5 files changed, 11 insertions, 7 deletions

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 3401293359e8..04f3ffb8d9d4 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2023,7 +2023,7 @@ int __audit_signal_info(int sig, struct task_struct *t)
                 axp->d.next = ctx->aux_pids;
                 ctx->aux_pids = (void *)axp;
         }
-        BUG_ON(axp->pid_count > AUDIT_AUX_PIDS);
+        BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
 
         axp->target_pid[axp->pid_count] = t->tgid;
         selinux_get_task_sid(t, &axp->target_sid[axp->pid_count]);
diff --git a/kernel/futex.c b/kernel/futex.c
index 3415e9ad1391..e8935b195e88 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1670,6 +1670,7 @@ pi_faulted:
                                          attempt);
                 if (ret)
                         goto out;
+                uval = 0;
                 goto retry_unlocked;
         }
 
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 203a518b6f14..853aefbd184b 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -462,7 +462,9 @@ void free_irq(unsigned int irq, void *dev_id)
                  * We do this after actually deregistering it, to make sure that
                  * a 'real' IRQ doesn't run in parallel with our fake
                  */
+                local_irq_save(flags);
                 handler(irq, dev_id);
+                local_irq_restore(flags);
         }
 #endif
 }
diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 55b3761edaa9..7a15afb73ed0 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -547,9 +547,9 @@ sys_timer_create(const clockid_t which_clock,
                                 new_timer->it_process = process;
                                 list_add(&new_timer->list,
                                          &process->signal->posix_timers);
-                                spin_unlock_irqrestore(&process->sighand->siglock, flags);
                                 if (new_timer->it_sigev_notify == (SIGEV_SIGNAL|SIGEV_THREAD_ID))
                                         get_task_struct(process);
+                                spin_unlock_irqrestore(&process->sighand->siglock, flags);
                         } else {
                                 spin_unlock_irqrestore(&process->sighand->siglock, flags);
                                 process = NULL;
@@ -605,13 +605,14 @@ static struct k_itimer * lock_timer(timer_t timer_id, unsigned long *flags)
         timr = (struct k_itimer *) idr_find(&posix_timers_id, (int) timer_id);
         if (timr) {
                 spin_lock(&timr->it_lock);
-                spin_unlock(&idr_lock);
 
                 if ((timr->it_id != timer_id) || !(timr->it_process) ||
                                 timr->it_process->tgid != current->tgid) {
-                        unlock_timer(timr, *flags);
+                        spin_unlock(&timr->it_lock);
+                        spin_unlock_irqrestore(&idr_lock, *flags);
                         timr = NULL;
-                }
+                } else
+                        spin_unlock(&idr_lock);
         } else
                 spin_unlock_irqrestore(&idr_lock, *flags);
 
diff --git a/kernel/signal.c b/kernel/signal.c
index b27c01a66448..ad63109e413c 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -378,7 +378,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
         /* We only dequeue private signals from ourselves, we don't let
          * signalfd steal them
          */
-        if (tsk == current)
+        if (likely(tsk == current))
                 signr = __dequeue_signal(&tsk->pending, mask, info);
         if (!signr) {
                 signr = __dequeue_signal(&tsk->signal->shared_pending,
@@ -425,7 +425,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
                 if (!(tsk->signal->flags & SIGNAL_GROUP_EXIT))
                         tsk->signal->flags |= SIGNAL_STOP_DEQUEUED;
         }
-        if ( signr &&
+        if (signr && likely(tsk == current) &&
              ((info->si_code & __SI_MASK) == __SI_TIMER) &&
              info->si_sys_private){
                 /*