[PATCH] sparse: drivers/video partial annotation

misc annotation in drivers/video/* (nowhere near complete)

drivers/video/fbmem.c

@@ -802,7 +802,7 @@ static int fbmem_read_proc(char *buf, char **start, off_t offset,
 }
 
 static ssize_t
-fb_read(struct file *file, char *buf, size_t count, loff_t *ppos)
+fb_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
 	unsigned long p = *ppos;
 	struct inode *inode = file->f_dentry->d_inode;
@@ -839,7 +839,7 @@ fb_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 }
 
 static ssize_t
-fb_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
+fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 {
 	unsigned long p = *ppos;
 	struct inode *inode = file->f_dentry->d_inode;

drivers/video/imsttfb.c

@@ -1267,48 +1267,49 @@ imsttfb_ioctl(struct inode *inode, struct file *file, u_int cmd,
 	      u_long arg, struct fb_info *info)
 {
 	struct imstt_par *par = (struct imstt_par *) info->par;
+	void __user *argp = (void __user *)arg;
 	__u32 reg[2];
 	__u8 idx[2];
 
 	switch (cmd) {
 		case FBIMSTT_SETREG:
-			if (copy_from_user(reg, (void *)arg, 8) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
+			if (copy_from_user(reg, argp, 8) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
 				return -EFAULT;
 			write_reg_le32(par->dc_regs, reg[0], reg[1]);
 			return 0;
 		case FBIMSTT_GETREG:
-			if (copy_from_user(reg, (void *)arg, 4) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
+			if (copy_from_user(reg, argp, 4) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
 				return -EFAULT;
 			reg[1] = read_reg_le32(par->dc_regs, reg[0]);
-			if (copy_to_user((void *)(arg + 4), &reg[1], 4))
+			if (copy_to_user((void __user *)(arg + 4), &reg[1], 4))
 				return -EFAULT;
 			return 0;
 		case FBIMSTT_SETCMAPREG:
-			if (copy_from_user(reg, (void *)arg, 8) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
+			if (copy_from_user(reg, argp, 8) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
 				return -EFAULT;
 			write_reg_le32(((u_int *)par->cmap_regs), reg[0], reg[1]);
 			return 0;
 		case FBIMSTT_GETCMAPREG:
-			if (copy_from_user(reg, (void *)arg, 4) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
+			if (copy_from_user(reg, argp, 4) || reg[0] > (0x1000 - sizeof(reg[0])) / sizeof(reg[0]))
 				return -EFAULT;
 			reg[1] = read_reg_le32(((u_int *)par->cmap_regs), reg[0]);
-			if (copy_to_user((void *)(arg + 4), &reg[1], 4))
+			if (copy_to_user((void __user *)(arg + 4), &reg[1], 4))
 				return -EFAULT;
 			return 0;
 		case FBIMSTT_SETIDXREG:
-			if (copy_from_user(idx, (void *)arg, 2))
+			if (copy_from_user(idx, argp, 2))
 				return -EFAULT;
 			par->cmap_regs[PIDXHI] = 0;		eieio();
 			par->cmap_regs[PIDXLO] = idx[0];	eieio();
 			par->cmap_regs[PIDXDATA] = idx[1];	eieio();
 			return 0;
 		case FBIMSTT_GETIDXREG:
-			if (copy_from_user(idx, (void *)arg, 1))
+			if (copy_from_user(idx, argp, 1))
 				return -EFAULT;
 			par->cmap_regs[PIDXHI] = 0;		eieio();
 			par->cmap_regs[PIDXLO] = idx[0];	eieio();
 			idx[1] = par->cmap_regs[PIDXDATA];
-			if (copy_to_user((void *)(arg + 1), &idx[1], 1))
+			if (copy_to_user((void __user *)(arg + 1), &idx[1], 1))
 				return -EFAULT;
 			return 0;
 		default:

drivers/video/radeonfb.c

@@ -1544,7 +1544,7 @@ static int radeonfb_ioctl (struct inode *inode, struct file *file, unsigned int
 					break;
 			}
 
-			rc = get_user(value, (__u32*)arg);
+			rc = get_user(value, (__u32 __user *)arg);
 
 			if (rc)
 				return rc;
@@ -1598,7 +1598,7 @@ static int radeonfb_ioctl (struct inode *inode, struct file *file, unsigned int
 			if (CRTC_CRT_ON & tmp)
 				value |= 0x02;
 
-			return put_user(value, (__u32*)arg);
+			return put_user(value, (__u32 __user *)arg);
 		default:
 			return -EINVAL;
 	}

drivers/video/sstfb.c

@@ -790,7 +790,7 @@ static int sstfb_ioctl(struct inode *inode, struct file *file,
 		
 	/* fills lfb with #arg pixels */
 	case _IOW('F', 0xdc, u32):	/* 0x46dc */
-		if (copy_from_user(&val, (void *)arg, sizeof(val)))
+		if (copy_from_user(&val, (void __user *)arg, sizeof(val)))
 			return -EFAULT;
 		if (val > info->fix.smem_len)
 			val = info->fix.smem_len;
@@ -801,7 +801,7 @@ static int sstfb_ioctl(struct inode *inode, struct file *file,
 		
 	/* change VGA pass_through mode */
 	case _IOW('F', 0xdd, u32):	/* 0x46dd */
-		if (copy_from_user(&val, (void *)arg, sizeof(val)))
+		if (copy_from_user(&val, (void __user *)arg, sizeof(val)))
 			return -EFAULT;
 		pci_read_config_dword(sst_dev, PCI_INIT_ENABLE, &tmp);
 		pci_write_config_dword(sst_dev, PCI_INIT_ENABLE,

include/linux/fb.h

@@ -458,8 +458,8 @@ struct fb_ops {
 	/* For framebuffers with strange non linear layouts or that do not
 	 * work with normal memory mapped access
 	 */
-	ssize_t (*fb_read)(struct file *file, char *buf, size_t count, loff_t *ppos);
-	ssize_t (*fb_write)(struct file *file, const char *buf, size_t count, loff_t *ppos);
+	ssize_t (*fb_read)(struct file *file, char __user *buf, size_t count, loff_t *ppos);
+	ssize_t (*fb_write)(struct file *file, const char __user *buf, size_t count, loff_t *ppos);
 
 	/* checks var and eventually tweaks it to something supported,
 	 * DO NOT MODIFY PAR */