5 files changed, 69 insertions, 70 deletions

diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
index 276f7207a5..ab26176f6b 100644
--- a/fs/udf/balloc.c
+++ b/fs/udf/balloc.c
@@ -540,26 +540,24 @@ static void udf_table_free_blocks(struct super_block *sb,
                         if (epos.offset + adsize > sb->s_blocksize) {
                                 loffset = epos.offset;
                                 aed->lengthAllocDescs = cpu_to_le32(adsize);
-                                sptr = UDF_I_DATA(inode) + epos.offset -
-                                        udf_file_entry_alloc_offset(inode) +
-                                        UDF_I_LENEATTR(inode) - adsize;
+                                sptr = UDF_I_DATA(table) + epos.offset - adsize;
                                 dptr = epos.bh->b_data + sizeof(struct allocExtDesc);
                                 memcpy(dptr, sptr, adsize);
                                 epos.offset = sizeof(struct allocExtDesc) + adsize;
                         } else {
                                 loffset = epos.offset + adsize;
                                 aed->lengthAllocDescs = cpu_to_le32(0);
-                                sptr = oepos.bh->b_data + epos.offset;
-                                epos.offset = sizeof(struct allocExtDesc);
-
                                 if (oepos.bh) {
+                                        sptr = oepos.bh->b_data + epos.offset;
                                         aed = (struct allocExtDesc *)oepos.bh->b_data;
                                         aed->lengthAllocDescs =
                                                 cpu_to_le32(le32_to_cpu(aed->lengthAllocDescs) + adsize);
                                 } else {
+                                        sptr = UDF_I_DATA(table) + epos.offset;
                                         UDF_I_LENALLOC(table) += adsize;
                                         mark_inode_dirty(table);
                                 }
+                                epos.offset = sizeof(struct allocExtDesc);
                         }
                         if (UDF_SB_UDFREV(sb) >= 0x0200)
                                 udf_new_tag(epos.bh->b_data, TAG_IDENT_AED, 3, 1,
@@ -691,7 +689,7 @@ static int udf_table_new_block(struct super_block *sb,
         uint32_t spread = 0xFFFFFFFF, nspread = 0xFFFFFFFF;
         uint32_t newblock = 0, adsize;
         uint32_t elen, goal_elen = 0;
-        kernel_lb_addr eloc, goal_eloc;
+        kernel_lb_addr eloc, uninitialized_var(goal_eloc);
         struct extent_position epos, goal_epos;
         int8_t etype;
 
diff --git a/fs/udf/file.c b/fs/udf/file.c
index 5d7a4ea277..7c7a1b39d5 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -76,36 +76,29 @@ static int udf_adinicb_writepage(struct page *page, struct writeback_control *wb
         return 0;
 }
 
-static int udf_adinicb_prepare_write(struct file *file, struct page *page,
-                                     unsigned offset, unsigned to)
+static int udf_adinicb_write_end(struct file *file,
+                        struct address_space *mapping,
+                        loff_t pos, unsigned len, unsigned copied,
+                        struct page *page, void *fsdata)
 {
-        kmap(page);
-        return 0;
-}
-
-static int udf_adinicb_commit_write(struct file *file, struct page *page,
-                                    unsigned offset, unsigned to)
-{
-        struct inode *inode = page->mapping->host;
-        char *kaddr = page_address(page);
+        struct inode *inode = mapping->host;
+        unsigned offset = pos & (PAGE_CACHE_SIZE - 1);
+        char *kaddr;
 
+        kaddr = kmap_atomic(page, KM_USER0);
         memcpy(UDF_I_DATA(inode) + UDF_I_LENEATTR(inode) + offset,
-               kaddr + offset, to - offset);
-        mark_inode_dirty(inode);
-        SetPageUptodate(page);
-        kunmap(page);
-        /* only one page here */
-        if (to > inode->i_size)
-                inode->i_size = to;
-        return 0;
+                kaddr + offset, copied);
+        kunmap_atomic(kaddr, KM_USER0);
+
+        return simple_write_end(file, mapping, pos, len, copied, page, fsdata);
 }
 
 const struct address_space_operations udf_adinicb_aops = {
         .readpage       = udf_adinicb_readpage,
         .writepage      = udf_adinicb_writepage,
         .sync_page      = block_sync_page,
-        .prepare_write  = udf_adinicb_prepare_write,
-        .commit_write   = udf_adinicb_commit_write,
+        .write_begin = simple_write_begin,
+        .write_end = udf_adinicb_write_end,
 };
 
 static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 1652b2c665..6ff8151984 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -133,10 +133,13 @@ static int udf_readpage(struct file *file, struct page *page)
         return block_read_full_page(page, udf_get_block);
 }
 
-static int udf_prepare_write(struct file *file, struct page *page,
-                             unsigned from, unsigned to)
+static int udf_write_begin(struct file *file, struct address_space *mapping,
+                        loff_t pos, unsigned len, unsigned flags,
+                        struct page **pagep, void **fsdata)
 {
-        return block_prepare_write(page, from, to, udf_get_block);
+        *pagep = NULL;
+        return block_write_begin(file, mapping, pos, len, flags, pagep, fsdata,
+                                udf_get_block);
 }
 
 static sector_t udf_bmap(struct address_space *mapping, sector_t block)
@@ -148,8 +151,8 @@ const struct address_space_operations udf_aops = {
         .readpage       = udf_readpage,
         .writepage      = udf_writepage,
         .sync_page      = block_sync_page,
-        .prepare_write  = udf_prepare_write,
-        .commit_write   = generic_commit_write,
+        .write_begin            = udf_write_begin,
+        .write_end              = generic_write_end,
         .bmap           = udf_bmap,
 };
 
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 382be7be5a..4360c7a057 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -89,7 +89,7 @@ static int udf_find_fileset(struct super_block *, kernel_lb_addr *,
 static void udf_load_pvoldesc(struct super_block *, struct buffer_head *);
 static void udf_load_fileset(struct super_block *, struct buffer_head *,
                              kernel_lb_addr *);
-static void udf_load_partdesc(struct super_block *, struct buffer_head *);
+static int udf_load_partdesc(struct super_block *, struct buffer_head *);
 static void udf_open_lvid(struct super_block *);
 static void udf_close_lvid(struct super_block *);
 static unsigned int udf_count_free(struct super_block *);
@@ -134,7 +134,7 @@ static void udf_destroy_inode(struct inode *inode)
         kmem_cache_free(udf_inode_cachep, UDF_I(inode));
 }
 
-static void init_once(void *foo, struct kmem_cache *cachep, unsigned long flags)
+static void init_once(struct kmem_cache *cachep, void *foo)
 {
         struct udf_inode_info *ei = (struct udf_inode_info *)foo;
 
@@ -877,7 +877,7 @@ static void udf_load_fileset(struct super_block *sb, struct buffer_head *bh,
                   root->logicalBlockNum, root->partitionReferenceNum);
 }
 
-static void udf_load_partdesc(struct super_block *sb, struct buffer_head *bh)
+static int udf_load_partdesc(struct super_block *sb, struct buffer_head *bh)
 {
         struct partitionDesc *p;
         int i;
@@ -912,6 +912,10 @@ static void udf_load_partdesc(struct super_block *sb, struct buffer_head *bh)
 
                                         UDF_SB_PARTMAPS(sb)[i].s_uspace.s_table =
                                                 udf_iget(sb, loc);
+                                        if (!UDF_SB_PARTMAPS(sb)[i].s_uspace.s_table) {
+                                                udf_debug("cannot load unallocSpaceTable (part %d)\n", i);
+                                                return 1;
+                                        }
                                         UDF_SB_PARTFLAGS(sb,i) |= UDF_PART_FLAG_UNALLOC_TABLE;
                                         udf_debug("unallocSpaceTable (part %d) @ %ld\n",
                                                   i, UDF_SB_PARTMAPS(sb)[i].s_uspace.s_table->i_ino);
@@ -938,6 +942,10 @@ static void udf_load_partdesc(struct super_block *sb, struct buffer_head *bh)
 
                                         UDF_SB_PARTMAPS(sb)[i].s_fspace.s_table =
                                                 udf_iget(sb, loc);
+                                        if (!UDF_SB_PARTMAPS(sb)[i].s_fspace.s_table) {
+                                                udf_debug("cannot load freedSpaceTable (part %d)\n", i);
+                                                return 1;
+                                        }
                                         UDF_SB_PARTFLAGS(sb,i) |= UDF_PART_FLAG_FREED_TABLE;
                                         udf_debug("freedSpaceTable (part %d) @ %ld\n",
                                                   i, UDF_SB_PARTMAPS(sb)[i].s_fspace.s_table->i_ino);
@@ -966,6 +974,7 @@ static void udf_load_partdesc(struct super_block *sb, struct buffer_head *bh)
                           le16_to_cpu(p->partitionNumber), i, UDF_SB_PARTTYPE(sb,i),
                           UDF_SB_PARTROOT(sb,i), UDF_SB_PARTLEN(sb,i));
         }
+        return 0;
 }
 
 static int udf_load_logicalvol(struct super_block *sb, struct buffer_head *bh,
@@ -1177,12 +1186,19 @@ static int udf_process_sequence(struct super_block *sb, long block, long lastblo
                                 udf_load_logicalvol(sb, bh, fileset);
                         } else if (i == VDS_POS_PARTITION_DESC) {
                                 struct buffer_head *bh2 = NULL;
-                                udf_load_partdesc(sb, bh);
+                                if (udf_load_partdesc(sb, bh)) {
+                                        brelse(bh);
+                                        return 1;
+                                }
                                 for (j = vds[i].block + 1; j <  vds[VDS_POS_TERMINATING_DESC].block; j++) {
                                         bh2 = udf_read_tagged(sb, j, j, &ident);
                                         gd = (struct generic_desc *)bh2->b_data;
                                         if (ident == TAG_IDENT_PD)
-                                                udf_load_partdesc(sb, bh2);
+                                                if (udf_load_partdesc(sb, bh2)) {
+                                                        brelse(bh);
+                                                        brelse(bh2);
+                                                        return 1;
+                                                }
                                         brelse(bh2);
                                 }
                         }
@@ -1275,19 +1291,16 @@ static int udf_load_partition(struct super_block *sb, kernel_lb_addr *fileset)
 
                         if (!UDF_SB_LASTBLOCK(sb)) {
                                 udf_debug("Unable to determine Lastblock (For "
-                                                "Virtual Partition)\n");
+                                          "Virtual Partition)\n");
                                 return 1;
                         }
 
                         for (j = 0; j < UDF_SB_NUMPARTS(sb); j++) {
-                                if (j != i && UDF_SB_PARTVSN(sb, i) ==
-                                        UDF_SB_PARTVSN(sb, j) &&
-                                        UDF_SB_PARTNUM(sb, i) ==
-                                                UDF_SB_PARTNUM(sb, j)) {
+                                if (j != i &&
+                                    UDF_SB_PARTVSN(sb, i) == UDF_SB_PARTVSN(sb, j) &&
+                                    UDF_SB_PARTNUM(sb, i) == UDF_SB_PARTNUM(sb, j)) {
                                         ino.partitionReferenceNum = j;
-                                        ino.logicalBlockNum =
-                                            UDF_SB_LASTBLOCK(sb) -
-                                            UDF_SB_PARTROOT(sb, j);
+                                        ino.logicalBlockNum = UDF_SB_LASTBLOCK(sb) - UDF_SB_PARTROOT(sb, j);
                                         break;
                                 }
                         }
@@ -1300,9 +1313,9 @@ static int udf_load_partition(struct super_block *sb, kernel_lb_addr *fileset)
 
                         if (UDF_SB_PARTTYPE(sb, i) == UDF_VIRTUAL_MAP15) {
                                 UDF_SB_TYPEVIRT(sb, i).s_start_offset =
-                                    udf_ext0_offset(UDF_SB_VAT(sb));
+                                        udf_ext0_offset(UDF_SB_VAT(sb));
                                 UDF_SB_TYPEVIRT(sb, i).s_num_entries =
-                                    (UDF_SB_VAT(sb)->i_size - 36) >> 2;
+                                        (UDF_SB_VAT(sb)->i_size - 36) >> 2;
                         } else if (UDF_SB_PARTTYPE(sb, i) == UDF_VIRTUAL_MAP20) {
                                 struct buffer_head *bh = NULL;
                                 uint32_t pos;
@@ -1312,19 +1325,15 @@ static int udf_load_partition(struct super_block *sb, kernel_lb_addr *fileset)
                                 if (!bh)
                                         return 1;
                                 UDF_SB_TYPEVIRT(sb, i).s_start_offset =
-                                    le16_to_cpu(((struct
-                                        virtualAllocationTable20 *)bh->b_data +
-                                          udf_ext0_offset(UDF_SB_VAT(sb)))->
-                                                lengthHeader) +
-                                          udf_ext0_offset(UDF_SB_VAT(sb));
-                                UDF_SB_TYPEVIRT(sb, i).s_num_entries =
-                                    (UDF_SB_VAT(sb)->i_size -
-                                     UDF_SB_TYPEVIRT(sb, i).s_start_offset) >> 2;
+                                        le16_to_cpu(((struct virtualAllocationTable20 *)bh->b_data +
+                                                     udf_ext0_offset(UDF_SB_VAT(sb)))->lengthHeader) +
+                                        udf_ext0_offset(UDF_SB_VAT(sb));
+                                UDF_SB_TYPEVIRT(sb, i).s_num_entries = (UDF_SB_VAT(sb)->i_size -
+                                                                        UDF_SB_TYPEVIRT(sb, i).s_start_offset) >> 2;
                                 brelse(bh);
                         }
                         UDF_SB_PARTROOT(sb, i) = udf_get_pblock(sb, 0, i, 0);
-                        UDF_SB_PARTLEN(sb, i) = UDF_SB_PARTLEN(sb,
-                                                ino.partitionReferenceNum);
+                        UDF_SB_PARTLEN(sb, i) = UDF_SB_PARTLEN(sb, ino.partitionReferenceNum);
                 }
         }
         return 0;
@@ -1339,21 +1348,17 @@ static void udf_open_lvid(struct super_block *sb)
                 UDF_SB_LVIDIU(sb)->impIdent.identSuffix[0] = UDF_OS_CLASS_UNIX;
                 UDF_SB_LVIDIU(sb)->impIdent.identSuffix[1] = UDF_OS_ID_LINUX;
                 if (udf_time_to_stamp(&cpu_time, CURRENT_TIME))
-                        UDF_SB_LVID(sb)->recordingDateAndTime =
-                            cpu_to_lets(cpu_time);
+                        UDF_SB_LVID(sb)->recordingDateAndTime = cpu_to_lets(cpu_time);
                 UDF_SB_LVID(sb)->integrityType = LVID_INTEGRITY_TYPE_OPEN;
 
-                UDF_SB_LVID(sb)->descTag.descCRC =
-                    cpu_to_le16(udf_crc((char *)UDF_SB_LVID(sb) + sizeof(tag),
-                                        le16_to_cpu(UDF_SB_LVID(sb)->descTag.
-                                                    descCRCLength), 0));
+                UDF_SB_LVID(sb)->descTag.descCRC = cpu_to_le16(udf_crc((char *)UDF_SB_LVID(sb) + sizeof(tag),
+                                                                       le16_to_cpu(UDF_SB_LVID(sb)->descTag.descCRCLength), 0));
 
                 UDF_SB_LVID(sb)->descTag.tagChecksum = 0;
                 for (i = 0; i < 16; i++)
                         if (i != 4)
                                 UDF_SB_LVID(sb)->descTag.tagChecksum +=
-                                    ((uint8_t *) &
-                                     (UDF_SB_LVID(sb)->descTag))[i];
+                                        ((uint8_t *) &(UDF_SB_LVID(sb)->descTag))[i];
 
                 mark_buffer_dirty(UDF_SB_LVIDBH(sb));
         }
diff --git a/fs/udf/udftime.c b/fs/udf/udftime.c
index 3fd80eb66a..adcb87c2da 100644
--- a/fs/udf/udftime.c
+++ b/fs/udf/udftime.c
@@ -108,10 +108,10 @@ time_t *udf_stamp_to_time(time_t *dest, long *dest_usec, kernel_timestamp src)
         *dest = year_seconds[src.year - EPOCH_YEAR];
         *dest -= offset * 60;
 
-        yday = ((__mon_yday[__isleap (src.year)]
-                 [src.month - 1]) + (src.day - 1));
-        *dest += ( ( (yday * 24) + src.hour ) * 60 + src.minute ) * 60 + src.second;
-        *dest_usec = src.centiseconds * 10000 + src.hundredsOfMicroseconds * 100 + src.microseconds;
+        yday = ((__mon_yday[__isleap(src.year)][src.month - 1]) + src.day - 1);
+        *dest += (((yday * 24) + src.hour) * 60 + src.minute) * 60 + src.second;
+        *dest_usec = src.centiseconds * 10000 +
+                        src.hundredsOfMicroseconds * 100 + src.microseconds;
         return dest;
 }