4 files changed, 26 insertions, 3 deletions

diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 358563689064..6406f896bf95 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -242,7 +242,8 @@ struct p9_fid *v9fs_fid_lookup(struct dentry *dentry)
         }
         kfree(wnames);
 fid_out:
-        v9fs_fid_add(dentry, fid);
+        if (!IS_ERR(fid))
+                v9fs_fid_add(dentry, fid);
 err_out:
         up_read(&v9ses->rename_sem);
         return fid;
diff --git a/fs/namespace.c b/fs/namespace.c
index de402eb6eafb..a72eaabfe8f2 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1484,13 +1484,30 @@ out_unlock:
 }
 
 /*
+ * Sanity check the flags to change_mnt_propagation.
+ */
+
+static int flags_to_propagation_type(int flags)
+{
+        int type = flags & ~MS_REC;
+
+        /* Fail if any non-propagation flags are set */
+        if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
+                return 0;
+        /* Only one propagation flag should be set */
+        if (!is_power_of_2(type))
+                return 0;
+        return type;
+}
+
+/*
  * recursively change the type of the mountpoint.
  */
 static int do_change_type(struct path *path, int flag)
 {
         struct vfsmount *m, *mnt = path->mnt;
         int recurse = flag & MS_REC;
-        int type = flag & ~MS_REC;
+        int type;
         int err = 0;
 
         if (!capable(CAP_SYS_ADMIN))
@@ -1499,6 +1516,10 @@ static int do_change_type(struct path *path, int flag)
         if (path->dentry != path->mnt->mnt_root)
                 return -EINVAL;
 
+        type = flags_to_propagation_type(flag);
+        if (!type)
+                return -EINVAL;
+
         down_write(&namespace_sem);
         if (type == MS_SHARED) {
                 err = invent_group_ids(mnt, recurse);
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 4317f177ea7c..ba7c10c917fc 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -446,6 +446,7 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
         nilfs_mdt_destroy(nilfs->ns_cpfile);
         nilfs_mdt_destroy(nilfs->ns_sufile);
         nilfs_mdt_destroy(nilfs->ns_dat);
+        nilfs_mdt_destroy(nilfs->ns_gc_dat);
 
  failed:
         nilfs_clear_recovery_info(&ri);
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 1b27b5688f62..da3fefe91a8f 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -340,7 +340,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
         char *p;
 
         p = d_path(&file->f_path, last_sysfs_file, sizeof(last_sysfs_file));
-        if (p)
+        if (!IS_ERR(p))
                 memmove(last_sysfs_file, p, strlen(p) + 1);
 
         /* need attr_sd for attr and ops, its parent for kobj */