3 files changed, 46 insertions, 13 deletions

diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index d61e3b28ce37..36d961f342af 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -146,7 +146,7 @@ static int v9fs_dir_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 while (rdir->head < rdir->tail) {
                         p9stat_init(&st);
                         err = p9stat_read(rdir->buf + rdir->head,
-                                                buflen - rdir->head, &st,
+                                                rdir->tail - rdir->head, &st,
                                                 fid->clnt->proto_version);
                         if (err) {
                                 P9_DPRINTK(P9_DEBUG_VFS, "returned %d\n", err);
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index 26ca3361a8bc..6b48d7c268b2 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -1231,6 +1231,25 @@ static int do_filldir_main(struct gfs2_inode *dip, u64 *offset,
         return 0;
 }
 
+static void *gfs2_alloc_sort_buffer(unsigned size)
+{
+        void *ptr = NULL;
+
+        if (size < KMALLOC_MAX_SIZE)
+                ptr = kmalloc(size, GFP_NOFS | __GFP_NOWARN);
+        if (!ptr)
+                ptr = __vmalloc(size, GFP_NOFS, PAGE_KERNEL);
+        return ptr;
+}
+
+static void gfs2_free_sort_buffer(void *ptr)
+{
+        if (is_vmalloc_addr(ptr))
+                vfree(ptr);
+        else
+                kfree(ptr);
+}
+
 static int gfs2_dir_read_leaf(struct inode *inode, u64 *offset, void *opaque,
                               filldir_t filldir, int *copied, unsigned *depth,
                               u64 leaf_no)
@@ -1271,7 +1290,7 @@ static int gfs2_dir_read_leaf(struct inode *inode, u64 *offset, void *opaque,
          * 99 is the maximum number of entries that can fit in a single
          * leaf block.
          */
-        larr = vmalloc((leaves + entries + 99) * sizeof(void *));
+        larr = gfs2_alloc_sort_buffer((leaves + entries + 99) * sizeof(void *));
         if (!larr)
                 goto out;
         darr = (const struct gfs2_dirent **)(larr + leaves);
@@ -1282,7 +1301,7 @@ static int gfs2_dir_read_leaf(struct inode *inode, u64 *offset, void *opaque,
         do {
                 error = get_leaf(ip, lfn, &bh);
                 if (error)
-                        goto out_kfree;
+                        goto out_free;
                 lf = (struct gfs2_leaf *)bh->b_data;
                 lfn = be64_to_cpu(lf->lf_next);
                 if (lf->lf_entries) {
@@ -1291,7 +1310,7 @@ static int gfs2_dir_read_leaf(struct inode *inode, u64 *offset, void *opaque,
                                                 gfs2_dirent_gather, NULL, &g);
                         error = PTR_ERR(dent);
                         if (IS_ERR(dent))
-                                goto out_kfree;
+                                goto out_free;
                         if (entries2 != g.offset) {
                                 fs_warn(sdp, "Number of entries corrupt in dir "
                                                 "leaf %llu, entries2 (%u) != "
@@ -1300,7 +1319,7 @@ static int gfs2_dir_read_leaf(struct inode *inode, u64 *offset, void *opaque,
                                         entries2, g.offset);
                                         
                                 error = -EIO;
-                                goto out_kfree;
+                                goto out_free;
                         }
                         error = 0;
                         larr[leaf++] = bh;
@@ -1312,10 +1331,10 @@ static int gfs2_dir_read_leaf(struct inode *inode, u64 *offset, void *opaque,
         BUG_ON(entries2 != entries);
         error = do_filldir_main(ip, offset, opaque, filldir, darr,
                                 entries, copied);
-out_kfree:
+out_free:
         for(i = 0; i < leaf; i++)
                 brelse(larr[i]);
-        vfree(larr);
+        gfs2_free_sort_buffer(larr);
 out:
         return error;
 }
diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
index f71246bebfe4..a7ac78f8e67a 100644
--- a/fs/sysfs/symlink.c
+++ b/fs/sysfs/symlink.c
@@ -28,6 +28,7 @@ static int sysfs_do_create_link(struct kobject *kobj, struct kobject *target,
         struct sysfs_dirent *target_sd = NULL;
         struct sysfs_dirent *sd = NULL;
         struct sysfs_addrm_cxt acxt;
+        enum kobj_ns_type ns_type;
         int error;
 
         BUG_ON(!name);
@@ -58,16 +59,29 @@ static int sysfs_do_create_link(struct kobject *kobj, struct kobject *target,
         if (!sd)
                 goto out_put;
 
-        if (sysfs_ns_type(parent_sd))
+        ns_type = sysfs_ns_type(parent_sd);
+        if (ns_type)
                 sd->s_ns = target->ktype->namespace(target);
         sd->s_symlink.target_sd = target_sd;
         target_sd = NULL;       /* reference is now owned by the symlink */
 
         sysfs_addrm_start(&acxt, parent_sd);
-        if (warn)
-                error = sysfs_add_one(&acxt, sd);
-        else
-                error = __sysfs_add_one(&acxt, sd);
+        /* Symlinks must be between directories with the same ns_type */
+        if (!ns_type ||
+            (ns_type == sysfs_ns_type(sd->s_symlink.target_sd->s_parent))) {
+                if (warn)
+                        error = sysfs_add_one(&acxt, sd);
+                else
+                        error = __sysfs_add_one(&acxt, sd);
+        } else {
+                error = -EINVAL;
+                WARN(1, KERN_WARNING
+                        "sysfs: symlink across ns_types %s/%s -> %s/%s\n",
+                        parent_sd->s_name,
+                        sd->s_name,
+                        sd->s_symlink.target_sd->s_parent->s_name,
+                        sd->s_symlink.target_sd->s_name);
+        }
         sysfs_addrm_finish(&acxt);
 
         if (error)
@@ -122,7 +136,7 @@ void sysfs_delete_link(struct kobject *kobj, struct kobject *targ,
 {
         const void *ns = NULL;
         spin_lock(&sysfs_assoc_lock);
-        if (targ->sd)
+        if (targ->sd && sysfs_ns_type(kobj->sd))
                 ns = targ->sd->s_ns;
         spin_unlock(&sysfs_assoc_lock);
         sysfs_hash_and_remove(kobj->sd, ns, name);