9 files changed, 32 insertions, 14 deletions

diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 1e25efcb55c8..d27d4ec6579b 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -720,7 +720,7 @@ void
 cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb)
 {
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
-                cifs_sb->mnt_cifs_flags &= CIFS_MOUNT_SERVER_INUM;
+                cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM;
                 cERROR(1, ("Autodisabling the use of server inode numbers on "
                            "%s. This server doesn't seem to support them "
                            "properly. Hardlinks will not be recognized on this "
diff --git a/fs/fcntl.c b/fs/fcntl.c
index fc089f2f7f56..2cf93ec40a67 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -284,7 +284,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
                 type = PIDTYPE_PID;
                 break;
 
-        case F_OWNER_GID:
+        case F_OWNER_PGRP:
                 type = PIDTYPE_PGID;
                 break;
 
@@ -321,7 +321,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg)
                 break;
 
         case PIDTYPE_PGID:
-                owner.type = F_OWNER_GID;
+                owner.type = F_OWNER_PGRP;
                 break;
 
         default:
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index edf926e1062f..d0a2ce1b4324 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -958,7 +958,7 @@ encode_entry(struct readdir_cd *ccd, const char *name, int namlen,
                 p1 = encode_entry_baggage(cd, p1, name, namlen, ino);
 
                 if (plus)
-                        p = encode_entryplus_baggage(cd, p1, name, namlen);
+                        p1 = encode_entryplus_baggage(cd, p1, name, namlen);
 
                 /* determine entry word length and lengths to go in pages */
                 num_entry_words = p1 - tmp;
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index 1c6cfb59128d..3f5d5d06f53c 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -871,7 +871,6 @@ int nilfs_cpfile_change_cpmode(struct inode *cpfile, __u64 cno, int mode)
                  * exclusive with a new mount job.  Though it doesn't cover
                  * umount, it's enough for the purpose.
                  */
-                mutex_lock(&nilfs->ns_mount_mutex);
                 if (nilfs_checkpoint_is_mounted(nilfs, cno, 1)) {
                         /* Current implementation does not have to protect
                            plain read-only mounts since they are exclusive
@@ -880,7 +879,6 @@ int nilfs_cpfile_change_cpmode(struct inode *cpfile, __u64 cno, int mode)
                         ret = -EBUSY;
                 } else
                         ret = nilfs_cpfile_clear_snapshot(cpfile, cno);
-                mutex_unlock(&nilfs->ns_mount_mutex);
                 return ret;
         case NILFS_SNAPSHOT:
                 return nilfs_cpfile_set_snapshot(cpfile, cno);
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 5040220c3732..2a0a5a3ac134 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -664,7 +664,6 @@ int nilfs_load_inode_block(struct nilfs_sb_info *sbi, struct inode *inode,
         int err;
 
         spin_lock(&sbi->s_inode_lock);
-        /* Caller of this function MUST lock s_inode_lock */
         if (ii->i_bh == NULL) {
                 spin_unlock(&sbi->s_inode_lock);
                 err = nilfs_ifile_get_inode_block(sbi->s_ifile, inode->i_ino,
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index d24057d58f17..f6af76042d80 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -99,7 +99,8 @@ static int nilfs_ioctl_wrap_copy(struct the_nilfs *nilfs,
 static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
                                      unsigned int cmd, void __user *argp)
 {
-        struct inode *cpfile = NILFS_SB(inode->i_sb)->s_nilfs->ns_cpfile;
+        struct the_nilfs *nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+        struct inode *cpfile = nilfs->ns_cpfile;
         struct nilfs_transaction_info ti;
         struct nilfs_cpmode cpmode;
         int ret;
@@ -109,14 +110,17 @@ static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
         if (copy_from_user(&cpmode, argp, sizeof(cpmode)))
                 return -EFAULT;
 
+        mutex_lock(&nilfs->ns_mount_mutex);
         nilfs_transaction_begin(inode->i_sb, &ti, 0);
         ret = nilfs_cpfile_change_cpmode(
                 cpfile, cpmode.cm_cno, cpmode.cm_mode);
         if (unlikely(ret < 0)) {
                 nilfs_transaction_abort(inode->i_sb);
+                mutex_unlock(&nilfs->ns_mount_mutex);
                 return ret;
         }
         nilfs_transaction_commit(inode->i_sb); /* never fails */
+        mutex_unlock(&nilfs->ns_mount_mutex);
         return ret;
 }
 
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 07f77a7945c3..822c2d506518 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -571,7 +571,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                 rsslim,
                 mm ? mm->start_code : 0,
                 mm ? mm->end_code : 0,
-                (permitted) ? task->stack_start : 0,
+                (permitted && mm) ? task->stack_start : 0,
                 esp,
                 eip,
                 /* The signal information here is obsolete.
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 1099395d7d6c..fb17f8226b09 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1980,7 +1980,7 @@ xlog_recover_do_reg_buffer(
                                         "XFS: NULL dquot in %s.", __func__);
                                 goto next;
                         }
-                        if (item->ri_buf[i].i_len < sizeof(xfs_dqblk_t)) {
+                        if (item->ri_buf[i].i_len < sizeof(xfs_disk_dquot_t)) {
                                 cmn_err(CE_ALERT,
                                         "XFS: dquot too small (%d) in %s.",
                                         item->ri_buf[i].i_len, __func__);
@@ -2635,7 +2635,7 @@ xlog_recover_do_dquot_trans(
                         "XFS: NULL dquot in %s.", __func__);
                 return XFS_ERROR(EIO);
         }
-        if (item->ri_buf[1].i_len < sizeof(xfs_dqblk_t)) {
+        if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) {
                 cmn_err(CE_ALERT,
                         "XFS: dquot too small (%d) in %s.",
                         item->ri_buf[1].i_len, __func__);
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index f31271c30de9..2ffc570679be 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -467,6 +467,7 @@ xfs_trans_ail_update(
 {
         xfs_log_item_t          *dlip = NULL;
         xfs_log_item_t          *mlip;  /* ptr to minimum lip */
+        xfs_lsn_t               tail_lsn;
 
         mlip = xfs_ail_min(ailp);
 
@@ -483,8 +484,16 @@ xfs_trans_ail_update(
 
         if (mlip == dlip) {
                 mlip = xfs_ail_min(ailp);
+                /*
+                 * It is not safe to access mlip after the AIL lock is
+                 * dropped, so we must get a copy of li_lsn before we do
+                 * so.  This is especially important on 32-bit platforms
+                 * where accessing and updating 64-bit values like li_lsn
+                 * is not atomic.
+                 */
+                tail_lsn = mlip->li_lsn;
                 spin_unlock(&ailp->xa_lock);
-                xfs_log_move_tail(ailp->xa_mount, mlip->li_lsn);
+                xfs_log_move_tail(ailp->xa_mount, tail_lsn);
         } else {
                 spin_unlock(&ailp->xa_lock);
         }
@@ -514,6 +523,7 @@ xfs_trans_ail_delete(
 {
         xfs_log_item_t          *dlip;
         xfs_log_item_t          *mlip;
+        xfs_lsn_t               tail_lsn;
 
         if (lip->li_flags & XFS_LI_IN_AIL) {
                 mlip = xfs_ail_min(ailp);
@@ -527,9 +537,16 @@ xfs_trans_ail_delete(
 
                 if (mlip == dlip) {
                         mlip = xfs_ail_min(ailp);
+                        /*
+                         * It is not safe to access mlip after the AIL lock
+                         * is dropped, so we must get a copy of li_lsn
+                         * before we do so.  This is especially important
+                         * on 32-bit platforms where accessing and updating
+                         * 64-bit values like li_lsn is not atomic.
+                         */
+                        tail_lsn = mlip ? mlip->li_lsn : 0;
                         spin_unlock(&ailp->xa_lock);
-                        xfs_log_move_tail(ailp->xa_mount,
-                                                (mlip ? mlip->li_lsn : 0));
+                        xfs_log_move_tail(ailp->xa_mount, tail_lsn);
                 } else {
                         spin_unlock(&ailp->xa_lock);
                 }