Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes

* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes:
  [GFS2] gfs2_dir_read_data(): fix uninitialized variable usage
  [GFS2] fs/gfs2/ops_fstype.c:fill_super_meta(): fix NULL dereference
  [GFS2] fs/gfs2/dir.c:gfs2_dir_write_data(): don't use an uninitialized variable
  [GFS2] fs/gfs2/ops_fstype.c:gfs2_get_sb_meta(): remove unused variable
  [GFS2] fs/gfs2/dir.c:gfs2_dir_write_data(): remove dead code
  [GFS2] gfs2 endianness bug: be16 assigned to be32 field
  [GFS2] Fix bmap to map extents properly
  [DLM] fix iovec length in recvmsg

9 files changed, 27 insertions, 28 deletions

diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 867f93d0417e..6da6b14d5a61 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -519,6 +519,7 @@ static int receive_from_sock(void)
         msg.msg_flags = 0;
         msg.msg_control = incmsg;
         msg.msg_controllen = sizeof(incmsg);
+        msg.msg_iovlen = 1;
 
         /* I don't see why this circular buffer stuff is necessary for SCTP
          * which is a packet-based protocol, but the whole thing breaks under
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index cc57f2ecd219..06e9a8cb45e9 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -434,8 +434,7 @@ static int lookup_block(struct gfs2_inode *ip, struct buffer_head *bh,
  */
 
 static int gfs2_block_pointers(struct inode *inode, u64 lblock, int create,
-                               struct buffer_head *bh_map, struct metapath *mp,
-                               unsigned int maxlen)
+                               struct buffer_head *bh_map, struct metapath *mp)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_sbd *sdp = GFS2_SB(inode);
@@ -448,6 +447,7 @@ static int gfs2_block_pointers(struct inode *inode, u64 lblock, int create,
         int new = 0;
         u64 dblock = 0;
         int boundary;
+        unsigned int maxlen = bh_map->b_size >> inode->i_blkbits;
 
         BUG_ON(maxlen == 0);
 
@@ -541,13 +541,13 @@ static inline void bmap_unlock(struct inode *inode, int create)
 }
 
 int gfs2_block_map(struct inode *inode, u64 lblock, int create,
-                   struct buffer_head *bh, unsigned int maxlen)
+                   struct buffer_head *bh)
 {
         struct metapath mp;
         int ret;
 
         bmap_lock(inode, create);
-        ret = gfs2_block_pointers(inode, lblock, create, bh, &mp, maxlen);
+        ret = gfs2_block_pointers(inode, lblock, create, bh, &mp);
         bmap_unlock(inode, create);
         return ret;
 }
@@ -555,7 +555,7 @@ int gfs2_block_map(struct inode *inode, u64 lblock, int create,
 int gfs2_extent_map(struct inode *inode, u64 lblock, int *new, u64 *dblock, unsigned *extlen)
 {
         struct metapath mp;
-        struct buffer_head bh = { .b_state = 0, .b_blocknr = 0, .b_size = 0 };
+        struct buffer_head bh = { .b_state = 0, .b_blocknr = 0 };
         int ret;
         int create = *new;
 
@@ -563,8 +563,9 @@ int gfs2_extent_map(struct inode *inode, u64 lblock, int *new, u64 *dblock, unsi
         BUG_ON(!dblock);
         BUG_ON(!new);
 
+        bh.b_size = 1 << (inode->i_blkbits + 5);
         bmap_lock(inode, create);
-        ret = gfs2_block_pointers(inode, lblock, create, &bh, &mp, 32);
+        ret = gfs2_block_pointers(inode, lblock, create, &bh, &mp);
         bmap_unlock(inode, create);
         *extlen = bh.b_size >> inode->i_blkbits;
         *dblock = bh.b_blocknr;
diff --git a/fs/gfs2/bmap.h b/fs/gfs2/bmap.h
index 0fd379b4cd9e..ac2fd04370dc 100644
--- a/fs/gfs2/bmap.h
+++ b/fs/gfs2/bmap.h
@@ -15,7 +15,7 @@ struct gfs2_inode;
 struct page;
 
 int gfs2_unstuff_dinode(struct gfs2_inode *ip, struct page *page);
-int gfs2_block_map(struct inode *inode, u64 lblock, int create, struct buffer_head *bh, unsigned int maxlen);
+int gfs2_block_map(struct inode *inode, u64 lblock, int create, struct buffer_head *bh);
 int gfs2_extent_map(struct inode *inode, u64 lblock, int *new, u64 *dblock, unsigned *extlen);
 
 int gfs2_truncatei(struct gfs2_inode *ip, u64 size);
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index 459498cac93b..e24af28b1a12 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -184,7 +184,7 @@ static int gfs2_dir_write_data(struct gfs2_inode *ip, const char *buf,
         while (copied < size) {
                 unsigned int amount;
                 struct buffer_head *bh;
-                int new;
+                int new = 0;
 
                 amount = size - copied;
                 if (amount > sdp->sd_sb.sb_bsize - o)
@@ -212,8 +212,6 @@ static int gfs2_dir_write_data(struct gfs2_inode *ip, const char *buf,
                 gfs2_trans_add_bh(ip->i_gl, bh, 1);
                 memcpy(bh->b_data + o, buf, amount);
                 brelse(bh);
-                if (error)
-                        goto fail;
 
                 buf += amount;
                 copied += amount;
@@ -317,8 +315,7 @@ static int gfs2_dir_read_data(struct gfs2_inode *ip, char *buf, u64 offset,
                         if (!ra)
                                 extlen = 1;
                         bh = gfs2_meta_ra(ip->i_gl, dblock, extlen);
-                }
-                if (!bh) {
+                } else {
                         error = gfs2_meta_read(ip->i_gl, dblock, DIO_WAIT, &bh);
                         if (error)
                                 goto fail;
@@ -332,7 +329,6 @@ static int gfs2_dir_read_data(struct gfs2_inode *ip, char *buf, u64 offset,
                 extlen--;
                 memcpy(buf, bh->b_data + o, amount);
                 brelse(bh);
-                bh = NULL;
                 buf += amount;
                 copied += amount;
                 lblock++;
@@ -815,7 +811,7 @@ static struct gfs2_leaf *new_leaf(struct inode *inode, struct buffer_head **pbh,
         leaf = (struct gfs2_leaf *)bh->b_data;
         leaf->lf_depth = cpu_to_be16(depth);
         leaf->lf_entries = 0;
-        leaf->lf_dirent_format = cpu_to_be16(GFS2_FORMAT_DE);
+        leaf->lf_dirent_format = cpu_to_be32(GFS2_FORMAT_DE);
         leaf->lf_next = 0;
         memset(leaf->lf_reserved, 0, sizeof(leaf->lf_reserved));
         dent = (struct gfs2_dirent *)(leaf+1);
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 72eec6542d6a..0cace3da9dbb 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -312,10 +312,12 @@ void gfs2_log_release(struct gfs2_sbd *sdp, unsigned int blks)
 
 static u64 log_bmap(struct gfs2_sbd *sdp, unsigned int lbn)
 {
+        struct inode *inode = sdp->sd_jdesc->jd_inode;
         int error;
-        struct buffer_head bh_map;
+        struct buffer_head bh_map = { .b_state = 0, .b_blocknr = 0 };
 
-        error = gfs2_block_map(sdp->sd_jdesc->jd_inode, lbn, 0, &bh_map, 1);
+        bh_map.b_size = 1 << inode->i_blkbits;
+        error = gfs2_block_map(inode, lbn, 0, &bh_map);
         if (error || !bh_map.b_blocknr)
                 printk(KERN_INFO "error=%d, dbn=%llu lbn=%u", error, bh_map.b_blocknr, lbn);
         gfs2_assert_withdraw(sdp, !error && bh_map.b_blocknr);
diff --git a/fs/gfs2/ops_address.c b/fs/gfs2/ops_address.c
index e0599fed99ce..8d5963c7e123 100644
--- a/fs/gfs2/ops_address.c
+++ b/fs/gfs2/ops_address.c
@@ -65,7 +65,7 @@ static void gfs2_page_add_databufs(struct gfs2_inode *ip, struct page *page,
 int gfs2_get_block(struct inode *inode, sector_t lblock,
                    struct buffer_head *bh_result, int create)
 {
-        return gfs2_block_map(inode, lblock, create, bh_result, 32);
+        return gfs2_block_map(inode, lblock, create, bh_result);
 }
 
 /**
@@ -83,7 +83,7 @@ static int gfs2_get_block_noalloc(struct inode *inode, sector_t lblock,
 {
         int error;
 
-        error = gfs2_block_map(inode, lblock, 0, bh_result, 1);
+        error = gfs2_block_map(inode, lblock, 0, bh_result);
         if (error)
                 return error;
         if (bh_result->b_blocknr == 0)
@@ -94,7 +94,7 @@ static int gfs2_get_block_noalloc(struct inode *inode, sector_t lblock,
 static int gfs2_get_block_direct(struct inode *inode, sector_t lblock,
                                  struct buffer_head *bh_result, int create)
 {
-        return gfs2_block_map(inode, lblock, 0, bh_result, 32);
+        return gfs2_block_map(inode, lblock, 0, bh_result);
 }
 
 /**
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 178b33911843..882873a6bd69 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -794,8 +794,8 @@ static int fill_super_meta(struct super_block *sb, struct super_block *new,
                 fs_err(sdp, "can't get root dentry\n");
                 error = -ENOMEM;
                 iput(inode);
-        }
-        new->s_root->d_op = &gfs2_dops;
+        } else
+                new->s_root->d_op = &gfs2_dops;
 
         return error;
 }
@@ -854,7 +854,6 @@ static int gfs2_get_sb_meta(struct file_system_type *fs_type, int flags,
         int error = 0;
         struct super_block *sb = NULL, *new;
         struct gfs2_sbd *sdp;
-        char *gfs2mnt = NULL;
 
         sb = get_gfs2_sb(dev_name);
         if (!sb) {
@@ -892,8 +891,6 @@ static int gfs2_get_sb_meta(struct file_system_type *fs_type, int flags,
         atomic_inc(&sdp->sd_gfs2mnt->mnt_count);
         return simple_set_mnt(mnt, new);
 error:
-        if (gfs2mnt)
-                kfree(gfs2mnt);
         return error;
 }
 
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index c69b94a55588..a3deae7416c9 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -251,7 +251,7 @@ static int bh_get(struct gfs2_quota_data *qd)
         unsigned int block, offset;
         struct buffer_head *bh;
         int error;
-        struct buffer_head bh_map;
+        struct buffer_head bh_map = { .b_state = 0, .b_blocknr = 0 };
 
         mutex_lock(&sdp->sd_quota_mutex);
 
@@ -263,7 +263,8 @@ static int bh_get(struct gfs2_quota_data *qd)
         block = qd->qd_slot / sdp->sd_qc_per_block;
         offset = qd->qd_slot % sdp->sd_qc_per_block;;
 
-        error = gfs2_block_map(&ip->i_inode, block, 0, &bh_map, 1);
+        bh_map.b_size = 1 << ip->i_inode.i_blkbits;
+        error = gfs2_block_map(&ip->i_inode, block, 0, &bh_map);
         if (error)
                 goto fail;
         error = gfs2_meta_read(ip->i_gl, bh_map.b_blocknr, DIO_WAIT, &bh);
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index 0a8a4b87dcc6..62cd223819b7 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -372,11 +372,12 @@ static int clean_journal(struct gfs2_jdesc *jd, struct gfs2_log_header *head)
         u32 hash;
         struct buffer_head *bh;
         int error;
-        struct buffer_head bh_map;
+        struct buffer_head bh_map = { .b_state = 0, .b_blocknr = 0 };
 
         lblock = head->lh_blkno;
         gfs2_replay_incr_blk(sdp, &lblock);
-        error = gfs2_block_map(&ip->i_inode, lblock, 0, &bh_map, 1);
+        bh_map.b_size = 1 << ip->i_inode.i_blkbits;
+        error = gfs2_block_map(&ip->i_inode, lblock, 0, &bh_map);
         if (error)
                 return error;
         if (!bh_map.b_blocknr) {