8 files changed, 34 insertions, 43 deletions

diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 976a691c5a68..7e056b9b49e8 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1806,13 +1806,6 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                 }
                 if ((rc < 0) || (smb_read_data == NULL)) {
                         cFYI(1, ("Read error in readpages: %d", rc));
-                        /* clean up remaing pages off list */
-                        while (!list_empty(page_list) && (i < num_pages)) {
-                                page = list_entry(page_list->prev, struct page,
-                                                  lru);
-                                list_del(&page->lru);
-                                page_cache_release(page);
-                        }
                         break;
                 } else if (bytes_read > 0) {
                         pSMBr = (struct smb_com_read_rsp *)smb_read_data;
@@ -1831,13 +1824,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                                    this case is ok - if we are at server EOF 
                                    we will hit it on next read */
 
-                        /* while (!list_empty(page_list) && (i < num_pages)) {
-                                        page = list_entry(page_list->prev, 
-                                                          struct page, list);
-                                        list_del(&page->list);
-                                        page_cache_release(page);
-                                }
-                                break; */
+                                /* break; */
                         }
                 } else {
                         cFYI(1, ("No bytes read (%d) at offset %lld . "
@@ -1845,14 +1832,6 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                                  bytes_read, offset));
                         /* BB turn off caching and do new lookup on 
                            file size at server? */
-                        while (!list_empty(page_list) && (i < num_pages)) {
-                                page = list_entry(page_list->prev, struct page,
-                                                  lru);
-                                list_del(&page->lru);
-
-                                /* BB removeme - replace with zero of page? */
-                                page_cache_release(page);
-                        }
                         break;
                 }
                 if (smb_read_data) {
diff --git a/fs/compat.c b/fs/compat.c
index 50624d4a70c6..8d0a0018a7d2 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1835,9 +1835,12 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
 
         } while (!ret && !timeout && tsp && (ts.tv_sec || ts.tv_nsec));
 
-        if (ret == 0 && tsp && !(current->personality & STICKY_TIMEOUTS)) {
+        if (tsp) {
                 struct compat_timespec rts;
 
+                if (current->personality & STICKY_TIMEOUTS)
+                        goto sticky;
+
                 rts.tv_sec = timeout / HZ;
                 rts.tv_nsec = (timeout % HZ) * (NSEC_PER_SEC/HZ);
                 if (rts.tv_nsec >= NSEC_PER_SEC) {
@@ -1846,8 +1849,19 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
                 }
                 if (compat_timespec_compare(&rts, &ts) >= 0)
                         rts = ts;
-                if (copy_to_user(tsp, &rts, sizeof(rts)))
-                        ret = -EFAULT;
+                if (copy_to_user(tsp, &rts, sizeof(rts))) {
+sticky:
+                        /*
+                         * If an application puts its timeval in read-only
+                         * memory, we don't want the Linux-specific update to
+                         * the timeval to cause a fault after the select has
+                         * completed successfully. However, because we're not
+                         * updating the timeval, we can't restart the system
+                         * call.
+                         */
+                        if (ret == -ERESTARTNOHAND)
+                                ret = -EINTR;
+                }
         }
 
         if (ret == -ERESTARTNOHAND) {
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index f49f105394b7..136175a69332 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -134,7 +134,7 @@ int ecryptfs_crypto_api_algify_cipher_name(char **algified_name,
 
         algified_name_len = (chaining_modifier_len + cipher_name_len + 3);
         (*algified_name) = kmalloc(algified_name_len, GFP_KERNEL);
-        if (!(algified_name)) {
+        if (!(*algified_name)) {
                 rc = -ENOMEM;
                 goto out;
         }
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 2bb5ace3882d..763a50daf1c0 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -397,14 +397,14 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
 
         err = -EIO;
         if (is_bad_inode(inode))
-                goto clean_pages_up;
+                goto out;
 
         data.file = file;
         data.inode = inode;
         data.req = fuse_get_req(fc);
         err = PTR_ERR(data.req);
         if (IS_ERR(data.req))
-                goto clean_pages_up;
+                goto out;
 
         err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
         if (!err) {
@@ -413,10 +413,7 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
                 else
                         fuse_put_request(fc, data.req);
         }
-        return err;
-
-clean_pages_up:
-        put_pages_list(pages);
+out:
         return err;
 }
 
diff --git a/fs/gfs2/ops_address.c b/fs/gfs2/ops_address.c
index 8d5963c7e123..015640b3f123 100644
--- a/fs/gfs2/ops_address.c
+++ b/fs/gfs2/ops_address.c
@@ -337,13 +337,6 @@ out:
 out_noerror:
         ret = 0;
 out_unlock:
-        /* unlock all pages, we can't do any I/O right now */
-        for (page_idx = 0; page_idx < nr_pages; page_idx++) {
-                struct page *page = list_entry(pages->prev, struct page, lru);
-                list_del(&page->lru);
-                unlock_page(page);
-                page_cache_release(page);
-        }
         if (do_unlock)
                 gfs2_holder_uninit(&gh);
         goto out;
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index e9d07704680e..81b8565d3837 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -274,7 +274,7 @@ nfsd4_clear_clid_dir(struct dentry *dir, struct dentry *dentry)
          * any regular files anyway, just in case the directory was created by
          * a kernel from the future.... */
         nfsd4_list_rec_dir(dentry, nfsd4_remove_clid_file);
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
         status = vfs_rmdir(dir->d_inode, dentry);
         mutex_unlock(&dir->d_inode->i_mutex);
         return status;
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 9041802df832..17249994110f 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1619,6 +1619,7 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
                       "jmacd-8: reiserfs_fill_super: unable to read bitmap");
                 goto error;
         }
+        errval = -EINVAL;
 #ifdef CONFIG_REISERFS_CHECK
         SWARN(silent, s, "CONFIG_REISERFS_CHECK is set ON");
         SWARN(silent, s, "- it is slow mode for debugging.");
diff --git a/fs/xattr.c b/fs/xattr.c
index 395635100f77..0901bdc2ce24 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -48,14 +48,21 @@ xattr_permission(struct inode *inode, const char *name, int mask)
                 return 0;
 
         /*
-         * The trusted.* namespace can only accessed by a privilegued user.
+         * The trusted.* namespace can only be accessed by a privileged user.
          */
         if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
                 return (capable(CAP_SYS_ADMIN) ? 0 : -EPERM);
 
+        /* In user.* namespace, only regular files and directories can have
+         * extended attributes. For sticky directories, only the owner and
+         * privileged user can write attributes.
+         */
         if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
-                if (!S_ISREG(inode->i_mode) &&
-                    (!S_ISDIR(inode->i_mode) || inode->i_mode & S_ISVTX))
+                if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
+                        return -EPERM;
+                if (S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX) &&
+                    (mask & MAY_WRITE) && (current->fsuid != inode->i_uid) &&
+                    !capable(CAP_FOWNER))
                         return -EPERM;
         }