- mm_segment_t oldfs;
- struct sigevent notification;
- char cookie[NOTIFY_COOKIE_LEN];
- compat_uptr_t u_cookie;
- long ret;
-
- if (!u_notification)
- return sys_mq_notify(mqdes, 0);
-
- if (get_compat_sigevent(¬ification, u_notification))
- return -EFAULT;
-
- if (notification.sigev_notify == SIGEV_THREAD) {
- u_cookie = (compat_uptr_t)notification.sigev_value.sival_int;
- if (copy_from_user(cookie, compat_ptr(u_cookie),
- NOTIFY_COOKIE_LEN)) {
+ struct sigevent __user *p = NULL;
+ if (u_notification) {
+ struct sigevent n;
+ p = compat_alloc_user_space(sizeof(*p));
+ if (get_compat_sigevent(&n, u_notification))
+ return -EFAULT;
+ if (n.sigev_notify == SIGEV_THREAD)
+ n.sigev_value.sival_ptr = compat_ptr(n.sigev_value.sival_int);
+ if (copy_to_user(p, &n, sizeof(*p)))