Yet another one in the namespace.c series.

The code in graft_tree() used to be correct, but the code

        err = -ENOENT;
        down(&nd->dentry->d_inode->i_sem);
        if (IS_DEADDIR(nd->dentry->d_inode))
                goto out_unlock;

        spin_lock(&dcache_lock);
        if (IS_ROOT(nd->dentry) || !d_unhashed(nd->dentry)) {
		...
	}
	spin_unlock(&dcache_lock);
 out_unlock:

was made incorrect in 2.5.29 when

        err = security_sb_check_sb(mnt, nd);
        if (err)
                goto out_unlock;

was inserted.  It has happened more often that people overlooked
a preexisting setting of err.