4 files changed, 47 insertions, 38 deletions

diff --git a/arch/frv/kernel/signal.c b/arch/frv/kernel/signal.c
index 0974c0ecc594..bab01298b58e 100644
--- a/arch/frv/kernel/signal.c
+++ b/arch/frv/kernel/signal.c
@@ -121,6 +121,9 @@ static int restore_sigcontext(struct sigcontext __user *sc, int *_gr8)
         struct user_context *user = current->thread.user;
         unsigned long tbr, psr;
 
+        /* Always make any pending restarted system calls return -EINTR */
+        current_thread_info()->restart_block.fn = do_no_restart_syscall;
+
         tbr = user->i.tbr;
         psr = user->i.psr;
         if (copy_from_user(user, &sc->sc_context, sizeof(sc->sc_context)))
@@ -250,6 +253,8 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set)
         struct sigframe __user *frame;
         int rsig;
 
+        set_fs(USER_DS);
+
         frame = get_sigframe(ka, sizeof(*frame));
 
         if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
@@ -293,22 +298,23 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set)
                                    (unsigned long) (frame->retcode + 2));
         }
 
-        /* set up registers for signal handler */
-        __frame->sp   = (unsigned long) frame;
-        __frame->lr   = (unsigned long) &frame->retcode;
-        __frame->gr8  = sig;
-
+        /* Set up registers for the signal handler */
         if (current->personality & FDPIC_FUNCPTRS) {
                 struct fdpic_func_descriptor __user *funcptr =
                         (struct fdpic_func_descriptor __user *) ka->sa.sa_handler;
-                __get_user(__frame->pc, &funcptr->text);
-                __get_user(__frame->gr15, &funcptr->GOT);
+                struct fdpic_func_descriptor desc;
+                if (copy_from_user(&desc, funcptr, sizeof(desc)))
+                        goto give_sigsegv;
+                __frame->pc = desc.text;
+                __frame->gr15 = desc.GOT;
         } else {
                 __frame->pc   = (unsigned long) ka->sa.sa_handler;
                 __frame->gr15 = 0;
         }
 
-        set_fs(USER_DS);
+        __frame->sp   = (unsigned long) frame;
+        __frame->lr   = (unsigned long) &frame->retcode;
+        __frame->gr8  = sig;
 
         /* the tracer may want to single-step inside the handler */
         if (test_thread_flag(TIF_SINGLESTEP))
@@ -323,7 +329,7 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set)
         return 0;
 
 give_sigsegv:
-        force_sig(SIGSEGV, current);
+        force_sigsegv(sig, current);
         return -EFAULT;
 
 } /* end setup_frame() */
@@ -338,6 +344,8 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         struct rt_sigframe __user *frame;
         int rsig;
 
+        set_fs(USER_DS);
+
         frame = get_sigframe(ka, sizeof(*frame));
 
         if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
@@ -392,22 +400,23 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         }
 
         /* Set up registers for signal handler */
-        __frame->sp  = (unsigned long) frame;
-        __frame->lr   = (unsigned long) &frame->retcode;
-        __frame->gr8 = sig;
-        __frame->gr9 = (unsigned long) &frame->info;
-
         if (current->personality & FDPIC_FUNCPTRS) {
                 struct fdpic_func_descriptor __user *funcptr =
                         (struct fdpic_func_descriptor __user *) ka->sa.sa_handler;
-                __get_user(__frame->pc, &funcptr->text);
-                __get_user(__frame->gr15, &funcptr->GOT);
+                struct fdpic_func_descriptor desc;
+                if (copy_from_user(&desc, funcptr, sizeof(desc)))
+                        goto give_sigsegv;
+                __frame->pc = desc.text;
+                __frame->gr15 = desc.GOT;
         } else {
                 __frame->pc   = (unsigned long) ka->sa.sa_handler;
                 __frame->gr15 = 0;
         }
 
-        set_fs(USER_DS);
+        __frame->sp  = (unsigned long) frame;
+        __frame->lr  = (unsigned long) &frame->retcode;
+        __frame->gr8 = sig;
+        __frame->gr9 = (unsigned long) &frame->info;
 
         /* the tracer may want to single-step inside the handler */
         if (test_thread_flag(TIF_SINGLESTEP))
@@ -422,7 +431,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         return 0;
 
 give_sigsegv:
-        force_sig(SIGSEGV, current);
+        force_sigsegv(sig, current);
         return -EFAULT;
 
 } /* end setup_rt_frame() */
@@ -437,7 +446,7 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
         int ret;
 
         /* Are we from a system call? */
-        if (in_syscall(__frame)) {
+        if (__frame->syscallno != -1) {
                 /* If so, check system call restarting.. */
                 switch (__frame->gr8) {
                 case -ERESTART_RESTARTBLOCK:
@@ -456,6 +465,7 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
                         __frame->gr8 = __frame->orig_gr8;
                         __frame->pc -= 4;
                 }
+                __frame->syscallno = -1;
         }
 
         /* Set up the stack frame */
@@ -538,10 +548,11 @@ no_signal:
                         break;
 
                 case -ERESTART_RESTARTBLOCK:
-                        __frame->gr8 = __NR_restart_syscall;
+                        __frame->gr7 = __NR_restart_syscall;
                         __frame->pc -= 4;
                         break;
                 }
+                __frame->syscallno = -1;
         }
 
         /* if there's no signal to deliver, we just put the saved sigmask
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index 50441ffe8e38..2904aa044126 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -472,14 +472,9 @@ pl010_set_termios(struct uart_port *port, struct ktermios *termios,
         spin_unlock_irqrestore(&uap->port.lock, flags);
 }
 
-static void pl010_set_ldisc(struct uart_port *port)
+static void pl010_set_ldisc(struct uart_port *port, int new)
 {
-        int line = port->line;
-
-        if (line >= port->state->port.tty->driver->num)
-                return;
-
-        if (port->state->port.tty->ldisc->ops->num == N_PPS) {
+        if (new == N_PPS) {
                 port->flags |= UPF_HARDPPS_CD;
                 pl010_enable_ms(port);
         } else
diff --git a/drivers/serial/mfd.c b/drivers/serial/mfd.c
index bc9af503907f..324c385a653d 100644
--- a/drivers/serial/mfd.c
+++ b/drivers/serial/mfd.c
@@ -1423,7 +1423,6 @@ static void hsu_global_init(void)
         }
 
         phsu = hsu;
-
         hsu_debugfs_init(hsu);
         return;
 
@@ -1435,18 +1434,20 @@ err_free_region:
 
 static void serial_hsu_remove(struct pci_dev *pdev)
 {
-        struct hsu_port *hsu;
-        int i;
+        void *priv = pci_get_drvdata(pdev);
+        struct uart_hsu_port *up;
 
-        hsu = pci_get_drvdata(pdev);
-        if (!hsu)
+        if (!priv)
                 return;
 
-        for (i = 0; i < 3; i++)
-                uart_remove_one_port(&serial_hsu_reg, &hsu->port[i].port);
+        /* For port 0/1/2, priv is the address of uart_hsu_port */
+        if (pdev->device != 0x081E) {
+                up = priv;
+                uart_remove_one_port(&serial_hsu_reg, &up->port);
+        }
 
         pci_set_drvdata(pdev, NULL);
-        free_irq(hsu->irq, hsu);
+        free_irq(pdev->irq, priv);
         pci_disable_device(pdev);
 }
 
diff --git a/mm/memory.c b/mm/memory.c
index 71b161b73bb5..0e18b4d649ec 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2680,10 +2680,12 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
         delayacct_clear_flag(DELAYACCT_PF_SWAPIN);
 
         /*
-         * Make sure try_to_free_swap didn't release the swapcache
-         * from under us. The page pin isn't enough to prevent that.
+         * Make sure try_to_free_swap or reuse_swap_page or swapoff did not
+         * release the swapcache from under us.  The page pin, and pte_same
+         * test below, are not enough to exclude that.  Even if it is still
+         * swapcache, we need to check that the page's swap has not changed.
          */
-        if (unlikely(!PageSwapCache(page)))
+        if (unlikely(!PageSwapCache(page) || page_private(page) != entry.val))
                 goto out_page;
 
         if (ksm_might_need_to_copy(page, vma, address)) {