[PATCH] sparse: drivers/isdn/* annotation

drivers/isdn/act2000/act2000.h

@@ -15,6 +15,8 @@
 #ifndef act2000_h
 #define act2000_h
 
+#include <linux/compiler.h>
+
 #define ACT2000_IOCTL_SETPORT    1
 #define ACT2000_IOCTL_GETPORT    2
 #define ACT2000_IOCTL_SETIRQ     3
@@ -46,7 +48,7 @@ typedef struct act2000_cdef {
 /* Struct for downloading firmware */
 typedef struct act2000_ddef {
         int length;             /* Length of code */
-        char *buffer;           /* Ptr. to code   */
+        char __user *buffer;    /* Ptr. to code   */
 } act2000_ddef;
 
 typedef struct act2000_fwid {

drivers/isdn/act2000/act2000_isa.c

@@ -405,7 +405,7 @@ act2000_isa_getid(act2000_card * card)
  * Download microcode into card, check Firmware signature.
  */
 int
-act2000_isa_download(act2000_card * card, act2000_ddef * cb)
+act2000_isa_download(act2000_card * card, act2000_ddef __user * cb)
 {
         unsigned int length;
         int ret;
@@ -413,18 +413,18 @@ act2000_isa_download(act2000_card * card, act2000_ddef * cb)
         int c;
         long timeout;
         u_char *b;
-        u_char *p;
+        u_char __user *p;
         u_char *buf;
         act2000_ddef cblock;
 
         if (!act2000_isa_reset(card->port))
                 return -ENXIO;
         act2000_isa_delay(HZ / 2);
-        if(copy_from_user(&cblock, (char *) cb, sizeof(cblock)))
+        if(copy_from_user(&cblock, cb, sizeof(cblock)))
         	return -EFAULT;
         length = cblock.length;
         p = cblock.buffer;
-        if ((ret = verify_area(VERIFY_READ, (void *) p, length)))
+        if ((ret = verify_area(VERIFY_READ, p, length)))
                 return ret;
         buf = (u_char *) kmalloc(1024, GFP_KERNEL);
         if (!buf)

drivers/isdn/act2000/act2000_isa.h

@@ -128,7 +128,7 @@ typedef enum {
 extern int act2000_isa_detect(unsigned short portbase);
 extern int act2000_isa_config_irq(act2000_card * card, short irq);
 extern int act2000_isa_config_port(act2000_card * card, unsigned short portbase);
-extern int act2000_isa_download(act2000_card * card, act2000_ddef * cb);
+extern int act2000_isa_download(act2000_card * card, act2000_ddef __user * cb);
 extern void act2000_isa_release(act2000_card * card);
 extern void act2000_isa_receive(act2000_card *card);
 extern void act2000_isa_send(act2000_card *card);

drivers/isdn/act2000/module.c

@@ -243,16 +243,18 @@ act2000_command(act2000_card * card, isdn_ctrl * c)
 	char tmp[17];
 	int ret;
 	unsigned long flags;
+	void __user *arg;
  
         switch (c->command) {
 		case ISDN_CMD_IOCTL:
 			memcpy(&a, c->parm.num, sizeof(ulong));
+			arg = (void __user *)a;
 			switch (c->arg) {
 				case ACT2000_IOCTL_LOADBOOT:
 					switch (card->bus) {
 						case ACT2000_BUS_ISA:
 							ret = act2000_isa_download(card,
-									   (act2000_ddef *)a);
+									   arg);
 							if (!ret) {
 								card->flags |= ACT2000_FLAGS_LOADED;
 								if (!(card->flags & ACT2000_FLAGS_IVALID)) {
@@ -278,7 +280,7 @@ act2000_command(act2000_card * card, isdn_ctrl * c)
 					actcapi_manufacturer_req_net(card);
 					return 0;
 				case ACT2000_IOCTL_SETMSN:
-					if (copy_from_user(tmp, (char *)a,
+					if (copy_from_user(tmp, arg,
 							   sizeof(tmp)))
 						return -EFAULT;
 					if ((ret = act2000_set_msn(card, tmp)))
@@ -287,7 +289,7 @@ act2000_command(act2000_card * card, isdn_ctrl * c)
 						return(actcapi_manufacturer_req_msn(card));
 					return 0;
 				case ACT2000_IOCTL_ADDCARD:
-					if (copy_from_user(&cdef, (char *)a,
+					if (copy_from_user(&cdef, arg,
 							   sizeof(cdef)))
 						return -EFAULT;
 					if (act2000_addcard(cdef.bus, cdef.port, cdef.irq, cdef.id))

drivers/isdn/capi/capi.c

@@ -878,8 +878,7 @@ capi_ioctl(struct inode *inode, struct file *file,
 			struct capi_manufacturer_cmd mcmd;
 			if (!capable(CAP_SYS_ADMIN))
 				return -EPERM;
-			if (copy_from_user(&mcmd, argp,
-					   sizeof(mcmd)))
+			if (copy_from_user(&mcmd, argp, sizeof(mcmd)))
 				return -EFAULT;
 			return capi20_manufacturer(mcmd.cmd, mcmd.data);
 		}

drivers/isdn/capi/kcapi.c

@@ -711,7 +711,7 @@ u16 capi20_get_profile(u32 contr, struct capi_profile *profp)
 EXPORT_SYMBOL(capi20_get_profile);
 
 #ifdef CONFIG_AVMB1_COMPAT
-static int old_capi_manufacturer(unsigned int cmd, void *data)
+static int old_capi_manufacturer(unsigned int cmd, void __user *data)
 {
 	avmb1_loadandconfigdef ldef;
 	avmb1_extcarddef cdef;
@@ -728,12 +728,12 @@ static int old_capi_manufacturer(unsigned int cmd, void *data)
 	case AVMB1_ADDCARD:
 	case AVMB1_ADDCARD_WITH_TYPE:
 		if (cmd == AVMB1_ADDCARD) {
-		   if ((retval = copy_from_user((void *) &cdef, data,
+		   if ((retval = copy_from_user(&cdef, data,
 					    sizeof(avmb1_carddef))))
 			   return retval;
 		   cdef.cardtype = AVM_CARDTYPE_B1;
 		} else {
-		   if ((retval = copy_from_user((void *) &cdef, data,
+		   if ((retval = copy_from_user(&cdef, data,
 					    sizeof(avmb1_extcarddef))))
 			   return retval;
 		}
@@ -780,13 +780,13 @@ static int old_capi_manufacturer(unsigned int cmd, void *data)
 	case AVMB1_LOAD_AND_CONFIG:
 
 		if (cmd == AVMB1_LOAD) {
-			if (copy_from_user((void *)&ldef, data,
+			if (copy_from_user(&ldef, data,
 					   sizeof(avmb1_loaddef)))
 				return -EFAULT;
 			ldef.t4config.len = 0;
 			ldef.t4config.data = NULL;
 		} else {
-			if (copy_from_user((void *)&ldef, data,
+			if (copy_from_user(&ldef, data,
 					   sizeof(avmb1_loadandconfigdef)))
 				return -EFAULT;
 		}
@@ -843,7 +843,7 @@ static int old_capi_manufacturer(unsigned int cmd, void *data)
 		return 0;
 
 	case AVMB1_RESETCARD:
-		if (copy_from_user((void *)&rdef, data, sizeof(avmb1_resetdef)))
+		if (copy_from_user(&rdef, data, sizeof(avmb1_resetdef)))
 			return -EFAULT;
 		card = get_capi_ctr_by_nr(rdef.contr);
 		if (!card)
@@ -869,7 +869,7 @@ static int old_capi_manufacturer(unsigned int cmd, void *data)
 }
 #endif
 
-int capi20_manufacturer(unsigned int cmd, void *data)
+int capi20_manufacturer(unsigned int cmd, void __user *data)
 {
         struct capi_ctr *card;
 
@@ -886,7 +886,7 @@ int capi20_manufacturer(unsigned int cmd, void *data)
 	{
 		kcapi_flagdef fdef;
 
-		if (copy_from_user((void *)&fdef, data, sizeof(kcapi_flagdef)))
+		if (copy_from_user(&fdef, data, sizeof(kcapi_flagdef)))
 			return -EFAULT;
 
 		card = get_capi_ctr_by_nr(fdef.contr);
@@ -906,8 +906,7 @@ int capi20_manufacturer(unsigned int cmd, void *data)
 		kcapi_carddef cdef;
 		int retval;
 
-		if ((retval = copy_from_user((void *) &cdef, data,
-							sizeof(cdef))))
+		if ((retval = copy_from_user(&cdef, data, sizeof(cdef))))
 			return retval;
 
 		cparams.port = cdef.port;

drivers/isdn/hardware/eicon/diva.c

@@ -388,7 +388,7 @@ void divasa_xdi_driver_unload(void)
 /*
 **  Receive and process command from user mode utility
 */
-void *diva_xdi_open_adapter(void *os_handle, const void *src,
+void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
 			    int length,
 			    divas_xdi_copy_from_user_fn_t cp_fn)
 {
@@ -437,7 +437,7 @@ void diva_xdi_close_adapter(void *adapter, void *os_handle)
 }
 
 int
-diva_xdi_write(void *adapter, void *os_handle, const void *src,
+diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
 	       int length, divas_xdi_copy_from_user_fn_t cp_fn)
 {
 	diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) adapter;
@@ -480,7 +480,7 @@ diva_xdi_write(void *adapter, void *os_handle, const void *src,
 **  Write answers to user mode utility, if any
 */
 int
-diva_xdi_read(void *adapter, void *os_handle, void *dst,
+diva_xdi_read(void *adapter, void *os_handle, void __user *dst,
 	      int max_length, divas_xdi_copy_to_user_fn_t cp_fn)
 {
 	diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) adapter;

drivers/isdn/hardware/eicon/diva.h

@@ -9,19 +9,19 @@ void divasa_xdi_driver_unload(void);
 void *diva_driver_add_card(void *pdev, unsigned long CardOrdinal);
 void diva_driver_remove_card(void *pdiva);
 
-typedef int (*divas_xdi_copy_to_user_fn_t) (void *os_handle, void *dst,
+typedef int (*divas_xdi_copy_to_user_fn_t) (void *os_handle, void __user *dst,
 					    const void *src, int length);
 
 typedef int (*divas_xdi_copy_from_user_fn_t) (void *os_handle, void *dst,
-					      const void *src, int length);
+					      const void __user *src, int length);
 
-int diva_xdi_read(void *adapter, void *os_handle, void *dst,
+int diva_xdi_read(void *adapter, void *os_handle, void __user *dst,
 		  int max_length, divas_xdi_copy_to_user_fn_t cp_fn);
 
-int diva_xdi_write(void *adapter, void *os_handle, const void *src,
+int diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
 		   int length, divas_xdi_copy_from_user_fn_t cp_fn);
 
-void *diva_xdi_open_adapter(void *os_handle, const void *src,
+void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
 			    int length,
 			    divas_xdi_copy_from_user_fn_t cp_fn);
 

drivers/isdn/hardware/eicon/divamnt.c

@@ -53,7 +53,7 @@ static struct timeval start_time;
 
 extern int mntfunc_init(int *, void **, unsigned long);
 extern void mntfunc_finit(void);
-extern int maint_read_write(void *buf, int count);
+extern int maint_read_write(void __user *buf, int count);
 
 /*
  *  helper functions
@@ -90,12 +90,12 @@ void diva_os_free_tbuffer(unsigned long flags, void *ptr)
 /*
  * kernel/user space copy functions
  */
-int diva_os_copy_to_user(void *os_handle, void *dst, const void *src,
+int diva_os_copy_to_user(void *os_handle, void __user *dst, const void *src,
 			 int length)
 {
 	return (copy_to_user(dst, src, length));
 }
-int diva_os_copy_from_user(void *os_handle, void *dst, const void *src,
+int diva_os_copy_from_user(void *os_handle, void *dst, const void __user *src,
 			   int length)
 {
 	return (copy_from_user(dst, src, length));
@@ -142,7 +142,7 @@ static struct proc_dir_entry *maint_proc_entry = NULL;
   to read unstructured traces, formated as ascii string only
   */
 static ssize_t
-maint_read(struct file *file, char *buf, size_t count, loff_t * off)
+maint_read(struct file *file, char __user *buf, size_t count, loff_t * off)
 {
 	diva_dbg_entry_head_t *pmsg = NULL;
 	diva_os_spin_lock_magic_t old_irql;
@@ -277,7 +277,7 @@ maint_read(struct file *file, char *buf, size_t count, loff_t * off)
 }
 
 static ssize_t
-maint_write(struct file *file, const char *buf, size_t count, loff_t * off)
+maint_write(struct file *file, const char __user *buf, size_t count, loff_t * off)
 {
 	return (-ENODEV);
 }
@@ -360,13 +360,13 @@ static void remove_maint_proc(void)
 /*
  * device node operations
  */
-static ssize_t divas_maint_write(struct file *file, const char *buf,
+static ssize_t divas_maint_write(struct file *file, const char __user *buf,
 				 size_t count, loff_t * ppos)
 {
-	return (maint_read_write((char *) buf, (int) count));
+	return (maint_read_write((char __user *) buf, (int) count));
 }
 
-static ssize_t divas_maint_read(struct file *file, char *buf,
+static ssize_t divas_maint_read(struct file *file, char __user *buf,
 				size_t count, loff_t * ppos)
 {
 	return (maint_read_write(buf, (int) count));

drivers/isdn/hardware/eicon/divasi.c

@@ -71,9 +71,9 @@ static char *getrev(const char *revision)
 /*
  *  LOCALS
  */
-static ssize_t um_idi_read(struct file *file, char *buf, size_t count,
+static ssize_t um_idi_read(struct file *file, char __user *buf, size_t count,
 			   loff_t * offset);
-static ssize_t um_idi_write(struct file *file, const char *buf,
+static ssize_t um_idi_write(struct file *file, const char __user *buf,
 			    size_t count, loff_t * offset);
 static unsigned int um_idi_poll(struct file *file, poll_table * wait);
 static int um_idi_open(struct inode *inode, struct file *file);
@@ -231,7 +231,7 @@ divas_um_idi_copy_to_user(void *os_handle, void *dst, const void *src,
 }
 
 static ssize_t
-um_idi_read(struct file *file, char *buf, size_t count, loff_t * offset)
+um_idi_read(struct file *file, char __user *buf, size_t count, loff_t * offset)
 {
 	diva_um_idi_os_context_t *p_os;
 	int ret = -EINVAL;
@@ -312,7 +312,7 @@ static int um_idi_open_adapter(struct file *file, int adapter_nr)
 }
 
 static ssize_t
-um_idi_write(struct file *file, const char *buf, size_t count,
+um_idi_write(struct file *file, const char __user *buf, size_t count,
 	     loff_t * offset)
 {
 	diva_um_idi_os_context_t *p_os;

drivers/isdn/hardware/eicon/divasmain.c

@@ -565,7 +565,7 @@ void diva_os_remove_soft_isr(diva_os_soft_isr_t * psoft_isr)
  * kernel/user space copy functions
  */
 static int
-xdi_copy_to_user(void *os_handle, void *dst, const void *src, int length)
+xdi_copy_to_user(void *os_handle, void __user *dst, const void *src, int length)
 {
 	if (copy_to_user(dst, src, length)) {
 		return (-EFAULT);
@@ -574,7 +574,7 @@ xdi_copy_to_user(void *os_handle, void *dst, const void *src, int length)
 }
 
 static int
-xdi_copy_from_user(void *os_handle, void *dst, const void *src, int length)
+xdi_copy_from_user(void *os_handle, void *dst, const void __user *src, int length)
 {
 	if (copy_from_user(dst, src, length)) {
 		return (-EFAULT);
@@ -598,7 +598,7 @@ static int divas_release(struct inode *inode, struct file *file)
 	return (0);
 }
 
-static ssize_t divas_write(struct file *file, const char *buf,
+static ssize_t divas_write(struct file *file, const char __user *buf,
 			   size_t count, loff_t * ppos)
 {
 	int ret = -EINVAL;
@@ -629,7 +629,7 @@ static ssize_t divas_write(struct file *file, const char *buf,
 	return (ret);
 }
 
-static ssize_t divas_read(struct file *file, char *buf,
+static ssize_t divas_read(struct file *file, char __user *buf,
 			  size_t count, loff_t * ppos)
 {
 	int ret = -EINVAL;

drivers/isdn/hardware/eicon/mntfunc.c

@@ -34,10 +34,10 @@ static DESCRIPTOR MaintDescriptor =
 extern void *diva_os_malloc_tbuffer(unsigned long flags,
 				    unsigned long size);
 extern void diva_os_free_tbuffer(unsigned long flags, void *ptr);
-extern int diva_os_copy_to_user(void *os_handle, void *dst,
+extern int diva_os_copy_to_user(void *os_handle, void __user *dst,
 				const void *src, int length);
 extern int diva_os_copy_from_user(void *os_handle, void *dst,
-				  const void *src, int length);
+				  const void __user *src, int length);
 
 static void no_printf(unsigned char *x, ...)
 {
@@ -148,7 +148,7 @@ static void DIVA_EXIT_FUNCTION disconnect_didd(void)
 /*
  * read/write maint
  */
-int maint_read_write(void *buf, int count)
+int maint_read_write(void __user *buf, int count)
 {
 	byte data[128];
 	dword cmd, id, mask;

drivers/isdn/hisax/isar.c

@@ -186,12 +186,12 @@ ISARVersion(struct IsdnCardState *cs, char *s)
 }
 
 int
-isar_load_firmware(struct IsdnCardState *cs, u_char *buf)
+isar_load_firmware(struct IsdnCardState *cs, u_char __user *buf)
 {
 	int ret, size, cnt, debug;
 	u_char len, nom, noc;
 	u_short sadr, left, *sp;
-	u_char *p = buf;
+	u_char __user *p = buf;
 	u_char *msg, *tmpmsg, *mp, tmp[64];
 	u_long flags;
 	struct isar_reg *ireg = cs->bcs[0].hw.isar.reg;
@@ -1856,7 +1856,7 @@ isar_auxcmd(struct IsdnCardState *cs, isdn_ctrl *ic) {
 						ISDN_FEATURE_L2_FAX |
 						ISDN_FEATURE_L3_FCLASS1;
 					memcpy(&adr, ic->parm.num, sizeof(ulong));
-					if (isar_load_firmware(cs, (u_char *)adr))
+					if (isar_load_firmware(cs, (u_char __user *)adr))
 						return(1);
 					else 
 						ll_run(cs, features);

drivers/isdn/i4l/isdn_tty.c

@@ -1483,7 +1483,7 @@ isdn_tty_ioctl(struct tty_struct *tty, struct file *file,
 #ifdef ISDN_DEBUG_MODEM_IOCTL
 			printk(KERN_DEBUG "ttyI%d ioctl TIOCSERGETLSR\n", info->line);
 #endif
-			return isdn_tty_get_lsr_info(info, (uint *) arg);
+			return isdn_tty_get_lsr_info(info, (uint __user *) arg);
 		default:
 #ifdef ISDN_DEBUG_MODEM_IOCTL
 			printk(KERN_DEBUG "UNKNOWN ioctl 0x%08x on ttyi%d\n", cmd, info->line);

drivers/isdn/icn/icn.c

@@ -798,7 +798,7 @@ int slsec = sec; \
 #endif
 
 static int
-icn_loadboot(u_char * buffer, icn_card * card)
+icn_loadboot(u_char __user * buffer, icn_card * card)
 {
 	int ret;
 	u_char *codebuf;
@@ -903,9 +903,9 @@ icn_loadboot(u_char * buffer, icn_card * card)
 }
 
 static int
-icn_loadproto(u_char * buffer, icn_card * card)
+icn_loadproto(u_char __user * buffer, icn_card * card)
 {
-	register u_char *p = buffer;
+	register u_char __user *p = buffer;
 	u_char codebuf[256];
 	uint left = ICN_CODE_STAGE2;
 	uint cnt;
@@ -916,7 +916,7 @@ icn_loadproto(u_char * buffer, icn_card * card)
 #ifdef BOOT_DEBUG
 	printk(KERN_DEBUG "icn_loadproto called\n");
 #endif
-	if ((ret = verify_area(VERIFY_READ, (void *) buffer, ICN_CODE_STAGE2)))
+	if ((ret = verify_area(VERIFY_READ, buffer, ICN_CODE_STAGE2)))
 		return ret;
 	timer = 0;
 	spin_lock_irqsave(&dev.devlock, flags);
@@ -1160,10 +1160,12 @@ icn_command(isdn_ctrl * c, icn_card * card)
 	char cbuf[60];
 	isdn_ctrl cmd;
 	icn_cdef cdef;
+	char __user *arg;
 
 	switch (c->command) {
 		case ISDN_CMD_IOCTL:
 			memcpy(&a, c->parm.num, sizeof(ulong));
+			arg = (char __user *)a;
 			switch (c->arg) {
 				case ICN_IOCTL_SETMMIO:
 					if (dev.memaddr != (a & 0x0ffc000)) {
@@ -1227,15 +1229,15 @@ icn_command(isdn_ctrl * c, icn_card * card)
 				case ICN_IOCTL_GETDOUBLE:
 					return (int) card->doubleS0;
 				case ICN_IOCTL_DEBUGVAR:
-					if (copy_to_user((char *)a,
-							 (char *)&card,
+					if (copy_to_user(arg,
+							 &card,
 							 sizeof(ulong)))
 						return -EFAULT;
 					a += sizeof(ulong);
 					{
 						ulong l = (ulong) & dev;
-						if (copy_to_user((char *)a,
-								 (char *)&l,
+						if (copy_to_user(arg,
+								 &l,
 								 sizeof(ulong)))
 							return -EFAULT;
 					}
@@ -1246,20 +1248,20 @@ icn_command(isdn_ctrl * c, icn_card * card)
 						dev.firstload = 0;
 					}
 					icn_stopcard(card);
-					return (icn_loadboot((u_char *) a, card));
+					return (icn_loadboot(arg, card));
 				case ICN_IOCTL_LOADPROTO:
 					icn_stopcard(card);
-					if ((i = (icn_loadproto((u_char *) a, card))))
+					if ((i = (icn_loadproto(arg, card))))
 						return i;
 					if (card->doubleS0)
-						i = icn_loadproto((u_char *) (a + ICN_CODE_STAGE2), card->other);
+						i = icn_loadproto(arg + ICN_CODE_STAGE2, card->other);
 					return i;
 					break;
 				case ICN_IOCTL_ADDCARD:
 					if (!dev.firstload)
 						return -EBUSY;
-					if (copy_from_user((char *)&cdef,
-							   (char *)a,
+					if (copy_from_user(&cdef,
+							   arg,
 							   sizeof(cdef)))
 						return -EFAULT;
 					return (icn_addcard(cdef.port, cdef.id1, cdef.id2));

drivers/isdn/sc/command.c

@@ -117,7 +117,7 @@ int command(isdn_ctrl *cmd)
 		scs_ioctl	ioc;
 
 		memcpy(&cmdptr, cmd->parm.num, sizeof(unsigned long));
-		if (copy_from_user(&ioc, (scs_ioctl *)cmdptr,
+		if (copy_from_user(&ioc, (scs_ioctl __user *)cmdptr,
 				   sizeof(scs_ioctl))) {
 			pr_debug("%s: Failed to verify user space 0x%x\n",
 				sc_adapter[card]->devicename, cmdptr);

drivers/isdn/sc/ioctl.c

@@ -72,7 +72,7 @@ int sc_ioctl(int card, scs_ioctl *data)
 		/*
 		 * Get the SRec from user space
 		 */
-		if (copy_from_user(srec, (char *) data->dataptr, sizeof(srec))) {
+		if (copy_from_user(srec, data->dataptr, sizeof(srec))) {
 			kfree(rcvmsg);
 			kfree(srec);
 			return -EFAULT;
@@ -118,8 +118,7 @@ int sc_ioctl(int card, scs_ioctl *data)
 		/*
 		 * Get the switch type from user space
 		 */
-		if (copy_from_user(&switchtype, (char *)data->dataptr,
-				   sizeof(char))) {
+		if (copy_from_user(&switchtype, data->dataptr, sizeof(char))) {
 			kfree(rcvmsg);
 			return -EFAULT;
 		}
@@ -169,7 +168,7 @@ int sc_ioctl(int card, scs_ioctl *data)
 		/*
 		 * Package the switch type and send to user space
 		 */
-		if (copy_to_user((char *)data->dataptr, &switchtype,
+		if (copy_to_user(data->dataptr, &switchtype,
 				 sizeof(char))) {
 			kfree(rcvmsg);
 			return -EFAULT;
@@ -209,7 +208,7 @@ int sc_ioctl(int card, scs_ioctl *data)
 		/*
 		 * Package the switch type and send to user space
 		 */
-		if (copy_to_user((char *)data->dataptr, spid, SCIOC_SPIDSIZE)) {
+		if (copy_to_user(data->dataptr, spid, SCIOC_SPIDSIZE)) {
 			kfree(spid);
 			kfree(rcvmsg);
 			return -EFAULT;
@@ -234,7 +233,7 @@ int sc_ioctl(int card, scs_ioctl *data)
 		/*
 		 * Get the spid from user space
 		 */
-		if (copy_from_user(spid, (char *) data->dataptr, SCIOC_SPIDSIZE)) {
+		if (copy_from_user(spid, data->dataptr, SCIOC_SPIDSIZE)) {
 			kfree(rcvmsg);
 			return -EFAULT;
 		}
@@ -292,7 +291,7 @@ int sc_ioctl(int card, scs_ioctl *data)
 		/*
 		 * Package the dn and send to user space
 		 */
-		if (copy_to_user((char *)data->dataptr, dn, SCIOC_DNSIZE)) {
+		if (copy_to_user(data->dataptr, dn, SCIOC_DNSIZE)) {
 			kfree(dn);
 			return -EFAULT;
 		}
@@ -313,7 +312,7 @@ int sc_ioctl(int card, scs_ioctl *data)
 		/*
 		 * Get the spid from user space
 		 */
-		if (copy_from_user(dn, (char *)data->dataptr, SCIOC_DNSIZE)) {
+		if (copy_from_user(dn, data->dataptr, SCIOC_DNSIZE)) {
 			kfree(rcvmsg);
 			kfree(dn);
 			return -EFAULT;
@@ -366,8 +365,7 @@ int sc_ioctl(int card, scs_ioctl *data)
 		kfree(rcvmsg);
 		GetStatus(card, bi);
 
-		if (copy_to_user((boardInfo *)data->dataptr, bi,
-				 sizeof(boardInfo))) {
+		if (copy_to_user(data->dataptr, bi, sizeof(boardInfo))) {
 			kfree(bi);
 			return -EFAULT;
 		}
@@ -405,7 +403,7 @@ int sc_ioctl(int card, scs_ioctl *data)
 		 * Package the switch type and send to user space
 		 */
 
-		if (copy_to_user((char *) data->dataptr, &speed, sizeof(char)))
+		if (copy_to_user(data->dataptr, &speed, sizeof(char)))
 			return -EFAULT;
 
 		return 0;

drivers/isdn/sc/scioc.h

@@ -27,7 +27,7 @@ typedef struct {
 	int device;
 	int channel;
 	unsigned long command;
-	void *dataptr;
+	void __user *dataptr;
 } scs_ioctl;
 
 /* Size of strings */

drivers/isdn/tpam/tpam.h

@@ -173,8 +173,8 @@ extern void copy_to_pam_dword(tpam_card *, const void *, u32);
 extern void copy_to_pam(tpam_card *, void *, const void *, u32);
 extern u32 copy_from_pam_dword(tpam_card *, const void *);
 extern void copy_from_pam(tpam_card *, void *, const void *, u32);
-extern int copy_from_pam_to_user(tpam_card *, void *, const void *, u32);
-extern int copy_from_user_to_pam(tpam_card *, void *, const void *, u32);
+extern int copy_from_pam_to_user(tpam_card *, void __user *, const void *, u32);
+extern int copy_from_user_to_pam(tpam_card *, void *, const void __user *, u32);
 extern int tpam_verify_area(u32, u32);
 
 /* Function prototypes from tpam_nco.c */

drivers/isdn/tpam/tpam_commands.c

@@ -120,7 +120,7 @@ static int tpam_command_ioctl_dspload(tpam_card *card, u32 arg) {
 	dprintk("TurboPAM(tpam_command_ioctl_dspload): card=%d\n", card->id);
 
 	/* get the IOCTL parameter from userspace */
-	if (copy_from_user(&tdl, (void *)arg, sizeof(tpam_dsp_ioctl)))
+	if (copy_from_user(&tdl, (void __user *)arg, sizeof(tpam_dsp_ioctl)))
 		return -EFAULT;
 
 	/* if the board's firmware was started, protect against writes
@@ -131,7 +131,7 @@ static int tpam_command_ioctl_dspload(tpam_card *card, u32 arg) {
 
 	/* write the data in the board's memory */
 	return copy_from_user_to_pam(card, (void *)tdl.address, 
-				     (void *)arg + sizeof(tpam_dsp_ioctl), 
+				     (void __user *)arg + sizeof(tpam_dsp_ioctl), 
 				     tdl.data_len);
 }
 
@@ -150,7 +150,7 @@ static int tpam_command_ioctl_dspsave(tpam_card *card, u32 arg) {
 	dprintk("TurboPAM(tpam_command_ioctl_dspsave): card=%d\n", card->id);
 
 	/* get the IOCTL parameter from userspace */
-	if (copy_from_user(&tdl, (void *)arg, sizeof(tpam_dsp_ioctl)))
+	if (copy_from_user(&tdl, (void __user *)arg, sizeof(tpam_dsp_ioctl)))
 		return -EFAULT;
 
 	/* protect against read from unallowed memory areas */
@@ -158,7 +158,7 @@ static int tpam_command_ioctl_dspsave(tpam_card *card, u32 arg) {
 		return -EPERM;
 
 	/* read the data from the board's memory */
-	return copy_from_pam_to_user(card, (void *)arg + sizeof(tpam_dsp_ioctl),
+	return copy_from_pam_to_user(card, (void __user *)arg + sizeof(tpam_dsp_ioctl),
 				     (void *)tdl.address, tdl.data_len);
 }
 

drivers/isdn/tpam/tpam_memory.c

@@ -125,7 +125,7 @@ void copy_from_pam(tpam_card *card, void *to, const void *from, u32 n) {
  *
  * Return: 0 if OK, <0 if error.
  */
-int copy_from_pam_to_user(tpam_card *card, void *to, const void *from, u32 n) {
+int copy_from_pam_to_user(tpam_card *card, void __user *to, const void *from, u32 n) {
 	void *page;
 	u32 count;
 
@@ -171,7 +171,7 @@ int copy_from_pam_to_user(tpam_card *card, void *to, const void *from, u32 n) {
  *
  * Return: 0 if OK, <0 if error.
  */
-int copy_from_user_to_pam(tpam_card *card, void *to, const void *from, u32 n) {
+int copy_from_user_to_pam(tpam_card *card, void *to, const void __user *from, u32 n) {
 	void *page;
 	u32 count;
 

include/linux/capi.h

@@ -77,7 +77,7 @@ typedef struct capi_profile {
 
 typedef struct capi_manufacturer_cmd {
 	unsigned long cmd;
-	void *data;
+	void __user *data;
 } capi_manufacturer_cmd;
 
 /*

include/linux/kernelcapi.h

@@ -81,7 +81,7 @@ u16 capi20_get_manufacturer(u32 contr, u8 buf[CAPI_MANUFACTURER_LEN]);
 u16 capi20_get_version(u32 contr, struct capi_version *verp);
 u16 capi20_get_serial(u32 contr, u8 serial[CAPI_SERIAL_LEN]);
 u16 capi20_get_profile(u32 contr, struct capi_profile *profp);
-int capi20_manufacturer(unsigned int cmd, void *data);
+int capi20_manufacturer(unsigned int cmd, void __user *data);
 
 /* temporary hack XXX */
 void capi20_set_callback(struct capi20_appl *ap,