Add user pointer annotations.

arch/i386/kernel/irq.c

@@ -828,7 +828,7 @@ static struct proc_dir_entry * irq_dir [NR_IRQS];
 
 #define HEX_DIGITS 8
 
-static unsigned int parse_hex_value (const char *buffer,
+static unsigned int parse_hex_value (const char __user *buffer,
 		unsigned long count, unsigned long *ret)
 {
 	unsigned char hexnum [HEX_DIGITS];
@@ -878,7 +878,7 @@ static int irq_affinity_read_proc (char *page, char **start, off_t off,
 	return sprintf (page, "%08lx\n", irq_affinity[(long)data]);
 }
 
-static int irq_affinity_write_proc (struct file *file, const char *buffer,
+static int irq_affinity_write_proc (struct file *file, const char __user *buffer,
 					unsigned long count, void *data)
 {
 	int irq = (long) data, full_count = count, err;
@@ -914,7 +914,7 @@ static int prof_cpu_mask_read_proc (char *page, char **start, off_t off,
 	return sprintf (page, "%08lx\n", *mask);
 }
 
-static int prof_cpu_mask_write_proc (struct file *file, const char *buffer,
+static int prof_cpu_mask_write_proc (struct file *file, const char __user *buffer,
 					unsigned long count, void *data)
 {
 	unsigned long *mask = (unsigned long *) data, full_count = count, err;

arch/i386/kernel/ptrace.c

@@ -155,7 +155,7 @@ void ptrace_disable(struct task_struct *child)
  */
 static int
 ptrace_get_thread_area(struct task_struct *child,
-		       int idx, struct user_desc *user_desc)
+		       int idx, struct user_desc __user *user_desc)
 {
 	struct user_desc info;
 	struct desc_struct *desc;
@@ -206,7 +206,7 @@ ptrace_get_thread_area(struct task_struct *child,
  */
 static int
 ptrace_set_thread_area(struct task_struct *child,
-		       int idx, struct user_desc *user_desc)
+		       int idx, struct user_desc __user *user_desc)
 {
 	struct user_desc info;
 	struct desc_struct *desc;
@@ -458,7 +458,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
 		ret = 0;
 		if (!child->used_math)
 			init_fpu(child);
-		get_fpregs((struct user_i387_struct *)data, child);
+		get_fpregs((struct user_i387_struct __user *)data, child);
 		break;
 	}
 
@@ -469,7 +469,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
 			break;
 		}
 		child->used_math = 1;
-		set_fpregs(child, (struct user_i387_struct *)data);
+		set_fpregs(child, (struct user_i387_struct __user *)data);
 		ret = 0;
 		break;
 	}
@@ -482,7 +482,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
 		}
 		if (!child->used_math)
 			init_fpu(child);
-		ret = get_fpxregs((struct user_fxsr_struct *)data, child);
+		ret = get_fpxregs((struct user_fxsr_struct __user *)data, child);
 		break;
 	}
 
@@ -493,18 +493,18 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
 			break;
 		}
 		child->used_math = 1;
-		ret = set_fpxregs(child, (struct user_fxsr_struct *)data);
+		ret = set_fpxregs(child, (struct user_fxsr_struct __user *)data);
 		break;
 	}
 
 	case PTRACE_GET_THREAD_AREA:
 		ret = ptrace_get_thread_area(child,
-					     addr, (struct user_desc *) data);
+					     addr, (struct user_desc __user *) data);
 		break;
 
 	case PTRACE_SET_THREAD_AREA:
 		ret = ptrace_set_thread_area(child,
-					     addr, (struct user_desc *) data);
+					     addr, (struct user_desc __user *) data);
 		break;
 
 	default:

include/linux/proc_fs.h

@@ -48,7 +48,7 @@ enum {
 
 typedef	int (read_proc_t)(char *page, char **start, off_t off,
 			  int count, int *eof, void *data);
-typedef	int (write_proc_t)(struct file *file, const char *buffer,
+typedef	int (write_proc_t)(struct file *file, const char __user *buffer,
 			   unsigned long count, void *data);
 typedef int (get_info_t)(char *, char **, off_t, int);
 

include/linux/seq_file.h

@@ -29,7 +29,7 @@ struct seq_operations {
 };
 
 int seq_open(struct file *, struct seq_operations *);
-ssize_t seq_read(struct file *, char *, size_t, loff_t *);
+ssize_t seq_read(struct file *, char __user *, size_t, loff_t *);
 loff_t seq_lseek(struct file *, loff_t, int);
 int seq_release(struct inode *, struct file *);
 int seq_escape(struct seq_file *, const char *, const char *);

mm/slab.c

@@ -2448,7 +2448,7 @@ struct seq_operations slabinfo_op = {
  * @count: data len
  * @data: unused
  */
-ssize_t slabinfo_write(struct file *file, const char *buffer,
+ssize_t slabinfo_write(struct file *file, const char __user *buffer,
 				size_t count, loff_t *ppos)
 {
 	char kbuf[MAX_SLABINFO_WRITE+1], *tmp;