                break;
                                        brelse(mp->mp_bh[i]);
                                        mp->mp_bh[i] = NULL;
                                }
-                                i = zmpl;
+                                i = branch_start;
                        }
                        if (n == 0)
                                break;
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index d31badadef8..07d84d16cda 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -249,7 +249,7 @@ static int inode_go_lock(struct gfs2_holder *gh)
        struct gfs2_inode *ip = gl->gl_object;
        int error = 0;
-        if (!ip)
+        if (!ip || (gh->gh_flags & GL_SKIP))
                return 0;
        if (test_bit(GIF_INVALID, &ip->i_flags)) {
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index 9c2c0b90b22..eabe5eac41d 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -236,6 +236,7 @@ enum {
        GIF_INVALID             = 0,
        GIF_QD_LOCKED           = 1,
        GIF_SW_PAGED            = 3,
+        GIF_USER                = 4, /* user inode, not metadata addr space */
 };
 struct gfs2_dinode_host {
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 3a9ef526c30..09453d057e4 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -47,8 +47,7 @@ static int iget_test(struct inode *inode, void *opaque)
        struct gfs2_inode *ip = GFS2_I(inode);
        u64 *no_addr = opaque;
-        if (ip->i_no_addr == *no_addr &&
+        if (ip->i_no_addr == *no_addr && test_bit(GIF_USER, &ip->i_flags))
-            inode->i_private != NULL)
                return 1;
        return 0;
@@ -61,6 +60,7 @@ static int iget_set(struct inode *inode, void *opaque)
        inode->i_ino = (unsigned long)*no_addr;
        ip->i_no_addr = *no_addr;
+        set_bit(GIF_USER, &ip->i_flags);
        return 0;
 }
@@ -86,7 +86,7 @@ static int iget_skip_test(struct inode *inode, void *opaque)
        struct gfs2_inode *ip = GFS2_I(inode);
        struct gfs2_skip_data *data = opaque;
-        if (ip->i_no_addr == data->no_addr && inode->i_private != NULL){
+        if (ip->i_no_addr == data->no_addr && test_bit(GIF_USER, &ip->i_flags)){
                if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE)){
                        data->skipped = 1;
                        return 0;
@@ -105,6 +105,7 @@ static int iget_skip_set(struct inode *inode, void *opaque)
                return 1;
        inode->i_ino = (unsigned long)(data->no_addr);
        ip->i_no_addr = data->no_addr;
+        set_bit(GIF_USER, &ip->i_flags);
        return 0;
 }
@@ -166,7 +167,7 @@ void gfs2_set_iop(struct inode *inode)
 * Returns: A VFS inode, or an error
 */
-struct inode *gfs2_inode_lookup(struct super_block *sb, 
+struct inode *gfs2_inode_lookup(struct super_block *sb,
                                unsigned int type,
                                u64 no_addr,
                                u64 no_formal_ino, int skip_freeing)
@@ -187,7 +188,6 @@ struct inode *gfs2_inode_lookup(struct super_block *sb,
        if (inode->i_state & I_NEW) {
                struct gfs2_sbd *sdp = GFS2_SB(inode);
-                inode->i_private = ip;
                ip->i_no_formal_ino = no_formal_ino;
                error = gfs2_glock_get(sdp, no_addr, &gfs2_inode_glops, CREATE, &ip->i_gl);
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index 85aea27b4a8..78d75f892f8 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) Sistina Software, Inc.  1997-2003 All rights reserved.
- * Copyright (C) 2004-2006 Red Hat, Inc.  All rights reserved.
+ * Copyright (C) 2004-2008 Red Hat, Inc.  All rights reserved.
 *
 * This copyrighted material is made available to anyone wishing to use,
 * modify, copy, or redistribute it subject to the terms and conditions
@@ -69,13 +69,15 @@ static const struct address_space_operations aspace_aops = {
 struct inode *gfs2_aspace_get(struct gfs2_sbd *sdp)
 {
        struct inode *aspace;
+        struct gfs2_inode *ip;
        aspace = new_inode(sdp->sd_vfs);
        if (aspace) {
                mapping_set_gfp_mask(aspace->i_mapping, GFP_NOFS);
                aspace->i_mapping->a_ops = &aspace_aops;
                aspace->i_size = ~0ULL;
-                aspace->i_private = NULL;
+                ip = GFS2_I(aspace);
+                clear_bit(GIF_USER, &ip->i_flags);
                insert_inode_hash(aspace);
        }
        return aspace;
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index ef9c6c4f80f..b2028c82e8d 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -142,8 +142,8 @@ static int init_names(struct gfs2_sbd *sdp, int silent)
        if (!table[0])
                table = sdp->sd_vfs->s_id;
-        snprintf(sdp->sd_proto_name, GFS2_FSNAME_LEN, "%s", proto);
+        strlcpy(sdp->sd_proto_name, proto, GFS2_FSNAME_LEN);
-        snprintf(sdp->sd_table_name, GFS2_FSNAME_LEN, "%s", table);
+        strlcpy(sdp->sd_table_name, table, GFS2_FSNAME_LEN);
        table = sdp->sd_table_name;
        while ((table = strchr(table, '/')))
diff --git a/fs/gfs2/ops_super.c b/fs/gfs2/ops_super.c
index 2278c68b7e3..0b7cc920eb8 100644
--- a/fs/gfs2/ops_super.c
+++ b/fs/gfs2/ops_super.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) Sistina Software, Inc.  1997-2003 All rights reserved.
- * Copyright (C) 2004-2006 Red Hat, Inc.  All rights reserved.
+ * Copyright (C) 2004-2008 Red Hat, Inc.  All rights reserved.
 *
 * This copyrighted material is made available to anyone wishing to use,
 * modify, copy, or redistribute it subject to the terms and conditions
@@ -52,7 +52,7 @@ static int gfs2_write_inode(struct inode *inode, int sync)
        struct gfs2_inode *ip = GFS2_I(inode);
        /* Check this is a "normal" inode */
-        if (inode->i_private) {
+        if (test_bit(GIF_USER, &ip->i_flags)) {
                if (current->flags & PF_MEMALLOC)
                        return 0;
                if (sync)
@@ -297,8 +297,9 @@ static int gfs2_remount_fs(struct super_block *sb, int *flags, char *data)
 */
 static void gfs2_drop_inode(struct inode *inode)
 {
-        if (inode->i_private && inode->i_nlink) {
+        struct gfs2_inode *ip = GFS2_I(inode);
-                struct gfs2_inode *ip = GFS2_I(inode);
+        if (test_bit(GIF_USER, &ip->i_flags) && inode->i_nlink) {
                struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
                if (gl && test_bit(GLF_DEMOTE, &gl->gl_flags))
                        clear_nlink(inode);
@@ -314,12 +315,13 @@ static void gfs2_drop_inode(struct inode *inode)
 static void gfs2_clear_inode(struct inode *inode)
 {
+        struct gfs2_inode *ip = GFS2_I(inode);
        /* This tells us its a "real" inode and not one which only
         * serves to contain an address space (see rgrp.c, meta_io.c)
         * which therefore doesn't have its own glocks.
         */
-        if (inode->i_private) {
+        if (test_bit(GIF_USER, &ip->i_flags)) {
-                struct gfs2_inode *ip = GFS2_I(inode);
                ip->i_gl->gl_object = NULL;
                gfs2_glock_schedule_for_reclaim(ip->i_gl);
                gfs2_glock_put(ip->i_gl);
@@ -419,7 +421,7 @@ static void gfs2_delete_inode(struct inode *inode)
        struct gfs2_holder gh;
        int error;
-        if (!inode->i_private)
+        if (!test_bit(GIF_USER, &ip->i_flags))
                goto out;
        error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 7e8f0b1d6c6..3401628d742 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -195,7 +195,7 @@ ulong_aligned:
           depending on architecture.  I've experimented with several ways
           of writing this section such as using an else before the goto
           but this one seems to be the fastest. */
-        while ((unsigned char *)plong < end - 1) {
+        while ((unsigned char *)plong < end - sizeof(unsigned long)) {
                prefetch(plong + 1);
                if (((*plong) & LBITMASK) != lskipval)
                        break;
@@ -1495,7 +1495,7 @@ u64 gfs2_alloc_block(struct gfs2_inode *ip, unsigned int *n)
        al->al_alloced += *n;
-        gfs2_statfs_change(sdp, 0, -*n, 0);
+        gfs2_statfs_change(sdp, 0, -(s64)*n, 0);
        gfs2_quota_change(ip, *n, ip->i_inode.i_uid, ip->i_inode.i_gid);
        spin_lock(&sdp->sd_rindex_spin);
diff --git a/fs/hppfs/Makefile b/fs/hppfs/Makefile
index 8a1f5034436..3a982bd975d 100644
--- a/fs/hppfs/Makefile
+++ b/fs/hppfs/Makefile
@@ -3,7 +3,4 @@
 # Licensed under the GPL
 #
-hppfs-objs := hppfs.o
+obj-$(CONFIG_HPPFS) += hppfs.o
-obj-y =
-obj-$(CONFIG_HPPFS) += $(hppfs-objs)
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 4d99685fdce..a2ed72f7cee 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -168,6 +168,7 @@ static int journal_submit_commit_record(journal_t *journal,
                spin_unlock(&journal->j_state_lock);
                /* And try again, without the barrier */
+                lock_buffer(bh);
                set_buffer_uptodate(bh);
                set_buffer_dirty(bh);
                ret = submit_bh(WRITE, bh);
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 5d0405a9e7c..058f50f65b7 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -344,6 +344,7 @@ static int calc_chksums(journal_t *journal, struct buffer_head *bh,
                        *crc32_sum = crc32_be(*crc32_sum, (void *)obh->b_data,
                                     obh->b_size);
                }
+                put_bh(obh);
        }
        return 0;
 }
@@ -610,9 +611,8 @@ static int do_one_pass(journal_t *journal,
                                chksum_err = chksum_seen = 0;
                                if (info->end_transaction) {
-                                        printk(KERN_ERR "JBD: Transaction %u "
+                                        journal->j_failed_commit =
-                                                "found to be corrupt.\n",
+                                                info->end_transaction;
-                                                next_commit_ID - 1);
                                        brelse(bh);
                                        break;
                                }
@@ -643,10 +643,8 @@ static int do_one_pass(journal_t *journal,
                                        if (!JBD2_HAS_INCOMPAT_FEATURE(journal,
                                           JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT)){
-                                                printk(KERN_ERR
+                                                journal->j_failed_commit =
-                                                       "JBD: Transaction %u "
+                                                        next_commit_ID;
-                                                       "found to be corrupt.\n",
-                                                       next_commit_ID);
                                                brelse(bh);
                                                break;
                                        }
diff --git a/fs/libfs.c b/fs/libfs.c
index b004dfadd89..baeb71ee1cd 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -512,6 +512,20 @@ void simple_release_fs(struct vfsmount **mount, int *count)
        mntput(mnt);
 }
+/**
+ * simple_read_from_buffer - copy data from the buffer to user space
+ * @to: the user space buffer to read to
+ * @count: the maximum number of bytes to read
+ * @ppos: the current position in the buffer
+ * @from: the buffer to read from
+ * @available: the size of the buffer
+ *
+ * The simple_read_from_buffer() function reads up to @count bytes from the
+ * buffer @from at offset @ppos into the user space address starting at @to.
+ *
+ * On success, the number of bytes read is returned and the offset @ppos is
+ * advanced by this number, or negative value is returned on error.
+ **/
 ssize_t simple_read_from_buffer(void __user *to, size_t count, loff_t *ppos,
                                const void *from, size_t available)
 {
@@ -528,6 +542,37 @@ ssize_t simple_read_from_buffer(void __user *to, size_t count, loff_t *ppos,
        return count;
 }
+/**
+ * memory_read_from_buffer - copy data from the buffer
+ * @to: the kernel space buffer to read to
+ * @count: the maximum number of bytes to read
+ * @ppos: the current position in the buffer
+ * @from: the buffer to read from
+ * @available: the size of the buffer
+ *
+ * The memory_read_from_buffer() function reads up to @count bytes from the
+ * buffer @from at offset @ppos into the kernel space address starting at @to.
+ *
+ * On success, the number of bytes read is returned and the offset @ppos is
+ * advanced by this number, or negative value is returned on error.
+ **/
+ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,
+                                const void *from, size_t available)
+{
+        loff_t pos = *ppos;
+        if (pos < 0)
+                return -EINVAL;
+        if (pos >= available)
+                return 0;
+        if (count > available - pos)
+                count = available - pos;
+        memcpy(to, from + pos, count);
+        *ppos = pos + count;
+        return count;
+}
 /*
 * Transaction based IO.
 * The file expects a single write which triggers the transaction, and then
@@ -800,6 +845,7 @@ EXPORT_SYMBOL(simple_statfs);
 EXPORT_SYMBOL(simple_sync_file);
 EXPORT_SYMBOL(simple_unlink);
 EXPORT_SYMBOL(simple_read_from_buffer);
+EXPORT_SYMBOL(memory_read_from_buffer);
 EXPORT_SYMBOL(simple_transaction_get);
 EXPORT_SYMBOL(simple_transaction_read);
 EXPORT_SYMBOL(simple_transaction_release);
diff --git a/fs/locks.c b/fs/locks.c
index 11dbf08651b..dce8c747371 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -561,9 +561,6 @@ static void locks_insert_lock(struct file_lock **pos, struct file_lock *fl)
        /* insert into file's list */
        fl->fl_next = *pos;
        *pos = fl;
-        if (fl->fl_ops && fl->fl_ops->fl_insert)
-                fl->fl_ops->fl_insert(fl);
 }
 /*
@@ -586,9 +583,6 @@ static void locks_delete_lock(struct file_lock **thisfl_p)
                fl->fl_fasync = NULL;
        }
-        if (fl->fl_ops && fl->fl_ops->fl_remove)
-                fl->fl_ops->fl_remove(fl);
        if (fl->fl_nspid) {
                put_pid(fl->fl_nspid);
                fl->fl_nspid = NULL;
diff --git a/fs/namei.c b/fs/namei.c
index c7e43536c49..01e67dddcc3 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -581,15 +581,13 @@ static __always_inline int link_path_walk(const char *name, struct nameidata *nd
        int result;
        /* make sure the stuff we saved doesn't go away */
-        dget(save.dentry);
+        path_get(&save);
-        mntget(save.mnt);
        result = __link_path_walk(name, nd);
        if (result == -ESTALE) {
                /* nd->path had been dropped */
                nd->path = save;
-                dget(nd->path.dentry);
+                path_get(&nd->path);
-                mntget(nd->path.mnt);
                nd->flags |= LOOKUP_REVAL;
                result = __link_path_walk(name, nd);
        }
@@ -1216,8 +1214,9 @@ int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
        nd->flags = flags;
        nd->depth = 0;
-        nd->path.mnt = mntget(mnt);
+        nd->path.dentry = dentry;
-        nd->path.dentry = dget(dentry);
+        nd->path.mnt = mnt;
+        path_get(&nd->path);
        retval = path_walk(name, nd);
        if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
@@ -2857,16 +2856,17 @@ int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
 {
        struct nameidata nd;
        void *cookie;
+        int res;
        nd.depth = 0;
        cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
-        if (!IS_ERR(cookie)) {
+        if (IS_ERR(cookie))
-                int res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
+                return PTR_ERR(cookie);
-                if (dentry->d_inode->i_op->put_link)
-                        dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
+        res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
-                cookie = ERR_PTR(res);
+        if (dentry->d_inode->i_op->put_link)
-        }
+                dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
-        return PTR_ERR(cookie);
+        return res;
 }
 int vfs_follow_link(struct nameidata *nd, const char *link)
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index 49c7cd0502c..779d2eb649c 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -130,10 +130,11 @@ static int xdr_decode_fhstatus3(struct rpc_rqst *req, __be32 *p,
                                struct mnt_fhstatus *res)
 {
        struct nfs_fh *fh = res->fh;
+        unsigned size;
        if ((res->status = ntohl(*p++)) == 0) {
-                int size = ntohl(*p++);
+                size = ntohl(*p++);
-                if (size <= NFS3_FHSIZE) {
+                if (size <= NFS3_FHSIZE && size != 0) {
                        fh->size = size;
                        memcpy(fh->data, p, size);
                } else
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 2a4a024a4e7..614efeed543 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1216,8 +1216,6 @@ static int nfs_validate_mount_data(void *options,
 {
        struct nfs_mount_data *data = (struct nfs_mount_data *)options;
-        memset(args, 0, sizeof(*args));
        if (data == NULL)
                goto out_no_data;
@@ -1251,13 +1249,13 @@ static int nfs_validate_mount_data(void *options,
        case 5:
                memset(data->context, 0, sizeof(data->context));
        case 6:
-                if (data->flags & NFS_MOUNT_VER3)
+                if (data->flags & NFS_MOUNT_VER3) {
+                        if (data->root.size > NFS3_FHSIZE || data->root.size == 0)
+                                goto out_invalid_fh;
                        mntfh->size = data->root.size;
-                else
+                } else
                        mntfh->size = NFS2_FHSIZE;
-                if (mntfh->size > sizeof(mntfh->data))
-                        goto out_invalid_fh;
                memcpy(mntfh->data, data->root.data, mntfh->size);
                if (mntfh->size < sizeof(mntfh->data))
@@ -1585,24 +1583,29 @@ static int nfs_get_sb(struct file_system_type *fs_type,
 {
        struct nfs_server *server = NULL;
        struct super_block *s;
-        struct nfs_fh mntfh;
+        struct nfs_parsed_mount_data *data;
-        struct nfs_parsed_mount_data data;
+        struct nfs_fh *mntfh;
        struct dentry *mntroot;
        int (*compare_super)(struct super_block *, void *) = nfs_compare_super;
        struct nfs_sb_mountdata sb_mntdata = {
                .mntflags = flags,
        };
-        int error;
+        int error = -ENOMEM;
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
+        if (data == NULL || mntfh == NULL)
+                goto out_free_fh;
-        security_init_mnt_opts(&data.lsm_opts);
+        security_init_mnt_opts(&data->lsm_opts);
        /* Validate the mount data */
-        error = nfs_validate_mount_data(raw_data, &data, &mntfh, dev_name);
+        error = nfs_validate_mount_data(raw_data, data, mntfh, dev_name);
        if (error < 0)
                goto out;
        /* Get a volume representation */
-        server = nfs_create_server(&data, &mntfh);
+        server = nfs_create_server(data, mntfh);
        if (IS_ERR(server)) {
                error = PTR_ERR(server);
                goto out;
@@ -1630,16 +1633,16 @@ static int nfs_get_sb(struct file_system_type *fs_type,
        if (!s->s_root) {
                /* initial superblock/root creation */
-                nfs_fill_super(s, &data);
+                nfs_fill_super(s, data);
        }
-        mntroot = nfs_get_root(s, &mntfh);
+        mntroot = nfs_get_root(s, mntfh);
        if (IS_ERR(mntroot)) {
                error = PTR_ERR(mntroot);
                goto error_splat_super;
        }
-        error = security_sb_set_mnt_opts(s, &data.lsm_opts);
+        error = security_sb_set_mnt_opts(s, &data->lsm_opts);
        if (error)
                goto error_splat_root;
@@ -1649,9 +1652,12 @@ static int nfs_get_sb(struct file_system_type *fs_type,
        error = 0;
 out:
-        kfree(data.nfs_server.hostname);
+        kfree(data->nfs_server.hostname);
-        kfree(data.mount_server.hostname);
+        kfree(data->mount_server.hostname);
-        security_free_mnt_opts(&data.lsm_opts);
+        security_free_mnt_opts(&data->lsm_opts);
+out_free_fh:
+        kfree(mntfh);
+        kfree(data);
        return error;
 out_err_nosb:
@@ -1800,8 +1806,6 @@ static int nfs4_validate_mount_data(void *options,
        struct nfs4_mount_data *data = (struct nfs4_mount_data *)options;
        char *c;
-        memset(args, 0, sizeof(*args));
        if (data == NULL)
                goto out_no_data;
@@ -1959,26 +1963,31 @@ out_no_client_address:
 static int nfs4_get_sb(struct file_system_type *fs_type,
        int flags, const char *dev_name, void *raw_data, struct vfsmount *mnt)
 {
-        struct nfs_parsed_mount_data data;
+        struct nfs_parsed_mount_data *data;
        struct super_block *s;
        struct nfs_server *server;
-        struct nfs_fh mntfh;
+        struct nfs_fh *mntfh;
        struct dentry *mntroot;
        int (*compare_super)(struct super_block *, void *) = nfs_compare_super;
        struct nfs_sb_mountdata sb_mntdata = {
                .mntflags = flags,
        };
-        int error;
+        int error = -ENOMEM;
-        security_init_mnt_opts(&data.lsm_opts);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
+        if (data == NULL || mntfh == NULL)
+                goto out_free_fh;
+        security_init_mnt_opts(&data->lsm_opts);
        /* Validate the mount data */
-        error = nfs4_validate_mount_data(raw_data, &data, dev_name);
+        error = nfs4_validate_mount_data(raw_data, data, dev_name);
        if (error < 0)
                goto out;
        /* Get a volume representation */
-        server = nfs4_create_server(&data, &mntfh);
+        server = nfs4_create_server(data, mntfh);
        if (IS_ERR(server)) {
                error = PTR_ERR(server);
                goto out;
@@ -2009,13 +2018,13 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
                nfs4_fill_super(s);
        }
-        mntroot = nfs4_get_root(s, &mntfh);
+        mntroot = nfs4_get_root(s, mntfh);
        if (IS_ERR(mntroot)) {
                error = PTR_ERR(mntroot);
                goto error_splat_super;
        }
-        error = security_sb_set_mnt_opts(s, &data.lsm_opts);
+        error = security_sb_set_mnt_opts(s, &data->lsm_opts);
        if (error)
                goto error_splat_root;
@@ -2025,10 +2034,13 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
        error = 0;
 out:
-        kfree(data.client_address);
+        kfree(data->client_address);
-        kfree(data.nfs_server.export_path);
+        kfree(data->nfs_server.export_path);
-        kfree(data.nfs_server.hostname);
+        kfree(data->nfs_server.hostname);
-        security_free_mnt_opts(&data.lsm_opts);
+        security_free_mnt_opts(&data->lsm_opts);
+out_free_fh:
+        kfree(mntfh);
+        kfree(data);
        return error;
 out_free:
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 6d8ace3e325..f333848fd3b 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -739,12 +739,13 @@ int nfs_updatepage(struct file *file, struct page *page,
        }
        status = nfs_writepage_setup(ctx, page, offset, count);
-        __set_page_dirty_nobuffers(page);
+        if (status < 0)
+                nfs_set_pageerror(page);
+        else
+                __set_page_dirty_nobuffers(page);
        dprintk("NFS:      nfs_updatepage returns %d (isize %Ld)\n",
                        status, (long long)i_size_read(inode));
-        if (status < 0)
-                nfs_set_pageerror(page);
        return status;
 }
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index 0b3ffa9840c..4d4760e687c 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -419,9 +419,9 @@ static int do_probe_callback(void *data)
 out_release_client:
        rpc_shutdown_client(client);
 out_err:
-        put_nfs4_client(clp);
        dprintk("NFSD: warning: no callback path to client %.*s\n",
                (int)clp->cl_name.len, clp->cl_name.data);
+        put_nfs4_client(clp);
        return status;
 }
diff --git a/fs/ntfs/upcase.c b/fs/ntfs/upcase.c
index 9101807dc81..e2f72ca9803 100644
--- a/fs/ntfs/upcase.c
+++ b/fs/ntfs/upcase.c
@@ -77,11 +77,10 @@ ntfschar *generate_default_upcase(void)
                uc[i] = cpu_to_le16(i);
        for (r = 0; uc_run_table[r][0]; r++)
                for (i = uc_run_table[r][0]; i < uc_run_table[r][1]; i++)
-                        uc[i] = cpu_to_le16(le16_to_cpu(uc[i]) +
+                        le16_add_cpu(&uc[i], uc_run_table[r][2]);
-                                        uc_run_table[r][2]);
        for (r = 0; uc_dup_table[r][0]; r++)
                for (i = uc_dup_table[r][0]; i < uc_dup_table[r][1]; i += 2)
-                        uc[i + 1] = cpu_to_le16(le16_to_cpu(uc[i + 1]) - 1);
+                        le16_add_cpu(&uc[i + 1], -1);
        for (r = 0; uc_word_table[r][0]; r++)
                uc[uc_word_table[r][0]] = cpu_to_le16(uc_word_table[r][1]);
        return uc;
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 41f84c92094..10bfb466e06 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -2788,7 +2788,7 @@ static int ocfs2_merge_rec_right(struct inode *inode,
        BUG_ON(index >= le16_to_cpu(el->l_next_free_rec));
        left_rec = &el->l_recs[index];
-        if (index == le16_to_cpu(el->l_next_free_rec - 1) &&
+        if (index == le16_to_cpu(el->l_next_free_rec) - 1 &&
            le16_to_cpu(el->l_next_free_rec) == le16_to_cpu(el->l_count)) {
                /* we meet with a cross extent block merge. */
                ret = ocfs2_get_right_path(inode, left_path, &right_path);
@@ -2802,7 +2802,7 @@ static int ocfs2_merge_rec_right(struct inode *inode,
                BUG_ON(next_free <= 0);
                right_rec = &right_el->l_recs[0];
                if (ocfs2_is_empty_extent(right_rec)) {
-                        BUG_ON(le16_to_cpu(next_free) <= 1);
+                        BUG_ON(next_free <= 1);
                        right_rec = &right_el->l_recs[1];
                }
diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index cf9401e8cd0..cfdb08b484e 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -21,7 +21,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/sysctl.h>
 #include <linux/configfs.h>
 #include "tcp.h"
@@ -36,65 +35,6 @@
 * cluster references throughout where nodes are looked up */
 struct o2nm_cluster *o2nm_single_cluster = NULL;
-#define OCFS2_MAX_HB_CTL_PATH 256
-static char ocfs2_hb_ctl_path[OCFS2_MAX_HB_CTL_PATH] = "/sbin/ocfs2_hb_ctl";
-static ctl_table ocfs2_nm_table[] = {
-        {
-                .ctl_name       = 1,
-                .procname       = "hb_ctl_path",
-                .data           = ocfs2_hb_ctl_path,
-                .maxlen         = OCFS2_MAX_HB_CTL_PATH,
-                .mode           = 0644,
-                .proc_handler   = &proc_dostring,
-                .strategy       = &sysctl_string,
-        },
-        { .ctl_name = 0 }
-};
-static ctl_table ocfs2_mod_table[] = {
-        {
-                .ctl_name       = FS_OCFS2_NM,
-                .procname       = "nm",
-                .data           = NULL,
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = ocfs2_nm_table
-        },
-        { .ctl_name = 0}
-};
-static ctl_table ocfs2_kern_table[] = {
-        {
-                .ctl_name       = FS_OCFS2,
-                .procname       = "ocfs2",
-                .data           = NULL,
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = ocfs2_mod_table
-        },
-        { .ctl_name = 0}
-};
-static ctl_table ocfs2_root_table[] = {
-        {
-                .ctl_name       = CTL_FS,
-                .procname       = "fs",
-                .data           = NULL,
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = ocfs2_kern_table
-        },
-        { .ctl_name = 0 }
-};
-static struct ctl_table_header *ocfs2_table_header = NULL;
-const char *o2nm_get_hb_ctl_path(void)
-{
-        return ocfs2_hb_ctl_path;
-}
-EXPORT_SYMBOL_GPL(o2nm_get_hb_ctl_path);
 struct o2nm_node *o2nm_get_node_by_num(u8 node_num)
 {
@@ -941,9 +881,6 @@ void o2nm_undepend_this_node(void)
 static void __exit exit_o2nm(void)
 {
-        if (ocfs2_table_header)
-                unregister_sysctl_table(ocfs2_table_header);
        /* XXX sync with hb callbacks and shut down hb? */
        o2net_unregister_hb_callbacks();
        configfs_unregister_subsystem(&o2nm_cluster_group.cs_subsys);
@@ -964,16 +901,9 @@ static int __init init_o2nm(void)
        if (ret)
                goto out;
-        ocfs2_table_header = register_sysctl_table(ocfs2_root_table);
-        if (!ocfs2_table_header) {
-                printk(KERN_ERR "nodemanager: unable to register sysctl\n");
-                ret = -ENOMEM; /* or something. */
-                goto out_o2net;
-        }
        ret = o2net_register_hb_callbacks();
        if (ret)
-                goto out_sysctl;
+                goto out_o2net;
        config_group_init(&o2nm_cluster_group.cs_subsys.su_group);
        mutex_init(&o2nm_cluster_group.cs_subsys.su_mutex);
@@ -990,8 +920,6 @@ static int __init init_o2nm(void)
        configfs_unregister_subsystem(&o2nm_cluster_group.cs_subsys);
 out_callbacks:
        o2net_unregister_hb_callbacks();
-out_sysctl:
-        unregister_sysctl_table(ocfs2_table_header);
 out_o2net:
        o2net_exit();
 out:
diff --git a/fs/ocfs2/cluster/nodemanager.h b/fs/ocfs2/cluster/nodemanager.h
index 7c860361b8d..c992ea0da4a 100644
--- a/fs/ocfs2/cluster/nodemanager.h
+++ b/fs/ocfs2/cluster/nodemanager.h
@@ -33,10 +33,6 @@
 #include <linux/configfs.h>
 #include <linux/rbtree.h>
-#define FS_OCFS2_NM             1
-const char *o2nm_get_hb_ctl_path(void);
 struct o2nm_node {
        spinlock_t              nd_lock;
        struct config_item      nd_item;
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 1e44ad14881..a27d61581bd 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -142,53 +142,43 @@ static void o2net_idle_timer(unsigned long data);
 static void o2net_sc_postpone_idle(struct o2net_sock_container *sc);
 static void o2net_sc_reset_idle_timer(struct o2net_sock_container *sc);
-static void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
-                           u32 msgkey, struct task_struct *task, u8 node)
-{
 #ifdef CONFIG_DEBUG_FS
+void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
+                    u32 msgkey, struct task_struct *task, u8 node)
+{
        INIT_LIST_HEAD(&nst->st_net_debug_item);
        nst->st_task = task;
        nst->st_msg_type = msgtype;
        nst->st_msg_key = msgkey;
        nst->st_node = node;
-#endif
 }
-static void o2net_set_nst_sock_time(struct o2net_send_tracking *nst)
+void o2net_set_nst_sock_time(struct o2net_send_tracking *nst)
 {
-#ifdef CONFIG_DEBUG_FS
        do_gettimeofday(&nst->st_sock_time);
-#endif
 }
-static void o2net_set_nst_send_time(struct o2net_send_tracking *nst)
+void o2net_set_nst_send_time(struct o2net_send_tracking *nst)
 {
-#ifdef CONFIG_DEBUG_FS
        do_gettimeofday(&nst->st_send_time);
-#endif
 }
-static void o2net_set_nst_status_time(struct o2net_send_tracking *nst)
+void o2net_set_nst_status_time(struct o2net_send_tracking *nst)
 {
-#ifdef CONFIG_DEBUG_FS
        do_gettimeofday(&nst->st_status_time);
-#endif
 }
-static void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
+void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
                                         struct o2net_sock_container *sc)
 {
-#ifdef CONFIG_DEBUG_FS
        nst->st_sc = sc;
-#endif
 }
-static void o2net_set_nst_msg_id(struct o2net_send_tracking *nst, u32 msg_id)
+void o2net_set_nst_msg_id(struct o2net_send_tracking *nst, u32 msg_id)
 {
-#ifdef CONFIG_DEBUG_FS
        nst->st_id = msg_id;
-#endif
 }
+#endif /* CONFIG_DEBUG_FS */
 static inline int o2net_reconnect_delay(void)
 {
diff --git a/fs/ocfs2/cluster/tcp.h b/fs/ocfs2/cluster/tcp.h
index a705d5d1903..fd6179eb26d 100644
--- a/fs/ocfs2/cluster/tcp.h
+++ b/fs/ocfs2/cluster/tcp.h
@@ -128,23 +128,23 @@ void o2net_debug_del_nst(struct o2net_send_tracking *nst);
 void o2net_debug_add_sc(struct o2net_sock_container *sc);
 void o2net_debug_del_sc(struct o2net_sock_container *sc);
 #else
-static int o2net_debugfs_init(void)
+static inline int o2net_debugfs_init(void)
 {
        return 0;
 }
-static void o2net_debugfs_exit(void)
+static inline void o2net_debugfs_exit(void)
 {
 }
-static void o2net_debug_add_nst(struct o2net_send_tracking *nst)
+static inline void o2net_debug_add_nst(struct o2net_send_tracking *nst)
 {
 }
-static void o2net_debug_del_nst(struct o2net_send_tracking *nst)
+static inline void o2net_debug_del_nst(struct o2net_send_tracking *nst)
 {
 }
-static void o2net_debug_add_sc(struct o2net_sock_container *sc)
+static inline void o2net_debug_add_sc(struct o2net_sock_container *sc)
 {
 }
-static void o2net_debug_del_sc(struct o2net_sock_container *sc)
+static inline void o2net_debug_del_sc(struct o2net_sock_container *sc)
 {
 }
 #endif  /* CONFIG_DEBUG_FS */
diff --git a/fs/ocfs2/cluster/tcp_internal.h b/fs/ocfs2/cluster/tcp_internal.h
index 8d58cfe410b..18307ff81b7 100644
--- a/fs/ocfs2/cluster/tcp_internal.h
+++ b/fs/ocfs2/cluster/tcp_internal.h
@@ -224,10 +224,42 @@ struct o2net_send_tracking {
        struct timeval                  st_send_time;
        struct timeval                  st_status_time;
 };
+void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
+                    u32 msgkey, struct task_struct *task, u8 node);
+void o2net_set_nst_sock_time(struct o2net_send_tracking *nst);
+void o2net_set_nst_send_time(struct o2net_send_tracking *nst);
+void o2net_set_nst_status_time(struct o2net_send_tracking *nst);
+void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
+                                  struct o2net_sock_container *sc);
+void o2net_set_nst_msg_id(struct o2net_send_tracking *nst, u32 msg_id);
 #else
 struct o2net_send_tracking {
        u32     dummy;
 };
+static inline void o2net_init_nst(struct o2net_send_tracking *nst, u32 msgtype,
+                                  u32 msgkey, struct task_struct *task, u8 node)
+{
+}
+static inline void o2net_set_nst_sock_time(struct o2net_send_tracking *nst)
+{
+}
+static inline void o2net_set_nst_send_time(struct o2net_send_tracking *nst)
+{
+}
+static inline void o2net_set_nst_status_time(struct o2net_send_tracking *nst)
+{
+}
+static inline void o2net_set_nst_sock_container(struct o2net_send_tracking *nst,
+                                                struct o2net_sock_container *sc)
+{
+}
+static inline void o2net_set_nst_msg_id(struct o2net_send_tracking *nst,
+                                        u32 msg_id)
+{
+}
 #endif  /* CONFIG_DEBUG_FS */
 #endif /* O2CLUSTER_TCP_INTERNAL_H */
diff --git a/fs/ocfs2/dlm/dlmdebug.h b/fs/ocfs2/dlm/dlmdebug.h
index d34a62a3a62..8c686d22f9c 100644
--- a/fs/ocfs2/dlm/dlmdebug.h
+++ b/fs/ocfs2/dlm/dlmdebug.h
@@ -60,25 +60,25 @@ void dlm_destroy_debugfs_root(void);
 #else
-static int dlm_debug_init(struct dlm_ctxt *dlm)
+static inline int dlm_debug_init(struct dlm_ctxt *dlm)
 {
        return 0;
 }
-static void dlm_debug_shutdown(struct dlm_ctxt *dlm)
+static inline void dlm_debug_shutdown(struct dlm_ctxt *dlm)
 {
 }
-static int dlm_create_debugfs_subroot(struct dlm_ctxt *dlm)
+static inline int dlm_create_debugfs_subroot(struct dlm_ctxt *dlm)
 {
        return 0;
 }
-static void dlm_destroy_debugfs_subroot(struct dlm_ctxt *dlm)
+static inline void dlm_destroy_debugfs_subroot(struct dlm_ctxt *dlm)
 {
 }
-static int dlm_create_debugfs_root(void)
+static inline int dlm_create_debugfs_root(void)
 {
        return 0;
 }
-static void dlm_destroy_debugfs_root(void)
+static inline void dlm_destroy_debugfs_root(void)
 {
 }
diff --git a/fs/ocfs2/stack_o2cb.c b/fs/ocfs2/stack_o2cb.c
index bbd1667aa7d..fcd120f1493 100644
--- a/fs/ocfs2/stack_o2cb.c
+++ b/fs/ocfs2/stack_o2cb.c
@@ -317,8 +317,7 @@ out:
        return rc;
 }
-static int o2cb_cluster_disconnect(struct ocfs2_cluster_connection *conn,
+static int o2cb_cluster_disconnect(struct ocfs2_cluster_connection *conn)
-                                   int hangup_pending)
 {
        struct dlm_ctxt *dlm = conn->cc_lockspace;
        struct o2dlm_private *priv = conn->cc_private;
@@ -333,43 +332,6 @@ static int o2cb_cluster_disconnect(struct ocfs2_cluster_connection *conn,
        return 0;
 }
-static void o2hb_stop(const char *group)
-{
-        int ret;
-        char *argv[5], *envp[3];
-        argv[0] = (char *)o2nm_get_hb_ctl_path();
-        argv[1] = "-K";
-        argv[2] = "-u";
-        argv[3] = (char *)group;
-        argv[4] = NULL;
-        mlog(0, "Run: %s %s %s %s\n", argv[0], argv[1], argv[2], argv[3]);
-        /* minimal command environment taken from cpu_run_sbin_hotplug */
-        envp[0] = "HOME=/";
-        envp[1] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
-        envp[2] = NULL;
-        ret = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
-        if (ret < 0)
-                mlog_errno(ret);
-}
-/*
- * Hangup is a hack for tools compatibility.  Older ocfs2-tools software
- * expects the filesystem to call "ocfs2_hb_ctl" during unmount.  This
- * happens regardless of whether the DLM got started, so we can't do it
- * in ocfs2_cluster_disconnect().  We bring the o2hb_stop() function into
- * the glue and provide a "hangup" API for super.c to call.
- *
- * Other stacks will eventually provide a NULL ->hangup() pointer.
- */
-static void o2cb_cluster_hangup(const char *group, int grouplen)
-{
-        o2hb_stop(group);
-}
 static int o2cb_cluster_this_node(unsigned int *node)
 {
        int node_num;
@@ -388,7 +350,6 @@ static int o2cb_cluster_this_node(unsigned int *node)
 static struct ocfs2_stack_operations o2cb_stack_ops = {
        .connect        = o2cb_cluster_connect,
        .disconnect     = o2cb_cluster_disconnect,
-        .hangup         = o2cb_cluster_hangup,
        .this_node      = o2cb_cluster_this_node,
        .dlm_lock       = o2cb_dlm_lock,
        .dlm_unlock     = o2cb_dlm_unlock,
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index b503772cd0e..c021280dd46 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -61,7 +61,7 @@
 * negotiated by the client.  The client negotiates based on the maximum
 * version advertised in /sys/fs/ocfs2/max_locking_protocol.  The major
 * number from the "SETV" message must match
- * user_stack.sp_proto->lp_max_version.pv_major, and the minor number
+ * ocfs2_user_plugin.sp_proto->lp_max_version.pv_major, and the minor number
 * must be less than or equal to ...->lp_max_version.pv_minor.
 *
 * Once this information has been set, mounts will be allowed.  From this
@@ -153,7 +153,7 @@ union ocfs2_control_message {
        struct ocfs2_control_message_down       u_down;
 };
-static struct ocfs2_stack_plugin user_stack;
+static struct ocfs2_stack_plugin ocfs2_user_plugin;
 static atomic_t ocfs2_control_opened;
 static int ocfs2_control_this_node = -1;
@@ -399,7 +399,7 @@ static int ocfs2_control_do_setversion_msg(struct file *file,
        char *ptr = NULL;
        struct ocfs2_control_private *p = file->private_data;
        struct ocfs2_protocol_version *max =
-                &user_stack.sp_proto->lp_max_version;
+                &ocfs2_user_plugin.sp_proto->lp_max_version;
        if (ocfs2_control_get_handshake_state(file) !=
            OCFS2_CONTROL_HANDSHAKE_PROTOCOL)
@@ -680,7 +680,7 @@ static void fsdlm_lock_ast_wrapper(void *astarg)
        struct dlm_lksb *lksb = fsdlm_astarg_to_lksb(astarg);
        int status = lksb->sb_status;
-        BUG_ON(user_stack.sp_proto == NULL);
+        BUG_ON(ocfs2_user_plugin.sp_proto == NULL);
        /*
         * For now we're punting on the issue of other non-standard errors
@@ -693,16 +693,16 @@ static void fsdlm_lock_ast_wrapper(void *astarg)
         */
        if (status == -DLM_EUNLOCK || status == -DLM_ECANCEL)
-                user_stack.sp_proto->lp_unlock_ast(astarg, 0);
+                ocfs2_user_plugin.sp_proto->lp_unlock_ast(astarg, 0);
        else
-                user_stack.sp_proto->lp_lock_ast(astarg);
+                ocfs2_user_plugin.sp_proto->lp_lock_ast(astarg);
 }
 static void fsdlm_blocking_ast_wrapper(void *astarg, int level)
 {
-        BUG_ON(user_stack.sp_proto == NULL);
+        BUG_ON(ocfs2_user_plugin.sp_proto == NULL);
-        user_stack.sp_proto->lp_blocking_ast(astarg, level);
+        ocfs2_user_plugin.sp_proto->lp_blocking_ast(astarg, level);
 }
 static int user_dlm_lock(struct ocfs2_cluster_connection *conn,
@@ -816,8 +816,7 @@ out:
        return rc;
 }
-static int user_cluster_disconnect(struct ocfs2_cluster_connection *conn,
+static int user_cluster_disconnect(struct ocfs2_cluster_connection *conn)
-                                   int hangup_pending)
 {
        dlm_release_lockspace(conn->cc_lockspace, 2);
        conn->cc_lockspace = NULL;
@@ -838,7 +837,7 @@ static int user_cluster_this_node(unsigned int *this_node)
        return 0;
 }
-static struct ocfs2_stack_operations user_stack_ops = {
+static struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
        .connect        = user_cluster_connect,
        .disconnect     = user_cluster_disconnect,
        .this_node      = user_cluster_this_node,
@@ -849,20 +848,20 @@ static struct ocfs2_stack_operations user_stack_ops = {
        .dump_lksb      = user_dlm_dump_lksb,
 };
-static struct ocfs2_stack_plugin user_stack = {
+static struct ocfs2_stack_plugin ocfs2_user_plugin = {
        .sp_name        = "user",
-        .sp_ops         = &user_stack_ops,
+        .sp_ops         = &ocfs2_user_plugin_ops,
        .sp_owner       = THIS_MODULE,
 };
-static int __init user_stack_init(void)
+static int __init ocfs2_user_plugin_init(void)
 {
        int rc;
        rc = ocfs2_control_init();
        if (!rc) {
-                rc = ocfs2_stack_glue_register(&user_stack);
+                rc = ocfs2_stack_glue_register(&ocfs2_user_plugin);
                if (rc)
                        ocfs2_control_exit();
        }
@@ -870,14 +869,14 @@ static int __init user_stack_init(void)
        return rc;
 }
-static void __exit user_stack_exit(void)
+static void __exit ocfs2_user_plugin_exit(void)
 {
-        ocfs2_stack_glue_unregister(&user_stack);
+        ocfs2_stack_glue_unregister(&ocfs2_user_plugin);
        ocfs2_control_exit();
 }
 MODULE_AUTHOR("Oracle");
 MODULE_DESCRIPTION("ocfs2 driver for userspace cluster stacks");
 MODULE_LICENSE("GPL");
-module_init(user_stack_init);
+module_init(ocfs2_user_plugin_init);
-module_exit(user_stack_exit);
+module_exit(ocfs2_user_plugin_exit);
diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
index 119f60cea9c..10e149ae5e3 100644
--- a/fs/ocfs2/stackglue.c
+++ b/fs/ocfs2/stackglue.c
@@ -26,6 +26,7 @@
 #include <linux/fs.h>
 #include <linux/kobject.h>
 #include <linux/sysfs.h>
+#include <linux/sysctl.h>
 #include "ocfs2_fs.h"
@@ -33,11 +34,13 @@
 #define OCFS2_STACK_PLUGIN_O2CB         "o2cb"
 #define OCFS2_STACK_PLUGIN_USER         "user"
+#define OCFS2_MAX_HB_CTL_PATH           256
 static struct ocfs2_locking_protocol *lproto;
 static DEFINE_SPINLOCK(ocfs2_stack_lock);
 static LIST_HEAD(ocfs2_stack_list);
 static char cluster_stack_name[OCFS2_STACK_LABEL_LEN + 1];
+static char ocfs2_hb_ctl_path[OCFS2_MAX_HB_CTL_PATH] = "/sbin/ocfs2_hb_ctl";
 /*
 * The stack currently in use.  If not null, active_stack->sp_count > 0,
@@ -349,7 +352,7 @@ int ocfs2_cluster_disconnect(struct ocfs2_cluster_connection *conn,
        BUG_ON(conn == NULL);
-        ret = active_stack->sp_ops->disconnect(conn, hangup_pending);
+        ret = active_stack->sp_ops->disconnect(conn);
        /* XXX Should we free it anyway? */
        if (!ret) {
@@ -362,13 +365,48 @@ int ocfs2_cluster_disconnect(struct ocfs2_cluster_connection *conn,
 }
 EXPORT_SYMBOL_GPL(ocfs2_cluster_disconnect);
+/*
+ * Leave the group for this filesystem.  This is executed by a userspace
+ * program (stored in ocfs2_hb_ctl_path).
+ */
+static void ocfs2_leave_group(const char *group)
+{
+        int ret;
+        char *argv[5], *envp[3];
+        argv[0] = ocfs2_hb_ctl_path;
+        argv[1] = "-K";
+        argv[2] = "-u";
+        argv[3] = (char *)group;
+        argv[4] = NULL;
+        /* minimal command environment taken from cpu_run_sbin_hotplug */
+        envp[0] = "HOME=/";
+        envp[1] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
+        envp[2] = NULL;
+        ret = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
+        if (ret < 0) {
+                printk(KERN_ERR
+                       "ocfs2: Error %d running user helper "
+                       "\"%s %s %s %s\"\n",
+                       ret, argv[0], argv[1], argv[2], argv[3]);
+        }
+}
+/*
+ * Hangup is a required post-umount.  ocfs2-tools software expects the
+ * filesystem to call "ocfs2_hb_ctl" during unmount.  This happens
+ * regardless of whether the DLM got started, so we can't do it
+ * in ocfs2_cluster_disconnect().  The ocfs2_leave_group() function does
+ * the actual work.
+ */
 void ocfs2_cluster_hangup(const char *group, int grouplen)
 {
        BUG_ON(group == NULL);
        BUG_ON(group[grouplen] != '\0');
-        if (active_stack->sp_ops->hangup)
+        ocfs2_leave_group(group);
-                active_stack->sp_ops->hangup(group, grouplen);
        /* cluster_disconnect() was called with hangup_pending==1 */
        ocfs2_stack_driver_put();
@@ -548,10 +586,83 @@ error:
        return ret;
 }
+/*
+ * Sysctl bits
+ *
+ * The sysctl lives at /proc/sys/fs/ocfs2/nm/hb_ctl_path.  The 'nm' doesn't
+ * make as much sense in a multiple cluster stack world, but it's safer
+ * and easier to preserve the name.
+ */
+#define FS_OCFS2_NM             1
+static ctl_table ocfs2_nm_table[] = {
+        {
+                .ctl_name       = 1,
+                .procname       = "hb_ctl_path",
+                .data           = ocfs2_hb_ctl_path,
+                .maxlen         = OCFS2_MAX_HB_CTL_PATH,
+                .mode           = 0644,
+                .proc_handler   = &proc_dostring,
+                .strategy       = &sysctl_string,
+        },
+        { .ctl_name = 0 }
+};
+static ctl_table ocfs2_mod_table[] = {
+        {
+                .ctl_name       = FS_OCFS2_NM,
+                .procname       = "nm",
+                .data           = NULL,
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = ocfs2_nm_table
+        },
+        { .ctl_name = 0}
+};
+static ctl_table ocfs2_kern_table[] = {
+        {
+                .ctl_name       = FS_OCFS2,
+                .procname       = "ocfs2",
+                .data           = NULL,
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = ocfs2_mod_table
+        },
+        { .ctl_name = 0}
+};
+static ctl_table ocfs2_root_table[] = {
+        {
+                .ctl_name       = CTL_FS,
+                .procname       = "fs",
+                .data           = NULL,
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = ocfs2_kern_table
+        },
+        { .ctl_name = 0 }
+};
+static struct ctl_table_header *ocfs2_table_header = NULL;
+/*
+ * Initialization
+ */
 static int __init ocfs2_stack_glue_init(void)
 {
        strcpy(cluster_stack_name, OCFS2_STACK_PLUGIN_O2CB);
+        ocfs2_table_header = register_sysctl_table(ocfs2_root_table);
+        if (!ocfs2_table_header) {
+                printk(KERN_ERR
+                       "ocfs2 stack glue: unable to register sysctl\n");
+                return -ENOMEM; /* or something. */
+        }
        return ocfs2_sysfs_init();
 }
@@ -559,6 +670,8 @@ static void __exit ocfs2_stack_glue_exit(void)
 {
        lproto = NULL;
        ocfs2_sysfs_exit();
+        if (ocfs2_table_header)
+                unregister_sysctl_table(ocfs2_table_header);
 }
 MODULE_AUTHOR("Oracle");
diff --git a/fs/ocfs2/stackglue.h b/fs/ocfs2/stackglue.h
index 005e4f170e0..db56281dd1b 100644
--- a/fs/ocfs2/stackglue.h
+++ b/fs/ocfs2/stackglue.h
@@ -134,22 +134,10 @@ struct ocfs2_stack_operations {
         * be freed.  Thus, a stack must not return from ->disconnect()
         * until it will no longer reference the conn pointer.
         *
-         * If hangup_pending is zero, ocfs2_cluster_disconnect() will also
+         * Once this call returns, the stack glue will be dropping this
-         * be dropping the reference on the module.
+         * connection's reference on the module.
         */
-        int (*disconnect)(struct ocfs2_cluster_connection *conn,
+        int (*disconnect)(struct ocfs2_cluster_connection *conn);
-                          int hangup_pending);
-        /*
-         * ocfs2_cluster_hangup() exists for compatibility with older
-         * ocfs2 tools.  Only the classic stack really needs it.  As such
-         * ->hangup() is not required of all stacks.  See the comment by
-         * ocfs2_cluster_hangup() for more details.
-         *
-         * Note that ocfs2_cluster_hangup() can only be called if
-         * hangup_pending was passed to ocfs2_cluster_disconnect().
-         */
-        void (*hangup)(const char *group, int grouplen);
        /*
         * ->this_node() returns the cluster's unique identifier for the
@@ -258,4 +246,5 @@ void ocfs2_stack_glue_set_locking_protocol(struct ocfs2_locking_protocol *proto)
 /* Used by stack plugins */
 int ocfs2_stack_glue_register(struct ocfs2_stack_plugin *plugin);
 void ocfs2_stack_glue_unregister(struct ocfs2_stack_plugin *plugin);
 #endif  /* STACKGLUE_H */
diff --git a/fs/open.c b/fs/open.c
index a1450086e92..a99ad09c319 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -16,6 +16,7 @@
 #include <linux/namei.h>
 #include <linux/backing-dev.h>
 #include <linux/capability.h>
+#include <linux/securebits.h>
 #include <linux/security.h>
 #include <linux/mount.h>
 #include <linux/vfs.h>
@@ -425,7 +426,7 @@ asmlinkage long sys_faccessat(int dfd, const char __user *filename, int mode)
 {
        struct nameidata nd;
        int old_fsuid, old_fsgid;
-        kernel_cap_t old_cap;
+        kernel_cap_t uninitialized_var(old_cap);  /* !SECURE_NO_SETUID_FIXUP */
        int res;
        if (mode & ~S_IRWXO)    /* where's F_OK, X_OK, W_OK, R_OK? */
@@ -433,23 +434,27 @@ asmlinkage long sys_faccessat(int dfd, const char __user *filename, int mode)
        old_fsuid = current->fsuid;
        old_fsgid = current->fsgid;
-        old_cap = current->cap_effective;
        current->fsuid = current->uid;
        current->fsgid = current->gid;
-        /*
+        if (!issecure(SECURE_NO_SETUID_FIXUP)) {
-         * Clear the capabilities if we switch to a non-root user
+                /*
-         *
+                 * Clear the capabilities if we switch to a non-root user
-         * FIXME: There is a race here against sys_capset.  The
+                 */
-         * capabilities can change yet we will restore the old
+#ifndef CONFIG_SECURITY_FILE_CAPABILITIES
-         * value below.  We should hold task_capabilities_lock,
+                /*
-         * but we cannot because user_path_walk can sleep.
+                 * FIXME: There is a race here against sys_capset.  The
-         */
+                 * capabilities can change yet we will restore the old
-        if (current->uid)
+                 * value below.  We should hold task_capabilities_lock,
-                cap_clear(current->cap_effective);
+                 * but we cannot because user_path_walk can sleep.
-        else
+                 */
-                current->cap_effective = current->cap_permitted;
+#endif /* ndef CONFIG_SECURITY_FILE_CAPABILITIES */
+                if (current->uid)
+                        old_cap = cap_set_effective(__cap_empty_set);
+                else
+                        old_cap = cap_set_effective(current->cap_permitted);
+        }
        res = __user_walk_fd(dfd, filename, LOOKUP_FOLLOW|LOOKUP_ACCESS, &nd);
        if (res)
@@ -478,7 +483,9 @@ out_path_release:
 out:
        current->fsuid = old_fsuid;
        current->fsgid = old_fsgid;
-        current->cap_effective = old_cap;
+        if (!issecure(SECURE_NO_SETUID_FIXUP))
+                cap_set_effective(old_cap);
        return res;
 }
diff --git a/fs/pipe.c b/fs/pipe.c
index ec228bc9f88..700f4e0d957 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1003,8 +1003,7 @@ struct file *create_write_pipe(void)
 void free_write_pipe(struct file *f)
 {
        free_pipe_info(f->f_dentry->d_inode);
-        dput(f->f_path.dentry);
+        path_put(&f->f_path);
-        mntput(f->f_path.mnt);
        put_filp(f);
 }
@@ -1015,8 +1014,8 @@ struct file *create_read_pipe(struct file *wrf)
                return ERR_PTR(-ENFILE);
        /* Grab pipe from the writer */
-        f->f_path.mnt = mntget(wrf->f_path.mnt);
+        f->f_path = wrf->f_path;
-        f->f_path.dentry = dget(wrf->f_path.dentry);
+        path_get(&wrf->f_path);
        f->f_mapping = wrf->f_path.dentry->d_inode->i_mapping;
        f->f_pos = 0;
@@ -1068,8 +1067,7 @@ int do_pipe(int *fd)
 err_fdr:
        put_unused_fd(fdr);
 err_read_pipe:
-        dput(fr->f_dentry);
+        path_put(&fr->f_path);
-        mntput(fr->f_vfsmnt);
        put_filp(fr);
 err_write_pipe:
        free_write_pipe(fw);
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 9e3b8c33c24..797d775e035 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -288,7 +288,7 @@ static void render_cap_t(struct seq_file *m, const char *header,
        seq_printf(m, "%s", header);
        CAP_FOR_EACH_U32(__capi) {
                seq_printf(m, "%08x",
-                           a->cap[(_LINUX_CAPABILITY_U32S-1) - __capi]);
+                           a->cap[(_KERNEL_CAPABILITY_U32S-1) - __capi]);
        }
        seq_printf(m, "\n");
 }
diff --git a/fs/proc/base.c b/fs/proc/base.c
index c447e0743a3..3b455371e7f 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -127,6 +127,25 @@ struct pid_entry {
                NULL, &proc_single_file_operations,     \
                { .proc_show = &proc_##OTYPE } )
+/*
+ * Count the number of hardlinks for the pid_entry table, excluding the .
+ * and .. links.
+ */
+static unsigned int pid_entry_count_dirs(const struct pid_entry *entries,
+        unsigned int n)
+{
+        unsigned int i;
+        unsigned int count;
+        count = 0;
+        for (i = 0; i < n; ++i) {
+                if (S_ISDIR(entries[i].mode))
+                        ++count;
+        }
+        return count;
+}
 int maps_protect;
 EXPORT_SYMBOL(maps_protect);
@@ -2585,10 +2604,9 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
        inode->i_op = &proc_tgid_base_inode_operations;
        inode->i_fop = &proc_tgid_base_operations;
        inode->i_flags|=S_IMMUTABLE;
-        inode->i_nlink = 5;
-#ifdef CONFIG_SECURITY
+        inode->i_nlink = 2 + pid_entry_count_dirs(tgid_base_stuff,
-        inode->i_nlink += 1;
+                ARRAY_SIZE(tgid_base_stuff));
-#endif
        dentry->d_op = &pid_dentry_operations;
@@ -2816,10 +2834,9 @@ static struct dentry *proc_task_instantiate(struct inode *dir,
        inode->i_op = &proc_tid_base_inode_operations;
        inode->i_fop = &proc_tid_base_operations;
        inode->i_flags|=S_IMMUTABLE;
-        inode->i_nlink = 4;
-#ifdef CONFIG_SECURITY
+        inode->i_nlink = 2 + pid_entry_count_dirs(tid_base_stuff,
-        inode->i_nlink += 1;
+                ARRAY_SIZE(tid_base_stuff));
-#endif
        dentry->d_op = &pid_dentry_operations;
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 6f4e8dc97da..b08d1001791 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -425,7 +425,8 @@ struct inode *proc_get_inode(struct super_block *sb, unsigned int ino,
                        }
                }
                unlock_new_inode(inode);
-        }
+        } else
+               module_put(de->owner);
        return inode;
 out_ino:
diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
index 74a323d2b85..c652d469dc0 100644
--- a/fs/proc/proc_misc.c
+++ b/fs/proc/proc_misc.c
@@ -123,6 +123,11 @@ static int uptime_read_proc(char *page, char **start, off_t off,
        return proc_calc_metrics(page, start, off, count, eof, len);
 }
+int __attribute__((weak)) arch_report_meminfo(char *page)
+{
+        return 0;
+}
 static int meminfo_read_proc(char *page, char **start, off_t off,
                                 int count, int *eof, void *data)
 {
@@ -139,7 +144,7 @@ static int meminfo_read_proc(char *page, char **start, off_t off,
 #define K(x) ((x) << (PAGE_SHIFT - 10))
        si_meminfo(&i);
        si_swapinfo(&i);
-        committed = atomic_read(&vm_committed_space);
+        committed = atomic_long_read(&vm_committed_space);
        allowed = ((totalram_pages - hugetlb_total_pages())
                * sysctl_overcommit_ratio / 100) + total_swap_pages;
@@ -221,6 +226,8 @@ static int meminfo_read_proc(char *page, char **start, off_t off,
                len += hugetlb_report_meminfo(page + len);
+        len += arch_report_meminfo(page + len);
        return proc_calc_metrics(page, start, off, count, eof, len);
 #undef K
 }
@@ -472,6 +479,13 @@ static const struct file_operations proc_vmalloc_operations = {
 };
 #endif
+#ifndef arch_irq_stat_cpu
+#define arch_irq_stat_cpu(cpu) 0
+#endif
+#ifndef arch_irq_stat
+#define arch_irq_stat() 0
+#endif
 static int show_stat(struct seq_file *p, void *v)
 {
        int i;
@@ -509,7 +523,9 @@ static int show_stat(struct seq_file *p, void *v)
                        sum += temp;
                        per_irq_sum[j] += temp;
                }
+                sum += arch_irq_stat_cpu(i);
        }
+        sum += arch_irq_stat();
        seq_printf(p, "cpu  %llu %llu %llu %llu %llu %llu %llu %llu %llu\n",
                (unsigned long long)cputime64_to_clock_t(user),
@@ -716,7 +732,7 @@ static ssize_t kpagecount_read(struct file *file, char __user *buf,
        pfn = src / KPMSIZE;
        count = min_t(size_t, count, (max_pfn * KPMSIZE) - src);
        if (src & KPMMASK || count & KPMMASK)
-                return -EIO;
+                return -EINVAL;
        while (count > 0) {
                ppage = NULL;
@@ -726,7 +742,7 @@ static ssize_t kpagecount_read(struct file *file, char __user *buf,
                if (!ppage)
                        pcount = 0;
                else
-                        pcount = atomic_read(&ppage->_count);
+                        pcount = page_mapcount(ppage);
                if (put_user(pcount, out++)) {
                        ret = -EFAULT;
@@ -782,7 +798,7 @@ static ssize_t kpageflags_read(struct file *file, char __user *buf,
        pfn = src / KPMSIZE;
        count = min_t(unsigned long, count, (max_pfn * KPMSIZE) - src);
        if (src & KPMMASK || count & KPMMASK)
-                return -EIO;
+                return -EINVAL;
        while (count > 0) {
                ppage = NULL;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 88717c0f941..c492449f3b4 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -315,9 +315,9 @@ struct mem_size_stats {
 };
 static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
-                           void *private)
+                           struct mm_walk *walk)
 {
-        struct mem_size_stats *mss = private;
+        struct mem_size_stats *mss = walk->private;
        struct vm_area_struct *vma = mss->vma;
        pte_t *pte, ptent;
        spinlock_t *ptl;
@@ -365,19 +365,21 @@ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
        return 0;
 }
-static struct mm_walk smaps_walk = { .pmd_entry = smaps_pte_range };
 static int show_smap(struct seq_file *m, void *v)
 {
        struct vm_area_struct *vma = v;
        struct mem_size_stats mss;
        int ret;
+        struct mm_walk smaps_walk = {
+                .pmd_entry = smaps_pte_range,
+                .mm = vma->vm_mm,
+                .private = &mss,
+        };
        memset(&mss, 0, sizeof mss);
        mss.vma = vma;
        if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-                walk_page_range(vma->vm_mm, vma->vm_start, vma->vm_end,
+                walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-                                &smaps_walk, &mss);
        ret = show_map(m, v);
        if (ret)
@@ -426,9 +428,9 @@ const struct file_operations proc_smaps_operations = {
 };
 static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
-                                unsigned long end, void *private)
+                                unsigned long end, struct mm_walk *walk)
 {
-        struct vm_area_struct *vma = private;
+        struct vm_area_struct *vma = walk->private;
        pte_t *pte, ptent;
        spinlock_t *ptl;
        struct page *page;
@@ -452,8 +454,6 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
        return 0;
 }
-static struct mm_walk clear_refs_walk = { .pmd_entry = clear_refs_pte_range };
 static ssize_t clear_refs_write(struct file *file, const char __user *buf,
                                size_t count, loff_t *ppos)
 {
@@ -476,11 +476,17 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
                return -ESRCH;
        mm = get_task_mm(task);
        if (mm) {
+                struct mm_walk clear_refs_walk = {
+                        .pmd_entry = clear_refs_pte_range,
+                        .mm = mm,
+                };
                down_read(&mm->mmap_sem);
-                for (vma = mm->mmap; vma; vma = vma->vm_next)
+                for (vma = mm->mmap; vma; vma = vma->vm_next) {
+                        clear_refs_walk.private = vma;
                        if (!is_vm_hugetlb_page(vma))
-                                walk_page_range(mm, vma->vm_start, vma->vm_end,
+                                walk_page_range(vma->vm_start, vma->vm_end,
-                                                &clear_refs_walk, vma);
+                                                &clear_refs_walk);
+                }
                flush_tlb_mm(mm);
                up_read(&mm->mmap_sem);
                mmput(mm);
@@ -496,7 +502,7 @@ const struct file_operations proc_clear_refs_operations = {
 };
 struct pagemapread {
-        char __user *out, *end;
+        u64 __user *out, *end;
 };
 #define PM_ENTRY_BYTES      sizeof(u64)
@@ -519,28 +525,18 @@ struct pagemapread {
 static int add_to_pagemap(unsigned long addr, u64 pfn,
                          struct pagemapread *pm)
 {
-        /*
-         * Make sure there's room in the buffer for an
-         * entire entry.  Otherwise, only copy part of
-         * the pfn.
-         */
-        if (pm->out + PM_ENTRY_BYTES >= pm->end) {
-                if (copy_to_user(pm->out, &pfn, pm->end - pm->out))
-                        return -EFAULT;
-                pm->out = pm->end;
-                return PM_END_OF_BUFFER;
-        }
        if (put_user(pfn, pm->out))
                return -EFAULT;
-        pm->out += PM_ENTRY_BYTES;
+        pm->out++;
+        if (pm->out >= pm->end)
+                return PM_END_OF_BUFFER;
        return 0;
 }
 static int pagemap_pte_hole(unsigned long start, unsigned long end,
-                                void *private)
+                                struct mm_walk *walk)
 {
-        struct pagemapread *pm = private;
+        struct pagemapread *pm = walk->private;
        unsigned long addr;
        int err = 0;
        for (addr = start; addr < end; addr += PAGE_SIZE) {
@@ -557,24 +553,45 @@ static u64 swap_pte_to_pagemap_entry(pte_t pte)
        return swp_type(e) | (swp_offset(e) << MAX_SWAPFILES_SHIFT);
 }
+static unsigned long pte_to_pagemap_entry(pte_t pte)
+{
+        unsigned long pme = 0;
+        if (is_swap_pte(pte))
+                pme = PM_PFRAME(swap_pte_to_pagemap_entry(pte))
+                        | PM_PSHIFT(PAGE_SHIFT) | PM_SWAP;
+        else if (pte_present(pte))
+                pme = PM_PFRAME(pte_pfn(pte))
+                        | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT;
+        return pme;
+}
 static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
-                             void *private)
+                             struct mm_walk *walk)
 {
-        struct pagemapread *pm = private;
+        struct vm_area_struct *vma;
+        struct pagemapread *pm = walk->private;
        pte_t *pte;
        int err = 0;
+        /* find the first VMA at or above 'addr' */
+        vma = find_vma(walk->mm, addr);
        for (; addr != end; addr += PAGE_SIZE) {
                u64 pfn = PM_NOT_PRESENT;
-                pte = pte_offset_map(pmd, addr);
-                if (is_swap_pte(*pte))
+                /* check to see if we've left 'vma' behind
-                        pfn = PM_PFRAME(swap_pte_to_pagemap_entry(*pte))
+                 * and need a new, higher one */
-                                | PM_PSHIFT(PAGE_SHIFT) | PM_SWAP;
+                if (vma && (addr >= vma->vm_end))
-                else if (pte_present(*pte))
+                        vma = find_vma(walk->mm, addr);
-                        pfn = PM_PFRAME(pte_pfn(*pte))
-                                | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT;
+                /* check that 'vma' actually covers this address,
-                /* unmap so we're not in atomic when we copy to userspace */
+                 * and that it isn't a huge page vma */
-                pte_unmap(pte);
+                if (vma && (vma->vm_start <= addr) &&
+                    !is_vm_hugetlb_page(vma)) {
+                        pte = pte_offset_map(pmd, addr);
+                        pfn = pte_to_pagemap_entry(*pte);
+                        /* unmap before userspace copy */
+                        pte_unmap(pte);
+                }
                err = add_to_pagemap(addr, pfn, pm);
                if (err)
                        return err;
@@ -585,11 +602,6 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
        return err;
 }
-static struct mm_walk pagemap_walk = {
-        .pmd_entry = pagemap_pte_range,
-        .pte_hole = pagemap_pte_hole
-};
 /*
 * /proc/pid/pagemap - an array mapping virtual pages to pfns
 *
@@ -624,6 +636,11 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
        struct pagemapread pm;
        int pagecount;
        int ret = -ESRCH;
+        struct mm_walk pagemap_walk;
+        unsigned long src;
+        unsigned long svpfn;
+        unsigned long start_vaddr;
+        unsigned long end_vaddr;
        if (!task)
                goto out;
@@ -634,7 +651,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
        ret = -EINVAL;
        /* file position must be aligned */
-        if (*ppos % PM_ENTRY_BYTES)
+        if ((*ppos % PM_ENTRY_BYTES) || (count % PM_ENTRY_BYTES))
                goto out_task;
        ret = 0;
@@ -642,11 +659,15 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
        if (!mm)
                goto out_task;
-        ret = -ENOMEM;
        uaddr = (unsigned long)buf & PAGE_MASK;
        uend = (unsigned long)(buf + count);
        pagecount = (PAGE_ALIGN(uend) - uaddr) / PAGE_SIZE;
-        pages = kmalloc(pagecount * sizeof(struct page *), GFP_KERNEL);
+        ret = 0;
+        if (pagecount == 0)
+                goto out_mm;
+        pages = kcalloc(pagecount, sizeof(struct page *), GFP_KERNEL);
+        ret = -ENOMEM;
        if (!pages)
                goto out_mm;
@@ -664,36 +685,36 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
                goto out_pages;
        }
-        pm.out = buf;
+        pm.out = (u64 *)buf;
-        pm.end = buf + count;
+        pm.end = (u64 *)(buf + count);
-        if (!ptrace_may_attach(task)) {
+        pagemap_walk.pmd_entry = pagemap_pte_range;
-                ret = -EIO;
+        pagemap_walk.pte_hole = pagemap_pte_hole;
-        } else {
+        pagemap_walk.mm = mm;
-                unsigned long src = *ppos;
+        pagemap_walk.private = &pm;
-                unsigned long svpfn = src / PM_ENTRY_BYTES;
-                unsigned long start_vaddr = svpfn << PAGE_SHIFT;
+        src = *ppos;
-                unsigned long end_vaddr = TASK_SIZE_OF(task);
+        svpfn = src / PM_ENTRY_BYTES;
+        start_vaddr = svpfn << PAGE_SHIFT;
-                /* watch out for wraparound */
+        end_vaddr = TASK_SIZE_OF(task);
-                if (svpfn > TASK_SIZE_OF(task) >> PAGE_SHIFT)
-                        start_vaddr = end_vaddr;
+        /* watch out for wraparound */
+        if (svpfn > TASK_SIZE_OF(task) >> PAGE_SHIFT)
-                /*
+                start_vaddr = end_vaddr;
-                 * The odds are that this will stop walking way
-                 * before end_vaddr, because the length of the
+        /*
-                 * user buffer is tracked in "pm", and the walk
+         * The odds are that this will stop walking way
-                 * will stop when we hit the end of the buffer.
+         * before end_vaddr, because the length of the
-                 */
+         * user buffer is tracked in "pm", and the walk
-                ret = walk_page_range(mm, start_vaddr, end_vaddr,
+         * will stop when we hit the end of the buffer.
-                                        &pagemap_walk, &pm);
+         */
-                if (ret == PM_END_OF_BUFFER)
+        ret = walk_page_range(start_vaddr, end_vaddr, &pagemap_walk);
-                        ret = 0;
+        if (ret == PM_END_OF_BUFFER)
-                /* don't need mmap_sem for these, but this looks cleaner */
+                ret = 0;
-                *ppos += pm.out - buf;
+        /* don't need mmap_sem for these, but this looks cleaner */
-                if (!ret)
+        *ppos += (char *)pm.out - buf;
-                        ret = pm.out - buf;
+        if (!ret)
-        }
+                ret = (char *)pm.out - buf;
 out_pages:
        for (; pagecount; pagecount--) {
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index ed424d708e6..1d40f2bd197 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -2165,8 +2165,10 @@ static ssize_t reiserfs_quota_write(struct super_block *sb, int type,
                blk++;
        }
 out:
-        if (len == towrite)
+        if (len == towrite) {
+                mutex_unlock(&inode->i_mutex);
                return err;
+        }
        if (inode->i_size < off + len - towrite)
                i_size_write(inode, off + len - towrite);
        inode->i_version++;
diff --git a/fs/select.c b/fs/select.c
index 8dda969614a..da0e88201c3 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -249,7 +249,6 @@ int do_select(int n, fd_set_bits *fds, s64 *timeout)
                                                retval++;
                                        }
                                }
-                                cond_resched();
                        }
                        if (res_in)
                                *rinp = res_in;
@@ -257,6 +256,7 @@ int do_select(int n, fd_set_bits *fds, s64 *timeout)
                                *routp = res_out;
                        if (res_ex)
                                *rexp = res_ex;
+                        cond_resched();
                }
                wait = NULL;
                if (retval || !*timeout || signal_pending(current))
diff --git a/fs/splice.c b/fs/splice.c
index 78150038b58..aa5f6f60b30 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -58,8 +58,8 @@ static int page_cache_pipe_buf_steal(struct pipe_inode_info *pipe,
                 */
                wait_on_page_writeback(page);
-                if (PagePrivate(page))
+                if (PagePrivate(page) && !try_to_release_page(page, GFP_KERNEL))
-                        try_to_release_page(page, GFP_KERNEL);
+                        goto out_unlock;
                /*
                 * If we succeeded in removing the mapping, set LRU flag
@@ -75,6 +75,7 @@ static int page_cache_pipe_buf_steal(struct pipe_inode_info *pipe,
         * Raced with truncate or failed to remove page from current
         * address space, unlock and return failure.
         */
+out_unlock:
        unlock_page(page);
        return 1;
 }
@@ -983,7 +984,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
        while (len) {
                size_t read_len;
-                loff_t pos = sd->pos;
+                loff_t pos = sd->pos, prev_pos = pos;
                ret = do_splice_to(in, &pos, pipe, len, flags);
                if (unlikely(ret <= 0))
@@ -998,15 +999,19 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
                 * could get stuck data in the internal pipe:
                 */
                ret = actor(pipe, sd);
-                if (unlikely(ret <= 0))
+                if (unlikely(ret <= 0)) {
+                        sd->pos = prev_pos;
                        goto out_release;
+                }
                bytes += ret;
                len -= ret;
                sd->pos = pos;
-                if (ret < read_len)
+                if (ret < read_len) {
+                        sd->pos = prev_pos + ret;
                        goto out_release;
+                }
        }
 done:
@@ -1072,7 +1077,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
        ret = splice_direct_to_actor(in, &sd, direct_splice_actor);
        if (ret > 0)
-                *ppos += ret;
+                *ppos = sd.pos;
        return ret;
 }
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index a1c3a1fab7f..8c0e4b92574 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -419,12 +419,8 @@ void sysfs_addrm_start(struct sysfs_addrm_cxt *acxt,
 */
 int sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
 {
-        if (sysfs_find_dirent(acxt->parent_sd, sd->s_name)) {
+        if (sysfs_find_dirent(acxt->parent_sd, sd->s_name))
-                printk(KERN_WARNING "sysfs: duplicate filename '%s' "
-                       "can not be created\n", sd->s_name);
-                WARN_ON(1);
                return -EEXIST;
-        }
        sd->s_parent = sysfs_get(acxt->parent_sd);
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 7a5f69be6ac..44cc702f96c 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -682,38 +682,26 @@ static int udf_vrs(struct super_block *sb, int silent)
 /*
 * Check whether there is an anchor block in the given block
 */
-static int udf_check_anchor_block(struct super_block *sb, sector_t block,
+static int udf_check_anchor_block(struct super_block *sb, sector_t block)
-                                        bool varconv)
 {
-        struct buffer_head *bh = NULL;
+        struct buffer_head *bh;
-        tag *t;
        uint16_t ident;
-        uint32_t location;
-        if (varconv) {
+        if (UDF_QUERY_FLAG(sb, UDF_FLAG_VARCONV) &&
-                if (udf_fixed_to_variable(block) >=
+            udf_fixed_to_variable(block) >=
-                    sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits)
+            sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits)
-                        return 0;
+                return 0;
-                bh = sb_bread(sb, udf_fixed_to_variable(block));
-        }
-        else
-                bh = sb_bread(sb, block);
+        bh = udf_read_tagged(sb, block, block, &ident);
        if (!bh)
                return 0;
-        t = (tag *)bh->b_data;
-        ident = le16_to_cpu(t->tagIdent);
-        location = le32_to_cpu(t->tagLocation);
        brelse(bh);
-        if (ident != TAG_IDENT_AVDP)
-                return 0;
+        return ident == TAG_IDENT_AVDP;
-        return location == block;
 }
 /* Search for an anchor volume descriptor pointer */
-static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
+static sector_t udf_scan_anchors(struct super_block *sb, sector_t lastblock)
-                                        sector_t lastblock)
 {
        sector_t last[6];
        int i;
@@ -739,7 +727,7 @@ static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
                                sb->s_blocksize_bits)
                        continue;
-                if (udf_check_anchor_block(sb, last[i], varconv)) {
+                if (udf_check_anchor_block(sb, last[i])) {
                        sbi->s_anchor[0] = last[i];
                        sbi->s_anchor[1] = last[i] - 256;
                        return last[i];
@@ -748,17 +736,17 @@ static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
                if (last[i] < 256)
                        continue;
-                if (udf_check_anchor_block(sb, last[i] - 256, varconv)) {
+                if (udf_check_anchor_block(sb, last[i] - 256)) {
                        sbi->s_anchor[1] = last[i] - 256;
                        return last[i];
                }
        }
-        if (udf_check_anchor_block(sb, sbi->s_session + 256, varconv)) {
+        if (udf_check_anchor_block(sb, sbi->s_session + 256)) {
                sbi->s_anchor[0] = sbi->s_session + 256;
                return last[0];
        }
-        if (udf_check_anchor_block(sb, sbi->s_session + 512, varconv)) {
+        if (udf_check_anchor_block(sb, sbi->s_session + 512)) {
                sbi->s_anchor[0] = sbi->s_session + 512;
                return last[0];
        }
@@ -780,23 +768,24 @@ static void udf_find_anchor(struct super_block *sb)
        int i;
        struct udf_sb_info *sbi = UDF_SB(sb);
-        lastblock = udf_scan_anchors(sb, 0, sbi->s_last_block);
+        lastblock = udf_scan_anchors(sb, sbi->s_last_block);
        if (lastblock)
                goto check_anchor;
        /* No anchor found? Try VARCONV conversion of block numbers */
+        UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
        /* Firstly, we try to not convert number of the last block */
-        lastblock = udf_scan_anchors(sb, 1,
+        lastblock = udf_scan_anchors(sb,
                                udf_variable_to_fixed(sbi->s_last_block));
-        if (lastblock) {
+        if (lastblock)
-                UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
                goto check_anchor;
-        }
        /* Secondly, we try with converted number of the last block */
-        lastblock = udf_scan_anchors(sb, 1, sbi->s_last_block);
+        lastblock = udf_scan_anchors(sb, sbi->s_last_block);
-        if (lastblock)
+        if (!lastblock) {
-                UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
+                /* VARCONV didn't help. Clear it. */
+                UDF_CLEAR_FLAG(sb, UDF_FLAG_VARCONV);
+        }
 check_anchor:
        /*
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index 8fa9c2d7091..8ec865de5f1 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -16,7 +16,7 @@
 #define UDF_PREALLOCATE
 #define UDF_DEFAULT_PREALLOC_BLOCKS     8
-#define UDFFS_DEBUG
+#undef UDFFS_DEBUG
 #ifdef UDFFS_DEBUG
 #define udf_debug(f, a...) \
diff --git a/fs/utimes.c b/fs/utimes.c
index af059d5cb48..b6b664e7145 100644
--- a/fs/utimes.c
+++ b/fs/utimes.c
@@ -40,14 +40,9 @@ asmlinkage long sys_utime(char __user *filename, struct utimbuf __user *times)
 #endif
-static bool nsec_special(long nsec)
-{
-        return nsec == UTIME_OMIT || nsec == UTIME_NOW;
-}
 static bool nsec_valid(long nsec)
 {
-        if (nsec_special(nsec))
+        if (nsec == UTIME_OMIT || nsec == UTIME_NOW)
                return true;
        return nsec >= 0 && nsec <= 999999999;
@@ -102,7 +97,11 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
        if (error)
                goto dput_and_out;
-        /* Don't worry, the checks are done in inode_change_ok() */
+        if (times && times[0].tv_nsec == UTIME_NOW &&
+                     times[1].tv_nsec == UTIME_NOW)
+                times = NULL;
+        /* In most cases, the checks are done in inode_change_ok() */
        newattrs.ia_valid = ATTR_CTIME | ATTR_MTIME | ATTR_ATIME;
        if (times) {
                error = -EPERM;
@@ -124,28 +123,34 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
                        newattrs.ia_mtime.tv_nsec = times[1].tv_nsec;
                        newattrs.ia_valid |= ATTR_MTIME_SET;
                }
-        }
-        /*
+                /*
-         * If times is NULL or both times are either UTIME_OMIT or
+                 * For the UTIME_OMIT/UTIME_NOW and UTIME_NOW/UTIME_OMIT
-         * UTIME_NOW, then need to check permissions, because
+                 * cases, we need to make an extra check that is not done by
-         * inode_change_ok() won't do it.
+                 * inode_change_ok().
-         */
+                 */
-        if (!times || (nsec_special(times[0].tv_nsec) &&
+                if (((times[0].tv_nsec == UTIME_NOW &&
-                       nsec_special(times[1].tv_nsec))) {
+                            times[1].tv_nsec == UTIME_OMIT)
+                     ||
+                     (times[0].tv_nsec == UTIME_OMIT &&
+                            times[1].tv_nsec == UTIME_NOW))
+                    && !is_owner_or_cap(inode))
+                        goto mnt_drop_write_and_out;
+        } else {
+                /*
+                 * If times is NULL (or both times are UTIME_NOW),
+                 * then we need to check permissions, because
+                 * inode_change_ok() won't do it.
+                 */
                error = -EACCES;
                if (IS_IMMUTABLE(inode))
                        goto mnt_drop_write_and_out;
                if (!is_owner_or_cap(inode)) {
-                        if (f) {
+                        error = permission(inode, MAY_WRITE, NULL);
-                                if (!(f->f_mode & FMODE_WRITE))
+                        if (error)
-                                        goto mnt_drop_write_and_out;
+                                goto mnt_drop_write_and_out;
-                        } else {
-                                error = vfs_permission(&nd, MAY_WRITE);
-                                if (error)
-                                        goto mnt_drop_write_and_out;
-                        }
                }
        }
        mutex_lock(&inode->i_mutex);
@@ -169,14 +174,6 @@ asmlinkage long sys_utimensat(int dfd, char __user *filename, struct timespec __
        if (utimes) {
                if (copy_from_user(&tstimes, utimes, sizeof(tstimes)))
                        return -EFAULT;
-                if ((tstimes[0].tv_nsec == UTIME_OMIT ||
-                     tstimes[0].tv_nsec == UTIME_NOW) &&
-                    tstimes[0].tv_sec != 0)
-                        return -EINVAL;
-                if ((tstimes[1].tv_nsec == UTIME_OMIT ||
-                     tstimes[1].tv_nsec == UTIME_NOW) &&
-                    tstimes[1].tv_sec != 0)
-                        return -EINVAL;
                /* Nothing to do, we must not even check the path.  */
                if (tstimes[0].tv_nsec == UTIME_OMIT &&
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 5105015a75a..98e0e86093b 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -387,6 +387,8 @@ _xfs_buf_lookup_pages(
                if (unlikely(page == NULL)) {
                        if (flags & XBF_READ_AHEAD) {
                                bp->b_page_count = i;
+                                for (i = 0; i < bp->b_page_count; i++)
+                                        unlock_page(bp->b_pages[i]);
                                return -ENOMEM;
                        }
@@ -416,17 +418,24 @@ _xfs_buf_lookup_pages(
                ASSERT(!PagePrivate(page));
                if (!PageUptodate(page)) {
                        page_count--;
-                        if (blocksize < PAGE_CACHE_SIZE && !PagePrivate(page)) {
+                        if (blocksize >= PAGE_CACHE_SIZE) {
+                                if (flags & XBF_READ)
+                                        bp->b_flags |= _XBF_PAGE_LOCKED;
+                        } else if (!PagePrivate(page)) {
                                if (test_page_region(page, offset, nbytes))
                                        page_count++;
                        }
                }
-                unlock_page(page);
                bp->b_pages[i] = page;
                offset = 0;
        }
+        if (!(bp->b_flags & _XBF_PAGE_LOCKED)) {
+                for (i = 0; i < bp->b_page_count; i++)
+                        unlock_page(bp->b_pages[i]);
+        }
        if (page_count == bp->b_page_count)
                bp->b_flags |= XBF_DONE;
@@ -746,6 +755,7 @@ xfs_buf_associate_memory(
        bp->b_count_desired = len;
        bp->b_buffer_length = buflen;
        bp->b_flags |= XBF_MAPPED;
+        bp->b_flags &= ~_XBF_PAGE_LOCKED;
        return 0;
 }
@@ -1093,8 +1103,10 @@ _xfs_buf_ioend(
        xfs_buf_t               *bp,
        int                     schedule)
 {
-        if (atomic_dec_and_test(&bp->b_io_remaining) == 1)
+        if (atomic_dec_and_test(&bp->b_io_remaining) == 1) {
+                bp->b_flags &= ~_XBF_PAGE_LOCKED;
                xfs_buf_ioend(bp, schedule);
+        }
 }
 STATIC void
@@ -1125,6 +1137,9 @@ xfs_buf_bio_end_io(
                if (--bvec >= bio->bi_io_vec)
                        prefetchw(&bvec->bv_page->flags);
+                if (bp->b_flags & _XBF_PAGE_LOCKED)
+                        unlock_page(page);
        } while (bvec >= bio->bi_io_vec);
        _xfs_buf_ioend(bp, 1);
@@ -1163,7 +1178,8 @@ _xfs_buf_ioapply(
         * filesystem block size is not smaller than the page size.
         */
        if ((bp->b_buffer_length < PAGE_CACHE_SIZE) &&
-            (bp->b_flags & XBF_READ) &&
+            ((bp->b_flags & (XBF_READ|_XBF_PAGE_LOCKED)) ==
+              (XBF_READ|_XBF_PAGE_LOCKED)) &&
            (blocksize >= PAGE_CACHE_SIZE)) {
                bio = bio_alloc(GFP_NOIO, 1);
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index 841d7883528..f948ec7ba9a 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -66,6 +66,25 @@ typedef enum {
        _XBF_PAGES = (1 << 18),     /* backed by refcounted pages          */
        _XBF_RUN_QUEUES = (1 << 19),/* run block device task queue         */
        _XBF_DELWRI_Q = (1 << 21),   /* buffer on delwri queue             */
+        /*
+         * Special flag for supporting metadata blocks smaller than a FSB.
+         *
+         * In this case we can have multiple xfs_buf_t on a single page and
+         * need to lock out concurrent xfs_buf_t readers as they only
+         * serialise access to the buffer.
+         *
+         * If the FSB size >= PAGE_CACHE_SIZE case, we have no serialisation
+         * between reads of the page. Hence we can have one thread read the
+         * page and modify it, but then race with another thread that thinks
+         * the page is not up-to-date and hence reads it again.
+         *
+         * The result is that the first modifcation to the page is lost.
+         * This sort of AGF/AGI reading race can happen when unlinking inodes
+         * that require truncation and results in the AGI unlinked list
+         * modifications being lost.
+         */
+        _XBF_PAGE_LOCKED = (1 << 22),
 } xfs_buf_flags_t;
 typedef enum {
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index 65e78c13d4a..5f60363b934 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -184,19 +184,24 @@ xfs_file_release(
        return -xfs_release(XFS_I(inode));
 }
+/*
+ * We ignore the datasync flag here because a datasync is effectively
+ * identical to an fsync. That is, datasync implies that we need to write
+ * only the metadata needed to be able to access the data that is written
+ * if we crash after the call completes. Hence if we are writing beyond
+ * EOF we have to log the inode size change as well, which makes it a
+ * full fsync. If we don't write beyond EOF, the inode core will be
+ * clean in memory and so we don't need to log the inode, just like
+ * fsync.
+ */
 STATIC int
 xfs_file_fsync(
        struct file     *filp,
        struct dentry   *dentry,
        int             datasync)
 {
-        int             flags = FSYNC_WAIT;
-        if (datasync)
-                flags |= FSYNC_DATA;
        xfs_iflags_clear(XFS_I(dentry->d_inode), XFS_ITRUNCATED);
-        return -xfs_fsync(XFS_I(dentry->d_inode), flags,
+        return -xfs_fsync(XFS_I(dentry->d_inode));
-                        (xfs_off_t)0, (xfs_off_t)-1);
 }
 /*
diff --git a/fs/xfs/linux-2.6/xfs_vnode.h b/fs/xfs/linux-2.6/xfs_vnode.h
index 9d73cb5c0fc..25eb2a9e8d9 100644
--- a/fs/xfs/linux-2.6/xfs_vnode.h
+++ b/fs/xfs/linux-2.6/xfs_vnode.h
@@ -230,14 +230,6 @@ static inline void vn_atime_to_time_t(bhv_vnode_t *vp, time_t *tt)
 #define ATTR_NOSIZETOK  0x400   /* Don't get the SIZE token */
 /*
- * Flags to vop_fsync/reclaim.
- */
-#define FSYNC_NOWAIT    0       /* asynchronous flush */
-#define FSYNC_WAIT      0x1     /* synchronous fsync or forced reclaim */
-#define FSYNC_INVAL     0x2     /* flush and invalidate cached data */
-#define FSYNC_DATA      0x4     /* synchronous fsync of data only */
-/*
 * Tracking vnode activity.
 */
 #if defined(XFS_INODE_TRACE)
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index cf0bb9c1d62..e569bf5d6cf 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2974,6 +2974,7 @@ xfs_iflush_cluster(
        xfs_mount_t             *mp = ip->i_mount;
        xfs_perag_t             *pag = xfs_get_perag(mp, ip->i_ino);
        unsigned long           first_index, mask;
+        unsigned long           inodes_per_cluster;
        int                     ilist_size;
        xfs_inode_t             **ilist;
        xfs_inode_t             *iq;
@@ -2985,8 +2986,9 @@ xfs_iflush_cluster(
        ASSERT(pag->pagi_inodeok);
        ASSERT(pag->pag_ici_init);
-        ilist_size = XFS_INODE_CLUSTER_SIZE(mp) * sizeof(xfs_inode_t *);
+        inodes_per_cluster = XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_inodelog;
-        ilist = kmem_alloc(ilist_size, KM_MAYFAIL);
+        ilist_size = inodes_per_cluster * sizeof(xfs_inode_t *);
+        ilist = kmem_alloc(ilist_size, KM_MAYFAIL|KM_NOFS);
        if (!ilist)
                return 0;
@@ -2995,8 +2997,7 @@ xfs_iflush_cluster(
        read_lock(&pag->pag_ici_lock);
        /* really need a gang lookup range call here */
        nr_found = radix_tree_gang_lookup(&pag->pag_ici_root, (void**)ilist,
-                                        first_index,
+                                        first_index, inodes_per_cluster);
-                                        XFS_INODE_CLUSTER_SIZE(mp));
        if (nr_found == 0)
                goto out_free;
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 70702a60b4b..e475e3717eb 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -856,18 +856,14 @@ xfs_readlink(
 /*
 * xfs_fsync
 *
- * This is called to sync the inode and its data out to disk.
+ * This is called to sync the inode and its data out to disk.  We need to hold
- * We need to hold the I/O lock while flushing the data, and
+ * the I/O lock while flushing the data, and the inode lock while flushing the
- * the inode lock while flushing the inode.  The inode lock CANNOT
+ * inode.  The inode lock CANNOT be held while flushing the data, so acquire
- * be held while flushing the data, so acquire after we're done
+ * after we're done with that.
- * with that.
 */
 int
 xfs_fsync(
-        xfs_inode_t     *ip,
+        xfs_inode_t     *ip)
-        int             flag,
-        xfs_off_t       start,
-        xfs_off_t       stop)
 {
        xfs_trans_t     *tp;
        int             error;
@@ -875,103 +871,79 @@ xfs_fsync(
        xfs_itrace_entry(ip);
-        ASSERT(start >= 0 && stop >= -1);
        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
                return XFS_ERROR(EIO);
-        if (flag & FSYNC_DATA)
+        /* capture size updates in I/O completion before writing the inode. */
-                filemap_fdatawait(vn_to_inode(XFS_ITOV(ip))->i_mapping);
+        error = filemap_fdatawait(vn_to_inode(XFS_ITOV(ip))->i_mapping);
+        if (error)
+                return XFS_ERROR(error);
        /*
-         * We always need to make sure that the required inode state
+         * We always need to make sure that the required inode state is safe on
-         * is safe on disk.  The vnode might be clean but because
+         * disk.  The vnode might be clean but we still might need to force the
-         * of committed transactions that haven't hit the disk yet.
+         * log because of committed transactions that haven't hit the disk yet.
-         * Likewise, there could be unflushed non-transactional
+         * Likewise, there could be unflushed non-transactional changes to the
-         * changes to the inode core that have to go to disk.
+         * inode core that have to go to disk and this requires us to issue
+         * a synchronous transaction to capture these changes correctly.
         *
-         * The following code depends on one assumption:  that
+         * This code relies on the assumption that if the update_* fields
-         * any transaction that changes an inode logs the core
+         * of the inode are clear and the inode is unpinned then it is clean
-         * because it has to change some field in the inode core
+         * and no action is required.
-         * (typically nextents or nblocks).  That assumption
-         * implies that any transactions against an inode will
-         * catch any non-transactional updates.  If inode-altering
-         * transactions exist that violate this assumption, the
-         * code breaks.  Right now, it figures that if the involved
-         * update_* field is clear and the inode is unpinned, the
-         * inode is clean.  Either it's been flushed or it's been
-         * committed and the commit has hit the disk unpinning the inode.
-         * (Note that xfs_inode_item_format() called at commit clears
-         * the update_* fields.)
         */
        xfs_ilock(ip, XFS_ILOCK_SHARED);
-        /* If we are flushing data then we care about update_size
+        if (!(ip->i_update_size || ip->i_update_core)) {
-         * being set, otherwise we care about update_core
-         */
-        if ((flag & FSYNC_DATA) ?
-                        (ip->i_update_size == 0) :
-                        (ip->i_update_core == 0)) {
                /*
-                 * Timestamps/size haven't changed since last inode
+                 * Timestamps/size haven't changed since last inode flush or
-                 * flush or inode transaction commit.  That means
+                 * inode transaction commit.  That means either nothing got
-                 * either nothing got written or a transaction
+                 * written or a transaction committed which caught the updates.
-                 * committed which caught the updates.  If the
+                 * If the latter happened and the transaction hasn't hit the
-                 * latter happened and the transaction hasn't
+                 * disk yet, the inode will be still be pinned.  If it is,
-                 * hit the disk yet, the inode will be still
+                 * force the log.
-                 * be pinned.  If it is, force the log.
                 */
                xfs_iunlock(ip, XFS_ILOCK_SHARED);
                if (xfs_ipincount(ip)) {
-                        _xfs_log_force(ip->i_mount, (xfs_lsn_t)0,
+                        error = _xfs_log_force(ip->i_mount, (xfs_lsn_t)0,
-                                      XFS_LOG_FORCE |
+                                      XFS_LOG_FORCE | XFS_LOG_SYNC,
-                                      ((flag & FSYNC_WAIT)
-                                       ? XFS_LOG_SYNC : 0),
                                      &log_flushed);
                } else {
                        /*
-                         * If the inode is not pinned and nothing
+                         * If the inode is not pinned and nothing has changed
-                         * has changed we don't need to flush the
+                         * we don't need to flush the cache.
-                         * cache.
                         */
                        changed = 0;
                }
-                error = 0;
        } else  {
                /*
-                 * Kick off a transaction to log the inode
+                 * Kick off a transaction to log the inode core to get the
-                 * core to get the updates.  Make it
+                 * updates.  The sync transaction will also force the log.
-                 * sync if FSYNC_WAIT is passed in (which
-                 * is done by everybody but specfs).  The
-                 * sync transaction will also force the log.
                 */
                xfs_iunlock(ip, XFS_ILOCK_SHARED);
                tp = xfs_trans_alloc(ip->i_mount, XFS_TRANS_FSYNC_TS);
-                if ((error = xfs_trans_reserve(tp, 0,
+                error = xfs_trans_reserve(tp, 0,
-                                XFS_FSYNC_TS_LOG_RES(ip->i_mount),
+                                XFS_FSYNC_TS_LOG_RES(ip->i_mount), 0, 0, 0);
-                                0, 0, 0)))  {
+                if (error) {
                        xfs_trans_cancel(tp, 0);
                        return error;
                }
                xfs_ilock(ip, XFS_ILOCK_EXCL);
                /*
-                 * Note - it's possible that we might have pushed
+                 * Note - it's possible that we might have pushed ourselves out
-                 * ourselves out of the way during trans_reserve
+                 * of the way during trans_reserve which would flush the inode.
-                 * which would flush the inode.  But there's no
+                 * But there's no guarantee that the inode buffer has actually
-                 * guarantee that the inode buffer has actually
+                 * gone out yet (it's delwri).  Plus the buffer could be pinned
-                 * gone out yet (it's delwri).  Plus the buffer
+                 * anyway if it's part of an inode in another recent
-                 * could be pinned anyway if it's part of an
+                 * transaction.  So we play it safe and fire off the
-                 * inode in another recent transaction.  So we
+                 * transaction anyway.
-                 * play it safe and fire off the transaction anyway.
                 */
                xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
                xfs_trans_ihold(tp, ip);
                xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-                if (flag & FSYNC_WAIT)
+                xfs_trans_set_sync(tp);
-                        xfs_trans_set_sync(tp);
                error = _xfs_trans_commit(tp, 0, &log_flushed);
                xfs_iunlock(ip, XFS_ILOCK_EXCL);
diff --git a/fs/xfs/xfs_vnodeops.h b/fs/xfs/xfs_vnodeops.h
index 8abe8f186e2..57335ba4ce5 100644
--- a/fs/xfs/xfs_vnodeops.h
+++ b/fs/xfs/xfs_vnodeops.h
@@ -18,8 +18,7 @@ int xfs_open(struct xfs_inode *ip);
 int xfs_setattr(struct xfs_inode *ip, struct bhv_vattr *vap, int flags,
                struct cred *credp);
 int xfs_readlink(struct xfs_inode *ip, char *link);
-int xfs_fsync(struct xfs_inode *ip, int flag, xfs_off_t start,
+int xfs_fsync(struct xfs_inode *ip);
-                xfs_off_t stop);
 int xfs_release(struct xfs_inode *ip);
 int xfs_inactive(struct xfs_inode *ip);
 int xfs_lookup(struct xfs_inode *dp, struct xfs_name *name,