7 files changed, 117 insertions, 115 deletions

diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 69f44dcdb0b4..b1c902e319c1 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -428,7 +428,6 @@ static int load_flat_file(struct linux_binprm * bprm,
         loff_t fpos;
         unsigned long start_code, end_code;
         int ret;
-        int exec_fileno;
 
         hdr = ((struct flat_hdr *) bprm->buf);          /* exec-header */
         inode = bprm->file->f_dentry->d_inode;
@@ -502,21 +501,12 @@ static int load_flat_file(struct linux_binprm * bprm,
                 goto err;
         }
 
-        /* check file descriptor */
-        exec_fileno = get_unused_fd();
-        if (exec_fileno < 0) {
-                ret = -EMFILE;
-                goto err;
-        }
-        get_file(bprm->file);
-        fd_install(exec_fileno, bprm->file);
-
         /* Flush all traces of the currently running executable */
         if (id == 0) {
                 result = flush_old_exec(bprm);
                 if (result) {
                         ret = result;
-                        goto err_close;
+                        goto err;
                 }
 
                 /* OK, This is the point of no return */
@@ -548,7 +538,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                                 textpos = (unsigned long) -ENOMEM;
                         printk("Unable to mmap process text, errno %d\n", (int)-textpos);
                         ret = textpos;
-                        goto err_close;
+                        goto err;
                 }
 
                 down_write(&current->mm->mmap_sem);
@@ -564,7 +554,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                                         (int)-datapos);
                         do_munmap(current->mm, textpos, text_len);
                         ret = realdatastart;
-                        goto err_close;
+                        goto err;
                 }
                 datapos = realdatastart + MAX_SHARED_LIBS * sizeof(unsigned long);
 
@@ -587,7 +577,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                         do_munmap(current->mm, textpos, text_len);
                         do_munmap(current->mm, realdatastart, data_len + extra);
                         ret = result;
-                        goto err_close;
+                        goto err;
                 }
 
                 reloc = (unsigned long *) (datapos+(ntohl(hdr->reloc_start)-text_len));
@@ -606,7 +596,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                         printk("Unable to allocate RAM for process text/data, errno %d\n",
                                         (int)-textpos);
                         ret = textpos;
-                        goto err_close;
+                        goto err;
                 }
 
                 realdatastart = textpos + ntohl(hdr->data_start);
@@ -652,7 +642,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                         do_munmap(current->mm, textpos, text_len + data_len + extra +
                                 MAX_SHARED_LIBS * sizeof(unsigned long));
                         ret = result;
-                        goto err_close;
+                        goto err;
                 }
         }
 
@@ -717,7 +707,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                                 addr = calc_reloc(*rp, libinfo, id, 0);
                                 if (addr == RELOC_FAILED) {
                                         ret = -ENOEXEC;
-                                        goto err_close;
+                                        goto err;
                                 }
                                 *rp = addr;
                         }
@@ -747,7 +737,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                         rp = (unsigned long *) calc_reloc(addr, libinfo, id, 1);
                         if (rp == (unsigned long *)RELOC_FAILED) {
                                 ret = -ENOEXEC;
-                                goto err_close;
+                                goto err;
                         }
 
                         /* Get the pointer's value.  */
@@ -762,7 +752,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                                 addr = calc_reloc(addr, libinfo, id, 0);
                                 if (addr == RELOC_FAILED) {
                                         ret = -ENOEXEC;
-                                        goto err_close;
+                                        goto err;
                                 }
 
                                 /* Write back the relocated pointer.  */
@@ -783,8 +773,6 @@ static int load_flat_file(struct linux_binprm * bprm,
                         stack_len);
 
         return 0;
-err_close:
-        sys_close(exec_fileno);
 err:
         return ret;
 }
diff --git a/fs/bio.c b/fs/bio.c
index eb8fbc53f2cd..098c12b2d60a 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -1116,6 +1116,9 @@ struct bio_pair *bio_split(struct bio *bi, mempool_t *pool, int first_sectors)
         bp->bio1.bi_io_vec = &bp->bv1;
         bp->bio2.bi_io_vec = &bp->bv2;
 
+        bp->bio1.bi_max_vecs = 1;
+        bp->bio2.bi_max_vecs = 1;
+
         bp->bio1.bi_end_io = bio_pair_end_1;
         bp->bio2.bi_end_io = bio_pair_end_2;
 
diff --git a/fs/compat.c b/fs/compat.c
index 01f39f87f372..b1f64786a613 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -2030,109 +2030,115 @@ union compat_nfsctl_res {
         struct knfsd_fh         cr32_getfs;
 };
 
-static int compat_nfs_svc_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg __user *arg)
-{
-        int err;
-
-        err = access_ok(VERIFY_READ, &arg->ca32_svc, sizeof(arg->ca32_svc));
-        err |= get_user(karg->ca_version, &arg->ca32_version);
-        err |= __get_user(karg->ca_svc.svc_port, &arg->ca32_svc.svc32_port);
-        err |= __get_user(karg->ca_svc.svc_nthreads, &arg->ca32_svc.svc32_nthreads);
-        return (err) ? -EFAULT : 0;
+static int compat_nfs_svc_trans(struct nfsctl_arg *karg,
+                                struct compat_nfsctl_arg __user *arg)
+{
+        if (!access_ok(VERIFY_READ, &arg->ca32_svc, sizeof(arg->ca32_svc)) ||
+                get_user(karg->ca_version, &arg->ca32_version) ||
+                __get_user(karg->ca_svc.svc_port, &arg->ca32_svc.svc32_port) ||
+                __get_user(karg->ca_svc.svc_nthreads,
+                                &arg->ca32_svc.svc32_nthreads))
+                return -EFAULT;
+        return 0;
 }
 
-static int compat_nfs_clnt_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg __user *arg)
-{
-        int err;
-
-        err = access_ok(VERIFY_READ, &arg->ca32_client, sizeof(arg->ca32_client));
-        err |= get_user(karg->ca_version, &arg->ca32_version);
-        err |= __copy_from_user(&karg->ca_client.cl_ident[0],
-                          &arg->ca32_client.cl32_ident[0],
-                          NFSCLNT_IDMAX);
-        err |= __get_user(karg->ca_client.cl_naddr, &arg->ca32_client.cl32_naddr);
-        err |= __copy_from_user(&karg->ca_client.cl_addrlist[0],
-                          &arg->ca32_client.cl32_addrlist[0],
-                          (sizeof(struct in_addr) * NFSCLNT_ADDRMAX));
-        err |= __get_user(karg->ca_client.cl_fhkeytype,
-                      &arg->ca32_client.cl32_fhkeytype);
-        err |= __get_user(karg->ca_client.cl_fhkeylen,
-                      &arg->ca32_client.cl32_fhkeylen);
-        err |= __copy_from_user(&karg->ca_client.cl_fhkey[0],
-                          &arg->ca32_client.cl32_fhkey[0],
-                          NFSCLNT_KEYMAX);
+static int compat_nfs_clnt_trans(struct nfsctl_arg *karg,
+                                struct compat_nfsctl_arg __user *arg)
+{
+        if (!access_ok(VERIFY_READ, &arg->ca32_client,
+                        sizeof(arg->ca32_client)) ||
+                get_user(karg->ca_version, &arg->ca32_version) ||
+                __copy_from_user(&karg->ca_client.cl_ident[0],
+                                &arg->ca32_client.cl32_ident[0],
+                                NFSCLNT_IDMAX) ||
+                __get_user(karg->ca_client.cl_naddr,
+                                &arg->ca32_client.cl32_naddr) ||
+                __copy_from_user(&karg->ca_client.cl_addrlist[0],
+                                &arg->ca32_client.cl32_addrlist[0],
+                                (sizeof(struct in_addr) * NFSCLNT_ADDRMAX)) ||
+                __get_user(karg->ca_client.cl_fhkeytype,
+                                &arg->ca32_client.cl32_fhkeytype) ||
+                __get_user(karg->ca_client.cl_fhkeylen,
+                                &arg->ca32_client.cl32_fhkeylen) ||
+                __copy_from_user(&karg->ca_client.cl_fhkey[0],
+                                &arg->ca32_client.cl32_fhkey[0],
+                                NFSCLNT_KEYMAX))
+                return -EFAULT;
 
-        return (err) ? -EFAULT : 0;
+        return 0;
 }
 
-static int compat_nfs_exp_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg __user *arg)
-{
-        int err;
-
-        err = access_ok(VERIFY_READ, &arg->ca32_export, sizeof(arg->ca32_export));
-        err |= get_user(karg->ca_version, &arg->ca32_version);
-        err |= __copy_from_user(&karg->ca_export.ex_client[0],
-                          &arg->ca32_export.ex32_client[0],
-                          NFSCLNT_IDMAX);
-        err |= __copy_from_user(&karg->ca_export.ex_path[0],
-                          &arg->ca32_export.ex32_path[0],
-                          NFS_MAXPATHLEN);
-        err |= __get_user(karg->ca_export.ex_dev,
-                      &arg->ca32_export.ex32_dev);
-        err |= __get_user(karg->ca_export.ex_ino,
-                      &arg->ca32_export.ex32_ino);
-        err |= __get_user(karg->ca_export.ex_flags,
-                      &arg->ca32_export.ex32_flags);
-        err |= __get_user(karg->ca_export.ex_anon_uid,
-                      &arg->ca32_export.ex32_anon_uid);
-        err |= __get_user(karg->ca_export.ex_anon_gid,
-                      &arg->ca32_export.ex32_anon_gid);
+static int compat_nfs_exp_trans(struct nfsctl_arg *karg,
+                                struct compat_nfsctl_arg __user *arg)
+{
+        if (!access_ok(VERIFY_READ, &arg->ca32_export,
+                                sizeof(arg->ca32_export)) ||
+                get_user(karg->ca_version, &arg->ca32_version) ||
+                __copy_from_user(&karg->ca_export.ex_client[0],
+                                &arg->ca32_export.ex32_client[0],
+                                NFSCLNT_IDMAX) ||
+                __copy_from_user(&karg->ca_export.ex_path[0],
+                                &arg->ca32_export.ex32_path[0],
+                                NFS_MAXPATHLEN) ||
+                __get_user(karg->ca_export.ex_dev,
+                                &arg->ca32_export.ex32_dev) ||
+                __get_user(karg->ca_export.ex_ino,
+                                &arg->ca32_export.ex32_ino) ||
+                __get_user(karg->ca_export.ex_flags,
+                                &arg->ca32_export.ex32_flags) ||
+                __get_user(karg->ca_export.ex_anon_uid,
+                                &arg->ca32_export.ex32_anon_uid) ||
+                __get_user(karg->ca_export.ex_anon_gid,
+                                &arg->ca32_export.ex32_anon_gid))
+                return -EFAULT;
         SET_UID(karg->ca_export.ex_anon_uid, karg->ca_export.ex_anon_uid);
         SET_GID(karg->ca_export.ex_anon_gid, karg->ca_export.ex_anon_gid);
 
-        return (err) ? -EFAULT : 0;
+        return 0;
 }
 
-static int compat_nfs_getfd_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg __user *arg)
-{
-        int err;
-
-        err = access_ok(VERIFY_READ, &arg->ca32_getfd, sizeof(arg->ca32_getfd));
-        err |= get_user(karg->ca_version, &arg->ca32_version);
-        err |= __copy_from_user(&karg->ca_getfd.gd_addr,
-                          &arg->ca32_getfd.gd32_addr,
-                          (sizeof(struct sockaddr)));
-        err |= __copy_from_user(&karg->ca_getfd.gd_path,
-                          &arg->ca32_getfd.gd32_path,
-                          (NFS_MAXPATHLEN+1));
-        err |= __get_user(karg->ca_getfd.gd_version,
-                      &arg->ca32_getfd.gd32_version);
+static int compat_nfs_getfd_trans(struct nfsctl_arg *karg,
+                                struct compat_nfsctl_arg __user *arg)
+{
+        if (!access_ok(VERIFY_READ, &arg->ca32_getfd,
+                        sizeof(arg->ca32_getfd)) ||
+                get_user(karg->ca_version, &arg->ca32_version) ||
+                __copy_from_user(&karg->ca_getfd.gd_addr,
+                                &arg->ca32_getfd.gd32_addr,
+                                (sizeof(struct sockaddr))) ||
+                __copy_from_user(&karg->ca_getfd.gd_path,
+                                &arg->ca32_getfd.gd32_path,
+                                (NFS_MAXPATHLEN+1)) ||
+                __get_user(karg->ca_getfd.gd_version,
+                                &arg->ca32_getfd.gd32_version))
+                return -EFAULT;
 
-        return (err) ? -EFAULT : 0;
+        return 0;
 }
 
-static int compat_nfs_getfs_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg __user *arg)
+static int compat_nfs_getfs_trans(struct nfsctl_arg *karg,
+                                struct compat_nfsctl_arg __user *arg)
 {
-        int err;
-
-        err = access_ok(VERIFY_READ, &arg->ca32_getfs, sizeof(arg->ca32_getfs));
-        err |= get_user(karg->ca_version, &arg->ca32_version);
-        err |= __copy_from_user(&karg->ca_getfs.gd_addr,
-                          &arg->ca32_getfs.gd32_addr,
-                          (sizeof(struct sockaddr)));
-        err |= __copy_from_user(&karg->ca_getfs.gd_path,
-                          &arg->ca32_getfs.gd32_path,
-                          (NFS_MAXPATHLEN+1));
-        err |= __get_user(karg->ca_getfs.gd_maxlen,
-                      &arg->ca32_getfs.gd32_maxlen);
+        if (!access_ok(VERIFY_READ,&arg->ca32_getfs,sizeof(arg->ca32_getfs)) ||
+                get_user(karg->ca_version, &arg->ca32_version) ||
+                __copy_from_user(&karg->ca_getfs.gd_addr,
+                                &arg->ca32_getfs.gd32_addr,
+                                (sizeof(struct sockaddr))) ||
+                __copy_from_user(&karg->ca_getfs.gd_path,
+                                &arg->ca32_getfs.gd32_path,
+                                (NFS_MAXPATHLEN+1)) ||
+                __get_user(karg->ca_getfs.gd_maxlen,
+                                &arg->ca32_getfs.gd32_maxlen))
+                return -EFAULT;
 
-        return (err) ? -EFAULT : 0;
+        return 0;
 }
 
 /* This really doesn't need translations, we are only passing
  * back a union which contains opaque nfs file handle data.
  */
-static int compat_nfs_getfh_res_trans(union nfsctl_res *kres, union compat_nfsctl_res __user *res)
+static int compat_nfs_getfh_res_trans(union nfsctl_res *kres,
+                                union compat_nfsctl_res __user *res)
 {
         int err;
 
@@ -2141,8 +2147,9 @@ static int compat_nfs_getfh_res_trans(union nfsctl_res *kres, union compat_nfsct
         return (err) ? -EFAULT : 0;
 }
 
-asmlinkage long compat_sys_nfsservctl(int cmd, struct compat_nfsctl_arg __user *arg,
-                                        union compat_nfsctl_res __user *res)
+asmlinkage long compat_sys_nfsservctl(int cmd,
+                                struct compat_nfsctl_arg __user *arg,
+                                union compat_nfsctl_res __user *res)
 {
         struct nfsctl_arg *karg;
         union nfsctl_res *kres;
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index b06b54f1bbbb..4c39009350f3 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -102,7 +102,7 @@ find_exported_dentry(struct super_block *sb, void *obj, void *parent,
                 if (acceptable(context, result))
                         return result;
                 if (S_ISDIR(result->d_inode->i_mode)) {
-                        /* there is no other dentry, so fail */
+                        err = -EACCES;
                         goto err_result;
                 }
 
diff --git a/fs/inotify.c b/fs/inotify.c
index 1f50302849c5..732ec4bd5774 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -848,7 +848,11 @@ static int inotify_release(struct inode *ignored, struct file *file)
                 inode = watch->inode;
                 mutex_lock(&inode->inotify_mutex);
                 mutex_lock(&dev->mutex);
-                remove_watch_no_event(watch, dev);
+
+                /* make sure we didn't race with another list removal */
+                if (likely(idr_find(&dev->idr, watch->wd)))
+                        remove_watch_no_event(watch, dev);
+
                 mutex_unlock(&dev->mutex);
                 mutex_unlock(&inode->inotify_mutex);
                 put_inotify_watch(watch);
@@ -890,8 +894,7 @@ static int inotify_ignore(struct inotify_device *dev, s32 wd)
         mutex_lock(&dev->mutex);
 
         /* make sure that we did not race */
-        watch = idr_find(&dev->idr, wd);
-        if (likely(watch))
+        if (likely(idr_find(&dev->idr, wd) == watch))
                 remove_watch(watch, dev);
 
         mutex_unlock(&dev->mutex);
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 4e0578121d9a..3eec30000f3f 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -1066,9 +1066,11 @@ exp_pseudoroot(struct auth_domain *clp, struct svc_fh *fhp,
                 rv = nfserr_perm;
         else if (IS_ERR(exp))
                 rv = nfserrno(PTR_ERR(exp));
-        else
+        else {
                 rv = fh_compose(fhp, exp,
                                 fsid_key->ek_dentry, NULL);
+                exp_put(exp);
+        }
         cache_put(&fsid_key->h, &svc_expkey_cache);
         return rv;
 }
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 6aa92d0e6876..1d65f13f458c 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1922,11 +1922,10 @@ nfsd_set_posix_acl(struct svc_fh *fhp, int type, struct posix_acl *acl)
                 value = kmalloc(size, GFP_KERNEL);
                 if (!value)
                         return -ENOMEM;
-                size = posix_acl_to_xattr(acl, value, size);
-                if (size < 0) {
-                        error = size;
+                error = posix_acl_to_xattr(acl, value, size);
+                if (error < 0)
                         goto getout;
-                }
+                size = error;
         } else
                 size = 0;