3 files changed, 23 insertions, 11 deletions

diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 48ae0339af17..2edd7eec88fd 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -711,7 +711,7 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode,
          * direct blocks blocks
          */
         if (num == 0 && blks > 1) {
-                current_block = le32_to_cpu(where->key + 1);
+                current_block = le32_to_cpu(where->key) + 1;
                 for (i = 1; i < blks; i++)
                         *(where->p + i ) = cpu_to_le32(current_block++);
         }
@@ -724,7 +724,7 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode,
         if (block_i) {
                 block_i->last_alloc_logical_block = block + blks - 1;
                 block_i->last_alloc_physical_block =
-                                le32_to_cpu(where[num].key + blks - 1);
+                                le32_to_cpu(where[num].key) + blks - 1;
         }
 
         /* We are done with atomic stuff, now do the rest of housekeeping */
@@ -814,11 +814,13 @@ int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
 
         /* Simplest case - block found, no allocation needed */
         if (!partial) {
-                first_block = chain[depth - 1].key;
+                first_block = le32_to_cpu(chain[depth - 1].key);
                 clear_buffer_new(bh_result);
                 count++;
                 /*map more blocks*/
                 while (count < maxblocks && count <= blocks_to_boundary) {
+                        unsigned long blk;
+
                         if (!verify_chain(chain, partial)) {
                                 /*
                                  * Indirect block might be removed by
@@ -831,8 +833,9 @@ int ext3_get_blocks_handle(handle_t *handle, struct inode *inode,
                                 count = 0;
                                 break;
                         }
-                        if (le32_to_cpu(*(chain[depth-1].p+count) ==
-                                        (first_block + count)))
+                        blk = le32_to_cpu(*(chain[depth-1].p + count));
+
+                        if (blk == first_block + count)
                                 count++;
                         else
                                 break;
diff --git a/fs/ext3/ioctl.c b/fs/ext3/ioctl.c
index aaf1da17b6d4..8c22aa9a7fbb 100644
--- a/fs/ext3/ioctl.c
+++ b/fs/ext3/ioctl.c
@@ -48,6 +48,7 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                 if (!S_ISDIR(inode->i_mode))
                         flags &= ~EXT3_DIRSYNC_FL;
 
+                mutex_lock(&inode->i_mutex);
                 oldflags = ei->i_flags;
 
                 /* The JOURNAL_DATA flag is modifiable only by root */
@@ -60,8 +61,10 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                  * This test looks nicer. Thanks to Pauline Middelink
                  */
                 if ((flags ^ oldflags) & (EXT3_APPEND_FL | EXT3_IMMUTABLE_FL)) {
-                        if (!capable(CAP_LINUX_IMMUTABLE))
+                        if (!capable(CAP_LINUX_IMMUTABLE)) {
+                                mutex_unlock(&inode->i_mutex);
                                 return -EPERM;
+                        }
                 }
 
                 /*
@@ -69,14 +72,18 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                  * the relevant capability.
                  */
                 if ((jflag ^ oldflags) & (EXT3_JOURNAL_DATA_FL)) {
-                        if (!capable(CAP_SYS_RESOURCE))
+                        if (!capable(CAP_SYS_RESOURCE)) {
+                                mutex_unlock(&inode->i_mutex);
                                 return -EPERM;
+                        }
                 }
 
 
                 handle = ext3_journal_start(inode, 1);
-                if (IS_ERR(handle))
+                if (IS_ERR(handle)) {
+                        mutex_unlock(&inode->i_mutex);
                         return PTR_ERR(handle);
+                }
                 if (IS_SYNC(inode))
                         handle->h_sync = 1;
                 err = ext3_reserve_inode_write(handle, inode, &iloc);
@@ -93,11 +100,14 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                 err = ext3_mark_iloc_dirty(handle, inode, &iloc);
 flags_err:
                 ext3_journal_stop(handle);
-                if (err)
+                if (err) {
+                        mutex_unlock(&inode->i_mutex);
                         return err;
+                }
 
                 if ((jflag ^ oldflags) & (EXT3_JOURNAL_DATA_FL))
                         err = ext3_change_inode_journal_flag(inode, jflag);
+                mutex_unlock(&inode->i_mutex);
                 return err;
         }
         case EXT3_IOC_GETVERSION:
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index c5ffa8523968..34b39e9a1e5a 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -213,7 +213,7 @@ static int setup_new_group_blocks(struct super_block *sb,
                         goto exit_bh;
                 }
                 lock_buffer(bh);
-                memcpy(gdb->b_data, sbi->s_group_desc[i], bh->b_size);
+                memcpy(gdb->b_data, sbi->s_group_desc[i]->b_data, bh->b_size);
                 set_buffer_uptodate(gdb);
                 unlock_buffer(bh);
                 ext3_journal_dirty_metadata(handle, gdb);
@@ -767,7 +767,6 @@ int ext3_group_add(struct super_block *sb, struct ext3_new_group_data *input)
         if (input->group != sbi->s_groups_count) {
                 ext3_warning(sb, __FUNCTION__,
                              "multiple resizers run on filesystem!");
-                unlock_super(sb);
                 err = -EBUSY;
                 goto exit_journal;
         }