[PATCH] sparse: ipc __user annotation

include/linux/sem.h

@@ -45,10 +45,10 @@ struct sembuf {
 /* arg for semctl system calls. */
 union semun {
 	int val;			/* value for SETVAL */
-	struct semid_ds *buf;		/* buffer for IPC_STAT & IPC_SET */
-	unsigned short *array;		/* array for GETALL & SETALL */
-	struct seminfo *__buf;		/* buffer for IPC_INFO */
-	void *__pad;
+	struct semid_ds __user *buf;	/* buffer for IPC_STAT & IPC_SET */
+	unsigned short __user *array;	/* array for GETALL & SETALL */
+	struct seminfo __user *__buf;	/* buffer for IPC_INFO */
+	void __user *__pad;
 };
 
 struct  seminfo {

ipc/compat.c

@@ -134,7 +134,7 @@ static inline int compat_ipc_parse_version(int *cmd)
 }
 
 static inline int __get_compat_ipc64_perm(struct ipc64_perm *p64,
-					  struct compat_ipc64_perm *up64)
+					  struct compat_ipc64_perm __user *up64)
 {
 	int err;
 
@@ -145,7 +145,7 @@ static inline int __get_compat_ipc64_perm(struct ipc64_perm *p64,
 }
 
 static inline int __get_compat_ipc_perm(struct ipc64_perm *p,
-					struct compat_ipc_perm *up)
+					struct compat_ipc_perm __user *up)
 {
 	int err;
 
@@ -156,7 +156,7 @@ static inline int __get_compat_ipc_perm(struct ipc64_perm *p,
 }
 
 static inline int __put_compat_ipc64_perm(struct ipc64_perm *p64,
-					  struct compat_ipc64_perm *up64)
+					  struct compat_ipc64_perm __user *up64)
 {
 	int err;
 
@@ -171,7 +171,7 @@ static inline int __put_compat_ipc64_perm(struct ipc64_perm *p64,
 }
 
 static inline int __put_compat_ipc_perm(struct ipc64_perm *p,
-					struct compat_ipc_perm *up)
+					struct compat_ipc_perm __user *up)
 {
 	int err;
 	compat_uid_t u;
@@ -192,7 +192,7 @@ static inline int __put_compat_ipc_perm(struct ipc64_perm *p,
 }
 
 static inline int get_compat_semid64_ds(struct semid64_ds *s64,
-					struct compat_semid64_ds *up64)
+					struct compat_semid64_ds __user *up64)
 {
 	if (!access_ok (VERIFY_READ, up64, sizeof(*up64)))
 		return -EFAULT;
@@ -200,7 +200,7 @@ static inline int get_compat_semid64_ds(struct semid64_ds *s64,
 }
 
 static inline int get_compat_semid_ds(struct semid64_ds *s,
-				      struct compat_semid_ds *up)
+				      struct compat_semid_ds __user *up)
 {
 	if (!access_ok (VERIFY_READ, up, sizeof(*up)))
 		return -EFAULT;
@@ -208,7 +208,7 @@ static inline int get_compat_semid_ds(struct semid64_ds *s,
 }
 
 static inline int put_compat_semid64_ds(struct semid64_ds *s64,
-					struct compat_semid64_ds *up64)
+					struct compat_semid64_ds __user *up64)
 {
 	int err;
 
@@ -222,7 +222,7 @@ static inline int put_compat_semid64_ds(struct semid64_ds *s64,
 }
 
 static inline int put_compat_semid_ds(struct semid64_ds *s,
-				      struct compat_semid_ds *up)
+				      struct compat_semid_ds __user *up)
 {
 	int err;
 
@@ -413,7 +413,7 @@ static inline int get_compat_msqid(struct msqid64_ds *m,
 }
 
 static inline int put_compat_msqid64_ds(struct msqid64_ds *m64,
-				 struct compat_msqid64_ds __user __user *up64)
+				 struct compat_msqid64_ds __user *up64)
 {
 	int err;
 
@@ -450,7 +450,7 @@ static inline int put_compat_msqid_ds(struct msqid64_ds *m,
 	return err;
 }
 
-static inline int do_msgctl(int first, int second, void __user *buf)
+static inline int do_msgctl(int first, int second, void *buf)
 {
 	mm_segment_t old_fs;
 	int err;
@@ -712,7 +712,8 @@ long compat_sys_shmctl(int first, int second, void __user *uptr)
 long compat_sys_semtimedop(int semid, struct sembuf __user *tsems,
 		unsigned nsops, const struct compat_timespec __user *timeout)
 {
-	struct timespec ts, __user *ts64;
+	struct timespec ts;
+	struct timespec __user *ts64;
 
 	/* parameter checking precedence should mirror sys_semtimedop() */
 	if (nsops < 1 || semid < 0)

ipc/compat_mq.c

@@ -77,7 +77,8 @@ asmlinkage long compat_sys_mq_open(const char __user *u_name,
 static struct timespec __user *compat_prepare_timeout(
 			const struct compat_timespec __user *u_abs_timeout)
 {
-	struct timespec ts, __user *u_ts;
+	struct timespec ts;
+	struct timespec __user *u_ts;
 
 	if (!u_abs_timeout)
 		return 0;
@@ -110,7 +111,7 @@ asmlinkage ssize_t compat_sys_mq_timedreceive(mqd_t mqdes,
 			size_t msg_len, unsigned int __user *u_msg_prio,
 			const struct compat_timespec __user *u_abs_timeout)
 {
-	struct timespec *u_ts;
+	struct timespec __user *u_ts;
 
 	u_ts = compat_prepare_timeout(u_abs_timeout);
 	if (IS_ERR(u_ts))

ipc/mqueue.c

@@ -780,7 +780,7 @@ asmlinkage long sys_mq_timedsend(mqd_t mqdes, const char __user *u_msg_ptr,
 
 	/* First try to allocate memory, before doing anything with
 	 * existing queues. */
-	msg_ptr = load_msg((void *)u_msg_ptr, msg_len);
+	msg_ptr = load_msg(u_msg_ptr, msg_len);
 	if (unlikely(IS_ERR(msg_ptr))) {
 		ret = PTR_ERR(msg_ptr);
 		goto out_fput;

ipc/msg.c

@@ -229,7 +229,7 @@ asmlinkage long sys_msgget (key_t key, int msgflg)
 	return ret;
 }
 
-static inline unsigned long copy_msqid_to_user(void *buf, struct msqid64_ds *in, int version)
+static inline unsigned long copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
 {
 	switch(version) {
 	case IPC_64:
@@ -280,7 +280,7 @@ struct msq_setbuf {
 	mode_t		mode;
 };
 
-static inline unsigned long copy_msqid_from_user(struct msq_setbuf *out, void *buf, int version)
+static inline unsigned long copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version)
 {
 	switch(version) {
 	case IPC_64:
@@ -320,7 +320,7 @@ static inline unsigned long copy_msqid_from_user(struct msq_setbuf *out, void *b
 	}
 }
 
-asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds *buf)
+asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
 {
 	int err, version;
 	struct msg_queue *msq;
@@ -539,7 +539,7 @@ static inline int pipelined_send(struct msg_queue* msq, struct msg_msg* msg)
 	return 0;
 }
 
-asmlinkage long sys_msgsnd (int msqid, struct msgbuf *msgp, size_t msgsz, int msgflg)
+asmlinkage long sys_msgsnd (int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg)
 {
 	struct msg_queue *msq;
 	struct msg_msg *msg;
@@ -645,7 +645,7 @@ static inline int convert_mode(long* msgtyp, int msgflg)
 	return SEARCH_EQUAL;
 }
 
-asmlinkage long sys_msgrcv (int msqid, struct msgbuf *msgp, size_t msgsz,
+asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz,
 			    long msgtyp, int msgflg)
 {
 	struct msg_queue *msq;

ipc/msgutil.c

@@ -25,7 +25,7 @@ struct msg_msgseg {
 #define DATALEN_MSG	(PAGE_SIZE-sizeof(struct msg_msg))
 #define DATALEN_SEG	(PAGE_SIZE-sizeof(struct msg_msgseg))
 
-struct msg_msg *load_msg(void __user *src, int len)
+struct msg_msg *load_msg(const void __user *src, int len)
 {
 	struct msg_msg *msg;
 	struct msg_msgseg **pseg;
@@ -49,7 +49,7 @@ struct msg_msg *load_msg(void __user *src, int len)
 	}
 
 	len -= alen;
-	src = ((char *)src) + alen;
+	src = ((char __user *)src) + alen;
 	pseg = &msg->next;
 	while (len > 0) {
 		struct msg_msgseg *seg;
@@ -70,7 +70,7 @@ struct msg_msg *load_msg(void __user *src, int len)
 		}
 		pseg = &seg->next;
 		len -= alen;
-		src = ((char *)src) + alen;
+		src = ((char __user *)src) + alen;
 	}
 
 	err = security_msg_msg_alloc(msg);
@@ -96,7 +96,7 @@ int store_msg(void __user *dest, struct msg_msg *msg, int len)
 		return -1;
 
 	len -= alen;
-	dest = ((char *)dest) + alen;
+	dest = ((char __user *)dest) + alen;
 	seg = msg->next;
 	while (len > 0) {
 		alen = len;
@@ -105,7 +105,7 @@ int store_msg(void __user *dest, struct msg_msg *msg, int len)
 		if (copy_to_user(dest, seg + 1, alen))
 			return -1;
 		len -= alen;
-		dest = ((char *)dest) + alen;
+		dest = ((char __user *)dest) + alen;
 		seg = seg->next;
 	}
 	return 0;

ipc/sem.c

@@ -610,7 +610,7 @@ static int semctl_main(int semid, int semnum, int cmd, int version, union semun
 	switch (cmd) {
 	case GETALL:
 	{
-		ushort *array = arg.array;
+		ushort __user *array = arg.array;
 		int i;
 
 		if(nsems > SEMMSL_FAST) {

ipc/util.h

@@ -68,7 +68,7 @@ int ipc_parse_version (int *cmd);
 #endif
 
 extern void free_msg(struct msg_msg *msg);
-extern struct msg_msg *load_msg(void __user *src, int len);
+extern struct msg_msg *load_msg(const void __user *src, int len);
 extern int store_msg(void __user *dest, struct msg_msg *msg, int len);
 
 #endif