[PATCH] sparse: more net/* annotation

	Annotation of net/* ...copy... that deals with userland pointers +
several bits that fell out of previous patch (trivial annotations)

include/linux/skbuff.h

@@ -1014,13 +1014,13 @@ extern struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
 extern unsigned int    datagram_poll(struct file *file, struct socket *sock,
 				     struct poll_table_struct *wait);
 extern int	       skb_copy_datagram(const struct sk_buff *from,
-					 int offset, char *to, int size);
+					 int offset, char __user *to, int size);
 extern int	       skb_copy_datagram_iovec(const struct sk_buff *from,
 					       int offset, struct iovec *to,
 					       int size);
 extern int	       skb_copy_and_csum_datagram(const struct sk_buff *skb,
-						  int offset, u8 *to, int len,
-						  unsigned int *csump);
+						  int offset, u8 __user *to,
+						  int len, unsigned int *csump);
 extern int	       skb_copy_and_csum_datagram_iovec(const
 							struct sk_buff *skb,
 							int hlen,

include/net/checksum.h

@@ -95,7 +95,7 @@ static __inline__ unsigned short int csum_ipv6_magic(struct in6_addr *saddr,
 
 #ifndef _HAVE_ARCH_COPY_AND_CSUM_FROM_USER
 static inline
-unsigned int csum_and_copy_from_user (const char *src, char *dst,
+unsigned int csum_and_copy_from_user (const char __user *src, char *dst,
 				      int len, int sum, int *err_ptr)
 {
 	if (verify_area(VERIFY_READ, src, len) == 0)
@@ -110,7 +110,7 @@ unsigned int csum_and_copy_from_user (const char *src, char *dst,
 
 #ifndef HAVE_CSUM_COPY_USER
 static __inline__ unsigned int csum_and_copy_to_user
-(const char *src, char *dst, int len, unsigned int sum, int *err_ptr)
+(const char *src, char __user *dst, int len, unsigned int sum, int *err_ptr)
 {
 	sum = csum_partial(src, len, sum);
 

net/core/datagram.c

@@ -202,7 +202,7 @@ void skb_free_datagram(struct sock *sk, struct sk_buff *skb)
 /*
  *	Copy a datagram to a linear buffer.
  */
-int skb_copy_datagram(const struct sk_buff *skb, int offset, char *to, int size)
+int skb_copy_datagram(const struct sk_buff *skb, int offset, char __user *to, int size)
 {
 	struct iovec iov = {
 		.iov_base = to,
@@ -297,7 +297,7 @@ int skb_copy_datagram_iovec(const struct sk_buff *skb, int offset,
 }
 
 int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
-			       u8 *to, int len, unsigned int *csump)
+			       u8 __user *to, int len, unsigned int *csump)
 {
 	int start = skb_headlen(skb);
 	int pos = 0;

net/core/iovec.c

@@ -192,7 +192,7 @@ int csum_partial_copy_fromiovecend(unsigned char *kdata, struct iovec *iov,
 	}
 
 	while (len > 0) {
-		u8 *base = iov->iov_base + offset;
+		u8 __user *base = iov->iov_base + offset;
 		int copy = min_t(unsigned int, len, iov->iov_len - offset);
 
 		offset = 0;

net/core/scm.c

@@ -169,7 +169,7 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
 
 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
 {
-	struct cmsghdr *cm = (struct cmsghdr*)msg->msg_control;
+	struct cmsghdr __user *cm = (struct cmsghdr __user *)msg->msg_control;
 	struct cmsghdr cmhdr;
 	int cmlen = CMSG_LEN(len);
 	int err;
@@ -204,16 +204,18 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
 
 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
 {
-	struct cmsghdr *cm = (struct cmsghdr*)msg->msg_control;
+	struct cmsghdr __user *cm = (struct cmsghdr __user*)msg->msg_control;
 
 	int fdmax = 0;
 	int fdnum = scm->fp->count;
 	struct file **fp = scm->fp->fp;
-	int *cmfptr;
+	int __user *cmfptr;
 	int err = 0, i;
 
-	if (MSG_CMSG_COMPAT & msg->msg_flags)
-		return scm_detach_fds_compat(msg, scm);
+	if (MSG_CMSG_COMPAT & msg->msg_flags) {
+		scm_detach_fds_compat(msg, scm);
+		return;
+	}
 
 	if (msg->msg_controllen > sizeof(struct cmsghdr))
 		fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr))
@@ -222,7 +224,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
 	if (fdnum < fdmax)
 		fdmax = fdnum;
 
-	for (i=0, cmfptr=(int*)CMSG_DATA(cm); i<fdmax; i++, cmfptr++)
+	for (i=0, cmfptr=(int __user *)CMSG_DATA(cm); i<fdmax; i++, cmfptr++)
 	{
 		int new_fd;
 		err = security_file_receive(fp[i]);

net/ipv4/tcp.c

@@ -966,7 +966,7 @@ ssize_t tcp_sendpage(struct socket *sock, struct page *page, int offset,
 #define TCP_PAGE(sk)	(inet_sk(sk)->sndmsg_page)
 #define TCP_OFF(sk)	(inet_sk(sk)->sndmsg_off)
 
-static inline int tcp_copy_to_page(struct sock *sk, char *from,
+static inline int tcp_copy_to_page(struct sock *sk, char __user *from,
 				   struct sk_buff *skb, struct page *page,
 				   int off, int copy)
 {
@@ -991,7 +991,7 @@ static inline int tcp_copy_to_page(struct sock *sk, char *from,
 	return 0;
 }
 
-static inline int skb_add_data(struct sk_buff *skb, char *from, int copy)
+static inline int skb_add_data(struct sk_buff *skb, char __user *from, int copy)
 {
 	int err = 0;
 	unsigned int csum;
@@ -1065,7 +1065,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
 	while (--iovlen >= 0) {
 		int seglen = iov->iov_len;
-		unsigned char *from = iov->iov_base;
+		unsigned char __user *from = iov->iov_base;
 
 		iov++;
 

net/ipv6/af_inet6.c

@@ -479,14 +479,14 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 	case SIOCADDRT:
 	case SIOCDELRT:
 	  
-		return(ipv6_route_ioctl(cmd,(void *)arg));
+		return(ipv6_route_ioctl(cmd,(void __user *)arg));
 
 	case SIOCSIFADDR:
-		return addrconf_add_ifaddr((void *) arg);
+		return addrconf_add_ifaddr((void __user *) arg);
 	case SIOCDIFADDR:
-		return addrconf_del_ifaddr((void *) arg);
+		return addrconf_del_ifaddr((void __user *) arg);
 	case SIOCSIFDSTADDR:
-		return addrconf_set_dstaddr((void *) arg);
+		return addrconf_set_dstaddr((void __user *) arg);
 	default:
 		if (!sk->sk_prot->ioctl ||
 		    (err = sk->sk_prot->ioctl(sk, cmd, arg)) == -ENOIOCTLCMD)