Merge remote-tracking branch 'common/android-4.4-p' into lineage-18.1-caf-msm8998

* common/android-4.4-p:
  Linux 4.4.293
  usb: max-3421: Use driver data instead of maintaining a list of bound devices
  ASoC: DAPM: Cover regression by kctl change notification fix
  batman-adv: Avoid WARN_ON timing related checks
  batman-adv: Don't always reallocate the fragmentation skb head
  batman-adv: Reserve needed_*room for fragments
  batman-adv: Consider fragmentation for needed_headroom
  batman-adv: set .owner to THIS_MODULE
  batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
  batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh
  batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN
  batman-adv: Prevent duplicated softif_vlan entry
  batman-adv: Fix multicast TT issues with bogus ROAM flags
  batman-adv: Keep fragments equally sized
  drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors
  drm/udl: fix control-message timeout
  cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
  parisc/sticon: fix reverse colors
  btrfs: fix memory ordering between normal and ordered work functions
  mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
  hexagon: export raw I/O routines for modules
  tun: fix bonding active backup with arp monitoring
  NFC: reorder the logic in nfc_{un,}register_device
  NFC: reorganize the functions in nci_request
  platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
  mips: bcm63xx: add support for clk_get_parent()
  net: bnx2x: fix variable dereferenced before check
  sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
  mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
  sh: define __BIG_ENDIAN for math-emu
  sh: fix kconfig unmet dependency warning for FRAME_POINTER
  maple: fix wrong return value of maple_bus_init().
  sh: check return code of request_irq
  powerpc/dcr: Use cmplwi instead of 3-argument cmpli
  ALSA: gus: fix null pointer dereference on pointer block
  powerpc/5200: dts: fix memory node unit name
  scsi: target: Fix alua_tg_pt_gps_count tracking
  scsi: target: Fix ordered tag handling
  MIPS: sni: Fix the build
  tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
  usb: host: ohci-tmio: check return value after calling platform_get_resource()
  ARM: dts: omap: fix gpmc,mux-add-data type
  scsi: advansys: Fix kernel pointer leak
  usb: musb: tusb6010: check return value after calling platform_get_resource()
  scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
  net: batman-adv: fix error handling
  PCI/MSI: Destroy sysfs before freeing entries
  parisc/entry: fix trace test in syscall exit path
  PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
  mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
  ARM: 9156/1: drop cc-option fallbacks for architecture selection
  USB: chipidea: fix interrupt deadlock
  vsock: prevent unnecessary refcnt inc for nonblocking connect
  nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
  llc: fix out-of-bound array index in llc_sk_dev_hash()
  bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
  net: davinci_emac: Fix interrupt pacing disable
  xen-pciback: Fix return in pm_ctrl_init()
  scsi: qla2xxx: Turn off target reset during issue_lip
  watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
  m68k: set a default value for MEMORY_RESERVE
  netfilter: nfnetlink_queue: fix OOB when mac header was cleared
  dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
  RDMA/mlx4: Return missed an error if device doesn't support steering
  scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
  power: supply: rt5033_battery: Change voltage values to µV
  usb: gadget: hid: fix error code in do_config()
  serial: 8250_dw: Drop wrong use of ACPI_PTR()
  video: fbdev: chipsfb: use memset_io() instead of memset()
  memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
  JFS: fix memleak in jfs_mount
  scsi: dc395: Fix error case unwinding
  ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
  crypto: pcrypt - Delay write to padata->info
  libertas: Fix possible memory leak in probe and disconnect
  libertas_tf: Fix possible memory leak in probe and disconnect
  smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
  mwifiex: Send DELBA requests according to spec
  platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
  net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
  drm/msm: uninitialized variable in msm_gem_import()
  memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
  memstick: avoid out-of-range warning
  b43: fix a lower bounds test
  b43legacy: fix a lower bounds test
  crypto: qat - detect PFVF collision after ACK
  ath9k: Fix potential interrupt storm on queue reset
  cpuidle: Fix kobject memory leaks in error paths
  media: si470x: Avoid card name truncation
  media: dvb-usb: fix ununit-value in az6027_rc_query
  parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
  parisc: fix warning in flush_tlb_all
  ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
  ARM: clang: Do not rely on lr register for stacktrace
  smackfs: use __GFP_NOFAIL for smk_cipso_doi()
  iwlwifi: mvm: disable RX-diversity in powersave
  PM: hibernate: Get block device exclusively in swsusp_check()
  mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
  lib/xz: Validate the value before assigning it to an enum variable
  lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
  memstick: r592: Fix a UAF bug when removing the driver
  ACPI: battery: Accept charges over the design capacity as full
  ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
  tracefs: Have tracefs directories not set OTH permission bits by default
  media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
  ACPICA: Avoid evaluating methods too early during system resume
  ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
  media: mceusb: return without resubmitting URB in case of -EPROTO error.
  media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
  media: uvcvideo: Set capability in s_param
  media: netup_unidvb: handle interrupt properly according to the firmware
  media: mt9p031: Fix corrupted frame after restarting stream
  x86: Increase exception stack sizes
  smackfs: Fix use-after-free in netlbl_catmap_walk()
  MIPS: lantiq: dma: reset correct number of channel
  MIPS: lantiq: dma: add small delay after reset
  platform/x86: wmi: do not fail if disabling fails
  Bluetooth: fix use-after-free error in lock_sock_nested()
  Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
  USB: iowarrior: fix control-message timeouts
  USB: serial: keyspan: fix memleak on probe errors
  iio: dac: ad5446: Fix ad5622_write() return value
  quota: correct error number in free_dqentry()
  quota: check block number when reading the block in quota file
  ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
  ALSA: mixer: oss: Fix racy access to slots
  power: supply: max17042_battery: use VFSOC for capacity when no rsns
  power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
  signal: Remove the bogus sigkill_pending in ptrace_stop
  mwifiex: Read a PCI register after writing the TX ring write pointer
  wcn36xx: Fix HT40 capability for 2Ghz band
  PCI: Mark Atheros QCA6174 to avoid bus reset
  ath6kl: fix control-message timeout
  ath6kl: fix division by zero in send path
  mwifiex: fix division by zero in fw download path
  EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
  hwmon: (pmbus/lm25066) Add offset coefficients
  btrfs: fix lost error handling when replaying directory deletes
  vmxnet3: do not stop tx queues after netif_device_detach()
  spi: spl022: fix Microwire full duplex mode
  xen/netfront: stop tx queues during live migration
  mmc: winbond: don't build on M68K
  hyperv/vmbus: include linux/bitops.h
  x86/irq: Ensure PI wakeup handler is unregistered before module unload
  ALSA: timer: Unconditionally unlink slave instances, too
  ALSA: timer: Fix use-after-free problem
  ALSA: synth: missing check for possible NULL after the call to kstrdup
  ALSA: line6: fix control and interrupt message timeouts
  ALSA: 6fire: fix control and bulk message timeouts
  ALSA: ua101: fix division by zero at probe
  media: ite-cir: IR receiver stop working after receive overflow
  parisc: Fix ptrace check on syscall return
  mmc: dw_mmc: Dont wait for DRTO on Write RSP error
  ocfs2: fix data corruption on truncate
  libata: fix read log timeout value
  Input: i8042 - Add quirk for Fujitsu Lifebook T725
  Input: elantench - fix misreporting trackpoint coordinates
  xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
  binder: use cred instead of task for selinux checks
  binder: use euid from cred instead of using task
  FROMGIT: binder: fix test regression due to sender_euid change
  BACKPORT: binder: use cred instead of task for selinux checks
  BACKPORT: binder: use euid from cred instead of using task
  BACKPORT: ip_gre: add validation for csum_start
  Linux 4.4.292
  rsi: fix control-message timeout
  staging: rtl8192u: fix control-message timeouts
  staging: r8712u: fix control-message timeout
  comedi: vmk80xx: fix bulk and interrupt message timeouts
  comedi: vmk80xx: fix bulk-buffer overflow
  comedi: vmk80xx: fix transfer-buffer overflows
  staging: comedi: drivers: replace le16_to_cpu() with usb_endpoint_maxp()
  comedi: ni_usb6501: fix NULL-deref in command paths
  comedi: dt9812: fix DMA buffers on stack
  isofs: Fix out of bound access for corrupted isofs image
  usb: hso: fix error handling code of hso_create_net_device
  printk/console: Allow to disable console output by using console="" or console=null
  usb-storage: Add compatibility quirk flags for iODD 2531/2541
  usb: gadget: Mark USB_FSL_QE broken on 64-bit
  IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
  IB/qib: Use struct_size() helper
  net: hso: register netdev later to avoid a race condition
  ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
  scsi: core: Put LLD module refcnt after SCSI device is released
  Linux 4.4.291
  sctp: add vtag check in sctp_sf_violation
  sctp: use init_tag from inithdr for ABORT chunk
  nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST
  regmap: Fix possible double-free in regcache_rbtree_exit()
  net: lan78xx: fix division by zero in send path
  mmc: sdhci: Map more voltage level to SDHCI_POWER_330
  mmc: dw_mmc: exynos: fix the finding clock sample value
  mmc: vub300: fix control-message timeouts
  Revert "net: mdiobus: Fix memory leak in __mdiobus_register"
  nfc: port100: fix using -ERRNO as command type mask
  ata: sata_mv: Fix the error handling of mv_chip_id()
  usbnet: fix error return code in usbnet_probe()
  usbnet: sanity check for maxpacket
  ARM: 8819/1: Remove '-p' from LDFLAGS
  ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype
  ARM: 9134/1: remove duplicate memcpy() definition
  ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned
  Linux 4.4.290
  ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
  tracing: Have all levels of checks prevent recursion
  net: mdiobus: Fix memory leak in __mdiobus_register
  ALSA: hda: avoid write to STATESTS if controller is in reset
  platform/x86: intel_scu_ipc: Update timeout value in comment
  isdn: mISDN: Fix sleeping function called from invalid context
  ARM: dts: spear3xx: Fix gmac node
  netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
  isdn: cpai: check ctr->cnr to avoid array index out of bound
  nfc: nci: fix the UAF of rf_conn_info object
  ovl: fix missing negative dentry check in ovl_rename()
  ASoC: DAPM: Fix missing kctl change notifications
  ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
  elfcore: correct reference to CONFIG_UML
  ocfs2: mount fails with buffer overflow in strlen
  can: peak_pci: peak_pci_remove(): fix UAF
  can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification
  can: rcar_can: fix suspend/resume
  NIOS2: irqflags: rename a redefined register name
  netfilter: ipvs: make global sysctl readonly in non-init netns
  NFSD: Keep existing listeners on portlist error
  r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256
  drm/msm: Fix null pointer dereference on pointer edp
  pata_legacy: fix a couple uninitialized variable bugs
  NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
  NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
  nfc: fix error handling of nfc_proto_register()
  ethernet: s2io: fix setting mac address during resume
  net: encx24j600: check error in devm_regmap_init_encx24j600
  net: korina: select CRC32
  net: arc: select CRC32
  iio: ssp_sensors: fix error code in ssp_print_mcu_debug()
  iio: ssp_sensors: add more range checking in ssp_parse_dataframe()
  iio: adc128s052: Fix the error handling path of 'adc128_probe()'
  nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
  USB: serial: option: add Telit LE910Cx composition 0x1204
  USB: serial: qcserial: add EM9191 QDL support
  Input: xpad - add support for another USB ID of Nacon GC-100
  efi/cper: use stack buffer for error record decoding
  cb710: avoid NULL pointer subtraction
  xhci: Enable trust tx length quirk for Fresco FL11 USB controller
  s390: fix strrchr() implementation
  ALSA: seq: Fix a potential UAF by wrong private_free call order

 Conflicts:
	drivers/gpu/drm/msm/msm_gem.c
	net/bluetooth/l2cap_sock.c

Change-Id: Ia008e8ba419fa5604b5780265564ba80d05fbafa

10 files changed, 85 insertions, 41 deletions

diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 205d6b43cd7d..d096254d9acc 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -261,6 +261,13 @@ static void run_ordered_work(struct __btrfs_workqueue *wq)
 				  ordered_list);
 		if (!test_bit(WORK_DONE_BIT, &work->flags))
 			break;
+		/*
+		 * Orders all subsequent loads after reading WORK_DONE_BIT,
+		 * paired with the smp_mb__before_atomic in btrfs_work_helper
+		 * this guarantees that the ordered function will see all
+		 * updates from ordinary work function.
+		 */
+		smp_rmb();
 
 		/*
 		 * we are going to call the ordered done function, but
@@ -310,6 +317,13 @@ static void normal_work_helper(struct btrfs_work *work)
 	thresh_exec_hook(wq);
 	work->func(work);
 	if (need_order) {
+		/*
+		 * Ensures all memory accesses done in the work function are
+		 * ordered before setting the WORK_DONE_BIT. Ensuring the thread
+		 * which is going to executed the ordered work sees them.
+		 * Pairs with the smp_rmb in run_ordered_work.
+		 */
+		smp_mb__before_atomic();
 		set_bit(WORK_DONE_BIT, &work->flags);
 		run_ordered_work(wq);
 	}
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 0cbc7af54d0b..bcf61a32f970 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2207,7 +2207,9 @@ again:
 		else {
 			ret = find_dir_range(log, path, dirid, key_type,
 					     &range_start, &range_end);
-			if (ret != 0)
+			if (ret < 0)
+				goto out;
+			else if (ret > 0)
 				break;
 		}
 
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 350f67fb5b9c..41ece64f1a34 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -1268,6 +1268,8 @@ static int isofs_read_inode(struct inode *inode, int relocated)
 
 	de = (struct iso_directory_record *) (bh->b_data + offset);
 	de_len = *(unsigned char *) de;
+	if (de_len < sizeof(struct iso_directory_record))
+		goto fail;
 
 	if (offset + de_len > bufsize) {
 		int frag1 = bufsize - offset;
diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
index 103788ecc28c..0c2aabba1fdb 100644
--- a/fs/jfs/jfs_mount.c
+++ b/fs/jfs/jfs_mount.c
@@ -93,14 +93,14 @@ int jfs_mount(struct super_block *sb)
 	 * (initialize mount inode from the superblock)
 	 */
 	if ((rc = chkSuper(sb))) {
-		goto errout20;
+		goto out;
 	}
 
 	ipaimap = diReadSpecial(sb, AGGREGATE_I, 0);
 	if (ipaimap == NULL) {
 		jfs_err("jfs_mount: Failed to read AGGREGATE_I");
 		rc = -EIO;
-		goto errout20;
+		goto out;
 	}
 	sbi->ipaimap = ipaimap;
 
@@ -111,7 +111,7 @@ int jfs_mount(struct super_block *sb)
 	 */
 	if ((rc = diMount(ipaimap))) {
 		jfs_err("jfs_mount: diMount(ipaimap) failed w/rc = %d", rc);
-		goto errout21;
+		goto err_ipaimap;
 	}
 
 	/*
@@ -120,7 +120,7 @@ int jfs_mount(struct super_block *sb)
 	ipbmap = diReadSpecial(sb, BMAP_I, 0);
 	if (ipbmap == NULL) {
 		rc = -EIO;
-		goto errout22;
+		goto err_umount_ipaimap;
 	}
 
 	jfs_info("jfs_mount: ipbmap:0x%p", ipbmap);
@@ -132,7 +132,7 @@ int jfs_mount(struct super_block *sb)
 	 */
 	if ((rc = dbMount(ipbmap))) {
 		jfs_err("jfs_mount: dbMount failed w/rc = %d", rc);
-		goto errout22;
+		goto err_ipbmap;
 	}
 
 	/*
@@ -151,7 +151,7 @@ int jfs_mount(struct super_block *sb)
 		if (!ipaimap2) {
 			jfs_err("jfs_mount: Failed to read AGGREGATE_I");
 			rc = -EIO;
-			goto errout35;
+			goto err_umount_ipbmap;
 		}
 		sbi->ipaimap2 = ipaimap2;
 
@@ -163,7 +163,7 @@ int jfs_mount(struct super_block *sb)
 		if ((rc = diMount(ipaimap2))) {
 			jfs_err("jfs_mount: diMount(ipaimap2) failed, rc = %d",
 				rc);
-			goto errout35;
+			goto err_ipaimap2;
 		}
 	} else
 		/* Secondary aggregate inode table is not valid */
@@ -180,7 +180,7 @@ int jfs_mount(struct super_block *sb)
 		jfs_err("jfs_mount: Failed to read FILESYSTEM_I");
 		/* open fileset secondary inode allocation map */
 		rc = -EIO;
-		goto errout40;
+		goto err_umount_ipaimap2;
 	}
 	jfs_info("jfs_mount: ipimap:0x%p", ipimap);
 
@@ -190,41 +190,34 @@ int jfs_mount(struct super_block *sb)
 	/* initialize fileset inode allocation map */
 	if ((rc = diMount(ipimap))) {
 		jfs_err("jfs_mount: diMount failed w/rc = %d", rc);
-		goto errout41;
+		goto err_ipimap;
 	}
 
-	goto out;
+	return rc;
 
 	/*
 	 *	unwind on error
 	 */
-      errout41:		/* close fileset inode allocation map inode */
+err_ipimap:
+	/* close fileset inode allocation map inode */
 	diFreeSpecial(ipimap);
-
-      errout40:		/* fileset closed */
-
+err_umount_ipaimap2:
 	/* close secondary aggregate inode allocation map */
-	if (ipaimap2) {
+	if (ipaimap2)
 		diUnmount(ipaimap2, 1);
+err_ipaimap2:
+	/* close aggregate inodes */
+	if (ipaimap2)
 		diFreeSpecial(ipaimap2);
-	}
-
-      errout35:
-
-	/* close aggregate block allocation map */
+err_umount_ipbmap:	/* close aggregate block allocation map */
 	dbUnmount(ipbmap, 1);
+err_ipbmap:		/* close aggregate inodes */
 	diFreeSpecial(ipbmap);
-
-      errout22:		/* close aggregate inode allocation map */
-
+err_umount_ipaimap:	/* close aggregate inode allocation map */
 	diUnmount(ipaimap, 1);
-
-      errout21:		/* close aggregate inodes */
+err_ipaimap:		/* close aggregate inodes */
 	diFreeSpecial(ipaimap);
-      errout20:		/* aggregate closed */
-
-      out:
-
+out:
 	if (rc)
 		jfs_err("Mount JFS Failure: %d", rc);
 
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 0cd57db5c5af..dfd1949b31ea 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -768,7 +768,10 @@ out_close:
 		svc_xprt_put(xprt);
 	}
 out_err:
-	nfsd_destroy(net);
+	if (!list_empty(&nn->nfsd_serv->sv_permsocks))
+		nn->nfsd_serv->sv_nrthreads--;
+	 else
+		nfsd_destroy(net);
 	return err;
 }
 
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 0de92ad0ba79..73c12b13fc3e 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -490,10 +490,11 @@ int ocfs2_truncate_file(struct inode *inode,
 	 * greater than page size, so we have to truncate them
 	 * anyway.
 	 */
-	unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1);
-	truncate_inode_pages(inode->i_mapping, new_i_size);
 
 	if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+		unmap_mapping_range(inode->i_mapping,
+				    new_i_size + PAGE_SIZE - 1, 0, 1);
+		truncate_inode_pages(inode->i_mapping, new_i_size);
 		status = ocfs2_truncate_inline(inode, di_bh, new_i_size,
 					       i_size_read(inode), 1);
 		if (status)
@@ -512,6 +513,9 @@ int ocfs2_truncate_file(struct inode *inode,
 		goto bail_unlock_sem;
 	}
 
+	unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1);
+	truncate_inode_pages(inode->i_mapping, new_i_size);
+
 	status = ocfs2_commit_truncate(osb, inode, di_bh);
 	if (status < 0) {
 		mlog_errno(status);
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 0ee1f088bace..337f0628c378 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -2208,11 +2208,17 @@ static int ocfs2_initialize_super(struct super_block *sb,
 	}
 
 	if (ocfs2_clusterinfo_valid(osb)) {
+		/*
+		 * ci_stack and ci_cluster in ocfs2_cluster_info may not be null
+		 * terminated, so make sure no overflow happens here by using
+		 * memcpy. Destination strings will always be null terminated
+		 * because osb is allocated using kzalloc.
+		 */
 		osb->osb_stackflags =
 			OCFS2_RAW_SB(di)->s_cluster_info.ci_stackflags;
-		strlcpy(osb->osb_cluster_stack,
+		memcpy(osb->osb_cluster_stack,
 		       OCFS2_RAW_SB(di)->s_cluster_info.ci_stack,
-		       OCFS2_STACK_LABEL_LEN + 1);
+		       OCFS2_STACK_LABEL_LEN);
 		if (strlen(osb->osb_cluster_stack) != OCFS2_STACK_LABEL_LEN) {
 			mlog(ML_ERROR,
 			     "couldn't mount because of an invalid "
@@ -2221,9 +2227,9 @@ static int ocfs2_initialize_super(struct super_block *sb,
 			status = -EINVAL;
 			goto bail;
 		}
-		strlcpy(osb->osb_cluster_name,
+		memcpy(osb->osb_cluster_name,
 			OCFS2_RAW_SB(di)->s_cluster_info.ci_cluster,
-			OCFS2_CLUSTER_NAME_LEN + 1);
+			OCFS2_CLUSTER_NAME_LEN);
 	} else {
 		/* The empty string is identical with classic tools that
 		 * don't know about s_cluster_info. */
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 953c88dd6519..bf2c8ae8ed73 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -831,9 +831,13 @@ static int ovl_rename2(struct inode *olddir, struct dentry *old,
 		}
 	} else {
 		new_create = true;
-		if (!d_is_negative(newdentry) &&
-		    (!new_opaque || !ovl_is_whiteout(newdentry)))
-			goto out_dput;
+		if (!d_is_negative(newdentry)) {
+			if (!new_opaque || !ovl_is_whiteout(newdentry))
+				goto out_dput;
+		} else {
+			if (flags & RENAME_EXCHANGE)
+				goto out_dput;
+		}
 	}
 
 	if (olddentry == trap)
diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c
index 3069b1186719..4f21724a212b 100644
--- a/fs/quota/quota_tree.c
+++ b/fs/quota/quota_tree.c
@@ -416,6 +416,7 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot,
 		quota_error(dquot->dq_sb, "Quota structure has offset to "
 			"other block (%u) than it should (%u)", blk,
 			(uint)(dquot->dq_off >> info->dqi_blocksize_bits));
+		ret = -EIO;
 		goto out_buf;
 	}
 	ret = read_blk(info, blk, buf);
@@ -481,6 +482,13 @@ static int remove_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot,
 		goto out_buf;
 	}
 	newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]);
+	if (newblk < QT_TREEOFF || newblk >= info->dqi_blocks) {
+		quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)",
+			    newblk, info->dqi_blocks);
+		ret = -EUCLEAN;
+		goto out_buf;
+	}
+
 	if (depth == info->dqi_qtree_depth - 1) {
 		ret = free_dqentry(info, dquot, newblk);
 		newblk = 0;
@@ -580,6 +588,13 @@ static loff_t find_tree_dqentry(struct qtree_mem_dqinfo *info,
 	blk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]);
 	if (!blk)	/* No reference? */
 		goto out_buf;
+	if (blk < QT_TREEOFF || blk >= info->dqi_blocks) {
+		quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)",
+			    blk, info->dqi_blocks);
+		ret = -EUCLEAN;
+		goto out_buf;
+	}
+
 	if (depth < info->dqi_qtree_depth - 1)
 		ret = find_tree_dqentry(info, dquot, blk, depth+1);
 	else
diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
index c66f2423e1f5..6ccfd47157d3 100644
--- a/fs/tracefs/inode.c
+++ b/fs/tracefs/inode.c
@@ -429,7 +429,8 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent,
 	if (unlikely(!inode))
 		return failed_creating(dentry);
 
-	inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
+	/* Do not set bits for OTH */
+	inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP;
 	inode->i_op = ops;
 	inode->i_fop = &simple_dir_operations;