Merge commit 'v2.6.26' into bkl-removal

26 files changed, 773 insertions, 653 deletions

diff --git a/fs/cifs/AUTHORS b/fs/cifs/AUTHORS
index 8848e4dfa026..9c136d7803d9 100644
--- a/fs/cifs/AUTHORS
+++ b/fs/cifs/AUTHORS
@@ -36,6 +36,7 @@ Miklos Szeredi
 Kazeon team for various fixes especially for 2.4 version.
 Asser Ferno (Change Notify support)
 Shaggy (Dave Kleikamp) for inumerable small fs suggestions and some good cleanup
+Igor Mammedov (DFS support)
 
 Test case and Bug Report contributors
 -------------------------------------
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 8355e918fddf..1f3465201fdf 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,5 +1,12 @@
 Version 1.53
 ------------
+DFS support added (Microsoft Distributed File System client support needed
+for referrals which enable a hierarchical name space among servers).
+Disable temporary caching of mode bits to servers which do not support
+storing of mode (e.g. Windows servers, when client mounts without cifsacl
+mount option) and add new "dynperm" mount option to enable temporary caching
+of mode (enable old behavior).  Fix hang on mount caused when server crashes
+tcp session during negotiate protocol.
 
 Version 1.52
 ------------
@@ -12,7 +19,8 @@ Add ability to modify cifs acls for handling chmod (when mounted with
 cifsacl flag). Fix prefixpath path separator so we can handle mounts
 with prefixpaths longer than one directory (one path component) when
 mounted to Windows servers.  Fix slow file open when cifsacl
-enabled.
+enabled. Fix memory leak in FindNext when the SMB call returns -EBADF.
+
 
 Version 1.51
 ------------
diff --git a/fs/cifs/README b/fs/cifs/README
index 621aa1a85971..2bd6fe556f88 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -483,6 +483,11 @@ A partial list of the supported mount options follows:
  sign           Must use packet signing (helps avoid unwanted data modification
                 by intermediate systems in the route).  Note that signing
                 does not work with lanman or plaintext authentication.
+ seal           Must seal (encrypt) all data on this mounted share before
+                sending on the network.  Requires support for Unix Extensions.
+                Note that this differs from the sign mount option in that it
+                causes encryption of data sent over this mounted share but other
+                shares mounted to the same server are unaffected.
  sec            Security mode.  Allowed values are:
                         none    attempt to connection as a null user (no name)
                         krb5    Use Kerberos version 5 authentication
diff --git a/fs/cifs/TODO b/fs/cifs/TODO
index 92c9feac440f..5aff46c61e52 100644
--- a/fs/cifs/TODO
+++ b/fs/cifs/TODO
@@ -1,4 +1,4 @@
-Version 1.52 January 3, 2008
+Version 1.53 May 20, 2008
 
 A Partial List of Missing Features
 ==================================
@@ -20,20 +20,21 @@ d) Cleanup now unneeded SessSetup code in
 fs/cifs/connect.c and add back in NTLMSSP code if any servers
 need it
 
-e) ms-dfs and ms-dfs host name resolution cleanup
-
-f) fix NTLMv2 signing when two mounts with different users to same
+e) fix NTLMv2 signing when two mounts with different users to same
 server.
 
-g) Directory entry caching relies on a 1 second timer, rather than 
+f) Directory entry caching relies on a 1 second timer, rather than 
 using FindNotify or equivalent.  - (started)
 
-h) quota support (needs minor kernel change since quota calls
+g) quota support (needs minor kernel change since quota calls
 to make it to network filesystems or deviceless filesystems)
 
-i) investigate sync behavior (including syncpage) and check  
+h) investigate sync behavior (including syncpage) and check  
 for proper behavior of intr/nointr
 
+i) improve support for very old servers (OS/2 and Win9x for example)
+Including support for changing the time remotely (utimes command).
+
 j) hook lower into the sockets api (as NFS/SunRPC does) to avoid the
 extra copy in/out of the socket buffers in some cases.
 
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index cb52cbbe45ff..f58e41d3ba48 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -186,6 +186,11 @@ asn1_length_decode(struct asn1_ctx *ctx, unsigned int *def, unsigned int *len)
                         }
                 }
         }
+
+        /* don't trust len bigger than ctx buffer */
+        if (*len > ctx->end - ctx->pointer)
+                return 0;
+
         return 1;
 }
 
@@ -203,6 +208,10 @@ asn1_header_decode(struct asn1_ctx *ctx,
         if (!asn1_length_decode(ctx, &def, &len))
                 return 0;
 
+        /* primitive shall be definite, indefinite shall be constructed */
+        if (*con == ASN1_PRI && !def)
+                return 0;
+
         if (def)
                 *eoc = ctx->pointer + len;
         else
@@ -389,6 +398,11 @@ asn1_oid_decode(struct asn1_ctx *ctx,
         unsigned long *optr;
 
         size = eoc - ctx->pointer + 1;
+
+        /* first subid actually encodes first two subids */
+        if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
+                return 0;
+
         *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
         if (*oid == NULL)
                 return 0;
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index f6fdecf6598c..d82374c9e329 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -219,53 +219,6 @@ static struct vfsmount *cifs_dfs_do_refmount(const struct vfsmount *mnt_parent,
 
 }
 
-static char *build_full_dfs_path_from_dentry(struct dentry *dentry)
-{
-        char *full_path = NULL;
-        char *search_path;
-        char *tmp_path;
-        size_t l_max_len;
-        struct cifs_sb_info *cifs_sb;
-
-        if (dentry->d_inode == NULL)
-                return NULL;
-
-        cifs_sb = CIFS_SB(dentry->d_inode->i_sb);
-
-        if (cifs_sb->tcon == NULL)
-                return NULL;
-
-        search_path = build_path_from_dentry(dentry);
-        if (search_path == NULL)
-                return NULL;
-
-        if (cifs_sb->tcon->Flags & SMB_SHARE_IS_IN_DFS) {
-                int i;
-                /* we should use full path name for correct working with DFS */
-                l_max_len = strnlen(cifs_sb->tcon->treeName, MAX_TREE_SIZE+1) +
-                                        strnlen(search_path, MAX_PATHCONF) + 1;
-                tmp_path = kmalloc(l_max_len, GFP_KERNEL);
-                if (tmp_path == NULL) {
-                        kfree(search_path);
-                        return NULL;
-                }
-                strncpy(tmp_path, cifs_sb->tcon->treeName, l_max_len);
-                tmp_path[l_max_len-1] = 0;
-                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)
-                        for (i = 0; i < l_max_len; i++) {
-                                if (tmp_path[i] == '\\')
-                                        tmp_path[i] = '/';
-                        }
-                strncat(tmp_path, search_path, l_max_len - strlen(tmp_path));
-
-                full_path = tmp_path;
-                kfree(search_path);
-        } else {
-                full_path = search_path;
-        }
-        return full_path;
-}
-
 static int add_mount_helper(struct vfsmount *newmnt, struct nameidata *nd,
                                 struct list_head *mntlist)
 {
@@ -333,7 +286,7 @@ cifs_dfs_follow_mountpoint(struct dentry *dentry, struct nameidata *nd)
                 goto out_err;
         }
 
-        full_path = build_full_dfs_path_from_dentry(dentry);
+        full_path = build_path_from_dentry(dentry);
         if (full_path == NULL) {
                 rc = -ENOMEM;
                 goto out_err;
diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h
index 8ad2330ba061..877c85409f1f 100644
--- a/fs/cifs/cifs_fs_sb.h
+++ b/fs/cifs/cifs_fs_sb.h
@@ -30,6 +30,7 @@
 #define CIFS_MOUNT_CIFS_ACL     0x200 /* send ACL requests to non-POSIX srv   */
 #define CIFS_MOUNT_OVERR_UID    0x400 /* override uid returned from server    */
 #define CIFS_MOUNT_OVERR_GID    0x800 /* override gid returned from server    */
+#define CIFS_MOUNT_DYNPERM      0x1000 /* allow in-memory only mode setting */
 
 struct cifs_sb_info {
         struct cifsTconInfo *tcon;      /* primary mount */
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 6653e29637a7..7013aaff6aed 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -119,6 +119,9 @@ cifs_get_spnego_key(struct cifsSesInfo *sesInfo)
         dp = description + strlen(description);
         sprintf(dp, ";uid=0x%x", sesInfo->linux_uid);
 
+        dp = description + strlen(description);
+        sprintf(dp, ";user=%s", sesInfo->userName);
+
         cFYI(1, ("key description = %s", description));
         spnego_key = request_key(&cifs_spnego_key_type, description, "");
 
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 34902cff5400..0e9fc2ba90ee 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -34,11 +34,11 @@
 static struct cifs_wksid wksidarr[NUM_WK_SIDS] = {
         {{1, 0, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }, "null user"},
         {{1, 1, {0, 0, 0, 0, 0, 1}, {0, 0, 0, 0, 0} }, "nobody"},
-        {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"},
-        {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(18), 0, 0, 0, 0} }, "sys"},
-        {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(544), 0, 0, 0} }, "root"},
-        {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(545), 0, 0, 0} }, "users"},
-        {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(546), 0, 0, 0} }, "guest"} }
+        {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"},
+        {{1, 1, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(18), 0, 0, 0, 0} }, "sys"},
+        {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(544), 0, 0, 0} }, "root"},
+        {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(545), 0, 0, 0} }, "users"},
+        {{1, 2, {0, 0, 0, 0, 0, 5}, {__constant_cpu_to_le32(32), __constant_cpu_to_le32(546), 0, 0, 0} }, "guest"} }
 ;
 
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index aeff0fe5b6b9..22857c639df5 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/cifsfs.c
  *
- *   Copyright (C) International Business Machines  Corp., 2002,2007
+ *   Copyright (C) International Business Machines  Corp., 2002,2008
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   Common Internet FileSystem (CIFS) client
@@ -97,9 +97,6 @@ cifs_read_super(struct super_block *sb, void *data,
 {
         struct inode *inode;
         struct cifs_sb_info *cifs_sb;
-#ifdef CONFIG_CIFS_DFS_UPCALL
-        int len;
-#endif
         int rc = 0;
 
         /* BB should we make this contingent on mount parm? */
@@ -117,15 +114,17 @@ cifs_read_super(struct super_block *sb, void *data,
          * complex operation (mount), and in case of fail
          * just exit instead of doing mount and attempting
          * undo it if this copy fails?*/
-        len = strlen(data);
-        cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
-        if (cifs_sb->mountdata == NULL) {
-                kfree(sb->s_fs_info);
-                sb->s_fs_info = NULL;
-                return -ENOMEM;
+        if (data) {
+                int len = strlen(data);
+                cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
+                if (cifs_sb->mountdata == NULL) {
+                        kfree(sb->s_fs_info);
+                        sb->s_fs_info = NULL;
+                        return -ENOMEM;
+                }
+                strncpy(cifs_sb->mountdata, data, len + 1);
+                cifs_sb->mountdata[len] = '\0';
         }
-        strncpy(cifs_sb->mountdata, data, len + 1);
-        cifs_sb->mountdata[len] = '\0';
 #endif
 
         rc = cifs_mount(sb, cifs_sb, data, devname);
@@ -353,9 +352,41 @@ cifs_show_options(struct seq_file *s, struct vfsmount *m)
                         if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID) ||
                            !(cifs_sb->tcon->unix_ext))
                                 seq_printf(s, ",gid=%d", cifs_sb->mnt_gid);
+                        if (!cifs_sb->tcon->unix_ext) {
+                                seq_printf(s, ",file_mode=0%o,dir_mode=0%o",
+                                           cifs_sb->mnt_file_mode,
+                                           cifs_sb->mnt_dir_mode);
+                        }
+                        if (cifs_sb->tcon->seal)
+                                seq_printf(s, ",seal");
+                        if (cifs_sb->tcon->nocase)
+                                seq_printf(s, ",nocase");
+                        if (cifs_sb->tcon->retry)
+                                seq_printf(s, ",hard");
                 }
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)
                         seq_printf(s, ",posixpaths");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)
+                        seq_printf(s, ",setuids");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)
+                        seq_printf(s, ",serverino");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DIRECT_IO)
+                        seq_printf(s, ",directio");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
+                        seq_printf(s, ",nouser_xattr");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR)
+                        seq_printf(s, ",mapchars");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)
+                        seq_printf(s, ",sfu");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_BRL)
+                        seq_printf(s, ",nobrl");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL)
+                        seq_printf(s, ",cifsacl");
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)
+                        seq_printf(s, ",dynperm");
+                if (m->mnt_sb->s_flags & MS_POSIXACL)
+                        seq_printf(s, ",acl");
+
                 seq_printf(s, ",rsize=%d", cifs_sb->rsize);
                 seq_printf(s, ",wsize=%d", cifs_sb->wsize);
         }
@@ -657,7 +688,7 @@ const struct file_operations cifs_file_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
 #ifdef CONFIG_CIFS_POSIX
-        .ioctl  = cifs_ioctl,
+        .unlocked_ioctl = cifs_ioctl,
 #endif /* CONFIG_CIFS_POSIX */
 
 #ifdef CONFIG_CIFS_EXPERIMENTAL
@@ -677,7 +708,7 @@ const struct file_operations cifs_file_direct_ops = {
         .flush = cifs_flush,
         .splice_read = generic_file_splice_read,
 #ifdef CONFIG_CIFS_POSIX
-        .ioctl  = cifs_ioctl,
+        .unlocked_ioctl  = cifs_ioctl,
 #endif /* CONFIG_CIFS_POSIX */
         .llseek = cifs_llseek,
 #ifdef CONFIG_CIFS_EXPERIMENTAL
@@ -697,7 +728,7 @@ const struct file_operations cifs_file_nobrl_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
 #ifdef CONFIG_CIFS_POSIX
-        .ioctl  = cifs_ioctl,
+        .unlocked_ioctl = cifs_ioctl,
 #endif /* CONFIG_CIFS_POSIX */
 
 #ifdef CONFIG_CIFS_EXPERIMENTAL
@@ -716,7 +747,7 @@ const struct file_operations cifs_file_direct_nobrl_ops = {
         .flush = cifs_flush,
         .splice_read = generic_file_splice_read,
 #ifdef CONFIG_CIFS_POSIX
-        .ioctl  = cifs_ioctl,
+        .unlocked_ioctl  = cifs_ioctl,
 #endif /* CONFIG_CIFS_POSIX */
         .llseek = cifs_llseek,
 #ifdef CONFIG_CIFS_EXPERIMENTAL
@@ -731,7 +762,7 @@ const struct file_operations cifs_dir_ops = {
 #ifdef CONFIG_CIFS_EXPERIMENTAL
         .dir_notify = cifs_dir_notify,
 #endif /* CONFIG_CIFS_EXPERIMENTAL */
-        .ioctl  = cifs_ioctl,
+        .unlocked_ioctl  = cifs_ioctl,
 };
 
 static void
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index cd1301a09b3b..25a6cbd15529 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -95,8 +95,7 @@ extern int 	cifs_setxattr(struct dentry *, const char *, const void *,
                         size_t, int);
 extern ssize_t  cifs_getxattr(struct dentry *, const char *, void *, size_t);
 extern ssize_t  cifs_listxattr(struct dentry *, char *, size_t);
-extern int cifs_ioctl(struct inode *inode, struct file *filep,
-                       unsigned int command, unsigned long arg);
+extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 
 #ifdef CONFIG_CIFS_EXPERIMENTAL
 extern const struct export_operations cifs_export_ops;
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index b7d9f698e63e..9cfcf326ead3 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -281,6 +281,7 @@ struct cifsTconInfo {
         bool ipc:1;             /* set if connection to IPC$ eg for RPC/PIPES */
         bool retry:1;
         bool nocase:1;
+        bool seal:1;      /* transport encryption for this mounted share */
         bool unix_ext:1;  /* if false disable Linux extensions to CIFS protocol
                                 for this mount even if server would support */
         /* BB add field for back pointer to sb struct(s)? */
@@ -332,7 +333,6 @@ struct cifsFileInfo {
         bool messageMode:1;     /* for pipes: message vs byte mode */
         atomic_t wrtPending;   /* handle in use - defer close */
         struct semaphore fh_sem; /* prevents reopen race after dead ses*/
-        char *search_resume_name; /* BB removeme BB */
         struct cifs_search_info srch_inf;
 };
 
@@ -625,7 +625,7 @@ GLOBAL_EXTERN atomic_t tcpSesAllocCount;
 GLOBAL_EXTERN atomic_t tcpSesReconnectCount;
 GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
 
-/* Various Debug counters to remove someday (BB) */
+/* Various Debug counters */
 GLOBAL_EXTERN atomic_t bufAllocCount;    /* current number allocated  */
 #ifdef CONFIG_CIFS_STATS2
 GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index c43bf4b7a556..0f327c224da3 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -79,6 +79,19 @@
 #define TRANS2_GET_DFS_REFERRAL       0x10
 #define TRANS2_REPORT_DFS_INCOSISTENCY 0x11
 
+/* SMB Transact (Named Pipe) subcommand codes */
+#define TRANS_SET_NMPIPE_STATE      0x0001
+#define TRANS_RAW_READ_NMPIPE       0x0011
+#define TRANS_QUERY_NMPIPE_STATE    0x0021
+#define TRANS_QUERY_NMPIPE_INFO     0x0022
+#define TRANS_PEEK_NMPIPE           0x0023
+#define TRANS_TRANSACT_NMPIPE       0x0026
+#define TRANS_RAW_WRITE_NMPIPE      0x0031
+#define TRANS_READ_NMPIPE           0x0036
+#define TRANS_WRITE_NMPIPE          0x0037
+#define TRANS_WAIT_NMPIPE           0x0053
+#define TRANS_CALL_NMPIPE           0x0054
+
 /* NT Transact subcommand codes */
 #define NT_TRANSACT_CREATE            0x01
 #define NT_TRANSACT_IOCTL             0x02
@@ -328,12 +341,13 @@
 #define CREATE_COMPLETE_IF_OPLK 0x00000100      /* should be zero */
 #define CREATE_NO_EA_KNOWLEDGE  0x00000200
 #define CREATE_EIGHT_DOT_THREE  0x00000400      /* doc says this is obsolete
-                                                 open for recovery flag - should
-                                                 be zero */
+                                                 "open for recovery" flag - should
+                                                 be zero in any case */
+#define CREATE_OPEN_FOR_RECOVERY 0x00000400
 #define CREATE_RANDOM_ACCESS    0x00000800
 #define CREATE_DELETE_ON_CLOSE  0x00001000
 #define CREATE_OPEN_BY_ID       0x00002000
-#define CREATE_OPEN_BACKUP_INTN 0x00004000
+#define CREATE_OPEN_BACKUP_INTENT 0x00004000
 #define CREATE_NO_COMPRESSION   0x00008000
 #define CREATE_RESERVE_OPFILTER 0x00100000      /* should be zero */
 #define OPEN_REPARSE_POINT      0x00200000
@@ -722,7 +736,6 @@ typedef struct smb_com_tconx_rsp_ext {
 #define SMB_CSC_CACHE_AUTO_REINT   0x0004
 #define SMB_CSC_CACHE_VDO          0x0008
 #define SMB_CSC_NO_CACHING         0x000C
-
 #define SMB_UNIQUE_FILE_NAME    0x0010
 #define SMB_EXTENDED_SIGNATURES 0x0020
 
@@ -806,7 +819,7 @@ typedef struct smb_com_findclose_req {
 #define ICOUNT_MASK             0x00FF
 #define PIPE_READ_MODE          0x0100
 #define NAMED_PIPE_TYPE         0x0400
-#define PIPE_END_POINT          0x0800
+#define PIPE_END_POINT          0x4000
 #define BLOCKING_NAMED_PIPE     0x8000
 
 typedef struct smb_com_open_req {       /* also handles create */
@@ -1904,19 +1917,26 @@ typedef struct smb_com_transaction2_get_dfs_refer_req {
         char RequestFileName[1];
 } __attribute__((packed)) TRANSACTION2_GET_DFS_REFER_REQ;
 
+#define DFS_VERSION cpu_to_le16(0x0003)
+
+/* DFS server target type */
+#define DFS_TYPE_LINK 0x0000  /* also for sysvol targets */
+#define DFS_TYPE_ROOT 0x0001
+ 
+/* Referral Entry Flags */
+#define DFS_NAME_LIST_REF 0x0200
+
 typedef struct dfs_referral_level_3 {
         __le16 VersionNumber;
-        __le16 ReferralSize;
-        __le16 ServerType;      /* 0x0001 = CIFS server */
-        __le16 ReferralFlags;   /* or proximity - not clear which since it is
-                                   always set to zero - SNIA spec says 0x01
-                                   means strip off PathConsumed chars before
-                                   submitting RequestFileName to remote node */
-        __le16 TimeToLive;
-        __le16 Proximity;
+        __le16 Size;
+        __le16 ServerType; /* 0x0001 = root targets; 0x0000 = link targets */
+        __le16 ReferralEntryFlags; /* 0x0200 bit set only for domain
+                                      or DC referral responce */
+        __le32 TimeToLive;
         __le16 DfsPathOffset;
         __le16 DfsAlternatePathOffset;
-        __le16 NetworkAddressOffset;
+        __le16 NetworkAddressOffset; /* offset of the link target */
+        __le16 ServiceSiteGuid;
 } __attribute__((packed)) REFERRAL3;
 
 typedef struct smb_com_transaction_get_dfs_refer_rsp {
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index d481f6c5a2be..b9f5e935f821 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -93,7 +93,7 @@ extern struct timespec cnvrtDosUnixTm(__u16 date, __u16 time);
 
 extern int cifs_get_inode_info(struct inode **pinode,
                         const unsigned char *search_path,
-                        FILE_ALL_INFO * pfile_info,
+                        FILE_ALL_INFO *pfile_info,
                         struct super_block *sb, int xid, const __u16 *pfid);
 extern int cifs_get_inode_info_unix(struct inode **pinode,
                         const unsigned char *search_path,
@@ -130,7 +130,7 @@ extern int CIFSFindClose(const int, struct cifsTconInfo *tcon,
 
 extern int CIFSSMBQPathInfo(const int xid, struct cifsTconInfo *tcon,
                         const unsigned char *searchName,
-                        FILE_ALL_INFO * findData,
+                        FILE_ALL_INFO *findData,
                         int legacy /* whether to use old info level */,
                         const struct nls_table *nls_codepage, int remap);
 extern int SMBQueryInformation(const int xid, struct cifsTconInfo *tcon,
@@ -141,18 +141,15 @@ extern int SMBQueryInformation(const int xid, struct cifsTconInfo *tcon,
 extern int CIFSSMBUnixQPathInfo(const int xid,
                         struct cifsTconInfo *tcon,
                         const unsigned char *searchName,
-                        FILE_UNIX_BASIC_INFO * pFindData,
+                        FILE_UNIX_BASIC_INFO *pFindData,
                         const struct nls_table *nls_codepage, int remap);
 
 extern int CIFSGetDFSRefer(const int xid, struct cifsSesInfo *ses,
                         const unsigned char *searchName,
-                        unsigned char **targetUNCs,
-                        unsigned int *number_of_UNC_in_array,
+                        struct dfs_info3_param **target_nodes,
+                        unsigned int *number_of_nodes_in_array,
                         const struct nls_table *nls_codepage, int remap);
 
-extern int connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
-                        const char *old_path,
-                        const struct nls_table *nls_codepage, int remap);
 extern int get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
                         const char *old_path,
                         const struct nls_table *nls_codepage,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 95fbba4ea7d4..4511b708f0f3 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -81,6 +81,40 @@ static struct {
 #endif /* CONFIG_CIFS_WEAK_PW_HASH */
 #endif /* CIFS_POSIX */
 
+/* Allocates buffer into dst and copies smb string from src to it.
+ * caller is responsible for freeing dst if function returned 0.
+ * returns:
+ *      on success - 0
+ *      on failure - errno
+ */
+static int
+cifs_strncpy_to_host(char **dst, const char *src, const int maxlen,
+                 const bool is_unicode, const struct nls_table *nls_codepage)
+{
+        int plen;
+
+        if (is_unicode) {
+                plen = UniStrnlen((wchar_t *)src, maxlen);
+                *dst = kmalloc(plen + 2, GFP_KERNEL);
+                if (!*dst)
+                        goto cifs_strncpy_to_host_ErrExit;
+                cifs_strfromUCS_le(*dst, (__le16 *)src, plen, nls_codepage);
+        } else {
+                plen = strnlen(src, maxlen);
+                *dst = kmalloc(plen + 2, GFP_KERNEL);
+                if (!*dst)
+                        goto cifs_strncpy_to_host_ErrExit;
+                strncpy(*dst, src, plen);
+        }
+        (*dst)[plen] = 0;
+        (*dst)[plen+1] = 0; /* harmless for ASCII case, needed for Unicode */
+        return 0;
+
+cifs_strncpy_to_host_ErrExit:
+        cERROR(1, ("Failed to allocate buffer for string\n"));
+        return -ENOMEM;
+}
+
 
 /* Mark as invalid, all open files on tree connections since they
    were closed when session to server was lost */
@@ -1166,6 +1200,20 @@ static __u16 convert_disposition(int disposition)
         return ofun;
 }
 
+static int
+access_flags_to_smbopen_mode(const int access_flags)
+{
+        int masked_flags = access_flags & (GENERIC_READ | GENERIC_WRITE);
+
+        if (masked_flags == GENERIC_READ)
+                return SMBOPEN_READ;
+        else if (masked_flags == GENERIC_WRITE)
+                return SMBOPEN_WRITE;
+
+        /* just go for read/write */
+        return SMBOPEN_READWRITE;
+}
+
 int
 SMBLegacyOpen(const int xid, struct cifsTconInfo *tcon,
             const char *fileName, const int openDisposition,
@@ -1207,13 +1255,7 @@ OldOpenRetry:
                 pSMB->OpenFlags = cpu_to_le16(REQ_BATCHOPLOCK);
 
         pSMB->OpenFlags |= cpu_to_le16(REQ_MORE_INFO);
-        /* BB fixme add conversion for access_flags to bits 0 - 2 of mode */
-        /* 0 = read
-           1 = write
-           2 = rw
-           3 = execute
-         */
-        pSMB->Mode = cpu_to_le16(2);
+        pSMB->Mode = cpu_to_le16(access_flags_to_smbopen_mode(access_flags));
         pSMB->Mode |= cpu_to_le16(0x40); /* deny none */
         /* set file as system file if special file such
            as fifo and server expecting SFU style and
@@ -1247,7 +1289,7 @@ OldOpenRetry:
         } else {
         /* BB verify if wct == 15 */
 
-/*              *pOplock = pSMBr->OplockLevel; */  /* BB take from action field BB */
+/*              *pOplock = pSMBr->OplockLevel; */ /* BB take from action field*/
 
                 *netfid = pSMBr->Fid;   /* cifs fid stays in le */
                 /* Let caller know file was created so we can set the mode. */
@@ -1686,7 +1728,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
 {
         int rc = 0;
         LOCK_REQ *pSMB = NULL;
-        LOCK_RSP *pSMBr = NULL;
+/*      LOCK_RSP *pSMBr = NULL; */ /* No response data other than rc to parse */
         int bytes_returned;
         int timeout = 0;
         __u16 count;
@@ -1697,8 +1739,6 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
         if (rc)
                 return rc;
 
-        pSMBr = (LOCK_RSP *)pSMB; /* BB removeme BB */
-
         if (lockType == LOCKING_ANDX_OPLOCK_RELEASE) {
                 timeout = CIFS_ASYNC_OP; /* no response expected */
                 pSMB->Timeout = 0;
@@ -1732,7 +1772,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
 
         if (waitFlag) {
                 rc = SendReceiveBlockingLock(xid, tcon, (struct smb_hdr *) pSMB,
-                        (struct smb_hdr *) pSMBr, &bytes_returned);
+                        (struct smb_hdr *) pSMB, &bytes_returned);
                 cifs_small_buf_release(pSMB);
         } else {
                 rc = SendReceiveNoRsp(xid, tcon->ses, (struct smb_hdr *)pSMB,
@@ -1767,7 +1807,7 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
         cFYI(1, ("Posix Lock"));
 
         if (pLockData == NULL)
-                return EINVAL;
+                return -EINVAL;
 
         rc = small_smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB);
 
@@ -1944,7 +1984,7 @@ renameRetry:
         /* protocol requires ASCII signature byte on Unicode string */
                 pSMB->OldFileName[name_len + 1] = 0x00;
                 name_len2 =
-                    cifsConvertToUCS((__le16 *) &pSMB->OldFileName[name_len + 2],
+                    cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
                                      toName, PATH_MAX, nls_codepage, remap);
                 name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                 name_len2 *= 2; /* convert to bytes */
@@ -2117,8 +2157,7 @@ copyRetry:
                 cFYI(1, ("Send error in copy = %d with %d files copied",
                         rc, le16_to_cpu(pSMBr->CopyCount)));
         }
-        if (pSMB)
-                cifs_buf_release(pSMB);
+        cifs_buf_release(pSMB);
 
         if (rc == -EAGAIN)
                 goto copyRetry;
@@ -2207,8 +2246,7 @@ createSymLinkRetry:
         if (rc)
                 cFYI(1, ("Send error in SetPathInfo create symlink = %d", rc));
 
-        if (pSMB)
-                cifs_buf_release(pSMB);
+        cifs_buf_release(pSMB);
 
         if (rc == -EAGAIN)
                 goto createSymLinkRetry;
@@ -2925,7 +2963,8 @@ setAclRetry:
         }
         params = 6 + name_len;
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find max SMB size from sess */
+        /* BB find max SMB size from sess */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -3322,7 +3361,8 @@ QPathInfoRetry:
         params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
         pSMB->TotalDataCount = 0;
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(4000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(4000);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -3388,7 +3428,7 @@ QPathInfoRetry:
 int
 CIFSSMBUnixQPathInfo(const int xid, struct cifsTconInfo *tcon,
                      const unsigned char *searchName,
-                     FILE_UNIX_BASIC_INFO * pFindData,
+                     FILE_UNIX_BASIC_INFO *pFindData,
                      const struct nls_table *nls_codepage, int remap)
 {
 /* SMB_QUERY_FILE_UNIX_BASIC */
@@ -3679,6 +3719,7 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
         if (rc) {
                 if (rc == -EBADF) {
                         psrch_inf->endOfSearch = true;
+                        cifs_buf_release(pSMB);
                         rc = 0; /* search probably was closed at end of search*/
                 } else
                         cFYI(1, ("FindNext returned = %d", rc));
@@ -3856,25 +3897,112 @@ GetInodeNumOut:
         return rc;
 }
 
+/* parses DFS refferal V3 structure
+ * caller is responsible for freeing target_nodes
+ * returns:
+ *      on success - 0
+ *      on failure - errno
+ */
+static int
+parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
+                unsigned int *num_of_nodes,
+                struct dfs_info3_param **target_nodes,
+                const struct nls_table *nls_codepage)
+{
+        int i, rc = 0;
+        char *data_end;
+        bool is_unicode;
+        struct dfs_referral_level_3 *ref;
+
+        is_unicode = pSMBr->hdr.Flags2 & SMBFLG2_UNICODE;
+        *num_of_nodes = le16_to_cpu(pSMBr->NumberOfReferrals);
+
+        if (*num_of_nodes < 1) {
+                cERROR(1, ("num_referrals: must be at least > 0,"
+                        "but we get num_referrals = %d\n", *num_of_nodes));
+                rc = -EINVAL;
+                goto parse_DFS_referrals_exit;
+        }
+
+        ref = (struct dfs_referral_level_3 *) &(pSMBr->referrals);
+        if (ref->VersionNumber != cpu_to_le16(3)) {
+                cERROR(1, ("Referrals of V%d version are not supported,"
+                        "should be V3", le16_to_cpu(ref->VersionNumber)));
+                rc = -EINVAL;
+                goto parse_DFS_referrals_exit;
+        }
+
+        /* get the upper boundary of the resp buffer */
+        data_end = (char *)(&(pSMBr->PathConsumed)) +
+                                le16_to_cpu(pSMBr->t2.DataCount);
+
+        cFYI(1, ("num_referrals: %d dfs flags: 0x%x ... \n",
+                        *num_of_nodes,
+                        le16_to_cpu(pSMBr->DFSFlags)));
+
+        *target_nodes = kzalloc(sizeof(struct dfs_info3_param) *
+                        *num_of_nodes, GFP_KERNEL);
+        if (*target_nodes == NULL) {
+                cERROR(1, ("Failed to allocate buffer for target_nodes\n"));
+                rc = -ENOMEM;
+                goto parse_DFS_referrals_exit;
+        }
+
+        /* collect neccessary data from referrals */
+        for (i = 0; i < *num_of_nodes; i++) {
+                char *temp;
+                int max_len;
+                struct dfs_info3_param *node = (*target_nodes)+i;
+
+                node->flags = le16_to_cpu(pSMBr->DFSFlags);
+                node->path_consumed = le16_to_cpu(pSMBr->PathConsumed);
+                node->server_type = le16_to_cpu(ref->ServerType);
+                node->ref_flag = le16_to_cpu(ref->ReferralEntryFlags);
+
+                /* copy DfsPath */
+                temp = (char *)ref + le16_to_cpu(ref->DfsPathOffset);
+                max_len = data_end - temp;
+                rc = cifs_strncpy_to_host(&(node->path_name), temp,
+                                        max_len, is_unicode, nls_codepage);
+                if (rc)
+                        goto parse_DFS_referrals_exit;
+
+                /* copy link target UNC */
+                temp = (char *)ref + le16_to_cpu(ref->NetworkAddressOffset);
+                max_len = data_end - temp;
+                rc = cifs_strncpy_to_host(&(node->node_name), temp,
+                                        max_len, is_unicode, nls_codepage);
+                if (rc)
+                        goto parse_DFS_referrals_exit;
+
+                ref += le16_to_cpu(ref->Size);
+        }
+
+parse_DFS_referrals_exit:
+        if (rc) {
+                free_dfs_info_array(*target_nodes, *num_of_nodes);
+                *target_nodes = NULL;
+                *num_of_nodes = 0;
+        }
+        return rc;
+}
+
 int
 CIFSGetDFSRefer(const int xid, struct cifsSesInfo *ses,
                 const unsigned char *searchName,
-                unsigned char **targetUNCs,
-                unsigned int *number_of_UNC_in_array,
+                struct dfs_info3_param **target_nodes,
+                unsigned int *num_of_nodes,
                 const struct nls_table *nls_codepage, int remap)
 {
 /* TRANS2_GET_DFS_REFERRAL */
         TRANSACTION2_GET_DFS_REFER_REQ *pSMB = NULL;
         TRANSACTION2_GET_DFS_REFER_RSP *pSMBr = NULL;
-        struct dfs_referral_level_3 *referrals = NULL;
         int rc = 0;
         int bytes_returned;
         int name_len;
-        unsigned int i;
-        char *temp;
         __u16 params, byte_count;
-        *number_of_UNC_in_array = 0;
-        *targetUNCs = NULL;
+        *num_of_nodes = 0;
+        *target_nodes = NULL;
 
         cFYI(1, ("In GetDFSRefer the path %s", searchName));
         if (ses == NULL)
@@ -3921,7 +4049,8 @@ getDFSRetry:
         pSMB->DataCount = 0;
         pSMB->DataOffset = 0;
         pSMB->MaxParameterCount = 0;
-        pSMB->MaxDataCount = cpu_to_le16(4000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(4000);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -3943,103 +4072,26 @@ getDFSRetry:
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
         if (rc) {
                 cFYI(1, ("Send error in GetDFSRefer = %d", rc));
-        } else {                /* decode response */
-/* BB Add logic to parse referrals here */
-                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
+                goto GetDFSRefExit;
+        }
+        rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
-                /* BB Also check if enough total bytes returned? */
-                if (rc || (pSMBr->ByteCount < 17))
-                        rc = -EIO;      /* bad smb */
-                else {
-                        __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
-                        __u16 data_count = le16_to_cpu(pSMBr->t2.DataCount);
+        /* BB Also check if enough total bytes returned? */
+        if (rc || (pSMBr->ByteCount < 17)) {
+                rc = -EIO;      /* bad smb */
+                goto GetDFSRefExit;
+        }
 
-                        cFYI(1,
-                            ("Decoding GetDFSRefer response BCC: %d  Offset %d",
-                              pSMBr->ByteCount, data_offset));
-                        referrals =
-                            (struct dfs_referral_level_3 *)
-                                        (8 /* sizeof start of data block */ +
-                                        data_offset +
-                                        (char *) &pSMBr->hdr.Protocol);
-                        cFYI(1, ("num_referrals: %d dfs flags: 0x%x ... \n"
-                                "for referral one refer size: 0x%x srv "
-                                "type: 0x%x refer flags: 0x%x ttl: 0x%x",
-                                le16_to_cpu(pSMBr->NumberOfReferrals),
-                                le16_to_cpu(pSMBr->DFSFlags),
-                                le16_to_cpu(referrals->ReferralSize),
-                                le16_to_cpu(referrals->ServerType),
-                                le16_to_cpu(referrals->ReferralFlags),
-                                le16_to_cpu(referrals->TimeToLive)));
-                        /* BB This field is actually two bytes in from start of
-                           data block so we could do safety check that DataBlock
-                           begins at address of pSMBr->NumberOfReferrals */
-                        *number_of_UNC_in_array =
-                                        le16_to_cpu(pSMBr->NumberOfReferrals);
-
-                        /* BB Fix below so can return more than one referral */
-                        if (*number_of_UNC_in_array > 1)
-                                *number_of_UNC_in_array = 1;
-
-                        /* get the length of the strings describing refs */
-                        name_len = 0;
-                        for (i = 0; i < *number_of_UNC_in_array; i++) {
-                                /* make sure that DfsPathOffset not past end */
-                                __u16 offset =
-                                        le16_to_cpu(referrals->DfsPathOffset);
-                                if (offset > data_count) {
-                                        /* if invalid referral, stop here and do
-                                        not try to copy any more */
-                                        *number_of_UNC_in_array = i;
-                                        break;
-                                }
-                                temp = ((char *)referrals) + offset;
+        cFYI(1, ("Decoding GetDFSRefer response BCC: %d  Offset %d",
+                                pSMBr->ByteCount,
+                                le16_to_cpu(pSMBr->t2.DataOffset)));
 
-                                if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE) {
-                                        name_len += UniStrnlen((wchar_t *)temp,
-                                                                data_count);
-                                } else {
-                                        name_len += strnlen(temp, data_count);
-                                }
-                                referrals++;
-                                /* BB add check that referral pointer does
-                                   not fall off end PDU */
-                        }
-                        /* BB add check for name_len bigger than bcc */
-                        *targetUNCs =
-                                kmalloc(name_len+1+(*number_of_UNC_in_array),
-                                        GFP_KERNEL);
-                        if (*targetUNCs == NULL) {
-                                rc = -ENOMEM;
-                                goto GetDFSRefExit;
-                        }
-                        /* copy the ref strings */
-                        referrals = (struct dfs_referral_level_3 *)
-                                        (8 /* sizeof data hdr */ + data_offset +
-                                        (char *) &pSMBr->hdr.Protocol);
-
-                        for (i = 0; i < *number_of_UNC_in_array; i++) {
-                                temp = ((char *)referrals) +
-                                          le16_to_cpu(referrals->DfsPathOffset);
-                                if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE) {
-                                        cifs_strfromUCS_le(*targetUNCs,
-                                                          (__le16 *) temp,
-                                                          name_len,
-                                                          nls_codepage);
-                                } else {
-                                        strncpy(*targetUNCs, temp, name_len);
-                                }
-                                /*  BB update target_uncs pointers */
-                                referrals++;
-                        }
-                        temp = *targetUNCs;
-                        temp[name_len] = 0;
-                }
+        /* parse returned result into more usable form */
+        rc = parse_DFS_referrals(pSMBr, num_of_nodes,
+                                 target_nodes, nls_codepage);
 
-        }
 GetDFSRefExit:
-        if (pSMB)
-                cifs_buf_release(pSMB);
+        cifs_buf_release(pSMB);
 
         if (rc == -EAGAIN)
                 goto getDFSRetry;
@@ -4229,7 +4281,8 @@ QFSAttributeRetry:
         params = 2;     /* level */
         pSMB->TotalDataCount = 0;
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -4298,7 +4351,8 @@ QFSDeviceRetry:
         params = 2;     /* level */
         pSMB->TotalDataCount = 0;
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -4369,7 +4423,8 @@ QFSUnixRetry:
         pSMB->DataCount = 0;
         pSMB->DataOffset = 0;
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(100);  /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(100);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -4444,7 +4499,8 @@ SETFSUnixRetry:
         offset = param_offset + params;
 
         pSMB->MaxParameterCount = cpu_to_le16(4);
-        pSMB->MaxDataCount = cpu_to_le16(100);  /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(100);
         pSMB->SetupCount = 1;
         pSMB->Reserved3 = 0;
         pSMB->SubCommand = cpu_to_le16(TRANS2_SET_FS_INFORMATION);
@@ -4512,7 +4568,8 @@ QFSPosixRetry:
         pSMB->DataCount = 0;
         pSMB->DataOffset = 0;
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(100);  /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(100);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -4702,7 +4759,8 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
 
         count = sizeof(struct file_end_of_file_info);
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find max SMB PDU from sess */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
         pSMB->SetupCount = 1;
         pSMB->Reserved3 = 0;
         pSMB->SubCommand = cpu_to_le16(TRANS2_SET_FILE_INFORMATION);
@@ -4789,7 +4847,8 @@ CIFSSMBSetFileTimes(const int xid, struct cifsTconInfo *tcon,
 
         count = sizeof(FILE_BASIC_INFO);
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find max SMB PDU from sess */
+        /* BB find max SMB PDU from sess */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
         pSMB->SetupCount = 1;
         pSMB->Reserved3 = 0;
         pSMB->SubCommand = cpu_to_le16(TRANS2_SET_FILE_INFORMATION);
@@ -4856,7 +4915,8 @@ SetTimesRetry:
         params = 6 + name_len;
         count = sizeof(FILE_BASIC_INFO);
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -4986,7 +5046,8 @@ setPermsRetry:
         params = 6 + name_len;
         count = sizeof(FILE_UNIX_BASIC_INFO);
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -5051,8 +5112,7 @@ setPermsRetry:
         if (rc)
                 cFYI(1, ("SetPathInfo (perms) returned %d", rc));
 
-        if (pSMB)
-                cifs_buf_release(pSMB);
+        cifs_buf_release(pSMB);
         if (rc == -EAGAIN)
                 goto setPermsRetry;
         return rc;
@@ -5169,7 +5229,8 @@ QAllEAsRetry:
         params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
         pSMB->TotalDataCount = 0;
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(4000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(4000);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -5273,8 +5334,7 @@ QAllEAsRetry:
                         }
                 }
         }
-        if (pSMB)
-                cifs_buf_release(pSMB);
+        cifs_buf_release(pSMB);
         if (rc == -EAGAIN)
                 goto QAllEAsRetry;
 
@@ -5317,7 +5377,8 @@ QEARetry:
         params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
         pSMB->TotalDataCount = 0;
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(4000); /* BB find exact max SMB PDU from sess structure BB */
+        /* BB find exact max SMB PDU from sess structure BB */
+        pSMB->MaxDataCount = cpu_to_le16(4000);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -5422,8 +5483,7 @@ QEARetry:
                         }
                 }
         }
-        if (pSMB)
-                cifs_buf_release(pSMB);
+        cifs_buf_release(pSMB);
         if (rc == -EAGAIN)
                 goto QEARetry;
 
@@ -5475,7 +5535,8 @@ SetEARetry:
 
         count = sizeof(*parm_data) + ea_value_len + name_len;
         pSMB->MaxParameterCount = cpu_to_le16(2);
-        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find max SMB size from sess */
+        /* BB find max SMB PDU from sess */
+        pSMB->MaxDataCount = cpu_to_le16(1000);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index f428bf3bf1a9..e8fa46c7cff2 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -60,7 +60,7 @@ struct smb_vol {
         char *domainname;
         char *UNC;
         char *UNCip;
-        char *in6_addr;  /* ipv6 address as human readable form of in6_addr */
+        char *in6_addr;   /* ipv6 address as human readable form of in6_addr */
         char *iocharset;  /* local code page for mapping to and from Unicode */
         char source_rfc1001_name[16]; /* netbios name of client */
         char target_rfc1001_name[16]; /* netbios name of server for Win9x/ME */
@@ -75,19 +75,21 @@ struct smb_vol {
         bool setuids:1;
         bool override_uid:1;
         bool override_gid:1;
+        bool dynperm:1;
         bool noperm:1;
         bool no_psx_acl:1; /* set if posix acl support should be disabled */
         bool cifs_acl:1;
         bool no_xattr:1;   /* set if xattr (EA) support should be disabled*/
         bool server_ino:1; /* use inode numbers from server ie UniqueId */
         bool direct_io:1;
-        bool remap:1;     /* set to remap seven reserved chars in filenames */
-        bool posix_paths:1;   /* unset to not ask for posix pathnames. */
+        bool remap:1;      /* set to remap seven reserved chars in filenames */
+        bool posix_paths:1; /* unset to not ask for posix pathnames. */
         bool no_linux_ext:1;
         bool sfu_emul:1;
-        bool nullauth:1; /* attempt to authenticate with null user */
-        unsigned nocase;     /* request case insensitive filenames */
-        unsigned nobrl;      /* disable sending byte range locks to srv */
+        bool nullauth:1;   /* attempt to authenticate with null user */
+        bool nocase:1;     /* request case insensitive filenames */
+        bool nobrl:1;      /* disable sending byte range locks to srv */
+        bool seal:1;       /* request transport encryption on share */
         unsigned int rsize;
         unsigned int wsize;
         unsigned int sockopt;
@@ -651,6 +653,7 @@ multi_t2_fnd:
         spin_lock(&GlobalMid_Lock);
         server->tcpStatus = CifsExiting;
         spin_unlock(&GlobalMid_Lock);
+        wake_up_all(&server->response_q);
 
         /* don't exit until kthread_stop is called */
         set_current_state(TASK_UNINTERRUPTIBLE);
@@ -1246,6 +1249,10 @@ cifs_parse_mount_options(char *options, const char *devname,
                         vol->setuids = 1;
                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
                         vol->setuids = 0;
+                } else if (strnicmp(data, "dynperm", 7) == 0) {
+                        vol->dynperm = true;
+                } else if (strnicmp(data, "nodynperm", 9) == 0) {
+                        vol->dynperm = false;
                 } else if (strnicmp(data, "nohard", 6) == 0) {
                         vol->retry = 0;
                 } else if (strnicmp(data, "nosoft", 6) == 0) {
@@ -1268,8 +1275,12 @@ cifs_parse_mount_options(char *options, const char *devname,
                         vol->no_psx_acl = 1;
                 } else if (strnicmp(data, "sign", 4) == 0) {
                         vol->secFlg |= CIFSSEC_MUST_SIGN;
-/*              } else if (strnicmp(data, "seal",4) == 0) {
-                        vol->secFlg |= CIFSSEC_MUST_SEAL; */
+                } else if (strnicmp(data, "seal", 4) == 0) {
+                        /* we do not do the following in secFlags because seal
+                           is a per tree connection (mount) not a per socket
+                           or per-smb connection option in the protocol */
+                        /* vol->secFlg |= CIFSSEC_MUST_SEAL; */
+                        vol->seal = 1;
                 } else if (strnicmp(data, "direct", 6) == 0) {
                         vol->direct_io = 1;
                 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
@@ -1414,34 +1425,12 @@ find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
 }
 
 int
-connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
-                    const char *old_path, const struct nls_table *nls_codepage,
-                    int remap)
-{
-        struct dfs_info3_param *referrals = NULL;
-        unsigned int num_referrals;
-        int rc = 0;
-
-        rc = get_dfs_path(xid, pSesInfo, old_path, nls_codepage,
-                        &num_referrals, &referrals, remap);
-
-        /* BB Add in code to: if valid refrl, if not ip address contact
-                the helper that resolves tcp names, mount to it, try to
-                tcon to it unmount it if fail */
-
-        kfree(referrals);
-
-        return rc;
-}
-
-int
 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
              const struct nls_table *nls_codepage, unsigned int *pnum_referrals,
              struct dfs_info3_param **preferrals, int remap)
 {
         char *temp_unc;
         int rc = 0;
-        unsigned char *targetUNCs;
 
         *pnum_referrals = 0;
         *preferrals = NULL;
@@ -1464,7 +1453,7 @@ get_dfs_path(int xid, struct cifsSesInfo *pSesInfo, const char *old_path,
                 kfree(temp_unc);
         }
         if (rc == 0)
-                rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, &targetUNCs,
+                rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
                                      pnum_referrals, nls_codepage, remap);
         /* BB map targetUNCs to dfs_info3 structures, here or
                 in CIFSGetDFSRefer BB */
@@ -1815,7 +1804,7 @@ convert_delimiter(char *path, char delim)
         if (path == NULL)
                 return;
 
-        if (delim == '/') 
+        if (delim == '/')
                 old_delim = '\\';
         else
                 old_delim = '/';
@@ -2125,11 +2114,17 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_UID;
                 if (volume_info.override_gid)
                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_OVERR_GID;
+                if (volume_info.dynperm)
+                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DYNPERM;
                 if (volume_info.direct_io) {
                         cFYI(1, ("mounting share using direct i/o"));
                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
                 }
 
+                if ((volume_info.cifs_acl) && (volume_info.dynperm))
+                        cERROR(1, ("mount option dynperm ignored if cifsacl "
+                                   "mount option supported"));
+
                 tcon =
                     find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
                              volume_info.username);
@@ -2141,6 +2136,9 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                            for the retry flag is used */
                         tcon->retry = volume_info.retry;
                         tcon->nocase = volume_info.nocase;
+                        if (tcon->seal != volume_info.seal)
+                                cERROR(1, ("transport encryption setting "
+                                           "conflicts with existing tid"));
                 } else {
                         tcon = tconInfoAlloc();
                         if (tcon == NULL)
@@ -2154,10 +2152,11 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
                                     && (strchr(volume_info.UNC + 3, '/') ==
                                         NULL)) {
-                                        rc = connect_to_dfs_path(xid, pSesInfo,
+/*                                      rc = connect_to_dfs_path(xid, pSesInfo,
                                                 "", cifs_sb->local_nls,
                                                 cifs_sb->mnt_cifs_flags &
-                                                  CIFS_MOUNT_MAP_SPECIAL_CHR);
+                                                  CIFS_MOUNT_MAP_SPECIAL_CHR);*/
+                                        cFYI(1, ("DFS root not supported"));
                                         rc = -ENODEV;
                                         goto out;
                                 } else {
@@ -2173,6 +2172,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                         atomic_inc(&pSesInfo->inUse);
                                         tcon->retry = volume_info.retry;
                                         tcon->nocase = volume_info.nocase;
+                                        tcon->seal = volume_info.seal;
                                 }
                         }
                 }
@@ -2314,9 +2314,10 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
         user = ses->userName;
         domain = ses->domainName;
         smb_buffer = cifs_buf_get();
-        if (smb_buffer == NULL) {
+
+        if (smb_buffer == NULL)
                 return -ENOMEM;
-        }
+
         smb_buffer_response = smb_buffer;
         pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
 
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index e4e0078a0526..fb69c1fa85c9 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -49,18 +49,25 @@ build_path_from_dentry(struct dentry *direntry)
         struct dentry *temp;
         int namelen;
         int pplen;
+        int dfsplen;
         char *full_path;
         char dirsep;
+        struct cifs_sb_info *cifs_sb;
 
         if (direntry == NULL)
                 return NULL;  /* not much we can do if dentry is freed and
                 we need to reopen the file after it was closed implicitly
                 when the server crashed */
 
-        dirsep = CIFS_DIR_SEP(CIFS_SB(direntry->d_sb));
-        pplen = CIFS_SB(direntry->d_sb)->prepathlen;
+        cifs_sb = CIFS_SB(direntry->d_sb);
+        dirsep = CIFS_DIR_SEP(cifs_sb);
+        pplen = cifs_sb->prepathlen;
+        if (cifs_sb->tcon && (cifs_sb->tcon->Flags & SMB_SHARE_IS_IN_DFS))
+                dfsplen = strnlen(cifs_sb->tcon->treeName, MAX_TREE_SIZE + 1);
+        else
+                dfsplen = 0;
 cifs_bp_rename_retry:
-        namelen = pplen;
+        namelen = pplen + dfsplen;
         for (temp = direntry; !IS_ROOT(temp);) {
                 namelen += (1 + temp->d_name.len);
                 temp = temp->d_parent;
@@ -91,7 +98,7 @@ cifs_bp_rename_retry:
                         return NULL;
                 }
         }
-        if (namelen != pplen) {
+        if (namelen != pplen + dfsplen) {
                 cERROR(1,
                        ("did not end path lookup where expected namelen is %d",
                         namelen));
@@ -107,7 +114,18 @@ cifs_bp_rename_retry:
            since the '\' is a valid posix character so we can not switch
            those safely to '/' if any are found in the middle of the prepath */
         /* BB test paths to Windows with '/' in the midst of prepath */
-        strncpy(full_path, CIFS_SB(direntry->d_sb)->prepath, pplen);
+
+        if (dfsplen) {
+                strncpy(full_path, cifs_sb->tcon->treeName, dfsplen);
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
+                        int i;
+                        for (i = 0; i < dfsplen; i++) {
+                                if (full_path[i] == '\\')
+                                        full_path[i] = '/';
+                        }
+                }
+        }
+        strncpy(full_path + dfsplen, CIFS_SB(direntry->d_sb)->prepath, pplen);
         return full_path;
 }
 
@@ -242,7 +260,9 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                                                  buf, inode->i_sb, xid,
                                                  &fileHandle);
                         if (newinode) {
-                                newinode->i_mode = mode;
+                                if (cifs_sb->mnt_cifs_flags &
+                                    CIFS_MOUNT_DYNPERM)
+                                        newinode->i_mode = mode;
                                 if ((oplock & CIFS_CREATE_ACTION) &&
                                     (cifs_sb->mnt_cifs_flags &
                                      CIFS_MOUNT_SET_UID)) {
@@ -590,7 +610,7 @@ static int cifs_ci_compare(struct dentry *dentry, struct qstr *a,
                  * case take precedence.  If a is not a negative dentry, this
                  * should have no side effects
                  */
-                memcpy(a->name, b->name, a->len);
+                memcpy((void *)a->name, b->name, a->len);
                 return 0;
         }
         return 1;
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 939e256f8497..f730ef35499e 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -134,10 +134,6 @@ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
         rkey = request_key(&key_type_dns_resolver, name, "");
         if (!IS_ERR(rkey)) {
                 data = rkey->payload.data;
-                cFYI(1, ("%s: resolved: %s to %s", __func__,
-                                        rkey->description,
-                                        *ip_addr
-                                ));
         } else {
                 cERROR(1, ("%s: unable to resolve: %s", __func__, name));
                 goto out;
@@ -150,6 +146,11 @@ skip_upcall:
                 if (*ip_addr) {
                         memcpy(*ip_addr, data, len);
                         (*ip_addr)[len] = '\0';
+                        if (!IS_ERR(rkey))
+                                cFYI(1, ("%s: resolved: %s to %s", __func__,
+                                                        name,
+                                                        *ip_addr
+                                        ));
                         rc = 0;
                 } else {
                         rc = -ENOMEM;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 31a0a33b9d95..0aac824371a5 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -75,7 +75,11 @@ static inline int cifs_convert_flags(unsigned int flags)
                 return (GENERIC_READ | GENERIC_WRITE);
         }
 
-        return 0x20197;
+        return (READ_CONTROL | FILE_WRITE_ATTRIBUTES | FILE_READ_ATTRIBUTES |
+                FILE_WRITE_EA | FILE_APPEND_DATA | FILE_WRITE_DATA |
+                FILE_READ_DATA);
+
+
 }
 
 static inline int cifs_get_disposition(unsigned int flags)
@@ -542,7 +546,6 @@ int cifs_close(struct inode *inode, struct file *file)
                         msleep(timeout);
                         timeout *= 8;
                 }
-                kfree(pSMBFile->search_resume_name);
                 kfree(file->private_data);
                 file->private_data = NULL;
         } else
@@ -601,12 +604,6 @@ int cifs_closedir(struct inode *inode, struct file *file)
                         else
                                 cifs_buf_release(ptmp);
                 }
-                ptmp = pCFileStruct->search_resume_name;
-                if (ptmp) {
-                        cFYI(1, ("closedir free resume name"));
-                        pCFileStruct->search_resume_name = NULL;
-                        kfree(ptmp);
-                }
                 kfree(file->private_data);
                 file->private_data = NULL;
         }
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index fcbdbb6ad7bf..2e904bd111c8 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -161,118 +161,115 @@ static void cifs_unix_info_to_inode(struct inode *inode,
         spin_unlock(&inode->i_lock);
 }
 
-static const unsigned char *cifs_get_search_path(struct cifs_sb_info *cifs_sb,
-                                                const char *search_path)
-{
-        int tree_len;
-        int path_len;
-        int i;
-        char *tmp_path;
-        struct cifsTconInfo *pTcon = cifs_sb->tcon;
-
-        if (!(pTcon->Flags & SMB_SHARE_IS_IN_DFS))
-                return search_path;
-
-        /* use full path name for working with DFS */
-        tree_len = strnlen(pTcon->treeName, MAX_TREE_SIZE + 1);
-        path_len = strnlen(search_path, MAX_PATHCONF);
 
-        tmp_path = kmalloc(tree_len+path_len+1, GFP_KERNEL);
-        if (tmp_path == NULL)
-                return search_path;
+/*
+ *      Needed to setup inode data for the directory which is the
+ *      junction to the new submount (ie to setup the fake directory
+ *      which represents a DFS referral)
+ */
+static void fill_fake_finddataunix(FILE_UNIX_BASIC_INFO *pfnd_dat,
+                               struct super_block *sb)
+{
+        struct inode *pinode = NULL;
+
+        memset(pfnd_dat, 0, sizeof(FILE_UNIX_BASIC_INFO));
+
+/*      __le64 pfnd_dat->EndOfFile = cpu_to_le64(0);
+        __le64 pfnd_dat->NumOfBytes = cpu_to_le64(0);
+        __u64 UniqueId = 0;  */
+        pfnd_dat->LastStatusChange =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->LastAccessTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->LastModificationTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->Type = cpu_to_le32(UNIX_DIR);
+        pfnd_dat->Permissions = cpu_to_le64(S_IXUGO | S_IRWXU);
+        pfnd_dat->Nlinks = cpu_to_le64(2);
+        if (sb->s_root)
+                pinode = sb->s_root->d_inode;
+        if (pinode == NULL)
+                return;
 
-        strncpy(tmp_path, pTcon->treeName, tree_len);
-        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)
-                for (i = 0; i < tree_len; i++) {
-                        if (tmp_path[i] == '\\')
-                                tmp_path[i] = '/';
-                }
-        strncpy(tmp_path+tree_len, search_path, path_len);
-        tmp_path[tree_len+path_len] = 0;
-        return tmp_path;
+        /* fill in default values for the remaining based on root
+           inode since we can not query the server for this inode info */
+        pfnd_dat->DevMajor = cpu_to_le64(MAJOR(pinode->i_rdev));
+        pfnd_dat->DevMinor = cpu_to_le64(MINOR(pinode->i_rdev));
+        pfnd_dat->Uid = cpu_to_le64(pinode->i_uid);
+        pfnd_dat->Gid = cpu_to_le64(pinode->i_gid);
 }
 
 int cifs_get_inode_info_unix(struct inode **pinode,
-        const unsigned char *search_path, struct super_block *sb, int xid)
+        const unsigned char *full_path, struct super_block *sb, int xid)
 {
         int rc = 0;
-        FILE_UNIX_BASIC_INFO findData;
+        FILE_UNIX_BASIC_INFO find_data;
         struct cifsTconInfo *pTcon;
         struct inode *inode;
         struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
-        const unsigned char *full_path;
         bool is_dfs_referral = false;
+        struct cifsInodeInfo *cifsInfo;
+        __u64 num_of_bytes;
+        __u64 end_of_file;
 
         pTcon = cifs_sb->tcon;
-        cFYI(1, ("Getting info on %s", search_path));
-
-        full_path = cifs_get_search_path(cifs_sb, search_path);
+        cFYI(1, ("Getting info on %s", full_path));
 
-try_again_CIFSSMBUnixQPathInfo:
         /* could have done a find first instead but this returns more info */
-        rc = CIFSSMBUnixQPathInfo(xid, pTcon, full_path, &findData,
+        rc = CIFSSMBUnixQPathInfo(xid, pTcon, full_path, &find_data,
                                   cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
-/*      dump_mem("\nUnixQPathInfo return data", &findData,
-                 sizeof(findData)); */
-        if (rc) {
-                if (rc == -EREMOTE && !is_dfs_referral) {
-                        is_dfs_referral = true;
-                        if (full_path != search_path) {
-                                kfree(full_path);
-                                full_path = search_path;
-                        }
-                        goto try_again_CIFSSMBUnixQPathInfo;
-                }
+        if (rc == -EREMOTE && !is_dfs_referral) {
+                is_dfs_referral = true;
+                cFYI(DBG2, ("DFS ref"));
+                /* for DFS, server does not give us real inode data */
+                fill_fake_finddataunix(&find_data, sb);
+                rc = 0;
+        } else if (rc)
                 goto cgiiu_exit;
-        } else {
-                struct cifsInodeInfo *cifsInfo;
-                __u64 num_of_bytes = le64_to_cpu(findData.NumOfBytes);
-                __u64 end_of_file = le64_to_cpu(findData.EndOfFile);
 
-                /* get new inode */
-                if (*pinode == NULL) {
-                        *pinode = new_inode(sb);
-                        if (*pinode == NULL) {
-                                rc = -ENOMEM;
-                                goto cgiiu_exit;
-                        }
-                        /* Is an i_ino of zero legal? */
-                        /* Are there sanity checks we can use to ensure that
-                           the server is really filling in that field? */
-                        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
-                                (*pinode)->i_ino =
-                                        (unsigned long)findData.UniqueId;
-                        } /* note ino incremented to unique num in new_inode */
-                        if (sb->s_flags & MS_NOATIME)
-                                (*pinode)->i_flags |= S_NOATIME | S_NOCMTIME;
+        num_of_bytes = le64_to_cpu(find_data.NumOfBytes);
+        end_of_file = le64_to_cpu(find_data.EndOfFile);
 
-                        insert_inode_hash(*pinode);
+        /* get new inode */
+        if (*pinode == NULL) {
+                *pinode = new_inode(sb);
+                if (*pinode == NULL) {
+                        rc = -ENOMEM;
+                        goto cgiiu_exit;
                 }
+                /* Is an i_ino of zero legal? */
+                /* note ino incremented to unique num in new_inode */
+                /* Are there sanity checks we can use to ensure that
+                   the server is really filling in that field? */
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)
+                        (*pinode)->i_ino = (unsigned long)find_data.UniqueId;
 
-                inode = *pinode;
-                cifsInfo = CIFS_I(inode);
+                if (sb->s_flags & MS_NOATIME)
+                        (*pinode)->i_flags |= S_NOATIME | S_NOCMTIME;
 
-                cFYI(1, ("Old time %ld", cifsInfo->time));
-                cifsInfo->time = jiffies;
-                cFYI(1, ("New time %ld", cifsInfo->time));
-                /* this is ok to set on every inode revalidate */
-                atomic_set(&cifsInfo->inUse, 1);
+                insert_inode_hash(*pinode);
+        }
 
-                cifs_unix_info_to_inode(inode, &findData, 0);
+        inode = *pinode;
+        cifsInfo = CIFS_I(inode);
 
+        cFYI(1, ("Old time %ld", cifsInfo->time));
+        cifsInfo->time = jiffies;
+        cFYI(1, ("New time %ld", cifsInfo->time));
+        /* this is ok to set on every inode revalidate */
+        atomic_set(&cifsInfo->inUse, 1);
 
-                if (num_of_bytes < end_of_file)
-                        cFYI(1, ("allocation size less than end of file"));
-                cFYI(1, ("Size %ld and blocks %llu",
-                        (unsigned long) inode->i_size,
-                        (unsigned long long)inode->i_blocks));
+        cifs_unix_info_to_inode(inode, &find_data, 0);
 
-                cifs_set_ops(inode, is_dfs_referral);
-        }
+        if (num_of_bytes < end_of_file)
+                cFYI(1, ("allocation size less than end of file"));
+        cFYI(1, ("Size %ld and blocks %llu",
+                (unsigned long) inode->i_size,
+                (unsigned long long)inode->i_blocks));
+
+        cifs_set_ops(inode, is_dfs_referral);
 cgiiu_exit:
-        if (full_path != search_path)
-                kfree(full_path);
         return rc;
 }
 
@@ -379,21 +376,52 @@ static int get_sfu_mode(struct inode *inode,
 #endif
 }
 
+/*
+ *      Needed to setup inode data for the directory which is the
+ *      junction to the new submount (ie to setup the fake directory
+ *      which represents a DFS referral)
+ */
+static void fill_fake_finddata(FILE_ALL_INFO *pfnd_dat,
+                               struct super_block *sb)
+{
+        memset(pfnd_dat, 0, sizeof(FILE_ALL_INFO));
+
+/*      __le64 pfnd_dat->AllocationSize = cpu_to_le64(0);
+        __le64 pfnd_dat->EndOfFile = cpu_to_le64(0);
+        __u8 pfnd_dat->DeletePending = 0;
+        __u8 pfnd_data->Directory = 0;
+        __le32 pfnd_dat->EASize = 0;
+        __u64 pfnd_dat->IndexNumber = 0;
+        __u64 pfnd_dat->IndexNumber1 = 0;  */
+        pfnd_dat->CreationTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->LastAccessTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->LastWriteTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->ChangeTime =
+                cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
+        pfnd_dat->Attributes = cpu_to_le32(ATTR_DIRECTORY);
+        pfnd_dat->NumberOfLinks = cpu_to_le32(2);
+}
+
 int cifs_get_inode_info(struct inode **pinode,
-        const unsigned char *search_path, FILE_ALL_INFO *pfindData,
+        const unsigned char *full_path, FILE_ALL_INFO *pfindData,
         struct super_block *sb, int xid, const __u16 *pfid)
 {
         int rc = 0;
+        __u32 attr;
+        struct cifsInodeInfo *cifsInfo;
         struct cifsTconInfo *pTcon;
         struct inode *inode;
         struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
-        const unsigned char *full_path = NULL;
         char *buf = NULL;
         bool adjustTZ = false;
         bool is_dfs_referral = false;
+        umode_t default_mode;
 
         pTcon = cifs_sb->tcon;
-        cFYI(1, ("Getting info on %s", search_path));
+        cFYI(1, ("Getting info on %s", full_path));
 
         if ((pfindData == NULL) && (*pinode != NULL)) {
                 if (CIFS_I(*pinode)->clientCanCacheRead) {
@@ -409,9 +437,6 @@ int cifs_get_inode_info(struct inode **pinode,
                         return -ENOMEM;
                 pfindData = (FILE_ALL_INFO *)buf;
 
-                full_path = cifs_get_search_path(cifs_sb, search_path);
-
-try_again_CIFSSMBQPathInfo:
                 /* could do find first instead but this returns more info */
                 rc = CIFSSMBQPathInfo(xid, pTcon, full_path, pfindData,
                               0 /* not legacy */,
@@ -429,178 +454,163 @@ try_again_CIFSSMBQPathInfo:
                 }
         }
         /* dump_mem("\nQPathInfo return data",&findData, sizeof(findData)); */
-        if (rc) {
-                if (rc == -EREMOTE && !is_dfs_referral) {
-                        is_dfs_referral = true;
-                        if (full_path != search_path) {
-                                kfree(full_path);
-                                full_path = search_path;
-                        }
-                        goto try_again_CIFSSMBQPathInfo;
-                }
+        if (rc == -EREMOTE) {
+                is_dfs_referral = true;
+                fill_fake_finddata(pfindData, sb);
+                rc = 0;
+        } else if (rc)
                 goto cgii_exit;
-        } else {
-                struct cifsInodeInfo *cifsInfo;
-                __u32 attr = le32_to_cpu(pfindData->Attributes);
-
-                /* get new inode */
-                if (*pinode == NULL) {
-                        *pinode = new_inode(sb);
-                        if (*pinode == NULL) {
-                                rc = -ENOMEM;
-                                goto cgii_exit;
-                        }
-                        /* Is an i_ino of zero legal? Can we use that to check
-                           if the server supports returning inode numbers?  Are
-                           there other sanity checks we can use to ensure that
-                           the server is really filling in that field? */
-
-                        /* We can not use the IndexNumber field by default from
-                           Windows or Samba (in ALL_INFO buf) but we can request
-                           it explicitly.  It may not be unique presumably if
-                           the server has multiple devices mounted under one
-                           share */
-
-                        /* There may be higher info levels that work but are
-                           there Windows server or network appliances for which
-                           IndexNumber field is not guaranteed unique? */
 
-                        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
-                                int rc1 = 0;
-                                __u64 inode_num;
+        attr = le32_to_cpu(pfindData->Attributes);
 
-                                rc1 = CIFSGetSrvInodeNumber(xid, pTcon,
-                                        search_path, &inode_num,
+        /* get new inode */
+        if (*pinode == NULL) {
+                *pinode = new_inode(sb);
+                if (*pinode == NULL) {
+                        rc = -ENOMEM;
+                        goto cgii_exit;
+                }
+                /* Is an i_ino of zero legal? Can we use that to check
+                   if the server supports returning inode numbers?  Are
+                   there other sanity checks we can use to ensure that
+                   the server is really filling in that field? */
+
+                /* We can not use the IndexNumber field by default from
+                   Windows or Samba (in ALL_INFO buf) but we can request
+                   it explicitly.  It may not be unique presumably if
+                   the server has multiple devices mounted under one share */
+
+                /* There may be higher info levels that work but are
+                   there Windows server or network appliances for which
+                   IndexNumber field is not guaranteed unique? */
+
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
+                        int rc1 = 0;
+                        __u64 inode_num;
+
+                        rc1 = CIFSGetSrvInodeNumber(xid, pTcon,
+                                        full_path, &inode_num,
                                         cifs_sb->local_nls,
                                         cifs_sb->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
-                                if (rc1) {
-                                        cFYI(1, ("GetSrvInodeNum rc %d", rc1));
-                                        /* BB EOPNOSUPP disable SERVER_INUM? */
-                                } else /* do we need cast or hash to ino? */
-                                        (*pinode)->i_ino = inode_num;
-                        } /* else ino incremented to unique num in new_inode*/
-                        if (sb->s_flags & MS_NOATIME)
-                                (*pinode)->i_flags |= S_NOATIME | S_NOCMTIME;
-                        insert_inode_hash(*pinode);
-                }
-                inode = *pinode;
-                cifsInfo = CIFS_I(inode);
-                cifsInfo->cifsAttrs = attr;
-                cFYI(1, ("Old time %ld", cifsInfo->time));
-                cifsInfo->time = jiffies;
-                cFYI(1, ("New time %ld", cifsInfo->time));
-
-                /* blksize needs to be multiple of two. So safer to default to
-                blksize and blkbits set in superblock so 2**blkbits and blksize
-                will match rather than setting to:
-                (pTcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE) & 0xFFFFFE00;*/
-
-                /* Linux can not store file creation time so ignore it */
-                if (pfindData->LastAccessTime)
-                        inode->i_atime = cifs_NTtimeToUnix
-                                (le64_to_cpu(pfindData->LastAccessTime));
-                else /* do not need to use current_fs_time - time not stored */
-                        inode->i_atime = CURRENT_TIME;
-                inode->i_mtime =
+                        if (rc1) {
+                                cFYI(1, ("GetSrvInodeNum rc %d", rc1));
+                                /* BB EOPNOSUPP disable SERVER_INUM? */
+                        } else /* do we need cast or hash to ino? */
+                                (*pinode)->i_ino = inode_num;
+                } /* else ino incremented to unique num in new_inode*/
+                if (sb->s_flags & MS_NOATIME)
+                        (*pinode)->i_flags |= S_NOATIME | S_NOCMTIME;
+                insert_inode_hash(*pinode);
+        }
+        inode = *pinode;
+        cifsInfo = CIFS_I(inode);
+        cifsInfo->cifsAttrs = attr;
+        cFYI(1, ("Old time %ld", cifsInfo->time));
+        cifsInfo->time = jiffies;
+        cFYI(1, ("New time %ld", cifsInfo->time));
+
+        /* blksize needs to be multiple of two. So safer to default to
+        blksize and blkbits set in superblock so 2**blkbits and blksize
+        will match rather than setting to:
+        (pTcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE) & 0xFFFFFE00;*/
+
+        /* Linux can not store file creation time so ignore it */
+        if (pfindData->LastAccessTime)
+                inode->i_atime = cifs_NTtimeToUnix
+                        (le64_to_cpu(pfindData->LastAccessTime));
+        else /* do not need to use current_fs_time - time not stored */
+                inode->i_atime = CURRENT_TIME;
+        inode->i_mtime =
                     cifs_NTtimeToUnix(le64_to_cpu(pfindData->LastWriteTime));
-                inode->i_ctime =
-                    cifs_NTtimeToUnix(le64_to_cpu(pfindData->ChangeTime));
-                cFYI(0, ("Attributes came in as 0x%x", attr));
-                if (adjustTZ && (pTcon->ses) && (pTcon->ses->server)) {
-                        inode->i_ctime.tv_sec += pTcon->ses->server->timeAdj;
-                        inode->i_mtime.tv_sec += pTcon->ses->server->timeAdj;
-                }
+        inode->i_ctime =
+            cifs_NTtimeToUnix(le64_to_cpu(pfindData->ChangeTime));
+        cFYI(DBG2, ("Attributes came in as 0x%x", attr));
+        if (adjustTZ && (pTcon->ses) && (pTcon->ses->server)) {
+                inode->i_ctime.tv_sec += pTcon->ses->server->timeAdj;
+                inode->i_mtime.tv_sec += pTcon->ses->server->timeAdj;
+        }
 
-                /* set default mode. will override for dirs below */
-                if (atomic_read(&cifsInfo->inUse) == 0)
-                        /* new inode, can safely set these fields */
-                        inode->i_mode = cifs_sb->mnt_file_mode;
-                else /* since we set the inode type below we need to mask off
-                     to avoid strange results if type changes and both
-                     get orred in */
+        /* get default inode mode */
+        if (attr & ATTR_DIRECTORY)
+                default_mode = cifs_sb->mnt_dir_mode;
+        else
+                default_mode = cifs_sb->mnt_file_mode;
+
+        /* set permission bits */
+        if (atomic_read(&cifsInfo->inUse) == 0 ||
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
+                inode->i_mode = default_mode;
+        else {
+                /* just reenable write bits if !ATTR_READONLY */
+                if ((inode->i_mode & S_IWUGO) == 0 &&
+                    (attr & ATTR_READONLY) == 0)
+                        inode->i_mode |= (S_IWUGO & default_mode);
                         inode->i_mode &= ~S_IFMT;
-/*              if (attr & ATTR_REPARSE)  */
-                /* We no longer handle these as symlinks because we could not
-                   follow them due to the absolute path with drive letter */
-                if (attr & ATTR_DIRECTORY) {
-                /* override default perms since we do not do byte range locking
-                   on dirs */
-                        inode->i_mode = cifs_sb->mnt_dir_mode;
-                        inode->i_mode |= S_IFDIR;
-                } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
-                           (cifsInfo->cifsAttrs & ATTR_SYSTEM) &&
-                           /* No need to le64 convert size of zero */
-                           (pfindData->EndOfFile == 0)) {
-                        inode->i_mode = cifs_sb->mnt_file_mode;
+        }
+        /* clear write bits if ATTR_READONLY is set */
+        if (attr & ATTR_READONLY)
+                inode->i_mode &= ~S_IWUGO;
+
+        /* set inode type */
+        if ((attr & ATTR_SYSTEM) &&
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)) {
+                /* no need to fix endianness on 0 */
+                if (pfindData->EndOfFile == 0)
                         inode->i_mode |= S_IFIFO;
-/* BB Finish for SFU style symlinks and devices */
-                } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
-                           (cifsInfo->cifsAttrs & ATTR_SYSTEM)) {
-                        if (decode_sfu_inode(inode,
-                                         le64_to_cpu(pfindData->EndOfFile),
-                                         search_path,
-                                         cifs_sb, xid))
-                                cFYI(1, ("Unrecognized sfu inode type"));
-
-                        cFYI(1, ("sfu mode 0%o", inode->i_mode));
-                } else {
+                else if (decode_sfu_inode(inode,
+                                le64_to_cpu(pfindData->EndOfFile),
+                                full_path, cifs_sb, xid))
+                        cFYI(1, ("unknown SFU file type\n"));
+        } else {
+                if (attr & ATTR_DIRECTORY)
+                        inode->i_mode |= S_IFDIR;
+                else
                         inode->i_mode |= S_IFREG;
-                        /* treat the dos attribute of read-only as read-only
-                           mode e.g. 555 */
-                        if (cifsInfo->cifsAttrs & ATTR_READONLY)
-                                inode->i_mode &= ~(S_IWUGO);
-                        else if ((inode->i_mode & S_IWUGO) == 0)
-                                /* the ATTR_READONLY flag may have been */
-                                /* changed on server -- set any w bits  */
-                                /* allowed by mnt_file_mode             */
-                                inode->i_mode |= (S_IWUGO &
-                                                  cifs_sb->mnt_file_mode);
-                /* BB add code here -
-                   validate if device or weird share or device type? */
-                }
+        }
 
-                spin_lock(&inode->i_lock);
-                if (is_size_safe_to_change(cifsInfo,
-                                           le64_to_cpu(pfindData->EndOfFile))) {
-                        /* can not safely shrink the file size here if the
-                           client is writing to it due to potential races */
-                        i_size_write(inode, le64_to_cpu(pfindData->EndOfFile));
-
-                        /* 512 bytes (2**9) is the fake blocksize that must be
-                           used for this calculation */
-                        inode->i_blocks = (512 - 1 + le64_to_cpu(
-                                           pfindData->AllocationSize)) >> 9;
-                }
-                spin_unlock(&inode->i_lock);
+        spin_lock(&inode->i_lock);
+        if (is_size_safe_to_change(cifsInfo,
+                                   le64_to_cpu(pfindData->EndOfFile))) {
+                /* can not safely shrink the file size here if the
+                   client is writing to it due to potential races */
+                i_size_write(inode, le64_to_cpu(pfindData->EndOfFile));
+
+                /* 512 bytes (2**9) is the fake blocksize that must be
+                   used for this calculation */
+                inode->i_blocks = (512 - 1 + le64_to_cpu(
+                                   pfindData->AllocationSize)) >> 9;
+        }
+        spin_unlock(&inode->i_lock);
 
-                inode->i_nlink = le32_to_cpu(pfindData->NumberOfLinks);
+        inode->i_nlink = le32_to_cpu(pfindData->NumberOfLinks);
 
-                /* BB fill in uid and gid here? with help from winbind?
-                   or retrieve from NTFS stream extended attribute */
+        /* BB fill in uid and gid here? with help from winbind?
+           or retrieve from NTFS stream extended attribute */
 #ifdef CONFIG_CIFS_EXPERIMENTAL
-                /* fill in 0777 bits from ACL */
-                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
-                        cFYI(1, ("Getting mode bits from ACL"));
-                        acl_to_uid_mode(inode, search_path, pfid);
-                }
+        /* fill in 0777 bits from ACL */
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
+                cFYI(1, ("Getting mode bits from ACL"));
+                acl_to_uid_mode(inode, full_path, pfid);
+        }
 #endif
-                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) {
-                        /* fill in remaining high mode bits e.g. SUID, VTX */
-                        get_sfu_mode(inode, search_path, cifs_sb, xid);
-                } else if (atomic_read(&cifsInfo->inUse) == 0) {
-                        inode->i_uid = cifs_sb->mnt_uid;
-                        inode->i_gid = cifs_sb->mnt_gid;
-                        /* set so we do not keep refreshing these fields with
-                           bad data after user has changed them in memory */
-                        atomic_set(&cifsInfo->inUse, 1);
-                }
-
-                cifs_set_ops(inode, is_dfs_referral);
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) {
+                /* fill in remaining high mode bits e.g. SUID, VTX */
+                get_sfu_mode(inode, full_path, cifs_sb, xid);
+        } else if (atomic_read(&cifsInfo->inUse) == 0) {
+                inode->i_uid = cifs_sb->mnt_uid;
+                inode->i_gid = cifs_sb->mnt_gid;
+                /* set so we do not keep refreshing these fields with
+                   bad data after user has changed them in memory */
+                atomic_set(&cifsInfo->inUse, 1);
         }
+
+        cifs_set_ops(inode, is_dfs_referral);
+
+
+
+
 cgii_exit:
-        if (full_path != search_path)
-                kfree(full_path);
         kfree(buf);
         return rc;
 }
@@ -1005,8 +1015,11 @@ mkdir_get_info:
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
                         }
                         if (direntry->d_inode) {
-                                direntry->d_inode->i_mode = mode;
-                                direntry->d_inode->i_mode |= S_IFDIR;
+                                if (cifs_sb->mnt_cifs_flags &
+                                     CIFS_MOUNT_DYNPERM)
+                                        direntry->d_inode->i_mode =
+                                                (mode | S_IFDIR);
+
                                 if (cifs_sb->mnt_cifs_flags &
                                      CIFS_MOUNT_SET_UID) {
                                         direntry->d_inode->i_uid =
@@ -1502,8 +1515,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                                 int oplock = 0;
 
                                 rc = SMBLegacyOpen(xid, pTcon, full_path,
-                                        FILE_OPEN,
-                                        SYNCHRONIZE | FILE_WRITE_ATTRIBUTES,
+                                        FILE_OPEN, GENERIC_WRITE,
                                         CREATE_NOT_DIR, &netfid, &oplock,
                                         NULL, cifs_sb->local_nls,
                                         cifs_sb->mnt_cifs_flags &
@@ -1534,13 +1546,26 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                 } else
                         goto cifs_setattr_exit;
         }
-        if (attrs->ia_valid & ATTR_UID) {
-                cFYI(1, ("UID changed to %d", attrs->ia_uid));
-                uid = attrs->ia_uid;
-        }
-        if (attrs->ia_valid & ATTR_GID) {
-                cFYI(1, ("GID changed to %d", attrs->ia_gid));
-                gid = attrs->ia_gid;
+
+        /*
+         * Without unix extensions we can't send ownership changes to the
+         * server, so silently ignore them. This is consistent with how
+         * local DOS/Windows filesystems behave (VFAT, NTFS, etc). With
+         * CIFSACL support + proper Windows to Unix idmapping, we may be
+         * able to support this in the future.
+         */
+        if (!pTcon->unix_ext &&
+            !(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)) {
+                attrs->ia_valid &= ~(ATTR_UID | ATTR_GID);
+        } else {
+                if (attrs->ia_valid & ATTR_UID) {
+                        cFYI(1, ("UID changed to %d", attrs->ia_uid));
+                        uid = attrs->ia_uid;
+                }
+                if (attrs->ia_valid & ATTR_GID) {
+                        cFYI(1, ("GID changed to %d", attrs->ia_gid));
+                        gid = attrs->ia_gid;
+                }
         }
 
         time_buf.Attributes = 0;
@@ -1550,7 +1575,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                 attrs->ia_valid &= ~ATTR_MODE;
 
         if (attrs->ia_valid & ATTR_MODE) {
-                cFYI(1, ("Mode changed to 0x%x", attrs->ia_mode));
+                cFYI(1, ("Mode changed to 0%o", attrs->ia_mode));
                 mode = attrs->ia_mode;
         }
 
@@ -1565,18 +1590,18 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
 #ifdef CONFIG_CIFS_EXPERIMENTAL
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL)
                         rc = mode_to_acl(inode, full_path, mode);
-                else if ((mode & S_IWUGO) == 0) {
-#else
-                if ((mode & S_IWUGO) == 0) {
+                else
 #endif
-                        /* not writeable */
-                        if ((cifsInode->cifsAttrs & ATTR_READONLY) == 0) {
-                                set_dosattr = true;
-                                time_buf.Attributes =
-                                        cpu_to_le32(cifsInode->cifsAttrs |
-                                                    ATTR_READONLY);
-                        }
-                } else if (cifsInode->cifsAttrs & ATTR_READONLY) {
+                if (((mode & S_IWUGO) == 0) &&
+                    (cifsInode->cifsAttrs & ATTR_READONLY) == 0) {
+                        set_dosattr = true;
+                        time_buf.Attributes = cpu_to_le32(cifsInode->cifsAttrs |
+                                                          ATTR_READONLY);
+                        /* fix up mode if we're not using dynperm */
+                        if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
+                                attrs->ia_mode = inode->i_mode & ~S_IWUGO;
+                } else if ((mode & S_IWUGO) &&
+                           (cifsInode->cifsAttrs & ATTR_READONLY)) {
                         /* If file is readonly on server, we would
                         not be able to write to it - so if any write
                         bit is enabled for user or group or other we
@@ -1587,6 +1612,20 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                         /* Windows ignores set to zero */
                         if (time_buf.Attributes == 0)
                                 time_buf.Attributes |= cpu_to_le32(ATTR_NORMAL);
+
+                        /* reset local inode permissions to normal */
+                        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)) {
+                                attrs->ia_mode &= ~(S_IALLUGO);
+                                if (S_ISDIR(inode->i_mode))
+                                        attrs->ia_mode |=
+                                                cifs_sb->mnt_dir_mode;
+                                else
+                                        attrs->ia_mode |=
+                                                cifs_sb->mnt_file_mode;
+                        }
+                } else if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)) {
+                        /* ignore mode change - ATTR_READONLY hasn't changed */
+                        attrs->ia_valid &= ~ATTR_MODE;
                 }
         }
 
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index 5c792df13d62..0088a5b52564 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -30,9 +30,9 @@
 
 #define CIFS_IOC_CHECKUMOUNT _IO(0xCF, 2)
 
-int cifs_ioctl(struct inode *inode, struct file *filep,
-                unsigned int command, unsigned long arg)
+long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
 {
+        struct inode *inode = filep->f_dentry->d_inode;
         int rc = -ENOTTY; /* strange error - but the precedent */
         int xid;
         struct cifs_sb_info *cifs_sb;
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 1c2c3ce5020b..63f644000ce5 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -234,7 +234,6 @@ cifs_readlink(struct dentry *direntry, char __user *pBuffer, int buflen)
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
         char *full_path = NULL;
-        char *tmp_path = NULL;
         char *tmpbuffer;
         int len;
         __u16 fid;
@@ -295,45 +294,9 @@ cifs_readlink(struct dentry *direntry, char __user *pBuffer, int buflen)
                                 cFYI(1, ("Error closing junction point "
                                          "(open for ioctl)"));
                         }
-                        /* BB unwind this long, nested function, or remove BB */
-                        if (rc == -EIO) {
-                                /* Query if DFS Junction */
-                                unsigned int num_referrals = 0;
-                                struct dfs_info3_param *refs = NULL;
-                                tmp_path =
-                                        kmalloc(MAX_TREE_SIZE + MAX_PATHCONF + 1,
-                                                GFP_KERNEL);
-                                if (tmp_path) {
-                                        strncpy(tmp_path, pTcon->treeName,
-                                                MAX_TREE_SIZE);
-                                        strncat(tmp_path, full_path,
-                                                MAX_PATHCONF);
-                                        rc = get_dfs_path(xid, pTcon->ses,
-                                                tmp_path,
-                                                cifs_sb->local_nls,
-                                                &num_referrals, &refs,
-                                                cifs_sb->mnt_cifs_flags &
-                                                    CIFS_MOUNT_MAP_SPECIAL_CHR);
-                                        cFYI(1, ("Get DFS for %s rc = %d ",
-                                                tmp_path, rc));
-                                        if ((num_referrals == 0) && (rc == 0))
-                                                rc = -EACCES;
-                                        else {
-                                                cFYI(1, ("num referral: %d",
-                                                        num_referrals));
-                                                if (refs && refs->path_name) {
-                                                        strncpy(tmpbuffer,
-                                                                refs->path_name,
-                                                                len-1);
-                                                }
-                                        }
-                                        kfree(refs);
-                                        kfree(tmp_path);
-}
-                                /* BB add code like else decode referrals
-                                then memcpy to tmpbuffer and free referrals
-                                string array BB */
-                        }
+                        /* If it is a DFS junction earlier we would have gotten
+                           PATH_NOT_COVERED returned from server so we do
+                           not need to request the DFS info here */
                 }
         }
         /* BB Anything else to do to handle recursive links? */
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 1d69b8014e0b..4b17f8fe3157 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -519,8 +519,7 @@ is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
                         pnotify = (struct file_notify_information *)
                                 ((char *)&pSMBr->hdr.Protocol + data_offset);
                         cFYI(1, ("dnotify on %s Action: 0x%x",
-                                 pnotify->FileName,
-                                pnotify->Action));  /* BB removeme BB */
+                                 pnotify->FileName, pnotify->Action));
                         /*   cifs_dump_mem("Rcvd notify Data: ",buf,
                                 sizeof(struct smb_hdr)+60); */
                         return true;
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index 00f4cff400b3..8703d68f5b20 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -141,11 +141,11 @@ cifs_inet_pton(const int address_family, const char *cp, void *dst)
         int ret = 0;
 
         /* calculate length by finding first slash or NULL */
-        if (address_family == AF_INET) {
+        if (address_family == AF_INET)
                 ret = in4_pton(cp, -1 /* len */, dst, '\\', NULL);
-        } else if (address_family == AF_INET6) {
+        else if (address_family == AF_INET6)
                 ret = in6_pton(cp, -1 /* len */, dst , '\\', NULL);
-        }
+
         cFYI(DBG2, ("address conversion returned %d for %s", ret, cp));
         if (ret > 0)
                 ret = 1;
diff --git a/fs/cifs/ntlmssp.h b/fs/cifs/ntlmssp.h
index 7170a9b70f1e..c377d8065d99 100644
--- a/fs/cifs/ntlmssp.h
+++ b/fs/cifs/ntlmssp.h
@@ -64,7 +64,7 @@ typedef struct _SECURITY_BUFFER {
 } __attribute__((packed)) SECURITY_BUFFER;
 
 typedef struct _NEGOTIATE_MESSAGE {
-        __u8 Signature[sizeof (NTLMSSP_SIGNATURE)];
+        __u8 Signature[sizeof(NTLMSSP_SIGNATURE)];
         __le32 MessageType;     /* 1 */
         __le32 NegotiateFlags;
         SECURITY_BUFFER DomainName;     /* RFC 1001 style and ASCII */
@@ -74,7 +74,7 @@ typedef struct _NEGOTIATE_MESSAGE {
 } __attribute__((packed)) NEGOTIATE_MESSAGE, *PNEGOTIATE_MESSAGE;
 
 typedef struct _CHALLENGE_MESSAGE {
-        __u8 Signature[sizeof (NTLMSSP_SIGNATURE)];
+        __u8 Signature[sizeof(NTLMSSP_SIGNATURE)];
         __le32 MessageType;   /* 2 */
         SECURITY_BUFFER TargetName;
         __le32 NegotiateFlags;
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 34ec32100c72..83f306954883 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -132,6 +132,7 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
         __u32 attr;
         __u64 allocation_size;
         __u64 end_of_file;
+        umode_t default_mode;
 
         /* save mtime and size */
         local_mtime = tmp_inode->i_mtime;
@@ -187,48 +188,54 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
         if (atomic_read(&cifsInfo->inUse) == 0) {
                 tmp_inode->i_uid = cifs_sb->mnt_uid;
                 tmp_inode->i_gid = cifs_sb->mnt_gid;
-                /* set default mode. will override for dirs below */
-                tmp_inode->i_mode = cifs_sb->mnt_file_mode;
-        } else {
-                /* mask off the type bits since it gets set
-                below and we do not want to get two type
-                bits set */
+        }
+
+        if (attr & ATTR_DIRECTORY)
+                default_mode = cifs_sb->mnt_dir_mode;
+        else
+                default_mode = cifs_sb->mnt_file_mode;
+
+        /* set initial permissions */
+        if ((atomic_read(&cifsInfo->inUse) == 0) ||
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
+                tmp_inode->i_mode = default_mode;
+        else {
+                /* just reenable write bits if !ATTR_READONLY */
+                if ((tmp_inode->i_mode & S_IWUGO) == 0 &&
+                    (attr & ATTR_READONLY) == 0)
+                        tmp_inode->i_mode |= (S_IWUGO & default_mode);
+
                 tmp_inode->i_mode &= ~S_IFMT;
         }
 
-        if (attr & ATTR_DIRECTORY) {
-                *pobject_type = DT_DIR;
-                /* override default perms since we do not lock dirs */
-                if (atomic_read(&cifsInfo->inUse) == 0)
-                        tmp_inode->i_mode = cifs_sb->mnt_dir_mode;
-                tmp_inode->i_mode |= S_IFDIR;
-        } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
-                   (attr & ATTR_SYSTEM)) {
+        /* clear write bits if ATTR_READONLY is set */
+        if (attr & ATTR_READONLY)
+                tmp_inode->i_mode &= ~S_IWUGO;
+
+        /* set inode type */
+        if ((attr & ATTR_SYSTEM) &&
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)) {
                 if (end_of_file == 0)  {
-                        *pobject_type = DT_FIFO;
                         tmp_inode->i_mode |= S_IFIFO;
+                        *pobject_type = DT_FIFO;
                 } else {
-                        /* rather than get the type here, we mark the
-                        inode as needing revalidate and get the real type
-                        (blk vs chr vs. symlink) later ie in lookup */
-                        *pobject_type = DT_REG;
+                        /*
+                         * trying to get the type can be slow, so just call
+                         * this a regular file for now, and mark for reval
+                         */
                         tmp_inode->i_mode |= S_IFREG;
+                        *pobject_type = DT_REG;
                         cifsInfo->time = 0;
                 }
-/* we no longer mark these because we could not follow them */
-/*        } else if (attr & ATTR_REPARSE) {
-                *pobject_type = DT_LNK;
-                tmp_inode->i_mode |= S_IFLNK; */
         } else {
-                *pobject_type = DT_REG;
-                tmp_inode->i_mode |= S_IFREG;
-                if (attr & ATTR_READONLY)
-                        tmp_inode->i_mode &= ~(S_IWUGO);
-                else if ((tmp_inode->i_mode & S_IWUGO) == 0)
-                        /* the ATTR_READONLY flag may have been changed on   */
-                        /* server -- set any w bits allowed by mnt_file_mode */
-                        tmp_inode->i_mode |= (S_IWUGO & cifs_sb->mnt_file_mode);
-        } /* could add code here - to validate if device or weird share type? */
+                if (attr & ATTR_DIRECTORY) {
+                        tmp_inode->i_mode |= S_IFDIR;
+                        *pobject_type = DT_DIR;
+                } else {
+                        tmp_inode->i_mode |= S_IFREG;
+                        *pobject_type = DT_REG;
+                }
+        }
 
         /* can not fill in nlink here as in qpathinfo version and Unx search */
         if (atomic_read(&cifsInfo->inUse) == 0)
@@ -670,10 +677,11 @@ static int find_cifs_entry(const int xid, struct cifsTconInfo *pTcon,
            (index_to_find < first_entry_in_buffer)) {
                 /* close and restart search */
                 cFYI(1, ("search backing up - close and restart search"));
-                cifsFile->invalidHandle = true;
-                CIFSFindClose(xid, pTcon, cifsFile->netfid);
-                kfree(cifsFile->search_resume_name);
-                cifsFile->search_resume_name = NULL;
+                if (!cifsFile->srch_inf.endOfSearch &&
+                    !cifsFile->invalidHandle) {
+                        cifsFile->invalidHandle = true;
+                        CIFSFindClose(xid, pTcon, cifsFile->netfid);
+                }
                 if (cifsFile->srch_inf.ntwrk_buf_start) {
                         cFYI(1, ("freeing SMB ff cache buf on search rewind"));
                         if (cifsFile->srch_inf.smallBuf)
@@ -1040,9 +1048,7 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                 } /* else {
                         cifsFile->invalidHandle = true;
                         CIFSFindClose(xid, pTcon, cifsFile->netfid);
-                }
-                kfree(cifsFile->search_resume_name);
-                cifsFile->search_resume_name = NULL; */
+                } */
 
                 rc = find_cifs_entry(xid, pTcon, file,
                                 &current_entry, &num_to_fill);