20 files changed, 342 insertions, 138 deletions
diff --git a/fs/buffer.c b/fs/buffer.c
index e8504b65176c..1d0852fa728b 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2365,6 +2365,10 @@ failed:
 }
 EXPORT_SYMBOL(nobh_prepare_write);
+/*
+ * Make sure any changes to nobh_commit_write() are reflected in
+ * nobh_truncate_page(), since it doesn't call commit_write().
+ */
 int nobh_commit_write(struct file *file, struct page *page,
                unsigned from, unsigned to)
 {
@@ -2466,6 +2470,11 @@ int nobh_truncate_page(struct address_space *mapping, loff_t from)
                memset(kaddr + offset, 0, PAGE_CACHE_SIZE - offset);
                flush_dcache_page(page);
                kunmap_atomic(kaddr, KM_USER0);
+                /*
+                 * It would be more correct to call aops->commit_write()
+                 * here, but this is more efficient.
+                 */
+                SetPageUptodate(page);
                set_page_dirty(page);
        }
        unlock_page(page);
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 5fe13593b57f..6247628bdaed 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,10 @@
+Verison 1.48
+------------
+Fix mtime bouncing around from local idea of last write times to remote time.
+Fix hang (in i_size_read) when simultaneous size update of same remote file
+on smp system corrupts sequence number. Do not reread unnecessarily partial page
+(which we are about to overwrite anyway) when writing out file opened rw.
 Version 1.47
 ------------
 Fix oops in list_del during mount caused by unaligned string.
diff --git a/fs/cifs/Makefile b/fs/cifs/Makefile
index a26f26ed5a17..6ecd9d6ba3f3 100644
--- a/fs/cifs/Makefile
+++ b/fs/cifs/Makefile
@@ -3,4 +3,4 @@
 #
 obj-$(CONFIG_CIFS) += cifs.o
-cifs-objs := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o link.o misc.o netmisc.o smbdes.o smbencrypt.o transport.o asn1.o md4.o md5.o cifs_unicode.o nterr.o xattr.o cifsencrypt.o fcntl.o readdir.o ioctl.o sess.o
+cifs-objs := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o link.o misc.o netmisc.o smbdes.o smbencrypt.o transport.o asn1.o md4.o md5.o cifs_unicode.o nterr.o xattr.o cifsencrypt.o fcntl.o readdir.o ioctl.o sess.o export.o
diff --git a/fs/cifs/TODO b/fs/cifs/TODO
index 68372946dc92..d7b9c27c942d 100644
--- a/fs/cifs/TODO
+++ b/fs/cifs/TODO
@@ -18,7 +18,9 @@ better)
 d) Kerberos/SPNEGO session setup support - (started)
-e) NTLMv2 authentication (mostly implemented)
+e) NTLMv2 authentication (mostly implemented - double check
+that NTLMv2 signing works, also need to cleanup now unneeded SessSetup code in
+fs/cifs/connect.c)
 f) MD5-HMAC signing SMB PDUs when SPNEGO style SessionSetup 
 used (Kerberos or NTLMSSP). Signing alreadyimplemented for NTLM
@@ -88,11 +90,12 @@ w) Finish up the dos time conversion routines needed to return old server
 time to the client (default time, of now or time 0 is used now for these 
 very old servers)
-x) Add support for OS/2 (LANMAN 1.2 and LANMAN2.1 based SMB servers)
+x) In support for OS/2 (LANMAN 1.2 and LANMAN2.1 based SMB servers) 
+need to add ability to set time to server (utimes command)
 y) Finish testing of Windows 9x/Windows ME server support (started).
-KNOWN BUGS (updated April 29, 2005)
+KNOWN BUGS (updated February 26, 2007)
 ====================================
 See http://bugzilla.samba.org - search on product "CifsVFS" for
 current bug list.
@@ -107,11 +110,6 @@ but recognizes them
 succeed but still return access denied (appears to be Windows 
 server not cifs client problem) and has not been reproduced recently.
 NTFS partitions do not have this problem.
-4) debug connectathon lock test case 10 which fails against
-Samba (may be unmappable due to POSIX to Windows lock model
-differences but worth investigating).  Also debug Samba to 
-see why lock test case 7 takes longer to complete to Samba
-than to Windows.
 Misc testing to do
 ==================
@@ -119,7 +117,7 @@ Misc testing to do
 types. Try nested symlinks (8 deep). Return max path name in stat -f information
 2) Modify file portion of ltp so it can run against a mounted network
-share and run it against cifs vfs.
+share and run it against cifs vfs in automated fashion.
 3) Additional performance testing and optimization using iozone and similar - 
 there are some easy changes that can be done to parallelize sequential writes,
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index bc2c0ac27169..faba4d69fe91 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1,7 +1,7 @@
 /*
 *   fs/cifs/cifsfs.c
 *
- *   Copyright (C) International Business Machines  Corp., 2002,2004
+ *   Copyright (C) International Business Machines  Corp., 2002,2007
 *   Author(s): Steve French (sfrench@us.ibm.com)
 *
 *   Common Internet FileSystem (CIFS) client
@@ -47,7 +47,11 @@
 #ifdef CONFIG_CIFS_QUOTA
 static struct quotactl_ops cifs_quotactl_ops;
-#endif
+#endif /* QUOTA */
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+extern struct export_operations cifs_export_ops;
+#endif /* EXPERIMENTAL */
 int cifsFYI = 0;
 int cifsERROR = 1;
@@ -62,8 +66,8 @@ unsigned int extended_security = CIFSSEC_DEF;
 unsigned int sign_CIFS_PDUs = 1;
 extern struct task_struct * oplockThread; /* remove sparse warning */
 struct task_struct * oplockThread = NULL;
-extern struct task_struct * dnotifyThread; /* remove sparse warning */
+/* extern struct task_struct * dnotifyThread; remove sparse warning */
-struct task_struct * dnotifyThread = NULL;
+static struct task_struct * dnotifyThread = NULL;
 static const struct super_operations cifs_super_ops;
 unsigned int CIFSMaxBufSize = CIFS_MAX_MSGSIZE;
 module_param(CIFSMaxBufSize, int, 0);
@@ -110,6 +114,10 @@ cifs_read_super(struct super_block *sb, void *data,
        sb->s_magic = CIFS_MAGIC_NUMBER;
        sb->s_op = &cifs_super_ops;
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+        if(experimEnabled != 0)
+                sb->s_export_op = &cifs_export_ops;
+#endif /* EXPERIMENTAL */       
 /*      if(cifs_sb->tcon->ses->server->maxBuf > MAX_CIFS_HDR_SIZE + 512)
            sb->s_blocksize = cifs_sb->tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE; */
 #ifdef CONFIG_CIFS_QUOTA
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index c97c08eb481a..2c2c384894d8 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -38,8 +38,8 @@ extern const struct address_space_operations cifs_addr_ops_smallbuf;
 /* Functions related to super block operations */
 /* extern const struct super_operations cifs_super_ops;*/
 extern void cifs_read_inode(struct inode *);
-extern void cifs_delete_inode(struct inode *);
+/*extern void cifs_delete_inode(struct inode *);*/  /* BB not needed yet */
-/* extern void cifs_write_inode(struct inode *); *//* BB not needed yet */
+/* extern void cifs_write_inode(struct inode *); */ /* BB not needed yet */
 /* Functions related to inodes */
 extern const struct inode_operations cifs_dir_inode_ops;
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 74d3ccbb103b..e4de8eba4780 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -525,15 +525,17 @@ require use of the stronger protocol */
 */
 GLOBAL_EXTERN struct smbUidInfo *GlobalUidList[UID_HASH];
-GLOBAL_EXTERN struct list_head GlobalServerList; /* BB not implemented yet */
+/* GLOBAL_EXTERN struct list_head GlobalServerList; BB not implemented yet */
 GLOBAL_EXTERN struct list_head GlobalSMBSessionList;
 GLOBAL_EXTERN struct list_head GlobalTreeConnectionList;
 GLOBAL_EXTERN rwlock_t GlobalSMBSeslock;  /* protects list inserts on 3 above */
 GLOBAL_EXTERN struct list_head GlobalOplock_Q;
-GLOBAL_EXTERN struct list_head GlobalDnotifyReqList; /* Outstanding dir notify requests */
+/* Outstanding dir notify requests */
-GLOBAL_EXTERN struct list_head GlobalDnotifyRsp_Q;/* DirNotify response queue */
+GLOBAL_EXTERN struct list_head GlobalDnotifyReqList;
+/* DirNotify response queue */
+GLOBAL_EXTERN struct list_head GlobalDnotifyRsp_Q;
 /*
 * Global transaction id (XID) information
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 2498d644827c..0efdf35aab2c 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -220,6 +220,9 @@
 */
 #define CIFS_NO_HANDLE        0xFFFF
+#define NO_CHANGE_64          0xFFFFFFFFFFFFFFFFULL
+#define NO_CHANGE_32          0xFFFFFFFFUL
 /* IPC$ in ASCII */
 #define CIFS_IPC_RESOURCE "\x49\x50\x43\x24"
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 6148b82170c4..32eb1acab630 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -43,7 +43,7 @@ extern void _FreeXid(unsigned int);
 #define FreeXid(curr_xid) {_FreeXid(curr_xid); cFYI(1,("CIFS VFS: leaving %s (xid = %d) rc = %d",__FUNCTION__,curr_xid,(int)rc));}
 extern char *build_path_from_dentry(struct dentry *);
 extern char *build_wildcard_path_from_dentry(struct dentry *direntry);
-extern void renew_parental_timestamps(struct dentry *direntry);
+/* extern void renew_parental_timestamps(struct dentry *direntry);*/
 extern int SendReceive(const unsigned int /* xid */ , struct cifsSesInfo *,
                        struct smb_hdr * /* input */ ,
                        struct smb_hdr * /* out */ ,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 24364106b8f9..48fc0c2ab0e5 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -4803,6 +4803,16 @@ setPermsRetry:
        pSMB->InformationLevel = cpu_to_le16(SMB_SET_FILE_UNIX_BASIC);
        pSMB->Reserved4 = 0;
        pSMB->hdr.smb_buf_length += byte_count;
+        /* Samba server ignores set of file size to zero due to bugs in some
+        older clients, but we should be precise - we use SetFileSize to
+        set file size and do not want to truncate file size to zero
+        accidently as happened on one Samba server beta by putting
+        zero instead of -1 here */ 
+        data_offset->EndOfFile = NO_CHANGE_64;
+        data_offset->NumOfBytes = NO_CHANGE_64;
+        data_offset->LastStatusChange = NO_CHANGE_64;
+        data_offset->LastAccessTime = NO_CHANGE_64;
+        data_offset->LastModificationTime = NO_CHANGE_64;
        data_offset->Uid = cpu_to_le64(uid);
        data_offset->Gid = cpu_to_le64(gid);
        /* better to leave device as zero when it is  */
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 66b825ade3e1..3fad638d26d3 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -31,7 +31,7 @@
 #include "cifs_debug.h"
 #include "cifs_fs_sb.h"
-void
+static void
 renew_parental_timestamps(struct dentry *direntry)
 {
        /* BB check if there is a way to get the kernel to do this or if we really need this */
diff --git a/fs/cifs/export.c b/fs/cifs/export.c
new file mode 100644
index 000000000000..1d716392c3aa
--- /dev/null
+++ b/fs/cifs/export.c
@@ -0,0 +1,52 @@
+/*
+ *   fs/cifs/export.c
+ *
+ *   Copyright (C) International Business Machines  Corp., 2007
+ *   Author(s): Steve French (sfrench@us.ibm.com)
+ *
+ *   Common Internet FileSystem (CIFS) client
+ * 
+ *   Operations related to support for exporting files via NFSD
+ *
+ *   This library is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU Lesser General Public License as published
+ *   by the Free Software Foundation; either version 2.1 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
+ *   the GNU Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public License
+ *   along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+ 
+ /* 
+  * See Documentation/filesystems/Exporting
+  * and examples in fs/exportfs
+  */
+#include <linux/fs.h>
+ 
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+ 
+static struct dentry *cifs_get_parent(struct dentry *dentry)
+{
+        /* BB need to add code here eventually to enable export via NFSD */
+        return ERR_PTR(-EACCES);
+}
+ 
+struct export_operations cifs_export_ops = {
+        .get_parent = cifs_get_parent,
+/*      Following five export operations are unneeded so far and can default */         
+/*      .get_dentry =
+        .get_name =
+        .find_exported_dentry =
+        .decode_fh = 
+        .encode_fs =  */
+ };
+ 
+#endif /* EXPERIMENTAL */
+ 
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index a1265c9bfec0..2d3275bedb55 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -879,18 +879,19 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
        cifs_stats_bytes_written(pTcon, total_written);
        /* since the write may have blocked check these pointers again */
-        if (file->f_path.dentry) {
+        if ((file->f_path.dentry) && (file->f_path.dentry->d_inode)) {
-                if (file->f_path.dentry->d_inode) {
+                struct inode *inode = file->f_path.dentry->d_inode;
-                        struct inode *inode = file->f_path.dentry->d_inode;
+/* Do not update local mtime - server will set its actual value on write                
-                        inode->i_ctime = inode->i_mtime =
+ *              inode->i_ctime = inode->i_mtime = 
-                                current_fs_time(inode->i_sb);
+ *                      current_fs_time(inode->i_sb);*/
-                        if (total_written > 0) {
+                if (total_written > 0) {
-                                if (*poffset > file->f_path.dentry->d_inode->i_size)
+                        spin_lock(&inode->i_lock);
-                                        i_size_write(file->f_path.dentry->d_inode,
+                        if (*poffset > file->f_path.dentry->d_inode->i_size)
+                                i_size_write(file->f_path.dentry->d_inode,
                                        *poffset);
-                        }
+                        spin_unlock(&inode->i_lock);
-                        mark_inode_dirty_sync(file->f_path.dentry->d_inode);
                }
+                mark_inode_dirty_sync(file->f_path.dentry->d_inode);    
        }
        FreeXid(xid);
        return total_written;
@@ -1012,18 +1013,18 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
        cifs_stats_bytes_written(pTcon, total_written);
        /* since the write may have blocked check these pointers again */
-        if (file->f_path.dentry) {
+        if ((file->f_path.dentry) && (file->f_path.dentry->d_inode)) {
-                if (file->f_path.dentry->d_inode) {
 /*BB We could make this contingent on superblock ATIME flag too */
-/*                      file->f_path.dentry->d_inode->i_ctime =
+/*              file->f_path.dentry->d_inode->i_ctime =
-                        file->f_path.dentry->d_inode->i_mtime = CURRENT_TIME;*/
+                file->f_path.dentry->d_inode->i_mtime = CURRENT_TIME;*/
-                        if (total_written > 0) {
+                if (total_written > 0) {
-                                if (*poffset > file->f_path.dentry->d_inode->i_size)
+                        spin_lock(&file->f_path.dentry->d_inode->i_lock);
-                                        i_size_write(file->f_path.dentry->d_inode,
+                        if (*poffset > file->f_path.dentry->d_inode->i_size)
-                                                     *poffset);
+                                i_size_write(file->f_path.dentry->d_inode,
-                        }
+                                             *poffset);
-                        mark_inode_dirty_sync(file->f_path.dentry->d_inode);
+                        spin_unlock(&file->f_path.dentry->d_inode->i_lock);
                }
+                mark_inode_dirty_sync(file->f_path.dentry->d_inode);
        }
        FreeXid(xid);
        return total_written;
@@ -1400,6 +1401,7 @@ static int cifs_commit_write(struct file *file, struct page *page,
        xid = GetXid();
        cFYI(1, ("commit write for page %p up to position %lld for %d", 
                 page, position, to));
+        spin_lock(&inode->i_lock);
        if (position > inode->i_size) {
                i_size_write(inode, position);
                /* if (file->private_data == NULL) {
@@ -1429,6 +1431,7 @@ static int cifs_commit_write(struct file *file, struct page *page,
                        cFYI(1, (" SetEOF (commit write) rc = %d", rc));
                } */
        }
+        spin_unlock(&inode->i_lock);
        if (!PageUptodate(page)) {
                position =  ((loff_t)page->index << PAGE_CACHE_SHIFT) + offset;
                /* can not rely on (or let) writepage write this data */
@@ -1989,34 +1992,52 @@ static int cifs_prepare_write(struct file *file, struct page *page,
        unsigned from, unsigned to)
 {
        int rc = 0;
-        loff_t offset = (loff_t)page->index << PAGE_CACHE_SHIFT;
+        loff_t i_size;
+        loff_t offset;
        cFYI(1, ("prepare write for page %p from %d to %d",page,from,to));
-        if (!PageUptodate(page)) {
+        if (PageUptodate(page))
-        /*      if (to - from != PAGE_CACHE_SIZE) {
+                return 0;
-                        void *kaddr = kmap_atomic(page, KM_USER0);
+        /* If we are writing a full page it will be up to date,
+           no need to read from the server */
+        if ((to == PAGE_CACHE_SIZE) && (from == 0)) {
+                SetPageUptodate(page);
+                return 0;
+        }
+        offset = (loff_t)page->index << PAGE_CACHE_SHIFT;
+        i_size = i_size_read(page->mapping->host);
+        if ((offset >= i_size) ||
+            ((from == 0) && (offset + to) >= i_size)) {
+                /*
+                 * We don't need to read data beyond the end of the file.
+                 * zero it, and set the page uptodate
+                 */
+                void *kaddr = kmap_atomic(page, KM_USER0);
+                if (from)
                        memset(kaddr, 0, from);
+                if (to < PAGE_CACHE_SIZE)
                        memset(kaddr + to, 0, PAGE_CACHE_SIZE - to);
-                        flush_dcache_page(page);
+                flush_dcache_page(page);
-                        kunmap_atomic(kaddr, KM_USER0);
+                kunmap_atomic(kaddr, KM_USER0);
-                } */
+                SetPageUptodate(page);
-                /* If we are writing a full page it will be up to date,
+        } else if ((file->f_flags & O_ACCMODE) != O_WRONLY) {
-                   no need to read from the server */
-                if ((to == PAGE_CACHE_SIZE) && (from == 0))
-                        SetPageUptodate(page);
                /* might as well read a page, it is fast enough */
-                if ((file->f_flags & O_ACCMODE) != O_WRONLY) {
+                rc = cifs_readpage_worker(file, page, &offset);
-                        rc = cifs_readpage_worker(file, page, &offset);
+        } else {
-                } else {
+                /* we could try using another file handle if there is one -
-                /* should we try using another file handle if there is one -
+                   but how would we lock it to prevent close of that handle
-                   how would we lock it to prevent close of that handle
+                   racing with this read? In any case
-                   racing with this read?
+                   this will be written out by commit_write so is fine */
-                   In any case this will be written out by commit_write */
-                }
        }
-        /* BB should we pass any errors back? 
+        /* we do not need to pass errors back 
-           e.g. if we do not have read access to the file */
+           e.g. if we do not have read access to the file 
+           because cifs_commit_write will do the right thing.  -- shaggy */
        return 0;
 }
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 37c6ce87416b..86b9dbbd8441 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -143,10 +143,10 @@ int cifs_get_inode_info_unix(struct inode **pinode,
                inode->i_gid = le64_to_cpu(findData.Gid);
                inode->i_nlink = le64_to_cpu(findData.Nlinks);
+                spin_lock(&inode->i_lock);
                if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                /* can not safely change the file size here if the
                   client is writing to it due to potential races */
                        i_size_write(inode, end_of_file);
                /* blksize needs to be multiple of two. So safer to default to
@@ -162,6 +162,7 @@ int cifs_get_inode_info_unix(struct inode **pinode,
                /* for this calculation */
                        inode->i_blocks = (512 - 1 + num_of_bytes) >> 9;
                }
+                spin_unlock(&inode->i_lock);
                if (num_of_bytes < end_of_file)
                        cFYI(1, ("allocation size less than end of file"));
@@ -496,6 +497,8 @@ int cifs_get_inode_info(struct inode **pinode,
                /* BB add code here -
                   validate if device or weird share or device type? */
                }
+                
+                spin_lock(&inode->i_lock);
                if (is_size_safe_to_change(cifsInfo, le64_to_cpu(pfindData->EndOfFile))) {
                        /* can not safely shrink the file size here if the
                           client is writing to it due to potential races */
@@ -506,6 +509,7 @@ int cifs_get_inode_info(struct inode **pinode,
                        inode->i_blocks = (512 - 1 + le64_to_cpu(
                                           pfindData->AllocationSize)) >> 9;
                }
+                spin_unlock(&inode->i_lock);
                inode->i_nlink = le32_to_cpu(pfindData->NumberOfLinks);
@@ -834,8 +838,10 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
        if (!rc) {
                drop_nlink(inode);
+                spin_lock(&direntry->d_inode->i_lock);
                i_size_write(direntry->d_inode,0);
                clear_nlink(direntry->d_inode);
+                spin_unlock(&direntry->d_inode->i_lock);
        }
        cifsInode = CIFS_I(direntry->d_inode);
@@ -1128,6 +1134,52 @@ static int cifs_truncate_page(struct address_space *mapping, loff_t from)
        return rc;
 }
+static int cifs_vmtruncate(struct inode * inode, loff_t offset)
+{
+        struct address_space *mapping = inode->i_mapping;
+        unsigned long limit;
+        spin_lock(&inode->i_lock);
+        if (inode->i_size < offset)
+                goto do_expand;
+        /*
+         * truncation of in-use swapfiles is disallowed - it would cause
+         * subsequent swapout to scribble on the now-freed blocks.
+         */
+        if (IS_SWAPFILE(inode)) {
+                spin_unlock(&inode->i_lock);
+                goto out_busy;
+        }
+        i_size_write(inode, offset);
+        spin_unlock(&inode->i_lock);
+        unmap_mapping_range(mapping, offset + PAGE_SIZE - 1, 0, 1);
+        truncate_inode_pages(mapping, offset);
+        goto out_truncate;
+do_expand:
+        limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
+        if (limit != RLIM_INFINITY && offset > limit) {
+                spin_unlock(&inode->i_lock);
+                goto out_sig;
+        }
+        if (offset > inode->i_sb->s_maxbytes) {
+                spin_unlock(&inode->i_lock);
+                goto out_big;
+        }
+        i_size_write(inode, offset);
+        spin_unlock(&inode->i_lock);
+out_truncate:
+        if (inode->i_op && inode->i_op->truncate)
+                inode->i_op->truncate(inode);
+        return 0;
+out_sig:
+        send_sig(SIGXFSZ, current, 0);
+out_big:
+        return -EFBIG;
+out_busy:
+        return -ETXTBSY;
+}
 int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
 {
        int xid;
@@ -1244,7 +1296,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                   */
                if (rc == 0) {
-                        rc = vmtruncate(direntry->d_inode, attrs->ia_size);
+                        rc = cifs_vmtruncate(direntry->d_inode, attrs->ia_size);
                        cifs_truncate_page(direntry->d_inode->i_mapping,
                                           direntry->d_inode->i_size);
                } else 
@@ -1379,9 +1431,11 @@ cifs_setattr_exit:
        return rc;
 }
+#if 0
 void cifs_delete_inode(struct inode *inode)
 {
        cFYI(1, ("In cifs_delete_inode, inode = 0x%p", inode));
        /* may have to add back in if and when safe distributed caching of
           directories added e.g. via FindNotify */
 }
+#endif
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index c444798f0740..44cfb528797d 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -3,7 +3,7 @@
 *
 *   Directory search handling
 * 
- *   Copyright (C) International Business Machines  Corp., 2004, 2005
+ *   Copyright (C) International Business Machines  Corp., 2004, 2007
 *   Author(s): Steve French (sfrench@us.ibm.com)
 *
 *   This library is free software; you can redistribute it and/or modify
@@ -226,6 +226,7 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
                atomic_set(&cifsInfo->inUse, 1);
        }
+        spin_lock(&tmp_inode->i_lock);
        if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                /* can not safely change the file size here if the 
                client is writing to it due to potential races */
@@ -235,6 +236,7 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
        /* for this calculation, even though the reported blocksize is larger */
                tmp_inode->i_blocks = (512 - 1 + allocation_size) >> 9;
        }
+        spin_unlock(&tmp_inode->i_lock);
        if (allocation_size < end_of_file)
                cFYI(1, ("May be sparse file, allocation less than file size"));
@@ -355,6 +357,7 @@ static void unix_fill_in_inode(struct inode *tmp_inode,
        tmp_inode->i_gid = le64_to_cpu(pfindData->Gid);
        tmp_inode->i_nlink = le64_to_cpu(pfindData->Nlinks);
+        spin_lock(&tmp_inode->i_lock);
        if (is_size_safe_to_change(cifsInfo, end_of_file)) {
                /* can not safely change the file size here if the 
                client is writing to it due to potential races */
@@ -364,6 +367,7 @@ static void unix_fill_in_inode(struct inode *tmp_inode,
        /* for this calculation, not the real blocksize */
                tmp_inode->i_blocks = (512 - 1 + num_of_bytes) >> 9;
        }
+        spin_unlock(&tmp_inode->i_lock);
        if (S_ISREG(tmp_inode->i_mode)) {
                cFYI(1, ("File inode"));
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index f80007eaebf4..5f468459a1e2 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -499,7 +499,7 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
           due to last connection to this server being unmounted */
        if (signal_pending(current)) {
                /* if signal pending do not hold up user for full smb timeout
-                but we still give response a change to complete */
+                but we still give response a chance to complete */
                timeout = 2 * HZ;
        }   
@@ -587,7 +587,6 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
        }
 out:
        DeleteMidQEntry(midQ);
        atomic_dec(&ses->server->inFlight); 
        wake_up(&ses->server->request_q);
@@ -681,7 +680,7 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
           due to last connection to this server being unmounted */
        if (signal_pending(current)) {
                /* if signal pending do not hold up user for full smb timeout
-                but we still give response a change to complete */
+                but we still give response a chance to complete */
                timeout = 2 * HZ;
        }   
@@ -765,7 +764,6 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
        }
 out:
        DeleteMidQEntry(midQ);
        atomic_dec(&ses->server->inFlight); 
        wake_up(&ses->server->request_q);
diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
index 14939ddf74f1..7285c94956c4 100644
--- a/fs/ncpfs/inode.c
+++ b/fs/ncpfs/inode.c
@@ -576,6 +576,12 @@ static int ncp_fill_super(struct super_block *sb, void *raw_data, int silent)
        server->packet = vmalloc(NCP_PACKET_SIZE);
        if (server->packet == NULL)
                goto out_nls;
+        server->txbuf = vmalloc(NCP_PACKET_SIZE);
+        if (server->txbuf == NULL)
+                goto out_packet;
+        server->rxbuf = vmalloc(NCP_PACKET_SIZE);
+        if (server->rxbuf == NULL)
+                goto out_txbuf;
        sock->sk->sk_data_ready   = ncp_tcp_data_ready;
        sock->sk->sk_error_report = ncp_tcp_error_report;
@@ -597,7 +603,7 @@ static int ncp_fill_super(struct super_block *sb, void *raw_data, int silent)
        error = ncp_connect(server);
        ncp_unlock_server(server);
        if (error < 0)
-                goto out_packet;
+                goto out_rxbuf;
        DPRINTK("ncp_fill_super: NCP_SBP(sb) = %x\n", (int) NCP_SBP(sb));
        error = -EMSGSIZE;      /* -EREMOTESIDEINCOMPATIBLE */
@@ -666,8 +672,12 @@ out_disconnect:
        ncp_lock_server(server);
        ncp_disconnect(server);
        ncp_unlock_server(server);
-out_packet:
+out_rxbuf:
        ncp_stop_tasks(server);
+        vfree(server->rxbuf);
+out_txbuf:
+        vfree(server->txbuf);
+out_packet:
        vfree(server->packet);
 out_nls:
 #ifdef CONFIG_NCPFS_NLS
@@ -723,6 +733,8 @@ static void ncp_put_super(struct super_block *sb)
        kfree(server->priv.data);
        kfree(server->auth.object_name);
+        vfree(server->rxbuf);
+        vfree(server->txbuf);
        vfree(server->packet);
        sb->s_fs_info = NULL;
        kfree(server);
diff --git a/fs/ncpfs/sock.c b/fs/ncpfs/sock.c
index e496d8b65e92..e37df8d5fe70 100644
--- a/fs/ncpfs/sock.c
+++ b/fs/ncpfs/sock.c
@@ -14,6 +14,7 @@
 #include <linux/socket.h>
 #include <linux/fcntl.h>
 #include <linux/stat.h>
+#include <linux/string.h>
 #include <asm/uaccess.h>
 #include <linux/in.h>
 #include <linux/net.h>
@@ -55,10 +56,11 @@ static int _send(struct socket *sock, const void *buff, int len)
 struct ncp_request_reply {
        struct list_head req;
        wait_queue_head_t wq;
-        struct ncp_reply_header* reply_buf;
+        atomic_t refs;
+        unsigned char* reply_buf;
        size_t datalen;
        int result;
-        enum { RQ_DONE, RQ_INPROGRESS, RQ_QUEUED, RQ_IDLE } status;
+        enum { RQ_DONE, RQ_INPROGRESS, RQ_QUEUED, RQ_IDLE, RQ_ABANDONED } status;
        struct kvec* tx_ciov;
        size_t tx_totallen;
        size_t tx_iovlen;
@@ -67,6 +69,32 @@ struct ncp_request_reply {
        u_int32_t sign[6];
 };
+static inline struct ncp_request_reply* ncp_alloc_req(void)
+{
+        struct ncp_request_reply *req;
+        req = kmalloc(sizeof(struct ncp_request_reply), GFP_KERNEL);
+        if (!req)
+                return NULL;
+        init_waitqueue_head(&req->wq);
+        atomic_set(&req->refs, (1));
+        req->status = RQ_IDLE;
+        return req;
+}
+static void ncp_req_get(struct ncp_request_reply *req)
+{
+        atomic_inc(&req->refs);
+}
+static void ncp_req_put(struct ncp_request_reply *req)
+{
+        if (atomic_dec_and_test(&req->refs))
+                kfree(req);
+}
 void ncp_tcp_data_ready(struct sock *sk, int len)
 {
        struct ncp_server *server = sk->sk_user_data;
@@ -101,14 +129,17 @@ void ncpdgram_timeout_call(unsigned long v)
        schedule_work(&server->timeout_tq);
 }
-static inline void ncp_finish_request(struct ncp_request_reply *req, int result)
+static inline void ncp_finish_request(struct ncp_server *server, struct ncp_request_reply *req, int result)
 {
        req->result = result;
+        if (req->status != RQ_ABANDONED)
+                memcpy(req->reply_buf, server->rxbuf, req->datalen);
        req->status = RQ_DONE;
        wake_up_all(&req->wq);
+        ncp_req_put(req);
 }
-static void __abort_ncp_connection(struct ncp_server *server, struct ncp_request_reply *aborted, int err)
+static void __abort_ncp_connection(struct ncp_server *server)
 {
        struct ncp_request_reply *req;
@@ -118,31 +149,19 @@ static void __abort_ncp_connection(struct ncp_server *server, struct ncp_request
                req = list_entry(server->tx.requests.next, struct ncp_request_reply, req);
                
                list_del_init(&req->req);
-                if (req == aborted) {
+                ncp_finish_request(server, req, -EIO);
-                        ncp_finish_request(req, err);
-                } else {
-                        ncp_finish_request(req, -EIO);
-                }
        }
        req = server->rcv.creq;
        if (req) {
                server->rcv.creq = NULL;
-                if (req == aborted) {
+                ncp_finish_request(server, req, -EIO);
-                        ncp_finish_request(req, err);
-                } else {
-                        ncp_finish_request(req, -EIO);
-                }
                server->rcv.ptr = NULL;
                server->rcv.state = 0;
        }
        req = server->tx.creq;
        if (req) {
                server->tx.creq = NULL;
-                if (req == aborted) {
+                ncp_finish_request(server, req, -EIO);
-                        ncp_finish_request(req, err);
-                } else {
-                        ncp_finish_request(req, -EIO);
-                }
        }
 }
@@ -160,10 +179,12 @@ static inline void __ncp_abort_request(struct ncp_server *server, struct ncp_req
                        break;
                case RQ_QUEUED:
                        list_del_init(&req->req);
-                        ncp_finish_request(req, err);
+                        ncp_finish_request(server, req, err);
                        break;
                case RQ_INPROGRESS:
-                        __abort_ncp_connection(server, req, err);
+                        req->status = RQ_ABANDONED;
+                        break;
+                case RQ_ABANDONED:
                        break;
        }
 }
@@ -177,7 +198,7 @@ static inline void ncp_abort_request(struct ncp_server *server, struct ncp_reque
 static inline void __ncptcp_abort(struct ncp_server *server)
 {
-        __abort_ncp_connection(server, NULL, 0);
+        __abort_ncp_connection(server);
 }
 static int ncpdgram_send(struct socket *sock, struct ncp_request_reply *req)
@@ -294,6 +315,11 @@ static void ncptcp_start_request(struct ncp_server *server, struct ncp_request_r
 static inline void __ncp_start_request(struct ncp_server *server, struct ncp_request_reply *req)
 {
+        /* we copy the data so that we do not depend on the caller
+           staying alive */
+        memcpy(server->txbuf, req->tx_iov[1].iov_base, req->tx_iov[1].iov_len);
+        req->tx_iov[1].iov_base = server->txbuf;
        if (server->ncp_sock->type == SOCK_STREAM)
                ncptcp_start_request(server, req);
        else
@@ -308,6 +334,7 @@ static int ncp_add_request(struct ncp_server *server, struct ncp_request_reply *
                printk(KERN_ERR "ncpfs: tcp: Server died\n");
                return -EIO;
        }
+        ncp_req_get(req);
        if (server->tx.creq || server->rcv.creq) {
                req->status = RQ_QUEUED;
                list_add_tail(&req->req, &server->tx.requests);
@@ -409,7 +436,7 @@ void ncpdgram_rcv_proc(struct work_struct *work)
                                        server->timeout_last = NCP_MAX_RPC_TIMEOUT;
                                        mod_timer(&server->timeout_tm, jiffies + NCP_MAX_RPC_TIMEOUT);
                                } else if (reply.type == NCP_REPLY) {
-                                        result = _recv(sock, (void*)req->reply_buf, req->datalen, MSG_DONTWAIT);
+                                        result = _recv(sock, server->rxbuf, req->datalen, MSG_DONTWAIT);
 #ifdef CONFIG_NCPFS_PACKET_SIGNING
                                        if (result >= 0 && server->sign_active && req->tx_type != NCP_DEALLOC_SLOT_REQUEST) {
                                                if (result < 8 + 8) {
@@ -419,7 +446,7 @@ void ncpdgram_rcv_proc(struct work_struct *work)
                                                        
                                                        result -= 8;
                                                        hdrl = sock->sk->sk_family == AF_INET ? 8 : 6;
-                                                        if (sign_verify_reply(server, ((char*)req->reply_buf) + hdrl, result - hdrl, cpu_to_le32(result), ((char*)req->reply_buf) + result)) {
+                                                        if (sign_verify_reply(server, server->rxbuf + hdrl, result - hdrl, cpu_to_le32(result), server->rxbuf + result)) {
                                                                printk(KERN_INFO "ncpfs: Signature violation\n");
                                                                result = -EIO;
                                                        }
@@ -428,7 +455,7 @@ void ncpdgram_rcv_proc(struct work_struct *work)
 #endif
                                        del_timer(&server->timeout_tm);
                                        server->rcv.creq = NULL;
-                                        ncp_finish_request(req, result);
+                                        ncp_finish_request(server, req, result);
                                        __ncp_next_request(server);
                                        mutex_unlock(&server->rcv.creq_mutex);
                                        continue;
@@ -478,12 +505,6 @@ void ncpdgram_timeout_proc(struct work_struct *work)
        mutex_unlock(&server->rcv.creq_mutex);
 }
-static inline void ncp_init_req(struct ncp_request_reply* req)
-{
-        init_waitqueue_head(&req->wq);
-        req->status = RQ_IDLE;
-}
 static int do_tcp_rcv(struct ncp_server *server, void *buffer, size_t len)
 {
        int result;
@@ -601,8 +622,8 @@ skipdata:;
                                        goto skipdata;
                                }
                                req->datalen = datalen - 8;
-                                req->reply_buf->type = NCP_REPLY;
+                                ((struct ncp_reply_header*)server->rxbuf)->type = NCP_REPLY;
-                                server->rcv.ptr = (unsigned char*)(req->reply_buf) + 2;
+                                server->rcv.ptr = server->rxbuf + 2;
                                server->rcv.len = datalen - 10;
                                server->rcv.state = 1;
                                break;
@@ -615,12 +636,12 @@ skipdata:;
                        case 1:
                                req = server->rcv.creq;
                                if (req->tx_type != NCP_ALLOC_SLOT_REQUEST) {
-                                        if (req->reply_buf->sequence != server->sequence) {
+                                        if (((struct ncp_reply_header*)server->rxbuf)->sequence != server->sequence) {
                                                printk(KERN_ERR "ncpfs: tcp: Bad sequence number\n");
                                                __ncp_abort_request(server, req, -EIO);
                                                return -EIO;
                                        }
-                                        if ((req->reply_buf->conn_low | (req->reply_buf->conn_high << 8)) != server->connection) {
+                                        if ((((struct ncp_reply_header*)server->rxbuf)->conn_low | (((struct ncp_reply_header*)server->rxbuf)->conn_high << 8)) != server->connection) {
                                                printk(KERN_ERR "ncpfs: tcp: Connection number mismatch\n");
                                                __ncp_abort_request(server, req, -EIO);
                                                return -EIO;
@@ -628,14 +649,14 @@ skipdata:;
                                }
 #ifdef CONFIG_NCPFS_PACKET_SIGNING                              
                                if (server->sign_active && req->tx_type != NCP_DEALLOC_SLOT_REQUEST) {
-                                        if (sign_verify_reply(server, (unsigned char*)(req->reply_buf) + 6, req->datalen - 6, cpu_to_be32(req->datalen + 16), &server->rcv.buf.type)) {
+                                        if (sign_verify_reply(server, server->rxbuf + 6, req->datalen - 6, cpu_to_be32(req->datalen + 16), &server->rcv.buf.type)) {
                                                printk(KERN_ERR "ncpfs: tcp: Signature violation\n");
                                                __ncp_abort_request(server, req, -EIO);
                                                return -EIO;
                                        }
                                }
 #endif                          
-                                ncp_finish_request(req, req->datalen);
+                                ncp_finish_request(server, req, req->datalen);
                        nextreq:;
                                __ncp_next_request(server);
                        case 2:
@@ -645,7 +666,7 @@ skipdata:;
                                server->rcv.state = 0;
                                break;
                        case 3:
-                                ncp_finish_request(server->rcv.creq, -EIO);
+                                ncp_finish_request(server, server->rcv.creq, -EIO);
                                goto nextreq;
                        case 5:
                                info_server(server, 0, server->unexpected_packet.data, server->unexpected_packet.len);
@@ -675,28 +696,39 @@ void ncp_tcp_tx_proc(struct work_struct *work)
 }
 static int do_ncp_rpc_call(struct ncp_server *server, int size,
-                struct ncp_reply_header* reply_buf, int max_reply_size)
+                unsigned char* reply_buf, int max_reply_size)
 {
        int result;
-        struct ncp_request_reply req;
+        struct ncp_request_reply *req;
-        ncp_init_req(&req);
+        req = ncp_alloc_req();
-        req.reply_buf = reply_buf;
+        if (!req)
-        req.datalen = max_reply_size;
+                return -ENOMEM;
-        req.tx_iov[1].iov_base = server->packet;
-        req.tx_iov[1].iov_len = size;
+        req->reply_buf = reply_buf;
-        req.tx_iovlen = 1;
+        req->datalen = max_reply_size;
-        req.tx_totallen = size;
+        req->tx_iov[1].iov_base = server->packet;
-        req.tx_type = *(u_int16_t*)server->packet;
+        req->tx_iov[1].iov_len = size;
+        req->tx_iovlen = 1;
-        result = ncp_add_request(server, &req);
+        req->tx_totallen = size;
-        if (result < 0) {
+        req->tx_type = *(u_int16_t*)server->packet;
-                return result;
-        }
+        result = ncp_add_request(server, req);
-        if (wait_event_interruptible(req.wq, req.status == RQ_DONE)) {
+        if (result < 0)
-                ncp_abort_request(server, &req, -EIO);
+                goto out;
+        if (wait_event_interruptible(req->wq, req->status == RQ_DONE)) {
+                ncp_abort_request(server, req, -EINTR);
+                result = -EINTR;
+                goto out;
        }
-        return req.result;
+        result = req->result;
+out:
+        ncp_req_put(req);
+        return result;
 }
 /*
@@ -751,11 +783,6 @@ static int ncp_do_request(struct ncp_server *server, int size,
        DDPRINTK("do_ncp_rpc_call returned %d\n", result);
-        if (result < 0) {
-                /* There was a problem with I/O, so the connections is
-                 * no longer usable. */
-                ncp_invalidate_conn(server);
-        }
        return result;
 }
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 8813990304fe..85a668680f82 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -431,6 +431,8 @@ int sysfs_move_dir(struct kobject *kobj, struct kobject *new_parent)
        new_parent_dentry = new_parent ?
                new_parent->dentry : sysfs_mount->mnt_sb->s_root;
+        if (old_parent_dentry->d_inode == new_parent_dentry->d_inode)
+                return 0;       /* nothing to move */
 again:
        mutex_lock(&old_parent_dentry->d_inode->i_mutex);
        if (!mutex_trylock(&new_parent_dentry->d_inode->i_mutex)) {
diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
index dd1344b007f5..ccb7d722c558 100644
--- a/fs/sysfs/inode.c
+++ b/fs/sysfs/inode.c
@@ -227,11 +227,8 @@ static inline void orphan_all_buffers(struct inode *node)
        mutex_lock_nested(&node->i_mutex, I_MUTEX_CHILD);
        if (node->i_private) {
-                list_for_each_entry(buf, &set->associates, associates) {
+                list_for_each_entry(buf, &set->associates, associates)
-                        down(&buf->sem);
                        buf->orphaned = 1;
-                        up(&buf->sem);
-                }
        }
        mutex_unlock(&node->i_mutex);
 }