6 files changed, 16 insertions, 11 deletions

diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index aa83a0865ec1..09050797c76a 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -2856,6 +2856,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
                 /* Assume a single IPMB channel at zero. */
                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
+                intf->curr_channel = IPMI_MAX_CHANNELS;
         }
 
         if (rv == 0)
@@ -3648,13 +3649,13 @@ static int handle_new_recv_msg(ipmi_smi_t          intf,
                 }
 
                 /*
-                ** We need to make sure the channels have been initialized.
-                ** The channel_handler routine will set the "curr_channel"
-                ** equal to or greater than IPMI_MAX_CHANNELS when all the
-                ** channels for this interface have been initialized.
-                */
+                 * We need to make sure the channels have been initialized.
+                 * The channel_handler routine will set the "curr_channel"
+                 * equal to or greater than IPMI_MAX_CHANNELS when all the
+                 * channels for this interface have been initialized.
+                 */
                 if (intf->curr_channel < IPMI_MAX_CHANNELS) {
-                        requeue = 1;     /* Just put the message back for now */
+                        requeue = 0; /* Throw the message away */
                         goto out;
                 }
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 8f05c38c2f06..65e12bca657c 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -694,6 +694,9 @@ static ssize_t read_zero(struct file * file, char __user * buf,
                 written += chunk - unwritten;
                 if (unwritten)
                         break;
+                /* Consider changing this to just 'signal_pending()' with lots of testing */
+                if (fatal_signal_pending(current))
+                        return written ? written : -EINTR;
                 buf += chunk;
                 count -= chunk;
                 cond_resched();
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index a420e8d437dd..13f8871e5b21 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -2711,7 +2711,7 @@ static int __init mxser_module_init(void)
                         continue;
 
                 brd = &mxser_boards[m];
-                retval = mxser_get_ISA_conf(!ioaddr[b], brd);
+                retval = mxser_get_ISA_conf(ioaddr[b], brd);
                 if (retval <= 0) {
                         brd->info = NULL;
                         continue;
diff --git a/drivers/char/random.c b/drivers/char/random.c
index b2ced39d76b2..8c7444857a4b 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1673,7 +1673,7 @@ unsigned int get_random_int(void)
         int ret;
 
         keyptr = get_keyptr();
-        hash[0] += current->pid + jiffies + get_cycles() + (int)(long)&ret;
+        hash[0] += current->pid + jiffies + get_cycles();
 
         ret = half_md4_transform(hash, keyptr->secret);
         put_cpu_var(get_random_int_hash);
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index b0a6a3e51924..d6a807f4077d 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -406,7 +406,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         &sysrq_showlocks_op,            /* d */
         &sysrq_term_op,                 /* e */
         &sysrq_moom_op,                 /* f */
-        /* g: May be registered by ppc for kgdb */
+        /* g: May be registered for the kernel debugger */
         NULL,                           /* g */
         NULL,                           /* h - reserved for help */
         &sysrq_kill_op,                 /* i */
@@ -431,7 +431,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         &sysrq_sync_op,                 /* s */
         &sysrq_showstate_op,            /* t */
         &sysrq_mountro_op,              /* u */
-        /* v: May be registered at init time by SMP VOYAGER */
+        /* v: May be registered for frame buffer console restore */
         NULL,                           /* v */
         &sysrq_showstate_blocked_op,    /* w */
         /* x: May be registered on ppc/powerpc for xmon */
diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index ed306eb1057f..0c2f55a38b95 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -212,7 +212,8 @@ static int get_event_name(char *dest, struct tcpa_event *event,
                         unsigned char * event_entry)
 {
         const char *name = "";
-        char data[40] = "";
+        /* 41 so there is room for 40 data and 1 nul */
+        char data[41] = "";
         int i, n_len = 0, d_len = 0;
         struct tcpa_pc_event *pc_event;