36 files changed, 336 insertions, 176 deletions

diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index be7288184fa9..0ea965c3bb7d 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -427,6 +427,8 @@ v9fs_create(struct inode *dir,
 
         v9fs_mistat2inode(fcall->params.rstat.stat, file_inode, sb);
         kfree(fcall);
+        fcall = NULL;
+        file_dentry->d_op = &v9fs_dentry_operations;
         d_instantiate(file_dentry, file_inode);
 
         if (perm & V9FS_DMDIR) {
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 6bded10c0d50..943ef9b82244 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,10 +1,12 @@
 Version 1.39
 ------------
-Defer close of a file handle slightly if pending writes depend on that file handle
+Defer close of a file handle slightly if pending writes depend on that handle
 (this reduces the EBADF bad file handle errors that can be logged under heavy
 stress on writes). Modify cifs Kconfig options to expose CONFIG_CIFS_STATS2 
-Fix SFU style symlinks and mknod needed for servers which do not support the CIFS
-Unix Extensions.  Fix setfacl/getfacl on bigendian. 
+Fix SFU style symlinks and mknod needed for servers which do not support the
+CIFS Unix Extensions.  Fix setfacl/getfacl on bigendian. Timeout negative
+dentries so files that the client sees as deleted but that later get created
+on the server will be recognized.  Add client side permission check on setattr.
 
 Version 1.38
 ------------
diff --git a/fs/cifs/README b/fs/cifs/README
index bb90941826ad..e5d09a2fc7a5 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -278,7 +278,9 @@ A partial list of the supported mount options follows:
                 (such as Windows), permissions can also be checked at the
                 client, and a crude form of client side permission checking 
                 can be enabled by specifying file_mode and dir_mode on 
-                the client
+                the client.  Note that the mount.cifs helper must be
+                at version 1.10 or higher to support specifying the uid
+                (or gid) in non-numberic form.
   gid           If CIFS Unix extensions are not supported by the server
                 this overrides the default gid for inodes.
   file_mode     If CIFS Unix extensions are not supported by the server
@@ -345,7 +347,10 @@ A partial list of the supported mount options follows:
                 client system. It is typically only needed when the server
                 supports the CIFS Unix Extensions but the UIDs/GIDs on the
                 client and server system do not match closely enough to allow
-                access by the user doing the mount.
+                access by the user doing the mount, but it may be useful with
+                non CIFS Unix Extension mounts for cases in which the default
+                mode is specified on the mount but is not to be enforced on the
+                client (e.g. perhaps when MultiUserMount is enabled)
                 Note that this does not affect the normal ACL check on the
                 target machine done by the server software (of the server
                 ACL against the user name provided at mount time).
@@ -368,15 +373,21 @@ A partial list of the supported mount options follows:
   setuids       If the CIFS Unix extensions are negotiated with the server
                 the client will attempt to set the effective uid and gid of
                 the local process on newly created files, directories, and
-                devices (create, mkdir, mknod).
+                devices (create, mkdir, mknod).  If the CIFS Unix Extensions
+                are not negotiated, for newly created files and directories
+                instead of using the default uid and gid specified on the
+                the mount, cache the new file's uid and gid locally which means
+                that the uid for the file can change when the inode is
+                reloaded (or the user remounts the share).
   nosetuids     The client will not attempt to set the uid and gid on
                 on newly created files, directories, and devices (create, 
                 mkdir, mknod) which will result in the server setting the
                 uid and gid to the default (usually the server uid of the
                 user who mounted the share).  Letting the server (rather than
-                the client) set the uid and gid is the default. This
-                parameter has no effect if the CIFS Unix Extensions are not
-                negotiated.
+                the client) set the uid and gid is the default. If the CIFS
+                Unix Extensions are not negotiated then the uid and gid for
+                new files will appear to be the uid (gid) of the mounter or the
+                uid (gid) parameter specified on the mount.
   netbiosname   When mounting to servers via port 139, specifies the RFC1001
                 source name to use to represent the client netbios machine 
                 name when doing the RFC1001 netbios session initialize.
@@ -418,6 +429,13 @@ A partial list of the supported mount options follows:
                 byte range locks).
  remount        remount the share (often used to change from ro to rw mounts
                 or vice versa)
+ sfu            When the CIFS Unix Extensions are not negotiated, attempt to
+                create device files and fifos in a format compatible with
+                Services for Unix (SFU).  In addition retrieve bits 10-12
+                of the mode via the SETFILEBITS extended attribute (as
+                SFU does).  In the future the bottom 9 bits of the mode
+                mode also will be emulated using queries of the security
+                descriptor (ACL).
                 
 The mount.cifs mount helper also accepts a few mount options before -o
 including:
diff --git a/fs/cifs/TODO b/fs/cifs/TODO
index c909298d11ed..fc34c74ec4be 100644
--- a/fs/cifs/TODO
+++ b/fs/cifs/TODO
@@ -1,4 +1,4 @@
-version 1.37 October 9, 2005
+Version 1.39 November 30, 2005
 
 A Partial List of Missing Features
 ==================================
@@ -58,7 +58,7 @@ o) Improve performance of readpages by sending more than one read
 at a time when 8 pages or more are requested. In conjuntion
 add support for async_cifs_readpages.
 
-p) Add support for storing symlink and fifo info to Windows servers 
+p) Add support for storing symlink info to Windows servers 
 in the Extended Attribute format their SFU clients would recognize.
 
 q) Finish fcntl D_NOTIFY support so kde and gnome file list windows
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 51548ed2e9cc..2a13a2bac8f1 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -32,6 +32,7 @@
 #include <linux/seq_file.h>
 #include <linux/vfs.h>
 #include <linux/mempool.h>
+#include <linux/delay.h>
 #include "cifsfs.h"
 #include "cifspdu.h"
 #define DECLARE_GLOBALS_HERE
@@ -429,6 +430,11 @@ static void cifs_umount_begin(struct super_block * sblock)
         {
                 cFYI(1,("wake up tasks now - umount begin not complete"));
                 wake_up_all(&tcon->ses->server->request_q);
+                wake_up_all(&tcon->ses->server->response_q);
+                msleep(1); /* yield */
+                /* we have to kick the requests once more */
+                wake_up_all(&tcon->ses->server->response_q);
+                msleep(1);
         }
 /* BB FIXME - finish add checks for tidStatus BB */
 
@@ -895,6 +901,9 @@ static int cifs_oplock_thread(void * dummyarg)
 
 static int cifs_dnotify_thread(void * dummyarg)
 {
+        struct list_head *tmp;
+        struct cifsSesInfo *ses;
+
         daemonize("cifsdnotifyd");
         allow_signal(SIGTERM);
 
@@ -903,7 +912,19 @@ static int cifs_dnotify_thread(void * dummyarg)
                 if(try_to_freeze())
                         continue;
                 set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(39*HZ);
+                schedule_timeout(15*HZ);
+                read_lock(&GlobalSMBSeslock);
+                /* check if any stuck requests that need
+                   to be woken up and wakeq so the
+                   thread can wake up and error out */
+                list_for_each(tmp, &GlobalSMBSessionList) {
+                        ses = list_entry(tmp, struct cifsSesInfo, 
+                                cifsSessionList);
+                        if(ses && ses->server && 
+                             atomic_read(&ses->server->inFlight))
+                                wake_up_all(&ses->server->response_q);
+                }
+                read_unlock(&GlobalSMBSeslock);
         } while(!signal_pending(current));
         complete_and_exit (&cifs_dnotify_exited, 0);
 }
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index d179b0c3eee4..6867e556d37e 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -90,6 +90,18 @@ small_smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
            check for tcp and smb session status done differently
            for those three - in the calling routine */
         if(tcon) {
+                if(tcon->tidStatus == CifsExiting) {
+                        /* only tree disconnect, open, and write,
+                        (and ulogoff which does not have tcon)
+                        are allowed as we start force umount */
+                        if((smb_command != SMB_COM_WRITE_ANDX) && 
+                           (smb_command != SMB_COM_OPEN_ANDX) && 
+                           (smb_command != SMB_COM_TREE_DISCONNECT)) {
+                                cFYI(1,("can not send cmd %d while umounting",
+                                        smb_command));
+                                return -ENODEV;
+                        }
+                }
                 if((tcon->ses) && (tcon->ses->status != CifsExiting) &&
                                   (tcon->ses->server)){
                         struct nls_table *nls_codepage;
@@ -187,6 +199,19 @@ smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
            check for tcp and smb session status done differently
            for those three - in the calling routine */
         if(tcon) {
+                if(tcon->tidStatus == CifsExiting) {
+                        /* only tree disconnect, open, and write,
+                          (and ulogoff which does not have tcon)
+                          are allowed as we start force umount */
+                        if((smb_command != SMB_COM_WRITE_ANDX) &&
+                           (smb_command != SMB_COM_OPEN_ANDX) &&
+                           (smb_command != SMB_COM_TREE_DISCONNECT)) {
+                                cFYI(1,("can not send cmd %d while umounting",
+                                        smb_command));
+                                return -ENODEV;
+                        }
+                }
+
                 if((tcon->ses) && (tcon->ses->status != CifsExiting) && 
                                   (tcon->ses->server)){
                         struct nls_table *nls_codepage;
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 16b21522e8fe..32cc96cafa3e 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -228,8 +228,15 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                 else {
                         rc = cifs_get_inode_info(&newinode, full_path,
                                                  buf, inode->i_sb,xid);
-                        if(newinode)
+                        if(newinode) {
                                 newinode->i_mode = mode;
+                                if((oplock & CIFS_CREATE_ACTION) &&
+                                  (cifs_sb->mnt_cifs_flags & 
+                                     CIFS_MOUNT_SET_UID)) {
+                                        newinode->i_uid = current->fsuid;
+                                        newinode->i_gid = current->fsgid;
+                                }
+                        }
                 }
 
                 if (rc != 0) {
@@ -465,12 +472,20 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry, struct name
                         direntry->d_op = &cifs_dentry_ops;
                 d_add(direntry, newInode);
 
-                /* since paths are not looked up by component - the parent directories are presumed to be good here */
+                /* since paths are not looked up by component - the parent 
+                   directories are presumed to be good here */
                 renew_parental_timestamps(direntry);
 
         } else if (rc == -ENOENT) {
                 rc = 0;
+                direntry->d_time = jiffies;
+                if (pTcon->nocase)
+                        direntry->d_op = &cifs_ci_dentry_ops;
+                else
+                        direntry->d_op = &cifs_dentry_ops;
                 d_add(direntry, NULL);
+        /*      if it was once a directory (but how can we tell?) we could do  
+                        shrink_dcache_parent(direntry); */
         } else {
                 cERROR(1,("Error 0x%x on cifs_get_inode_info in lookup of %s",
                            rc,full_path));
@@ -489,21 +504,20 @@ cifs_d_revalidate(struct dentry *direntry, struct nameidata *nd)
 {
         int isValid = 1;
 
-/*      lock_kernel(); *//* surely we do not want to lock the kernel for a whole network round trip which could take seconds */
-
         if (direntry->d_inode) {
                 if (cifs_revalidate(direntry)) {
-                        /* unlock_kernel(); */
                         return 0;
                 }
         } else {
-                cFYI(1,
-                     ("In cifs_d_revalidate with no inode but name = %s and dentry 0x%p",
-                      direntry->d_name.name, direntry));
+                cFYI(1, ("neg dentry 0x%p name = %s",
+                         direntry, direntry->d_name.name));
+                if(time_after(jiffies, direntry->d_time + HZ) || 
+                        !lookupCacheEnabled) {
+                        d_drop(direntry);
+                        isValid = 0;
+                } 
         }
 
-/*    unlock_kernel(); */
-
         return isValid;
 }
 
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 05b525812adb..411c1f7f84da 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -710,7 +710,7 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
         char *full_path = NULL;
         struct inode *newinode = NULL;
 
-        cFYI(1, ("In cifs_mkdir, mode = 0x%x inode = 0x%p ", mode, inode));
+        cFYI(1, ("In cifs_mkdir, mode = 0x%x inode = 0x%p", mode, inode));
 
         xid = GetXid();
 
@@ -768,6 +768,17 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                         /* BB to be implemented via Windows secrty descriptors
                            eg CIFSSMBWinSetPerms(xid, pTcon, full_path, mode,
                                                  -1, -1, local_nls); */
+                        if(direntry->d_inode) {
+                                direntry->d_inode->i_mode = mode;
+                                direntry->d_inode->i_mode |= S_IFDIR;
+                                if(cifs_sb->mnt_cifs_flags & 
+                                     CIFS_MOUNT_SET_UID) {
+                                        direntry->d_inode->i_uid = 
+                                                current->fsuid;
+                                        direntry->d_inode->i_gid = 
+                                                current->fsgid;
+                                }
+                        }
                 }
         }
         kfree(full_path);
@@ -1039,14 +1050,20 @@ int cifs_revalidate(struct dentry *direntry)
                 filemap_fdatawrite(direntry->d_inode->i_mapping);
         }
         if (invalidate_inode) {
-                if (direntry->d_inode->i_mapping)
-                        filemap_fdatawait(direntry->d_inode->i_mapping);
-                /* may eventually have to do this for open files too */
-                if (list_empty(&(cifsInode->openFileList))) {
-                        /* Has changed on server - flush read ahead pages */
-                        cFYI(1, ("Invalidating read ahead data on "
-                                 "closed file"));
-                        invalidate_remote_inode(direntry->d_inode);
+        /* shrink_dcache not necessary now that cifs dentry ops
+        are exported for negative dentries */
+/*              if(S_ISDIR(direntry->d_inode->i_mode)) 
+                        shrink_dcache_parent(direntry); */
+                if (S_ISREG(direntry->d_inode->i_mode)) {
+                        if (direntry->d_inode->i_mapping)
+                                filemap_fdatawait(direntry->d_inode->i_mapping);
+                        /* may eventually have to do this for open files too */
+                        if (list_empty(&(cifsInode->openFileList))) {
+                                /* changed on server - flush read ahead pages */
+                                cFYI(1, ("Invalidating read ahead data on "
+                                         "closed file"));
+                                invalidate_remote_inode(direntry->d_inode);
+                        }
                 }
         }
 /*      up(&direntry->d_inode->i_sem); */
@@ -1105,9 +1122,20 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
 
         cFYI(1, ("In cifs_setattr, name = %s attrs->iavalid 0x%x ",
                  direntry->d_name.name, attrs->ia_valid));
+
         cifs_sb = CIFS_SB(direntry->d_inode->i_sb);
         pTcon = cifs_sb->tcon;
 
+        if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_PERM) == 0) {
+                /* check if we have permission to change attrs */
+                rc = inode_change_ok(direntry->d_inode, attrs);
+                if(rc < 0) {
+                        FreeXid(xid);
+                        return rc;
+                } else
+                        rc = 0;
+        }
+                
         down(&direntry->d_sb->s_vfs_rename_sem);
         full_path = build_path_from_dentry(direntry);
         up(&direntry->d_sb->s_vfs_rename_sem);
@@ -1147,7 +1175,9 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                                                   1 /* 45 seconds */);
                                 cFYI(1,("Wrt seteof rc %d", rc));
                         }
-                }
+                } else 
+                        rc = -EINVAL;
+
                 if (rc != 0) {
                         /* Set file size by pathname rather than by handle
                            either because no valid, writeable file handle for
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index ca27a82c54cd..94baf6c8ecbd 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -397,12 +397,12 @@ checkSMBhdr(struct smb_hdr *smb, __u16 mid)
                         if(smb->Command == SMB_COM_LOCKING_ANDX)
                                 return 0;
                         else
-                                cERROR(1, ("Rcvd Request not response "));         
+                                cERROR(1, ("Rcvd Request not response"));         
                 }
         } else { /* bad signature or mid */
                 if (*(__le32 *) smb->Protocol != cpu_to_le32(0x424d53ff))
                         cERROR(1,
-                               ("Bad protocol string signature header %x ",
+                               ("Bad protocol string signature header %x",
                                 *(unsigned int *) smb->Protocol));
                 if (mid != smb->Mid)
                         cERROR(1, ("Mids do not match"));
@@ -417,7 +417,7 @@ checkSMB(struct smb_hdr *smb, __u16 mid, int length)
         __u32 len = smb->smb_buf_length;
         __u32 clc_len;  /* calculated length */
         cFYI(0,
-             ("Entering checkSMB with Length: %x, smb_buf_length: %x ",
+             ("Entering checkSMB with Length: %x, smb_buf_length: %x",
               length, len));
         if (((unsigned int)length < 2 + sizeof (struct smb_hdr)) ||
             (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)) {
@@ -451,9 +451,16 @@ checkSMB(struct smb_hdr *smb, __u16 mid, int length)
                 cERROR(1, ("bad smb size detected for Mid=%d", smb->Mid));
                 /* Windows XP can return a few bytes too much, presumably
                 an illegal pad, at the end of byte range lock responses 
-                so we allow for up to eight byte pad, as long as actual
+                so we allow for that three byte pad, as long as actual
                 received length is as long or longer than calculated length */
-                if((4+len > clc_len) && (len <= clc_len + 3))
+                /* We have now had to extend this more, since there is a 
+                case in which it needs to be bigger still to handle a
+                malformed response to transact2 findfirst from WinXP when
+                access denied is returned and thus bcc and wct are zero
+                but server says length is 0x21 bytes too long as if the server
+                forget to reset the smb rfc1001 length when it reset the
+                wct and bcc to minimum size and drop the t2 parms and data */
+                if((4+len > clc_len) && (len <= clc_len + 512))
                         return 0;
                 else
                         return 1;
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index f7814689844b..5de74d216fdd 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -330,7 +330,7 @@ static const struct {
         ERRHRD, ERRgeneral, NT_STATUS_ACCOUNT_RESTRICTION}, {
         ERRSRV, 2241, NT_STATUS_INVALID_LOGON_HOURS}, {
         ERRSRV, 2240, NT_STATUS_INVALID_WORKSTATION}, {
-        ERRSRV, 2242, NT_STATUS_PASSWORD_EXPIRED}, {
+        ERRSRV, ERRpasswordExpired, NT_STATUS_PASSWORD_EXPIRED}, {
         ERRSRV, 2239, NT_STATUS_ACCOUNT_DISABLED}, {
         ERRHRD, ERRgeneral, NT_STATUS_NONE_MAPPED}, {
         ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_LUIDS_REQUESTED}, {
@@ -676,7 +676,7 @@ static const struct {
         ERRDOS, 193, NT_STATUS_IMAGE_CHECKSUM_MISMATCH}, {
         ERRHRD, ERRgeneral, NT_STATUS_LOST_WRITEBEHIND_DATA}, {
         ERRHRD, ERRgeneral, NT_STATUS_CLIENT_SERVER_PARAMETERS_INVALID}, {
-        ERRSRV, 2242, NT_STATUS_PASSWORD_MUST_CHANGE}, {
+        ERRSRV, ERRpasswordExpired, NT_STATUS_PASSWORD_MUST_CHANGE}, {
         ERRHRD, ERRgeneral, NT_STATUS_NOT_FOUND}, {
         ERRHRD, ERRgeneral, NT_STATUS_NOT_TINY_STREAM}, {
         ERRHRD, ERRgeneral, NT_STATUS_RECOVERY_FAILURE}, {
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 41a9659c16bc..f8871196098c 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -515,6 +515,7 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
                         *pbytes_returned = in_buf->smb_buf_length;
 
                         /* BB special case reconnect tid and uid here? */
+                        /* BB special case Errbadpassword and pwdexpired here */
                         rc = map_smb_to_linux_error(in_buf);
 
                         /* convert ByteCount if necessary */
diff --git a/fs/dquot.c b/fs/dquot.c
index 05b60283c9c2..2a62b3dc20ec 100644
--- a/fs/dquot.c
+++ b/fs/dquot.c
@@ -1513,10 +1513,16 @@ int vfs_quota_on_mount(struct super_block *sb, char *qf_name,
         if (IS_ERR(dentry))
                 return PTR_ERR(dentry);
 
+        if (!dentry->d_inode) {
+                error = -ENOENT;
+                goto out;
+        }
+
         error = security_quota_on(dentry);
         if (!error)
                 error = vfs_quota_on_inode(dentry->d_inode, type, format_id);
 
+out:
         dput(dentry);
         return error;
 }
diff --git a/fs/exec.c b/fs/exec.c
index 1f8a9fd2c9ed..22533cce0611 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -306,9 +306,6 @@ void install_arg_page(struct vm_area_struct *vma,
                         struct page *page, unsigned long address)
 {
         struct mm_struct *mm = vma->vm_mm;
-        pgd_t * pgd;
-        pud_t * pud;
-        pmd_t * pmd;
         pte_t * pte;
         spinlock_t *ptl;
 
@@ -316,14 +313,7 @@ void install_arg_page(struct vm_area_struct *vma,
                 goto out;
 
         flush_dcache_page(page);
-        pgd = pgd_offset(mm, address);
-        pud = pud_alloc(mm, pgd, address);
-        if (!pud)
-                goto out;
-        pmd = pmd_alloc(mm, pud, address);
-        if (!pmd)
-                goto out;
-        pte = pte_alloc_map_lock(mm, pmd, address, &ptl);
+        pte = get_locked_pte(mm, address, &ptl);
         if (!pte)
                 goto out;
         if (!pte_none(*pte)) {
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 1be78b4b4de9..6104ad310507 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -767,6 +767,7 @@ int ext3_group_add(struct super_block *sb, struct ext3_new_group_data *input)
         if (input->group != EXT3_SB(sb)->s_groups_count) {
                 ext3_warning(sb, __FUNCTION__,
                              "multiple resizers run on filesystem!\n");
+                err = -EBUSY;
                 goto exit_journal;
         }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index c045cc70c749..51f5da652771 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -74,6 +74,24 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
         return 1;
 }
 
+static int dir_alias(struct inode *inode)
+{
+        if (S_ISDIR(inode->i_mode)) {
+                /* Don't allow creating an alias to a directory  */
+                struct dentry *alias = d_find_alias(inode);
+                if (alias) {
+                        dput(alias);
+                        return 1;
+                }
+        }
+        return 0;
+}
+
+static inline int invalid_nodeid(u64 nodeid)
+{
+        return !nodeid || nodeid == FUSE_ROOT_ID;
+}
+
 static struct dentry_operations fuse_dentry_operations = {
         .d_revalidate   = fuse_dentry_revalidate,
 };
@@ -97,7 +115,7 @@ static int fuse_lookup_iget(struct inode *dir, struct dentry *entry,
         fuse_lookup_init(req, dir, entry, &outarg);
         request_send(fc, req);
         err = req->out.h.error;
-        if (!err && (!outarg.nodeid || outarg.nodeid == FUSE_ROOT_ID))
+        if (!err && invalid_nodeid(outarg.nodeid))
                 err = -EIO;
         if (!err) {
                 inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
@@ -193,7 +211,7 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         }
 
         err = -EIO;
-        if (!S_ISREG(outentry.attr.mode))
+        if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid))
                 goto out_free_ff;
 
         inode = fuse_iget(dir->i_sb, outentry.nodeid, outentry.generation,
@@ -250,7 +268,7 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
                 fuse_put_request(fc, req);
                 return err;
         }
-        if (!outarg.nodeid || outarg.nodeid == FUSE_ROOT_ID) {
+        if (invalid_nodeid(outarg.nodeid)) {
                 fuse_put_request(fc, req);
                 return -EIO;
         }
@@ -263,7 +281,7 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
         fuse_put_request(fc, req);
 
         /* Don't allow userspace to do really stupid things... */
-        if ((inode->i_mode ^ mode) & S_IFMT) {
+        if (((inode->i_mode ^ mode) & S_IFMT) || dir_alias(inode)) {
                 iput(inode);
                 return -EIO;
         }
@@ -874,14 +892,9 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         err = fuse_lookup_iget(dir, entry, &inode);
         if (err)
                 return ERR_PTR(err);
-        if (inode && S_ISDIR(inode->i_mode)) {
-                /* Don't allow creating an alias to a directory  */
-                struct dentry *alias = d_find_alias(inode);
-                if (alias) {
-                        dput(alias);
-                        iput(inode);
-                        return ERR_PTR(-EIO);
-                }
+        if (inode && dir_alias(inode)) {
+                iput(inode);
+                return ERR_PTR(-EIO);
         }
         d_add(entry, inode);
         return NULL;
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index c60e5635498d..df16fcbff3fb 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -151,6 +151,7 @@ struct hfsplus_sb_info {
 
 #define HFSPLUS_SB_WRITEBACKUP  0x0001
 #define HFSPLUS_SB_NODECOMPOSE  0x0002
+#define HFSPLUS_SB_FORCE        0x0004
 
 
 struct hfsplus_inode_info {
diff --git a/fs/hfsplus/hfsplus_raw.h b/fs/hfsplus/hfsplus_raw.h
index 5bad37cfdb29..b4fbed633219 100644
--- a/fs/hfsplus/hfsplus_raw.h
+++ b/fs/hfsplus/hfsplus_raw.h
@@ -123,11 +123,13 @@ struct hfsplus_vh {
 } __packed;
 
 /* HFS+ volume attributes */
-#define HFSPLUS_VOL_UNMNT     (1 << 8)
-#define HFSPLUS_VOL_SPARE_BLK (1 << 9)
-#define HFSPLUS_VOL_NOCACHE   (1 << 10)
-#define HFSPLUS_VOL_INCNSTNT  (1 << 11)
-#define HFSPLUS_VOL_SOFTLOCK  (1 << 15)
+#define HFSPLUS_VOL_UNMNT               (1 << 8)
+#define HFSPLUS_VOL_SPARE_BLK           (1 << 9)
+#define HFSPLUS_VOL_NOCACHE             (1 << 10)
+#define HFSPLUS_VOL_INCNSTNT            (1 << 11)
+#define HFSPLUS_VOL_NODEID_REUSED       (1 << 12)
+#define HFSPLUS_VOL_JOURNALED           (1 << 13)
+#define HFSPLUS_VOL_SOFTLOCK            (1 << 15)
 
 /* HFS+ BTree node descriptor */
 struct hfs_bnode_desc {
diff --git a/fs/hfsplus/options.c b/fs/hfsplus/options.c
index cca0818aa4ca..935dafba0078 100644
--- a/fs/hfsplus/options.c
+++ b/fs/hfsplus/options.c
@@ -22,7 +22,7 @@ enum {
         opt_umask, opt_uid, opt_gid,
         opt_part, opt_session, opt_nls,
         opt_nodecompose, opt_decompose,
-        opt_err
+        opt_force, opt_err
 };
 
 static match_table_t tokens = {
@@ -36,6 +36,7 @@ static match_table_t tokens = {
         { opt_nls, "nls=%s" },
         { opt_decompose, "decompose" },
         { opt_nodecompose, "nodecompose" },
+        { opt_force, "force" },
         { opt_err, NULL }
 };
 
@@ -145,6 +146,9 @@ int hfsplus_parse_options(char *input, struct hfsplus_sb_info *sbi)
                 case opt_nodecompose:
                         sbi->flags |= HFSPLUS_SB_NODECOMPOSE;
                         break;
+                case opt_force:
+                        sbi->flags |= HFSPLUS_SB_FORCE;
+                        break;
                 default:
                         return 0;
                 }
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 0ce1c455ae55..8093351bd7c3 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -251,16 +251,28 @@ static int hfsplus_remount(struct super_block *sb, int *flags, char *data)
                 return 0;
         if (!(*flags & MS_RDONLY)) {
                 struct hfsplus_vh *vhdr = HFSPLUS_SB(sb).s_vhdr;
+                struct hfsplus_sb_info sbi;
+
+                memset(&sbi, 0, sizeof(struct hfsplus_sb_info));
+                sbi.nls = HFSPLUS_SB(sb).nls;
+                if (!hfsplus_parse_options(data, &sbi))
+                        return -EINVAL;
 
                 if (!(vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_UNMNT))) {
                         printk("HFS+-fs warning: Filesystem was not cleanly unmounted, "
                                "running fsck.hfsplus is recommended.  leaving read-only.\n");
                         sb->s_flags |= MS_RDONLY;
                         *flags |= MS_RDONLY;
+                } else if (sbi.flags & HFSPLUS_SB_FORCE) {
+                        /* nothing */
                 } else if (vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_SOFTLOCK)) {
                         printk("HFS+-fs: Filesystem is marked locked, leaving read-only.\n");
                         sb->s_flags |= MS_RDONLY;
                         *flags |= MS_RDONLY;
+                } else if (vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_JOURNALED)) {
+                        printk("HFS+-fs: Filesystem is marked journaled, leaving read-only.\n");
+                        sb->s_flags |= MS_RDONLY;
+                        *flags |= MS_RDONLY;
                 }
         }
         return 0;
@@ -352,11 +364,19 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
                         printk("HFS+-fs warning: Filesystem was not cleanly unmounted, "
                                "running fsck.hfsplus is recommended.  mounting read-only.\n");
                 sb->s_flags |= MS_RDONLY;
+        } else if (sbi->flags & HFSPLUS_SB_FORCE) {
+                /* nothing */
         } else if (vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_SOFTLOCK)) {
                 if (!silent)
                         printk("HFS+-fs: Filesystem is marked locked, mounting read-only.\n");
                 sb->s_flags |= MS_RDONLY;
+        } else if (vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_JOURNALED)) {
+                if (!silent)
+                        printk("HFS+-fs: write access to a jounaled filesystem is not supported, "
+                               "use the force option at your own risk, mounting read-only.\n");
+                sb->s_flags |= MS_RDONLY;
         }
+        sbi->flags &= ~HFSPLUS_SB_FORCE;
 
         /* Load metadata objects (B*Trees) */
         HFSPLUS_SB(sb).ext_tree = hfs_btree_open(sb, HFSPLUS_EXT_CNID);
diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 543420665c5b..d0fcc5f3497e 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -234,6 +234,7 @@ void jffs2_read_inode (struct inode *inode)
         c = JFFS2_SB_INFO(inode->i_sb);
 
         jffs2_init_inode_info(f);
+        down(&f->sem);
 
         ret = jffs2_do_read_inode(c, f, inode->i_ino, &latest_node);
 
@@ -400,6 +401,7 @@ struct inode *jffs2_new_inode (struct inode *dir_i, int mode, struct jffs2_raw_i
 
         f = JFFS2_INODE_INFO(inode);
         jffs2_init_inode_info(f);
+        down(&f->sem);
 
         memset(ri, 0, sizeof(*ri));
         /* Set OS-specific defaults for new inodes */
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 9e0b5458d9c0..93883817cbd0 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -51,7 +51,7 @@ static void jffs2_i_init_once(void * foo, kmem_cache_t * cachep, unsigned long f
 
         if ((flags & (SLAB_CTOR_VERIFY|SLAB_CTOR_CONSTRUCTOR)) ==
             SLAB_CTOR_CONSTRUCTOR) {
-                init_MUTEX_LOCKED(&ei->sem);
+                init_MUTEX(&ei->sem);
                 inode_init_once(&ei->vfs_inode);
         }
 }
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 7370583b61e5..c0d1a214572c 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1287,6 +1287,7 @@ dentry->d_parent->d_name.name, dentry->d_name.name);
                 nfs_begin_data_update(dentry->d_inode);
                 error = NFS_PROTO(dir)->rename(dir, &dentry->d_name,
                                 dir, &qsilly);
+                nfs_mark_for_revalidate(dentry->d_inode);
                 nfs_end_data_update(dentry->d_inode);
         } else
                 error = NFS_PROTO(dir)->rename(dir, &dentry->d_name,
@@ -1334,6 +1335,7 @@ static int nfs_safe_remove(struct dentry *dentry)
                 /* The VFS may want to delete this inode */
                 if (error == 0)
                         inode->i_nlink--;
+                nfs_mark_for_revalidate(inode);
                 nfs_end_data_update(inode);
         } else
                 error = NFS_PROTO(dir)->remove(dir, &dentry->d_name);
@@ -1556,6 +1558,7 @@ go_ahead:
         nfs_begin_data_update(old_inode);
         error = NFS_PROTO(old_dir)->rename(old_dir, &old_dentry->d_name,
                                            new_dir, &new_dentry->d_name);
+        nfs_mark_for_revalidate(old_inode);
         nfs_end_data_update(old_inode);
         nfs_end_data_update(new_dir);
         nfs_end_data_update(old_dir);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 6391d8964214..afd75d0463fd 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -54,7 +54,7 @@
 #define NFS_MAX_READAHEAD       (RPC_DEF_SLOT_TABLE - 1)
 
 static void nfs_invalidate_inode(struct inode *);
-static int nfs_update_inode(struct inode *, struct nfs_fattr *, unsigned long);
+static int nfs_update_inode(struct inode *, struct nfs_fattr *);
 
 static struct inode *nfs_alloc_inode(struct super_block *sb);
 static void nfs_destroy_inode(struct inode *);
@@ -643,14 +643,11 @@ static int nfs_show_options(struct seq_file *m, struct vfsmount *mnt)
 /*
  * Invalidate the local caches
  */
-void
-nfs_zap_caches(struct inode *inode)
+static void nfs_zap_caches_locked(struct inode *inode)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
         int mode = inode->i_mode;
 
-        spin_lock(&inode->i_lock);
-
         NFS_ATTRTIMEO(inode) = NFS_MINATTRTIMEO(inode);
         NFS_ATTRTIMEO_UPDATE(inode) = jiffies;
 
@@ -659,7 +656,12 @@ nfs_zap_caches(struct inode *inode)
                 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
         else
                 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
+}
 
+void nfs_zap_caches(struct inode *inode)
+{
+        spin_lock(&inode->i_lock);
+        nfs_zap_caches_locked(inode);
         spin_unlock(&inode->i_lock);
 }
 
@@ -676,16 +678,13 @@ static void nfs_zap_acl_cache(struct inode *inode)
 }
 
 /*
- * Invalidate, but do not unhash, the inode
+ * Invalidate, but do not unhash, the inode.
+ * NB: must be called with inode->i_lock held!
  */
-static void
-nfs_invalidate_inode(struct inode *inode)
+static void nfs_invalidate_inode(struct inode *inode)
 {
-        umode_t save_mode = inode->i_mode;
-
-        make_bad_inode(inode);
-        inode->i_mode = save_mode;
-        nfs_zap_caches(inode);
+        set_bit(NFS_INO_STALE, &NFS_FLAGS(inode));
+        nfs_zap_caches_locked(inode);
 }
 
 struct nfs_find_desc {
@@ -1081,8 +1080,6 @@ __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
         int              status = -ESTALE;
         struct nfs_fattr fattr;
         struct nfs_inode *nfsi = NFS_I(inode);
-        unsigned long verifier;
-        unsigned long cache_validity;
 
         dfprintk(PAGECACHE, "NFS: revalidating (%s/%Ld)\n",
                 inode->i_sb->s_id, (long long)NFS_FILEID(inode));
@@ -1107,8 +1104,6 @@ __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
                 }
         }
 
-        /* Protect against RPC races by saving the change attribute */
-        verifier = nfs_save_change_attribute(inode);
         status = NFS_PROTO(inode)->getattr(server, NFS_FH(inode), &fattr);
         if (status != 0) {
                 dfprintk(PAGECACHE, "nfs_revalidate_inode: (%s/%Ld) getattr failed, error=%d\n",
@@ -1123,7 +1118,7 @@ __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
         }
 
         spin_lock(&inode->i_lock);
-        status = nfs_update_inode(inode, &fattr, verifier);
+        status = nfs_update_inode(inode, &fattr);
         if (status) {
                 spin_unlock(&inode->i_lock);
                 dfprintk(PAGECACHE, "nfs_revalidate_inode: (%s/%Ld) refresh failed, error=%d\n",
@@ -1131,20 +1126,11 @@ __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
                          (long long)NFS_FILEID(inode), status);
                 goto out;
         }
-        cache_validity = nfsi->cache_validity;
-        nfsi->cache_validity &= ~NFS_INO_REVAL_PAGECACHE;
-
-        /*
-         * We may need to keep the attributes marked as invalid if
-         * we raced with nfs_end_attr_update().
-         */
-        if (time_after_eq(verifier, nfsi->cache_change_attribute))
-                nfsi->cache_validity &= ~(NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ATIME);
         spin_unlock(&inode->i_lock);
 
         nfs_revalidate_mapping(inode, inode->i_mapping);
 
-        if (cache_validity & NFS_INO_INVALID_ACL)
+        if (nfsi->cache_validity & NFS_INO_INVALID_ACL)
                 nfs_zap_acl_cache(inode);
 
         dfprintk(PAGECACHE, "NFS: (%s/%Ld) revalidation complete\n",
@@ -1347,10 +1333,8 @@ int nfs_refresh_inode(struct inode *inode, struct nfs_fattr *fattr)
                 return 0;
         spin_lock(&inode->i_lock);
         nfsi->cache_validity &= ~NFS_INO_REVAL_PAGECACHE;
-        if (nfs_verify_change_attribute(inode, fattr->time_start))
-                nfsi->cache_validity &= ~(NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ATIME);
         if (time_after(fattr->time_start, nfsi->last_updated))
-                status = nfs_update_inode(inode, fattr, fattr->time_start);
+                status = nfs_update_inode(inode, fattr);
         else
                 status = nfs_check_inode_attributes(inode, fattr);
 
@@ -1376,10 +1360,7 @@ int nfs_post_op_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 nfsi->cache_validity |= NFS_INO_INVALID_ATTR | NFS_INO_INVALID_ACCESS;
                 goto out;
         }
-        status = nfs_update_inode(inode, fattr, fattr->time_start);
-        if (time_after_eq(fattr->time_start, nfsi->cache_change_attribute))
-                nfsi->cache_validity &= ~(NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ATIME|NFS_INO_REVAL_PAGECACHE);
-        nfsi->cache_change_attribute = jiffies;
+        status = nfs_update_inode(inode, fattr);
 out:
         spin_unlock(&inode->i_lock);
         return status;
@@ -1397,12 +1378,12 @@ out:
  *
  * A very similar scenario holds for the dir cache.
  */
-static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr, unsigned long verifier)
+static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
         loff_t cur_isize, new_isize;
         unsigned int    invalid = 0;
-        int data_unstable;
+        int data_stable;
 
         dfprintk(VFS, "NFS: %s(%s/%ld ct=%d info=0x%x)\n",
                         __FUNCTION__, inode->i_sb->s_id, inode->i_ino,
@@ -1433,8 +1414,9 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr, unsign
         nfsi->last_updated = jiffies;
 
         /* Are we racing with known updates of the metadata on the server? */
-        data_unstable = ! (nfs_verify_change_attribute(inode, verifier) ||
-                (nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE));
+        data_stable = nfs_verify_change_attribute(inode, fattr->time_start);
+        if (data_stable)
+                nfsi->cache_validity &= ~(NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ATIME);
 
         /* Check if our cached file size is stale */
         new_isize = nfs_size_to_loff_t(fattr->size);
@@ -1443,7 +1425,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr, unsign
                 /* Do we perhaps have any outstanding writes? */
                 if (nfsi->npages == 0) {
                         /* No, but did we race with nfs_end_data_update()? */
-                        if (time_after_eq(verifier,  nfsi->cache_change_attribute)) {
+                        if (data_stable) {
                                 inode->i_size = new_isize;
                                 invalid |= NFS_INO_INVALID_DATA;
                         }
@@ -1452,6 +1434,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr, unsign
                         inode->i_size = new_isize;
                         invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
                 }
+                nfsi->cache_change_attribute = jiffies;
                 dprintk("NFS: isize change on server for file %s/%ld\n",
                                 inode->i_sb->s_id, inode->i_ino);
         }
@@ -1461,8 +1444,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr, unsign
                 memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
                 dprintk("NFS: mtime change on server for file %s/%ld\n",
                                 inode->i_sb->s_id, inode->i_ino);
-                if (!data_unstable)
-                        invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
+                invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
+                nfsi->cache_change_attribute = jiffies;
         }
 
         if ((fattr->valid & NFS_ATTR_FATTR_V4)
@@ -1470,15 +1453,15 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr, unsign
                 dprintk("NFS: change_attr change on server for file %s/%ld\n",
                        inode->i_sb->s_id, inode->i_ino);
                 nfsi->change_attr = fattr->change_attr;
-                if (!data_unstable)
-                        invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
+                invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
+                nfsi->cache_change_attribute = jiffies;
         }
 
         /* If ctime has changed we should definitely clear access+acl caches */
         if (!timespec_equal(&inode->i_ctime, &fattr->ctime)) {
-                if (!data_unstable)
-                        invalid |= NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
+                invalid |= NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
                 memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+                nfsi->cache_change_attribute = jiffies;
         }
         memcpy(&inode->i_atime, &fattr->atime, sizeof(inode->i_atime));
 
@@ -1516,6 +1499,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr, unsign
         if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)
                                 || S_ISLNK(inode->i_mode)))
                 invalid &= ~NFS_INO_INVALID_DATA;
+        if (data_stable)
+                invalid &= ~(NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ATIME|NFS_INO_REVAL_PAGECACHE);
         if (!nfs_have_delegation(inode, FMODE_READ))
                 nfsi->cache_validity |= invalid;
 
@@ -1528,14 +1513,13 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr, unsign
         printk(KERN_DEBUG "%s: inode %ld mode changed, %07o to %07o\n",
                         __FUNCTION__, inode->i_ino, inode->i_mode, fattr->mode);
 #endif
+ out_err:
         /*
          * No need to worry about unhashing the dentry, as the
          * lookup validation will know that the inode is bad.
          * (But we fall through to invalidate the caches.)
          */
         nfs_invalidate_inode(inode);
- out_err:
-        set_bit(NFS_INO_STALE, &NFS_FLAGS(inode));
         return -ESTALE;
 }
 
@@ -2068,6 +2052,7 @@ static struct inode *nfs_alloc_inode(struct super_block *sb)
                 return NULL;
         nfsi->flags = 0UL;
         nfsi->cache_validity = 0UL;
+        nfsi->cache_change_attribute = jiffies;
 #ifdef CONFIG_NFS_V3_ACL
         nfsi->acl_access = ERR_PTR(-EAGAIN);
         nfsi->acl_default = ERR_PTR(-EAGAIN);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 21482b2518f6..f988a9417b13 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1506,10 +1506,15 @@ static int _nfs4_proc_write(struct nfs_write_data *wdata)
         dprintk("NFS call  write %d @ %Ld\n", wdata->args.count,
                         (long long) wdata->args.offset);
 
+        wdata->args.bitmask = server->attr_bitmask;
+        wdata->res.server = server;
         nfs_fattr_init(fattr);
         status = rpc_call_sync(server->client, &msg, rpcflags);
         dprintk("NFS reply write: %d\n", status);
-        return status;
+        if (status < 0)
+                return status;
+        nfs_post_op_update_inode(inode, fattr);
+        return wdata->res.count;
 }
 
 static int nfs4_proc_write(struct nfs_write_data *wdata)
@@ -1540,9 +1545,13 @@ static int _nfs4_proc_commit(struct nfs_write_data *cdata)
         dprintk("NFS call  commit %d @ %Ld\n", cdata->args.count,
                         (long long) cdata->args.offset);
 
+        cdata->args.bitmask = server->attr_bitmask;
+        cdata->res.server = server;
         nfs_fattr_init(fattr);
         status = rpc_call_sync(server->client, &msg, 0);
         dprintk("NFS reply commit: %d\n", status);
+        if (status >= 0)
+                nfs_post_op_update_inode(inode, fattr);
         return status;
 }
 
@@ -3071,15 +3080,15 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
         struct nfs4_client *clp = state->owner->so_client;
         int status;
 
-        down_read(&clp->cl_sem);
         /* Is this a delegated open? */
-        if (test_bit(NFS_DELEGATED_STATE, &state->flags)) {
+        if (NFS_I(state->inode)->delegation_state != 0) {
                 /* Yes: cache locks! */
                 status = do_vfs_lock(request->fl_file, request);
                 /* ...but avoid races with delegation recall... */
                 if (status < 0 || test_bit(NFS_DELEGATED_STATE, &state->flags))
-                        goto out;
+                        return status;
         }
+        down_read(&clp->cl_sem);
         status = nfs4_set_lock_state(state, request);
         if (status != 0)
                 goto out;
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 0675f3215e0a..5ef4c57618fe 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -644,12 +644,15 @@ void nfs4_copy_stateid(nfs4_stateid *dst, struct nfs4_state *state, fl_owner_t f
 
 struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter)
 {
+        struct rpc_sequence *sequence = counter->sequence;
         struct nfs_seqid *new;
 
         new = kmalloc(sizeof(*new), GFP_KERNEL);
         if (new != NULL) {
                 new->sequence = counter;
-                INIT_LIST_HEAD(&new->list);
+                spin_lock(&sequence->lock);
+                list_add_tail(&new->list, &sequence->list);
+                spin_unlock(&sequence->lock);
         }
         return new;
 }
@@ -658,12 +661,10 @@ void nfs_free_seqid(struct nfs_seqid *seqid)
 {
         struct rpc_sequence *sequence = seqid->sequence->sequence;
 
-        if (!list_empty(&seqid->list)) {
-                spin_lock(&sequence->lock);
-                list_del(&seqid->list);
-                spin_unlock(&sequence->lock);
-        }
-        rpc_wake_up_next(&sequence->wait);
+        spin_lock(&sequence->lock);
+        list_del(&seqid->list);
+        spin_unlock(&sequence->lock);
+        rpc_wake_up(&sequence->wait);
         kfree(seqid);
 }
 
@@ -722,11 +723,10 @@ int nfs_wait_on_sequence(struct nfs_seqid *seqid, struct rpc_task *task)
         if (sequence->list.next == &seqid->list)
                 goto out;
         spin_lock(&sequence->lock);
-        if (!list_empty(&sequence->list)) {
+        if (sequence->list.next != &seqid->list) {
                 rpc_sleep_on(&sequence->wait, task, NULL, NULL);
                 status = -EAGAIN;
-        } else
-                list_add(&seqid->list, &sequence->list);
+        }
         spin_unlock(&sequence->lock);
 out:
         return status;
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index a48a003242c0..e1e3ca5d746b 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -375,6 +375,7 @@ nfs_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
 
         dprintk("NFS call  link %s\n", name->name);
         status = rpc_call(NFS_CLIENT(inode), NFSPROC_LINK, &arg, NULL, 0);
+        nfs_mark_for_revalidate(inode);
         nfs_mark_for_revalidate(dir);
         dprintk("NFS reply link: %d\n", status);
         return status;
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 8f71e766cc5d..3107908e5f3f 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -189,6 +189,7 @@ static int nfs_writepage_sync(struct nfs_open_context *ctx, struct inode *inode,
                 (long long)NFS_FILEID(inode),
                 count, (long long)(page_offset(page) + offset));
 
+        set_page_writeback(page);
         nfs_begin_data_update(inode);
         do {
                 if (count < wsize)
@@ -221,6 +222,7 @@ static int nfs_writepage_sync(struct nfs_open_context *ctx, struct inode *inode,
 
 io_error:
         nfs_end_data_update(inode);
+        end_page_writeback(page);
         nfs_writedata_free(wdata);
         return written ? written : result;
 }
@@ -929,7 +931,7 @@ static int nfs_flush_multi(struct list_head *head, struct inode *inode, int how)
         atomic_set(&req->wb_complete, requests);
 
         ClearPageError(page);
-        SetPageWriteback(page);
+        set_page_writeback(page);
         offset = 0;
         nbytes = req->wb_bytes;
         do {
@@ -992,7 +994,7 @@ static int nfs_flush_one(struct list_head *head, struct inode *inode, int how)
                 nfs_list_remove_request(req);
                 nfs_list_add_request(req, &data->pages);
                 ClearPageError(req->wb_page);
-                SetPageWriteback(req->wb_page);
+                set_page_writeback(req->wb_page);
                 *pages++ = req->wb_page;
                 count += req->wb_bytes;
         }
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 9ab97cef0daa..50bd5a8f0446 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -402,12 +402,11 @@ struct numa_maps {
 /*
  * Calculate numa node maps for a vma
  */
-static struct numa_maps *get_numa_maps(const struct vm_area_struct *vma)
+static struct numa_maps *get_numa_maps(struct vm_area_struct *vma)
 {
+        int i;
         struct page *page;
         unsigned long vaddr;
-        struct mm_struct *mm = vma->vm_mm;
-        int i;
         struct numa_maps *md = kmalloc(sizeof(struct numa_maps), GFP_KERNEL);
 
         if (!md)
@@ -420,7 +419,7 @@ static struct numa_maps *get_numa_maps(const struct vm_area_struct *vma)
                 md->node[i] =0;
 
         for (vaddr = vma->vm_start; vaddr < vma->vm_end; vaddr += PAGE_SIZE) {
-                page = follow_page(mm, vaddr, 0);
+                page = follow_page(vma, vaddr, 0);
                 if (page) {
                         int count = page_mapcount(page);
 
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 5f82352b97e1..0a044ad98885 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -2194,7 +2194,7 @@ static int map_block_for_writepage(struct inode *inode,
         INITIALIZE_PATH(path);
         int pos_in_item;
         int jbegin_count = JOURNAL_PER_BALANCE_CNT;
-        loff_t byte_offset = (block << inode->i_sb->s_blocksize_bits) + 1;
+        loff_t byte_offset = ((loff_t)block << inode->i_sb->s_blocksize_bits)+1;
         int retval;
         int use_get_block = 0;
         int bytes_copied = 0;
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 4b15761434bc..68b7b78638ff 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2757,6 +2757,15 @@ int journal_init(struct super_block *p_s_sb, const char *j_dev_name,
         journal->j_cnode_used = 0;
         journal->j_must_wait = 0;
 
+        if (journal->j_cnode_free == 0) {
+                reiserfs_warning(p_s_sb, "journal-2004: Journal cnode memory "
+                                 "allocation failed (%ld bytes). Journal is "
+                                 "too large for available memory. Usually "
+                                 "this is due to a journal that is too large.",
+                                 sizeof (struct reiserfs_journal_cnode) * num_cnodes);
+                goto free_and_return;
+        }
+
         init_journal_hash(p_s_sb);
         jl = journal->j_current_jl;
         jl->j_list_bitmap = get_list_bitmap(p_s_sb, jl);
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index c6108971b4e6..94d3cdfbf9b8 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -941,13 +941,12 @@ __linvfs_get_block(
         int                     retpbbm = 1;
         int                     error;
 
-        if (blocks) {
-                offset = blocks << inode->i_blkbits;    /* 64 bit goodness */
-                size = (ssize_t) min_t(xfs_off_t, offset, LONG_MAX);
-        } else {
-                size = 1 << inode->i_blkbits;
-        }
         offset = (xfs_off_t)iblock << inode->i_blkbits;
+        if (blocks)
+                size = (ssize_t) min_t(xfs_off_t, LONG_MAX,
+                                        (xfs_off_t)blocks << inode->i_blkbits);
+        else
+                size = 1 << inode->i_blkbits;
 
         VOP_BMAP(vp, offset, size,
                 create ? flags : BMAPI_READ, &iomap, &retpbbm, error);
@@ -1007,7 +1006,7 @@ __linvfs_get_block(
                 ASSERT(iomap.iomap_bsize - iomap.iomap_delta > 0);
                 offset = min_t(xfs_off_t,
                                 iomap.iomap_bsize - iomap.iomap_delta,
-                                blocks << inode->i_blkbits);
+                                (xfs_off_t)blocks << inode->i_blkbits);
                 bh_result->b_size = (u32) min_t(xfs_off_t, UINT_MAX, offset);
         }
 
diff --git a/fs/xfs/xfs_attr_leaf.c b/fs/xfs/xfs_attr_leaf.c
index 35e557b00db2..1c7421840c18 100644
--- a/fs/xfs/xfs_attr_leaf.c
+++ b/fs/xfs/xfs_attr_leaf.c
@@ -310,7 +310,8 @@ xfs_attr_shortform_remove(xfs_da_args_t *args)
          * Fix up the start offset of the attribute fork
          */
         totsize -= size;
-        if (totsize == sizeof(xfs_attr_sf_hdr_t) && !args->addname) {
+        if (totsize == sizeof(xfs_attr_sf_hdr_t) && !args->addname &&
+            !(mp->m_flags & XFS_MOUNT_COMPAT_ATTR)) {
                 /*
                  * Last attribute now removed, revert to original
                  * inode format making all literal area available
@@ -328,7 +329,8 @@ xfs_attr_shortform_remove(xfs_da_args_t *args)
                 xfs_idata_realloc(dp, -size, XFS_ATTR_FORK);
                 dp->i_d.di_forkoff = xfs_attr_shortform_bytesfit(dp, totsize);
                 ASSERT(dp->i_d.di_forkoff);
-                ASSERT(totsize > sizeof(xfs_attr_sf_hdr_t) || args->addname);
+                ASSERT(totsize > sizeof(xfs_attr_sf_hdr_t) || args->addname ||
+                        (mp->m_flags & XFS_MOUNT_COMPAT_ATTR));
                 dp->i_afp->if_ext_max =
                         XFS_IFORK_ASIZE(dp) / (uint)sizeof(xfs_bmbt_rec_t);
                 dp->i_df.if_ext_max =
@@ -737,7 +739,8 @@ xfs_attr_shortform_allfit(xfs_dabuf_t *bp, xfs_inode_t *dp)
                                 + name_loc->namelen
                                 + INT_GET(name_loc->valuelen, ARCH_CONVERT);
         }
-        if (bytes == sizeof(struct xfs_attr_sf_hdr))
+        if (!(dp->i_mount->m_flags & XFS_MOUNT_COMPAT_ATTR) &&
+            (bytes == sizeof(struct xfs_attr_sf_hdr)))
                 return(-1);
         return(xfs_attr_shortform_bytesfit(dp, bytes));
 }
@@ -775,6 +778,8 @@ xfs_attr_leaf_to_shortform(xfs_dabuf_t *bp, xfs_da_args_t *args, int forkoff)
                 goto out;
 
         if (forkoff == -1) {
+                ASSERT(!(dp->i_mount->m_flags & XFS_MOUNT_COMPAT_ATTR));
+
                 /*
                  * Last attribute was removed, revert to original
                  * inode format making all literal area available
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 7ceabd0e2d9d..d1236d6f4045 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -550,7 +550,7 @@ xfs_fs_goingdown(
                 struct vfs *vfsp = XFS_MTOVFS(mp);
                 struct super_block *sb = freeze_bdev(vfsp->vfs_super->s_bdev);
 
-                if (sb) {
+                if (sb && !IS_ERR(sb)) {
                         xfs_force_shutdown(mp, XFS_FORCE_UMOUNT);
                         thaw_bdev(sb->s_bdev, sb);
                 }
diff --git a/fs/xfs/xfs_iomap.h b/fs/xfs/xfs_iomap.h
index fcd6d63bb68b..3ce204a524b0 100644
--- a/fs/xfs/xfs_iomap.h
+++ b/fs/xfs/xfs_iomap.h
@@ -69,7 +69,7 @@ typedef struct xfs_iomap {
         xfs_buftarg_t           *iomap_target;
         xfs_off_t               iomap_offset;   /* offset of mapping, bytes */
         xfs_off_t               iomap_bsize;    /* size of mapping, bytes */
-        size_t                  iomap_delta;    /* offset into mapping, bytes */
+        xfs_off_t               iomap_delta;    /* offset into mapping, bytes */
         iomap_flags_t           iomap_flags;
 } xfs_iomap_t;
 
diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
index 8f285149681f..4518b188ade6 100644
--- a/fs/xfs/xfs_log_priv.h
+++ b/fs/xfs/xfs_log_priv.h
@@ -494,10 +494,8 @@ typedef struct log {
 
 #define XLOG_FORCED_SHUTDOWN(log)       ((log)->l_flags & XLOG_IO_ERROR)
 
-#define XLOG_GRANT_SUB_SPACE(log,bytes,type)    \
-        xlog_grant_sub_space(log,bytes,type)
-static inline void xlog_grant_sub_space(struct log *log, int bytes, int type)
-{
+#define XLOG_GRANT_SUB_SPACE(log,bytes,type)                            \
+    {                                                                   \
         if (type == 'w') {                                              \
                 (log)->l_grant_write_bytes -= (bytes);                  \
                 if ((log)->l_grant_write_bytes < 0) {                   \
@@ -511,13 +509,9 @@ static inline void xlog_grant_sub_space(struct log *log, int bytes, int type)
                         (log)->l_grant_reserve_cycle--;                 \
                 }                                                       \
          }                                                              \
-}
-
-#define XLOG_GRANT_ADD_SPACE(log,bytes,type)    \
-        xlog_grant_add_space(log,bytes,type)
-static inline void
-xlog_grant_add_space(struct log *log, int bytes, int type)
-{
+    }
+#define XLOG_GRANT_ADD_SPACE(log,bytes,type)                            \
+    {                                                                   \
         if (type == 'w') {                                              \
                 (log)->l_grant_write_bytes += (bytes);                  \
                 if ((log)->l_grant_write_bytes > (log)->l_logsize) {    \
@@ -531,12 +525,9 @@ xlog_grant_add_space(struct log *log, int bytes, int type)
                         (log)->l_grant_reserve_cycle++;                 \
                 }                                                       \
          }                                                              \
-}
-
-#define XLOG_INS_TICKETQ(q, tic)        xlog_ins_ticketq(q, tic)
-static inline void
-xlog_ins_ticketq(struct xlog_ticket *q, struct xlog_ticket *tic)
-{                                                       \
+    }
+#define XLOG_INS_TICKETQ(q, tic)                        \
+    {                                                   \
         if (q) {                                        \
                 (tic)->t_next       = (q);              \
                 (tic)->t_prev       = (q)->t_prev;      \
@@ -547,12 +538,9 @@ xlog_ins_ticketq(struct xlog_ticket *q, struct xlog_ticket *tic)
                 (q) = (tic);                            \
         }                                               \
         (tic)->t_flags |= XLOG_TIC_IN_Q;                \
-}
-
-#define XLOG_DEL_TICKETQ(q, tic)        xlog_del_ticketq(q, tic)
-static inline void
-xlog_del_ticketq(struct xlog_ticket *q, struct xlog_ticket *tic)
-{                                                       \
+    }
+#define XLOG_DEL_TICKETQ(q, tic)                        \
+    {                                                   \
         if ((tic) == (tic)->t_next) {                   \
                 (q) = NULL;                             \
         } else {                                        \
@@ -562,7 +550,7 @@ xlog_del_ticketq(struct xlog_ticket *q, struct xlog_ticket *tic)
         }                                               \
         (tic)->t_next = (tic)->t_prev = NULL;           \
         (tic)->t_flags &= ~XLOG_TIC_IN_Q;               \
-}
+    }
 
 /* common routines */
 extern xfs_lsn_t xlog_assign_tail_lsn(struct xfs_mount *mp);
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 7c1f74531463..e03fa2a3d5ed 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -3958,8 +3958,9 @@ xfs_finish_reclaim_all(xfs_mount_t *mp, int noblock)
                                 }
                         }
                         XFS_MOUNT_IUNLOCK(mp);
-                        xfs_finish_reclaim(ip, noblock,
-                                XFS_IFLUSH_DELWRI_ELSE_ASYNC);
+                        if (xfs_finish_reclaim(ip, noblock,
+                                        XFS_IFLUSH_DELWRI_ELSE_ASYNC))
+                                delay(1);
                         purged = 1;
                         break;
                 }