Merge ppc970.osdl.org:/home/torvalds/v2.6/v2.6.7

into ppc970.osdl.org:/home/torvalds/v2.6/linux

arch/x86_64/Makefile

@@ -37,6 +37,8 @@ LDFLAGS		:= -m elf_x86_64
 OBJCOPYFLAGS	:= -O binary -R .note -R .comment -S
 LDFLAGS_vmlinux := -e stext
 
+CHECK           := $(CHECK) -D__x86_64__=1
+
 cflags-$(CONFIG_MK8) += $(call check_gcc,-march=k8,)
 cflags-$(CONFIG_MPSC) += $(call check_gcc,-march=nocona,)
 CFLAGS += $(cflags-y)

drivers/char/applicom.c

@@ -105,8 +105,8 @@ static unsigned int WriteErrorCount;	/* number of write error      */
 static unsigned int ReadErrorCount;	/* number of read error       */
 static unsigned int DeviceErrorCount;	/* number of device error     */
 
-static ssize_t ac_read (struct file *, char *, size_t, loff_t *);
-static ssize_t ac_write (struct file *, const char *, size_t, loff_t *);
+static ssize_t ac_read (struct file *, char __user *, size_t, loff_t *);
+static ssize_t ac_write (struct file *, const char __user *, size_t, loff_t *);
 static int ac_ioctl(struct inode *, struct file *, unsigned int,
 		    unsigned long);
 static irqreturn_t ac_interrupt(int, void *, struct pt_regs *);
@@ -343,7 +343,7 @@ int __init applicom_init(void)
 __initcall(applicom_init);
 #endif
 
-static ssize_t ac_write(struct file *file, const char *buf, size_t count, loff_t * ppos)
+static ssize_t ac_write(struct file *file, const char __user *buf, size_t count, loff_t * ppos)
 {
 	unsigned int NumCard;	/* Board number 1 -> 8           */
 	unsigned int IndexCard;	/* Index board number 0 -> 7     */
@@ -467,7 +467,7 @@ static ssize_t ac_write(struct file *file, const char *buf, size_t count, loff_t
 	return 0;
 }
 
-static int do_ac_read(int IndexCard, char *buf,
+static int do_ac_read(int IndexCard, char __user *buf,
 		struct st_ram_io *st_loc, struct mailbox *mailbox)
 {
 	unsigned long from = (unsigned long)apbs[IndexCard].RamIO + RAM_TO_PC;
@@ -521,7 +521,7 @@ static int do_ac_read(int IndexCard, char *buf,
 	return (sizeof(struct st_ram_io) + sizeof(struct mailbox));
 }
 
-static ssize_t ac_read (struct file *filp, char *buf, size_t count, loff_t *ptr)
+static ssize_t ac_read (struct file *filp, char __user *buf, size_t count, loff_t *ptr)
 {
 	unsigned long flags;
 	unsigned int i;
@@ -689,6 +689,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
 	int ret = 0;
 	volatile unsigned char byte_reset_it;
 	struct st_ram_io *adgl;
+	void __user *argp = (void __user *)arg;
 
 	/* In general, the device is only openable by root anyway, so we're not
 	   particularly concerned that bogus ioctls can flood the console. */
@@ -697,7 +698,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
 	if (!adgl)
 		return -ENOMEM;
 
-	if (copy_from_user(adgl, (void *)arg,sizeof(struct st_ram_io))) {
+	if (copy_from_user(adgl, argp, sizeof(struct st_ram_io))) {
 		kfree(adgl);
 		return -EFAULT;
 	}
@@ -721,7 +722,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
 		pmem = apbs[IndexCard].RamIO;
 		for (i = 0; i < sizeof(struct st_ram_io); i++)
 			((unsigned char *)adgl)[i]=readb(pmem++);
-		if (copy_to_user((void *)arg, adgl, sizeof(struct st_ram_io)))
+		if (copy_to_user(argp, adgl, sizeof(struct st_ram_io)))
 			ret = -EFAULT;
 		break;
 	case 1:
@@ -742,7 +743,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
 			(readb(apbs[IndexCard].RamIO + SERIAL_NUMBER + 1) << 8) + 
 			(readb(apbs[IndexCard].RamIO + SERIAL_NUMBER + 2) );
 
-		if (copy_to_user((void *)arg, adgl, sizeof(struct st_ram_io)))
+		if (copy_to_user(argp, adgl, sizeof(struct st_ram_io)))
 			ret = -EFAULT;
 		break;
 	case 2:
@@ -768,7 +769,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
 		pmem = apbs[IndexCard].RamIO + TIC_OWNER_TO_PC;
 		adgl->tic_owner_to_pc     = readb(pmem++);
 		adgl->numcard_owner_to_pc = readb(pmem);
-		if (copy_to_user((void *)arg, adgl,sizeof(struct st_ram_io)))
+		if (copy_to_user(argp, adgl,sizeof(struct st_ram_io)))
 			ret = -EFAULT;
 		break;
 	case 5:

drivers/char/cyclades.c

@@ -676,8 +676,6 @@ static char rcsid[] =
 #include <linux/stat.h>
 #include <linux/proc_fs.h>
 
-#define cy_put_user	put_user
-
 static void cy_throttle (struct tty_struct *tty);
 static void cy_send_xchar (struct tty_struct *tty, char ch);
 
@@ -3536,7 +3534,7 @@ set_line_char(struct cyclades_port * info)
 
 static int
 get_serial_info(struct cyclades_port * info,
-                           struct serial_struct * retinfo)
+                           struct serial_struct __user * retinfo)
 {
   struct serial_struct tmp;
   struct cyclades_card *cinfo = &cy_card[info->card];
@@ -3559,7 +3557,7 @@ get_serial_info(struct cyclades_port * info,
 
 static int
 set_serial_info(struct cyclades_port * info,
-                           struct serial_struct * new_info)
+                           struct serial_struct __user * new_info)
 {
   struct serial_struct new_serial;
   struct cyclades_port old_info;
@@ -3613,7 +3611,7 @@ set_serial_info(struct cyclades_port * info,
  *	    transmit holding register is empty.  This functionality
  *	    allows an RS485 driver to be written in user space.
  */
-static int get_lsr_info(struct cyclades_port *info, unsigned int *value)
+static int get_lsr_info(struct cyclades_port *info, unsigned int __user *value)
 {
     int card, chip, channel, index;
     unsigned char status;
@@ -3638,7 +3636,7 @@ static int get_lsr_info(struct cyclades_port *info, unsigned int *value)
 	/* Not supported yet */
 	return -EINVAL;
     }
-    return cy_put_user(result, (unsigned long *) value);
+    return put_user(result, (unsigned long __user *) value);
 }
 
 static int
@@ -3916,7 +3914,7 @@ cy_break(struct tty_struct *tty, int break_state)
 } /* cy_break */
 
 static int
-get_mon_info(struct cyclades_port * info, struct cyclades_monitor * mon)
+get_mon_info(struct cyclades_port * info, struct cyclades_monitor __user * mon)
 {
 
     if(copy_to_user(mon, &info->mon, sizeof(struct cyclades_monitor)))
@@ -3961,7 +3959,7 @@ set_threshold(struct cyclades_port * info, unsigned long value)
 
 
 static int
-get_threshold(struct cyclades_port * info, unsigned long *value)
+get_threshold(struct cyclades_port * info, unsigned long __user *value)
 {
   unsigned char *base_addr;
   int card,channel,chip,index;
@@ -3978,7 +3976,7 @@ get_threshold(struct cyclades_port * info, unsigned long *value)
 		       + (cy_chip_offset[chip]<<index));
 
 	tmp = cy_readb(base_addr+(CyCOR3<<index)) & CyREC_FIFO;
-	return cy_put_user(tmp,value);
+	return put_user(tmp,value);
     } else {
 	// Nothing to do!
 	return 0;
@@ -3995,9 +3993,9 @@ set_default_threshold(struct cyclades_port * info, unsigned long value)
 
 
 static int
-get_default_threshold(struct cyclades_port * info, unsigned long *value)
+get_default_threshold(struct cyclades_port * info, unsigned long __user *value)
 {
-    return cy_put_user(info->default_threshold,value);
+    return put_user(info->default_threshold,value);
 }/* get_default_threshold */
 
 
@@ -4029,7 +4027,7 @@ set_timeout(struct cyclades_port * info, unsigned long value)
 
 
 static int
-get_timeout(struct cyclades_port * info, unsigned long *value)
+get_timeout(struct cyclades_port * info, unsigned long __user *value)
 {
   unsigned char *base_addr;
   int card,channel,chip,index;
@@ -4046,7 +4044,7 @@ get_timeout(struct cyclades_port * info, unsigned long *value)
 		       + (cy_chip_offset[chip]<<index));
 
 	tmp = cy_readb(base_addr+(CyRTPR<<index));
-	return cy_put_user(tmp,value);
+	return put_user(tmp,value);
     } else {
 	// Nothing to do!
 	return 0;
@@ -4063,9 +4061,9 @@ set_default_timeout(struct cyclades_port * info, unsigned long value)
 
 
 static int
-get_default_timeout(struct cyclades_port * info, unsigned long *value)
+get_default_timeout(struct cyclades_port * info, unsigned long __user *value)
 {
-    return cy_put_user(info->default_timeout,value);
+    return put_user(info->default_timeout,value);
 }/* get_default_timeout */
 
 /*
@@ -4079,9 +4077,10 @@ cy_ioctl(struct tty_struct *tty, struct file * file,
 {
   struct cyclades_port * info = (struct cyclades_port *)tty->driver_data;
   struct cyclades_icount cprev, cnow;		/* kernel counter temps */
-  struct serial_icounter_struct *p_cuser;	/* user space */
+  struct serial_icounter_struct __user *p_cuser;	/* user space */
   int ret_val = 0;
   unsigned long flags;
+  void __user *argp = (void __user *)arg;
 
     if (serial_paranoia_check(info, tty->name, "cy_ioctl"))
 	return -ENODEV;
@@ -4093,31 +4092,31 @@ cy_ioctl(struct tty_struct *tty, struct file * file,
 
     switch (cmd) {
         case CYGETMON:
-            ret_val = get_mon_info(info, (struct cyclades_monitor *)arg);
+            ret_val = get_mon_info(info, argp);
             break;
         case CYGETTHRESH:
-            ret_val = get_threshold(info, (unsigned long *)arg);
+            ret_val = get_threshold(info, argp);
             break;
         case CYSETTHRESH:
-            ret_val = set_threshold(info, (unsigned long)arg);
+            ret_val = set_threshold(info, arg);
             break;
         case CYGETDEFTHRESH:
-            ret_val = get_default_threshold(info, (unsigned long *)arg);
+            ret_val = get_default_threshold(info, argp);
             break;
         case CYSETDEFTHRESH:
-            ret_val = set_default_threshold(info, (unsigned long)arg);
+            ret_val = set_default_threshold(info, arg);
             break;
         case CYGETTIMEOUT:
-            ret_val = get_timeout(info, (unsigned long *)arg);
+            ret_val = get_timeout(info, argp);
             break;
         case CYSETTIMEOUT:
-            ret_val = set_timeout(info, (unsigned long)arg);
+            ret_val = set_timeout(info, arg);
             break;
         case CYGETDEFTIMEOUT:
-            ret_val = get_default_timeout(info, (unsigned long *)arg);
+            ret_val = get_default_timeout(info, argp);
             break;
         case CYSETDEFTIMEOUT:
-            ret_val = set_default_timeout(info, (unsigned long)arg);
+            ret_val = set_default_timeout(info, arg);
             break;
 	case CYSETRFLOW:
     	    info->rflow = (int)arg;
@@ -4134,7 +4133,7 @@ cy_ioctl(struct tty_struct *tty, struct file * file,
 	    ret_val = info->rtsdtr_inv;
 	    break;
 	case CYGETCARDINFO:
-            if (copy_to_user((void *)arg, (void *)&cy_card[info->card], 
+            if (copy_to_user(argp, &cy_card[info->card], 
 			sizeof (struct cyclades_card))) {
 		ret_val = -EFAULT;
 		break;
@@ -4161,13 +4160,13 @@ cy_ioctl(struct tty_struct *tty, struct file * file,
 	    ret_val = info->closing_wait / (HZ/100);
 	    break;
         case TIOCGSERIAL:
-            ret_val = get_serial_info(info, (struct serial_struct *) arg);
+            ret_val = get_serial_info(info, argp);
             break;
         case TIOCSSERIAL:
-            ret_val = set_serial_info(info, (struct serial_struct *) arg);
+            ret_val = set_serial_info(info, argp);
             break;
 	case TIOCSERGETLSR: /* Get line status register */
-	    ret_val = get_lsr_info(info, (unsigned int *) arg);
+	    ret_val = get_lsr_info(info, argp);
 	    break;
 	/*
 	 * Wait for any of the 4 modem inputs (DCD,RI,DSR,CTS) to change 
@@ -4215,7 +4214,7 @@ cy_ioctl(struct tty_struct *tty, struct file * file,
 	    CY_LOCK(info, flags);
 	    cnow = info->icount;
 	    CY_UNLOCK(info, flags);
-	    p_cuser = (struct serial_icounter_struct *) arg;
+	    p_cuser = argp;
 	    ret_val = put_user(cnow.cts, &p_cuser->cts);
 	    if (ret_val) return ret_val;
 	    ret_val = put_user(cnow.dsr, &p_cuser->dsr);

drivers/char/ipmi/ipmi_devintf.c

@@ -231,6 +231,7 @@ static int ipmi_ioctl(struct inode  *inode,
 {
 	int                      rv = -EINVAL;
 	struct ipmi_file_private *priv = file->private_data;
+	void __user *arg = (void __user *)data;
 
 	switch (cmd) 
 	{
@@ -238,7 +239,7 @@ static int ipmi_ioctl(struct inode  *inode,
 	{
 		struct ipmi_req req;
 
-		if (copy_from_user(&req, (void *) data, sizeof(req))) {
+		if (copy_from_user(&req, arg, sizeof(req))) {
 			rv = -EFAULT;
 			break;
 		}
@@ -254,7 +255,7 @@ static int ipmi_ioctl(struct inode  *inode,
 	{
 		struct ipmi_req_settime req;
 
-		if (copy_from_user(&req, (void *) data, sizeof(req))) {
+		if (copy_from_user(&req, arg, sizeof(req))) {
 			rv = -EFAULT;
 			break;
 		}
@@ -277,7 +278,7 @@ static int ipmi_ioctl(struct inode  *inode,
 		
 
 		rv = 0;
-		if (copy_from_user(&rsp, (void *) data, sizeof(rsp))) {
+		if (copy_from_user(&rsp, arg, sizeof(rsp))) {
 			rv = -EFAULT;
 			break;
 		}
@@ -344,7 +345,7 @@ static int ipmi_ioctl(struct inode  *inode,
 			rsp.msg.data_len = 0;
 		}
 
-		if (copy_to_user((void *) data, &rsp, sizeof(rsp))) {
+		if (copy_to_user(arg, &rsp, sizeof(rsp))) {
 			rv = -EFAULT;
 			goto recv_putback_on_err;
 		}
@@ -371,7 +372,7 @@ static int ipmi_ioctl(struct inode  *inode,
 	{
 		struct ipmi_cmdspec val;
 
-		if (copy_from_user(&val, (void *) data, sizeof(val))) {
+		if (copy_from_user(&val, arg, sizeof(val))) {
 			rv = -EFAULT;
 			break;
 		}
@@ -384,7 +385,7 @@ static int ipmi_ioctl(struct inode  *inode,
 	{
 		struct ipmi_cmdspec   val;
 
-		if (copy_from_user(&val, (void *) data, sizeof(val))) {
+		if (copy_from_user(&val, arg, sizeof(val))) {
 			rv = -EFAULT;
 			break;
 		}
@@ -397,7 +398,7 @@ static int ipmi_ioctl(struct inode  *inode,
 	{
 		int val;
 
-		if (copy_from_user(&val, (void *) data, sizeof(val))) {
+		if (copy_from_user(&val, arg, sizeof(val))) {
 			rv = -EFAULT;
 			break;
 		}
@@ -410,7 +411,7 @@ static int ipmi_ioctl(struct inode  *inode,
 	{
 		unsigned int val;
 
-		if (copy_from_user(&val, (void *) data, sizeof(val))) {
+		if (copy_from_user(&val, arg, sizeof(val))) {
 			rv = -EFAULT;
 			break;
 		}
@@ -426,7 +427,7 @@ static int ipmi_ioctl(struct inode  *inode,
 
 		val = ipmi_get_my_address(priv->user);
 
-		if (copy_to_user((void *) data, &val, sizeof(val))) {
+		if (copy_to_user(arg, &val, sizeof(val))) {
 			rv = -EFAULT;
 			break;
 		}
@@ -438,7 +439,7 @@ static int ipmi_ioctl(struct inode  *inode,
 	{
 		unsigned int val;
 
-		if (copy_from_user(&val, (void *) data, sizeof(val))) {
+		if (copy_from_user(&val, arg, sizeof(val))) {
 			rv = -EFAULT;
 			break;
 		}
@@ -454,7 +455,7 @@ static int ipmi_ioctl(struct inode  *inode,
 
 		val = ipmi_get_my_LUN(priv->user);
 
-		if (copy_to_user((void *) data, &val, sizeof(val))) {
+		if (copy_to_user(arg, &val, sizeof(val))) {
 			rv = -EFAULT;
 			break;
 		}
@@ -465,7 +466,7 @@ static int ipmi_ioctl(struct inode  *inode,
 	{
 		struct ipmi_timing_parms parms;
 
-		if (copy_from_user(&parms, (void *) data, sizeof(parms))) {
+		if (copy_from_user(&parms, arg, sizeof(parms))) {
 			rv = -EFAULT;
 			break;
 		}
@@ -483,7 +484,7 @@ static int ipmi_ioctl(struct inode  *inode,
 		parms.retries = priv->default_retries;
 		parms.retry_time_ms = priv->default_retry_time_ms;
 
-		if (copy_to_user((void *) data, &parms, sizeof(parms))) {
+		if (copy_to_user(arg, &parms, sizeof(parms))) {
 			rv = -EFAULT;
 			break;
 		}

drivers/char/ipmi/ipmi_watchdog.c

@@ -515,40 +515,37 @@ static struct watchdog_info ident=
 static int ipmi_ioctl(struct inode *inode, struct file *file,
 		      unsigned int cmd, unsigned long arg)
 {
+	void __user *argp = (void __user *)arg;
 	int i;
 	int val;
 
 	switch(cmd) {
 	case WDIOC_GETSUPPORT:
-		i = copy_to_user((void*)arg, &ident, sizeof(ident));
+		i = copy_to_user(argp, &ident, sizeof(ident));
 		return i ? -EFAULT : 0;
 
 	case WDIOC_SETTIMEOUT:
-		i = copy_from_user(&val, (void *) arg, sizeof(int));
+		i = copy_from_user(&val, argp, sizeof(int));
 		if (i)
 			return -EFAULT;
 		timeout = val;
 		return ipmi_set_timeout(IPMI_SET_TIMEOUT_HB_IF_NECESSARY);
 
 	case WDIOC_GETTIMEOUT:
-		i = copy_to_user((void *) arg,
-				 &timeout,
-				 sizeof(timeout));
+		i = copy_to_user(argp, &timeout, sizeof(timeout));
 		if (i)
 			return -EFAULT;
 		return 0;
 
 	case WDIOC_SET_PRETIMEOUT:
-		i = copy_from_user(&val, (void *) arg, sizeof(int));
+		i = copy_from_user(&val, argp, sizeof(int));
 		if (i)
 			return -EFAULT;
 		pretimeout = val;
 		return ipmi_set_timeout(IPMI_SET_TIMEOUT_HB_IF_NECESSARY);
 
 	case WDIOC_GET_PRETIMEOUT:
-		i = copy_to_user((void *) arg,
-				 &pretimeout,
-				 sizeof(pretimeout));
+		i = copy_to_user(argp, &pretimeout, sizeof(pretimeout));
 		if (i)
 			return -EFAULT;
 		return 0;
@@ -557,7 +554,7 @@ static int ipmi_ioctl(struct inode *inode, struct file *file,
 		return ipmi_heartbeat();
 
 	case WDIOC_SETOPTIONS:
-		i = copy_from_user(&val, (void *) arg, sizeof(int));
+		i = copy_from_user(&val, argp, sizeof(int));
 		if (i)
 			return -EFAULT;
 		if (val & WDIOS_DISABLECARD)
@@ -576,7 +573,7 @@ static int ipmi_ioctl(struct inode *inode, struct file *file,
 
 	case WDIOC_GETSTATUS:
 		val = 0;
-		i = copy_to_user((void *) arg, &val, sizeof(val));
+		i = copy_to_user(argp, &val, sizeof(val));
 		if (i)
 			return -EFAULT;
 		return 0;
@@ -587,7 +584,7 @@ static int ipmi_ioctl(struct inode *inode, struct file *file,
 }
 
 static ssize_t ipmi_write(struct file *file,
-			  const char  *buf,
+			  const char  __user *buf,
 			  size_t      len,
 			  loff_t      *ppos)
 {
@@ -607,7 +604,7 @@ static ssize_t ipmi_write(struct file *file,
 }
 
 static ssize_t ipmi_read(struct file *file,
-			 char        *buf,
+			 char        __user *buf,
 			 size_t      count,
 			 loff_t      *ppos)
 {

drivers/char/mwave/3780i.c

@@ -467,10 +467,10 @@ int dsp3780I_Run(DSP_3780I_CONFIG_SETTINGS * pSettings)
 }
 
 
-int dsp3780I_ReadDStore(unsigned short usDspBaseIO, void *pvBuffer,
+int dsp3780I_ReadDStore(unsigned short usDspBaseIO, void __user *pvBuffer,
                         unsigned uCount, unsigned long ulDSPAddr)
 {
-	unsigned short *pusBuffer = pvBuffer;
+	unsigned short __user *pusBuffer = pvBuffer;
 	unsigned short val;
 
 
@@ -508,10 +508,10 @@ int dsp3780I_ReadDStore(unsigned short usDspBaseIO, void *pvBuffer,
 }
 
 int dsp3780I_ReadAndClearDStore(unsigned short usDspBaseIO,
-                                void *pvBuffer, unsigned uCount,
+                                void __user *pvBuffer, unsigned uCount,
                                 unsigned long ulDSPAddr)
 {
-	unsigned short *pusBuffer = pvBuffer;
+	unsigned short __user *pusBuffer = pvBuffer;
 	unsigned short val;
 
 
@@ -549,10 +549,10 @@ int dsp3780I_ReadAndClearDStore(unsigned short usDspBaseIO,
 }
 
 
-int dsp3780I_WriteDStore(unsigned short usDspBaseIO, void *pvBuffer,
+int dsp3780I_WriteDStore(unsigned short usDspBaseIO, void __user *pvBuffer,
                          unsigned uCount, unsigned long ulDSPAddr)
 {
-	unsigned short *pusBuffer = pvBuffer;
+	unsigned short __user *pusBuffer = pvBuffer;
 
 
 	PRINTK_5(TRACE_3780I,
@@ -590,10 +590,10 @@ int dsp3780I_WriteDStore(unsigned short usDspBaseIO, void *pvBuffer,
 }
 
 
-int dsp3780I_ReadIStore(unsigned short usDspBaseIO, void *pvBuffer,
+int dsp3780I_ReadIStore(unsigned short usDspBaseIO, void __user *pvBuffer,
                         unsigned uCount, unsigned long ulDSPAddr)
 {
-	unsigned short *pusBuffer = pvBuffer;
+	unsigned short __user *pusBuffer = pvBuffer;
 
 	PRINTK_5(TRACE_3780I,
 		"3780i::dsp3780I_ReadIStore entry usDspBaseIO %x, pusBuffer %p, uCount %x, ulDSPAddr %lx\n",
@@ -637,10 +637,10 @@ int dsp3780I_ReadIStore(unsigned short usDspBaseIO, void *pvBuffer,
 }
 
 
-int dsp3780I_WriteIStore(unsigned short usDspBaseIO, void *pvBuffer,
+int dsp3780I_WriteIStore(unsigned short usDspBaseIO, void __user *pvBuffer,
                          unsigned uCount, unsigned long ulDSPAddr)
 {
-	unsigned short *pusBuffer = pvBuffer;
+	unsigned short __user *pusBuffer = pvBuffer;
 
 	PRINTK_5(TRACE_3780I,
 		"3780i::dsp3780I_WriteIStore entry usDspBaseIO %x, pusBuffer %p, uCount %x, ulDSPAddr %lx\n",

drivers/char/mwave/3780i.h

@@ -323,16 +323,16 @@ int dsp3780I_EnableDSP(DSP_3780I_CONFIG_SETTINGS * pSettings,
 int dsp3780I_DisableDSP(DSP_3780I_CONFIG_SETTINGS * pSettings);
 int dsp3780I_Reset(DSP_3780I_CONFIG_SETTINGS * pSettings);
 int dsp3780I_Run(DSP_3780I_CONFIG_SETTINGS * pSettings);
-int dsp3780I_ReadDStore(unsigned short usDspBaseIO, void *pvBuffer,
+int dsp3780I_ReadDStore(unsigned short usDspBaseIO, void __user *pvBuffer,
                         unsigned uCount, unsigned long ulDSPAddr);
 int dsp3780I_ReadAndClearDStore(unsigned short usDspBaseIO,
-                                void *pvBuffer, unsigned uCount,
+                                void __user *pvBuffer, unsigned uCount,
                                 unsigned long ulDSPAddr);
-int dsp3780I_WriteDStore(unsigned short usDspBaseIO, void *pvBuffer,
+int dsp3780I_WriteDStore(unsigned short usDspBaseIO, void __user *pvBuffer,
                          unsigned uCount, unsigned long ulDSPAddr);
-int dsp3780I_ReadIStore(unsigned short usDspBaseIO, void *pvBuffer,
+int dsp3780I_ReadIStore(unsigned short usDspBaseIO, void __user *pvBuffer,
                         unsigned uCount, unsigned long ulDSPAddr);
-int dsp3780I_WriteIStore(unsigned short usDspBaseIO, void *pvBuffer,
+int dsp3780I_WriteIStore(unsigned short usDspBaseIO, void __user *pvBuffer,
                          unsigned uCount, unsigned long ulDSPAddr);
 unsigned short dsp3780I_ReadMsaCfg(unsigned short usDspBaseIO,
                                    unsigned long ulMsaAddr);

drivers/char/mwave/mwavedd.c

@@ -121,6 +121,7 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
 {
 	unsigned int retval = 0;
 	pMWAVE_DEVICE_DATA pDrvData = &mwave_s_mdd;
+	void __user *arg = (void __user *)ioarg;
 
 	PRINTK_5(TRACE_MWAVE,
 		"mwavedd::mwave_ioctl, entry inode %x file %x cmd %x arg %x\n",
@@ -164,8 +165,7 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
 				" retval %x from tp3780I_QueryAbilities\n",
 				retval);
 			if (retval == 0) {
-				if( copy_to_user((char *) ioarg,
-							(char *) &rAbilities,
+				if( copy_to_user(arg, &rAbilities,
 							sizeof(MW_ABILITIES)) )
 					return -EFAULT;
 			}
@@ -179,13 +179,12 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
 		case IOCTL_MW_READ_DATA:
 		case IOCTL_MW_READCLEAR_DATA: {
 			MW_READWRITE rReadData;
-			unsigned short *pusBuffer = 0;
+			unsigned short __user *pusBuffer = 0;
 	
-			if( copy_from_user((char *) &rReadData,
-						(char *) ioarg,
+			if( copy_from_user(&rReadData, arg,
 						sizeof(MW_READWRITE)) )
 				return -EFAULT;
-			pusBuffer = (unsigned short *) (rReadData.pBuf);
+			pusBuffer = (unsigned short __user *) (rReadData.pBuf);
 	
 			PRINTK_4(TRACE_MWAVE,
 				"mwavedd::mwave_ioctl IOCTL_MW_READ_DATA,"
@@ -193,7 +192,7 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
 				rReadData.ulDataLength, ioarg, pusBuffer);
 			retval = tp3780I_ReadWriteDspDStore(&pDrvData->rBDData,
 					iocmd,
-					(void *) pusBuffer,
+					pusBuffer,
 					rReadData.ulDataLength,
 					rReadData.usDspAddress);
 		}
@@ -201,12 +200,12 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
 	
 		case IOCTL_MW_READ_INST: {
 			MW_READWRITE rReadData;
-			unsigned short *pusBuffer = 0;
+			unsigned short __user *pusBuffer = 0;
 	
-			if( copy_from_user((char *) &rReadData, (char *) ioarg,
+			if( copy_from_user(&rReadData, arg,
 						sizeof(MW_READWRITE)) )
 				return -EFAULT;
-			pusBuffer = (unsigned short *) (rReadData.pBuf);
+			pusBuffer = (unsigned short __user *) (rReadData.pBuf);
 	
 			PRINTK_4(TRACE_MWAVE,
 				"mwavedd::mwave_ioctl IOCTL_MW_READ_INST,"
@@ -222,13 +221,12 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
 	
 		case IOCTL_MW_WRITE_DATA: {
 			MW_READWRITE rWriteData;
-			unsigned short *pusBuffer = 0;
+			unsigned short __user *pusBuffer = 0;
 	
-			if( copy_from_user((char *) &rWriteData,
-						(char *) ioarg,
+			if( copy_from_user(&rWriteData, arg,
 						sizeof(MW_READWRITE)) )
 				return -EFAULT;
-			pusBuffer = (unsigned short *) (rWriteData.pBuf);
+			pusBuffer = (unsigned short __user *) (rWriteData.pBuf);
 	
 			PRINTK_4(TRACE_MWAVE,
 				"mwavedd::mwave_ioctl IOCTL_MW_WRITE_DATA,"
@@ -244,13 +242,12 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
 	
 		case IOCTL_MW_WRITE_INST: {
 			MW_READWRITE rWriteData;
-			unsigned short *pusBuffer = 0;
+			unsigned short __user *pusBuffer = 0;
 	
-			if( copy_from_user((char *) &rWriteData,
-						(char *) ioarg,
+			if( copy_from_user(&rWriteData, arg,
 						sizeof(MW_READWRITE)) )
 				return -EFAULT;
-			pusBuffer = (unsigned short *) (rWriteData.pBuf);
+			pusBuffer = (unsigned short __user *)(rWriteData.pBuf);
 	
 			PRINTK_4(TRACE_MWAVE,
 				"mwavedd::mwave_ioctl IOCTL_MW_WRITE_INST,"
@@ -388,7 +385,7 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
 }
 
 
-static ssize_t mwave_read(struct file *file, char *buf, size_t count,
+static ssize_t mwave_read(struct file *file, char __user *buf, size_t count,
                           loff_t * ppos)
 {
 	PRINTK_5(TRACE_MWAVE,
@@ -399,7 +396,7 @@ static ssize_t mwave_read(struct file *file, char *buf, size_t count,
 }
 
 
-static ssize_t mwave_write(struct file *file, const char *buf,
+static ssize_t mwave_write(struct file *file, const char __user *buf,
                            size_t count, loff_t * ppos)
 {
 	PRINTK_5(TRACE_MWAVE,

drivers/char/mwave/tp3780i.c

@@ -522,7 +522,7 @@ int tp3780I_QueryAbilities(THINKPAD_BD_DATA * pBDData, MW_ABILITIES * pAbilities
 }
 
 int tp3780I_ReadWriteDspDStore(THINKPAD_BD_DATA * pBDData, unsigned int uOpcode,
-                               void *pvBuffer, unsigned int uCount,
+                               void __user *pvBuffer, unsigned int uCount,
                                unsigned long ulDSPAddr)
 {
 	int retval = 0;
@@ -558,7 +558,7 @@ int tp3780I_ReadWriteDspDStore(THINKPAD_BD_DATA * pBDData, unsigned int uOpcode,
 
 
 int tp3780I_ReadWriteDspIStore(THINKPAD_BD_DATA * pBDData, unsigned int uOpcode,
-                               void *pvBuffer, unsigned int uCount,
+                               void __user *pvBuffer, unsigned int uCount,
                                unsigned long ulDSPAddr)
 {
 	int retval = 0;

drivers/char/mwave/tp3780i.h

@@ -93,10 +93,10 @@ int tp3780I_StartDSP(THINKPAD_BD_DATA * pBDData);
 int tp3780I_QueryAbilities(THINKPAD_BD_DATA * pBDData, MW_ABILITIES * pAbilities);
 int tp3780I_Cleanup(THINKPAD_BD_DATA * pBDData);
 int tp3780I_ReadWriteDspDStore(THINKPAD_BD_DATA * pBDData, unsigned int uOpcode,
-                               void *pvBuffer, unsigned int uCount,
+                               void __user *pvBuffer, unsigned int uCount,
                                unsigned long ulDSPAddr);
 int tp3780I_ReadWriteDspIStore(THINKPAD_BD_DATA * pBDData, unsigned int uOpcode,
-                               void *pvBuffer, unsigned int uCount,
+                               void __user *pvBuffer, unsigned int uCount,
                                unsigned long ulDSPAddr);
 
 

drivers/char/synclinkmp.c

@@ -567,17 +567,17 @@ static struct net_device_stats *sppp_cb_net_stats(struct net_device *dev);
 
 /* ioctl handlers */
 
-static int  get_stats(SLMP_INFO *info, struct mgsl_icount *user_icount);
-static int  get_params(SLMP_INFO *info, MGSL_PARAMS *params);
-static int  set_params(SLMP_INFO *info, MGSL_PARAMS *params);
-static int  get_txidle(SLMP_INFO *info, int*idle_mode);
+static int  get_stats(SLMP_INFO *info, struct mgsl_icount __user *user_icount);
+static int  get_params(SLMP_INFO *info, MGSL_PARAMS __user *params);
+static int  set_params(SLMP_INFO *info, MGSL_PARAMS __user *params);
+static int  get_txidle(SLMP_INFO *info, int __user *idle_mode);
 static int  set_txidle(SLMP_INFO *info, int idle_mode);
 static int  tx_enable(SLMP_INFO *info, int enable);
 static int  tx_abort(SLMP_INFO *info);
 static int  rx_enable(SLMP_INFO *info, int enable);
 static int  map_status(int signals);
 static int  modem_input_wait(SLMP_INFO *info,int arg);
-static int  wait_mgsl_event(SLMP_INFO *info, int *mask_ptr);
+static int  wait_mgsl_event(SLMP_INFO *info, int __user *mask_ptr);
 static int  tiocmget(struct tty_struct *tty, struct file *file);
 static int  tiocmset(struct tty_struct *tty, struct file *file,
 		     unsigned int set, unsigned int clear);
@@ -692,7 +692,7 @@ static u32 sca_pci_load_interval = 64;
  * This allows remote debugging of dynamically loadable modules.
  */
 static void* synclinkmp_get_text_ptr(void);
-static void* synclinkmp_get_text_ptr() {return synclinkmp_get_text_ptr;}
+static void* synclinkmp_get_text_ptr(void) {return synclinkmp_get_text_ptr;}
 
 static inline int sanity_check(SLMP_INFO *info,
 			       char *name, const char *routine)
@@ -1333,8 +1333,9 @@ static int ioctl(struct tty_struct *tty, struct file *file,
 	SLMP_INFO *info = (SLMP_INFO *)tty->driver_data;
 	int error;
 	struct mgsl_icount cnow;	/* kernel counter temps */
-	struct serial_icounter_struct *p_cuser;	/* user space */
+	struct serial_icounter_struct __user *p_cuser;	/* user space */
 	unsigned long flags;
+	void __user *argp = (void __user *)arg;
 
 	if (debug_level >= DEBUG_LEVEL_INFO)
 		printk("%s(%d):%s ioctl() cmd=%08X\n", __FILE__,__LINE__,
@@ -1351,23 +1352,23 @@ static int ioctl(struct tty_struct *tty, struct file *file,
 
 	switch (cmd) {
 	case MGSL_IOCGPARAMS:
-		return get_params(info,(MGSL_PARAMS *)arg);
+		return get_params(info, argp);
 	case MGSL_IOCSPARAMS:
-		return set_params(info,(MGSL_PARAMS *)arg);
+		return set_params(info, argp);
 	case MGSL_IOCGTXIDLE:
-		return get_txidle(info,(int*)arg);
+		return get_txidle(info, argp);
 	case MGSL_IOCSTXIDLE:
-		return set_txidle(info,(int)arg);
+		return set_txidle(info, (int)arg);
 	case MGSL_IOCTXENABLE:
-		return tx_enable(info,(int)arg);
+		return tx_enable(info, (int)arg);
 	case MGSL_IOCRXENABLE:
-		return rx_enable(info,(int)arg);
+		return rx_enable(info, (int)arg);
 	case MGSL_IOCTXABORT:
 		return tx_abort(info);
 	case MGSL_IOCGSTATS:
-		return get_stats(info,(struct mgsl_icount*)arg);
+		return get_stats(info, argp);
 	case MGSL_IOCWAITEVENT:
-		return wait_mgsl_event(info,(int*)arg);
+		return wait_mgsl_event(info, argp);
 	case MGSL_IOCLOOPTXDONE:
 		return 0; // TODO: Not supported, need to document
 		/* Wait for modem input (DCD,RI,DSR,CTS) change
@@ -1386,7 +1387,7 @@ static int ioctl(struct tty_struct *tty, struct file *file,
 		spin_lock_irqsave(&info->lock,flags);
 		cnow = info->icount;
 		spin_unlock_irqrestore(&info->lock,flags);
-		p_cuser = (struct serial_icounter_struct *) arg;
+		p_cuser = argp;
 		PUT_USER(error,cnow.cts, &p_cuser->cts);
 		if (error) return error;
 		PUT_USER(error,cnow.dsr, &p_cuser->dsr);
@@ -2762,7 +2763,7 @@ static void change_params(SLMP_INFO *info)
 	program_hw(info);
 }
 
-static int get_stats(SLMP_INFO * info, struct mgsl_icount *user_icount)
+static int get_stats(SLMP_INFO * info, struct mgsl_icount __user *user_icount)
 {
 	int err;
 
@@ -2781,7 +2782,7 @@ static int get_stats(SLMP_INFO * info, struct mgsl_icount *user_icount)
 	return 0;
 }
 
-static int get_params(SLMP_INFO * info, MGSL_PARAMS *user_params)
+static int get_params(SLMP_INFO * info, MGSL_PARAMS __user *user_params)
 {
 	int err;
 	if (debug_level >= DEBUG_LEVEL_INFO)
@@ -2799,7 +2800,7 @@ static int get_params(SLMP_INFO * info, MGSL_PARAMS *user_params)
 	return 0;
 }
 
-static int set_params(SLMP_INFO * info, MGSL_PARAMS *new_params)
+static int set_params(SLMP_INFO * info, MGSL_PARAMS __user *new_params)
 {
  	unsigned long flags;
 	MGSL_PARAMS tmp_params;
@@ -2825,7 +2826,7 @@ static int set_params(SLMP_INFO * info, MGSL_PARAMS *new_params)
 	return 0;
 }
 
-static int get_txidle(SLMP_INFO * info, int*idle_mode)
+static int get_txidle(SLMP_INFO * info, int __user *idle_mode)
 {
 	int err;
 
@@ -2938,7 +2939,7 @@ static int map_status(int signals)
 
 /* wait for specified event to occur
  */
-static int wait_mgsl_event(SLMP_INFO * info, int * mask_ptr)
+static int wait_mgsl_event(SLMP_INFO * info, int __user *mask_ptr)
 {
  	unsigned long flags;
 	int s;

drivers/video/fbmem.c

@@ -806,7 +806,7 @@ static int fbmem_read_proc(char *buf, char **start, off_t offset,
 }
 
 static ssize_t
-fb_read(struct file *file, char *buf, size_t count, loff_t *ppos)
+fb_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
 	unsigned long p = *ppos;
 	struct inode *inode = file->f_dentry->d_inode;
@@ -843,7 +843,7 @@ fb_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 }
 
 static ssize_t
-fb_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
+fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 {
 	unsigned long p = *ppos;
 	struct inode *inode = file->f_dentry->d_inode;

drivers/video/imsttfb.c

@@ -1267,48 +1267,49 @@ imsttfb_ioctl(struct inode *inode, struct file *file, u_int cmd,
 	      u_long arg, struct fb_info *info)
 {
 	struct imstt_par *par = (struct imstt_par *) info->par;
+	void __user *argp = (void __user *)arg;
 	__u32 reg[2];
 	__u8 idx[2];
 
 	switch (cmd) {
 		case FBIMSTT_SETREG:
-			if (copy_from_user(reg, (void *)arg, 8) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
+			if (copy_from_user(reg, argp, 8) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
 				return -EFAULT;
 			write_reg_le32(par->dc_regs, reg[0], reg[1]);
 			return 0;
 		case FBIMSTT_GETREG:
-			if (copy_from_user(reg, (void *)arg, 4) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
+			if (copy_from_user(reg, argp, 4) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
 				return -EFAULT;
 			reg[1] = read_reg_le32(par->dc_regs, reg[0]);
-			if (copy_to_user((void *)(arg + 4), &reg[1], 4))
+			if (copy_to_user((void __user *)(arg + 4), &reg[1], 4))
 				return -EFAULT;
 			return 0;
 		case FBIMSTT_SETCMAPREG:
-			if (copy_from_user(reg, (void *)arg, 8) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
+			if (copy_from_user(reg, argp, 8) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
 				return -EFAULT;
 			write_reg_le32(((u_int *)par->cmap_regs), reg[0], reg[1]);
 			return 0;
 		case FBIMSTT_GETCMAPREG:
-			if (copy_from_user(reg, (void *)arg, 4) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
+			if (copy_from_user(reg, argp, 4) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
 				return -EFAULT;
 			reg[1] = read_reg_le32(((u_int *)par->cmap_regs), reg[0]);
-			if (copy_to_user((void *)(arg + 4), &reg[1], 4))
+			if (copy_to_user((void __user *)(arg + 4), &reg[1], 4))
 				return -EFAULT;
 			return 0;
 		case FBIMSTT_SETIDXREG:
-			if (copy_from_user(idx, (void *)arg, 2))
+			if (copy_from_user(idx, argp, 2))
 				return -EFAULT;
 			par->cmap_regs[PIDXHI] = 0;		eieio();
 			par->cmap_regs[PIDXLO] = idx[0];	eieio();
 			par->cmap_regs[PIDXDATA] = idx[1];	eieio();
 			return 0;
 		case FBIMSTT_GETIDXREG:
-			if (copy_from_user(idx, (void *)arg, 1))
+			if (copy_from_user(idx, argp, 1))
 				return -EFAULT;
 			par->cmap_regs[PIDXHI] = 0;		eieio();
 			par->cmap_regs[PIDXLO] = idx[0];	eieio();
 			idx[1] = par->cmap_regs[PIDXDATA];
-			if (copy_to_user((void *)(arg + 1), &idx[1], 1))
+			if (copy_to_user((void __user *)(arg + 1), &idx[1], 1))
 				return -EFAULT;
 			return 0;
 		default:

drivers/video/kyro/fbdev.c

@@ -592,11 +592,11 @@ static int kyrofb_ioctl(struct inode *inode, struct file *file,
 {
 	overlay_create ol_create;
 	overlay_viewport_set ol_viewport_set;
+	void __user *argp = (void __user *)arg;
 
 	switch (cmd) {
 	case KYRO_IOCTL_OVERLAY_CREATE:
-		copy_from_user((void *) &ol_create, (void *) arg,
-			       sizeof(overlay_create));
+		copy_from_user(&ol_create, argp, sizeof(overlay_create));
 
 		if (kyro_dev_overlay_create(ol_create.ulWidth,
 					    ol_create.ulHeight, 0) < 0) {
@@ -606,7 +606,7 @@ static int kyrofb_ioctl(struct inode *inode, struct file *file,
 		}
 		break;
 	case KYRO_IOCTL_OVERLAY_VIEWPORT_SET:
-		copy_from_user((void *) &ol_viewport_set, (void *) arg,
+		copy_from_user(&ol_viewport_set, argp,
 			       sizeof(overlay_viewport_set));
 
 		if (kyro_dev_overlay_viewport_set(ol_viewport_set.xOrgin,
@@ -627,13 +627,13 @@ static int kyrofb_ioctl(struct inode *inode, struct file *file,
 		}
 		break;
 	case KYRO_IOCTL_UVSTRIDE:
-		copy_to_user((void *)arg, (void *)&deviceInfo.ulOverlayUVStride, sizeof(unsigned long));
+		copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(unsigned long));
 		break;
 	case KYRO_IOCTL_STRIDE:
-		copy_to_user((void *)arg, (void *)&deviceInfo.ulOverlayStride, sizeof(unsigned long));
+		copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(unsigned long));
 		break;
 	case KYRO_IOCTL_OVERLAY_OFFSET:
-		copy_to_user((void *)arg, (void *)&deviceInfo.ulOverlayOffset, sizeof(unsigned long));
+		copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(unsigned long));
 		break;
 	}
 

drivers/video/matrox/matroxfb_base.c

@@ -874,6 +874,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 			  unsigned int cmd, unsigned long arg,
 			  struct fb_info *info)
 {
+	void __user *argp = (void __user *)arg;
 	MINFO_FROM_INFO(info);
 	
 	DBG(__FUNCTION__)
@@ -891,7 +892,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 				err = matroxfb_get_vblank(PMINFO &vblank);
 				if (err)
 					return err;
-				if (copy_to_user((struct fb_vblank*)arg, &vblank, sizeof(vblank)))
+				if (copy_to_user(argp, &vblank, sizeof(vblank)))
 					return -EFAULT;
 				return 0;
 			}
@@ -899,7 +900,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 			{
 				u_int32_t crt;
 
-				if (get_user(crt, (u_int32_t *)arg))
+				if (get_user(crt, (u_int32_t __user *)arg))
 					return -EFAULT;
 
 				return matroxfb_wait_for_sync(PMINFO crt);
@@ -910,7 +911,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 				struct matrox_altout *oproc;
 				int val;
 
-				if (copy_from_user(&mom, (struct matroxioc_output_mode*)arg, sizeof(mom)))
+				if (copy_from_user(&mom, argp, sizeof(mom)))
 					return -EFAULT;
 				if (mom.output >= MATROXFB_MAX_OUTPUTS)
 					return -ENXIO;
@@ -960,7 +961,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 				struct matrox_altout *oproc;
 				int val;
 
-				if (copy_from_user(&mom, (struct matroxioc_output_mode*)arg, sizeof(mom)))
+				if (copy_from_user(&mom, argp, sizeof(mom)))
 					return -EFAULT;
 				if (mom.output >= MATROXFB_MAX_OUTPUTS)
 					return -ENXIO;
@@ -975,7 +976,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 				up_read(&ACCESS_FBINFO(altout.lock));
 				if (val)
 					return val;
-				if (copy_to_user((struct matroxioc_output_mode*)arg, &mom, sizeof(mom)))
+				if (copy_to_user(argp, &mom, sizeof(mom)))
 					return -EFAULT;
 				return 0;
 			}
@@ -985,7 +986,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 				int i;
 				int changes;
 
-				if (copy_from_user(&tmp, (u_int32_t*)arg, sizeof(tmp)))
+				if (copy_from_user(&tmp, argp, sizeof(tmp)))
 					return -EFAULT;
 				for (i = 0; i < 32; i++) {
 					if (tmp & (1 << i)) {
@@ -1040,7 +1041,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 						conn |= 1 << i;
 					}
 				}
-				if (put_user(conn, (u_int32_t*)arg))
+				if (put_user(conn, (u_int32_t __user *)arg))
 					return -EFAULT;
 				return 0;
 			}
@@ -1065,7 +1066,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 					if (conn & MATROXFB_OUTPUT_CONN_SECONDARY)
 						conn &= ~MATROXFB_OUTPUT_CONN_DFP;
 				}
-				if (put_user(conn, (u_int32_t*)arg))
+				if (put_user(conn, (u_int32_t __user *)arg))
 					return -EFAULT;
 				return 0;
 			}
@@ -1079,7 +1080,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 						conn |= 1 << i;
 					}
 				}
-				if (put_user(conn, (u_int32_t*)arg))
+				if (put_user(conn, (u_int32_t __user *)arg))
 					return -EFAULT;
 				return 0;
 			}
@@ -1093,7 +1094,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 				sprintf(r.bus_info, "PCI:%s", pci_name(ACCESS_FBINFO(pcidev)));
 				r.version = KERNEL_VERSION(1,0,0);
 				r.capabilities = V4L2_CAP_VIDEO_OUTPUT;
-				if (copy_to_user((void*)arg, &r, sizeof(r)))
+				if (copy_to_user(argp, &r, sizeof(r)))
 					return -EFAULT;
 				return 0;
 				
@@ -1103,7 +1104,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 				struct v4l2_queryctrl qctrl;
 				int err;
 
-				if (copy_from_user(&qctrl, (struct v4l2_queryctrl*)arg, sizeof(qctrl)))
+				if (copy_from_user(&qctrl, argp, sizeof(qctrl)))
 					return -EFAULT;
 
 				down_read(&ACCESS_FBINFO(altout).lock);
@@ -1116,7 +1117,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 				}
 				up_read(&ACCESS_FBINFO(altout).lock);
 				if (err >= 0 &&
-				    copy_to_user((struct v4l2_queryctrl*)arg, &qctrl, sizeof(qctrl)))
+				    copy_to_user(argp, &qctrl, sizeof(qctrl)))
 					return -EFAULT;
 				return err;
 			}
@@ -1125,7 +1126,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 				struct v4l2_control ctrl;
 				int err;
 
-				if (copy_from_user(&ctrl, (struct v4l2_control*)arg, sizeof(ctrl)))
+				if (copy_from_user(&ctrl, argp, sizeof(ctrl)))
 					return -EFAULT;
 
 				down_read(&ACCESS_FBINFO(altout).lock);
@@ -1138,7 +1139,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 				}
 				up_read(&ACCESS_FBINFO(altout).lock);
 				if (err >= 0 &&
-				    copy_to_user((struct v4l2_control*)arg, &ctrl, sizeof(ctrl)))
+				    copy_to_user(argp, &ctrl, sizeof(ctrl)))
 					return -EFAULT;
 				return err;
 			}
@@ -1147,7 +1148,7 @@ static int matroxfb_ioctl(struct inode *inode, struct file *file,
 				struct v4l2_control ctrl;
 				int err;
 
-				if (copy_from_user(&ctrl, (struct v4l2_control*)arg, sizeof(ctrl)))
+				if (copy_from_user(&ctrl, argp, sizeof(ctrl)))
 					return -EFAULT;
 
 				down_read(&ACCESS_FBINFO(altout).lock);

drivers/video/matrox/matroxfb_crtc2.c

@@ -437,7 +437,7 @@ static int matroxfb_dh_ioctl(struct inode* inode,
 				err = matroxfb_dh_get_vblank(m2info, &vblank);
 				if (err)
 					return err;
-				if (copy_to_user((struct fb_vblank*)arg, &vblank, sizeof(vblank)))
+				if (copy_to_user((void __user *)arg, &vblank, sizeof(vblank)))
 					return -EFAULT;
 				return 0;
 			}
@@ -445,7 +445,7 @@ static int matroxfb_dh_ioctl(struct inode* inode,
 			{
 				u_int32_t crt;
 
-				if (get_user(crt, (u_int32_t *)arg))
+				if (get_user(crt, (u_int32_t __user *)arg))
 					return -EFAULT;
 
 				if (crt != 0)
@@ -464,7 +464,7 @@ static int matroxfb_dh_ioctl(struct inode* inode,
 				int out;
 				int changes;
 
-				if (get_user(tmp, (u_int32_t*)arg))
+				if (get_user(tmp, (u_int32_t __user *)arg))
 					return -EFAULT;
 				for (out = 0; out < 32; out++) {
 					if (tmp & (1 << out)) {
@@ -514,7 +514,7 @@ static int matroxfb_dh_ioctl(struct inode* inode,
 						conn |= 1 << out;
 					}
 				}
-				if (put_user(conn, (u_int32_t*)arg))
+				if (put_user(conn, (u_int32_t __user *)arg))
 					return -EFAULT;
 				return 0;
 			}
@@ -539,7 +539,7 @@ static int matroxfb_dh_ioctl(struct inode* inode,
 						tmp = 0;
 					}
 				}
-				if (put_user(tmp, (u_int32_t*)arg))
+				if (put_user(tmp, (u_int32_t __user *)arg))
 					return -EFAULT;
 				return 0;
 			}

drivers/video/radeonfb.c

@@ -1544,7 +1544,7 @@ static int radeonfb_ioctl (struct inode *inode, struct file *file, unsigned int
 					break;
 			}
 
-			rc = get_user(value, (__u32*)arg);
+			rc = get_user(value, (__u32 __user *)arg);
 
 			if (rc)
 				return rc;
@@ -1598,7 +1598,7 @@ static int radeonfb_ioctl (struct inode *inode, struct file *file, unsigned int
 			if (CRTC_CRT_ON & tmp)
 				value |= 0x02;
 
-			return put_user(value, (__u32*)arg);
+			return put_user(value, (__u32 __user *)arg);
 		default:
 			return -EINVAL;
 	}

drivers/video/sstfb.c

@@ -790,7 +790,7 @@ static int sstfb_ioctl(struct inode *inode, struct file *file,
 		
 	/* fills lfb with #arg pixels */
 	case _IOW('F', 0xdc, u32):	/* 0x46dc */
-		if (copy_from_user(&val, (void *)arg, sizeof(val)))
+		if (copy_from_user(&val, (void __user *)arg, sizeof(val)))
 			return -EFAULT;
 		if (val > info->fix.smem_len)
 			val = info->fix.smem_len;
@@ -801,7 +801,7 @@ static int sstfb_ioctl(struct inode *inode, struct file *file,
 		
 	/* change VGA pass_through mode */
 	case _IOW('F', 0xdd, u32):	/* 0x46dd */
-		if (copy_from_user(&val, (void *)arg, sizeof(val)))
+		if (copy_from_user(&val, (void __user *)arg, sizeof(val)))
 			return -EFAULT;
 		pci_read_config_dword(sst_dev, PCI_INIT_ENABLE, &tmp);
 		pci_write_config_dword(sst_dev, PCI_INIT_ENABLE,

fs/autofs/root.c

@@ -468,7 +468,7 @@ static int autofs_root_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 
 /* Get/set timeout ioctl() operation */
 static inline int autofs_get_set_timeout(struct autofs_sb_info *sbi,
-					 unsigned long *p)
+					 unsigned long __user *p)
 {
 	unsigned long ntimeout;
 
@@ -485,7 +485,7 @@ static inline int autofs_get_set_timeout(struct autofs_sb_info *sbi,
 }
 
 /* Return protocol version */
-static inline int autofs_get_protover(int *p)
+static inline int autofs_get_protover(int __user *p)
 {
 	return put_user(AUTOFS_PROTO_VERSION, p);
 }
@@ -494,7 +494,7 @@ static inline int autofs_get_protover(int *p)
 static inline int autofs_expire_run(struct super_block *sb,
 				    struct autofs_sb_info *sbi,
 				    struct vfsmount *mnt,
-				    struct autofs_packet_expire *pkt_p)
+				    struct autofs_packet_expire __user *pkt_p)
 {
 	struct autofs_dir_ent *ent;
 	struct autofs_packet_expire pkt;
@@ -526,6 +526,7 @@ static int autofs_root_ioctl(struct inode *inode, struct file *filp,
 			     unsigned int cmd, unsigned long arg)
 {
 	struct autofs_sb_info *sbi = autofs_sbi(inode->i_sb);
+	void __user *argp = (void __user *)arg;
 
 	DPRINTK(("autofs_ioctl: cmd = 0x%08x, arg = 0x%08lx, sbi = %p, pgrp = %u\n",cmd,arg,sbi,process_group(current)));
 
@@ -545,12 +546,12 @@ static int autofs_root_ioctl(struct inode *inode, struct file *filp,
 		autofs_catatonic_mode(sbi);
 		return 0;
 	case AUTOFS_IOC_PROTOVER: /* Get protocol version */
-		return autofs_get_protover((int *)arg);
+		return autofs_get_protover(argp);
 	case AUTOFS_IOC_SETTIMEOUT:
-		return autofs_get_set_timeout(sbi,(unsigned long *)arg);
+		return autofs_get_set_timeout(sbi, argp);
 	case AUTOFS_IOC_EXPIRE:
 		return autofs_expire_run(inode->i_sb, sbi, filp->f_vfsmnt,
-					 (struct autofs_packet_expire *)arg);
+					 argp);
 	default:
 		return -ENOSYS;
 	}

fs/binfmt_aout.c

@@ -140,14 +140,14 @@ static int aout_core_dump(long signr, struct pt_regs * regs, struct file *file)
 /* make sure we actually have a data and stack area to dump */
 	set_fs(USER_DS);
 #ifdef __sparc__
-	if (verify_area(VERIFY_READ, (void *) START_DATA(dump), dump.u_dsize))
+	if (verify_area(VERIFY_READ, (void __user *)START_DATA(dump), dump.u_dsize))
 		dump.u_dsize = 0;
-	if (verify_area(VERIFY_READ, (void *) START_STACK(dump), dump.u_ssize))
+	if (verify_area(VERIFY_READ, (void __user *)START_STACK(dump), dump.u_ssize))
 		dump.u_ssize = 0;
 #else
-	if (verify_area(VERIFY_READ, (void *) START_DATA(dump), dump.u_dsize << PAGE_SHIFT))
+	if (verify_area(VERIFY_READ, (void __user *)START_DATA(dump), dump.u_dsize << PAGE_SHIFT))
 		dump.u_dsize = 0;
-	if (verify_area(VERIFY_READ, (void *) START_STACK(dump), dump.u_ssize << PAGE_SHIFT))
+	if (verify_area(VERIFY_READ, (void __user *)START_STACK(dump), dump.u_ssize << PAGE_SHIFT))
 		dump.u_ssize = 0;
 #endif
 
@@ -193,17 +193,18 @@ static int aout_core_dump(long signr, struct pt_regs * regs, struct file *file)
  * memory and creates the pointer tables from them, and puts their
  * addresses on the "stack", returning the new stack pointer value.
  */
-static unsigned long * create_aout_tables(char * p, struct linux_binprm * bprm)
+static unsigned long __user *create_aout_tables(char __user *p, struct linux_binprm * bprm)
 {
-	char **argv, **envp;
-	unsigned long * sp;
+	char __user * __user *argv;
+	char __user * __user *envp;
+	unsigned long __user *sp;
 	int argc = bprm->argc;
 	int envc = bprm->envc;
 
-	sp = (unsigned long *) ((-(unsigned long)sizeof(char *)) & (unsigned long) p);
+	sp = (void __user *)((-(unsigned long)sizeof(char *)) & (unsigned long) p);
 #ifdef __sparc__
 	/* This imposes the proper stack alignment for a new process. */
-	sp = (unsigned long *) (((unsigned long) sp) & ~7);
+	sp = (void __user *) (((unsigned long) sp) & ~7);
 	if ((envc+argc+3)&1) --sp;
 #endif
 #ifdef __alpha__
@@ -220,9 +221,9 @@ static unsigned long * create_aout_tables(char * p, struct linux_binprm * bprm)
 	put_user(0x3e9, --sp);
 #endif
 	sp -= envc+1;
-	envp = (char **) sp;
+	envp = (char __user * __user *) sp;
 	sp -= argc+1;
-	argv = (char **) sp;
+	argv = (char __user * __user *) sp;
 #if defined(__i386__) || defined(__mc68000__) || defined(__arm__) || defined(__arch_um__)
 	put_user((unsigned long) envp,--sp);
 	put_user((unsigned long) argv,--sp);
@@ -420,7 +421,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 	}
 
 	current->mm->start_stack =
-		(unsigned long) create_aout_tables((char *) bprm->p, bprm);
+		(unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
 #ifdef __alpha__
 	regs->gp = ex.a_gpvalue;
 #endif

fs/nfs/direct.c

@@ -475,7 +475,7 @@ nfs_file_direct_read(struct kiocb *iocb, char __user *buf, size_t count, loff_t
 	struct address_space *mapping = file->f_mapping;
 	struct inode *inode = mapping->host;
 	struct iovec iov = {
-		.iov_base = (char *)buf,
+		.iov_base = buf,
 		.iov_len = count,
 	};
 

fs/nfs/idmap.c

@@ -75,9 +75,10 @@ struct idmap {
 	struct idmap_hashtable idmap_group_hash;
 };
 
-static ssize_t   idmap_pipe_upcall(struct file *, struct rpc_pipe_msg *, char *,
+static ssize_t   idmap_pipe_upcall(struct file *, struct rpc_pipe_msg *,
+		     char __user *, size_t);
+static ssize_t   idmap_pipe_downcall(struct file *, const char __user *,
 		     size_t);
-static ssize_t   idmap_pipe_downcall(struct file *, const char *, size_t);
 void             idmap_pipe_destroy_msg(struct rpc_pipe_msg *);
 
 static unsigned int fnvhash32(const void *, size_t);
@@ -332,7 +333,7 @@ nfs_idmap_name(struct idmap *idmap, struct idmap_hashtable *h,
 /* RPC pipefs upcall/downcall routines */
 static ssize_t
 idmap_pipe_upcall(struct file *filp, struct rpc_pipe_msg *msg,
-    char *dst, size_t buflen)
+    char __user *dst, size_t buflen)
 {
         char *data = (char *)msg->data + msg->copied;
         ssize_t mlen = msg->len - msg->copied;
@@ -353,7 +354,7 @@ idmap_pipe_upcall(struct file *filp, struct rpc_pipe_msg *msg,
 }
 
 static ssize_t
-idmap_pipe_downcall(struct file *filp, const char *src, size_t mlen)
+idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 {
         struct rpc_inode *rpci = RPC_I(filp->f_dentry->d_inode);
 	struct idmap *idmap = (struct idmap *)rpci->private;

fs/udf/crc.c

@@ -84,7 +84,7 @@ static uint16_t crc_table[256] = {
  *	July 21, 1997 - Andrew E. Mileski
  *	Adapted from OSTA-UDF(tm) 1.50 standard.
  */
-extern uint16_t
+uint16_t
 udf_crc(uint8_t *data, uint32_t size, uint16_t crc)
 {
 	while (size--)

fs/udf/misc.c

@@ -34,7 +34,7 @@
 #include "udf_i.h"
 #include "udf_sb.h"
 
-extern struct buffer_head *
+struct buffer_head *
 udf_tgetblk(struct super_block *sb, int block)
 {
 	if (UDF_QUERY_FLAG(sb, UDF_FLAG_VARCONV))
@@ -43,7 +43,7 @@ udf_tgetblk(struct super_block *sb, int block)
 		return sb_getblk(sb, block);
 }
 
-extern struct buffer_head *
+struct buffer_head *
 udf_tread(struct super_block *sb, int block)
 {
 	if (UDF_QUERY_FLAG(sb, UDF_FLAG_VARCONV))
@@ -52,7 +52,7 @@ udf_tread(struct super_block *sb, int block)
 		return sb_bread(sb, block);
 }
 
-extern struct genericFormat *
+struct genericFormat *
 udf_add_extendedattr(struct inode * inode, uint32_t size, uint32_t type,
 	uint8_t loc)
 {
@@ -157,7 +157,7 @@ udf_add_extendedattr(struct inode * inode, uint32_t size, uint32_t type,
 	return NULL;
 }
 
-extern struct genericFormat *
+struct genericFormat *
 udf_get_extendedattr(struct inode *inode, uint32_t type, uint8_t subtype)
 {
 	struct genericFormat *gaf;
@@ -207,7 +207,7 @@ udf_get_extendedattr(struct inode *inode, uint32_t type, uint8_t subtype)
  *	July 1, 1997 - Andrew E. Mileski
  *	Written, tested, and released.
  */
-extern struct buffer_head *
+struct buffer_head *
 udf_read_tagged(struct super_block *sb, uint32_t block, uint32_t location, uint16_t *ident)
 {
 	tag *tag_p;
@@ -272,7 +272,7 @@ udf_read_tagged(struct super_block *sb, uint32_t block, uint32_t location, uint1
 	return NULL;
 }
 
-extern struct buffer_head *
+struct buffer_head *
 udf_read_ptagged(struct super_block *sb, lb_addr loc, uint32_t offset, uint16_t *ident)
 {
 	return udf_read_tagged(sb, udf_get_lb_pblock(sb, loc, offset),

include/asm-x86_64/uaccess.h

@@ -33,16 +33,6 @@
 
 #define segment_eq(a,b)	((a).seg == (b).seg)
 
-#ifdef __CHECKER__
-#define CHECK_UPTR(ptr) do {				\
-	__typeof__(*(ptr)) *__dummy_check_uptr =	\
-		(void __user *)&__dummy_check_uptr;	\
-} while(0)
-#else
-#define CHECK_UPTR(ptr)
-#endif
-
-
 #define __addr_ok(addr) (!((unsigned long)(addr) & (current_thread_info()->addr_limit.seg)))
 
 /*
@@ -50,7 +40,7 @@
  */
 #define __range_not_ok(addr,size) ({ \
 	unsigned long flag,sum; \
-	CHECK_UPTR(addr);	\
+	__chk_user_ptr(addr); \
 	asm("# range_ok\n\r" \
 		"addq %3,%1 ; sbbq %0,%0 ; cmpq %1,%4 ; sbbq $0,%0"  \
 		:"=&r" (flag), "=r" (sum) \
@@ -114,7 +104,7 @@ extern void __get_user_8(void);
 #define get_user(x,ptr)							\
 ({	long __val_gu;							\
 	int __ret_gu; 							\
-	CHECK_UPTR(ptr);						\
+	__chk_user_ptr(ptr);						\
 	switch(sizeof (*(ptr))) {					\
 	case 1:  __get_user_x(1,__ret_gu,__val_gu,ptr); break;		\
 	case 2:  __get_user_x(2,__ret_gu,__val_gu,ptr); break;		\
@@ -150,7 +140,6 @@ extern void __put_user_bad(void);
 #define __put_user_nocheck(x,ptr,size)			\
 ({							\
 	int __pu_err;					\
-	CHECK_UPTR(ptr);				\
 	__put_user_size((x),(ptr),(size),__pu_err);	\
 	__pu_err;					\
 })
@@ -168,6 +157,7 @@ extern void __put_user_bad(void);
 #define __put_user_size(x,ptr,size,retval)				\
 do {									\
 	retval = 0;							\
+	__chk_user_ptr(ptr);						\
 	switch (size) {							\
 	  case 1: __put_user_asm(x,ptr,retval,"b","b","iq",-EFAULT); break;\
 	  case 2: __put_user_asm(x,ptr,retval,"w","w","ir",-EFAULT); break;\
@@ -206,7 +196,6 @@ struct __large_struct { unsigned long buf[100]; };
 ({								\
 	int __gu_err;						\
 	long __gu_val;						\
-	CHECK_UPTR(ptr);					\
 	__get_user_size(__gu_val,(ptr),(size),__gu_err);	\
 	(x) = (__typeof__(*(ptr)))__gu_val;			\
 	__gu_err;						\
@@ -217,6 +206,7 @@ extern int __get_user_bad(void);
 #define __get_user_size(x,ptr,size,retval)				\
 do {									\
 	retval = 0;							\
+	__chk_user_ptr(ptr);						\
 	switch (size) {							\
 	  case 1: __get_user_asm(x,ptr,retval,"b","b","=q",-EFAULT); break;\
 	  case 2: __get_user_asm(x,ptr,retval,"w","w","=r",-EFAULT); break;\
@@ -257,28 +247,28 @@ static inline int __copy_from_user(void *dst, const void __user *src, unsigned s
 { 
        int ret = 0;
 	if (!__builtin_constant_p(size))
-		return copy_user_generic(dst,(void *)src,size);
+		return copy_user_generic(dst,(__force void *)src,size);
 	switch (size) { 
-	case 1:__get_user_asm(*(u8*)dst,(u8 *)src,ret,"b","b","=q",1); 
+	case 1:__get_user_asm(*(u8*)dst,(u8 __user *)src,ret,"b","b","=q",1); 
 		return ret;
-	case 2:__get_user_asm(*(u16*)dst,(u16*)src,ret,"w","w","=r",2);
+	case 2:__get_user_asm(*(u16*)dst,(u16 __user *)src,ret,"w","w","=r",2);
 		return ret;
-	case 4:__get_user_asm(*(u32*)dst,(u32*)src,ret,"l","k","=r",4);
+	case 4:__get_user_asm(*(u32*)dst,(u32 __user *)src,ret,"l","k","=r",4);
 		return ret;
-	case 8:__get_user_asm(*(u64*)dst,(u64*)src,ret,"q","","=r",8);
+	case 8:__get_user_asm(*(u64*)dst,(u64 __user *)src,ret,"q","","=r",8);
 		return ret; 
 	case 10:
-	       	__get_user_asm(*(u64*)dst,(u64*)src,ret,"q","","=r",16);
+	       	__get_user_asm(*(u64*)dst,(u64 __user *)src,ret,"q","","=r",16);
 		if (unlikely(ret)) return ret;
-		__get_user_asm(*(u16*)(8+(char*)dst),(u16*)(8+(char*)src),ret,"w","w","=r",2);
+		__get_user_asm(*(u16*)(8+(char*)dst),(u16 __user *)(8+(char __user *)src),ret,"w","w","=r",2);
 		return ret; 
 	case 16:
-		__get_user_asm(*(u64*)dst,(u64*)src,ret,"q","","=r",16);
+		__get_user_asm(*(u64*)dst,(u64 __user *)src,ret,"q","","=r",16);
 		if (unlikely(ret)) return ret;
-		__get_user_asm(*(u64*)(8+(char*)dst),(u64*)(8+(char*)src),ret,"q","","=r",8);
+		__get_user_asm(*(u64*)(8+(char*)dst),(u64 __user *)(8+(char __user *)src),ret,"q","","=r",8);
 		return ret; 
 	default:
-		return copy_user_generic(dst,(void *)src,size); 
+		return copy_user_generic(dst,(__force void *)src,size); 
 	}
 }	
 
@@ -286,30 +276,30 @@ static inline int __copy_to_user(void __user *dst, const void *src, unsigned siz
 { 
        int ret = 0;
 	if (!__builtin_constant_p(size))
-		return copy_user_generic((void *)dst,src,size);
+		return copy_user_generic((__force void *)dst,src,size);
 	switch (size) { 
-	case 1:__put_user_asm(*(u8*)src,(u8 *)dst,ret,"b","b","iq",1); 
+	case 1:__put_user_asm(*(u8*)src,(u8 __user *)dst,ret,"b","b","iq",1); 
 		return ret;
-	case 2:__put_user_asm(*(u16*)src,(u16*)dst,ret,"w","w","ir",2);
+	case 2:__put_user_asm(*(u16*)src,(u16 __user *)dst,ret,"w","w","ir",2);
 		return ret;
-	case 4:__put_user_asm(*(u32*)src,(u32*)dst,ret,"l","k","ir",4);
+	case 4:__put_user_asm(*(u32*)src,(u32 __user *)dst,ret,"l","k","ir",4);
 		return ret;
-	case 8:__put_user_asm(*(u64*)src,(u64*)dst,ret,"q","","ir",8);
+	case 8:__put_user_asm(*(u64*)src,(u64 __user *)dst,ret,"q","","ir",8);
 		return ret; 
 	case 10:
-		__put_user_asm(*(u64*)src,(u64*)dst,ret,"q","","ir",10);
+		__put_user_asm(*(u64*)src,(u64 __user *)dst,ret,"q","","ir",10);
 		if (unlikely(ret)) return ret;
 		asm("":::"memory");
-		__put_user_asm(4[(u16*)src],4+(u16*)dst,ret,"w","w","ir",2);
+		__put_user_asm(4[(u16*)src],4+(u16 __user *)dst,ret,"w","w","ir",2);
 		return ret; 
 	case 16:
-		__put_user_asm(*(u64*)src,(u64*)dst,ret,"q","","ir",16);
+		__put_user_asm(*(u64*)src,(u64 __user *)dst,ret,"q","","ir",16);
 		if (unlikely(ret)) return ret;
 		asm("":::"memory");
-		__put_user_asm(1[(u64*)src],1+(u64*)dst,ret,"q","","ir",8);
+		__put_user_asm(1[(u64*)src],1+(u64 __user *)dst,ret,"q","","ir",8);
 		return ret; 
 	default:
-		return copy_user_generic((void *)dst,src,size); 
+		return copy_user_generic((__force void *)dst,src,size); 
 	}
 }	
 
@@ -318,39 +308,39 @@ static inline int __copy_in_user(void __user *dst, const void __user *src, unsig
 { 
        int ret = 0;
 	if (!__builtin_constant_p(size))
-		return copy_user_generic((void *)dst,(void *)src,size);
+		return copy_user_generic((__force void *)dst,(__force void *)src,size);
 	switch (size) { 
 	case 1: { 
 		u8 tmp;
-		__get_user_asm(tmp,(u8 *)src,ret,"b","b","=q",1); 
+		__get_user_asm(tmp,(u8 __user *)src,ret,"b","b","=q",1); 
 		if (likely(!ret))
-			__put_user_asm(tmp,(u8 *)dst,ret,"b","b","iq",1); 
+			__put_user_asm(tmp,(u8 __user *)dst,ret,"b","b","iq",1); 
 		return ret;
 	}
 	case 2: { 
 		u16 tmp;
-		__get_user_asm(tmp,(u16 *)src,ret,"w","w","=r",2); 
+		__get_user_asm(tmp,(u16 __user *)src,ret,"w","w","=r",2); 
 		if (likely(!ret))
-			__put_user_asm(tmp,(u16 *)dst,ret,"w","w","ir",2); 
+			__put_user_asm(tmp,(u16 __user *)dst,ret,"w","w","ir",2); 
 		return ret;
 	}
 
 	case 4: { 
 		u32 tmp;
-		__get_user_asm(tmp,(u32 *)src,ret,"l","k","=r",4); 
+		__get_user_asm(tmp,(u32 __user *)src,ret,"l","k","=r",4); 
 		if (likely(!ret))
-			__put_user_asm(tmp,(u32 *)dst,ret,"l","k","ir",4); 
+			__put_user_asm(tmp,(u32 __user *)dst,ret,"l","k","ir",4); 
 		return ret;
 	}
 	case 8: { 
 		u64 tmp;
-		__get_user_asm(tmp,(u64 *)src,ret,"q","","=r",8); 
+		__get_user_asm(tmp,(u64 __user *)src,ret,"q","","=r",8); 
 		if (likely(!ret))
-			__put_user_asm(tmp,(u64 *)dst,ret,"q","","ir",8); 
+			__put_user_asm(tmp,(u64 __user *)dst,ret,"q","","ir",8); 
 		return ret;
 	}
 	default:
-		return copy_user_generic((void *)dst,(void *)src,size); 
+		return copy_user_generic((__force void *)dst,(__force void *)src,size); 
 	}
 }	
 

include/linux/fb.h

@@ -459,8 +459,8 @@ struct fb_ops {
 	/* For framebuffers with strange non linear layouts or that do not
 	 * work with normal memory mapped access
 	 */
-	ssize_t (*fb_read)(struct file *file, char *buf, size_t count, loff_t *ppos);
-	ssize_t (*fb_write)(struct file *file, const char *buf, size_t count, loff_t *ppos);
+	ssize_t (*fb_read)(struct file *file, char __user *buf, size_t count, loff_t *ppos);
+	ssize_t (*fb_write)(struct file *file, const char __user *buf, size_t count, loff_t *ppos);
 
 	/* checks var and eventually tweaks it to something supported,
 	 * DO NOT MODIFY PAR */

include/linux/ipmi.h

@@ -498,7 +498,7 @@ int ipmi_addr_equal(struct ipmi_addr *addr1, struct ipmi_addr *addr2);
 /* Messages sent to the interface are this format. */
 struct ipmi_req
 {
-	unsigned char *addr; /* Address to send the message to. */
+	unsigned char __user *addr; /* Address to send the message to. */
 	unsigned int  addr_len;
 
 	long    msgid; /* The sequence number for the message.  This
@@ -549,7 +549,7 @@ struct ipmi_recv
 	int     recv_type; /* Is this a command, response or an
 			      asyncronous event. */
 
-	unsigned char *addr;    /* Address the message was from is put
+	unsigned char __user *addr;    /* Address the message was from is put
 				   here.  The caller must supply the
 				   memory. */
 	unsigned int  addr_len; /* The size of the address buffer.

include/linux/nfs4_mount.h

@@ -20,7 +20,7 @@
 
 struct nfs_string {
 	unsigned int len;
-	const char* data;
+	const char __user * data;
 };
 
 struct nfs4_mount_data {
@@ -45,14 +45,14 @@ struct nfs4_mount_data {
 	struct nfs_string hostname;		/* 1 */
 	/* Server IP address */
 	unsigned int host_addrlen;		/* 1 */
-	struct sockaddr* host_addr;		/* 1 */
+	struct sockaddr __user * host_addr;	/* 1 */
 
 	/* Transport protocol to use */
 	int proto;				/* 1 */
 
 	/* Pseudo-flavours to use for authentication. See RFC2623 */
 	int auth_flavourlen;			/* 1 */
-	int *auth_flavours;			/* 1 */
+	int __user *auth_flavours;		/* 1 */
 };
 
 /* bits in the flags field */