Index: qemu/linux-user/syscall.c
===================================================================
--- qemu.orig/linux-user/syscall.c	2007-09-17 01:02:17.000000000 -0400
+++ qemu/linux-user/syscall.c	2007-09-17 01:06:30.000000000 -0400
@@ -2242,73 +2242,69 @@
 static long do_fcntl(int fd, int cmd, target_ulong arg)
 {
     struct flock fl;
-    struct target_flock *target_fl;
+    struct target_flock *target_fl = (struct target_flock *)arg;
     struct flock64 fl64;
-    struct target_flock64 *target_fl64;
+    struct target_flock64 *target_fl64 = (struct target_flock64 *)arg;
     long ret;
 
     switch(cmd) {
     case TARGET_F_GETLK:
-        lock_user_struct(target_fl, arg, 1);
-        fl.l_type = tswap16(target_fl->l_type);
-        fl.l_whence = tswap16(target_fl->l_whence);
-        fl.l_start = tswapl(target_fl->l_start);
-        fl.l_len = tswapl(target_fl->l_len);
-        fl.l_pid = tswapl(target_fl->l_pid);
-        unlock_user_struct(target_fl, arg, 0);
+        if( !access_ok(VERIFY_READ,target_fl,sizeof(struct target_flock)) ) return -EFAULT;
+        __get_user(fl.l_type, &target_fl->l_type);
+        __get_user(fl.l_whence, &target_fl->l_whence);
+        __get_user(fl.l_start, &target_fl->l_start);
+        __get_user(fl.l_len, &target_fl->l_len);
+        __get_user(fl.l_pid, &target_fl->l_pid);
         ret = fcntl(fd, cmd, &fl);
         if (ret == 0) {
-            lock_user_struct(target_fl, arg, 0);
-            target_fl->l_type = tswap16(fl.l_type);
-            target_fl->l_whence = tswap16(fl.l_whence);
-            target_fl->l_start = tswapl(fl.l_start);
-            target_fl->l_len = tswapl(fl.l_len);
-            target_fl->l_pid = tswapl(fl.l_pid);
-            unlock_user_struct(target_fl, arg, 1);
+            if( !access_ok(VERIFY_WRITE,target_fl,sizeof(struct target_flock)) ) return -EFAULT;
+            __put_user(fl.l_type, &target_fl->l_type);
+            __put_user(fl.l_whence, &target_fl->l_whence);
+            __put_user(fl.l_start, &target_fl->l_start);
+            __put_user(fl.l_len, &target_fl->l_len);
+            __put_user(fl.l_pid, &target_fl->l_pid);
         }
         break;
        
     case TARGET_F_SETLK:
     case TARGET_F_SETLKW:
-        lock_user_struct(target_fl, arg, 1);
-        fl.l_type = tswap16(target_fl->l_type);
-        fl.l_whence = tswap16(target_fl->l_whence);
-        fl.l_start = tswapl(target_fl->l_start);
-        fl.l_len = tswapl(target_fl->l_len);
-        fl.l_pid = tswapl(target_fl->l_pid);
-        unlock_user_struct(target_fl, arg, 0);
+        if( !access_ok(VERIFY_READ,target_fl,sizeof(struct target_flock)) ) return -EFAULT;
+        __get_user(fl.l_type, &target_fl->l_type);
+        __get_user(fl.l_whence, &target_fl->l_whence);
+        __get_user(fl.l_start, &target_fl->l_start);
+        __get_user(fl.l_len, &target_fl->l_len);
         ret = fcntl(fd, cmd, &fl);
         break;
        
     case TARGET_F_GETLK64:
-        lock_user_struct(target_fl64, arg, 1);
-        fl64.l_type = tswap16(target_fl64->l_type) >> 1;
-        fl64.l_whence = tswap16(target_fl64->l_whence);
-        fl64.l_start = tswapl(target_fl64->l_start);
-        fl64.l_len = tswapl(target_fl64->l_len);
-        fl64.l_pid = tswap16(target_fl64->l_pid);
-        unlock_user_struct(target_fl64, arg, 0);
+        if( !access_ok(VERIFY_READ,target_fl64,sizeof(struct target_flock64)) ) return -EFAULT;
+        __get_user(fl64.l_type, &target_fl64->l_type);
+        fl64.l_type >>= 1;
+        __get_user(fl64.l_whence, &target_fl64->l_whence);
+        __get_user(fl64.l_start, &target_fl64->l_start);
+        __get_user(fl64.l_len, &target_fl64->l_len);
+        __get_user(fl64.l_pid, &target_fl64->l_pid);
         ret = fcntl(fd, cmd >> 1, &fl64);
         if (ret == 0) {
-            lock_user_struct(target_fl64, arg, 0);
-            target_fl64->l_type = tswap16(fl64.l_type) >> 1;
-            target_fl64->l_whence = tswap16(fl64.l_whence);
-            target_fl64->l_start = tswapl(fl64.l_start);
-            target_fl64->l_len = tswapl(fl64.l_len);
-            target_fl64->l_pid = tswapl(fl64.l_pid);
-            unlock_user_struct(target_fl64, arg, 1);
+            if( !access_ok(VERIFY_WRITE,target_fl64,sizeof(struct target_flock64)) ) return -EFAULT;
+            __put_user(fl64.l_type, &target_fl64->l_type);
+            target_fl64->l_type >>= 1;
+            __put_user(fl64.l_whence, &target_fl64->l_whence);
+            __put_user(fl64.l_start, &target_fl64->l_start);
+            __put_user(fl64.l_len, &target_fl64->l_len);
+            __put_user(fl64.l_pid, &target_fl64->l_pid);
         }
-		break;
+	break;
     case TARGET_F_SETLK64:
     case TARGET_F_SETLKW64:
-        lock_user_struct(target_fl64, arg, 1);
-        fl64.l_type = tswap16(target_fl64->l_type) >> 1;
-        fl64.l_whence = tswap16(target_fl64->l_whence);
-        fl64.l_start = tswapl(target_fl64->l_start);
-        fl64.l_len = tswapl(target_fl64->l_len);
-        fl64.l_pid = tswap16(target_fl64->l_pid);
-        unlock_user_struct(target_fl64, arg, 0);
-		ret = fcntl(fd, cmd >> 1, &fl64);
+        if( !access_ok(VERIFY_READ,target_fl64,sizeof(struct target_flock64)) ) return -EFAULT;
+        __get_user(fl64.l_type, &target_fl64->l_type);
+        fl64.l_type >>= 1;
+        __get_user(fl64.l_whence, &target_fl64->l_whence);
+        __get_user(fl64.l_start, &target_fl64->l_start);
+        __get_user(fl64.l_len, &target_fl64->l_len);
+        __get_user(fl64.l_pid, &target_fl64->l_pid);
+        ret = fcntl(fd, cmd >> 1, &fl64);
         break;
 
     case F_GETFL: