1 files changed, 16 insertions, 13 deletions

diff --git a/kernel/sys.c b/kernel/sys.c
index 241507f23eca..e6e0ece5f6a0 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -368,6 +368,7 @@ EXPORT_SYMBOL(unregister_reboot_notifier);
 void kernel_restart(char *cmd)
 {
         kernel_restart_prepare(cmd);
+        disable_nonboot_cpus();
         if (!cmd)
                 printk(KERN_EMERG "Restarting system.\n");
         else
@@ -1264,15 +1265,16 @@ DECLARE_RWSEM(uts_sem);
  * Work around broken programs that cannot handle "Linux 3.0".
  * Instead we map 3.x to 2.6.40+x, so e.g. 3.0 would be 2.6.40
  */
-static int override_release(char __user *release, int len)
+static int override_release(char __user *release, size_t len)
 {
         int ret = 0;
-        char buf[65];
 
         if (current->personality & UNAME26) {
-                char *rest = UTS_RELEASE;
+                const char *rest = UTS_RELEASE;
+                char buf[65] = { 0 };
                 int ndots = 0;
                 unsigned v;
+                size_t copy;
 
                 while (*rest) {
                         if (*rest == '.' && ++ndots >= 3)
@@ -1282,8 +1284,9 @@ static int override_release(char __user *release, int len)
                         rest++;
                 }
                 v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
-                snprintf(buf, len, "2.6.%u%s", v, rest);
-                ret = copy_to_user(release, buf, len);
+                copy = clamp_t(size_t, len, 1, sizeof(buf));
+                copy = scnprintf(buf, copy, "2.6.%u%s", v, rest);
+                ret = copy_to_user(release, buf, copy + 1);
         }
         return ret;
 }
@@ -1788,15 +1791,15 @@ SYSCALL_DEFINE1(umask, int, mask)
 #ifdef CONFIG_CHECKPOINT_RESTORE
 static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
 {
-        struct file *exe_file;
+        struct fd exe;
         struct dentry *dentry;
         int err;
 
-        exe_file = fget(fd);
-        if (!exe_file)
+        exe = fdget(fd);
+        if (!exe.file)
                 return -EBADF;
 
-        dentry = exe_file->f_path.dentry;
+        dentry = exe.file->f_path.dentry;
 
         /*
          * Because the original mm->exe_file points to executable file, make
@@ -1805,7 +1808,7 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
          */
         err = -EACCES;
         if (!S_ISREG(dentry->d_inode->i_mode)   ||
-            exe_file->f_path.mnt->mnt_flags & MNT_NOEXEC)
+            exe.file->f_path.mnt->mnt_flags & MNT_NOEXEC)
                 goto exit;
 
         err = inode_permission(dentry->d_inode, MAY_EXEC);
@@ -1839,12 +1842,12 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
                 goto exit_unlock;
 
         err = 0;
-        set_mm_exe_file(mm, exe_file);
+        set_mm_exe_file(mm, exe.file);  /* this grabs a reference to exe.file */
 exit_unlock:
         up_write(&mm->mmap_sem);
 
 exit:
-        fput(exe_file);
+        fdput(exe);
         return err;
 }
 
@@ -2204,7 +2207,7 @@ static int __orderly_poweroff(void)
                 return -ENOMEM;
         }
 
-        ret = call_usermodehelper_fns(argv[0], argv, envp, UMH_NO_WAIT,
+        ret = call_usermodehelper_fns(argv[0], argv, envp, UMH_WAIT_EXEC,
                                       NULL, argv_cleanup, NULL);
         if (ret == -ENOMEM)
                 argv_free(argv);