5 files changed, 10 insertions, 10 deletions
diff --git a/ipc/msg.c b/ipc/msg.c
index de2c406b9..a2eadc979 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -16,7 +16,7 @@
  */
 
 #include <linux/config.h>
-#include <linux/malloc.h>
+#include <linux/slab.h>
 #include <linux/msg.h>
 #include <linux/spinlock.h>
 #include <linux/init.h>
@@ -473,7 +473,7 @@ asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds *buf)
 		int success_return;
 		if (!buf)
 			return -EFAULT;
-		if(cmd == MSG_STAT && msqid > msg_ids.size)
+		if(cmd == MSG_STAT && msqid >= msg_ids.size)
 			return -EINVAL;
 
 		memset(&tbuf,0,sizeof(tbuf));
diff --git a/ipc/sem.c b/ipc/sem.c
index 203418a8a..c9c424dfa 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -56,7 +56,7 @@
  */
 
 #include <linux/config.h>
-#include <linux/malloc.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/init.h>
 #include <linux/proc_fs.h>
@@ -467,7 +467,7 @@ int semctl_nolock(int semid, int semnum, int cmd, int version, union semun arg)
 		struct semid64_ds tbuf;
 		int id;
 
-		if(semid > sem_ids.size)
+		if(semid >= sem_ids.size)
 			return -EINVAL;
 
 		memset(&tbuf,0,sizeof(tbuf));
@@ -922,7 +922,7 @@ asmlinkage long sys_semop (int semid, struct sembuf *tsops, unsigned nsops)
 
 		tmp = sem_lock(semid);
 		if(tmp==NULL) {
-			if(queue.status != -EIDRM)
+			if(queue.prev != NULL)
 				BUG();
 			current->semsleeping = NULL;
 			error = -EIDRM;
diff --git a/ipc/shm.c b/ipc/shm.c
index 71e22cd58..b6558a8b5 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -16,7 +16,7 @@
  */
 
 #include <linux/config.h>
-#include <linux/malloc.h>
+#include <linux/slab.h>
 #include <linux/shm.h>
 #include <linux/init.h>
 #include <linux/file.h>
diff --git a/ipc/util.c b/ipc/util.c
index 6e1158be2..85d7a65b2 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -17,7 +17,7 @@
 #include <linux/msg.h>
 #include <linux/smp_lock.h>
 #include <linux/vmalloc.h>
-#include <linux/malloc.h>
+#include <linux/slab.h>
 #include <linux/highuid.h>
 
 #if defined(CONFIG_SYSVIPC)
@@ -185,7 +185,7 @@ struct kern_ipc_perm* ipc_rmid(struct ipc_ids* ids, int id)
 {
 	struct kern_ipc_perm* p;
 	int lid = id % SEQ_MULTIPLIER;
-	if(lid > ids->size)
+	if(lid >= ids->size)
 		BUG();
 	p = ids->entries[lid].p;
 	ids->entries[lid].p = NULL;
diff --git a/ipc/util.h b/ipc/util.h
index ff4bfb0fc..f05f6c213 100644
--- a/ipc/util.h
+++ b/ipc/util.h
@@ -54,7 +54,7 @@ extern inline struct kern_ipc_perm* ipc_get(struct ipc_ids* ids, int id)
 {
 	struct kern_ipc_perm* out;
 	int lid = id % SEQ_MULTIPLIER;
-	if(lid > ids->size)
+	if(lid >= ids->size)
 		return NULL;
 
 	out = ids->entries[lid].p;
@@ -69,7 +69,7 @@ extern inline struct kern_ipc_perm* ipc_lock(struct ipc_ids* ids, int id)
 {
 	struct kern_ipc_perm* out;
 	int lid = id % SEQ_MULTIPLIER;
-	if(lid > ids->size)
+	if(lid >= ids->size)
 		return NULL;
 
 	spin_lock(&ids->ary);