4 files changed, 25 insertions, 14 deletions

diff --git a/arch/ppc/kernel/ppc_ksyms.c b/arch/ppc/kernel/ppc_ksyms.c
index d59ad07de8e7..e7d40cc6c1b6 100644
--- a/arch/ppc/kernel/ppc_ksyms.c
+++ b/arch/ppc/kernel/ppc_ksyms.c
@@ -324,7 +324,7 @@ EXPORT_SYMBOL(__res);
 
 EXPORT_SYMBOL(next_mmu_context);
 EXPORT_SYMBOL(set_context);
-EXPORT_SYMBOL(handle_mm_fault); /* For MOL */
+EXPORT_SYMBOL_GPL(__handle_mm_fault); /* For MOL */
 EXPORT_SYMBOL(disarm_decr);
 #ifdef CONFIG_PPC_STD_MMU
 extern long mol_trampoline;
diff --git a/fs/isofs/compress.c b/fs/isofs/compress.c
index 34a44e451689..4917315db732 100644
--- a/fs/isofs/compress.c
+++ b/fs/isofs/compress.c
@@ -129,8 +129,14 @@ static int zisofs_readpage(struct file *file, struct page *page)
         cend = le32_to_cpu(*(__le32 *)(bh->b_data + (blockendptr & bufmask)));
         brelse(bh);
 
+        if (cstart > cend)
+                goto eio;
+                
         csize = cend-cstart;
 
+        if (csize > deflateBound(1UL << zisofs_block_shift))
+                goto eio;
+
         /* Now page[] contains an array of pages, any of which can be NULL,
            and the locks on which we hold.  We should now read the data and
            release the pages.  If the pages are NULL the decompressed data
diff --git a/include/asm-ppc/pgtable.h b/include/asm-ppc/pgtable.h
index c41c7958ea1f..92f30b28b252 100644
--- a/include/asm-ppc/pgtable.h
+++ b/include/asm-ppc/pgtable.h
@@ -227,21 +227,21 @@ extern unsigned long ioremap_bot, ioremap_base;
  *     doesn't support SMP. So we can use this as software bit, like
  *     DIRTY.
  *
- * PPC Book-E Linux implementation uses PPC HW PTE bit field definition,
- * even it doesn't have HW PTE. 0-11th LSB of PTE stand for memory
- * protection-related function. (See PTE structure in include/asm-ppc/mmu.h)
- * Definition of _PAGE_XXX in "include/asm-ppc/pagetable.h" stands for
- * above bits. Note that those bits values are CPU dependent, not
- * architecture.
+ * With the PPC 44x Linux implementation, the 0-11th LSBs of the PTE are used
+ * for memory protection related functions (see PTE structure in
+ * include/asm-ppc/mmu.h).  The _PAGE_XXX definitions in this file map to the
+ * above bits.  Note that the bit values are CPU specific, not architecture
+ * specific.
  *
- * Kernel PTE entry holds arch-dependent swp_entry structure under certain
- * situation. In other words, in such situation, some portion of PTE bits
- * are used as swp_entry. In PPC implementation, 3-24th LSB are shared with
- * swp_entry, however 0-2nd three LSB still hold protection values.
- * That means three protection bits are reserved for both PTE and SWAP
- * entry at the most three LSBs.
+ * The kernel PTE entry holds an arch-dependent swp_entry structure under
+ * certain situations. In other words, in such situations some portion of
+ * the PTE bits are used as a swp_entry. In the PPC implementation, the
+ * 3-24th LSB are shared with swp_entry, however the 0-2nd three LSB still
+ * hold protection values. That means the three protection bits are
+ * reserved for both PTE and SWAP entry at the most significant three
+ * LSBs.
  *
- * There are three protection bits available for SWAP entry;
+ * There are three protection bits available for SWAP entry:
  *      _PAGE_PRESENT
  *      _PAGE_FILE
  *      _PAGE_HASHPTE (if HW has)
diff --git a/include/linux/zlib.h b/include/linux/zlib.h
index 850076ea14d3..74f7b78c22d2 100644
--- a/include/linux/zlib.h
+++ b/include/linux/zlib.h
@@ -506,6 +506,11 @@ extern int zlib_deflateReset (z_streamp strm);
    stream state was inconsistent (such as zalloc or state being NULL).
 */
 
+static inline unsigned long deflateBound(unsigned long s)
+{
+        return s + ((s + 7) >> 3) + ((s + 63) >> 6) + 11;
+}
+
 extern int zlib_deflateParams (z_streamp strm, int level, int strategy);
 /*
      Dynamically update the compression level and compression strategy.  The