diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 0ab83bb7bbdf..6200860ff03d 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -110,15 +110,218 @@ struct dtsplit {
 
 #define DT_PAGE(IP, MP) BT_PAGE(IP, MP, dtpage_t, i_dtroot)
 
+bool check_dtroot(dtroot_t *p)
+{
+	DECLARE_BITMAP(bitmap, DTROOTMAXSLOT) = {0};
+	int i;
+
+	/* freecnt cannot be negative or exceed DTROOTMAXSLOT-1
+	 * (since slot[0] is occupied by the header).
+	 */
+	if (unlikely(p->header.freecnt < 0 ||
+				p->header.freecnt > DTROOTMAXSLOT - 1)) {
+		jfs_err("Bad freecnt:%d in dtroot\n", p->header.freecnt);
+		return false;
+	} else if (p->header.freecnt == 0) {
+		/* No free slots: freelist must be -1 */
+		if (unlikely(p->header.freelist != -1)) {
+			jfs_err("freecnt=0, but freelist=%d in dtroot\n",
+					p->header.freelist);
+			return false;
+		}
+	} else {
+		int fsi, i;
+		/* When there are free slots, freelist must be a valid slot index in
+		 * 1~DTROOTMAXSLOT-1(since slot[0] is occupied by the header).
+		 */
+		if (unlikely(p->header.freelist < 1 ||
+					p->header.freelist >= DTROOTMAXSLOT)) {
+			jfs_err("Bad freelist:%d in dtroot\n", p->header.freelist);
+			return false;
+		}
+
+		/* Traverse the free list to check validity of all node indices */
+		fsi = p->header.freelist;
+		for (i = 0; i < p->header.freecnt - 1; i++) {
+			/* Check for duplicate indices in the free list */
+			if (unlikely(__test_and_set_bit(fsi, bitmap))) {
+				jfs_err("duplicate index%d in slot in dtroot\n", fsi);
+				return false;
+			}
+			fsi = p->slot[fsi].next;
+
+			/* Ensure the next slot index in the free list is valid */
+			if (unlikely(fsi < 1 || fsi >= DTROOTMAXSLOT)) {
+				jfs_err("Bad index:%d in slot in dtroot\n", fsi);
+				return false;
+			}
+		}
+
+		/* The last node in the free list must terminate with next = -1 */
+		if (unlikely(p->slot[fsi].next != -1)) {
+			jfs_err("Bad next:%d of the last slot in dtroot\n",
+					p->slot[fsi].next);
+			return false;
+		}
+	}
+
+	/* Validate nextindex (next free entry index in stbl)
+	 * stbl array has size 8 (indices 0~7), so nextindex must be within this range
+	 */
+	if (unlikely(p->header.nextindex >= ARRAY_SIZE(p->header.stbl))) {
+		jfs_err("Bad nextindex:%d in dtroot\n", p->header.nextindex);
+		return false;
+	}
+
+	/* Validate index validity of stbl array (8 elements)
+	 * Each entry in stbl is a slot index, with valid range: -1 (invalid) or 0~8 (slot[0]~slot[8])
+	 */
+	for (i = 0; i < p->header.nextindex; i++) {
+		int idx = p->header.stbl[i];
+		if (unlikely(idx < 0 || idx >= 9)) {
+			jfs_err("Bad index:%d of stbl[%d] in dtroot\n", idx, i);
+			return false; /* stbl entry points out of slot array range */
+		}
+
+		/* Check for duplicate valid indices (skip check for idx=0) */
+		if (unlikely(idx && __test_and_set_bit(idx, bitmap))) {
+			jfs_err("Duplicate index:%d in stbl in dtroot\n", idx);
+			return false;
+		}
+	}
+
+    return true;
+}
+
+bool check_dtpage(dtpage_t *p)
+{
+	DECLARE_BITMAP(bitmap, DTPAGEMAXSLOT) = {0};
+	const int stblsize = ((PSIZE >> L2DTSLOTSIZE) + 31) >> L2DTSLOTSIZE;
+    int i;
+
+     /* Validate flag field (BT_TYPE must be one of valid types)
+     * Allowed types: BT_LEAF (leaf page) or BT_INTERNAL (internal node)
+     */
+    if ((p->header.flag & BT_TYPE) == 0 || (p->header.flag & ~(BT_TYPE | BT_ROOT | BT_RIGHTMOST | BT_LEFTMOST | BT_SWAPPED))) {
+        jfs_err("Bad flag:0x%x in dtpage\n", p->header.flag);
+        return false;
+    }
+
+    /* Validate maxslot (maximum number of slots in the page)
+     * dtpage_t slot array is defined to hold up to DTPAGEMAXSLOT (128) slots
+     */
+    if (p->header.maxslot != DTPAGEMAXSLOT) {
+        jfs_err("Bad maxslot:%d in dtpage (expected %d)\n",
+                p->header.maxslot, DTPAGEMAXSLOT);
+        return false;
+    }
+
+#if 0
+    /* Validate self extent descriptor (must point to a valid block range)
+     * Address must be non-negative; length must be positive
+     */
+    if (addressPXD(&p->header.self) < 0 || lengthPXD(&p->header.self) <= 0) {
+        jfs_err("Bad self pxd (addr:0x%llx, len:%d) in dtpage\n",
+                (unsigned long long)addressPXD(&p->header.self),
+                lengthPXD(&p->header.self));
+        return false;
+    }
+#endif
+
+    /* freecnt cannot be negative or exceed DTPAGEMAXSLOT-1
+	 * (since slot[0] is occupied by the header).
+     */
+    if (unlikely(p->header.freecnt < 0 ||
+                p->header.freecnt > DTPAGEMAXSLOT - 1)) {
+        jfs_err("Bad freecnt:%d in dtpage\n", p->header.freecnt);
+        return false;
+    } else if (p->header.freecnt == 0) {
+        /* No free slots: freelist must be -1 */
+        if (p->header.freelist != -1) {
+            jfs_err("freecnt=0 but freelist=%d in dtpage\n",
+                    p->header.freelist);
+            return false;
+        }
+    } else {
+        int fsi;
+        /* When there are free slots, freelist must be a valid slot index in
+		 * 1~DTROOTMAXSLOT-1(since slot[0] is occupied by the header).
+         */
+        if (unlikely(p->header.freelist < 1 ||
+					p->header.freelist >= DTPAGEMAXSLOT)) {
+            jfs_err("Bad freelist:%d in dtpage\n", p->header.freelist);
+            return false;
+        }
+
+        /* Traverse the free list to check validity of all node indices */
+        fsi = p->header.freelist;
+        for (i = 0; i < p->header.freecnt - 1; i++) {
+            /* Check for duplicate indices in the free list */
+            if (unlikely(__test_and_set_bit(fsi, bitmap))) {
+                jfs_err("duplicate index%d in slot in dtpage\n", fsi);
+                return false;
+            }
+            fsi = p->slot[fsi].next;
+
+            /* Ensure the next slot index in the free list is valid */
+            if (unlikely(fsi < 1 || fsi >= DTPAGEMAXSLOT)) {
+                jfs_err("Bad index:%d in slot in dtpage\n", fsi);
+                return false;
+            }
+        }
+
+        /* The last node in the free list must terminate with next = -1 */
+        if (unlikely(p->slot[fsi].next != -1)) {
+            jfs_err("Bad next:%d of the last slot in dtpage\n",
+                    p->slot[fsi].next);
+            return false;
+        }
+    }
+
+	/* stbl must be little then maxslot */
+	if (p->header.stblindex >= p->header.maxslot - stblsize) {
+		jfs_err("Bad stblindex:%d in dtpage (stbl size %d)\n",
+				p->header.stblindex, stblsize);
+		return false;
+	}
+
+     /* nextindex must be little then stblsize*32 */
+    if (p->header.nextindex >= (stblsize << L2DTSLOTSIZE)) {
+        jfs_err("Bad nextindex:%d in dtpage (stbl size %d)\n",
+                p->header.nextindex, stblsize);
+        return false;
+    }
+
+	/* Validate stbl entries
+	 * Each entry is a slot index, valid range: -1 (invalid) or [0, nextindex-1] (valid data slots)
+	 * (stblindex and higher slots are reserved for stbl itself)
+	 */
+	for (i = 0; i < p->header.nextindex; i++) {
+		int idx = DT_GETSTBL(p)[i];
+
+		/* Check if index is out of valid data slot range */
+		if (idx < 1 || idx >= p->header.maxslot) {
+			jfs_err("Bad stbl[%d] index:%d (stblindex %d) in dtpage\n",
+					i, idx, p->header.stblindex);
+			return false;
+		}
+
+		/* Check for duplicate valid indices (skip -1) */
+		if (__test_and_set_bit(idx, bitmap)) {
+			jfs_err("Duplicate index:%d in stbl of dtpage\n", idx);
+			return false;
+		}
+	}
+
+    return true;
+}
+
 /* get page buffer for specified block address */
 #define DT_GETPAGE(IP, BN, MP, SIZE, P, RC)				\
 do {									\
 	BT_GETPAGE(IP, BN, MP, dtpage_t, SIZE, P, RC, i_dtroot);	\
 	if (!(RC)) {							\
-		if (((P)->header.nextindex >				\
-		     (((BN) == 0) ? DTROOTMAXSLOT : (P)->header.maxslot)) || \
-		    ((BN) && (((P)->header.maxslot > DTPAGEMAXSLOT) ||	\
-		    ((P)->header.stblindex >= DTPAGEMAXSLOT)))) {	\
+		if ((BN) && !check_dtpage(P)) { \
 			BT_PUTPAGE(MP);					\
 			jfs_error((IP)->i_sb,				\
 				  "DT_GETPAGE: dtree page corrupt\n");	\
@@ -591,7 +794,7 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
 
 
 	/* uppercase search key for c-i directory */
-	UniStrcpy(ciKey.name, key->name);
+	UniStrncpy_le(ciKey.name, key->name, JFS_NAME_MAX);
 	ciKey.namlen = key->namlen;
 
 	/* only uppercase if case-insensitive support is on */
@@ -1483,6 +1686,9 @@ static int dtSplitPage(tid_t tid, struct inode *ip, struct dtsplit * split,
 			tlck, ip, mp);
 		dtlck = (struct dt_lock *) & tlck->lock;
 
+		if (dtlck->index >= dtlck->maxcnt)
+			dtlck = txLinelock(dtlck);
+
 		/* linelock header of previous right sibling page */
 		lv = & dtlck->lv[dtlck->index];
 		lv->offset = 0;
@@ -1553,6 +1759,8 @@ static int dtSplitPage(tid_t tid, struct inode *ip, struct dtsplit * split,
 	 * new/right page moved in entries are linelocked;
 	 */
 	/* linelock header + stbl of new right page */
+	if (rdtlck->index >= rdtlck->maxcnt)
+		rdtlck = txLinelock(rdtlck);
 	rlv = & rdtlck->lv[rdtlck->index];
 	rlv->offset = 0;
 	rlv->length = 5;
@@ -1834,6 +2042,8 @@ static int dtExtendPage(tid_t tid,
 	 */
 	tlck = txLock(tid, ip, pmp, tlckDTREE | tlckENTRY);
 	dtlck = (struct dt_lock *) & tlck->lock;
+	if (dtlck->index >= dtlck->maxcnt)
+		dtlck = txLinelock(dtlck);
 	lv = & dtlck->lv[dtlck->index];
 
 	/* linelock parent entry - 1st slot */
@@ -3809,10 +4019,14 @@ static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp,
 	sfsi = sp->header.freelist;
 
 	/* linelock destination entry slot */
+	if (ddtlck->index >= ddtlck->maxcnt)
+		ddtlck = txLinelock(ddtlck);
 	dlv = & ddtlck->lv[ddtlck->index];
 	dlv->offset = dsi;
 
 	/* linelock source entry slot */
+	if (sdtlck->index >= sdtlck->maxcnt)
+		sdtlck = txLinelock(sdtlck);
 	slv = & sdtlck->lv[sdtlck->index];
 	slv->offset = sstbl[si];
 	xssi = slv->offset - 1;
diff --git a/fs/jfs/jfs_dtree.h b/fs/jfs/jfs_dtree.h
index 1758289647a0..6b9de1f62cfe 100644
--- a/fs/jfs/jfs_dtree.h
+++ b/fs/jfs/jfs_dtree.h
@@ -253,4 +253,7 @@ extern int dtModify(tid_t tid, struct inode *ip, struct component_name * key,
 		    ino_t * orig_ino, ino_t new_ino, int flag);
 
 extern int jfs_readdir(struct file *file, struct dir_context *ctx);
+
+extern bool check_dtroot(dtroot_t *p);
+extern bool check_dtpage(dtpage_t *p);
 #endif				/* !_H_JFS_DTREE */
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index ecb8e05b8b84..105b8656c3fb 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -762,6 +762,8 @@ int diWrite(tid_t tid, struct inode *ip)
 	 * copy inline symlink from in-memory inode to on-disk inode
 	 */
 	if (S_ISLNK(ip->i_mode) && ip->i_size < IDATASIZE) {
+		if (unlikely(dilinelock->index >= dilinelock->maxcnt))
+			dilinelock = txLinelock(dilinelock);
 		lv = & dilinelock->lv[dilinelock->index];
 		lv->offset = (dioffset + 2 * 128) >> L2INODESLOTSIZE;
 		lv->length = 2;
@@ -773,6 +775,8 @@ int diWrite(tid_t tid, struct inode *ip)
 	 * 128 byte slot granularity
 	 */
 	if (test_cflag(COMMIT_Inlineea, ip)) {
+		if (unlikely(dilinelock->index >= dilinelock->maxcnt))
+			dilinelock = txLinelock(dilinelock);
 		lv = & dilinelock->lv[dilinelock->index];
 		lv->offset = (dioffset + 3 * 128) >> L2INODESLOTSIZE;
 		lv->length = 1;
@@ -785,6 +789,8 @@ int diWrite(tid_t tid, struct inode *ip)
 	/*
 	 *	lock/copy inode base: 128 byte slot granularity
 	 */
+	if (unlikely(dilinelock->index >= dilinelock->maxcnt))
+		dilinelock = txLinelock(dilinelock);
 	lv = & dilinelock->lv[dilinelock->index];
 	lv->offset = dioffset >> L2INODESLOTSIZE;
 	copy_to_dinode(dp, ip);
@@ -3102,6 +3108,10 @@ static int copy_from_dinode(struct dinode * dip, struct inode *ip)
 
 	if (S_ISDIR(ip->i_mode)) {
 		memcpy(&jfs_ip->u.dir, &dip->u._dir, 384);
+		if (!check_dtroot(&jfs_ip->i_dtroot)) {
+			jfs_err("Corrupt dtroot\n");
+			return -EIO;
+		}
 	} else if (S_ISREG(ip->i_mode) || S_ISLNK(ip->i_mode)) {
 		memcpy(&jfs_ip->i_xtroot, &dip->di_xtroot, 288);
 	} else
diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 871cf4fb3636..0d6c40e7e551 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -270,6 +270,7 @@ static inline struct metapage *alloc_metapage(gfp_t gfp_mask)
 		mp->clsn = 0;
 		mp->log = NULL;
 		init_waitqueue_head(&mp->wait);
+		INIT_LIST_HEAD(&mp->synclist);
 	}
 	return mp;
 }
@@ -379,7 +380,7 @@ static void remove_from_logsync(struct metapage *mp)
 		mp->lsn = 0;
 		mp->clsn = 0;
 		log->count--;
-		list_del(&mp->synclist);
+		list_del_init(&mp->synclist);
 	}
 	LOGSYNC_UNLOCK(log, flags);
 }
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index 7840a03e5bcb..a5a5bc0a266d 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -275,6 +275,7 @@ int txInit(void)
 	for (k = 0; k < nTxBlock; k++) {
 		init_waitqueue_head(&TxBlock[k].gcwait);
 		init_waitqueue_head(&TxBlock[k].waitor);
+		INIT_LIST_HEAD(&TxBlock[k].synclist);
 	}
 
 	for (k = 1; k < nTxBlock - 1; k++) {
@@ -974,7 +975,7 @@ static void txUnlock(struct tblock * tblk)
 	if (tblk->lsn) {
 		LOGSYNC_LOCK(log, flags);
 		log->count--;
-		list_del(&tblk->synclist);
+		list_del_init(&tblk->synclist);
 		LOGSYNC_UNLOCK(log, flags);
 	}
 }