Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Assorted fixes, sat in -next for a week or so...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  ocfs2: deal with wraparounds of i_nlink in ocfs2_rename()
  vfs: fix compat_sys_stat() handling of overflows in st_nlink
  quota: Fix deadlock with suspend and quotas
  vfs: Provide function to get superblock and wait for it to thaw
  vfs: fix panic in __d_lookup() with high dentry hashtable counts
  autofs4 - fix lockdep splat in autofs
  vfs: fix d_inode_lookup() dentry ref leak

12 files changed, 89 insertions, 48 deletions

diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 450f529a4eae..1feb68ecef95 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -124,6 +124,7 @@ start:
         /* Negative dentry - try next */
         if (!simple_positive(q)) {
                 spin_unlock(&p->d_lock);
+                lock_set_subclass(&q->d_lock.dep_map, 0, _RET_IP_);
                 p = q;
                 goto again;
         }
@@ -186,6 +187,7 @@ again:
         /* Negative dentry - try next */
         if (!simple_positive(ret)) {
                 spin_unlock(&p->d_lock);
+                lock_set_subclass(&ret->d_lock.dep_map, 0, _RET_IP_);
                 p = ret;
                 goto again;
         }
diff --git a/fs/compat.c b/fs/compat.c
index fa9d721ecfee..07880bae28a9 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -131,41 +131,35 @@ asmlinkage long compat_sys_utimes(const char __user *filename, struct compat_tim
 
 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
 {
-        compat_ino_t ino = stat->ino;
-        typeof(ubuf->st_uid) uid = 0;
-        typeof(ubuf->st_gid) gid = 0;
-        int err;
+        struct compat_stat tmp;
 
-        SET_UID(uid, stat->uid);
-        SET_GID(gid, stat->gid);
+        if (!old_valid_dev(stat->dev) || !old_valid_dev(stat->rdev))
+                return -EOVERFLOW;
 
-        if ((u64) stat->size > MAX_NON_LFS ||
-            !old_valid_dev(stat->dev) ||
-            !old_valid_dev(stat->rdev))
+        memset(&tmp, 0, sizeof(tmp));
+        tmp.st_dev = old_encode_dev(stat->dev);
+        tmp.st_ino = stat->ino;
+        if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
                 return -EOVERFLOW;
-        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+        tmp.st_mode = stat->mode;
+        tmp.st_nlink = stat->nlink;
+        if (tmp.st_nlink != stat->nlink)
                 return -EOVERFLOW;
-
-        if (clear_user(ubuf, sizeof(*ubuf)))
-                return -EFAULT;
-
-        err  = __put_user(old_encode_dev(stat->dev), &ubuf->st_dev);
-        err |= __put_user(ino, &ubuf->st_ino);
-        err |= __put_user(stat->mode, &ubuf->st_mode);
-        err |= __put_user(stat->nlink, &ubuf->st_nlink);
-        err |= __put_user(uid, &ubuf->st_uid);
-        err |= __put_user(gid, &ubuf->st_gid);
-        err |= __put_user(old_encode_dev(stat->rdev), &ubuf->st_rdev);
-        err |= __put_user(stat->size, &ubuf->st_size);
-        err |= __put_user(stat->atime.tv_sec, &ubuf->st_atime);
-        err |= __put_user(stat->atime.tv_nsec, &ubuf->st_atime_nsec);
-        err |= __put_user(stat->mtime.tv_sec, &ubuf->st_mtime);
-        err |= __put_user(stat->mtime.tv_nsec, &ubuf->st_mtime_nsec);
-        err |= __put_user(stat->ctime.tv_sec, &ubuf->st_ctime);
-        err |= __put_user(stat->ctime.tv_nsec, &ubuf->st_ctime_nsec);
-        err |= __put_user(stat->blksize, &ubuf->st_blksize);
-        err |= __put_user(stat->blocks, &ubuf->st_blocks);
-        return err;
+        SET_UID(tmp.st_uid, stat->uid);
+        SET_GID(tmp.st_gid, stat->gid);
+        tmp.st_rdev = old_encode_dev(stat->rdev);
+        if ((u64) stat->size > MAX_NON_LFS)
+                return -EOVERFLOW;
+        tmp.st_size = stat->size;
+        tmp.st_atime = stat->atime.tv_sec;
+        tmp.st_atime_nsec = stat->atime.tv_nsec;
+        tmp.st_mtime = stat->mtime.tv_sec;
+        tmp.st_mtime_nsec = stat->mtime.tv_nsec;
+        tmp.st_ctime = stat->ctime.tv_sec;
+        tmp.st_ctime_nsec = stat->ctime.tv_nsec;
+        tmp.st_blocks = stat->blocks;
+        tmp.st_blksize = stat->blksize;
+        return copy_to_user(ubuf, &tmp, sizeof(tmp)) ? -EFAULT : 0;
 }
 
 asmlinkage long compat_sys_newstat(const char __user * filename,
diff --git a/fs/dcache.c b/fs/dcache.c
index 16a53cc2cc02..fe19ac13f75f 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2968,7 +2968,7 @@ __setup("dhash_entries=", set_dhash_entries);
 
 static void __init dcache_init_early(void)
 {
-        int loop;
+        unsigned int loop;
 
         /* If hashes are distributed across NUMA nodes, defer
          * hash allocation until vmalloc space is available.
@@ -2986,13 +2986,13 @@ static void __init dcache_init_early(void)
                                         &d_hash_mask,
                                         0);
 
-        for (loop = 0; loop < (1 << d_hash_shift); loop++)
+        for (loop = 0; loop < (1U << d_hash_shift); loop++)
                 INIT_HLIST_BL_HEAD(dentry_hashtable + loop);
 }
 
 static void __init dcache_init(void)
 {
-        int loop;
+        unsigned int loop;
 
         /* 
          * A constructor could be added for stable state like the lists,
@@ -3016,7 +3016,7 @@ static void __init dcache_init(void)
                                         &d_hash_mask,
                                         0);
 
-        for (loop = 0; loop < (1 << d_hash_shift); loop++)
+        for (loop = 0; loop < (1U << d_hash_shift); loop++)
                 INIT_HLIST_BL_HEAD(dentry_hashtable + loop);
 }
 
diff --git a/fs/inode.c b/fs/inode.c
index fb10d86ffad7..d3ebdbe723d0 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1651,7 +1651,7 @@ __setup("ihash_entries=", set_ihash_entries);
  */
 void __init inode_init_early(void)
 {
-        int loop;
+        unsigned int loop;
 
         /* If hashes are distributed across NUMA nodes, defer
          * hash allocation until vmalloc space is available.
@@ -1669,13 +1669,13 @@ void __init inode_init_early(void)
                                         &i_hash_mask,
                                         0);
 
-        for (loop = 0; loop < (1 << i_hash_shift); loop++)
+        for (loop = 0; loop < (1U << i_hash_shift); loop++)
                 INIT_HLIST_HEAD(&inode_hashtable[loop]);
 }
 
 void __init inode_init(void)
 {
-        int loop;
+        unsigned int loop;
 
         /* inode slab cache */
         inode_cachep = kmem_cache_create("inode_cache",
@@ -1699,7 +1699,7 @@ void __init inode_init(void)
                                         &i_hash_mask,
                                         0);
 
-        for (loop = 0; loop < (1 << i_hash_shift); loop++)
+        for (loop = 0; loop < (1U << i_hash_shift); loop++)
                 INIT_HLIST_HEAD(&inode_hashtable[loop]);
 }
 
diff --git a/fs/namei.c b/fs/namei.c
index 208c6aa4a989..a780ea515c47 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1095,8 +1095,10 @@ static struct dentry *d_inode_lookup(struct dentry *parent, struct dentry *dentr
         struct dentry *old;
 
         /* Don't create child dentry for a dead directory. */
-        if (unlikely(IS_DEADDIR(inode)))
+        if (unlikely(IS_DEADDIR(inode))) {
+                dput(dentry);
                 return ERR_PTR(-ENOENT);
+        }
 
         old = inode->i_op->lookup(inode, dentry, nd);
         if (unlikely(old)) {
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index be244692550d..a9856e3eaaf0 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -1053,7 +1053,7 @@ static int ocfs2_rename(struct inode *old_dir,
         handle_t *handle = NULL;
         struct buffer_head *old_dir_bh = NULL;
         struct buffer_head *new_dir_bh = NULL;
-        nlink_t old_dir_nlink = old_dir->i_nlink;
+        u32 old_dir_nlink = old_dir->i_nlink;
         struct ocfs2_dinode *old_di;
         struct ocfs2_dir_lookup_result old_inode_dot_dot_res = { NULL, };
         struct ocfs2_dir_lookup_result target_lookup_res = { NULL, };
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index 7898cd688a00..fc2c4388d126 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -292,11 +292,26 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
         }
 }
 
+/* Return 1 if 'cmd' will block on frozen filesystem */
+static int quotactl_cmd_write(int cmd)
+{
+        switch (cmd) {
+        case Q_GETFMT:
+        case Q_GETINFO:
+        case Q_SYNC:
+        case Q_XGETQSTAT:
+        case Q_XGETQUOTA:
+        case Q_XQUOTASYNC:
+                return 0;
+        }
+        return 1;
+}
+
 /*
  * look up a superblock on which quota ops will be performed
  * - use the name of a block device to find the superblock thereon
  */
-static struct super_block *quotactl_block(const char __user *special)
+static struct super_block *quotactl_block(const char __user *special, int cmd)
 {
 #ifdef CONFIG_BLOCK
         struct block_device *bdev;
@@ -309,7 +324,10 @@ static struct super_block *quotactl_block(const char __user *special)
         putname(tmp);
         if (IS_ERR(bdev))
                 return ERR_CAST(bdev);
-        sb = get_super(bdev);
+        if (quotactl_cmd_write(cmd))
+                sb = get_super_thawed(bdev);
+        else
+                sb = get_super(bdev);
         bdput(bdev);
         if (!sb)
                 return ERR_PTR(-ENODEV);
@@ -361,7 +379,7 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
                         pathp = &path;
         }
 
-        sb = quotactl_block(special);
+        sb = quotactl_block(special, cmds);
         if (IS_ERR(sb)) {
                 ret = PTR_ERR(sb);
                 goto out;
diff --git a/fs/super.c b/fs/super.c
index 6015c02296b7..6277ec6cb60a 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -634,6 +634,28 @@ rescan:
 EXPORT_SYMBOL(get_super);
 
 /**
+ *      get_super_thawed - get thawed superblock of a device
+ *      @bdev: device to get the superblock for
+ *
+ *      Scans the superblock list and finds the superblock of the file system
+ *      mounted on the device. The superblock is returned once it is thawed
+ *      (or immediately if it was not frozen). %NULL is returned if no match
+ *      is found.
+ */
+struct super_block *get_super_thawed(struct block_device *bdev)
+{
+        while (1) {
+                struct super_block *s = get_super(bdev);
+                if (!s || s->s_frozen == SB_UNFROZEN)
+                        return s;
+                up_read(&s->s_umount);
+                vfs_check_frozen(s, SB_FREEZE_WRITE);
+                put_super(s);
+        }
+}
+EXPORT_SYMBOL(get_super_thawed);
+
+/**
  * get_active_super - get an active reference to the superblock of a device
  * @bdev: device to get the superblock for
  *
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 386da09f229d..69cd5bb640f5 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2496,6 +2496,7 @@ extern void get_filesystem(struct file_system_type *fs);
 extern void put_filesystem(struct file_system_type *fs);
 extern struct file_system_type *get_fs_type(const char *name);
 extern struct super_block *get_super(struct block_device *);
+extern struct super_block *get_super_thawed(struct block_device *);
 extern struct super_block *get_active_super(struct block_device *bdev);
 extern void drop_super(struct super_block *sb);
 extern void iterate_supers(void (*)(struct super_block *, void *), void *);
diff --git a/kernel/pid.c b/kernel/pid.c
index ce8e00deaccb..9f08dfabaf13 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -543,12 +543,12 @@ struct pid *find_ge_pid(int nr, struct pid_namespace *ns)
  */
 void __init pidhash_init(void)
 {
-        int i, pidhash_size;
+        unsigned int i, pidhash_size;
 
         pid_hash = alloc_large_system_hash("PID", sizeof(*pid_hash), 0, 18,
                                            HASH_EARLY | HASH_SMALL,
                                            &pidhash_shift, NULL, 4096);
-        pidhash_size = 1 << pidhash_shift;
+        pidhash_size = 1U << pidhash_shift;
 
         for (i = 0; i < pidhash_size; i++)
                 INIT_HLIST_HEAD(&pid_hash[i]);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d2186ecb36f7..a13ded1938f0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5236,6 +5236,7 @@ void *__init alloc_large_system_hash(const char *tablename,
                 max = ((unsigned long long)nr_all_pages << PAGE_SHIFT) >> 4;
                 do_div(max, bucketsize);
         }
+        max = min(max, 0x80000000ULL);
 
         if (numentries > max)
                 numentries = max;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 37755ccc0e96..22ef5f9fd2ff 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3240,7 +3240,8 @@ void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
         unsigned long limit;
-        int i, max_share, cnt;
+        int max_share, cnt;
+        unsigned int i;
         unsigned long jiffy = jiffies;
 
         BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
@@ -3283,7 +3284,7 @@ void __init tcp_init(void)
                                         &tcp_hashinfo.bhash_size,
                                         NULL,
                                         64 * 1024);
-        tcp_hashinfo.bhash_size = 1 << tcp_hashinfo.bhash_size;
+        tcp_hashinfo.bhash_size = 1U << tcp_hashinfo.bhash_size;
         for (i = 0; i < tcp_hashinfo.bhash_size; i++) {
                 spin_lock_init(&tcp_hashinfo.bhash[i].lock);
                 INIT_HLIST_HEAD(&tcp_hashinfo.bhash[i].chain);