Merge branch 'akpm' (patches from Andrew Morton) into next

Merge more updates from Andrew Morton:

 - Most of the rest of MM.

   This includes "mark remap_file_pages syscall as deprecated" but the
   actual "replace remap_file_pages syscall with emulation" is held
   back.  I guess we'll need to work out when to pull the trigger on
   that one.

 - various minor cleanups to obscure filesystems

 - the drivers/rtc queue

 - hfsplus updates

 - ufs, hpfs, fatfs, affs, reiserfs

 - Documentation/

 - signals

 - procfs

 - cpu hotplug

 - lib/idr.c

 - rapidio

 - sysctl

 - ipc updates

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (171 commits)
  ufs: sb mutex merge + mutex_destroy
  powerpc: update comments for generic idle conversion
  cris: update comments for generic idle conversion
  idle: remove cpu_idle() forward declarations
  nbd: zero from and len fields in NBD_CMD_DISCONNECT.
  mm: convert some level-less printks to pr_*
  MAINTAINERS: adi-buildroot-devel is moderated
  MAINTAINERS: add linux-api for review of API/ABI changes
  mm/kmemleak-test.c: use pr_fmt for logging
  fs/dlm/debug_fs.c: replace seq_printf by seq_puts
  fs/dlm/lockspace.c: convert simple_str to kstr
  fs/dlm/config.c: convert simple_str to kstr
  mm: mark remap_file_pages() syscall as deprecated
  mm: memcontrol: remove unnecessary memcg argument from soft limit functions
  mm: memcontrol: clean up memcg zoneinfo lookup
  mm/memblock.c: call kmemleak directly from memblock_(alloc|free)
  mm/mempool.c: update the kmemleak stack trace for mempool allocations
  lib/radix-tree.c: update the kmemleak stack trace for radix tree allocations
  mm: introduce kmemleak_update_trace()
  mm/kmemleak.c: use %u to print ->checksum
  ...

1 files changed, 15 insertions, 8 deletions

diff --git a/ipc/shm.c b/ipc/shm.c
index 76459616a7fa..89fc354156cb 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -43,7 +43,7 @@
 #include <linux/mount.h>
 #include <linux/ipc_namespace.h>
 
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #include "util.h"
 
@@ -493,7 +493,11 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
         if (size < SHMMIN || size > ns->shm_ctlmax)
                 return -EINVAL;
 
-        if (ns->shm_tot + numpages > ns->shm_ctlall)
+        if (numpages << PAGE_SHIFT < size)
+                return -ENOSPC;
+
+        if (ns->shm_tot + numpages < ns->shm_tot ||
+                        ns->shm_tot + numpages > ns->shm_ctlall)
                 return -ENOSPC;
 
         shp = ipc_rcu_alloc(sizeof(*shp));
@@ -609,15 +613,15 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
 {
         struct ipc_namespace *ns;
-        struct ipc_ops shm_ops;
+        static const struct ipc_ops shm_ops = {
+                .getnew = newseg,
+                .associate = shm_security,
+                .more_checks = shm_more_checks,
+        };
         struct ipc_params shm_params;
 
         ns = current->nsproxy->ipc_ns;
 
-        shm_ops.getnew = newseg;
-        shm_ops.associate = shm_security;
-        shm_ops.more_checks = shm_more_checks;
-
         shm_params.key = key;
         shm_params.flg = shmflg;
         shm_params.u.size = size;
@@ -694,7 +698,7 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf
                 out.shmmin      = in->shmmin;
                 out.shmmni      = in->shmmni;
                 out.shmseg      = in->shmseg;
-                out.shmall      = in->shmall; 
+                out.shmall      = in->shmall;
 
                 return copy_to_user(buf, &out, sizeof(out));
             }
@@ -1160,6 +1164,9 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
         down_write(&current->mm->mmap_sem);
         if (addr && !(shmflg & SHM_REMAP)) {
                 err = -EINVAL;
+                if (addr + size < addr)
+                        goto invalid;
+
                 if (find_vma_intersection(current->mm, addr, addr + size))
                         goto invalid;
                 /*