15 files changed, 390 insertions, 316 deletions

diff --git a/fs/nfsd/auth.h b/fs/nfsd/auth.h
new file mode 100644
index 000000000000..78b3c0e93822
--- /dev/null
+++ b/fs/nfsd/auth.h
@@ -0,0 +1,22 @@
+/*
+ * nfsd-specific authentication stuff.
+ * uid/gid mapping not yet implemented.
+ *
+ * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
+ */
+
+#ifndef LINUX_NFSD_AUTH_H
+#define LINUX_NFSD_AUTH_H
+
+#define nfsd_luid(rq, uid)      ((u32)(uid))
+#define nfsd_lgid(rq, gid)      ((u32)(gid))
+#define nfsd_ruid(rq, uid)      ((u32)(uid))
+#define nfsd_rgid(rq, gid)      ((u32)(gid))
+
+/*
+ * Set the current process's fsuid/fsgid etc to those of the NFS
+ * client user
+ */
+int nfsd_setuser(struct svc_rqst *, struct svc_export *);
+
+#endif /* LINUX_NFSD_AUTH_H */
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 66d0aeb32a47..79b4bf812960 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -1357,8 +1357,6 @@ exp_pseudoroot(struct svc_rqst *rqstp, struct svc_fh *fhp)
         mk_fsid(FSID_NUM, fsidv, 0, 0, 0, NULL);
 
         exp = rqst_exp_find(rqstp, FSID_NUM, fsidv);
-        if (PTR_ERR(exp) == -ENOENT)
-                return nfserr_perm;
         if (IS_ERR(exp))
                 return nfserrno(PTR_ERR(exp));
         rv = fh_compose(fhp, exp, exp->ex_dentry, NULL);
@@ -1637,13 +1635,19 @@ exp_verify_string(char *cp, int max)
 /*
  * Initialize the exports module.
  */
-void
+int
 nfsd_export_init(void)
 {
+        int rv;
         dprintk("nfsd: initializing export module.\n");
 
-        cache_register(&svc_export_cache);
-        cache_register(&svc_expkey_cache);
+        rv = cache_register(&svc_export_cache);
+        if (rv)
+                return rv;
+        rv = cache_register(&svc_expkey_cache);
+        if (rv)
+                cache_unregister(&svc_export_cache);
+        return rv;
 
 }
 
@@ -1670,10 +1674,8 @@ nfsd_export_shutdown(void)
 
         exp_writelock();
 
-        if (cache_unregister(&svc_expkey_cache))
-                printk(KERN_ERR "nfsd: failed to unregister expkey cache\n");
-        if (cache_unregister(&svc_export_cache))
-                printk(KERN_ERR "nfsd: failed to unregister export cache\n");
+        cache_unregister(&svc_expkey_cache);
+        cache_unregister(&svc_export_cache);
         svcauth_unix_purge();
 
         exp_writeunlock();
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index 0e5fa11e6b44..1c3b7654e966 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -221,12 +221,17 @@ static int nfsaclsvc_encode_getaclres(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_getaclres *resp)
 {
         struct dentry *dentry = resp->fh.fh_dentry;
-        struct inode *inode = dentry->d_inode;
+        struct inode *inode;
         struct kvec *head = rqstp->rq_res.head;
         unsigned int base;
         int n;
         int w;
 
+        /*
+         * Since this is version 2, the check for nfserr in
+         * nfsd_dispatch actually ensures the following cannot happen.
+         * However, it seems fragile to depend on that.
+         */
         if (dentry == NULL || dentry->d_inode == NULL)
                 return 0;
         inode = dentry->d_inode;
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index f917fd25858a..d7647f70e02b 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -21,6 +21,7 @@
 #include <linux/sunrpc/svc.h>
 #include <linux/nfsd/nfsd.h>
 #include <linux/nfsd/xdr3.h>
+#include "auth.h"
 
 #define NFSDDBG_FACILITY                NFSDDBG_XDR
 
@@ -88,10 +89,10 @@ encode_fh(__be32 *p, struct svc_fh *fhp)
  * no slashes or null bytes.
  */
 static __be32 *
-decode_filename(__be32 *p, char **namp, int *lenp)
+decode_filename(__be32 *p, char **namp, unsigned int *lenp)
 {
         char            *name;
-        int             i;
+        unsigned int    i;
 
         if ((p = xdr_decode_string_inplace(p, namp, lenp, NFS3_MAXNAMLEN)) != NULL) {
                 for (i = 0, name = *namp; i < *lenp; i++, name++) {
@@ -452,8 +453,7 @@ int
 nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_symlinkargs *args)
 {
-        unsigned int len;
-        int avail;
+        unsigned int len, avail;
         char *old, *new;
         struct kvec *vec;
 
@@ -486,7 +486,8 @@ nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, __be32 *p,
         /* now copy next page if there is one */
         if (len && !avail && rqstp->rq_arg.page_len) {
                 avail = rqstp->rq_arg.page_len;
-                if (avail > PAGE_SIZE) avail = PAGE_SIZE;
+                if (avail > PAGE_SIZE)
+                        avail = PAGE_SIZE;
                 old = page_address(rqstp->rq_arg.pages[0]);
         }
         while (len && avail && *old) {
@@ -816,11 +817,11 @@ static __be32 *
 encode_entryplus_baggage(struct nfsd3_readdirres *cd, __be32 *p,
                 struct svc_fh *fhp)
 {
-                p = encode_post_op_attr(cd->rqstp, p, fhp);
-                *p++ = xdr_one;                 /* yes, a file handle follows */
-                p = encode_fh(p, fhp);
-                fh_put(fhp);
-                return p;
+        p = encode_post_op_attr(cd->rqstp, p, fhp);
+        *p++ = xdr_one;                 /* yes, a file handle follows */
+        p = encode_fh(p, fhp);
+        fh_put(fhp);
+        return p;
 }
 
 static int
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index 9d536a8cb379..aae2b29ae2c9 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -350,30 +350,6 @@ static struct rpc_version *	nfs_cb_version[] = {
 static int do_probe_callback(void *data)
 {
         struct nfs4_client *clp = data;
-        struct nfs4_callback *cb = &clp->cl_callback;
-        struct rpc_message msg = {
-                .rpc_proc       = &nfs4_cb_procedures[NFSPROC4_CLNT_CB_NULL],
-                .rpc_argp       = clp,
-        };
-        int status;
-
-        status = rpc_call_sync(cb->cb_client, &msg, RPC_TASK_SOFT);
-
-        if (status) {
-                rpc_shutdown_client(cb->cb_client);
-                cb->cb_client = NULL;
-        } else
-                atomic_set(&cb->cb_set, 1);
-        put_nfs4_client(clp);
-        return 0;
-}
-
-/*
- * Set up the callback client and put a NFSPROC4_CB_NULL on the wire...
- */
-void
-nfsd4_probe_callback(struct nfs4_client *clp)
-{
         struct sockaddr_in      addr;
         struct nfs4_callback    *cb = &clp->cl_callback;
         struct rpc_timeout      timeparms = {
@@ -390,13 +366,15 @@ nfsd4_probe_callback(struct nfs4_client *clp)
                 .timeout        = &timeparms,
                 .program        = program,
                 .version        = nfs_cb_version[1]->number,
-                .authflavor     = RPC_AUTH_UNIX,        /* XXX: need AUTH_GSS... */
+                .authflavor     = RPC_AUTH_UNIX, /* XXX: need AUTH_GSS... */
                 .flags          = (RPC_CLNT_CREATE_NOPING),
         };
-        struct task_struct *t;
-
-        if (atomic_read(&cb->cb_set))
-                return;
+        struct rpc_message msg = {
+                .rpc_proc       = &nfs4_cb_procedures[NFSPROC4_CLNT_CB_NULL],
+                .rpc_argp       = clp,
+        };
+        struct rpc_clnt *client;
+        int status;
 
         /* Initialize address */
         memset(&addr, 0, sizeof(addr));
@@ -416,29 +394,50 @@ nfsd4_probe_callback(struct nfs4_client *clp)
         program->stats->program = program;
 
         /* Create RPC client */
-        cb->cb_client = rpc_create(&args);
-        if (IS_ERR(cb->cb_client)) {
+        client = rpc_create(&args);
+        if (IS_ERR(client)) {
                 dprintk("NFSD: couldn't create callback client\n");
+                status = PTR_ERR(client);
                 goto out_err;
         }
 
+        status = rpc_call_sync(client, &msg, RPC_TASK_SOFT);
+
+        if (status)
+                goto out_release_client;
+
+        cb->cb_client = client;
+        atomic_set(&cb->cb_set, 1);
+        put_nfs4_client(clp);
+        return 0;
+out_release_client:
+        rpc_shutdown_client(client);
+out_err:
+        put_nfs4_client(clp);
+        dprintk("NFSD: warning: no callback path to client %.*s\n",
+                (int)clp->cl_name.len, clp->cl_name.data);
+        return status;
+}
+
+/*
+ * Set up the callback client and put a NFSPROC4_CB_NULL on the wire...
+ */
+void
+nfsd4_probe_callback(struct nfs4_client *clp)
+{
+        struct task_struct *t;
+
+        BUG_ON(atomic_read(&clp->cl_callback.cb_set));
+
         /* the task holds a reference to the nfs4_client struct */
         atomic_inc(&clp->cl_count);
 
         t = kthread_run(do_probe_callback, clp, "nfs4_cb_probe");
 
         if (IS_ERR(t))
-                goto out_release_clp;
+                atomic_dec(&clp->cl_count);
 
         return;
-
-out_release_clp:
-        atomic_dec(&clp->cl_count);
-        rpc_shutdown_client(cb->cb_client);
-out_err:
-        cb->cb_client = NULL;
-        dprintk("NFSD: warning: no callback path to client %.*s\n",
-                (int)clp->cl_name.len, clp->cl_name.data);
 }
 
 /*
@@ -458,9 +457,6 @@ nfsd4_cb_recall(struct nfs4_delegation *dp)
         int retries = 1;
         int status = 0;
 
-        if ((!atomic_read(&clp->cl_callback.cb_set)) || !clnt)
-                return;
-
         cbr->cbr_trunc = 0; /* XXX need to implement truncate optimization */
         cbr->cbr_dp = dp;
 
@@ -469,6 +465,7 @@ nfsd4_cb_recall(struct nfs4_delegation *dp)
                 switch (status) {
                         case -EIO:
                                 /* Network partition? */
+                                atomic_set(&clp->cl_callback.cb_set, 0);
                         case -EBADHANDLE:
                         case -NFS4ERR_BAD_STATEID:
                                 /* Race: client probably got cb_recall
@@ -481,11 +478,10 @@ nfsd4_cb_recall(struct nfs4_delegation *dp)
                 status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFT);
         }
 out_put_cred:
-        if (status == -EIO)
-                atomic_set(&clp->cl_callback.cb_set, 0);
-        /* Success or failure, now we're either waiting for lease expiration
-         * or deleg_return. */
-        dprintk("NFSD: nfs4_cb_recall: dp %p dl_flock %p dl_count %d\n",dp, dp->dl_flock, atomic_read(&dp->dl_count));
+        /*
+         * Success or failure, now we're either waiting for lease expiration
+         * or deleg_return.
+         */
         put_nfs4_client(clp);
         nfs4_put_delegation(dp);
         return;
diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
index 4c0c683ce07a..996bd88b75ba 100644
--- a/fs/nfsd/nfs4idmap.c
+++ b/fs/nfsd/nfs4idmap.c
@@ -255,13 +255,10 @@ idtoname_parse(struct cache_detail *cd, char *buf, int buflen)
                 goto out;
         if (len == 0)
                 set_bit(CACHE_NEGATIVE, &ent.h.flags);
-        else {
-                if (error >= IDMAP_NAMESZ) {
-                        error = -EINVAL;
-                        goto out;
-                }
+        else if (len >= IDMAP_NAMESZ)
+                goto out;
+        else
                 memcpy(ent.name, buf1, sizeof(ent.name));
-        }
         error = -ENOMEM;
         res = idtoname_update(&ent, res);
         if (res == NULL)
@@ -467,20 +464,25 @@ nametoid_update(struct ent *new, struct ent *old)
  * Exported API
  */
 
-void
+int
 nfsd_idmap_init(void)
 {
-        cache_register(&idtoname_cache);
-        cache_register(&nametoid_cache);
+        int rv;
+
+        rv = cache_register(&idtoname_cache);
+        if (rv)
+                return rv;
+        rv = cache_register(&nametoid_cache);
+        if (rv)
+                cache_unregister(&idtoname_cache);
+        return rv;
 }
 
 void
 nfsd_idmap_shutdown(void)
 {
-        if (cache_unregister(&idtoname_cache))
-                printk(KERN_ERR "nfsd: failed to unregister idtoname cache\n");
-        if (cache_unregister(&nametoid_cache))
-                printk(KERN_ERR "nfsd: failed to unregister nametoid cache\n");
+        cache_unregister(&idtoname_cache);
+        cache_unregister(&nametoid_cache);
 }
 
 /*
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 18ead1790bb3..c593db047d8b 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -750,7 +750,7 @@ _nfsd4_verify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                                     cstate->current_fh.fh_export,
                                     cstate->current_fh.fh_dentry, buf,
                                     &count, verify->ve_bmval,
-                                    rqstp);
+                                    rqstp, 0);
 
         /* this means that nfsd4_encode_fattr() ran out of space */
         if (status == nfserr_resource && count == 0)
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 31673cd251c3..f6744bc03dae 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -61,7 +61,6 @@ static time_t lease_time = 90;     /* default lease time */
 static time_t user_lease_time = 90;
 static time_t boot_time;
 static int in_grace = 1;
-static u32 current_clientid = 1;
 static u32 current_ownerid = 1;
 static u32 current_fileid = 1;
 static u32 current_delegid = 1;
@@ -340,21 +339,20 @@ STALE_CLIENTID(clientid_t *clid)
  * This type of memory management is somewhat inefficient, but we use it
  * anyway since SETCLIENTID is not a common operation.
  */
-static inline struct nfs4_client *
-alloc_client(struct xdr_netobj name)
+static struct nfs4_client *alloc_client(struct xdr_netobj name)
 {
         struct nfs4_client *clp;
 
-        if ((clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL))!= NULL) {
-                if ((clp->cl_name.data = kmalloc(name.len, GFP_KERNEL)) != NULL) {
-                        memcpy(clp->cl_name.data, name.data, name.len);
-                        clp->cl_name.len = name.len;
-                }
-                else {
-                        kfree(clp);
-                        clp = NULL;
-                }
+        clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
+        if (clp == NULL)
+                return NULL;
+        clp->cl_name.data = kmalloc(name.len, GFP_KERNEL);
+        if (clp->cl_name.data == NULL) {
+                kfree(clp);
+                return NULL;
         }
+        memcpy(clp->cl_name.data, name.data, name.len);
+        clp->cl_name.len = name.len;
         return clp;
 }
 
@@ -363,8 +361,11 @@ shutdown_callback_client(struct nfs4_client *clp)
 {
         struct rpc_clnt *clnt = clp->cl_callback.cb_client;
 
-        /* shutdown rpc client, ending any outstanding recall rpcs */
         if (clnt) {
+                /*
+                 * Callback threads take a reference on the client, so there
+                 * should be no outstanding callbacks at this point.
+                 */
                 clp->cl_callback.cb_client = NULL;
                 rpc_shutdown_client(clnt);
         }
@@ -422,12 +423,13 @@ expire_client(struct nfs4_client *clp)
         put_nfs4_client(clp);
 }
 
-static struct nfs4_client *
-create_client(struct xdr_netobj name, char *recdir) {
+static struct nfs4_client *create_client(struct xdr_netobj name, char *recdir)
+{
         struct nfs4_client *clp;
 
-        if (!(clp = alloc_client(name)))
-                goto out;
+        clp = alloc_client(name);
+        if (clp == NULL)
+                return NULL;
         memcpy(clp->cl_recdir, recdir, HEXDIR_LEN);
         atomic_set(&clp->cl_count, 1);
         atomic_set(&clp->cl_callback.cb_set, 0);
@@ -436,32 +438,30 @@ create_client(struct xdr_netobj name, char *recdir) {
         INIT_LIST_HEAD(&clp->cl_openowners);
         INIT_LIST_HEAD(&clp->cl_delegations);
         INIT_LIST_HEAD(&clp->cl_lru);
-out:
         return clp;
 }
 
-static void
-copy_verf(struct nfs4_client *target, nfs4_verifier *source) {
-        memcpy(target->cl_verifier.data, source->data, sizeof(target->cl_verifier.data));
+static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
+{
+        memcpy(target->cl_verifier.data, source->data,
+                        sizeof(target->cl_verifier.data));
 }
 
-static void
-copy_clid(struct nfs4_client *target, struct nfs4_client *source) {
+static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
+{
         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot; 
         target->cl_clientid.cl_id = source->cl_clientid.cl_id; 
 }
 
-static void
-copy_cred(struct svc_cred *target, struct svc_cred *source) {
-
+static void copy_cred(struct svc_cred *target, struct svc_cred *source)
+{
         target->cr_uid = source->cr_uid;
         target->cr_gid = source->cr_gid;
         target->cr_group_info = source->cr_group_info;
         get_group_info(target->cr_group_info);
 }
 
-static inline int
-same_name(const char *n1, const char *n2)
+static int same_name(const char *n1, const char *n2)
 {
         return 0 == memcmp(n1, n2, HEXDIR_LEN);
 }
@@ -485,26 +485,26 @@ same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
         return cr1->cr_uid == cr2->cr_uid;
 }
 
-static void
-gen_clid(struct nfs4_client *clp) {
+static void gen_clid(struct nfs4_client *clp)
+{
+        static u32 current_clientid = 1;
+
         clp->cl_clientid.cl_boot = boot_time;
         clp->cl_clientid.cl_id = current_clientid++; 
 }
 
-static void
-gen_confirm(struct nfs4_client *clp) {
-        struct timespec         tv;
-        u32 *                   p;
+static void gen_confirm(struct nfs4_client *clp)
+{
+        static u32 i;
+        u32 *p;
 
-        tv = CURRENT_TIME;
         p = (u32 *)clp->cl_confirm.data;
-        *p++ = tv.tv_sec;
-        *p++ = tv.tv_nsec;
+        *p++ = get_seconds();
+        *p++ = i++;
 }
 
-static int
-check_name(struct xdr_netobj name) {
-
+static int check_name(struct xdr_netobj name)
+{
         if (name.len == 0) 
                 return 0;
         if (name.len > NFS4_OPAQUE_LIMIT) {
@@ -683,39 +683,6 @@ out_err:
         return;
 }
 
-/*
- * RFC 3010 has a complex implmentation description of processing a 
- * SETCLIENTID request consisting of 5 bullets, labeled as 
- * CASE0 - CASE4 below.
- *
- * NOTES:
- *      callback information will be processed in a future patch
- *
- *      an unconfirmed record is added when:
- *      NORMAL (part of CASE 4): there is no confirmed nor unconfirmed record.
- *      CASE 1: confirmed record found with matching name, principal,
- *              verifier, and clientid.
- *      CASE 2: confirmed record found with matching name, principal,
- *              and there is no unconfirmed record with matching
- *              name and principal
- *
- *      an unconfirmed record is replaced when:
- *      CASE 3: confirmed record found with matching name, principal,
- *              and an unconfirmed record is found with matching 
- *              name, principal, and with clientid and
- *              confirm that does not match the confirmed record.
- *      CASE 4: there is no confirmed record with matching name and 
- *              principal. there is an unconfirmed record with 
- *              matching name, principal.
- *
- *      an unconfirmed record is deleted when:
- *      CASE 1: an unconfirmed record that matches input name, verifier,
- *              and confirmed clientid.
- *      CASE 4: any unconfirmed records with matching name and principal
- *              that exist after an unconfirmed record has been replaced
- *              as described above.
- *
- */
 __be32
 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                   struct nfsd4_setclientid *setclid)
@@ -748,11 +715,7 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         nfs4_lock_state();
         conf = find_confirmed_client_by_str(dname, strhashval);
         if (conf) {
-                /* 
-                 * CASE 0:
-                 * clname match, confirmed, different principal
-                 * or different ip_address
-                 */
+                /* RFC 3530 14.2.33 CASE 0: */
                 status = nfserr_clid_inuse;
                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)
                                 || conf->cl_addr != sin->sin_addr.s_addr) {
@@ -761,12 +724,17 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                         goto out;
                 }
         }
+        /*
+         * section 14.2.33 of RFC 3530 (under the heading "IMPLEMENTATION")
+         * has a description of SETCLIENTID request processing consisting
+         * of 5 bullet points, labeled as CASE0 - CASE4 below.
+         */
         unconf = find_unconfirmed_client_by_str(dname, strhashval);
         status = nfserr_resource;
         if (!conf) {
-                /* 
-                 * CASE 4:
-                 * placed first, because it is the normal case.
+                /*
+                 * RFC 3530 14.2.33 CASE 4:
+                 * placed first, because it is the normal case
                  */
                 if (unconf)
                         expire_client(unconf);
@@ -776,17 +744,8 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 gen_clid(new);
         } else if (same_verf(&conf->cl_verifier, &clverifier)) {
                 /*
-                 * CASE 1:
-                 * cl_name match, confirmed, principal match
-                 * verifier match: probable callback update
-                 *
-                 * remove any unconfirmed nfs4_client with 
-                 * matching cl_name, cl_verifier, and cl_clientid
-                 *
-                 * create and insert an unconfirmed nfs4_client with same 
-                 * cl_name, cl_verifier, and cl_clientid as existing 
-                 * nfs4_client,  but with the new callback info and a 
-                 * new cl_confirm
+                 * RFC 3530 14.2.33 CASE 1:
+                 * probable callback update
                  */
                 if (unconf) {
                         /* Note this is removing unconfirmed {*x***},
@@ -802,43 +761,25 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 copy_clid(new, conf);
         } else if (!unconf) {
                 /*
-                 * CASE 2:
-                 * clname match, confirmed, principal match
-                 * verfier does not match
-                 * no unconfirmed. create a new unconfirmed nfs4_client
-                 * using input clverifier, clname, and callback info
-                 * and generate a new cl_clientid and cl_confirm.
+                 * RFC 3530 14.2.33 CASE 2:
+                 * probable client reboot; state will be removed if
+                 * confirmed.
                  */
                 new = create_client(clname, dname);
                 if (new == NULL)
                         goto out;
                 gen_clid(new);
-        } else if (!same_verf(&conf->cl_confirm, &unconf->cl_confirm)) {
-                /*      
-                 * CASE3:
-                 * confirmed found (name, principal match)
-                 * confirmed verifier does not match input clverifier
-                 *
-                 * unconfirmed found (name match)
-                 * confirmed->cl_confirm != unconfirmed->cl_confirm
-                 *
-                 * remove unconfirmed.
-                 *
-                 * create an unconfirmed nfs4_client 
-                 * with same cl_name as existing confirmed nfs4_client, 
-                 * but with new callback info, new cl_clientid,
-                 * new cl_verifier and a new cl_confirm
+        } else {
+                /*
+                 * RFC 3530 14.2.33 CASE 3:
+                 * probable client reboot; state will be removed if
+                 * confirmed.
                  */
                 expire_client(unconf);
                 new = create_client(clname, dname);
                 if (new == NULL)
                         goto out;
                 gen_clid(new);
-        } else {
-                /* No cases hit !!! */
-                status = nfserr_inval;
-                goto out;
-
         }
         copy_verf(new, &clverifier);
         new->cl_addr = sin->sin_addr.s_addr;
@@ -857,11 +798,9 @@ out:
 
 
 /*
- * RFC 3010 has a complex implmentation description of processing a 
- * SETCLIENTID_CONFIRM request consisting of 4 bullets describing
- * processing on a DRC miss, labeled as CASE1 - CASE4 below.
- *
- * NOTE: callback information will be processed here in a future patch
+ * Section 14.2.34 of RFC 3530 (under the heading "IMPLEMENTATION") has
+ * a description of SETCLIENTID_CONFIRM request processing consisting of 4
+ * bullets, labeled as CASE1 - CASE4 below.
  */
 __be32
 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
@@ -892,16 +831,16 @@ nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
         if (unconf && unconf->cl_addr != sin->sin_addr.s_addr)
                 goto out;
 
-        if ((conf && unconf) && 
-            (same_verf(&unconf->cl_confirm, &confirm)) &&
-            (same_verf(&conf->cl_verifier, &unconf->cl_verifier)) &&
-            (same_name(conf->cl_recdir,unconf->cl_recdir))  &&
-            (!same_verf(&conf->cl_confirm, &unconf->cl_confirm))) {
-                /* CASE 1:
-                * unconf record that matches input clientid and input confirm.
-                * conf record that matches input clientid.
-                * conf and unconf records match names, verifiers
-                */
+        /*
+         * section 14.2.34 of RFC 3530 has a description of
+         * SETCLIENTID_CONFIRM request processing consisting
+         * of 4 bullet points, labeled as CASE1 - CASE4 below.
+         */
+        if (conf && unconf && same_verf(&confirm, &unconf->cl_confirm)) {
+                /*
+                 * RFC 3530 14.2.34 CASE 1:
+                 * callback update
+                 */
                 if (!same_creds(&conf->cl_cred, &unconf->cl_cred))
                         status = nfserr_clid_inuse;
                 else {
@@ -914,15 +853,11 @@ nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
                         status = nfs_ok;
 
                 }
-        } else if ((conf && !unconf) ||
-            ((conf && unconf) && 
-             (!same_verf(&conf->cl_verifier, &unconf->cl_verifier) ||
-              !same_name(conf->cl_recdir, unconf->cl_recdir)))) {
-                /* CASE 2:
-                 * conf record that matches input clientid.
-                 * if unconf record matches input clientid, then
-                 * unconf->cl_name or unconf->cl_verifier don't match the
-                 * conf record.
+        } else if (conf && !unconf) {
+                /*
+                 * RFC 3530 14.2.34 CASE 2:
+                 * probable retransmitted request; play it safe and
+                 * do nothing.
                  */
                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred))
                         status = nfserr_clid_inuse;
@@ -930,10 +865,9 @@ nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
                         status = nfs_ok;
         } else if (!conf && unconf
                         && same_verf(&unconf->cl_confirm, &confirm)) {
-                /* CASE 3:
-                 * conf record not found.
-                 * unconf record found.
-                 * unconf->cl_confirm matches input confirm
+                /*
+                 * RFC 3530 14.2.34 CASE 3:
+                 * Normal case; new or rebooted client:
                  */
                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred)) {
                         status = nfserr_clid_inuse;
@@ -948,16 +882,15 @@ nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
                         }
                         move_to_confirmed(unconf);
                         conf = unconf;
+                        nfsd4_probe_callback(conf);
                         status = nfs_ok;
                 }
         } else if ((!conf || (conf && !same_verf(&conf->cl_confirm, &confirm)))
             && (!unconf || (unconf && !same_verf(&unconf->cl_confirm,
                                                                 &confirm)))) {
-                /* CASE 4:
-                 * conf record not found, or if conf, conf->cl_confirm does not
-                 * match input confirm.
-                 * unconf record not found, or if unconf, unconf->cl_confirm
-                 * does not match input confirm.
+                /*
+                 * RFC 3530 14.2.34 CASE 4:
+                 * Client probably hasn't noticed that we rebooted yet.
                  */
                 status = nfserr_stale_clientid;
         } else {
@@ -965,8 +898,6 @@ nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
                 status = nfserr_clid_inuse;
         }
 out:
-        if (!status)
-                nfsd4_probe_callback(conf);
         nfs4_unlock_state();
         return status;
 }
@@ -1226,14 +1157,19 @@ find_file(struct inode *ino)
         return NULL;
 }
 
-static int access_valid(u32 x)
+static inline int access_valid(u32 x)
 {
-        return (x > 0 && x < 4);
+        if (x < NFS4_SHARE_ACCESS_READ)
+                return 0;
+        if (x > NFS4_SHARE_ACCESS_BOTH)
+                return 0;
+        return 1;
 }
 
-static int deny_valid(u32 x)
+static inline int deny_valid(u32 x)
 {
-        return (x >= 0 && x < 5);
+        /* Note: unlike access bits, deny bits may be zero. */
+        return x <= NFS4_SHARE_DENY_BOTH;
 }
 
 static void
@@ -2162,8 +2098,10 @@ nfs4_preprocess_seqid_op(struct svc_fh *current_fh, u32 seqid, stateid_t *statei
                 goto check_replay;
         }
 
+        *stpp = stp;
+        *sopp = sop = stp->st_stateowner;
+
         if (lock) {
-                struct nfs4_stateowner *sop = stp->st_stateowner;
                 clientid_t *lockclid = &lock->v.new.clientid;
                 struct nfs4_client *clp = sop->so_client;
                 int lkflg = 0;
@@ -2193,9 +2131,6 @@ nfs4_preprocess_seqid_op(struct svc_fh *current_fh, u32 seqid, stateid_t *statei
                 return nfserr_bad_stateid;
         }
 
-        *stpp = stp;
-        *sopp = sop = stp->st_stateowner;
-
         /*
         *  We now validate the seqid and stateid generation numbers.
         *  For the moment, we ignore the possibility of 
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 57333944af7f..b0592e7c378d 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -148,12 +148,12 @@ xdr_error:					\
         }                                       \
 } while (0)
 
-static __be32 *read_buf(struct nfsd4_compoundargs *argp, int nbytes)
+static __be32 *read_buf(struct nfsd4_compoundargs *argp, u32 nbytes)
 {
         /* We want more bytes than seem to be available.
          * Maybe we need a new page, maybe we have just run out
          */
-        int avail = (char*)argp->end - (char*)argp->p;
+        unsigned int avail = (char *)argp->end - (char *)argp->p;
         __be32 *p;
         if (avail + argp->pagelen < nbytes)
                 return NULL;
@@ -169,6 +169,11 @@ static __be32 *read_buf(struct nfsd4_compoundargs *argp, int nbytes)
                         return NULL;
                 
         }
+        /*
+         * The following memcpy is safe because read_buf is always
+         * called with nbytes > avail, and the two cases above both
+         * guarantee p points to at least nbytes bytes.
+         */
         memcpy(p, argp->p, avail);
         /* step to next page */
         argp->p = page_address(argp->pagelist[0]);
@@ -1448,7 +1453,7 @@ static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *rdattr_err)
 __be32
 nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
                 struct dentry *dentry, __be32 *buffer, int *countp, u32 *bmval,
-                struct svc_rqst *rqstp)
+                struct svc_rqst *rqstp, int ignore_crossmnt)
 {
         u32 bmval0 = bmval[0];
         u32 bmval1 = bmval[1];
@@ -1828,7 +1833,12 @@ out_acl:
         if (bmval1 & FATTR4_WORD1_MOUNTED_ON_FILEID) {
                 if ((buflen -= 8) < 0)
                         goto out_resource;
-                if (exp->ex_mnt->mnt_root->d_inode == dentry->d_inode) {
+                /*
+                 * Get parent's attributes if not ignoring crossmount
+                 * and this is the root of a cross-mounted filesystem.
+                 */
+                if (ignore_crossmnt == 0 &&
+                    exp->ex_mnt->mnt_root->d_inode == dentry->d_inode) {
                         err = vfs_getattr(exp->ex_mnt->mnt_parent,
                                 exp->ex_mnt->mnt_mountpoint, &stat);
                         if (err)
@@ -1864,13 +1874,25 @@ nfsd4_encode_dirent_fattr(struct nfsd4_readdir *cd,
         struct svc_export *exp = cd->rd_fhp->fh_export;
         struct dentry *dentry;
         __be32 nfserr;
+        int ignore_crossmnt = 0;
 
         dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
         if (IS_ERR(dentry))
                 return nfserrno(PTR_ERR(dentry));
 
         exp_get(exp);
-        if (d_mountpoint(dentry)) {
+        /*
+         * In the case of a mountpoint, the client may be asking for
+         * attributes that are only properties of the underlying filesystem
+         * as opposed to the cross-mounted file system. In such a case,
+         * we will not follow the cross mount and will fill the attribtutes
+         * directly from the mountpoint dentry.
+         */
+        if (d_mountpoint(dentry) &&
+            (cd->rd_bmval[0] & ~FATTR4_WORD0_RDATTR_ERROR) == 0 &&
+            (cd->rd_bmval[1] & ~FATTR4_WORD1_MOUNTED_ON_FILEID) == 0)
+                ignore_crossmnt = 1;
+        else if (d_mountpoint(dentry)) {
                 int err;
 
                 /*
@@ -1889,7 +1911,7 @@ nfsd4_encode_dirent_fattr(struct nfsd4_readdir *cd,
 
         }
         nfserr = nfsd4_encode_fattr(NULL, exp, dentry, p, buflen, cd->rd_bmval,
-                                        cd->rd_rqstp);
+                                        cd->rd_rqstp, ignore_crossmnt);
 out_put:
         dput(dentry);
         exp_put(exp);
@@ -2043,7 +2065,7 @@ nfsd4_encode_getattr(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4
         buflen = resp->end - resp->p - (COMPOUND_ERR_SLACK_SPACE >> 2);
         nfserr = nfsd4_encode_fattr(fhp, fhp->fh_export, fhp->fh_dentry,
                                     resp->p, &buflen, getattr->ga_bmval,
-                                    resp->rqstp);
+                                    resp->rqstp, 0);
         if (!nfserr)
                 resp->p += buflen;
         return nfserr;
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 578f2c9d56be..5bfc2ac60d54 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -44,17 +44,17 @@ static int	nfsd_cache_append(struct svc_rqst *rqstp, struct kvec *vec);
  */
 static DEFINE_SPINLOCK(cache_lock);
 
-void
-nfsd_cache_init(void)
+int nfsd_reply_cache_init(void)
 {
         struct svc_cacherep     *rp;
         int                     i;
 
         INIT_LIST_HEAD(&lru_head);
         i = CACHESIZE;
-        while(i) {
+        while (i) {
                 rp = kmalloc(sizeof(*rp), GFP_KERNEL);
-                if (!rp) break;
+                if (!rp)
+                        goto out_nomem;
                 list_add(&rp->c_lru, &lru_head);
                 rp->c_state = RC_UNUSED;
                 rp->c_type = RC_NOCACHE;
@@ -62,23 +62,19 @@ nfsd_cache_init(void)
                 i--;
         }
 
-        if (i)
-                printk (KERN_ERR "nfsd: cannot allocate all %d cache entries, only got %d\n",
-                        CACHESIZE, CACHESIZE-i);
-
         hash_list = kcalloc (HASHSIZE, sizeof(struct hlist_head), GFP_KERNEL);
-        if (!hash_list) {
-                nfsd_cache_shutdown();
-                printk (KERN_ERR "nfsd: cannot allocate %Zd bytes for hash list\n",
-                        HASHSIZE * sizeof(struct hlist_head));
-                return;
-        }
+        if (!hash_list)
+                goto out_nomem;
 
         cache_disabled = 0;
+        return 0;
+out_nomem:
+        printk(KERN_ERR "nfsd: failed to allocate reply cache\n");
+        nfsd_reply_cache_shutdown();
+        return -ENOMEM;
 }
 
-void
-nfsd_cache_shutdown(void)
+void nfsd_reply_cache_shutdown(void)
 {
         struct svc_cacherep     *rp;
 
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 77dc9893b7ba..8516137cdbb0 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -304,6 +304,9 @@ static ssize_t write_filehandle(struct file *file, char *buf, size_t size)
         struct auth_domain *dom;
         struct knfsd_fh fh;
 
+        if (size == 0)
+                return -EINVAL;
+
         if (buf[size-1] != '\n')
                 return -EINVAL;
         buf[size-1] = 0;
@@ -503,7 +506,7 @@ static ssize_t write_ports(struct file *file, char *buf, size_t size)
                 int len = 0;
                 lock_kernel();
                 if (nfsd_serv)
-                        len = svc_sock_names(buf, nfsd_serv, NULL);
+                        len = svc_xprt_names(nfsd_serv, buf, 0);
                 unlock_kernel();
                 return len;
         }
@@ -540,7 +543,7 @@ static ssize_t write_ports(struct file *file, char *buf, size_t size)
                 }
                 return err < 0 ? err : 0;
         }
-        if (buf[0] == '-') {
+        if (buf[0] == '-' && isdigit(buf[1])) {
                 char *toclose = kstrdup(buf+1, GFP_KERNEL);
                 int len = 0;
                 if (!toclose)
@@ -554,6 +557,53 @@ static ssize_t write_ports(struct file *file, char *buf, size_t size)
                 kfree(toclose);
                 return len;
         }
+        /*
+         * Add a transport listener by writing it's transport name
+         */
+        if (isalpha(buf[0])) {
+                int err;
+                char transport[16];
+                int port;
+                if (sscanf(buf, "%15s %4d", transport, &port) == 2) {
+                        err = nfsd_create_serv();
+                        if (!err) {
+                                err = svc_create_xprt(nfsd_serv,
+                                                      transport, port,
+                                                      SVC_SOCK_ANONYMOUS);
+                                if (err == -ENOENT)
+                                        /* Give a reasonable perror msg for
+                                         * bad transport string */
+                                        err = -EPROTONOSUPPORT;
+                        }
+                        return err < 0 ? err : 0;
+                }
+        }
+        /*
+         * Remove a transport by writing it's transport name and port number
+         */
+        if (buf[0] == '-' && isalpha(buf[1])) {
+                struct svc_xprt *xprt;
+                int err = -EINVAL;
+                char transport[16];
+                int port;
+                if (sscanf(&buf[1], "%15s %4d", transport, &port) == 2) {
+                        if (port == 0)
+                                return -EINVAL;
+                        lock_kernel();
+                        if (nfsd_serv) {
+                                xprt = svc_find_xprt(nfsd_serv, transport,
+                                                     AF_UNSPEC, port);
+                                if (xprt) {
+                                        svc_close_xprt(xprt);
+                                        svc_xprt_put(xprt);
+                                        err = 0;
+                                } else
+                                        err = -ENOTCONN;
+                        }
+                        unlock_kernel();
+                        return err < 0 ? err : 0;
+                }
+        }
         return -EINVAL;
 }
 
@@ -616,7 +666,7 @@ static ssize_t write_recoverydir(struct file *file, char *buf, size_t size)
         char *recdir;
         int len, status;
 
-        if (size > PATH_MAX || buf[size-1] != '\n')
+        if (size == 0 || size > PATH_MAX || buf[size-1] != '\n')
                 return -EINVAL;
         buf[size-1] = 0;
 
@@ -674,6 +724,27 @@ static struct file_system_type nfsd_fs_type = {
         .kill_sb        = kill_litter_super,
 };
 
+#ifdef CONFIG_PROC_FS
+static int create_proc_exports_entry(void)
+{
+        struct proc_dir_entry *entry;
+
+        entry = proc_mkdir("fs/nfs", NULL);
+        if (!entry)
+                return -ENOMEM;
+        entry = create_proc_entry("fs/nfs/exports", 0, NULL);
+        if (!entry)
+                return -ENOMEM;
+        entry->proc_fops =  &exports_operations;
+        return 0;
+}
+#else /* CONFIG_PROC_FS */
+static int create_proc_exports_entry(void)
+{
+        return 0;
+}
+#endif
+
 static int __init init_nfsd(void)
 {
         int retval;
@@ -683,32 +754,43 @@ static int __init init_nfsd(void)
         if (retval)
                 return retval;
         nfsd_stat_init();       /* Statistics */
-        nfsd_cache_init();      /* RPC reply cache */
-        nfsd_export_init();     /* Exports table */
+        retval = nfsd_reply_cache_init();
+        if (retval)
+                goto out_free_stat;
+        retval = nfsd_export_init();
+        if (retval)
+                goto out_free_cache;
         nfsd_lockd_init();      /* lockd->nfsd callbacks */
-        nfsd_idmap_init();      /* Name to ID mapping */
-        if (proc_mkdir("fs/nfs", NULL)) {
-                struct proc_dir_entry *entry;
-                entry = create_proc_entry("fs/nfs/exports", 0, NULL);
-                if (entry)
-                        entry->proc_fops =  &exports_operations;
-        }
+        retval = nfsd_idmap_init();
+        if (retval)
+                goto out_free_lockd;
+        retval = create_proc_exports_entry();
+        if (retval)
+                goto out_free_idmap;
         retval = register_filesystem(&nfsd_fs_type);
-        if (retval) {
-                nfsd_export_shutdown();
-                nfsd_cache_shutdown();
-                remove_proc_entry("fs/nfs/exports", NULL);
-                remove_proc_entry("fs/nfs", NULL);
-                nfsd_stat_shutdown();
-                nfsd_lockd_shutdown();
-        }
+        if (retval)
+                goto out_free_all;
+        return 0;
+out_free_all:
+        remove_proc_entry("fs/nfs/exports", NULL);
+        remove_proc_entry("fs/nfs", NULL);
+out_free_idmap:
+        nfsd_idmap_shutdown();
+out_free_lockd:
+        nfsd_lockd_shutdown();
+        nfsd_export_shutdown();
+out_free_cache:
+        nfsd_reply_cache_shutdown();
+out_free_stat:
+        nfsd_stat_shutdown();
+        nfsd4_free_slabs();
         return retval;
 }
 
 static void __exit exit_nfsd(void)
 {
         nfsd_export_shutdown();
-        nfsd_cache_shutdown();
+        nfsd_reply_cache_shutdown();
         remove_proc_entry("fs/nfs/exports", NULL);
         remove_proc_entry("fs/nfs", NULL);
         nfsd_stat_shutdown();
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index 468f17a78441..8fbd2dc08a92 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -22,6 +22,7 @@
 #include <linux/sunrpc/svc.h>
 #include <linux/sunrpc/svcauth_gss.h>
 #include <linux/nfsd/nfsd.h>
+#include "auth.h"
 
 #define NFSDDBG_FACILITY                NFSDDBG_FH
 
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 1190aeaa92be..9647b0f7bc0c 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -155,8 +155,8 @@ static int killsig;	/* signal that was used to kill last nfsd */
 static void nfsd_last_thread(struct svc_serv *serv)
 {
         /* When last nfsd thread exits we need to do some clean-up */
-        struct svc_sock *svsk;
-        list_for_each_entry(svsk, &serv->sv_permsocks, sk_list)
+        struct svc_xprt *xprt;
+        list_for_each_entry(xprt, &serv->sv_permsocks, xpt_list)
                 lockd_down();
         nfsd_serv = NULL;
         nfsd_racache_shutdown();
@@ -236,7 +236,7 @@ static int nfsd_init_socks(int port)
 
         error = lockd_up(IPPROTO_UDP);
         if (error >= 0) {
-                error = svc_makesock(nfsd_serv, IPPROTO_UDP, port,
+                error = svc_create_xprt(nfsd_serv, "udp", port,
                                         SVC_SOCK_DEFAULTS);
                 if (error < 0)
                         lockd_down();
@@ -247,7 +247,7 @@ static int nfsd_init_socks(int port)
 #ifdef CONFIG_NFSD_TCP
         error = lockd_up(IPPROTO_TCP);
         if (error >= 0) {
-                error = svc_makesock(nfsd_serv, IPPROTO_TCP, port,
+                error = svc_create_xprt(nfsd_serv, "tcp", port,
                                         SVC_SOCK_DEFAULTS);
                 if (error < 0)
                         lockd_down();
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index b86e3658a0af..61ad61743d94 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -15,6 +15,7 @@
 #include <linux/nfsd/nfsd.h>
 #include <linux/nfsd/xdr.h>
 #include <linux/mm.h>
+#include "auth.h"
 
 #define NFSDDBG_FACILITY                NFSDDBG_XDR
 
@@ -62,10 +63,10 @@ encode_fh(__be32 *p, struct svc_fh *fhp)
  * no slashes or null bytes.
  */
 static __be32 *
-decode_filename(__be32 *p, char **namp, int *lenp)
+decode_filename(__be32 *p, char **namp, unsigned int *lenp)
 {
         char            *name;
-        int             i;
+        unsigned int    i;
 
         if ((p = xdr_decode_string_inplace(p, namp, lenp, NFS_MAXNAMLEN)) != NULL) {
                 for (i = 0, name = *namp; i < *lenp; i++, name++) {
@@ -78,10 +79,10 @@ decode_filename(__be32 *p, char **namp, int *lenp)
 }
 
 static __be32 *
-decode_pathname(__be32 *p, char **namp, int *lenp)
+decode_pathname(__be32 *p, char **namp, unsigned int *lenp)
 {
         char            *name;
-        int             i;
+        unsigned int    i;
 
         if ((p = xdr_decode_string_inplace(p, namp, lenp, NFS_MAXPATHLEN)) != NULL) {
                 for (i = 0, name = *namp; i < *lenp; i++, name++) {
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index d0199189924c..cc75e4fcd02b 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -132,7 +132,7 @@ out:
 
 __be32
 nfsd_lookup_dentry(struct svc_rqst *rqstp, struct svc_fh *fhp,
-                   const char *name, int len,
+                   const char *name, unsigned int len,
                    struct svc_export **exp_ret, struct dentry **dentry_ret)
 {
         struct svc_export       *exp;
@@ -226,7 +226,7 @@ out_nfserr:
  */
 __be32
 nfsd_lookup(struct svc_rqst *rqstp, struct svc_fh *fhp, const char *name,
-                                        int len, struct svc_fh *resfh)
+                                unsigned int len, struct svc_fh *resfh)
 {
         struct svc_export       *exp;
         struct dentry           *dentry;
@@ -1151,6 +1151,26 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp,
 }
 #endif /* CONFIG_NFSD_V3 */
 
+__be32
+nfsd_create_setattr(struct svc_rqst *rqstp, struct svc_fh *resfhp,
+                        struct iattr *iap)
+{
+        /*
+         * Mode has already been set earlier in create:
+         */
+        iap->ia_valid &= ~ATTR_MODE;
+        /*
+         * Setting uid/gid works only for root.  Irix appears to
+         * send along the gid on create when it tries to implement
+         * setgid directories via NFS:
+         */
+        if (current->fsuid != 0)
+                iap->ia_valid &= ~(ATTR_UID|ATTR_GID);
+        if (iap->ia_valid)
+                return nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
+        return 0;
+}
+
 /*
  * Create a file (regular, directory, device, fifo); UNIX sockets 
  * not yet implemented.
@@ -1167,6 +1187,7 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
         struct dentry   *dentry, *dchild = NULL;
         struct inode    *dirp;
         __be32          err;
+        __be32          err2;
         int             host_err;
 
         err = nfserr_perm;
@@ -1257,16 +1278,9 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
         }
 
 
-        /* Set file attributes. Mode has already been set and
-         * setting uid/gid works only for root. Irix appears to
-         * send along the gid when it tries to implement setgid
-         * directories via NFS.
-         */
-        if ((iap->ia_valid &= ~(ATTR_UID|ATTR_GID|ATTR_MODE)) != 0) {
-                __be32 err2 = nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
-                if (err2)
-                        err = err2;
-        }
+        err2 = nfsd_create_setattr(rqstp, resfhp, iap);
+        if (err2)
+                err = err2;
         /*
          * Update the file handle to get the new inode info.
          */
@@ -1295,6 +1309,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         struct dentry   *dentry, *dchild = NULL;
         struct inode    *dirp;
         __be32          err;
+        __be32          err2;
         int             host_err;
         __u32           v_mtime=0, v_atime=0;
 
@@ -1399,16 +1414,10 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 iap->ia_atime.tv_nsec = 0;
         }
 
-        /* Set file attributes.
-         * Irix appears to send along the gid when it tries to
-         * implement setgid directories via NFS. Clear out all that cruft.
-         */
  set_attr:
-        if ((iap->ia_valid &= ~(ATTR_UID|ATTR_GID|ATTR_MODE)) != 0) {
-                __be32 err2 = nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
-                if (err2)
-                        err = err2;
-        }
+        err2 = nfsd_create_setattr(rqstp, resfhp, iap);
+        if (err2)
+                err = err2;
 
         /*
          * Update the filehandle to get the new inode info.