Merge commit 'v2.6.28-rc2' into topic/asoc

4 files changed, 24 insertions, 13 deletions

diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
index 69bc85978ba0..0dfebc509426 100644
--- a/ipc/ipc_sysctl.c
+++ b/ipc/ipc_sysctl.c
@@ -131,7 +131,7 @@ static int proc_ipcauto_dointvec_minmax(ctl_table *table, int write,
 
 #ifdef CONFIG_SYSCTL_SYSCALL
 /* The generic sysctl ipc data routine. */
-static int sysctl_ipc_data(ctl_table *table, int __user *name, int nlen,
+static int sysctl_ipc_data(ctl_table *table,
                 void __user *oldval, size_t __user *oldlenp,
                 void __user *newval, size_t newlen)
 {
@@ -169,14 +169,13 @@ static int sysctl_ipc_data(ctl_table *table, int __user *name, int nlen,
         return 1;
 }
 
-static int sysctl_ipc_registered_data(ctl_table *table, int __user *name,
-                int nlen, void __user *oldval, size_t __user *oldlenp,
+static int sysctl_ipc_registered_data(ctl_table *table,
+                void __user *oldval, size_t __user *oldlenp,
                 void __user *newval, size_t newlen)
 {
         int rc;
 
-        rc = sysctl_ipc_data(table, name, nlen, oldval, oldlenp, newval,
-                newlen);
+        rc = sysctl_ipc_data(table, oldval, oldlenp, newval, newlen);
 
         if (newval && newlen && rc > 0)
                 /*
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 96fb36cd9874..68eb857cfdea 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -52,6 +52,14 @@
 #define HARD_MSGMAX     (131072/sizeof(void*))
 #define DFLT_MSGSIZEMAX 8192    /* max message size */
 
+/*
+ * Define the ranges various user-specified maximum values can
+ * be set to.
+ */
+#define MIN_MSGMAX      1               /* min value for msg_max */
+#define MAX_MSGMAX      HARD_MSGMAX     /* max value for msg_max */
+#define MIN_MSGSIZEMAX  128             /* min value for msgsize_max */
+#define MAX_MSGSIZEMAX  (8192*128)      /* max value for msgsize_max */
 
 struct ext_wait_queue {         /* queue of sleeping tasks */
         struct task_struct *task;
@@ -134,8 +142,8 @@ static struct inode *mqueue_get_inode(struct super_block *sb, int mode,
                         info->qsize = 0;
                         info->user = NULL;      /* set when all is ok */
                         memset(&info->attr, 0, sizeof(info->attr));
-                        info->attr.mq_maxmsg = DFLT_MSGMAX;
-                        info->attr.mq_msgsize = DFLT_MSGSIZEMAX;
+                        info->attr.mq_maxmsg = msg_max;
+                        info->attr.mq_msgsize = msgsize_max;
                         if (attr) {
                                 info->attr.mq_maxmsg = attr->mq_maxmsg;
                                 info->attr.mq_msgsize = attr->mq_msgsize;
@@ -1191,11 +1199,11 @@ static struct file_system_type mqueue_fs_type = {
         .kill_sb = kill_litter_super,
 };
 
-static int msg_max_limit_min = DFLT_MSGMAX;
-static int msg_max_limit_max = HARD_MSGMAX;
+static int msg_max_limit_min = MIN_MSGMAX;
+static int msg_max_limit_max = MAX_MSGMAX;
 
-static int msg_maxsize_limit_min = DFLT_MSGSIZEMAX;
-static int msg_maxsize_limit_max = INT_MAX;
+static int msg_maxsize_limit_min = MIN_MSGSIZEMAX;
+static int msg_maxsize_limit_max = MAX_MSGSIZEMAX;
 
 static ctl_table mq_sysctls[] = {
         {
diff --git a/ipc/sem.c b/ipc/sem.c
index bf1bc36cb7ee..082122469b17 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -504,7 +504,7 @@ static int count_semzcnt (struct sem_array * sma, ushort semnum)
         return semzcnt;
 }
 
-void free_un(struct rcu_head *head)
+static void free_un(struct rcu_head *head)
 {
         struct sem_undo *un = container_of(head, struct sem_undo, rcu);
         kfree(un);
diff --git a/ipc/shm.c b/ipc/shm.c
index e77ec698cf40..867e5d6a55c2 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -737,6 +737,10 @@ asmlinkage long sys_shmctl(int shmid, int cmd, struct shmid_ds __user *buf)
         case SHM_LOCK:
         case SHM_UNLOCK:
         {
+                struct file *uninitialized_var(shm_file);
+
+                lru_add_drain_all();  /* drain pagevecs to lru lists */
+
                 shp = shm_lock_check(ns, shmid);
                 if (IS_ERR(shp)) {
                         err = PTR_ERR(shp);
@@ -813,7 +817,7 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
         struct ipc_namespace *ns;
         struct shm_file_data *sfd;
         struct path path;
-        mode_t f_mode;
+        fmode_t f_mode;
 
         err = -EINVAL;
         if (shmid < 0)