Merge branch 'work.misc-set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull misc user access cleanups from Al Viro:
 "The first pile is assorted getting rid of cargo-culted access_ok(),
  cargo-culted set_fs() and field-by-field copyouts.

  The same description applies to a lot of stuff in other branches -
  this is just the stuff that didn't fit into a more specific topical
  branch"

* 'work.misc-set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  Switch flock copyin/copyout primitives to copy_{from,to}_user()
  fs/fcntl: return -ESRCH in f_setown when pid/pgid can't be found
  fs/fcntl: f_setown, avoid undefined behaviour
  fs/fcntl: f_setown, allow returning error
  lpfc debugfs: get rid of pointless access_ok()
  adb: get rid of pointless access_ok()
  isdn: get rid of pointless access_ok()
  compat statfs: switch to copy_to_user()
  fs/locks: don't mess with the address limit in compat_fcntl64
  nfsd_readlink(): switch to vfs_get_link()
  drbd: ->sendpage() never needed set_fs()
  fs/locks: pass kernel struct flock to fcntl_getlk/setlk
  fs: locks: Fix some troubles at kernel-doc comments

12 files changed, 220 insertions, 271 deletions

diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 5fb99e06ebe4..e2ed28d45ce1 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1551,7 +1551,6 @@ static int _drbd_send_page(struct drbd_peer_device *peer_device, struct page *pa
                     int offset, size_t size, unsigned msg_flags)
 {
         struct socket *socket = peer_device->connection->data.socket;
-        mm_segment_t oldfs = get_fs();
         int len = size;
         int err = -EIO;
 
@@ -1566,7 +1565,6 @@ static int _drbd_send_page(struct drbd_peer_device *peer_device, struct page *pa
 
         msg_flags |= MSG_NOSIGNAL;
         drbd_update_congested(peer_device->connection);
-        set_fs(KERNEL_DS);
         do {
                 int sent;
 
@@ -1586,7 +1584,6 @@ static int _drbd_send_page(struct drbd_peer_device *peer_device, struct page *pa
                 len    -= sent;
                 offset += sent;
         } while (len > 0 /* THINK && device->cstate >= C_CONNECTED*/);
-        set_fs(oldfs);
         clear_bit(NET_CONGESTED, &peer_device->connection->flags);
 
         if (len == 0) {
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 9b856e1890d1..89b09c51ab7c 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1304,9 +1304,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                         if (arg) {
                                 ulong __user *p = argp;
                                 int i;
-                                if (!access_ok(VERIFY_WRITE, p,
-                                               sizeof(ulong) * ISDN_MAX_CHANNELS * 2))
-                                        return -EFAULT;
                                 for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
                                         put_user(dev->ibytes[i], p++);
                                         put_user(dev->obytes[i], p++);
@@ -1540,11 +1537,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                                 char __user *p = argp;
                                 int i;
 
-                                if (!access_ok(VERIFY_WRITE, argp,
-                                               (ISDN_MODEM_NUMREG + ISDN_MSNLEN + ISDN_LMSNLEN)
-                                               * ISDN_MAX_CHANNELS))
-                                        return -EFAULT;
-
                                 for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
                                         if (copy_to_user(p, dev->mdm.info[i].emu.profile,
                                                          ISDN_MODEM_NUMREG))
@@ -1567,11 +1559,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                                 char __user *p = argp;
                                 int i;
 
-                                if (!access_ok(VERIFY_READ, argp,
-                                               (ISDN_MODEM_NUMREG + ISDN_MSNLEN + ISDN_LMSNLEN)
-                                               * ISDN_MAX_CHANNELS))
-                                        return -EFAULT;
-
                                 for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
                                         if (copy_from_user(dev->mdm.info[i].emu.profile, p,
                                                            ISDN_MODEM_NUMREG))
@@ -1617,8 +1604,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                                                 int j = 0;
 
                                                 while (1) {
-                                                        if (!access_ok(VERIFY_READ, p, 1))
-                                                                return -EFAULT;
                                                         get_user(bname[j], p++);
                                                         switch (bname[j]) {
                                                         case '\0':
@@ -1685,9 +1670,6 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
                                         drvidx = 0;
                                 if (drvidx == -1)
                                         return -ENODEV;
-                                if (!access_ok(VERIFY_WRITE, argp,
-                                               sizeof(isdn_ioctl_struct)))
-                                        return -EFAULT;
                                 c.driver = drvidx;
                                 c.command = ISDN_CMD_IOCTL;
                                 c.arg = cmd;
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 88e5a025cea7..6c44609fd83a 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -795,9 +795,6 @@ isdn_ppp_read(int min, struct file *file, char __user *buf, int count)
         if (!(is->state & IPPP_OPEN))
                 return 0;
 
-        if (!access_ok(VERIFY_WRITE, buf, count))
-                return -EFAULT;
-
         spin_lock_irqsave(&is->buflock, flags);
         b = is->first->next;
         save_buf = b->buf;
@@ -2014,9 +2011,6 @@ isdn_ppp_dev_ioctl_stats(int slot, struct ifreq *ifr, struct net_device *dev)
         struct ppp_stats t;
         isdn_net_local *lp = netdev_priv(dev);
 
-        if (!access_ok(VERIFY_WRITE, res, sizeof(struct ppp_stats)))
-                return -EFAULT;
-
         /* build a temporary stat struct and copy it to user space */
 
         memset(&t, 0, sizeof(struct ppp_stats));
diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index 7ac7badb8f55..6ffd13466b8c 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -1142,8 +1142,6 @@ isdnloop_command(isdn_ctrl *c, isdnloop_card *card)
                 case ISDNLOOP_IOCTL_DEBUGVAR:
                         return (ulong) card;
                 case ISDNLOOP_IOCTL_STARTUP:
-                        if (!access_ok(VERIFY_READ, (void *) a, sizeof(isdnloop_sdef)))
-                                return -EFAULT;
                         return isdnloop_start(card, (isdnloop_sdef *) a);
                         break;
                 case ISDNLOOP_IOCTL_ADDCARD:
diff --git a/drivers/macintosh/adb.c b/drivers/macintosh/adb.c
index fee939efc4fc..039dc8285fc5 100644
--- a/drivers/macintosh/adb.c
+++ b/drivers/macintosh/adb.c
@@ -723,8 +723,6 @@ static ssize_t adb_read(struct file *file, char __user *buf,
                 return -EINVAL;
         if (count > sizeof(req->reply))
                 count = sizeof(req->reply);
-        if (!access_ok(VERIFY_WRITE, buf, count))
-                return -EFAULT;
 
         req = NULL;
         spin_lock_irqsave(&state->lock, flags);
@@ -781,8 +779,6 @@ static ssize_t adb_write(struct file *file, const char __user *buf,
                 return -EINVAL;
         if (adb_controller == NULL)
                 return -ENXIO;
-        if (!access_ok(VERIFY_READ, buf, count))
-                return -EFAULT;
 
         req = kmalloc(sizeof(struct adb_request),
                                              GFP_KERNEL);
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 4bcb92c844ca..89afa7813e5a 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -1949,10 +1949,6 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
         if (nbytes > 64)
                 nbytes = 64;
 
-        /* Protect copy from user */
-        if (!access_ok(VERIFY_READ, buf, nbytes))
-                return -EFAULT;
-
         memset(mybuf, 0, sizeof(mybuf));
 
         if (copy_from_user(mybuf, buf, nbytes))
@@ -2037,10 +2033,6 @@ lpfc_debugfs_nvmektime_write(struct file *file, const char __user *buf,
         if (nbytes > 64)
                 nbytes = 64;
 
-        /* Protect copy from user */
-        if (!access_ok(VERIFY_READ, buf, nbytes))
-                return -EFAULT;
-
         memset(mybuf, 0, sizeof(mybuf));
 
         if (copy_from_user(mybuf, buf, nbytes))
@@ -2169,10 +2161,6 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf,
         if (nbytes > 64)
                 nbytes = 64;
 
-        /* Protect copy from user */
-        if (!access_ok(VERIFY_READ, buf, nbytes))
-                return -EFAULT;
-
         memset(mybuf, 0, sizeof(mybuf));
 
         if (copy_from_user(mybuf, buf, nbytes))
@@ -2280,10 +2268,6 @@ lpfc_debugfs_cpucheck_write(struct file *file, const char __user *buf,
         if (nbytes > 64)
                 nbytes = 64;
 
-        /* Protect copy from user */
-        if (!access_ok(VERIFY_READ, buf, nbytes))
-                return -EFAULT;
-
         memset(mybuf, 0, sizeof(mybuf));
 
         if (copy_from_user(mybuf, buf, nbytes))
@@ -2354,10 +2338,6 @@ static int lpfc_idiag_cmd_get(const char __user *buf, size_t nbytes,
         int i;
         size_t bsize;
 
-        /* Protect copy from user */
-        if (!access_ok(VERIFY_READ, buf, nbytes))
-                return -EFAULT;
-
         memset(mybuf, 0, sizeof(mybuf));
         memset(idiag_cmd, 0, sizeof(*idiag_cmd));
         bsize = min(nbytes, (sizeof(mybuf)-1));
diff --git a/fs/fcntl.c b/fs/fcntl.c
index ed051f825bad..b6bd89628025 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -109,20 +109,34 @@ void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
 }
 EXPORT_SYMBOL(__f_setown);
 
-void f_setown(struct file *filp, unsigned long arg, int force)
+int f_setown(struct file *filp, unsigned long arg, int force)
 {
         enum pid_type type;
-        struct pid *pid;
-        int who = arg;
+        struct pid *pid = NULL;
+        int who = arg, ret = 0;
+
         type = PIDTYPE_PID;
         if (who < 0) {
+                /* avoid overflow below */
+                if (who == INT_MIN)
+                        return -EINVAL;
+
                 type = PIDTYPE_PGID;
                 who = -who;
         }
+
         rcu_read_lock();
-        pid = find_vpid(who);
-        __f_setown(filp, pid, type, force);
+        if (who) {
+                pid = find_vpid(who);
+                if (!pid)
+                        ret = -ESRCH;
+        }
+
+        if (!ret)
+                __f_setown(filp, pid, type, force);
         rcu_read_unlock();
+
+        return ret;
 }
 EXPORT_SYMBOL(f_setown);
 
@@ -307,6 +321,8 @@ static long fcntl_rw_hint(struct file *file, unsigned int cmd,
 static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
                 struct file *filp)
 {
+        void __user *argp = (void __user *)arg;
+        struct flock flock;
         long err = -EINVAL;
 
         switch (cmd) {
@@ -334,7 +350,11 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
         case F_OFD_GETLK:
 #endif
         case F_GETLK:
-                err = fcntl_getlk(filp, cmd, (struct flock __user *) arg);
+                if (copy_from_user(&flock, argp, sizeof(flock)))
+                        return -EFAULT;
+                err = fcntl_getlk(filp, cmd, &flock);
+                if (!err && copy_to_user(argp, &flock, sizeof(flock)))
+                        return -EFAULT;
                 break;
 #if BITS_PER_LONG != 32
         /* 32-bit arches must use fcntl64() */
@@ -344,7 +364,9 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
                 /* Fallthrough */
         case F_SETLK:
         case F_SETLKW:
-                err = fcntl_setlk(fd, filp, cmd, (struct flock __user *) arg);
+                if (copy_from_user(&flock, argp, sizeof(flock)))
+                        return -EFAULT;
+                err = fcntl_setlk(fd, filp, cmd, &flock);
                 break;
         case F_GETOWN:
                 /*
@@ -358,8 +380,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
                 force_successful_syscall_return();
                 break;
         case F_SETOWN:
-                f_setown(filp, arg, 1);
-                err = 0;
+                err = f_setown(filp, arg, 1);
                 break;
         case F_GETOWN_EX:
                 err = f_getown_ex(filp, arg);
@@ -450,7 +471,9 @@ out:
 SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
                 unsigned long, arg)
 {       
+        void __user *argp = (void __user *)arg;
         struct fd f = fdget_raw(fd);
+        struct flock64 flock;
         long err = -EBADF;
 
         if (!f.file)
@@ -468,14 +491,21 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
         switch (cmd) {
         case F_GETLK64:
         case F_OFD_GETLK:
-                err = fcntl_getlk64(f.file, cmd, (struct flock64 __user *) arg);
+                err = -EFAULT;
+                if (copy_from_user(&flock, argp, sizeof(flock)))
+                        break;
+                err = fcntl_getlk64(f.file, cmd, &flock);
+                if (!err && copy_to_user(argp, &flock, sizeof(flock)))
+                        err = -EFAULT;
                 break;
         case F_SETLK64:
         case F_SETLKW64:
         case F_OFD_SETLK:
         case F_OFD_SETLKW:
-                err = fcntl_setlk64(fd, f.file, cmd,
-                                (struct flock64 __user *) arg);
+                err = -EFAULT;
+                if (copy_from_user(&flock, argp, sizeof(flock)))
+                        break;
+                err = fcntl_setlk64(fd, f.file, cmd, &flock);
                 break;
         default:
                 err = do_fcntl(fd, cmd, arg, f.file);
@@ -489,57 +519,56 @@ out:
 #endif
 
 #ifdef CONFIG_COMPAT
+/* careful - don't use anywhere else */
+#define copy_flock_fields(from, to)             \
+        (to).l_type = (from).l_type;            \
+        (to).l_whence = (from).l_whence;        \
+        (to).l_start = (from).l_start;          \
+        (to).l_len = (from).l_len;              \
+        (to).l_pid = (from).l_pid;
+
 static int get_compat_flock(struct flock *kfl, struct compat_flock __user *ufl)
 {
-        if (!access_ok(VERIFY_READ, ufl, sizeof(*ufl)) ||
-            __get_user(kfl->l_type, &ufl->l_type) ||
-            __get_user(kfl->l_whence, &ufl->l_whence) ||
-            __get_user(kfl->l_start, &ufl->l_start) ||
-            __get_user(kfl->l_len, &ufl->l_len) ||
-            __get_user(kfl->l_pid, &ufl->l_pid))
+        struct compat_flock fl;
+
+        if (copy_from_user(&fl, ufl, sizeof(struct compat_flock)))
                 return -EFAULT;
+        copy_flock_fields(*kfl, fl);
         return 0;
 }
 
-static int put_compat_flock(struct flock *kfl, struct compat_flock __user *ufl)
+static int get_compat_flock64(struct flock *kfl, struct compat_flock64 __user *ufl)
 {
-        if (!access_ok(VERIFY_WRITE, ufl, sizeof(*ufl)) ||
-            __put_user(kfl->l_type, &ufl->l_type) ||
-            __put_user(kfl->l_whence, &ufl->l_whence) ||
-            __put_user(kfl->l_start, &ufl->l_start) ||
-            __put_user(kfl->l_len, &ufl->l_len) ||
-            __put_user(kfl->l_pid, &ufl->l_pid))
+        struct compat_flock64 fl;
+
+        if (copy_from_user(&fl, ufl, sizeof(struct compat_flock64)))
                 return -EFAULT;
+        copy_flock_fields(*kfl, fl);
         return 0;
 }
 
-#ifndef HAVE_ARCH_GET_COMPAT_FLOCK64
-static int get_compat_flock64(struct flock *kfl, struct compat_flock64 __user *ufl)
+static int put_compat_flock(struct flock *kfl, struct compat_flock __user *ufl)
 {
-        if (!access_ok(VERIFY_READ, ufl, sizeof(*ufl)) ||
-            __get_user(kfl->l_type, &ufl->l_type) ||
-            __get_user(kfl->l_whence, &ufl->l_whence) ||
-            __get_user(kfl->l_start, &ufl->l_start) ||
-            __get_user(kfl->l_len, &ufl->l_len) ||
-            __get_user(kfl->l_pid, &ufl->l_pid))
+        struct compat_flock fl;
+
+        memset(&fl, 0, sizeof(struct compat_flock));
+        copy_flock_fields(fl, *kfl);
+        if (copy_to_user(ufl, &fl, sizeof(struct compat_flock)))
                 return -EFAULT;
         return 0;
 }
-#endif
 
-#ifndef HAVE_ARCH_PUT_COMPAT_FLOCK64
 static int put_compat_flock64(struct flock *kfl, struct compat_flock64 __user *ufl)
 {
-        if (!access_ok(VERIFY_WRITE, ufl, sizeof(*ufl)) ||
-            __put_user(kfl->l_type, &ufl->l_type) ||
-            __put_user(kfl->l_whence, &ufl->l_whence) ||
-            __put_user(kfl->l_start, &ufl->l_start) ||
-            __put_user(kfl->l_len, &ufl->l_len) ||
-            __put_user(kfl->l_pid, &ufl->l_pid))
+        struct compat_flock64 fl;
+
+        memset(&fl, 0, sizeof(struct compat_flock64));
+        copy_flock_fields(fl, *kfl);
+        if (copy_to_user(ufl, &fl, sizeof(struct compat_flock64)))
                 return -EFAULT;
         return 0;
 }
-#endif
+#undef copy_flock_fields
 
 static unsigned int
 convert_fcntl_cmd(unsigned int cmd)
@@ -556,76 +585,92 @@ convert_fcntl_cmd(unsigned int cmd)
         return cmd;
 }
 
+/*
+ * GETLK was successful and we need to return the data, but it needs to fit in
+ * the compat structure.
+ * l_start shouldn't be too big, unless the original start + end is greater than
+ * COMPAT_OFF_T_MAX, in which case the app was asking for trouble, so we return
+ * -EOVERFLOW in that case.  l_len could be too big, in which case we just
+ * truncate it, and only allow the app to see that part of the conflicting lock
+ * that might make sense to it anyway
+ */
+static int fixup_compat_flock(struct flock *flock)
+{
+        if (flock->l_start > COMPAT_OFF_T_MAX)
+                return -EOVERFLOW;
+        if (flock->l_len > COMPAT_OFF_T_MAX)
+                flock->l_len = COMPAT_OFF_T_MAX;
+        return 0;
+}
+
 COMPAT_SYSCALL_DEFINE3(fcntl64, unsigned int, fd, unsigned int, cmd,
                        compat_ulong_t, arg)
 {
-        mm_segment_t old_fs;
-        struct flock f;
-        long ret;
-        unsigned int conv_cmd;
+        struct fd f = fdget_raw(fd);
+        struct flock flock;
+        long err = -EBADF;
+
+        if (!f.file)
+                return err;
+
+        if (unlikely(f.file->f_mode & FMODE_PATH)) {
+                if (!check_fcntl_cmd(cmd))
+                        goto out_put;
+        }
+
+        err = security_file_fcntl(f.file, cmd, arg);
+        if (err)
+                goto out_put;
 
         switch (cmd) {
         case F_GETLK:
+                err = get_compat_flock(&flock, compat_ptr(arg));
+                if (err)
+                        break;
+                err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
+                if (err)
+                        break;
+                err = fixup_compat_flock(&flock);
+                if (err)
+                        return err;
+                err = put_compat_flock(&flock, compat_ptr(arg));
+                break;
+        case F_GETLK64:
+        case F_OFD_GETLK:
+                err = get_compat_flock64(&flock, compat_ptr(arg));
+                if (err)
+                        break;
+                err = fcntl_getlk(f.file, convert_fcntl_cmd(cmd), &flock);
+                if (err)
+                        break;
+                err = fixup_compat_flock(&flock);
+                if (err)
+                        return err;
+                err = put_compat_flock64(&flock, compat_ptr(arg));
+                break;
         case F_SETLK:
         case F_SETLKW:
-                ret = get_compat_flock(&f, compat_ptr(arg));
-                if (ret != 0)
+                err = get_compat_flock(&flock, compat_ptr(arg));
+                if (err)
                         break;
-                old_fs = get_fs();
-                set_fs(KERNEL_DS);
-                ret = sys_fcntl(fd, cmd, (unsigned long)&f);
-                set_fs(old_fs);
-                if (cmd == F_GETLK && ret == 0) {
-                        /* GETLK was successful and we need to return the data...
-                         * but it needs to fit in the compat structure.
-                         * l_start shouldn't be too big, unless the original
-                         * start + end is greater than COMPAT_OFF_T_MAX, in which
-                         * case the app was asking for trouble, so we return
-                         * -EOVERFLOW in that case.
-                         * l_len could be too big, in which case we just truncate it,
-                         * and only allow the app to see that part of the conflicting
-                         * lock that might make sense to it anyway
-                         */
-
-                        if (f.l_start > COMPAT_OFF_T_MAX)
-                                ret = -EOVERFLOW;
-                        if (f.l_len > COMPAT_OFF_T_MAX)
-                                f.l_len = COMPAT_OFF_T_MAX;
-                        if (ret == 0)
-                                ret = put_compat_flock(&f, compat_ptr(arg));
-                }
+                err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
                 break;
-
-        case F_GETLK64:
         case F_SETLK64:
         case F_SETLKW64:
-        case F_OFD_GETLK:
         case F_OFD_SETLK:
         case F_OFD_SETLKW:
-                ret = get_compat_flock64(&f, compat_ptr(arg));
-                if (ret != 0)
+                err = get_compat_flock64(&flock, compat_ptr(arg));
+                if (err)
                         break;
-                old_fs = get_fs();
-                set_fs(KERNEL_DS);
-                conv_cmd = convert_fcntl_cmd(cmd);
-                ret = sys_fcntl(fd, conv_cmd, (unsigned long)&f);
-                set_fs(old_fs);
-                if ((conv_cmd == F_GETLK || conv_cmd == F_OFD_GETLK) && ret == 0) {
-                        /* need to return lock information - see above for commentary */
-                        if (f.l_start > COMPAT_LOFF_T_MAX)
-                                ret = -EOVERFLOW;
-                        if (f.l_len > COMPAT_LOFF_T_MAX)
-                                f.l_len = COMPAT_LOFF_T_MAX;
-                        if (ret == 0)
-                                ret = put_compat_flock64(&f, compat_ptr(arg));
-                }
+                err = fcntl_setlk(fd, f.file, convert_fcntl_cmd(cmd), &flock);
                 break;
-
         default:
-                ret = sys_fcntl(fd, cmd, arg);
+                err = do_fcntl(fd, cmd, arg, f.file);
                 break;
         }
-        return ret;
+out_put:
+        fdput(f);
+        return err;
 }
 
 COMPAT_SYSCALL_DEFINE3(fcntl, unsigned int, fd, unsigned int, cmd,
diff --git a/fs/locks.c b/fs/locks.c
index af2031a1fcff..afefeb4ad6de 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1858,8 +1858,8 @@ EXPORT_SYMBOL(generic_setlease);
  *
  * Call this to establish a lease on the file. The "lease" argument is not
  * used for F_UNLCK requests and may be NULL. For commands that set or alter
- * an existing lease, the (*lease)->fl_lmops->lm_break operation must be set;
- * if not, this function will return -ENOLCK (and generate a scary-looking
+ * an existing lease, the ``(*lease)->fl_lmops->lm_break`` operation must be
+ * set; if not, this function will return -ENOLCK (and generate a scary-looking
  * stack trace).
  *
  * The "priv" pointer is passed directly to the lm_setup function as-is. It
@@ -1972,15 +1972,13 @@ EXPORT_SYMBOL(locks_lock_inode_wait);
  *      @cmd: the type of lock to apply.
  *
  *      Apply a %FL_FLOCK style lock to an open file descriptor.
- *      The @cmd can be one of
+ *      The @cmd can be one of:
  *
- *      %LOCK_SH -- a shared lock.
- *
- *      %LOCK_EX -- an exclusive lock.
- *
- *      %LOCK_UN -- remove an existing lock.
- *
- *      %LOCK_MAND -- a `mandatory' flock.  This exists to emulate Windows Share Modes.
+ *      - %LOCK_SH -- a shared lock.
+ *      - %LOCK_EX -- an exclusive lock.
+ *      - %LOCK_UN -- remove an existing lock.
+ *      - %LOCK_MAND -- a 'mandatory' flock.
+ *        This exists to emulate Windows Share Modes.
  *
  *      %LOCK_MAND can be combined with %LOCK_READ or %LOCK_WRITE to allow other
  *      processes read and write access respectively.
@@ -2086,26 +2084,22 @@ static void posix_lock_to_flock64(struct flock64 *flock, struct file_lock *fl)
 /* Report the first existing lock that would conflict with l.
  * This implements the F_GETLK command of fcntl().
  */
-int fcntl_getlk(struct file *filp, unsigned int cmd, struct flock __user *l)
+int fcntl_getlk(struct file *filp, unsigned int cmd, struct flock *flock)
 {
         struct file_lock file_lock;
-        struct flock flock;
         int error;
 
-        error = -EFAULT;
-        if (copy_from_user(&flock, l, sizeof(flock)))
-                goto out;
         error = -EINVAL;
-        if ((flock.l_type != F_RDLCK) && (flock.l_type != F_WRLCK))
+        if (flock->l_type != F_RDLCK && flock->l_type != F_WRLCK)
                 goto out;
 
-        error = flock_to_posix_lock(filp, &file_lock, &flock);
+        error = flock_to_posix_lock(filp, &file_lock, flock);
         if (error)
                 goto out;
 
         if (cmd == F_OFD_GETLK) {
                 error = -EINVAL;
-                if (flock.l_pid != 0)
+                if (flock->l_pid != 0)
                         goto out;
 
                 cmd = F_GETLK;
@@ -2117,15 +2111,12 @@ int fcntl_getlk(struct file *filp, unsigned int cmd, struct flock __user *l)
         if (error)
                 goto out;
  
-        flock.l_type = file_lock.fl_type;
+        flock->l_type = file_lock.fl_type;
         if (file_lock.fl_type != F_UNLCK) {
-                error = posix_lock_to_flock(&flock, &file_lock);
+                error = posix_lock_to_flock(flock, &file_lock);
                 if (error)
                         goto rel_priv;
         }
-        error = -EFAULT;
-        if (!copy_to_user(l, &flock, sizeof(flock)))
-                error = 0;
 rel_priv:
         locks_release_private(&file_lock);
 out:
@@ -2218,26 +2209,16 @@ check_fmode_for_setlk(struct file_lock *fl)
  * This implements both the F_SETLK and F_SETLKW commands of fcntl().
  */
 int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
-                struct flock __user *l)
+                struct flock *flock)
 {
         struct file_lock *file_lock = locks_alloc_lock();
-        struct flock flock;
-        struct inode *inode;
+        struct inode *inode = locks_inode(filp);
         struct file *f;
         int error;
 
         if (file_lock == NULL)
                 return -ENOLCK;
 
-        inode = locks_inode(filp);
-
-        /*
-         * This might block, so we do it before checking the inode.
-         */
-        error = -EFAULT;
-        if (copy_from_user(&flock, l, sizeof(flock)))
-                goto out;
-
         /* Don't allow mandatory locks on files that may be memory mapped
          * and shared.
          */
@@ -2246,7 +2227,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
                 goto out;
         }
 
-        error = flock_to_posix_lock(filp, file_lock, &flock);
+        error = flock_to_posix_lock(filp, file_lock, flock);
         if (error)
                 goto out;
 
@@ -2261,7 +2242,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
         switch (cmd) {
         case F_OFD_SETLK:
                 error = -EINVAL;
-                if (flock.l_pid != 0)
+                if (flock->l_pid != 0)
                         goto out;
 
                 cmd = F_SETLK;
@@ -2270,7 +2251,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
                 break;
         case F_OFD_SETLKW:
                 error = -EINVAL;
-                if (flock.l_pid != 0)
+                if (flock->l_pid != 0)
                         goto out;
 
                 cmd = F_SETLKW;
@@ -2315,26 +2296,22 @@ out:
 /* Report the first existing lock that would conflict with l.
  * This implements the F_GETLK command of fcntl().
  */
-int fcntl_getlk64(struct file *filp, unsigned int cmd, struct flock64 __user *l)
+int fcntl_getlk64(struct file *filp, unsigned int cmd, struct flock64 *flock)
 {
         struct file_lock file_lock;
-        struct flock64 flock;
         int error;
 
-        error = -EFAULT;
-        if (copy_from_user(&flock, l, sizeof(flock)))
-                goto out;
         error = -EINVAL;
-        if ((flock.l_type != F_RDLCK) && (flock.l_type != F_WRLCK))
+        if (flock->l_type != F_RDLCK && flock->l_type != F_WRLCK)
                 goto out;
 
-        error = flock64_to_posix_lock(filp, &file_lock, &flock);
+        error = flock64_to_posix_lock(filp, &file_lock, flock);
         if (error)
                 goto out;
 
         if (cmd == F_OFD_GETLK) {
                 error = -EINVAL;
-                if (flock.l_pid != 0)
+                if (flock->l_pid != 0)
                         goto out;
 
                 cmd = F_GETLK64;
@@ -2346,13 +2323,9 @@ int fcntl_getlk64(struct file *filp, unsigned int cmd, struct flock64 __user *l)
         if (error)
                 goto out;
 
-        flock.l_type = file_lock.fl_type;
+        flock->l_type = file_lock.fl_type;
         if (file_lock.fl_type != F_UNLCK)
-                posix_lock_to_flock64(&flock, &file_lock);
-
-        error = -EFAULT;
-        if (!copy_to_user(l, &flock, sizeof(flock)))
-                error = 0;
+                posix_lock_to_flock64(flock, &file_lock);
 
         locks_release_private(&file_lock);
 out:
@@ -2363,26 +2336,16 @@ out:
  * This implements both the F_SETLK and F_SETLKW commands of fcntl().
  */
 int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
-                struct flock64 __user *l)
+                struct flock64 *flock)
 {
         struct file_lock *file_lock = locks_alloc_lock();
-        struct flock64 flock;
-        struct inode *inode;
+        struct inode *inode = locks_inode(filp);
         struct file *f;
         int error;
 
         if (file_lock == NULL)
                 return -ENOLCK;
 
-        /*
-         * This might block, so we do it before checking the inode.
-         */
-        error = -EFAULT;
-        if (copy_from_user(&flock, l, sizeof(flock)))
-                goto out;
-
-        inode = locks_inode(filp);
-
         /* Don't allow mandatory locks on files that may be memory mapped
          * and shared.
          */
@@ -2391,7 +2354,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
                 goto out;
         }
 
-        error = flock64_to_posix_lock(filp, file_lock, &flock);
+        error = flock64_to_posix_lock(filp, file_lock, flock);
         if (error)
                 goto out;
 
@@ -2406,7 +2369,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
         switch (cmd) {
         case F_OFD_SETLK:
                 error = -EINVAL;
-                if (flock.l_pid != 0)
+                if (flock->l_pid != 0)
                         goto out;
 
                 cmd = F_SETLK64;
@@ -2415,7 +2378,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
                 break;
         case F_OFD_SETLKW:
                 error = -EINVAL;
-                if (flock.l_pid != 0)
+                if (flock->l_pid != 0)
                         goto out;
 
                 cmd = F_SETLKW64;
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 2be32955d7f2..6eef95c585e3 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1464,41 +1464,34 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
 __be32
 nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
 {
-        mm_segment_t    oldfs;
         __be32          err;
-        int             host_err;
+        const char *link;
         struct path path;
+        DEFINE_DELAYED_CALL(done);
+        int len;
 
         err = fh_verify(rqstp, fhp, S_IFLNK, NFSD_MAY_NOP);
-        if (err)
-                goto out;
+        if (unlikely(err))
+                return err;
 
         path.mnt = fhp->fh_export->ex_path.mnt;
         path.dentry = fhp->fh_dentry;
 
-        err = nfserr_inval;
-        if (!d_is_symlink(path.dentry))
-                goto out;
+        if (unlikely(!d_is_symlink(path.dentry)))
+                return nfserr_inval;
 
         touch_atime(&path);
-        /* N.B. Why does this call need a get_fs()??
-         * Remove the set_fs and watch the fireworks:-) --okir
-         */
 
-        oldfs = get_fs(); set_fs(KERNEL_DS);
-        host_err = vfs_readlink(path.dentry, (char __user *)buf, *lenp);
-        set_fs(oldfs);
+        link = vfs_get_link(path.dentry, &done);
+        if (IS_ERR(link))
+                return nfserrno(PTR_ERR(link));
 
-        if (host_err < 0)
-                goto out_nfserr;
-        *lenp = host_err;
-        err = 0;
-out:
-        return err;
-
-out_nfserr:
-        err = nfserrno(host_err);
-        goto out;
+        len = strlen(link);
+        if (len < *lenp)
+                *lenp = len;
+        memcpy(buf, link, *lenp);
+        do_delayed_call(&done);
+        return 0;
 }
 
 /*
diff --git a/fs/statfs.c b/fs/statfs.c
index 4e4623c7a126..41a6a82da5e2 100644
--- a/fs/statfs.c
+++ b/fs/statfs.c
@@ -244,6 +244,7 @@ SYSCALL_DEFINE2(ustat, unsigned, dev, struct ustat __user *, ubuf)
 #ifdef CONFIG_COMPAT
 static int put_compat_statfs(struct compat_statfs __user *ubuf, struct kstatfs *kbuf)
 {
+        struct compat_statfs buf;
         if (sizeof ubuf->f_blocks == 4) {
                 if ((kbuf->f_blocks | kbuf->f_bfree | kbuf->f_bavail |
                      kbuf->f_bsize | kbuf->f_frsize) & 0xffffffff00000000ULL)
@@ -257,20 +258,20 @@ static int put_compat_statfs(struct compat_statfs __user *ubuf, struct kstatfs *
                  && (kbuf->f_ffree & 0xffffffff00000000ULL))
                         return -EOVERFLOW;
         }
-        if (!access_ok(VERIFY_WRITE, ubuf, sizeof(*ubuf)) ||
-            __put_user(kbuf->f_type, &ubuf->f_type) ||
-            __put_user(kbuf->f_bsize, &ubuf->f_bsize) ||
-            __put_user(kbuf->f_blocks, &ubuf->f_blocks) ||
-            __put_user(kbuf->f_bfree, &ubuf->f_bfree) ||
-            __put_user(kbuf->f_bavail, &ubuf->f_bavail) ||
-            __put_user(kbuf->f_files, &ubuf->f_files) ||
-            __put_user(kbuf->f_ffree, &ubuf->f_ffree) ||
-            __put_user(kbuf->f_namelen, &ubuf->f_namelen) ||
-            __put_user(kbuf->f_fsid.val[0], &ubuf->f_fsid.val[0]) ||
-            __put_user(kbuf->f_fsid.val[1], &ubuf->f_fsid.val[1]) ||
-            __put_user(kbuf->f_frsize, &ubuf->f_frsize) ||
-            __put_user(kbuf->f_flags, &ubuf->f_flags) ||
-            __clear_user(ubuf->f_spare, sizeof(ubuf->f_spare)))
+        memset(&buf, 0, sizeof(struct compat_statfs));
+        buf.f_type = kbuf->f_type;
+        buf.f_bsize = kbuf->f_bsize;
+        buf.f_blocks = kbuf->f_blocks;
+        buf.f_bfree = kbuf->f_bfree;
+        buf.f_bavail = kbuf->f_bavail;
+        buf.f_files = kbuf->f_files;
+        buf.f_ffree = kbuf->f_ffree;
+        buf.f_namelen = kbuf->f_namelen;
+        buf.f_fsid.val[0] = kbuf->f_fsid.val[0];
+        buf.f_fsid.val[1] = kbuf->f_fsid.val[1];
+        buf.f_frsize = kbuf->f_frsize;
+        buf.f_flags = kbuf->f_flags;
+        if (copy_to_user(ubuf, &buf, sizeof(struct compat_statfs)))
                 return -EFAULT;
         return 0;
 }
@@ -299,6 +300,7 @@ COMPAT_SYSCALL_DEFINE2(fstatfs, unsigned int, fd, struct compat_statfs __user *,
 
 static int put_compat_statfs64(struct compat_statfs64 __user *ubuf, struct kstatfs *kbuf)
 {
+        struct compat_statfs64 buf;
         if (sizeof(ubuf->f_bsize) == 4) {
                 if ((kbuf->f_type | kbuf->f_bsize | kbuf->f_namelen |
                      kbuf->f_frsize | kbuf->f_flags) & 0xffffffff00000000ULL)
@@ -312,20 +314,20 @@ static int put_compat_statfs64(struct compat_statfs64 __user *ubuf, struct kstat
                  && (kbuf->f_ffree & 0xffffffff00000000ULL))
                         return -EOVERFLOW;
         }
-        if (!access_ok(VERIFY_WRITE, ubuf, sizeof(*ubuf)) ||
-            __put_user(kbuf->f_type, &ubuf->f_type) ||
-            __put_user(kbuf->f_bsize, &ubuf->f_bsize) ||
-            __put_user(kbuf->f_blocks, &ubuf->f_blocks) ||
-            __put_user(kbuf->f_bfree, &ubuf->f_bfree) ||
-            __put_user(kbuf->f_bavail, &ubuf->f_bavail) ||
-            __put_user(kbuf->f_files, &ubuf->f_files) ||
-            __put_user(kbuf->f_ffree, &ubuf->f_ffree) ||
-            __put_user(kbuf->f_namelen, &ubuf->f_namelen) ||
-            __put_user(kbuf->f_fsid.val[0], &ubuf->f_fsid.val[0]) ||
-            __put_user(kbuf->f_fsid.val[1], &ubuf->f_fsid.val[1]) ||
-            __put_user(kbuf->f_frsize, &ubuf->f_frsize) ||
-            __put_user(kbuf->f_flags, &ubuf->f_flags) ||
-            __clear_user(ubuf->f_spare, sizeof(ubuf->f_spare)))
+        memset(&buf, 0, sizeof(struct compat_statfs64));
+        buf.f_type = kbuf->f_type;
+        buf.f_bsize = kbuf->f_bsize;
+        buf.f_blocks = kbuf->f_blocks;
+        buf.f_bfree = kbuf->f_bfree;
+        buf.f_bavail = kbuf->f_bavail;
+        buf.f_files = kbuf->f_files;
+        buf.f_ffree = kbuf->f_ffree;
+        buf.f_namelen = kbuf->f_namelen;
+        buf.f_fsid.val[0] = kbuf->f_fsid.val[0];
+        buf.f_fsid.val[1] = kbuf->f_fsid.val[1];
+        buf.f_frsize = kbuf->f_frsize;
+        buf.f_flags = kbuf->f_flags;
+        if (copy_to_user(ubuf, &buf, sizeof(struct compat_statfs64)))
                 return -EFAULT;
         return 0;
 }
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 771fe1131467..9a540d399d1b 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1047,14 +1047,14 @@ static inline struct inode *locks_inode(const struct file *f)
 }
 
 #ifdef CONFIG_FILE_LOCKING
-extern int fcntl_getlk(struct file *, unsigned int, struct flock __user *);
+extern int fcntl_getlk(struct file *, unsigned int, struct flock *);
 extern int fcntl_setlk(unsigned int, struct file *, unsigned int,
-                        struct flock __user *);
+                        struct flock *);
 
 #if BITS_PER_LONG == 32
-extern int fcntl_getlk64(struct file *, unsigned int, struct flock64 __user *);
+extern int fcntl_getlk64(struct file *, unsigned int, struct flock64 *);
 extern int fcntl_setlk64(unsigned int, struct file *, unsigned int,
-                        struct flock64 __user *);
+                        struct flock64 *);
 #endif
 
 extern int fcntl_setlease(unsigned int fd, struct file *filp, long arg);
@@ -1258,7 +1258,7 @@ extern void fasync_free(struct fasync_struct *);
 extern void kill_fasync(struct fasync_struct **, int, int);
 
 extern void __f_setown(struct file *filp, struct pid *, enum pid_type, int force);
-extern void f_setown(struct file *filp, unsigned long arg, int force);
+extern int f_setown(struct file *filp, unsigned long arg, int force);
 extern void f_delown(struct file *filp);
 extern pid_t f_getown(struct file *filp);
 extern int send_sigurg(struct fown_struct *fown);
diff --git a/net/socket.c b/net/socket.c
index 8f9dab330d57..59e902b9df09 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -991,8 +991,7 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
                         err = -EFAULT;
                         if (get_user(pid, (int __user *)argp))
                                 break;
-                        f_setown(sock->file, pid, 1);
-                        err = 0;
+                        err = f_setown(sock->file, pid, 1);
                         break;
                 case FIOGETOWN:
                 case SIOCGPGRP: