Merge branch 'master'

3 files changed, 23 insertions, 14 deletions

diff --git a/kernel/futex.c b/kernel/futex.c
index 5872e3507f35..5e71a6bf6f6b 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -270,7 +270,13 @@ static void wake_futex(struct futex_q *q)
         /*
          * The waiting task can free the futex_q as soon as this is written,
          * without taking any locks.  This must come last.
+         *
+         * A memory barrier is required here to prevent the following store
+         * to lock_ptr from getting ahead of the wakeup. Clearing the lock
+         * at the end of wake_up_all() does not prevent this store from
+         * moving.
          */
+        wmb();
         q->lock_ptr = NULL;
 }
 
diff --git a/kernel/params.c b/kernel/params.c
index 47ba69547945..c76ad25e6a21 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -619,7 +619,7 @@ static void __init param_sysfs_builtin(void)
 
 
 /* module-related sysfs stuff */
-#ifdef CONFIG_MODULES
+#ifdef CONFIG_SYSFS
 
 #define to_module_attr(n) container_of(n, struct module_attribute, attr);
 #define to_module_kobject(n) container_of(n, struct module_kobject, kobj);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 9990e10192e8..b53115b882e1 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2192,29 +2192,32 @@ int sysctl_string(ctl_table *table, int __user *name, int nlen,
                   void __user *oldval, size_t __user *oldlenp,
                   void __user *newval, size_t newlen, void **context)
 {
-        size_t l, len;
-        
         if (!table->data || !table->maxlen) 
                 return -ENOTDIR;
         
         if (oldval && oldlenp) {
-                if (get_user(len, oldlenp))
+                size_t bufsize;
+                if (get_user(bufsize, oldlenp))
                         return -EFAULT;
-                if (len) {
-                        l = strlen(table->data);
-                        if (len > l) len = l;
-                        if (len >= table->maxlen)
+                if (bufsize) {
+                        size_t len = strlen(table->data), copied;
+
+                        /* This shouldn't trigger for a well-formed sysctl */
+                        if (len > table->maxlen)
                                 len = table->maxlen;
-                        if(copy_to_user(oldval, table->data, len))
-                                return -EFAULT;
-                        if(put_user(0, ((char __user *) oldval) + len))
+
+                        /* Copy up to a max of bufsize-1 bytes of the string */
+                        copied = (len >= bufsize) ? bufsize - 1 : len;
+
+                        if (copy_to_user(oldval, table->data, copied) ||
+                            put_user(0, (char __user *)(oldval + copied)))
                                 return -EFAULT;
-                        if(put_user(len, oldlenp))
+                        if (put_user(len, oldlenp))
                                 return -EFAULT;
                 }
         }
         if (newval && newlen) {
-                len = newlen;
+                size_t len = newlen;
                 if (len > table->maxlen)
                         len = table->maxlen;
                 if(copy_from_user(table->data, newval, len))
@@ -2223,7 +2226,7 @@ int sysctl_string(ctl_table *table, int __user *name, int nlen,
                         len--;
                 ((char *) table->data)[len] = 0;
         }
-        return 0;
+        return 1;
 }
 
 /*