Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  mount_subtree() pointless use-after-free
  iio: fix a leak due to improper use of anon_inode_getfd()
  microblaze: bury asm/namei.h

3 files changed, 13 insertions, 25 deletions

diff --git a/arch/microblaze/include/asm/namei.h b/arch/microblaze/include/asm/namei.h
deleted file mode 100644
index 61d60b8a07d5..000000000000
--- a/arch/microblaze/include/asm/namei.h
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright (C) 2006 Atmark Techno, Inc.
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License. See the file "COPYING" in the main directory of this archive
- * for more details.
- */
-
-#ifndef _ASM_MICROBLAZE_NAMEI_H
-#define _ASM_MICROBLAZE_NAMEI_H
-
-#ifdef __KERNEL__
-
-/* This dummy routine maybe changed to something useful
- * for /usr/gnemul/ emulation stuff.
- * Look at asm-sparc/namei.h for details.
- */
-#define __emul_prefix() NULL
-
-#endif /* __KERNEL__ */
-
-#endif /* _ASM_MICROBLAZE_NAMEI_H */
diff --git a/drivers/staging/iio/industrialio-core.c b/drivers/staging/iio/industrialio-core.c
index 326e967d54ef..26564094e33b 100644
--- a/drivers/staging/iio/industrialio-core.c
+++ b/drivers/staging/iio/industrialio-core.c
@@ -242,6 +242,8 @@ static const struct file_operations iio_event_chrdev_fileops = {
 
 static int iio_event_getfd(struct iio_dev *indio_dev)
 {
+        int fd;
+
         if (indio_dev->event_interface == NULL)
                 return -ENODEV;
 
@@ -252,9 +254,15 @@ static int iio_event_getfd(struct iio_dev *indio_dev)
                 return -EBUSY;
         }
         mutex_unlock(&indio_dev->event_interface->event_list_lock);
-        return anon_inode_getfd("iio:event",
+        fd = anon_inode_getfd("iio:event",
                                 &iio_event_chrdev_fileops,
                                 indio_dev->event_interface, O_RDONLY);
+        if (fd < 0) {
+                mutex_lock(&indio_dev->event_interface->event_list_lock);
+                clear_bit(IIO_BUSY_BIT_POS, &ev_int->flags);
+                mutex_unlock(&indio_dev->event_interface->event_list_lock);
+        }
+        return fd;
 }
 
 static int __init iio_init(void)
diff --git a/fs/namespace.c b/fs/namespace.c
index 50ee30345b4f..6d3a1963879b 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2493,6 +2493,7 @@ EXPORT_SYMBOL(create_mnt_ns);
 struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
 {
         struct mnt_namespace *ns;
+        struct super_block *s;
         struct path path;
         int err;
 
@@ -2509,10 +2510,11 @@ struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
                 return ERR_PTR(err);
 
         /* trade a vfsmount reference for active sb one */
-        atomic_inc(&path.mnt->mnt_sb->s_active);
+        s = path.mnt->mnt_sb;
+        atomic_inc(&s->s_active);
         mntput(path.mnt);
         /* lock the sucker */
-        down_write(&path.mnt->mnt_sb->s_umount);
+        down_write(&s->s_umount);
         /* ... and return the root of (sub)tree on it */
         return path.dentry;
 }