do_i2c_rdwr_ioctl() does two compat_alloc_user_space().  That doesn't
work; no state is kept and second allocation will ignore the first one
(i.e.  give overlapping chunk of user stack).

Fixed by doing allocation at once, slightly cleaned up.
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>