47 files changed, 788 insertions, 487 deletions

diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index b9a843226de8..633c701a287d 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -297,7 +297,7 @@ static int __add_delayed_refs(struct btrfs_delayed_ref_head *head, u64 seq,
         struct btrfs_delayed_extent_op *extent_op = head->extent_op;
         struct rb_node *n = &head->node.rb_node;
         int sgn;
-        int ret;
+        int ret = 0;
 
         if (extent_op && extent_op->update_key)
                 btrfs_disk_key_to_cpu(info_key, &extent_op->key);
@@ -392,7 +392,7 @@ static int __add_inline_refs(struct btrfs_fs_info *fs_info,
                              struct btrfs_key *info_key, int *info_level,
                              struct list_head *prefs)
 {
-        int ret;
+        int ret = 0;
         int slot;
         struct extent_buffer *leaf;
         struct btrfs_key key;
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index ad0b3ba735b7..b669a7d8e499 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -1662,7 +1662,7 @@ static void btrfsic_process_written_block(struct btrfsic_dev_state *dev_state,
         block = btrfsic_block_hashtable_lookup(bdev, dev_bytenr,
                                                &state->block_hashtable);
         if (NULL != block) {
-                u64 bytenr;
+                u64 bytenr = 0;
                 struct list_head *elem_ref_to;
                 struct list_head *tmp_ref_to;
 
@@ -2777,9 +2777,10 @@ int btrfsic_submit_bh(int rw, struct buffer_head *bh)
                         printk(KERN_INFO
                                "submit_bh(rw=0x%x, blocknr=%lu (bytenr %llu),"
                                " size=%lu, data=%p, bdev=%p)\n",
-                               rw, bh->b_blocknr,
-                               (unsigned long long)dev_bytenr, bh->b_size,
-                               bh->b_data, bh->b_bdev);
+                               rw, (unsigned long)bh->b_blocknr,
+                               (unsigned long long)dev_bytenr,
+                               (unsigned long)bh->b_size, bh->b_data,
+                               bh->b_bdev);
                 btrfsic_process_written_block(dev_state, dev_bytenr,
                                               bh->b_data, bh->b_size, NULL,
                                               NULL, bh, rw);
@@ -2844,7 +2845,7 @@ void btrfsic_submit_bio(int rw, struct bio *bio)
                         printk(KERN_INFO
                                "submit_bio(rw=0x%x, bi_vcnt=%u,"
                                " bi_sector=%lu (bytenr %llu), bi_bdev=%p)\n",
-                               rw, bio->bi_vcnt, bio->bi_sector,
+                               rw, bio->bi_vcnt, (unsigned long)bio->bi_sector,
                                (unsigned long long)dev_bytenr,
                                bio->bi_bdev);
 
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 7aa9cd36bf1b..811d9f918b1c 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -962,6 +962,13 @@ static int btree_releasepage(struct page *page, gfp_t gfp_flags)
         tree = &BTRFS_I(page->mapping->host)->io_tree;
         map = &BTRFS_I(page->mapping->host)->extent_tree;
 
+        /*
+         * We need to mask out eg. __GFP_HIGHMEM and __GFP_DMA32 as we're doing
+         * slab allocation from alloc_extent_state down the callchain where
+         * it'd hit a BUG_ON as those flags are not allowed.
+         */
+        gfp_flags &= ~GFP_SLAB_BUG_MASK;
+
         ret = try_release_extent_state(map, tree, page, gfp_flags);
         if (!ret)
                 return 0;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 700879ed64cf..283af7a676a3 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -34,23 +34,24 @@
 #include "locking.h"
 #include "free-space-cache.h"
 
-/* control flags for do_chunk_alloc's force field
+/*
+ * control flags for do_chunk_alloc's force field
  * CHUNK_ALLOC_NO_FORCE means to only allocate a chunk
  * if we really need one.
  *
- * CHUNK_ALLOC_FORCE means it must try to allocate one
- *
  * CHUNK_ALLOC_LIMITED means to only try and allocate one
  * if we have very few chunks already allocated.  This is
  * used as part of the clustering code to help make sure
  * we have a good pool of storage to cluster in, without
  * filling the FS with empty chunks
  *
+ * CHUNK_ALLOC_FORCE means it must try to allocate one
+ *
  */
 enum {
         CHUNK_ALLOC_NO_FORCE = 0,
-        CHUNK_ALLOC_FORCE = 1,
-        CHUNK_ALLOC_LIMITED = 2,
+        CHUNK_ALLOC_LIMITED = 1,
+        CHUNK_ALLOC_FORCE = 2,
 };
 
 /*
@@ -3414,7 +3415,7 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans,
 
 again:
         spin_lock(&space_info->lock);
-        if (space_info->force_alloc)
+        if (force < space_info->force_alloc)
                 force = space_info->force_alloc;
         if (space_info->full) {
                 spin_unlock(&space_info->lock);
@@ -5794,6 +5795,7 @@ int btrfs_reserve_extent(struct btrfs_trans_handle *trans,
                          u64 search_end, struct btrfs_key *ins,
                          u64 data)
 {
+        bool final_tried = false;
         int ret;
         u64 search_start = 0;
 
@@ -5813,22 +5815,25 @@ again:
                                search_start, search_end, hint_byte,
                                ins, data);
 
-        if (ret == -ENOSPC && num_bytes > min_alloc_size) {
-                num_bytes = num_bytes >> 1;
-                num_bytes = num_bytes & ~(root->sectorsize - 1);
-                num_bytes = max(num_bytes, min_alloc_size);
-                do_chunk_alloc(trans, root->fs_info->extent_root,
-                               num_bytes, data, CHUNK_ALLOC_FORCE);
-                goto again;
-        }
-        if (ret == -ENOSPC && btrfs_test_opt(root, ENOSPC_DEBUG)) {
-                struct btrfs_space_info *sinfo;
-
-                sinfo = __find_space_info(root->fs_info, data);
-                printk(KERN_ERR "btrfs allocation failed flags %llu, "
-                       "wanted %llu\n", (unsigned long long)data,
-                       (unsigned long long)num_bytes);
-                dump_space_info(sinfo, num_bytes, 1);
+        if (ret == -ENOSPC) {
+                if (!final_tried) {
+                        num_bytes = num_bytes >> 1;
+                        num_bytes = num_bytes & ~(root->sectorsize - 1);
+                        num_bytes = max(num_bytes, min_alloc_size);
+                        do_chunk_alloc(trans, root->fs_info->extent_root,
+                                       num_bytes, data, CHUNK_ALLOC_FORCE);
+                        if (num_bytes == min_alloc_size)
+                                final_tried = true;
+                        goto again;
+                } else if (btrfs_test_opt(root, ENOSPC_DEBUG)) {
+                        struct btrfs_space_info *sinfo;
+
+                        sinfo = __find_space_info(root->fs_info, data);
+                        printk(KERN_ERR "btrfs allocation failed flags %llu, "
+                               "wanted %llu\n", (unsigned long long)data,
+                               (unsigned long long)num_bytes);
+                        dump_space_info(sinfo, num_bytes, 1);
+                }
         }
 
         trace_btrfs_reserved_extent_alloc(root, ins->objectid, ins->offset);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 9d09a4f81875..fcf77e1ded40 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -3909,6 +3909,8 @@ int extent_range_uptodate(struct extent_io_tree *tree,
         while (start <= end) {
                 index = start >> PAGE_CACHE_SHIFT;
                 page = find_get_page(tree->mapping, index);
+                if (!page)
+                        return 1;
                 uptodate = PageUptodate(page);
                 page_cache_release(page);
                 if (!uptodate) {
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index d20ff87ca603..c2f20594c9f7 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -2242,7 +2242,7 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
                 if (entry->bitmap) {
                         ret = btrfs_alloc_from_bitmap(block_group,
                                                       cluster, entry, bytes,
-                                                      min_start);
+                                                      cluster->window_start);
                         if (ret == 0) {
                                 node = rb_next(&entry->offset_index);
                                 if (!node)
@@ -2251,6 +2251,7 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
                                                  offset_index);
                                 continue;
                         }
+                        cluster->window_start += bytes;
                 } else {
                         ret = entry->offset;
 
@@ -2475,7 +2476,7 @@ setup_cluster_bitmap(struct btrfs_block_group_cache *block_group,
         }
 
         list_for_each_entry(entry, bitmaps, list) {
-                if (entry->bytes < min_bytes)
+                if (entry->bytes < bytes)
                         continue;
                 ret = btrfs_bitmap_cluster(block_group, entry, cluster, offset,
                                            bytes, cont1_bytes, min_bytes);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 0da19a0ea00d..32214fe0f7e3 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6401,18 +6401,23 @@ int btrfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
         unsigned long zero_start;
         loff_t size;
         int ret;
+        int reserved = 0;
         u64 page_start;
         u64 page_end;
 
         ret  = btrfs_delalloc_reserve_space(inode, PAGE_CACHE_SIZE);
-        if (!ret)
+        if (!ret) {
                 ret = btrfs_update_time(vma->vm_file);
+                reserved = 1;
+        }
         if (ret) {
                 if (ret == -ENOMEM)
                         ret = VM_FAULT_OOM;
                 else /* -ENOSPC, -EIO, etc */
                         ret = VM_FAULT_SIGBUS;
-                goto out;
+                if (reserved)
+                        goto out;
+                goto out_noreserve;
         }
 
         ret = VM_FAULT_NOPAGE; /* make the VM retry the fault */
@@ -6495,6 +6500,7 @@ out_unlock:
         unlock_page(page);
 out:
         btrfs_delalloc_release_space(inode, PAGE_CACHE_SIZE);
+out_noreserve:
         return ret;
 }
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index ab620014bcc3..03bb62a9ee24 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1065,7 +1065,7 @@ int btrfs_defrag_file(struct inode *inode, struct file *file,
                 i = range->start >> PAGE_CACHE_SHIFT;
         }
         if (!max_to_defrag)
-                max_to_defrag = last_index;
+                max_to_defrag = last_index + 1;
 
         /*
          * make writeback starts from i, so the defrag range can be
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index cb877e0886a7..966cc74f5d6c 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1957,7 +1957,8 @@ static int wait_log_commit(struct btrfs_trans_handle *trans,
 
                 finish_wait(&root->log_commit_wait[index], &wait);
                 mutex_lock(&root->log_mutex);
-        } while (root->log_transid < transid + 2 &&
+        } while (root->fs_info->last_trans_log_full_commit !=
+                 trans->transid && root->log_transid < transid + 2 &&
                  atomic_read(&root->log_commit[index]));
         return 0;
 }
@@ -1966,7 +1967,8 @@ static int wait_for_writer(struct btrfs_trans_handle *trans,
                            struct btrfs_root *root)
 {
         DEFINE_WAIT(wait);
-        while (atomic_read(&root->log_writers)) {
+        while (root->fs_info->last_trans_log_full_commit !=
+               trans->transid && atomic_read(&root->log_writers)) {
                 prepare_to_wait(&root->log_writer_wait,
                                 &wait, TASK_UNINTERRUPTIBLE);
                 mutex_unlock(&root->log_mutex);
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index f66cc1625150..0554b00a7b33 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -140,7 +140,6 @@ config CIFS_DFS_UPCALL
 
 config CIFS_FSCACHE
           bool "Provide CIFS client caching support (EXPERIMENTAL)"
-          depends on EXPERIMENTAL
           depends on CIFS=m && FSCACHE || CIFS=y && FSCACHE=y
           help
             Makes CIFS FS-Cache capable. Say Y here if you want your CIFS data
@@ -149,7 +148,7 @@ config CIFS_FSCACHE
 
 config CIFS_ACL
           bool "Provide CIFS ACL support (EXPERIMENTAL)"
-          depends on EXPERIMENTAL && CIFS_XATTR && KEYS
+          depends on CIFS_XATTR && KEYS
           help
             Allows to fetch CIFS/NTFS ACL from the server.  The DACL blob
             is handed over to the application/caller.
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 84e8c0724704..24b3dfc05282 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -676,14 +676,23 @@ static ssize_t cifs_multiuser_mount_proc_write(struct file *file,
 {
         char c;
         int rc;
+        static bool warned;
 
         rc = get_user(c, buffer);
         if (rc)
                 return rc;
         if (c == '0' || c == 'n' || c == 'N')
                 multiuser_mount = 0;
-        else if (c == '1' || c == 'y' || c == 'Y')
+        else if (c == '1' || c == 'y' || c == 'Y') {
                 multiuser_mount = 1;
+                if (!warned) {
+                        warned = true;
+                        printk(KERN_WARNING "CIFS VFS: The legacy multiuser "
+                                "mount code is scheduled to be deprecated in "
+                                "3.5. Please switch to using the multiuser "
+                                "mount option.");
+                }
+        }
 
         return count;
 }
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 2272fd5fe5b7..e622863b292f 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -113,9 +113,11 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo)
                    MAX_MECH_STR_LEN +
                    UID_KEY_LEN + (sizeof(uid_t) * 2) +
                    CREDUID_KEY_LEN + (sizeof(uid_t) * 2) +
-                   USER_KEY_LEN + strlen(sesInfo->user_name) +
                    PID_KEY_LEN + (sizeof(pid_t) * 2) + 1;
 
+        if (sesInfo->user_name)
+                desc_len += USER_KEY_LEN + strlen(sesInfo->user_name);
+
         spnego_key = ERR_PTR(-ENOMEM);
         description = kzalloc(desc_len, GFP_KERNEL);
         if (description == NULL)
@@ -152,8 +154,10 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo)
         dp = description + strlen(description);
         sprintf(dp, ";creduid=0x%x", sesInfo->cred_uid);
 
-        dp = description + strlen(description);
-        sprintf(dp, ";user=%s", sesInfo->user_name);
+        if (sesInfo->user_name) {
+                dp = description + strlen(description);
+                sprintf(dp, ";user=%s", sesInfo->user_name);
+        }
 
         dp = description + strlen(description);
         sprintf(dp, ";pid=0x%x", current->pid);
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 1b2e180b018d..fbb9da951843 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -27,17 +27,17 @@
 #include "cifs_debug.h"
 
 /*
- * cifs_ucs2_bytes - how long will a string be after conversion?
- * @ucs - pointer to input string
+ * cifs_utf16_bytes - how long will a string be after conversion?
+ * @utf16 - pointer to input string
  * @maxbytes - don't go past this many bytes of input string
  * @codepage - destination codepage
  *
- * Walk a ucs2le string and return the number of bytes that the string will
+ * Walk a utf16le string and return the number of bytes that the string will
  * be after being converted to the given charset, not including any null
  * termination required. Don't walk past maxbytes in the source buffer.
  */
 int
-cifs_ucs2_bytes(const __le16 *from, int maxbytes,
+cifs_utf16_bytes(const __le16 *from, int maxbytes,
                 const struct nls_table *codepage)
 {
         int i;
@@ -122,7 +122,7 @@ cp_convert:
 }
 
 /*
- * cifs_from_ucs2 - convert utf16le string to local charset
+ * cifs_from_utf16 - convert utf16le string to local charset
  * @to - destination buffer
  * @from - source buffer
  * @tolen - destination buffer size (in bytes)
@@ -130,7 +130,7 @@ cp_convert:
  * @codepage - codepage to which characters should be converted
  * @mapchar - should characters be remapped according to the mapchars option?
  *
- * Convert a little-endian ucs2le string (as sent by the server) to a string
+ * Convert a little-endian utf16le string (as sent by the server) to a string
  * in the provided codepage. The tolen and fromlen parameters are to ensure
  * that the code doesn't walk off of the end of the buffer (which is always
  * a danger if the alignment of the source buffer is off). The destination
@@ -139,12 +139,12 @@ cp_convert:
  * null terminator).
  *
  * Note that some windows versions actually send multiword UTF-16 characters
- * instead of straight UCS-2. The linux nls routines however aren't able to
+ * instead of straight UTF16-2. The linux nls routines however aren't able to
  * deal with those characters properly. In the event that we get some of
  * those characters, they won't be translated properly.
  */
 int
-cifs_from_ucs2(char *to, const __le16 *from, int tolen, int fromlen,
+cifs_from_utf16(char *to, const __le16 *from, int tolen, int fromlen,
                  const struct nls_table *codepage, bool mapchar)
 {
         int i, charlen, safelen;
@@ -190,13 +190,13 @@ cifs_from_ucs2(char *to, const __le16 *from, int tolen, int fromlen,
 }
 
 /*
- * NAME:        cifs_strtoUCS()
+ * NAME:        cifs_strtoUTF16()
  *
  * FUNCTION:    Convert character string to unicode string
  *
  */
 int
-cifs_strtoUCS(__le16 *to, const char *from, int len,
+cifs_strtoUTF16(__le16 *to, const char *from, int len,
               const struct nls_table *codepage)
 {
         int charlen;
@@ -206,7 +206,7 @@ cifs_strtoUCS(__le16 *to, const char *from, int len,
         for (i = 0; len && *from; i++, from += charlen, len -= charlen) {
                 charlen = codepage->char2uni(from, len, &wchar_to);
                 if (charlen < 1) {
-                        cERROR(1, "strtoUCS: char2uni of 0x%x returned %d",
+                        cERROR(1, "strtoUTF16: char2uni of 0x%x returned %d",
                                 *from, charlen);
                         /* A question mark */
                         wchar_to = 0x003f;
@@ -220,7 +220,8 @@ cifs_strtoUCS(__le16 *to, const char *from, int len,
 }
 
 /*
- * cifs_strndup_from_ucs - copy a string from wire format to the local codepage
+ * cifs_strndup_from_utf16 - copy a string from wire format to the local
+ * codepage
  * @src - source string
  * @maxlen - don't walk past this many bytes in the source string
  * @is_unicode - is this a unicode string?
@@ -231,19 +232,19 @@ cifs_strtoUCS(__le16 *to, const char *from, int len,
  * error.
  */
 char *
-cifs_strndup_from_ucs(const char *src, const int maxlen, const bool is_unicode,
-             const struct nls_table *codepage)
+cifs_strndup_from_utf16(const char *src, const int maxlen,
+                        const bool is_unicode, const struct nls_table *codepage)
 {
         int len;
         char *dst;
 
         if (is_unicode) {
-                len = cifs_ucs2_bytes((__le16 *) src, maxlen, codepage);
+                len = cifs_utf16_bytes((__le16 *) src, maxlen, codepage);
                 len += nls_nullsize(codepage);
                 dst = kmalloc(len, GFP_KERNEL);
                 if (!dst)
                         return NULL;
-                cifs_from_ucs2(dst, (__le16 *) src, len, maxlen, codepage,
+                cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage,
                                false);
         } else {
                 len = strnlen(src, maxlen);
@@ -264,7 +265,7 @@ cifs_strndup_from_ucs(const char *src, const int maxlen, const bool is_unicode,
  * names are little endian 16 bit Unicode on the wire
  */
 int
-cifsConvertToUCS(__le16 *target, const char *source, int srclen,
+cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
                  const struct nls_table *cp, int mapChars)
 {
         int i, j, charlen;
@@ -273,7 +274,7 @@ cifsConvertToUCS(__le16 *target, const char *source, int srclen,
         wchar_t tmp;
 
         if (!mapChars)
-                return cifs_strtoUCS(target, source, PATH_MAX, cp);
+                return cifs_strtoUTF16(target, source, PATH_MAX, cp);
 
         for (i = 0, j = 0; i < srclen; j++) {
                 src_char = source[i];
@@ -281,7 +282,7 @@ cifsConvertToUCS(__le16 *target, const char *source, int srclen,
                 switch (src_char) {
                 case 0:
                         put_unaligned(0, &target[j]);
-                        goto ctoUCS_out;
+                        goto ctoUTF16_out;
                 case ':':
                         dst_char = cpu_to_le16(UNI_COLON);
                         break;
@@ -326,7 +327,7 @@ cifsConvertToUCS(__le16 *target, const char *source, int srclen,
                 put_unaligned(dst_char, &target[j]);
         }
 
-ctoUCS_out:
+ctoUTF16_out:
         return i;
 }
 
diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
index 6d02fd560566..a513a546700b 100644
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -74,16 +74,16 @@ extern const struct UniCaseRange CifsUniLowerRange[];
 #endif                          /* UNIUPR_NOLOWER */
 
 #ifdef __KERNEL__
-int cifs_from_ucs2(char *to, const __le16 *from, int tolen, int fromlen,
-                   const struct nls_table *codepage, bool mapchar);
-int cifs_ucs2_bytes(const __le16 *from, int maxbytes,
-                    const struct nls_table *codepage);
-int cifs_strtoUCS(__le16 *, const char *, int, const struct nls_table *);
-char *cifs_strndup_from_ucs(const char *src, const int maxlen,
-                            const bool is_unicode,
-                            const struct nls_table *codepage);
-extern int cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
-                        const struct nls_table *cp, int mapChars);
+int cifs_from_utf16(char *to, const __le16 *from, int tolen, int fromlen,
+                    const struct nls_table *codepage, bool mapchar);
+int cifs_utf16_bytes(const __le16 *from, int maxbytes,
+                     const struct nls_table *codepage);
+int cifs_strtoUTF16(__le16 *, const char *, int, const struct nls_table *);
+char *cifs_strndup_from_utf16(const char *src, const int maxlen,
+                              const bool is_unicode,
+                              const struct nls_table *codepage);
+extern int cifsConvertToUTF16(__le16 *target, const char *source, int maxlen,
+                              const struct nls_table *cp, int mapChars);
 
 #endif
 
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 72ddf23ef6f7..c1b254487388 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -909,6 +909,8 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
                 umode_t group_mask = S_IRWXG;
                 umode_t other_mask = S_IRWXU | S_IRWXG | S_IRWXO;
 
+                if (num_aces > ULONG_MAX / sizeof(struct cifs_ace *))
+                        return;
                 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
                                 GFP_KERNEL);
                 if (!ppace) {
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 5d9b9acc5fce..63c460e503b6 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -327,7 +327,7 @@ build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
         attrptr->type = cpu_to_le16(NTLMSSP_AV_NB_DOMAIN_NAME);
         attrptr->length = cpu_to_le16(2 * dlen);
         blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        cifs_strtoUCS((__le16 *)blobptr, ses->domainName, dlen, nls_cp);
+        cifs_strtoUTF16((__le16 *)blobptr, ses->domainName, dlen, nls_cp);
 
         return 0;
 }
@@ -376,7 +376,7 @@ find_domain_name(struct cifs_ses *ses, const struct nls_table *nls_cp)
                                         kmalloc(attrsize + 1, GFP_KERNEL);
                                 if (!ses->domainName)
                                                 return -ENOMEM;
-                                cifs_from_ucs2(ses->domainName,
+                                cifs_from_utf16(ses->domainName,
                                         (__le16 *)blobptr, attrsize, attrsize,
                                         nls_cp, false);
                                 break;
@@ -420,15 +420,20 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
         }
 
         /* convert ses->user_name to unicode and uppercase */
-        len = strlen(ses->user_name);
+        len = ses->user_name ? strlen(ses->user_name) : 0;
         user = kmalloc(2 + (len * 2), GFP_KERNEL);
         if (user == NULL) {
                 cERROR(1, "calc_ntlmv2_hash: user mem alloc failure\n");
                 rc = -ENOMEM;
                 return rc;
         }
-        len = cifs_strtoUCS((__le16 *)user, ses->user_name, len, nls_cp);
-        UniStrupr(user);
+
+        if (len) {
+                len = cifs_strtoUTF16((__le16 *)user, ses->user_name, len, nls_cp);
+                UniStrupr(user);
+        } else {
+                memset(user, '\0', 2);
+        }
 
         rc = crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
                                 (char *)user, 2 * len);
@@ -448,8 +453,8 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
                         rc = -ENOMEM;
                         return rc;
                 }
-                len = cifs_strtoUCS((__le16 *)domain, ses->domainName, len,
-                                        nls_cp);
+                len = cifs_strtoUTF16((__le16 *)domain, ses->domainName, len,
+                                      nls_cp);
                 rc =
                 crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
                                         (char *)domain, 2 * len);
@@ -468,7 +473,7 @@ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
                         rc = -ENOMEM;
                         return rc;
                 }
-                len = cifs_strtoUCS((__le16 *)server, ses->serverName, len,
+                len = cifs_strtoUTF16((__le16 *)server, ses->serverName, len,
                                         nls_cp);
                 rc =
                 crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index ba53c1c6c6cc..76e7d8b6da17 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -879,6 +879,8 @@ require use of the stronger protocol */
 #define   CIFSSEC_MASK          0xB70B7 /* current flags supported if weak */
 #endif /* UPCALL */
 #else /* do not allow weak pw hash */
+#define   CIFSSEC_MUST_LANMAN   0
+#define   CIFSSEC_MUST_PLNTXT   0
 #ifdef CONFIG_CIFS_UPCALL
 #define   CIFSSEC_MASK          0x8F08F /* flags supported if no weak allowed */
 #else
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 6600aa2d2ef3..8b7794c31591 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -821,8 +821,8 @@ PsxDelete:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else { /* BB add path length overrun check */
@@ -893,8 +893,8 @@ DelFileRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->fileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->fileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve check for buffer overruns BB */
@@ -938,8 +938,8 @@ RmDirRetry:
                 return rc;
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifsConvertToUCS((__le16 *) pSMB->DirName, dirName,
-                                         PATH_MAX, nls_codepage, remap);
+                name_len = cifsConvertToUTF16((__le16 *) pSMB->DirName, dirName,
+                                              PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve check for buffer overruns BB */
@@ -981,8 +981,8 @@ MkDirRetry:
                 return rc;
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifsConvertToUCS((__le16 *) pSMB->DirName, name,
-                                            PATH_MAX, nls_codepage, remap);
+                name_len = cifsConvertToUTF16((__le16 *) pSMB->DirName, name,
+                                              PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve check for buffer overruns BB */
@@ -1030,8 +1030,8 @@ PsxCreat:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, name,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, name,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -1197,8 +1197,8 @@ OldOpenRetry:
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 count = 1;      /* account for one byte pad to word boundary */
                 name_len =
-                   cifsConvertToUCS((__le16 *) (pSMB->fileName + 1),
-                                    fileName, PATH_MAX, nls_codepage, remap);
+                   cifsConvertToUTF16((__le16 *) (pSMB->fileName + 1),
+                                      fileName, PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve check for buffer overruns BB */
@@ -1304,8 +1304,8 @@ openRetry:
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 count = 1;      /* account for one byte pad to word boundary */
                 name_len =
-                    cifsConvertToUCS((__le16 *) (pSMB->fileName + 1),
-                                     fileName, PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) (pSMB->fileName + 1),
+                                       fileName, PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->NameLength = cpu_to_le16(name_len);
@@ -2649,16 +2649,16 @@ renameRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->OldFileName, fromName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->OldFileName, fromName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->OldFileName[name_len] = 0x04;     /* pad */
         /* protocol requires ASCII signature byte on Unicode string */
                 pSMB->OldFileName[name_len + 1] = 0x00;
                 name_len2 =
-                    cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
-                                     toName, PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *)&pSMB->OldFileName[name_len+2],
+                                       toName, PATH_MAX, nls_codepage, remap);
                 name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                 name_len2 *= 2; /* convert to bytes */
         } else {        /* BB improve the check for buffer overruns BB */
@@ -2738,10 +2738,12 @@ int CIFSSMBRenameOpenFile(const int xid, struct cifs_tcon *pTcon,
         /* unicode only call */
         if (target_name == NULL) {
                 sprintf(dummy_string, "cifs%x", pSMB->hdr.Mid);
-                len_of_str = cifsConvertToUCS((__le16 *)rename_info->target_name,
+                len_of_str =
+                        cifsConvertToUTF16((__le16 *)rename_info->target_name,
                                         dummy_string, 24, nls_codepage, remap);
         } else {
-                len_of_str = cifsConvertToUCS((__le16 *)rename_info->target_name,
+                len_of_str =
+                        cifsConvertToUTF16((__le16 *)rename_info->target_name,
                                         target_name, PATH_MAX, nls_codepage,
                                         remap);
         }
@@ -2795,17 +2797,17 @@ copyRetry:
         pSMB->Flags = cpu_to_le16(flags & COPY_TREE);
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifsConvertToUCS((__le16 *) pSMB->OldFileName,
-                                            fromName, PATH_MAX, nls_codepage,
-                                            remap);
+                name_len = cifsConvertToUTF16((__le16 *) pSMB->OldFileName,
+                                              fromName, PATH_MAX, nls_codepage,
+                                              remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->OldFileName[name_len] = 0x04;     /* pad */
                 /* protocol requires ASCII signature byte on Unicode string */
                 pSMB->OldFileName[name_len + 1] = 0x00;
                 name_len2 =
-                    cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
-                                toName, PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *)&pSMB->OldFileName[name_len+2],
+                                       toName, PATH_MAX, nls_codepage, remap);
                 name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                 name_len2 *= 2; /* convert to bytes */
         } else {        /* BB improve the check for buffer overruns BB */
@@ -2861,9 +2863,9 @@ createSymLinkRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((__le16 *) pSMB->FileName, fromName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifs_strtoUTF16((__le16 *) pSMB->FileName, fromName,
+                                    /* find define for this maxpathcomponent */
+                                    PATH_MAX, nls_codepage);
                 name_len++;     /* trailing null */
                 name_len *= 2;
 
@@ -2885,9 +2887,9 @@ createSymLinkRetry:
         data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len_target =
-                    cifs_strtoUCS((__le16 *) data_offset, toName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifs_strtoUTF16((__le16 *) data_offset, toName, PATH_MAX
+                                    /* find define for this maxpathcomponent */
+                                    , nls_codepage);
                 name_len_target++;      /* trailing null */
                 name_len_target *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -2949,8 +2951,8 @@ createHardLinkRetry:
                 return rc;
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifsConvertToUCS((__le16 *) pSMB->FileName, toName,
-                                            PATH_MAX, nls_codepage, remap);
+                name_len = cifsConvertToUTF16((__le16 *) pSMB->FileName, toName,
+                                              PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
 
@@ -2972,8 +2974,8 @@ createHardLinkRetry:
         data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len_target =
-                    cifsConvertToUCS((__le16 *) data_offset, fromName, PATH_MAX,
-                                     nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) data_offset, fromName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len_target++;      /* trailing null */
                 name_len_target *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -3042,8 +3044,8 @@ winCreateHardLinkRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->OldFileName, fromName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->OldFileName, fromName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
 
@@ -3051,8 +3053,8 @@ winCreateHardLinkRetry:
                 pSMB->OldFileName[name_len] = 0x04;
                 pSMB->OldFileName[name_len + 1] = 0x00; /* pad */
                 name_len2 =
-                    cifsConvertToUCS((__le16 *)&pSMB->OldFileName[name_len + 2],
-                                     toName, PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *)&pSMB->OldFileName[name_len+2],
+                                       toName, PATH_MAX, nls_codepage, remap);
                 name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                 name_len2 *= 2; /* convert to bytes */
         } else {        /* BB improve the check for buffer overruns BB */
@@ -3108,8 +3110,8 @@ querySymLinkRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((__le16 *) pSMB->FileName, searchName,
-                                  PATH_MAX, nls_codepage);
+                        cifs_strtoUTF16((__le16 *) pSMB->FileName, searchName,
+                                        PATH_MAX, nls_codepage);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -3166,8 +3168,8 @@ querySymLinkRetry:
                                 is_unicode = false;
 
                         /* BB FIXME investigate remapping reserved chars here */
-                        *symlinkinfo = cifs_strndup_from_ucs(data_start, count,
-                                                    is_unicode, nls_codepage);
+                        *symlinkinfo = cifs_strndup_from_utf16(data_start,
+                                        count, is_unicode, nls_codepage);
                         if (!*symlinkinfo)
                                 rc = -ENOMEM;
                 }
@@ -3450,8 +3452,9 @@ queryAclRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                         PATH_MAX, nls_codepage, remap);
+                        cifsConvertToUTF16((__le16 *) pSMB->FileName,
+                                           searchName, PATH_MAX, nls_codepage,
+                                           remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->FileName[name_len] = 0;
@@ -3537,8 +3540,8 @@ setAclRetry:
                 return rc;
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                      PATH_MAX, nls_codepage, remap);
+                        cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                           PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -3948,8 +3951,9 @@ QInfRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                        PATH_MAX, nls_codepage, remap);
+                        cifsConvertToUTF16((__le16 *) pSMB->FileName,
+                                           searchName, PATH_MAX, nls_codepage,
+                                           remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {
@@ -4086,8 +4090,8 @@ QPathInfoRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, searchName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -4255,8 +4259,8 @@ UnixQPathInfoRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                  PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, searchName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -4344,8 +4348,8 @@ findFirstRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                 PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, searchName,
+                                       PATH_MAX, nls_codepage, remap);
                 /* We can not add the asterik earlier in case
                 it got remapped to 0xF03A as if it were part of the
                 directory name instead of a wildcard */
@@ -4656,8 +4660,9 @@ GetInodeNumberRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                         PATH_MAX, nls_codepage, remap);
+                        cifsConvertToUTF16((__le16 *) pSMB->FileName,
+                                           searchName, PATH_MAX, nls_codepage,
+                                           remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -4794,9 +4799,9 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                                 rc = -ENOMEM;
                                 goto parse_DFS_referrals_exit;
                         }
-                        cifsConvertToUCS((__le16 *) tmp, searchName,
-                                        PATH_MAX, nls_codepage, remap);
-                        node->path_consumed = cifs_ucs2_bytes(tmp,
+                        cifsConvertToUTF16((__le16 *) tmp, searchName,
+                                           PATH_MAX, nls_codepage, remap);
+                        node->path_consumed = cifs_utf16_bytes(tmp,
                                         le16_to_cpu(pSMBr->PathConsumed),
                                         nls_codepage);
                         kfree(tmp);
@@ -4809,8 +4814,8 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 /* copy DfsPath */
                 temp = (char *)ref + le16_to_cpu(ref->DfsPathOffset);
                 max_len = data_end - temp;
-                node->path_name = cifs_strndup_from_ucs(temp, max_len,
-                                                      is_unicode, nls_codepage);
+                node->path_name = cifs_strndup_from_utf16(temp, max_len,
+                                                is_unicode, nls_codepage);
                 if (!node->path_name) {
                         rc = -ENOMEM;
                         goto parse_DFS_referrals_exit;
@@ -4819,8 +4824,8 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 /* copy link target UNC */
                 temp = (char *)ref + le16_to_cpu(ref->NetworkAddressOffset);
                 max_len = data_end - temp;
-                node->node_name = cifs_strndup_from_ucs(temp, max_len,
-                                                      is_unicode, nls_codepage);
+                node->node_name = cifs_strndup_from_utf16(temp, max_len,
+                                                is_unicode, nls_codepage);
                 if (!node->node_name)
                         rc = -ENOMEM;
         }
@@ -4873,8 +4878,9 @@ getDFSRetry:
         if (ses->capabilities & CAP_UNICODE) {
                 pSMB->hdr.Flags2 |= SMBFLG2_UNICODE;
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->RequestFileName,
-                                     searchName, PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->RequestFileName,
+                                       searchName, PATH_MAX, nls_codepage,
+                                       remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -5506,8 +5512,8 @@ SetEOFRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -5796,8 +5802,8 @@ SetTimesRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -5877,8 +5883,8 @@ SetAttrLgcyRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        ConvertToUCS((__le16 *) pSMB->fileName, fileName,
-                                PATH_MAX, nls_codepage);
+                        ConvertToUTF16((__le16 *) pSMB->fileName, fileName,
+                                       PATH_MAX, nls_codepage);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -6030,8 +6036,8 @@ setPermsRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -6123,8 +6129,8 @@ QAllEAsRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 list_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, searchName,
+                                       PATH_MAX, nls_codepage, remap);
                 list_len++;     /* trailing null */
                 list_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -6301,8 +6307,8 @@ SetEARetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, fileName,
-                                     PATH_MAX, nls_codepage, remap);
+                    cifsConvertToUTF16((__le16 *) pSMB->FileName, fileName,
+                                       PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 4666780f315d..986709a8d903 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -38,6 +38,7 @@
 #include <asm/processor.h>
 #include <linux/inet.h>
 #include <linux/module.h>
+#include <keys/user-type.h>
 #include <net/ipv6.h>
 #include "cifspdu.h"
 #include "cifsglob.h"
@@ -225,74 +226,90 @@ static int check2ndT2(struct smb_hdr *pSMB)
 
 static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
 {
-        struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
+        struct smb_t2_rsp *pSMBs = (struct smb_t2_rsp *)psecond;
         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
-        char *data_area_of_target;
-        char *data_area_of_buf2;
+        char *data_area_of_tgt;
+        char *data_area_of_src;
         int remaining;
-        unsigned int byte_count, total_in_buf;
-        __u16 total_data_size, total_in_buf2;
+        unsigned int byte_count, total_in_tgt;
+        __u16 tgt_total_cnt, src_total_cnt, total_in_src;
 
-        total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
+        src_total_cnt = get_unaligned_le16(&pSMBs->t2_rsp.TotalDataCount);
+        tgt_total_cnt = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 
-        if (total_data_size !=
-            get_unaligned_le16(&pSMB2->t2_rsp.TotalDataCount))
-                cFYI(1, "total data size of primary and secondary t2 differ");
+        if (tgt_total_cnt != src_total_cnt)
+                cFYI(1, "total data count of primary and secondary t2 differ "
+                        "source=%hu target=%hu", src_total_cnt, tgt_total_cnt);
 
-        total_in_buf = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
+        total_in_tgt = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 
-        remaining = total_data_size - total_in_buf;
+        remaining = tgt_total_cnt - total_in_tgt;
 
-        if (remaining < 0)
+        if (remaining < 0) {
+                cFYI(1, "Server sent too much data. tgt_total_cnt=%hu "
+                        "total_in_tgt=%hu", tgt_total_cnt, total_in_tgt);
                 return -EPROTO;
+        }
 
-        if (remaining == 0) /* nothing to do, ignore */
+        if (remaining == 0) {
+                /* nothing to do, ignore */
+                cFYI(1, "no more data remains");
                 return 0;
+        }
 
-        total_in_buf2 = get_unaligned_le16(&pSMB2->t2_rsp.DataCount);
-        if (remaining < total_in_buf2) {
+        total_in_src = get_unaligned_le16(&pSMBs->t2_rsp.DataCount);
+        if (remaining < total_in_src)
                 cFYI(1, "transact2 2nd response contains too much data");
-        }
 
         /* find end of first SMB data area */
-        data_area_of_target = (char *)&pSMBt->hdr.Protocol +
+        data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
                                 get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
-        /* validate target area */
 
-        data_area_of_buf2 = (char *)&pSMB2->hdr.Protocol +
-                                get_unaligned_le16(&pSMB2->t2_rsp.DataOffset);
+        /* validate target area */
+        data_area_of_src = (char *)&pSMBs->hdr.Protocol +
+                                get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);
 
-        data_area_of_target += total_in_buf;
+        data_area_of_tgt += total_in_tgt;
 
-        /* copy second buffer into end of first buffer */
-        total_in_buf += total_in_buf2;
+        total_in_tgt += total_in_src;
         /* is the result too big for the field? */
-        if (total_in_buf > USHRT_MAX)
+        if (total_in_tgt > USHRT_MAX) {
+                cFYI(1, "coalesced DataCount too large (%u)", total_in_tgt);
                 return -EPROTO;
-        put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount);
+        }
+        put_unaligned_le16(total_in_tgt, &pSMBt->t2_rsp.DataCount);
 
         /* fix up the BCC */
         byte_count = get_bcc(pTargetSMB);
-        byte_count += total_in_buf2;
+        byte_count += total_in_src;
         /* is the result too big for the field? */
-        if (byte_count > USHRT_MAX)
+        if (byte_count > USHRT_MAX) {
+                cFYI(1, "coalesced BCC too large (%u)", byte_count);
                 return -EPROTO;
+        }
         put_bcc(byte_count, pTargetSMB);
 
         byte_count = be32_to_cpu(pTargetSMB->smb_buf_length);
-        byte_count += total_in_buf2;
+        byte_count += total_in_src;
         /* don't allow buffer to overflow */
-        if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)
+        if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
+                cFYI(1, "coalesced BCC exceeds buffer size (%u)", byte_count);
                 return -ENOBUFS;
+        }
         pTargetSMB->smb_buf_length = cpu_to_be32(byte_count);
 
-        memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
+        /* copy second buffer into end of first buffer */
+        memcpy(data_area_of_tgt, data_area_of_src, total_in_src);
 
-        if (remaining == total_in_buf2) {
-                cFYI(1, "found the last secondary response");
-                return 0; /* we are done */
-        } else /* more responses to go */
+        if (remaining != total_in_src) {
+                /* more responses to go */
+                cFYI(1, "waiting for more secondary responses");
                 return 1;
+        }
+
+        /* we are done */
+        cFYI(1, "found the last secondary response");
+        return 0;
 }
 
 static void
@@ -1578,11 +1595,14 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                 }
         }
 
-        if (vol->multiuser && !(vol->secFlg & CIFSSEC_MAY_KRB5)) {
-                cERROR(1, "Multiuser mounts currently require krb5 "
-                          "authentication!");
+#ifndef CONFIG_KEYS
+        /* Muliuser mounts require CONFIG_KEYS support */
+        if (vol->multiuser) {
+                cERROR(1, "Multiuser mounts require kernels with "
+                          "CONFIG_KEYS enabled.");
                 goto cifs_parse_mount_err;
         }
+#endif
 
         if (vol->UNCip == NULL)
                 vol->UNCip = &vol->UNC[2];
@@ -1981,10 +2001,16 @@ static int match_session(struct cifs_ses *ses, struct smb_vol *vol)
                         return 0;
                 break;
         default:
+                /* NULL username means anonymous session */
+                if (ses->user_name == NULL) {
+                        if (!vol->nullauth)
+                                return 0;
+                        break;
+                }
+
                 /* anything else takes username/password */
-                if (ses->user_name == NULL)
-                        return 0;
-                if (strncmp(ses->user_name, vol->username,
+                if (strncmp(ses->user_name,
+                            vol->username ? vol->username : "",
                             MAX_USERNAME_SIZE))
                         return 0;
                 if (strlen(vol->username) != 0 &&
@@ -2039,6 +2065,132 @@ cifs_put_smb_ses(struct cifs_ses *ses)
         cifs_put_tcp_session(server);
 }
 
+#ifdef CONFIG_KEYS
+
+/* strlen("cifs:a:") + INET6_ADDRSTRLEN + 1 */
+#define CIFSCREDS_DESC_SIZE (7 + INET6_ADDRSTRLEN + 1)
+
+/* Populate username and pw fields from keyring if possible */
+static int
+cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
+{
+        int rc = 0;
+        char *desc, *delim, *payload;
+        ssize_t len;
+        struct key *key;
+        struct TCP_Server_Info *server = ses->server;
+        struct sockaddr_in *sa;
+        struct sockaddr_in6 *sa6;
+        struct user_key_payload *upayload;
+
+        desc = kmalloc(CIFSCREDS_DESC_SIZE, GFP_KERNEL);
+        if (!desc)
+                return -ENOMEM;
+
+        /* try to find an address key first */
+        switch (server->dstaddr.ss_family) {
+        case AF_INET:
+                sa = (struct sockaddr_in *)&server->dstaddr;
+                sprintf(desc, "cifs:a:%pI4", &sa->sin_addr.s_addr);
+                break;
+        case AF_INET6:
+                sa6 = (struct sockaddr_in6 *)&server->dstaddr;
+                sprintf(desc, "cifs:a:%pI6c", &sa6->sin6_addr.s6_addr);
+                break;
+        default:
+                cFYI(1, "Bad ss_family (%hu)", server->dstaddr.ss_family);
+                rc = -EINVAL;
+                goto out_err;
+        }
+
+        cFYI(1, "%s: desc=%s", __func__, desc);
+        key = request_key(&key_type_logon, desc, "");
+        if (IS_ERR(key)) {
+                if (!ses->domainName) {
+                        cFYI(1, "domainName is NULL");
+                        rc = PTR_ERR(key);
+                        goto out_err;
+                }
+
+                /* didn't work, try to find a domain key */
+                sprintf(desc, "cifs:d:%s", ses->domainName);
+                cFYI(1, "%s: desc=%s", __func__, desc);
+                key = request_key(&key_type_logon, desc, "");
+                if (IS_ERR(key)) {
+                        rc = PTR_ERR(key);
+                        goto out_err;
+                }
+        }
+
+        down_read(&key->sem);
+        upayload = key->payload.data;
+        if (IS_ERR_OR_NULL(upayload)) {
+                rc = PTR_ERR(key);
+                goto out_key_put;
+        }
+
+        /* find first : in payload */
+        payload = (char *)upayload->data;
+        delim = strnchr(payload, upayload->datalen, ':');
+        cFYI(1, "payload=%s", payload);
+        if (!delim) {
+                cFYI(1, "Unable to find ':' in payload (datalen=%d)",
+                                upayload->datalen);
+                rc = -EINVAL;
+                goto out_key_put;
+        }
+
+        len = delim - payload;
+        if (len > MAX_USERNAME_SIZE || len <= 0) {
+                cFYI(1, "Bad value from username search (len=%ld)", len);
+                rc = -EINVAL;
+                goto out_key_put;
+        }
+
+        vol->username = kstrndup(payload, len, GFP_KERNEL);
+        if (!vol->username) {
+                cFYI(1, "Unable to allocate %ld bytes for username", len);
+                rc = -ENOMEM;
+                goto out_key_put;
+        }
+        cFYI(1, "%s: username=%s", __func__, vol->username);
+
+        len = key->datalen - (len + 1);
+        if (len > MAX_PASSWORD_SIZE || len <= 0) {
+                cFYI(1, "Bad len for password search (len=%ld)", len);
+                rc = -EINVAL;
+                kfree(vol->username);
+                vol->username = NULL;
+                goto out_key_put;
+        }
+
+        ++delim;
+        vol->password = kstrndup(delim, len, GFP_KERNEL);
+        if (!vol->password) {
+                cFYI(1, "Unable to allocate %ld bytes for password", len);
+                rc = -ENOMEM;
+                kfree(vol->username);
+                vol->username = NULL;
+                goto out_key_put;
+        }
+
+out_key_put:
+        up_read(&key->sem);
+        key_put(key);
+out_err:
+        kfree(desc);
+        cFYI(1, "%s: returning %d", __func__, rc);
+        return rc;
+}
+#else /* ! CONFIG_KEYS */
+static inline int
+cifs_set_cifscreds(struct smb_vol *vol __attribute__((unused)),
+                   struct cifs_ses *ses __attribute__((unused)))
+{
+        return -ENOSYS;
+}
+#endif /* CONFIG_KEYS */
+
 static bool warned_on_ntlm;  /* globals init to false automatically */
 
 static struct cifs_ses *
@@ -2914,18 +3066,33 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 #define CIFS_DEFAULT_IOSIZE (1024 * 1024)
 
 /*
- * Windows only supports a max of 60k reads. Default to that when posix
- * extensions aren't in force.
+ * Windows only supports a max of 60kb reads and 65535 byte writes. Default to
+ * those values when posix extensions aren't in force. In actuality here, we
+ * use 65536 to allow for a write that is a multiple of 4k. Most servers seem
+ * to be ok with the extra byte even though Windows doesn't send writes that
+ * are that large.
+ *
+ * Citation:
+ *
+ * http://blogs.msdn.com/b/openspecification/archive/2009/04/10/smb-maximum-transmit-buffer-size-and-performance-tuning.aspx
  */
 #define CIFS_DEFAULT_NON_POSIX_RSIZE (60 * 1024)
+#define CIFS_DEFAULT_NON_POSIX_WSIZE (65536)
 
 static unsigned int
 cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
 {
         __u64 unix_cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
         struct TCP_Server_Info *server = tcon->ses->server;
-        unsigned int wsize = pvolume_info->wsize ? pvolume_info->wsize :
-                                CIFS_DEFAULT_IOSIZE;
+        unsigned int wsize;
+
+        /* start with specified wsize, or default */
+        if (pvolume_info->wsize)
+                wsize = pvolume_info->wsize;
+        else if (tcon->unix_ext && (unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
+                wsize = CIFS_DEFAULT_IOSIZE;
+        else
+                wsize = CIFS_DEFAULT_NON_POSIX_WSIZE;
 
         /* can server support 24-bit write sizes? (via UNIX extensions) */
         if (!tcon->unix_ext || !(unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
@@ -3136,10 +3303,9 @@ cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
                 return -EINVAL;
 
         if (volume_info->nullauth) {
-                cFYI(1, "null user");
-                volume_info->username = kzalloc(1, GFP_KERNEL);
-                if (volume_info->username == NULL)
-                        return -ENOMEM;
+                cFYI(1, "Anonymous login");
+                kfree(volume_info->username);
+                volume_info->username = NULL;
         } else if (volume_info->username) {
                 /* BB fixme parse for domain name here */
                 cFYI(1, "Username: %s", volume_info->username);
@@ -3478,7 +3644,7 @@ CIFSTCon(unsigned int xid, struct cifs_ses *ses,
         if (ses->capabilities & CAP_UNICODE) {
                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
                 length =
-                    cifs_strtoUCS((__le16 *) bcc_ptr, tree,
+                    cifs_strtoUTF16((__le16 *) bcc_ptr, tree,
                         6 /* max utf8 char length in bytes */ *
                         (/* server len*/ + 256 /* share len */), nls_codepage);
                 bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
@@ -3533,7 +3699,7 @@ CIFSTCon(unsigned int xid, struct cifs_ses *ses,
 
                 /* mostly informational -- no need to fail on error here */
                 kfree(tcon->nativeFileSystem);
-                tcon->nativeFileSystem = cifs_strndup_from_ucs(bcc_ptr,
+                tcon->nativeFileSystem = cifs_strndup_from_utf16(bcc_ptr,
                                                       bytes_left, is_unicode,
                                                       nls_codepage);
 
@@ -3657,16 +3823,38 @@ int cifs_setup_session(unsigned int xid, struct cifs_ses *ses,
         return rc;
 }
 
+static int
+cifs_set_vol_auth(struct smb_vol *vol, struct cifs_ses *ses)
+{
+        switch (ses->server->secType) {
+        case Kerberos:
+                vol->secFlg = CIFSSEC_MUST_KRB5;
+                return 0;
+        case NTLMv2:
+                vol->secFlg = CIFSSEC_MUST_NTLMV2;
+                break;
+        case NTLM:
+                vol->secFlg = CIFSSEC_MUST_NTLM;
+                break;
+        case RawNTLMSSP:
+                vol->secFlg = CIFSSEC_MUST_NTLMSSP;
+                break;
+        case LANMAN:
+                vol->secFlg = CIFSSEC_MUST_LANMAN;
+                break;
+        }
+
+        return cifs_set_cifscreds(vol, ses);
+}
+
 static struct cifs_tcon *
 cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
 {
+        int rc;
         struct cifs_tcon *master_tcon = cifs_sb_master_tcon(cifs_sb);
         struct cifs_ses *ses;
         struct cifs_tcon *tcon = NULL;
         struct smb_vol *vol_info;
-        char username[28]; /* big enough for "krb50x" + hex of ULONG_MAX 6+16 */
-                           /* We used to have this as MAX_USERNAME which is   */
-                           /* way too big now (256 instead of 32) */
 
         vol_info = kzalloc(sizeof(*vol_info), GFP_KERNEL);
         if (vol_info == NULL) {
@@ -3674,8 +3862,6 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
                 goto out;
         }
 
-        snprintf(username, sizeof(username), "krb50x%x", fsuid);
-        vol_info->username = username;
         vol_info->local_nls = cifs_sb->local_nls;
         vol_info->linux_uid = fsuid;
         vol_info->cred_uid = fsuid;
@@ -3685,8 +3871,11 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
         vol_info->local_lease = master_tcon->local_lease;
         vol_info->no_linux_ext = !master_tcon->unix_ext;
 
-        /* FIXME: allow for other secFlg settings */
-        vol_info->secFlg = CIFSSEC_MUST_KRB5;
+        rc = cifs_set_vol_auth(vol_info, master_tcon->ses);
+        if (rc) {
+                tcon = ERR_PTR(rc);
+                goto out;
+        }
 
         /* get a reference for the same TCP session */
         spin_lock(&cifs_tcp_ses_lock);
@@ -3709,6 +3898,8 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
         if (ses->capabilities & CAP_UNIX)
                 reset_cifs_unix_caps(0, tcon, NULL, vol_info);
 out:
+        kfree(vol_info->username);
+        kfree(vol_info->password);
         kfree(vol_info);
 
         return tcon;
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index a090bbe6ee29..e2bbc683e018 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -647,10 +647,11 @@ static int cifs_filldir(char *find_entry, struct file *file, filldir_t filldir,
 
                 name.name = scratch_buf;
                 name.len =
-                        cifs_from_ucs2((char *)name.name, (__le16 *)de.name,
-                                       UNICODE_NAME_MAX,
-                                       min(de.namelen, (size_t)max_len), nlt,
-                                       cifs_sb->mnt_cifs_flags &
+                        cifs_from_utf16((char *)name.name, (__le16 *)de.name,
+                                        UNICODE_NAME_MAX,
+                                        min_t(size_t, de.namelen,
+                                              (size_t)max_len), nlt,
+                                        cifs_sb->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
                 name.len -= nls_nullsize(nlt);
         } else {
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 4ec3ee9d72cc..d85efad5765f 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -167,16 +167,16 @@ unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
         int bytes_ret = 0;
 
         /* Copy OS version */
-        bytes_ret = cifs_strtoUCS((__le16 *)bcc_ptr, "Linux version ", 32,
-                                  nls_cp);
+        bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
+                                    nls_cp);
         bcc_ptr += 2 * bytes_ret;
-        bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, init_utsname()->release,
-                                  32, nls_cp);
+        bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
+                                    32, nls_cp);
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2; /* trailing null */
 
-        bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
-                                  32, nls_cp);
+        bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
+                                    32, nls_cp);
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2; /* trailing null */
 
@@ -197,8 +197,8 @@ static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
                 *(bcc_ptr+1) = 0;
                 bytes_ret = 0;
         } else
-                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName,
-                                          256, nls_cp);
+                bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
+                                            256, nls_cp);
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2;  /* account for null terminator */
 
@@ -226,8 +226,8 @@ static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
                 *bcc_ptr = 0;
                 *(bcc_ptr+1) = 0;
         } else {
-                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->user_name,
-                                          MAX_USERNAME_SIZE, nls_cp);
+                bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
+                                            MAX_USERNAME_SIZE, nls_cp);
         }
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2; /* account for null termination */
@@ -287,7 +287,7 @@ decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
         cFYI(1, "bleft %d", bleft);
 
         kfree(ses->serverOS);
-        ses->serverOS = cifs_strndup_from_ucs(data, bleft, true, nls_cp);
+        ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
         cFYI(1, "serverOS=%s", ses->serverOS);
         len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
         data += len;
@@ -296,7 +296,7 @@ decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
                 return;
 
         kfree(ses->serverNOS);
-        ses->serverNOS = cifs_strndup_from_ucs(data, bleft, true, nls_cp);
+        ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
         cFYI(1, "serverNOS=%s", ses->serverNOS);
         len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
         data += len;
@@ -305,7 +305,7 @@ decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
                 return;
 
         kfree(ses->serverDomain);
-        ses->serverDomain = cifs_strndup_from_ucs(data, bleft, true, nls_cp);
+        ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
         cFYI(1, "serverDomain=%s", ses->serverDomain);
 
         return;
@@ -502,8 +502,8 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 tmp += 2;
         } else {
                 int len;
-                len = cifs_strtoUCS((__le16 *)tmp, ses->domainName,
-                                    MAX_USERNAME_SIZE, nls_cp);
+                len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
+                                      MAX_USERNAME_SIZE, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
                 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
                 sec_blob->DomainName.Length = cpu_to_le16(len);
@@ -518,8 +518,8 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 tmp += 2;
         } else {
                 int len;
-                len = cifs_strtoUCS((__le16 *)tmp, ses->user_name,
-                                    MAX_USERNAME_SIZE, nls_cp);
+                len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
+                                      MAX_USERNAME_SIZE, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
                 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
                 sec_blob->UserName.Length = cpu_to_le16(len);
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index 80d850881938..d5cd9aa7eacc 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -213,7 +213,7 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16,
 
         /* Password cannot be longer than 128 characters */
         if (passwd) /* Password must be converted to NT unicode */
-                len = cifs_strtoUCS(wpwd, passwd, 128, codepage);
+                len = cifs_strtoUTF16(wpwd, passwd, 128, codepage);
         else {
                 len = 0;
                 *wpwd = 0; /* Ensure string is null terminated */
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index f65d4455c5e5..ef023eef0464 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -540,7 +540,7 @@ EXPORT_SYMBOL_GPL(debugfs_create_blob);
  * debugfs_print_regs32 - use seq_print to describe a set of registers
  * @s: the seq_file structure being used to generate output
  * @regs: an array if struct debugfs_reg32 structures
- * @mregs: the length of the above array
+ * @nregs: the length of the above array
  * @base: the base address to be used in reading the registers
  * @prefix: a string to be prefixed to every output line
  *
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 2a834255c75d..63ab24510649 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -417,17 +417,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
                         (unsigned long long)(extent_base + extent_offset), rc);
                 goto out;
         }
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Encrypting extent "
-                                "with iv:\n");
-                ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
-                                "encryption:\n");
-                ecryptfs_dump_hex((char *)
-                                  (page_address(page)
-                                   + (extent_offset * crypt_stat->extent_size)),
-                                  8);
-        }
         rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, 0,
                                           page, (extent_offset
                                                  * crypt_stat->extent_size),
@@ -440,14 +429,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
                 goto out;
         }
         rc = 0;
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Encrypt extent [0x%.16llx]; "
-                        "rc = [%d]\n",
-                        (unsigned long long)(extent_base + extent_offset), rc);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
-                                "encryption:\n");
-                ecryptfs_dump_hex((char *)(page_address(enc_extent_page)), 8);
-        }
 out:
         return rc;
 }
@@ -543,17 +524,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
                         (unsigned long long)(extent_base + extent_offset), rc);
                 goto out;
         }
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Decrypting extent "
-                                "with iv:\n");
-                ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
-                                "decryption:\n");
-                ecryptfs_dump_hex((char *)
-                                  (page_address(enc_extent_page)
-                                   + (extent_offset * crypt_stat->extent_size)),
-                                  8);
-        }
         rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
                                           (extent_offset
                                            * crypt_stat->extent_size),
@@ -567,16 +537,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
                 goto out;
         }
         rc = 0;
-        if (unlikely(ecryptfs_verbosity > 0)) {
-                ecryptfs_printk(KERN_DEBUG, "Decrypt extent [0x%.16llx]; "
-                        "rc = [%d]\n",
-                        (unsigned long long)(extent_base + extent_offset), rc);
-                ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
-                                "decryption:\n");
-                ecryptfs_dump_hex((char *)(page_address(page)
-                                           + (extent_offset
-                                              * crypt_stat->extent_size)), 8);
-        }
 out:
         return rc;
 }
@@ -1590,8 +1550,8 @@ int ecryptfs_read_and_validate_xattr_region(struct dentry *dentry,
  */
 int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
 {
-        int rc = 0;
-        char *page_virt = NULL;
+        int rc;
+        char *page_virt;
         struct inode *ecryptfs_inode = ecryptfs_dentry->d_inode;
         struct ecryptfs_crypt_stat *crypt_stat =
             &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
@@ -1616,11 +1576,13 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
                                                 ecryptfs_dentry,
                                                 ECRYPTFS_VALIDATE_HEADER_SIZE);
         if (rc) {
+                /* metadata is not in the file header, so try xattrs */
                 memset(page_virt, 0, PAGE_CACHE_SIZE);
                 rc = ecryptfs_read_xattr_region(page_virt, ecryptfs_inode);
                 if (rc) {
                         printk(KERN_DEBUG "Valid eCryptfs headers not found in "
-                               "file header region or xattr region\n");
+                               "file header region or xattr region, inode %lu\n",
+                                ecryptfs_inode->i_ino);
                         rc = -EINVAL;
                         goto out;
                 }
@@ -1629,7 +1591,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
                                                 ECRYPTFS_DONT_VALIDATE_HEADER_SIZE);
                 if (rc) {
                         printk(KERN_DEBUG "Valid eCryptfs headers not found in "
-                               "file xattr region either\n");
+                               "file xattr region either, inode %lu\n",
+                                ecryptfs_inode->i_ino);
                         rc = -EINVAL;
                 }
                 if (crypt_stat->mount_crypt_stat->flags
@@ -1640,7 +1603,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
                                "crypto metadata only in the extended attribute "
                                "region, but eCryptfs was mounted without "
                                "xattr support enabled. eCryptfs will not treat "
-                               "this like an encrypted file.\n");
+                               "this like an encrypted file, inode %lu\n",
+                                ecryptfs_inode->i_ino);
                         rc = -EINVAL;
                 }
         }
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index a9f29b12fbf2..a2362df58ae8 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -151,6 +151,11 @@ ecryptfs_get_key_payload_data(struct key *key)
                                           * dentry name */
 #define ECRYPTFS_TAG_73_PACKET_TYPE 0x49 /* FEK-encrypted filename as
                                           * metadata */
+#define ECRYPTFS_MIN_PKT_LEN_SIZE 1 /* Min size to specify packet length */
+#define ECRYPTFS_MAX_PKT_LEN_SIZE 2 /* Pass at least this many bytes to
+                                     * ecryptfs_parse_packet_length() and
+                                     * ecryptfs_write_packet_length()
+                                     */
 /* Constraint: ECRYPTFS_FILENAME_MIN_RANDOM_PREPEND_BYTES >=
  * ECRYPTFS_MAX_IV_BYTES */
 #define ECRYPTFS_FILENAME_MIN_RANDOM_PREPEND_BYTES 16
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 19a8ca4ab1dd..19892d7d2ed1 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -822,18 +822,6 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
                 size_t num_zeros = (PAGE_CACHE_SIZE
                                     - (ia->ia_size & ~PAGE_CACHE_MASK));
 
-
-                /*
-                 * XXX(truncate) this should really happen at the begginning
-                 * of ->setattr.  But the code is too messy to that as part
-                 * of a larger patch.  ecryptfs is also totally missing out
-                 * on the inode_change_ok check at the beginning of
-                 * ->setattr while would include this.
-                 */
-                rc = inode_newsize_ok(inode, ia->ia_size);
-                if (rc)
-                        goto out;
-
                 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
                         truncate_setsize(inode, ia->ia_size);
                         lower_ia->ia_size = ia->ia_size;
@@ -883,6 +871,28 @@ out:
         return rc;
 }
 
+static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
+{
+        struct ecryptfs_crypt_stat *crypt_stat;
+        loff_t lower_oldsize, lower_newsize;
+
+        crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
+        lower_oldsize = upper_size_to_lower_size(crypt_stat,
+                                                 i_size_read(inode));
+        lower_newsize = upper_size_to_lower_size(crypt_stat, offset);
+        if (lower_newsize > lower_oldsize) {
+                /*
+                 * The eCryptfs inode and the new *lower* size are mixed here
+                 * because we may not have the lower i_mutex held and/or it may
+                 * not be appropriate to call inode_newsize_ok() with inodes
+                 * from other filesystems.
+                 */
+                return inode_newsize_ok(inode, lower_newsize);
+        }
+
+        return 0;
+}
+
 /**
  * ecryptfs_truncate
  * @dentry: The ecryptfs layer dentry
@@ -899,6 +909,10 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
         struct iattr lower_ia = { .ia_valid = 0 };
         int rc;
 
+        rc = ecryptfs_inode_newsize_ok(dentry->d_inode, new_length);
+        if (rc)
+                return rc;
+
         rc = truncate_upper(dentry, &ia, &lower_ia);
         if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
                 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
@@ -978,6 +992,16 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
                 }
         }
         mutex_unlock(&crypt_stat->cs_mutex);
+
+        rc = inode_change_ok(inode, ia);
+        if (rc)
+                goto out;
+        if (ia->ia_valid & ATTR_SIZE) {
+                rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);
+                if (rc)
+                        goto out;
+        }
+
         if (S_ISREG(inode->i_mode)) {
                 rc = filemap_write_and_wait(inode->i_mapping);
                 if (rc)
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index ac1ad48c2376..8e3b943e330f 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -109,7 +109,7 @@ int ecryptfs_parse_packet_length(unsigned char *data, size_t *size,
                 (*size) += ((unsigned char)(data[1]) + 192);
                 (*length_size) = 2;
         } else if (data[0] == 255) {
-                /* Five-byte length; we're not supposed to see this */
+                /* If support is added, adjust ECRYPTFS_MAX_PKT_LEN_SIZE */
                 ecryptfs_printk(KERN_ERR, "Five-byte packet length not "
                                 "supported\n");
                 rc = -EINVAL;
@@ -126,7 +126,7 @@ out:
 /**
  * ecryptfs_write_packet_length
  * @dest: The byte array target into which to write the length. Must
- *        have at least 5 bytes allocated.
+ *        have at least ECRYPTFS_MAX_PKT_LEN_SIZE bytes allocated.
  * @size: The length to write.
  * @packet_size_length: The number of bytes used to encode the packet
  *                      length is written to this address.
@@ -146,6 +146,7 @@ int ecryptfs_write_packet_length(char *dest, size_t size,
                 dest[1] = ((size - 192) % 256);
                 (*packet_size_length) = 2;
         } else {
+                /* If support is added, adjust ECRYPTFS_MAX_PKT_LEN_SIZE */
                 rc = -EINVAL;
                 ecryptfs_printk(KERN_WARNING,
                                 "Unsupported packet size: [%zd]\n", size);
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 940a82e63dc3..349209dc6a91 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -218,6 +218,29 @@ out_unlock:
         return rc;
 }
 
+/*
+ * miscdevfs packet format:
+ *  Octet 0: Type
+ *  Octets 1-4: network byte order msg_ctx->counter
+ *  Octets 5-N0: Size of struct ecryptfs_message to follow
+ *  Octets N0-N1: struct ecryptfs_message (including data)
+ *
+ *  Octets 5-N1 not written if the packet type does not include a message
+ */
+#define PKT_TYPE_SIZE           1
+#define PKT_CTR_SIZE            4
+#define MIN_NON_MSG_PKT_SIZE    (PKT_TYPE_SIZE + PKT_CTR_SIZE)
+#define MIN_MSG_PKT_SIZE        (PKT_TYPE_SIZE + PKT_CTR_SIZE \
+                                 + ECRYPTFS_MIN_PKT_LEN_SIZE)
+/* 4 + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES comes from tag 65 packet format */
+#define MAX_MSG_PKT_SIZE        (PKT_TYPE_SIZE + PKT_CTR_SIZE \
+                                 + ECRYPTFS_MAX_PKT_LEN_SIZE \
+                                 + sizeof(struct ecryptfs_message) \
+                                 + 4 + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES)
+#define PKT_TYPE_OFFSET         0
+#define PKT_CTR_OFFSET          PKT_TYPE_SIZE
+#define PKT_LEN_OFFSET          (PKT_TYPE_SIZE + PKT_CTR_SIZE)
+
 /**
  * ecryptfs_miscdev_read - format and send message from queue
  * @file: fs/ecryptfs/euid miscdevfs handle (ignored)
@@ -237,7 +260,7 @@ ecryptfs_miscdev_read(struct file *file, char __user *buf, size_t count,
         struct ecryptfs_daemon *daemon;
         struct ecryptfs_msg_ctx *msg_ctx;
         size_t packet_length_size;
-        char packet_length[3];
+        char packet_length[ECRYPTFS_MAX_PKT_LEN_SIZE];
         size_t i;
         size_t total_length;
         uid_t euid = current_euid();
@@ -305,15 +328,8 @@ check_list:
                 packet_length_size = 0;
                 msg_ctx->msg_size = 0;
         }
-        /* miscdevfs packet format:
-         *  Octet 0: Type
-         *  Octets 1-4: network byte order msg_ctx->counter
-         *  Octets 5-N0: Size of struct ecryptfs_message to follow
-         *  Octets N0-N1: struct ecryptfs_message (including data)
-         *
-         *  Octets 5-N1 not written if the packet type does not
-         *  include a message */
-        total_length = (1 + 4 + packet_length_size + msg_ctx->msg_size);
+        total_length = (PKT_TYPE_SIZE + PKT_CTR_SIZE + packet_length_size
+                        + msg_ctx->msg_size);
         if (count < total_length) {
                 rc = 0;
                 printk(KERN_WARNING "%s: Only given user buffer of "
@@ -324,9 +340,10 @@ check_list:
         rc = -EFAULT;
         if (put_user(msg_ctx->type, buf))
                 goto out_unlock_msg_ctx;
-        if (put_user(cpu_to_be32(msg_ctx->counter), (__be32 __user *)(buf + 1)))
+        if (put_user(cpu_to_be32(msg_ctx->counter),
+                     (__be32 __user *)(&buf[PKT_CTR_OFFSET])))
                 goto out_unlock_msg_ctx;
-        i = 5;
+        i = PKT_TYPE_SIZE + PKT_CTR_SIZE;
         if (msg_ctx->msg) {
                 if (copy_to_user(&buf[i], packet_length, packet_length_size))
                         goto out_unlock_msg_ctx;
@@ -391,12 +408,6 @@ out:
  * @count: Amount of data in @buf
  * @ppos: Pointer to offset in file (ignored)
  *
- * miscdevfs packet format:
- *  Octet 0: Type
- *  Octets 1-4: network byte order msg_ctx->counter (0's for non-response)
- *  Octets 5-N0: Size of struct ecryptfs_message to follow
- *  Octets N0-N1: struct ecryptfs_message (including data)
- *
  * Returns the number of bytes read from @buf
  */
 static ssize_t
@@ -405,60 +416,78 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
 {
         __be32 counter_nbo;
         u32 seq;
-        size_t packet_size, packet_size_length, i;
-        ssize_t sz = 0;
+        size_t packet_size, packet_size_length;
         char *data;
         uid_t euid = current_euid();
-        int rc;
+        unsigned char packet_size_peek[ECRYPTFS_MAX_PKT_LEN_SIZE];
+        ssize_t rc;
 
-        if (count == 0)
-                goto out;
+        if (count == 0) {
+                return 0;
+        } else if (count == MIN_NON_MSG_PKT_SIZE) {
+                /* Likely a harmless MSG_HELO or MSG_QUIT - no packet length */
+                goto memdup;
+        } else if (count < MIN_MSG_PKT_SIZE || count > MAX_MSG_PKT_SIZE) {
+                printk(KERN_WARNING "%s: Acceptable packet size range is "
+                       "[%d-%lu], but amount of data written is [%zu].",
+                       __func__, MIN_MSG_PKT_SIZE, MAX_MSG_PKT_SIZE, count);
+                return -EINVAL;
+        }
+
+        if (copy_from_user(packet_size_peek, &buf[PKT_LEN_OFFSET],
+                           sizeof(packet_size_peek))) {
+                printk(KERN_WARNING "%s: Error while inspecting packet size\n",
+                       __func__);
+                return -EFAULT;
+        }
 
+        rc = ecryptfs_parse_packet_length(packet_size_peek, &packet_size,
+                                          &packet_size_length);
+        if (rc) {
+                printk(KERN_WARNING "%s: Error parsing packet length; "
+                       "rc = [%zd]\n", __func__, rc);
+                return rc;
+        }
+
+        if ((PKT_TYPE_SIZE + PKT_CTR_SIZE + packet_size_length + packet_size)
+            != count) {
+                printk(KERN_WARNING "%s: Invalid packet size [%zu]\n", __func__,
+                       packet_size);
+                return -EINVAL;
+        }
+
+memdup:
         data = memdup_user(buf, count);
         if (IS_ERR(data)) {
                 printk(KERN_ERR "%s: memdup_user returned error [%ld]\n",
                        __func__, PTR_ERR(data));
-                goto out;
+                return PTR_ERR(data);
         }
-        sz = count;
-        i = 0;
-        switch (data[i++]) {
+        switch (data[PKT_TYPE_OFFSET]) {
         case ECRYPTFS_MSG_RESPONSE:
-                if (count < (1 + 4 + 1 + sizeof(struct ecryptfs_message))) {
+                if (count < (MIN_MSG_PKT_SIZE
+                             + sizeof(struct ecryptfs_message))) {
                         printk(KERN_WARNING "%s: Minimum acceptable packet "
                                "size is [%zd], but amount of data written is "
                                "only [%zd]. Discarding response packet.\n",
                                __func__,
-                               (1 + 4 + 1 + sizeof(struct ecryptfs_message)),
-                               count);
+                               (MIN_MSG_PKT_SIZE
+                                + sizeof(struct ecryptfs_message)), count);
+                        rc = -EINVAL;
                         goto out_free;
                 }
-                memcpy(&counter_nbo, &data[i], 4);
+                memcpy(&counter_nbo, &data[PKT_CTR_OFFSET], PKT_CTR_SIZE);
                 seq = be32_to_cpu(counter_nbo);
-                i += 4;
-                rc = ecryptfs_parse_packet_length(&data[i], &packet_size,
-                                                  &packet_size_length);
+                rc = ecryptfs_miscdev_response(
+                                &data[PKT_LEN_OFFSET + packet_size_length],
+                                packet_size, euid, current_user_ns(),
+                                task_pid(current), seq);
                 if (rc) {
-                        printk(KERN_WARNING "%s: Error parsing packet length; "
-                               "rc = [%d]\n", __func__, rc);
-                        goto out_free;
-                }
-                i += packet_size_length;
-                if ((1 + 4 + packet_size_length + packet_size) != count) {
-                        printk(KERN_WARNING "%s: (1 + packet_size_length([%zd])"
-                               " + packet_size([%zd]))([%zd]) != "
-                               "count([%zd]). Invalid packet format.\n",
-                               __func__, packet_size_length, packet_size,
-                               (1 + packet_size_length + packet_size), count);
-                        goto out_free;
-                }
-                rc = ecryptfs_miscdev_response(&data[i], packet_size,
-                                               euid, current_user_ns(),
-                                               task_pid(current), seq);
-                if (rc)
                         printk(KERN_WARNING "%s: Failed to deliver miscdev "
-                               "response to requesting operation; rc = [%d]\n",
+                               "response to requesting operation; rc = [%zd]\n",
                                __func__, rc);
+                        goto out_free;
+                }
                 break;
         case ECRYPTFS_MSG_HELO:
         case ECRYPTFS_MSG_QUIT:
@@ -467,12 +496,13 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
                 ecryptfs_printk(KERN_WARNING, "Dropping miscdev "
                                 "message of unrecognized type [%d]\n",
                                 data[0]);
-                break;
+                rc = -EINVAL;
+                goto out_free;
         }
+        rc = count;
 out_free:
         kfree(data);
-out:
-        return sz;
+        return rc;
 }
 
 
diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c
index 6a44148c5fb9..10ec695ccd68 100644
--- a/fs/ecryptfs/mmap.c
+++ b/fs/ecryptfs/mmap.c
@@ -57,6 +57,10 @@ struct page *ecryptfs_get_locked_page(struct inode *inode, loff_t index)
  * @page: Page that is locked before this call is made
  *
  * Returns zero on success; non-zero otherwise
+ *
+ * This is where we encrypt the data and pass the encrypted data to
+ * the lower filesystem.  In OpenPGP-compatible mode, we operate on
+ * entire underlying packets.
  */
 static int ecryptfs_writepage(struct page *page, struct writeback_control *wbc)
 {
@@ -481,10 +485,6 @@ int ecryptfs_write_inode_size_to_metadata(struct inode *ecryptfs_inode)
  * @copied: The amount of data copied
  * @page: The eCryptfs page
  * @fsdata: The fsdata (unused)
- *
- * This is where we encrypt the data and pass the encrypted data to
- * the lower filesystem.  In OpenPGP-compatible mode, we operate on
- * entire underlying packets.
  */
 static int ecryptfs_write_end(struct file *file,
                         struct address_space *mapping,
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index 3745f7c2b9c2..5c0106f75775 100644
--- a/fs/ecryptfs/read_write.c
+++ b/fs/ecryptfs/read_write.c
@@ -130,13 +130,18 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
                 pgoff_t ecryptfs_page_idx = (pos >> PAGE_CACHE_SHIFT);
                 size_t start_offset_in_page = (pos & ~PAGE_CACHE_MASK);
                 size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
-                size_t total_remaining_bytes = ((offset + size) - pos);
+                loff_t total_remaining_bytes = ((offset + size) - pos);
+
+                if (fatal_signal_pending(current)) {
+                        rc = -EINTR;
+                        break;
+                }
 
                 if (num_bytes > total_remaining_bytes)
                         num_bytes = total_remaining_bytes;
                 if (pos < offset) {
                         /* remaining zeros to write, up to destination offset */
-                        size_t total_remaining_zeros = (offset - pos);
+                        loff_t total_remaining_zeros = (offset - pos);
 
                         if (num_bytes > total_remaining_zeros)
                                 num_bytes = total_remaining_zeros;
@@ -193,15 +198,19 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
                 }
                 pos += num_bytes;
         }
-        if ((offset + size) > ecryptfs_file_size) {
-                i_size_write(ecryptfs_inode, (offset + size));
+        if (pos > ecryptfs_file_size) {
+                i_size_write(ecryptfs_inode, pos);
                 if (crypt_stat->flags & ECRYPTFS_ENCRYPTED) {
-                        rc = ecryptfs_write_inode_size_to_metadata(
+                        int rc2;
+
+                        rc2 = ecryptfs_write_inode_size_to_metadata(
                                                                 ecryptfs_inode);
-                        if (rc) {
+                        if (rc2) {
                                 printk(KERN_ERR "Problem with "
                                        "ecryptfs_write_inode_size_to_metadata; "
-                                       "rc = [%d]\n", rc);
+                                       "rc = [%d]\n", rc2);
+                                if (!rc)
+                                        rc = rc2;
                                 goto out;
                         }
                 }
@@ -273,76 +282,3 @@ int ecryptfs_read_lower_page_segment(struct page *page_for_ecryptfs,
         flush_dcache_page(page_for_ecryptfs);
         return rc;
 }
-
-#if 0
-/**
- * ecryptfs_read
- * @data: The virtual address into which to write the data read (and
- *        possibly decrypted) from the lower file
- * @offset: The offset in the decrypted view of the file from which to
- *          read into @data
- * @size: The number of bytes to read into @data
- * @ecryptfs_file: The eCryptfs file from which to read
- *
- * Read an arbitrary amount of data from an arbitrary location in the
- * eCryptfs page cache. This is done on an extent-by-extent basis;
- * individual extents are decrypted and read from the lower page
- * cache (via VFS reads). This function takes care of all the
- * address translation to locations in the lower filesystem.
- *
- * Returns zero on success; non-zero otherwise
- */
-int ecryptfs_read(char *data, loff_t offset, size_t size,
-                  struct file *ecryptfs_file)
-{
-        struct inode *ecryptfs_inode = ecryptfs_file->f_dentry->d_inode;
-        struct page *ecryptfs_page;
-        char *ecryptfs_page_virt;
-        loff_t ecryptfs_file_size = i_size_read(ecryptfs_inode);
-        loff_t data_offset = 0;
-        loff_t pos;
-        int rc = 0;
-
-        if ((offset + size) > ecryptfs_file_size) {
-                rc = -EINVAL;
-                printk(KERN_ERR "%s: Attempt to read data past the end of the "
-                        "file; offset = [%lld]; size = [%td]; "
-                       "ecryptfs_file_size = [%lld]\n",
-                       __func__, offset, size, ecryptfs_file_size);
-                goto out;
-        }
-        pos = offset;
-        while (pos < (offset + size)) {
-                pgoff_t ecryptfs_page_idx = (pos >> PAGE_CACHE_SHIFT);
-                size_t start_offset_in_page = (pos & ~PAGE_CACHE_MASK);
-                size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
-                size_t total_remaining_bytes = ((offset + size) - pos);
-
-                if (num_bytes > total_remaining_bytes)
-                        num_bytes = total_remaining_bytes;
-                ecryptfs_page = ecryptfs_get_locked_page(ecryptfs_inode,
-                                                         ecryptfs_page_idx);
-                if (IS_ERR(ecryptfs_page)) {
-                        rc = PTR_ERR(ecryptfs_page);
-                        printk(KERN_ERR "%s: Error getting page at "
-                               "index [%ld] from eCryptfs inode "
-                               "mapping; rc = [%d]\n", __func__,
-                               ecryptfs_page_idx, rc);
-                        goto out;
-                }
-                ecryptfs_page_virt = kmap_atomic(ecryptfs_page, KM_USER0);
-                memcpy((data + data_offset),
-                       ((char *)ecryptfs_page_virt + start_offset_in_page),
-                       num_bytes);
-                kunmap_atomic(ecryptfs_page_virt, KM_USER0);
-                flush_dcache_page(ecryptfs_page);
-                SetPageUptodate(ecryptfs_page);
-                unlock_page(ecryptfs_page);
-                page_cache_release(ecryptfs_page);
-                pos += num_bytes;
-                data_offset += num_bytes;
-        }
-out:
-        return rc;
-}
-#endif  /*  0  */
diff --git a/fs/ext2/ioctl.c b/fs/ext2/ioctl.c
index 1089f760c847..2de655f5d625 100644
--- a/fs/ext2/ioctl.c
+++ b/fs/ext2/ioctl.c
@@ -77,10 +77,11 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 flags = flags & EXT2_FL_USER_MODIFIABLE;
                 flags |= oldflags & ~EXT2_FL_USER_MODIFIABLE;
                 ei->i_flags = flags;
-                mutex_unlock(&inode->i_mutex);
 
                 ext2_set_inode_flags(inode);
                 inode->i_ctime = CURRENT_TIME_SEC;
+                mutex_unlock(&inode->i_mutex);
+
                 mark_inode_dirty(inode);
 setflags_out:
                 mnt_drop_write_file(filp);
@@ -88,20 +89,29 @@ setflags_out:
         }
         case EXT2_IOC_GETVERSION:
                 return put_user(inode->i_generation, (int __user *) arg);
-        case EXT2_IOC_SETVERSION:
+        case EXT2_IOC_SETVERSION: {
+                __u32 generation;
+
                 if (!inode_owner_or_capable(inode))
                         return -EPERM;
                 ret = mnt_want_write_file(filp);
                 if (ret)
                         return ret;
-                if (get_user(inode->i_generation, (int __user *) arg)) {
+                if (get_user(generation, (int __user *) arg)) {
                         ret = -EFAULT;
-                } else {
-                        inode->i_ctime = CURRENT_TIME_SEC;
-                        mark_inode_dirty(inode);
+                        goto setversion_out;
                 }
+
+                mutex_lock(&inode->i_mutex);
+                inode->i_ctime = CURRENT_TIME_SEC;
+                inode->i_generation = generation;
+                mutex_unlock(&inode->i_mutex);
+
+                mark_inode_dirty(inode);
+setversion_out:
                 mnt_drop_write_file(filp);
                 return ret;
+        }
         case EXT2_IOC_GETRSVSZ:
                 if (test_opt(inode->i_sb, RESERVATION)
                         && S_ISREG(inode->i_mode)
diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
index 5d1a00a5041b..05f0754f2b46 100644
--- a/fs/jbd/checkpoint.c
+++ b/fs/jbd/checkpoint.c
@@ -453,8 +453,6 @@ out:
  *
  * Return <0 on error, 0 on success, 1 if there was nothing to clean up.
  *
- * Called with the journal lock held.
- *
  * This is the only part of the journaling code which really needs to be
  * aware of transaction aborts.  Checkpointing involves writing to the
  * main filesystem area rather than to the journal, so it can proceed
@@ -472,13 +470,14 @@ int cleanup_journal_tail(journal_t *journal)
         if (is_journal_aborted(journal))
                 return 1;
 
-        /* OK, work out the oldest transaction remaining in the log, and
+        /*
+         * OK, work out the oldest transaction remaining in the log, and
          * the log block it starts at.
          *
          * If the log is now empty, we need to work out which is the
          * next transaction ID we will write, and where it will
-         * start. */
-
+         * start.
+         */
         spin_lock(&journal->j_state_lock);
         spin_lock(&journal->j_list_lock);
         transaction = journal->j_checkpoint_transactions;
@@ -504,7 +503,25 @@ int cleanup_journal_tail(journal_t *journal)
                 spin_unlock(&journal->j_state_lock);
                 return 1;
         }
+        spin_unlock(&journal->j_state_lock);
+
+        /*
+         * We need to make sure that any blocks that were recently written out
+         * --- perhaps by log_do_checkpoint() --- are flushed out before we
+         * drop the transactions from the journal. It's unlikely this will be
+         * necessary, especially with an appropriately sized journal, but we
+         * need this to guarantee correctness.  Fortunately
+         * cleanup_journal_tail() doesn't get called all that often.
+         */
+        if (journal->j_flags & JFS_BARRIER)
+                blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
 
+        spin_lock(&journal->j_state_lock);
+        if (!tid_gt(first_tid, journal->j_tail_sequence)) {
+                spin_unlock(&journal->j_state_lock);
+                /* Someone else cleaned up journal so return 0 */
+                return 0;
+        }
         /* OK, update the superblock to recover the freed space.
          * Physical blocks come first: have we wrapped beyond the end of
          * the log?  */
diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
index 5b43e96788e6..008bf062fd26 100644
--- a/fs/jbd/recovery.c
+++ b/fs/jbd/recovery.c
@@ -20,6 +20,7 @@
 #include <linux/fs.h>
 #include <linux/jbd.h>
 #include <linux/errno.h>
+#include <linux/blkdev.h>
 #endif
 
 /*
@@ -263,6 +264,9 @@ int journal_recover(journal_t *journal)
         err2 = sync_blockdev(journal->j_fs_dev);
         if (!err)
                 err = err2;
+        /* Flush disk caches to get replayed data on the permanent storage */
+        if (journal->j_flags & JFS_BARRIER)
+                blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
 
         return err;
 }
diff --git a/fs/logfs/dir.c b/fs/logfs/dir.c
index 501043e8966c..3de7a32cadbe 100644
--- a/fs/logfs/dir.c
+++ b/fs/logfs/dir.c
@@ -71,7 +71,7 @@ static int write_dir(struct inode *dir, struct logfs_disk_dentry *dd,
 
 static int write_inode(struct inode *inode)
 {
-        return __logfs_write_inode(inode, WF_LOCK);
+        return __logfs_write_inode(inode, NULL, WF_LOCK);
 }
 
 static s64 dir_seek_data(struct inode *inode, s64 pos)
diff --git a/fs/logfs/file.c b/fs/logfs/file.c
index b548c87a86f1..3886cded283c 100644
--- a/fs/logfs/file.c
+++ b/fs/logfs/file.c
@@ -230,7 +230,9 @@ int logfs_fsync(struct file *file, loff_t start, loff_t end, int datasync)
                 return ret;
 
         mutex_lock(&inode->i_mutex);
+        logfs_get_wblocks(sb, NULL, WF_LOCK);
         logfs_write_anchor(sb);
+        logfs_put_wblocks(sb, NULL, WF_LOCK);
         mutex_unlock(&inode->i_mutex);
 
         return 0;
diff --git a/fs/logfs/gc.c b/fs/logfs/gc.c
index caa4419285dc..d4efb061bdc5 100644
--- a/fs/logfs/gc.c
+++ b/fs/logfs/gc.c
@@ -367,7 +367,7 @@ static struct gc_candidate *get_candidate(struct super_block *sb)
         int i, max_dist;
         struct gc_candidate *cand = NULL, *this;
 
-        max_dist = min(no_free_segments(sb), LOGFS_NO_AREAS);
+        max_dist = min(no_free_segments(sb), LOGFS_NO_AREAS - 1);
 
         for (i = max_dist; i >= 0; i--) {
                 this = first_in_list(&super->s_low_list[i]);
diff --git a/fs/logfs/inode.c b/fs/logfs/inode.c
index 388df1aa35e5..a422f42238b2 100644
--- a/fs/logfs/inode.c
+++ b/fs/logfs/inode.c
@@ -286,7 +286,7 @@ static int logfs_write_inode(struct inode *inode, struct writeback_control *wbc)
         if (logfs_inode(inode)->li_flags & LOGFS_IF_STILLBORN)
                 return 0;
 
-        ret = __logfs_write_inode(inode, flags);
+        ret = __logfs_write_inode(inode, NULL, flags);
         LOGFS_BUG_ON(ret, inode->i_sb);
         return ret;
 }
@@ -363,7 +363,9 @@ static void logfs_init_once(void *_li)
 
 static int logfs_sync_fs(struct super_block *sb, int wait)
 {
+        logfs_get_wblocks(sb, NULL, WF_LOCK);
         logfs_write_anchor(sb);
+        logfs_put_wblocks(sb, NULL, WF_LOCK);
         return 0;
 }
 
diff --git a/fs/logfs/journal.c b/fs/logfs/journal.c
index 9da29706f91c..1e1c369df22b 100644
--- a/fs/logfs/journal.c
+++ b/fs/logfs/journal.c
@@ -612,7 +612,6 @@ static size_t __logfs_write_je(struct super_block *sb, void *buf, u16 type,
         if (len == 0)
                 return logfs_write_header(super, header, 0, type);
 
-        BUG_ON(len > sb->s_blocksize);
         compr_len = logfs_compress(buf, data, len, sb->s_blocksize);
         if (compr_len < 0 || type == JE_ANCHOR) {
                 memcpy(data, buf, len);
diff --git a/fs/logfs/logfs.h b/fs/logfs/logfs.h
index 926373866a55..5f0937609465 100644
--- a/fs/logfs/logfs.h
+++ b/fs/logfs/logfs.h
@@ -528,7 +528,7 @@ void logfs_destroy_inode_cache(void);
 void logfs_set_blocks(struct inode *inode, u64 no);
 /* these logically belong into inode.c but actually reside in readwrite.c */
 int logfs_read_inode(struct inode *inode);
-int __logfs_write_inode(struct inode *inode, long flags);
+int __logfs_write_inode(struct inode *inode, struct page *, long flags);
 void logfs_evict_inode(struct inode *inode);
 
 /* journal.c */
@@ -577,6 +577,8 @@ void initialize_block_counters(struct page *page, struct logfs_block *block,
                 __be64 *array, int page_is_empty);
 int logfs_exist_block(struct inode *inode, u64 bix);
 int get_page_reserve(struct inode *inode, struct page *page);
+void logfs_get_wblocks(struct super_block *sb, struct page *page, int lock);
+void logfs_put_wblocks(struct super_block *sb, struct page *page, int lock);
 extern struct logfs_block_ops indirect_block_ops;
 
 /* segment.c */
@@ -594,6 +596,7 @@ int logfs_init_mapping(struct super_block *sb);
 void logfs_sync_area(struct logfs_area *area);
 void logfs_sync_segments(struct super_block *sb);
 void freeseg(struct super_block *sb, u32 segno);
+void free_areas(struct super_block *sb);
 
 /* area handling */
 int logfs_init_areas(struct super_block *sb);
diff --git a/fs/logfs/readwrite.c b/fs/logfs/readwrite.c
index 2ac4217b7901..4153e65b0148 100644
--- a/fs/logfs/readwrite.c
+++ b/fs/logfs/readwrite.c
@@ -244,8 +244,7 @@ static void preunlock_page(struct super_block *sb, struct page *page, int lock)
  * is waiting for s_write_mutex.  We annotate this fact by setting PG_pre_locked
  * in addition to PG_locked.
  */
-static void logfs_get_wblocks(struct super_block *sb, struct page *page,
-                int lock)
+void logfs_get_wblocks(struct super_block *sb, struct page *page, int lock)
 {
         struct logfs_super *super = logfs_super(sb);
 
@@ -260,8 +259,7 @@ static void logfs_get_wblocks(struct super_block *sb, struct page *page,
         }
 }
 
-static void logfs_put_wblocks(struct super_block *sb, struct page *page,
-                int lock)
+void logfs_put_wblocks(struct super_block *sb, struct page *page, int lock)
 {
         struct logfs_super *super = logfs_super(sb);
 
@@ -424,7 +422,7 @@ static void inode_write_block(struct logfs_block *block)
         if (inode->i_ino == LOGFS_INO_MASTER)
                 logfs_write_anchor(inode->i_sb);
         else {
-                ret = __logfs_write_inode(inode, 0);
+                ret = __logfs_write_inode(inode, NULL, 0);
                 /* see indirect_write_block comment */
                 BUG_ON(ret);
         }
@@ -560,8 +558,13 @@ static void inode_free_block(struct super_block *sb, struct logfs_block *block)
 static void indirect_free_block(struct super_block *sb,
                 struct logfs_block *block)
 {
-        ClearPagePrivate(block->page);
-        block->page->private = 0;
+        struct page *page = block->page;
+
+        if (PagePrivate(page)) {
+                ClearPagePrivate(page);
+                page_cache_release(page);
+                set_page_private(page, 0);
+        }
         __free_block(sb, block);
 }
 
@@ -650,8 +653,11 @@ static void alloc_data_block(struct inode *inode, struct page *page)
         logfs_unpack_index(page->index, &bix, &level);
         block = __alloc_block(inode->i_sb, inode->i_ino, bix, level);
         block->page = page;
+
         SetPagePrivate(page);
-        page->private = (unsigned long)block;
+        page_cache_get(page);
+        set_page_private(page, (unsigned long) block);
+
         block->ops = &indirect_block_ops;
 }
 
@@ -1570,11 +1576,15 @@ int logfs_write_buf(struct inode *inode, struct page *page, long flags)
 static int __logfs_delete(struct inode *inode, struct page *page)
 {
         long flags = WF_DELETE;
+        int err;
 
         inode->i_ctime = inode->i_mtime = CURRENT_TIME;
 
         if (page->index < I0_BLOCKS)
                 return logfs_write_direct(inode, page, flags);
+        err = grow_inode(inode, page->index, 0);
+        if (err)
+                return err;
         return logfs_write_rec(inode, page, page->index, 0, flags);
 }
 
@@ -1623,7 +1633,7 @@ int logfs_rewrite_block(struct inode *inode, u64 bix, u64 ofs,
                         if (inode->i_ino == LOGFS_INO_MASTER)
                                 logfs_write_anchor(inode->i_sb);
                         else {
-                                err = __logfs_write_inode(inode, flags);
+                                err = __logfs_write_inode(inode, page, flags);
                         }
                 }
         }
@@ -1873,7 +1883,7 @@ int logfs_truncate(struct inode *inode, u64 target)
                 logfs_get_wblocks(sb, NULL, 1);
                 err = __logfs_truncate(inode, size);
                 if (!err)
-                        err = __logfs_write_inode(inode, 0);
+                        err = __logfs_write_inode(inode, NULL, 0);
                 logfs_put_wblocks(sb, NULL, 1);
         }
 
@@ -1901,8 +1911,11 @@ static void move_page_to_inode(struct inode *inode, struct page *page)
         li->li_block = block;
 
         block->page = NULL;
-        page->private = 0;
-        ClearPagePrivate(page);
+        if (PagePrivate(page)) {
+                ClearPagePrivate(page);
+                page_cache_release(page);
+                set_page_private(page, 0);
+        }
 }
 
 static void move_inode_to_page(struct page *page, struct inode *inode)
@@ -1918,8 +1931,12 @@ static void move_inode_to_page(struct page *page, struct inode *inode)
         BUG_ON(PagePrivate(page));
         block->ops = &indirect_block_ops;
         block->page = page;
-        page->private = (unsigned long)block;
-        SetPagePrivate(page);
+
+        if (!PagePrivate(page)) {
+                SetPagePrivate(page);
+                page_cache_get(page);
+                set_page_private(page, (unsigned long) block);
+        }
 
         block->inode = NULL;
         li->li_block = NULL;
@@ -2106,14 +2123,14 @@ void logfs_set_segment_unreserved(struct super_block *sb, u32 segno, u32 ec)
                         ec_level);
 }
 
-int __logfs_write_inode(struct inode *inode, long flags)
+int __logfs_write_inode(struct inode *inode, struct page *page, long flags)
 {
         struct super_block *sb = inode->i_sb;
         int ret;
 
-        logfs_get_wblocks(sb, NULL, flags & WF_LOCK);
+        logfs_get_wblocks(sb, page, flags & WF_LOCK);
         ret = do_write_inode(inode);
-        logfs_put_wblocks(sb, NULL, flags & WF_LOCK);
+        logfs_put_wblocks(sb, page, flags & WF_LOCK);
         return ret;
 }
 
diff --git a/fs/logfs/segment.c b/fs/logfs/segment.c
index 9d5187353255..ab798ed1cc88 100644
--- a/fs/logfs/segment.c
+++ b/fs/logfs/segment.c
@@ -86,7 +86,11 @@ int __logfs_buf_write(struct logfs_area *area, u64 ofs, void *buf, size_t len,
                 BUG_ON(!page); /* FIXME: reserve a pool */
                 SetPageUptodate(page);
                 memcpy(page_address(page) + offset, buf, copylen);
-                SetPagePrivate(page);
+
+                if (!PagePrivate(page)) {
+                        SetPagePrivate(page);
+                        page_cache_get(page);
+                }
                 page_cache_release(page);
 
                 buf += copylen;
@@ -110,7 +114,10 @@ static void pad_partial_page(struct logfs_area *area)
                 page = get_mapping_page(sb, index, 0);
                 BUG_ON(!page); /* FIXME: reserve a pool */
                 memset(page_address(page) + offset, 0xff, len);
-                SetPagePrivate(page);
+                if (!PagePrivate(page)) {
+                        SetPagePrivate(page);
+                        page_cache_get(page);
+                }
                 page_cache_release(page);
         }
 }
@@ -130,7 +137,10 @@ static void pad_full_pages(struct logfs_area *area)
                 BUG_ON(!page); /* FIXME: reserve a pool */
                 SetPageUptodate(page);
                 memset(page_address(page), 0xff, PAGE_CACHE_SIZE);
-                SetPagePrivate(page);
+                if (!PagePrivate(page)) {
+                        SetPagePrivate(page);
+                        page_cache_get(page);
+                }
                 page_cache_release(page);
                 index++;
                 no_indizes--;
@@ -485,8 +495,12 @@ static void move_btree_to_page(struct inode *inode, struct page *page,
                 mempool_free(item, super->s_alias_pool);
         }
         block->page = page;
-        SetPagePrivate(page);
-        page->private = (unsigned long)block;
+
+        if (!PagePrivate(page)) {
+                SetPagePrivate(page);
+                page_cache_get(page);
+                set_page_private(page, (unsigned long) block);
+        }
         block->ops = &indirect_block_ops;
         initialize_block_counters(page, block, data, 0);
 }
@@ -536,8 +550,12 @@ void move_page_to_btree(struct page *page)
                 list_add(&item->list, &block->item_list);
         }
         block->page = NULL;
-        ClearPagePrivate(page);
-        page->private = 0;
+
+        if (PagePrivate(page)) {
+                ClearPagePrivate(page);
+                page_cache_release(page);
+                set_page_private(page, 0);
+        }
         block->ops = &btree_block_ops;
         err = alias_tree_insert(block->sb, block->ino, block->bix, block->level,
                         block);
@@ -702,7 +720,10 @@ void freeseg(struct super_block *sb, u32 segno)
                 page = find_get_page(mapping, ofs >> PAGE_SHIFT);
                 if (!page)
                         continue;
-                ClearPagePrivate(page);
+                if (PagePrivate(page)) {
+                        ClearPagePrivate(page);
+                        page_cache_release(page);
+                }
                 page_cache_release(page);
         }
 }
@@ -841,6 +862,16 @@ static void free_area(struct logfs_area *area)
         kfree(area);
 }
 
+void free_areas(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int i;
+
+        for_each_area(i)
+                free_area(super->s_area[i]);
+        free_area(super->s_journal_area);
+}
+
 static struct logfs_area *alloc_area(struct super_block *sb)
 {
         struct logfs_area *area;
@@ -923,10 +954,6 @@ err:
 void logfs_cleanup_areas(struct super_block *sb)
 {
         struct logfs_super *super = logfs_super(sb);
-        int i;
 
         btree_grim_visitor128(&super->s_object_alias_tree, 0, kill_alias);
-        for_each_area(i)
-                free_area(super->s_area[i]);
-        free_area(super->s_journal_area);
 }
diff --git a/fs/logfs/super.c b/fs/logfs/super.c
index e795c234ea33..c9ee7f5d1caf 100644
--- a/fs/logfs/super.c
+++ b/fs/logfs/super.c
@@ -486,14 +486,15 @@ static void logfs_kill_sb(struct super_block *sb)
         /* Alias entries slow down mount, so evict as many as possible */
         sync_filesystem(sb);
         logfs_write_anchor(sb);
+        free_areas(sb);
 
         /*
          * From this point on alias entries are simply dropped - and any
          * writes to the object store are considered bugs.
          */
-        super->s_flags |= LOGFS_SB_FLAG_SHUTDOWN;
         log_super("LogFS: Now in shutdown\n");
         generic_shutdown_super(sb);
+        super->s_flags |= LOGFS_SB_FLAG_SHUTDOWN;
 
         BUG_ON(super->s_dirty_used_bytes || super->s_dirty_free_bytes);
 
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index e418c5abdb0e..7dcd2a250495 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -518,6 +518,9 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
                 if (!page)
                         continue;
 
+                if (PageReserved(page))
+                        continue;
+
                 /* Clear accessed and referenced bits. */
                 ptep_test_and_clear_young(vma, addr, pte);
                 ClearPageReferenced(page);
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 5ec59b20cf76..46741970371b 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -2125,6 +2125,8 @@ static int vfs_load_quota_inode(struct inode *inode, int type, int format_id,
                 mutex_unlock(&dqopt->dqio_mutex);
                 goto out_file_init;
         }
+        if (dqopt->flags & DQUOT_QUOTA_SYS_FILE)
+                dqopt->info[type].dqi_flags |= DQF_SYS_FILE;
         mutex_unlock(&dqopt->dqio_mutex);
         spin_lock(&dq_state_lock);
         dqopt->flags |= dquot_state_flag(flags, type);
@@ -2464,7 +2466,7 @@ int dquot_get_dqinfo(struct super_block *sb, int type, struct if_dqinfo *ii)
         spin_lock(&dq_data_lock);
         ii->dqi_bgrace = mi->dqi_bgrace;
         ii->dqi_igrace = mi->dqi_igrace;
-        ii->dqi_flags = mi->dqi_flags & DQF_MASK;
+        ii->dqi_flags = mi->dqi_flags & DQF_GETINFO_MASK;
         ii->dqi_valid = IIF_ALL;
         spin_unlock(&dq_data_lock);
         mutex_unlock(&sb_dqopt(sb)->dqonoff_mutex);
@@ -2490,8 +2492,8 @@ int dquot_set_dqinfo(struct super_block *sb, int type, struct if_dqinfo *ii)
         if (ii->dqi_valid & IIF_IGRACE)
                 mi->dqi_igrace = ii->dqi_igrace;
         if (ii->dqi_valid & IIF_FLAGS)
-                mi->dqi_flags = (mi->dqi_flags & ~DQF_MASK) |
-                                (ii->dqi_flags & DQF_MASK);
+                mi->dqi_flags = (mi->dqi_flags & ~DQF_SETINFO_MASK) |
+                                (ii->dqi_flags & DQF_SETINFO_MASK);
         spin_unlock(&dq_data_lock);
         mark_info_dirty(sb, type);
         /* Force write to disk */
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 62f4fb37789e..00012e31829d 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -493,6 +493,12 @@ int sysfs_attr_ns(struct kobject *kobj, const struct attribute *attr,
         const void *ns = NULL;
         int err;
 
+        if (!dir_sd) {
+                WARN(1, KERN_ERR "sysfs: kobject %s without dirent\n",
+                        kobject_name(kobj));
+                return -ENOENT;
+        }
+
         err = 0;
         if (!sysfs_ns_type(dir_sd))
                 goto out;
diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
index 4a802b4a9056..85eb81683a29 100644
--- a/fs/sysfs/inode.c
+++ b/fs/sysfs/inode.c
@@ -318,8 +318,11 @@ int sysfs_hash_and_remove(struct sysfs_dirent *dir_sd, const void *ns, const cha
         struct sysfs_addrm_cxt acxt;
         struct sysfs_dirent *sd;
 
-        if (!dir_sd)
+        if (!dir_sd) {
+                WARN(1, KERN_WARNING "sysfs: can not remove '%s', no directory\n",
+                        name);
                 return -ENOENT;
+        }
 
         sysfs_addrm_start(&acxt, dir_sd);
 
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 0cf52da9d246..ebdb88840a47 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -131,7 +131,8 @@ xfs_readlink(
                          __func__, (unsigned long long) ip->i_ino,
                          (long long) pathlen);
                 ASSERT(0);
-                return XFS_ERROR(EFSCORRUPTED);
+                error = XFS_ERROR(EFSCORRUPTED);
+                goto out;
         }