2 files changed, 18 insertions, 6 deletions

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 96fb36cd9874..68eb857cfdea 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -52,6 +52,14 @@
 #define HARD_MSGMAX     (131072/sizeof(void*))
 #define DFLT_MSGSIZEMAX 8192    /* max message size */
 
+/*
+ * Define the ranges various user-specified maximum values can
+ * be set to.
+ */
+#define MIN_MSGMAX      1               /* min value for msg_max */
+#define MAX_MSGMAX      HARD_MSGMAX     /* max value for msg_max */
+#define MIN_MSGSIZEMAX  128             /* min value for msgsize_max */
+#define MAX_MSGSIZEMAX  (8192*128)      /* max value for msgsize_max */
 
 struct ext_wait_queue {         /* queue of sleeping tasks */
         struct task_struct *task;
@@ -134,8 +142,8 @@ static struct inode *mqueue_get_inode(struct super_block *sb, int mode,
                         info->qsize = 0;
                         info->user = NULL;      /* set when all is ok */
                         memset(&info->attr, 0, sizeof(info->attr));
-                        info->attr.mq_maxmsg = DFLT_MSGMAX;
-                        info->attr.mq_msgsize = DFLT_MSGSIZEMAX;
+                        info->attr.mq_maxmsg = msg_max;
+                        info->attr.mq_msgsize = msgsize_max;
                         if (attr) {
                                 info->attr.mq_maxmsg = attr->mq_maxmsg;
                                 info->attr.mq_msgsize = attr->mq_msgsize;
@@ -1191,11 +1199,11 @@ static struct file_system_type mqueue_fs_type = {
         .kill_sb = kill_litter_super,
 };
 
-static int msg_max_limit_min = DFLT_MSGMAX;
-static int msg_max_limit_max = HARD_MSGMAX;
+static int msg_max_limit_min = MIN_MSGMAX;
+static int msg_max_limit_max = MAX_MSGMAX;
 
-static int msg_maxsize_limit_min = DFLT_MSGSIZEMAX;
-static int msg_maxsize_limit_max = INT_MAX;
+static int msg_maxsize_limit_min = MIN_MSGSIZEMAX;
+static int msg_maxsize_limit_max = MAX_MSGSIZEMAX;
 
 static ctl_table mq_sysctls[] = {
         {
diff --git a/ipc/shm.c b/ipc/shm.c
index e77ec698cf40..0add3fa5f547 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -737,6 +737,10 @@ asmlinkage long sys_shmctl(int shmid, int cmd, struct shmid_ds __user *buf)
         case SHM_LOCK:
         case SHM_UNLOCK:
         {
+                struct file *uninitialized_var(shm_file);
+
+                lru_add_drain_all();  /* drain pagevecs to lru lists */
+
                 shp = shm_lock_check(ns, shmid);
                 if (IS_ERR(shp)) {
                         err = PTR_ERR(shp);