[PATCH] sparse: drivers/char/*

the rest of BROKEN_ON_SMP drivers in drivers/char sparsified.
Signed-off-by: Al Viro <viro@parcelfarce.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

drivers/char/epca.c

@@ -48,8 +48,8 @@
 #define ENABLE_PCI
 #endif /* CONFIG_PCI */
 
-#define putUser(arg1, arg2) put_user(arg1, (unsigned long *)arg2)
-#define getUser(arg1, arg2) get_user(arg1, (unsigned int *)arg2)
+#define putUser(arg1, arg2) put_user(arg1, (unsigned long __user *)arg2)
+#define getUser(arg1, arg2) get_user(arg1, (unsigned __user *)arg2)
 
 #ifdef ENABLE_PCI
 #include <linux/pci.h>
@@ -218,7 +218,7 @@ static void setup_empty_event(struct tty_struct *tty, struct channel *ch);
 void epca_setup(char *, int *);
 void console_print(const char *);
 
-static int get_termio(struct tty_struct *, struct termio *);
+static int get_termio(struct tty_struct *, struct termio __user *);
 static int pc_write(struct tty_struct *, int, const unsigned char *, int);
 int pc_init(void);
 
@@ -835,38 +835,29 @@ static int pc_write(struct tty_struct * tty, int from_user,
 
 		if (bytesAvailable) 
 		{ /* Begin bytesAvailable */
+			/* ---------------------------------------------------------------
+				The below function reads data from user memory.  This routine
+				can not be used in an interrupt routine. (Because it may 
+				generate a page fault)  It can only be called while we can the
+				user context is accessible. 
+
+				The prototype is :
+				inline void copy_from_user(void * to, const void * from,
+							  unsigned long count);
+
+				I also think (Check hackers guide) that optimization must
+				be turned ON.  (Which sounds strange to me...)
+
+				Remember copy_from_user WILL generate a page fault if the
+				user memory being accessed has been swapped out.  This can
+				cause this routine to temporarily sleep while this page
+				fault is occurring.
+			
+			----------------------------------------------------------------- */
 
-			/* Can the user buffer be accessed at the moment ? */
-			if (verify_area(VERIFY_READ, (char*)buf, bytesAvailable))
-				bytesAvailable = 0; /* Can't do; try again later */
-			else  /* Evidently it can, began transmission */
-			{ /* Begin if area verified */
-				/* ---------------------------------------------------------------
-					The below function reads data from user memory.  This routine
-					can not be used in an interrupt routine. (Because it may 
-					generate a page fault)  It can only be called while we can the
-					user context is accessible. 
-
-					The prototype is :
-					inline void copy_from_user(void * to, const void * from,
-					                          unsigned long count);
-
-					I also think (Check hackers guide) that optimization must
-					be turned ON.  (Which sounds strange to me...)
-	
-					Remember copy_from_user WILL generate a page fault if the
-					user memory being accessed has been swapped out.  This can
-					cause this routine to temporarily sleep while this page
-					fault is occurring.
-				
-				----------------------------------------------------------------- */
-
-				if (copy_from_user(ch->tmp_buf, buf,
-						   bytesAvailable))
-					return -EFAULT;
-
-			} /* End if area verified */
-
+			if (copy_from_user(ch->tmp_buf, buf,
+					   bytesAvailable))
+				return -EFAULT;
 		} /* End bytesAvailable */
 
 		/* ------------------------------------------------------------------ 
@@ -1984,7 +1975,7 @@ static void post_fep_init(unsigned int crd)
 		ch->boardnum   = crd;
 		ch->channelnum = i;
 		ch->magic      = EPCA_MAGIC;
-		ch->tty        = 0;
+		ch->tty        = NULL;
 
 		if (shrinkmem) 
 		{
@@ -2728,7 +2719,7 @@ static void receive_data(struct channel *ch)
 { /* Begin receive_data */
 
 	unchar *rptr;
-	struct termios *ts = 0;
+	struct termios *ts = NULL;
 	struct tty_struct *tty;
 	volatile struct board_chan *bc;
 	register int dataToRead, wrapgap, bytesAvailable;
@@ -2851,8 +2842,6 @@ static void receive_data(struct channel *ch)
 static int info_ioctl(struct tty_struct *tty, struct file * file,
 		    unsigned int cmd, unsigned long arg)
 {
-	int error;
-	
 	switch (cmd) 
 	{ /* Begin switch cmd */
 
@@ -2862,13 +2851,7 @@ static int info_ioctl(struct tty_struct *tty, struct file * file,
 			struct digi_info di ;
 			int brd;
 
-			getUser(brd, (unsigned int *)arg);
-
-			if ((error = verify_area(VERIFY_WRITE, (char*)arg, sizeof(di))))
-			{
-				printk(KERN_ERR "DIGI_GETINFO : verify area size 0x%x failed\n",sizeof(di));
-				return(error);
-			}
+			getUser(brd, (unsigned int __user *)arg);
 
 			if ((brd < 0) || (brd >= num_cards) || (num_cards == 0))
 				return (-ENODEV);
@@ -2882,7 +2865,7 @@ static int info_ioctl(struct tty_struct *tty, struct file * file,
 			di.port = boards[brd].port ;
 			di.membase = boards[brd].membase ;
 
-			if (copy_to_user((char *)arg, &di, sizeof (di)))
+			if (copy_to_user((void __user *)arg, &di, sizeof (di)))
 				return -EFAULT;
 			break;
 
@@ -3020,6 +3003,7 @@ static int pc_tiocmset(struct tty_struct *tty, struct file *file,
 	epcaparam(tty,ch);
 	memoff(ch);
 	restore_flags(flags);
+	return 0;
 }
 
 static int pc_ioctl(struct tty_struct *tty, struct file * file,
@@ -3027,12 +3011,13 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
 { /* Begin pc_ioctl */
 
 	digiflow_t dflow;
-	int retval, error;
+	int retval;
 	unsigned long flags;
 	unsigned int mflag, mstat;
 	unsigned char startc, stopc;
 	volatile struct board_chan *bc;
 	struct channel *ch = (struct channel *) tty->driver_data;
+	void __user *argp = (void __user *)arg;
 	
 	if (ch)
 		bc = ch->brdchan;
@@ -3054,13 +3039,13 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
 	{ /* Begin switch cmd */
 
 		case TCGETS:
-			if (copy_to_user((struct termios *)arg, 
+			if (copy_to_user(argp, 
 					 tty->termios, sizeof(struct termios)))
 				return -EFAULT;
 			return(0);
 
 		case TCGETA:
-			return get_termio(tty, (struct termio *)arg);
+			return get_termio(tty, argp);
 
 		case TCSBRK:	/* SVID version: non-zero arg --> no break */
 
@@ -3090,21 +3075,16 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
 			return 0;
 
 		case TIOCGSOFTCAR:
-
-			error = verify_area(VERIFY_WRITE, (void *) arg,sizeof(long));
-			if (error)
-				return error;
-
-			putUser(C_CLOCAL(tty) ? 1 : 0,
-			            (unsigned long *) arg);
+			if (put_user(C_CLOCAL(tty)?1:0, (unsigned long __user *)arg))
+				return -EFAULT;
 			return 0;
 
 		case TIOCSSOFTCAR:
-			/*RONNIE PUT VERIFY_READ (See above) check here */
 		{
 			unsigned int value;
 
-			getUser(value, (unsigned int *)arg);
+			if (get_user(value, (unsigned __user *)argp))
+				return -EFAULT;
 			tty->termios->c_cflag =
 				((tty->termios->c_cflag & ~CLOCAL) |
 				 (value ? CLOCAL : 0));
@@ -3113,12 +3093,12 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
 
 		case TIOCMODG:
 			mflag = pc_tiocmget(tty, file);
-			if (putUser(mflag, (unsigned int *) arg))
+			if (put_user(mflag, (unsigned long __user *)argp))
 				return -EFAULT;
 			break;
 
 		case TIOCMODS:
-			if (getUser(mstat, (unsigned int *)arg))
+			if (get_user(mstat, (unsigned __user *)argp))
 				return -EFAULT;
 			return pc_tiocmset(tty, file, mstat, ~mstat);
 
@@ -3141,8 +3121,7 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
 			break;
 
 		case DIGI_GETA:
-			if (copy_to_user((char*)arg, &ch->digiext,
-					 sizeof(digi_t)))
+			if (copy_to_user(argp, &ch->digiext, sizeof(digi_t)))
 				return -EFAULT;
 			break;
 
@@ -3164,8 +3143,7 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
 			/* Fall Thru */
 
 		case DIGI_SETA:
-			if (copy_from_user(&ch->digiext, (char*)arg,
-					   sizeof(digi_t)))
+			if (copy_from_user(&ch->digiext, argp, sizeof(digi_t)))
 				return -EFAULT;
 			
 			if (ch->digiext.digi_flags & DIGI_ALTPIN) 
@@ -3209,7 +3187,7 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
 			memoff(ch);
 			restore_flags(flags);
 
-			if (copy_to_user((char*)arg, &dflow, sizeof(dflow)))
+			if (copy_to_user(argp, &dflow, sizeof(dflow)))
 				return -EFAULT;
 			break;
 
@@ -3226,7 +3204,7 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
 				stopc = ch->stopca;
 			}
 
-			if (copy_from_user(&dflow, (char*)arg, sizeof(dflow)))
+			if (copy_from_user(&dflow, argp, sizeof(dflow)))
 				return -EFAULT;
 
 			if (dflow.startc != startc || dflow.stopc != stopc) 
@@ -3555,17 +3533,9 @@ static void setup_empty_event(struct tty_struct *tty, struct channel *ch)
 
 /* --------------------- Begin get_termio ----------------------- */
 
-static int get_termio(struct tty_struct * tty, struct termio * termio)
+static int get_termio(struct tty_struct * tty, struct termio __user * termio)
 { /* Begin get_termio */
-	int error;
-
-	error = verify_area(VERIFY_WRITE, termio, sizeof (struct termio));
-	if (error)
-		return error;
-
-	kernel_termios_to_user_termio(termio, tty->termios);
-
-	return 0;
+	return kernel_termios_to_user_termio(termio, tty->termios);
 } /* End get_termio */
 /* ---------------------- Begin epca_setup  -------------------------- */
 void epca_setup(char *str, int *ints)

drivers/char/esp.c

@@ -933,7 +933,7 @@ static int startup(struct esp_struct * info)
 		else if (request_dma(dma, "esp serial")) {
 			free_pages((unsigned long)dma_buffer,
 				   get_order(DMA_BUFFER_SZ));
-			dma_buffer = 0;
+			dma_buffer = NULL;
 			info->stat_flags |= ESP_STAT_USE_PIO;
 		}
 			
@@ -1038,13 +1038,13 @@ static void shutdown(struct esp_struct * info)
 			free_dma(dma);
 			free_pages((unsigned long)dma_buffer,
 				   get_order(DMA_BUFFER_SZ));
-			dma_buffer = 0;
+			dma_buffer = NULL;
 		}		
 	}
 
 	if (info->xmit_buf) {
 		free_page((unsigned long) info->xmit_buf);
-		info->xmit_buf = 0;
+		info->xmit_buf = NULL;
 	}
 
 	info->IER = 0;
@@ -1435,12 +1435,10 @@ static void rs_unthrottle(struct tty_struct * tty)
  */
 
 static int get_serial_info(struct esp_struct * info,
-			   struct serial_struct * retinfo)
+			   struct serial_struct __user *retinfo)
 {
 	struct serial_struct tmp;
   
-	if (!retinfo)
-		return -EFAULT;
 	memset(&tmp, 0, sizeof(tmp));
 	tmp.type = PORT_16550A;
 	tmp.line = info->line;
@@ -1459,7 +1457,7 @@ static int get_serial_info(struct esp_struct * info,
 }
 
 static int get_esp_config(struct esp_struct * info,
-			  struct hayes_esp_config * retinfo)
+			  struct hayes_esp_config __user *retinfo)
 {
 	struct hayes_esp_config tmp;
   
@@ -1479,7 +1477,7 @@ static int get_esp_config(struct esp_struct * info,
 }
 
 static int set_serial_info(struct esp_struct * info,
-			   struct serial_struct * new_info)
+			   struct serial_struct __user *new_info)
 {
 	struct serial_struct new_serial;
 	struct esp_struct old_info;
@@ -1594,7 +1592,7 @@ static int set_serial_info(struct esp_struct * info,
 }
 
 static int set_esp_config(struct esp_struct * info,
-			  struct hayes_esp_config * new_info)
+			  struct hayes_esp_config __user * new_info)
 {
 	struct hayes_esp_config new_config;
 	unsigned int change_dma;
@@ -1739,7 +1737,7 @@ static int set_esp_config(struct esp_struct * info,
  * 	    transmit holding register is empty.  This functionality
  * 	    allows an RS485 driver to be written in user space. 
  */
-static int get_lsr_info(struct esp_struct * info, unsigned int *value)
+static int get_lsr_info(struct esp_struct * info, unsigned int __user *value)
 {
 	unsigned char status;
 	unsigned int result;
@@ -1834,7 +1832,8 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
 {
 	struct esp_struct * info = (struct esp_struct *)tty->driver_data;
 	struct async_icount cprev, cnow;	/* kernel counter temps */
-	struct serial_icounter_struct *p_cuser;	/* user space */
+	struct serial_icounter_struct __user *p_cuser;	/* user space */
+	void __user *argp = (void __user *)arg;
 
 	if (serial_paranoia_check(info, tty->name, "rs_ioctl"))
 		return -ENODEV;
@@ -1850,20 +1849,18 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
 	
 	switch (cmd) {
 		case TIOCGSERIAL:
-			return get_serial_info(info,
-					       (struct serial_struct *) arg);
+			return get_serial_info(info, argp);
 		case TIOCSSERIAL:
-			return set_serial_info(info,
-					       (struct serial_struct *) arg);
+			return set_serial_info(info, argp);
 		case TIOCSERCONFIG:
 			/* do not reconfigure after initial configuration */
 			return 0;
 
 		case TIOCSERGWILD:
-			return put_user(0L, (unsigned long *) arg);
+			return put_user(0L, (unsigned long __user *)argp);
 
 		case TIOCSERGETLSR: /* Get line status register */
-			    return get_lsr_info(info, (unsigned int *) arg);
+			    return get_lsr_info(info, argp);
 
 		case TIOCSERSWILD:
 			if (!capable(CAP_SYS_ADMIN))
@@ -1917,7 +1914,7 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
 			cli();
 			cnow = info->icount;
 			sti();
-			p_cuser = (struct serial_icounter_struct *) arg;
+			p_cuser = argp;
 			if (put_user(cnow.cts, &p_cuser->cts) ||
 			    put_user(cnow.dsr, &p_cuser->dsr) ||
 			    put_user(cnow.rng, &p_cuser->rng) ||
@@ -1926,9 +1923,9 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
 
 			return 0;
 	case TIOCGHAYESESP:
-		return (get_esp_config(info, (struct hayes_esp_config *)arg));
+		return get_esp_config(info, argp);
 	case TIOCSHAYESESP:
-		return (set_esp_config(info, (struct hayes_esp_config *)arg));
+		return set_esp_config(info, argp);
 
 		default:
 			return -ENOIOCTLCMD;
@@ -2076,7 +2073,7 @@ static void rs_close(struct tty_struct *tty, struct file * filp)
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
 	info->event = 0;
-	info->tty = 0;
+	info->tty = NULL;
 
 	if (info->blocked_open) {
 		if (info->close_delay) {
@@ -2144,7 +2141,7 @@ static void esp_hangup(struct tty_struct *tty)
 	info->event = 0;
 	info->count = 0;
 	info->flags &= ~ASYNC_NORMAL_ACTIVE;
-	info->tty = 0;
+	info->tty = NULL;
 	wake_up_interruptible(&info->open_wait);
 }
 
@@ -2446,7 +2443,7 @@ int __init espserial_init(void)
 	int i, offset;
 	int region_start;
 	struct esp_struct * info;
-	struct esp_struct *last_primary = 0;
+	struct esp_struct *last_primary = NULL;
 	int esp[] = {0x100,0x140,0x180,0x200,0x240,0x280,0x300,0x380};
 
 	esp_driver = alloc_tty_driver(NR_PORTS);

drivers/char/generic_serial.c

@@ -45,7 +45,7 @@ static int gs_debug;
 #define func_enter() gs_dprintk (GS_DEBUG_FLOW, "gs: enter %s\n", __FUNCTION__)
 #define func_exit()  gs_dprintk (GS_DEBUG_FLOW, "gs: exit  %s\n", __FUNCTION__)
 
-#if NEW_WRITE_LOCKING
+#ifdef NEW_WRITE_LOCKING
 #define DECL      /* Nothing */
 #define LOCKIT    down (& port->port_write_sem);
 #define RELEASEIT up (&port->port_write_sem);
@@ -526,7 +526,7 @@ void gs_shutdown_port (struct gs_port *port)
 
 	if (port->xmit_buf) {
 		free_page((unsigned long) port->xmit_buf);
-		port->xmit_buf = 0;
+		port->xmit_buf = NULL;
 	}
 
 	if (port->tty)
@@ -767,7 +767,7 @@ void gs_close(struct tty_struct * tty, struct file * filp)
 	port->event = 0;
 	port->rd->close (port);
 	port->rd->shutdown_port (port);
-	port->tty = 0;
+	port->tty = NULL;
 
 	if (port->blocked_open) {
 		if (port->close_delay) {
@@ -967,7 +967,7 @@ int gs_init_port(struct gs_port *port)
 }
 
 
-int gs_setserial(struct gs_port *port, struct serial_struct *sp)
+int gs_setserial(struct gs_port *port, struct serial_struct __user *sp)
 {
 	struct serial_struct sio;
 
@@ -1002,7 +1002,7 @@ int gs_setserial(struct gs_port *port, struct serial_struct *sp)
  *      Generate the serial struct info.
  */
 
-int gs_getserial(struct gs_port *port, struct serial_struct *sp)
+int gs_getserial(struct gs_port *port, struct serial_struct __user *sp)
 {
 	struct serial_struct    sio;
 

drivers/char/ip2main.c

@@ -203,16 +203,16 @@ static void ip2_wait_until_sent(PTTY,int);
 
 static void set_params (i2ChanStrPtr, struct termios *);
 static int set_modem_info(i2ChanStrPtr, unsigned int, unsigned int *);
-static int get_serial_info(i2ChanStrPtr, struct serial_struct *);
-static int set_serial_info(i2ChanStrPtr, struct serial_struct *);
+static int get_serial_info(i2ChanStrPtr, struct serial_struct __user *);
+static int set_serial_info(i2ChanStrPtr, struct serial_struct __user *);
 
-static ssize_t ip2_ipl_read(struct file *, char *, size_t, loff_t *);
-static ssize_t ip2_ipl_write(struct file *, const char *, size_t, loff_t *);
+static ssize_t ip2_ipl_read(struct file *, char __user *, size_t, loff_t *);
+static ssize_t ip2_ipl_write(struct file *, const char __user *, size_t, loff_t *);
 static int ip2_ipl_ioctl(struct inode *, struct file *, UINT, ULONG);
 static int ip2_ipl_open(struct inode *, struct file *);
 
-static int DumpTraceBuffer(char *, int);
-static int DumpFifoBuffer( char *, int);
+static int DumpTraceBuffer(char __user *, int);
+static int DumpFifoBuffer( char __user *, int);
 
 static void ip2_init_board(int);
 static unsigned short find_eisa_board(int);
@@ -1121,7 +1121,7 @@ set_irq( int boardnum, int boardIrq )
 /******************************************************************************/
 
 static inline void
-service_all_boards()
+service_all_boards(void)
 {
 	int i;
 	i2eBordStrPtr  pB;
@@ -2082,9 +2082,10 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
 	wait_queue_t wait;
 	i2ChanStrPtr pCh = DevTable[tty->index];
 	struct async_icount cprev, cnow;	/* kernel counter temps */
-	struct serial_icounter_struct *p_cuser;	/* user space */
+	struct serial_icounter_struct __user *p_cuser;
 	int rc = 0;
 	unsigned long flags;
+	void __user *argp = (void __user *)arg;
 
 	if ( pCh == NULL ) {
 		return -ENODEV;
@@ -2101,7 +2102,7 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
 
 		ip2trace (CHANN, ITRC_IOCTL, 2, 1, rc );
 
-		rc = get_serial_info(pCh, (struct serial_struct *) arg);
+		rc = get_serial_info(pCh, argp);
 		if (rc)
 			return rc;
 		break;
@@ -2110,7 +2111,7 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
 
 		ip2trace (CHANN, ITRC_IOCTL, 3, 1, rc );
 
-		rc = set_serial_info(pCh, (struct serial_struct *) arg);
+		rc = set_serial_info(pCh, argp);
 		if (rc)
 			return rc;
 		break;
@@ -2174,7 +2175,7 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
 
 		ip2trace (CHANN, ITRC_IOCTL, 6, 1, rc );
 
-			rc = put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long *) arg);
+			rc = put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *)argp);
 		if (rc)	
 			return rc;
 	break;
@@ -2183,7 +2184,7 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
 
 		ip2trace (CHANN, ITRC_IOCTL, 7, 1, rc );
 
-		rc = get_user(arg,(unsigned long *) arg);
+		rc = get_user(arg,(unsigned long __user *) argp);
 		if (rc) 
 			return rc;
 		tty->termios->c_cflag = ((tty->termios->c_cflag & ~CLOCAL)
@@ -2262,7 +2263,7 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
 		save_flags(flags);cli();
 		cnow = pCh->icount;
 		restore_flags(flags);
-		p_cuser = (struct serial_icounter_struct *) arg;
+		p_cuser = argp;
 		rc = put_user(cnow.cts, &p_cuser->cts);
 		rc = put_user(cnow.dsr, &p_cuser->dsr);
 		rc = put_user(cnow.rng, &p_cuser->rng);
@@ -2311,14 +2312,9 @@ ip2_ioctl ( PTTY tty, struct file *pFile, UINT cmd, ULONG arg )
 /* standard Linux serial structure.                                           */
 /******************************************************************************/
 static int
-get_serial_info ( i2ChanStrPtr pCh, struct serial_struct *retinfo )
+get_serial_info ( i2ChanStrPtr pCh, struct serial_struct __user *retinfo )
 {
 	struct serial_struct tmp;
-	int rc;
-
-	if ( !retinfo ) {
-		return -EFAULT;
-	}
 
 	memset ( &tmp, 0, sizeof(tmp) );
 	tmp.type = pCh->pMyBord->channelBtypes.bid_value[(pCh->port_index & (IP2_PORTS_PER_BOARD-1))/16];
@@ -2335,8 +2331,7 @@ get_serial_info ( i2ChanStrPtr pCh, struct serial_struct *retinfo )
 	tmp.close_delay = pCh->ClosingDelay;
 	tmp.closing_wait = pCh->ClosingWaitTime;
 	tmp.custom_divisor = pCh->BaudDivisor;
-   	rc = copy_to_user(retinfo,&tmp,sizeof(*retinfo));
-   return rc;
+   	return copy_to_user(retinfo,&tmp,sizeof(*retinfo));
 }
 
 /******************************************************************************/
@@ -2351,18 +2346,13 @@ get_serial_info ( i2ChanStrPtr pCh, struct serial_struct *retinfo )
 /* change the IRQ, address or type of the port the ioctl fails.               */
 /******************************************************************************/
 static int
-set_serial_info( i2ChanStrPtr pCh, struct serial_struct *new_info )
+set_serial_info( i2ChanStrPtr pCh, struct serial_struct __user *new_info )
 {
 	struct serial_struct ns;
 	int   old_flags, old_baud_divisor;
 
-	if ( !new_info ) {
+	if (copy_from_user(&ns, new_info, sizeof (ns)))
 		return -EFAULT;
-	}
-
-	if (copy_from_user(&ns, new_info, sizeof (ns))) {
-		return -EFAULT;
-	}
 
 	/*
 	 * We don't allow setserial to change IRQ, board address, type or baud
@@ -2727,7 +2717,7 @@ set_params( i2ChanStrPtr pCh, struct termios *o_tios )
 
 static 
 ssize_t
-ip2_ipl_read(struct file *pFile, char *pData, size_t count, loff_t *off )
+ip2_ipl_read(struct file *pFile, char __user *pData, size_t count, loff_t *off )
 {
 	unsigned int minor = iminor(pFile->f_dentry->d_inode);
 	int rc = 0;
@@ -2760,7 +2750,7 @@ ip2_ipl_read(struct file *pFile, char *pData, size_t count, loff_t *off )
 }
 
 static int
-DumpFifoBuffer ( char *pData, int count )
+DumpFifoBuffer ( char __user *pData, int count )
 {
 #ifdef DEBUG_FIFO
 	int rc;
@@ -2774,13 +2764,13 @@ DumpFifoBuffer ( char *pData, int count )
 }
 
 static int
-DumpTraceBuffer ( char *pData, int count )
+DumpTraceBuffer ( char __user *pData, int count )
 {
 #ifdef IP2DEBUG_TRACE
 	int rc;
 	int dumpcount;
 	int chunk;
-	int *pIndex = (int*)pData;
+	int *pIndex = (int __user *)pData;
 
 	if ( count < (sizeof(int) * 6) ) {
 		return -EIO;
@@ -2836,7 +2826,7 @@ DumpTraceBuffer ( char *pData, int count )
 /*                                                                            */
 /******************************************************************************/
 static ssize_t
-ip2_ipl_write(struct file *pFile, const char *pData, size_t count, loff_t *off)
+ip2_ipl_write(struct file *pFile, const char __user *pData, size_t count, loff_t *off)
 {
 #ifdef IP2DEBUG_IPL
 	printk (KERN_DEBUG "IP2IPL: write %p, %d bytes\n", pData, count );
@@ -2861,7 +2851,8 @@ ip2_ipl_ioctl ( struct inode *pInode, struct file *pFile, UINT cmd, ULONG arg )
 {
 	unsigned int iplminor = iminor(pInode);
 	int rc = 0;
-	ULONG *pIndex = (ULONG*)arg;
+	void __user *argp = (void __user *)arg;
+	ULONG __user *pIndex = argp;
 	i2eBordStrPtr pB = i2BoardPtrTable[iplminor / 4];
 	i2ChanStrPtr pCh;
 
@@ -2886,9 +2877,9 @@ ip2_ipl_ioctl ( struct inode *pInode, struct file *pFile, UINT cmd, ULONG arg )
 
 		case 65:	/* Board  - ip2stat */
 			if ( pB ) {
-				rc = copy_to_user((char*)arg, (char*)pB, sizeof(i2eBordStr) );
+				rc = copy_to_user(argp, pB, sizeof(i2eBordStr));
 				rc = put_user(INB(pB->i2eStatus),
-					(ULONG*)(arg + (ULONG)(&pB->i2eStatus) - (ULONG)pB ) );
+					(ULONG __user *)(arg + (ULONG)(&pB->i2eStatus) - (ULONG)pB ) );
 			} else {
 				rc = -ENODEV;
 			}
@@ -2899,7 +2890,7 @@ ip2_ipl_ioctl ( struct inode *pInode, struct file *pFile, UINT cmd, ULONG arg )
 				pCh = DevTable[cmd];
 				if ( pCh )
 				{
-					rc = copy_to_user((char*)arg, (char*)pCh, sizeof(i2ChanStr) );
+					rc = copy_to_user(argp, pCh, sizeof(i2ChanStr));
 				} else {
 					rc = -ENODEV;
 				}

drivers/char/isicom.c

@@ -90,7 +90,7 @@ static int ISILoad_ioctl(struct inode *inode, struct file *filp, unsigned  int c
 static void isicom_tx(unsigned long _data);
 static void isicom_start(struct tty_struct * tty);
 
-static unsigned char * tmp_buf = 0;
+static unsigned char * tmp_buf;
 static DECLARE_MUTEX(tmp_buf_sem);
 
 /*   baud index mappings from linux defns to isi */
@@ -132,9 +132,10 @@ static int ISILoad_ioctl(struct inode *inode, struct file *filp,
 	unsigned long t;
 	unsigned short word_count, base;
 	bin_frame frame;
+	void __user *argp = (void __user *)arg;
 	/* exec_record exec_rec; */
 	
-	if(get_user(card, (int *)arg))
+	if(get_user(card, (int __user *)argp))
 		return -EFAULT;
 		
 	if(card < 0 || card >= BOARD_COUNT)
@@ -208,13 +209,13 @@ static int ISILoad_ioctl(struct inode *inode, struct file *filp,
 				 return -EIO;
 			}
 			printk("-Done\n");
-			return put_user(signature,(unsigned int*)arg);
+			return put_user(signature,(unsigned __user *)argp);
 						
 	case	MIOCTL_LOAD_FIRMWARE:
 			if (!capable(CAP_SYS_ADMIN))
 				return -EPERM;
 				
-			if(copy_from_user(&frame, (void *) arg, sizeof(bin_frame)))
+			if(copy_from_user(&frame, argp, sizeof(bin_frame)))
 				return -EFAULT;
 			
 			if (WaitTillCardIsFree(base))
@@ -257,7 +258,7 @@ static int ISILoad_ioctl(struct inode *inode, struct file *filp,
 			if (!capable(CAP_SYS_ADMIN))
 				return -EPERM;
 				
-			if(copy_from_user(&frame, (void *) arg, sizeof(bin_header)))
+			if(copy_from_user(&frame, argp, sizeof(bin_header)))
 				return -EFAULT;
 			
 			if (WaitTillCardIsFree(base))
@@ -296,7 +297,7 @@ static int ISILoad_ioctl(struct inode *inode, struct file *filp,
 				return -EIO;
 			}	
 			
-			if(copy_to_user((void *) arg, &frame, sizeof(bin_frame)))
+			if(copy_to_user(argp, &frame, sizeof(bin_frame)))
 				return -EFAULT;
 			return 0;
 	
@@ -1121,7 +1122,7 @@ static void isicom_close(struct tty_struct * tty, struct file * filp)
 	if (tty->ldisc.flush_buffer)
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
-	port->tty = 0;
+	port->tty = NULL;
 	if (port->blocked_open) {
 		if (port->close_delay) {
 			set_current_state(TASK_INTERRUPTIBLE);
@@ -1334,7 +1335,7 @@ static int isicom_tiocmset(struct tty_struct *tty, struct file *file,
 }			
 
 static int isicom_set_serial_info(struct isi_port * port,
-					struct serial_struct * info)
+					struct serial_struct __user *info)
 {
 	struct serial_struct newinfo;
 	unsigned long flags;
@@ -1370,7 +1371,7 @@ static int isicom_set_serial_info(struct isi_port * port,
 }		
 
 static int isicom_get_serial_info(struct isi_port * port, 
-					struct serial_struct * info)
+					struct serial_struct __user *info)
 {
 	struct serial_struct out_info;
 	
@@ -1392,6 +1393,7 @@ static int isicom_ioctl(struct tty_struct * tty, struct file * filp,
 			unsigned int cmd, unsigned long arg) 
 {
 	struct isi_port * port = (struct isi_port *) tty->driver_data;
+	void __user *argp = (void __user *)arg;
 	int retval;
 
 	if (isicom_paranoia_check(port, tty->name, "isicom_ioctl"))
@@ -1416,10 +1418,10 @@ static int isicom_ioctl(struct tty_struct * tty, struct file * filp,
 			return 0;
 			
 		case TIOCGSOFTCAR:
-			return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long *) arg);
+			return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *)argp);
 			
 		case TIOCSSOFTCAR:
-			if(get_user(arg, (unsigned long *) arg))
+			if(get_user(arg, (unsigned long __user *) argp))
 				return -EFAULT;
 			tty->termios->c_cflag =
 				((tty->termios->c_cflag & ~CLOCAL) |
@@ -1427,12 +1429,10 @@ static int isicom_ioctl(struct tty_struct * tty, struct file * filp,
 			return 0;	
 			
 		case TIOCGSERIAL:
-			return isicom_get_serial_info(port, 
-					(struct serial_struct *) arg);
+			return isicom_get_serial_info(port, argp);
 		
 		case TIOCSSERIAL:
-			return isicom_set_serial_info(port,
-					(struct serial_struct *) arg);
+			return isicom_set_serial_info(port, argp);
 					
 		default:
 			return -ENOIOCTLCMD;						
@@ -1545,7 +1545,7 @@ static void isicom_hangup(struct tty_struct * tty)
 	isicom_shutdown_port(port);
 	port->count = 0;
 	port->flags &= ~ASYNC_NORMAL_ACTIVE;
-	port->tty = 0;
+	port->tty = NULL;
 	wake_up_interruptible(&port->open_wait);
 }
 

drivers/char/moxa.c

@@ -275,8 +275,8 @@ static void MoxaPortTxDisable(int);
 static void MoxaPortTxEnable(int);
 static int MoxaPortResetBrkCnt(int);
 static void MoxaPortSendBreak(int, int);
-static int moxa_get_serial_info(struct moxa_str *, struct serial_struct *);
-static int moxa_set_serial_info(struct moxa_str *, struct serial_struct *);
+static int moxa_get_serial_info(struct moxa_str *, struct serial_struct __user *);
+static int moxa_set_serial_info(struct moxa_str *, struct serial_struct __user *);
 static void MoxaSetFifo(int port, int enable);
 
 static struct tty_operations moxa_ops = {
@@ -351,13 +351,13 @@ static int __init moxa_init(void)
 	moxaDriver->flags = TTY_DRIVER_REAL_RAW;
 	tty_set_operations(moxaDriver, &moxa_ops);
 
-	moxaXmitBuff = 0;
+	moxaXmitBuff = NULL;
 
 	for (i = 0, ch = moxaChannels; i < MAX_PORTS; i++, ch++) {
 		ch->type = PORT_16550A;
 		ch->port = i;
 		INIT_WORK(&ch->tqueue, do_moxa_softint, ch);
-		ch->tty = 0;
+		ch->tty = NULL;
 		ch->close_delay = 5 * HZ / 10;
 		ch->closing_wait = 30 * HZ;
 		ch->count = 0;
@@ -622,7 +622,7 @@ static void moxa_close(struct tty_struct *tty, struct file *filp)
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
 	ch->event = 0;
-	ch->tty = 0;
+	ch->tty = NULL;
 	if (ch->blocked_open) {
 		if (ch->close_delay) {
 			set_current_state(TASK_INTERRUPTIBLE);
@@ -807,6 +807,7 @@ static int moxa_ioctl(struct tty_struct *tty, struct file *file,
 {
 	struct moxa_str *ch = (struct moxa_str *) tty->driver_data;
 	register int port;
+	void __user *argp = (void __user *)arg;
 	int retval;
 
 	port = PORTNO(tty);
@@ -832,9 +833,9 @@ static int moxa_ioctl(struct tty_struct *tty, struct file *file,
 		MoxaPortSendBreak(ch->port, arg);
 		return (0);
 	case TIOCGSOFTCAR:
-		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long *) arg);
+		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *) argp);
 	case TIOCSSOFTCAR:
-		if(get_user(retval, (unsigned long *) arg))
+		if(get_user(retval, (unsigned long __user *) argp))
 			return -EFAULT;
 		arg = retval;
 		tty->termios->c_cflag = ((tty->termios->c_cflag & ~CLOCAL) |
@@ -845,10 +846,10 @@ static int moxa_ioctl(struct tty_struct *tty, struct file *file,
 			ch->asyncflags |= ASYNC_CHECK_CD;
 		return (0);
 	case TIOCGSERIAL:
-		return (moxa_get_serial_info(ch, (struct serial_struct *) arg));
+		return moxa_get_serial_info(ch, argp);
 
 	case TIOCSSERIAL:
-		return (moxa_set_serial_info(ch, (struct serial_struct *) arg));
+		return moxa_set_serial_info(ch, argp);
 	default:
 		retval = MoxaDriverIoctl(cmd, arg, port);
 	}
@@ -916,7 +917,7 @@ static void moxa_hangup(struct tty_struct *tty)
 	ch->event = 0;
 	ch->count = 0;
 	ch->asyncflags &= ~ASYNC_NORMAL_ACTIVE;
-	ch->tty = 0;
+	ch->tty = NULL;
 	wake_up_interruptible(&ch->open_wait);
 }
 
@@ -1163,7 +1164,7 @@ static void receive_data(struct moxa_str *ch)
 	unsigned char *charptr, *flagptr;
 	unsigned long flags;
 
-	ts = 0;
+	ts = NULL;
 	tp = ch->tty;
 	if (tp)
 		ts = tp->termios;
@@ -1522,10 +1523,10 @@ static void moxadelay(int);
 static void moxafunc(unsigned long, int, ushort);
 static void wait_finish(unsigned long);
 static void low_water_check(unsigned long);
-static int moxaloadbios(int, unsigned char *, int);
+static int moxaloadbios(int, unsigned char __user *, int);
 static int moxafindcard(int);
-static int moxaload320b(int, unsigned char *, int);
-static int moxaloadcode(int, unsigned char *, int);
+static int moxaload320b(int, unsigned char __user *, int);
+static int moxaloadcode(int, unsigned char __user *, int);
 static int moxaloadc218(int, unsigned long, int);
 static int moxaloadc320(int, unsigned long, int, int *);
 
@@ -1575,7 +1576,7 @@ struct moxaq_str {
 };
 
 struct dl_str {
-	char *buf;
+	char __user *buf;
 	int len;
 	int cardno;
 };
@@ -1601,6 +1602,7 @@ int MoxaDriverIoctl(unsigned int cmd, unsigned long arg, int port)
 	int i;
 	int status;
 	int MoxaPortTxQueue(int), MoxaPortRxQueue(int);
+	void __user *argp = (void __user *)arg;
 
 	if (port == QueryPort) {
 		if ((cmd != MOXA_GET_CONF) && (cmd != MOXA_INIT_DRIVER) &&
@@ -1612,7 +1614,7 @@ int MoxaDriverIoctl(unsigned int cmd, unsigned long arg, int port)
 	}
 	switch (cmd) {
 	case MOXA_GET_CONF:
-		if(copy_to_user((void *)arg, &moxa_boards, MAX_BOARDS * sizeof(moxa_board_conf)))
+		if(copy_to_user(argp, &moxa_boards, MAX_BOARDS * sizeof(moxa_board_conf)))
 			return -EFAULT;
 		return (0);
 	case MOXA_INIT_DRIVER:
@@ -1621,7 +1623,7 @@ int MoxaDriverIoctl(unsigned int cmd, unsigned long arg, int port)
 		return (0);
 	case MOXA_GETDATACOUNT:
 		moxaLog.tick = jiffies;
-		if(copy_to_user((void *)arg, &moxaLog, sizeof(mon_st)))
+		if(copy_to_user(argp, &moxaLog, sizeof(mon_st)))
 			return -EFAULT;
 		return (0);
 	case MOXA_FLUSH_QUEUE:
@@ -1634,22 +1636,22 @@ int MoxaDriverIoctl(unsigned int cmd, unsigned long arg, int port)
 				temp_queue[i].outq = MoxaPortTxQueue(i);
 			}
 		}
-		if(copy_to_user((void *)arg, temp_queue, sizeof(struct moxaq_str) * MAX_PORTS))
+		if(copy_to_user(argp, temp_queue, sizeof(struct moxaq_str) * MAX_PORTS))
 			return -EFAULT;
 		return (0);
 	case MOXA_GET_OQUEUE:
 		i = MoxaPortTxQueue(port);
-		return put_user(i, (unsigned long *) arg);
+		return put_user(i, (unsigned long __user *)argp);
 	case MOXA_GET_IQUEUE:
 		i = MoxaPortRxQueue(port);
-		return put_user(i, (unsigned long *) arg);
+		return put_user(i, (unsigned long __user *)argp);
 	case MOXA_GET_MAJOR:
-		if(copy_to_user((void *)arg, &ttymajor, sizeof(int)))
+		if(copy_to_user(argp, &ttymajor, sizeof(int)))
 			return -EFAULT;
 		return 0;
 	case MOXA_GET_CUMAJOR:
 		i = 0;
-		if(copy_to_user((void *)arg, &i, sizeof(int)))
+		if(copy_to_user(argp, &i, sizeof(int)))
 			return -EFAULT;
 		return 0;
 	case MOXA_GETMSTATUS:
@@ -1675,7 +1677,7 @@ int MoxaDriverIoctl(unsigned int cmd, unsigned long arg, int port)
 			else
 				GMStatus[i].cflag = moxaChannels[i].tty->termios->c_cflag;
 		}
-		if(copy_to_user((void *)arg, GMStatus, sizeof(struct mxser_mstatus) * MAX_PORTS))
+		if(copy_to_user(argp, GMStatus, sizeof(struct mxser_mstatus) * MAX_PORTS))
 			return -EFAULT;
 		return 0;
 	default:
@@ -1687,7 +1689,7 @@ int MoxaDriverIoctl(unsigned int cmd, unsigned long arg, int port)
 		break;
 	}
 
-	if(copy_from_user(&dltmp, (void *)arg, sizeof(struct dl_str)))
+	if(copy_from_user(&dltmp, argp, sizeof(struct dl_str)))
 		return -EFAULT;
 	if(dltmp.cardno < 0 || dltmp.cardno >= MAX_BOARDS)
 		return -EINVAL;
@@ -2682,12 +2684,10 @@ void MoxaPortSendBreak(int port, int ms100)
 }
 
 static int moxa_get_serial_info(struct moxa_str *info,
-				struct serial_struct *retinfo)
+				struct serial_struct __user *retinfo)
 {
 	struct serial_struct tmp;
 
-	if (!retinfo)
-		return (-EFAULT);
 	memset(&tmp, 0, sizeof(tmp));
 	tmp.type = info->type;
 	tmp.line = info->port;
@@ -2706,7 +2706,7 @@ static int moxa_get_serial_info(struct moxa_str *info,
 
 
 static int moxa_set_serial_info(struct moxa_str *info,
-				struct serial_struct *new_info)
+				struct serial_struct __user *new_info)
 {
 	struct serial_struct new_serial;
 
@@ -2795,7 +2795,7 @@ static void low_water_check(unsigned long ofsAddr)
 	}
 }
 
-static int moxaloadbios(int cardno, unsigned char *tmp, int len)
+static int moxaloadbios(int cardno, unsigned char __user *tmp, int len)
 {
 	unsigned long baseAddr;
 	int i;
@@ -2842,7 +2842,7 @@ static int moxafindcard(int cardno)
 	return (0);
 }
 
-static int moxaload320b(int cardno, unsigned char * tmp, int len)
+static int moxaload320b(int cardno, unsigned char __user *tmp, int len)
 {
 	unsigned long baseAddr;
 	int i;
@@ -2862,7 +2862,7 @@ static int moxaload320b(int cardno, unsigned char * tmp, int len)
 	return (0);
 }
 
-static int moxaloadcode(int cardno, unsigned char * tmp, int len)
+static int moxaloadcode(int cardno, unsigned char __user *tmp, int len)
 {
 	unsigned long baseAddr, ofsAddr;
 	int retval, port, i;

drivers/char/mxser.c

@@ -357,9 +357,9 @@ static int mxser_block_til_ready(struct tty_struct *, struct file *, struct mxse
 static int mxser_startup(struct mxser_struct *);
 static void mxser_shutdown(struct mxser_struct *);
 static int mxser_change_speed(struct mxser_struct *, struct termios *old_termios);
-static int mxser_get_serial_info(struct mxser_struct *, struct serial_struct *);
-static int mxser_set_serial_info(struct mxser_struct *, struct serial_struct *);
-static int mxser_get_lsr_info(struct mxser_struct *, unsigned int *);
+static int mxser_get_serial_info(struct mxser_struct *, struct serial_struct __user *);
+static int mxser_set_serial_info(struct mxser_struct *, struct serial_struct __user *);
+static int mxser_get_lsr_info(struct mxser_struct *, unsigned int __user *);
 static void mxser_send_break(struct mxser_struct *, int);
 static int mxser_tiocmget(struct tty_struct *, struct file *);
 static int mxser_tiocmset(struct tty_struct *, struct file *, unsigned int, unsigned int);
@@ -821,7 +821,7 @@ static void mxser_close(struct tty_struct *tty, struct file *filp)
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
 	info->event = 0;
-	info->tty = 0;
+	info->tty = NULL;
 	if (info->blocked_open) {
 		if (info->close_delay) {
 			set_current_state(TASK_INTERRUPTIBLE);
@@ -988,8 +988,9 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
 	struct mxser_struct *info = (struct mxser_struct *) tty->driver_data;
 	int retval;
 	struct async_icount cprev, cnow;	/* kernel counter temps */
-	struct serial_icounter_struct *p_cuser;		/* user space */
+	struct serial_icounter_struct __user *p_cuser;
 	unsigned long templ;
+	void __user *argp = (void __user *)arg;
 
 	if (PORTNO(tty) == MXSER_PORTS)
 		return (mxser_ioctl_special(cmd, arg));
@@ -1015,20 +1016,20 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
 		mxser_send_break(info, arg ? arg * (HZ / 10) : HZ / 4);
 		return (0);
 	case TIOCGSOFTCAR:
-		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long *) arg);
+		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *)argp);
 	case TIOCSSOFTCAR:
-		if(get_user(templ, (unsigned long *) arg))
+		if(get_user(templ, (unsigned long __user *) arg))
 			return -EFAULT;
 		arg = templ;
 		tty->termios->c_cflag = ((tty->termios->c_cflag & ~CLOCAL) |
 					 (arg ? CLOCAL : 0));
 		return (0);
 	case TIOCGSERIAL:
-		return (mxser_get_serial_info(info, (struct serial_struct *) arg));
+		return mxser_get_serial_info(info, argp);
 	case TIOCSSERIAL:
-		return (mxser_set_serial_info(info, (struct serial_struct *) arg));
+		return mxser_set_serial_info(info, argp);
 	case TIOCSERGETLSR:	/* Get line status register */
-		return (mxser_get_lsr_info(info, (unsigned int *) arg));
+		return mxser_get_lsr_info(info, argp);
 		/*
 		 * Wait for any of the 4 modem inputs (DCD,RI,DSR,CTS) to change
 		 * - mask passed in arg for lines of interest
@@ -1072,7 +1073,7 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
 		cli();
 		cnow = info->icount;
 		restore_flags(flags);
-		p_cuser = (struct serial_icounter_struct *) arg;
+		p_cuser = argp;
 		if(put_user(cnow.cts, &p_cuser->cts))
 			return -EFAULT;
 		if(put_user(cnow.dsr, &p_cuser->dsr))
@@ -1081,7 +1082,7 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
 			return -EFAULT;
 		return put_user(cnow.dcd, &p_cuser->dcd);
 	case MOXA_HighSpeedOn:
-		return put_user(info->baud_base != 115200 ? 1 : 0, (int *) arg);
+		return put_user(info->baud_base != 115200 ? 1 : 0, (int __user *)argp);
 	default:
 		return (-ENOIOCTLCMD);
 	}
@@ -1091,21 +1092,22 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
 static int mxser_ioctl_special(unsigned int cmd, unsigned long arg)
 {
 	int i, result, status;
+	void __user *argp = (void __user *)arg;
 
 	switch (cmd) {
 	case MOXA_GET_CONF:
-		if(copy_to_user((struct mxser_hwconf *) arg, mxsercfg,
+		if(copy_to_user(argp, mxsercfg,
 			     sizeof(struct mxser_hwconf) * 4))
 			     	return -EFAULT;
 		return 0;
 	case MOXA_GET_MAJOR:
-		if(copy_to_user((int *) arg, &ttymajor, sizeof(int)))
+		if(copy_to_user(argp, &ttymajor, sizeof(int)))
 			return -EFAULT;
 		return 0;
 
 	case MOXA_GET_CUMAJOR:
 		result = 0;
-		if(copy_to_user((int *) arg, &result, sizeof(int)))
+		if(copy_to_user(argp, &result, sizeof(int)))
 			return -EFAULT;
 		return 0;
 
@@ -1115,9 +1117,9 @@ static int mxser_ioctl_special(unsigned int cmd, unsigned long arg)
 			if (mxvar_table[i].base)
 				result |= (1 << i);
 		}
-		return put_user(result, (unsigned long *) arg);
+		return put_user(result, (unsigned long __user *) argp);
 	case MOXA_GETDATACOUNT:
-		if(copy_to_user((struct mxser_log *) arg, &mxvar_log, sizeof(mxvar_log)))
+		if (copy_to_user(argp, &mxvar_log, sizeof(mxvar_log)))
 			return -EFAULT;
 		return (0);
 	case MOXA_GETMSTATUS:
@@ -1151,7 +1153,7 @@ static int mxser_ioctl_special(unsigned int cmd, unsigned long arg)
 			else
 				GMStatus[i].cts = 0;
 		}
-		if(copy_to_user((struct mxser_mstatus *) arg, GMStatus,
+		if(copy_to_user(argp, GMStatus,
 			     sizeof(struct mxser_mstatus) * MXSER_PORTS))
 			return -EFAULT;
 		return 0;
@@ -1301,7 +1303,7 @@ void mxser_hangup(struct tty_struct *tty)
 	info->event = 0;
 	info->count = 0;
 	info->flags &= ~ASYNC_NORMAL_ACTIVE;
-	info->tty = 0;
+	info->tty = NULL;
 	wake_up_interruptible(&info->open_wait);
 }
 
@@ -1317,7 +1319,7 @@ static irqreturn_t mxser_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 	int pass_counter = 0;
 	int handled = 0;
 
-	port = 0;
+	port = NULL;
 	for (i = 0; i < MXSER_BOARDS; i++) {
 		if (dev_id == &(mxvar_table[i * MXSER_PORTS_PER_BOARD])) {
 			port = dev_id;
@@ -1665,7 +1667,7 @@ static int mxser_startup(struct mxser_struct *info)
 	/*
 	 * and set the speed of the serial port
 	 */
-	mxser_change_speed(info, 0);
+	mxser_change_speed(info, NULL);
 
 	info->flags |= ASYNC_INITIALIZED;
 	restore_flags(flags);
@@ -1697,7 +1699,7 @@ static void mxser_shutdown(struct mxser_struct *info)
 	 */
 	if (info->xmit_buf) {
 		free_page((unsigned long) info->xmit_buf);
-		info->xmit_buf = 0;
+		info->xmit_buf = NULL;
 	}
 	info->IER = 0;
 	outb(0x00, info->base + UART_IER);	/* disable all intrs */
@@ -2048,7 +2050,7 @@ static int mxser_change_speed(struct mxser_struct *info,
  * ------------------------------------------------------------
  */
 static int mxser_get_serial_info(struct mxser_struct *info,
-				 struct serial_struct *retinfo)
+				 struct serial_struct __user *retinfo)
 {
 	struct serial_struct tmp;
 
@@ -2069,7 +2071,7 @@ static int mxser_get_serial_info(struct mxser_struct *info,
 }
 
 static int mxser_set_serial_info(struct mxser_struct *info,
-				 struct serial_struct *new_info)
+				 struct serial_struct __user *new_info)
 {
 	struct serial_struct new_serial;
 	unsigned int flags;
@@ -2110,7 +2112,7 @@ static int mxser_set_serial_info(struct mxser_struct *info,
 
 	if (info->flags & ASYNC_INITIALIZED) {
 		if (flags != (info->flags & ASYNC_SPD_MASK)) {
-			mxser_change_speed(info, 0);
+			mxser_change_speed(info, NULL);
 		}
 	} else
 		retval = mxser_startup(info);
@@ -2127,7 +2129,7 @@ static int mxser_set_serial_info(struct mxser_struct *info,
  *          transmit holding register is empty.  This functionality
  *          allows an RS485 driver to be written in user space.
  */
-static int mxser_get_lsr_info(struct mxser_struct *info, unsigned int *value)
+static int mxser_get_lsr_info(struct mxser_struct *info, unsigned int __user *value)
 {
 	unsigned char status;
 	unsigned int result;

drivers/char/riscom8.c

@@ -1131,7 +1131,7 @@ static void rc_close(struct tty_struct * tty, struct file * filp)
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
 	port->event = 0;
-	port->tty = 0;
+	port->tty = NULL;
 	if (port->blocked_open) {
 		if (port->close_delay) {
 			current->state = TASK_INTERRUPTIBLE;
@@ -1380,7 +1380,7 @@ static inline void rc_send_break(struct riscom_port * port, unsigned long length
 }
 
 static inline int rc_set_serial_info(struct riscom_port * port,
-				     struct serial_struct * newinfo)
+				     struct serial_struct __user * newinfo)
 {
 	struct serial_struct tmp;
 	struct riscom_board *bp = port_Board(port);
@@ -1427,7 +1427,7 @@ static inline int rc_set_serial_info(struct riscom_port * port,
 }
 
 static inline int rc_get_serial_info(struct riscom_port * port,
-				     struct serial_struct * retinfo)
+				     struct serial_struct __user *retinfo)
 {
 	struct serial_struct tmp;
 	struct riscom_board *bp = port_Board(port);
@@ -1450,6 +1450,7 @@ static int rc_ioctl(struct tty_struct * tty, struct file * filp,
 		    
 {
 	struct riscom_port *port = (struct riscom_port *)tty->driver_data;
+	void __user *argp = (void __user *)arg;
 	int retval;
 				
 	if (rc_paranoia_check(port, tty->name, "rc_ioctl"))
@@ -1472,18 +1473,18 @@ static int rc_ioctl(struct tty_struct * tty, struct file * filp,
 		rc_send_break(port, arg ? arg*(HZ/10) : HZ/4);
 		break;
 	 case TIOCGSOFTCAR:
-		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned int *) arg);
+		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned __user *)argp);
 	 case TIOCSSOFTCAR:
-		if (get_user(arg,(unsigned int *) arg))
+		if (get_user(arg,(unsigned __user *) argp))
 			return -EFAULT;
 		tty->termios->c_cflag =
 			((tty->termios->c_cflag & ~CLOCAL) |
 			(arg ? CLOCAL : 0));
 		break;
 	 case TIOCGSERIAL:	
-		return rc_get_serial_info(port, (struct serial_struct *) arg);
+		return rc_get_serial_info(port, argp);
 	 case TIOCSSERIAL:	
-		return rc_set_serial_info(port, (struct serial_struct *) arg);
+		return rc_set_serial_info(port, argp);
 	 default:
 		return -ENOIOCTLCMD;
 	}
@@ -1607,7 +1608,7 @@ static void rc_hangup(struct tty_struct * tty)
 	port->event = 0;
 	port->count = 0;
 	port->flags &= ~ASYNC_NORMAL_ACTIVE;
-	port->tty = 0;
+	port->tty = NULL;
 	wake_up_interruptible(&port->open_wait);
 }
 

drivers/char/specialix.c

@@ -1472,7 +1472,7 @@ static void sx_close(struct tty_struct * tty, struct file * filp)
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
 	port->event = 0;
-	port->tty = 0;
+	port->tty = NULL;
 	if (port->blocked_open) {
 		if (port->close_delay) {
 			current->state = TASK_INTERRUPTIBLE;
@@ -1757,18 +1757,13 @@ static inline void sx_send_break(struct specialix_port * port, unsigned long len
 
 
 static inline int sx_set_serial_info(struct specialix_port * port,
-                                     struct serial_struct * newinfo)
+                                     struct serial_struct __user * newinfo)
 {
 	struct serial_struct tmp;
 	struct specialix_board *bp = port_Board(port);
 	int change_speed;
 	unsigned long flags;
-	int error;
 	
-	error = verify_area(VERIFY_READ, (void *) newinfo, sizeof(tmp));
-	if (error)
-		return error;
-
 	if (copy_from_user(&tmp, newinfo, sizeof(tmp)))
 		return -EFAULT;
 	
@@ -1813,16 +1808,11 @@ static inline int sx_set_serial_info(struct specialix_port * port,
 
 
 static inline int sx_get_serial_info(struct specialix_port * port,
-				     struct serial_struct * retinfo)
+				     struct serial_struct __user *retinfo)
 {
 	struct serial_struct tmp;
 	struct specialix_board *bp = port_Board(port);
-	int error;
 	
-	error = verify_area(VERIFY_WRITE, (void *) retinfo, sizeof(tmp));
-	if (error)
-		return error;
-
 	memset(&tmp, 0, sizeof(tmp));
 	tmp.type = PORT_CIRRUS;
 	tmp.line = port - sx_port;
@@ -1844,8 +1834,8 @@ static int sx_ioctl(struct tty_struct * tty, struct file * filp,
                     unsigned int cmd, unsigned long arg)
 {
 	struct specialix_port *port = (struct specialix_port *)tty->driver_data;
-	int error;
 	int retval;
+	void __user *argp = (void __user *)arg;
 				
 	if (sx_paranoia_check(port, tty->name, "sx_ioctl"))
 		return -ENODEV;
@@ -1867,22 +1857,20 @@ static int sx_ioctl(struct tty_struct * tty, struct file * filp,
 		sx_send_break(port, arg ? arg*(HZ/10) : HZ/4);
 		return 0;
 	 case TIOCGSOFTCAR:
-		error = verify_area(VERIFY_WRITE, (void *) arg, sizeof(long));
-		if (error)
-			return error;
-		put_user(C_CLOCAL(tty) ? 1 : 0,
-		         (unsigned long *) arg);
+		if (put_user(C_CLOCAL(tty)?1:0, (unsigned long __user *)argp))
+			return -EFAULT;
 		return 0;
 	 case TIOCSSOFTCAR:
-		get_user(arg, (unsigned long *) arg);
+		if (get_user(arg, (unsigned long __user *) argp))
+			return -EFAULT;
 		tty->termios->c_cflag =
 			((tty->termios->c_cflag & ~CLOCAL) |
 			(arg ? CLOCAL : 0));
 		return 0;
 	 case TIOCGSERIAL:	
-		return sx_get_serial_info(port, (struct serial_struct *) arg);
+		return sx_get_serial_info(port, argp);
 	 case TIOCSSERIAL:	
-		return sx_set_serial_info(port, (struct serial_struct *) arg);
+		return sx_set_serial_info(port, argp);
 	 default:
 		return -ENOIOCTLCMD;
 	}
@@ -2027,7 +2015,7 @@ static void sx_hangup(struct tty_struct * tty)
 	port->event = 0;
 	port->count = 0;
 	port->flags &= ~ASYNC_NORMAL_ACTIVE;
-	port->tty = 0;
+	port->tty = NULL;
 	wake_up_interruptible(&port->open_wait);
 }
 

drivers/char/sx.c

@@ -1594,7 +1594,8 @@ static int sx_fw_ioctl (struct inode *inode, struct file *filp,
                         unsigned int cmd, unsigned long arg)
 {
 	int rc = 0;
-	int *descr = (int *)arg, i;
+	int __user *descr = (int __user *)arg;
+	int i;
 	static struct sx_board *board = NULL;
 	int nbytes, offset;
 	unsigned long data;
@@ -1670,7 +1671,7 @@ static int sx_fw_ioctl (struct inode *inode, struct file *filp,
 		get_user (data,	 descr++);
 		while (nbytes && data) {
 			for (i=0;i<nbytes;i += SX_CHUNK_SIZE) {
-				if (copy_from_user(tmp, (char *)data + i, 
+				if (copy_from_user(tmp, (char __user *)data+i, 
 						   (i + SX_CHUNK_SIZE >
 						    nbytes) ? nbytes - i :
 						   	      SX_CHUNK_SIZE)) {
@@ -1776,6 +1777,7 @@ static int sx_ioctl (struct tty_struct * tty, struct file * filp,
 {
 	int rc;
 	struct sx_port *port = tty->driver_data;
+	void __user *argp = (void __user *)arg;
 	int ival;
 
 	/* func_enter2(); */
@@ -1784,24 +1786,20 @@ static int sx_ioctl (struct tty_struct * tty, struct file * filp,
 	switch (cmd) {
 	case TIOCGSOFTCAR:
 		rc = put_user(((tty->termios->c_cflag & CLOCAL) ? 1 : 0),
-		              (unsigned int *) arg);
+		              (unsigned __user *) argp);
 		break;
 	case TIOCSSOFTCAR:
-		if ((rc = get_user(ival, (unsigned int *) arg)) == 0) {
+		if ((rc = get_user(ival, (unsigned __user *) argp)) == 0) {
 			tty->termios->c_cflag =
 				(tty->termios->c_cflag & ~CLOCAL) |
 				(ival ? CLOCAL : 0);
 		}
 		break;
 	case TIOCGSERIAL:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		                      sizeof(struct serial_struct))) == 0)
-			rc = gs_getserial(&port->gs, (struct serial_struct *) arg);
+		rc = gs_getserial(&port->gs, argp);
 		break;
 	case TIOCSSERIAL:
-		if ((rc = verify_area(VERIFY_READ, (void *) arg,
-		                      sizeof(struct serial_struct))) == 0)
-			rc = gs_setserial(&port->gs, (struct serial_struct *) arg);
+		rc = gs_setserial(&port->gs, argp);
 		break;
 	default:
 		rc = -ENOIOCTLCMD;

include/linux/generic_serial.h

@@ -88,8 +88,8 @@ void gs_close(struct tty_struct *tty, struct file *filp);
 void gs_set_termios (struct tty_struct * tty, 
                      struct termios * old_termios);
 int  gs_init_port(struct gs_port *port);
-int  gs_setserial(struct gs_port *port, struct serial_struct *sp);
-int  gs_getserial(struct gs_port *port, struct serial_struct *sp);
+int  gs_setserial(struct gs_port *port, struct serial_struct __user *sp);
+int  gs_getserial(struct gs_port *port, struct serial_struct __user *sp);
 void gs_got_break(struct gs_port *port);
 
 extern int gs_debug;