1 files changed, 15 insertions, 8 deletions

diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
index 11093a7c3e32..9b06bb41fca6 100644
--- a/arch/arm/lib/getuser.S
+++ b/arch/arm/lib/getuser.S
@@ -16,8 +16,9 @@
  * __get_user_X
  *
  * Inputs:      r0 contains the address
+ *              r1 contains the address limit, which must be preserved
  * Outputs:     r0 is the error code
- *              r2, r3 contains the zero-extended value
+ *              r2 contains the zero-extended value
  *              lr corrupted
  *
  * No other registers must be altered.  (see <asm/uaccess.h>
@@ -27,33 +28,39 @@
  * Note also that it is intended that __get_user_bad is not global.
  */
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/errno.h>
 #include <asm/domain.h>
 
 ENTRY(__get_user_1)
+        check_uaccess r0, 1, r1, r2, __get_user_bad
 1: TUSER(ldrb)  r2, [r0]
         mov     r0, #0
         mov     pc, lr
 ENDPROC(__get_user_1)
 
 ENTRY(__get_user_2)
-#ifdef CONFIG_THUMB2_KERNEL
-2: TUSER(ldrb)  r2, [r0]
-3: TUSER(ldrb)  r3, [r0, #1]
+        check_uaccess r0, 2, r1, r2, __get_user_bad
+#ifdef CONFIG_CPU_USE_DOMAINS
+rb      .req    ip
+2:      ldrbt   r2, [r0], #1
+3:      ldrbt   rb, [r0], #0
 #else
-2: TUSER(ldrb)  r2, [r0], #1
-3: TUSER(ldrb)  r3, [r0]
+rb      .req    r0
+2:      ldrb    r2, [r0]
+3:      ldrb    rb, [r0, #1]
 #endif
 #ifndef __ARMEB__
-        orr     r2, r2, r3, lsl #8
+        orr     r2, r2, rb, lsl #8
 #else
-        orr     r2, r3, r2, lsl #8
+        orr     r2, rb, r2, lsl #8
 #endif
         mov     r0, #0
         mov     pc, lr
 ENDPROC(__get_user_2)
 
 ENTRY(__get_user_4)
+        check_uaccess r0, 4, r1, r2, __get_user_bad
 4: TUSER(ldr)   r2, [r0]
         mov     r0, #0
         mov     pc, lr