Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: (38 commits)
  MIPS: Sibyte: Fix locking in set_irq_affinity
  MIPS: Use force_sig when handling address errors.
  MIPS: Cavium: Add struct clocksource * argument to octeon_cvmcount_read()
  MIPS: Rewrite <asm/div64.h> to work with gcc 4.4.0.
  MIPS: Fix highmem.
  MIPS: Fix sign-extension bug in 32-bit kernel on 32-bit hardware.
  MIPS: MSP71xx: Remove the RAMROOT functions
  MIPS: Use -mno-check-zero-division
  MIPS: Set compiler options only after the compiler prefix has ben set.
  MIPS: IP27: Get rid of #ident.  Gcc 4.4.0 doesn't like it.
  MIPS: uaccess: Switch lock annotations to might_fault().
  MIPS: MSP71xx: Resolve use of non-existent GPIO routines in msp71xx reset
  MIPS: MSP71xx: Resolve multiple definition of plat_timer_setup
  MIPS: Make uaccess.h slightly more sparse friendly.
  MIPS: Make access_ok() sideeffect proof.
  MIPS: IP27: Fix clash with NMI_OFFSET from hardirq.h
  MIPS: Alchemy: Timer build fix
  MIPS: Kconfig: Delete duplicate definition of RWSEM_GENERIC_SPINLOCK.
  MIPS: Cavium: Add support for 8k and 32k page sizes.
  MIPS: TXx9: Fix possible overflow in clock calculations
  ...

1 files changed, 48 insertions, 18 deletions

diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index 09ff5bb17445..8de858f5449f 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -105,10 +105,20 @@
 #define __access_mask get_fs().seg
 
 #define __access_ok(addr, size, mask)					\
-	(((signed long)((mask) & ((addr) | ((addr) + (size)) | __ua_size(size)))) == 0)
+({									\
+	unsigned long __addr = (unsigned long) (addr);			\
+	unsigned long __size = size;					\
+	unsigned long __mask = mask;					\
+	unsigned long __ok;						\
+									\
+	__chk_user_ptr(addr);						\
+	__ok = (signed long)(__mask & (__addr | (__addr + __size) |	\
+		__ua_size(__size)));					\
+	__ok == 0;							\
+})
 
 #define access_ok(type, addr, size)					\
-	likely(__access_ok((unsigned long)(addr), (size), __access_mask))
+	likely(__access_ok((addr), (size), __access_mask))
 
 /*
  * put_user: - Write a simple value into user space.
@@ -225,6 +235,7 @@ do {									\
 ({									\
 	int __gu_err;							\
 									\
+	__chk_user_ptr(ptr);						\
 	__get_user_common((x), size, ptr);				\
 	__gu_err;							\
 })
@@ -234,6 +245,7 @@ do {									\
 	int __gu_err = -EFAULT;						\
 	const __typeof__(*(ptr)) __user * __gu_ptr = (ptr);		\
 									\
+	might_fault();							\
 	if (likely(access_ok(VERIFY_READ,  __gu_ptr, size)))		\
 		__get_user_common((x), size, __gu_ptr);			\
 									\
@@ -305,6 +317,7 @@ do {									\
 	__typeof__(*(ptr)) __pu_val;					\
 	int __pu_err = 0;						\
 									\
+	__chk_user_ptr(ptr);						\
 	__pu_val = (x);							\
 	switch (size) {							\
 	case 1: __put_user_asm("sb", ptr); break;			\
@@ -322,6 +335,7 @@ do {									\
 	__typeof__(*(ptr)) __pu_val = (x);				\
 	int __pu_err = -EFAULT;						\
 									\
+	might_fault();							\
 	if (likely(access_ok(VERIFY_WRITE,  __pu_addr, size))) {	\
 		switch (size) {						\
 		case 1: __put_user_asm("sb", __pu_addr); break;		\
@@ -696,10 +710,10 @@ extern size_t __copy_user(void *__to, const void *__from, size_t __n);
 	const void *__cu_from;						\
 	long __cu_len;							\
 									\
-	might_sleep();							\
 	__cu_to = (to);							\
 	__cu_from = (from);						\
 	__cu_len = (n);							\
+	might_fault();							\
 	__cu_len = __invoke_copy_to_user(__cu_to, __cu_from, __cu_len);	\
 	__cu_len;							\
 })
@@ -752,13 +766,14 @@ extern size_t __copy_user_inatomic(void *__to, const void *__from, size_t __n);
 	const void *__cu_from;						\
 	long __cu_len;							\
 									\
-	might_sleep();							\
 	__cu_to = (to);							\
 	__cu_from = (from);						\
 	__cu_len = (n);							\
-	if (access_ok(VERIFY_WRITE, __cu_to, __cu_len))			\
+	if (access_ok(VERIFY_WRITE, __cu_to, __cu_len)) {		\
+		might_fault();						\
 		__cu_len = __invoke_copy_to_user(__cu_to, __cu_from,	\
 		                                 __cu_len);		\
+	}								\
 	__cu_len;							\
 })
 
@@ -831,10 +846,10 @@ extern size_t __copy_user_inatomic(void *__to, const void *__from, size_t __n);
 	const void __user *__cu_from;					\
 	long __cu_len;							\
 									\
-	might_sleep();							\
 	__cu_to = (to);							\
 	__cu_from = (from);						\
 	__cu_len = (n);							\
+	might_fault();							\
 	__cu_len = __invoke_copy_from_user(__cu_to, __cu_from,		\
 	                                   __cu_len);			\
 	__cu_len;							\
@@ -862,17 +877,31 @@ extern size_t __copy_user_inatomic(void *__to, const void *__from, size_t __n);
 	const void __user *__cu_from;					\
 	long __cu_len;							\
 									\
-	might_sleep();							\
 	__cu_to = (to);							\
 	__cu_from = (from);						\
 	__cu_len = (n);							\
-	if (access_ok(VERIFY_READ, __cu_from, __cu_len))		\
+	if (access_ok(VERIFY_READ, __cu_from, __cu_len)) {		\
+		might_fault();						\
 		__cu_len = __invoke_copy_from_user(__cu_to, __cu_from,	\
 		                                   __cu_len);		\
+	}								\
 	__cu_len;							\
 })
 
-#define __copy_in_user(to, from, n)	__copy_from_user(to, from, n)
+#define __copy_in_user(to, from, n)					\
+({									\
+	void __user *__cu_to;						\
+	const void __user *__cu_from;					\
+	long __cu_len;							\
+									\
+	__cu_to = (to);							\
+	__cu_from = (from);						\
+	__cu_len = (n);							\
+	might_fault();							\
+	__cu_len = __invoke_copy_from_user(__cu_to, __cu_from,		\
+	                                   __cu_len);			\
+	__cu_len;							\
+})
 
 #define copy_in_user(to, from, n)					\
 ({									\
@@ -880,14 +909,15 @@ extern size_t __copy_user_inatomic(void *__to, const void *__from, size_t __n);
 	const void __user *__cu_from;					\
 	long __cu_len;							\
 									\
-	might_sleep();							\
 	__cu_to = (to);							\
 	__cu_from = (from);						\
 	__cu_len = (n);							\
 	if (likely(access_ok(VERIFY_READ, __cu_from, __cu_len) &&	\
-	           access_ok(VERIFY_WRITE, __cu_to, __cu_len)))		\
+	           access_ok(VERIFY_WRITE, __cu_to, __cu_len))) {	\
+		might_fault();						\
 		__cu_len = __invoke_copy_from_user(__cu_to, __cu_from,	\
 		                                   __cu_len);		\
+	}								\
 	__cu_len;							\
 })
 
@@ -907,7 +937,7 @@ __clear_user(void __user *addr, __kernel_size_t size)
 {
 	__kernel_size_t res;
 
-	might_sleep();
+	might_fault();
 	__asm__ __volatile__(
 		"move\t$4, %1\n\t"
 		"move\t$5, $0\n\t"
@@ -956,7 +986,7 @@ __strncpy_from_user(char *__to, const char __user *__from, long __len)
 {
 	long res;
 
-	might_sleep();
+	might_fault();
 	__asm__ __volatile__(
 		"move\t$4, %1\n\t"
 		"move\t$5, %2\n\t"
@@ -993,7 +1023,7 @@ strncpy_from_user(char *__to, const char __user *__from, long __len)
 {
 	long res;
 
-	might_sleep();
+	might_fault();
 	__asm__ __volatile__(
 		"move\t$4, %1\n\t"
 		"move\t$5, %2\n\t"
@@ -1012,7 +1042,7 @@ static inline long __strlen_user(const char __user *s)
 {
 	long res;
 
-	might_sleep();
+	might_fault();
 	__asm__ __volatile__(
 		"move\t$4, %1\n\t"
 		__MODULE_JAL(__strlen_user_nocheck_asm)
@@ -1042,7 +1072,7 @@ static inline long strlen_user(const char __user *s)
 {
 	long res;
 
-	might_sleep();
+	might_fault();
 	__asm__ __volatile__(
 		"move\t$4, %1\n\t"
 		__MODULE_JAL(__strlen_user_asm)
@@ -1059,7 +1089,7 @@ static inline long __strnlen_user(const char __user *s, long n)
 {
 	long res;
 
-	might_sleep();
+	might_fault();
 	__asm__ __volatile__(
 		"move\t$4, %1\n\t"
 		"move\t$5, %2\n\t"
@@ -1090,7 +1120,7 @@ static inline long strnlen_user(const char __user *s, long n)
 {
 	long res;
 
-	might_sleep();
+	might_fault();
 	__asm__ __volatile__(
 		"move\t$4, %1\n\t"
 		"move\t$5, %2\n\t"