3 files changed, 10 insertions, 7 deletions

diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 6e025e02ffde..cc1febd8fadf 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -2563,9 +2563,9 @@ static int corrupt_data(const struct ubifs_info *c, const void *buf,
         unsigned int from, to, ffs = chance(1, 2);
         unsigned char *p = (void *)buf;
 
-        from = prandom_u32() % (len + 1);
-        /* Corruption may only span one max. write unit */
-        to = min(len, ALIGN(from, c->max_write_size));
+        from = prandom_u32() % len;
+        /* Corruption span max to end of write unit */
+        to = min(len, ALIGN(from + 1, c->max_write_size));
 
         ubifs_warn("filled bytes %u-%u with %s", from, to - 1,
                    ffs ? "0xFFs" : "random data");
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 76ca53cd3eee..9718da86ad01 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -668,8 +668,7 @@ int ubifs_garbage_collect(struct ubifs_info *c, int anyway)
         ubifs_assert(!wbuf->used);
 
         for (i = 0; ; i++) {
-                int space_before = c->leb_size - wbuf->offs - wbuf->used;
-                int space_after;
+                int space_before, space_after;
 
                 cond_resched();
 
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 3e4aa7281e04..f69daa514a57 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1630,8 +1630,10 @@ static int ubifs_remount_rw(struct ubifs_info *c)
         }
 
         c->write_reserve_buf = kmalloc(COMPRESSED_DATA_NODE_BUF_SZ, GFP_KERNEL);
-        if (!c->write_reserve_buf)
+        if (!c->write_reserve_buf) {
+                err = -ENOMEM;
                 goto out;
+        }
 
         err = ubifs_lpt_init(c, 0, 1);
         if (err)
@@ -2064,8 +2066,10 @@ static int ubifs_fill_super(struct super_block *sb, void *data, int silent)
         }
 
         sb->s_root = d_make_root(root);
-        if (!sb->s_root)
+        if (!sb->s_root) {
+                err = -ENOMEM;
                 goto out_umount;
+        }
 
         mutex_unlock(&c->umount_mutex);
         return 0;