12 files changed, 50 insertions, 18 deletions

diff --git a/arch/ia64/kernel/domain.c b/arch/ia64/kernel/domain.c
index d65e87b6394f..bbb8efe126b7 100644
--- a/arch/ia64/kernel/domain.c
+++ b/arch/ia64/kernel/domain.c
@@ -341,7 +341,7 @@ next_sg:
 #endif
 
         /* Attach the domains */
-        for_each_online_cpu(i) {
+        for_each_cpu_mask(i, *cpu_map) {
                 struct sched_domain *sd;
 #ifdef CONFIG_SCHED_SMT
                 sd = &per_cpu(cpu_domains, i);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 4845911f1c63..bb7ca022bcb2 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -814,28 +814,39 @@ nfs_setattr(struct dentry *dentry, struct iattr *attr)
                 nfs_wb_all(inode);
         }
         error = NFS_PROTO(inode)->setattr(dentry, &fattr, attr);
-        if (error == 0) {
+        if (error == 0)
                 nfs_refresh_inode(inode, &fattr);
+        nfs_end_data_update(inode);
+        unlock_kernel();
+        return error;
+}
+
+/**
+ * nfs_setattr_update_inode - Update inode metadata after a setattr call.
+ * @inode: pointer to struct inode
+ * @attr: pointer to struct iattr
+ *
+ * Note: we do this in the *proc.c in order to ensure that
+ *       it works for things like exclusive creates too.
+ */
+void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr)
+{
+        if ((attr->ia_valid & (ATTR_MODE|ATTR_UID|ATTR_GID)) != 0) {
                 if ((attr->ia_valid & ATTR_MODE) != 0) {
-                        int mode;
-                        mode = inode->i_mode & ~S_IALLUGO;
-                        mode |= attr->ia_mode & S_IALLUGO;
+                        int mode = attr->ia_mode & S_IALLUGO;
+                        mode |= inode->i_mode & ~S_IALLUGO;
                         inode->i_mode = mode;
                 }
                 if ((attr->ia_valid & ATTR_UID) != 0)
                         inode->i_uid = attr->ia_uid;
                 if ((attr->ia_valid & ATTR_GID) != 0)
                         inode->i_gid = attr->ia_gid;
-                if ((attr->ia_valid & ATTR_SIZE) != 0) {
-                        inode->i_size = attr->ia_size;
-                        vmtruncate(inode, attr->ia_size);
-                }
-        }
-        if ((attr->ia_valid & (ATTR_MODE|ATTR_UID|ATTR_GID)) != 0)
                 NFS_FLAGS(inode) |= NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
-        nfs_end_data_update(inode);
-        unlock_kernel();
-        return error;
+        }
+        if ((attr->ia_valid & ATTR_SIZE) != 0) {
+                inode->i_size = attr->ia_size;
+                vmtruncate(inode, attr->ia_size);
+        }
 }
 
 /*
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 7851569b31c6..2681485cf2d0 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -120,6 +120,8 @@ nfs3_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
         dprintk("NFS call  setattr\n");
         fattr->valid = 0;
         status = rpc_call(NFS_CLIENT(inode), NFS3PROC_SETATTR, &arg, fattr, 0);
+        if (status == 0)
+                nfs_setattr_update_inode(inode, sattr);
         dprintk("NFS reply setattr: %d\n", status);
         return status;
 }
@@ -370,6 +372,8 @@ again:
                  * not sure this buys us anything (and I'd have
                  * to revamp the NFSv3 XDR code) */
                 status = nfs3_proc_setattr(dentry, &fattr, sattr);
+                if (status == 0)
+                        nfs_setattr_update_inode(dentry->d_inode, sattr);
                 nfs_refresh_inode(dentry->d_inode, &fattr);
                 dprintk("NFS reply setattr (post-create): %d\n", status);
         }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 1b76f80aedb9..0c5a308e4963 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -753,6 +753,7 @@ static int _nfs4_do_setattr(struct nfs_server *server, struct nfs_fattr *fattr,
                 .rpc_argp       = &arg,
                 .rpc_resp       = &res,
         };
+        int status;
 
         fattr->valid = 0;
 
@@ -762,7 +763,8 @@ static int _nfs4_do_setattr(struct nfs_server *server, struct nfs_fattr *fattr,
         } else
                 memcpy(&arg.stateid, &zero_stateid, sizeof(arg.stateid));
 
-        return rpc_call_sync(server->client, &msg, 0);
+        status = rpc_call_sync(server->client, &msg, 0);
+        return status;
 }
 
 static int nfs4_do_setattr(struct nfs_server *server, struct nfs_fattr *fattr,
@@ -1145,6 +1147,8 @@ nfs4_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
 
         status = nfs4_do_setattr(NFS_SERVER(inode), fattr,
                         NFS_FH(inode), sattr, state);
+        if (status == 0)
+                nfs_setattr_update_inode(inode, sattr);
         if (state != NULL)
                 nfs4_close_state(state, FMODE_WRITE);
         put_rpccred(cred);
@@ -1449,8 +1453,10 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
                 struct nfs_fattr fattr;
                 status = nfs4_do_setattr(NFS_SERVER(dir), &fattr,
                                      NFS_FH(state->inode), sattr, state);
-                if (status == 0)
+                if (status == 0) {
+                        nfs_setattr_update_inode(state->inode, sattr);
                         goto out;
+                }
         } else if (flags != 0)
                 goto out;
         nfs4_close_state(state, flags);
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index cedf636bcf3c..be23c3fb9260 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -114,6 +114,8 @@ nfs_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
         dprintk("NFS call  setattr\n");
         fattr->valid = 0;
         status = rpc_call(NFS_CLIENT(inode), NFSPROC_SETATTR, &arg, fattr, 0);
+        if (status == 0)
+                nfs_setattr_update_inode(inode, sattr);
         dprintk("NFS reply setattr: %d\n", status);
         return status;
 }
diff --git a/fs/nfs_common/nfsacl.c b/fs/nfs_common/nfsacl.c
index 18c58c32e326..251e5a1bb1c4 100644
--- a/fs/nfs_common/nfsacl.c
+++ b/fs/nfs_common/nfsacl.c
@@ -239,6 +239,7 @@ nfsacl_decode(struct xdr_buf *buf, unsigned int base, unsigned int *aclcnt,
         if (xdr_decode_word(buf, base, &entries) ||
             entries > NFS_ACL_MAX_ENTRIES)
                 return -EINVAL;
+        nfsacl_desc.desc.array_maxlen = entries;
         err = xdr_decode_array2(buf, base + 4, &nfsacl_desc.desc);
         if (err)
                 return err;
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog
index 9709fac6531d..21e21fe519e2 100644
--- a/fs/ntfs/ChangeLog
+++ b/fs/ntfs/ChangeLog
@@ -174,6 +174,9 @@ ToDo/Notes:
           fact that the vfs and ntfs inodes are one struct in memory to find
           the ntfs inode in memory if present.  Also, the ntfs inode has its
           own locking so it does not matter if the vfs inode is locked.
+        - Fix bug in mft record writing where we forgot to set the device in
+          the buffers when mapping them after the VM had discarded them
+          Thanks to Martin MOKREJŠ for the bug report.
 
 2.1.22 - Many bug and race fixes and error handling improvements.
 
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index ac9ff39aa834..317f7c679fd3 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -533,6 +533,7 @@ int ntfs_sync_mft_mirror(ntfs_volume *vol, const unsigned long mft_no,
                         LCN lcn;
                         unsigned int vcn_ofs;
 
+                        bh->b_bdev = vol->sb->s_bdev;
                         /* Obtain the vcn and offset of the current block. */
                         vcn = ((VCN)mft_no << vol->mft_record_size_bits) +
                                         (block_start - m_start);
@@ -725,6 +726,7 @@ int write_mft_record_nolock(ntfs_inode *ni, MFT_RECORD *m, int sync)
                         LCN lcn;
                         unsigned int vcn_ofs;
 
+                        bh->b_bdev = vol->sb->s_bdev;
                         /* Obtain the vcn and offset of the current block. */
                         vcn = ((VCN)ni->mft_no << vol->mft_record_size_bits) +
                                         (block_start - m_start);
diff --git a/include/asm-um/page.h b/include/asm-um/page.h
index 5afee8a8cdf3..f58aedadeb4e 100644
--- a/include/asm-um/page.h
+++ b/include/asm-um/page.h
@@ -104,8 +104,8 @@ extern void *to_virt(unsigned long phys);
  * casting is the right thing, but 32-bit UML can't have 64-bit virtual
  * addresses
  */
-#define __pa(virt) to_phys((void *) (unsigned long) virt)
-#define __va(phys) to_virt((unsigned long) phys)
+#define __pa(virt) to_phys((void *) (unsigned long) (virt))
+#define __va(phys) to_virt((unsigned long) (phys))
 
 #define page_to_pfn(page) ((page) - mem_map)
 #define pfn_to_page(pfn) (mem_map + (pfn))
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 8ea249110fb0..7d78a783c64a 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -292,6 +292,7 @@ extern int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode);
 extern int __nfs_revalidate_inode(struct nfs_server *, struct inode *);
 extern void nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping);
 extern int nfs_setattr(struct dentry *, struct iattr *);
+extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr);
 extern void nfs_begin_attr_update(struct inode *);
 extern void nfs_end_attr_update(struct inode *);
 extern void nfs_begin_data_update(struct inode *);
diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
index 34ec3e8d99b3..23448d0fb5bc 100644
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -177,6 +177,7 @@ typedef int (*xdr_xcode_elem_t)(struct xdr_array2_desc *desc, void *elem);
 struct xdr_array2_desc {
         unsigned int elem_size;
         unsigned int array_len;
+        unsigned int array_maxlen;
         xdr_xcode_elem_t xcode;
 };
 
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 8a4d9c106af1..fde16f40a581 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -993,6 +993,7 @@ xdr_xcode_array2(struct xdr_buf *buf, unsigned int base,
                         return -EINVAL;
         } else {
                 if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
+                    desc->array_len > desc->array_maxlen ||
                     (unsigned long) base + 4 + desc->array_len *
                                     desc->elem_size > buf->len)
                         return -EINVAL;