21 files changed, 221 insertions, 145 deletions

diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index ee45648b0d1a..7cb0f7f847e4 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -3,6 +3,7 @@ config CIFS
         depends on INET
         select NLS
         select CRYPTO
+        select CRYPTO_MD4
         select CRYPTO_MD5
         select CRYPTO_HMAC
         select CRYPTO_ARC4
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index f1c68629f277..0a265ad9e426 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -282,8 +282,6 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
         cFYI(1, "in %s", __func__);
         BUG_ON(IS_ROOT(mntpt));
 
-        xid = GetXid();
-
         /*
          * The MSDFS spec states that paths in DFS referral requests and
          * responses must be prefixed by a single '\' character instead of
@@ -293,7 +291,7 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
         mnt = ERR_PTR(-ENOMEM);
         full_path = build_path_from_dentry(mntpt);
         if (full_path == NULL)
-                goto free_xid;
+                goto cdda_exit;
 
         cifs_sb = CIFS_SB(mntpt->d_inode->i_sb);
         tlink = cifs_sb_tlink(cifs_sb);
@@ -303,9 +301,11 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
         }
         ses = tlink_tcon(tlink)->ses;
 
+        xid = GetXid();
         rc = get_dfs_path(xid, ses, full_path + 1, cifs_sb->local_nls,
                 &num_referrals, &referrals,
                 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
+        FreeXid(xid);
 
         cifs_put_tlink(tlink);
 
@@ -338,8 +338,7 @@ success:
         free_dfs_info_array(referrals, num_referrals);
 free_full_path:
         kfree(full_path);
-free_xid:
-        FreeXid(xid);
+cdda_exit:
         cFYI(1, "leaving %s" , __func__);
         return mnt;
 }
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 0db5f1de0227..a51585f9852b 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -657,9 +657,10 @@ calc_seckey(struct cifsSesInfo *ses)
         get_random_bytes(sec_key, CIFS_SESS_KEY_SIZE);
 
         tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
-        if (!tfm_arc4 || IS_ERR(tfm_arc4)) {
+        if (IS_ERR(tfm_arc4)) {
+                rc = PTR_ERR(tfm_arc4);
                 cERROR(1, "could not allocate crypto API arc4\n");
-                return PTR_ERR(tfm_arc4);
+                return rc;
         }
 
         desc.tfm = tfm_arc4;
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 14789a97304e..4a3330235d55 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -127,5 +127,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* EXPERIMENTAL */
 
-#define CIFS_VERSION   "1.69"
+#define CIFS_VERSION   "1.70"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 3106f5e5c633..46c66ed01af4 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -4914,7 +4914,6 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
                    __u16 fid, __u32 pid_of_opener, bool SetAllocation)
 {
         struct smb_com_transaction2_sfi_req *pSMB  = NULL;
-        char *data_offset;
         struct file_end_of_file_info *parm_data;
         int rc = 0;
         __u16 params, param_offset, offset, byte_count, count;
@@ -4938,8 +4937,6 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
         param_offset = offsetof(struct smb_com_transaction2_sfi_req, Fid) - 4;
         offset = param_offset + params;
 
-        data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
-
         count = sizeof(struct file_end_of_file_info);
         pSMB->MaxParameterCount = cpu_to_le16(2);
         /* BB find exact max SMB PDU from sess structure BB */
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 0de17c1db608..74c0a282d012 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -346,7 +346,6 @@ int cifs_open(struct inode *inode, struct file *file)
         struct cifsTconInfo *tcon;
         struct tcon_link *tlink;
         struct cifsFileInfo *pCifsFile = NULL;
-        struct cifsInodeInfo *pCifsInode;
         char *full_path = NULL;
         bool posix_open_ok = false;
         __u16 netfid;
@@ -361,8 +360,6 @@ int cifs_open(struct inode *inode, struct file *file)
         }
         tcon = tlink_tcon(tlink);
 
-        pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
-
         full_path = build_path_from_dentry(file->f_path.dentry);
         if (full_path == NULL) {
                 rc = -ENOMEM;
@@ -1146,7 +1143,6 @@ static int cifs_partialpagewrite(struct page *page, unsigned from, unsigned to)
         char *write_data;
         int rc = -EFAULT;
         int bytes_written = 0;
-        struct cifs_sb_info *cifs_sb;
         struct inode *inode;
         struct cifsFileInfo *open_file;
 
@@ -1154,7 +1150,6 @@ static int cifs_partialpagewrite(struct page *page, unsigned from, unsigned to)
                 return -EFAULT;
 
         inode = page->mapping->host;
-        cifs_sb = CIFS_SB(inode->i_sb);
 
         offset += (loff_t)from;
         write_data = kmap(page);
@@ -1667,7 +1662,8 @@ static ssize_t
 cifs_iovec_write(struct file *file, const struct iovec *iov,
                  unsigned long nr_segs, loff_t *poffset)
 {
-        size_t total_written = 0, written = 0;
+        size_t total_written = 0;
+        unsigned int written = 0;
         unsigned long num_pages, npages;
         size_t copied, len, cur_len, i;
         struct kvec *to_send;
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 02cd60aefbff..e8804d373404 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -55,8 +55,9 @@ symlink_hash(unsigned int link_len, const char *link_str, u8 *md5_hash)
 
         md5 = crypto_alloc_shash("md5", 0, 0);
         if (IS_ERR(md5)) {
+                rc = PTR_ERR(md5);
                 cERROR(1, "%s: Crypto md5 allocation error %d\n", __func__, rc);
-                return PTR_ERR(md5);
+                return rc;
         }
         size = sizeof(struct shash_desc) + crypto_shash_descsize(md5);
         sdescmd5 = kmalloc(size, GFP_KERNEL);
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index a09e077ba925..2a930a752a78 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -236,10 +236,7 @@ __u16 GetNextMid(struct TCP_Server_Info *server)
 {
         __u16 mid = 0;
         __u16 last_mid;
-        int   collision;
-
-        if (server == NULL)
-                return mid;
+        bool collision;
 
         spin_lock(&GlobalMid_Lock);
         last_mid = server->CurrentMid; /* we do not want to loop forever */
@@ -252,24 +249,38 @@ __u16 GetNextMid(struct TCP_Server_Info *server)
         (and it would also have to have been a request that
          did not time out) */
         while (server->CurrentMid != last_mid) {
-                struct list_head *tmp;
                 struct mid_q_entry *mid_entry;
+                unsigned int num_mids;
 
-                collision = 0;
+                collision = false;
                 if (server->CurrentMid == 0)
                         server->CurrentMid++;
 
-                list_for_each(tmp, &server->pending_mid_q) {
-                        mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
-
-                        if ((mid_entry->mid == server->CurrentMid) &&
-                            (mid_entry->midState == MID_REQUEST_SUBMITTED)) {
+                num_mids = 0;
+                list_for_each_entry(mid_entry, &server->pending_mid_q, qhead) {
+                        ++num_mids;
+                        if (mid_entry->mid == server->CurrentMid &&
+                            mid_entry->midState == MID_REQUEST_SUBMITTED) {
                                 /* This mid is in use, try a different one */
-                                collision = 1;
+                                collision = true;
                                 break;
                         }
                 }
-                if (collision == 0) {
+
+                /*
+                 * if we have more than 32k mids in the list, then something
+                 * is very wrong. Possibly a local user is trying to DoS the
+                 * box by issuing long-running calls and SIGKILL'ing them. If
+                 * we get to 2^16 mids then we're in big trouble as this
+                 * function could loop forever.
+                 *
+                 * Go ahead and assign out the mid in this situation, but force
+                 * an eventual reconnect to clean out the pending_mid_q.
+                 */
+                if (num_mids > 32768)
+                        server->tcpStatus = CifsNeedReconnect;
+
+                if (!collision) {
                         mid = server->CurrentMid;
                         break;
                 }
@@ -381,29 +392,31 @@ header_assemble(struct smb_hdr *buffer, char smb_command /* command */ ,
 }
 
 static int
-checkSMBhdr(struct smb_hdr *smb, __u16 mid)
+check_smb_hdr(struct smb_hdr *smb, __u16 mid)
 {
-        /* Make sure that this really is an SMB, that it is a response,
-           and that the message ids match */
-        if ((*(__le32 *) smb->Protocol == cpu_to_le32(0x424d53ff)) &&
-                (mid == smb->Mid)) {
-                if (smb->Flags & SMBFLG_RESPONSE)
-                        return 0;
-                else {
-                /* only one valid case where server sends us request */
-                        if (smb->Command == SMB_COM_LOCKING_ANDX)
-                                return 0;
-                        else
-                                cERROR(1, "Received Request not response");
-                }
-        } else { /* bad signature or mid */
-                if (*(__le32 *) smb->Protocol != cpu_to_le32(0x424d53ff))
-                        cERROR(1, "Bad protocol string signature header %x",
-                                *(unsigned int *) smb->Protocol);
-                if (mid != smb->Mid)
-                        cERROR(1, "Mids do not match");
+        /* does it have the right SMB "signature" ? */
+        if (*(__le32 *) smb->Protocol != cpu_to_le32(0x424d53ff)) {
+                cERROR(1, "Bad protocol string signature header 0x%x",
+                        *(unsigned int *)smb->Protocol);
+                return 1;
+        }
+
+        /* Make sure that message ids match */
+        if (mid != smb->Mid) {
+                cERROR(1, "Mids do not match. received=%u expected=%u",
+                        smb->Mid, mid);
+                return 1;
         }
-        cERROR(1, "bad smb detected. The Mid=%d", smb->Mid);
+
+        /* if it's a response then accept */
+        if (smb->Flags & SMBFLG_RESPONSE)
+                return 0;
+
+        /* only one valid case where server sends us request */
+        if (smb->Command == SMB_COM_LOCKING_ANDX)
+                return 0;
+
+        cERROR(1, "Server sent request, not response. mid=%u", smb->Mid);
         return 1;
 }
 
@@ -448,7 +461,7 @@ checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length)
                 return 1;
         }
 
-        if (checkSMBhdr(smb, mid))
+        if (check_smb_hdr(smb, mid))
                 return 1;
         clc_len = smbCalcSize_LE(smb);
 
@@ -465,25 +478,26 @@ checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length)
                         if (((4 + len) & 0xFFFF) == (clc_len & 0xFFFF))
                                 return 0; /* bcc wrapped */
                 }
-                cFYI(1, "Calculated size %d vs length %d mismatch for mid %d",
+                cFYI(1, "Calculated size %u vs length %u mismatch for mid=%u",
                                 clc_len, 4 + len, smb->Mid);
-                /* Windows XP can return a few bytes too much, presumably
-                an illegal pad, at the end of byte range lock responses
-                so we allow for that three byte pad, as long as actual
-                received length is as long or longer than calculated length */
-                /* We have now had to extend this more, since there is a
-                case in which it needs to be bigger still to handle a
-                malformed response to transact2 findfirst from WinXP when
-                access denied is returned and thus bcc and wct are zero
-                but server says length is 0x21 bytes too long as if the server
-                forget to reset the smb rfc1001 length when it reset the
-                wct and bcc to minimum size and drop the t2 parms and data */
-                if ((4+len > clc_len) && (len <= clc_len + 512))
-                        return 0;
-                else {
-                        cERROR(1, "RFC1001 size %d bigger than SMB for Mid=%d",
+
+                if (4 + len < clc_len) {
+                        cERROR(1, "RFC1001 size %u smaller than SMB for mid=%u",
                                         len, smb->Mid);
                         return 1;
+                } else if (len > clc_len + 512) {
+                        /*
+                         * Some servers (Windows XP in particular) send more
+                         * data than the lengths in the SMB packet would
+                         * indicate on certain calls (byte range locks and
+                         * trans2 find first calls in particular). While the
+                         * client can handle such a frame by ignoring the
+                         * trailing data, we choose limit the amount of extra
+                         * data to 512 bytes.
+                         */
+                        cERROR(1, "RFC1001 size %u more than 512 bytes larger "
+                                  "than SMB for mid=%u", len, smb->Mid);
+                        return 1;
                 }
         }
         return 0;
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 7f25cc3d2256..f8e4cd2a7912 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -764,7 +764,6 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
 {
         int rc = 0;
         int xid, i;
-        struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
         struct cifsFileInfo *cifsFile = NULL;
         char *current_entry;
@@ -775,8 +774,6 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
 
         xid = GetXid();
 
-        cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
-
         /*
          * Ensure FindFirst doesn't fail before doing filldir() for '.' and
          * '..'. Otherwise we won't be able to notify VFS in case of failure.
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index b5450e9f40c0..b5041c849981 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -58,8 +58,9 @@ mdfour(unsigned char *md4_hash, unsigned char *link_str, int link_len)
 
         md4 = crypto_alloc_shash("md4", 0, 0);
         if (IS_ERR(md4)) {
+                rc = PTR_ERR(md4);
                 cERROR(1, "%s: Crypto md4 allocation error %d\n", __func__, rc);
-                return PTR_ERR(md4);
+                return rc;
         }
         size = sizeof(struct shash_desc) + crypto_shash_descsize(md4);
         sdescmd4 = kmalloc(size, GFP_KERNEL);
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index c1ccca1a933f..b8c5e2eb43d0 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -236,9 +236,9 @@ smb_sendv(struct TCP_Server_Info *server, struct kvec *iov, int n_vec)
                 server->tcpStatus = CifsNeedReconnect;
         }
 
-        if (rc < 0) {
+        if (rc < 0 && rc != -EINTR)
                 cERROR(1, "Error %d sending data on socket to server", rc);
-        } else
+        else
                 rc = 0;
 
         /* Don't want to modify the buffer as a
@@ -570,17 +570,33 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
 #endif
 
         mutex_unlock(&ses->server->srv_mutex);
-        cifs_small_buf_release(in_buf);
 
-        if (rc < 0)
+        if (rc < 0) {
+                cifs_small_buf_release(in_buf);
                 goto out;
+        }
 
-        if (long_op == CIFS_ASYNC_OP)
+        if (long_op == CIFS_ASYNC_OP) {
+                cifs_small_buf_release(in_buf);
                 goto out;
+        }
 
         rc = wait_for_response(ses->server, midQ);
-        if (rc != 0)
-                goto out;
+        if (rc != 0) {
+                send_nt_cancel(ses->server, in_buf, midQ);
+                spin_lock(&GlobalMid_Lock);
+                if (midQ->midState == MID_REQUEST_SUBMITTED) {
+                        midQ->callback = DeleteMidQEntry;
+                        spin_unlock(&GlobalMid_Lock);
+                        cifs_small_buf_release(in_buf);
+                        atomic_dec(&ses->server->inFlight);
+                        wake_up(&ses->server->request_q);
+                        return rc;
+                }
+                spin_unlock(&GlobalMid_Lock);
+        }
+
+        cifs_small_buf_release(in_buf);
 
         rc = sync_mid_result(midQ, ses->server);
         if (rc != 0) {
@@ -724,8 +740,19 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
                 goto out;
 
         rc = wait_for_response(ses->server, midQ);
-        if (rc != 0)
-                goto out;
+        if (rc != 0) {
+                send_nt_cancel(ses->server, in_buf, midQ);
+                spin_lock(&GlobalMid_Lock);
+                if (midQ->midState == MID_REQUEST_SUBMITTED) {
+                        /* no longer considered to be "in-flight" */
+                        midQ->callback = DeleteMidQEntry;
+                        spin_unlock(&GlobalMid_Lock);
+                        atomic_dec(&ses->server->inFlight);
+                        wake_up(&ses->server->request_q);
+                        return rc;
+                }
+                spin_unlock(&GlobalMid_Lock);
+        }
 
         rc = sync_mid_result(midQ, ses->server);
         if (rc != 0) {
@@ -922,10 +949,21 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
                         }
                 }
 
-                if (wait_for_response(ses->server, midQ) == 0) {
-                        /* We got the response - restart system call. */
-                        rstart = 1;
+                rc = wait_for_response(ses->server, midQ);
+                if (rc) {
+                        send_nt_cancel(ses->server, in_buf, midQ);
+                        spin_lock(&GlobalMid_Lock);
+                        if (midQ->midState == MID_REQUEST_SUBMITTED) {
+                                /* no longer considered to be "in-flight" */
+                                midQ->callback = DeleteMidQEntry;
+                                spin_unlock(&GlobalMid_Lock);
+                                return rc;
+                        }
+                        spin_unlock(&GlobalMid_Lock);
                 }
+
+                /* We got the response - restart system call. */
+                rstart = 1;
         }
 
         rc = sync_mid_result(midQ, ses->server);
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index cc8a9b7d6064..267d0ada4541 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1114,6 +1114,17 @@ static int ep_send_events(struct eventpoll *ep,
         return ep_scan_ready_list(ep, ep_send_events_proc, &esed);
 }
 
+static inline struct timespec ep_set_mstimeout(long ms)
+{
+        struct timespec now, ts = {
+                .tv_sec = ms / MSEC_PER_SEC,
+                .tv_nsec = NSEC_PER_MSEC * (ms % MSEC_PER_SEC),
+        };
+
+        ktime_get_ts(&now);
+        return timespec_add_safe(now, ts);
+}
+
 static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
                    int maxevents, long timeout)
 {
@@ -1121,12 +1132,11 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
         unsigned long flags;
         long slack;
         wait_queue_t wait;
-        struct timespec end_time;
         ktime_t expires, *to = NULL;
 
         if (timeout > 0) {
-                ktime_get_ts(&end_time);
-                timespec_add_ns(&end_time, (u64)timeout * NSEC_PER_MSEC);
+                struct timespec end_time = ep_set_mstimeout(timeout);
+
                 slack = select_estimate_accuracy(&end_time);
                 to = &expires;
                 *to = timespec_to_ktime(end_time);
diff --git a/fs/exec.c b/fs/exec.c
index c62efcb959c7..52a447d9b6ab 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -120,7 +120,7 @@ SYSCALL_DEFINE1(uselib, const char __user *, library)
                 goto out;
 
         file = do_filp_open(AT_FDCWD, tmp,
-                                O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+                                O_LARGEFILE | O_RDONLY | __FMODE_EXEC, 0,
                                 MAY_READ | MAY_EXEC | MAY_OPEN);
         putname(tmp);
         error = PTR_ERR(file);
@@ -723,7 +723,7 @@ struct file *open_exec(const char *name)
         int err;
 
         file = do_filp_open(AT_FDCWD, name,
-                                O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+                                O_LARGEFILE | O_RDONLY | __FMODE_EXEC, 0,
                                 MAY_EXEC | MAY_OPEN);
         if (IS_ERR(file))
                 goto out;
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 42685424817b..a7555238c41a 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -1030,7 +1030,6 @@ struct inode *exofs_iget(struct super_block *sb, unsigned long ino)
                 memcpy(oi->i_data, fcb.i_data, sizeof(fcb.i_data));
         }
 
-        inode->i_mapping->backing_dev_info = sb->s_bdi;
         if (S_ISREG(inode->i_mode)) {
                 inode->i_op = &exofs_file_inode_operations;
                 inode->i_fop = &exofs_file_operations;
@@ -1131,7 +1130,6 @@ struct inode *exofs_new_inode(struct inode *dir, int mode)
 
         sbi = sb->s_fs_info;
 
-        inode->i_mapping->backing_dev_info = sb->s_bdi;
         sb->s_dirt = 1;
         inode_init_owner(inode, dir, mode);
         inode->i_ino = sbi->s_nextid++;
diff --git a/fs/fcntl.c b/fs/fcntl.c
index ecc8b3954ed6..cb1026181bdc 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -815,7 +815,7 @@ static int __init fcntl_init(void)
                 __O_SYNC        | O_DSYNC       | FASYNC        |
                 O_DIRECT        | O_LARGEFILE   | O_DIRECTORY   |
                 O_NOFOLLOW      | O_NOATIME     | O_CLOEXEC     |
-                FMODE_EXEC
+                __FMODE_EXEC
                 ));
 
         fasync_cache = kmem_cache_create("fasync_cache",
diff --git a/fs/file_table.c b/fs/file_table.c
index c3e89adf53c0..eb36b6b17e26 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -125,13 +125,13 @@ struct file *get_empty_filp(void)
                 goto fail;
 
         percpu_counter_inc(&nr_files);
+        f->f_cred = get_cred(cred);
         if (security_file_alloc(f))
                 goto fail_sec;
 
         INIT_LIST_HEAD(&f->f_u.fu_list);
         atomic_long_set(&f->f_count, 1);
         rwlock_init(&f->f_owner.lock);
-        f->f_cred = get_cred(cred);
         spin_lock_init(&f->f_lock);
         eventpoll_init_file(f);
         /* f->f_version: 0 */
diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
index 52a0bcaa7b6d..b1991a2a08e0 100644
--- a/fs/hfsplus/extents.c
+++ b/fs/hfsplus/extents.c
@@ -397,8 +397,8 @@ int hfsplus_file_extend(struct inode *inode)
         u32 start, len, goal;
         int res;
 
-        if (sbi->total_blocks - sbi->free_blocks + 8 >
-                        sbi->alloc_file->i_size * 8) {
+        if (sbi->alloc_file->i_size * 8 <
+            sbi->total_blocks - sbi->free_blocks + 8) {
                 /* extend alloc file */
                 printk(KERN_ERR "hfs: extend alloc file! "
                                 "(%llu,%u,%u)\n",
diff --git a/fs/hfsplus/part_tbl.c b/fs/hfsplus/part_tbl.c
index d66ad113b1cc..40ad88c12c64 100644
--- a/fs/hfsplus/part_tbl.c
+++ b/fs/hfsplus/part_tbl.c
@@ -134,7 +134,7 @@ int hfs_part_find(struct super_block *sb,
         res = hfsplus_submit_bio(sb->s_bdev, *part_start + HFS_PMAP_BLK,
                                  data, READ);
         if (res)
-                return res;
+                goto out;
 
         switch (be16_to_cpu(*((__be16 *)data))) {
         case HFS_OLD_PMAP_MAGIC:
@@ -147,7 +147,7 @@ int hfs_part_find(struct super_block *sb,
                 res = -ENOENT;
                 break;
         }
-
+out:
         kfree(data);
         return res;
 }
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 9a3b4795f43c..b49b55584c84 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -338,20 +338,22 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         struct inode *root, *inode;
         struct qstr str;
         struct nls_table *nls = NULL;
-        int err = -EINVAL;
+        int err;
 
+        err = -EINVAL;
         sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
         if (!sbi)
-                return -ENOMEM;
+                goto out;
 
         sb->s_fs_info = sbi;
         mutex_init(&sbi->alloc_mutex);
         mutex_init(&sbi->vh_mutex);
         hfsplus_fill_defaults(sbi);
+
+        err = -EINVAL;
         if (!hfsplus_parse_options(data, sbi)) {
                 printk(KERN_ERR "hfs: unable to parse mount options\n");
-                err = -EINVAL;
-                goto cleanup;
+                goto out_unload_nls;
         }
 
         /* temporarily use utf8 to correctly find the hidden dir below */
@@ -359,16 +361,14 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         sbi->nls = load_nls("utf8");
         if (!sbi->nls) {
                 printk(KERN_ERR "hfs: unable to load nls for utf8\n");
-                err = -EINVAL;
-                goto cleanup;
+                goto out_unload_nls;
         }
 
         /* Grab the volume header */
         if (hfsplus_read_wrapper(sb)) {
                 if (!silent)
                         printk(KERN_WARNING "hfs: unable to find HFS+ superblock\n");
-                err = -EINVAL;
-                goto cleanup;
+                goto out_unload_nls;
         }
         vhdr = sbi->s_vhdr;
 
@@ -377,7 +377,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         if (be16_to_cpu(vhdr->version) < HFSPLUS_MIN_VERSION ||
             be16_to_cpu(vhdr->version) > HFSPLUS_CURRENT_VERSION) {
                 printk(KERN_ERR "hfs: wrong filesystem version\n");
-                goto cleanup;
+                goto out_free_vhdr;
         }
         sbi->total_blocks = be32_to_cpu(vhdr->total_blocks);
         sbi->free_blocks = be32_to_cpu(vhdr->free_blocks);
@@ -421,19 +421,19 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         sbi->ext_tree = hfs_btree_open(sb, HFSPLUS_EXT_CNID);
         if (!sbi->ext_tree) {
                 printk(KERN_ERR "hfs: failed to load extents file\n");
-                goto cleanup;
+                goto out_free_vhdr;
         }
         sbi->cat_tree = hfs_btree_open(sb, HFSPLUS_CAT_CNID);
         if (!sbi->cat_tree) {
                 printk(KERN_ERR "hfs: failed to load catalog file\n");
-                goto cleanup;
+                goto out_close_ext_tree;
         }
 
         inode = hfsplus_iget(sb, HFSPLUS_ALLOC_CNID);
         if (IS_ERR(inode)) {
                 printk(KERN_ERR "hfs: failed to load allocation file\n");
                 err = PTR_ERR(inode);
-                goto cleanup;
+                goto out_close_cat_tree;
         }
         sbi->alloc_file = inode;
 
@@ -442,14 +442,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         if (IS_ERR(root)) {
                 printk(KERN_ERR "hfs: failed to load root directory\n");
                 err = PTR_ERR(root);
-                goto cleanup;
-        }
-        sb->s_d_op = &hfsplus_dentry_operations;
-        sb->s_root = d_alloc_root(root);
-        if (!sb->s_root) {
-                iput(root);
-                err = -ENOMEM;
-                goto cleanup;
+                goto out_put_alloc_file;
         }
 
         str.len = sizeof(HFSP_HIDDENDIR_NAME) - 1;
@@ -459,46 +452,69 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         if (!hfs_brec_read(&fd, &entry, sizeof(entry))) {
                 hfs_find_exit(&fd);
                 if (entry.type != cpu_to_be16(HFSPLUS_FOLDER))
-                        goto cleanup;
+                        goto out_put_root;
                 inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id));
                 if (IS_ERR(inode)) {
                         err = PTR_ERR(inode);
-                        goto cleanup;
+                        goto out_put_root;
                 }
                 sbi->hidden_dir = inode;
         } else
                 hfs_find_exit(&fd);
 
-        if (sb->s_flags & MS_RDONLY)
-                goto out;
+        if (!(sb->s_flags & MS_RDONLY)) {
+                /*
+                 * H+LX == hfsplusutils, H+Lx == this driver, H+lx is unused
+                 * all three are registered with Apple for our use
+                 */
+                vhdr->last_mount_vers = cpu_to_be32(HFSP_MOUNT_VERSION);
+                vhdr->modify_date = hfsp_now2mt();
+                be32_add_cpu(&vhdr->write_count, 1);
+                vhdr->attributes &= cpu_to_be32(~HFSPLUS_VOL_UNMNT);
+                vhdr->attributes |= cpu_to_be32(HFSPLUS_VOL_INCNSTNT);
+                hfsplus_sync_fs(sb, 1);
 
-        /* H+LX == hfsplusutils, H+Lx == this driver, H+lx is unused
-         * all three are registered with Apple for our use
-         */
-        vhdr->last_mount_vers = cpu_to_be32(HFSP_MOUNT_VERSION);
-        vhdr->modify_date = hfsp_now2mt();
-        be32_add_cpu(&vhdr->write_count, 1);
-        vhdr->attributes &= cpu_to_be32(~HFSPLUS_VOL_UNMNT);
-        vhdr->attributes |= cpu_to_be32(HFSPLUS_VOL_INCNSTNT);
-        hfsplus_sync_fs(sb, 1);
-
-        if (!sbi->hidden_dir) {
-                mutex_lock(&sbi->vh_mutex);
-                sbi->hidden_dir = hfsplus_new_inode(sb, S_IFDIR);
-                hfsplus_create_cat(sbi->hidden_dir->i_ino, sb->s_root->d_inode,
-                                   &str, sbi->hidden_dir);
-                mutex_unlock(&sbi->vh_mutex);
-
-                hfsplus_mark_inode_dirty(sbi->hidden_dir, HFSPLUS_I_CAT_DIRTY);
+                if (!sbi->hidden_dir) {
+                        mutex_lock(&sbi->vh_mutex);
+                        sbi->hidden_dir = hfsplus_new_inode(sb, S_IFDIR);
+                        hfsplus_create_cat(sbi->hidden_dir->i_ino, root, &str,
+                                           sbi->hidden_dir);
+                        mutex_unlock(&sbi->vh_mutex);
+
+                        hfsplus_mark_inode_dirty(sbi->hidden_dir,
+                                                 HFSPLUS_I_CAT_DIRTY);
+                }
         }
-out:
+
+        sb->s_d_op = &hfsplus_dentry_operations;
+        sb->s_root = d_alloc_root(root);
+        if (!sb->s_root) {
+                err = -ENOMEM;
+                goto out_put_hidden_dir;
+        }
+
         unload_nls(sbi->nls);
         sbi->nls = nls;
         return 0;
 
-cleanup:
-        hfsplus_put_super(sb);
+out_put_hidden_dir:
+        iput(sbi->hidden_dir);
+out_put_root:
+        iput(sbi->alloc_file);
+out_put_alloc_file:
+        iput(sbi->alloc_file);
+out_close_cat_tree:
+        hfs_btree_close(sbi->cat_tree);
+out_close_ext_tree:
+        hfs_btree_close(sbi->ext_tree);
+out_free_vhdr:
+        kfree(sbi->s_vhdr);
+        kfree(sbi->s_backup_vhdr);
+out_unload_nls:
+        unload_nls(sbi->nls);
         unload_nls(nls);
+        kfree(sbi);
+out:
         return err;
 }
 
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 196231794f64..3031d81f5f0f 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -167,7 +167,7 @@ reread:
                 break;
         case cpu_to_be16(HFSP_WRAP_MAGIC):
                 if (!hfsplus_read_mdb(sbi->s_vhdr, &wd))
-                        goto out;
+                        goto out_free_backup_vhdr;
                 wd.ablk_size >>= HFSPLUS_SECTOR_SHIFT;
                 part_start += wd.ablk_start + wd.embed_start * wd.ablk_size;
                 part_size = wd.embed_count * wd.ablk_size;
@@ -179,7 +179,7 @@ reread:
                  * (should do this only for cdrom/loop though)
                  */
                 if (hfs_part_find(sb, &part_start, &part_size))
-                        goto out;
+                        goto out_free_backup_vhdr;
                 goto reread;
         }
 
diff --git a/fs/ioctl.c b/fs/ioctl.c
index a59635e295fa..1eebeb72b202 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -273,6 +273,13 @@ int __generic_block_fiemap(struct inode *inode,
                 len = isize;
         }
 
+        /*
+         * Some filesystems can't deal with being asked to map less than
+         * blocksize, so make sure our len is at least block length.
+         */
+        if (logical_to_blk(inode, len) == 0)
+                len = blk_to_logical(inode, 1);
+
         start_blk = logical_to_blk(inode, start);
         last_blk = logical_to_blk(inode, start + len - 1);