Skip to content

L
linux
Commit 1ca09186 authored by David S. Miller's avatar David S. Miller
Browse files
Options

[SPARC64]: Use __user in ioctl32.c

parent 5c09d8c4
Hide whitespace changes
Inline Side-by-side
Showing with 101 additions and 104 deletions
arch/sparc64/kernel/ioctl32.c
View file @ 1ca09186
......@@ -107,15 +107,9 @@
#include <linux/filter.h>
/* Use this to get at 32-bit user passed pointers.
See sys_sparc32.c for description about these. */
#define A(__x) ((unsigned long)(__x))
#define AA(__x) \
({ unsigned long __ret; \
__asm__ ("srl %0, 0, %0" \
: "=r" (__ret) \
: "0" (__x)); \
__ret; \
})
* See sys_sparc32.c for description about it.
*/
#define A(__x) ((void __user *)(unsigned long)(__x))
/* Aiee. Someone does not find a difference between int and long */
#define EXT2_IOC32_GETFLAGS _IOR('f', 1, int)
......@@ -261,7 +255,7 @@ static void free_kvideo_clips(struct video_window *kp)
static int get_video_window32(struct video_window *kp, struct video_window32 *up)
{
struct video_clip32 *ucp;
struct video_clip32 __user *ucp;
struct video_clip *kcp;
int nclips, err, i;
u32 tmp;
......@@ -275,7 +269,7 @@ static int get_video_window32(struct video_window *kp, struct video_window32 *up
__get_user(kp->flags, &up->flags);
__get_user(kp->clipcount, &up->clipcount);
__get_user(tmp, &up->clips);
ucp = (struct video_clip32 *)A(tmp);
ucp = A(tmp);
kp->clips = NULL;
nclips = kp->clipcount;
......@@ -487,7 +481,7 @@ static int dev_ifconf(unsigned int fd, unsigned int cmd, unsigned long arg)
{
struct ifconf32 ifc32;
struct ifconf ifc;
struct ifreq32 *ifr32;
struct ifreq32 __user *ifr32;
struct ifreq *ifr;
mm_segment_t old_fs;
unsigned int i, j;
......@@ -508,7 +502,7 @@ static int dev_ifconf(unsigned int fd, unsigned int cmd, unsigned long arg)
return -ENOMEM;
}
ifr = ifc.ifc_req;
ifr32 = (struct ifreq32 *)A(ifc32.ifcbuf);
ifr32 = A(ifc32.ifcbuf);
for (i = 0; i < ifc32.ifc_len; i += sizeof (struct ifreq32)) {
if (copy_from_user(ifr++, ifr32++, sizeof (struct ifreq32))) {
kfree (ifc.ifc_buf);
......@@ -520,7 +514,7 @@ static int dev_ifconf(unsigned int fd, unsigned int cmd, unsigned long arg)
set_fs (old_fs);
if (!err) {
ifr = ifc.ifc_req;
ifr32 = (struct ifreq32 *)A(ifc32.ifcbuf);
ifr32 = A(ifc32.ifcbuf);
for (i = 0, j = 0; i < ifc32.ifc_len && j < ifc.ifc_len;
i += sizeof (struct ifreq32), j += sizeof (struct ifreq)) {
if (copy_to_user(ifr32++, ifr++, sizeof (struct ifreq32))) {
......@@ -566,7 +560,7 @@ static int ethtool_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
__get_user(data, &(((struct ifreq32 *)arg)->ifr_ifru.ifru_data));
if (get_user(ethcmd, (u32 *)A(data))) {
if (get_user(ethcmd, (u32 __user *) A(data))) {
err = -EFAULT;
goto out;
}
......@@ -577,7 +571,7 @@ static int ethtool_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
case ETHTOOL_GLINK:
case ETHTOOL_NWAY_RST: len = sizeof(struct ethtool_value); break;
case ETHTOOL_GREGS: {
struct ethtool_regs *regaddr = (struct ethtool_regs *)A(data);
struct ethtool_regs __user *regaddr = A(data);
/* darned variable size arguments */
if (get_user(len, (u32 *)&regaddr->len)) {
err = -EFAULT;
......@@ -593,7 +587,7 @@ static int ethtool_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
goto out;
}
if (copy_from_user(ifr.ifr_data, (char *)A(data), len)) {
if (copy_from_user(ifr.ifr_data, A(data), len)) {
err = -EFAULT;
goto out;
}
......@@ -606,7 +600,7 @@ static int ethtool_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
u32 data;
__get_user(data, &(((struct ifreq32 *)arg)->ifr_ifru.ifru_data));
len = copy_to_user((char *)A(data), ifr.ifr_data, len);
len = copy_to_user(A(data), ifr.ifr_data, len);
if (len)
err = -EFAULT;
}
......@@ -648,7 +642,7 @@ static int bond_ioctl(unsigned long fd, unsigned int cmd, unsigned long arg)
};
__get_user(data, &(((struct ifreq32 *)arg)->ifr_ifru.ifru_data));
if (copy_from_user(ifr.ifr_data, (char *)A(data), len)) {
if (copy_from_user(ifr.ifr_data, A(data), len)) {
err = -EFAULT;
goto out;
}
......@@ -658,7 +652,7 @@ static int bond_ioctl(unsigned long fd, unsigned int cmd, unsigned long arg)
err = sys_ioctl (fd, cmd, (unsigned long)&ifr);
set_fs (old_fs);
if (!err) {
len = copy_to_user((char *)A(data), ifr.ifr_data, len);
len = copy_to_user(A(data), ifr.ifr_data, len);
if (len)
err = -EFAULT;
}
......@@ -684,7 +678,7 @@ static int siocdevprivate_ioctl(unsigned int fd, unsigned int cmd, unsigned long
struct ifreq *u_ifreq64;
struct ifreq32 *u_ifreq32 = (struct ifreq32 *) arg;
char tmp_buf[IFNAMSIZ];
void *data64;
void __user *data64;
u32 data32;
if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
......@@ -692,7 +686,7 @@ static int siocdevprivate_ioctl(unsigned int fd, unsigned int cmd, unsigned long
return -EFAULT;
if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
return -EFAULT;
data64 = (void *) A(data32);
data64 = A(data32);
u_ifreq64 = alloc_user_space(sizeof(*u_ifreq64));
......@@ -829,7 +823,7 @@ static int routing_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
ret |= __get_user (r4.rt_irtt, &(((struct rtentry32 *)arg)->rt_irtt));
ret |= __get_user (rtdev, &(((struct rtentry32 *)arg)->rt_dev));
if (rtdev) {
ret |= copy_from_user (devname, (char *)A(rtdev), 15);
ret |= copy_from_user (devname, A(rtdev), 15);
r4.rt_dev = devname; devname[15] = 0;
} else
r4.rt_dev = 0;
......@@ -932,9 +926,9 @@ static int fbiogetputcmap(unsigned int fd, unsigned int cmd, unsigned long arg)
if (f.index + f.count > 256)
f.count = 256 - f.index;
if (cmd == FBIOPUTCMAP32) {
ret = copy_from_user (red, (char *)A(r), f.count);
ret |= copy_from_user (green, (char *)A(g), f.count);
ret |= copy_from_user (blue, (char *)A(b), f.count);
ret = copy_from_user (red, A(r), f.count);
ret |= copy_from_user (green, A(g), f.count);
ret |= copy_from_user (blue, A(b), f.count);
if (ret)
return -EFAULT;
}
......@@ -943,9 +937,9 @@ static int fbiogetputcmap(unsigned int fd, unsigned int cmd, unsigned long arg)
ret = sys_ioctl (fd, (cmd == FBIOPUTCMAP32) ? FBIOPUTCMAP_SPARC : FBIOGETCMAP_SPARC, (long)&f);
set_fs (old_fs);
if (!ret && cmd == FBIOGETCMAP32) {
ret = copy_to_user ((char *)A(r), red, f.count);
ret |= copy_to_user ((char *)A(g), green, f.count);
ret |= copy_to_user ((char *)A(b), blue, f.count);
ret = copy_to_user (A(r), red, f.count);
ret |= copy_to_user (A(g), green, f.count);
ret |= copy_to_user (A(b), blue, f.count);
}
return ret ? -EFAULT : 0;
}
......@@ -989,16 +983,16 @@ static int fbiogscursor(unsigned int fd, unsigned int cmd, unsigned long arg)
if (f.set & FB_CUR_SETCMAP) {
if ((uint) f.size.y > 32)
return -EINVAL;
ret = copy_from_user (mask, (char *)A(m), f.size.y * 4);
ret |= copy_from_user (image, (char *)A(i), f.size.y * 4);
ret = copy_from_user (mask, A(m), f.size.y * 4);
ret |= copy_from_user (image, A(i), f.size.y * 4);
if (ret)
return -EFAULT;
f.image = image; f.mask = mask;
}
if (f.set & FB_CUR_SETCMAP) {
ret = copy_from_user (red, (char *)A(r), 2);
ret |= copy_from_user (green, (char *)A(g), 2);
ret |= copy_from_user (blue, (char *)A(b), 2);
ret = copy_from_user (red, A(r), 2);
ret |= copy_from_user (green, A(g), 2);
ret |= copy_from_user (blue, A(b), 2);
if (ret)
return -EFAULT;
f.cmap.red = red; f.cmap.green = green; f.cmap.blue = blue;
......@@ -1081,10 +1075,10 @@ static int fb_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
if (cmd == FBIOGETCMAP)
break;
err = __copy_from_user(cmap.red, (char *)A(red), cmap.len * sizeof(__u16));
err |= __copy_from_user(cmap.green, (char *)A(green), cmap.len * sizeof(__u16));
err |= __copy_from_user(cmap.blue, (char *)A(blue), cmap.len * sizeof(__u16));
if (cmap.transp) err |= __copy_from_user(cmap.transp, (char *)A(transp), cmap.len * sizeof(__u16));
err = __copy_from_user(cmap.red, A(red), cmap.len * sizeof(__u16));
err |= __copy_from_user(cmap.green, A(green), cmap.len * sizeof(__u16));
err |= __copy_from_user(cmap.blue, A(blue), cmap.len * sizeof(__u16));
if (cmap.transp) err |= __copy_from_user(cmap.transp, A(transp), cmap.len * sizeof(__u16));
if (err) {
err = -EFAULT;
goto out;
......@@ -1123,11 +1117,11 @@ static int fb_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
err |= __copy_to_user((char *)((struct fb_fix_screeninfo32 *)arg)->reserved, (char *)fix.reserved, sizeof(fix.reserved));
break;
case FBIOGETCMAP:
err = __copy_to_user((char *)A(red), cmap.red, cmap.len * sizeof(__u16));
err |= __copy_to_user((char *)A(green), cmap.blue, cmap.len * sizeof(__u16));
err |= __copy_to_user((char *)A(blue), cmap.blue, cmap.len * sizeof(__u16));
err = __copy_to_user(A(red), cmap.red, cmap.len * sizeof(__u16));
err |= __copy_to_user(A(green), cmap.blue, cmap.len * sizeof(__u16));
err |= __copy_to_user(A(blue), cmap.blue, cmap.len * sizeof(__u16));
if (cmap.transp)
err |= __copy_to_user((char *)A(transp), cmap.transp, cmap.len * sizeof(__u16));
err |= __copy_to_user(A(transp), cmap.transp, cmap.len * sizeof(__u16));
break;
case FBIOPUTCMAP:
break;
......@@ -1504,7 +1498,7 @@ typedef struct sg_iovec32 {
static int alloc_sg_iovec(sg_io_hdr_t *sgp, u32 uptr32)
{
sg_iovec32_t *uiov = (sg_iovec32_t *) A(uptr32);
sg_iovec32_t __user *uiov = A(uptr32);
sg_iovec_t *kiov;
int i;
......@@ -1526,7 +1520,7 @@ static int alloc_sg_iovec(sg_io_hdr_t *sgp, u32 uptr32)
if (!kiov->iov_base)
return -ENOMEM;
if (copy_from_user(kiov->iov_base,
(void *) A(iov_base32),
A(iov_base32),
kiov->iov_len))
return -EFAULT;
......@@ -1539,7 +1533,7 @@ static int alloc_sg_iovec(sg_io_hdr_t *sgp, u32 uptr32)
static int copy_back_sg_iovec(sg_io_hdr_t *sgp, u32 uptr32)
{
sg_iovec32_t *uiov = (sg_iovec32_t *) A(uptr32);
sg_iovec32_t __user *uiov = A(uptr32);
sg_iovec_t *kiov = (sg_iovec_t *) sgp->dxferp;
int i;
......@@ -1549,7 +1543,7 @@ static int copy_back_sg_iovec(sg_io_hdr_t *sgp, u32 uptr32)
if (__get_user(iov_base32, &uiov->iov_base))
return -EFAULT;
if (copy_to_user((void *) A(iov_base32),
if (copy_to_user(A(iov_base32),
kiov->iov_base,
kiov->iov_len))
return -EFAULT;
......@@ -1607,7 +1601,7 @@ static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
goto out;
}
if (copy_from_user(sg_io64.cmdp,
(void *) A(cmdp32),
A(cmdp32),
sg_io64.cmd_len)) {
err = -EFAULT;
goto out;
......@@ -1620,7 +1614,7 @@ static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
goto out;
}
if (copy_from_user(sg_io64.sbp,
(void *) A(sbp32),
A(sbp32),
sg_io64.mx_sb_len)) {
err = -EFAULT;
goto out;
......@@ -1641,7 +1635,7 @@ static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
goto out;
}
if (copy_from_user(sg_io64.dxferp,
(void *) A(dxferp32),
A(dxferp32),
sg_io64.dxfer_len)) {
err = -EFAULT;
goto out;
......@@ -1672,12 +1666,12 @@ static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
err |= __put_user(sg_io64.resid, &sg_io32->resid);
err |= __put_user(sg_io64.duration, &sg_io32->duration);
err |= __put_user(sg_io64.info, &sg_io32->info);
err |= copy_to_user((void *)A(sbp32), sg_io64.sbp, sg_io64.mx_sb_len);
err |= copy_to_user(A(sbp32), sg_io64.sbp, sg_io64.mx_sb_len);
if (sg_io64.dxferp) {
if (sg_io64.iovec_count)
err |= copy_back_sg_iovec(&sg_io64, dxferp32);
else
err |= copy_to_user((void *)A(dxferp32),
err |= copy_to_user(A(dxferp32),
sg_io64.dxferp,
sg_io64.dxfer_len);
}
......@@ -1711,7 +1705,7 @@ static int ppp_sock_fprog_ioctl_trans(unsigned int fd, unsigned int cmd, unsigne
{
struct sock_fprog32 *u_fprog32 = (struct sock_fprog32 *) arg;
struct sock_fprog *u_fprog64 = alloc_user_space(sizeof(struct sock_fprog));
void *fptr64;
void __user *fptr64;
u32 fptr32;
u16 flen;
......@@ -1719,7 +1713,7 @@ static int ppp_sock_fprog_ioctl_trans(unsigned int fd, unsigned int cmd, unsigne
get_user(fptr32, &u_fprog32->filter))
return -EFAULT;
fptr64 = (void *) A(fptr32);
fptr64 = A(fptr32);
if (put_user(flen, &u_fprog64->len) ||
put_user(fptr64, &u_fprog64->filter))
......@@ -1768,7 +1762,7 @@ static int ppp_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
data.ptr = kmalloc (data32.length, GFP_KERNEL);
if (!data.ptr)
return -ENOMEM;
if (copy_from_user(data.ptr, (__u8 *)A(data32.ptr), data32.length)) {
if (copy_from_user(data.ptr, A(data32.ptr), data32.length)) {
kfree(data.ptr);
return -EFAULT;
}
......@@ -2025,13 +2019,13 @@ static int cdrom_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long ar
case CDROMREADMODE1:
case CDROMREADRAW:
case CDROMREADCOOKED:
err = copy_to_user((char *)A(addr), data, cdread.cdread_buflen);
err = copy_to_user(A(addr), data, cdread.cdread_buflen);
break;
case CDROMREADAUDIO:
err = copy_to_user((char *)A(addr), data, cdreadaudio.nframes * 2352);
err = copy_to_user(A(addr), data, cdreadaudio.nframes * 2352);
break;
case CDROM_SEND_PACKET:
err = copy_to_user((char *)A(addr), data, cgc.buflen);
err = copy_to_user(A(addr), data, cgc.buflen);
break;
default:
break;
......@@ -2148,7 +2142,7 @@ static int do_fontx_ioctl(unsigned int fd, int cmd, struct consolefontdesc32 *us
if (copy_from_user(&cfdarg, user_cfd, sizeof(struct consolefontdesc32)))
return -EFAULT;
cfdarg.chardata = (unsigned char *)A(((struct consolefontdesc32 *)&cfdarg)->chardata);
cfdarg.chardata = A(((struct consolefontdesc32 *)&cfdarg)->chardata);
switch (cmd) {
case PIO_FONTX:
......@@ -2203,7 +2197,7 @@ static int do_kdfontop_ioctl(unsigned int fd, unsigned int cmd, struct console_f
return -EFAULT;
if (!perm && op.op != KD_FONT_OP_GET)
return -EPERM;
op.data = (unsigned char *)A(((struct console_font_op32 *)&op)->data);
op.data = A(((struct console_font_op32 *)&op)->data);
op.flags |= KD_FONT_FLAG_OLD;
vt = (struct vt_struct *)((struct tty_struct *)file->private_data)->driver_data;
i = con_font_op(vt->vc_num, &op);
......@@ -2230,9 +2224,9 @@ static int do_unimap_ioctl(unsigned int fd, unsigned int cmd, struct unimapdesc3
switch (cmd) {
case PIO_UNIMAP:
if (!perm) return -EPERM;
return con_set_unimap(fg_console, tmp.entry_ct, (struct unipair *)A(tmp.entries));
return con_set_unimap(fg_console, tmp.entry_ct, A(tmp.entries));
case GIO_UNIMAP:
return con_get_unimap(fg_console, tmp.entry_ct, &(user_ud->entry_ct), (struct unipair *)A(tmp.entries));
return con_get_unimap(fg_console, tmp.entry_ct, &(user_ud->entry_ct), A(tmp.entries));
}
return 0;
}
......@@ -2907,9 +2901,9 @@ static lv_t *get_lv_t(u32 p, int *errp)
int err, i;
u32 ptr1, ptr2;
size_t size;
lv_block_exception32_t *lbe32;
lv_block_exception32_t __user *lbe32;
lv_block_exception_t *lbe;
lv32_t *ul = (lv32_t *)A(p);
lv32_t __user *ul = A(p);
lv_t *l = (lv_t *) kmalloc(sizeof(lv_t), GFP_KERNEL);
if (!l) {
......@@ -2933,13 +2927,13 @@ static lv_t *get_lv_t(u32 p, int *errp)
size = l->lv_allocated_le * sizeof(pe_t);
l->lv_current_pe = vmalloc(size);
if (l->lv_current_pe)
err = copy_from_user(l->lv_current_pe, (void *)A(ptr1), size);
err = copy_from_user(l->lv_current_pe, A(ptr1), size);
}
if (!err && ptr2) {
size = l->lv_remap_end * sizeof(lv_block_exception_t);
l->lv_block_exception = lbe = vmalloc(size);
if (l->lv_block_exception) {
lbe32 = (lv_block_exception32_t *)A(ptr2);
lbe32 = A(ptr2);
memset(lbe, 0, size);
for (i = 0; i < l->lv_remap_end; i++, lbe++, lbe32++) {
err |= get_user(lbe->rsector_org, &lbe32->rsector_org);
......@@ -2963,7 +2957,7 @@ static lv_t *get_lv_t(u32 p, int *errp)
static int copy_lv_t(u32 ptr, lv_t *l)
{
int err;
lv32_t *ul = (lv32_t *)A(ptr);
lv32_t __user *ul = A(ptr);
u32 ptr1;
size_t size;
......@@ -2977,7 +2971,7 @@ static int copy_lv_t(u32 ptr, lv_t *l)
((long)&ul->dummy[0]) - ((long)&ul->lv_remap_ptr));
size = l->lv_allocated_le * sizeof(pe_t);
if (ptr1)
err |= __copy_to_user((void *)A(ptr1), l->lv_current_pe, size);
err |= __copy_to_user(A(ptr1), l->lv_current_pe, size);
return err ? -EFAULT : 0;
}
......@@ -3036,14 +3030,14 @@ static int do_lvm_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
err = -ENOMEM;
break;
}
err = copy_from_user(v->pv[i], (void *)A(ptr),
err = copy_from_user(v->pv[i], A(ptr),
sizeof(pv32_t) - 8 - UUID_LEN+1);
if (err) {
err = -EFAULT;
break;
}
err = copy_from_user(v->pv[i]->pv_uuid,
((pv32_t *)A(ptr))->pv_uuid,
err = copy_from_user(&v->pv[i]->pv_uuid[0],
&((pv32_t __user *)A(ptr))->pv_uuid[0],
UUID_LEN+1);
if (err) {
err = -EFAULT;
......@@ -3125,7 +3119,7 @@ static int do_lvm_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
return err;
u.pv_status.pv = &p;
if (cmd == PV_CHANGE) {
err = copy_from_user(&p, (void *)A(ptr),
err = copy_from_user(&p, A(ptr),
sizeof(pv32_t) - 8 - UUID_LEN+1);
if (err)
return -EFAULT;
......@@ -3195,10 +3189,10 @@ static int do_lvm_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
case PV_STATUS:
if (!err) {
err = copy_to_user((void *)A(ptr), &p, sizeof(pv32_t) - 8 - UUID_LEN+1);
err = copy_to_user(A(ptr), &p, sizeof(pv32_t) - 8 - UUID_LEN+1);
if (err)
return -EFAULT;
err = copy_to_user(((pv_t *)A(ptr))->pv_uuid, p.pv_uuid, UUID_LEN + 1);
err = copy_to_user(&((pv_t __user *)A(ptr))->pv_uuid[0], &p.pv_uuid[0], UUID_LEN + 1);
if (err)
return -EFAULT;
}
......@@ -3229,7 +3223,7 @@ typedef struct drm32_version {
static int drm32_version(unsigned int fd, unsigned int cmd, unsigned long arg)
{
drm32_version_t *uversion = (drm32_version_t *)arg;
char *name_ptr, *date_ptr, *desc_ptr;
char __user *name_ptr, *date_ptr, *desc_ptr;
u32 tmp1, tmp2, tmp3;
drm_version_t kversion;
mm_segment_t old_fs;
......@@ -3244,9 +3238,9 @@ static int drm32_version(unsigned int fd, unsigned int cmd, unsigned long arg)
get_user(tmp3, &uversion->desc))
return -EFAULT;
name_ptr = (char *) A(tmp1);
date_ptr = (char *) A(tmp2);
desc_ptr = (char *) A(tmp3);
name_ptr = A(tmp1);
date_ptr = A(tmp2);
desc_ptr = A(tmp3);
ret = -ENOMEM;
if (kversion.name_len && name_ptr) {
......@@ -3309,7 +3303,7 @@ static int drm32_getsetunique(unsigned int fd, unsigned int cmd, unsigned long a
drm32_unique_t *uarg = (drm32_unique_t *)arg;
drm_unique_t karg;
mm_segment_t old_fs;
char *uptr;
char __user *uptr;
u32 tmp;
int ret;
......@@ -3320,7 +3314,7 @@ static int drm32_getsetunique(unsigned int fd, unsigned int cmd, unsigned long a
if (get_user(tmp, &uarg->unique))
return -EFAULT;
uptr = (char *) A(tmp);
uptr = A(tmp);
if (uptr) {
karg.unique = kmalloc(karg.unique_len, GFP_KERNEL);
......@@ -3385,7 +3379,7 @@ static int drm32_addmap(unsigned int fd, unsigned int cmd, unsigned long arg)
if (ret)
return -EFAULT;
karg.handle = (void *) A(tmp);
karg.handle = A(tmp);
old_fs = get_fs();
set_fs(KERNEL_DS);
......@@ -3416,7 +3410,7 @@ typedef struct drm32_buf_info {
static int drm32_info_bufs(unsigned int fd, unsigned int cmd, unsigned long arg)
{
drm32_buf_info_t *uarg = (drm32_buf_info_t *)arg;
drm_buf_desc_t *ulist;
drm_buf_desc_t __user *ulist;
drm_buf_info_t karg;
mm_segment_t old_fs;
int orig_count, ret;
......@@ -3426,7 +3420,7 @@ static int drm32_info_bufs(unsigned int fd, unsigned int cmd, unsigned long arg)
get_user(tmp, &uarg->list))
return -EFAULT;
ulist = (drm_buf_desc_t *) A(tmp);
ulist = A(tmp);
orig_count = karg.count;
......@@ -3464,7 +3458,7 @@ static int drm32_free_bufs(unsigned int fd, unsigned int cmd, unsigned long arg)
drm32_buf_free_t *uarg = (drm32_buf_free_t *)arg;
drm_buf_free_t karg;
mm_segment_t old_fs;
int *ulist;
int __user *ulist;
int ret;
u32 tmp;
......@@ -3472,7 +3466,7 @@ static int drm32_free_bufs(unsigned int fd, unsigned int cmd, unsigned long arg)
get_user(tmp, &uarg->list))
return -EFAULT;
ulist = (int *) A(tmp);
ulist = A(tmp);
karg.list = kmalloc(karg.count * sizeof(int), GFP_KERNEL);
if (!karg.list)
......@@ -3510,7 +3504,7 @@ typedef struct drm32_buf_map {
static int drm32_map_bufs(unsigned int fd, unsigned int cmd, unsigned long arg)
{
drm32_buf_map_t *uarg = (drm32_buf_map_t *)arg;
drm32_buf_pub_t *ulist;
drm32_buf_pub_t __user *ulist;
drm_buf_map_t karg;
mm_segment_t old_fs;
int orig_count, ret, i;
......@@ -3521,8 +3515,8 @@ static int drm32_map_bufs(unsigned int fd, unsigned int cmd, unsigned long arg)
get_user(tmp2, &uarg->list))
return -EFAULT;
karg.virtual = (void *) A(tmp1);
ulist = (drm32_buf_pub_t *) A(tmp2);
karg.virtual = A(tmp1);
ulist = A(tmp2);
orig_count = karg.count;
......@@ -3538,7 +3532,7 @@ static int drm32_map_bufs(unsigned int fd, unsigned int cmd, unsigned long arg)
get_user(tmp1, &ulist[i].address))
goto out;
karg.list[i].address = (void *) A(tmp1);
karg.list[i].address = A(tmp1);
}
old_fs = get_fs();
......@@ -3589,7 +3583,7 @@ typedef struct drm32_dma {
static int drm32_dma(unsigned int fd, unsigned int cmd, unsigned long arg)
{
drm32_dma_t *uarg = (drm32_dma_t *) arg;
int *u_si, *u_ss, *u_ri, *u_rs;
int __user *u_si, *u_ss, *u_ri, *u_rs;
drm_dma_t karg;
mm_segment_t old_fs;
int ret;
......@@ -3610,10 +3604,10 @@ static int drm32_dma(unsigned int fd, unsigned int cmd, unsigned long arg)
get_user(karg.granted_count, &uarg->granted_count))
return -EFAULT;
u_si = (int *) A(tmp1);
u_ss = (int *) A(tmp2);
u_ri = (int *) A(tmp3);
u_rs = (int *) A(tmp4);
u_si = A(tmp1);
u_ss = A(tmp2);
u_ri = A(tmp3);
u_rs = A(tmp4);
if (karg.send_count) {
karg.send_indices = kmalloc(karg.send_count * sizeof(int), GFP_KERNEL);
......@@ -3699,7 +3693,7 @@ typedef struct drm32_ctx_res {
static int drm32_res_ctx(unsigned int fd, unsigned int cmd, unsigned long arg)
{
drm32_ctx_res_t *uarg = (drm32_ctx_res_t *) arg;
drm_ctx_t *ulist;
drm_ctx_t __user *ulist;
drm_ctx_res_t karg;
mm_segment_t old_fs;
int orig_count, ret;
......@@ -3710,7 +3704,7 @@ static int drm32_res_ctx(unsigned int fd, unsigned int cmd, unsigned long arg)
get_user(tmp, &uarg->contexts))
return -EFAULT;
ulist = (drm_ctx_t *) A(tmp);
ulist = A(tmp);
orig_count = karg.count;
if (karg.count && ulist) {
......@@ -3817,7 +3811,8 @@ static int do_usbdevfs_control(unsigned int fd, unsigned int cmd, unsigned long
struct usbdevfs_ctrltransfer32 *uctrl;
mm_segment_t old_fs;
__u32 udata;
void *uptr, *kptr;
void __user *uptr;
void *kptr;
int err;
uctrl = (struct usbdevfs_ctrltransfer32 *) arg;
......@@ -3829,7 +3824,7 @@ static int do_usbdevfs_control(unsigned int fd, unsigned int cmd, unsigned long
if (get_user(udata, &uctrl->data))
return -EFAULT;
uptr = (void *) A(udata);
uptr = A(udata);
/* In usbdevice_fs, it limits the control buffer to a page,
* for simplicity so do we.
......@@ -3878,7 +3873,8 @@ static int do_usbdevfs_bulk(unsigned int fd, unsigned int cmd, unsigned long arg
struct usbdevfs_bulktransfer32 *ubulk;
mm_segment_t old_fs;
__u32 udata;
void *uptr, *kptr;
void __user *uptr;
void *kptr;
int err;
ubulk = (struct usbdevfs_bulktransfer32 *) arg;
......@@ -3889,7 +3885,7 @@ static int do_usbdevfs_bulk(unsigned int fd, unsigned int cmd, unsigned long arg
get_user(udata, &ubulk->data))
return -EFAULT;
uptr = (void *) A(udata);
uptr = A(udata);
/* In usbdevice_fs, it limits the control buffer to a page,
* for simplicity so do we.
......@@ -4072,7 +4068,8 @@ static int do_usbdevfs_urb(unsigned int fd, unsigned int cmd, unsigned long arg)
struct usbdevfs_urb32 *uurb;
mm_segment_t old_fs;
__u32 udata;
void *uptr, *kptr;
void __user *uptr;
void *kptr;
unsigned int buflen;
int err;
......@@ -4096,7 +4093,7 @@ static int do_usbdevfs_urb(unsigned int fd, unsigned int cmd, unsigned long arg)
err = -EFAULT;
if (__get_user(udata, &uurb->buffer))
goto out;
uptr = (void *) A(udata);
uptr = A(udata);
err = -ENOMEM;
buflen = kurb->buffer_length;
......@@ -4153,7 +4150,7 @@ static int do_usbdevfs_reapurb(unsigned int fd, unsigned int cmd, unsigned long
set_fs(old_fs);
if (err >= 0 &&
put_user(((u32)(long)kptr), (u32 *) A(arg)))
put_user(((u32)(long)kptr), (u32 __user *) A(arg)))
err = -EFAULT;
return err;
......@@ -4205,7 +4202,7 @@ static int mtd_rw_oob(unsigned int fd, unsigned int cmd, unsigned long arg)
struct mtd_oob_buf32 *uarg = (struct mtd_oob_buf32 *)arg;
struct mtd_oob_buf karg;
u32 tmp;
char *ptr;
char __user *ptr;
int ret;
if (get_user(karg.start, &uarg->start) ||
......@@ -4213,7 +4210,7 @@ static int mtd_rw_oob(unsigned int fd, unsigned int cmd, unsigned long arg)
get_user(tmp, &uarg->ptr))
return -EFAULT;
ptr = (char *)A(tmp);
ptr = A(tmp);
if (0 >= karg.length)
return -EINVAL;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7