3 files changed, 35 insertions, 48 deletions

diff --git a/arch/x86/lib/usercopy.c b/arch/x86/lib/usercopy.c
index d6ae30bbd7b..2e4e4b02c37 100644
--- a/arch/x86/lib/usercopy.c
+++ b/arch/x86/lib/usercopy.c
@@ -44,13 +44,6 @@ copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
 }
 EXPORT_SYMBOL_GPL(copy_from_user_nmi);
 
-static inline unsigned long count_bytes(unsigned long mask)
-{
-        mask = (mask - 1) & ~mask;
-        mask >>= 7;
-        return count_masked_bytes(mask);
-}
-
 /*
  * Do a strncpy, return length of string without final '\0'.
  * 'count' is the user-supplied count (return 'count' if we
@@ -69,16 +62,19 @@ static inline long do_strncpy_from_user(char *dst, const char __user *src, long
                 max = count;
 
         while (max >= sizeof(unsigned long)) {
-                unsigned long c;
+                unsigned long c, mask;
 
                 /* Fall back to byte-at-a-time if we get a page fault */
                 if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
                         break;
-                /* This can write a few bytes past the NUL character, but that's ok */
+                mask = has_zero(c);
+                if (mask) {
+                        mask = (mask - 1) & ~mask;
+                        mask >>= 7;
+                        *(unsigned long *)(dst+res) = c & mask;
+                        return res + count_masked_bytes(mask);
+                }
                 *(unsigned long *)(dst+res) = c;
-                c = has_zero(c);
-                if (c)
-                        return res + count_bytes(c);
                 res += sizeof(unsigned long);
                 max -= sizeof(unsigned long);
         }
diff --git a/fs/namei.c b/fs/namei.c
index c42791914f8..709fb2c17b5 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -116,47 +116,37 @@
  * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
  * PATH_MAX includes the nul terminator --RR.
  */
-static int do_getname(const char __user *filename, char *page)
-{
-        int retval;
-        unsigned long len = PATH_MAX;
-
-        if (!segment_eq(get_fs(), KERNEL_DS)) {
-                if ((unsigned long) filename >= TASK_SIZE)
-                        return -EFAULT;
-                if (TASK_SIZE - (unsigned long) filename < PATH_MAX)
-                        len = TASK_SIZE - (unsigned long) filename;
-        }
-
-        retval = strncpy_from_user(page, filename, len);
-        if (retval > 0) {
-                if (retval < len)
-                        return 0;
-                return -ENAMETOOLONG;
-        } else if (!retval)
-                retval = -ENOENT;
-        return retval;
-}
-
 static char *getname_flags(const char __user *filename, int flags, int *empty)
 {
-        char *result = __getname();
-        int retval;
+        char *result = __getname(), *err;
+        int len;
 
-        if (!result)
+        if (unlikely(!result))
                 return ERR_PTR(-ENOMEM);
 
-        retval = do_getname(filename, result);
-        if (retval < 0) {
-                if (retval == -ENOENT && empty)
+        len = strncpy_from_user(result, filename, PATH_MAX);
+        err = ERR_PTR(len);
+        if (unlikely(len < 0))
+                goto error;
+
+        /* The empty path is special. */
+        if (unlikely(!len)) {
+                if (empty)
                         *empty = 1;
-                if (retval != -ENOENT || !(flags & LOOKUP_EMPTY)) {
-                        __putname(result);
-                        return ERR_PTR(retval);
-                }
+                err = ERR_PTR(-ENOENT);
+                if (!(flags & LOOKUP_EMPTY))
+                        goto error;
         }
-        audit_getname(result);
-        return result;
+
+        err = ERR_PTR(-ENAMETOOLONG);
+        if (likely(len < PATH_MAX)) {
+                audit_getname(result);
+                return result;
+        }
+
+error:
+        __putname(result);
+        return err;
 }
 
 char *getname(const char __user * filename)
diff --git a/fs/stat.c b/fs/stat.c
index b30ac60291e..0cef3366a91 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -57,12 +57,13 @@ EXPORT_SYMBOL(vfs_getattr);
 
 int vfs_fstat(unsigned int fd, struct kstat *stat)
 {
-        struct file *f = fget(fd);
+        int fput_needed;
+        struct file *f = fget_light(fd, &fput_needed);
         int error = -EBADF;
 
         if (f) {
                 error = vfs_getattr(f->f_path.mnt, f->f_path.dentry, stat);
-                fput(f);
+                fput_light(f, fput_needed);
         }
         return error;
 }