[PATCH] sparse: trivial part of drivers/char __user annotation

drivers/char/hw_random.c

@@ -79,7 +79,7 @@
 #define RNG_MISCDEV_MINOR		183 /* official */
 
 static int rng_dev_open (struct inode *inode, struct file *filp);
-static ssize_t rng_dev_read (struct file *filp, char *buf, size_t size,
+static ssize_t rng_dev_read (struct file *filp, char __user *buf, size_t size,
 			     loff_t * offp);
 
 static int __init intel_init (struct pci_dev *dev);
@@ -482,7 +482,7 @@ static int rng_dev_open (struct inode *inode, struct file *filp)
 }
 
 
-static ssize_t rng_dev_read (struct file *filp, char *buf, size_t size,
+static ssize_t rng_dev_read (struct file *filp, char __user *buf, size_t size,
 			     loff_t * offp)
 {
 	static spinlock_t rng_lock = SPIN_LOCK_UNLOCKED;

drivers/char/mem.c

@@ -116,7 +116,7 @@ static inline int valid_phys_addr_range(unsigned long addr, size_t *count)
 #endif
 
 static ssize_t do_write_mem(void *p, unsigned long realp,
-			    const char * buf, size_t count, loff_t *ppos)
+			    const char __user * buf, size_t count, loff_t *ppos)
 {
 	ssize_t written;
 	unsigned long copied;
@@ -152,7 +152,7 @@ static ssize_t do_write_mem(void *p, unsigned long realp,
  * This funcion reads the *physical* memory. The f_pos points directly to the 
  * memory location. 
  */
-static ssize_t read_mem(struct file * file, char * buf,
+static ssize_t read_mem(struct file * file, char __user * buf,
 			size_t count, loff_t *ppos)
 {
 	unsigned long p = *ppos;
@@ -184,7 +184,7 @@ static ssize_t read_mem(struct file * file, char * buf,
 	return read;
 }
 
-static ssize_t write_mem(struct file * file, const char * buf, 
+static ssize_t write_mem(struct file * file, const char __user * buf, 
 			 size_t count, loff_t *ppos)
 {
 	unsigned long p = *ppos;
@@ -226,7 +226,7 @@ extern long vwrite(char *buf, char *addr, unsigned long count);
 /*
  * This function reads the *virtual* memory as seen by the kernel.
  */
-static ssize_t read_kmem(struct file *file, char *buf, 
+static ssize_t read_kmem(struct file *file, char __user *buf, 
 			 size_t count, loff_t *ppos)
 {
 	unsigned long p = *ppos;
@@ -289,7 +289,7 @@ static ssize_t read_kmem(struct file *file, char *buf,
 /*
  * This function writes to the *virtual* memory as seen by the kernel.
  */
-static ssize_t write_kmem(struct file * file, const char * buf, 
+static ssize_t write_kmem(struct file * file, const char __user * buf, 
 			  size_t count, loff_t *ppos)
 {
 	unsigned long p = *ppos;
@@ -346,11 +346,11 @@ static ssize_t write_kmem(struct file * file, const char * buf,
 }
 
 #if defined(CONFIG_ISA) || !defined(__mc68000__)
-static ssize_t read_port(struct file * file, char * buf,
+static ssize_t read_port(struct file * file, char __user * buf,
 			 size_t count, loff_t *ppos)
 {
 	unsigned long i = *ppos;
-	char *tmp = buf;
+	char __user *tmp = buf;
 
 	if (verify_area(VERIFY_WRITE,buf,count))
 		return -EFAULT; 
@@ -364,11 +364,11 @@ static ssize_t read_port(struct file * file, char * buf,
 	return tmp-buf;
 }
 
-static ssize_t write_port(struct file * file, const char * buf,
+static ssize_t write_port(struct file * file, const char __user * buf,
 			  size_t count, loff_t *ppos)
 {
 	unsigned long i = *ppos;
-	const char * tmp = buf;
+	const char __user * tmp = buf;
 
 	if (verify_area(VERIFY_READ,buf,count))
 		return -EFAULT;
@@ -385,13 +385,13 @@ static ssize_t write_port(struct file * file, const char * buf,
 }
 #endif
 
-static ssize_t read_null(struct file * file, char * buf,
+static ssize_t read_null(struct file * file, char __user * buf,
 			 size_t count, loff_t *ppos)
 {
 	return 0;
 }
 
-static ssize_t write_null(struct file * file, const char * buf,
+static ssize_t write_null(struct file * file, const char __user * buf,
 			  size_t count, loff_t *ppos)
 {
 	return count;
@@ -401,7 +401,7 @@ static ssize_t write_null(struct file * file, const char * buf,
 /*
  * For fun, we are using the MMU for this.
  */
-static inline size_t read_zero_pagealigned(char * buf, size_t size)
+static inline size_t read_zero_pagealigned(char __user * buf, size_t size)
 {
 	struct mm_struct *mm;
 	struct vm_area_struct * vma;
@@ -451,7 +451,7 @@ static inline size_t read_zero_pagealigned(char * buf, size_t size)
 	return size;
 }
 
-static ssize_t read_zero(struct file * file, char * buf, 
+static ssize_t read_zero(struct file * file, char __user * buf, 
 			 size_t count, loff_t *ppos)
 {
 	unsigned long left, unwritten, written = 0;
@@ -523,7 +523,7 @@ static int mmap_zero(struct file * file, struct vm_area_struct * vma)
 }
 #endif /* CONFIG_MMU */
 
-static ssize_t write_full(struct file * file, const char * buf,
+static ssize_t write_full(struct file * file, const char __user * buf,
 			  size_t count, loff_t *ppos)
 {
 	return -ENOSPC;
@@ -628,7 +628,7 @@ static struct file_operations full_fops = {
 	.write		= write_full,
 };
 
-static ssize_t kmsg_write(struct file * file, const char * buf,
+static ssize_t kmsg_write(struct file * file, const char __user * buf,
 			  size_t count, loff_t *ppos)
 {
 	char *tmp;

drivers/char/pty.c

@@ -211,7 +211,7 @@ static int pty_chars_in_buffer(struct tty_struct *tty)
  * one we got after it is open, with an ioctl.
  */
 #ifdef CONFIG_UNIX98_PTYS
-static int pty_get_device_number(struct tty_struct *tty, unsigned int *value)
+static int pty_get_device_number(struct tty_struct *tty, unsigned __user *value)
 {
 	unsigned int result = tty->index;
 	return put_user(result, value);
@@ -219,7 +219,7 @@ static int pty_get_device_number(struct tty_struct *tty, unsigned int *value)
 #endif
 
 /* Set the lock flag on a pty */
-static int pty_set_lock(struct tty_struct *tty, int * arg)
+static int pty_set_lock(struct tty_struct *tty, int __user * arg)
 {
 	int val;
 	if (get_user(val,arg))
@@ -241,7 +241,7 @@ static int pty_bsd_ioctl(struct tty_struct *tty, struct file *file,
 	}
 	switch(cmd) {
 	case TIOCSPTLCK: /* Set PT Lock (disallow slave open) */
-		return pty_set_lock(tty, (int *) arg);
+		return pty_set_lock(tty, (int __user *) arg);
 	}
 	return -ENOIOCTLCMD;
 }
@@ -257,9 +257,9 @@ static int pty_unix98_ioctl(struct tty_struct *tty, struct file *file,
 	}
 	switch(cmd) {
 	case TIOCSPTLCK: /* Set PT Lock (disallow slave open) */
-		return pty_set_lock(tty, (int *)arg);
+		return pty_set_lock(tty, (int __user *)arg);
 	case TIOCGPTN: /* Get PT Number */
-		return pty_get_device_number(tty, (unsigned int *)arg);
+		return pty_get_device_number(tty, (unsigned int __user *)arg);
 	}
 
 	return -ENOIOCTLCMD;

drivers/char/random.c

@@ -1586,7 +1586,7 @@ void rand_initialize_disk(struct gendisk *disk)
 }
 
 static ssize_t
-random_read(struct file * file, char * buf, size_t nbytes, loff_t *ppos)
+random_read(struct file * file, char __user * buf, size_t nbytes, loff_t *ppos)
 {
 	DECLARE_WAITQUEUE(wait, current);
 	ssize_t			n, retval = 0, count = 0;
@@ -1666,7 +1666,7 @@ random_read(struct file * file, char * buf, size_t nbytes, loff_t *ppos)
 }
 
 static ssize_t
-urandom_read(struct file * file, char * buf,
+urandom_read(struct file * file, char __user * buf,
 		      size_t nbytes, loff_t *ppos)
 {
 	return extract_entropy(sec_random_state, buf, nbytes,
@@ -1690,13 +1690,13 @@ random_poll(struct file *file, poll_table * wait)
 }
 
 static ssize_t
-random_write(struct file * file, const char * buffer,
+random_write(struct file * file, const char __user * buffer,
 	     size_t count, loff_t *ppos)
 {
 	int		ret = 0;
 	size_t		bytes;
 	__u32 		buf[16];
-	const char 	*p = buffer;
+	const char 	__user *p = buffer;
 	size_t		c = count;
 
 	while (c > 0) {
@@ -1725,20 +1725,21 @@ static int
 random_ioctl(struct inode * inode, struct file * file,
 	     unsigned int cmd, unsigned long arg)
 {
-	int *p, *tmp, size, ent_count;
+	int *tmp, size, ent_count;
+	int __user *p = (int __user *)arg;
 	int retval;
 	unsigned long flags;
 	
 	switch (cmd) {
 	case RNDGETENTCNT:
 		ent_count = random_state->entropy_count;
-		if (put_user(ent_count, (int *) arg))
+		if (put_user(ent_count, p))
 			return -EFAULT;
 		return 0;
 	case RNDADDTOENTCNT:
 		if (!capable(CAP_SYS_ADMIN))
 			return -EPERM;
-		if (get_user(ent_count, (int *) arg))
+		if (get_user(ent_count, p))
 			return -EFAULT;
 		credit_entropy_store(random_state, ent_count);
 		/*
@@ -1751,7 +1752,6 @@ random_ioctl(struct inode * inode, struct file * file,
 	case RNDGETPOOL:
 		if (!capable(CAP_SYS_ADMIN))
 			return -EPERM;
-		p = (int *) arg;
 		if (get_user(size, p) ||
 		    put_user(random_state->poolinfo.poolwords, p++))
 			return -EFAULT;
@@ -1786,14 +1786,13 @@ random_ioctl(struct inode * inode, struct file * file,
 	case RNDADDENTROPY:
 		if (!capable(CAP_SYS_ADMIN))
 			return -EPERM;
-		p = (int *) arg;
 		if (get_user(ent_count, p++))
 			return -EFAULT;
 		if (ent_count < 0)
 			return -EINVAL;
 		if (get_user(size, p++))
 			return -EFAULT;
-		retval = random_write(file, (const char *) p,
+		retval = random_write(file, (const char __user *) p,
 				      size, &file->f_pos);
 		if (retval < 0)
 			return retval;
@@ -1895,7 +1894,7 @@ static int change_poolsize(int poolsize)
 }
 
 static int proc_do_poolsize(ctl_table *table, int write, struct file *filp,
-			    void *buffer, size_t *lenp)
+			    void __user *buffer, size_t *lenp)
 {
 	int	ret;
 
@@ -1909,9 +1908,9 @@ static int proc_do_poolsize(ctl_table *table, int write, struct file *filp,
 	return change_poolsize(sysctl_poolsize);
 }
 
-static int poolsize_strategy(ctl_table *table, int *name, int nlen,
-			     void *oldval, size_t *oldlenp,
-			     void *newval, size_t newlen, void **context)
+static int poolsize_strategy(ctl_table *table, int __user *name, int nlen,
+			     void __user *oldval, size_t __user *oldlenp,
+			     void __user *newval, size_t newlen, void **context)
 {
 	int	len;
 	
@@ -1946,7 +1945,7 @@ static int poolsize_strategy(ctl_table *table, int *name, int nlen,
  * sysctl system call, it is returned as 16 bytes of binary data.
  */
 static int proc_do_uuid(ctl_table *table, int write, struct file *filp,
-			void *buffer, size_t *lenp)
+			void __user *buffer, size_t *lenp)
 {
 	ctl_table	fake_table;
 	unsigned char	buf[64], tmp_uuid[16], *uuid;
@@ -1971,9 +1970,9 @@ static int proc_do_uuid(ctl_table *table, int write, struct file *filp,
 	return proc_dostring(&fake_table, write, filp, buffer, lenp);
 }
 
-static int uuid_strategy(ctl_table *table, int *name, int nlen,
-			 void *oldval, size_t *oldlenp,
-			 void *newval, size_t newlen, void **context)
+static int uuid_strategy(ctl_table *table, int __user *name, int nlen,
+			 void __user *oldval, size_t __user *oldlenp,
+			 void __user *newval, size_t newlen, void **context)
 {
 	unsigned char	tmp_uuid[16], *uuid;
 	unsigned int	len;

drivers/char/raw.c

@@ -140,7 +140,7 @@ static int raw_ctl_ioctl(struct inode *inode, struct file *filp,
 
 		/* First, find out which raw minor we want */
 
-		if (copy_from_user(&rq, (void *) arg, sizeof(rq))) {
+		if (copy_from_user(&rq, (void __user *) arg, sizeof(rq))) {
 			err = -EFAULT;
 			goto out;
 		}
@@ -211,7 +211,7 @@ static int raw_ctl_ioctl(struct inode *inode, struct file *filp,
 				rq.block_major = rq.block_minor = 0;
 			}
 			up(&raw_mutex);
-			if (copy_to_user((void *)arg, &rq, sizeof(rq))) {
+			if (copy_to_user((void __user *)arg, &rq, sizeof(rq))) {
 				err = -EFAULT;
 				goto out;
 			}
@@ -225,18 +225,24 @@ static int raw_ctl_ioctl(struct inode *inode, struct file *filp,
 	return err;
 }
 
-static ssize_t raw_file_write(struct file *file, const char *buf,
+static ssize_t raw_file_write(struct file *file, const char __user *buf,
 				   size_t count, loff_t *ppos)
 {
-	struct iovec local_iov = { .iov_base = (void *)buf, .iov_len = count };
+	struct iovec local_iov = {
+		.iov_base = (char __user *)buf,
+		.iov_len = count
+	};
 
 	return generic_file_write_nolock(file, &local_iov, 1, ppos);
 }
 
-static ssize_t raw_file_aio_write(struct kiocb *iocb, const char *buf,
+static ssize_t raw_file_aio_write(struct kiocb *iocb, const char __user *buf,
 					size_t count, loff_t pos)
 {
-	struct iovec local_iov = { .iov_base = (void *)buf, .iov_len = count };
+	struct iovec local_iov = {
+		.iov_base = (char __user *)buf,
+		.iov_len = count
+	};
 
 	return generic_file_aio_write_nolock(iocb, &local_iov, 1, &iocb->ki_pos);
 }

drivers/char/vc_screen.c

@@ -102,7 +102,7 @@ extern char con_buf[PAGE_SIZE];
 extern struct semaphore con_buf_sem;
 
 static ssize_t
-vcs_read(struct file *file, char *buf, size_t count, loff_t *ppos)
+vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
 	struct inode *inode = file->f_dentry->d_inode;
 	unsigned int currcons = iminor(inode);
@@ -271,7 +271,7 @@ vcs_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 }
 
 static ssize_t
-vcs_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
+vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 {
 	struct inode *inode = file->f_dentry->d_inode;
 	unsigned int currcons = iminor(inode);