2 files changed, 7 insertions, 0 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 9fe7216457d8..edfca5b75535 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1397,6 +1397,9 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb)
                 if (unlikely(!access_ok(VERIFY_WRITE, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
+                ret = security_file_permission(file, MAY_READ);
+                if (unlikely(ret))
+                        break;
                 ret = -EINVAL;
                 if (file->f_op->aio_read)
                         kiocb->ki_retry = aio_pread;
@@ -1409,6 +1412,9 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb)
                 if (unlikely(!access_ok(VERIFY_READ, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
+                ret = security_file_permission(file, MAY_WRITE);
+                if (unlikely(ret))
+                        break;
                 ret = -EINVAL;
                 if (file->f_op->aio_write)
                         kiocb->ki_retry = aio_pwrite;
diff --git a/fs/inotify.c b/fs/inotify.c
index a37e9fb1da58..9fbaebfdf40b 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -176,6 +176,7 @@ static inline void put_inotify_dev(struct inotify_device *dev)
         if (atomic_dec_and_test(&dev->count)) {
                 atomic_dec(&dev->user->inotify_devs);
                 free_uid(dev->user);
+                idr_destroy(&dev->idr);
                 kfree(dev);
         }
 }