diff --git a/ChangeLog b/ChangeLog
index 28e45be978..0f84b8c171 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2006-12-09  Jakub Jelinek  <jakub@redhat.com>
+
+	* misc/mntent_r.c (__hasmntopt): Check p[optlen] even when p == rest.
+	Start searching for next comma at p rather than rest.
+	* misc/Makefile (tests): Add tst-mntent2.
+	* misc/tst-mntent2.c: New test.
+
+	* misc/getusershell.c (initshells): Check for integer overflows.
+	Make strings buffer one bigger as fgets always succeeds when second
+	argument is 1.  Don't use calloc for shells array.  Disallow
+	/ as shell.
+
 2006-12-08  Ulrich Drepper  <drepper@redhat.com>
 
 	* malloc/memusage.c: Handle realloc with new size of zero and
diff --git a/nptl/ChangeLog b/nptl/ChangeLog
index 20f530077a..510693de6f 100644
--- a/nptl/ChangeLog
+++ b/nptl/ChangeLog
@@ -1,3 +1,12 @@
+2006-12-06  Jakub Jelinek  <jakub@redhat.com>
+
+	* sysdeps/unix/sysv/linux/s390/s390-32/sysdep-cancel.h (PSEUDO): Handle
+	6 argument cancellable syscalls.
+	(STM_6, LM_6, LR7_0, LR7_1, LR7_2, LR7_3, LR7_4, LR7_5, LR7_6): Define.
+	* sysdeps/unix/sysv/linux/s390/s390-64/sysdep-cancel.h (PSEUDO): Handle
+	6 argument cancellable syscalls.
+	(STM_6, LM_6, LR7_0, LR7_1, LR7_2, LR7_3, LR7_4, LR7_5, LR7_6): Define.
+
 2006-12-09  Ulrich Drepper  <drepper@redhat.com>
 
 	* sysdeps/unix/sysv/linux/rtld-lowlevel.h
diff --git a/nptl/sysdeps/unix/sysv/linux/s390/s390-32/sysdep-cancel.h b/nptl/sysdeps/unix/sysv/linux/s390/s390-32/sysdep-cancel.h
index 17ab562daa..6b0240243a 100644
--- a/nptl/sysdeps/unix/sysv/linux/s390/s390-32/sysdep-cancel.h
+++ b/nptl/sysdeps/unix/sysv/linux/s390/s390-32/sysdep-cancel.h
@@ -45,7 +45,13 @@ L(pseudo_cancel):							      \
 	bas	%r14,0(%r1,%r13);					      \
 	lr	%r0,%r2;						      \
 	LM_##args							      \
-	DO_CALL(syscall_name, args);					      \
+	.if SYS_ify (syscall_name) < 256;				      \
+	svc SYS_ify (syscall_name);					      \
+	.else;								      \
+	lhi %r1,SYS_ify (syscall_name);					      \
+	svc 0;								      \
+	.endif;								      \
+	LR7_##args							      \
 	l	%r1,2f-0b(%r13);					      \
 	lr	%r12,%r2;						      \
 	lr	%r2,%r0;						      \
@@ -89,6 +95,7 @@ L(pseudo_end):
 #define STM_3		stm %r2,%r4,8(%r15);
 #define STM_4		stm %r2,%r5,8(%r15);
 #define STM_5		stm %r2,%r5,8(%r15);
+#define STM_6		stm %r2,%r7,8(%r15);
 
 #define LM_0		/* Nothing */
 #define LM_1		l %r2,8+96(%r15);
@@ -96,6 +103,18 @@ L(pseudo_end):
 #define LM_3		lm %r2,%r4,8+96(%r15);
 #define LM_4		lm %r2,%r5,8+96(%r15);
 #define LM_5		lm %r2,%r5,8+96(%r15);
+#define LM_6		lm %r2,%r5,8+96(%r15); \
+			cfi_offset (%r7, -68); \
+			l %r7,96+96(%r15);
+
+#define LR7_0		/* Nothing */
+#define LR7_1		/* Nothing */
+#define LR7_2		/* Nothing */
+#define LR7_3		/* Nothing */
+#define LR7_4		/* Nothing */
+#define LR7_5		/* Nothing */
+#define LR7_6		l %r7,28+96(%r15); \
+			cfi_restore (%r7);
 
 # ifndef __ASSEMBLER__
 #  define SINGLE_THREAD_P \
diff --git a/nptl/sysdeps/unix/sysv/linux/s390/s390-64/sysdep-cancel.h b/nptl/sysdeps/unix/sysv/linux/s390/s390-64/sysdep-cancel.h
index 77ce742495..70d5a86429 100644
--- a/nptl/sysdeps/unix/sysv/linux/s390/s390-64/sysdep-cancel.h
+++ b/nptl/sysdeps/unix/sysv/linux/s390/s390-64/sysdep-cancel.h
@@ -42,7 +42,13 @@ L(pseudo_cancel):							      \
 	brasl	%r14,CENABLE;						      \
 	lgr	%r0,%r2;						      \
 	LM_##args							      \
-	DO_CALL(syscall_name, args);					      \
+	.if SYS_ify (syscall_name) < 256;				      \
+	svc SYS_ify (syscall_name);					      \
+	.else;								      \
+	lghi %r1,SYS_ify (syscall_name);				      \
+	svc 0;								      \
+	.endif;								      \
+	LR7_##args							      \
 	lgr	%r13,%r2;						      \
 	lgr	%r2,%r0;						      \
 	brasl	%r14,CDISABLE;						      \
@@ -85,6 +91,7 @@ L(pseudo_end):
 #define STM_3		stmg %r2,%r4,16(%r15);
 #define STM_4		stmg %r2,%r5,16(%r15);
 #define STM_5		stmg %r2,%r5,16(%r15);
+#define STM_6		stmg %r2,%r7,16(%r15);
 
 #define LM_0		/* Nothing */
 #define LM_1		lg %r2,16+160(%r15);
@@ -92,6 +99,18 @@ L(pseudo_end):
 #define LM_3		lmg %r2,%r4,16+160(%r15);
 #define LM_4		lmg %r2,%r5,16+160(%r15);
 #define LM_5		lmg %r2,%r5,16+160(%r15);
+#define LM_6		lmg %r2,%r5,16+160(%r15); \
+			cfi_offset (%r7, -104); \
+			lg %r7,160+160(%r15);
+
+#define LR7_0		/* Nothing */
+#define LR7_1		/* Nothing */
+#define LR7_2		/* Nothing */
+#define LR7_3		/* Nothing */
+#define LR7_4		/* Nothing */
+#define LR7_5		/* Nothing */
+#define LR7_6		lg %r7,56+160(%r15); \
+			cfi_restore (%r7);
 
 # if defined IS_IN_libpthread || !defined NOT_IN_libc
 #  ifndef __ASSEMBLER__