[PATCH] sparse: __user annotations for s390 drivers

From: Arnd Bergmann <arnd@arndb.de>

This should catch almost all s390 device drivers
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

arch/s390/appldata/appldata_base.c

@@ -85,9 +85,10 @@ struct appldata_parameter_list {
  */
 static const char appldata_proc_name[APPLDATA_PROC_NAME_LENGTH] = "appldata";
 static int appldata_timer_handler(ctl_table *ctl, int write, struct file *filp,
-		   		  void *buffer, size_t *lenp);
+				  void __user *buffer, size_t *lenp);
 static int appldata_interval_handler(ctl_table *ctl, int write,
-					 struct file *filp, void *buffer,
+					 struct file *filp,
+					 void __user *buffer,
 					 size_t *lenp);
 
 static struct ctl_table_header *appldata_sysctl_header;
@@ -192,7 +193,8 @@ static void appldata_tasklet_function(unsigned long data)
  * wrapper function for mod_virt_timer(), because smp_call_function_on()
  * accepts only one parameter.
  */
-static void appldata_mod_vtimer_wrap(struct appldata_mod_vtimer_args *args) {
+static void appldata_mod_vtimer_wrap(void *p) {
+	struct appldata_mod_vtimer_args *args = p;
 	mod_virt_timer(args->timer, args->expires);
 }
 
@@ -252,7 +254,7 @@ static int appldata_diag(char record_nr, u16 function, unsigned long buffer,
  */
 static int
 appldata_timer_handler(ctl_table *ctl, int write, struct file *filp,
-			   void *buffer, size_t *lenp)
+			   void __user *buffer, size_t *lenp)
 {
 	int len, i;
 	char buf[2];
@@ -309,7 +311,7 @@ appldata_timer_handler(ctl_table *ctl, int write, struct file *filp,
  */
 static int
 appldata_interval_handler(ctl_table *ctl, int write, struct file *filp,
-			   void *buffer, size_t *lenp)
+			   void __user *buffer, size_t *lenp)
 {
 	int len, i, interval;
 	char buf[16];
@@ -347,7 +349,7 @@ appldata_interval_handler(ctl_table *ctl, int write, struct file *filp,
 			appldata_mod_vtimer_args.expires =
 					per_cpu_interval;
 			smp_call_function_on(
-				(void *) appldata_mod_vtimer_wrap,
+				appldata_mod_vtimer_wrap,
 				&appldata_mod_vtimer_args,
 				0, 1, i);
 		}
@@ -370,7 +372,7 @@ appldata_interval_handler(ctl_table *ctl, int write, struct file *filp,
  */
 static int
 appldata_generic_handler(ctl_table *ctl, int write, struct file *filp,
-			   void *buffer, size_t *lenp)
+			   void __user *buffer, size_t *lenp)
 {
 	struct appldata_ops *ops = NULL, *tmp_ops;
 	int rc, len, found;

drivers/s390/block/dasd_cmb.c

@@ -58,7 +58,7 @@ static int
 dasd_ioctl_readall_cmb(struct block_device *bdev, int no, long args)
 {
 	struct dasd_device *device;
-	struct cmbdata * __user udata;
+	struct cmbdata __user *udata;
 	struct cmbdata data;
 	size_t size;
 	int ret;
@@ -66,7 +66,7 @@ dasd_ioctl_readall_cmb(struct block_device *bdev, int no, long args)
 	device = bdev->bd_disk->private_data;
 	if (!device)
 		return -EINVAL;
-	udata = (void *) args;
+	udata = (void __user *) args;
 	size = _IOC_SIZE(no);
 
 	if (!access_ok(VERIFY_WRITE, udata, size))

drivers/s390/block/dasd_eckd.c

@@ -1289,7 +1289,7 @@ dasd_eckd_performance(struct block_device *bdev, int no, long args)
 		/* Prepare for Read Subsystem Data */
 		prssdp = (struct dasd_psf_prssd_data *) cqr->data;
 		stats = (struct dasd_rssd_perf_stats_t *) (prssdp + 1);
-		rc = copy_to_user((long *) args, (long *) stats,
+		rc = copy_to_user((long __user *) args, (long *) stats,
 				  sizeof(struct dasd_rssd_perf_stats_t));
 	}
 	dasd_sfree_request(cqr, cqr->device);
@@ -1319,10 +1319,10 @@ dasd_eckd_get_attrib (struct block_device *bdev, int no, long args)
 
         private = (struct dasd_eckd_private *) device->private;
         attrib = private->attrib;
-	
-        rc = copy_to_user((long *) args, (long *) &attrib,
+
+        rc = copy_to_user((long __user *) args, (long *) &attrib,
 			  sizeof (struct attrib_data_t));
-	
+
 	return rc;
 }
 
@@ -1346,7 +1346,7 @@ dasd_eckd_set_attrib(struct block_device *bdev, int no, long args)
 	if (device == NULL)
 		return -ENODEV;
 
-	if (copy_from_user(&attrib, (void *) args,
+	if (copy_from_user(&attrib, (void __user *) args,
 			   sizeof (struct attrib_data_t))) {
 		return -EFAULT;
 	}

drivers/s390/block/dasd_ioctl.c

@@ -120,7 +120,7 @@ static int
 dasd_ioctl_api_version(struct block_device *bdev, int no, long args)
 {
 	int ver = DASD_API_VERSION;
-	return put_user(ver, (int *) args);
+	return put_user(ver, (int __user *) args);
 }
 
 /*
@@ -305,7 +305,7 @@ dasd_ioctl_format(struct block_device *bdev, int no, long args)
 		return -ENODEV;
 	if (test_bit(DASD_FLAG_RO, &device->flags))
 		return -EROFS;
-	if (copy_from_user(&fdata, (void *) args,
+	if (copy_from_user(&fdata, (void __user *) args,
 			   sizeof (struct format_data_t)))
 		return -EFAULT;
 	if (bdev != bdev->bd_contains) {
@@ -348,7 +348,7 @@ dasd_ioctl_read_profile(struct block_device *bdev, int no, long args)
 	if (device == NULL)
 		return -ENODEV;
 
-	if (copy_to_user((long *) args, (long *) &device->profile,
+	if (copy_to_user((long __user *) args, (long *) &device->profile,
 			 sizeof (struct dasd_profile_info_t)))
 		return -EFAULT;
 	return 0;
@@ -441,9 +441,9 @@ dasd_ioctl_information(struct block_device *bdev, int no, long args)
 		spin_unlock_irqrestore(get_ccwdev_lock(device->cdev),
 				       flags);
 	}
-	
+
 	rc = 0;
-	if (copy_to_user((long *) args, (long *) dasd_info,
+	if (copy_to_user((long __user *) args, (long *) dasd_info,
 			 ((no == (unsigned int) BIODASDINFO2) ?
 			  sizeof (struct dasd_information2_t) :
 			  sizeof (struct dasd_information_t))))
@@ -466,7 +466,7 @@ dasd_ioctl_set_ro(struct block_device *bdev, int no, long args)
 	if (bdev != bdev->bd_contains)
 		// ro setting is not allowed for partitions
 		return -EINVAL;
-	if (get_user(intval, (int *) args))
+	if (get_user(intval, (int __user *) args))
 		return -EFAULT;
 	device =  bdev->bd_disk->private_data;
 	if (device == NULL)
@@ -499,7 +499,7 @@ dasd_ioctl_getgeo(struct block_device *bdev, int no, long args)
 	geo = (struct hd_geometry) {};
 	device->discipline->fill_geometry(device, &geo);
 	geo.start = get_start_sect(bdev) >> device->s2b_shift;
-	if (copy_to_user((struct hd_geometry *) args, &geo,
+	if (copy_to_user((struct hd_geometry __user *) args, &geo,
 			 sizeof (struct hd_geometry)))
 		return -EFAULT;
 

drivers/s390/block/dasd_proc.c

@@ -30,7 +30,7 @@ static struct proc_dir_entry *dasd_devices_entry = NULL;
 static struct proc_dir_entry *dasd_statistics_entry = NULL;
 
 static inline char *
-dasd_get_user_string(const char *user_buf, size_t user_len)
+dasd_get_user_string(const char __user *user_buf, size_t user_len)
 {
 	char *buffer;
 
@@ -239,7 +239,7 @@ dasd_statistics_read(char *page, char **start, off_t off,
 }
 
 static int
-dasd_statistics_write(struct file *file, const char *user_buf,
+dasd_statistics_write(struct file *file, const char __user *user_buf,
 		      unsigned long user_len, void *data)
 {
 #ifdef CONFIG_DASD_PROFILE

drivers/s390/block/xpram.c

@@ -155,7 +155,7 @@ static int xpram_page_in (unsigned long page_addr, unsigned int xpage_index)
 {
 	int cc;
 
-	__asm__ __volatile(
+	__asm__ __volatile__ (
 		"   lhi   %0,2\n"  /* return unused cc 2 if pgin traps */
 		"   .insn rre,0xb22e0000,%1,%2\n"  /* pgin %1,%2 */
                 "0: ipm   %0\n"
@@ -203,7 +203,7 @@ static long xpram_page_out (unsigned long page_addr, unsigned int xpage_index)
 {
 	int cc;
 
-	__asm__ __volatile(
+	__asm__ __volatile__ (
 		"   lhi   %0,2\n"  /* return unused cc 2 if pgout traps */
 		"   .insn rre,0xb22f0000,%1,%2\n"  /* pgout %1,%2 */
                 "0: ipm   %0\n"
@@ -332,16 +332,16 @@ static int xpram_make_request(request_queue_t *q, struct bio *bio)
 static int xpram_ioctl (struct inode *inode, struct file *filp,
 		 unsigned int cmd, unsigned long arg)
 {
-	struct hd_geometry *geo;
+	struct hd_geometry __user *geo;
 	unsigned long size;
- 	if (cmd != HDIO_GETGEO)
+	if (cmd != HDIO_GETGEO)
 		return -EINVAL;
 	/*
 	 * get geometry: we have to fake one...  trim the size to a
 	 * multiple of 64 (32k): tell we have 16 sectors, 4 heads,
 	 * whatever cylinders. Tell also that data starts at sector. 4.
 	 */
-	geo = (struct hd_geometry *) arg;
+	geo = (struct hd_geometry __user *) arg;
 	size = (xpram_pages * 8) & ~0x3f;
 	put_user(size >> 6, &geo->cylinders);
 	put_user(4, &geo->heads);

drivers/s390/char/con3215.c

@@ -1002,7 +1002,8 @@ tty3215_write(struct tty_struct * tty, int from_user,
 	ret = 0;
 	while (count > 0) {
 		length = count < 80 ? count : 80;
-		length -= copy_from_user(raw->ubuffer, buf, length);
+		length -= copy_from_user(raw->ubuffer,
+				(const unsigned char __user *)buf, length);
 		if (length == 0) {
 			if (!ret)
 				ret = -EFAULT;

drivers/s390/char/keyboard.c

@@ -338,7 +338,7 @@ kbd_keycode(struct kbd_data *kbd, unsigned int keycode)
  * Ioctl stuff.
  */
 static int
-do_kdsk_ioctl(struct kbd_data *kbd, struct kbentry *user_kbe,
+do_kdsk_ioctl(struct kbd_data *kbd, struct kbentry __user *user_kbe,
 	      int cmd, int perm)
 {
 	struct kbentry tmp;
@@ -410,7 +410,7 @@ do_kdsk_ioctl(struct kbd_data *kbd, struct kbentry *user_kbe,
 }
 
 static int
-do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry *u_kbs,
+do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
 	       int cmd, int perm)
 {
 	unsigned char kb_func;
@@ -464,9 +464,12 @@ int
 kbd_ioctl(struct kbd_data *kbd, struct file *file,
 	  unsigned int cmd, unsigned long arg)
 {
-	struct kbdiacrs *a;
+	struct kbdiacrs __user *a;
+	void __user *argp;
 	int ct, perm;
 
+	argp = (void __user *)arg;
+
 	/*
 	 * To have permissions to do most of the vt ioctls, we either have
 	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
@@ -474,15 +477,15 @@ kbd_ioctl(struct kbd_data *kbd, struct file *file,
 	perm = current->signal->tty == kbd->tty || capable(CAP_SYS_TTY_CONFIG);
 	switch (cmd) {
 	case KDGKBTYPE:
-		return put_user(KB_101, (char*) arg);
+		return put_user(KB_101, (char __user *)argp);
 	case KDGKBENT:
 	case KDSKBENT:
-		return do_kdsk_ioctl(kbd, (struct kbentry *)arg, cmd, perm);
+		return do_kdsk_ioctl(kbd, argp, cmd, perm);
 	case KDGKBSENT:
 	case KDSKBSENT:
-		return do_kdgkb_ioctl(kbd, (struct kbsentry *)arg, cmd, perm);
+		return do_kdgkb_ioctl(kbd, argp, cmd, perm);
 	case KDGKBDIACR:
-		a = (struct kbdiacrs *) arg;
+		a = argp;
 
 		if (put_user(kbd->accent_table_size, &a->kb_cnt))
 			return -EFAULT;
@@ -492,7 +495,7 @@ kbd_ioctl(struct kbd_data *kbd, struct file *file,
 			return -EFAULT;
 		return 0;
 	case KDSKBDIACR:
-		a = (struct kbdiacrs *) arg;
+		a = argp;
 		if (!perm)
 			return -EPERM;
 		if (get_user(ct, &a->kb_cnt))

drivers/s390/char/sclp_tty.c

@@ -112,46 +112,46 @@ sclp_tty_ioctl(struct tty_struct *tty, struct file * file,
 	switch (cmd) {
 	case TIOCSCLPSHTAB:
 		/* set width of horizontal tab	*/
-		if (get_user(sclp_ioctls.htab, (unsigned short *) arg))
+		if (get_user(sclp_ioctls.htab, (unsigned short __user *) arg))
 			rc = -EFAULT;
 		else
 			check = 1;
 		break;
 	case TIOCSCLPGHTAB:
 		/* get width of horizontal tab	*/
-		if (put_user(sclp_ioctls.htab, (unsigned short *) arg))
+		if (put_user(sclp_ioctls.htab, (unsigned short __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPSECHO:
 		/* enable/disable echo of input */
-		if (get_user(sclp_ioctls.echo, (unsigned char *) arg))
+		if (get_user(sclp_ioctls.echo, (unsigned char __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPGECHO:
 		/* Is echo of input enabled ?  */
-		if (put_user(sclp_ioctls.echo, (unsigned char *) arg))
+		if (put_user(sclp_ioctls.echo, (unsigned char __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPSCOLS:
 		/* set number of columns for output  */
-		if (get_user(sclp_ioctls.columns, (unsigned short *) arg))
+		if (get_user(sclp_ioctls.columns, (unsigned short __user *) arg))
 			rc = -EFAULT;
 		else
 			check = 1;
 		break;
 	case TIOCSCLPGCOLS:
 		/* get number of columns for output  */
-		if (put_user(sclp_ioctls.columns, (unsigned short *) arg))
+		if (put_user(sclp_ioctls.columns, (unsigned short __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPSNL:
 		/* enable/disable writing without final new line character  */
-		if (get_user(sclp_ioctls.final_nl, (signed char *) arg))
+		if (get_user(sclp_ioctls.final_nl, (signed char __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPGNL:
 		/* Is writing without final new line character enabled ?  */
-		if (put_user(sclp_ioctls.final_nl, (signed char *) arg))
+		if (put_user(sclp_ioctls.final_nl, (signed char __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPSOBUF:
@@ -160,7 +160,7 @@ sclp_tty_ioctl(struct tty_struct *tty, struct file * file,
 		 * up to next 4kB boundary and stored as number of SCCBs
 		 * (4kB Buffers) limitation: 256 x 4kB
 		 */
-		if (get_user(obuf, (unsigned int *) arg) == 0) {
+		if (get_user(obuf, (unsigned int __user *) arg) == 0) {
 			if (obuf & 0xFFF)
 				sclp_ioctls.max_sccb = (obuf >> 12) + 1;
 			else
@@ -171,22 +171,22 @@ sclp_tty_ioctl(struct tty_struct *tty, struct file * file,
 	case TIOCSCLPGOBUF:
 		/* get the maximum buffers size for output  */
 		obuf = sclp_ioctls.max_sccb << 12;
-		if (put_user(obuf, (unsigned int *) arg))
+		if (put_user(obuf, (unsigned int __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPGKBUF:
 		/* get the number of buffers got from kernel at startup */
-		if (put_user(sclp_ioctls.kmem_sccb, (unsigned short *) arg))
+		if (put_user(sclp_ioctls.kmem_sccb, (unsigned short __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPSCASE:
 		/* enable/disable conversion from upper to lower case */
-		if (get_user(sclp_ioctls.tolower, (unsigned char *) arg))
+		if (get_user(sclp_ioctls.tolower, (unsigned char __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPGCASE:
 		/* Is conversion from upper to lower case of input enabled? */
-		if (put_user(sclp_ioctls.tolower, (unsigned char *) arg))
+		if (put_user(sclp_ioctls.tolower, (unsigned char __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPSDELIM:
@@ -194,7 +194,7 @@ sclp_tty_ioctl(struct tty_struct *tty, struct file * file,
 		 * set special character used for separating upper and
 		 * lower case, 0x00 disables this feature
 		 */
-		if (get_user(sclp_ioctls.delim, (unsigned char *) arg))
+		if (get_user(sclp_ioctls.delim, (unsigned char __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPGDELIM:
@@ -202,7 +202,7 @@ sclp_tty_ioctl(struct tty_struct *tty, struct file * file,
 		 * get special character used for separating upper and
 		 * lower case, 0x00 disables this feature
 		 */
-		if (put_user(sclp_ioctls.delim, (unsigned char *) arg))
+		if (put_user(sclp_ioctls.delim, (unsigned char __user *) arg))
 			rc = -EFAULT;
 		break;
 	case TIOCSCLPSINIT:
@@ -415,7 +415,8 @@ sclp_tty_write(struct tty_struct *tty, int from_user,
 	while (count > 0) {
 		length = count < SCLP_TTY_BUF_SIZE ?
 			count : SCLP_TTY_BUF_SIZE;
-		length -= copy_from_user(sclp_tty_chars, buf, length);
+		length -= copy_from_user(sclp_tty_chars,
+				(const unsigned char __user *)buf, length);
 		if (length == 0) {
 			if (!ret)
 				ret = -EFAULT;

drivers/s390/char/sclp_vt220.c

@@ -490,7 +490,8 @@ sclp_vt220_write(struct tty_struct *tty, int from_user,
 	while (count > 0) {
 		length = count < SCLP_VT220_BUF_SIZE ?
 			 count : SCLP_VT220_BUF_SIZE;
-		length -= copy_from_user(tty->driver_data, buf, length);
+		length -= copy_from_user(tty->driver_data,
+				(const unsigned char __user *)buf, length);
 		if (length == 0) {
 			if (!ret)
 				return -EFAULT;

drivers/s390/char/tape_34xx.c

@@ -885,7 +885,7 @@ tape_34xx_ioctl(struct tape_device *device, unsigned int cmd, unsigned long arg)
 	if (cmd == TAPE390_DISPLAY) {
 		struct display_struct disp;
 
-		if (copy_from_user(&disp, (char *) arg, sizeof(disp)) != 0)
+		if (copy_from_user(&disp, (char __user *) arg, sizeof(disp)) != 0)
 			return -EFAULT;
 
 		return tape_std_display(device, &disp);

drivers/s390/char/tape_char.c

@@ -29,8 +29,8 @@
 /*
  * file operation structure for tape character frontend
  */
-static ssize_t tapechar_read(struct file *, char *, size_t, loff_t *);
-static ssize_t tapechar_write(struct file *, const char *, size_t, loff_t *);
+static ssize_t tapechar_read(struct file *, char __user *, size_t, loff_t *);
+static ssize_t tapechar_write(struct file *, const char __user *, size_t, loff_t *);
 static int tapechar_open(struct inode *,struct file *);
 static int tapechar_release(struct inode *,struct file *);
 static int tapechar_ioctl(struct inode *, struct file *, unsigned int,
@@ -134,7 +134,7 @@ tapechar_check_idalbuffer(struct tape_device *device, size_t block_size)
  * Tape device read function
  */
 ssize_t
-tapechar_read (struct file *filp, char *data, size_t count, loff_t *ppos)
+tapechar_read(struct file *filp, char __user *data, size_t count, loff_t *ppos)
 {
 	struct tape_device *device;
 	struct tape_request *request;
@@ -208,7 +208,7 @@ tapechar_read (struct file *filp, char *data, size_t count, loff_t *ppos)
  * Tape device write function
  */
 ssize_t
-tapechar_write(struct file *filp, const char *data, size_t count, loff_t *ppos)
+tapechar_write(struct file *filp, const char __user *data, size_t count, loff_t *ppos)
 {
 	struct tape_device *device;
 	struct tape_request *request;
@@ -389,7 +389,7 @@ tapechar_ioctl(struct inode *inp, struct file *filp,
 	if (no == MTIOCTOP) {
 		struct mtop op;
 
-		if (copy_from_user(&op, (char *) data, sizeof(op)) != 0)
+		if (copy_from_user(&op, (char __user *) data, sizeof(op)) != 0)
 			return -EFAULT;
 		if (op.mt_count < 0)
 			return -EINVAL;
@@ -436,7 +436,7 @@ tapechar_ioctl(struct inode *inp, struct file *filp,
 		if (rc < 0)
 			return rc;
 		pos.mt_blkno = rc;
-		if (copy_to_user((char *) data, &pos, sizeof(pos)) != 0)
+		if (copy_to_user((char __user *) data, &pos, sizeof(pos)) != 0)
 			return -EFAULT;
 		return 0;
 	}
@@ -466,7 +466,7 @@ tapechar_ioctl(struct inode *inp, struct file *filp,
 			get.mt_blkno = rc;
 		}
 
-		if (copy_to_user((char *) data, &get, sizeof(get)) != 0)
+		if (copy_to_user((char __user *) data, &get, sizeof(get)) != 0)
 			return -EFAULT;
 
 		return 0;

drivers/s390/cio/blacklist.c

@@ -308,7 +308,7 @@ static int cio_ignore_read (char *page, char **start, off_t off,
 	return len;
 }
 
-static int cio_ignore_write (struct file *file, const char *user_buf,
+static int cio_ignore_write(struct file *file, const char __user *user_buf,
 			     unsigned long user_len, void *data)
 {
 	char *buf;

drivers/s390/cio/device_fsm.c

@@ -1071,103 +1071,103 @@ ccw_device_bug(struct ccw_device *cdev, enum dev_event dev_event)
  * device statemachine
  */
 fsm_func_t *dev_jumptable[NR_DEV_STATES][NR_DEV_EVENTS] = {
-	[DEV_STATE_NOT_OPER] {
-		[DEV_EVENT_NOTOPER]	ccw_device_nop,
-		[DEV_EVENT_INTERRUPT]	ccw_device_bug,
-		[DEV_EVENT_TIMEOUT]	ccw_device_nop,
-		[DEV_EVENT_VERIFY]	ccw_device_nop,
+	[DEV_STATE_NOT_OPER] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_nop,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_bug,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_nop,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
-	[DEV_STATE_SENSE_PGID] {
-		[DEV_EVENT_NOTOPER]	ccw_device_online_notoper,
-		[DEV_EVENT_INTERRUPT]	ccw_device_sense_pgid_irq,
-		[DEV_EVENT_TIMEOUT]	ccw_device_onoff_timeout,
-		[DEV_EVENT_VERIFY]	ccw_device_nop,
+	[DEV_STATE_SENSE_PGID] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_online_notoper,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_sense_pgid_irq,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_onoff_timeout,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
-	[DEV_STATE_SENSE_ID] {
-		[DEV_EVENT_NOTOPER]	ccw_device_recog_notoper,
-		[DEV_EVENT_INTERRUPT]	ccw_device_sense_id_irq,
-		[DEV_EVENT_TIMEOUT]	ccw_device_recog_timeout,
-		[DEV_EVENT_VERIFY]	ccw_device_nop,
+	[DEV_STATE_SENSE_ID] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_recog_notoper,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_sense_id_irq,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_recog_timeout,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
-	[DEV_STATE_OFFLINE] {
-		[DEV_EVENT_NOTOPER]	ccw_device_offline_notoper,
-		[DEV_EVENT_INTERRUPT]	ccw_device_offline_irq,
-		[DEV_EVENT_TIMEOUT]	ccw_device_nop,
-		[DEV_EVENT_VERIFY]	ccw_device_nop,
+	[DEV_STATE_OFFLINE] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_offline_notoper,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_offline_irq,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_nop,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
-	[DEV_STATE_VERIFY] {
-		[DEV_EVENT_NOTOPER]	ccw_device_online_notoper,
-		[DEV_EVENT_INTERRUPT]	ccw_device_verify_irq,
-		[DEV_EVENT_TIMEOUT]	ccw_device_onoff_timeout,
-		[DEV_EVENT_VERIFY]	ccw_device_nop,
+	[DEV_STATE_VERIFY] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_online_notoper,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_verify_irq,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_onoff_timeout,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
-	[DEV_STATE_ONLINE] {
-		[DEV_EVENT_NOTOPER]	ccw_device_online_notoper,
-		[DEV_EVENT_INTERRUPT]	ccw_device_irq,
-		[DEV_EVENT_TIMEOUT]	ccw_device_online_timeout,
-		[DEV_EVENT_VERIFY]	ccw_device_online_verify,
+	[DEV_STATE_ONLINE] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_online_notoper,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_irq,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_online_timeout,
+		[DEV_EVENT_VERIFY]	= ccw_device_online_verify,
 	},
-	[DEV_STATE_W4SENSE] {
-		[DEV_EVENT_NOTOPER]	ccw_device_online_notoper,
-		[DEV_EVENT_INTERRUPT]	ccw_device_w4sense,
-		[DEV_EVENT_TIMEOUT]	ccw_device_nop,
-		[DEV_EVENT_VERIFY]	ccw_device_online_verify,
+	[DEV_STATE_W4SENSE] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_online_notoper,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_w4sense,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_nop,
+		[DEV_EVENT_VERIFY]	= ccw_device_online_verify,
 	},
-	[DEV_STATE_DISBAND_PGID] {
-		[DEV_EVENT_NOTOPER]	ccw_device_online_notoper,
-		[DEV_EVENT_INTERRUPT]	ccw_device_disband_irq,
-		[DEV_EVENT_TIMEOUT]	ccw_device_onoff_timeout,
-		[DEV_EVENT_VERIFY]	ccw_device_nop,
+	[DEV_STATE_DISBAND_PGID] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_online_notoper,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_disband_irq,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_onoff_timeout,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
-	[DEV_STATE_BOXED] {
-		[DEV_EVENT_NOTOPER]	ccw_device_offline_notoper,
-		[DEV_EVENT_INTERRUPT]	ccw_device_stlck_done,
-		[DEV_EVENT_TIMEOUT]	ccw_device_stlck_done,
-		[DEV_EVENT_VERIFY]	ccw_device_nop,
+	[DEV_STATE_BOXED] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_offline_notoper,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_stlck_done,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_stlck_done,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
 	/* states to wait for i/o completion before doing something */
-	[DEV_STATE_CLEAR_VERIFY] {
-		[DEV_EVENT_NOTOPER]     ccw_device_online_notoper,
-		[DEV_EVENT_INTERRUPT]   ccw_device_clear_verify,
-		[DEV_EVENT_TIMEOUT]	ccw_device_nop,
-		[DEV_EVENT_VERIFY]	ccw_device_nop,
+	[DEV_STATE_CLEAR_VERIFY] = {
+		[DEV_EVENT_NOTOPER]     = ccw_device_online_notoper,
+		[DEV_EVENT_INTERRUPT]   = ccw_device_clear_verify,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_nop,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
-	[DEV_STATE_TIMEOUT_KILL] {
-		[DEV_EVENT_NOTOPER]	ccw_device_online_notoper,
-		[DEV_EVENT_INTERRUPT]	ccw_device_killing_irq,
-		[DEV_EVENT_TIMEOUT]	ccw_device_killing_timeout,
-		[DEV_EVENT_VERIFY]	ccw_device_nop, //FIXME
+	[DEV_STATE_TIMEOUT_KILL] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_online_notoper,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_killing_irq,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_killing_timeout,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop, //FIXME
 	},
-	[DEV_STATE_WAIT4IO] {
-		[DEV_EVENT_NOTOPER]	ccw_device_online_notoper,
-		[DEV_EVENT_INTERRUPT]	ccw_device_wait4io_irq,
-		[DEV_EVENT_TIMEOUT]	ccw_device_wait4io_timeout,
-		[DEV_EVENT_VERIFY]	ccw_device_wait4io_verify,
+	[DEV_STATE_WAIT4IO] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_online_notoper,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_wait4io_irq,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_wait4io_timeout,
+		[DEV_EVENT_VERIFY]	= ccw_device_wait4io_verify,
 	},
-	[DEV_STATE_QUIESCE] {
-		[DEV_EVENT_NOTOPER]	ccw_device_quiesce_done,
-		[DEV_EVENT_INTERRUPT]	ccw_device_quiesce_done,
-		[DEV_EVENT_TIMEOUT]	ccw_device_quiesce_timeout,
-		[DEV_EVENT_VERIFY]	ccw_device_nop,
+	[DEV_STATE_QUIESCE] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_quiesce_done,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_quiesce_done,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_quiesce_timeout,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
 	/* special states for devices gone not operational */
-	[DEV_STATE_DISCONNECTED] {
-		[DEV_EVENT_NOTOPER]	ccw_device_nop,
-		[DEV_EVENT_INTERRUPT]	ccw_device_start_id,
-		[DEV_EVENT_TIMEOUT]	ccw_device_bug,
-		[DEV_EVENT_VERIFY]	ccw_device_nop,
+	[DEV_STATE_DISCONNECTED] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_nop,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_start_id,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_bug,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
-	[DEV_STATE_DISCONNECTED_SENSE_ID] {
-		[DEV_EVENT_NOTOPER]	ccw_device_recog_notoper,
-		[DEV_EVENT_INTERRUPT]	ccw_device_sense_id_irq,
-		[DEV_EVENT_TIMEOUT]	ccw_device_recog_timeout,
-		[DEV_EVENT_VERIFY]	ccw_device_nop,
+	[DEV_STATE_DISCONNECTED_SENSE_ID] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_recog_notoper,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_sense_id_irq,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_recog_timeout,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
-	[DEV_STATE_CMFCHANGE] {
-		[DEV_EVENT_NOTOPER]	ccw_device_change_cmfstate,
-		[DEV_EVENT_INTERRUPT]	ccw_device_change_cmfstate,
-		[DEV_EVENT_TIMEOUT]	ccw_device_change_cmfstate,
-		[DEV_EVENT_VERIFY]	ccw_device_change_cmfstate,
+	[DEV_STATE_CMFCHANGE] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_change_cmfstate,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_change_cmfstate,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_change_cmfstate,
+		[DEV_EVENT_VERIFY]	= ccw_device_change_cmfstate,
 	},
 };
 

drivers/s390/crypto/z90crypt.h

@@ -46,12 +46,12 @@
  * - length(n_modulus) = inputdatalength
  */
 struct ica_rsa_modexpo {
-	char *		inputdata;
+	char __user *	inputdata;
 	unsigned int	inputdatalength;
-	char *		outputdata;
+	char __user *	outputdata;
 	unsigned int	outputdatalength;
-	char *		b_key;
-	char *		n_modulus;
+	char __user *	b_key;
+	char __user *	n_modulus;
 };
 
 /**
@@ -69,15 +69,15 @@ struct ica_rsa_modexpo {
  * - length(u_mult_inv) = inputdatalength/2 + 8
  */
 struct ica_rsa_modexpo_crt {
-	char *		inputdata;
+	char __user *	inputdata;
 	unsigned int	inputdatalength;
-	char *		outputdata;
+	char __user *	outputdata;
 	unsigned int	outputdatalength;
-	char *		bp_key;
-	char *		bq_key;
-	char *		np_prime;
-	char *		nq_prime;
-	char *		u_mult_inv;
+	char __user *	bp_key;
+	char __user *	bq_key;
+	char __user *	np_prime;
+	char __user *	nq_prime;
+	char __user *	u_mult_inv;
 };
 
 #define Z90_IOCTL_MAGIC 'z'  // NOTE:  Need to allocate from linux folks

drivers/s390/crypto/z90main.c

@@ -361,7 +361,7 @@ struct work_element {
 	int		  buff_size;	  // size of the buffer for the request
 	char		  resp_buff[RESPBUFFSIZE];
 	int		  resp_buff_size;
-	char *		  resp_addr;	  // address of response in user space
+	char __user *	  resp_addr;	  // address of response in user space
 	unsigned int	  funccode;	  // function code of request
 	wait_queue_head_t waitq;
 	unsigned long	  requestsent;	  // time at which the request was sent
@@ -378,8 +378,9 @@ struct work_element {
  */
 static int z90crypt_open(struct inode *, struct file *);
 static int z90crypt_release(struct inode *, struct file *);
-static ssize_t z90crypt_read(struct file *, char *, size_t, loff_t *);
-static ssize_t z90crypt_write(struct file *, const char *, size_t, loff_t *);
+static ssize_t z90crypt_read(struct file *, char __user *, size_t, loff_t *);
+static ssize_t z90crypt_write(struct file *, const char __user *,
+							size_t, loff_t *);
 static int z90crypt_ioctl(struct inode *, struct file *,
 			  unsigned int, unsigned long);
 
@@ -389,7 +390,7 @@ static void z90crypt_config_task(unsigned long);
 static void z90crypt_cleanup_task(unsigned long);
 
 static int z90crypt_status(char *, char **, off_t, int, int *, void *);
-static int z90crypt_status_write(struct file *, const char *,
+static int z90crypt_status_write(struct file *, const char __user *,
 				 unsigned long, void *);
 
 /**
@@ -473,9 +474,9 @@ static int
 trans_modexpo32(unsigned int fd, unsigned int cmd, unsigned long arg,
 		struct file *file)
 {
-	struct ica_rsa_modexpo_32 *mex32u = compat_ptr(arg);
+	struct ica_rsa_modexpo_32 __user *mex32u = compat_ptr(arg);
 	struct ica_rsa_modexpo_32  mex32k;
-	struct ica_rsa_modexpo    *mex64;
+	struct ica_rsa_modexpo __user *mex64;
 	int ret = 0;
 	unsigned int i;
 
@@ -517,9 +518,9 @@ static int
 trans_modexpo_crt32(unsigned int fd, unsigned int cmd, unsigned long arg,
 		    struct file *file)
 {
-	struct ica_rsa_modexpo_crt_32 *crt32u = compat_ptr(arg);
+	struct ica_rsa_modexpo_crt_32 __user *crt32u = compat_ptr(arg);
 	struct ica_rsa_modexpo_crt_32  crt32k;
-	struct ica_rsa_modexpo_crt    *crt64;
+	struct ica_rsa_modexpo_crt __user *crt64;
 	int ret = 0;
 	unsigned int i;
 
@@ -841,7 +842,7 @@ z90crypt_release(struct inode *inode, struct file *filp)
  * z90crypt_read will not be supported beyond z90crypt 1.3.1
  */
 static ssize_t
-z90crypt_read(struct file *filp, char *buf, size_t count, loff_t *f_pos)
+z90crypt_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
 {
 	PDEBUG("filp %p (PID %d)\n", filp, PID());
 	return -EPERM;
@@ -854,7 +855,7 @@ z90crypt_read(struct file *filp, char *buf, size_t count, loff_t *f_pos)
  */
 #include <linux/random.h>
 static ssize_t
-z90crypt_read(struct file *filp, char *buf, size_t count, loff_t *f_pos)
+z90crypt_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
 {
 	unsigned char *temp_buff;
 
@@ -892,7 +893,7 @@ z90crypt_read(struct file *filp, char *buf, size_t count, loff_t *f_pos)
  * Write is is not allowed
  */
 static ssize_t
-z90crypt_write(struct file *filp, const char *buf, size_t count, loff_t *f_pos)
+z90crypt_write(struct file *filp, const char __user *buf, size_t count, loff_t *f_pos)
 {
 	PDEBUG("filp %p (PID %d)\n", filp, PID());
 	return -EPERM;
@@ -1258,7 +1259,7 @@ z90crypt_send(struct work_element *we_p, const char *buf)
  * process_results copies the user's work from kernel space.
  */
 static inline int
-z90crypt_process_results(struct work_element *we_p, char *buf)
+z90crypt_process_results(struct work_element *we_p, char __user *buf)
 {
 	int rv;
 
@@ -1556,7 +1557,7 @@ get_crypto_request_buffer(struct work_element *we_p)
 
 static inline int
 z90crypt_prepare(struct work_element *we_p, unsigned int funccode,
-		 const char *buffer)
+		 const char __user *buffer)
 {
 	int rv;
 
@@ -1641,7 +1642,7 @@ z90crypt_rsa(struct priv_data *private_data_p, pid_t pid,
 		PDEBUG("PID %d: allocate_work_element returned ENOMEM\n", pid);
 		return rv;
 	}
-	if ((rv = z90crypt_prepare(we_p, cmd, (const char *)arg)))
+	if ((rv = z90crypt_prepare(we_p, cmd, (const char __user *)arg)))
 		PDEBUG("PID %d: rv = %d from z90crypt_prepare\n", pid, rv);
 	if (!rv)
 		if ((rv = z90crypt_send(we_p, (const char *)arg)))
@@ -1653,7 +1654,7 @@ z90crypt_rsa(struct priv_data *private_data_p, pid_t pid,
 		rv = we_p->retcode;
 	}
 	if (!rv)
-		rv = z90crypt_process_results(we_p, (char *)arg);
+		rv = z90crypt_process_results(we_p, (char __user *)arg);
 
 	if ((we_p->status[0] & STAT_FAILED)) {
 		switch (rv) {
@@ -1748,49 +1749,49 @@ z90crypt_ioctl(struct inode *inode, struct file *filp,
 
 	case Z90STAT_TOTALCOUNT:
 		tempstat = get_status_totalcount();
-		if (copy_to_user((int *)arg, &tempstat,sizeof(int)) != 0)
+		if (copy_to_user((int __user *)arg, &tempstat,sizeof(int)) != 0)
 			ret = -EFAULT;
 		break;
 
 	case Z90STAT_PCICACOUNT:
 		tempstat = get_status_PCICAcount();
-		if (copy_to_user((int *)arg, &tempstat, sizeof(int)) != 0)
+		if (copy_to_user((int __user *)arg, &tempstat, sizeof(int)) != 0)
 			ret = -EFAULT;
 		break;
 
 	case Z90STAT_PCICCCOUNT:
 		tempstat = get_status_PCICCcount();
-		if (copy_to_user((int *)arg, &tempstat, sizeof(int)) != 0)
+		if (copy_to_user((int __user *)arg, &tempstat, sizeof(int)) != 0)
 			ret = -EFAULT;
 		break;
 
 	case Z90STAT_PCIXCCCOUNT:
 		tempstat = get_status_PCIXCCcount();
-		if (copy_to_user((int *)arg, &tempstat, sizeof(int)) != 0)
+		if (copy_to_user((int __user *)arg, &tempstat, sizeof(int)) != 0)
 			ret = -EFAULT;
 		break;
 
 	case Z90STAT_REQUESTQ_COUNT:
 		tempstat = get_status_requestq_count();
-		if (copy_to_user((int *)arg, &tempstat, sizeof(int)) != 0)
+		if (copy_to_user((int __user *)arg, &tempstat, sizeof(int)) != 0)
 			ret = -EFAULT;
 		break;
 
 	case Z90STAT_PENDINGQ_COUNT:
 		tempstat = get_status_pendingq_count();
-		if (copy_to_user((int *)arg, &tempstat, sizeof(int)) != 0)
+		if (copy_to_user((int __user *)arg, &tempstat, sizeof(int)) != 0)
 			ret = -EFAULT;
 		break;
 
 	case Z90STAT_TOTALOPEN_COUNT:
 		tempstat = get_status_totalopen_count();
-		if (copy_to_user((int *)arg, &tempstat, sizeof(int)) != 0)
+		if (copy_to_user((int __user *)arg, &tempstat, sizeof(int)) != 0)
 			ret = -EFAULT;
 		break;
 
 	case Z90STAT_DOMAIN_INDEX:
 		tempstat = get_status_domain_index();
-		if (copy_to_user((int *)arg, &tempstat, sizeof(int)) != 0)
+		if (copy_to_user((int __user *)arg, &tempstat, sizeof(int)) != 0)
 			ret = -EFAULT;
 		break;
 
@@ -1802,7 +1803,8 @@ z90crypt_ioctl(struct inode *inode, struct file *filp,
 			break;
 		}
 		get_status_status_mask(status);
-		if (copy_to_user((char *) arg, status, Z90CRYPT_NUM_APS) != 0)
+		if (copy_to_user((char __user *) arg, status, Z90CRYPT_NUM_APS)
+									!= 0)
 			ret = -EFAULT;
 		kfree(status);
 		break;
@@ -1815,7 +1817,7 @@ z90crypt_ioctl(struct inode *inode, struct file *filp,
 			break;
 		}
 		get_status_qdepth_mask(qdepth);
-		if (copy_to_user((char *) arg, qdepth, Z90CRYPT_NUM_APS) != 0)
+		if (copy_to_user((char __user *) arg, qdepth, Z90CRYPT_NUM_APS) != 0)
 			ret = -EFAULT;
 		kfree(qdepth);
 		break;
@@ -1828,7 +1830,7 @@ z90crypt_ioctl(struct inode *inode, struct file *filp,
 			break;
 		}
 		get_status_perdevice_reqcnt(reqcnt);
-		if (copy_to_user((char *) arg, reqcnt,
+		if (copy_to_user((char __user *) arg, reqcnt,
 				 Z90CRYPT_NUM_APS * sizeof(int)) != 0)
 			ret = -EFAULT;
 		kfree(reqcnt);
@@ -1861,7 +1863,7 @@ z90crypt_ioctl(struct inode *inode, struct file *filp,
 		get_status_status_mask(pstat->status);
 		get_status_qdepth_mask(pstat->qdepth);
 
-		if (copy_to_user((struct ica_z90_status *) arg, pstat,
+		if (copy_to_user((struct ica_z90_status __user *) arg, pstat,
 				 sizeof(struct ica_z90_status)) != 0)
 			ret = -EFAULT;
 		kfree(pstat);
@@ -2104,7 +2106,7 @@ scan_string(unsigned char *bf, unsigned int len,
 }
 
 static int
-z90crypt_status_write(struct file *file, const char *buffer,
+z90crypt_status_write(struct file *file, const char __user *buffer,
 		      unsigned long count, void *data)
 {
 	int i, j, len, offs, found, eof;
@@ -2209,7 +2211,7 @@ z90crypt_status_write(struct file *file, const char *buffer,
  */
 static inline int
 receive_from_crypto_device(int index, unsigned char *psmid, int *buff_len_p,
-			   unsigned char *buff, unsigned char **dest_p_p)
+			   unsigned char *buff, unsigned char __user **dest_p_p)
 {
 	int dv, rv;
 	struct device *dev_ptr;
@@ -2397,7 +2399,7 @@ helper_send_work(int index)
 static inline void
 helper_handle_work_element(int index, unsigned char psmid[8], int rc,
 			   int buff_len, unsigned char *buff,
-			   unsigned char *resp_addr)
+			   unsigned char __user *resp_addr)
 {
 	struct work_element *pq_p;
 	struct list_head *lptr, *tptr;
@@ -2502,7 +2504,8 @@ static void
 z90crypt_reader_task(unsigned long ptr)
 {
 	int workavail, remaining, index, rc, buff_len;
-	unsigned char	psmid[8], *resp_addr;
+	unsigned char	psmid[8];
+	unsigned char __user *resp_addr;
 	static unsigned char buff[1024];
 
 	PDEBUG("jiffies %ld\n", jiffies);

drivers/s390/net/ctctty.c

@@ -515,7 +515,8 @@ ctc_tty_write(struct tty_struct *tty, int from_user, const u_char * buf, int cou
 		}
 		skb_reserve(skb, skb_res);
 		if (from_user)
-			copy_from_user(skb_put(skb, c), buf, c);
+			copy_from_user(skb_put(skb, c),
+					(const u_char __user *)buf, c);
 		else
 			memcpy(skb_put(skb, c), buf, c);
 		skb_queue_tail(&info->tx_queue, skb);
@@ -640,7 +641,7 @@ ctc_tty_unthrottle(struct tty_struct *tty)
  *          allows RS485 driver to be written in user space.
  */
 static int
-ctc_tty_get_lsr_info(ctc_tty_info * info, uint * value)
+ctc_tty_get_lsr_info(ctc_tty_info * info, uint __user *value)
 {
 	u_char status;
 	uint result;
@@ -650,7 +651,7 @@ ctc_tty_get_lsr_info(ctc_tty_info * info, uint * value)
 	status = info->lsr;
 	spin_unlock_irqrestore(&ctc_tty_lock, flags);
 	result = ((status & UART_LSR_TEMT) ? TIOCSER_TEMT : 0);
-	put_user(result, (uint *) value);
+	put_user(result, value);
 	return 0;
 }
 
@@ -743,14 +744,14 @@ ctc_tty_ioctl(struct tty_struct *tty, struct file *file,
 			printk(KERN_DEBUG "%s%d ioctl TIOCGSOFTCAR\n", CTC_TTY_NAME,
 			       info->line);
 #endif
-			error = put_user(C_CLOCAL(tty) ? 1 : 0, (ulong *) arg);
+			error = put_user(C_CLOCAL(tty) ? 1 : 0, (ulong __user *) arg);
 			return error;
 		case TIOCSSOFTCAR:
 #ifdef CTC_DEBUG_MODEM_IOCTL
 			printk(KERN_DEBUG "%s%d ioctl TIOCSSOFTCAR\n", CTC_TTY_NAME,
 			       info->line);
 #endif
-			error = get_user(arg, (ulong *) arg);
+			error = get_user(arg, (ulong __user *) arg);
 			if (error)
 				return error;
 			tty->termios->c_cflag =
@@ -762,11 +763,11 @@ ctc_tty_ioctl(struct tty_struct *tty, struct file *file,
 			printk(KERN_DEBUG "%s%d ioctl TIOCSERGETLSR\n", CTC_TTY_NAME,
 			       info->line);
 #endif
-			error = verify_area(VERIFY_WRITE, (void *) arg, sizeof(uint));
+			error = verify_area(VERIFY_WRITE, (void __user *) arg, sizeof(uint));
 			if (error)
 				return error;
 			else
-				return ctc_tty_get_lsr_info(info, (uint *) arg);
+				return ctc_tty_get_lsr_info(info, (uint __user *) arg);
 		default:
 #ifdef CTC_DEBUG_MODEM_IOCTL
 			printk(KERN_DEBUG "UNKNOWN ioctl 0x%08x on %s%d\n", cmd,