5 files changed, 50 insertions, 33 deletions

diff --git a/ipc/compat.c b/ipc/compat.c
index 4d20cfd38f0a..fa18141539fb 100644
--- a/ipc/compat.c
+++ b/ipc/compat.c
@@ -115,7 +115,6 @@ struct compat_shm_info {
 
 extern int sem_ctls[];
 #define sc_semopm       (sem_ctls[2])
-#define MAXBUF (64*1024)
 
 static inline int compat_ipc_parse_version(int *cmd)
 {
@@ -307,35 +306,30 @@ long compat_sys_semctl(int first, int second, int third, void __user *uptr)
 
 long compat_sys_msgsnd(int first, int second, int third, void __user *uptr)
 {
-        struct msgbuf __user *p;
         struct compat_msgbuf __user *up = uptr;
         long type;
 
         if (first < 0)
                 return -EINVAL;
-        if (second < 0 || (second >= MAXBUF - sizeof(struct msgbuf)))
+        if (second < 0)
                 return -EINVAL;
 
-        p = compat_alloc_user_space(second + sizeof(struct msgbuf));
-        if (get_user(type, &up->mtype) ||
-            put_user(type, &p->mtype) ||
-            copy_in_user(p->mtext, up->mtext, second))
+        if (get_user(type, &up->mtype))
                 return -EFAULT;
 
-        return sys_msgsnd(first, p, second, third);
+        return do_msgsnd(first, type, up->mtext, second, third);
 }
 
 long compat_sys_msgrcv(int first, int second, int msgtyp, int third,
                            int version, void __user *uptr)
 {
-        struct msgbuf __user *p;
         struct compat_msgbuf __user *up;
         long type;
         int err;
 
         if (first < 0)
                 return -EINVAL;
-        if (second < 0 || (second >= MAXBUF - sizeof(struct msgbuf)))
+        if (second < 0)
                 return -EINVAL;
 
         if (!version) {
@@ -349,14 +343,11 @@ long compat_sys_msgrcv(int first, int second, int msgtyp, int third,
                 uptr = compat_ptr(ipck.msgp);
                 msgtyp = ipck.msgtyp;
         }
-        p = compat_alloc_user_space(second + sizeof(struct msgbuf));
-        err = sys_msgrcv(first, p, second, msgtyp, third);
+        up = uptr;
+        err = do_msgrcv(first, &type, up->mtext, second, msgtyp, third);
         if (err < 0)
                 goto out;
-        up = uptr;
-        if (get_user(type, &p->mtype) ||
-            put_user(type, &up->mtype) ||
-            copy_in_user(up->mtext, p->mtext, err))
+        if (put_user(type, &up->mtype))
                 err = -EFAULT;
 out:
         return err;
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 7c274002c9f5..3acc1661e517 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -90,7 +90,7 @@ static struct super_operations mqueue_super_ops;
 static void remove_notification(struct mqueue_inode_info *info);
 
 static spinlock_t mq_lock;
-static kmem_cache_t *mqueue_inode_cachep;
+static struct kmem_cache *mqueue_inode_cachep;
 static struct vfsmount *mqueue_mnt;
 
 static unsigned int queues_count;
@@ -211,7 +211,7 @@ static int mqueue_get_sb(struct file_system_type *fs_type,
         return get_sb_single(fs_type, flags, data, mqueue_fill_super, mnt);
 }
 
-static void init_once(void *foo, kmem_cache_t * cachep, unsigned long flags)
+static void init_once(void *foo, struct kmem_cache * cachep, unsigned long flags)
 {
         struct mqueue_inode_info *p = (struct mqueue_inode_info *) foo;
 
@@ -224,7 +224,7 @@ static struct inode *mqueue_alloc_inode(struct super_block *sb)
 {
         struct mqueue_inode_info *ei;
 
-        ei = kmem_cache_alloc(mqueue_inode_cachep, SLAB_KERNEL);
+        ei = kmem_cache_alloc(mqueue_inode_cachep, GFP_KERNEL);
         if (!ei)
                 return NULL;
         return &ei->vfs_inode;
diff --git a/ipc/msg.c b/ipc/msg.c
index 1266b1d0c8e3..a388824740e7 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -626,12 +626,11 @@ static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg)
         return 0;
 }
 
-asmlinkage long
-sys_msgsnd(int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg)
+long do_msgsnd(int msqid, long mtype, void __user *mtext,
+                size_t msgsz, int msgflg)
 {
         struct msg_queue *msq;
         struct msg_msg *msg;
-        long mtype;
         int err;
         struct ipc_namespace *ns;
 
@@ -639,12 +638,10 @@ sys_msgsnd(int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg)
 
         if (msgsz > ns->msg_ctlmax || (long) msgsz < 0 || msqid < 0)
                 return -EINVAL;
-        if (get_user(mtype, &msgp->mtype))
-                return -EFAULT;
         if (mtype < 1)
                 return -EINVAL;
 
-        msg = load_msg(msgp->mtext, msgsz);
+        msg = load_msg(mtext, msgsz);
         if (IS_ERR(msg))
                 return PTR_ERR(msg);
 
@@ -723,6 +720,16 @@ out_free:
         return err;
 }
 
+asmlinkage long
+sys_msgsnd(int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg)
+{
+        long mtype;
+
+        if (get_user(mtype, &msgp->mtype))
+                return -EFAULT;
+        return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
+}
+
 static inline int convert_mode(long *msgtyp, int msgflg)
 {
         /*
@@ -742,8 +749,8 @@ static inline int convert_mode(long *msgtyp, int msgflg)
         return SEARCH_EQUAL;
 }
 
-asmlinkage long sys_msgrcv(int msqid, struct msgbuf __user *msgp, size_t msgsz,
-                           long msgtyp, int msgflg)
+long do_msgrcv(int msqid, long *pmtype, void __user *mtext,
+                size_t msgsz, long msgtyp, int msgflg)
 {
         struct msg_queue *msq;
         struct msg_msg *msg;
@@ -889,15 +896,30 @@ out_unlock:
                 return PTR_ERR(msg);
 
         msgsz = (msgsz > msg->m_ts) ? msg->m_ts : msgsz;
-        if (put_user (msg->m_type, &msgp->mtype) ||
-            store_msg(msgp->mtext, msg, msgsz)) {
+        *pmtype = msg->m_type;
+        if (store_msg(mtext, msg, msgsz))
                 msgsz = -EFAULT;
-        }
+
         free_msg(msg);
 
         return msgsz;
 }
 
+asmlinkage long sys_msgrcv(int msqid, struct msgbuf __user *msgp, size_t msgsz,
+                           long msgtyp, int msgflg)
+{
+        long err, mtype;
+
+        err =  do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg);
+        if (err < 0)
+                goto out;
+
+        if (put_user(mtype, &msgp->mtype))
+                err = -EFAULT;
+out:
+        return err;
+}
+
 #ifdef CONFIG_PROC_FS
 static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
 {
diff --git a/ipc/sem.c b/ipc/sem.c
index 21b3289d640c..d3e12efd55cb 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1070,14 +1070,13 @@ static struct sem_undo *find_undo(struct ipc_namespace *ns, int semid)
         ipc_rcu_getref(sma);
         sem_unlock(sma);
 
-        new = (struct sem_undo *) kmalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
+        new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
         if (!new) {
                 ipc_lock_by_ptr(&sma->sem_perm);
                 ipc_rcu_putref(sma);
                 sem_unlock(sma);
                 return ERR_PTR(-ENOMEM);
         }
-        memset(new, 0, sizeof(struct sem_undo) + sizeof(short)*nsems);
         new->semadj = (short *) &new[1];
         new->semid = semid;
 
diff --git a/ipc/util.c b/ipc/util.c
index cd8bb14a431f..a9b7a227b8d4 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -514,6 +514,11 @@ void ipc_rcu_getref(void *ptr)
         container_of(ptr, struct ipc_rcu_hdr, data)->refcount++;
 }
 
+static void ipc_do_vfree(struct work_struct *work)
+{
+        vfree(container_of(work, struct ipc_rcu_sched, work));
+}
+
 /**
  * ipc_schedule_free - free ipc + rcu space
  * @head: RCU callback structure for queued work
@@ -528,7 +533,7 @@ static void ipc_schedule_free(struct rcu_head *head)
         struct ipc_rcu_sched *sched =
                         container_of(&(grace->data[0]), struct ipc_rcu_sched, data[0]);
 
-        INIT_WORK(&sched->work, vfree, sched);
+        INIT_WORK(&sched->work, ipc_do_vfree);
         schedule_work(&sched->work);
 }