22 files changed, 190 insertions, 220 deletions
diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 77ebc3c263d6..549b0144da11 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -140,7 +140,6 @@ int bio_integrity_add_page(struct bio *bio, struct page *page,
        iv = bip_vec_idx(bip, bip->bip_vcnt);
        BUG_ON(iv == NULL);
-        BUG_ON(iv->bv_page != NULL);
        iv->bv_page = page;
        iv->bv_len = len;
@@ -465,7 +464,7 @@ static int bio_integrity_verify(struct bio *bio)
                if (ret) {
                        kunmap_atomic(kaddr, KM_USER0);
-                        break;
+                        return ret;
                }
                sectors = bv->bv_len / bi->sector_size;
@@ -493,18 +492,13 @@ static void bio_integrity_verify_fn(struct work_struct *work)
        struct bio_integrity_payload *bip =
                container_of(work, struct bio_integrity_payload, bip_work);
        struct bio *bio = bip->bip_bio;
-        int error = bip->bip_error;
+        int error;
-        if (bio_integrity_verify(bio)) {
+        error = bio_integrity_verify(bio);
-                clear_bit(BIO_UPTODATE, &bio->bi_flags);
-                error = -EIO;
-        }
        /* Restore original bio completion handler */
        bio->bi_end_io = bip->bip_end_io;
+        bio_endio(bio, error);
-        if (bio->bi_end_io)
-                bio->bi_end_io(bio, error);
 }
 /**
@@ -525,7 +519,17 @@ void bio_integrity_endio(struct bio *bio, int error)
        BUG_ON(bip->bip_bio != bio);
-        bip->bip_error = error;
+        /* In case of an I/O error there is no point in verifying the
+         * integrity metadata.  Restore original bio end_io handler
+         * and run it.
+         */
+        if (error) {
+                bio->bi_end_io = bip->bip_end_io;
+                bio_endio(bio, error);
+                return;
+        }
        INIT_WORK(&bip->bip_work, bio_integrity_verify_fn);
        queue_work(kintegrityd_wq, &bip->bip_work);
 }
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 080703a15f44..73ac7ebd1dfc 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -5,7 +5,9 @@ rather than posix (advisory) byte range locks, even though server would
 support posix byte range locks.  Fix query of root inode when prefixpath
 specified and user does not have access to query information about the
 top of the share.  Fix problem in 2.6.28 resolving DFS paths to
-Samba servers (worked to Windows).
+Samba servers (worked to Windows).  Fix rmdir so that pending search
+(readdir) requests do not get invalid results which include the now
+removed directory.
 Version 1.55
 ------------
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index d4839cf0cb2c..7c9809523f42 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -48,11 +48,11 @@ static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
        if ((cifs_pdu == NULL) || (signature == NULL) || (key == NULL))
                return -EINVAL;
-        MD5Init(&context);
+        cifs_MD5_init(&context);
-        MD5Update(&context, (char *)&key->data, key->len);
+        cifs_MD5_update(&context, (char *)&key->data, key->len);
-        MD5Update(&context, cifs_pdu->Protocol, cifs_pdu->smb_buf_length);
+        cifs_MD5_update(&context, cifs_pdu->Protocol, cifs_pdu->smb_buf_length);
-        MD5Final(signature, &context);
+        cifs_MD5_final(signature, &context);
        return 0;
 }
@@ -96,8 +96,8 @@ static int cifs_calc_signature2(const struct kvec *iov, int n_vec,
        if ((iov == NULL) || (signature == NULL) || (key == NULL))
                return -EINVAL;
-        MD5Init(&context);
+        cifs_MD5_init(&context);
-        MD5Update(&context, (char *)&key->data, key->len);
+        cifs_MD5_update(&context, (char *)&key->data, key->len);
        for (i = 0; i < n_vec; i++) {
                if (iov[i].iov_len == 0)
                        continue;
@@ -110,13 +110,13 @@ static int cifs_calc_signature2(const struct kvec *iov, int n_vec,
                if (i == 0) {
                        if (iov[0].iov_len <= 8) /* cmd field at offset 9 */
                                break; /* nothing to sign or corrupt header */
-                        MD5Update(&context, iov[0].iov_base+4,
+                        cifs_MD5_update(&context, iov[0].iov_base+4,
                                  iov[0].iov_len-4);
                } else
-                        MD5Update(&context, iov[i].iov_base, iov[i].iov_len);
+                        cifs_MD5_update(&context, iov[i].iov_base, iov[i].iov_len);
        }
-        MD5Final(signature, &context);
+        cifs_MD5_final(signature, &context);
        return 0;
 }
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 06f6779988bf..382ba6298809 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -35,8 +35,8 @@ extern struct smb_hdr *cifs_buf_get(void);
 extern void cifs_buf_release(void *);
 extern struct smb_hdr *cifs_small_buf_get(void);
 extern void cifs_small_buf_release(void *);
-extern int smb_send(struct socket *, struct smb_hdr *,
+extern int smb_send(struct TCP_Server_Info *, struct smb_hdr *,
-                        unsigned int /* length */ , struct sockaddr *, bool);
+                        unsigned int /* length */);
 extern unsigned int _GetXid(void);
 extern void _FreeXid(unsigned int);
 #define GetXid() (int)_GetXid(); cFYI(1,("CIFS VFS: in %s as Xid: %d with uid: %d",__func__, xid,current_fsuid()));
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index e9ea394ee075..2209be943051 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1354,7 +1354,7 @@ cifs_parse_mount_options(char *options, const char *devname,
 }
 static struct TCP_Server_Info *
-cifs_find_tcp_session(struct sockaddr *addr)
+cifs_find_tcp_session(struct sockaddr_storage *addr)
 {
        struct list_head *tmp;
        struct TCP_Server_Info *server;
@@ -1374,11 +1374,11 @@ cifs_find_tcp_session(struct sockaddr *addr)
                if (server->tcpStatus == CifsNew)
                        continue;
-                if (addr->sa_family == AF_INET &&
+                if (addr->ss_family == AF_INET &&
                    (addr4->sin_addr.s_addr !=
                     server->addr.sockAddr.sin_addr.s_addr))
                        continue;
-                else if (addr->sa_family == AF_INET6 &&
+                else if (addr->ss_family == AF_INET6 &&
                         memcmp(&server->addr.sockAddr6.sin6_addr,
                                &addr6->sin6_addr, sizeof(addr6->sin6_addr)))
                        continue;
@@ -1419,12 +1419,12 @@ static struct TCP_Server_Info *
 cifs_get_tcp_session(struct smb_vol *volume_info)
 {
        struct TCP_Server_Info *tcp_ses = NULL;
-        struct sockaddr addr;
+        struct sockaddr_storage addr;
        struct sockaddr_in *sin_server = (struct sockaddr_in *) &addr;
        struct sockaddr_in6 *sin_server6 = (struct sockaddr_in6 *) &addr;
        int rc;
-        memset(&addr, 0, sizeof(struct sockaddr));
+        memset(&addr, 0, sizeof(struct sockaddr_storage));
        if (volume_info->UNCip && volume_info->UNC) {
                rc = cifs_inet_pton(AF_INET, volume_info->UNCip,
@@ -1435,9 +1435,9 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
                        rc = cifs_inet_pton(AF_INET6, volume_info->UNCip,
                                            &sin_server6->sin6_addr.in6_u);
                        if (rc > 0)
-                                addr.sa_family = AF_INET6;
+                                addr.ss_family = AF_INET6;
                } else {
-                        addr.sa_family = AF_INET;
+                        addr.ss_family = AF_INET;
                }
                if (rc <= 0) {
@@ -1502,7 +1502,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
        tcp_ses->tcpStatus = CifsNew;
        ++tcp_ses->srv_count;
-        if (addr.sa_family == AF_INET6) {
+        if (addr.ss_family == AF_INET6) {
                cFYI(1, ("attempting ipv6 connect"));
                /* BB should we allow ipv6 on port 139? */
                /* other OS never observed in Wild doing 139 with v6 */
@@ -1802,7 +1802,7 @@ ipv4_connect(struct TCP_Server_Info *server)
         *  user space buffer
         */
        socket->sk->sk_rcvtimeo = 7 * HZ;
-        socket->sk->sk_sndtimeo = 3 * HZ;
+        socket->sk->sk_sndtimeo = 5 * HZ;
        /* make the bufsizes depend on wsize/rsize and max requests */
        if (server->noautotune) {
@@ -1860,9 +1860,7 @@ ipv4_connect(struct TCP_Server_Info *server)
                        smb_buf = (struct smb_hdr *)ses_init_buf;
                        /* sizeof RFC1002_SESSION_REQUEST with no scope */
                        smb_buf->smb_buf_length = 0x81000044;
-                        rc = smb_send(socket, smb_buf, 0x44,
+                        rc = smb_send(server, smb_buf, 0x44);
-                                (struct sockaddr *) &server->addr.sockAddr,
-                                server->noblocksnd);
                        kfree(ses_init_buf);
                        msleep(1); /* RFC1001 layer in at least one server
                                      requires very short break before negprot
@@ -1955,7 +1953,7 @@ ipv6_connect(struct TCP_Server_Info *server)
         * user space buffer
         */
        socket->sk->sk_rcvtimeo = 7 * HZ;
-        socket->sk->sk_sndtimeo = 3 * HZ;
+        socket->sk->sk_sndtimeo = 5 * HZ;
        server->ssocket = socket;
        return rc;
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 838d9c720a5c..964aad03c5ad 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -129,6 +129,17 @@ cifs_bp_rename_retry:
        return full_path;
 }
+static void setup_cifs_dentry(struct cifsTconInfo *tcon,
+                              struct dentry *direntry,
+                              struct inode *newinode)
+{
+        if (tcon->nocase)
+                direntry->d_op = &cifs_ci_dentry_ops;
+        else
+                direntry->d_op = &cifs_dentry_ops;
+        d_instantiate(direntry, newinode);
+}
 /* Inode operations in similar order to how they appear in Linux file fs.h */
 int
@@ -139,14 +150,14 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
        int xid;
        int create_options = CREATE_NOT_DIR;
        int oplock = 0;
+        /* BB below access is too much for the mknod to request */
        int desiredAccess = GENERIC_READ | GENERIC_WRITE;
        __u16 fileHandle;
        struct cifs_sb_info *cifs_sb;
-        struct cifsTconInfo *pTcon;
+        struct cifsTconInfo *tcon;
        char *full_path = NULL;
        FILE_ALL_INFO *buf = NULL;
        struct inode *newinode = NULL;
-        struct cifsFileInfo *pCifsFile = NULL;
        struct cifsInodeInfo *pCifsInode;
        int disposition = FILE_OVERWRITE_IF;
        bool write_only = false;
@@ -154,7 +165,7 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
        xid = GetXid();
        cifs_sb = CIFS_SB(inode->i_sb);
-        pTcon = cifs_sb->tcon;
+        tcon = cifs_sb->tcon;
        full_path = build_path_from_dentry(direntry);
        if (full_path == NULL) {
@@ -162,6 +173,8 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                return -ENOMEM;
        }
+        mode &= ~current->fs->umask;
        if (nd && (nd->flags & LOOKUP_OPEN)) {
                int oflags = nd->intent.open.flags;
@@ -196,17 +209,15 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                return -ENOMEM;
        }
-        mode &= ~current->fs->umask;
        /*
         * if we're not using unix extensions, see if we need to set
         * ATTR_READONLY on the create call
         */
-        if (!pTcon->unix_ext && (mode & S_IWUGO) == 0)
+        if (!tcon->unix_ext && (mode & S_IWUGO) == 0)
                create_options |= CREATE_OPTION_READONLY;
        if (cifs_sb->tcon->ses->capabilities & CAP_NT_SMBS)
-                rc = CIFSSMBOpen(xid, pTcon, full_path, disposition,
+                rc = CIFSSMBOpen(xid, tcon, full_path, disposition,
                         desiredAccess, create_options,
                         &fileHandle, &oplock, buf, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
@@ -215,7 +226,7 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
        if (rc == -EIO) {
                /* old server, retry the open legacy style */
-                rc = SMBLegacyOpen(xid, pTcon, full_path, disposition,
+                rc = SMBLegacyOpen(xid, tcon, full_path, disposition,
                        desiredAccess, create_options,
                        &fileHandle, &oplock, buf, cifs_sb->local_nls,
                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
@@ -225,7 +236,7 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
        } else {
                /* If Open reported that we actually created a file
                then we now have to set the mode if possible */
-                if ((pTcon->unix_ext) && (oplock & CIFS_CREATE_ACTION)) {
+                if ((tcon->unix_ext) && (oplock & CIFS_CREATE_ACTION)) {
                        struct cifs_unix_set_info_args args = {
                                .mode   = mode,
                                .ctime  = NO_CHANGE_64,
@@ -244,20 +255,20 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                                args.uid = NO_CHANGE_64;
                                args.gid = NO_CHANGE_64;
                        }
-                        CIFSSMBUnixSetInfo(xid, pTcon, full_path, &args,
+                        CIFSSMBUnixSetInfo(xid, tcon, full_path, &args,
                                cifs_sb->local_nls,
                                cifs_sb->mnt_cifs_flags &
                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
                } else {
                        /* BB implement mode setting via Windows security
                           descriptors e.g. */
-                        /* CIFSSMBWinSetPerms(xid,pTcon,path,mode,-1,-1,nls);*/
+                        /* CIFSSMBWinSetPerms(xid,tcon,path,mode,-1,-1,nls);*/
                        /* Could set r/o dos attribute if mode & 0222 == 0 */
                }
                /* server might mask mode so we have to query for it */
-                if (pTcon->unix_ext)
+                if (tcon->unix_ext)
                        rc = cifs_get_inode_info_unix(&newinode, full_path,
                                                 inode->i_sb, xid);
                else {
@@ -283,22 +294,17 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                }
                if (rc != 0) {
-                        cFYI(1,
+                        cFYI(1, ("Create worked, get_inode_info failed rc = %d",
-                             ("Create worked but get_inode_info failed rc = %d",
+                                 rc));
-                              rc));
+                } else
-                } else {
+                        setup_cifs_dentry(tcon, direntry, newinode);
-                        if (pTcon->nocase)
-                                direntry->d_op = &cifs_ci_dentry_ops;
-                        else
-                                direntry->d_op = &cifs_dentry_ops;
-                        d_instantiate(direntry, newinode);
-                }
                if ((nd == NULL /* nfsd case - nfs srv does not set nd */) ||
                        (!(nd->flags & LOOKUP_OPEN))) {
                        /* mknod case - do not leave file open */
-                        CIFSSMBClose(xid, pTcon, fileHandle);
+                        CIFSSMBClose(xid, tcon, fileHandle);
                } else if (newinode) {
-                        pCifsFile =
+                        struct cifsFileInfo *pCifsFile =
                           kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
                        if (pCifsFile == NULL)
@@ -316,7 +322,7 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                        /* set the following in open now
                                pCifsFile->pfile = file; */
                        write_lock(&GlobalSMBSeslock);
-                        list_add(&pCifsFile->tlist, &pTcon->openFileList);
+                        list_add(&pCifsFile->tlist, &tcon->openFileList);
                        pCifsInode = CIFS_I(newinode);
                        if (pCifsInode) {
                                /* if readable file instance put first in list*/
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 5ab9896fdcb2..bcf7b5184664 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1285,6 +1285,11 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
        cifsInode = CIFS_I(direntry->d_inode);
        cifsInode->time = 0;    /* force revalidate to go get info when
                                   needed */
+        cifsInode = CIFS_I(inode);
+        cifsInode->time = 0;    /* force revalidate to get parent dir info
+                                   since cached search results now invalid */
        direntry->d_inode->i_ctime = inode->i_ctime = inode->i_mtime =
                current_fs_time(inode->i_sb);
diff --git a/fs/cifs/md5.c b/fs/cifs/md5.c
index 462bbfefd4b6..98b66a54c319 100644
--- a/fs/cifs/md5.c
+++ b/fs/cifs/md5.c
@@ -10,8 +10,8 @@
 * with every copy.
 *
 * To compute the message digest of a chunk of bytes, declare an
- * MD5Context structure, pass it to MD5Init, call MD5Update as
+ * MD5Context structure, pass it to cifs_MD5_init, call cifs_MD5_update as
- * needed on buffers full of bytes, and then call MD5Final, which
+ * needed on buffers full of bytes, and then call cifs_MD5_final, which
 * will fill a supplied 16-byte array with the digest.
 */
@@ -45,7 +45,7 @@ byteReverse(unsigned char *buf, unsigned longs)
 * initialization constants.
 */
 void
-MD5Init(struct MD5Context *ctx)
+cifs_MD5_init(struct MD5Context *ctx)
 {
        ctx->buf[0] = 0x67452301;
        ctx->buf[1] = 0xefcdab89;
@@ -61,7 +61,7 @@ MD5Init(struct MD5Context *ctx)
 * of bytes.
 */
 void
-MD5Update(struct MD5Context *ctx, unsigned char const *buf, unsigned len)
+cifs_MD5_update(struct MD5Context *ctx, unsigned char const *buf, unsigned len)
 {
        register __u32 t;
@@ -110,7 +110,7 @@ MD5Update(struct MD5Context *ctx, unsigned char const *buf, unsigned len)
 * 1 0* (64-bit count of bits processed, MSB-first)
 */
 void
-MD5Final(unsigned char digest[16], struct MD5Context *ctx)
+cifs_MD5_final(unsigned char digest[16], struct MD5Context *ctx)
 {
        unsigned int count;
        unsigned char *p;
@@ -165,7 +165,7 @@ MD5Final(unsigned char digest[16], struct MD5Context *ctx)
 /*
 * The core of the MD5 algorithm, this alters an existing MD5 hash to
- * reflect the addition of 16 longwords of new data.  MD5Update blocks
+ * reflect the addition of 16 longwords of new data.  cifs_MD5_update blocks
 * the data and converts bytes into longwords for this routine.
 */
 static void
@@ -267,9 +267,9 @@ hmac_md5_init_rfc2104(unsigned char *key, int key_len,
                unsigned char tk[16];
                struct MD5Context tctx;
-                MD5Init(&tctx);
+                cifs_MD5_init(&tctx);
-                MD5Update(&tctx, key, key_len);
+                cifs_MD5_update(&tctx, key, key_len);
-                MD5Final(tk, &tctx);
+                cifs_MD5_final(tk, &tctx);
                key = tk;
                key_len = 16;
@@ -287,8 +287,8 @@ hmac_md5_init_rfc2104(unsigned char *key, int key_len,
                ctx->k_opad[i] ^= 0x5c;
        }
-        MD5Init(&ctx->ctx);
+        cifs_MD5_init(&ctx->ctx);
-        MD5Update(&ctx->ctx, ctx->k_ipad, 64);
+        cifs_MD5_update(&ctx->ctx, ctx->k_ipad, 64);
 }
 #endif
@@ -317,8 +317,8 @@ hmac_md5_init_limK_to_64(const unsigned char *key, int key_len,
                ctx->k_opad[i] ^= 0x5c;
        }
-        MD5Init(&ctx->ctx);
+        cifs_MD5_init(&ctx->ctx);
-        MD5Update(&ctx->ctx, ctx->k_ipad, 64);
+        cifs_MD5_update(&ctx->ctx, ctx->k_ipad, 64);
 }
 /***********************************************************************
@@ -328,7 +328,7 @@ void
 hmac_md5_update(const unsigned char *text, int text_len,
                struct HMACMD5Context *ctx)
 {
-        MD5Update(&ctx->ctx, text, text_len);   /* then text of datagram */
+        cifs_MD5_update(&ctx->ctx, text, text_len);     /* then text of datagram */
 }
 /***********************************************************************
@@ -339,12 +339,12 @@ hmac_md5_final(unsigned char *digest, struct HMACMD5Context *ctx)
 {
        struct MD5Context ctx_o;
-        MD5Final(digest, &ctx->ctx);
+        cifs_MD5_final(digest, &ctx->ctx);
-        MD5Init(&ctx_o);
+        cifs_MD5_init(&ctx_o);
-        MD5Update(&ctx_o, ctx->k_opad, 64);
+        cifs_MD5_update(&ctx_o, ctx->k_opad, 64);
-        MD5Update(&ctx_o, digest, 16);
+        cifs_MD5_update(&ctx_o, digest, 16);
-        MD5Final(digest, &ctx_o);
+        cifs_MD5_final(digest, &ctx_o);
 }
 /***********************************************************
diff --git a/fs/cifs/md5.h b/fs/cifs/md5.h
index f7d4f4197bac..6fba8cb402fd 100644
--- a/fs/cifs/md5.h
+++ b/fs/cifs/md5.h
@@ -20,10 +20,10 @@ struct HMACMD5Context {
 };
 #endif                          /* _HMAC_MD5_H */
-void MD5Init(struct MD5Context *context);
+void cifs_MD5_init(struct MD5Context *context);
-void MD5Update(struct MD5Context *context, unsigned char const *buf,
+void cifs_MD5_update(struct MD5Context *context, unsigned char const *buf,
                        unsigned len);
-void MD5Final(unsigned char digest[16], struct MD5Context *context);
+void cifs_MD5_final(unsigned char digest[16], struct MD5Context *context);
 /* The following definitions come from lib/hmacmd5.c  */
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 7ebe6599ed3a..0ad3e2d116a6 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -154,81 +154,8 @@ void DeleteTconOplockQEntries(struct cifsTconInfo *tcon)
        spin_unlock(&GlobalMid_Lock);
 }
-int
-smb_send(struct socket *ssocket, struct smb_hdr *smb_buffer,
-         unsigned int smb_buf_length, struct sockaddr *sin, bool noblocksnd)
-{
-        int rc = 0;
-        int i = 0;
-        struct msghdr smb_msg;
-        struct kvec iov;
-        unsigned len = smb_buf_length + 4;
-        if (ssocket == NULL)
-                return -ENOTSOCK; /* BB eventually add reconnect code here */
-        iov.iov_base = smb_buffer;
-        iov.iov_len = len;
-        smb_msg.msg_name = sin;
-        smb_msg.msg_namelen = sizeof(struct sockaddr);
-        smb_msg.msg_control = NULL;
-        smb_msg.msg_controllen = 0;
-        if (noblocksnd)
-                smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
-        else
-                smb_msg.msg_flags = MSG_NOSIGNAL;
-        /* smb header is converted in header_assemble. bcc and rest of SMB word
-           area, and byte area if necessary, is converted to littleendian in
-           cifssmb.c and RFC1001 len is converted to bigendian in smb_send
-           Flags2 is converted in SendReceive */
-        smb_buffer->smb_buf_length = cpu_to_be32(smb_buffer->smb_buf_length);
-        cFYI(1, ("Sending smb of length %d", smb_buf_length));
-        dump_smb(smb_buffer, len);
-        while (len > 0) {
-                rc = kernel_sendmsg(ssocket, &smb_msg, &iov, 1, len);
-                if ((rc == -ENOSPC) || (rc == -EAGAIN)) {
-                        i++;
-                /* smaller timeout here than send2 since smaller size */
-                /* Although it may not be required, this also is smaller
-                   oplock break time */
-                        if (i > 12) {
-                                cERROR(1,
-                                   ("sends on sock %p stuck for 7 seconds",
-                                    ssocket));
-                                rc = -EAGAIN;
-                                break;
-                        }
-                        msleep(1 << i);
-                        continue;
-                }
-                if (rc < 0)
-                        break;
-                else
-                        i = 0; /* reset i after each successful send */
-                iov.iov_base += rc;
-                iov.iov_len -= rc;
-                len -= rc;
-        }
-        if (rc < 0) {
-                cERROR(1, ("Error %d sending data on socket to server", rc));
-        } else {
-                rc = 0;
-        }
-        /* Don't want to modify the buffer as a
-           side effect of this call. */
-        smb_buffer->smb_buf_length = smb_buf_length;
-        return rc;
-}
 static int
-smb_send2(struct TCP_Server_Info *server, struct kvec *iov, int n_vec,
+smb_sendv(struct TCP_Server_Info *server, struct kvec *iov, int n_vec)
-          struct sockaddr *sin, bool noblocksnd)
 {
        int rc = 0;
        int i = 0;
@@ -243,11 +170,11 @@ smb_send2(struct TCP_Server_Info *server, struct kvec *iov, int n_vec,
        if (ssocket == NULL)
                return -ENOTSOCK; /* BB eventually add reconnect code here */
-        smb_msg.msg_name = sin;
+        smb_msg.msg_name = (struct sockaddr *) &server->addr.sockAddr;
        smb_msg.msg_namelen = sizeof(struct sockaddr);
        smb_msg.msg_control = NULL;
        smb_msg.msg_controllen = 0;
-        if (noblocksnd)
+        if (server->noblocksnd)
                smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
        else
                smb_msg.msg_flags = MSG_NOSIGNAL;
@@ -272,7 +199,25 @@ smb_send2(struct TCP_Server_Info *server, struct kvec *iov, int n_vec,
                                    n_vec - first_vec, total_len);
                if ((rc == -ENOSPC) || (rc == -EAGAIN)) {
                        i++;
-                        if (i >= 14) {
+                        /* if blocking send we try 3 times, since each can block
+                           for 5 seconds. For nonblocking  we have to try more
+                           but wait increasing amounts of time allowing time for
+                           socket to clear.  The overall time we wait in either
+                           case to send on the socket is about 15 seconds.
+                           Similarly we wait for 15 seconds for
+                           a response from the server in SendReceive[2]
+                           for the server to send a response back for
+                           most types of requests (except SMB Write
+                           past end of file which can be slow, and
+                           blocking lock operations). NFS waits slightly longer
+                           than CIFS, but this can make it take longer for
+                           nonresponsive servers to be detected and 15 seconds
+                           is more than enough time for modern networks to
+                           send a packet.  In most cases if we fail to send
+                           after the retries we will kill the socket and
+                           reconnect which may clear the network problem.
+                        */
+                        if ((i >= 14) || (!server->noblocksnd && (i > 2))) {
                                cERROR(1,
                                   ("sends on sock %p stuck for 15 seconds",
                                    ssocket));
@@ -339,6 +284,18 @@ smb_send2(struct TCP_Server_Info *server, struct kvec *iov, int n_vec,
        return rc;
 }
+int
+smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer,
+         unsigned int smb_buf_length)
+{
+        struct kvec iov;
+        iov.iov_base = smb_buffer;
+        iov.iov_len = smb_buf_length + 4;
+        return smb_sendv(server, &iov, 1);
+}
 static int wait_for_free_request(struct cifsSesInfo *ses, const int long_op)
 {
        if (long_op == CIFS_ASYNC_OP) {
@@ -540,9 +497,7 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
 #ifdef CONFIG_CIFS_STATS2
        atomic_inc(&ses->server->inSend);
 #endif
-        rc = smb_send2(ses->server, iov, n_vec,
+        rc = smb_sendv(ses->server, iov, n_vec);
-                      (struct sockaddr *) &(ses->server->addr.sockAddr),
-                       ses->server->noblocksnd);
 #ifdef CONFIG_CIFS_STATS2
        atomic_dec(&ses->server->inSend);
        midQ->when_sent = jiffies;
@@ -736,9 +691,7 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
 #ifdef CONFIG_CIFS_STATS2
        atomic_inc(&ses->server->inSend);
 #endif
-        rc = smb_send(ses->server->ssocket, in_buf, in_buf->smb_buf_length,
+        rc = smb_send(ses->server, in_buf, in_buf->smb_buf_length);
-                      (struct sockaddr *) &(ses->server->addr.sockAddr),
-                      ses->server->noblocksnd);
 #ifdef CONFIG_CIFS_STATS2
        atomic_dec(&ses->server->inSend);
        midQ->when_sent = jiffies;
@@ -879,9 +832,7 @@ send_nt_cancel(struct cifsTconInfo *tcon, struct smb_hdr *in_buf,
                mutex_unlock(&ses->server->srv_mutex);
                return rc;
        }
-        rc = smb_send(ses->server->ssocket, in_buf, in_buf->smb_buf_length,
+        rc = smb_send(ses->server, in_buf, in_buf->smb_buf_length);
-              (struct sockaddr *) &(ses->server->addr.sockAddr),
-              ses->server->noblocksnd);
        mutex_unlock(&ses->server->srv_mutex);
        return rc;
 }
@@ -973,9 +924,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
 #ifdef CONFIG_CIFS_STATS2
        atomic_inc(&ses->server->inSend);
 #endif
-        rc = smb_send(ses->server->ssocket, in_buf, in_buf->smb_buf_length,
+        rc = smb_send(ses->server, in_buf, in_buf->smb_buf_length);
-                      (struct sockaddr *) &(ses->server->addr.sockAddr),
-                      ses->server->noblocksnd);
 #ifdef CONFIG_CIFS_STATS2
        atomic_dec(&ses->server->inSend);
        midQ->when_sent = jiffies;
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index ba2f9ec71192..011b9b8c90c6 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -234,8 +234,6 @@ struct ep_pqueue {
 /*
 * Configuration options available inside /proc/sys/fs/epoll/
 */
-/* Maximum number of epoll devices, per user */
-static int max_user_instances __read_mostly;
 /* Maximum number of epoll watched descriptors, per user */
 static int max_user_watches __read_mostly;
@@ -261,14 +259,6 @@ static int zero;
 ctl_table epoll_table[] = {
        {
-                .procname       = "max_user_instances",
-                .data           = &max_user_instances,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .extra1         = &zero,
-        },
-        {
                .procname       = "max_user_watches",
                .data           = &max_user_watches,
                .maxlen         = sizeof(int),
@@ -491,7 +481,6 @@ static void ep_free(struct eventpoll *ep)
        mutex_unlock(&epmutex);
        mutex_destroy(&ep->mtx);
-        atomic_dec(&ep->user->epoll_devs);
        free_uid(ep->user);
        kfree(ep);
 }
@@ -581,10 +570,6 @@ static int ep_alloc(struct eventpoll **pep)
        struct eventpoll *ep;
        user = get_current_user();
-        error = -EMFILE;
-        if (unlikely(atomic_read(&user->epoll_devs) >=
-                        max_user_instances))
-                goto free_uid;
        error = -ENOMEM;
        ep = kzalloc(sizeof(*ep), GFP_KERNEL);
        if (unlikely(!ep))
@@ -1141,7 +1126,6 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
                              flags & O_CLOEXEC);
        if (fd < 0)
                ep_free(ep);
-        atomic_inc(&ep->user->epoll_devs);
 error_return:
        DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d) = %d\n",
@@ -1366,8 +1350,10 @@ static int __init eventpoll_init(void)
        struct sysinfo si;
        si_meminfo(&si);
-        max_user_instances = 128;
+        /*
-        max_user_watches = (((si.totalram - si.totalhigh) / 32) << PAGE_SHIFT) /
+         * Allows top 4% of lomem to be allocated for epoll watches (per user).
+         */
+        max_user_watches = (((si.totalram - si.totalhigh) / 25) << PAGE_SHIFT) /
                EP_ITEM_COST;
        /* Initialize the structure used to perform safe poll wait head wake ups */
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 69a3d19ca9fd..4db4ffa1edad 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -1358,7 +1358,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        struct fake_dirent *fde;
        blocksize =  dir->i_sb->s_blocksize;
-        dxtrace(printk("Creating index\n"));
+        dxtrace(printk(KERN_DEBUG "Creating index: inode %lu\n", dir->i_ino));
        retval = ext3_journal_get_write_access(handle, bh);
        if (retval) {
                ext3_std_error(dir->i_sb, retval);
@@ -1367,6 +1367,19 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        }
        root = (struct dx_root *) bh->b_data;
+        /* The 0th block becomes the root, move the dirents out */
+        fde = &root->dotdot;
+        de = (struct ext3_dir_entry_2 *)((char *)fde +
+                        ext3_rec_len_from_disk(fde->rec_len));
+        if ((char *) de >= (((char *) root) + blocksize)) {
+                ext3_error(dir->i_sb, __func__,
+                           "invalid rec_len for '..' in inode %lu",
+                           dir->i_ino);
+                brelse(bh);
+                return -EIO;
+        }
+        len = ((char *) root) + blocksize - (char *) de;
        bh2 = ext3_append (handle, dir, &block, &retval);
        if (!(bh2)) {
                brelse(bh);
@@ -1375,11 +1388,6 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        EXT3_I(dir)->i_flags |= EXT3_INDEX_FL;
        data1 = bh2->b_data;
-        /* The 0th block becomes the root, move the dirents out */
-        fde = &root->dotdot;
-        de = (struct ext3_dir_entry_2 *)((char *)fde +
-                        ext3_rec_len_from_disk(fde->rec_len));
-        len = ((char *) root) + blocksize - (char *) de;
        memcpy (data1, de, len);
        de = (struct ext3_dir_entry_2 *) data1;
        top = data1 + len;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 6bba06b09dd1..9a50b8052dcf 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -684,15 +684,15 @@ ext4_fsblk_t ext4_count_free_blocks(struct super_block *sb)
                gdp = ext4_get_group_desc(sb, i, NULL);
                if (!gdp)
                        continue;
-                desc_count += le16_to_cpu(gdp->bg_free_blocks_count);
+                desc_count += ext4_free_blks_count(sb, gdp);
                brelse(bitmap_bh);
                bitmap_bh = ext4_read_block_bitmap(sb, i);
                if (bitmap_bh == NULL)
                        continue;
                x = ext4_count_free(bitmap_bh, sb->s_blocksize);
-                printk(KERN_DEBUG "group %lu: stored = %d, counted = %u\n",
+                printk(KERN_DEBUG "group %u: stored = %d, counted = %u\n",
-                        i, le16_to_cpu(gdp->bg_free_blocks_count), x);
+                        i, ext4_free_blks_count(sb, gdp), x);
                bitmap_count += x;
        }
        brelse(bitmap_bh);
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index c668e4377d76..aafc9eba1c25 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1206,8 +1206,11 @@ static inline void ext4_r_blocks_count_set(struct ext4_super_block *es,
 static inline loff_t ext4_isize(struct ext4_inode *raw_inode)
 {
-        return ((loff_t)le32_to_cpu(raw_inode->i_size_high) << 32) |
+        if (S_ISREG(le16_to_cpu(raw_inode->i_mode)))
-                le32_to_cpu(raw_inode->i_size_lo);
+                return ((loff_t)le32_to_cpu(raw_inode->i_size_high) << 32) |
+                        le32_to_cpu(raw_inode->i_size_lo);
+        else
+                return (loff_t) le32_to_cpu(raw_inode->i_size_lo);
 }
 static inline void ext4_isize_set(struct ext4_inode *raw_inode, loff_t i_size)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 54bf0623a9ae..e2eab196875f 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3048,7 +3048,7 @@ retry:
                        WARN_ON(ret <= 0);
                        printk(KERN_ERR "%s: ext4_ext_get_blocks "
                                    "returned error inode#%lu, block=%u, "
-                                    "max_blocks=%lu", __func__,
+                                    "max_blocks=%u", __func__,
                                    inode->i_ino, block, max_blocks);
 #endif
                        ext4_mark_inode_dirty(handle, inode);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index a6444cee0c7e..03ba20be1329 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -360,9 +360,9 @@ static int ext4_block_to_path(struct inode *inode,
                final = ptrs;
        } else {
                ext4_warning(inode->i_sb, "ext4_block_to_path",
-                                "block %lu > max",
+                                "block %lu > max in inode %lu",
                                i_block + direct_blocks +
-                                indirect_blocks + double_blocks);
+                                indirect_blocks + double_blocks, inode->i_ino);
        }
        if (boundary)
                *boundary = final - 1 - (i_block & (ptrs - 1));
@@ -2821,9 +2821,6 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
                filemap_write_and_wait(mapping);
        }
-        BUG_ON(!EXT4_JOURNAL(inode) &&
-               EXT4_I(inode)->i_state & EXT4_STATE_JDATA);
        if (EXT4_JOURNAL(inode) && EXT4_I(inode)->i_state & EXT4_STATE_JDATA) {
                /*
                 * This is a REALLY heavyweight approach, but the use of
@@ -3622,7 +3619,7 @@ static void ext4_free_data(handle_t *handle, struct inode *inode,
                 * block pointed to itself, it would have been detached when
                 * the block was cleared. Check for this instead of OOPSing.
                 */
-                if (bh2jh(this_bh))
+                if ((EXT4_JOURNAL(inode) == NULL) || bh2jh(this_bh))
                        ext4_handle_dirty_metadata(handle, inode, this_bh);
                else
                        ext4_error(inode->i_sb, __func__,
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 918aec0c8a11..deba54f6cbed 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3025,7 +3025,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
                goto out_err;
        ext4_debug("using block group %u(%d)\n", ac->ac_b_ex.fe_group,
-                        gdp->bg_free_blocks_count);
+                        ext4_free_blks_count(sb, gdp));
        err = ext4_journal_get_write_access(handle, gdp_bh);
        if (err)
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index fec0b4c2f5f1..ba702bd7910d 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1368,7 +1368,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        struct fake_dirent *fde;
        blocksize =  dir->i_sb->s_blocksize;
-        dxtrace(printk(KERN_DEBUG "Creating index\n"));
+        dxtrace(printk(KERN_DEBUG "Creating index: inode %lu\n", dir->i_ino));
        retval = ext4_journal_get_write_access(handle, bh);
        if (retval) {
                ext4_std_error(dir->i_sb, retval);
@@ -1377,6 +1377,20 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        }
        root = (struct dx_root *) bh->b_data;
+        /* The 0th block becomes the root, move the dirents out */
+        fde = &root->dotdot;
+        de = (struct ext4_dir_entry_2 *)((char *)fde +
+                ext4_rec_len_from_disk(fde->rec_len));
+        if ((char *) de >= (((char *) root) + blocksize)) {
+                ext4_error(dir->i_sb, __func__,
+                           "invalid rec_len for '..' in inode %lu",
+                           dir->i_ino);
+                brelse(bh);
+                return -EIO;
+        }
+        len = ((char *) root) + blocksize - (char *) de;
+        /* Allocate new block for the 0th block's dirents */
        bh2 = ext4_append(handle, dir, &block, &retval);
        if (!(bh2)) {
                brelse(bh);
@@ -1385,11 +1399,6 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
        EXT4_I(dir)->i_flags |= EXT4_INDEX_FL;
        data1 = bh2->b_data;
-        /* The 0th block becomes the root, move the dirents out */
-        fde = &root->dotdot;
-        de = (struct ext4_dir_entry_2 *)((char *)fde +
-                ext4_rec_len_from_disk(fde->rec_len));
-        len = ((char *) root) + blocksize - (char *) de;
        memcpy (data1, de, len);
        de = (struct ext4_dir_entry_2 *) data1;
        top = data1 + len;
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index c328be5d6885..c06886abd658 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -861,12 +861,13 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
        gdp = (struct ext4_group_desc *)((char *)primary->b_data +
                                         gdb_off * EXT4_DESC_SIZE(sb));
+        memset(gdp, 0, EXT4_DESC_SIZE(sb));
        ext4_block_bitmap_set(sb, gdp, input->block_bitmap); /* LV FIXME */
        ext4_inode_bitmap_set(sb, gdp, input->inode_bitmap); /* LV FIXME */
        ext4_inode_table_set(sb, gdp, input->inode_table); /* LV FIXME */
        ext4_free_blks_set(sb, gdp, input->free_blocks_count);
        ext4_free_inodes_set(sb, gdp, EXT4_INODES_PER_GROUP(sb));
-        gdp->bg_flags |= cpu_to_le16(EXT4_BG_INODE_ZEROED);
+        gdp->bg_flags = cpu_to_le16(EXT4_BG_INODE_ZEROED);
        gdp->bg_checksum = ext4_group_desc_csum(sbi, input->group, gdp);
        /*
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 56675306ed81..eb343008eded 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -37,10 +37,10 @@
 #include <linux/proc_fs.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/math64.h>
 #include <asm/uaccess.h>
 #include <asm/page.h>
-#include <asm/div64.h>
 EXPORT_SYMBOL(jbd2_journal_start);
 EXPORT_SYMBOL(jbd2_journal_restart);
@@ -846,8 +846,8 @@ static int jbd2_seq_info_show(struct seq_file *seq, void *v)
            jiffies_to_msecs(s->stats->u.run.rs_flushing / s->stats->ts_tid));
        seq_printf(seq, "  %ums logging transaction\n",
            jiffies_to_msecs(s->stats->u.run.rs_logging / s->stats->ts_tid));
-        seq_printf(seq, "  %luus average transaction commit time\n",
+        seq_printf(seq, "  %lluus average transaction commit time\n",
-                   do_div(s->journal->j_average_commit_time, 1000));
+                   div_u64(s->journal->j_average_commit_time, 1000));
        seq_printf(seq, "  %lu handles per transaction\n",
            s->stats->u.run.rs_handle_count / s->stats->ts_tid);
        seq_printf(seq, "  %lu blocks per transaction\n",
diff --git a/fs/nfsd/auth.c b/fs/nfsd/auth.c
index c903e04aa217..5573508f707f 100644
--- a/fs/nfsd/auth.c
+++ b/fs/nfsd/auth.c
@@ -49,6 +49,8 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
                new->fsuid = exp->ex_anon_uid;
                new->fsgid = exp->ex_anon_gid;
                gi = groups_alloc(0);
+                if (!gi)
+                        goto oom;
        } else if (flags & NFSEXP_ROOTSQUASH) {
                if (!new->fsuid)
                        new->fsuid = exp->ex_anon_uid;
@@ -85,6 +87,7 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
                new->cap_effective = cap_raise_nfsd_set(new->cap_effective,
                                                        new->cap_permitted);
        put_cred(override_creds(new));
+        put_cred(new);
        return 0;
 oom:
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 88db7d3ec120..b6f60f48e94b 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2871,7 +2871,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                file_lock.fl_owner = (fl_owner_t)lockt->lt_stateowner;
        file_lock.fl_pid = current->tgid;
        file_lock.fl_flags = FL_POSIX;
-        file_lock.fl_lmops = &nfsd_posix_mng_ops;
        file_lock.fl_start = lockt->lt_offset;
        file_lock.fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);