19 files changed, 149 insertions, 94 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index 9d3d0f0b27d9..eb9934a82fc1 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1590,8 +1590,6 @@ repeat:
                                         goto repeat;
                                 if (retval != 0) /* He released the lock.  */
                                         goto end;
-                        } else if (p->exit_state == EXIT_DEAD) {
-                                continue;
                         } else if (p->exit_state == EXIT_ZOMBIE) {
                                 /*
                                  * Eligible but we cannot release it yet:
@@ -1606,7 +1604,7 @@ repeat:
                                 /* He released the lock.  */
                                 if (retval != 0)
                                         goto end;
-                        } else {
+                        } else if (p->exit_state != EXIT_DEAD) {
 check_continued:
                                 /*
                                  * It's running now, so it might later
diff --git a/kernel/fork.c b/kernel/fork.c
index 2b55b74cd999..3995297567a9 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1399,7 +1399,7 @@ fork_out:
         return ERR_PTR(retval);
 }
 
-noinline struct pt_regs * __devinit __attribute__((weak)) idle_regs(struct pt_regs *regs)
+noinline struct pt_regs * __cpuinit __attribute__((weak)) idle_regs(struct pt_regs *regs)
 {
         memset(regs, 0, sizeof(struct pt_regs));
         return regs;
@@ -1510,7 +1510,7 @@ long do_fork(unsigned long clone_flags,
                 if (!(clone_flags & CLONE_STOPPED))
                         wake_up_new_task(p, clone_flags);
                 else
-                        p->state = TASK_STOPPED;
+                        __set_task_state(p, TASK_STOPPED);
 
                 if (unlikely (trace)) {
                         current->ptrace_message = nr;
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 7dadc71ce516..f091d13def00 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -53,14 +53,6 @@ static inline int is_kernel_inittext(unsigned long addr)
         return 0;
 }
 
-static inline int is_kernel_extratext(unsigned long addr)
-{
-        if (addr >= (unsigned long)_sextratext
-            && addr <= (unsigned long)_eextratext)
-                return 1;
-        return 0;
-}
-
 static inline int is_kernel_text(unsigned long addr)
 {
         if (addr >= (unsigned long)_stext && addr <= (unsigned long)_etext)
@@ -80,8 +72,7 @@ static int is_ksym_addr(unsigned long addr)
         if (all_var)
                 return is_kernel(addr);
 
-        return is_kernel_text(addr) || is_kernel_inittext(addr) ||
-                is_kernel_extratext(addr);
+        return is_kernel_text(addr) || is_kernel_inittext(addr);
 }
 
 /* expand a compressed symbol data into the resulting uncompressed string,
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index d0493eafea3e..7a86e6432338 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -699,6 +699,12 @@ static int __kprobes pre_handler_kretprobe(struct kprobe *p,
                                  struct kretprobe_instance, uflist);
                 ri->rp = rp;
                 ri->task = current;
+
+                if (rp->entry_handler && rp->entry_handler(ri, regs)) {
+                        spin_unlock_irqrestore(&kretprobe_lock, flags);
+                        return 0;
+                }
+
                 arch_prepare_kretprobe(ri, regs);
 
                 /* XXX(hch): why is there no hlist_move_head? */
@@ -745,7 +751,8 @@ int __kprobes register_kretprobe(struct kretprobe *rp)
         INIT_HLIST_HEAD(&rp->used_instances);
         INIT_HLIST_HEAD(&rp->free_instances);
         for (i = 0; i < rp->maxactive; i++) {
-                inst = kmalloc(sizeof(struct kretprobe_instance), GFP_KERNEL);
+                inst = kmalloc(sizeof(struct kretprobe_instance) +
+                               rp->data_size, GFP_KERNEL);
                 if (inst == NULL) {
                         free_rp_inst(rp);
                         return -ENOMEM;
diff --git a/kernel/notifier.c b/kernel/notifier.c
index 4253f472f060..643360d1bb14 100644
--- a/kernel/notifier.c
+++ b/kernel/notifier.c
@@ -4,6 +4,7 @@
 #include <linux/notifier.h>
 #include <linux/rcupdate.h>
 #include <linux/vmalloc.h>
+#include <linux/reboot.h>
 
 /*
  *      Notifier list for kernel code which wants to be called
diff --git a/kernel/params.c b/kernel/params.c
index 42fe5e6126c0..e28c70628bb7 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -272,7 +272,7 @@ static int param_array(const char *name,
                        unsigned int min, unsigned int max,
                        void *elem, int elemsize,
                        int (*set)(const char *, struct kernel_param *kp),
-                       int *num)
+                       unsigned int *num)
 {
         int ret;
         struct kernel_param kp;
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index ef9b802738a5..79833170bb9c 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -74,8 +74,8 @@ config PM_TRACE_RTC
         RTC across reboots, so that you can debug a machine that just hangs
         during suspend (or more commonly, during resume).
 
-        To use this debugging feature you should attempt to suspend the machine,
-        then reboot it, then run
+        To use this debugging feature you should attempt to suspend the
+        machine, reboot it and then run
 
                 dmesg -s 1000000 | grep 'hash matches'
 
@@ -123,7 +123,10 @@ config HIBERNATION
           called "hibernation" in user interfaces.  STD checkpoints the
           system and powers it off; and restores that checkpoint on reboot.
 
-          You can suspend your machine with 'echo disk > /sys/power/state'.
+          You can suspend your machine with 'echo disk > /sys/power/state'
+          after placing resume=/dev/swappartition on the kernel command line
+          in your bootloader's configuration file.
+
           Alternatively, you can use the additional userland tools available
           from <http://suspend.sf.net>.
 
diff --git a/kernel/printk.c b/kernel/printk.c
index 29ae1e99cde0..4a090621f379 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -93,16 +93,16 @@ static int console_locked, console_suspended;
  */
 static DEFINE_SPINLOCK(logbuf_lock);
 
-#define LOG_BUF_MASK    (log_buf_len-1)
+#define LOG_BUF_MASK (log_buf_len-1)
 #define LOG_BUF(idx) (log_buf[(idx) & LOG_BUF_MASK])
 
 /*
  * The indices into log_buf are not constrained to log_buf_len - they
  * must be masked before subscripting
  */
-static unsigned long log_start; /* Index into log_buf: next char to be read by syslog() */
-static unsigned long con_start; /* Index into log_buf: next char to be sent to consoles */
-static unsigned long log_end;   /* Index into log_buf: most-recently-written-char + 1 */
+static unsigned log_start;      /* Index into log_buf: next char to be read by syslog() */
+static unsigned con_start;      /* Index into log_buf: next char to be sent to consoles */
+static unsigned log_end;        /* Index into log_buf: most-recently-written-char + 1 */
 
 /*
  *      Array of consoles built from command line options (console=)
@@ -128,17 +128,17 @@ static int console_may_schedule;
 static char __log_buf[__LOG_BUF_LEN];
 static char *log_buf = __log_buf;
 static int log_buf_len = __LOG_BUF_LEN;
-static unsigned long logged_chars; /* Number of chars produced since last read+clear operation */
+static unsigned logged_chars; /* Number of chars produced since last read+clear operation */
 
 static int __init log_buf_len_setup(char *str)
 {
-        unsigned long size = memparse(str, &str);
+        unsigned size = memparse(str, &str);
         unsigned long flags;
 
         if (size)
                 size = roundup_pow_of_two(size);
         if (size > log_buf_len) {
-                unsigned long start, dest_idx, offset;
+                unsigned start, dest_idx, offset;
                 char *new_log_buf;
 
                 new_log_buf = alloc_bootmem(size);
@@ -295,7 +295,7 @@ int log_buf_read(int idx)
  */
 int do_syslog(int type, char __user *buf, int len)
 {
-        unsigned long i, j, limit, count;
+        unsigned i, j, limit, count;
         int do_clear = 0;
         char c;
         int error = 0;
@@ -436,7 +436,7 @@ asmlinkage long sys_syslog(int type, char __user *buf, int len)
 /*
  * Call the console drivers on a range of log_buf
  */
-static void __call_console_drivers(unsigned long start, unsigned long end)
+static void __call_console_drivers(unsigned start, unsigned end)
 {
         struct console *con;
 
@@ -463,8 +463,8 @@ early_param("ignore_loglevel", ignore_loglevel_setup);
 /*
  * Write out chars from start to end - 1 inclusive
  */
-static void _call_console_drivers(unsigned long start,
-                                unsigned long end, int msg_log_level)
+static void _call_console_drivers(unsigned start,
+                                unsigned end, int msg_log_level)
 {
         if ((msg_log_level < console_loglevel || ignore_loglevel) &&
                         console_drivers && start != end) {
@@ -484,12 +484,12 @@ static void _call_console_drivers(unsigned long start,
  * log_buf[start] to log_buf[end - 1].
  * The console_sem must be held.
  */
-static void call_console_drivers(unsigned long start, unsigned long end)
+static void call_console_drivers(unsigned start, unsigned end)
 {
-        unsigned long cur_index, start_print;
+        unsigned cur_index, start_print;
         static int msg_level = -1;
 
-        BUG_ON(((long)(start - end)) > 0);
+        BUG_ON(((int)(start - end)) > 0);
 
         cur_index = start;
         start_print = start;
@@ -790,7 +790,7 @@ asmlinkage long sys_syslog(int type, char __user *buf, int len)
         return -ENOSYS;
 }
 
-static void call_console_drivers(unsigned long start, unsigned long end)
+static void call_console_drivers(unsigned start, unsigned end)
 {
 }
 
@@ -983,8 +983,8 @@ void wake_up_klogd(void)
 void release_console_sem(void)
 {
         unsigned long flags;
-        unsigned long _con_start, _log_end;
-        unsigned long wake_klogd = 0;
+        unsigned _con_start, _log_end;
+        unsigned wake_klogd = 0;
 
         if (console_suspended) {
                 up(&secondary_console_sem);
@@ -1275,7 +1275,7 @@ void tty_write_message(struct tty_struct *tty, char *msg)
 int __printk_ratelimit(int ratelimit_jiffies, int ratelimit_burst)
 {
         static DEFINE_SPINLOCK(ratelimit_lock);
-        static unsigned long toks = 10 * 5 * HZ;
+        static unsigned toks = 10 * 5 * HZ;
         static unsigned long last_msg;
         static int missed;
         unsigned long flags;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index b0d4ab4dfd3d..628b03ab88a5 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -20,6 +20,7 @@
 #include <linux/signal.h>
 #include <linux/audit.h>
 #include <linux/pid_namespace.h>
+#include <linux/syscalls.h>
 
 #include <asm/pgtable.h>
 #include <asm/uaccess.h>
@@ -53,7 +54,7 @@ void ptrace_untrace(struct task_struct *child)
         spin_lock(&child->sighand->siglock);
         if (task_is_traced(child)) {
                 if (child->signal->flags & SIGNAL_STOP_STOPPED) {
-                        child->state = TASK_STOPPED;
+                        __set_task_state(child, TASK_STOPPED);
                 } else {
                         signal_wake_up(child, 1);
                 }
@@ -103,18 +104,16 @@ int ptrace_check_attach(struct task_struct *child, int kill)
             && child->signal != NULL) {
                 ret = 0;
                 spin_lock_irq(&child->sighand->siglock);
-                if (task_is_stopped(child)) {
+                if (task_is_stopped(child))
                         child->state = TASK_TRACED;
-                } else if (!task_is_traced(child) && !kill) {
+                else if (!task_is_traced(child) && !kill)
                         ret = -ESRCH;
-                }
                 spin_unlock_irq(&child->sighand->siglock);
         }
         read_unlock(&tasklist_lock);
 
-        if (!ret && !kill) {
+        if (!ret && !kill)
                 wait_task_inactive(child);
-        }
 
         /* All systems go.. */
         return ret;
diff --git a/kernel/relay.c b/kernel/relay.c
index 7c0373322f18..d080b9d161a7 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -37,37 +37,31 @@ static void relay_file_mmap_close(struct vm_area_struct *vma)
 }
 
 /*
- * nopage() vm_op implementation for relay file mapping.
+ * fault() vm_op implementation for relay file mapping.
  */
-static struct page *relay_buf_nopage(struct vm_area_struct *vma,
-                                     unsigned long address,
-                                     int *type)
+static int relay_buf_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
         struct page *page;
         struct rchan_buf *buf = vma->vm_private_data;
-        unsigned long offset = address - vma->vm_start;
+        pgoff_t pgoff = vmf->pgoff;
 
-        if (address > vma->vm_end)
-                return NOPAGE_SIGBUS; /* Disallow mremap */
         if (!buf)
-                return NOPAGE_OOM;
+                return VM_FAULT_OOM;
 
-        page = vmalloc_to_page(buf->start + offset);
+        page = vmalloc_to_page(buf->start + (pgoff << PAGE_SHIFT));
         if (!page)
-                return NOPAGE_OOM;
+                return VM_FAULT_SIGBUS;
         get_page(page);
+        vmf->page = page;
 
-        if (type)
-                *type = VM_FAULT_MINOR;
-
-        return page;
+        return 0;
 }
 
 /*
  * vm_ops for relay file mappings.
  */
 static struct vm_operations_struct relay_file_mmap_ops = {
-        .nopage = relay_buf_nopage,
+        .fault = relay_buf_fault,
         .close = relay_file_mmap_close,
 };
 
diff --git a/kernel/signal.c b/kernel/signal.c
index 6a5f97cd337a..5d30ff561847 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1578,6 +1578,17 @@ static inline int may_ptrace_stop(void)
 }
 
 /*
+ * Return nonzero if there is a SIGKILL that should be waking us up.
+ * Called with the siglock held.
+ */
+static int sigkill_pending(struct task_struct *tsk)
+{
+        return ((sigismember(&tsk->pending.signal, SIGKILL) ||
+                 sigismember(&tsk->signal->shared_pending.signal, SIGKILL)) &&
+                !unlikely(sigismember(&tsk->blocked, SIGKILL)));
+}
+
+/*
  * This must be called with current->sighand->siglock held.
  *
  * This should be the path for all ptrace stops.
@@ -1590,6 +1601,26 @@ static inline int may_ptrace_stop(void)
  */
 static void ptrace_stop(int exit_code, int nostop_code, siginfo_t *info)
 {
+        int killed = 0;
+
+        if (arch_ptrace_stop_needed(exit_code, info)) {
+                /*
+                 * The arch code has something special to do before a
+                 * ptrace stop.  This is allowed to block, e.g. for faults
+                 * on user stack pages.  We can't keep the siglock while
+                 * calling arch_ptrace_stop, so we must release it now.
+                 * To preserve proper semantics, we must do this before
+                 * any signal bookkeeping like checking group_stop_count.
+                 * Meanwhile, a SIGKILL could come in before we retake the
+                 * siglock.  That must prevent us from sleeping in TASK_TRACED.
+                 * So after regaining the lock, we must check for SIGKILL.
+                 */
+                spin_unlock_irq(&current->sighand->siglock);
+                arch_ptrace_stop(exit_code, info);
+                spin_lock_irq(&current->sighand->siglock);
+                killed = sigkill_pending(current);
+        }
+
         /*
          * If there is a group stop in progress,
          * we must participate in the bookkeeping.
@@ -1601,11 +1632,11 @@ static void ptrace_stop(int exit_code, int nostop_code, siginfo_t *info)
         current->exit_code = exit_code;
 
         /* Let the debugger run.  */
-        set_current_state(TASK_TRACED);
+        __set_current_state(TASK_TRACED);
         spin_unlock_irq(&current->sighand->siglock);
         try_to_freeze();
         read_lock(&tasklist_lock);
-        if (may_ptrace_stop()) {
+        if (!unlikely(killed) && may_ptrace_stop()) {
                 do_notify_parent_cldstop(current, CLD_TRAPPED);
                 read_unlock(&tasklist_lock);
                 schedule();
diff --git a/kernel/srcu.c b/kernel/srcu.c
index 3507cabe963b..b0aeeaf22ce4 100644
--- a/kernel/srcu.c
+++ b/kernel/srcu.c
@@ -74,7 +74,7 @@ static int srcu_readers_active_idx(struct srcu_struct *sp, int idx)
  * severe errors when invoked on an active srcu_struct.  That said, it
  * can be useful as an error check at cleanup time.
  */
-int srcu_readers_active(struct srcu_struct *sp)
+static int srcu_readers_active(struct srcu_struct *sp)
 {
         return srcu_readers_active_idx(sp, 0) + srcu_readers_active_idx(sp, 1);
 }
@@ -255,4 +255,3 @@ EXPORT_SYMBOL_GPL(srcu_read_lock);
 EXPORT_SYMBOL_GPL(srcu_read_unlock);
 EXPORT_SYMBOL_GPL(synchronize_srcu);
 EXPORT_SYMBOL_GPL(srcu_batches_completed);
-EXPORT_SYMBOL_GPL(srcu_readers_active);
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 51b5ee53571a..6f4e0e13f70c 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -29,7 +29,6 @@ enum stopmachine_state {
 static enum stopmachine_state stopmachine_state;
 static unsigned int stopmachine_num_threads;
 static atomic_t stopmachine_thread_ack;
-static DECLARE_MUTEX(stopmachine_mutex);
 
 static int stopmachine(void *cpu)
 {
@@ -170,6 +169,7 @@ static int do_stop(void *_smdata)
 struct task_struct *__stop_machine_run(int (*fn)(void *), void *data,
                                        unsigned int cpu)
 {
+        static DEFINE_MUTEX(stopmachine_mutex);
         struct stop_machine_data smdata;
         struct task_struct *p;
 
@@ -177,7 +177,7 @@ struct task_struct *__stop_machine_run(int (*fn)(void *), void *data,
         smdata.data = data;
         init_completion(&smdata.done);
 
-        down(&stopmachine_mutex);
+        mutex_lock(&stopmachine_mutex);
 
         /* If they don't care which CPU fn runs on, bind to any online one. */
         if (cpu == NR_CPUS)
@@ -193,7 +193,7 @@ struct task_struct *__stop_machine_run(int (*fn)(void *), void *data,
                 wake_up_process(p);
                 wait_for_completion(&smdata.done);
         }
-        up(&stopmachine_mutex);
+        mutex_unlock(&stopmachine_mutex);
         return p;
 }
 
diff --git a/kernel/sys.c b/kernel/sys.c
index 53de35fc8245..e3c08d4324de 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1145,16 +1145,16 @@ static int groups_to_user(gid_t __user *grouplist,
     struct group_info *group_info)
 {
         int i;
-        int count = group_info->ngroups;
+        unsigned int count = group_info->ngroups;
 
         for (i = 0; i < group_info->nblocks; i++) {
-                int cp_count = min(NGROUPS_PER_BLOCK, count);
-                int off = i * NGROUPS_PER_BLOCK;
-                int len = cp_count * sizeof(*grouplist);
+                unsigned int cp_count = min(NGROUPS_PER_BLOCK, count);
+                unsigned int len = cp_count * sizeof(*grouplist);
 
-                if (copy_to_user(grouplist+off, group_info->blocks[i], len))
+                if (copy_to_user(grouplist, group_info->blocks[i], len))
                         return -EFAULT;
 
+                grouplist += NGROUPS_PER_BLOCK;
                 count -= cp_count;
         }
         return 0;
@@ -1165,16 +1165,16 @@ static int groups_from_user(struct group_info *group_info,
     gid_t __user *grouplist)
 {
         int i;
-        int count = group_info->ngroups;
+        unsigned int count = group_info->ngroups;
 
         for (i = 0; i < group_info->nblocks; i++) {
-                int cp_count = min(NGROUPS_PER_BLOCK, count);
-                int off = i * NGROUPS_PER_BLOCK;
-                int len = cp_count * sizeof(*grouplist);
+                unsigned int cp_count = min(NGROUPS_PER_BLOCK, count);
+                unsigned int len = cp_count * sizeof(*grouplist);
 
-                if (copy_from_user(group_info->blocks[i], grouplist+off, len))
+                if (copy_from_user(group_info->blocks[i], grouplist, len))
                         return -EFAULT;
 
+                grouplist += NGROUPS_PER_BLOCK;
                 count -= cp_count;
         }
         return 0;
@@ -1472,7 +1472,7 @@ asmlinkage long sys_setrlimit(unsigned int resource, struct rlimit __user *rlim)
         if ((new_rlim.rlim_max > old_rlim->rlim_max) &&
             !capable(CAP_SYS_RESOURCE))
                 return -EPERM;
-        if (resource == RLIMIT_NOFILE && new_rlim.rlim_max > NR_OPEN)
+        if (resource == RLIMIT_NOFILE && new_rlim.rlim_max > sysctl_nr_open)
                 return -EPERM;
 
         retval = security_task_setrlimit(resource, &new_rlim);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 5e2ad5bf88e2..86daaa26d120 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1203,6 +1203,14 @@ static struct ctl_table fs_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
         {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "nr_open",
+                .data           = &sysctl_nr_open,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
+        {
                 .ctl_name       = FS_DENTRY,
                 .procname       = "dentry-state",
                 .data           = &dentry_stat,
diff --git a/kernel/test_kprobes.c b/kernel/test_kprobes.c
index 88cdb109e13c..06b6395b45b2 100644
--- a/kernel/test_kprobes.c
+++ b/kernel/test_kprobes.c
@@ -135,6 +135,12 @@ static int test_jprobe(void)
 #ifdef CONFIG_KRETPROBES
 static u32 krph_val;
 
+static int entry_handler(struct kretprobe_instance *ri, struct pt_regs *regs)
+{
+        krph_val = (rand1 / div_factor);
+        return 0;
+}
+
 static int return_handler(struct kretprobe_instance *ri, struct pt_regs *regs)
 {
         unsigned long ret = regs_return_value(regs);
@@ -144,13 +150,19 @@ static int return_handler(struct kretprobe_instance *ri, struct pt_regs *regs)
                 printk(KERN_ERR "Kprobe smoke test failed: "
                                 "incorrect value in kretprobe handler\n");
         }
+        if (krph_val == 0) {
+                handler_errors++;
+                printk(KERN_ERR "Kprobe smoke test failed: "
+                                "call to kretprobe entry handler failed\n");
+        }
 
-        krph_val = (rand1 / div_factor);
+        krph_val = rand1;
         return 0;
 }
 
 static struct kretprobe rp = {
         .handler        = return_handler,
+        .entry_handler  = entry_handler,
         .kp.symbol_name = "kprobe_target"
 };
 
@@ -167,7 +179,7 @@ static int test_kretprobe(void)
 
         ret = kprobe_target(rand1);
         unregister_kretprobe(&rp);
-        if (krph_val == 0) {
+        if (krph_val != rand1) {
                 printk(KERN_ERR "Kprobe smoke test failed: "
                                 "kretprobe handler not called\n");
                 handler_errors++;
diff --git a/kernel/time.c b/kernel/time.c
index 4064c0566e77..33af3e55570d 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -566,7 +566,11 @@ EXPORT_SYMBOL(jiffies_to_timeval);
 clock_t jiffies_to_clock_t(long x)
 {
 #if (TICK_NSEC % (NSEC_PER_SEC / USER_HZ)) == 0
+# if HZ < USER_HZ
+        return x * (USER_HZ / HZ);
+# else
         return x / (HZ / USER_HZ);
+# endif
 #else
         u64 tmp = (u64)x * TICK_NSEC;
         do_div(tmp, (NSEC_PER_SEC / USER_HZ));
@@ -599,7 +603,14 @@ EXPORT_SYMBOL(clock_t_to_jiffies);
 u64 jiffies_64_to_clock_t(u64 x)
 {
 #if (TICK_NSEC % (NSEC_PER_SEC / USER_HZ)) == 0
+# if HZ < USER_HZ
+        x *= USER_HZ;
+        do_div(x, HZ);
+# elif HZ > USER_HZ
         do_div(x, HZ / USER_HZ);
+# else
+        /* Nothing to do */
+# endif
 #else
         /*
          * There are better ways that don't overflow early,
@@ -611,7 +622,6 @@ u64 jiffies_64_to_clock_t(u64 x)
 #endif
         return x;
 }
-
 EXPORT_SYMBOL(jiffies_64_to_clock_t);
 
 u64 nsec_to_clock_t(u64 x)
@@ -646,7 +656,6 @@ u64 get_jiffies_64(void)
         } while (read_seqretry(&xtime_lock, seq));
         return ret;
 }
-
 EXPORT_SYMBOL(get_jiffies_64);
 #endif
 
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 6e9259a5d501..81afb3927ecc 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -363,15 +363,13 @@ void clocksource_unregister(struct clocksource *cs)
 static ssize_t
 sysfs_show_current_clocksources(struct sys_device *dev, char *buf)
 {
-        char *curr = buf;
+        ssize_t count = 0;
 
         spin_lock_irq(&clocksource_lock);
-        curr += sprintf(curr, "%s ", curr_clocksource->name);
+        count = snprintf(buf, PAGE_SIZE, "%s\n", curr_clocksource->name);
         spin_unlock_irq(&clocksource_lock);
 
-        curr += sprintf(curr, "\n");
-
-        return curr - buf;
+        return count;
 }
 
 /**
@@ -439,17 +437,20 @@ static ssize_t
 sysfs_show_available_clocksources(struct sys_device *dev, char *buf)
 {
         struct clocksource *src;
-        char *curr = buf;
+        ssize_t count = 0;
 
         spin_lock_irq(&clocksource_lock);
         list_for_each_entry(src, &clocksource_list, list) {
-                curr += sprintf(curr, "%s ", src->name);
+                count += snprintf(buf + count,
+                                  max((ssize_t)PAGE_SIZE - count, (ssize_t)0),
+                                  "%s ", src->name);
         }
         spin_unlock_irq(&clocksource_lock);
 
-        curr += sprintf(curr, "\n");
+        count += snprintf(buf + count,
+                          max((ssize_t)PAGE_SIZE - count, (ssize_t)0), "\n");
 
-        return curr - buf;
+        return count;
 }
 
 /*
diff --git a/kernel/timer.c b/kernel/timer.c
index 9fbb472b8cf0..70b29b59343f 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -818,12 +818,14 @@ unsigned long next_timer_interrupt(void)
 #ifndef CONFIG_VIRT_CPU_ACCOUNTING
 void account_process_tick(struct task_struct *p, int user_tick)
 {
+        cputime_t one_jiffy = jiffies_to_cputime(1);
+
         if (user_tick) {
-                account_user_time(p, jiffies_to_cputime(1));
-                account_user_time_scaled(p, jiffies_to_cputime(1));
+                account_user_time(p, one_jiffy);
+                account_user_time_scaled(p, cputime_to_scaled(one_jiffy));
         } else {
-                account_system_time(p, HARDIRQ_OFFSET, jiffies_to_cputime(1));
-                account_system_time_scaled(p, jiffies_to_cputime(1));
+                account_system_time(p, HARDIRQ_OFFSET, one_jiffy);
+                account_system_time_scaled(p, cputime_to_scaled(one_jiffy));
         }
 }
 #endif