8 files changed, 55 insertions, 28 deletions

diff --git a/fs/coredump.c b/fs/coredump.c
index fd37facac8dc..ce47379bfa61 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -450,11 +450,12 @@ static int umh_pipe_setup(struct subprocess_info *info, struct cred *new)
 
         cp->file = files[1];
 
-        replace_fd(0, files[0], 0);
+        err = replace_fd(0, files[0], 0);
+        fput(files[0]);
         /* and disallow core files too */
         current->signal->rlim[RLIMIT_CORE] = (struct rlimit){1, 1};
 
-        return 0;
+        return err;
 }
 
 void do_coredump(siginfo_t *siginfo, struct pt_regs *regs)
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 6c205d0c565b..fa04d023177e 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -469,7 +469,7 @@ static int parse_options(char *options, struct super_block *sb)
                         uid = make_kuid(current_user_ns(), option);
                         if (!uid_valid(uid)) {
                                 ext2_msg(sb, KERN_ERR, "Invalid uid value %d", option);
-                                return -1;
+                                return 0;
 
                         }
                         sbi->s_resuid = uid;
@@ -480,7 +480,7 @@ static int parse_options(char *options, struct super_block *sb)
                         gid = make_kgid(current_user_ns(), option);
                         if (!gid_valid(gid)) {
                                 ext2_msg(sb, KERN_ERR, "Invalid gid value %d", option);
-                                return -1;
+                                return 0;
                         }
                         sbi->s_resgid = gid;
                         break;
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 8f4fddac01a6..890b8947c546 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -46,8 +46,7 @@ static struct buffer_head *ext3_append(handle_t *handle,
 
         *block = inode->i_size >> inode->i_sb->s_blocksize_bits;
 
-        bh = ext3_bread(handle, inode, *block, 1, err);
-        if (bh) {
+        if ((bh = ext3_dir_bread(handle, inode, *block, 1, err))) {
                 inode->i_size += inode->i_sb->s_blocksize;
                 EXT3_I(inode)->i_disksize = inode->i_size;
                 *err = ext3_journal_get_write_access(handle, bh);
@@ -339,8 +338,10 @@ dx_probe(struct qstr *entry, struct inode *dir,
         u32 hash;
 
         frame->bh = NULL;
-        if (!(bh = ext3_bread (NULL,dir, 0, 0, err)))
+        if (!(bh = ext3_dir_bread(NULL, dir, 0, 0, err))) {
+                *err = ERR_BAD_DX_DIR;
                 goto fail;
+        }
         root = (struct dx_root *) bh->b_data;
         if (root->info.hash_version != DX_HASH_TEA &&
             root->info.hash_version != DX_HASH_HALF_MD4 &&
@@ -436,8 +437,10 @@ dx_probe(struct qstr *entry, struct inode *dir,
                 frame->entries = entries;
                 frame->at = at;
                 if (!indirect--) return frame;
-                if (!(bh = ext3_bread (NULL,dir, dx_get_block(at), 0, err)))
+                if (!(bh = ext3_dir_bread(NULL, dir, dx_get_block(at), 0, err))) {
+                        *err = ERR_BAD_DX_DIR;
                         goto fail2;
+                }
                 at = entries = ((struct dx_node *) bh->b_data)->entries;
                 if (dx_get_limit(entries) != dx_node_limit (dir)) {
                         ext3_warning(dir->i_sb, __func__,
@@ -535,8 +538,8 @@ static int ext3_htree_next_block(struct inode *dir, __u32 hash,
          * block so no check is necessary
          */
         while (num_frames--) {
-                if (!(bh = ext3_bread(NULL, dir, dx_get_block(p->at),
-                                      0, &err)))
+                if (!(bh = ext3_dir_bread(NULL, dir, dx_get_block(p->at),
+                                          0, &err)))
                         return err; /* Failure */
                 p++;
                 brelse (p->bh);
@@ -559,10 +562,11 @@ static int htree_dirblock_to_tree(struct file *dir_file,
 {
         struct buffer_head *bh;
         struct ext3_dir_entry_2 *de, *top;
-        int err, count = 0;
+        int err = 0, count = 0;
 
         dxtrace(printk("In htree dirblock_to_tree: block %d\n", block));
-        if (!(bh = ext3_bread (NULL, dir, block, 0, &err)))
+
+        if (!(bh = ext3_dir_bread(NULL, dir, block, 0, &err)))
                 return err;
 
         de = (struct ext3_dir_entry_2 *) bh->b_data;
@@ -976,7 +980,7 @@ static struct buffer_head * ext3_dx_find_entry(struct inode *dir,
                 return NULL;
         do {
                 block = dx_get_block(frame->at);
-                if (!(bh = ext3_bread (NULL,dir, block, 0, err)))
+                if (!(bh = ext3_dir_bread (NULL, dir, block, 0, err)))
                         goto errout;
 
                 retval = search_dirblock(bh, dir, entry,
@@ -1458,9 +1462,9 @@ static int ext3_add_entry (handle_t *handle, struct dentry *dentry,
         }
         blocks = dir->i_size >> sb->s_blocksize_bits;
         for (block = 0; block < blocks; block++) {
-                bh = ext3_bread(handle, dir, block, 0, &retval);
-                if(!bh)
+                if (!(bh = ext3_dir_bread(handle, dir, block, 0, &retval)))
                         return retval;
+
                 retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
                 if (retval != -ENOSPC)
                         return retval;
@@ -1500,7 +1504,7 @@ static int ext3_dx_add_entry(handle_t *handle, struct dentry *dentry,
         entries = frame->entries;
         at = frame->at;
 
-        if (!(bh = ext3_bread(handle,dir, dx_get_block(frame->at), 0, &err)))
+        if (!(bh = ext3_dir_bread(handle, dir, dx_get_block(frame->at), 0, &err)))
                 goto cleanup;
 
         BUFFER_TRACE(bh, "get_write_access");
@@ -1790,8 +1794,7 @@ retry:
         inode->i_op = &ext3_dir_inode_operations;
         inode->i_fop = &ext3_dir_operations;
         inode->i_size = EXT3_I(inode)->i_disksize = inode->i_sb->s_blocksize;
-        dir_block = ext3_bread (handle, inode, 0, 1, &err);
-        if (!dir_block)
+        if (!(dir_block = ext3_dir_bread(handle, inode, 0, 1, &err)))
                 goto out_clear_inode;
 
         BUFFER_TRACE(dir_block, "get_write_access");
@@ -1859,7 +1862,7 @@ static int empty_dir (struct inode * inode)
 
         sb = inode->i_sb;
         if (inode->i_size < EXT3_DIR_REC_LEN(1) + EXT3_DIR_REC_LEN(2) ||
-            !(bh = ext3_bread (NULL, inode, 0, 0, &err))) {
+            !(bh = ext3_dir_bread(NULL, inode, 0, 0, &err))) {
                 if (err)
                         ext3_error(inode->i_sb, __func__,
                                    "error %d reading directory #%lu offset 0",
@@ -1890,9 +1893,8 @@ static int empty_dir (struct inode * inode)
                         (void *) de >= (void *) (bh->b_data+sb->s_blocksize)) {
                         err = 0;
                         brelse (bh);
-                        bh = ext3_bread (NULL, inode,
-                                offset >> EXT3_BLOCK_SIZE_BITS(sb), 0, &err);
-                        if (!bh) {
+                        if (!(bh = ext3_dir_bread (NULL, inode,
+                                offset >> EXT3_BLOCK_SIZE_BITS(sb), 0, &err))) {
                                 if (err)
                                         ext3_error(sb, __func__,
                                                    "error %d reading directory"
@@ -2388,7 +2390,7 @@ static int ext3_rename (struct inode * old_dir, struct dentry *old_dentry,
                                 goto end_rename;
                 }
                 retval = -EIO;
-                dir_bh = ext3_bread (handle, old_inode, 0, 0, &retval);
+                dir_bh = ext3_dir_bread(handle, old_inode, 0, 0, &retval);
                 if (!dir_bh)
                         goto end_rename;
                 if (le32_to_cpu(PARENT_INO(dir_bh->b_data)) != old_dir->i_ino)
diff --git a/fs/ext3/namei.h b/fs/ext3/namei.h
index f2ce2b0065c9..46304d8c9f0a 100644
--- a/fs/ext3/namei.h
+++ b/fs/ext3/namei.h
@@ -6,3 +6,22 @@
 */
 
 extern struct dentry *ext3_get_parent(struct dentry *child);
+
+static inline struct buffer_head *ext3_dir_bread(handle_t *handle,
+                                                 struct inode *inode,
+                                                 int block, int create,
+                                                 int *err)
+{
+        struct buffer_head *bh;
+
+        bh = ext3_bread(handle, inode, block, create, err);
+
+        if (!bh && !(*err)) {
+                *err = -EIO;
+                ext3_error(inode->i_sb, __func__,
+                           "Directory hole detected on inode %lu\n",
+                           inode->i_ino);
+                return NULL;
+        }
+        return bh;
+}
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 29e79713c7eb..5366393528df 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -1001,7 +1001,7 @@ static int parse_options (char *options, struct super_block *sb,
                         uid = make_kuid(current_user_ns(), option);
                         if (!uid_valid(uid)) {
                                 ext3_msg(sb, KERN_ERR, "Invalid uid value %d", option);
-                                return -1;
+                                return 0;
 
                         }
                         sbi->s_resuid = uid;
@@ -1012,7 +1012,7 @@ static int parse_options (char *options, struct super_block *sb,
                         gid = make_kgid(current_user_ns(), option);
                         if (!gid_valid(gid)) {
                                 ext3_msg(sb, KERN_ERR, "Invalid gid value %d", option);
-                                return -1;
+                                return 0;
                         }
                         sbi->s_resgid = gid;
                         break;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 79827ce03e3b..14df8806ff29 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1158,6 +1158,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
         struct vm_area_struct *vma = v;
         struct numa_maps *md = &numa_priv->md;
         struct file *file = vma->vm_file;
+        struct task_struct *task = proc_priv->task;
         struct mm_struct *mm = vma->vm_mm;
         struct mm_walk walk = {};
         struct mempolicy *pol;
@@ -1177,9 +1178,11 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
         walk.private = md;
         walk.mm = mm;
 
-        pol = get_vma_policy(proc_priv->task, vma, vma->vm_start);
+        task_lock(task);
+        pol = get_vma_policy(task, vma, vma->vm_start);
         mpol_to_str(buffer, sizeof(buffer), pol, 0);
         mpol_cond_put(pol);
+        task_unlock(task);
 
         seq_printf(m, "%08lx %s", vma->vm_start, buffer);
 
@@ -1189,7 +1192,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
         } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
                 seq_printf(m, " heap");
         } else {
-                pid_t tid = vm_is_stack(proc_priv->task, vma, is_pid);
+                pid_t tid = vm_is_stack(task, vma, is_pid);
                 if (tid != 0) {
                         /*
                          * Thread stack in /proc/PID/task/TID/maps or
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 557a9c20a215..05ae3c97f7a5 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1160,6 +1160,8 @@ static int need_print_warning(struct dquot_warn *warn)
                         return uid_eq(current_fsuid(), warn->w_dq_id.uid);
                 case GRPQUOTA:
                         return in_group_p(warn->w_dq_id.gid);
+                case PRJQUOTA:  /* Never taken... Just make gcc happy */
+                        return 0;
         }
         return 0;
 }
diff --git a/fs/xattr.c b/fs/xattr.c
index e164dddb8e96..e21c119f4f99 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -846,7 +846,7 @@ static int __simple_xattr_set(struct simple_xattrs *xattrs, const char *name,
                               const void *value, size_t size, int flags)
 {
         struct simple_xattr *xattr;
-        struct simple_xattr *uninitialized_var(new_xattr);
+        struct simple_xattr *new_xattr = NULL;
         int err = 0;
 
         /* value == NULL means remove */