[PATCH] sparse: drivers/media/* annotation

drivers/media/common/saa7146_vbi.c

@@ -459,7 +459,7 @@ static void vbi_irq_done(struct saa7146_dev *dev, unsigned long status)
 	spin_unlock(&dev->slock);
 }
 
-static ssize_t vbi_read(struct file *file, char *data, size_t count, loff_t *ppos)
+static ssize_t vbi_read(struct file *file, char __user *data, size_t count, loff_t *ppos)
 {
 	struct saa7146_fh *fh = file->private_data;
 	struct saa7146_dev *dev = fh->dev;

drivers/media/common/saa7146_video.c

@@ -1450,7 +1450,7 @@ static void video_irq_done(struct saa7146_dev *dev, unsigned long st)
 	spin_unlock(&dev->slock);
 }
 
-static ssize_t video_read(struct file *file, char *data, size_t count, loff_t *ppos)
+static ssize_t video_read(struct file *file, char __user *data, size_t count, loff_t *ppos)
 {
 	struct saa7146_fh *fh = file->private_data;
 	struct saa7146_dev *dev = fh->dev;

drivers/media/dvb/dvb-core/dmxdev.c

@@ -97,7 +97,7 @@ static inline int dvb_dmxdev_buffer_write(struct dmxdev_buffer *buf, const u8 *s
 }
 
 static ssize_t dvb_dmxdev_buffer_read(struct dmxdev_buffer *src,
-		int non_blocking, char *buf, size_t count, loff_t *ppos)
+		int non_blocking, char __user *buf, size_t count, loff_t *ppos)
 {
 	unsigned long todo=count;
 	int split, avail, error;
@@ -253,7 +253,7 @@ static int dvb_dvr_release(struct inode *inode, struct file *file)
 	return 0;
 }
 
-static ssize_t dvb_dvr_write(struct file *file, const char *buf,
+static ssize_t dvb_dvr_write(struct file *file, const char __user *buf,
 		size_t count, loff_t *ppos)
 {
 	struct dvb_device *dvbdev=(struct dvb_device *) file->private_data;
@@ -271,7 +271,7 @@ static ssize_t dvb_dvr_write(struct file *file, const char *buf,
 	return ret;
 }
 
-static ssize_t dvb_dvr_read(struct file *file, char *buf, size_t count,
+static ssize_t dvb_dvr_read(struct file *file, char __user *buf, size_t count,
 		loff_t *ppos)
 {
 	struct dvb_device *dvbdev=(struct dvb_device *) file->private_data;
@@ -806,7 +806,7 @@ static int dvb_dmxdev_pes_filter_set(struct dmxdev *dmxdev,
 }
 
 static ssize_t dvb_dmxdev_read_sec(struct dmxdev_filter *dfil,
-		struct file *file, char *buf, size_t count, loff_t *ppos)
+		struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
 	int result, hcount;
 	int done=0;
@@ -845,7 +845,7 @@ static ssize_t dvb_dmxdev_read_sec(struct dmxdev_filter *dfil,
 
 
 ssize_t 
-dvb_demux_read(struct file *file, char *buf, size_t count, loff_t *ppos)
+dvb_demux_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
 	struct dmxdev_filter *dmxdevfilter=dvb_dmxdev_file_to_filter(file);
 	int ret=0;

drivers/media/dvb/dvb-core/dvb_ca_en50221.c

@@ -1188,7 +1188,7 @@ static int dvb_ca_en50221_io_ioctl(struct inode *inode, struct file *file, unsig
  *
  * @return Number of bytes read, or <0 on error.
  */
-static ssize_t dvb_ca_en50221_io_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
+static ssize_t dvb_ca_en50221_io_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 {
         struct dvb_device *dvbdev=(struct dvb_device *) file->private_data;
         struct dvb_ca_private *ca=(struct dvb_ca_private*) dvbdev->priv;
@@ -1303,7 +1303,7 @@ static int dvb_ca_en50221_io_read_condition(struct dvb_ca_private* ca, int* resu
  *
  * @return Number of bytes read, or <0 on error.
  */
-static ssize_t dvb_ca_en50221_io_read(struct file *file, char *buf, size_t count, loff_t *ppos)
+static ssize_t dvb_ca_en50221_io_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
         struct dvb_device *dvbdev=(struct dvb_device *) file->private_data;
         struct dvb_ca_private *ca=(struct dvb_ca_private*) dvbdev->priv;

drivers/media/dvb/dvb-core/dvb_functions.c

@@ -36,7 +36,7 @@ int dvb_usercopy(struct inode *inode, struct file *file,
         /*  Copy arguments into temp kernel buffer  */
         switch (_IOC_DIR(cmd)) {
         case _IOC_NONE:
-                parg = (void *)arg;
+                parg = NULL;
                 break;
         case _IOC_READ: /* some v4l ioctls are marked wrong ... */
         case _IOC_WRITE:
@@ -52,7 +52,7 @@ int dvb_usercopy(struct inode *inode, struct file *file,
                 }
 
                 err = -EFAULT;
-                if (copy_from_user(parg, (void *)arg, _IOC_SIZE(cmd)))
+                if (copy_from_user(parg, (void __user *)arg, _IOC_SIZE(cmd)))
                         goto out;
                 break;
         }
@@ -69,7 +69,7 @@ int dvb_usercopy(struct inode *inode, struct file *file,
         {
         case _IOC_READ:
         case (_IOC_WRITE | _IOC_READ):
-                if (copy_to_user((void *)arg, parg, _IOC_SIZE(cmd)))
+                if (copy_to_user((void __user *)arg, parg, _IOC_SIZE(cmd)))
                         err = -EFAULT;
                 break;
         }

drivers/media/dvb/ttpci/av7110_av.c

@@ -487,7 +487,7 @@ static ssize_t dvb_play_kernel(struct av7110 *av7110, const u8 *buf,
 	return count - todo;
 }
 
-static ssize_t dvb_aplay(struct av7110 *av7110, const u8 *buf,
+static ssize_t dvb_aplay(struct av7110 *av7110, const u8 __user *buf,
 			 unsigned long count, int nonblock, int type)
 {
 	unsigned long todo = count, n;
@@ -896,7 +896,7 @@ static unsigned int dvb_video_poll(struct file *file, poll_table *wait)
 	return mask;
 }
 
-static ssize_t dvb_video_write(struct file *file, const char *buf,
+static ssize_t dvb_video_write(struct file *file, const char __user *buf,
 			       size_t count, loff_t *ppos)
 {
 	struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;
@@ -932,7 +932,7 @@ static unsigned int dvb_audio_poll(struct file *file, poll_table *wait)
 	return mask;
 }
 
-static ssize_t dvb_audio_write(struct file *file, const char *buf,
+static ssize_t dvb_audio_write(struct file *file, const char __user *buf,
 			       size_t count, loff_t *ppos)
 {
 	struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;
@@ -951,7 +951,7 @@ u8 iframe_header[] = { 0x00, 0x00, 0x01, 0xe0, 0x00, 0x00, 0x80, 0x00, 0x00 };
 
 #define MIN_IFRAME 400000
 
-static int play_iframe(struct av7110 *av7110, u8 *buf, unsigned int len, int nonblock)
+static int play_iframe(struct av7110 *av7110, u8 __user *buf, unsigned int len, int nonblock)
 {
 	int i, n;
 

drivers/media/dvb/ttpci/av7110_ca.c

@@ -142,7 +142,7 @@ int ci_ll_reset(struct dvb_ringbuffer *cibuf, struct file *file,
 }
 
 static ssize_t ci_ll_write(struct dvb_ringbuffer *cibuf, struct file *file,
-			   const char *buf, size_t count, loff_t *ppos)
+			   const char __user *buf, size_t count, loff_t *ppos)
 {
 	int free;
 	int non_blocking = file->f_flags & O_NONBLOCK;
@@ -181,7 +181,7 @@ static ssize_t ci_ll_write(struct dvb_ringbuffer *cibuf, struct file *file,
 }
 
 static ssize_t ci_ll_read(struct dvb_ringbuffer *cibuf, struct file *file,
-			  char *buf, size_t count, loff_t *ppos)
+			  char __user *buf, size_t count, loff_t *ppos)
 {
 	int avail;
 	int non_blocking = file->f_flags & O_NONBLOCK;
@@ -317,7 +317,7 @@ static int dvb_ca_ioctl(struct inode *inode, struct file *file,
 	return 0;
 }
 
-static ssize_t dvb_ca_write(struct file *file, const char *buf,
+static ssize_t dvb_ca_write(struct file *file, const char __user *buf,
 			    size_t count, loff_t *ppos)
 {
 	struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;
@@ -327,7 +327,7 @@ static ssize_t dvb_ca_write(struct file *file, const char *buf,
 	return ci_ll_write(&av7110->ci_wbuffer, file, buf, count, ppos);
 }
 
-static ssize_t dvb_ca_read(struct file *file, char *buf,
+static ssize_t dvb_ca_read(struct file *file, char __user *buf,
 			   size_t count, loff_t *ppos)
 {
 	struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;

drivers/media/dvb/ttpci/av7110_ir.c

@@ -138,7 +138,7 @@ static void input_repeat_key(unsigned long data)
 }
 
 
-static int av7110_ir_write_proc (struct file *file, const char *buffer,
+static int av7110_ir_write_proc (struct file *file, const char __user *buffer,
 	                  unsigned long count, void *data)
 {
 	char *page;

drivers/media/radio/miropcm20-rds.c

@@ -53,7 +53,7 @@ static void print_matrix(char *ch, char out[])
 	}
 }
 
-static ssize_t rds_f_read(struct file *file, char *buffer, size_t length, loff_t *offset)
+static ssize_t rds_f_read(struct file *file, char __user *buffer, size_t length, loff_t *offset)
 {
 //	i = sprintf(text_buffer, "length: %d, offset: %d\n", length, *offset);
 

drivers/media/radio/radio-cadet.c

@@ -323,7 +323,7 @@ void cadet_handler(unsigned long data)
 
 
 
-static ssize_t cadet_read(struct file *file, char *data,
+static ssize_t cadet_read(struct file *file, char __user *data,
 			  size_t count, loff_t *ppos)
 {
         int i=0;

drivers/media/video/bttv-driver.c

@@ -1068,7 +1068,7 @@ static void init_bt848(struct bttv *btv)
 	init_irqreg(btv);
 }
 
-extern void bttv_reinit_bt848(struct bttv *btv)
+void bttv_reinit_bt848(struct bttv *btv)
 {
 	unsigned long flags;
 
@@ -2261,7 +2261,7 @@ static int bttv_do_ioctl(struct inode *inode, struct file *file,
 		w2.w.width   = win->width;
 		w2.w.height  = win->height;
 		w2.clipcount = win->clipcount;
-		w2.clips     = (struct v4l2_clip*)win->clips;
+		w2.clips     = (struct v4l2_clip __user *)win->clips;
 		retval = setup_window(fh, btv, &w2, 0);
 		if (0 == retval) {
 			/* on v4l1 this ioctl affects the read() size too */
@@ -2821,7 +2821,7 @@ static int bttv_ioctl(struct inode *inode, struct file *file,
 	}
 }
 
-static ssize_t bttv_read(struct file *file, char *data,
+static ssize_t bttv_read(struct file *file, char __user *data,
 			 size_t count, loff_t *ppos)
 {
 	struct bttv_fh *fh = file->private_data;

drivers/media/video/bw-qcam.c

@@ -599,7 +599,7 @@ static inline int qc_readbytes(struct qcam_device *q, char buffer[])
  * n=2^(bit depth)-1.  Ask me for more details if you don't understand
  * this. */
 
-long qc_capture(struct qcam_device * q, char *buf, unsigned long len)
+long qc_capture(struct qcam_device * q, char __user *buf, unsigned long len)
 {
 	int i, j, k, yield;
 	int bytes;
@@ -855,7 +855,7 @@ static int qcam_ioctl(struct inode *inode, struct file *file,
 	return video_usercopy(inode, file, cmd, arg, qcam_do_ioctl);
 }
 
-static ssize_t qcam_read(struct file *file, char *buf,
+static ssize_t qcam_read(struct file *file, char __user *buf,
 			 size_t count, loff_t *ppos)
 {
 	struct video_device *v = video_devdata(file);

drivers/media/video/c-qcam.c

@@ -358,7 +358,7 @@ static unsigned int qcam_read_bytes(struct qcam_device *q, unsigned char *buf, u
 
 #define BUFSZ	150
 
-static long qc_capture(struct qcam_device *q, char *buf, unsigned long len)
+static long qc_capture(struct qcam_device *q, char __user *buf, unsigned long len)
 {
 	unsigned lines, pixelsperline, bitsperxfer;
 	unsigned int is_bi_dir = q->bidirectional;
@@ -667,7 +667,7 @@ static int qcam_ioctl(struct inode *inode, struct file *file,
 	return video_usercopy(inode, file, cmd, arg, qcam_do_ioctl);
 }
 
-static ssize_t qcam_read(struct file *file, char *buf,
+static ssize_t qcam_read(struct file *file, char __user *buf,
 			 size_t count, loff_t *ppos)
 {
 	struct video_device *v = video_devdata(file);

drivers/media/video/cpia.c

@@ -585,7 +585,7 @@ static unsigned long int value(char **buffer, unsigned long *count, int *err)
 	return ret;
 }
 
-static int cpia_write_proc(struct file *file, const char *buf,
+static int cpia_write_proc(struct file *file, const char __user *buf,
                            unsigned long count, void *data)
 {
 	struct cam_data *cam = data;
@@ -3299,7 +3299,7 @@ static int cpia_close(struct inode *inode, struct file *file)
 	return 0;
 }
 
-static ssize_t cpia_read(struct file *file, char *buf,
+static ssize_t cpia_read(struct file *file, char __user *buf,
 			 size_t count, loff_t *ppos)
 {
 	struct video_device *dev = file->private_data;

drivers/media/video/cx88/cx88-video.c

@@ -1279,7 +1279,7 @@ static int video_open(struct inode *inode, struct file *file)
 }
 
 static ssize_t
-video_read(struct file *file, char *data, size_t count, loff_t *ppos)
+video_read(struct file *file, char __user *data, size_t count, loff_t *ppos)
 {
 	struct cx8800_fh *fh = file->private_data;
 

drivers/media/video/pms.c

@@ -625,7 +625,7 @@ static void pms_vcrinput(short input)
 }
 
 
-static int pms_capture(struct pms_device *dev, char *buf, int rgb555, int count)
+static int pms_capture(struct pms_device *dev, char __user *buf, int rgb555, int count)
 {
 	int y;
 	int dw = 2*dev->width;
@@ -865,7 +865,7 @@ static int pms_ioctl(struct inode *inode, struct file *file,
 	return video_usercopy(inode, file, cmd, arg, pms_do_ioctl);
 }
 
-static int pms_read(struct file *file, char *buf,
+static int pms_read(struct file *file, char __user *buf,
 		    size_t count, loff_t *ppos)
 {
 	struct video_device *v = video_devdata(file);

drivers/media/video/saa7134/saa7134-oss.c

@@ -281,7 +281,7 @@ static int dsp_release(struct inode *inode, struct file *file)
 	return 0;
 }
 
-static ssize_t dsp_read(struct file *file, char *buffer,
+static ssize_t dsp_read(struct file *file, char __user *buffer,
 			size_t count, loff_t *ppos)
 {
 	struct saa7134_dev *dev = file->private_data;
@@ -354,7 +354,7 @@ static ssize_t dsp_read(struct file *file, char *buffer,
 	return ret;
 }
 
-static ssize_t dsp_write(struct file *file, const char *buffer,
+static ssize_t dsp_write(struct file *file, const char __user *buffer,
 			 size_t count, loff_t *ppos)
 {
 	return -EINVAL;
@@ -364,25 +364,27 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 		     unsigned int cmd, unsigned long arg)
 {
 	struct saa7134_dev *dev = file->private_data;
+	void __user *argp = (void __user *) arg;
+	int __user *p = argp;
 	int val = 0;
 	
 	if (oss_debug > 1)
 		saa7134_print_ioctl(dev->name,cmd);
         switch (cmd) {
         case OSS_GETVERSION:
-                return put_user(SOUND_VERSION, (int *)arg);
+                return put_user(SOUND_VERSION, p);
         case SNDCTL_DSP_GETCAPS:
 		return 0;
 
         case SNDCTL_DSP_SPEED:
-		if (get_user(val, (int*)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		/* fall through */
         case SOUND_PCM_READ_RATE:
-		return put_user(dev->oss.rate, (int*)arg);
+		return put_user(dev->oss.rate, p);
 
         case SNDCTL_DSP_STEREO:
-		if (get_user(val, (int*)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		down(&dev->oss.lock);
 		dev->oss.channels = val ? 2 : 1;
@@ -391,10 +393,10 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 			dsp_rec_start(dev);
 		}
 		up(&dev->oss.lock);
-		return put_user(dev->oss.channels-1, (int *)arg);
+		return put_user(dev->oss.channels-1, p);
 
         case SNDCTL_DSP_CHANNELS:
-		if (get_user(val, (int*)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		if (val != 1 && val != 2)
 			return -EINVAL;
@@ -407,15 +409,15 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 		up(&dev->oss.lock);
 		/* fall through */
         case SOUND_PCM_READ_CHANNELS:
-		return put_user(dev->oss.channels, (int *)arg);
+		return put_user(dev->oss.channels, p);
 		
         case SNDCTL_DSP_GETFMTS: /* Returns a mask */
 		return put_user(AFMT_U8     | AFMT_S8     |
 				AFMT_U16_LE | AFMT_U16_BE |
-				AFMT_S16_LE | AFMT_S16_BE, (int*)arg);
+				AFMT_S16_LE | AFMT_S16_BE, p);
 
         case SNDCTL_DSP_SETFMT: /* Selects ONE fmt */
-		if (get_user(val, (int*)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		switch (val) {
 		case AFMT_QUERY:
@@ -434,7 +436,7 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 				dsp_rec_start(dev);
 			}
 			up(&dev->oss.lock);
-			return put_user(dev->oss.afmt,(int*)arg);
+			return put_user(dev->oss.afmt, p);
 		default:
 			return -EINVAL;
 		}
@@ -443,12 +445,12 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 		switch (dev->oss.afmt) {
 		case AFMT_U8:
 		case AFMT_S8:
-			return put_user(8, (int*)arg);
+			return put_user(8, p);
 		case AFMT_U16_LE:
 		case AFMT_U16_BE:
 		case AFMT_S16_LE:
 		case AFMT_S16_BE:
-			return put_user(16, (int*)arg);
+			return put_user(16, p);
 		default:
 			return -EINVAL;
 		}
@@ -464,15 +466,16 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 		up(&dev->oss.lock);
 		return 0;
         case SNDCTL_DSP_GETBLKSIZE:
-		return put_user(dev->oss.blksize,(int*)arg);
+		return put_user(dev->oss.blksize, p);
 
         case SNDCTL_DSP_SETFRAGMENT:
-		if (get_user(val, (int*)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		if (dev->oss.recording_on)
 			return -EBUSY;
 		dsp_buffer_free(dev);
-		dsp_buffer_conf(dev,1 << (val & 0xffff), (arg >> 16) & 0xffff);
+		/* used to be arg >> 16 instead of val >> 16; fixed */
+		dsp_buffer_conf(dev,1 << (val & 0xffff), (val >> 16) & 0xffff);
 		dsp_buffer_init(dev);
 		return 0;
 
@@ -487,7 +490,7 @@ static int dsp_ioctl(struct inode *inode, struct file *file,
 		info.fragstotal = dev->oss.blocks;
 		info.bytes      = dev->oss.read_count;
 		info.fragments  = info.bytes / info.fragsize;
-		if (copy_to_user((void *)arg, &info, sizeof(info)))
+		if (copy_to_user(argp, &info, sizeof(info)))
 			return -EFAULT;
 		return 0;
 	}
@@ -648,12 +651,14 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
 	struct saa7134_dev *dev = file->private_data;
 	enum saa7134_audio_in input;
 	int val,ret;
+	void __user *argp = (void __user *) arg;
+	int __user *p = argp;
 	
 	if (oss_debug > 1)
 		saa7134_print_ioctl(dev->name,cmd);
         switch (cmd) {
         case OSS_GETVERSION:
-                return put_user(SOUND_VERSION, (int *)arg);
+                return put_user(SOUND_VERSION, p);
 	case SOUND_MIXER_INFO:
 	{
 		mixer_info info;
@@ -661,7 +666,7 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
                 strlcpy(info.id,   "TV audio", sizeof(info.id));
                 strlcpy(info.name, dev->name,  sizeof(info.name));
                 info.modify_counter = dev->oss.count;
-                if (copy_to_user((void *)arg, &info, sizeof(info)))
+                if (copy_to_user(argp, &info, sizeof(info)))
                         return -EFAULT;
 		return 0;
 	}
@@ -671,23 +676,23 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
 		memset(&info,0,sizeof(info));
                 strlcpy(info.id,   "TV audio", sizeof(info.id));
                 strlcpy(info.name, dev->name,  sizeof(info.name));
-                if (copy_to_user((void *)arg, &info, sizeof(info)))
+                if (copy_to_user(argp, &info, sizeof(info)))
                         return -EFAULT;
 		return 0;
 	}
 	case MIXER_READ(SOUND_MIXER_CAPS):
-		return put_user(SOUND_CAP_EXCL_INPUT,(int*)arg);
+		return put_user(SOUND_CAP_EXCL_INPUT, p);
 	case MIXER_READ(SOUND_MIXER_STEREODEVS):
-		return put_user(0,(int*)arg);
+		return put_user(0, p);
 	case MIXER_READ(SOUND_MIXER_RECMASK):
 	case MIXER_READ(SOUND_MIXER_DEVMASK):
 		val = SOUND_MASK_LINE1 | SOUND_MASK_LINE2;
 		if (32000 == dev->oss.rate)
 			val |= SOUND_MASK_VIDEO;
-		return put_user(val,(int*)arg);
+		return put_user(val, p);
 
 	case MIXER_WRITE(SOUND_MIXER_RECSRC):
-		if (get_user(val, (int *)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		input = dev->oss.input;
 		if (32000 == dev->oss.rate  &&
@@ -707,16 +712,16 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
 		case LINE2: ret = SOUND_MASK_LINE2; break;
 		default:    ret = 0;
 		}
-		return put_user(ret,(int*)arg);
+		return put_user(ret, p);
 
 	case MIXER_WRITE(SOUND_MIXER_VIDEO):
 	case MIXER_READ(SOUND_MIXER_VIDEO):
 		if (32000 != dev->oss.rate)
 			return -EINVAL;
-		return put_user(100 | 100 << 8,(int*)arg);
+		return put_user(100 | 100 << 8, p);
 
 	case MIXER_WRITE(SOUND_MIXER_LINE1):
-		if (get_user(val, (int *)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		val &= 0xff;
 		val = (val <= 50) ? 50 : 100;
@@ -724,11 +729,10 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
 		mixer_level(dev,LINE1,dev->oss.line1);
 		/* fall throuth */
 	case MIXER_READ(SOUND_MIXER_LINE1):
-		return put_user(dev->oss.line1 | dev->oss.line1 << 8,
-				(int*)arg);
+		return put_user(dev->oss.line1 | dev->oss.line1 << 8, p);
 
 	case MIXER_WRITE(SOUND_MIXER_LINE2):
-		if (get_user(val, (int *)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 		val &= 0xff;
 		val = (val <= 50) ? 50 : 100;
@@ -736,8 +740,7 @@ static int mixer_ioctl(struct inode *inode, struct file *file,
 		mixer_level(dev,LINE2,dev->oss.line2);
 		/* fall throuth */
 	case MIXER_READ(SOUND_MIXER_LINE2):
-		return put_user(dev->oss.line2 | dev->oss.line2 << 8,
-				(int*)arg);
+		return put_user(dev->oss.line2 | dev->oss.line2 << 8, p);
 
 	default:
 		return -EINVAL;

drivers/media/video/saa7134/saa7134-ts.c

@@ -241,7 +241,7 @@ static int ts_release(struct inode *inode, struct file *file)
 }
 
 static ssize_t
-ts_read(struct file *file, char *data, size_t count, loff_t *ppos)
+ts_read(struct file *file, char __user *data, size_t count, loff_t *ppos)
 {
 	struct saa7134_dev *dev = file->private_data;
 

drivers/media/video/saa7134/saa7134-video.c

@@ -1238,7 +1238,7 @@ static int video_open(struct inode *inode, struct file *file)
 }
 
 static ssize_t
-video_read(struct file *file, char *data, size_t count, loff_t *ppos)
+video_read(struct file *file, char __user *data, size_t count, loff_t *ppos)
 {
 	struct saa7134_fh *fh = file->private_data;
 

drivers/media/video/stradis.c

@@ -1322,7 +1322,7 @@ static int saa_ioctl(struct inode *inode, struct file *file,
 		     unsigned int cmd, unsigned long argl)
 {
 	struct saa7146 *saa = file->private_data;
-	void *arg = (void *)argl;
+	void __user *arg = (void __user *)argl;
 
 	switch (cmd) {
 	case VIDIOCGCAP:
@@ -1580,7 +1580,7 @@ static int saa_ioctl(struct inode *inode, struct file *file,
 			vu.radio = VIDEO_NO_UNIT;
 			vu.audio = VIDEO_NO_UNIT;
 			vu.teletext = VIDEO_NO_UNIT;
-			if (copy_to_user((void *) arg, (void *) &vu, sizeof(vu)))
+			if (copy_to_user(arg, &vu, sizeof(vu)))
 				return -EFAULT;
 			return 0;
 		}
@@ -1754,16 +1754,14 @@ static int saa_ioctl(struct inode *inode, struct file *file,
 			struct video_code ucode;
 			__u8 *udata;
 			int i;
-			if (copy_from_user((void *) &ucode, arg,
-			    sizeof(ucode)))
+			if (copy_from_user(&ucode, arg, sizeof(ucode)))
 				return -EFAULT;
 			if (ucode.datasize > 65536 || ucode.datasize < 1024 ||
 			    strncmp(ucode.loadwhat, "dec", 3))
 				return -EINVAL;
 			if ((udata = vmalloc(ucode.datasize)) == NULL)
 				return -ENOMEM;
-			if (copy_from_user((void *) udata, ucode.data,
-			    ucode.datasize)) {
+			if (copy_from_user(udata, ucode.data, ucode.datasize)) {
 				vfree(udata);
 				return -EFAULT;
 			}
@@ -1814,13 +1812,13 @@ static int saa_mmap(struct file *file, struct vm_area_struct *vma)
 	return -EINVAL;
 }
 
-static ssize_t saa_read(struct file *file, char *buf,
+static ssize_t saa_read(struct file *file, char __user *buf,
 			size_t count, loff_t *ppos)
 {
 	return -EINVAL;
 }
 
-static ssize_t saa_write(struct file *file, const char *buf,
+static ssize_t saa_write(struct file *file, const char __user *buf,
 			 size_t count, loff_t *ppos)
 {
 	struct saa7146 *saa = file->private_data;

drivers/media/video/tvmixer.c

@@ -77,6 +77,8 @@ static int tvmixer_ioctl(struct inode *inode, struct file *file, unsigned int cm
 	int left,right,ret,val = 0;
         struct TVMIXER *mix = file->private_data;
 	struct i2c_client *client = mix->dev;
+	void __user *argp = (void __user *)arg;
+	int __user *p = argp;
 
 	if (NULL == client)
 		return -ENODEV;
@@ -86,7 +88,7 @@ static int tvmixer_ioctl(struct inode *inode, struct file *file, unsigned int cm
                 strlcpy(info.id, "tv card", sizeof(info.id));
                 strlcpy(info.name, i2c_clientname(client), sizeof(info.name));
                 info.modify_counter = 42 /* FIXME */;
-                if (copy_to_user((void *)arg, &info, sizeof(info)))
+                if (copy_to_user(argp, &info, sizeof(info)))
                         return -EFAULT;
                 return 0;
         }
@@ -94,15 +96,15 @@ static int tvmixer_ioctl(struct inode *inode, struct file *file, unsigned int cm
                 _old_mixer_info info;
                 strlcpy(info.id, "tv card", sizeof(info.id));
                 strlcpy(info.name, i2c_clientname(client), sizeof(info.name));
-                if (copy_to_user((void *)arg, &info, sizeof(info)))
+                if (copy_to_user(argp, &info, sizeof(info)))
                         return -EFAULT;
                 return 0;
         }
         if (cmd == OSS_GETVERSION)
-                return put_user(SOUND_VERSION, (int *)arg);
+                return put_user(SOUND_VERSION, p);
 
 	if (_SIOC_DIR(cmd) & _SIOC_WRITE)
-		if (get_user(val, (int *)arg))
+		if (get_user(val, p))
 			return -EFAULT;
 
 	/* read state */
@@ -168,7 +170,7 @@ static int tvmixer_ioctl(struct inode *inode, struct file *file, unsigned int cm
 	default:
 		return -EINVAL;
 	}
-	if (put_user(ret, (int *)arg))
+	if (put_user(ret, p))
 		return -EFAULT;
 	return 0;
 }

drivers/media/video/v4l1-compat.c

@@ -490,7 +490,7 @@ v4l_compat_translate_ioctl(struct inode         *inode,
 		fmt2->fmt.win.w.width   = win->width;
 		fmt2->fmt.win.w.height  = win->height;
 		fmt2->fmt.win.chromakey = win->chromakey;
-		fmt2->fmt.win.clips     = (void *)win->clips;
+		fmt2->fmt.win.clips     = (void __user *)win->clips;
 		fmt2->fmt.win.clipcount = win->clipcount;
 		err2 = drv(inode, file, VIDIOC_S_FMT, fmt2);
 		if (err2 < 0)

drivers/media/video/video-buf.c

@@ -735,7 +735,7 @@ int videobuf_streamoff(struct file *file, struct videobuf_queue *q)
 
 static ssize_t
 videobuf_read_zerocopy(struct file *file, struct videobuf_queue *q,
-		       char *data, size_t count, loff_t *ppos)
+		       char __user *data, size_t count, loff_t *ppos)
 {
 	enum v4l2_field field;
 	unsigned long flags;
@@ -777,7 +777,7 @@ videobuf_read_zerocopy(struct file *file, struct videobuf_queue *q,
 }
 
 ssize_t videobuf_read_one(struct file *file, struct videobuf_queue *q,
-			  char *data, size_t count, loff_t *ppos)
+			  char __user *data, size_t count, loff_t *ppos)
 {
 	enum v4l2_field field;
 	unsigned long flags;
@@ -901,7 +901,7 @@ void videobuf_read_stop(struct file *file, struct videobuf_queue *q)
 }
 
 ssize_t videobuf_read_stream(struct file *file, struct videobuf_queue *q,
-			     char *data, size_t count, loff_t *ppos,
+			     char __user *data, size_t count, loff_t *ppos,
 			     int vbihack)
 {
 	unsigned int *fc, bytes;

drivers/media/video/videodev.c

@@ -183,7 +183,7 @@ video_usercopy(struct inode *inode, struct file *file,
 	/*  Copy arguments into temp kernel buffer  */
 	switch (_IOC_DIR(cmd)) {
 	case _IOC_NONE:
-		parg = (void *)arg;
+		parg = NULL;
 		break;
 	case _IOC_READ:
 	case _IOC_WRITE:
@@ -200,7 +200,7 @@ video_usercopy(struct inode *inode, struct file *file,
 		
 		err = -EFAULT;
 		if (_IOC_DIR(cmd) & _IOC_WRITE)
-			if (copy_from_user(parg, (void *)arg, _IOC_SIZE(cmd)))
+			if (copy_from_user(parg, (void __user *)arg, _IOC_SIZE(cmd)))
 				goto out;
 		break;
 	}
@@ -217,7 +217,7 @@ video_usercopy(struct inode *inode, struct file *file,
 	{
 	case _IOC_READ:
 	case (_IOC_WRITE | _IOC_READ):
-		if (copy_to_user((void *)arg, parg, _IOC_SIZE(cmd)))
+		if (copy_to_user((void __user *)arg, parg, _IOC_SIZE(cmd)))
 			err = -EFAULT;
 		break;
 	}
@@ -231,7 +231,7 @@ video_usercopy(struct inode *inode, struct file *file,
 /*
  * open/release helper functions -- handle exclusive opens
  */
-extern int video_exclusive_open(struct inode *inode, struct file *file)
+int video_exclusive_open(struct inode *inode, struct file *file)
 {
 	struct  video_device *vfl = video_devdata(file);
 	int retval = 0;
@@ -246,7 +246,7 @@ extern int video_exclusive_open(struct inode *inode, struct file *file)
 	return retval;
 }
 
-extern int video_exclusive_release(struct inode *inode, struct file *file)
+int video_exclusive_release(struct inode *inode, struct file *file)
 {
 	struct  video_device *vfl = video_devdata(file);
 	

drivers/media/video/w9966.c

@@ -179,7 +179,7 @@ static int w9966_i2c_rbyte(struct w9966_dev* cam);
 
 static int w9966_v4l_ioctl(struct inode *inode, struct file *file,
 			   unsigned int cmd, unsigned long arg);
-static ssize_t w9966_v4l_read(struct file *file, char *buf,
+static ssize_t w9966_v4l_read(struct file *file, char __user *buf,
 			      size_t count, loff_t *ppos);
 
 static struct file_operations w9966_fops = {
@@ -555,6 +555,14 @@ static inline void w9966_i2c_setsda(struct w9966_dev* cam, int state)
 	udelay(5);
 }
 
+// Get peripheral clock line
+// Expects a claimed pdev.
+static inline int w9966_i2c_getscl(struct w9966_dev* cam)
+{
+	const unsigned char state = w9966_rReg(cam, 0x18);
+	return ((state & W9966_I2C_R_CLOCK) > 0);
+}
+
 // Sets the clock line on the i2c bus.
 // Expects a claimed pdev. -1 on error
 static inline int w9966_i2c_setscl(struct w9966_dev* cam, int state)
@@ -588,14 +596,6 @@ static inline int w9966_i2c_getsda(struct w9966_dev* cam)
 	return ((state & W9966_I2C_R_DATA) > 0);
 }
 
-// Get peripheral clock line
-// Expects a claimed pdev.
-static inline int w9966_i2c_getscl(struct w9966_dev* cam)
-{
-	const unsigned char state = w9966_rReg(cam, 0x18);
-	return ((state & W9966_I2C_R_CLOCK) > 0);
-}
-
 // Write a byte with ack to the i2c bus.
 // Expects a claimed pdev. -1 on error
 static int w9966_i2c_wbyte(struct w9966_dev* cam, int data)
@@ -867,13 +867,13 @@ static int w9966_v4l_ioctl(struct inode *inode, struct file *file,
 }
 
 // Capture data
-static ssize_t w9966_v4l_read(struct file *file, char *buf,
+static ssize_t w9966_v4l_read(struct file *file, char  __user *buf,
 			      size_t count, loff_t *ppos)
 {
 	struct video_device *vdev = video_devdata(file);
 	struct w9966_dev *cam = (struct w9966_dev *)vdev->priv;
 	unsigned char addr = 0xa0;	// ECP, read, CCD-transfer, 00000
-	unsigned char* dest = (unsigned char*)buf;
+	unsigned char __user *dest = (unsigned char __user *)buf;
 	unsigned long dleft = count;
 	unsigned char *tbuf;
 	

drivers/media/video/zoran_driver.c

@@ -1470,7 +1470,7 @@ zoran_close (struct inode *inode,
 
 static ssize_t
 zoran_read (struct file *file,
-	    char        *data,
+	    char        __user *data,
 	    size_t       count,
 	    loff_t      *ppos)
 {
@@ -1481,7 +1481,7 @@ zoran_read (struct file *file,
 
 static ssize_t
 zoran_write (struct file *file,
-	     const char  *data,
+	     const char  __user *data,
 	     size_t       count,
 	     loff_t      *ppos)
 {
@@ -1567,9 +1567,9 @@ setup_window (struct file       *file,
 	      int                y,
 	      int                width,
 	      int                height,
-	      struct video_clip *clips,
+	      struct video_clip __user *clips,
 	      int                clipcount,
-	      void              *bitmap)
+	      void              __user *bitmap)
 {
 	struct zoran_fh *fh = file->private_data;
 	struct zoran *zr = fh->zr;
@@ -2871,7 +2871,7 @@ zoran_do_ioctl (struct inode *inode,
 					 fmt->fmt.win.w.top,
 					 fmt->fmt.win.w.width,
 					 fmt->fmt.win.w.height,
-					 (struct video_clip *)
+					 (struct video_clip __user *)
 					   fmt->fmt.win.clips,
 					 fmt->fmt.win.clipcount,
 					 fmt->fmt.win.bitmap);

drivers/media/video/zoran_procfs.c

@@ -196,7 +196,7 @@ zoran_read_proc (char  *buffer,
 
 static int
 zoran_write_proc (struct file   *file,
-		  const char    *buffer,
+		  const char    __user *buffer,
 		  unsigned long  count,
 		  void          *data)
 {

include/linux/dvb/osd.h

@@ -101,7 +101,7 @@ typedef struct osd_cmd_s {
         int x1;
         int y1;
         int color;
-        void *data;
+        void __user *data;
 } osd_cmd_t;
 
 

include/linux/dvb/video.h

@@ -100,7 +100,7 @@ struct video_status {
 
 
 struct video_still_picture {
-        char *iFrame;        /* pointer to a single iframe in memory */
+        char __user *iFrame;        /* pointer to a single iframe in memory */
         int32_t size; 
 };
 

include/linux/videodev.h

@@ -222,7 +222,7 @@ struct video_window
 	__u32	width,height;		/* Its size */
 	__u32	chromakey;
 	__u32	flags;
-	struct	video_clip *clips;	/* Set only */
+	struct	video_clip __user *clips;	/* Set only */
 	int	clipcount;
 #define VIDEO_WINDOW_INTERLACE	1
 #define VIDEO_WINDOW_CHROMAKEY	16	/* Overlay by chromakey */

include/linux/videodev2.h

@@ -433,9 +433,9 @@ struct v4l2_window
 	struct v4l2_rect        w;
 	enum v4l2_field  	field;
 	__u32			chromakey;
-	struct v4l2_clip	*clips;
+	struct v4l2_clip	__user *clips;
 	__u32			clipcount;
-	void			*bitmap;
+	void			__user *bitmap;
 };
 
 

include/linux/videotext.h

@@ -71,7 +71,7 @@ typedef struct
 	int pgbuf;	/* buffer where page will be stored */
 	int start;	/* start of requested part of page */
 	int end;	/* end of requested part of page */
-	void *buffer;	/* pointer to beginning of destination buffer */
+	void __user *buffer;	/* pointer to beginning of destination buffer */
 }
 vtx_pagereq_t;
 

include/media/saa7146_vv.h

@@ -184,7 +184,7 @@ struct saa7146_use_ops  {
         int(*open)(struct saa7146_dev *, struct file *);
         void (*release)(struct saa7146_dev *, struct file *);
         void (*irq_done)(struct saa7146_dev *, unsigned long status);
-	ssize_t (*read)(struct file *, char *, size_t, loff_t *);
+	ssize_t (*read)(struct file *, char __user *, size_t, loff_t *);
 };
 
 /* from saa7146_fops.c */

include/media/video-buf.h

@@ -226,10 +226,10 @@ int videobuf_streamoff(struct file *file, struct videobuf_queue *q);
 int videobuf_read_start(struct file *file, struct videobuf_queue *q);
 void videobuf_read_stop(struct file *file, struct videobuf_queue *q);
 ssize_t videobuf_read_stream(struct file *file, struct videobuf_queue *q,
-			     char *data, size_t count, loff_t *ppos,
+			     char __user *data, size_t count, loff_t *ppos,
 			     int vbihack);
 ssize_t videobuf_read_one(struct file *file, struct videobuf_queue *q,
-			  char *data, size_t count, loff_t *ppos);
+			  char __user *data, size_t count, loff_t *ppos);
 unsigned int videobuf_poll_stream(struct file *file,
 				  struct videobuf_queue *q,
 				  poll_table *wait);