[PATCH] sparse: trivial parts of fs/* annotation

	fs/*, fs/proc/*, fs/nfsd/*, fs/autofs4/* 

The only interdependent group is the fs/autofs4/* stuff.

fs/autofs4/autofs_i.h

@@ -144,9 +144,10 @@ void autofs4_free_ino(struct autofs_info *);
 /* Expiration */
 int is_autofs4_dentry(struct dentry *);
 int autofs4_expire_run(struct super_block *, struct vfsmount *,
-			struct autofs_sb_info *, struct autofs_packet_expire *);
+			struct autofs_sb_info *,
+			struct autofs_packet_expire __user *);
 int autofs4_expire_multi(struct super_block *, struct vfsmount *,
-			struct autofs_sb_info *, int *);
+			struct autofs_sb_info *, int __user *);
 
 /* Operations structures */
 

fs/autofs4/expire.c

@@ -306,7 +306,7 @@ static struct dentry *autofs4_expire(struct super_block *sb,
 int autofs4_expire_run(struct super_block *sb,
 		      struct vfsmount *mnt,
 		      struct autofs_sb_info *sbi,
-		      struct autofs_packet_expire *pkt_p)
+		      struct autofs_packet_expire __user *pkt_p)
 {
 	struct autofs_packet_expire pkt;
 	struct dentry *dentry;
@@ -333,7 +333,7 @@ int autofs4_expire_run(struct super_block *sb,
 /* Call repeatedly until it returns -EAGAIN, meaning there's nothing
    more to be done */
 int autofs4_expire_multi(struct super_block *sb, struct vfsmount *mnt,
-			struct autofs_sb_info *sbi, int *arg)
+			struct autofs_sb_info *sbi, int __user *arg)
 {
 	struct dentry *dentry;
 	int ret = -EAGAIN;

fs/autofs4/root.c

@@ -670,7 +670,7 @@ static int autofs4_dir_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 
 /* Get/set timeout ioctl() operation */
 static inline int autofs4_get_set_timeout(struct autofs_sb_info *sbi,
-					 unsigned long *p)
+					 unsigned long __user *p)
 {
 	int rv;
 	unsigned long ntimeout;
@@ -688,13 +688,13 @@ static inline int autofs4_get_set_timeout(struct autofs_sb_info *sbi,
 }
 
 /* Return protocol version */
-static inline int autofs4_get_protover(struct autofs_sb_info *sbi, int *p)
+static inline int autofs4_get_protover(struct autofs_sb_info *sbi, int __user *p)
 {
 	return put_user(sbi->version, p);
 }
 
 /* Return protocol sub version */
-static inline int autofs4_get_protosubver(struct autofs_sb_info *sbi, int *p)
+static inline int autofs4_get_protosubver(struct autofs_sb_info *sbi, int __user *p)
 {
 	return put_user(sbi->sub_version, p);
 }
@@ -703,7 +703,7 @@ static inline int autofs4_get_protosubver(struct autofs_sb_info *sbi, int *p)
  * Tells the daemon whether we need to reghost or not. Also, clears
  * the reghost_needed flag.
  */
-static inline int autofs4_ask_reghost(struct autofs_sb_info *sbi, int *p)
+static inline int autofs4_ask_reghost(struct autofs_sb_info *sbi, int __user *p)
 {
 	int status;
 
@@ -720,7 +720,7 @@ static inline int autofs4_ask_reghost(struct autofs_sb_info *sbi, int *p)
 /*
  * Enable / Disable reghosting ioctl() operation
  */
-static inline int autofs4_toggle_reghost(struct autofs_sb_info *sbi, int *p)
+static inline int autofs4_toggle_reghost(struct autofs_sb_info *sbi, int __user *p)
 {
 	int status;
 	int val;
@@ -740,7 +740,7 @@ static inline int autofs4_toggle_reghost(struct autofs_sb_info *sbi, int *p)
 /*
 * Tells the daemon whether it can umount the autofs mount.
 */
-static inline int autofs4_ask_umount(struct vfsmount *mnt, int *p)
+static inline int autofs4_ask_umount(struct vfsmount *mnt, int __user *p)
 {
 	int status = 0;
 
@@ -774,6 +774,7 @@ static int autofs4_root_ioctl(struct inode *inode, struct file *filp,
 			     unsigned int cmd, unsigned long arg)
 {
 	struct autofs_sb_info *sbi = autofs4_sbi(inode->i_sb);
+	void __user *p = (void __user *)arg;
 
 	DPRINTK("cmd = 0x%08x, arg = 0x%08lx, sbi = %p, pgrp = %u",
 		cmd,arg,sbi,process_group(current));
@@ -794,28 +795,26 @@ static int autofs4_root_ioctl(struct inode *inode, struct file *filp,
 		autofs4_catatonic_mode(sbi);
 		return 0;
 	case AUTOFS_IOC_PROTOVER: /* Get protocol version */
-		return autofs4_get_protover(sbi, (int *)arg);
+		return autofs4_get_protover(sbi, p);
 	case AUTOFS_IOC_PROTOSUBVER: /* Get protocol sub version */
-		return autofs4_get_protosubver(sbi, (int *)arg);
+		return autofs4_get_protosubver(sbi, p);
 	case AUTOFS_IOC_SETTIMEOUT:
-		return autofs4_get_set_timeout(sbi,(unsigned long *)arg);
+		return autofs4_get_set_timeout(sbi, p);
 
 	case AUTOFS_IOC_TOGGLEREGHOST:
-		return autofs4_toggle_reghost(sbi, (int *) arg);
+		return autofs4_toggle_reghost(sbi, p);
 	case AUTOFS_IOC_ASKREGHOST:
-		return autofs4_ask_reghost(sbi, (int *) arg);
+		return autofs4_ask_reghost(sbi, p);
 
 	case AUTOFS_IOC_ASKUMOUNT:
-		return autofs4_ask_umount(filp->f_vfsmnt, (int *) arg);
+		return autofs4_ask_umount(filp->f_vfsmnt, p);
 
 	/* return a single thing to expire */
 	case AUTOFS_IOC_EXPIRE:
-		return autofs4_expire_run(inode->i_sb,filp->f_vfsmnt,sbi,
-					  (struct autofs_packet_expire *)arg);
+		return autofs4_expire_run(inode->i_sb,filp->f_vfsmnt,sbi, p);
 	/* same as above, but can send multiple expires through pipe */
 	case AUTOFS_IOC_EXPIRE_MULTI:
-		return autofs4_expire_multi(inode->i_sb,filp->f_vfsmnt,sbi,
-					    (int *)arg);
+		return autofs4_expire_multi(inode->i_sb,filp->f_vfsmnt,sbi, p);
 
 	default:
 		return -ENOSYS;

fs/binfmt_elf.c

@@ -110,18 +110,18 @@ static void padzero(unsigned long elf_bss)
 	nbyte = ELF_PAGEOFFSET(elf_bss);
 	if (nbyte) {
 		nbyte = ELF_MIN_ALIGN - nbyte;
-		clear_user((void *) elf_bss, nbyte);
+		clear_user((void __user *) elf_bss, nbyte);
 	}
 }
 
 /* Let's use some macros to make this stack manipulation a litle clearer */
 #ifdef CONFIG_STACK_GROWSUP
-#define STACK_ADD(sp, items) ((elf_addr_t *)(sp) + (items))
+#define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
 #define STACK_ROUND(sp, items) \
 	((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
-#define STACK_ALLOC(sp, len) ({ elf_addr_t *old_sp = (elf_addr_t *)sp; sp += len; old_sp; })
+#define STACK_ALLOC(sp, len) ({ elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; old_sp; })
 #else
-#define STACK_ADD(sp, items) ((elf_addr_t *)(sp) - (items))
+#define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
 #define STACK_ROUND(sp, items) \
 	(((unsigned long) (sp - items)) &~ 15UL)
 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
@@ -135,8 +135,10 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr * exec,
 	unsigned long p = bprm->p;
 	int argc = bprm->argc;
 	int envc = bprm->envc;
-	elf_addr_t *argv, *envp;
-	elf_addr_t *sp, *u_platform;
+	elf_addr_t __user *argv;
+	elf_addr_t __user *envp;
+	elf_addr_t __user *sp;
+	elf_addr_t __user *u_platform;
 	const char *k_platform = ELF_PLATFORM;
 	int items;
 	elf_addr_t *elf_info;
@@ -169,7 +171,7 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr * exec,
 		if (smp_num_siblings > 1)
 			STACK_ALLOC(p, ((current->pid % 64) << 7));
 #endif
-		u_platform = (elf_addr_t *)STACK_ALLOC(p, len);
+		u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 		__copy_to_user(u_platform, k_platform, len);
 	}
 
@@ -222,10 +224,10 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr * exec,
 
 	/* Point sp at the lowest address on the stack */
 #ifdef CONFIG_STACK_GROWSUP
-	sp = (elf_addr_t *)bprm->p - items - ei_index;
+	sp = (elf_addr_t __user *)bprm->p - items - ei_index;
 	bprm->exec = (unsigned long) sp; /* XXX: PARISC HACK */
 #else
-	sp = (elf_addr_t *)bprm->p;
+	sp = (elf_addr_t __user *)bprm->p;
 #endif
 
 	/* Now, let's put argc (and argv, envp if appropriate) on the stack */
@@ -245,7 +247,7 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr * exec,
 	while (argc-- > 0) {
 		size_t len;
 		__put_user((elf_addr_t)p, argv++);
-		len = strnlen_user((void *)p, PAGE_SIZE*MAX_ARG_PAGES);
+		len = strnlen_user((void __user *)p, PAGE_SIZE*MAX_ARG_PAGES);
 		if (!len || len > PAGE_SIZE*MAX_ARG_PAGES)
 			return;
 		p += len;
@@ -255,7 +257,7 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr * exec,
 	while (envc-- > 0) {
 		size_t len;
 		__put_user((elf_addr_t)p, envp++);
-		len = strnlen_user((void *)p, PAGE_SIZE*MAX_ARG_PAGES);
+		len = strnlen_user((void __user *)p, PAGE_SIZE*MAX_ARG_PAGES);
 		if (!len || len > PAGE_SIZE*MAX_ARG_PAGES)
 			return;
 		p += len;
@@ -264,7 +266,7 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr * exec,
 	current->mm->env_end = p;
 
 	/* Put the elf_info on the stack in the right place.  */
-	sp = (elf_addr_t *)envp + 1;
+	sp = (elf_addr_t __user *)envp + 1;
 	copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t));
 }
 
@@ -418,7 +420,7 @@ static unsigned long load_aout_interp(struct exec * interp_ex,
 			     struct file * interpreter)
 {
 	unsigned long text_data, elf_entry = ~0UL;
-	char * addr;
+	char __user * addr;
 	loff_t offset;
 
 	current->mm->end_code = interp_ex->a_text;
@@ -429,12 +431,12 @@ static unsigned long load_aout_interp(struct exec * interp_ex,
 	switch (N_MAGIC(*interp_ex)) {
 	case OMAGIC:
 		offset = 32;
-		addr = (char *) 0;
+		addr = (char __user *)0;
 		break;
 	case ZMAGIC:
 	case QMAGIC:
 		offset = N_TXTOFF(*interp_ex);
-		addr = (char *) N_TXTADDR(*interp_ex);
+		addr = (char __user *) N_TXTADDR(*interp_ex);
 		break;
 	default:
 		goto out;
@@ -734,7 +736,7 @@ static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 				nbyte = ELF_MIN_ALIGN - nbyte;
 				if (nbyte > elf_brk - elf_bss)
 					nbyte = elf_brk - elf_bss;
-				clear_user((void *) elf_bss + load_bias, nbyte);
+				clear_user((void __user *) elf_bss + load_bias, nbyte);
 			}
 		}
 
@@ -1184,7 +1186,7 @@ static void fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
 	if (len >= ELF_PRARGSZ)
 		len = ELF_PRARGSZ-1;
 	copy_from_user(&psinfo->pr_psargs,
-		       (const char *)mm->arg_start, len);
+		       (const char __user *)mm->arg_start, len);
 	for(i = 0; i < len; i++)
 		if (psinfo->pr_psargs[i] == 0)
 			psinfo->pr_psargs[i] = ' ';

fs/dcookies.c

@@ -142,7 +142,7 @@ int get_dcookie(struct dentry * dentry, struct vfsmount * vfsmnt,
 /* And here is where the userspace process can look up the cookie value
  * to retrieve the path.
  */
-asmlinkage long sys_lookup_dcookie(u64 cookie64, char * buf, size_t len)
+asmlinkage long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len)
 {
 	unsigned long cookie = (unsigned long)cookie64;
 	int err = -EINVAL;

fs/ioctl.c

@@ -18,6 +18,7 @@ static int file_ioctl(struct file *filp,unsigned int cmd,unsigned long arg)
 	int error;
 	int block;
 	struct inode * inode = filp->f_dentry->d_inode;
+	int __user *p = (int __user *)arg;
 
 	switch (cmd) {
 		case FIBMAP:
@@ -29,18 +30,18 @@ static int file_ioctl(struct file *filp,unsigned int cmd,unsigned long arg)
 				return -EINVAL;
 			if (!capable(CAP_SYS_RAWIO))
 				return -EPERM;
-			if ((error = get_user(block, (int *) arg)) != 0)
+			if ((error = get_user(block, p)) != 0)
 				return error;
 
 			res = mapping->a_ops->bmap(mapping, block);
-			return put_user(res, (int *) arg);
+			return put_user(res, p);
 		}
 		case FIGETBSZ:
 			if (inode->i_sb == NULL)
 				return -EBADF;
-			return put_user(inode->i_sb->s_blocksize, (int *) arg);
+			return put_user(inode->i_sb->s_blocksize, p);
 		case FIONREAD:
-			return put_user(i_size_read(inode) - filp->f_pos, (int *) arg);
+			return put_user(i_size_read(inode) - filp->f_pos, p);
 	}
 	if (filp->f_op && filp->f_op->ioctl)
 		return filp->f_op->ioctl(inode, filp, cmd, arg);

fs/nfsd/nfsctl.c

@@ -91,7 +91,7 @@ struct argresp {
  * possibly a read which collects the result - which is stored in a 
  * file-local buffer.
  */
-static ssize_t TA_write(struct file *file, const char *buf, size_t size, loff_t *pos)
+static ssize_t TA_write(struct file *file, const char __user *buf, size_t size, loff_t *pos)
 {
 	ino_t ino =  file->f_dentry->d_inode->i_ino;
 	struct argresp *ar;
@@ -130,7 +130,7 @@ static ssize_t TA_write(struct file *file, const char *buf, size_t size, loff_t
 }
 
 
-static ssize_t TA_read(struct file *file, char *buf, size_t size, loff_t *pos)
+static ssize_t TA_read(struct file *file, char __user *buf, size_t size, loff_t *pos)
 {
 	struct argresp *ar;
 	ssize_t rv = 0;

fs/proc/base.c

@@ -511,7 +511,7 @@ static struct file_operations proc_mounts_operations = {
 
 #define PROC_BLOCK_SIZE	(3*1024)		/* 4K page size but our output routines use some slack for overruns */
 
-static ssize_t proc_info_read(struct file * file, char * buf,
+static ssize_t proc_info_read(struct file * file, char __user * buf,
 			  size_t count, loff_t *ppos)
 {
 	struct inode * inode = file->f_dentry->d_inode;
@@ -557,7 +557,7 @@ static int mem_open(struct inode* inode, struct file* file)
 	return 0;
 }
 
-static ssize_t mem_read(struct file * file, char * buf,
+static ssize_t mem_read(struct file * file, char __user * buf,
 			size_t count, loff_t *ppos)
 {
 	struct task_struct *task = proc_task(file->f_dentry->d_inode);
@@ -710,7 +710,7 @@ static int proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
 }
 
 static int do_proc_readlink(struct dentry *dentry, struct vfsmount *mnt,
-			    char *buffer, int buflen)
+			    char __user *buffer, int buflen)
 {
 	struct inode * inode;
 	char *tmp = (char*)__get_free_page(GFP_KERNEL), *path;
@@ -735,7 +735,7 @@ static int do_proc_readlink(struct dentry *dentry, struct vfsmount *mnt,
 	return len;
 }
 
-static int proc_pid_readlink(struct dentry * dentry, char * buffer, int buflen)
+static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int buflen)
 {
 	int error = -EACCES;
 	struct inode *inode = dentry->d_inode;

fs/readdir.c

@@ -50,7 +50,7 @@ EXPORT_SYMBOL(vfs_readdir);
  * anyway. Thus the special "fillonedir()" function for that
  * case (the low-level handlers don't need to care about this).
  */
-#define NAME_OFFSET(de) ((int) ((de)->d_name - (char *) (de)))
+#define NAME_OFFSET(de) ((int) ((de)->d_name - (char __user *) (de)))
 #define ROUND_UP(x) (((x)+sizeof(long)-1) & ~(sizeof(long)-1))
 
 #ifdef __ARCH_WANT_OLD_READDIR
@@ -77,7 +77,7 @@ static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset
 		return -EINVAL;
 	buf->result++;
 	dirent = buf->dirent;
-	if (!access_ok(VERIFY_WRITE, (unsigned long)dirent,
+	if (!access_ok(VERIFY_WRITE, dirent,
 			(unsigned long)(dirent->d_name + namlen + 1) -
 				(unsigned long)dirent))
 		goto efault;
@@ -160,7 +160,7 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
 		goto efault;
 	if (__put_user(0, dirent->d_name + namlen))
 		goto efault;
-	if (__put_user(d_type, (char *) dirent + reclen - 1))
+	if (__put_user(d_type, (char __user *) dirent + reclen - 1))
 		goto efault;
 	buf->previous = dirent;
 	dirent = (void __user *)dirent + reclen;