9 files changed, 39 insertions, 22 deletions

diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c
index 4c80404a9aba..d98713777a1b 100644
--- a/fs/jffs2/acl.c
+++ b/fs/jffs2/acl.c
@@ -314,7 +314,7 @@ static int jffs2_check_acl(struct inode *inode, int mask)
         return -EAGAIN;
 }
 
-int jffs2_permission(struct inode *inode, int mask, struct nameidata *nd)
+int jffs2_permission(struct inode *inode, int mask)
 {
         return generic_permission(inode, mask, jffs2_check_acl);
 }
diff --git a/fs/jffs2/acl.h b/fs/jffs2/acl.h
index 0bb7f003fd80..8ca058aed384 100644
--- a/fs/jffs2/acl.h
+++ b/fs/jffs2/acl.h
@@ -28,7 +28,7 @@ struct jffs2_acl_header {
 
 #define JFFS2_ACL_NOT_CACHED ((void *)-1)
 
-extern int jffs2_permission(struct inode *, int, struct nameidata *);
+extern int jffs2_permission(struct inode *, int);
 extern int jffs2_acl_chmod(struct inode *);
 extern int jffs2_init_acl_pre(struct inode *, struct inode *, int *);
 extern int jffs2_init_acl_post(struct inode *);
diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
index c0c141f6fde1..cd219ef55254 100644
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -38,7 +38,7 @@ const struct file_operations jffs2_dir_operations =
 {
         .read =         generic_read_dir,
         .readdir =      jffs2_readdir,
-        .ioctl =        jffs2_ioctl,
+        .unlocked_ioctl=jffs2_ioctl,
         .fsync =        jffs2_fsync
 };
 
diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
index 5e920343b2c5..5a98aa87c853 100644
--- a/fs/jffs2/file.c
+++ b/fs/jffs2/file.c
@@ -46,7 +46,7 @@ const struct file_operations jffs2_file_operations =
         .aio_read =     generic_file_aio_read,
         .write =        do_sync_write,
         .aio_write =    generic_file_aio_write,
-        .ioctl =        jffs2_ioctl,
+        .unlocked_ioctl=jffs2_ioctl,
         .mmap =         generic_file_readonly_mmap,
         .fsync =        jffs2_fsync,
         .splice_read =  generic_file_splice_read,
diff --git a/fs/jffs2/ioctl.c b/fs/jffs2/ioctl.c
index e2177210f621..9d41f43e47bb 100644
--- a/fs/jffs2/ioctl.c
+++ b/fs/jffs2/ioctl.c
@@ -12,8 +12,7 @@
 #include <linux/fs.h>
 #include "nodelist.h"
 
-int jffs2_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
-                unsigned long arg)
+long jffs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
         /* Later, this will provide for lsattr.jffs2 and chattr.jffs2, which
            will include compression support etc. */
diff --git a/fs/jffs2/os-linux.h b/fs/jffs2/os-linux.h
index 2cc866cf134f..5e194a5c8e29 100644
--- a/fs/jffs2/os-linux.h
+++ b/fs/jffs2/os-linux.h
@@ -167,7 +167,7 @@ int jffs2_fsync(struct file *, struct dentry *, int);
 int jffs2_do_readpage_unlock (struct inode *inode, struct page *pg);
 
 /* ioctl.c */
-int jffs2_ioctl(struct inode *, struct file *, unsigned int, unsigned long);
+long jffs2_ioctl(struct file *, unsigned int, unsigned long);
 
 /* symlink.c */
 extern const struct inode_operations jffs2_symlink_inode_operations;
diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c
index 629af01e5ade..6caf1e1ee26d 100644
--- a/fs/jffs2/summary.c
+++ b/fs/jffs2/summary.c
@@ -23,6 +23,8 @@
 
 int jffs2_sum_init(struct jffs2_sb_info *c)
 {
+        uint32_t sum_size = max_t(uint32_t, c->sector_size, MAX_SUMMARY_SIZE);
+
         c->summary = kzalloc(sizeof(struct jffs2_summary), GFP_KERNEL);
 
         if (!c->summary) {
@@ -30,7 +32,7 @@ int jffs2_sum_init(struct jffs2_sb_info *c)
                 return -ENOMEM;
         }
 
-        c->summary->sum_buf = vmalloc(c->sector_size);
+        c->summary->sum_buf = kmalloc(sum_size, GFP_KERNEL);
 
         if (!c->summary->sum_buf) {
                 JFFS2_WARNING("Can't allocate buffer for writing out summary information!\n");
@@ -49,7 +51,7 @@ void jffs2_sum_exit(struct jffs2_sb_info *c)
 
         jffs2_sum_disable_collecting(c->summary);
 
-        vfree(c->summary->sum_buf);
+        kfree(c->summary->sum_buf);
         c->summary->sum_buf = NULL;
 
         kfree(c->summary);
@@ -665,7 +667,7 @@ crc_err:
 /* Write summary data to flash - helper function for jffs2_sum_write_sumnode() */
 
 static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
-                                        uint32_t infosize, uint32_t datasize, int padsize)
+                                uint32_t infosize, uint32_t datasize, int padsize)
 {
         struct jffs2_raw_summary isum;
         union jffs2_sum_mem *temp;
@@ -676,6 +678,26 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
         int ret;
         size_t retlen;
 
+        if (padsize + datasize > MAX_SUMMARY_SIZE) {
+                /* It won't fit in the buffer. Abort summary for this jeb */
+                jffs2_sum_disable_collecting(c->summary);
+
+                JFFS2_WARNING("Summary too big (%d data, %d pad) in eraseblock at %08x\n",
+                              datasize, padsize, jeb->offset);
+                /* Non-fatal */
+                return 0;
+        }
+        /* Is there enough space for summary? */
+        if (padsize < 0) {
+                /* don't try to write out summary for this jeb */
+                jffs2_sum_disable_collecting(c->summary);
+
+                JFFS2_WARNING("Not enough space for summary, padsize = %d\n",
+                              padsize);
+                /* Non-fatal */
+                return 0;
+        }
+
         memset(c->summary->sum_buf, 0xff, datasize);
         memset(&isum, 0, sizeof(isum));
 
@@ -821,7 +843,7 @@ int jffs2_sum_write_sumnode(struct jffs2_sb_info *c)
 {
         int datasize, infosize, padsize;
         struct jffs2_eraseblock *jeb;
-        int ret;
+        int ret = 0;
 
         dbg_summary("called\n");
 
@@ -841,16 +863,6 @@ int jffs2_sum_write_sumnode(struct jffs2_sb_info *c)
         infosize += padsize;
         datasize += padsize;
 
-        /* Is there enough space for summary? */
-        if (padsize < 0) {
-                /* don't try to write out summary for this jeb */
-                jffs2_sum_disable_collecting(c->summary);
-
-                JFFS2_WARNING("Not enough space for summary, padsize = %d\n", padsize);
-                spin_lock(&c->erase_completion_lock);
-                return 0;
-        }
-
         ret = jffs2_sum_write_data(c, jeb, infosize, datasize, padsize);
         spin_lock(&c->erase_completion_lock);
         return ret;
diff --git a/fs/jffs2/summary.h b/fs/jffs2/summary.h
index 8bf34f2fa5ce..60207a2ae952 100644
--- a/fs/jffs2/summary.h
+++ b/fs/jffs2/summary.h
@@ -13,6 +13,12 @@
 #ifndef JFFS2_SUMMARY_H
 #define JFFS2_SUMMARY_H
 
+/* Limit summary size to 64KiB so that we can kmalloc it. If the summary
+   is larger than that, we have to just ditch it and avoid using summary
+   for the eraseblock in question... and it probably doesn't hurt us much
+   anyway. */
+#define MAX_SUMMARY_SIZE 65536
+
 #include <linux/uio.h>
 #include <linux/jffs2.h>
 
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 7da69eae49e4..efd401257ed9 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -44,7 +44,7 @@ static void jffs2_destroy_inode(struct inode *inode)
         kmem_cache_free(jffs2_inode_cachep, JFFS2_INODE_INFO(inode));
 }
 
-static void jffs2_i_init_once(struct kmem_cache *cachep, void *foo)
+static void jffs2_i_init_once(void *foo)
 {
         struct jffs2_inode_info *f = foo;