diff -urP linux-2.6.7-vanilla/Makefile linux-2.6.7/Makefile
--- linux-2.6.7-vanilla/Makefile	2004-06-16 01:19:37.000000000 -0400
+++ linux-2.6.7/Makefile	2004-09-24 04:52:07.000000000 -0400
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 7
-EXTRAVERSION =
+EXTRAVERSION = -tje
 NAME=Zonked Quokka
 
 # *DOCUMENTATION*
diff -urP linux-2.6.7-vanilla/fs/ext3/fsync.c linux-2.6.7/fs/ext3/fsync.c
--- linux-2.6.7-vanilla/fs/ext3/fsync.c	2004-06-16 01:20:19.000000000 -0400
+++ linux-2.6.7/fs/ext3/fsync.c	2004-09-16 23:53:39.000000000 -0400
@@ -76,6 +76,10 @@
 		goto out;
 	}
 
+	smp_mb();		/* prepare for locless i_state read */
+	if(!(inode->i_state & I_DIRTY))
+		goto out;
+
 	/*
 	 * The VFS has written the file data.  If the inode is unaltered
 	 * then we need not start a commit.
diff -urP linux-2.6.7-vanilla/fs/ext3/fsync.c.orig linux-2.6.7/fs/ext3/fsync.c.orig
--- linux-2.6.7-vanilla/fs/ext3/fsync.c.orig	1969-12-31 19:00:00.000000000 -0500
+++ linux-2.6.7/fs/ext3/fsync.c.orig	2004-06-16 01:20:19.000000000 -0400
@@ -0,0 +1,92 @@
+/*
+ *  linux/fs/ext3/fsync.c
+ *
+ *  Copyright (C) 1993  Stephen Tweedie (sct@redhat.com)
+ *  from
+ *  Copyright (C) 1992  Remy Card (card@masi.ibp.fr)
+ *                      Laboratoire MASI - Institut Blaise Pascal
+ *                      Universite Pierre et Marie Curie (Paris VI)
+ *  from
+ *  linux/fs/minix/truncate.c   Copyright (C) 1991, 1992  Linus Torvalds
+ * 
+ *  ext3fs fsync primitive
+ *
+ *  Big-endian to little-endian byte-swapping/bitmaps by
+ *        David S. Miller (davem@caip.rutgers.edu), 1995
+ * 
+ *  Removed unnecessary code duplication for little endian machines
+ *  and excessive __inline__s. 
+ *        Andi Kleen, 1997
+ *
+ * Major simplications and cleanup - we only need to do the metadata, because
+ * we can depend on generic_block_fdatasync() to sync the data blocks.
+ */
+
+#include <linux/time.h>
+#include <linux/fs.h>
+#include <linux/sched.h>
+#include <linux/writeback.h>
+#include <linux/jbd.h>
+#include <linux/ext3_fs.h>
+#include <linux/ext3_jbd.h>
+
+/*
+ * akpm: A new design for ext3_sync_file().
+ *
+ * This is only called from sys_fsync(), sys_fdatasync() and sys_msync().
+ * There cannot be a transaction open by this task.
+ * Another task could have dirtied this inode.  Its data can be in any
+ * state in the journalling system.
+ *
+ * What we do is just kick off a commit and wait on it.  This will snapshot the
+ * inode to disk.
+ */
+
+int ext3_sync_file(struct file * file, struct dentry *dentry, int datasync)
+{
+	struct inode *inode = dentry->d_inode;
+	int ret = 0;
+
+	J_ASSERT(ext3_journal_current_handle() == 0);
+
+	smp_mb();		/* prepare for lockless i_state read */
+	if (!(inode->i_state & I_DIRTY))
+		goto out;
+
+	/*
+	 * data=writeback:
+	 *  The caller's filemap_fdatawrite()/wait will sync the data.
+	 *  sync_inode() will sync the metadata
+	 *
+	 * data=ordered:
+	 *  The caller's filemap_fdatawrite() will write the data and
+	 *  sync_inode() will write the inode if it is dirty.  Then the caller's
+	 *  filemap_fdatawait() will wait on the pages.
+	 *
+	 * data=journal:
+	 *  filemap_fdatawrite won't do anything (the buffers are clean).
+	 *  ext3_force_commit will write the file data into the journal and
+	 *  will wait on that.
+	 *  filemap_fdatawait() will encounter a ton of newly-dirtied pages
+	 *  (they were dirtied by commit).  But that's OK - the blocks are
+	 *  safe in-journal, which is all fsync() needs to ensure.
+	 */
+	if (ext3_should_journal_data(inode)) {
+		ret = ext3_force_commit(inode->i_sb);
+		goto out;
+	}
+
+	/*
+	 * The VFS has written the file data.  If the inode is unaltered
+	 * then we need not start a commit.
+	 */
+	if (inode->i_state & (I_DIRTY_SYNC|I_DIRTY_DATASYNC)) {
+		struct writeback_control wbc = {
+			.sync_mode = WB_SYNC_ALL,
+			.nr_to_write = 0, /* sys_fsync did this */
+		};
+		ret = sync_inode(inode, &wbc);
+	}
+out:
+	return ret;
+}
diff -urP linux-2.6.7-vanilla/fs/locks.c linux-2.6.7/fs/locks.c
--- linux-2.6.7-vanilla/fs/locks.c	2004-06-16 01:20:03.000000000 -0400
+++ linux-2.6.7/fs/locks.c	2004-09-17 14:32:20.000000000 -0400
@@ -459,7 +459,8 @@
 	}
 	list_add_tail(&waiter->fl_block, &blocker->fl_block);
 	waiter->fl_next = blocker;
-	list_add(&waiter->fl_link, &blocked_list);
+	if(IS_POSIX(blocker))
+		list_add(&waiter->fl_link, &blocked_list);
 }
 
 /* Wake up processes blocked waiting for blocker.
diff -urP linux-2.6.7-vanilla/fs/nfsd/nfs3xdr.c linux-2.6.7/fs/nfsd/nfs3xdr.c
--- linux-2.6.7-vanilla/fs/nfsd/nfs3xdr.c	2004-06-16 01:18:37.000000000 -0400
+++ linux-2.6.7/fs/nfsd/nfs3xdr.c	2004-09-17 14:42:23.000000000 -0400
@@ -74,7 +74,7 @@
 static inline u32 *
 encode_fh(u32 *p, struct svc_fh *fhp)
 {
-	int size = fhp->fh_handle.fh_size;
+	unsigned int size = fhp->fh_handle.fh_size;
 	*p++ = htonl(size);
 	if (size) p[XDR_QUADLEN(size)-1]=0;
 	memcpy(p, &fhp->fh_handle.fh_base, size);
@@ -328,7 +328,7 @@
 nfs3svc_decode_readargs(struct svc_rqst *rqstp, u32 *p,
 					struct nfsd3_readargs *args)
 {
-	int len;
+	unsigned int len;
 	int v,pn;
 
 	if (!(p = decode_fh(p, &args->fh))
@@ -358,7 +358,7 @@
 nfs3svc_decode_writeargs(struct svc_rqst *rqstp, u32 *p,
 					struct nfsd3_writeargs *args)
 {
-	int len, v;
+	unsigned int len, v;
 
 	if (!(p = decode_fh(p, &args->fh))
 	 || !(p = xdr_decode_hyper(p, &args->offset)))
@@ -368,6 +368,12 @@
 	args->stable = ntohl(*p++);
 	len = args->len = ntohl(*p++);
 
+	if (rqstp->rq_arg.len <
+	    len + ( (char*)p -
+		    (char*)rqstp->rq_arg.head[0].iov_base)) {
+		return 0;
+	}
+
 	args->vec[0].iov_base = (void*)p;
 	args->vec[0].iov_len = rqstp->rq_arg.head[0].iov_len -
 		(((void*)p) - rqstp->rq_arg.head[0].iov_base);
@@ -427,7 +433,7 @@
 nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, u32 *p,
 					struct nfsd3_symlinkargs *args)
 {
-	int len;
+	unsigned int len;
 	int avail;
 	char *old, *new;
 	struct iovec *vec;
@@ -444,7 +450,7 @@
 	 */
 	svc_take_page(rqstp);
 	len = ntohl(*p++);
-	if (len <= 0 || len > NFS3_MAXPATHLEN || len >= PAGE_SIZE)
+	if (len == 0 || len > NFS3_MAXPATHLEN || len >= PAGE_SIZE)
 		return 0;
 	args->tname = new = page_address(rqstp->rq_respages[rqstp->rq_resused-1]);
 	args->tlen = len;
diff -urP linux-2.6.7-vanilla/fs/nfsd/nfsxdr.c linux-2.6.7/fs/nfsd/nfsxdr.c
--- linux-2.6.7-vanilla/fs/nfsd/nfsxdr.c	2004-06-16 01:18:53.000000000 -0400
+++ linux-2.6.7/fs/nfsd/nfsxdr.c	2004-09-17 14:42:23.000000000 -0400
@@ -234,7 +234,7 @@
 nfssvc_decode_readargs(struct svc_rqst *rqstp, u32 *p,
 					struct nfsd_readargs *args)
 {
-	int len;
+	unsigned int len;
 	int v,pn;
 	if (!(p = decode_fh(p, &args->fh)))
 		return 0;
@@ -266,7 +266,7 @@
 nfssvc_decode_writeargs(struct svc_rqst *rqstp, u32 *p,
 					struct nfsd_writeargs *args)
 {
-	int len;
+	unsigned int len;
 	int v;
 	if (!(p = decode_fh(p, &args->fh)))
 		return 0;

