5 files changed, 43 insertions, 15 deletions

diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 734cbf8d9676..dd9f1bebb5a3 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -344,7 +344,7 @@ static int autofs_dev_ioctl_fail(struct file *fp,
         int status;
 
         token = (autofs_wqt_t) param->fail.token;
-        status = param->fail.status ? param->fail.status : -ENOENT;
+        status = param->fail.status < 0 ? param->fail.status : -ENOENT;
         return autofs4_wait_release(sbi, token, status);
 }
 
diff --git a/fs/dax.c b/fs/dax.c
index 2a6889b3585f..9187f3b07f3e 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -859,6 +859,7 @@ int dax_writeback_mapping_range(struct address_space *mapping,
                         if (ret < 0)
                                 goto out;
                 }
+                start_index = indices[pvec.nr - 1] + 1;
         }
 out:
         put_dax(dax_dev);
diff --git a/fs/exec.c b/fs/exec.c
index 72934df68471..904199086490 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -220,8 +220,26 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
 
         if (write) {
                 unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
+                unsigned long ptr_size;
                 struct rlimit *rlim;
 
+                /*
+                 * Since the stack will hold pointers to the strings, we
+                 * must account for them as well.
+                 *
+                 * The size calculation is the entire vma while each arg page is
+                 * built, so each time we get here it's calculating how far it
+                 * is currently (rather than each call being just the newly
+                 * added size from the arg page).  As a result, we need to
+                 * always add the entire size of the pointers, so that on the
+                 * last call to get_arg_page() we'll actually have the entire
+                 * correct size.
+                 */
+                ptr_size = (bprm->argc + bprm->envc) * sizeof(void *);
+                if (ptr_size > ULONG_MAX - size)
+                        goto fail;
+                size += ptr_size;
+
                 acct_arg_size(bprm, size / PAGE_SIZE);
 
                 /*
@@ -239,13 +257,15 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
                  *    to work from.
                  */
                 rlim = current->signal->rlim;
-                if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) {
-                        put_page(page);
-                        return NULL;
-                }
+                if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4)
+                        goto fail;
         }
 
         return page;
+
+fail:
+        put_page(page);
+        return NULL;
 }
 
 static void put_arg_page(struct page *page)
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 3b7c937a36b5..4689940a953c 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -2591,6 +2591,10 @@ void ocfs2_inode_unlock_tracker(struct inode *inode,
         struct ocfs2_lock_res *lockres;
 
         lockres = &OCFS2_I(inode)->ip_inode_lockres;
+        /* had_lock means that the currect process already takes the cluster
+         * lock previously. If had_lock is 1, we have nothing to do here, and
+         * it will get unlocked where we got the lock.
+         */
         if (!had_lock) {
                 ocfs2_remove_holder(lockres, oh);
                 ocfs2_inode_unlock(inode, ex);
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 3c5384d9b3a5..f70c3778d600 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -1328,20 +1328,21 @@ static int ocfs2_xattr_get(struct inode *inode,
                            void *buffer,
                            size_t buffer_size)
 {
-        int ret;
+        int ret, had_lock;
         struct buffer_head *di_bh = NULL;
+        struct ocfs2_lock_holder oh;
 
-        ret = ocfs2_inode_lock(inode, &di_bh, 0);
-        if (ret < 0) {
-                mlog_errno(ret);
-                return ret;
+        had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 0, &oh);
+        if (had_lock < 0) {
+                mlog_errno(had_lock);
+                return had_lock;
         }
         down_read(&OCFS2_I(inode)->ip_xattr_sem);
         ret = ocfs2_xattr_get_nolock(inode, di_bh, name_index,
                                      name, buffer, buffer_size);
         up_read(&OCFS2_I(inode)->ip_xattr_sem);
 
-        ocfs2_inode_unlock(inode, 0);
+        ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock);
 
         brelse(di_bh);
 
@@ -3537,11 +3538,12 @@ int ocfs2_xattr_set(struct inode *inode,
 {
         struct buffer_head *di_bh = NULL;
         struct ocfs2_dinode *di;
-        int ret, credits, ref_meta = 0, ref_credits = 0;
+        int ret, credits, had_lock, ref_meta = 0, ref_credits = 0;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         struct inode *tl_inode = osb->osb_tl_inode;
         struct ocfs2_xattr_set_ctxt ctxt = { NULL, NULL, NULL, };
         struct ocfs2_refcount_tree *ref_tree = NULL;
+        struct ocfs2_lock_holder oh;
 
         struct ocfs2_xattr_info xi = {
                 .xi_name_index = name_index,
@@ -3572,8 +3574,9 @@ int ocfs2_xattr_set(struct inode *inode,
                 return -ENOMEM;
         }
 
-        ret = ocfs2_inode_lock(inode, &di_bh, 1);
-        if (ret < 0) {
+        had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 1, &oh);
+        if (had_lock < 0) {
+                ret = had_lock;
                 mlog_errno(ret);
                 goto cleanup_nolock;
         }
@@ -3670,7 +3673,7 @@ cleanup:
                 if (ret)
                         mlog_errno(ret);
         }
-        ocfs2_inode_unlock(inode, 1);
+        ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock);
 cleanup_nolock:
         brelse(di_bh);
         brelse(xbs.xattr_bh);