1 files changed, 34 insertions, 21 deletions

diff --git a/fs/compat.c b/fs/compat.c
index 18b21b4c9e3a..5333c7d7427f 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -73,17 +73,17 @@ asmlinkage long compat_sys_utime(char __user *filename, struct compat_utimbuf __
         return do_utimes(AT_FDCWD, filename, t ? tv : NULL);
 }
 
-asmlinkage long compat_sys_futimesat(int dfd, char __user *filename, struct compat_timeval __user *t)
+asmlinkage long compat_sys_futimesat(unsigned int dfd, char __user *filename, struct compat_timeval __user *t)
 {
         struct timeval tv[2];
 
-        if (t) { 
+        if (t) {
                 if (get_user(tv[0].tv_sec, &t[0].tv_sec) ||
                     get_user(tv[0].tv_usec, &t[0].tv_usec) ||
                     get_user(tv[1].tv_sec, &t[1].tv_sec) ||
                     get_user(tv[1].tv_usec, &t[1].tv_usec))
-                        return -EFAULT; 
-        } 
+                        return -EFAULT;
+        }
         return do_utimes(dfd, filename, t ? tv : NULL);
 }
 
@@ -114,7 +114,7 @@ asmlinkage long compat_sys_newlstat(char __user * filename,
         return error;
 }
 
-asmlinkage long compat_sys_newfstatat(int dfd, char __user *filename,
+asmlinkage long compat_sys_newfstatat(unsigned int dfd, char __user *filename,
                 struct compat_stat __user *statbuf, int flag)
 {
         struct kstat stat;
@@ -1326,7 +1326,7 @@ compat_sys_open(const char __user *filename, int flags, int mode)
  * O_LARGEFILE flag.
  */
 asmlinkage long
-compat_sys_openat(int dfd, const char __user *filename, int flags, int mode)
+compat_sys_openat(unsigned int dfd, const char __user *filename, int flags, int mode)
 {
         return do_sys_open(dfd, filename, flags, mode);
 }
@@ -1743,7 +1743,7 @@ asmlinkage long compat_sys_select(int n, compat_ulong_t __user *inp,
                 if ((u64)tv.tv_sec >= (u64)MAX_INT64_SECONDS)
                         timeout = -1;   /* infinite */
                 else {
-                        timeout = ROUND_UP(tv.tv_sec, 1000000/HZ);
+                        timeout = ROUND_UP(tv.tv_usec, 1000000/HZ);
                         timeout += tv.tv_sec * HZ;
                 }
         }
@@ -1751,11 +1751,15 @@ asmlinkage long compat_sys_select(int n, compat_ulong_t __user *inp,
         ret = compat_core_sys_select(n, inp, outp, exp, &timeout);
 
         if (tvp) {
+                struct compat_timeval rtv;
+
                 if (current->personality & STICKY_TIMEOUTS)
                         goto sticky;
-                tv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
-                tv.tv_sec = timeout;
-                if (copy_to_user(tvp, &tv, sizeof(tv))) {
+                rtv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
+                rtv.tv_sec = timeout;
+                if (compat_timeval_compare(&rtv, &tv) >= 0)
+                        rtv = tv;
+                if (copy_to_user(tvp, &rtv, sizeof(rtv))) {
 sticky:
                         /*
                          * If an application puts its timeval in read-only
@@ -1781,7 +1785,7 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
 {
         compat_sigset_t ss32;
         sigset_t ksigmask, sigsaved;
-        long timeout = MAX_SCHEDULE_TIMEOUT;
+        s64 timeout = MAX_SCHEDULE_TIMEOUT;
         struct compat_timespec ts;
         int ret;
 
@@ -1822,13 +1826,17 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
         } while (!ret && !timeout && tsp && (ts.tv_sec || ts.tv_nsec));
 
         if (tsp && !(current->personality & STICKY_TIMEOUTS)) {
-                ts.tv_sec += timeout / HZ;
-                ts.tv_nsec += (timeout % HZ) * (1000000000/HZ);
-                if (ts.tv_nsec >= 1000000000) {
-                        ts.tv_sec++;
-                        ts.tv_nsec -= 1000000000;
+                struct compat_timespec rts;
+
+                rts.tv_sec = timeout / HZ;
+                rts.tv_nsec = (timeout % HZ) * (NSEC_PER_SEC/HZ);
+                if (rts.tv_nsec >= NSEC_PER_SEC) {
+                        rts.tv_sec++;
+                        rts.tv_nsec -= NSEC_PER_SEC;
                 }
-                (void)copy_to_user(tsp, &ts, sizeof(ts));
+                if (compat_timespec_compare(&rts, &ts) >= 0)
+                        rts = ts;
+                copy_to_user(tsp, &rts, sizeof(rts));
         }
 
         if (ret == -ERESTARTNOHAND) {
@@ -1884,7 +1892,7 @@ asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
                 /* We assume that ts.tv_sec is always lower than
                    the number of seconds that can be expressed in
                    an s64. Otherwise the compiler bitches at us */
-                timeout = ROUND_UP(ts.tv_sec, 1000000000/HZ);
+                timeout = ROUND_UP(ts.tv_nsec, 1000000000/HZ);
                 timeout += ts.tv_sec * HZ;
         }
 
@@ -1918,12 +1926,17 @@ asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
                 sigprocmask(SIG_SETMASK, &sigsaved, NULL);
 
         if (tsp && timeout >= 0) {
+                struct compat_timespec rts;
+
                 if (current->personality & STICKY_TIMEOUTS)
                         goto sticky;
                 /* Yes, we know it's actually an s64, but it's also positive. */
-                ts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) * 1000;
-                ts.tv_sec = timeout;
-                if (copy_to_user(tsp, &ts, sizeof(ts))) {
+                rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
+                                        1000;
+                rts.tv_sec = timeout;
+                if (compat_timespec_compare(&rts, &ts) >= 0)
+                        rts = ts;
+                if (copy_to_user(tsp, &rts, sizeof(rts))) {
 sticky:
                         /*
                          * If an application puts its timeval in read-only