2 files changed, 18 insertions, 4 deletions
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index cb0cd3cf3b..0acf245f44 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -23,6 +23,7 @@
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
 #include <linux/syscalls.h>
+#include <linux/signal.h>
 #include <net/sock.h>
 #include "util.h"
@@ -767,7 +768,7 @@ static inline void pipelined_send(struct mqueue_inode_info *info,
        list_del(&receiver->list);
        receiver->state = STATE_PENDING;
        wake_up_process(receiver->task);
-        wmb();
+        smp_wmb();
        receiver->state = STATE_READY;
 }
@@ -786,7 +787,7 @@ static inline void pipelined_receive(struct mqueue_inode_info *info)
        list_del(&sender->list);
        sender->state = STATE_PENDING;
        wake_up_process(sender->task);
-        wmb();
+        smp_wmb();
        sender->state = STATE_READY;
 }
@@ -976,8 +977,7 @@ asmlinkage long sys_mq_notify(mqd_t mqdes,
                             notification.sigev_notify != SIGEV_THREAD))
                        return -EINVAL;
                if (notification.sigev_notify == SIGEV_SIGNAL &&
-                        (notification.sigev_signo < 0 ||
+                        !valid_signal(notification.sigev_signo)) {
-                         notification.sigev_signo > _NSIG)) {
                        return -EINVAL;
                }
                if (notification.sigev_notify == SIGEV_THREAD) {
diff --git a/ipc/shm.c b/ipc/shm.c
index 06cd5c9105..cce022435d 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -28,6 +28,8 @@
 #include <linux/security.h>
 #include <linux/syscalls.h>
 #include <linux/audit.h>
+#include <linux/ptrace.h>
 #include <asm/uaccess.h>
 #include "util.h"
@@ -771,6 +773,18 @@ out:
        return err;
 }
+asmlinkage long sys_shmat(int shmid, char __user *shmaddr, int shmflg)
+{
+        unsigned long ret;
+        long err;
+        err = do_shmat(shmid, shmaddr, shmflg, &ret);
+        if (err)
+                return err;
+        force_successful_syscall_return();
+        return (long)ret;
+}
 /*
 * detach and kill segment if marked destroyed.
 * The work is done in shm_close.