2 files changed, 9 insertions, 11 deletions

diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index a93c0f99acf7..1f59ea051bab 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -533,11 +533,12 @@ __clear_user(void __user *addr, unsigned long n)
 
 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        if (access_ok(VERIFY_READ, from, n))
-                n = __copy_from_user(to, from, n);
-        else /* security hole - plug it */
-                memset(to, 0, n);
-        return n;
+        unsigned long res = n;
+        if (likely(access_ok(VERIFY_READ, from, n)))
+                res = __copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
index 1512bebfbf1b..7a4b06049001 100644
--- a/arch/arm/lib/copy_from_user.S
+++ b/arch/arm/lib/copy_from_user.S
@@ -98,12 +98,9 @@ ENDPROC(arm_copy_from_user)
         .pushsection .fixup,"ax"
         .align 0
         copy_abort_preamble
-        ldmfd   sp!, {r1, r2}
-        sub     r3, r0, r1
-        rsb     r1, r3, r2
-        str     r1, [sp]
-        bl      __memzero
-        ldr     r0, [sp], #4
+        ldmfd   sp!, {r1, r2, r3}
+        sub     r0, r0, r1
+        rsb     r0, r0, r2
         copy_abort_end
         .popsection