[PATCH] sparse: trivial part of net/* annotation

include/linux/inetdevice.h

@@ -96,7 +96,7 @@ extern int unregister_inetaddr_notifier(struct notifier_block *nb);
 
 extern struct net_device 	*ip_dev_find(u32 addr);
 extern int		inet_addr_onlink(struct in_device *in_dev, u32 a, u32 b);
-extern int		devinet_ioctl(unsigned int cmd, void *);
+extern int		devinet_ioctl(unsigned int cmd, void __user *);
 extern void		devinet_init(void);
 extern struct in_device *inetdev_init(struct net_device *dev);
 extern struct in_device	*inetdev_by_index(int);

include/net/addrconf.h

@@ -52,9 +52,9 @@ struct prefix_info {
 extern void			addrconf_init(void);
 extern void			addrconf_cleanup(void);
 
-extern int			addrconf_add_ifaddr(void *arg);
-extern int			addrconf_del_ifaddr(void *arg);
-extern int			addrconf_set_dstaddr(void *arg);
+extern int			addrconf_add_ifaddr(void __user *arg);
+extern int			addrconf_del_ifaddr(void __user *arg);
+extern int			addrconf_set_dstaddr(void __user *arg);
 
 extern int			ipv6_chk_addr(struct in6_addr *addr,
 					      struct net_device *dev,

include/net/arp.h

@@ -13,7 +13,7 @@ extern void	arp_init(void);
 extern int	arp_rcv(struct sk_buff *skb, struct net_device *dev,
 			struct packet_type *pt);
 extern int	arp_find(unsigned char *haddr, struct sk_buff *skb);
-extern int	arp_ioctl(unsigned int cmd, void *arg);
+extern int	arp_ioctl(unsigned int cmd, void __user *arg);
 extern void     arp_send(int type, int ptype, u32 dest_ip, 
 			 struct net_device *dev, u32 src_ip, 
 			 unsigned char *dest_hw, unsigned char *src_hw, unsigned char *th);

include/net/compat.h

@@ -29,9 +29,9 @@ struct compat_cmsghdr {
 
 extern int get_compat_msghdr(struct msghdr *, struct compat_msghdr __user *);
 extern int verify_compat_iovec(struct msghdr *, struct iovec *, char *, int);
-extern asmlinkage long compat_sys_sendmsg(int,struct compat_msghdr *,unsigned);
-extern asmlinkage long compat_sys_recvmsg(int,struct compat_msghdr *,unsigned);
-extern asmlinkage long compat_sys_getsockopt(int, int, int, char *, int *);
+extern asmlinkage long compat_sys_sendmsg(int,struct compat_msghdr __user *,unsigned);
+extern asmlinkage long compat_sys_recvmsg(int,struct compat_msghdr __user *,unsigned);
+extern asmlinkage long compat_sys_getsockopt(int, int, int, char __user *, int __user *);
 extern int put_cmsg_compat(struct msghdr*, int, int, int, void *);
 extern int cmsghdr_from_user_compat_to_kern(struct msghdr *, unsigned char *,
 		int);

include/net/ip.h

@@ -300,11 +300,11 @@ extern int ipv4_proc_init(void);
  * fed into the routing cache should use these handlers.
  */
 int ipv4_doint_and_flush(ctl_table *ctl, int write,
-			 struct file* filp, void *buffer,
+			 struct file* filp, void __user *buffer,
 			 size_t *lenp);
-int ipv4_doint_and_flush_strategy(ctl_table *table, int *name, int nlen,
-				  void *oldval, size_t *oldlenp,
-				  void *newval, size_t newlen, 
+int ipv4_doint_and_flush_strategy(ctl_table *table, int __user *name, int nlen,
+				  void __user *oldval, size_t __user *oldlenp,
+				  void __user *newval, size_t newlen, 
 				  void **context);
 
 #endif	/* _IP_H */

include/net/ip6_route.h

@@ -35,7 +35,7 @@ extern int			ip6_route_me_harder(struct sk_buff *skb);
 extern void			ip6_route_init(void);
 extern void			ip6_route_cleanup(void);
 
-extern int			ipv6_route_ioctl(unsigned int cmd, void *arg);
+extern int			ipv6_route_ioctl(unsigned int cmd, void __user *arg);
 
 extern int			ip6_route_add(struct in6_rtmsg *rtmsg,
 					      struct nlmsghdr *,

net/compat.c

@@ -29,7 +29,7 @@
 #include <net/compat.h>
 
 static inline int iov_from_user_compat_to_kern(struct iovec *kiov,
-					  struct compat_iovec *uiov32,
+					  struct compat_iovec __user *uiov32,
 					  int niov)
 {
 	int tot_len = 0;
@@ -53,7 +53,7 @@ static inline int iov_from_user_compat_to_kern(struct iovec *kiov,
 	return tot_len;
 }
 
-int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr *umsg)
+int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
 {
 	compat_uptr_t tmp1, tmp2, tmp3;
 
@@ -98,7 +98,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
 	}
 
 	tot_len = iov_from_user_compat_to_kern(kern_iov,
-					  (struct compat_iovec *)kern_msg->msg_iov,
+					  (struct compat_iovec __user *)kern_msg->msg_iov,
 					  kern_msg->msg_iovlen);
 	if(tot_len >= 0)
 		kern_msg->msg_iov = kern_iov;
@@ -112,7 +112,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
 #define CMSG_COMPAT_ALIGN(len)	ALIGN((len), sizeof(s32))
 
 #define CMSG_COMPAT_DATA(cmsg)				\
-	((void *)((char *)(cmsg) + CMSG_COMPAT_ALIGN(sizeof(struct compat_cmsghdr))))
+	((void __user *)((char __user *)(cmsg) + CMSG_COMPAT_ALIGN(sizeof(struct compat_cmsghdr))))
 #define CMSG_COMPAT_SPACE(len)				\
 	(CMSG_COMPAT_ALIGN(sizeof(struct compat_cmsghdr)) + CMSG_COMPAT_ALIGN(len))
 #define CMSG_COMPAT_LEN(len)				\
@@ -120,20 +120,17 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
 
 #define CMSG_COMPAT_FIRSTHDR(msg)			\
 	(((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ?	\
-	 (struct compat_cmsghdr *)((msg)->msg_control) :		\
-	 (struct compat_cmsghdr *)NULL)
+	 (struct compat_cmsghdr __user *)((msg)->msg_control) :		\
+	 (struct compat_cmsghdr __user *)NULL)
 
-static inline struct compat_cmsghdr *cmsg_compat_nxthdr(struct msghdr *msg,
-		struct compat_cmsghdr *cmsg, int cmsg_len)
+static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
+		struct compat_cmsghdr __user *cmsg, int cmsg_len)
 {
-	struct compat_cmsghdr *ptr;
-
-	ptr = (struct compat_cmsghdr *)(((unsigned char *)cmsg) +
-			CMSG_COMPAT_ALIGN(cmsg_len));
-	if ((unsigned long)((char *)(ptr + 1) - (char *)msg->msg_control) >
+	char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
+	if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
 			msg->msg_controllen)
 		return NULL;
-	return ptr;
+	return (struct compat_cmsghdr __user *)ptr;
 }
 
 /* There is a lot of hair here because the alignment rules (and
@@ -143,7 +140,7 @@ static inline struct compat_cmsghdr *cmsg_compat_nxthdr(struct msghdr *msg,
 int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg,
 			       unsigned char *stackbuf, int stackbuf_size)
 {
-	struct compat_cmsghdr *ucmsg;
+	struct compat_cmsghdr __user *ucmsg;
 	struct cmsghdr *kcmsg, *kcmsg_base;
 	compat_size_t ucmlen;
 	__kernel_size_t kcmlen, tmp;
@@ -159,7 +156,7 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg,
 		if(CMSG_COMPAT_ALIGN(ucmlen) <
 		   CMSG_COMPAT_ALIGN(sizeof(struct compat_cmsghdr)))
 			return -EINVAL;
-		if((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control)
+		if((unsigned long)(((char __user *)ucmsg - (char __user *)kmsg->msg_control)
 				   + ucmlen) > kmsg->msg_controllen)
 			return -EINVAL;
 
@@ -217,7 +214,7 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg,
 int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *data)
 {
 	struct compat_timeval ctv;
-	struct compat_cmsghdr *cm = (struct compat_cmsghdr *) kmsg->msg_control;
+	struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
 	struct compat_cmsghdr cmhdr;
 	int cmlen;
 
@@ -255,17 +252,17 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
 
 void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
 {
-	struct compat_cmsghdr *cm = (struct compat_cmsghdr *) kmsg->msg_control;
+	struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
 	int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
 	int fdnum = scm->fp->count;
 	struct file **fp = scm->fp->fp;
-	int *cmfptr;
+	int __user *cmfptr;
 	int err = 0, i;
 
 	if (fdnum < fdmax)
 		fdmax = fdnum;
 
-	for (i = 0, cmfptr = (int *) CMSG_COMPAT_DATA(cm); i < fdmax; i++, cmfptr++) {
+	for (i = 0, cmfptr = (int __user *) CMSG_COMPAT_DATA(cm); i < fdmax; i++, cmfptr++) {
 		int new_fd;
 		err = get_unused_fd();
 		if (err < 0)
@@ -322,10 +319,10 @@ struct compat_ipt_replace {
 };
 
 static int do_netfilter_replace(int fd, int level, int optname,
-				char *optval, int optlen)
+				char __user *optval, int optlen)
 {
-	struct compat_ipt_replace *urepl = (struct compat_ipt_replace *)optval;
-	struct ipt_replace *repl_nat;
+	struct compat_ipt_replace __user *urepl;
+	struct ipt_replace __user *repl_nat;
 	char name[IPT_TABLE_MAXNAMELEN];
 	u32 origsize, tmp32, num_counters;
 	unsigned int repl_nat_size;
@@ -333,6 +330,7 @@ static int do_netfilter_replace(int fd, int level, int optname,
 	int i;
 	compat_uptr_t ucntrs;
 
+	urepl = (struct compat_ipt_replace __user *)optval;
 	if (get_user(origsize, &urepl->size))
 		return -EFAULT;
 
@@ -399,7 +397,7 @@ static int do_netfilter_replace(int fd, int level, int optname,
 
 
 	ret = sys_setsockopt(fd, level, optname,
-			     (char *)repl_nat, repl_nat_size);
+			     (char __user *)repl_nat, repl_nat_size);
 
 out:
 	return ret;
@@ -414,10 +412,10 @@ struct compat_sock_fprog {
 };
 
 static int do_set_attach_filter(int fd, int level, int optname,
-				char *optval, int optlen)
+				char __user *optval, int optlen)
 {
-	struct compat_sock_fprog *fprog32 = (struct compat_sock_fprog *)optval;
-	struct sock_fprog *kfprog = compat_alloc_user_space(sizeof(struct sock_fprog)); 
+	struct compat_sock_fprog __user *fprog32 = (struct compat_sock_fprog __user *)optval;
+	struct sock_fprog __user *kfprog = compat_alloc_user_space(sizeof(struct sock_fprog)); 
 	compat_uptr_t ptr;
 	u16 len;
 
@@ -429,13 +427,13 @@ static int do_set_attach_filter(int fd, int level, int optname,
 	    __put_user(compat_ptr(ptr), &kfprog->filter))
 		return -EFAULT;
 
-	return sys_setsockopt(fd, level, optname, (char *)kfprog, 
+	return sys_setsockopt(fd, level, optname, (char __user *)kfprog, 
 			      sizeof(struct sock_fprog));
 }
 
-static int do_set_sock_timeout(int fd, int level, int optname, char *optval, int optlen)
+static int do_set_sock_timeout(int fd, int level, int optname, char __user *optval, int optlen)
 {
-	struct compat_timeval *up = (struct compat_timeval *) optval;
+	struct compat_timeval __user *up = (struct compat_timeval __user *) optval;
 	struct timeval ktime;
 	mm_segment_t old_fs;
 	int err;
@@ -455,7 +453,7 @@ static int do_set_sock_timeout(int fd, int level, int optname, char *optval, int
 }
 
 asmlinkage long compat_sys_setsockopt(int fd, int level, int optname,
-				char *optval, int optlen)
+				char __user *optval, int optlen)
 {
 	if (optname == IPT_SO_SET_REPLACE)
 		return do_netfilter_replace(fd, level, optname,
@@ -469,14 +467,15 @@ asmlinkage long compat_sys_setsockopt(int fd, int level, int optname,
 	return sys_setsockopt(fd, level, optname, optval, optlen);
 }
 
-static int do_get_sock_timeout(int fd, int level, int optname, char *optval,
-		int *optlen)
+static int do_get_sock_timeout(int fd, int level, int optname,
+		char __user *optval, int __user *optlen)
 {
-	struct compat_timeval *up = (struct compat_timeval *) optval;
+	struct compat_timeval __user *up;
 	struct timeval ktime;
 	mm_segment_t old_fs;
 	int len, err;
 
+	up = (struct compat_timeval __user *) optval;
 	if (get_user(len, optlen))
 		return -EFAULT;
 	if (len < sizeof(*up))
@@ -498,7 +497,7 @@ static int do_get_sock_timeout(int fd, int level, int optname, char *optval,
 }
 
 asmlinkage long compat_sys_getsockopt(int fd, int level, int optname,
-				char *optval, int *optlen)
+				char __user *optval, int __user *optlen)
 {
 	if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
 		return do_get_sock_timeout(fd, level, optname, optval, optlen);
@@ -512,17 +511,17 @@ static unsigned char nas[18]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
 				AL(6),AL(2),AL(5),AL(5),AL(3),AL(3)};
 #undef AL
 
-asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr *msg, unsigned flags)
+asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags)
 {
-	return sys_sendmsg(fd, (struct msghdr *)msg, flags | MSG_CMSG_COMPAT);
+	return sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
-asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr *msg, unsigned int flags)
+asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
 {
-	return sys_recvmsg(fd, (struct msghdr *)msg, flags | MSG_CMSG_COMPAT);
+	return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
-asmlinkage long compat_sys_socketcall(int call, u32 *args)
+asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
 {
 	int ret;
 	u32 a[6];

net/ipv4/af_inet.c

@@ -853,7 +853,7 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 		case SIOCDARP:
 		case SIOCGARP:
 		case SIOCSARP:
-			err = arp_ioctl(cmd, (void *)arg);
+			err = arp_ioctl(cmd, (void __user *)arg);
 			break;
 		case SIOCGIFADDR:
 		case SIOCSIFADDR:
@@ -866,7 +866,7 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 		case SIOCSIFPFLAGS:
 		case SIOCGIFPFLAGS:
 		case SIOCSIFFLAGS:
-			err = devinet_ioctl(cmd, (void *)arg);
+			err = devinet_ioctl(cmd, (void __user *)arg);
 			break;
 		default:
 			if (!sk->sk_prot->ioctl ||

net/ipv4/arp.c

@@ -1103,7 +1103,7 @@ int arp_req_delete(struct arpreq *r, struct net_device * dev)
  *	Handle an ARP layer I/O control request.
  */
 
-int arp_ioctl(unsigned int cmd, void *arg)
+int arp_ioctl(unsigned int cmd, void __user *arg)
 {
 	int err;
 	struct arpreq r;

net/ipv4/devinet.c

@@ -489,7 +489,7 @@ static __inline__ int inet_abc_len(u32 addr)
 }
 
 
-int devinet_ioctl(unsigned int cmd, void *arg)
+int devinet_ioctl(unsigned int cmd, void __user *arg)
 {
 	struct ifreq ifr;
 	struct sockaddr_in sin_orig;
@@ -713,7 +713,7 @@ int devinet_ioctl(unsigned int cmd, void *arg)
 	goto out;
 }
 
-static int inet_gifconf(struct net_device *dev, char *buf, int len)
+static int inet_gifconf(struct net_device *dev, char __user *buf, int len)
 {
 	struct in_device *in_dev = __in_dev_get(dev);
 	struct in_ifaddr *ifa;
@@ -1136,7 +1136,7 @@ void inet_forward_change(void)
 }
 
 static int devinet_sysctl_forward(ctl_table *ctl, int write,
-				  struct file* filp, void *buffer,
+				  struct file* filp, void __user *buffer,
 				  size_t *lenp)
 {
 	int *valp = ctl->data;
@@ -1154,7 +1154,7 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
 }
 
 int ipv4_doint_and_flush(ctl_table *ctl, int write,
-			 struct file* filp, void *buffer,
+			 struct file* filp, void __user *buffer,
 			 size_t *lenp)
 {
 	int *valp = ctl->data;
@@ -1167,9 +1167,9 @@ int ipv4_doint_and_flush(ctl_table *ctl, int write,
 	return ret;
 }
 
-int ipv4_doint_and_flush_strategy(ctl_table *table, int *name, int nlen,
-				  void *oldval, size_t *oldlenp,
-				  void *newval, size_t newlen, 
+int ipv4_doint_and_flush_strategy(ctl_table *table, int __user *name, int nlen,
+				  void __user *oldval, size_t __user *oldlenp,
+				  void __user *newval, size_t newlen, 
 				  void **context)
 {
 	int *valp = table->data;
@@ -1181,7 +1181,7 @@ int ipv4_doint_and_flush_strategy(ctl_table *table, int *name, int nlen,
 	if (newlen != sizeof(int))
 		return -EINVAL;
 
-	if (get_user(new, (int *)newval))
+	if (get_user(new, (int __user *)newval))
 		return -EFAULT;
 
 	if (new == *valp)

net/ipv4/raw.c

@@ -631,7 +631,7 @@ static int raw_ioctl(struct sock *sk, int cmd, unsigned long arg)
 	switch (cmd) {
 		case SIOCOUTQ: {
 			int amount = atomic_read(&sk->sk_wmem_alloc);
-			return put_user(amount, (int *)arg);
+			return put_user(amount, (int __user *)arg);
 		}
 		case SIOCINQ: {
 			struct sk_buff *skb;
@@ -642,7 +642,7 @@ static int raw_ioctl(struct sock *sk, int cmd, unsigned long arg)
 			if (skb != NULL)
 				amount = skb->len;
 			spin_unlock_irq(&sk->sk_receive_queue.lock);
-			return put_user(amount, (int *)arg);
+			return put_user(amount, (int __user *)arg);
 		}
 
 		default:

net/ipv4/route.c

@@ -2482,7 +2482,7 @@ void ip_rt_multicast_event(struct in_device *in_dev)
 static int flush_delay;
 
 static int ipv4_sysctl_rtcache_flush(ctl_table *ctl, int write,
-					struct file *filp, void *buffer,
+					struct file *filp, void __user *buffer,
 					size_t *lenp)
 {
 	if (write) {
@@ -2494,15 +2494,19 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *ctl, int write,
 	return -EINVAL;
 }
 
-static int ipv4_sysctl_rtcache_flush_strategy(ctl_table *table, int *name,
-						int nlen, void *oldval,
-						size_t *oldlenp, void *newval,
-						size_t newlen, void **context)
+static int ipv4_sysctl_rtcache_flush_strategy(ctl_table *table,
+						int __user *name,
+						int nlen,
+						void __user *oldval,
+						size_t __user *oldlenp,
+						void __user *newval,
+						size_t newlen,
+						void **context)
 {
 	int delay;
 	if (newlen != sizeof(int))
 		return -EINVAL;
-	if (get_user(delay, (int *)newval))
+	if (get_user(delay, (int __user *)newval))
 		return -EFAULT; 
 	rt_cache_flush(delay); 
 	return 0;

net/ipv4/sysctl_net_ipv4.c

@@ -62,7 +62,7 @@ extern ctl_table ipv4_route_table[];
 
 static
 int ipv4_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
-			void *buffer, size_t *lenp)
+			void __user *buffer, size_t *lenp)
 {
 	int val = ipv4_devconf.forwarding;
 	int ret;
@@ -75,9 +75,10 @@ int ipv4_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
 	return ret;
 }
 
-static int ipv4_sysctl_forward_strategy(ctl_table *table, int *name, int nlen,
-			 void *oldval, size_t *oldlenp,
-			 void *newval, size_t newlen, 
+static int ipv4_sysctl_forward_strategy(ctl_table *table,
+			 int __user *name, int nlen,
+			 void __user *oldval, size_t __user *oldlenp,
+			 void __user *newval, size_t newlen, 
 			 void **context)
 {
 	int *valp = table->data;
@@ -89,7 +90,7 @@ static int ipv4_sysctl_forward_strategy(ctl_table *table, int *name, int nlen,
 	if (newlen != sizeof(int))
 		return -EINVAL;
 
-	if (get_user(new, (int *)newval))
+	if (get_user(new, (int __user *)newval))
 		return -EFAULT;
 
 	if (new == *valp)

net/ipv4/tcp.c

@@ -530,7 +530,7 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 		return -ENOIOCTLCMD;
 	};
 
-	return put_user(answ, (int *)arg);
+	return put_user(answ, (int __user *)arg);
 }
 
 

net/ipv4/udp.c

@@ -725,7 +725,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 		case SIOCOUTQ:
 		{
 			int amount = atomic_read(&sk->sk_wmem_alloc);
-			return put_user(amount, (int *)arg);
+			return put_user(amount, (int __user *)arg);
 		}
 
 		case SIOCINQ:
@@ -745,7 +745,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 				amount = skb->len - sizeof(struct udphdr);
 			}
 			spin_unlock_irq(&sk->sk_receive_queue.lock);
-			return put_user(amount, (int *)arg);
+			return put_user(amount, (int __user *)arg);
 		}
 
 		default:

net/ipv6/addrconf.c

@@ -1510,7 +1510,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
  *	Special case for SIT interfaces where we create a new "virtual"
  *	device.
  */
-int addrconf_set_dstaddr(void *arg)
+int addrconf_set_dstaddr(void __user *arg)
 {
 	struct in6_ifreq ireq;
 	struct net_device *dev;
@@ -1630,7 +1630,7 @@ static int inet6_addr_del(int ifindex, struct in6_addr *pfx, int plen)
 }
 
 
-int addrconf_add_ifaddr(void *arg)
+int addrconf_add_ifaddr(void __user *arg)
 {
 	struct in6_ifreq ireq;
 	int err;
@@ -1647,7 +1647,7 @@ int addrconf_add_ifaddr(void *arg)
 	return err;
 }
 
-int addrconf_del_ifaddr(void *arg)
+int addrconf_del_ifaddr(void __user *arg)
 {
 	struct in6_ifreq ireq;
 	int err;
@@ -3003,7 +3003,7 @@ static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 
 static
 int addrconf_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
-			   void *buffer, size_t *lenp)
+			   void __user *buffer, size_t *lenp)
 {
 	int *valp = ctl->data;
 	int val = *valp;
@@ -3031,9 +3031,10 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
 }
 
 static int addrconf_sysctl_forward_strategy(ctl_table *table, 
-					    int *name, int nlen,
-					    void *oldval, size_t *oldlenp,
-					    void *newval, size_t newlen,
+					    int __user *name, int nlen,
+					    void __user *oldval,
+					    size_t __user *oldlenp,
+					    void __user *newval, size_t newlen,
 					    void **context)
 {
 	int *valp = table->data;
@@ -3043,7 +3044,7 @@ static int addrconf_sysctl_forward_strategy(ctl_table *table,
 		return 0;
 	if (newlen != sizeof(int))
 		return -EINVAL;
-	if (get_user(new, (int *)newval))
+	if (get_user(new, (int __user *)newval))
 		return -EFAULT;
 	if (new == *valp)
 		return 0;

net/ipv6/raw.c

@@ -875,7 +875,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
 		case SIOCOUTQ:
 		{
 			int amount = atomic_read(&sk->sk_wmem_alloc);
-			return put_user(amount, (int *)arg);
+			return put_user(amount, (int __user *)arg);
 		}
 		case SIOCINQ:
 		{
@@ -887,7 +887,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
 			if (skb != NULL)
 				amount = skb->tail - skb->h.raw;
 			spin_unlock_irq(&sk->sk_receive_queue.lock);
-			return put_user(amount, (int *)arg);
+			return put_user(amount, (int __user *)arg);
 		}
 
 		default:

net/ipv6/route.c

@@ -1219,7 +1219,7 @@ void rt6_purge_dflt_routers(int last_resort)
 	read_unlock_bh(&rt6_lock);
 }
 
-int ipv6_route_ioctl(unsigned int cmd, void *arg)
+int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
 {
 	struct in6_rtmsg rtmsg;
 	int err;
@@ -1886,7 +1886,7 @@ static int flush_delay;
 
 static
 int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write, struct file * filp,
-			      void *buffer, size_t *lenp)
+			      void __user *buffer, size_t *lenp)
 {
 	if (write) {
 		proc_dointvec(ctl, write, filp, buffer, lenp);

net/packet/af_packet.c

@@ -1450,7 +1450,7 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
 		case SIOCOUTQ:
 		{
 			int amount = atomic_read(&sk->sk_wmem_alloc);
-			return put_user(amount, (int *)arg);
+			return put_user(amount, (int __user *)arg);
 		}
 		case SIOCINQ:
 		{
@@ -1462,7 +1462,7 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
 			if (skb)
 				amount = skb->len;
 			spin_unlock_bh(&sk->sk_receive_queue.lock);
-			return put_user(amount, (int *)arg);
+			return put_user(amount, (int __user *)arg);
 		}
 		case SIOCGSTAMP:
 			return sock_get_timestamp(sk, (struct timeval __user *)arg);

net/socket.c

@@ -786,13 +786,13 @@ static int sock_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 		case FIOSETOWN:
 		case SIOCSPGRP:
 			err = -EFAULT;
-			if (get_user(pid, (int *)arg))
+			if (get_user(pid, (int __user *)arg))
 				break;
 			err = f_setown(sock->file, pid, 1);
 			break;
 		case FIOGETOWN:
 		case SIOCGPGRP:
-			err = put_user(sock->file->f_owner.pid, (int *)arg);
+			err = put_user(sock->file->f_owner.pid, (int __user *)arg);
 			break;
 		case SIOCGIFBR:
 		case SIOCSIFBR:

net/sunrpc/cache.c

@@ -575,7 +575,7 @@ struct cache_reader {
 };
 
 static ssize_t
-cache_read(struct file *filp, char *buf, size_t count, loff_t *ppos)
+cache_read(struct file *filp, char __user *buf, size_t count, loff_t *ppos)
 {
 	struct cache_reader *rp = filp->private_data;
 	struct cache_request *rq;
@@ -656,7 +656,7 @@ cache_read(struct file *filp, char *buf, size_t count, loff_t *ppos)
 static char write_buf[8192]; /* protected by queue_io_sem */
 
 static ssize_t
-cache_write(struct file *filp, const char *buf, size_t count,
+cache_write(struct file *filp, const char __user *buf, size_t count,
 	    loff_t *ppos)
 {
 	int err;
@@ -743,7 +743,7 @@ cache_ioctl(struct inode *ino, struct file *filp,
 		}
 	spin_unlock(&queue_lock);
 
-	return put_user(len, (int *)arg);
+	return put_user(len, (int __user *)arg);
 }
 
 static int
@@ -1166,7 +1166,7 @@ static struct file_operations content_file_operations = {
 	.release	= content_release,
 };
 
-static ssize_t read_flush(struct file *file, char *buf,
+static ssize_t read_flush(struct file *file, char __user *buf,
 			    size_t count, loff_t *ppos)
 {
 	struct cache_detail *cd = PDE(file->f_dentry->d_inode)->data;
@@ -1187,7 +1187,7 @@ static ssize_t read_flush(struct file *file, char *buf,
 	return len;
 }
 
-static ssize_t write_flush(struct file * file, const char * buf,
+static ssize_t write_flush(struct file * file, const char __user * buf,
 			     size_t count, loff_t *ppos)
 {
 	struct cache_detail *cd = PDE(file->f_dentry->d_inode)->data;

net/sunrpc/rpc_pipe.c

@@ -270,7 +270,7 @@ rpc_pipe_ioctl(struct inode *ino, struct file *filp,
 			msg = (struct rpc_pipe_msg *)filp->private_data;
 			len += msg->len - msg->copied;
 		}
-		return put_user(len, (int *)arg);
+		return put_user(len, (int __user *)arg);
 	default:
 		return -EINVAL;
 	}

net/sunrpc/sysctl.c

@@ -58,9 +58,10 @@ rpc_unregister_sysctl(void)
 
 static int
 proc_dodebug(ctl_table *table, int write, struct file *file,
-				void *buffer, size_t *lenp)
+				void __user *buffer, size_t *lenp)
 {
-	char		tmpbuf[20], *p, c;
+	char		tmpbuf[20], c, *s;
+	char __user *p;
 	unsigned int	value;
 	size_t		left, len;
 
@@ -74,7 +75,7 @@ proc_dodebug(ctl_table *table, int write, struct file *file,
 	if (write) {
 		if (!access_ok(VERIFY_READ, buffer, left))
 			return -EFAULT;
-		p = (char *) buffer;
+		p = buffer;
 		while (left && __get_user(c, p) >= 0 && isspace(c))
 			left--, p++;
 		if (!left)
@@ -86,12 +87,12 @@ proc_dodebug(ctl_table *table, int write, struct file *file,
 			return -EFAULT;
 		tmpbuf[left] = '\0';
 
-		for (p = tmpbuf, value = 0; '0' <= *p && *p <= '9'; p++, left--)
-			value = 10 * value + (*p - '0');
-		if (*p && !isspace(*p))
+		for (s = tmpbuf, value = 0; '0' <= *s && *s <= '9'; s++, left--)
+			value = 10 * value + (*s - '0');
+		if (*s && !isspace(*s))
 			return -EINVAL;
-		while (left && isspace(*p))
-			left--, p++;
+		while (left && isspace(*s))
+			left--, s++;
 		*(unsigned int *) table->data = value;
 		/* Display the RPC tasks on writing to rpc_debug */
 		if (table->ctl_name == CTL_RPCDEBUG) {
@@ -106,7 +107,7 @@ proc_dodebug(ctl_table *table, int write, struct file *file,
 		if (__copy_to_user(buffer, tmpbuf, len))
 			return -EFAULT;
 		if ((left -= len) > 0) {
-			if (put_user('\n', (char *)buffer + len))
+			if (put_user('\n', (char __user *)buffer + len))
 				return -EFAULT;
 			left--;
 		}

net/unix/af_unix.c

@@ -1829,7 +1829,7 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 	{
 		case SIOCOUTQ:
 			amount = atomic_read(&sk->sk_wmem_alloc);
-			err = put_user(amount, (int *)arg);
+			err = put_user(amount, (int __user *)arg);
 			break;
 		case SIOCINQ:
 		{
@@ -1844,7 +1844,7 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 			if (skb)
 				amount=skb->len;
 			spin_unlock(&sk->sk_receive_queue.lock);
-			err = put_user(amount, (int *)arg);
+			err = put_user(amount, (int __user *)arg);
 			break;
 		}