17 files changed, 320 insertions, 173 deletions

diff --git a/fs/9p/error.c b/fs/9p/error.c
index ae91555c1558..0d7fa4e08812 100644
--- a/fs/9p/error.c
+++ b/fs/9p/error.c
@@ -83,6 +83,7 @@ int v9fs_errstr2errno(char *errstr, int len)
 
         if (errno == 0) {
                 /* TODO: if error isn't found, add it dynamically */
+                errstr[len] = 0;
                 printk(KERN_ERR "%s: errstr :%s: not found\n", __FUNCTION__,
                        errstr);
                 errno = 1;
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 27507201f9e7..a9b6301a04fc 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -25,6 +25,7 @@
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include <linux/idr.h>
+#include <asm/semaphore.h>
 
 #include "debug.h"
 #include "v9fs.h"
@@ -84,6 +85,7 @@ struct v9fs_fid *v9fs_fid_create(struct v9fs_session_info *v9ses, int fid)
         new->iounit = 0;
         new->rdir_pos = 0;
         new->rdir_fcall = NULL;
+        init_MUTEX(&new->lock);
         INIT_LIST_HEAD(&new->list);
 
         return new;
@@ -102,11 +104,11 @@ void v9fs_fid_destroy(struct v9fs_fid *fid)
 }
 
 /**
- * v9fs_fid_lookup - retrieve the right fid from a  particular dentry
+ * v9fs_fid_lookup - return a locked fid from a dentry
  * @dentry: dentry to look for fid in
- * @type: intent of lookup (operation or traversal)
  *
- * find a fid in the dentry
+ * find a fid in the dentry, obtain its semaphore and return a reference to it.
+ * code calling lookup is responsible for releasing lock
  *
  * TODO: only match fids that have the same uid as current user
  *
@@ -124,7 +126,68 @@ struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry)
 
         if (!return_fid) {
                 dprintk(DEBUG_ERROR, "Couldn't find a fid in dentry\n");
+                return_fid = ERR_PTR(-EBADF);
         }
 
+        if(down_interruptible(&return_fid->lock))
+                return ERR_PTR(-EINTR);
+
         return return_fid;
 }
+
+/**
+ * v9fs_fid_clone - lookup the fid for a dentry, clone a private copy and release it
+ * @dentry: dentry to look for fid in
+ *
+ * find a fid in the dentry and then clone to a new private fid
+ *
+ * TODO: only match fids that have the same uid as current user
+ *
+ */
+
+struct v9fs_fid *v9fs_fid_clone(struct dentry *dentry)
+{
+        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
+        struct v9fs_fid *base_fid, *new_fid = ERR_PTR(-EBADF);
+        struct v9fs_fcall *fcall = NULL;
+        int fid, err;
+
+        base_fid = v9fs_fid_lookup(dentry);
+
+        if(IS_ERR(base_fid))
+                return base_fid;
+
+        if(base_fid) {  /* clone fid */
+                fid = v9fs_get_idpool(&v9ses->fidpool);
+                if (fid < 0) {
+                        eprintk(KERN_WARNING, "newfid fails!\n");
+                        new_fid = ERR_PTR(-ENOSPC);
+                        goto Release_Fid;
+                }
+
+                err = v9fs_t_walk(v9ses, base_fid->fid, fid, NULL, &fcall);
+                if (err < 0) {
+                        dprintk(DEBUG_ERROR, "clone walk didn't work\n");
+                        v9fs_put_idpool(fid, &v9ses->fidpool);
+                        new_fid = ERR_PTR(err);
+                        goto Free_Fcall;
+                }
+                new_fid = v9fs_fid_create(v9ses, fid);
+                if (new_fid == NULL) {
+                        dprintk(DEBUG_ERROR, "out of memory\n");
+                        new_fid = ERR_PTR(-ENOMEM);
+                }
+Free_Fcall:
+                kfree(fcall);
+        }
+
+Release_Fid:
+        up(&base_fid->lock);
+        return new_fid;
+}
+
+void v9fs_fid_clunk(struct v9fs_session_info *v9ses, struct v9fs_fid *fid)
+{
+        v9fs_t_clunk(v9ses, fid->fid);
+        v9fs_fid_destroy(fid);
+}
diff --git a/fs/9p/fid.h b/fs/9p/fid.h
index aa974d6875c3..48fc170c26c8 100644
--- a/fs/9p/fid.h
+++ b/fs/9p/fid.h
@@ -30,6 +30,8 @@ struct v9fs_fid {
         struct list_head list;   /* list of fids associated with a dentry */
         struct list_head active; /* XXX - debug */
 
+        struct semaphore lock;
+
         u32 fid;
         unsigned char fidopen;    /* set when fid is opened */
         unsigned char fidclunked; /* set when fid has already been clunked */
@@ -55,3 +57,6 @@ struct v9fs_fid *v9fs_fid_get_created(struct dentry *);
 void v9fs_fid_destroy(struct v9fs_fid *fid);
 struct v9fs_fid *v9fs_fid_create(struct v9fs_session_info *, int fid);
 int v9fs_fid_insert(struct v9fs_fid *fid, struct dentry *dentry);
+struct v9fs_fid *v9fs_fid_clone(struct dentry *dentry);
+void v9fs_fid_clunk(struct v9fs_session_info *v9ses, struct v9fs_fid *fid);
+
diff --git a/fs/9p/mux.c b/fs/9p/mux.c
index 944273c3dbff..147ceef8e537 100644
--- a/fs/9p/mux.c
+++ b/fs/9p/mux.c
@@ -132,8 +132,10 @@ int v9fs_mux_global_init(void)
                 v9fs_mux_poll_tasks[i].task = NULL;
 
         v9fs_mux_wq = create_workqueue("v9fs");
-        if (!v9fs_mux_wq)
+        if (!v9fs_mux_wq) {
+                printk(KERN_WARNING "v9fs: mux: creating workqueue failed\n");
                 return -ENOMEM;
+        }
 
         return 0;
 }
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 0b96fae8b479..d9b561ba5e58 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -457,14 +457,19 @@ static int __init init_v9fs(void)
 
         v9fs_error_init();
 
-        printk(KERN_INFO "Installing v9fs 9P2000 file system support\n");
+        printk(KERN_INFO "Installing v9fs 9p2000 file system support\n");
 
         ret = v9fs_mux_global_init();
-        if (!ret)
+        if (ret) {
+                printk(KERN_WARNING "v9fs: starting mux failed\n");
                 return ret;
+        }
         ret = register_filesystem(&v9fs_fs_type);
-        if (!ret)
+        if (ret) {
+                printk(KERN_WARNING "v9fs: registering file system failed\n");
                 v9fs_mux_global_exit();
+        }
+
         return ret;
 }
 
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index e86a07151280..9f17b0cacdd0 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -55,53 +55,22 @@ int v9fs_file_open(struct inode *inode, struct file *file)
         struct v9fs_fid *vfid;
         struct v9fs_fcall *fcall = NULL;
         int omode;
-        int fid = V9FS_NOFID;
         int err;
 
         dprintk(DEBUG_VFS, "inode: %p file: %p \n", inode, file);
 
-        vfid = v9fs_fid_lookup(file->f_path.dentry);
-        if (!vfid) {
-                dprintk(DEBUG_ERROR, "Couldn't resolve fid from dentry\n");
-                return -EBADF;
-        }
-
-        fid = v9fs_get_idpool(&v9ses->fidpool);
-        if (fid < 0) {
-                eprintk(KERN_WARNING, "newfid fails!\n");
-                return -ENOSPC;
-        }
+        vfid = v9fs_fid_clone(file->f_path.dentry);
+        if (IS_ERR(vfid))
+                return PTR_ERR(vfid);
 
-        err = v9fs_t_walk(v9ses, vfid->fid, fid, NULL, &fcall);
-        if (err < 0) {
-                dprintk(DEBUG_ERROR, "rewalk didn't work\n");
-                if (fcall && fcall->id == RWALK)
-                        goto clunk_fid;
-                else {
-                        v9fs_put_idpool(fid, &v9ses->fidpool);
-                        goto free_fcall;
-                }
-        }
-        kfree(fcall);
-
-        /* TODO: do special things for O_EXCL, O_NOFOLLOW, O_SYNC */
-        /* translate open mode appropriately */
         omode = v9fs_uflags2omode(file->f_flags);
-        err = v9fs_t_open(v9ses, fid, omode, &fcall);
+        err = v9fs_t_open(v9ses, vfid->fid, omode, &fcall);
         if (err < 0) {
                 PRINT_FCALL_ERROR("open failed", fcall);
-                goto clunk_fid;
-        }
-
-        vfid = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);
-        if (vfid == NULL) {
-                dprintk(DEBUG_ERROR, "out of memory\n");
-                err = -ENOMEM;
-                goto clunk_fid;
+                goto Clunk_Fid;
         }
 
         file->private_data = vfid;
-        vfid->fid = fid;
         vfid->fidopen = 1;
         vfid->fidclunked = 0;
         vfid->iounit = fcall->params.ropen.iounit;
@@ -112,10 +81,8 @@ int v9fs_file_open(struct inode *inode, struct file *file)
 
         return 0;
 
-clunk_fid:
-        v9fs_t_clunk(v9ses, fid);
-
-free_fcall:
+Clunk_Fid:
+        v9fs_fid_clunk(v9ses, vfid);
         kfree(fcall);
 
         return err;
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 18f26cdfd882..9109ba1d6969 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -416,12 +416,8 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
         sb = file_inode->i_sb;
         v9ses = v9fs_inode2v9ses(file_inode);
         v9fid = v9fs_fid_lookup(file);
-
-        if (!v9fid) {
-                dprintk(DEBUG_ERROR,
-                        "no v9fs_fid\n");
-                return -EBADF;
-        }
+        if(IS_ERR(v9fid))
+                return PTR_ERR(v9fid);
 
         fid = v9fid->fid;
         if (fid < 0) {
@@ -433,11 +429,13 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
         result = v9fs_t_remove(v9ses, fid, &fcall);
         if (result < 0) {
                 PRINT_FCALL_ERROR("remove fails", fcall);
+                goto Error;
         }
 
         v9fs_put_idpool(fid, &v9ses->fidpool);
         v9fs_fid_destroy(v9fid);
 
+Error:
         kfree(fcall);
         return result;
 }
@@ -473,9 +471,13 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
         inode = NULL;
         vfid = NULL;
         v9ses = v9fs_inode2v9ses(dir);
-        dfid = v9fs_fid_lookup(dentry->d_parent);
-        perm = unixmode2p9mode(v9ses, mode);
+        dfid = v9fs_fid_clone(dentry->d_parent);
+        if(IS_ERR(dfid)) {
+                err = PTR_ERR(dfid);
+                goto error;
+        }
 
+        perm = unixmode2p9mode(v9ses, mode);
         if (nd && nd->flags & LOOKUP_OPEN)
                 flags = nd->intent.open.flags - 1;
         else
@@ -485,9 +487,10 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
                 perm, v9fs_uflags2omode(flags), NULL, &fid, &qid, &iounit);
 
         if (err)
-                goto error;
+                goto clunk_dfid;
 
         vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
+        v9fs_fid_clunk(v9ses, dfid);
         if (IS_ERR(vfid)) {
                 err = PTR_ERR(vfid);
                 vfid = NULL;
@@ -525,6 +528,9 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
 
         return 0;
 
+clunk_dfid:
+        v9fs_fid_clunk(v9ses, dfid);
+
 error:
         if (vfid)
                 v9fs_fid_destroy(vfid);
@@ -551,7 +557,12 @@ static int v9fs_vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         inode = NULL;
         vfid = NULL;
         v9ses = v9fs_inode2v9ses(dir);
-        dfid = v9fs_fid_lookup(dentry->d_parent);
+        dfid = v9fs_fid_clone(dentry->d_parent);
+        if(IS_ERR(dfid)) {
+                err = PTR_ERR(dfid);
+                goto error;
+        }
+
         perm = unixmode2p9mode(v9ses, mode | S_IFDIR);
 
         err = v9fs_create(v9ses, dfid->fid, (char *) dentry->d_name.name,
@@ -559,37 +570,36 @@ static int v9fs_vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 
         if (err) {
                 dprintk(DEBUG_ERROR, "create error %d\n", err);
-                goto error;
-        }
-
-        err = v9fs_t_clunk(v9ses, fid);
-        if (err) {
-                dprintk(DEBUG_ERROR, "clunk error %d\n", err);
-                goto error;
+                goto clean_up_dfid;
         }
 
         vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
         if (IS_ERR(vfid)) {
                 err = PTR_ERR(vfid);
                 vfid = NULL;
-                goto error;
+                goto clean_up_dfid;
         }
 
+        v9fs_fid_clunk(v9ses, dfid);
         inode = v9fs_inode_from_fid(v9ses, vfid->fid, dir->i_sb);
         if (IS_ERR(inode)) {
                 err = PTR_ERR(inode);
                 inode = NULL;
-                goto error;
+                goto clean_up_fids;
         }
 
         dentry->d_op = &v9fs_dentry_operations;
         d_instantiate(dentry, inode);
         return 0;
 
-error:
+clean_up_fids:
         if (vfid)
                 v9fs_fid_destroy(vfid);
 
+clean_up_dfid:
+        v9fs_fid_clunk(v9ses, dfid);
+
+error:
         return err;
 }
 
@@ -622,28 +632,23 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
         dentry->d_op = &v9fs_dentry_operations;
         dirfid = v9fs_fid_lookup(dentry->d_parent);
 
-        if (!dirfid) {
-                dprintk(DEBUG_ERROR, "no dirfid\n");
-                return ERR_PTR(-EINVAL);
-        }
+        if(IS_ERR(dirfid))
+                return ERR_PTR(PTR_ERR(dirfid));
 
         dirfidnum = dirfid->fid;
 
-        if (dirfidnum < 0) {
-                dprintk(DEBUG_ERROR, "no dirfid for inode %p, #%lu\n",
-                        dir, dir->i_ino);
-                return ERR_PTR(-EBADF);
-        }
-
         newfid = v9fs_get_idpool(&v9ses->fidpool);
         if (newfid < 0) {
                 eprintk(KERN_WARNING, "newfid fails!\n");
-                return ERR_PTR(-ENOSPC);
+                result = -ENOSPC;
+                goto Release_Dirfid;
         }
 
         result = v9fs_t_walk(v9ses, dirfidnum, newfid,
                 (char *)dentry->d_name.name, &fcall);
 
+        up(&dirfid->lock);
+
         if (result < 0) {
                 if (fcall && fcall->id == RWALK)
                         v9fs_t_clunk(v9ses, newfid);
@@ -701,8 +706,12 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
 
         return NULL;
 
-      FreeFcall:
+Release_Dirfid:
+        up(&dirfid->lock);
+
+FreeFcall:
         kfree(fcall);
+
         return ERR_PTR(result);
 }
 
@@ -746,10 +755,8 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         struct inode *old_inode = old_dentry->d_inode;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(old_inode);
         struct v9fs_fid *oldfid = v9fs_fid_lookup(old_dentry);
-        struct v9fs_fid *olddirfid =
-            v9fs_fid_lookup(old_dentry->d_parent);
-        struct v9fs_fid *newdirfid =
-            v9fs_fid_lookup(new_dentry->d_parent);
+        struct v9fs_fid *olddirfid;
+        struct v9fs_fid *newdirfid;
         struct v9fs_wstat wstat;
         struct v9fs_fcall *fcall = NULL;
         int fid = -1;
@@ -759,16 +766,26 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         dprintk(DEBUG_VFS, "\n");
 
-        if ((!oldfid) || (!olddirfid) || (!newdirfid)) {
-                dprintk(DEBUG_ERROR, "problem with arguments\n");
-                return -EBADF;
+        if(IS_ERR(oldfid))
+                return PTR_ERR(oldfid);
+
+        olddirfid = v9fs_fid_clone(old_dentry->d_parent);
+        if(IS_ERR(olddirfid)) {
+                retval = PTR_ERR(olddirfid);
+                goto Release_lock;
+        }
+
+        newdirfid = v9fs_fid_clone(new_dentry->d_parent);
+        if(IS_ERR(newdirfid)) {
+                retval = PTR_ERR(newdirfid);
+                goto Clunk_olddir;
         }
 
         /* 9P can only handle file rename in the same directory */
         if (memcmp(&olddirfid->qid, &newdirfid->qid, sizeof(newdirfid->qid))) {
                 dprintk(DEBUG_ERROR, "old dir and new dir are different\n");
-                retval = -EPERM;
-                goto FreeFcallnBail;
+                retval = -EXDEV;
+                goto Clunk_newdir;
         }
 
         fid = oldfid->fid;
@@ -779,7 +796,7 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 dprintk(DEBUG_ERROR, "no fid for old file #%lu\n",
                         old_inode->i_ino);
                 retval = -EBADF;
-                goto FreeFcallnBail;
+                goto Clunk_newdir;
         }
 
         v9fs_blank_wstat(&wstat);
@@ -788,11 +805,20 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         retval = v9fs_t_wstat(v9ses, fid, &wstat, &fcall);
 
-      FreeFcallnBail:
         if (retval < 0)
                 PRINT_FCALL_ERROR("wstat error", fcall);
 
         kfree(fcall);
+
+Clunk_newdir:
+        v9fs_fid_clunk(v9ses, newdirfid);
+
+Clunk_olddir:
+        v9fs_fid_clunk(v9ses, olddirfid);
+
+Release_lock:
+        up(&oldfid->lock);
+
         return retval;
 }
 
@@ -810,15 +836,12 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 {
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
+        struct v9fs_fid *fid = v9fs_fid_clone(dentry);
         int err = -EPERM;
 
         dprintk(DEBUG_VFS, "dentry: %p\n", dentry);
-        if (!fid) {
-                dprintk(DEBUG_ERROR,
-                        "couldn't find fid associated with dentry\n");
-                return -EBADF;
-        }
+        if(IS_ERR(fid))
+                return PTR_ERR(fid);
 
         err = v9fs_t_stat(v9ses, fid->fid, &fcall);
 
@@ -831,6 +854,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
         }
 
         kfree(fcall);
+        v9fs_fid_clunk(v9ses, fid);
         return err;
 }
 
@@ -844,18 +868,14 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
 {
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
+        struct v9fs_fid *fid = v9fs_fid_clone(dentry);
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_wstat wstat;
         int res = -EPERM;
 
         dprintk(DEBUG_VFS, "\n");
-
-        if (!fid) {
-                dprintk(DEBUG_ERROR,
-                        "Couldn't find fid associated with dentry\n");
-                return -EBADF;
-        }
+        if(IS_ERR(fid))
+                return PTR_ERR(fid);
 
         v9fs_blank_wstat(&wstat);
         if (iattr->ia_valid & ATTR_MODE)
@@ -887,6 +907,7 @@ static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
         if (res >= 0)
                 res = inode_setattr(dentry->d_inode, iattr);
 
+        v9fs_fid_clunk(v9ses, fid);
         return res;
 }
 
@@ -987,18 +1008,15 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
 
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
+        struct v9fs_fid *fid = v9fs_fid_clone(dentry);
 
-        if (!fid) {
-                dprintk(DEBUG_ERROR, "could not resolve fid from dentry\n");
-                retval = -EBADF;
-                goto FreeFcall;
-        }
+        if(IS_ERR(fid))
+                return PTR_ERR(fid);
 
         if (!v9ses->extended) {
                 retval = -EBADF;
                 dprintk(DEBUG_ERROR, "not extended\n");
-                goto FreeFcall;
+                goto ClunkFid;
         }
 
         dprintk(DEBUG_VFS, " %s\n", dentry->d_name.name);
@@ -1009,8 +1027,10 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
                 goto FreeFcall;
         }
 
-        if (!fcall)
-                return -EIO;
+        if (!fcall) {
+                retval = -EIO;
+                goto ClunkFid;
+        }
 
         if (!(fcall->params.rstat.stat.mode & V9FS_DMSYMLINK)) {
                 retval = -EINVAL;
@@ -1028,9 +1048,12 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
                 fcall->params.rstat.stat.extension.str, buffer);
         retval = buflen;
 
-      FreeFcall:
+FreeFcall:
         kfree(fcall);
 
+ClunkFid:
+        v9fs_fid_clunk(v9ses, fid);
+
         return retval;
 }
 
@@ -1123,52 +1146,58 @@ static int v9fs_vfs_mkspecial(struct inode *dir, struct dentry *dentry,
         int err;
         u32 fid, perm;
         struct v9fs_session_info *v9ses;
-        struct v9fs_fid *dfid, *vfid;
-        struct inode *inode;
+        struct v9fs_fid *dfid, *vfid = NULL;
+        struct inode *inode = NULL;
 
-        inode = NULL;
-        vfid = NULL;
         v9ses = v9fs_inode2v9ses(dir);
-        dfid = v9fs_fid_lookup(dentry->d_parent);
-        perm = unixmode2p9mode(v9ses, mode);
-
         if (!v9ses->extended) {
                 dprintk(DEBUG_ERROR, "not extended\n");
                 return -EPERM;
         }
 
+        dfid = v9fs_fid_clone(dentry->d_parent);
+        if(IS_ERR(dfid)) {
+                err = PTR_ERR(dfid);
+                goto error;
+        }
+
+        perm = unixmode2p9mode(v9ses, mode);
+
         err = v9fs_create(v9ses, dfid->fid, (char *) dentry->d_name.name,
                 perm, V9FS_OREAD, (char *) extension, &fid, NULL, NULL);
 
         if (err)
-                goto error;
+                goto clunk_dfid;
 
         err = v9fs_t_clunk(v9ses, fid);
         if (err)
-                goto error;
+                goto clunk_dfid;
 
         vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
         if (IS_ERR(vfid)) {
                 err = PTR_ERR(vfid);
                 vfid = NULL;
-                goto error;
+                goto clunk_dfid;
         }
 
         inode = v9fs_inode_from_fid(v9ses, vfid->fid, dir->i_sb);
         if (IS_ERR(inode)) {
                 err = PTR_ERR(inode);
                 inode = NULL;
-                goto error;
+                goto free_vfid;
         }
 
         dentry->d_op = &v9fs_dentry_operations;
         d_instantiate(dentry, inode);
         return 0;
 
-error:
-        if (vfid)
-                v9fs_fid_destroy(vfid);
+free_vfid:
+        v9fs_fid_destroy(vfid);
+
+clunk_dfid:
+        v9fs_fid_clunk(v9ses, dfid);
 
+error:
         return err;
 
 }
@@ -1209,26 +1238,29 @@ v9fs_vfs_link(struct dentry *old_dentry, struct inode *dir,
               struct dentry *dentry)
 {
         int retval;
+        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dir);
         struct v9fs_fid *oldfid;
         char *name;
 
         dprintk(DEBUG_VFS, " %lu,%s,%s\n", dir->i_ino, dentry->d_name.name,
                 old_dentry->d_name.name);
 
-        oldfid = v9fs_fid_lookup(old_dentry);
-        if (!oldfid) {
-                dprintk(DEBUG_ERROR, "can't find oldfid\n");
-                return -EPERM;
-        }
+        oldfid = v9fs_fid_clone(old_dentry);
+        if(IS_ERR(oldfid))
+                return PTR_ERR(oldfid);
 
         name = __getname();
-        if (unlikely(!name))
-                return -ENOMEM;
+        if (unlikely(!name)) {
+                retval = -ENOMEM;
+                goto clunk_fid;
+        }
 
         sprintf(name, "%d\n", oldfid->fid);
         retval = v9fs_vfs_mkspecial(dir, dentry, V9FS_DMLINK, name);
         __putname(name);
 
+clunk_fid:
+        v9fs_fid_clunk(v9ses, oldfid);
         return retval;
 }
 
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 7cb28720f90e..669dbe5b0317 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -682,6 +682,15 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                         retval = PTR_ERR(interpreter);
                         if (IS_ERR(interpreter))
                                 goto out_free_interp;
+
+                        /*
+                         * If the binary is not readable then enforce
+                         * mm->dumpable = 0 regardless of the interpreter's
+                         * permissions.
+                         */
+                        if (file_permission(interpreter, MAY_READ) < 0)
+                                bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
+
                         retval = kernel_read(interpreter, 0, bprm->buf,
                                              BINPRM_BUF_SIZE);
                         if (retval != BINPRM_BUF_SIZE) {
@@ -1178,6 +1187,10 @@ static int dump_seek(struct file *file, loff_t off)
  */
 static int maydump(struct vm_area_struct *vma)
 {
+        /* The vma can be set up to tell us the answer directly.  */
+        if (vma->vm_flags & VM_ALWAYSDUMP)
+                return 1;
+
         /* Do not dump I/O mapped devices or special mappings */
         if (vma->vm_flags & (VM_IO | VM_RESERVED))
                 return 0;
@@ -1424,6 +1437,32 @@ static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
         return sz;
 }
 
+static struct vm_area_struct *first_vma(struct task_struct *tsk,
+                                        struct vm_area_struct *gate_vma)
+{
+        struct vm_area_struct *ret = tsk->mm->mmap;
+
+        if (ret)
+                return ret;
+        return gate_vma;
+}
+/*
+ * Helper function for iterating across a vma list.  It ensures that the caller
+ * will visit `gate_vma' prior to terminating the search.
+ */
+static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
+                                        struct vm_area_struct *gate_vma)
+{
+        struct vm_area_struct *ret;
+
+        ret = this_vma->vm_next;
+        if (ret)
+                return ret;
+        if (this_vma == gate_vma)
+                return NULL;
+        return gate_vma;
+}
+
 /*
  * Actual dumper
  *
@@ -1439,7 +1478,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
         int segs;
         size_t size = 0;
         int i;
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *gate_vma;
         struct elfhdr *elf = NULL;
         loff_t offset = 0, dataoff, foffset;
         unsigned long limit = current->signal->rlim[RLIMIT_CORE].rlim_cur;
@@ -1525,6 +1564,10 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
         segs += ELF_CORE_EXTRA_PHDRS;
 #endif
 
+        gate_vma = get_gate_vma(current);
+        if (gate_vma != NULL)
+                segs++;
+
         /* Set up header */
         fill_elf_header(elf, segs + 1); /* including notes section */
 
@@ -1592,7 +1635,8 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
 
         /* Write program headers for segments dump */
-        for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
+        for (vma = first_vma(current, gate_vma); vma != NULL;
+                        vma = next_vma(vma, gate_vma)) {
                 struct elf_phdr phdr;
                 size_t sz;
 
@@ -1641,7 +1685,8 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
         /* Align to page */
         DUMP_SEEK(dataoff - foffset);
 
-        for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
+        for (vma = first_vma(current, gate_vma); vma != NULL;
+                        vma = next_vma(vma, gate_vma)) {
                 unsigned long addr;
 
                 if (!maydump(vma))
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 6e6d4568d548..a4d933a51208 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -234,6 +234,14 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
                                 goto error;
                         }
 
+                        /*
+                         * If the binary is not readable then enforce
+                         * mm->dumpable = 0 regardless of the interpreter's
+                         * permissions.
+                         */
+                        if (file_permission(interpreter, MAY_READ) < 0)
+                                bprm->interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP;
+
                         retval = kernel_read(interpreter, 0, bprm->buf,
                                              BINPRM_BUF_SIZE);
                         if (retval < 0)
diff --git a/fs/buffer.c b/fs/buffer.c
index 3b116078b4c3..460f1c43238e 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2834,7 +2834,7 @@ int try_to_free_buffers(struct page *page)
         int ret = 0;
 
         BUG_ON(!PageLocked(page));
-        if (PageDirty(page) || PageWriteback(page))
+        if (PageWriteback(page))
                 return 0;
 
         if (mapping == NULL) {          /* can this still happen? */
@@ -2845,6 +2845,19 @@ int try_to_free_buffers(struct page *page)
         spin_lock(&mapping->private_lock);
         ret = drop_buffers(page, &buffers_to_free);
         spin_unlock(&mapping->private_lock);
+
+        /*
+         * If the filesystem writes its buffers by hand (eg ext3)
+         * then we can have clean buffers against a dirty page.  We
+         * clean the page here; otherwise the VM will never notice
+         * that the filesystem did any IO at all.
+         *
+         * Also, during truncate, discard_buffer will have marked all
+         * the page's buffers clean.  We discover that here and clean
+         * the page also.
+         */
+        if (ret)
+                cancel_dirty_page(page, PAGE_CACHE_SIZE);
 out:
         if (buffers_to_free) {
                 struct buffer_head *bh = buffers_to_free;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index c403b66ec83c..a4b142a6a2c7 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -251,8 +251,19 @@ __writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
                 WARN_ON(inode->i_state & I_WILL_FREE);
 
         if ((wbc->sync_mode != WB_SYNC_ALL) && (inode->i_state & I_LOCK)) {
+                struct address_space *mapping = inode->i_mapping;
+                int ret;
+
                 list_move(&inode->i_list, &inode->i_sb->s_dirty);
-                return 0;
+
+                /*
+                 * Even if we don't actually write the inode itself here,
+                 * we can at least start some of the data writeout..
+                 */
+                spin_unlock(&inode_lock);
+                ret = do_writepages(mapping, wbc);
+                spin_lock(&inode_lock);
+                return ret;
         }
 
         /*
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 277df40f098d..e695660921ec 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -990,15 +990,16 @@ encode_entry(struct readdir_cd *ccd, const char *name,
 }
 
 int
-nfs3svc_encode_entry(struct readdir_cd *cd, const char *name,
-                     int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+nfs3svc_encode_entry(void *cd, const char *name,
+                     int namlen, loff_t offset, u64 ino, unsigned int d_type)
 {
         return encode_entry(cd, name, namlen, offset, ino, d_type, 0);
 }
 
 int
-nfs3svc_encode_entry_plus(struct readdir_cd *cd, const char *name,
-                          int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+nfs3svc_encode_entry_plus(void *cd, const char *name,
+                          int namlen, loff_t offset, u64 ino,
+                          unsigned int d_type)
 {
         return encode_entry(cd, name, namlen, offset, ino, d_type, 1);
 }
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index fea46368afb2..18aa9440df14 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1880,9 +1880,10 @@ nfsd4_encode_rdattr_error(__be32 *p, int buflen, __be32 nfserr)
 }
 
 static int
-nfsd4_encode_dirent(struct readdir_cd *ccd, const char *name, int namlen,
-                    loff_t offset, ino_t ino, unsigned int d_type)
+nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
+                    loff_t offset, u64 ino, unsigned int d_type)
 {
+        struct readdir_cd *ccd = ccdv;
         struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
         int buflen;
         __be32 *p = cd->buffer;
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 0aaccb03bf76..fbf5d51947ea 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -72,7 +72,7 @@ static struct svc_program	nfsd_acl_program = {
         .pg_prog                = NFS_ACL_PROGRAM,
         .pg_nvers               = NFSD_ACL_NRVERS,
         .pg_vers                = nfsd_acl_versions,
-        .pg_name                = "nfsd",
+        .pg_name                = "nfsacl",
         .pg_class               = "nfsd",
         .pg_stats               = &nfsd_acl_svcstats,
         .pg_authenticate        = &svc_set_client,
@@ -118,16 +118,16 @@ int nfsd_vers(int vers, enum vers_op change)
         switch(change) {
         case NFSD_SET:
                 nfsd_versions[vers] = nfsd_version[vers];
-                break;
 #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
                 if (vers < NFSD_ACL_NRVERS)
-                        nfsd_acl_version[vers] = nfsd_acl_version[vers];
+                        nfsd_acl_versions[vers] = nfsd_acl_version[vers];
 #endif
+                break;
         case NFSD_CLEAR:
                 nfsd_versions[vers] = NULL;
 #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
                 if (vers < NFSD_ACL_NRVERS)
-                        nfsd_acl_version[vers] = NULL;
+                        nfsd_acl_versions[vers] = NULL;
 #endif
                 break;
         case NFSD_TEST:
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index f5243f943996..6555c50d9006 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -462,9 +462,10 @@ nfssvc_encode_statfsres(struct svc_rqst *rqstp, __be32 *p,
 }
 
 int
-nfssvc_encode_entry(struct readdir_cd *ccd, const char *name,
-                    int namlen, loff_t offset, ino_t ino, unsigned int d_type)
+nfssvc_encode_entry(void *ccdv, const char *name,
+                    int namlen, loff_t offset, u64 ino, unsigned int d_type)
 {
+        struct readdir_cd *ccd = ccdv;
         struct nfsd_readdirres *cd = container_of(ccd, struct nfsd_readdirres, common);
         __be32  *p = cd->buffer;
         int     buflen, slen;
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 7a79c23aa6d4..5d32e5fa697e 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -822,7 +822,8 @@ nfsd_read_actor(read_descriptor_t *desc, struct page *page, unsigned long offset
                 rqstp->rq_res.page_len = size;
         } else if (page != pp[-1]) {
                 get_page(page);
-                put_page(*pp);
+                if (*pp)
+                        put_page(*pp);
                 *pp = page;
                 rqstp->rq_resused++;
                 rqstp->rq_res.page_len += size;
@@ -1244,7 +1245,6 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         __be32          err;
         int             host_err;
         __u32           v_mtime=0, v_atime=0;
-        int             v_mode=0;
 
         err = nfserr_perm;
         if (!flen)
@@ -1281,16 +1281,11 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 goto out;
 
         if (createmode == NFS3_CREATE_EXCLUSIVE) {
-                /* while the verifier would fit in mtime+atime,
-                 * solaris7 gets confused (bugid 4218508) if these have
-                 * the high bit set, so we use the mode as well
+                /* solaris7 gets confused (bugid 4218508) if these have
+                 * the high bit set, so just clear the high bits.
                  */
                 v_mtime = verifier[0]&0x7fffffff;
                 v_atime = verifier[1]&0x7fffffff;
-                v_mode  = S_IFREG
-                        | ((verifier[0]&0x80000000) >> (32-7)) /* u+x */
-                        | ((verifier[1]&0x80000000) >> (32-9)) /* u+r */
-                        ;
         }
         
         if (dchild->d_inode) {
@@ -1318,7 +1313,6 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 case NFS3_CREATE_EXCLUSIVE:
                         if (   dchild->d_inode->i_mtime.tv_sec == v_mtime
                             && dchild->d_inode->i_atime.tv_sec == v_atime
-                            && dchild->d_inode->i_mode  == v_mode
                             && dchild->d_inode->i_size  == 0 )
                                 break;
                          /* fallthru */
@@ -1340,26 +1334,22 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         }
 
         if (createmode == NFS3_CREATE_EXCLUSIVE) {
-                /* Cram the verifier into atime/mtime/mode */
+                /* Cram the verifier into atime/mtime */
                 iap->ia_valid = ATTR_MTIME|ATTR_ATIME
-                        | ATTR_MTIME_SET|ATTR_ATIME_SET
-                        | ATTR_MODE;
+                        | ATTR_MTIME_SET|ATTR_ATIME_SET;
                 /* XXX someone who knows this better please fix it for nsec */ 
                 iap->ia_mtime.tv_sec = v_mtime;
                 iap->ia_atime.tv_sec = v_atime;
                 iap->ia_mtime.tv_nsec = 0;
                 iap->ia_atime.tv_nsec = 0;
-                iap->ia_mode  = v_mode;
         }
 
         /* Set file attributes.
-         * Mode has already been set but we might need to reset it
-         * for CREATE_EXCLUSIVE
          * Irix appears to send along the gid when it tries to
          * implement setgid directories via NFS. Clear out all that cruft.
          */
  set_attr:
-        if ((iap->ia_valid &= ~(ATTR_UID|ATTR_GID)) != 0) {
+        if ((iap->ia_valid &= ~(ATTR_UID|ATTR_GID|ATTR_MODE)) != 0) {
                 __be32 err2 = nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
                 if (err2)
                         err = err2;
@@ -1726,7 +1716,7 @@ out:
  */
 __be32
 nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp, 
-             struct readdir_cd *cdp, encode_dent_fn func)
+             struct readdir_cd *cdp, filldir_t func)
 {
         __be32          err;
         int             host_err;
@@ -1751,7 +1741,7 @@ nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp,
 
         do {
                 cdp->err = nfserr_eof; /* will be cleared on successful read */
-                host_err = vfs_readdir(file, (filldir_t) func, cdp);
+                host_err = vfs_readdir(file, func, cdp);
         } while (host_err >=0 && cdp->err == nfs_ok);
         if (host_err)
                 err = nfserrno(host_err);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 77a57b5799c4..ff7a66850602 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -371,9 +371,11 @@ static int mounts_open(struct inode *inode, struct file *file)
 
         if (task) {
                 task_lock(task);
-                ns = task->nsproxy->mnt_ns;
-                if (ns)
-                        get_mnt_ns(ns);
+                if (task->nsproxy) {
+                        ns = task->nsproxy->mnt_ns;
+                        if (ns)
+                                get_mnt_ns(ns);
+                }
                 task_unlock(task);
                 put_task_struct(task);
         }