Add more user pointer annotations.

arch/i386/kernel/process.c

@@ -324,7 +324,7 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long esp,
 		int idx;
 
 		err = -EFAULT;
-		if (copy_from_user(&info, (void *)childregs->esi, sizeof(info)))
+		if (copy_from_user(&info, (void __user *)childregs->esi, sizeof(info)))
 			goto out;
 		err = -EINVAL;
 		if (LDT_empty(&info))
@@ -567,11 +567,14 @@ asmlinkage int sys_execve(struct pt_regs regs)
 	int error;
 	char * filename;
 
-	filename = getname((char *) regs.ebx);
+	filename = getname((char __user *) regs.ebx);
 	error = PTR_ERR(filename);
 	if (IS_ERR(filename))
 		goto out;
-	error = do_execve(filename, (char **) regs.ecx, (char **) regs.edx, &regs);
+	error = do_execve(filename,
+			(char __user * __user *) regs.ecx,
+			(char __user * __user *) regs.edx,
+			&regs);
 	if (error == 0) {
 		current->ptrace &= ~PT_DTRACE;
 		/* Make sure we don't return using sysenter.. */
@@ -633,7 +636,7 @@ static int get_free_idx(void)
 /*
  * Set a given TLS descriptor:
  */
-asmlinkage int sys_set_thread_area(struct user_desc *u_info)
+asmlinkage int sys_set_thread_area(struct user_desc __user *u_info)
 {
 	struct thread_struct *t = &current->thread;
 	struct user_desc info;
@@ -700,7 +703,7 @@ asmlinkage int sys_set_thread_area(struct user_desc *u_info)
 #define GET_PRESENT(desc)	(((desc)->b >> 15) & 1)
 #define GET_USEABLE(desc)	(((desc)->b >> 20) & 1)
 
-asmlinkage int sys_get_thread_area(struct user_desc *u_info)
+asmlinkage int sys_get_thread_area(struct user_desc __user *u_info)
 {
 	struct user_desc info;
 	struct desc_struct *desc;

fs/exec.c

@@ -491,7 +491,8 @@ int kernel_read(struct file *file, unsigned long offset,
 
 	old_fs = get_fs();
 	set_fs(get_ds());
-	result = vfs_read(file, addr, count, &pos);
+	/* The cast to a user pointer is valid due to the set_fs() */
+	result = vfs_read(file, (void __user *)addr, count, &pos);
 	set_fs(old_fs);
 	return result;
 }

include/linux/binfmts.h

@@ -56,7 +56,7 @@ extern void remove_arg_zero(struct linux_binprm *);
 extern int search_binary_handler(struct linux_binprm *,struct pt_regs *);
 extern int flush_old_exec(struct linux_binprm * bprm);
 extern int setup_arg_pages(struct linux_binprm * bprm);
-extern int copy_strings(int argc,char ** argv,struct linux_binprm *bprm); 
+extern int copy_strings(int argc,char __user * __user * argv,struct linux_binprm *bprm); 
 extern int copy_strings_kernel(int argc,char ** argv,struct linux_binprm *bprm);
 extern void compute_creds(struct linux_binprm *binprm);
 extern int do_coredump(long signr, int exit_code, struct pt_regs * regs);

include/linux/sched.h

@@ -629,7 +629,7 @@ extern void daemonize(const char *, ...);
 extern int allow_signal(int);
 extern task_t *child_reaper;
 
-extern int do_execve(char *, char **, char **, struct pt_regs *);
+extern int do_execve(char *, char __user * __user *, char __user * __user *, struct pt_regs *);
 extern struct task_struct *do_fork(unsigned long, unsigned long, struct pt_regs *, unsigned long, int *, int *);
 
 #ifdef CONFIG_SMP

include/linux/uio.h

 #ifndef __LINUX_UIO_H
 #define __LINUX_UIO_H
 
+#include <linux/compiler.h>
 #include <linux/types.h>
 
 /*