Merge bk://kernel.bkbits.net/davem/net-2.6

into ppc970.osdl.org:/home/torvalds/v2.6/linux

arch/ppc64/kernel/pacaData.c

@@ -54,7 +54,7 @@ struct systemcfg *systemcfg;
 		.xFPRegsInUse = 1,					    \
 		.xDynProcStatus = 2,					    \
 		.xDecrVal = 0x00ff0000,					    \
-		.xEndOfQuantum = 0xffffffffffffffff			    \
+		.xEndOfQuantum = 0xfffffffffffffffful			    \
 	},								    \
 	.xRegSav = {							    \
 		.xDesc = 0xd397d9e2,	/* "LpRS" */			    \

arch/ppc64/kernel/process.c

@@ -410,7 +410,7 @@ int sys_clone(unsigned long clone_flags, unsigned long p2, unsigned long p3,
 	}
 
 	return do_fork(clone_flags & ~CLONE_IDLETASK, p2, regs, 0,
-		    (int *)parent_tidptr, (int *)child_tidptr);
+		    (int __user *)parent_tidptr, (int __user *)child_tidptr);
 }
 
 int sys_fork(unsigned long p1, unsigned long p2, unsigned long p3,
@@ -435,7 +435,7 @@ int sys_execve(unsigned long a0, unsigned long a1, unsigned long a2,
 	int error;
 	char * filename;
 	
-	filename = getname((char *) a0);
+	filename = getname((char __user *) a0);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
 		goto out;
@@ -445,7 +445,8 @@ int sys_execve(unsigned long a0, unsigned long a1, unsigned long a2,
 	if (regs->msr & MSR_VEC)
 		giveup_altivec(current);
 #endif /* CONFIG_ALTIVEC */
-	error = do_execve(filename, (char **) a1, (char **) a2, regs);
+	error = do_execve(filename, (char __user * __user *) a1,
+				    (char __user * __user *) a2, regs);
   
 	if (error == 0)
 		current->ptrace &= ~PT_DTRACE;

arch/ppc64/kernel/sys_ppc32.c

@@ -78,7 +78,7 @@
 #include "pci.h"
 
 /* readdir & getdents */
-#define NAME_OFFSET(de) ((int) ((de)->d_name - (char *) (de)))
+#define NAME_OFFSET(de) ((int) ((de)->d_name - (char __user *) (de)))
 #define ROUND_UP(x) (((x)+sizeof(u32)-1) & ~(sizeof(u32)-1))
 
 struct old_linux_dirent32 {
@@ -89,7 +89,7 @@ struct old_linux_dirent32 {
 };
 
 struct readdir_callback32 {
-	struct old_linux_dirent32 * dirent;
+	struct old_linux_dirent32 __user * dirent;
 	int count;
 };
 
@@ -97,7 +97,7 @@ static int fillonedir(void * __buf, const char * name, int namlen,
 		                  off_t offset, ino_t ino, unsigned int d_type)
 {
 	struct readdir_callback32 * buf = (struct readdir_callback32 *) __buf;
-	struct old_linux_dirent32 * dirent;
+	struct old_linux_dirent32 __user * dirent;
 
 	if (buf->count)
 		return -EINVAL;
@@ -111,7 +111,7 @@ static int fillonedir(void * __buf, const char * name, int namlen,
 	return 0;
 }
 
-asmlinkage int old32_readdir(unsigned int fd, struct old_linux_dirent32 *dirent, unsigned int count)
+asmlinkage int old32_readdir(unsigned int fd, struct old_linux_dirent32 __user *dirent, unsigned int count)
 {
 	int error = -EBADF;
 	struct file * file;
@@ -143,8 +143,8 @@ struct linux_dirent32 {
 };
 
 struct getdents_callback32 {
-	struct linux_dirent32 * current_dir;
-	struct linux_dirent32 * previous;
+	struct linux_dirent32 __user * current_dir;
+	struct linux_dirent32 __user * previous;
 	int count;
 	int error;
 };
@@ -152,7 +152,7 @@ struct getdents_callback32 {
 static int filldir(void * __buf, const char * name, int namlen, off_t offset,
 		   ino_t ino, unsigned int d_type)
 {
-	struct linux_dirent32 * dirent;
+	struct linux_dirent32 __user * dirent;
 	struct getdents_callback32 * buf = (struct getdents_callback32 *) __buf;
 	int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 2);
 
@@ -176,7 +176,7 @@ static int filldir(void * __buf, const char * name, int namlen, off_t offset,
 	if (__put_user(d_type, (char *) dirent + reclen - 1))
 		goto efault;
 	buf->previous = dirent;
-	dirent = (void *)dirent + reclen;
+	dirent = (void __user *)dirent + reclen;
 	buf->current_dir = dirent;
 	buf->count -= reclen;
 	return 0;
@@ -185,11 +185,11 @@ static int filldir(void * __buf, const char * name, int namlen, off_t offset,
 	return -EFAULT;
 }
 
-long sys32_getdents(unsigned int fd, struct linux_dirent32 *dirent,
+asmlinkage long sys32_getdents(unsigned int fd, struct linux_dirent32 __user *dirent,
 		    unsigned int count)
 {
 	struct file * file;
-	struct linux_dirent32 * lastdirent;
+	struct linux_dirent32 __user * lastdirent;
 	struct getdents_callback32 buf;
 	int error;
 
@@ -233,7 +233,7 @@ asmlinkage long ppc32_select(u32 n, compat_ulong_t __user *inp,
 	return compat_sys_select((int)n, inp, outp, exp, compat_ptr(tvp_x));
 }
 
-int cp_compat_stat(struct kstat *stat, struct compat_stat *statbuf)
+int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
 	long err;
 
@@ -291,7 +291,7 @@ struct timex32 {
 extern int do_adjtimex(struct timex *);
 extern void ppc_adjtimex(void);
 
-asmlinkage long sys32_adjtimex(struct timex32 *utp)
+asmlinkage long sys32_adjtimex(struct timex32 __user *utp)
 {
 	struct timex txc;
 	int ret;
@@ -362,7 +362,7 @@ asmlinkage long sys32_pause(void)
 
 
 
-static inline long get_ts32(struct timespec *o, struct compat_timeval *i)
+static inline long get_ts32(struct timespec *o, struct compat_timeval __user *i)
 {
 	long usec;
 
@@ -376,7 +376,7 @@ static inline long get_ts32(struct timespec *o, struct compat_timeval *i)
 	return 0;
 }
 
-static inline long put_tv32(struct compat_timeval *o, struct timeval *i)
+static inline long put_tv32(struct compat_timeval __user *o, struct timeval *i)
 {
 	return (!access_ok(VERIFY_WRITE, o, sizeof(*o)) ||
 		(__put_user(i->tv_sec, &o->tv_sec) |
@@ -400,16 +400,18 @@ struct sysinfo32 {
 	char _f[20-2*sizeof(int)-sizeof(int)];
 };
 
-asmlinkage long sys32_sysinfo(struct sysinfo32 *info)
+asmlinkage long sys32_sysinfo(struct sysinfo32 __user *info)
 {
 	struct sysinfo s;
 	int ret, err;
 	int bitcount=0;
 	mm_segment_t old_fs = get_fs ();
 	
+	/* The __user cast is valid due to set_fs() */
 	set_fs (KERNEL_DS);
-	ret = sys_sysinfo(&s);
+	ret = sys_sysinfo((struct sysinfo __user *)&s);
 	set_fs (old_fs);
+
 	/* Check to see if any memory value is too large for 32-bit and
          * scale down if needed.
          */
@@ -455,7 +457,7 @@ asmlinkage long sys32_sysinfo(struct sysinfo32 *info)
    sorts of things, like timeval and itimerval.  */
 extern struct timezone sys_tz;
 
-asmlinkage long sys32_gettimeofday(struct compat_timeval *tv, struct timezone *tz)
+asmlinkage long sys32_gettimeofday(struct compat_timeval __user *tv, struct timezone __user *tz)
 {
 	if (tv) {
 		struct timeval ktv;
@@ -473,7 +475,7 @@ asmlinkage long sys32_gettimeofday(struct compat_timeval *tv, struct timezone *t
 
 
 
-asmlinkage long sys32_settimeofday(struct compat_timeval *tv, struct timezone *tz)
+asmlinkage long sys32_settimeofday(struct compat_timeval __user *tv, struct timezone __user *tz)
 {
 	struct timespec kts;
 	struct timezone ktz;
@@ -560,17 +562,20 @@ long sys32_ipc(u32 call, u32 first, u32 second, u32 third, compat_uptr_t ptr,
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_sendfile(u32 out_fd, u32 in_fd, compat_off_t* offset, u32 count)
+asmlinkage long sys32_sendfile(u32 out_fd, u32 in_fd, compat_off_t __user * offset, u32 count)
 {
 	mm_segment_t old_fs = get_fs();
 	int ret;
 	off_t of;
+	off_t __user *up;
 
 	if (offset && get_user(of, offset))
 		return -EFAULT;
 
+	/* The __user pointer cast is valid because of the set_fs() */		
 	set_fs(KERNEL_DS);
-	ret = sys_sendfile((int)out_fd, (int)in_fd, offset ? &of : NULL, count);
+	up = offset ? (off_t __user *) &of : NULL;
+	ret = sys_sendfile((int)out_fd, (int)in_fd, up, count);
 	set_fs(old_fs);
 	
 	if (offset && put_user(of, offset))
@@ -579,17 +584,20 @@ asmlinkage long sys32_sendfile(u32 out_fd, u32 in_fd, compat_off_t* offset, u32
 	return ret;
 }
 
-asmlinkage int sys32_sendfile64(int out_fd, int in_fd, compat_loff_t *offset, s32 count)
+asmlinkage int sys32_sendfile64(int out_fd, int in_fd, compat_loff_t __user *offset, s32 count)
 {
 	mm_segment_t old_fs = get_fs();
 	int ret;
 	loff_t lof;
+	loff_t __user *up;
 	
 	if (offset && get_user(lof, offset))
 		return -EFAULT;
 		
+	/* The __user pointer cast is valid because of the set_fs() */		
 	set_fs(KERNEL_DS);
-	ret = sys_sendfile64(out_fd, in_fd, offset ? &lof : NULL, count);
+	up = offset ? (loff_t __user *) &lof : NULL;
+	ret = sys_sendfile64(out_fd, in_fd, up, count);
 	set_fs(old_fs);
 	
 	if (offset && put_user(lof, offset))
@@ -605,7 +613,7 @@ long sys32_execve(unsigned long a0, unsigned long a1, unsigned long a2,
 	int error;
 	char * filename;
 	
-	filename = getname((char *) a0);
+	filename = getname((char __user *) a0);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
 		goto out;
@@ -675,14 +683,15 @@ asmlinkage long sys32_prctl(u32 option, u32 arg2, u32 arg3, u32 arg4, u32 arg5)
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_sched_rr_get_interval(u32 pid, struct compat_timespec *interval)
+asmlinkage long sys32_sched_rr_get_interval(u32 pid, struct compat_timespec __user *interval)
 {
 	struct timespec t;
 	int ret;
 	mm_segment_t old_fs = get_fs ();
 
+	/* The __user pointer cast is valid because of the set_fs() */
 	set_fs (KERNEL_DS);
-	ret = sys_sched_rr_get_interval((int)pid, &t);
+	ret = sys_sched_rr_get_interval((int)pid, (struct timespec __user *) &t);
 	set_fs (old_fs);
 	if (put_compat_timespec(&t, interval))
 		return -EFAULT;
@@ -695,7 +704,7 @@ asmlinkage int sys32_pciconfig_read(u32 bus, u32 dfn, u32 off, u32 len, u32 ubuf
 				  (unsigned long) dfn,
 				  (unsigned long) off,
 				  (unsigned long) len,
-				  (unsigned char *)AA(ubuf));
+				  (unsigned char __user *)AA(ubuf));
 }
 
 asmlinkage int sys32_pciconfig_write(u32 bus, u32 dfn, u32 off, u32 len, u32 ubuf)
@@ -704,7 +713,7 @@ asmlinkage int sys32_pciconfig_write(u32 bus, u32 dfn, u32 off, u32 len, u32 ubu
 				   (unsigned long) dfn,
 				   (unsigned long) off,
 				   (unsigned long) len,
-				   (unsigned char *)AA(ubuf));
+				   (unsigned char __user *)AA(ubuf));
 }
 
 #define IOBASE_BRIDGE_NUMBER	0
@@ -765,7 +774,7 @@ asmlinkage int sys32_pciconfig_iobase(u32 which, u32 in_bus, u32 in_devfn)
 }
 
 
-asmlinkage int ppc64_newuname(struct new_utsname * name)
+asmlinkage int ppc64_newuname(struct new_utsname __user * name)
 {
 	int errno = sys_newuname(name);
 
@@ -795,7 +804,7 @@ asmlinkage int ppc64_personality(unsigned long personality)
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_access(const char * filename, u32 mode)
+asmlinkage long sys32_access(const char __user * filename, u32 mode)
 {
 	return sys_access(filename, (int)mode);
 }
@@ -806,7 +815,7 @@ asmlinkage long sys32_access(const char * filename, u32 mode)
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_creat(const char * pathname, u32 mode)
+asmlinkage long sys32_creat(const char __user * pathname, u32 mode)
 {
 	return sys_creat(pathname, (int)mode);
 }
@@ -817,7 +826,7 @@ asmlinkage long sys32_creat(const char * pathname, u32 mode)
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_waitpid(u32 pid, unsigned int * stat_addr, u32 options)
+asmlinkage long sys32_waitpid(u32 pid, unsigned int __user * stat_addr, u32 options)
 {
 	return sys_waitpid((int)pid, stat_addr, (int)options);
 }
@@ -828,7 +837,7 @@ asmlinkage long sys32_waitpid(u32 pid, unsigned int * stat_addr, u32 options)
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_getgroups(u32 gidsetsize, gid_t *grouplist)
+asmlinkage long sys32_getgroups(u32 gidsetsize, gid_t __user *grouplist)
 {
 	return sys_getgroups((int)gidsetsize, grouplist);
 }
@@ -883,7 +892,7 @@ asmlinkage long sys32_kill(u32 pid, u32 sig)
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_mkdir(const char * pathname, u32 mode)
+asmlinkage long sys32_mkdir(const char __user * pathname, u32 mode)
 {
 	return sys_mkdir(pathname, (int)mode);
 }
@@ -904,7 +913,7 @@ off_t ppc32_lseek(unsigned int fd, u32 offset, unsigned int origin)
  * This is just a version for 32-bit applications which does
  * not force O_LARGEFILE on.
  */
-long sys32_open(const char * filename, int flags, int mode)
+asmlinkage long sys32_open(const char __user * filename, int flags, int mode)
 {
 	char * tmp;
 	int fd, error;
@@ -936,7 +945,7 @@ long sys32_open(const char * filename, int flags, int mode)
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_readlink(const char * path, char * buf, u32 bufsiz)
+asmlinkage long sys32_readlink(const char __user * path, char __user * buf, u32 bufsiz)
 {
 	return sys_readlink(path, buf, (int)bufsiz);
 }
@@ -968,7 +977,7 @@ asmlinkage long sys32_sched_get_priority_min(u32 policy)
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_sched_getparam(u32 pid, struct sched_param *param)
+asmlinkage long sys32_sched_getparam(u32 pid, struct sched_param __user *param)
 {
 	return sys_sched_getparam((int)pid, param);
 }
@@ -990,7 +999,7 @@ asmlinkage long sys32_sched_getscheduler(u32 pid)
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_sched_setparam(u32 pid, struct sched_param *param)
+asmlinkage long sys32_sched_setparam(u32 pid, struct sched_param __user *param)
 {
 	return sys_sched_setparam((int)pid, param);
 }
@@ -1001,7 +1010,7 @@ asmlinkage long sys32_sched_setparam(u32 pid, struct sched_param *param)
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_sched_setscheduler(u32 pid, u32 policy, struct sched_param *param)
+asmlinkage long sys32_sched_setscheduler(u32 pid, u32 policy, struct sched_param __user *param)
 {
 	return sys_sched_setscheduler((int)pid, (int)policy, param);
 }
@@ -1012,7 +1021,7 @@ asmlinkage long sys32_sched_setscheduler(u32 pid, u32 policy, struct sched_param
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_setdomainname(char *name, u32 len)
+asmlinkage long sys32_setdomainname(char __user *name, u32 len)
 {
 	return sys_setdomainname(name, (int)len);
 }
@@ -1023,13 +1032,13 @@ asmlinkage long sys32_setdomainname(char *name, u32 len)
  * proper conversion (sign extension) between the register representation of a signed int (msr in 32-bit mode)
  * and the register representation of a signed int (msr in 64-bit mode) is performed.
  */
-asmlinkage long sys32_setgroups(u32 gidsetsize, gid_t *grouplist)
+asmlinkage long sys32_setgroups(u32 gidsetsize, gid_t __user *grouplist)
 {
 	return sys_setgroups((int)gidsetsize, grouplist);
 }
 
 
-asmlinkage long sys32_sethostname(char *name, u32 len)
+asmlinkage long sys32_sethostname(char __user *name, u32 len)
 {
 	/* sign extend len */
 	return sys_sethostname(name, (int)len);
@@ -1063,7 +1072,7 @@ asmlinkage long sys32_ssetmask(u32 newmask)
 	return sys_ssetmask((int) newmask);
 }
 
-long sys32_syslog(u32 type, char * buf, u32 len)
+asmlinkage long sys32_syslog(u32 type, char __user * buf, u32 len)
 {
 	/* sign extend len */
 	return sys_syslog(type, buf, (int)len);
@@ -1090,11 +1099,12 @@ struct __sysctl_args32 {
 	u32 __unused[4];
 };
 
-extern asmlinkage long sys32_sysctl(struct __sysctl_args32 *args)
+extern asmlinkage long sys32_sysctl(struct __sysctl_args32 __user *args)
 {
 	struct __sysctl_args32 tmp;
 	int error;
-	size_t oldlen, *oldlenp = NULL;
+	size_t oldlen;
+	size_t __user *oldlenp = NULL;
 	unsigned long addr = (((long)&args->__unused[0]) + 7) & ~7;
 
 	if (copy_from_user(&tmp, args, sizeof(tmp)))
@@ -1107,20 +1117,20 @@ extern asmlinkage long sys32_sysctl(struct __sysctl_args32 *args)
 		   basically copy the whole sysctl.c here, and
 		   glibc's __sysctl uses rw memory for the structure
 		   anyway.  */
+		oldlenp = (size_t __user *)addr;
 		if (get_user(oldlen, (u32 *)A(tmp.oldlenp)) ||
-		    put_user(oldlen, (size_t *)addr))
+		    put_user(oldlen, oldlenp))
 			return -EFAULT;
-		oldlenp = (size_t *)addr;
 	}
 
 	lock_kernel();
-	error = do_sysctl((int *)A(tmp.name), tmp.nlen, (void *)A(tmp.oldval),
-			  oldlenp, (void *)A(tmp.newval), tmp.newlen);
+	error = do_sysctl((int __user *)A(tmp.name), tmp.nlen, (void __user *)A(tmp.oldval),
+			  oldlenp, (void __user *)A(tmp.newval), tmp.newlen);
 	unlock_kernel();
 	if (oldlenp) {
 		if (!error) {
-			if (get_user(oldlen, (size_t *)addr) ||
-			    put_user(oldlen, (u32 *)A(tmp.oldlenp)))
+			if (get_user(oldlen, oldlenp) ||
+			    put_user(oldlen, (u32 __user *)A(tmp.oldlenp)))
 				error = -EFAULT;
 		}
 		copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
@@ -1128,7 +1138,7 @@ extern asmlinkage long sys32_sysctl(struct __sysctl_args32 *args)
 	return error;
 }
 
-asmlinkage long sys32_time(compat_time_t* tloc)
+asmlinkage long sys32_time(compat_time_t __user * tloc)
 {
 	compat_time_t secs;
 
@@ -1145,7 +1155,7 @@ asmlinkage long sys32_time(compat_time_t* tloc)
 	return secs;
 }
 
-int sys32_olduname(struct oldold_utsname * name)
+asmlinkage int sys32_olduname(struct oldold_utsname __user * name)
 {
 	int error;
 	
@@ -1180,37 +1190,26 @@ unsigned long sys32_mmap2(unsigned long addr, size_t len,
 	return sys_mmap(addr, len, prot, flags, fd, pgoff << 12);
 }
 
-int get_compat_timeval(struct timeval *tv, struct compat_timeval *ctv)
+int get_compat_timeval(struct timeval *tv, struct compat_timeval __user *ctv)
 {
 	return (verify_area(VERIFY_READ, ctv, sizeof(*ctv)) ||
 		__get_user(tv->tv_sec, &ctv->tv_sec) ||
 		__get_user(tv->tv_usec, &ctv->tv_usec)) ? -EFAULT : 0;
 }
 
-long sys32_utimes(char *filename, struct compat_timeval *tvs)
+asmlinkage long sys32_utimes(char __user *filename, struct compat_timeval __user *tvs)
 {
-	char *kfilename;
-	struct timeval ktvs[2];
-	mm_segment_t old_fs;
-	long ret;
+	struct timeval ktvs[2], *ptr;
 
-	kfilename = getname(filename);
-	ret = PTR_ERR(kfilename);
-	if (!IS_ERR(kfilename)) {
+	ptr = NULL;
 	if (tvs) {
 		if (get_compat_timeval(&ktvs[0], &tvs[0]) ||
 		    get_compat_timeval(&ktvs[1], &tvs[1]))
 			return -EFAULT;
+		ptr = ktvs;
 	}
 
-		old_fs = get_fs();
-		set_fs(KERNEL_DS);
-		ret = do_utimes(kfilename, (tvs ? &ktvs[0] : NULL));
-		set_fs(old_fs);
-
-		putname(kfilename);
-	}
-	return ret;
+	return do_utimes(filename, ptr);
 }
 
 long sys32_tgkill(u32 tgid, u32 pid, int sig)
@@ -1224,13 +1223,13 @@ long sys32_tgkill(u32 tgid, u32 pid, int sig)
  * The 32 bit ABI passes long longs in an odd even register pair.
  */
 
-compat_ssize_t sys32_pread64(unsigned int fd, char *ubuf, compat_size_t count,
+compat_ssize_t sys32_pread64(unsigned int fd, char __user *ubuf, compat_size_t count,
 			     u32 reg6, u32 poshi, u32 poslo)
 {
 	return sys_pread64(fd, ubuf, count, ((loff_t)poshi << 32) | poslo);
 }
 
-compat_ssize_t sys32_pwrite64(unsigned int fd, char *ubuf, compat_size_t count,
+compat_ssize_t sys32_pwrite64(unsigned int fd, char __user *ubuf, compat_size_t count,
 			      u32 reg6, u32 poshi, u32 poslo)
 {
 	return sys_pwrite64(fd, ubuf, count, ((loff_t)poshi << 32) | poslo);
@@ -1241,7 +1240,7 @@ compat_ssize_t sys32_readahead(int fd, u32 r4, u32 offhi, u32 offlo, u32 count)
 	return sys_readahead(fd, ((loff_t)offhi << 32) | offlo, count);
 }
 
-asmlinkage int sys32_truncate64(const char * path, u32 reg4,
+asmlinkage int sys32_truncate64(const char __user * path, u32 reg4,
 				unsigned long high, unsigned long low)
 {
 	return sys_truncate(path, (high << 32) | low);
@@ -1253,7 +1252,7 @@ asmlinkage int sys32_ftruncate64(unsigned int fd, u32 reg4, unsigned long high,
 	return sys_ftruncate(fd, (high << 32) | low);
 }
 
-long ppc32_lookup_dcookie(u32 cookie_high, u32 cookie_low, char *buf,
+long ppc32_lookup_dcookie(u32 cookie_high, u32 cookie_low, char __user *buf,
 			  size_t len)
 {
 	return sys_lookup_dcookie((u64)cookie_high << 32 | cookie_low,
@@ -1274,7 +1273,7 @@ long ppc32_fadvise64_64(int fd, int advice, u32 offset_high, u32 offset_low,
 			     (u64)len_high << 32 | len_low, advice);
 }
 
-extern long sys_timer_create(clockid_t, sigevent_t *, timer_t *);
+extern asmlinkage long sys_timer_create(clockid_t, sigevent_t __user *, timer_t __user *);
 
 long ppc32_timer_create(clockid_t clock,
 			struct compat_sigevent __user *ev32,
@@ -1303,7 +1302,10 @@ long ppc32_timer_create(clockid_t clock,
 
 	savefs = get_fs();
 	set_fs(KERNEL_DS);
-	err = sys_timer_create(clock, &event, &t);
+	/* The __user pointer casts are valid due to the set_fs() */
+	err = sys_timer_create(clock,
+		(sigevent_t __user *) &event,
+		(timer_t __user *) &t);
 	set_fs(savefs);
 
 	if (err == 0)

arch/ppc64/kernel/syscalls.c

@@ -57,7 +57,7 @@ check_bugs(void)
  * This is really horribly ugly.
  */
 asmlinkage int 
-sys_ipc (uint call, int first, int second, long third, void *ptr, long fifth)
+sys_ipc (uint call, int first, int second, long third, void __user *ptr, long fifth)
 {
 	int version, ret;
 
@@ -67,12 +67,12 @@ sys_ipc (uint call, int first, int second, long third, void *ptr, long fifth)
 	ret = -ENOSYS;
 	switch (call) {
 	case SEMOP:
-		ret = sys_semtimedop (first, (struct sembuf *)ptr, second,
+		ret = sys_semtimedop (first, (struct sembuf __user *)ptr, second,
 				      NULL);
 		break;
 	case SEMTIMEDOP:
-		ret = sys_semtimedop (first, (struct sembuf *)ptr, second,
-				      (const struct timespec *) fifth);
+		ret = sys_semtimedop (first, (struct sembuf __user *)ptr, second,
+				      (const struct timespec __user *) fifth);
 		break;
 	case SEMGET:
 		ret = sys_semget (first, second, third);
@@ -83,13 +83,13 @@ sys_ipc (uint call, int first, int second, long third, void *ptr, long fifth)
 		ret = -EINVAL;
 		if (!ptr)
 			break;
-		if ((ret = get_user(fourth.__pad, (void **)ptr)))
+		if ((ret = get_user(fourth.__pad, (void __user * __user *)ptr)))
 			break;
 		ret = sys_semctl (first, second, third, fourth);
 		break;
 	}
 	case MSGSND:
-		ret = sys_msgsnd (first, (struct msgbuf *) ptr, second, third);
+		ret = sys_msgsnd (first, (struct msgbuf __user *) ptr, second, third);
 		break;
 	case MSGRCV:
 		switch (version) {
@@ -100,7 +100,7 @@ sys_ipc (uint call, int first, int second, long third, void *ptr, long fifth)
 			if (!ptr)
 				break;
 			if ((ret = copy_from_user(&tmp,
-						(struct ipc_kludge *) ptr,
+						(struct ipc_kludge __user *) ptr,
 						sizeof (tmp)) ? -EFAULT : 0))
 				break;
 			ret = sys_msgrcv (first, tmp.msgp, second, tmp.msgtyp,
@@ -108,7 +108,7 @@ sys_ipc (uint call, int first, int second, long third, void *ptr, long fifth)
 			break;
 		}
 		default:
-			ret = sys_msgrcv (first, (struct msgbuf *) ptr,
+			ret = sys_msgrcv (first, (struct msgbuf __user *) ptr,
 					  second, fifth, third);
 			break;
 		}
@@ -117,35 +117,35 @@ sys_ipc (uint call, int first, int second, long third, void *ptr, long fifth)
 		ret = sys_msgget ((key_t) first, second);
 		break;
 	case MSGCTL:
-		ret = sys_msgctl (first, second, (struct msqid_ds *) ptr);
+		ret = sys_msgctl (first, second, (struct msqid_ds __user *) ptr);
 		break;
 	case SHMAT:
 		switch (version) {
 		default: {
 			ulong raddr;
-			ret = do_shmat (first, (char *) ptr, second, &raddr);
+			ret = do_shmat (first, (char __user *) ptr, second, &raddr);
 			if (ret)
 				break;
-			ret = put_user (raddr, (ulong *) third);
+			ret = put_user (raddr, (ulong __user *) third);
 			break;
 		}
 		case 1:	/* iBCS2 emulator entry point */
 			ret = -EINVAL;
 			if (!segment_eq(get_fs(), get_ds()))
 				break;
-			ret = do_shmat (first, (char *) ptr, second,
+			ret = do_shmat (first, (char __user *) ptr, second,
 					 (ulong *) third);
 			break;
 		}
 		break;
 	case SHMDT: 
-		ret = sys_shmdt ((char *)ptr);
+		ret = sys_shmdt ((char __user *)ptr);
 		break;
 	case SHMGET:
 		ret = sys_shmget (first, second, third);
 		break;
 	case SHMCTL:
-		ret = sys_shmctl (first, second, (struct shmid_ds *) ptr);
+		ret = sys_shmctl (first, second, (struct shmid_ds __user *) ptr);
 		break;
 	}
 
@@ -156,7 +156,7 @@ sys_ipc (uint call, int first, int second, long third, void *ptr, long fifth)
  * sys_pipe() is the normal C calling standard for creating
  * a pipe. It's not the way unix traditionally does this, though.
  */
-asmlinkage int sys_pipe(int *fildes)
+asmlinkage int sys_pipe(int __user *fildes)
 {
 	int fd[2];
 	int error;
@@ -202,7 +202,7 @@ static int __init set_fakeppc(char *str)
 }
 __setup("fakeppc", set_fakeppc);
 
-asmlinkage int sys_uname(struct old_utsname * name)
+asmlinkage int sys_uname(struct old_utsname __user * name)
 {
 	int err = -EFAULT;
 	
@@ -214,7 +214,7 @@ asmlinkage int sys_uname(struct old_utsname * name)
 	return err;
 }
 
-asmlinkage time_t sys64_time(time_t* tloc)
+asmlinkage time_t sys64_time(time_t __user * tloc)
 {
 	time_t secs;
 	time_t usecs;

arch/sparc64/kernel/sys32.S

@@ -6,6 +6,7 @@
  * Copyright (C) 1998 Jakub Jelinek   (jj@ultra.linux.cz)
  */
 
+#include <linux/config.h>
 #include <asm/errno.h>
 
 /* NOTE: call as jump breaks return stack, we have to avoid that */
@@ -79,6 +80,18 @@ sys32_mq_timedreceive:
 	jmpl		%g1 + %lo(compat_sys_mq_timedreceive), %g0
 	 srl		%o4, 0, %o4
 
+	.globl		sys32_select
+sys32_select:
+	sethi		%hi(compat_sys_select), %g1
+	jmpl		%g1 + %lo(compat_sys_select), %g0
+	 srl		%o4, 0, %o4
+
+	.globl		sys32_futex
+sys32_futex:
+	sethi		%hi(compat_sys_futex), %g1
+	jmpl		%g1 + %lo(compat_sys_futex), %g0
+	 srl		%o4, 0, %o4
+
 	.align		32
 	.globl		sys32_socketcall
 sys32_socketcall:	/* %o0=call, %o1=args */

arch/sparc64/kernel/systbls.S

@@ -37,7 +37,7 @@ sys_call_table32:
 	.word sys_madvise, sys_vhangup, sys32_truncate64, sys_mincore, sys32_getgroups16
 /*80*/	.word sys32_setgroups16, sys_getpgrp, sys_setgroups, compat_sys_setitimer, sys32_ftruncate64
 	.word sys_swapon, compat_sys_getitimer, sys_setuid, sys_sethostname, sys_setgid
-/*90*/	.word sys_dup2, sys_setfsuid, compat_sys_fcntl, compat_sys_select, sys_setfsgid
+/*90*/	.word sys_dup2, sys_setfsuid, compat_sys_fcntl, sys32_select, sys_setfsgid
 	.word sys_fsync, sys_setpriority32, sys_nis_syscall, sys_nis_syscall, sys_nis_syscall
 /*100*/ .word sys_getpriority, sys32_rt_sigreturn, sys32_rt_sigaction, sys32_rt_sigprocmask, sys32_rt_sigpending
 	.word sys32_rt_sigtimedwait, sys32_rt_sigqueueinfo, sys32_rt_sigsuspend, sys_setresuid, sys_getresuid
@@ -47,7 +47,7 @@ sys_call_table32:
 	.word sys_nis_syscall, sys32_setreuid16, sys32_setregid16, sys_rename, sys_truncate
 /*130*/	.word sys_ftruncate, sys_flock, sys_lstat64, sys_nis_syscall, sys_nis_syscall
 	.word sys_nis_syscall, sys_mkdir, sys_rmdir, sys32_utimes, sys_stat64
-/*140*/	.word sys32_sendfile64, sys_nis_syscall, compat_sys_futex, sys_gettid, compat_sys_getrlimit
+/*140*/	.word sys32_sendfile64, sys_nis_syscall, sys32_futex, sys_gettid, compat_sys_getrlimit
 	.word compat_sys_setrlimit, sys_pivot_root, sys32_prctl, sys32_pciconfig_read, sys32_pciconfig_write
 /*150*/	.word sys_nis_syscall, sys_nis_syscall, sys_nis_syscall, sys_poll, sys_getdents64
 	.word compat_sys_fcntl64, sys_ni_syscall, compat_sys_statfs, compat_sys_fstatfs, sys_oldumount
@@ -65,7 +65,7 @@ sys_call_table32:
 	.word sys32_ipc, sys32_sigreturn, sys_clone, sys_nis_syscall, sys32_adjtimex
 /*220*/	.word compat_sys_sigprocmask, sys_ni_syscall, sys32_delete_module, sys_ni_syscall, sys_getpgid
 	.word sys32_bdflush, sys32_sysfs, sys_nis_syscall, sys32_setfsuid16, sys32_setfsgid16
-/*230*/	.word compat_sys_select, sys_time, sys_nis_syscall, sys_stime, compat_statfs64
+/*230*/	.word sys32_select, sys_time, sys_nis_syscall, sys_stime, compat_statfs64
 	.word compat_fstatfs64, sys_llseek, sys_mlock, sys_munlock, sys_mlockall
 /*240*/	.word sys_munlockall, sys_sched_setparam, sys_sched_getparam, sys_sched_setscheduler, sys_sched_getscheduler
 	.word sys_sched_yield, sys_sched_get_priority_max, sys_sched_get_priority_min, sys32_sched_rr_get_interval, compat_sys_nanosleep

fs/compat.c

@@ -50,7 +50,7 @@
  * Not all architectures have sys_utime, so implement this in terms
  * of sys_utimes.
  */
-asmlinkage long compat_sys_utime(char *filename, struct compat_utimbuf *t)
+asmlinkage long compat_sys_utime(char __user *filename, struct compat_utimbuf __user *t)
 {
 	struct timeval tv[2];
 
@@ -64,7 +64,7 @@ asmlinkage long compat_sys_utime(char *filename, struct compat_utimbuf *t)
 	return do_utimes(filename, t ? tv : NULL);
 }
 
-asmlinkage long compat_sys_utimes(char *filename, struct compat_timeval *t)
+asmlinkage long compat_sys_utimes(char __user *filename, struct compat_timeval __user *t)
 {
 	struct timeval tv[2];
 
@@ -78,8 +78,8 @@ asmlinkage long compat_sys_utimes(char *filename, struct compat_timeval *t)
 	return do_utimes(filename, t ? tv : NULL);
 }
 
-asmlinkage long compat_sys_newstat(char * filename,
-		struct compat_stat *statbuf)
+asmlinkage long compat_sys_newstat(char __user * filename,
+		struct compat_stat __user *statbuf)
 {
 	struct kstat stat;
 	int error = vfs_stat(filename, &stat);
@@ -89,8 +89,8 @@ asmlinkage long compat_sys_newstat(char * filename,
 	return error;
 }
 
-asmlinkage long compat_sys_newlstat(char * filename,
-		struct compat_stat *statbuf)
+asmlinkage long compat_sys_newlstat(char __user * filename,
+		struct compat_stat __user *statbuf)
 {
 	struct kstat stat;
 	int error = vfs_lstat(filename, &stat);
@@ -101,7 +101,7 @@ asmlinkage long compat_sys_newlstat(char * filename,
 }
 
 asmlinkage long compat_sys_newfstat(unsigned int fd,
-		struct compat_stat * statbuf)
+		struct compat_stat __user * statbuf)
 {
 	struct kstat stat;
 	int error = vfs_fstat(fd, &stat);
@@ -111,7 +111,7 @@ asmlinkage long compat_sys_newfstat(unsigned int fd,
 	return error;
 }
 
-static int put_compat_statfs(struct compat_statfs *ubuf, struct kstatfs *kbuf)
+static int put_compat_statfs(struct compat_statfs __user *ubuf, struct kstatfs *kbuf)
 {
 	
 	if (sizeof ubuf->f_blocks == 4) {
@@ -145,7 +145,7 @@ static int put_compat_statfs(struct compat_statfs *ubuf, struct kstatfs *kbuf)
  * The following statfs calls are copies of code from fs/open.c and
  * should be checked against those from time to time
  */
-asmlinkage long compat_sys_statfs(const char *path, struct compat_statfs *buf)
+asmlinkage long compat_sys_statfs(const char __user *path, struct compat_statfs __user *buf)
 {
 	struct nameidata nd;
 	int error;
@@ -161,7 +161,7 @@ asmlinkage long compat_sys_statfs(const char *path, struct compat_statfs *buf)
 	return error;
 }
 
-asmlinkage long compat_sys_fstatfs(unsigned int fd, struct compat_statfs *buf)
+asmlinkage long compat_sys_fstatfs(unsigned int fd, struct compat_statfs __user *buf)
 {
 	struct file * file;
 	struct kstatfs tmp;
@@ -179,7 +179,7 @@ asmlinkage long compat_sys_fstatfs(unsigned int fd, struct compat_statfs *buf)
 	return error;
 }
 
-static int put_compat_statfs64(struct compat_statfs64 *ubuf, struct kstatfs *kbuf)
+static int put_compat_statfs64(struct compat_statfs64 __user *ubuf, struct kstatfs *kbuf)
 {
 	if (sizeof ubuf->f_blocks == 4) {
 		if ((kbuf->f_blocks | kbuf->f_bfree |
@@ -203,7 +203,7 @@ static int put_compat_statfs64(struct compat_statfs64 *ubuf, struct kstatfs *kbu
 	return 0;
 }
 
-asmlinkage long compat_statfs64(const char *path, compat_size_t sz, struct compat_statfs64 *buf)
+asmlinkage long compat_statfs64(const char __user *path, compat_size_t sz, struct compat_statfs64 __user *buf)
 {
 	struct nameidata nd;
 	int error;
@@ -222,7 +222,7 @@ asmlinkage long compat_statfs64(const char *path, compat_size_t sz, struct compa
 	return error;
 }
 
-asmlinkage long compat_fstatfs64(unsigned int fd, compat_size_t sz, struct compat_statfs64 *buf)
+asmlinkage long compat_fstatfs64(unsigned int fd, compat_size_t sz, struct compat_statfs64 __user *buf)
 {
 	struct file * file;
 	struct kstatfs tmp;
@@ -450,7 +450,7 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
 	return error;
 }
 
-static int get_compat_flock(struct flock *kfl, struct compat_flock *ufl)
+static int get_compat_flock(struct flock *kfl, struct compat_flock __user *ufl)
 {
 	if (!access_ok(VERIFY_READ, ufl, sizeof(*ufl)) ||
 	    __get_user(kfl->l_type, &ufl->l_type) ||
@@ -462,7 +462,7 @@ static int get_compat_flock(struct flock *kfl, struct compat_flock *ufl)
 	return 0;
 }
 
-static int put_compat_flock(struct flock *kfl, struct compat_flock *ufl)
+static int put_compat_flock(struct flock *kfl, struct compat_flock __user *ufl)
 {
 	if (!access_ok(VERIFY_WRITE, ufl, sizeof(*ufl)) ||
 	    __put_user(kfl->l_type, &ufl->l_type) ||
@@ -475,7 +475,7 @@ static int put_compat_flock(struct flock *kfl, struct compat_flock *ufl)
 }
 
 #ifndef HAVE_ARCH_GET_COMPAT_FLOCK64
-static int get_compat_flock64(struct flock *kfl, struct compat_flock64 *ufl)
+static int get_compat_flock64(struct flock *kfl, struct compat_flock64 __user *ufl)
 {
 	if (!access_ok(VERIFY_READ, ufl, sizeof(*ufl)) ||
 	    __get_user(kfl->l_type, &ufl->l_type) ||
@@ -489,7 +489,7 @@ static int get_compat_flock64(struct flock *kfl, struct compat_flock64 *ufl)
 #endif
 
 #ifndef HAVE_ARCH_PUT_COMPAT_FLOCK64
-static int put_compat_flock64(struct flock *kfl, struct compat_flock64 *ufl)
+static int put_compat_flock64(struct flock *kfl, struct compat_flock64 __user *ufl)
 {
 	if (!access_ok(VERIFY_WRITE, ufl, sizeof(*ufl)) ||
 	    __put_user(kfl->l_type, &ufl->l_type) ||
@@ -566,7 +566,7 @@ asmlinkage long compat_sys_fcntl(unsigned int fd, unsigned int cmd,
 }
 
 asmlinkage long
-compat_sys_io_setup(unsigned nr_reqs, u32 *ctx32p)
+compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
 {
 	long ret;
 	aio_context_t ctx64;
@@ -576,7 +576,8 @@ compat_sys_io_setup(unsigned nr_reqs, u32 *ctx32p)
 		return -EFAULT;
 
 	set_fs(KERNEL_DS);
-	ret = sys_io_setup(nr_reqs, &ctx64);
+	/* The __user pointer cast is valid because of the set_fs() */
+	ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
 	set_fs(oldfs);
 	/* truncating is ok because it's a user address */
 	if (!ret)
@@ -588,12 +589,12 @@ asmlinkage long
 compat_sys_io_getevents(aio_context_t ctx_id,
 				 unsigned long min_nr,
 				 unsigned long nr,
-				 struct io_event *events,
-				 struct compat_timespec *timeout)
+				 struct io_event __user *events,
+				 struct compat_timespec __user *timeout)
 {
 	long ret;
 	struct timespec t;
-	struct timespec *ut = NULL;
+	struct timespec __user *ut = NULL;
 
 	ret = -EFAULT;
 	if (unlikely(!access_ok(VERIFY_WRITE, events, 
@@ -613,7 +614,7 @@ compat_sys_io_getevents(aio_context_t ctx_id,
 }
 
 static inline long
-copy_iocb(long nr, u32 *ptr32, u64 *ptr64)
+copy_iocb(long nr, u32 __user *ptr32, u64 __user *ptr64)
 {
 	compat_uptr_t uptr;
 	int i;
@@ -630,9 +631,9 @@ copy_iocb(long nr, u32 *ptr32, u64 *ptr64)
 #define MAX_AIO_SUBMITS 	(PAGE_SIZE/sizeof(struct iocb *))
 
 asmlinkage long
-compat_sys_io_submit(aio_context_t ctx_id, int nr, u32 *iocb)
+compat_sys_io_submit(aio_context_t ctx_id, int nr, u32 __user *iocb)
 {
-	struct iocb **iocb64; 
+	struct iocb __user * __user *iocb64; 
 	long ret;
 
 	if (unlikely(nr < 0))
@@ -642,7 +643,7 @@ compat_sys_io_submit(aio_context_t ctx_id, int nr, u32 *iocb)
 		nr = MAX_AIO_SUBMITS;
 	
 	iocb64 = compat_alloc_user_space(nr * sizeof(*iocb64));
-	ret = copy_iocb(nr, iocb, (u64 *) iocb64);
+	ret = copy_iocb(nr, iocb, (u64 __user *) iocb64);
 	if (!ret)
 		ret = sys_io_submit(ctx_id, nr, iocb64);
 	return ret;
@@ -980,7 +981,7 @@ compat_sys_writev(unsigned long fd, const struct compat_iovec __user *vec, unsig
  * a copy of count() from fs/exec.c, except that it works with 32 bit argv
  * and envp pointers.
  */
-static int compat_count(compat_uptr_t *argv, int max)
+static int compat_count(compat_uptr_t __user *argv, int max)
 {
 	int i = 0;
 
@@ -1452,7 +1453,7 @@ union compat_nfsctl_res {
 	struct knfsd_fh		cr32_getfs;
 };
 
-static int compat_nfs_svc_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg *arg)
+static int compat_nfs_svc_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg __user *arg)
 {
 	int err;
 
@@ -1463,7 +1464,7 @@ static int compat_nfs_svc_trans(struct nfsctl_arg *karg, struct compat_nfsctl_ar
 	return (err) ? -EFAULT : 0;
 }
 
-static int compat_nfs_clnt_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg *arg)
+static int compat_nfs_clnt_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg __user *arg)
 {
 	int err;
 
@@ -1487,7 +1488,7 @@ static int compat_nfs_clnt_trans(struct nfsctl_arg *karg, struct compat_nfsctl_a
 	return (err) ? -EFAULT : 0;
 }
 
-static int compat_nfs_exp_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg *arg)
+static int compat_nfs_exp_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg __user *arg)
 {
 	int err;
 
@@ -1515,7 +1516,7 @@ static int compat_nfs_exp_trans(struct nfsctl_arg *karg, struct compat_nfsctl_ar
 	return (err) ? -EFAULT : 0;
 }
 
-static int compat_nfs_getfd_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg *arg)
+static int compat_nfs_getfd_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg __user *arg)
 {
 	int err;
 
@@ -1533,7 +1534,7 @@ static int compat_nfs_getfd_trans(struct nfsctl_arg *karg, struct compat_nfsctl_
 	return (err) ? -EFAULT : 0;
 }
 
-static int compat_nfs_getfs_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg *arg)
+static int compat_nfs_getfs_trans(struct nfsctl_arg *karg, struct compat_nfsctl_arg __user *arg)
 {
 	int err;
 
@@ -1554,7 +1555,7 @@ static int compat_nfs_getfs_trans(struct nfsctl_arg *karg, struct compat_nfsctl_
 /* This really doesn't need translations, we are only passing
  * back a union which contains opaque nfs file handle data.
  */
-static int compat_nfs_getfh_res_trans(union nfsctl_res *kres, union compat_nfsctl_res *res)
+static int compat_nfs_getfh_res_trans(union nfsctl_res *kres, union compat_nfsctl_res __user *res)
 {
 	int err;
 
@@ -1563,8 +1564,8 @@ static int compat_nfs_getfh_res_trans(union nfsctl_res *kres, union compat_nfsct
 	return (err) ? -EFAULT : 0;
 }
 
-asmlinkage long compat_sys_nfsservctl(int cmd, struct compat_nfsctl_arg *arg,
-					union compat_nfsctl_res *res)
+asmlinkage long compat_sys_nfsservctl(int cmd, struct compat_nfsctl_arg __user *arg,
+					union compat_nfsctl_res __user *res)
 {
 	struct nfsctl_arg *karg;
 	union nfsctl_res *kres;
@@ -1611,7 +1612,8 @@ asmlinkage long compat_sys_nfsservctl(int cmd, struct compat_nfsctl_arg *arg,
 
 	oldfs = get_fs();
 	set_fs(KERNEL_DS);
-	err = sys_nfsservctl(cmd, karg, kres);
+	/* The __user pointer casts are valid because of the set_fs() */
+	err = sys_nfsservctl(cmd, (void __user *) karg, (void __user *) kres);
 	set_fs(oldfs);
 
 	if (err)

include/asm-mips/mach-dec/mc146818rtc.h

@@ -23,7 +23,7 @@ extern unsigned long dec_kn_slot_size;
 #define RTC_PORT(x)	CPHYSADDR(dec_rtc_base)
 #define RTC_IO_EXTENT	dec_kn_slot_size
 #define RTC_IOMAPPED	0
-#define RTC_IRQ		0
+#undef RTC_IRQ
 
 #define RTC_DEC_YEAR	0x3f	/* Where we store the real year on DECs.  */
 

include/asm-ppc64/compat.h

@@ -117,12 +117,12 @@ typedef u32		compat_sigset_word;
  */
 typedef	u32		compat_uptr_t;
 
-static inline void *compat_ptr(compat_uptr_t uptr)
+static inline void __user *compat_ptr(compat_uptr_t uptr)
 {
-	return (void *)(unsigned long)uptr;
+	return (void __user *)(unsigned long)uptr;
 }
 
-static inline void *compat_alloc_user_space(long len)
+static inline void __user *compat_alloc_user_space(long len)
 {
 	struct pt_regs *regs = current->thread.regs;
 	unsigned long usp = regs->gpr[1];
@@ -134,7 +134,7 @@ static inline void *compat_alloc_user_space(long len)
 	if (!(test_thread_flag(TIF_32BIT)))
 		usp -= 288;
 
-	return (void *) (usp - len);
+	return (void __user *) (usp - len);
 }
 
 /*

include/asm-ppc64/ipc.h

@@ -12,7 +12,7 @@
  * 2 of the License, or (at your option) any later version.
  */
 struct ipc_kludge {
-	struct msgbuf *msgp;
+	struct msgbuf __user *msgp;
 	long msgtyp;
 };
 

include/asm-ppc64/unistd.h

@@ -455,7 +455,7 @@ int sys_fork(unsigned long p1, unsigned long p2, unsigned long p3,
 int sys_vfork(unsigned long p1, unsigned long p2, unsigned long p3,
 		unsigned long p4, unsigned long p5, unsigned long p6,
 		struct pt_regs *regs);
-int sys_pipe(int *fildes);
+int sys_pipe(int __user *fildes);
 int sys_ptrace(long request, long pid, long addr, long data);
 struct sigaction;
 long sys_rt_sigaction(int sig, const struct sigaction __user *act,

sound/oss/aci.c

@@ -362,7 +362,7 @@ static int getequalizer(int __user *arg,
 static int aci_mixer_ioctl (int dev, unsigned int cmd, void __user * arg)
 {
 	int vol, buf;
-	int __user *p;
+	int __user *p = arg;
 
 	switch (cmd) {
 	case SOUND_MIXER_WRITE_VOLUME: