23 files changed, 263 insertions, 115 deletions
diff --git a/fs/adfs/inode.c b/fs/adfs/inode.c
index 798cb071d132..3f57ce4bee5d 100644
--- a/fs/adfs/inode.c
+++ b/fs/adfs/inode.c
@@ -19,9 +19,6 @@ static int
 adfs_get_block(struct inode *inode, sector_t block, struct buffer_head *bh,
               int create)
 {
-        if (block < 0)
-                goto abort_negative;
        if (!create) {
                if (block >= inode->i_blocks)
                        goto abort_toobig;
@@ -34,10 +31,6 @@ adfs_get_block(struct inode *inode, sector_t block, struct buffer_head *bh,
        /* don't support allocation of blocks yet */
        return -EIO;
-abort_negative:
-        adfs_error(inode->i_sb, "block %d < 0", block);
-        return -EIO;
 abort_toobig:
        return 0;
 }
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 442d94fe255c..b9b3bb51b1e4 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1711,42 +1711,52 @@ struct elf_note_info {
        int numnote;
 };
-static int fill_note_info(struct elfhdr *elf, int phdrs,
+static int elf_note_info_init(struct elf_note_info *info)
-                          struct elf_note_info *info,
-                          long signr, struct pt_regs *regs)
 {
-#define NUM_NOTES       6
+        memset(info, 0, sizeof(*info));
-        struct list_head *t;
-        info->notes = NULL;
-        info->prstatus = NULL;
-        info->psinfo = NULL;
-        info->fpu = NULL;
-#ifdef ELF_CORE_COPY_XFPREGS
-        info->xfpu = NULL;
-#endif
        INIT_LIST_HEAD(&info->thread_list);
-        info->notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote),
+        /* Allocate space for six ELF notes */
-                              GFP_KERNEL);
+        info->notes = kmalloc(6 * sizeof(struct memelfnote), GFP_KERNEL);
        if (!info->notes)
                return 0;
        info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
        if (!info->psinfo)
-                return 0;
+                goto notes_free;
        info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
        if (!info->prstatus)
-                return 0;
+                goto psinfo_free;
        info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
        if (!info->fpu)
-                return 0;
+                goto prstatus_free;
 #ifdef ELF_CORE_COPY_XFPREGS
        info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
        if (!info->xfpu)
-                return 0;
+                goto fpu_free;
+#endif
+        return 1;
+#ifdef ELF_CORE_COPY_XFPREGS
+ fpu_free:
+        kfree(info->fpu);
 #endif
+ prstatus_free:
+        kfree(info->prstatus);
+ psinfo_free:
+        kfree(info->psinfo);
+ notes_free:
+        kfree(info->notes);
+        return 0;
+}
+static int fill_note_info(struct elfhdr *elf, int phdrs,
+                          struct elf_note_info *info,
+                          long signr, struct pt_regs *regs)
+{
+        struct list_head *t;
+        if (!elf_note_info_init(info))
+                return 0;
-        info->thread_status_size = 0;
        if (signr) {
                struct core_thread *ct;
                struct elf_thread_status *ets;
@@ -1806,8 +1816,6 @@ static int fill_note_info(struct elfhdr *elf, int phdrs,
 #endif
        return 1;
-#undef NUM_NOTES
 }
 static size_t get_note_info_size(struct elf_note_info *info)
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 76285471073e..38502c67987c 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -283,20 +283,23 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
        }
        stack_size = exec_params.stack_size;
-        if (stack_size < interp_params.stack_size)
-                stack_size = interp_params.stack_size;
        if (exec_params.flags & ELF_FDPIC_FLAG_EXEC_STACK)
                executable_stack = EXSTACK_ENABLE_X;
        else if (exec_params.flags & ELF_FDPIC_FLAG_NOEXEC_STACK)
                executable_stack = EXSTACK_DISABLE_X;
-        else if (interp_params.flags & ELF_FDPIC_FLAG_EXEC_STACK)
-                executable_stack = EXSTACK_ENABLE_X;
-        else if (interp_params.flags & ELF_FDPIC_FLAG_NOEXEC_STACK)
-                executable_stack = EXSTACK_DISABLE_X;
        else
                executable_stack = EXSTACK_DEFAULT;
+        if (stack_size == 0) {
+                stack_size = interp_params.stack_size;
+                if (interp_params.flags & ELF_FDPIC_FLAG_EXEC_STACK)
+                        executable_stack = EXSTACK_ENABLE_X;
+                else if (interp_params.flags & ELF_FDPIC_FLAG_NOEXEC_STACK)
+                        executable_stack = EXSTACK_DISABLE_X;
+                else
+                        executable_stack = EXSTACK_DEFAULT;
+        }
        retval = -ENOEXEC;
        if (stack_size == 0)
                goto error;
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index e92f229e3c6e..a2796651e756 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -278,8 +278,6 @@ static int decompress_exec(
                ret = bprm->file->f_op->read(bprm->file, buf, LBUFSIZE, &fpos);
                if (ret <= 0)
                        break;
-                if (ret >= (unsigned long) -4096)
-                        break;
                len -= ret;
                strm.next_in = buf;
@@ -335,7 +333,7 @@ calc_reloc(unsigned long r, struct lib_info *p, int curid, int internalp)
                                        "(%d != %d)", (unsigned) r, curid, id);
                        goto failed;
                } else if ( ! p->lib_list[id].loaded &&
-                                load_flat_shared_library(id, p) > (unsigned long) -4096) {
+                                IS_ERR_VALUE(load_flat_shared_library(id, p))) {
                        printk("BINFMT_FLAT: failed to load library %d", id);
                        goto failed;
                }
@@ -545,7 +543,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                textpos = do_mmap(bprm->file, 0, text_len, PROT_READ|PROT_EXEC,
                                  MAP_PRIVATE|MAP_EXECUTABLE, 0);
                up_write(&current->mm->mmap_sem);
-                if (!textpos  || textpos >= (unsigned long) -4096) {
+                if (!textpos || IS_ERR_VALUE(textpos)) {
                        if (!textpos)
                                textpos = (unsigned long) -ENOMEM;
                        printk("Unable to mmap process text, errno %d\n", (int)-textpos);
@@ -560,7 +558,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                        PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0);
                up_write(&current->mm->mmap_sem);
-                if (realdatastart == 0 || realdatastart >= (unsigned long)-4096) {
+                if (realdatastart == 0 || IS_ERR_VALUE(realdatastart)) {
                        if (!realdatastart)
                                realdatastart = (unsigned long) -ENOMEM;
                        printk("Unable to allocate RAM for process data, errno %d\n",
@@ -587,7 +585,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                        result = bprm->file->f_op->read(bprm->file, (char *) datapos,
                                        data_len + (relocs * sizeof(unsigned long)), &fpos);
                }
-                if (result >= (unsigned long)-4096) {
+                if (IS_ERR_VALUE(result)) {
                        printk("Unable to read data+bss, errno %d\n", (int)-result);
                        do_munmap(current->mm, textpos, text_len);
                        do_munmap(current->mm, realdatastart, data_len + extra);
@@ -607,7 +605,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                        PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0);
                up_write(&current->mm->mmap_sem);
-                if (!textpos  || textpos >= (unsigned long) -4096) {
+                if (!textpos || IS_ERR_VALUE(textpos)) {
                        if (!textpos)
                                textpos = (unsigned long) -ENOMEM;
                        printk("Unable to allocate RAM for process text/data, errno %d\n",
@@ -641,7 +639,7 @@ static int load_flat_file(struct linux_binprm * bprm,
                        fpos = 0;
                        result = bprm->file->f_op->read(bprm->file,
                                        (char *) textpos, text_len, &fpos);
-                        if (result < (unsigned long) -4096)
+                        if (!IS_ERR_VALUE(result))
                                result = decompress_exec(bprm, text_len, (char *) datapos,
                                                 data_len + (relocs * sizeof(unsigned long)), 0);
                }
@@ -651,13 +649,13 @@ static int load_flat_file(struct linux_binprm * bprm,
                        fpos = 0;
                        result = bprm->file->f_op->read(bprm->file,
                                        (char *) textpos, text_len, &fpos);
-                        if (result < (unsigned long) -4096) {
+                        if (!IS_ERR_VALUE(result)) {
                                fpos = ntohl(hdr->data_start);
                                result = bprm->file->f_op->read(bprm->file, (char *) datapos,
                                        data_len + (relocs * sizeof(unsigned long)), &fpos);
                        }
                }
-                if (result >= (unsigned long)-4096) {
+                if (IS_ERR_VALUE(result)) {
                        printk("Unable to read code+data+bss, errno %d\n",(int)-result);
                        do_munmap(current->mm, textpos, text_len + data_len + extra +
                                MAX_SHARED_LIBS * sizeof(unsigned long));
@@ -835,7 +833,7 @@ static int load_flat_shared_library(int id, struct lib_info *libs)
        res = prepare_binprm(&bprm);
-        if (res <= (unsigned long)-4096)
+        if (!IS_ERR_VALUE(res))
                res = load_flat_file(&bprm, libs, id, NULL);
        abort_creds(bprm.cred);
@@ -880,7 +878,7 @@ static int load_flat_binary(struct linux_binprm * bprm, struct pt_regs * regs)
        stack_len += FLAT_DATA_ALIGN - 1;  /* reserve for upcoming alignment */
        
        res = load_flat_file(bprm, &libinfo, 0, &stack_len);
-        if (res > (unsigned long)-4096)
+        if (IS_ERR_VALUE(res))
                return res;
        
        /* Update data segment pointers for all libraries */
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 9096fd0ca3ca..d154a3f365d5 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5269,6 +5269,7 @@ static const struct address_space_operations btrfs_aops = {
        .invalidatepage = btrfs_invalidatepage,
        .releasepage    = btrfs_releasepage,
        .set_page_dirty = btrfs_set_page_dirty,
+        .error_remove_page = generic_error_remove_page,
 };
 static const struct address_space_operations btrfs_symlink_aops = {
diff --git a/fs/char_dev.c b/fs/char_dev.c
index 3cbc57f932d2..d6db933df2b2 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -264,7 +264,6 @@ int __register_chrdev(unsigned int major, unsigned int baseminor,
 {
        struct char_device_struct *cd;
        struct cdev *cdev;
-        char *s;
        int err = -ENOMEM;
        cd = __register_chrdev_region(major, baseminor, count, name);
@@ -278,8 +277,6 @@ int __register_chrdev(unsigned int major, unsigned int baseminor,
        cdev->owner = fops->owner;
        cdev->ops = fops;
        kobject_set_name(&cdev->kobj, "%s", name);
-        for (s = strchr(kobject_name(&cdev->kobj),'/'); s; s = strchr(s, '/'))
-                *s = '!';
                
        err = cdev_add(cdev, MKDEV(cd->major, baseminor), count);
        if (err)
diff --git a/fs/coda/coda_int.h b/fs/coda/coda_int.h
index 8ccd5ed81d9c..d99860a33890 100644
--- a/fs/coda/coda_int.h
+++ b/fs/coda/coda_int.h
@@ -2,6 +2,7 @@
 #define _CODA_INT_
 struct dentry;
+struct file;
 extern struct file_system_type coda_fs_type;
 extern unsigned long coda_timeout;
diff --git a/fs/drop_caches.c b/fs/drop_caches.c
index a2edb7913447..31f4b0e6d72c 100644
--- a/fs/drop_caches.c
+++ b/fs/drop_caches.c
@@ -63,9 +63,9 @@ static void drop_slab(void)
 }
 int drop_caches_sysctl_handler(ctl_table *table, int write,
-        struct file *file, void __user *buffer, size_t *length, loff_t *ppos)
+        void __user *buffer, size_t *length, loff_t *ppos)
 {
-        proc_dointvec_minmax(table, write, file, buffer, length, ppos);
+        proc_dointvec_minmax(table, write, buffer, length, ppos);
        if (write) {
                if (sysctl_drop_caches & 1)
                        drop_pagecache();
diff --git a/fs/exec.c b/fs/exec.c
index 5c833c18d0d4..d49be6bc1793 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -55,6 +55,7 @@
 #include <linux/kmod.h>
 #include <linux/fsnotify.h>
 #include <linux/fs_struct.h>
+#include <linux/pipe_fs_i.h>
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
@@ -63,6 +64,7 @@
 int core_uses_pid;
 char core_pattern[CORENAME_MAX_SIZE] = "core";
+unsigned int core_pipe_limit;
 int suid_dumpable = 0;
 /* The maximal length of core_pattern is also specified in sysctl.c */
@@ -1393,18 +1395,16 @@ out_ret:
        return retval;
 }
-int set_binfmt(struct linux_binfmt *new)
+void set_binfmt(struct linux_binfmt *new)
 {
-        struct linux_binfmt *old = current->binfmt;
+        struct mm_struct *mm = current->mm;
-        if (new) {
+        if (mm->binfmt)
-                if (!try_module_get(new->module))
+                module_put(mm->binfmt->module);
-                        return -1;
-        }
+        mm->binfmt = new;
-        current->binfmt = new;
+        if (new)
-        if (old)
+                __module_get(new->module);
-                module_put(old->module);
-        return 0;
 }
 EXPORT_SYMBOL(set_binfmt);
@@ -1728,6 +1728,29 @@ int get_dumpable(struct mm_struct *mm)
        return (ret >= 2) ? 2 : ret;
 }
+static void wait_for_dump_helpers(struct file *file)
+{
+        struct pipe_inode_info *pipe;
+        pipe = file->f_path.dentry->d_inode->i_pipe;
+        pipe_lock(pipe);
+        pipe->readers++;
+        pipe->writers--;
+        while ((pipe->readers > 1) && (!signal_pending(current))) {
+                wake_up_interruptible_sync(&pipe->wait);
+                kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+                pipe_wait(pipe);
+        }
+        pipe->readers--;
+        pipe->writers++;
+        pipe_unlock(pipe);
+}
 void do_coredump(long signr, int exit_code, struct pt_regs *regs)
 {
        struct core_state core_state;
@@ -1744,11 +1767,12 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
        unsigned long core_limit = current->signal->rlim[RLIMIT_CORE].rlim_cur;
        char **helper_argv = NULL;
        int helper_argc = 0;
-        char *delimit;
+        int dump_count = 0;
+        static atomic_t core_dump_count = ATOMIC_INIT(0);
        audit_core_dumps(signr);
-        binfmt = current->binfmt;
+        binfmt = mm->binfmt;
        if (!binfmt || !binfmt->core_dump)
                goto fail;
@@ -1799,54 +1823,63 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
        lock_kernel();
        ispipe = format_corename(corename, signr);
        unlock_kernel();
-        /*
-         * Don't bother to check the RLIMIT_CORE value if core_pattern points
-         * to a pipe.  Since we're not writing directly to the filesystem
-         * RLIMIT_CORE doesn't really apply, as no actual core file will be
-         * created unless the pipe reader choses to write out the core file
-         * at which point file size limits and permissions will be imposed
-         * as it does with any other process
-         */
        if ((!ispipe) && (core_limit < binfmt->min_coredump))
                goto fail_unlock;
        if (ispipe) {
+                if (core_limit == 0) {
+                        /*
+                         * Normally core limits are irrelevant to pipes, since
+                         * we're not writing to the file system, but we use
+                         * core_limit of 0 here as a speacial value. Any
+                         * non-zero limit gets set to RLIM_INFINITY below, but
+                         * a limit of 0 skips the dump.  This is a consistent
+                         * way to catch recursive crashes.  We can still crash
+                         * if the core_pattern binary sets RLIM_CORE =  !0
+                         * but it runs as root, and can do lots of stupid things
+                         * Note that we use task_tgid_vnr here to grab the pid
+                         * of the process group leader.  That way we get the
+                         * right pid if a thread in a multi-threaded
+                         * core_pattern process dies.
+                         */
+                        printk(KERN_WARNING
+                                "Process %d(%s) has RLIMIT_CORE set to 0\n",
+                                task_tgid_vnr(current), current->comm);
+                        printk(KERN_WARNING "Aborting core\n");
+                        goto fail_unlock;
+                }
+                dump_count = atomic_inc_return(&core_dump_count);
+                if (core_pipe_limit && (core_pipe_limit < dump_count)) {
+                        printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
+                               task_tgid_vnr(current), current->comm);
+                        printk(KERN_WARNING "Skipping core dump\n");
+                        goto fail_dropcount;
+                }
                helper_argv = argv_split(GFP_KERNEL, corename+1, &helper_argc);
                if (!helper_argv) {
                        printk(KERN_WARNING "%s failed to allocate memory\n",
                               __func__);
-                        goto fail_unlock;
+                        goto fail_dropcount;
-                }
-                /* Terminate the string before the first option */
-                delimit = strchr(corename, ' ');
-                if (delimit)
-                        *delimit = '\0';
-                delimit = strrchr(helper_argv[0], '/');
-                if (delimit)
-                        delimit++;
-                else
-                        delimit = helper_argv[0];
-                if (!strcmp(delimit, current->comm)) {
-                        printk(KERN_NOTICE "Recursive core dump detected, "
-                                        "aborting\n");
-                        goto fail_unlock;
                }
                core_limit = RLIM_INFINITY;
                /* SIGPIPE can happen, but it's just never processed */
-                if (call_usermodehelper_pipe(corename+1, helper_argv, NULL,
+                if (call_usermodehelper_pipe(helper_argv[0], helper_argv, NULL,
                                &file)) {
                        printk(KERN_INFO "Core dump to %s pipe failed\n",
                               corename);
-                        goto fail_unlock;
+                        goto fail_dropcount;
                }
        } else
                file = filp_open(corename,
                                 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
                                 0600);
        if (IS_ERR(file))
-                goto fail_unlock;
+                goto fail_dropcount;
        inode = file->f_path.dentry->d_inode;
        if (inode->i_nlink > 1)
                goto close_fail;        /* multiple links - don't dump */
@@ -1875,7 +1908,12 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
        if (retval)
                current->signal->group_exit_code |= 0x80;
 close_fail:
+        if (ispipe && core_pipe_limit)
+                wait_for_dump_helpers(file);
        filp_close(file, NULL);
+fail_dropcount:
+        if (dump_count)
+                atomic_dec(&core_dump_count);
 fail_unlock:
        if (helper_argv)
                argv_free(helper_argv);
diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
index 1c1638f873a4..ade634076d0a 100644
--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -819,6 +819,7 @@ const struct address_space_operations ext2_aops = {
        .writepages             = ext2_writepages,
        .migratepage            = buffer_migrate_page,
        .is_partially_uptodate  = block_is_partially_uptodate,
+        .error_remove_page      = generic_error_remove_page,
 };
 const struct address_space_operations ext2_aops_xip = {
@@ -837,6 +838,7 @@ const struct address_space_operations ext2_nobh_aops = {
        .direct_IO              = ext2_direct_IO,
        .writepages             = ext2_writepages,
        .migratepage            = buffer_migrate_page,
+        .error_remove_page      = generic_error_remove_page,
 };
 /*
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index cd098a7b77fc..acf1b1423327 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1830,6 +1830,7 @@ static const struct address_space_operations ext3_ordered_aops = {
        .direct_IO              = ext3_direct_IO,
        .migratepage            = buffer_migrate_page,
        .is_partially_uptodate  = block_is_partially_uptodate,
+        .error_remove_page      = generic_error_remove_page,
 };
 static const struct address_space_operations ext3_writeback_aops = {
@@ -1845,6 +1846,7 @@ static const struct address_space_operations ext3_writeback_aops = {
        .direct_IO              = ext3_direct_IO,
        .migratepage            = buffer_migrate_page,
        .is_partially_uptodate  = block_is_partially_uptodate,
+        .error_remove_page      = generic_error_remove_page,
 };
 static const struct address_space_operations ext3_journalled_aops = {
@@ -1859,6 +1861,7 @@ static const struct address_space_operations ext3_journalled_aops = {
        .invalidatepage         = ext3_invalidatepage,
        .releasepage            = ext3_releasepage,
        .is_partially_uptodate  = block_is_partially_uptodate,
+        .error_remove_page      = generic_error_remove_page,
 };
 void ext3_set_aops(struct inode *inode)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 3a798737e305..064746fad581 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3386,6 +3386,7 @@ static const struct address_space_operations ext4_ordered_aops = {
        .direct_IO              = ext4_direct_IO,
        .migratepage            = buffer_migrate_page,
        .is_partially_uptodate  = block_is_partially_uptodate,
+        .error_remove_page      = generic_error_remove_page,
 };
 static const struct address_space_operations ext4_writeback_aops = {
@@ -3401,6 +3402,7 @@ static const struct address_space_operations ext4_writeback_aops = {
        .direct_IO              = ext4_direct_IO,
        .migratepage            = buffer_migrate_page,
        .is_partially_uptodate  = block_is_partially_uptodate,
+        .error_remove_page      = generic_error_remove_page,
 };
 static const struct address_space_operations ext4_journalled_aops = {
@@ -3415,6 +3417,7 @@ static const struct address_space_operations ext4_journalled_aops = {
        .invalidatepage         = ext4_invalidatepage,
        .releasepage            = ext4_releasepage,
        .is_partially_uptodate  = block_is_partially_uptodate,
+        .error_remove_page      = generic_error_remove_page,
 };
 static const struct address_space_operations ext4_da_aops = {
@@ -3431,6 +3434,7 @@ static const struct address_space_operations ext4_da_aops = {
        .direct_IO              = ext4_direct_IO,
        .migratepage            = buffer_migrate_page,
        .is_partially_uptodate  = block_is_partially_uptodate,
+        .error_remove_page      = generic_error_remove_page,
 };
 void ext4_set_aops(struct inode *inode)
diff --git a/fs/fcntl.c b/fs/fcntl.c
index ae413086db97..fc089f2f7f56 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -263,6 +263,79 @@ pid_t f_getown(struct file *filp)
        return pid;
 }
+static int f_setown_ex(struct file *filp, unsigned long arg)
+{
+        struct f_owner_ex * __user owner_p = (void * __user)arg;
+        struct f_owner_ex owner;
+        struct pid *pid;
+        int type;
+        int ret;
+        ret = copy_from_user(&owner, owner_p, sizeof(owner));
+        if (ret)
+                return ret;
+        switch (owner.type) {
+        case F_OWNER_TID:
+                type = PIDTYPE_MAX;
+                break;
+        case F_OWNER_PID:
+                type = PIDTYPE_PID;
+                break;
+        case F_OWNER_GID:
+                type = PIDTYPE_PGID;
+                break;
+        default:
+                return -EINVAL;
+        }
+        rcu_read_lock();
+        pid = find_vpid(owner.pid);
+        if (owner.pid && !pid)
+                ret = -ESRCH;
+        else
+                ret = __f_setown(filp, pid, type, 1);
+        rcu_read_unlock();
+        return ret;
+}
+static int f_getown_ex(struct file *filp, unsigned long arg)
+{
+        struct f_owner_ex * __user owner_p = (void * __user)arg;
+        struct f_owner_ex owner;
+        int ret = 0;
+        read_lock(&filp->f_owner.lock);
+        owner.pid = pid_vnr(filp->f_owner.pid);
+        switch (filp->f_owner.pid_type) {
+        case PIDTYPE_MAX:
+                owner.type = F_OWNER_TID;
+                break;
+        case PIDTYPE_PID:
+                owner.type = F_OWNER_PID;
+                break;
+        case PIDTYPE_PGID:
+                owner.type = F_OWNER_GID;
+                break;
+        default:
+                WARN_ON(1);
+                ret = -EINVAL;
+                break;
+        }
+        read_unlock(&filp->f_owner.lock);
+        if (!ret)
+                ret = copy_to_user(owner_p, &owner, sizeof(owner));
+        return ret;
+}
 static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
                struct file *filp)
 {
@@ -313,6 +386,12 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
        case F_SETOWN:
                err = f_setown(filp, arg, 1);
                break;
+        case F_GETOWN_EX:
+                err = f_getown_ex(filp, arg);
+                break;
+        case F_SETOWN_EX:
+                err = f_setown_ex(filp, arg);
+                break;
        case F_GETSIG:
                err = filp->f_owner.signum;
                break;
@@ -428,8 +507,7 @@ static inline int sigio_perm(struct task_struct *p,
 static void send_sigio_to_task(struct task_struct *p,
                               struct fown_struct *fown,
-                               int fd,
+                               int fd, int reason, int group)
-                               int reason)
 {
        /*
         * F_SETSIG can change ->signum lockless in parallel, make
@@ -461,11 +539,11 @@ static void send_sigio_to_task(struct task_struct *p,
                        else
                                si.si_band = band_table[reason - POLL_IN];
                        si.si_fd    = fd;
-                        if (!group_send_sig_info(signum, &si, p))
+                        if (!do_send_sig_info(signum, &si, p, group))
                                break;
                /* fall-through: fall back on the old plain SIGIO signal */
                case 0:
-                        group_send_sig_info(SIGIO, SEND_SIG_PRIV, p);
+                        do_send_sig_info(SIGIO, SEND_SIG_PRIV, p, group);
        }
 }
@@ -474,16 +552,23 @@ void send_sigio(struct fown_struct *fown, int fd, int band)
        struct task_struct *p;
        enum pid_type type;
        struct pid *pid;
+        int group = 1;
        
        read_lock(&fown->lock);
        type = fown->pid_type;
+        if (type == PIDTYPE_MAX) {
+                group = 0;
+                type = PIDTYPE_PID;
+        }
        pid = fown->pid;
        if (!pid)
                goto out_unlock_fown;
        
        read_lock(&tasklist_lock);
        do_each_pid_task(pid, type, p) {
-                send_sigio_to_task(p, fown, fd, band);
+                send_sigio_to_task(p, fown, fd, band, group);
        } while_each_pid_task(pid, type, p);
        read_unlock(&tasklist_lock);
 out_unlock_fown:
@@ -491,10 +576,10 @@ void send_sigio(struct fown_struct *fown, int fd, int band)
 }
 static void send_sigurg_to_task(struct task_struct *p,
-                                struct fown_struct *fown)
+                                struct fown_struct *fown, int group)
 {
        if (sigio_perm(p, fown, SIGURG))
-                group_send_sig_info(SIGURG, SEND_SIG_PRIV, p);
+                do_send_sig_info(SIGURG, SEND_SIG_PRIV, p, group);
 }
 int send_sigurg(struct fown_struct *fown)
@@ -502,10 +587,17 @@ int send_sigurg(struct fown_struct *fown)
        struct task_struct *p;
        enum pid_type type;
        struct pid *pid;
+        int group = 1;
        int ret = 0;
        
        read_lock(&fown->lock);
        type = fown->pid_type;
+        if (type == PIDTYPE_MAX) {
+                group = 0;
+                type = PIDTYPE_PID;
+        }
        pid = fown->pid;
        if (!pid)
                goto out_unlock_fown;
@@ -514,7 +606,7 @@ int send_sigurg(struct fown_struct *fown)
        
        read_lock(&tasklist_lock);
        do_each_pid_task(pid, type, p) {
-                send_sigurg_to_task(p, fown);
+                send_sigurg_to_task(p, fown, group);
        } while_each_pid_task(pid, type, p);
        read_unlock(&tasklist_lock);
 out_unlock_fown:
diff --git a/fs/file_table.c b/fs/file_table.c
index 334ce39881f8..8eb44042e009 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -74,14 +74,14 @@ EXPORT_SYMBOL_GPL(get_max_files);
 * Handle nr_files sysctl
 */
 #if defined(CONFIG_SYSCTL) && defined(CONFIG_PROC_FS)
-int proc_nr_files(ctl_table *table, int write, struct file *filp,
+int proc_nr_files(ctl_table *table, int write,
                     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        files_stat.nr_files = get_nr_files();
-        return proc_dointvec(table, write, filp, buffer, lenp, ppos);
+        return proc_dointvec(table, write, buffer, lenp, ppos);
 }
 #else
-int proc_nr_files(ctl_table *table, int write, struct file *filp,
+int proc_nr_files(ctl_table *table, int write,
                     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        return -ENOSYS;
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index 7ebae9a4ecc0..694b5d48f036 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -1135,6 +1135,7 @@ static const struct address_space_operations gfs2_writeback_aops = {
        .direct_IO = gfs2_direct_IO,
        .migratepage = buffer_migrate_page,
        .is_partially_uptodate = block_is_partially_uptodate,
+        .error_remove_page = generic_error_remove_page,
 };
 static const struct address_space_operations gfs2_ordered_aops = {
@@ -1151,6 +1152,7 @@ static const struct address_space_operations gfs2_ordered_aops = {
        .direct_IO = gfs2_direct_IO,
        .migratepage = buffer_migrate_page,
        .is_partially_uptodate = block_is_partially_uptodate,
+        .error_remove_page = generic_error_remove_page,
 };
 static const struct address_space_operations gfs2_jdata_aops = {
@@ -1166,6 +1168,7 @@ static const struct address_space_operations gfs2_jdata_aops = {
        .invalidatepage = gfs2_invalidatepage,
        .releasepage = gfs2_releasepage,
        .is_partially_uptodate = block_is_partially_uptodate,
+        .error_remove_page = generic_error_remove_page,
 };
 void gfs2_set_aops(struct inode *inode)
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 478a169a262d..87a1258953b8 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -911,15 +911,9 @@ static struct file_system_type hugetlbfs_fs_type = {
 static struct vfsmount *hugetlbfs_vfsmount;
-static int can_do_hugetlb_shm(int creat_flags)
+static int can_do_hugetlb_shm(void)
 {
-        if (creat_flags != HUGETLB_SHMFS_INODE)
+        return capable(CAP_IPC_LOCK) || in_group_p(sysctl_hugetlb_shm_group);
-                return 0;
-        if (capable(CAP_IPC_LOCK))
-                return 1;
-        if (in_group_p(sysctl_hugetlb_shm_group))
-                return 1;
-        return 0;
 }
 struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag,
@@ -935,7 +929,7 @@ struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag,
        if (!hugetlbfs_vfsmount)
                return ERR_PTR(-ENOENT);
-        if (!can_do_hugetlb_shm(creat_flags)) {
+        if (creat_flags == HUGETLB_SHMFS_INODE && !can_do_hugetlb_shm()) {
                *user = current_user();
                if (user_shm_lock(size, *user)) {
                        WARN_ONCE(1,
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 5021b75d2d1e..86d6b4db1096 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -525,6 +525,7 @@ const struct address_space_operations nfs_file_aops = {
        .direct_IO = nfs_direct_IO,
        .migratepage = nfs_migrate_page,
        .launder_page = nfs_launder_page,
+        .error_remove_page = generic_error_remove_page,
 };
 /*
diff --git a/fs/ntfs/aops.c b/fs/ntfs/aops.c
index b38f944f0667..cfce53cb65d7 100644
--- a/fs/ntfs/aops.c
+++ b/fs/ntfs/aops.c
@@ -1550,6 +1550,7 @@ const struct address_space_operations ntfs_aops = {
        .migratepage    = buffer_migrate_page,  /* Move a page cache page from
                                                   one physical page to an
                                                   other. */
+        .error_remove_page = generic_error_remove_page,
 };
 /**
@@ -1569,6 +1570,7 @@ const struct address_space_operations ntfs_mst_aops = {
        .migratepage    = buffer_migrate_page,  /* Move a page cache page from
                                                   one physical page to an
                                                   other. */
+        .error_remove_page = generic_error_remove_page,
 };
 #ifdef NTFS_RW
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 72e76062a900..deb2b132ae5e 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -2022,4 +2022,5 @@ const struct address_space_operations ocfs2_aops = {
        .releasepage            = ocfs2_releasepage,
        .migratepage            = buffer_migrate_page,
        .is_partially_uptodate  = block_is_partially_uptodate,
+        .error_remove_page      = generic_error_remove_page,
 };
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index 171e052c07b3..c7bff4f603ff 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -97,7 +97,11 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
                "Committed_AS:   %8lu kB\n"
                "VmallocTotal:   %8lu kB\n"
                "VmallocUsed:    %8lu kB\n"
-                "VmallocChunk:   %8lu kB\n",
+                "VmallocChunk:   %8lu kB\n"
+#ifdef CONFIG_MEMORY_FAILURE
+                "HardwareCorrupted: %8lu kB\n"
+#endif
+                ,
                K(i.totalram),
                K(i.freeram),
                K(i.bufferram),
@@ -144,6 +148,9 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
                (unsigned long)VMALLOC_TOTAL >> 10,
                vmi.used >> 10,
                vmi.largest_chunk >> 10
+#ifdef CONFIG_MEMORY_FAILURE
+                ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
+#endif
                );
        hugetlb_report_meminfo(m);
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 9b1e4e9a16bf..f667e8aeabdf 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -153,7 +153,7 @@ static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf,
        /* careful: calling conventions are nasty here */
        res = count;
-        error = table->proc_handler(table, write, filp, buf, &res, ppos);
+        error = table->proc_handler(table, write, buf, &res, ppos);
        if (!error)
                error = res;
 out:
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index d5e5559e31db..381854461b28 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -1635,4 +1635,5 @@ const struct address_space_operations xfs_address_space_operations = {
        .direct_IO              = xfs_vm_direct_IO,
        .migratepage            = buffer_migrate_page,
        .is_partially_uptodate  = block_is_partially_uptodate,
+        .error_remove_page      = generic_error_remove_page,
 };
diff --git a/fs/xfs/linux-2.6/xfs_sysctl.c b/fs/xfs/linux-2.6/xfs_sysctl.c
index 916c0ffb6083..c5bc67c4e3bb 100644
--- a/fs/xfs/linux-2.6/xfs_sysctl.c
+++ b/fs/xfs/linux-2.6/xfs_sysctl.c
@@ -26,7 +26,6 @@ STATIC int
 xfs_stats_clear_proc_handler(
        ctl_table       *ctl,
        int             write,
-        struct file     *filp,
        void            __user *buffer,
        size_t          *lenp,
        loff_t          *ppos)
@@ -34,7 +33,7 @@ xfs_stats_clear_proc_handler(
        int             c, ret, *valp = ctl->data;
        __uint32_t      vn_active;
-        ret = proc_dointvec_minmax(ctl, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec_minmax(ctl, write, buffer, lenp, ppos);
        if (!ret && write && *valp) {
                printk("XFS Clearing xfsstats\n");