20 files changed, 375 insertions, 313 deletions

diff --git a/fs/block_dev.c b/fs/block_dev.c
index 702b88cbd91d..36c0e7af9d0f 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -642,34 +642,47 @@ static void free_bd_holder(struct bd_holder *bo)
 }
 
 /**
+ * find_bd_holder - find matching struct bd_holder from the block device
+ *
+ * @bdev:       struct block device to be searched
+ * @bo:         target struct bd_holder
+ *
+ * Returns matching entry with @bo in @bdev->bd_holder_list.
+ * If found, increment the reference count and return the pointer.
+ * If not found, returns NULL.
+ */
+static struct bd_holder *find_bd_holder(struct block_device *bdev,
+                                        struct bd_holder *bo)
+{
+        struct bd_holder *tmp;
+
+        list_for_each_entry(tmp, &bdev->bd_holder_list, list)
+                if (tmp->sdir == bo->sdir) {
+                        tmp->count++;
+                        return tmp;
+                }
+
+        return NULL;
+}
+
+/**
  * add_bd_holder - create sysfs symlinks for bd_claim() relationship
  *
  * @bdev:       block device to be bd_claimed
  * @bo:         preallocated and initialized by alloc_bd_holder()
  *
- * If there is no matching entry with @bo in @bdev->bd_holder_list,
- * add @bo to the list, create symlinks.
+ * Add @bo to @bdev->bd_holder_list, create symlinks.
  *
- * Returns 0 if symlinks are created or already there.
- * Returns -ve if something fails and @bo can be freed.
+ * Returns 0 if symlinks are created.
+ * Returns -ve if something fails.
  */
 static int add_bd_holder(struct block_device *bdev, struct bd_holder *bo)
 {
-        struct bd_holder *tmp;
         int ret;
 
         if (!bo)
                 return -EINVAL;
 
-        list_for_each_entry(tmp, &bdev->bd_holder_list, list) {
-                if (tmp->sdir == bo->sdir) {
-                        tmp->count++;
-                        /* We've already done what we need to do here. */
-                        free_bd_holder(bo);
-                        return 0;
-                }
-        }
-
         if (!bd_holder_grab_dirs(bdev, bo))
                 return -EBUSY;
 
@@ -740,7 +753,7 @@ static int bd_claim_by_kobject(struct block_device *bdev, void *holder,
                                 struct kobject *kobj)
 {
         int res;
-        struct bd_holder *bo;
+        struct bd_holder *bo, *found;
 
         if (!kobj)
                 return -EINVAL;
@@ -751,9 +764,16 @@ static int bd_claim_by_kobject(struct block_device *bdev, void *holder,
 
         mutex_lock_nested(&bdev->bd_mutex, BD_MUTEX_PARTITION);
         res = bd_claim(bdev, holder);
-        if (res == 0)
-                res = add_bd_holder(bdev, bo);
-        if (res)
+        if (res == 0) {
+                found = find_bd_holder(bdev, bo);
+                if (found == NULL) {
+                        res = add_bd_holder(bdev, bo);
+                        if (res)
+                                bd_release(bdev);
+                }
+        }
+
+        if (res || found)
                 free_bd_holder(bo);
         mutex_unlock(&bdev->bd_mutex);
 
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 1eb9a2ec0a3b..0b3c37ef52e0 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,6 +1,11 @@
 Version 1.46
 ------------
 Support deep tree mounts.  Better support OS/2, Win9x (DOS) time stamps.
+Allow null user to be specified on mount ("username="). Do not return
+EINVAL on readdir when filldir fails due to overwritten blocksize
+(fixes FC problem).  Return error in rename 2nd attempt retry (ie report
+if rename by handle also fails, after rename by path fails, we were
+not reporting whether the retry worked or not).
 
 Version 1.45
 ------------
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 4093d5332930..71f77914ce93 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -822,10 +822,13 @@ cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
                 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
                         vol->no_xattr = 1;
                 } else if (strnicmp(data, "user", 4) == 0) {
-                        if (!value || !*value) {
+                        if (!value) {
                                 printk(KERN_WARNING
                                        "CIFS: invalid or missing username\n");
                                 return 1;       /* needs_arg; */
+                        } else if(!*value) {
+                                /* null user, ie anonymous, authentication */
+                                vol->nullauth = 1;
                         }
                         if (strnlen(value, 200) < 200) {
                                 vol->username = value;
@@ -1642,6 +1645,8 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 /* BB fixme parse for domain name here */
                 cFYI(1, ("Username: %s ", volume_info.username));
 
+        } else if (volume_info.nullauth) {
+                cFYI(1,("null user"));
         } else {
                 cifserror("No username specified");
         /* In userspace mount helper we can get user name from alternate
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 976a691c5a68..7e056b9b49e8 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1806,13 +1806,6 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                 }
                 if ((rc < 0) || (smb_read_data == NULL)) {
                         cFYI(1, ("Read error in readpages: %d", rc));
-                        /* clean up remaing pages off list */
-                        while (!list_empty(page_list) && (i < num_pages)) {
-                                page = list_entry(page_list->prev, struct page,
-                                                  lru);
-                                list_del(&page->lru);
-                                page_cache_release(page);
-                        }
                         break;
                 } else if (bytes_read > 0) {
                         pSMBr = (struct smb_com_read_rsp *)smb_read_data;
@@ -1831,13 +1824,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                                    this case is ok - if we are at server EOF 
                                    we will hit it on next read */
 
-                        /* while (!list_empty(page_list) && (i < num_pages)) {
-                                        page = list_entry(page_list->prev, 
-                                                          struct page, list);
-                                        list_del(&page->list);
-                                        page_cache_release(page);
-                                }
-                                break; */
+                                /* break; */
                         }
                 } else {
                         cFYI(1, ("No bytes read (%d) at offset %lld . "
@@ -1845,14 +1832,6 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                                  bytes_read, offset));
                         /* BB turn off caching and do new lookup on 
                            file size at server? */
-                        while (!list_empty(page_list) && (i < num_pages)) {
-                                page = list_entry(page_list->prev, struct page,
-                                                  lru);
-                                list_del(&page->lru);
-
-                                /* BB removeme - replace with zero of page? */
-                                page_cache_release(page);
-                        }
                         break;
                 }
                 if (smb_read_data) {
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 35d54bb0869a..dffe295825f4 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -885,10 +885,14 @@ int cifs_rename(struct inode *source_inode, struct dentry *source_direntry,
                         kmalloc(2 * sizeof(FILE_UNIX_BASIC_INFO), GFP_KERNEL);
                 if (info_buf_source != NULL) {
                         info_buf_target = info_buf_source + 1;
-                        rc = CIFSSMBUnixQPathInfo(xid, pTcon, fromName,
-                                info_buf_source, cifs_sb_source->local_nls, 
-                                cifs_sb_source->mnt_cifs_flags &
-                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
+                        if (pTcon->ses->capabilities & CAP_UNIX)
+                                rc = CIFSSMBUnixQPathInfo(xid, pTcon, fromName,
+                                        info_buf_source, 
+                                        cifs_sb_source->local_nls,
+                                        cifs_sb_source->mnt_cifs_flags &
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
+                        /* else rc is still EEXIST so will fall through to
+                           unlink the target and retry rename */
                         if (rc == 0) {
                                 rc = CIFSSMBUnixQPathInfo(xid, pTcon, toName,
                                                 info_buf_target,
@@ -937,7 +941,7 @@ int cifs_rename(struct inode *source_inode, struct dentry *source_direntry,
                                  cifs_sb_source->mnt_cifs_flags & 
                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
                 if (rc==0) {
-                        CIFSSMBRenameOpenFile(xid, pTcon, netfid, toName,
+                        rc = CIFSSMBRenameOpenFile(xid, pTcon, netfid, toName,
                                               cifs_sb_source->local_nls, 
                                               cifs_sb_source->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index b5b0a2a41bef..ed18c3965f7b 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -896,6 +896,10 @@ static int cifs_filldir(char *pfindEntry, struct file *file,
                      tmp_inode->i_ino,obj_type);
         if(rc) {
                 cFYI(1,("filldir rc = %d",rc));
+                /* we can not return filldir errors to the caller
+                since they are "normal" when the stat blocksize
+                is too small - we return remapped error instead */
+                rc = -EOVERFLOW;
         }
 
         dput(tmp_dentry);
@@ -1074,6 +1078,11 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                         we want to check for that here? */
                         rc = cifs_filldir(current_entry, file,
                                         filldir, direntry, tmp_buf, max_len);
+                        if(rc == -EOVERFLOW) {
+                                rc = 0;
+                                break;
+                        }
+
                         file->f_pos++;
                         if(file->f_pos == 
                                 cifsFile->srch_inf.index_of_last_entry) {
diff --git a/fs/compat.c b/fs/compat.c
index 50624d4a70c6..8d0a0018a7d2 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1835,9 +1835,12 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
 
         } while (!ret && !timeout && tsp && (ts.tv_sec || ts.tv_nsec));
 
-        if (ret == 0 && tsp && !(current->personality & STICKY_TIMEOUTS)) {
+        if (tsp) {
                 struct compat_timespec rts;
 
+                if (current->personality & STICKY_TIMEOUTS)
+                        goto sticky;
+
                 rts.tv_sec = timeout / HZ;
                 rts.tv_nsec = (timeout % HZ) * (NSEC_PER_SEC/HZ);
                 if (rts.tv_nsec >= NSEC_PER_SEC) {
@@ -1846,8 +1849,19 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
                 }
                 if (compat_timespec_compare(&rts, &ts) >= 0)
                         rts = ts;
-                if (copy_to_user(tsp, &rts, sizeof(rts)))
-                        ret = -EFAULT;
+                if (copy_to_user(tsp, &rts, sizeof(rts))) {
+sticky:
+                        /*
+                         * If an application puts its timeval in read-only
+                         * memory, we don't want the Linux-specific update to
+                         * the timeval to cause a fault after the select has
+                         * completed successfully. However, because we're not
+                         * updating the timeval, we can't restart the system
+                         * call.
+                         */
+                        if (ret == -ERESTARTNOHAND)
+                                ret = -EINTR;
+                }
         }
 
         if (ret == -ERESTARTNOHAND) {
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index ed35a9712fa1..136175a69332 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -94,25 +94,53 @@ static int ecryptfs_calculate_md5(char *dst,
                                   struct ecryptfs_crypt_stat *crypt_stat,
                                   char *src, int len)
 {
-        int rc = 0;
         struct scatterlist sg;
+        struct hash_desc desc = {
+                .tfm = crypt_stat->hash_tfm,
+                .flags = CRYPTO_TFM_REQ_MAY_SLEEP
+        };
+        int rc = 0;
 
-        mutex_lock(&crypt_stat->cs_md5_tfm_mutex);
+        mutex_lock(&crypt_stat->cs_hash_tfm_mutex);
         sg_init_one(&sg, (u8 *)src, len);
-        if (!crypt_stat->md5_tfm) {
-                crypt_stat->md5_tfm =
-                        crypto_alloc_tfm("md5", CRYPTO_TFM_REQ_MAY_SLEEP);
-                if (!crypt_stat->md5_tfm) {
-                        rc = -ENOMEM;
+        if (!desc.tfm) {
+                desc.tfm = crypto_alloc_hash(ECRYPTFS_DEFAULT_HASH, 0,
+                                             CRYPTO_ALG_ASYNC);
+                if (IS_ERR(desc.tfm)) {
+                        rc = PTR_ERR(desc.tfm);
                         ecryptfs_printk(KERN_ERR, "Error attempting to "
-                                        "allocate crypto context\n");
+                                        "allocate crypto context; rc = [%d]\n",
+                                        rc);
                         goto out;
                 }
+                crypt_stat->hash_tfm = desc.tfm;
         }
-        crypto_digest_init(crypt_stat->md5_tfm);
-        crypto_digest_update(crypt_stat->md5_tfm, &sg, 1);
-        crypto_digest_final(crypt_stat->md5_tfm, dst);
-        mutex_unlock(&crypt_stat->cs_md5_tfm_mutex);
+        crypto_hash_init(&desc);
+        crypto_hash_update(&desc, &sg, len);
+        crypto_hash_final(&desc, dst);
+        mutex_unlock(&crypt_stat->cs_hash_tfm_mutex);
+out:
+        return rc;
+}
+
+int ecryptfs_crypto_api_algify_cipher_name(char **algified_name,
+                                           char *cipher_name,
+                                           char *chaining_modifier)
+{
+        int cipher_name_len = strlen(cipher_name);
+        int chaining_modifier_len = strlen(chaining_modifier);
+        int algified_name_len;
+        int rc;
+
+        algified_name_len = (chaining_modifier_len + cipher_name_len + 3);
+        (*algified_name) = kmalloc(algified_name_len, GFP_KERNEL);
+        if (!(*algified_name)) {
+                rc = -ENOMEM;
+                goto out;
+        }
+        snprintf((*algified_name), algified_name_len, "%s(%s)",
+                 chaining_modifier, cipher_name);
+        rc = 0;
 out:
         return rc;
 }
@@ -178,7 +206,7 @@ ecryptfs_init_crypt_stat(struct ecryptfs_crypt_stat *crypt_stat)
         memset((void *)crypt_stat, 0, sizeof(struct ecryptfs_crypt_stat));
         mutex_init(&crypt_stat->cs_mutex);
         mutex_init(&crypt_stat->cs_tfm_mutex);
-        mutex_init(&crypt_stat->cs_md5_tfm_mutex);
+        mutex_init(&crypt_stat->cs_hash_tfm_mutex);
         ECRYPTFS_SET_FLAG(crypt_stat->flags, ECRYPTFS_STRUCT_INITIALIZED);
 }
 
@@ -191,9 +219,9 @@ ecryptfs_init_crypt_stat(struct ecryptfs_crypt_stat *crypt_stat)
 void ecryptfs_destruct_crypt_stat(struct ecryptfs_crypt_stat *crypt_stat)
 {
         if (crypt_stat->tfm)
-                crypto_free_tfm(crypt_stat->tfm);
-        if (crypt_stat->md5_tfm)
-                crypto_free_tfm(crypt_stat->md5_tfm);
+                crypto_free_blkcipher(crypt_stat->tfm);
+        if (crypt_stat->hash_tfm)
+                crypto_free_hash(crypt_stat->hash_tfm);
         memset(crypt_stat, 0, sizeof(struct ecryptfs_crypt_stat));
 }
 
@@ -203,7 +231,7 @@ void ecryptfs_destruct_mount_crypt_stat(
         if (mount_crypt_stat->global_auth_tok_key)
                 key_put(mount_crypt_stat->global_auth_tok_key);
         if (mount_crypt_stat->global_key_tfm)
-                crypto_free_tfm(mount_crypt_stat->global_key_tfm);
+                crypto_free_blkcipher(mount_crypt_stat->global_key_tfm);
         memset(mount_crypt_stat, 0, sizeof(struct ecryptfs_mount_crypt_stat));
 }
 
@@ -269,6 +297,11 @@ static int encrypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
                                struct scatterlist *src_sg, int size,
                                unsigned char *iv)
 {
+        struct blkcipher_desc desc = {
+                .tfm = crypt_stat->tfm,
+                .info = iv,
+                .flags = CRYPTO_TFM_REQ_MAY_SLEEP
+        };
         int rc = 0;
 
         BUG_ON(!crypt_stat || !crypt_stat->tfm
@@ -282,8 +315,8 @@ static int encrypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
         }
         /* Consider doing this once, when the file is opened */
         mutex_lock(&crypt_stat->cs_tfm_mutex);
-        rc = crypto_cipher_setkey(crypt_stat->tfm, crypt_stat->key,
-                                  crypt_stat->key_size);
+        rc = crypto_blkcipher_setkey(crypt_stat->tfm, crypt_stat->key,
+                                     crypt_stat->key_size);
         if (rc) {
                 ecryptfs_printk(KERN_ERR, "Error setting key; rc = [%d]\n",
                                 rc);
@@ -292,7 +325,7 @@ static int encrypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
                 goto out;
         }
         ecryptfs_printk(KERN_DEBUG, "Encrypting [%d] bytes.\n", size);
-        crypto_cipher_encrypt_iv(crypt_stat->tfm, dest_sg, src_sg, size, iv);
+        crypto_blkcipher_encrypt_iv(&desc, dest_sg, src_sg, size);
         mutex_unlock(&crypt_stat->cs_tfm_mutex);
 out:
         return rc;
@@ -675,12 +708,17 @@ static int decrypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
                                struct scatterlist *src_sg, int size,
                                unsigned char *iv)
 {
+        struct blkcipher_desc desc = {
+                .tfm = crypt_stat->tfm,
+                .info = iv,
+                .flags = CRYPTO_TFM_REQ_MAY_SLEEP
+        };
         int rc = 0;
 
         /* Consider doing this once, when the file is opened */
         mutex_lock(&crypt_stat->cs_tfm_mutex);
-        rc = crypto_cipher_setkey(crypt_stat->tfm, crypt_stat->key,
-                                  crypt_stat->key_size);
+        rc = crypto_blkcipher_setkey(crypt_stat->tfm, crypt_stat->key,
+                                     crypt_stat->key_size);
         if (rc) {
                 ecryptfs_printk(KERN_ERR, "Error setting key; rc = [%d]\n",
                                 rc);
@@ -689,8 +727,7 @@ static int decrypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
                 goto out;
         }
         ecryptfs_printk(KERN_DEBUG, "Decrypting [%d] bytes.\n", size);
-        rc = crypto_cipher_decrypt_iv(crypt_stat->tfm, dest_sg, src_sg, size,
-                                      iv);
+        rc = crypto_blkcipher_decrypt_iv(&desc, dest_sg, src_sg, size);
         mutex_unlock(&crypt_stat->cs_tfm_mutex);
         if (rc) {
                 ecryptfs_printk(KERN_ERR, "Error decrypting; rc = [%d]\n",
@@ -759,6 +796,7 @@ ecryptfs_decrypt_page_offset(struct ecryptfs_crypt_stat *crypt_stat,
  */
 int ecryptfs_init_crypt_ctx(struct ecryptfs_crypt_stat *crypt_stat)
 {
+        char *full_alg_name;
         int rc = -EINVAL;
 
         if (!crypt_stat->cipher) {
@@ -775,16 +813,24 @@ int ecryptfs_init_crypt_ctx(struct ecryptfs_crypt_stat *crypt_stat)
                 goto out;
         }
         mutex_lock(&crypt_stat->cs_tfm_mutex);
-        crypt_stat->tfm = crypto_alloc_tfm(crypt_stat->cipher,
-                                           ECRYPTFS_DEFAULT_CHAINING_MODE
-                                           | CRYPTO_TFM_REQ_WEAK_KEY);
-        mutex_unlock(&crypt_stat->cs_tfm_mutex);
+        rc = ecryptfs_crypto_api_algify_cipher_name(&full_alg_name,
+                                                    crypt_stat->cipher, "cbc");
+        if (rc)
+                goto out;
+        crypt_stat->tfm = crypto_alloc_blkcipher(full_alg_name, 0,
+                                                 CRYPTO_ALG_ASYNC);
+        kfree(full_alg_name);
         if (!crypt_stat->tfm) {
                 ecryptfs_printk(KERN_ERR, "cryptfs: init_crypt_ctx(): "
                                 "Error initializing cipher [%s]\n",
                                 crypt_stat->cipher);
+                mutex_unlock(&crypt_stat->cs_tfm_mutex);
                 goto out;
         }
+        crypto_blkcipher_set_flags(crypt_stat->tfm,
+                                   (ECRYPTFS_DEFAULT_CHAINING_MODE
+                                    | CRYPTO_TFM_REQ_WEAK_KEY));
+        mutex_unlock(&crypt_stat->cs_tfm_mutex);
         rc = 0;
 out:
         return rc;
@@ -1145,28 +1191,28 @@ int ecryptfs_cipher_code_to_string(char *str, u16 cipher_code)
 int ecryptfs_read_header_region(char *data, struct dentry *dentry,
                                 struct vfsmount *mnt)
 {
-        struct file *file;
+        struct file *lower_file;
         mm_segment_t oldfs;
         int rc;
 
-        mnt = mntget(mnt);
-        file = dentry_open(dentry, mnt, O_RDONLY);
-        if (IS_ERR(file)) {
-                ecryptfs_printk(KERN_DEBUG, "Error opening file to "
-                                "read header region\n");
-                mntput(mnt);
-                rc = PTR_ERR(file);
+        if ((rc = ecryptfs_open_lower_file(&lower_file, dentry, mnt,
+                                           O_RDONLY))) {
+                printk(KERN_ERR
+                       "Error opening lower_file to read header region\n");
                 goto out;
         }
-        file->f_pos = 0;
+        lower_file->f_pos = 0;
         oldfs = get_fs();
         set_fs(get_ds());
         /* For releases 0.1 and 0.2, all of the header information
          * fits in the first data extent-sized region. */
-        rc = file->f_op->read(file, (char __user *)data,
-                              ECRYPTFS_DEFAULT_EXTENT_SIZE, &file->f_pos);
+        rc = lower_file->f_op->read(lower_file, (char __user *)data,
+                              ECRYPTFS_DEFAULT_EXTENT_SIZE, &lower_file->f_pos);
         set_fs(oldfs);
-        fput(file);
+        if ((rc = ecryptfs_close_lower_file(lower_file))) {
+                printk(KERN_ERR "Error closing lower_file\n");
+                goto out;
+        }
         rc = 0;
 out:
         return rc;
@@ -1573,84 +1619,52 @@ out:
 
 /**
  * ecryptfs_process_cipher - Perform cipher initialization.
- * @tfm: Crypto context set by this function
  * @key_tfm: Crypto context for key material, set by this function
- * @cipher_name: Name of the cipher.
- * @key_size: Size of the key in bytes.
+ * @cipher_name: Name of the cipher
+ * @key_size: Size of the key in bytes
  *
  * Returns zero on success. Any crypto_tfm structs allocated here
  * should be released by other functions, such as on a superblock put
  * event, regardless of whether this function succeeds for fails.
  */
 int
-ecryptfs_process_cipher(struct crypto_tfm **tfm, struct crypto_tfm **key_tfm,
-                        char *cipher_name, size_t key_size)
+ecryptfs_process_cipher(struct crypto_blkcipher **key_tfm, char *cipher_name,
+                        size_t *key_size)
 {
         char dummy_key[ECRYPTFS_MAX_KEY_BYTES];
+        char *full_alg_name;
         int rc;
 
-        *tfm = *key_tfm = NULL;
-        if (key_size > ECRYPTFS_MAX_KEY_BYTES) {
+        *key_tfm = NULL;
+        if (*key_size > ECRYPTFS_MAX_KEY_BYTES) {
                 rc = -EINVAL;
                 printk(KERN_ERR "Requested key size is [%Zd] bytes; maximum "
-                       "allowable is [%d]\n", key_size, ECRYPTFS_MAX_KEY_BYTES);
+                      "allowable is [%d]\n", *key_size, ECRYPTFS_MAX_KEY_BYTES);
                 goto out;
         }
-        *tfm = crypto_alloc_tfm(cipher_name, (ECRYPTFS_DEFAULT_CHAINING_MODE
-                                              | CRYPTO_TFM_REQ_WEAK_KEY));
-        if (!(*tfm)) {
-                rc = -EINVAL;
-                printk(KERN_ERR "Unable to allocate crypto cipher with name "
-                       "[%s]\n", cipher_name);
+        rc = ecryptfs_crypto_api_algify_cipher_name(&full_alg_name, cipher_name,
+                                                    "ecb");
+        if (rc)
                 goto out;
-        }
-        *key_tfm = crypto_alloc_tfm(cipher_name, CRYPTO_TFM_REQ_WEAK_KEY);
-        if (!(*key_tfm)) {
-                rc = -EINVAL;
+        *key_tfm = crypto_alloc_blkcipher(full_alg_name, 0, CRYPTO_ALG_ASYNC);
+        kfree(full_alg_name);
+        if (IS_ERR(*key_tfm)) {
+                rc = PTR_ERR(*key_tfm);
                 printk(KERN_ERR "Unable to allocate crypto cipher with name "
-                       "[%s]\n", cipher_name);
-                goto out;
-        }
-        if (key_size < crypto_tfm_alg_min_keysize(*tfm)) {
-                rc = -EINVAL;
-                printk(KERN_ERR "Request key size is [%Zd]; minimum key size "
-                       "supported by cipher [%s] is [%d]\n", key_size,
-                       cipher_name, crypto_tfm_alg_min_keysize(*tfm));
-                goto out;
-        }
-        if (key_size < crypto_tfm_alg_min_keysize(*key_tfm)) {
-                rc = -EINVAL;
-                printk(KERN_ERR "Request key size is [%Zd]; minimum key size "
-                       "supported by cipher [%s] is [%d]\n", key_size,
-                       cipher_name, crypto_tfm_alg_min_keysize(*key_tfm));
+                       "[%s]; rc = [%d]\n", cipher_name, rc);
                 goto out;
         }
-        if (key_size > crypto_tfm_alg_max_keysize(*tfm)) {
-                rc = -EINVAL;
-                printk(KERN_ERR "Request key size is [%Zd]; maximum key size "
-                       "supported by cipher [%s] is [%d]\n", key_size,
-                       cipher_name, crypto_tfm_alg_min_keysize(*tfm));
-                goto out;
-        }
-        if (key_size > crypto_tfm_alg_max_keysize(*key_tfm)) {
-                rc = -EINVAL;
-                printk(KERN_ERR "Request key size is [%Zd]; maximum key size "
-                       "supported by cipher [%s] is [%d]\n", key_size,
-                       cipher_name, crypto_tfm_alg_min_keysize(*key_tfm));
-                goto out;
-        }
-        get_random_bytes(dummy_key, key_size);
-        rc = crypto_cipher_setkey(*tfm, dummy_key, key_size);
-        if (rc) {
-                printk(KERN_ERR "Error attempting to set key of size [%Zd] for "
-                       "cipher [%s]; rc = [%d]\n", key_size, cipher_name, rc);
-                rc = -EINVAL;
-                goto out;
+        crypto_blkcipher_set_flags(*key_tfm, CRYPTO_TFM_REQ_WEAK_KEY);
+        if (*key_size == 0) {
+                struct blkcipher_alg *alg = crypto_blkcipher_alg(*key_tfm);
+
+                *key_size = alg->max_keysize;
         }
-        rc = crypto_cipher_setkey(*key_tfm, dummy_key, key_size);
+        get_random_bytes(dummy_key, *key_size);
+        rc = crypto_blkcipher_setkey(*key_tfm, dummy_key, *key_size);
         if (rc) {
                 printk(KERN_ERR "Error attempting to set key of size [%Zd] for "
-                       "cipher [%s]; rc = [%d]\n", key_size, cipher_name, rc);
+                       "cipher [%s]; rc = [%d]\n", *key_size, cipher_name, rc);
                 rc = -EINVAL;
                 goto out;
         }
diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
index f0d2a433242b..0b9992ab990f 100644
--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -24,6 +24,7 @@
 
 #include <linux/dcache.h>
 #include <linux/namei.h>
+#include <linux/mount.h>
 #include "ecryptfs_kernel.h"
 
 /**
@@ -76,8 +77,13 @@ static void ecryptfs_d_release(struct dentry *dentry)
         if (ecryptfs_dentry_to_private(dentry))
                 kmem_cache_free(ecryptfs_dentry_info_cache,
                                 ecryptfs_dentry_to_private(dentry));
-        if (lower_dentry)
+        if (lower_dentry) {
+                struct vfsmount *lower_mnt =
+                        ecryptfs_dentry_to_lower_mnt(dentry);
+
+                mntput(lower_mnt);
                 dput(lower_dentry);
+        }
         return;
 }
 
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 872c9958531a..f992533d1692 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -175,6 +175,7 @@ ecryptfs_get_key_payload_data(struct key *key)
 #define ECRYPTFS_DEFAULT_CIPHER "aes"
 #define ECRYPTFS_DEFAULT_KEY_BYTES 16
 #define ECRYPTFS_DEFAULT_CHAINING_MODE CRYPTO_TFM_MODE_CBC
+#define ECRYPTFS_DEFAULT_HASH "md5"
 #define ECRYPTFS_TAG_3_PACKET_TYPE 0x8C
 #define ECRYPTFS_TAG_11_PACKET_TYPE 0xED
 #define MD5_DIGEST_SIZE 16
@@ -204,15 +205,15 @@ struct ecryptfs_crypt_stat {
         size_t extent_shift;
         unsigned int extent_mask;
         struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
-        struct crypto_tfm *tfm;
-        struct crypto_tfm *md5_tfm; /* Crypto context for generating
-                                     * the initialization vectors */
+        struct crypto_blkcipher *tfm;
+        struct crypto_hash *hash_tfm; /* Crypto context for generating
+                                       * the initialization vectors */
         unsigned char cipher[ECRYPTFS_MAX_CIPHER_NAME_SIZE];
         unsigned char key[ECRYPTFS_MAX_KEY_BYTES];
         unsigned char root_iv[ECRYPTFS_MAX_IV_BYTES];
         unsigned char keysigs[ECRYPTFS_MAX_NUM_KEYSIGS][ECRYPTFS_SIG_SIZE_HEX];
         struct mutex cs_tfm_mutex;
-        struct mutex cs_md5_tfm_mutex;
+        struct mutex cs_hash_tfm_mutex;
         struct mutex cs_mutex;
 };
 
@@ -244,7 +245,7 @@ struct ecryptfs_mount_crypt_stat {
         struct ecryptfs_auth_tok *global_auth_tok;
         struct key *global_auth_tok_key;
         size_t global_default_cipher_key_size;
-        struct crypto_tfm *global_key_tfm;
+        struct crypto_blkcipher *global_key_tfm;
         struct mutex global_key_tfm_mutex;
         unsigned char global_default_cipher_name[ECRYPTFS_MAX_CIPHER_NAME_SIZE
                                                  + 1];
@@ -425,6 +426,9 @@ void ecryptfs_destruct_crypt_stat(struct ecryptfs_crypt_stat *crypt_stat);
 void ecryptfs_destruct_mount_crypt_stat(
         struct ecryptfs_mount_crypt_stat *mount_crypt_stat);
 int ecryptfs_init_crypt_ctx(struct ecryptfs_crypt_stat *crypt_stat);
+int ecryptfs_crypto_api_algify_cipher_name(char **algified_name,
+                                           char *cipher_name,
+                                           char *chaining_modifier);
 int ecryptfs_write_inode_size_to_header(struct file *lower_file,
                                         struct inode *lower_inode,
                                         struct inode *inode);
@@ -473,10 +477,14 @@ ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat,
                           unsigned char *src, struct dentry *ecryptfs_dentry);
 int ecryptfs_truncate(struct dentry *dentry, loff_t new_length);
 int
-ecryptfs_process_cipher(struct crypto_tfm **tfm, struct crypto_tfm **key_tfm,
-                        char *cipher_name, size_t key_size);
+ecryptfs_process_cipher(struct crypto_blkcipher **key_tfm, char *cipher_name,
+                        size_t *key_size);
 int ecryptfs_inode_test(struct inode *inode, void *candidate_lower_inode);
 int ecryptfs_inode_set(struct inode *inode, void *lower_inode);
 void ecryptfs_init_inode(struct inode *inode, struct inode *lower_inode);
+int ecryptfs_open_lower_file(struct file **lower_file,
+                             struct dentry *lower_dentry,
+                             struct vfsmount *lower_mnt, int flags);
+int ecryptfs_close_lower_file(struct file *lower_file);
 
 #endif /* #ifndef ECRYPTFS_KERNEL_H */
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index c8550c9f9cd2..a92ef05eff8f 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -198,6 +198,33 @@ retry:
 
 struct kmem_cache *ecryptfs_file_info_cache;
 
+int ecryptfs_open_lower_file(struct file **lower_file,
+                             struct dentry *lower_dentry,
+                             struct vfsmount *lower_mnt, int flags)
+{
+        int rc = 0;
+
+        dget(lower_dentry);
+        mntget(lower_mnt);
+        *lower_file = dentry_open(lower_dentry, lower_mnt, flags);
+        if (IS_ERR(*lower_file)) {
+                printk(KERN_ERR "Error opening lower file for lower_dentry "
+                       "[0x%p], lower_mnt [0x%p], and flags [0x%x]\n",
+                       lower_dentry, lower_mnt, flags);
+                rc = PTR_ERR(*lower_file);
+                *lower_file = NULL;
+                goto out;
+        }
+out:
+        return rc;
+}
+
+int ecryptfs_close_lower_file(struct file *lower_file)
+{
+        fput(lower_file);
+        return 0;
+}
+
 /**
  * ecryptfs_open
  * @inode: inode speciying file to open
@@ -244,19 +271,15 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                 ECRYPTFS_SET_FLAG(crypt_stat->flags, ECRYPTFS_ENCRYPTED);
         }
         mutex_unlock(&crypt_stat->cs_mutex);
-        /* This mntget & dget is undone via fput when the file is released */
-        dget(lower_dentry);
         lower_flags = file->f_flags;
         if ((lower_flags & O_ACCMODE) == O_WRONLY)
                 lower_flags = (lower_flags & O_ACCMODE) | O_RDWR;
         if (file->f_flags & O_APPEND)
                 lower_flags &= ~O_APPEND;
         lower_mnt = ecryptfs_dentry_to_lower_mnt(ecryptfs_dentry);
-        mntget(lower_mnt);
         /* Corresponding fput() in ecryptfs_release() */
-        lower_file = dentry_open(lower_dentry, lower_mnt, lower_flags);
-        if (IS_ERR(lower_file)) {
-                rc = PTR_ERR(lower_file);
+        if ((rc = ecryptfs_open_lower_file(&lower_file, lower_dentry, lower_mnt,
+                                           lower_flags))) {
                 ecryptfs_printk(KERN_ERR, "Error opening lower file\n");
                 goto out_puts;
         }
@@ -341,11 +364,16 @@ static int ecryptfs_release(struct inode *inode, struct file *file)
         struct file *lower_file = ecryptfs_file_to_lower(file);
         struct ecryptfs_file_info *file_info = ecryptfs_file_to_private(file);
         struct inode *lower_inode = ecryptfs_inode_to_lower(inode);
+        int rc;
 
-        fput(lower_file);
+        if ((rc = ecryptfs_close_lower_file(lower_file))) {
+                printk(KERN_ERR "Error closing lower_file\n");
+                goto out;
+        }
         inode->i_blocks = lower_inode->i_blocks;
         kmem_cache_free(ecryptfs_file_info_cache, file_info);
-        return 0;
+out:
+        return rc;
 }
 
 static int
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index efdd2b7b62d7..ff4865d24f0f 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -231,7 +231,6 @@ static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
         int lower_flags;
         struct ecryptfs_crypt_stat *crypt_stat;
         struct dentry *lower_dentry;
-        struct dentry *tlower_dentry = NULL;
         struct file *lower_file;
         struct inode *inode, *lower_inode;
         struct vfsmount *lower_mnt;
@@ -241,30 +240,19 @@ static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
                         lower_dentry->d_name.name);
         inode = ecryptfs_dentry->d_inode;
         crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
-        tlower_dentry = dget(lower_dentry);
-        if (!tlower_dentry) {
-                rc = -ENOMEM;
-                ecryptfs_printk(KERN_ERR, "Error dget'ing lower_dentry\n");
-                goto out;
-        }
         lower_flags = ((O_CREAT | O_WRONLY | O_TRUNC) & O_ACCMODE) | O_RDWR;
 #if BITS_PER_LONG != 32
         lower_flags |= O_LARGEFILE;
 #endif
         lower_mnt = ecryptfs_dentry_to_lower_mnt(ecryptfs_dentry);
-        mntget(lower_mnt);
         /* Corresponding fput() at end of this function */
-        lower_file = dentry_open(tlower_dentry, lower_mnt, lower_flags);
-        if (IS_ERR(lower_file)) {
-                rc = PTR_ERR(lower_file);
+        if ((rc = ecryptfs_open_lower_file(&lower_file, lower_dentry, lower_mnt,
+                                           lower_flags))) {
                 ecryptfs_printk(KERN_ERR,
                                 "Error opening dentry; rc = [%i]\n", rc);
                 goto out;
         }
-        /* fput(lower_file) should handle the puts if we do this */
-        lower_file->f_dentry = tlower_dentry;
-        lower_file->f_vfsmnt = lower_mnt;
-        lower_inode = tlower_dentry->d_inode;
+        lower_inode = lower_dentry->d_inode;
         if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
                 ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
                 ECRYPTFS_CLEAR_FLAG(crypt_stat->flags, ECRYPTFS_ENCRYPTED);
@@ -285,7 +273,8 @@ static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
         }
         rc = grow_file(ecryptfs_dentry, lower_file, inode, lower_inode);
 out_fput:
-        fput(lower_file);
+        if ((rc = ecryptfs_close_lower_file(lower_file)))
+                printk(KERN_ERR "Error closing lower_file\n");
 out:
         return rc;
 }
@@ -336,7 +325,6 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
         struct dentry *lower_dir_dentry;
         struct dentry *lower_dentry;
         struct vfsmount *lower_mnt;
-        struct dentry *tlower_dentry = NULL;
         char *encoded_name;
         unsigned int encoded_namelen;
         struct ecryptfs_crypt_stat *crypt_stat = NULL;
@@ -347,27 +335,32 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
         lower_dir_dentry = ecryptfs_dentry_to_lower(dentry->d_parent);
         dentry->d_op = &ecryptfs_dops;
         if ((dentry->d_name.len == 1 && !strcmp(dentry->d_name.name, "."))
-            || (dentry->d_name.len == 2 && !strcmp(dentry->d_name.name, "..")))
-                goto out_drop;
+            || (dentry->d_name.len == 2
+                && !strcmp(dentry->d_name.name, ".."))) {
+                d_drop(dentry);
+                goto out;
+        }
         encoded_namelen = ecryptfs_encode_filename(crypt_stat,
                                                    dentry->d_name.name,
                                                    dentry->d_name.len,
                                                    &encoded_name);
         if (encoded_namelen < 0) {
                 rc = encoded_namelen;
-                goto out_drop;
+                d_drop(dentry);
+                goto out;
         }
         ecryptfs_printk(KERN_DEBUG, "encoded_name = [%s]; encoded_namelen "
                         "= [%d]\n", encoded_name, encoded_namelen);
         lower_dentry = lookup_one_len(encoded_name, lower_dir_dentry,
                                       encoded_namelen - 1);
         kfree(encoded_name);
-        lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
         if (IS_ERR(lower_dentry)) {
                 ecryptfs_printk(KERN_ERR, "ERR from lower_dentry\n");
                 rc = PTR_ERR(lower_dentry);
-                goto out_drop;
+                d_drop(dentry);
+                goto out;
         }
+        lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
         ecryptfs_printk(KERN_DEBUG, "lower_dentry = [%p]; lower_dentry->"
                 "d_name.name = [%s]\n", lower_dentry,
                 lower_dentry->d_name.name);
@@ -408,12 +401,6 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
                                 "as we *think* we are about to unlink\n");
                 goto out;
         }
-        tlower_dentry = dget(lower_dentry);
-        if (!tlower_dentry || IS_ERR(tlower_dentry)) {
-                rc = -ENOMEM;
-                ecryptfs_printk(KERN_ERR, "Cannot dget lower_dentry\n");
-                goto out_dput;
-        }
         /* Released in this function */
         page_virt =
             (char *)kmem_cache_alloc(ecryptfs_header_cache_2,
@@ -425,7 +412,7 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
                 goto out_dput;
         }
         memset(page_virt, 0, PAGE_CACHE_SIZE);
-        rc = ecryptfs_read_header_region(page_virt, tlower_dentry, nd->mnt);
+        rc = ecryptfs_read_header_region(page_virt, lower_dentry, nd->mnt);
         crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
         if (!ECRYPTFS_CHECK_FLAG(crypt_stat->flags, ECRYPTFS_POLICY_APPLIED))
                 ecryptfs_set_default_sizes(crypt_stat);
@@ -448,9 +435,6 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
 
 out_dput:
         dput(lower_dentry);
-        if (tlower_dentry)
-                dput(tlower_dentry);
-out_drop:
         d_drop(dentry);
 out:
         return ERR_PTR(rc);
@@ -486,8 +470,8 @@ out_lock:
         unlock_dir(lower_dir_dentry);
         dput(lower_new_dentry);
         dput(lower_old_dentry);
-        if (!new_dentry->d_inode)
-                d_drop(new_dentry);
+        d_drop(new_dentry);
+        d_drop(old_dentry);
         return rc;
 }
 
@@ -576,41 +560,24 @@ out:
 
 static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
 {
-        int rc = 0;
-        struct dentry *tdentry = NULL;
         struct dentry *lower_dentry;
-        struct dentry *tlower_dentry = NULL;
         struct dentry *lower_dir_dentry;
+        int rc;
 
         lower_dentry = ecryptfs_dentry_to_lower(dentry);
-        if (!(tdentry = dget(dentry))) {
-                rc = -EINVAL;
-                ecryptfs_printk(KERN_ERR, "Error dget'ing dentry [%p]\n",
-                                dentry);
-                goto out;
-        }
+        dget(dentry);
         lower_dir_dentry = lock_parent(lower_dentry);
-        if (!(tlower_dentry = dget(lower_dentry))) {
-                rc = -EINVAL;
-                ecryptfs_printk(KERN_ERR, "Error dget'ing lower_dentry "
-                                "[%p]\n", lower_dentry);
-                goto out;
-        }
+        dget(lower_dentry);
         rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry);
-        if (!rc) {
-                d_delete(tlower_dentry);
-                tlower_dentry = NULL;
-        }
+        dput(lower_dentry);
+        if (!rc)
+                d_delete(lower_dentry);
         ecryptfs_copy_attr_times(dir, lower_dir_dentry->d_inode);
         dir->i_nlink = lower_dir_dentry->d_inode->i_nlink;
         unlock_dir(lower_dir_dentry);
         if (!rc)
                 d_drop(dentry);
-out:
-        if (tdentry)
-                dput(tdentry);
-        if (tlower_dentry)
-                dput(tlower_dentry);
+        dput(dentry);
         return rc;
 }
 
@@ -832,12 +799,11 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
         }
         lower_dentry = ecryptfs_dentry_to_lower(dentry);
         /* This dget & mntget is released through fput at out_fput: */
-        dget(lower_dentry);
         lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
-        mntget(lower_mnt);
-        lower_file = dentry_open(lower_dentry, lower_mnt, O_RDWR);
-        if (unlikely(IS_ERR(lower_file))) {
-                rc = PTR_ERR(lower_file);
+        if ((rc = ecryptfs_open_lower_file(&lower_file, lower_dentry, lower_mnt,
+                                           O_RDWR))) {
+                ecryptfs_printk(KERN_ERR,
+                                "Error opening dentry; rc = [%i]\n", rc);
                 goto out_free;
         }
         ecryptfs_set_file_lower(&fake_ecryptfs_file, lower_file);
@@ -879,7 +845,8 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
                 = CURRENT_TIME;
         mark_inode_dirty_sync(inode);
 out_fput:
-        fput(lower_file);
+        if ((rc = ecryptfs_close_lower_file(lower_file)))
+                printk(KERN_ERR "Error closing lower_file\n");
 out_free:
         if (ecryptfs_file_to_private(&fake_ecryptfs_file))
                 kmem_cache_free(ecryptfs_file_info_cache,
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index ba454785a0c5..c3746f56d162 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -458,14 +458,16 @@ out:
 static int decrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
                                struct ecryptfs_crypt_stat *crypt_stat)
 {
-        int rc = 0;
         struct ecryptfs_password *password_s_ptr;
-        struct crypto_tfm *tfm = NULL;
         struct scatterlist src_sg[2], dst_sg[2];
         struct mutex *tfm_mutex = NULL;
         /* TODO: Use virt_to_scatterlist for these */
         char *encrypted_session_key;
         char *session_key;
+        struct blkcipher_desc desc = {
+                .flags = CRYPTO_TFM_REQ_MAY_SLEEP
+        };
+        int rc = 0;
 
         password_s_ptr = &auth_tok->token.password;
         if (ECRYPTFS_CHECK_FLAG(password_s_ptr->flags,
@@ -482,30 +484,37 @@ static int decrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
         if (!strcmp(crypt_stat->cipher,
                     crypt_stat->mount_crypt_stat->global_default_cipher_name)
             && crypt_stat->mount_crypt_stat->global_key_tfm) {
-                tfm = crypt_stat->mount_crypt_stat->global_key_tfm;
+                desc.tfm = crypt_stat->mount_crypt_stat->global_key_tfm;
                 tfm_mutex = &crypt_stat->mount_crypt_stat->global_key_tfm_mutex;
         } else {
-                tfm = crypto_alloc_tfm(crypt_stat->cipher,
-                                       CRYPTO_TFM_REQ_WEAK_KEY);
-                if (!tfm) {
-                        printk(KERN_ERR "Error allocating crypto context\n");
-                        rc = -ENOMEM;
+                char *full_alg_name;
+
+                rc = ecryptfs_crypto_api_algify_cipher_name(&full_alg_name,
+                                                            crypt_stat->cipher,
+                                                            "ecb");
+                if (rc)
+                        goto out;
+                desc.tfm = crypto_alloc_blkcipher(full_alg_name, 0,
+                                                  CRYPTO_ALG_ASYNC);
+                kfree(full_alg_name);
+                if (IS_ERR(desc.tfm)) {
+                        rc = PTR_ERR(desc.tfm);
+                        printk(KERN_ERR "Error allocating crypto context; "
+                               "rc = [%d]\n", rc);
                         goto out;
                 }
-        }
-        if (password_s_ptr->session_key_encryption_key_bytes
-            < crypto_tfm_alg_min_keysize(tfm)) {
-                printk(KERN_WARNING "Session key encryption key is [%d] bytes; "
-                       "minimum keysize for selected cipher is [%d] bytes.\n",
-                       password_s_ptr->session_key_encryption_key_bytes,
-                       crypto_tfm_alg_min_keysize(tfm));
-                rc = -EINVAL;
-                goto out;
+                crypto_blkcipher_set_flags(desc.tfm, CRYPTO_TFM_REQ_WEAK_KEY);
         }
         if (tfm_mutex)
                 mutex_lock(tfm_mutex);
-        crypto_cipher_setkey(tfm, password_s_ptr->session_key_encryption_key,
-                             crypt_stat->key_size);
+        rc = crypto_blkcipher_setkey(desc.tfm,
+                                     password_s_ptr->session_key_encryption_key,
+                                     crypt_stat->key_size);
+        if (rc < 0) {
+                printk(KERN_ERR "Error setting key for crypto context\n");
+                rc = -EINVAL;
+                goto out_free_tfm;
+        }
         /* TODO: virt_to_scatterlist */
         encrypted_session_key = (char *)__get_free_page(GFP_KERNEL);
         if (!encrypted_session_key) {
@@ -531,9 +540,12 @@ static int decrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
         auth_tok->session_key.decrypted_key_size =
             auth_tok->session_key.encrypted_key_size;
         dst_sg[0].length = auth_tok->session_key.encrypted_key_size;
-        /* TODO: Handle error condition */
-        crypto_cipher_decrypt(tfm, dst_sg, src_sg,
-                              auth_tok->session_key.encrypted_key_size);
+        rc = crypto_blkcipher_decrypt(&desc, dst_sg, src_sg,
+                                      auth_tok->session_key.encrypted_key_size);
+        if (rc) {
+                printk(KERN_ERR "Error decrypting; rc = [%d]\n", rc);
+                goto out_free_memory;
+        }
         auth_tok->session_key.decrypted_key_size =
             auth_tok->session_key.encrypted_key_size;
         memcpy(auth_tok->session_key.decrypted_key, session_key,
@@ -546,6 +558,7 @@ static int decrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
         if (ecryptfs_verbosity > 0)
                 ecryptfs_dump_hex(crypt_stat->key,
                                   crypt_stat->key_size);
+out_free_memory:
         memset(encrypted_session_key, 0, PAGE_CACHE_SIZE);
         free_page((unsigned long)encrypted_session_key);
         memset(session_key, 0, PAGE_CACHE_SIZE);
@@ -554,7 +567,7 @@ out_free_tfm:
         if (tfm_mutex)
                 mutex_unlock(tfm_mutex);
         else
-                crypto_free_tfm(tfm);
+                crypto_free_blkcipher(desc.tfm);
 out:
         return rc;
 }
@@ -803,19 +816,21 @@ write_tag_3_packet(char *dest, size_t max, struct ecryptfs_auth_tok *auth_tok,
                    struct ecryptfs_crypt_stat *crypt_stat,
                    struct ecryptfs_key_record *key_rec, size_t *packet_size)
 {
-        int rc = 0;
-
         size_t i;
         size_t signature_is_valid = 0;
         size_t encrypted_session_key_valid = 0;
         char session_key_encryption_key[ECRYPTFS_MAX_KEY_BYTES];
         struct scatterlist dest_sg[2];
         struct scatterlist src_sg[2];
-        struct crypto_tfm *tfm = NULL;
         struct mutex *tfm_mutex = NULL;
         size_t key_rec_size;
         size_t packet_size_length;
         size_t cipher_code;
+        struct blkcipher_desc desc = {
+                .tfm = NULL,
+                .flags = CRYPTO_TFM_REQ_MAY_SLEEP
+        };
+        int rc = 0;
 
         (*packet_size) = 0;
         /* Check for a valid signature on the auth_tok */
@@ -882,33 +897,48 @@ write_tag_3_packet(char *dest, size_t max, struct ecryptfs_auth_tok *auth_tok,
         if (!strcmp(crypt_stat->cipher,
                     crypt_stat->mount_crypt_stat->global_default_cipher_name)
             && crypt_stat->mount_crypt_stat->global_key_tfm) {
-                tfm = crypt_stat->mount_crypt_stat->global_key_tfm;
+                desc.tfm = crypt_stat->mount_crypt_stat->global_key_tfm;
                 tfm_mutex = &crypt_stat->mount_crypt_stat->global_key_tfm_mutex;
-        } else
-                tfm = crypto_alloc_tfm(crypt_stat->cipher, 0);
-        if (!tfm) {
-                ecryptfs_printk(KERN_ERR, "Could not initialize crypto "
-                                "context for cipher [%s]\n",
-                                crypt_stat->cipher);
-                rc = -EINVAL;
-                goto out;
+        } else {
+                char *full_alg_name;
+
+                rc = ecryptfs_crypto_api_algify_cipher_name(&full_alg_name,
+                                                            crypt_stat->cipher,
+                                                            "ecb");
+                if (rc)
+                        goto out;
+                desc.tfm = crypto_alloc_blkcipher(full_alg_name, 0,
+                                                  CRYPTO_ALG_ASYNC);
+                kfree(full_alg_name);
+                if (IS_ERR(desc.tfm)) {
+                        rc = PTR_ERR(desc.tfm);
+                        ecryptfs_printk(KERN_ERR, "Could not initialize crypto "
+                                        "context for cipher [%s]; rc = [%d]\n",
+                                        crypt_stat->cipher, rc);
+                        goto out;
+                }
+                crypto_blkcipher_set_flags(desc.tfm, CRYPTO_TFM_REQ_WEAK_KEY);
         }
         if (tfm_mutex)
                 mutex_lock(tfm_mutex);
-        rc = crypto_cipher_setkey(tfm, session_key_encryption_key,
-                                  crypt_stat->key_size);
+        rc = crypto_blkcipher_setkey(desc.tfm, session_key_encryption_key,
+                                     crypt_stat->key_size);
         if (rc < 0) {
                 if (tfm_mutex)
                         mutex_unlock(tfm_mutex);
                 ecryptfs_printk(KERN_ERR, "Error setting key for crypto "
-                                "context\n");
+                                "context; rc = [%d]\n", rc);
                 goto out;
         }
         rc = 0;
         ecryptfs_printk(KERN_DEBUG, "Encrypting [%d] bytes of the key\n",
                         crypt_stat->key_size);
-        crypto_cipher_encrypt(tfm, dest_sg, src_sg,
-                              (*key_rec).enc_key_size);
+        rc = crypto_blkcipher_encrypt(&desc, dest_sg, src_sg,
+                                      (*key_rec).enc_key_size);
+        if (rc) {
+                printk(KERN_ERR "Error encrypting; rc = [%d]\n", rc);
+                goto out;
+        }
         if (tfm_mutex)
                 mutex_unlock(tfm_mutex);
         ecryptfs_printk(KERN_DEBUG, "This should be the encrypted key:\n");
@@ -971,8 +1001,8 @@ encrypted_session_key_set:
                (*key_rec).enc_key_size);
         (*packet_size) += (*key_rec).enc_key_size;
 out:
-        if (tfm && !tfm_mutex)
-                crypto_free_tfm(tfm);
+        if (desc.tfm && !tfm_mutex)
+                crypto_free_blkcipher(desc.tfm);
         if (rc)
                 (*packet_size) = 0;
         return rc;
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 5938a232d11b..a78d87d14baf 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -208,7 +208,6 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
         char *cipher_name_dst;
         char *cipher_name_src;
         char *cipher_key_bytes_src;
-        struct crypto_tfm *tmp_tfm;
         int cipher_name_len;
 
         if (!options) {
@@ -305,25 +304,19 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
                     = '\0';
         }
         if (!cipher_key_bytes_set) {
-                mount_crypt_stat->global_default_cipher_key_size =
-                        ECRYPTFS_DEFAULT_KEY_BYTES;
-                ecryptfs_printk(KERN_DEBUG, "Cipher key size was not "
-                                "specified.  Defaulting to [%d]\n",
-                                mount_crypt_stat->
-                                global_default_cipher_key_size);
+                mount_crypt_stat->global_default_cipher_key_size = 0;
         }
         rc = ecryptfs_process_cipher(
-                &tmp_tfm,
                 &mount_crypt_stat->global_key_tfm,
                 mount_crypt_stat->global_default_cipher_name,
-                mount_crypt_stat->global_default_cipher_key_size);
-        if (tmp_tfm)
-                crypto_free_tfm(tmp_tfm);
+                &mount_crypt_stat->global_default_cipher_key_size);
         if (rc) {
                 printk(KERN_ERR "Error attempting to initialize cipher [%s] "
                        "with key size [%Zd] bytes; rc = [%d]\n",
                        mount_crypt_stat->global_default_cipher_name,
                        mount_crypt_stat->global_default_cipher_key_size, rc);
+                mount_crypt_stat->global_key_tfm = NULL;
+                mount_crypt_stat->global_auth_tok_key = NULL;
                 rc = -EINVAL;
                 goto out;
         }
diff --git a/fs/ecryptfs/super.c b/fs/ecryptfs/super.c
index c337c0410fb1..825757ae4867 100644
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -138,23 +138,6 @@ static void ecryptfs_clear_inode(struct inode *inode)
 }
 
 /**
- * ecryptfs_umount_begin
- *
- * Called in do_umount().
- */
-static void ecryptfs_umount_begin(struct vfsmount *vfsmnt, int flags)
-{
-        struct vfsmount *lower_mnt =
-                ecryptfs_dentry_to_lower_mnt(vfsmnt->mnt_sb->s_root);
-        struct super_block *lower_sb;
-
-        mntput(lower_mnt);
-        lower_sb = lower_mnt->mnt_sb;
-        if (lower_sb->s_op->umount_begin)
-                lower_sb->s_op->umount_begin(lower_mnt, flags);
-}
-
-/**
  * ecryptfs_show_options
  *
  * Prints the directory we are currently mounted over.
@@ -193,6 +176,5 @@ struct super_operations ecryptfs_sops = {
         .statfs = ecryptfs_statfs,
         .remount_fs = NULL,
         .clear_inode = ecryptfs_clear_inode,
-        .umount_begin = ecryptfs_umount_begin,
         .show_options = ecryptfs_show_options
 };
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 2bb5ace3882d..763a50daf1c0 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -397,14 +397,14 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
 
         err = -EIO;
         if (is_bad_inode(inode))
-                goto clean_pages_up;
+                goto out;
 
         data.file = file;
         data.inode = inode;
         data.req = fuse_get_req(fc);
         err = PTR_ERR(data.req);
         if (IS_ERR(data.req))
-                goto clean_pages_up;
+                goto out;
 
         err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
         if (!err) {
@@ -413,10 +413,7 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
                 else
                         fuse_put_request(fc, data.req);
         }
-        return err;
-
-clean_pages_up:
-        put_pages_list(pages);
+out:
         return err;
 }
 
diff --git a/fs/gfs2/ops_address.c b/fs/gfs2/ops_address.c
index 8d5963c7e123..015640b3f123 100644
--- a/fs/gfs2/ops_address.c
+++ b/fs/gfs2/ops_address.c
@@ -337,13 +337,6 @@ out:
 out_noerror:
         ret = 0;
 out_unlock:
-        /* unlock all pages, we can't do any I/O right now */
-        for (page_idx = 0; page_idx < nr_pages; page_idx++) {
-                struct page *page = list_entry(pages->prev, struct page, lru);
-                list_del(&page->lru);
-                unlock_page(page);
-                page_cache_release(page);
-        }
         if (do_unlock)
                 gfs2_holder_uninit(&gh);
         goto out;
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index e9d07704680e..81b8565d3837 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -274,7 +274,7 @@ nfsd4_clear_clid_dir(struct dentry *dir, struct dentry *dentry)
          * any regular files anyway, just in case the directory was created by
          * a kernel from the future.... */
         nfsd4_list_rec_dir(dentry, nfsd4_remove_clid_file);
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
         status = vfs_rmdir(dir->d_inode, dentry);
         mutex_unlock(&dir->d_inode->i_mutex);
         return status;
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 9041802df832..17249994110f 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1619,6 +1619,7 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
                       "jmacd-8: reiserfs_fill_super: unable to read bitmap");
                 goto error;
         }
+        errval = -EINVAL;
 #ifdef CONFIG_REISERFS_CHECK
         SWARN(silent, s, "CONFIG_REISERFS_CHECK is set ON");
         SWARN(silent, s, "- it is slow mode for debugging.");
diff --git a/fs/xattr.c b/fs/xattr.c
index 395635100f77..0901bdc2ce24 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -48,14 +48,21 @@ xattr_permission(struct inode *inode, const char *name, int mask)
                 return 0;
 
         /*
-         * The trusted.* namespace can only accessed by a privilegued user.
+         * The trusted.* namespace can only be accessed by a privileged user.
          */
         if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
                 return (capable(CAP_SYS_ADMIN) ? 0 : -EPERM);
 
+        /* In user.* namespace, only regular files and directories can have
+         * extended attributes. For sticky directories, only the owner and
+         * privileged user can write attributes.
+         */
         if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
-                if (!S_ISREG(inode->i_mode) &&
-                    (!S_ISDIR(inode->i_mode) || inode->i_mode & S_ISVTX))
+                if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
+                        return -EPERM;
+                if (S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX) &&
+                    (mask & MAY_WRITE) && (current->fsuid != inode->i_uid) &&
+                    !capable(CAP_FOWNER))
                         return -EPERM;
         }