Merge git://oss.sgi.com:8090/xfs-2.6

* git://oss.sgi.com:8090/xfs-2.6:
  [XFS] Fix a possible metadata buffer (AGFL) refcount leak when fixing an
  [XFS] Fix a project quota space accounting leak on rename.
  [XFS] Fix a possible forced shutdown due to mishandling write barriers

4 files changed, 26 insertions, 20 deletions

diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 64ee07db0d5..8558226281c 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -1942,8 +1942,10 @@ xfs_alloc_fix_freelist(
                 /*
                  * Allocate as many blocks as possible at once.
                  */
-                if ((error = xfs_alloc_ag_vextent(&targs)))
+                if ((error = xfs_alloc_ag_vextent(&targs))) {
+                        xfs_trans_brelse(tp, agflbp);
                         return error;
+                }
                 /*
                  * Stop if we run out.  Won't happen if callers are obeying
                  * the restrictions correctly.  Can happen for free calls
@@ -1960,6 +1962,7 @@ xfs_alloc_fix_freelist(
                                 return error;
                 }
         }
+        xfs_trans_brelse(tp, agflbp);
         args->agbp = agbp;
         return 0;
 }
diff --git a/fs/xfs/xfs_rename.c b/fs/xfs/xfs_rename.c
index 81a05cfd77d..1f148762eb2 100644
--- a/fs/xfs/xfs_rename.c
+++ b/fs/xfs/xfs_rename.c
@@ -316,6 +316,18 @@ xfs_rename(
                 }
         }
 
+        /*
+         * If we are using project inheritance, we only allow renames
+         * into our tree when the project IDs are the same; else the
+         * tree quota mechanism would be circumvented.
+         */
+        if (unlikely((target_dp->i_d.di_flags & XFS_DIFLAG_PROJINHERIT) &&
+                     (target_dp->i_d.di_projid != src_ip->i_d.di_projid))) {
+                error = XFS_ERROR(EXDEV);
+                xfs_rename_unlock4(inodes, XFS_ILOCK_SHARED);
+                goto rele_return;
+        }
+
         new_parent = (src_dp != target_dp);
         src_is_directory = ((src_ip->i_d.di_mode & S_IFMT) == S_IFDIR);
 
diff --git a/fs/xfs/xfs_vfsops.c b/fs/xfs/xfs_vfsops.c
index f0e09ca1413..36ea1b2094f 100644
--- a/fs/xfs/xfs_vfsops.c
+++ b/fs/xfs/xfs_vfsops.c
@@ -669,31 +669,22 @@ xfs_mntupdate(
         xfs_mount_t     *mp = XFS_BHVTOM(bdp);
         int             error;
 
-        if (args->flags & XFSMNT_BARRIER)
-                mp->m_flags |= XFS_MOUNT_BARRIER;
-        else
-                mp->m_flags &= ~XFS_MOUNT_BARRIER;
-
-        if ((vfsp->vfs_flag & VFS_RDONLY) &&
-            !(*flags & MS_RDONLY)) {
-                vfsp->vfs_flag &= ~VFS_RDONLY;
-
-                if (args->flags & XFSMNT_BARRIER)
+        if (!(*flags & MS_RDONLY)) {                    /* rw/ro -> rw */
+                if (vfsp->vfs_flag & VFS_RDONLY)
+                        vfsp->vfs_flag &= ~VFS_RDONLY;
+                if (args->flags & XFSMNT_BARRIER) {
+                        mp->m_flags |= XFS_MOUNT_BARRIER;
                         xfs_mountfs_check_barriers(mp);
-        }
-
-        if (!(vfsp->vfs_flag & VFS_RDONLY) &&
-            (*flags & MS_RDONLY)) {
+                } else {
+                        mp->m_flags &= ~XFS_MOUNT_BARRIER;
+                }
+        } else if (!(vfsp->vfs_flag & VFS_RDONLY)) {    /* rw -> ro */
                 VFS_SYNC(vfsp, SYNC_FSDATA|SYNC_BDFLUSH|SYNC_ATTR, NULL, error);
-
                 xfs_quiesce_fs(mp);
-
-                /* Ok now write out an unmount record */
                 xfs_log_unmount_write(mp);
                 xfs_unmountfs_writesb(mp);
                 vfsp->vfs_flag |= VFS_RDONLY;
         }
-
         return 0;
 }
 
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index fa71b305ba5..7027ae68ee3 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -2663,7 +2663,7 @@ xfs_link(
          */
         if (unlikely((tdp->i_d.di_flags & XFS_DIFLAG_PROJINHERIT) &&
                      (tdp->i_d.di_projid != sip->i_d.di_projid))) {
-                error = XFS_ERROR(EPERM);
+                error = XFS_ERROR(EXDEV);
                 goto error_return;
         }