3 files changed, 29 insertions, 8 deletions

diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 3ebc437736f..1cbdeea1db4 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -46,11 +46,26 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         case HFS_EXT_CNID:
                 hfs_inode_read_fork(tree->inode, mdb->drXTExtRec, mdb->drXTFlSize,
                                     mdb->drXTFlSize, be32_to_cpu(mdb->drXTClpSiz));
+                if (HFS_I(tree->inode)->alloc_blocks >
+                                        HFS_I(tree->inode)->first_blocks) {
+                        printk(KERN_ERR "hfs: invalid btree extent records\n");
+                        unlock_new_inode(tree->inode);
+                        goto free_inode;
+                }
+
                 tree->inode->i_mapping->a_ops = &hfs_btree_aops;
                 break;
         case HFS_CAT_CNID:
                 hfs_inode_read_fork(tree->inode, mdb->drCTExtRec, mdb->drCTFlSize,
                                     mdb->drCTFlSize, be32_to_cpu(mdb->drCTClpSiz));
+
+                if (!HFS_I(tree->inode)->first_blocks) {
+                        printk(KERN_ERR "hfs: invalid btree extent records "
+                                                                "(0 size).\n");
+                        unlock_new_inode(tree->inode);
+                        goto free_inode;
+                }
+
                 tree->inode->i_mapping->a_ops = &hfs_btree_aops;
                 break;
         default:
@@ -59,11 +74,6 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         }
         unlock_new_inode(tree->inode);
 
-        if (!HFS_I(tree->inode)->first_blocks) {
-                printk(KERN_ERR "hfs: invalid btree extent records (0 size).\n");
-                goto free_inode;
-        }
-
         mapping = tree->inode->i_mapping;
         page = read_mapping_page(mapping, 0, NULL);
         if (IS_ERR(page))
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index fff16c968e6..96a1b625fc7 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -123,8 +123,8 @@ static ssize_t hfs_direct_IO(int rw, struct kiocb *iocb,
         struct inode *inode = file->f_path.dentry->d_inode->i_mapping->host;
         ssize_t ret;
 
-        ret = blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
-                                  offset, nr_segs, hfs_get_block, NULL);
+        ret = blockdev_direct_IO(rw, iocb, inode, iov, offset, nr_segs,
+                                 hfs_get_block);
 
         /*
          * In case of error extending write may have instantiated a few
@@ -615,6 +615,8 @@ int hfs_inode_setattr(struct dentry *dentry, struct iattr * attr)
 
         if ((attr->ia_valid & ATTR_SIZE) &&
             attr->ia_size != i_size_read(inode)) {
+                inode_dio_wait(inode);
+
                 error = vmtruncate(inode, attr->ia_size);
                 if (error)
                         return error;
@@ -625,12 +627,18 @@ int hfs_inode_setattr(struct dentry *dentry, struct iattr * attr)
         return 0;
 }
 
-static int hfs_file_fsync(struct file *filp, int datasync)
+static int hfs_file_fsync(struct file *filp, loff_t start, loff_t end,
+                          int datasync)
 {
         struct inode *inode = filp->f_mapping->host;
         struct super_block * sb;
         int ret, err;
 
+        ret = filemap_write_and_wait_range(inode->i_mapping, start, end);
+        if (ret)
+                return ret;
+        mutex_lock(&inode->i_mutex);
+
         /* sync the inode to buffers */
         ret = write_inode_now(inode, 0);
 
@@ -647,6 +655,7 @@ static int hfs_file_fsync(struct file *filp, int datasync)
         err = sync_blockdev(sb->s_bdev);
         if (!ret)
                 ret = err;
+        mutex_unlock(&inode->i_mutex);
         return ret;
 }
 
diff --git a/fs/hfs/trans.c b/fs/hfs/trans.c
index e673a88b8ae..b1ce4c7ad3f 100644
--- a/fs/hfs/trans.c
+++ b/fs/hfs/trans.c
@@ -40,6 +40,8 @@ int hfs_mac2asc(struct super_block *sb, char *out, const struct hfs_name *in)
 
         src = in->name;
         srclen = in->len;
+        if (srclen > HFS_NAMELEN)
+                srclen = HFS_NAMELEN;
         dst = out;
         dstlen = HFS_MAX_NAMELEN;
         if (nls_io) {