Merge in v2.6.14 by hand

3 files changed, 8 insertions, 0 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 9fe7216457d8..edfca5b75535 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1397,6 +1397,9 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb)
                 if (unlikely(!access_ok(VERIFY_WRITE, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
+                ret = security_file_permission(file, MAY_READ);
+                if (unlikely(ret))
+                        break;
                 ret = -EINVAL;
                 if (file->f_op->aio_read)
                         kiocb->ki_retry = aio_pread;
@@ -1409,6 +1412,9 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb)
                 if (unlikely(!access_ok(VERIFY_READ, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
+                ret = security_file_permission(file, MAY_WRITE);
+                if (unlikely(ret))
+                        break;
                 ret = -EINVAL;
                 if (file->f_op->aio_write)
                         kiocb->ki_retry = aio_pwrite;
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index fd0f0f050e1d..452fc1fdbd32 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -50,6 +50,7 @@ static void hfsplus_read_inode(struct inode *inode)
         init_MUTEX(&HFSPLUS_I(inode).extents_lock);
         HFSPLUS_I(inode).flags = 0;
         HFSPLUS_I(inode).rsrc_inode = NULL;
+        atomic_set(&HFSPLUS_I(inode).opencnt, 0);
 
         if (inode->i_ino >= HFSPLUS_FIRSTUSER_CNID) {
         read_inode:
diff --git a/fs/inotify.c b/fs/inotify.c
index a37e9fb1da58..9fbaebfdf40b 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -176,6 +176,7 @@ static inline void put_inotify_dev(struct inotify_device *dev)
         if (atomic_dec_and_test(&dev->count)) {
                 atomic_dec(&dev->user->inotify_devs);
                 free_uid(dev->user);
+                idr_destroy(&dev->idr);
                 kfree(dev);
         }
 }