9 files changed, 281 insertions, 297 deletions

diff --git a/fs/ecryptfs/Kconfig b/fs/ecryptfs/Kconfig
index 1cd6d9d3e29..cc16562654d 100644
--- a/fs/ecryptfs/Kconfig
+++ b/fs/ecryptfs/Kconfig
@@ -1,6 +1,6 @@
 config ECRYPT_FS
         tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && KEYS && CRYPTO
+        depends on EXPERIMENTAL && KEYS && CRYPTO && (ENCRYPTED_KEYS || ENCRYPTED_KEYS=n)
         select CRYPTO_ECB
         select CRYPTO_CBC
         select CRYPTO_MD5
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 58609bde3b9..68b19ab0481 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -417,17 +417,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
                         (unsigned long long)(extent_base + extent_offset), rc);
                 goto out;
         }
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Encrypting extent "
-                                "with iv:\n");
-                ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
-                                "encryption:\n");
-                ecryptfs_dump_hex((char *)
-                                  (page_address(page)
-                                   + (extent_offset * crypt_stat->extent_size)),
-                                  8);
-        }
         rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, 0,
                                           page, (extent_offset
                                                  * crypt_stat->extent_size),
@@ -440,14 +429,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
                 goto out;
         }
         rc = 0;
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Encrypt extent [0x%.16llx]; "
-                        "rc = [%d]\n",
-                        (unsigned long long)(extent_base + extent_offset), rc);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
-                                "encryption:\n");
-                ecryptfs_dump_hex((char *)(page_address(enc_extent_page)), 8);
-        }
 out:
         return rc;
 }
@@ -543,17 +524,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
                         (unsigned long long)(extent_base + extent_offset), rc);
                 goto out;
         }
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Decrypting extent "
-                                "with iv:\n");
-                ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
-                                "decryption:\n");
-                ecryptfs_dump_hex((char *)
-                                  (page_address(enc_extent_page)
-                                   + (extent_offset * crypt_stat->extent_size)),
-                                  8);
-        }
         rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
                                           (extent_offset
                                            * crypt_stat->extent_size),
@@ -567,16 +537,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
                 goto out;
         }
         rc = 0;
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Decrypt extent [0x%.16llx]; "
-                        "rc = [%d]\n",
-                        (unsigned long long)(extent_base + extent_offset), rc);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
-                                "decryption:\n");
-                ecryptfs_dump_hex((char *)(page_address(page)
-                                           + (extent_offset
-                                              * crypt_stat->extent_size)), 8);
-        }
 out:
         return rc;
 }
@@ -967,7 +927,7 @@ static void ecryptfs_set_default_crypt_stat_vals(
 
 /**
  * ecryptfs_new_file_context
- * @ecryptfs_dentry: The eCryptfs dentry
+ * @ecryptfs_inode: The eCryptfs inode
  *
  * If the crypto context for the file has not yet been established,
  * this is where we do that.  Establishing a new crypto context
@@ -984,13 +944,13 @@ static void ecryptfs_set_default_crypt_stat_vals(
  *
  * Returns zero on success; non-zero otherwise
  */
-int ecryptfs_new_file_context(struct dentry *ecryptfs_dentry)
+int ecryptfs_new_file_context(struct inode *ecryptfs_inode)
 {
         struct ecryptfs_crypt_stat *crypt_stat =
-            &ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->crypt_stat;
+            &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
         struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
             &ecryptfs_superblock_to_private(
-                    ecryptfs_dentry->d_sb)->mount_crypt_stat;
+                    ecryptfs_inode->i_sb)->mount_crypt_stat;
         int cipher_name_len;
         int rc = 0;
 
@@ -1299,12 +1259,12 @@ static int ecryptfs_write_headers_virt(char *page_virt, size_t max,
 }
 
 static int
-ecryptfs_write_metadata_to_contents(struct dentry *ecryptfs_dentry,
+ecryptfs_write_metadata_to_contents(struct inode *ecryptfs_inode,
                                     char *virt, size_t virt_len)
 {
         int rc;
 
-        rc = ecryptfs_write_lower(ecryptfs_dentry->d_inode, virt,
+        rc = ecryptfs_write_lower(ecryptfs_inode, virt,
                                   0, virt_len);
         if (rc < 0)
                 printk(KERN_ERR "%s: Error attempting to write header "
@@ -1338,7 +1298,8 @@ static unsigned long ecryptfs_get_zeroed_pages(gfp_t gfp_mask,
 
 /**
  * ecryptfs_write_metadata
- * @ecryptfs_dentry: The eCryptfs dentry
+ * @ecryptfs_dentry: The eCryptfs dentry, which should be negative
+ * @ecryptfs_inode: The newly created eCryptfs inode
  *
  * Write the file headers out.  This will likely involve a userspace
  * callout, in which the session key is encrypted with one or more
@@ -1348,10 +1309,11 @@ static unsigned long ecryptfs_get_zeroed_pages(gfp_t gfp_mask,
  *
  * Returns zero on success; non-zero on error
  */
-int ecryptfs_write_metadata(struct dentry *ecryptfs_dentry)
+int ecryptfs_write_metadata(struct dentry *ecryptfs_dentry,
+                            struct inode *ecryptfs_inode)
 {
         struct ecryptfs_crypt_stat *crypt_stat =
-                &ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->crypt_stat;
+                &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
         unsigned int order;
         char *virt;
         size_t virt_len;
@@ -1391,7 +1353,7 @@ int ecryptfs_write_metadata(struct dentry *ecryptfs_dentry)
                 rc = ecryptfs_write_metadata_to_xattr(ecryptfs_dentry, virt,
                                                       size);
         else
-                rc = ecryptfs_write_metadata_to_contents(ecryptfs_dentry, virt,
+                rc = ecryptfs_write_metadata_to_contents(ecryptfs_inode, virt,
                                                          virt_len);
         if (rc) {
                 printk(KERN_ERR "%s: Error writing metadata out to lower file; "
@@ -1618,7 +1580,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
                 rc = ecryptfs_read_xattr_region(page_virt, ecryptfs_inode);
                 if (rc) {
                         printk(KERN_DEBUG "Valid eCryptfs headers not found in "
-                               "file header region or xattr region\n");
+                               "file header region or xattr region, inode %lu\n",
+                                ecryptfs_inode->i_ino);
                         rc = -EINVAL;
                         goto out;
                 }
@@ -1627,7 +1590,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
                                                 ECRYPTFS_DONT_VALIDATE_HEADER_SIZE);
                 if (rc) {
                         printk(KERN_DEBUG "Valid eCryptfs headers not found in "
-                               "file xattr region either\n");
+                               "file xattr region either, inode %lu\n",
+                                ecryptfs_inode->i_ino);
                         rc = -EINVAL;
                 }
                 if (crypt_stat->mount_crypt_stat->flags
@@ -1638,7 +1602,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
                                "crypto metadata only in the extended attribute "
                                "region, but eCryptfs was mounted without "
                                "xattr support enabled. eCryptfs will not treat "
-                               "this like an encrypted file.\n");
+                               "this like an encrypted file, inode %lu\n",
+                                ecryptfs_inode->i_ino);
                         rc = -EINVAL;
                 }
         }
@@ -1943,7 +1908,7 @@ static unsigned char *portable_filename_chars = ("-.0123456789ABCD"
 
 /* We could either offset on every reverse map or just pad some 0x00's
  * at the front here */
-static const unsigned char filename_rev_map[] = {
+static const unsigned char filename_rev_map[256] = {
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 7 */
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 15 */
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 23 */
@@ -1959,7 +1924,7 @@ static const unsigned char filename_rev_map[] = {
         0x00, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, /* 103 */
         0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, /* 111 */
         0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, /* 119 */
-        0x3D, 0x3E, 0x3F
+        0x3D, 0x3E, 0x3F /* 123 - 255 initialized to 0x00 */
 };
 
 /**
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 43c7c43b06f..9ce1e92c7d9 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -29,6 +29,7 @@
 #define ECRYPTFS_KERNEL_H
 
 #include <keys/user-type.h>
+#include <keys/encrypted-type.h>
 #include <linux/fs.h>
 #include <linux/fs_stack.h>
 #include <linux/namei.h>
@@ -36,125 +37,18 @@
 #include <linux/hash.h>
 #include <linux/nsproxy.h>
 #include <linux/backing-dev.h>
+#include <linux/ecryptfs.h>
 
-/* Version verification for shared data structures w/ userspace */
-#define ECRYPTFS_VERSION_MAJOR 0x00
-#define ECRYPTFS_VERSION_MINOR 0x04
-#define ECRYPTFS_SUPPORTED_FILE_VERSION 0x03
-/* These flags indicate which features are supported by the kernel
- * module; userspace tools such as the mount helper read
- * ECRYPTFS_VERSIONING_MASK from a sysfs handle in order to determine
- * how to behave. */
-#define ECRYPTFS_VERSIONING_PASSPHRASE            0x00000001
-#define ECRYPTFS_VERSIONING_PUBKEY                0x00000002
-#define ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH 0x00000004
-#define ECRYPTFS_VERSIONING_POLICY                0x00000008
-#define ECRYPTFS_VERSIONING_XATTR                 0x00000010
-#define ECRYPTFS_VERSIONING_MULTKEY               0x00000020
-#define ECRYPTFS_VERSIONING_DEVMISC               0x00000040
-#define ECRYPTFS_VERSIONING_HMAC                  0x00000080
-#define ECRYPTFS_VERSIONING_FILENAME_ENCRYPTION   0x00000100
-#define ECRYPTFS_VERSIONING_GCM                   0x00000200
-#define ECRYPTFS_VERSIONING_MASK (ECRYPTFS_VERSIONING_PASSPHRASE \
-                                  | ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH \
-                                  | ECRYPTFS_VERSIONING_PUBKEY \
-                                  | ECRYPTFS_VERSIONING_XATTR \
-                                  | ECRYPTFS_VERSIONING_MULTKEY \
-                                  | ECRYPTFS_VERSIONING_DEVMISC \
-                                  | ECRYPTFS_VERSIONING_FILENAME_ENCRYPTION)
-#define ECRYPTFS_MAX_PASSWORD_LENGTH 64
-#define ECRYPTFS_MAX_PASSPHRASE_BYTES ECRYPTFS_MAX_PASSWORD_LENGTH
-#define ECRYPTFS_SALT_SIZE 8
-#define ECRYPTFS_SALT_SIZE_HEX (ECRYPTFS_SALT_SIZE*2)
-/* The original signature size is only for what is stored on disk; all
- * in-memory representations are expanded hex, so it better adapted to
- * be passed around or referenced on the command line */
-#define ECRYPTFS_SIG_SIZE 8
-#define ECRYPTFS_SIG_SIZE_HEX (ECRYPTFS_SIG_SIZE*2)
-#define ECRYPTFS_PASSWORD_SIG_SIZE ECRYPTFS_SIG_SIZE_HEX
-#define ECRYPTFS_MAX_KEY_BYTES 64
-#define ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES 512
 #define ECRYPTFS_DEFAULT_IV_BYTES 16
-#define ECRYPTFS_FILE_VERSION 0x03
 #define ECRYPTFS_DEFAULT_EXTENT_SIZE 4096
 #define ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE 8192
 #define ECRYPTFS_DEFAULT_MSG_CTX_ELEMS 32
 #define ECRYPTFS_DEFAULT_SEND_TIMEOUT HZ
 #define ECRYPTFS_MAX_MSG_CTX_TTL (HZ*3)
-#define ECRYPTFS_MAX_PKI_NAME_BYTES 16
 #define ECRYPTFS_DEFAULT_NUM_USERS 4
 #define ECRYPTFS_MAX_NUM_USERS 32768
 #define ECRYPTFS_XATTR_NAME "user.ecryptfs"
 
-#define RFC2440_CIPHER_DES3_EDE 0x02
-#define RFC2440_CIPHER_CAST_5 0x03
-#define RFC2440_CIPHER_BLOWFISH 0x04
-#define RFC2440_CIPHER_AES_128 0x07
-#define RFC2440_CIPHER_AES_192 0x08
-#define RFC2440_CIPHER_AES_256 0x09
-#define RFC2440_CIPHER_TWOFISH 0x0a
-#define RFC2440_CIPHER_CAST_6 0x0b
-
-#define RFC2440_CIPHER_RSA 0x01
-
-/**
- * For convenience, we may need to pass around the encrypted session
- * key between kernel and userspace because the authentication token
- * may not be extractable.  For example, the TPM may not release the
- * private key, instead requiring the encrypted data and returning the
- * decrypted data.
- */
-struct ecryptfs_session_key {
-#define ECRYPTFS_USERSPACE_SHOULD_TRY_TO_DECRYPT 0x00000001
-#define ECRYPTFS_USERSPACE_SHOULD_TRY_TO_ENCRYPT 0x00000002
-#define ECRYPTFS_CONTAINS_DECRYPTED_KEY 0x00000004
-#define ECRYPTFS_CONTAINS_ENCRYPTED_KEY 0x00000008
-        u32 flags;
-        u32 encrypted_key_size;
-        u32 decrypted_key_size;
-        u8 encrypted_key[ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES];
-        u8 decrypted_key[ECRYPTFS_MAX_KEY_BYTES];
-};
-
-struct ecryptfs_password {
-        u32 password_bytes;
-        s32 hash_algo;
-        u32 hash_iterations;
-        u32 session_key_encryption_key_bytes;
-#define ECRYPTFS_PERSISTENT_PASSWORD 0x01
-#define ECRYPTFS_SESSION_KEY_ENCRYPTION_KEY_SET 0x02
-        u32 flags;
-        /* Iterated-hash concatenation of salt and passphrase */
-        u8 session_key_encryption_key[ECRYPTFS_MAX_KEY_BYTES];
-        u8 signature[ECRYPTFS_PASSWORD_SIG_SIZE + 1];
-        /* Always in expanded hex */
-        u8 salt[ECRYPTFS_SALT_SIZE];
-};
-
-enum ecryptfs_token_types {ECRYPTFS_PASSWORD, ECRYPTFS_PRIVATE_KEY};
-
-struct ecryptfs_private_key {
-        u32 key_size;
-        u32 data_len;
-        u8 signature[ECRYPTFS_PASSWORD_SIG_SIZE + 1];
-        char pki_type[ECRYPTFS_MAX_PKI_NAME_BYTES + 1];
-        u8 data[];
-};
-
-/* May be a password or a private key */
-struct ecryptfs_auth_tok {
-        u16 version; /* 8-bit major and 8-bit minor */
-        u16 token_type;
-#define ECRYPTFS_ENCRYPT_ONLY 0x00000001
-        u32 flags;
-        struct ecryptfs_session_key session_key;
-        u8 reserved[32];
-        union {
-                struct ecryptfs_password password;
-                struct ecryptfs_private_key private_key;
-        } token;
-} __attribute__ ((packed));
-
 void ecryptfs_dump_auth_tok(struct ecryptfs_auth_tok *auth_tok);
 extern void ecryptfs_to_hex(char *dst, char *src, size_t src_size);
 extern void ecryptfs_from_hex(char *dst, char *src, int dst_size);
@@ -185,11 +79,47 @@ struct ecryptfs_page_crypt_context {
         } param;
 };
 
+#if defined(CONFIG_ENCRYPTED_KEYS) || defined(CONFIG_ENCRYPTED_KEYS_MODULE)
+static inline struct ecryptfs_auth_tok *
+ecryptfs_get_encrypted_key_payload_data(struct key *key)
+{
+        if (key->type == &key_type_encrypted)
+                return (struct ecryptfs_auth_tok *)
+                        (&((struct encrypted_key_payload *)key->payload.data)->payload_data);
+        else
+                return NULL;
+}
+
+static inline struct key *ecryptfs_get_encrypted_key(char *sig)
+{
+        return request_key(&key_type_encrypted, sig, NULL);
+}
+
+#else
+static inline struct ecryptfs_auth_tok *
+ecryptfs_get_encrypted_key_payload_data(struct key *key)
+{
+        return NULL;
+}
+
+static inline struct key *ecryptfs_get_encrypted_key(char *sig)
+{
+        return ERR_PTR(-ENOKEY);
+}
+
+#endif /* CONFIG_ENCRYPTED_KEYS */
+
 static inline struct ecryptfs_auth_tok *
 ecryptfs_get_key_payload_data(struct key *key)
 {
-        return (struct ecryptfs_auth_tok *)
-                (((struct user_key_payload*)key->payload.data)->data);
+        struct ecryptfs_auth_tok *auth_tok;
+
+        auth_tok = ecryptfs_get_encrypted_key_payload_data(key);
+        if (!auth_tok)
+                return (struct ecryptfs_auth_tok *)
+                        (((struct user_key_payload *)key->payload.data)->data);
+        else
+                return auth_tok;
 }
 
 #define ECRYPTFS_MAX_KEYSET_SIZE 1024
@@ -654,9 +584,10 @@ int ecryptfs_init_crypt_ctx(struct ecryptfs_crypt_stat *crypt_stat);
 int ecryptfs_write_inode_size_to_metadata(struct inode *ecryptfs_inode);
 int ecryptfs_encrypt_page(struct page *page);
 int ecryptfs_decrypt_page(struct page *page);
-int ecryptfs_write_metadata(struct dentry *ecryptfs_dentry);
+int ecryptfs_write_metadata(struct dentry *ecryptfs_dentry,
+                            struct inode *ecryptfs_inode);
 int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry);
-int ecryptfs_new_file_context(struct dentry *ecryptfs_dentry);
+int ecryptfs_new_file_context(struct inode *ecryptfs_inode);
 void ecryptfs_write_crypt_stat_flags(char *page_virt,
                                      struct ecryptfs_crypt_stat *crypt_stat,
                                      size_t *written);
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 4ec9eb00a24..d3f95f941c4 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -139,6 +139,27 @@ out:
         return rc;
 }
 
+static void ecryptfs_vma_close(struct vm_area_struct *vma)
+{
+        filemap_write_and_wait(vma->vm_file->f_mapping);
+}
+
+static const struct vm_operations_struct ecryptfs_file_vm_ops = {
+        .close          = ecryptfs_vma_close,
+        .fault          = filemap_fault,
+};
+
+static int ecryptfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        int rc;
+
+        rc = generic_file_mmap(file, vma);
+        if (!rc)
+                vma->vm_ops = &ecryptfs_file_vm_ops;
+
+        return rc;
+}
+
 struct kmem_cache *ecryptfs_file_info_cache;
 
 /**
@@ -270,14 +291,15 @@ static int ecryptfs_release(struct inode *inode, struct file *file)
 }
 
 static int
-ecryptfs_fsync(struct file *file, int datasync)
+ecryptfs_fsync(struct file *file, loff_t start, loff_t end, int datasync)
 {
         int rc = 0;
 
-        rc = generic_file_fsync(file, datasync);
+        rc = generic_file_fsync(file, start, end, datasync);
         if (rc)
                 goto out;
-        rc = vfs_fsync(ecryptfs_file_to_lower(file), datasync);
+        rc = vfs_fsync_range(ecryptfs_file_to_lower(file), start, end,
+                             datasync);
 out:
         return rc;
 }
@@ -348,7 +370,7 @@ const struct file_operations ecryptfs_main_fops = {
 #ifdef CONFIG_COMPAT
         .compat_ioctl = ecryptfs_compat_ioctl,
 #endif
-        .mmap = generic_file_mmap,
+        .mmap = ecryptfs_file_mmap,
         .open = ecryptfs_open,
         .flush = ecryptfs_flush,
         .release = ecryptfs_release,
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 7349ade17de..19b1f9035b0 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -69,6 +69,7 @@ static int ecryptfs_inode_set(struct inode *inode, void *opaque)
         inode->i_ino = lower_inode->i_ino;
         inode->i_version++;
         inode->i_mapping->a_ops = &ecryptfs_aops;
+        inode->i_mapping->backing_dev_info = inode->i_sb->s_bdi;
 
         if (S_ISLNK(inode->i_mode))
                 inode->i_op = &ecryptfs_symlink_iops;
@@ -147,7 +148,6 @@ static int ecryptfs_interpose(struct dentry *lower_dentry,
  * @lower_dir_inode: inode of the parent in the lower fs of the new file
  * @dentry: New file's dentry
  * @mode: The mode of the new file
- * @nd: nameidata of ecryptfs' parent's dentry & vfsmount
  *
  * Creates the file in the lower file system.
  *
@@ -155,31 +155,10 @@ static int ecryptfs_interpose(struct dentry *lower_dentry,
  */
 static int
 ecryptfs_create_underlying_file(struct inode *lower_dir_inode,
-                                struct dentry *dentry, int mode,
-                                struct nameidata *nd)
+                                struct dentry *dentry, int mode)
 {
         struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
-        struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
-        struct dentry *dentry_save;
-        struct vfsmount *vfsmount_save;
-        unsigned int flags_save;
-        int rc;
-
-        if (nd) {
-                dentry_save = nd->path.dentry;
-                vfsmount_save = nd->path.mnt;
-                flags_save = nd->flags;
-                nd->path.dentry = lower_dentry;
-                nd->path.mnt = lower_mnt;
-                nd->flags &= ~LOOKUP_OPEN;
-        }
-        rc = vfs_create(lower_dir_inode, lower_dentry, mode, nd);
-        if (nd) {
-                nd->path.dentry = dentry_save;
-                nd->path.mnt = vfsmount_save;
-                nd->flags = flags_save;
-        }
-        return rc;
+        return vfs_create(lower_dir_inode, lower_dentry, mode, NULL);
 }
 
 /**
@@ -193,44 +172,43 @@ ecryptfs_create_underlying_file(struct inode *lower_dir_inode,
  * it. It will also update the eCryptfs directory inode to mimic the
  * stat of the lower directory inode.
  *
- * Returns zero on success; non-zero on error condition
+ * Returns the new eCryptfs inode on success; an ERR_PTR on error condition
  */
-static int
+static struct inode *
 ecryptfs_do_create(struct inode *directory_inode,
-                   struct dentry *ecryptfs_dentry, int mode,
-                   struct nameidata *nd)
+                   struct dentry *ecryptfs_dentry, int mode)
 {
         int rc;
         struct dentry *lower_dentry;
         struct dentry *lower_dir_dentry;
+        struct inode *inode;
 
         lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
         lower_dir_dentry = lock_parent(lower_dentry);
         if (IS_ERR(lower_dir_dentry)) {
                 ecryptfs_printk(KERN_ERR, "Error locking directory of "
                                 "dentry\n");
-                rc = PTR_ERR(lower_dir_dentry);
+                inode = ERR_CAST(lower_dir_dentry);
                 goto out;
         }
         rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode,
-                                             ecryptfs_dentry, mode, nd);
+                                             ecryptfs_dentry, mode);
         if (rc) {
                 printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
                        "rc = [%d]\n", __func__, rc);
+                inode = ERR_PTR(rc);
                 goto out_lock;
         }
-        rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
-                                directory_inode->i_sb);
-        if (rc) {
-                ecryptfs_printk(KERN_ERR, "Failure in ecryptfs_interpose\n");
+        inode = __ecryptfs_get_inode(lower_dentry->d_inode,
+                                     directory_inode->i_sb);
+        if (IS_ERR(inode))
                 goto out_lock;
-        }
         fsstack_copy_attr_times(directory_inode, lower_dir_dentry->d_inode);
         fsstack_copy_inode_size(directory_inode, lower_dir_dentry->d_inode);
 out_lock:
         unlock_dir(lower_dir_dentry);
 out:
-        return rc;
+        return inode;
 }
 
 /**
@@ -241,26 +219,26 @@ out:
  *
  * Returns zero on success
  */
-static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
+static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
+                                    struct inode *ecryptfs_inode)
 {
         struct ecryptfs_crypt_stat *crypt_stat =
-                &ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->crypt_stat;
+                &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
         int rc = 0;
 
-        if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
+        if (S_ISDIR(ecryptfs_inode->i_mode)) {
                 ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
                 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
                 goto out;
         }
         ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
-        rc = ecryptfs_new_file_context(ecryptfs_dentry);
+        rc = ecryptfs_new_file_context(ecryptfs_inode);
         if (rc) {
                 ecryptfs_printk(KERN_ERR, "Error creating new file "
                                 "context; rc = [%d]\n", rc);
                 goto out;
         }
-        rc = ecryptfs_get_lower_file(ecryptfs_dentry,
-                                     ecryptfs_dentry->d_inode);
+        rc = ecryptfs_get_lower_file(ecryptfs_dentry, ecryptfs_inode);
         if (rc) {
                 printk(KERN_ERR "%s: Error attempting to initialize "
                         "the lower file for the dentry with name "
@@ -268,10 +246,10 @@ static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
                         ecryptfs_dentry->d_name.name, rc);
                 goto out;
         }
-        rc = ecryptfs_write_metadata(ecryptfs_dentry);
+        rc = ecryptfs_write_metadata(ecryptfs_dentry, ecryptfs_inode);
         if (rc)
                 printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
-        ecryptfs_put_lower_file(ecryptfs_dentry->d_inode);
+        ecryptfs_put_lower_file(ecryptfs_inode);
 out:
         return rc;
 }
@@ -291,18 +269,28 @@ static int
 ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry,
                 int mode, struct nameidata *nd)
 {
+        struct inode *ecryptfs_inode;
         int rc;
 
-        /* ecryptfs_do_create() calls ecryptfs_interpose() */
-        rc = ecryptfs_do_create(directory_inode, ecryptfs_dentry, mode, nd);
-        if (unlikely(rc)) {
+        ecryptfs_inode = ecryptfs_do_create(directory_inode, ecryptfs_dentry,
+                                            mode);
+        if (unlikely(IS_ERR(ecryptfs_inode))) {
                 ecryptfs_printk(KERN_WARNING, "Failed to create file in"
                                 "lower filesystem\n");
+                rc = PTR_ERR(ecryptfs_inode);
                 goto out;
         }
         /* At this point, a file exists on "disk"; we need to make sure
          * that this on disk file is prepared to be an ecryptfs file */
-        rc = ecryptfs_initialize_file(ecryptfs_dentry);
+        rc = ecryptfs_initialize_file(ecryptfs_dentry, ecryptfs_inode);
+        if (rc) {
+                drop_nlink(ecryptfs_inode);
+                unlock_new_inode(ecryptfs_inode);
+                iput(ecryptfs_inode);
+                goto out;
+        }
+        d_instantiate(ecryptfs_dentry, ecryptfs_inode);
+        unlock_new_inode(ecryptfs_inode);
 out:
         return rc;
 }
@@ -853,18 +841,6 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
                 size_t num_zeros = (PAGE_CACHE_SIZE
                                     - (ia->ia_size & ~PAGE_CACHE_MASK));
 
-
-                /*
-                 * XXX(truncate) this should really happen at the begginning
-                 * of ->setattr.  But the code is too messy to that as part
-                 * of a larger patch.  ecryptfs is also totally missing out
-                 * on the inode_change_ok check at the beginning of
-                 * ->setattr while would include this.
-                 */
-                rc = inode_newsize_ok(inode, ia->ia_size);
-                if (rc)
-                        goto out;
-
                 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
                         truncate_setsize(inode, ia->ia_size);
                         lower_ia->ia_size = ia->ia_size;
@@ -914,6 +890,28 @@ out:
         return rc;
 }
 
+static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
+{
+        struct ecryptfs_crypt_stat *crypt_stat;
+        loff_t lower_oldsize, lower_newsize;
+
+        crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
+        lower_oldsize = upper_size_to_lower_size(crypt_stat,
+                                                 i_size_read(inode));
+        lower_newsize = upper_size_to_lower_size(crypt_stat, offset);
+        if (lower_newsize > lower_oldsize) {
+                /*
+                 * The eCryptfs inode and the new *lower* size are mixed here
+                 * because we may not have the lower i_mutex held and/or it may
+                 * not be appropriate to call inode_newsize_ok() with inodes
+                 * from other filesystems.
+                 */
+                return inode_newsize_ok(inode, lower_newsize);
+        }
+
+        return 0;
+}
+
 /**
  * ecryptfs_truncate
  * @dentry: The ecryptfs layer dentry
@@ -930,6 +928,10 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
         struct iattr lower_ia = { .ia_valid = 0 };
         int rc;
 
+        rc = ecryptfs_inode_newsize_ok(dentry->d_inode, new_length);
+        if (rc)
+                return rc;
+
         rc = truncate_upper(dentry, &ia, &lower_ia);
         if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
                 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
@@ -942,10 +944,8 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
 }
 
 static int
-ecryptfs_permission(struct inode *inode, int mask, unsigned int flags)
+ecryptfs_permission(struct inode *inode, int mask)
 {
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
         return inode_permission(ecryptfs_inode_to_lower(inode), mask);
 }
 
@@ -1011,6 +1011,16 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
                 }
         }
         mutex_unlock(&crypt_stat->cs_mutex);
+
+        rc = inode_change_ok(inode, ia);
+        if (rc)
+                goto out;
+        if (ia->ia_valid & ATTR_SIZE) {
+                rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);
+                if (rc)
+                        goto out;
+        }
+
         if (S_ISREG(inode->i_mode)) {
                 rc = filemap_write_and_wait(inode->i_mapping);
                 if (rc)
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 27a7fefb83e..ac1ad48c237 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1635,11 +1635,14 @@ int ecryptfs_keyring_auth_tok_for_sig(struct key **auth_tok_key,
 
         (*auth_tok_key) = request_key(&key_type_user, sig, NULL);
         if (!(*auth_tok_key) || IS_ERR(*auth_tok_key)) {
-                printk(KERN_ERR "Could not find key with description: [%s]\n",
-                       sig);
-                rc = process_request_key_err(PTR_ERR(*auth_tok_key));
-                (*auth_tok_key) = NULL;
-                goto out;
+                (*auth_tok_key) = ecryptfs_get_encrypted_key(sig);
+                if (!(*auth_tok_key) || IS_ERR(*auth_tok_key)) {
+                        printk(KERN_ERR "Could not find key with description: [%s]\n",
+                              sig);
+                        rc = process_request_key_err(PTR_ERR(*auth_tok_key));
+                        (*auth_tok_key) = NULL;
+                        goto out;
+                }
         }
         down_write(&(*auth_tok_key)->sem);
         rc = ecryptfs_verify_auth_tok_from_key(*auth_tok_key, auth_tok);
@@ -1868,11 +1871,6 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat,
          * just one will be sufficient to decrypt to get the FEK. */
 find_next_matching_auth_tok:
         found_auth_tok = 0;
-        if (auth_tok_key) {
-                up_write(&(auth_tok_key->sem));
-                key_put(auth_tok_key);
-                auth_tok_key = NULL;
-        }
         list_for_each_entry(auth_tok_list_item, &auth_tok_list, list) {
                 candidate_auth_tok = &auth_tok_list_item->auth_tok;
                 if (unlikely(ecryptfs_verbosity > 0)) {
@@ -1909,14 +1907,22 @@ found_matching_auth_tok:
                 memcpy(&(candidate_auth_tok->token.private_key),
                        &(matching_auth_tok->token.private_key),
                        sizeof(struct ecryptfs_private_key));
+                up_write(&(auth_tok_key->sem));
+                key_put(auth_tok_key);
                 rc = decrypt_pki_encrypted_session_key(candidate_auth_tok,
                                                        crypt_stat);
         } else if (candidate_auth_tok->token_type == ECRYPTFS_PASSWORD) {
                 memcpy(&(candidate_auth_tok->token.password),
                        &(matching_auth_tok->token.password),
                        sizeof(struct ecryptfs_password));
+                up_write(&(auth_tok_key->sem));
+                key_put(auth_tok_key);
                 rc = decrypt_passphrase_encrypted_session_key(
                         candidate_auth_tok, crypt_stat);
+        } else {
+                up_write(&(auth_tok_key->sem));
+                key_put(auth_tok_key);
+                rc = -EINVAL;
         }
         if (rc) {
                 struct ecryptfs_auth_tok_list_item *auth_tok_list_item_tmp;
@@ -1956,21 +1962,18 @@ found_matching_auth_tok:
 out_wipe_list:
         wipe_auth_tok_list(&auth_tok_list);
 out:
-        if (auth_tok_key) {
-                up_write(&(auth_tok_key->sem));
-                key_put(auth_tok_key);
-        }
         return rc;
 }
 
 static int
-pki_encrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
+pki_encrypt_session_key(struct key *auth_tok_key,
+                        struct ecryptfs_auth_tok *auth_tok,
                         struct ecryptfs_crypt_stat *crypt_stat,
                         struct ecryptfs_key_record *key_rec)
 {
         struct ecryptfs_msg_ctx *msg_ctx = NULL;
         char *payload = NULL;
-        size_t payload_len;
+        size_t payload_len = 0;
         struct ecryptfs_message *msg;
         int rc;
 
@@ -1979,6 +1982,8 @@ pki_encrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
                                          crypt_stat->cipher,
                                          crypt_stat->key_size),
                                  crypt_stat, &payload, &payload_len);
+        up_write(&(auth_tok_key->sem));
+        key_put(auth_tok_key);
         if (rc) {
                 ecryptfs_printk(KERN_ERR, "Error generating tag 66 packet\n");
                 goto out;
@@ -2008,6 +2013,8 @@ out:
  * write_tag_1_packet - Write an RFC2440-compatible tag 1 (public key) packet
  * @dest: Buffer into which to write the packet
  * @remaining_bytes: Maximum number of bytes that can be writtn
+ * @auth_tok_key: The authentication token key to unlock and put when done with
+ *                @auth_tok
  * @auth_tok: The authentication token used for generating the tag 1 packet
  * @crypt_stat: The cryptographic context
  * @key_rec: The key record struct for the tag 1 packet
@@ -2018,7 +2025,7 @@ out:
  */
 static int
 write_tag_1_packet(char *dest, size_t *remaining_bytes,
-                   struct ecryptfs_auth_tok *auth_tok,
+                   struct key *auth_tok_key, struct ecryptfs_auth_tok *auth_tok,
                    struct ecryptfs_crypt_stat *crypt_stat,
                    struct ecryptfs_key_record *key_rec, size_t *packet_size)
 {
@@ -2039,12 +2046,15 @@ write_tag_1_packet(char *dest, size_t *remaining_bytes,
                 memcpy(key_rec->enc_key,
                        auth_tok->session_key.encrypted_key,
                        auth_tok->session_key.encrypted_key_size);
+                up_write(&(auth_tok_key->sem));
+                key_put(auth_tok_key);
                 goto encrypted_session_key_set;
         }
         if (auth_tok->session_key.encrypted_key_size == 0)
                 auth_tok->session_key.encrypted_key_size =
                         auth_tok->token.private_key.key_size;
-        rc = pki_encrypt_session_key(auth_tok, crypt_stat, key_rec);
+        rc = pki_encrypt_session_key(auth_tok_key, auth_tok, crypt_stat,
+                                     key_rec);
         if (rc) {
                 printk(KERN_ERR "Failed to encrypt session key via a key "
                        "module; rc = [%d]\n", rc);
@@ -2248,7 +2258,7 @@ write_tag_3_packet(char *dest, size_t *remaining_bytes,
                        auth_tok->token.password.session_key_encryption_key,
                        crypt_stat->key_size);
                 ecryptfs_printk(KERN_DEBUG,
-                                "Cached session key " "encryption key: \n");
+                                "Cached session key encryption key:\n");
                 if (ecryptfs_verbosity > 0)
                         ecryptfs_dump_hex(session_key_encryption_key, 16);
         }
@@ -2421,6 +2431,8 @@ ecryptfs_generate_key_packet_set(char *dest_base,
                                                 &max, auth_tok,
                                                 crypt_stat, key_rec,
                                                 &written);
+                        up_write(&(auth_tok_key->sem));
+                        key_put(auth_tok_key);
                         if (rc) {
                                 ecryptfs_printk(KERN_WARNING, "Error "
                                                 "writing tag 3 packet\n");
@@ -2438,8 +2450,8 @@ ecryptfs_generate_key_packet_set(char *dest_base,
                         }
                         (*len) += written;
                 } else if (auth_tok->token_type == ECRYPTFS_PRIVATE_KEY) {
-                        rc = write_tag_1_packet(dest_base + (*len),
-                                                &max, auth_tok,
+                        rc = write_tag_1_packet(dest_base + (*len), &max,
+                                                auth_tok_key, auth_tok,
                                                 crypt_stat, key_rec, &written);
                         if (rc) {
                                 ecryptfs_printk(KERN_WARNING, "Error "
@@ -2448,14 +2460,13 @@ ecryptfs_generate_key_packet_set(char *dest_base,
                         }
                         (*len) += written;
                 } else {
+                        up_write(&(auth_tok_key->sem));
+                        key_put(auth_tok_key);
                         ecryptfs_printk(KERN_WARNING, "Unsupported "
                                         "authentication token type\n");
                         rc = -EINVAL;
                         goto out_free;
                 }
-                up_write(&(auth_tok_key->sem));
-                key_put(auth_tok_key);
-                auth_tok_key = NULL;
         }
         if (likely(max > 0)) {
                 dest_base[(*len)] = 0x00;
@@ -2468,11 +2479,6 @@ out_free:
 out:
         if (rc)
                 (*len) = 0;
-        if (auth_tok_key) {
-                up_write(&(auth_tok_key->sem));
-                key_put(auth_tok_key);
-        }
-
         mutex_unlock(&crypt_stat->keysig_list_mutex);
         return rc;
 }
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 9f1bb747d77..b4a6befb121 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -175,6 +175,7 @@ enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig,
        ecryptfs_opt_encrypted_view, ecryptfs_opt_fnek_sig,
        ecryptfs_opt_fn_cipher, ecryptfs_opt_fn_cipher_key_bytes,
        ecryptfs_opt_unlink_sigs, ecryptfs_opt_mount_auth_tok_only,
+       ecryptfs_opt_check_dev_ruid,
        ecryptfs_opt_err };
 
 static const match_table_t tokens = {
@@ -191,6 +192,7 @@ static const match_table_t tokens = {
         {ecryptfs_opt_fn_cipher_key_bytes, "ecryptfs_fn_key_bytes=%u"},
         {ecryptfs_opt_unlink_sigs, "ecryptfs_unlink_sigs"},
         {ecryptfs_opt_mount_auth_tok_only, "ecryptfs_mount_auth_tok_only"},
+        {ecryptfs_opt_check_dev_ruid, "ecryptfs_check_dev_ruid"},
         {ecryptfs_opt_err, NULL}
 };
 
@@ -236,6 +238,7 @@ static void ecryptfs_init_mount_crypt_stat(
  * ecryptfs_parse_options
  * @sb: The ecryptfs super block
  * @options: The options passed to the kernel
+ * @check_ruid: set to 1 if device uid should be checked against the ruid
  *
  * Parse mount options:
  * debug=N         - ecryptfs_verbosity level for debug output
@@ -251,7 +254,8 @@ static void ecryptfs_init_mount_crypt_stat(
  *
  * Returns zero on success; non-zero on error
  */
-static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
+static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options,
+                                  uid_t *check_ruid)
 {
         char *p;
         int rc = 0;
@@ -276,6 +280,8 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
         char *cipher_key_bytes_src;
         char *fn_cipher_key_bytes_src;
 
+        *check_ruid = 0;
+
         if (!options) {
                 rc = -EINVAL;
                 goto out;
@@ -380,6 +386,9 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
                         mount_crypt_stat->flags |=
                                 ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY;
                         break;
+                case ecryptfs_opt_check_dev_ruid:
+                        *check_ruid = 1;
+                        break;
                 case ecryptfs_opt_err:
                 default:
                         printk(KERN_WARNING
@@ -475,6 +484,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
         const char *err = "Getting sb failed";
         struct inode *inode;
         struct path path;
+        uid_t check_ruid;
         int rc;
 
         sbi = kmem_cache_zalloc(ecryptfs_sb_info_cache, GFP_KERNEL);
@@ -483,7 +493,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
                 goto out;
         }
 
-        rc = ecryptfs_parse_options(sbi, raw_data);
+        rc = ecryptfs_parse_options(sbi, raw_data, &check_ruid);
         if (rc) {
                 err = "Error parsing options";
                 goto out;
@@ -521,6 +531,15 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
                         "known incompatibilities\n");
                 goto out_free;
         }
+
+        if (check_ruid && path.dentry->d_inode->i_uid != current_uid()) {
+                rc = -EPERM;
+                printk(KERN_ERR "Mount of device (uid: %d) not owned by "
+                       "requested user (uid: %d)\n",
+                       path.dentry->d_inode->i_uid, current_uid());
+                goto out_free;
+        }
+
         ecryptfs_set_superblock_lower(s, path.dentry->d_sb);
         s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
         s->s_blocksize = path.dentry->d_sb->s_blocksize;
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 940a82e63dc..0dc5a3d554a 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -409,11 +409,47 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
         ssize_t sz = 0;
         char *data;
         uid_t euid = current_euid();
+        unsigned char packet_size_peek[3];
         int rc;
 
-        if (count == 0)
+        if (count == 0) {
                 goto out;
+        } else if (count == (1 + 4)) {
+                /* Likely a harmless MSG_HELO or MSG_QUIT - no packet length */
+                goto memdup;
+        } else if (count < (1 + 4 + 1)
+                   || count > (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
+                               + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES)) {
+                printk(KERN_WARNING "%s: Acceptable packet size range is "
+                       "[%d-%lu], but amount of data written is [%zu].",
+                       __func__, (1 + 4 + 1),
+                       (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
+                        + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES), count);
+                return -EINVAL;
+        }
+
+        if (copy_from_user(packet_size_peek, (buf + 1 + 4),
+                           sizeof(packet_size_peek))) {
+                printk(KERN_WARNING "%s: Error while inspecting packet size\n",
+                       __func__);
+                return -EFAULT;
+        }
+
+        rc = ecryptfs_parse_packet_length(packet_size_peek, &packet_size,
+                                          &packet_size_length);
+        if (rc) {
+                printk(KERN_WARNING "%s: Error parsing packet length; "
+                       "rc = [%d]\n", __func__, rc);
+                return rc;
+        }
+
+        if ((1 + 4 + packet_size_length + packet_size) != count) {
+                printk(KERN_WARNING "%s: Invalid packet size [%zu]\n", __func__,
+                       packet_size);
+                return -EINVAL;
+        }
 
+memdup:
         data = memdup_user(buf, count);
         if (IS_ERR(data)) {
                 printk(KERN_ERR "%s: memdup_user returned error [%ld]\n",
@@ -435,23 +471,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
                 }
                 memcpy(&counter_nbo, &data[i], 4);
                 seq = be32_to_cpu(counter_nbo);
-                i += 4;
-                rc = ecryptfs_parse_packet_length(&data[i], &packet_size,
-                                                  &packet_size_length);
-                if (rc) {
-                        printk(KERN_WARNING "%s: Error parsing packet length; "
-                               "rc = [%d]\n", __func__, rc);
-                        goto out_free;
-                }
-                i += packet_size_length;
-                if ((1 + 4 + packet_size_length + packet_size) != count) {
-                        printk(KERN_WARNING "%s: (1 + packet_size_length([%zd])"
-                               " + packet_size([%zd]))([%zd]) != "
-                               "count([%zd]). Invalid packet format.\n",
-                               __func__, packet_size_length, packet_size,
-                               (1 + packet_size_length + packet_size), count);
-                        goto out_free;
-                }
+                i += 4 + packet_size_length;
                 rc = ecryptfs_miscdev_response(&data[i], packet_size,
                                                euid, current_user_ns(),
                                                task_pid(current), seq);
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index 85d43096311..54eb14caad7 100644
--- a/fs/ecryptfs/read_write.c
+++ b/fs/ecryptfs/read_write.c
@@ -39,15 +39,16 @@
 int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
                          loff_t offset, size_t size)
 {
-        struct ecryptfs_inode_info *inode_info;
+        struct file *lower_file;
         mm_segment_t fs_save;
         ssize_t rc;
 
-        inode_info = ecryptfs_inode_to_private(ecryptfs_inode);
-        BUG_ON(!inode_info->lower_file);
+        lower_file = ecryptfs_inode_to_private(ecryptfs_inode)->lower_file;
+        if (!lower_file)
+                return -EIO;
         fs_save = get_fs();
         set_fs(get_ds());
-        rc = vfs_write(inode_info->lower_file, data, size, &offset);
+        rc = vfs_write(lower_file, data, size, &offset);
         set_fs(fs_save);
         mark_inode_dirty_sync(ecryptfs_inode);
         return rc;
@@ -131,6 +132,11 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
                 size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
                 size_t total_remaining_bytes = ((offset + size) - pos);
 
+                if (fatal_signal_pending(current)) {
+                        rc = -EINTR;
+                        break;
+                }
+
                 if (num_bytes > total_remaining_bytes)
                         num_bytes = total_remaining_bytes;
                 if (pos < offset) {
@@ -192,15 +198,19 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
                 }
                 pos += num_bytes;
         }
-        if ((offset + size) > ecryptfs_file_size) {
-                i_size_write(ecryptfs_inode, (offset + size));
+        if (pos > ecryptfs_file_size) {
+                i_size_write(ecryptfs_inode, pos);
                 if (crypt_stat->flags & ECRYPTFS_ENCRYPTED) {
-                        rc = ecryptfs_write_inode_size_to_metadata(
+                        int rc2;
+
+                        rc2 = ecryptfs_write_inode_size_to_metadata(
                                                                 ecryptfs_inode);
-                        if (rc) {
+                        if (rc2) {
                                 printk(KERN_ERR "Problem with "
                                        "ecryptfs_write_inode_size_to_metadata; "
-                                       "rc = [%d]\n", rc);
+                                       "rc = [%d]\n", rc2);
+                                if (!rc)
+                                        rc = rc2;
                                 goto out;
                         }
                 }
@@ -225,15 +235,16 @@ out:
 int ecryptfs_read_lower(char *data, loff_t offset, size_t size,
                         struct inode *ecryptfs_inode)
 {
-        struct ecryptfs_inode_info *inode_info =
-                ecryptfs_inode_to_private(ecryptfs_inode);
+        struct file *lower_file;
         mm_segment_t fs_save;
         ssize_t rc;
 
-        BUG_ON(!inode_info->lower_file);
+        lower_file = ecryptfs_inode_to_private(ecryptfs_inode)->lower_file;
+        if (!lower_file)
+                return -EIO;
         fs_save = get_fs();
         set_fs(get_ds());
-        rc = vfs_read(inode_info->lower_file, data, size, &offset);
+        rc = vfs_read(lower_file, data, size, &offset);
         set_fs(fs_save);
         return rc;
 }