[PATCH] sparse: scsi_ioctl __user annotation

scsi_ioctl() and scsi_ioctl_send_command() switched to __user *;
scsi/scsi_ioctl.c annotated.

drivers/scsi/osst.c

@@ -5040,7 +5040,7 @@ static int osst_ioctl(struct inode * inode,struct file * file,
 
 	up(&STp->lock);
 
-	return scsi_ioctl(STp->device, cmd_in, (void *) arg);
+	return scsi_ioctl(STp->device, cmd_in, p);
 
 out:
 	if (SRpnt) scsi_release_request(SRpnt);

drivers/scsi/scsi_ioctl.c

@@ -42,14 +42,14 @@
  * (int *) arg
  */
 
-static int ioctl_probe(struct Scsi_Host *host, void *buffer)
+static int ioctl_probe(struct Scsi_Host *host, void __user *buffer)
 {
 	unsigned int len, slen;
 	const char *string;
 	int temp = host->hostt->present;
 
 	if (temp && buffer) {
-		if (get_user(len, (unsigned int *) buffer))
+		if (get_user(len, (unsigned int __user *) buffer))
 			return -EFAULT;
 
 		if (host->hostt->info)
@@ -204,11 +204,11 @@ int scsi_set_medium_removal(struct scsi_device *sdev, char state)
 #define OMAX_SB_LEN 16		/* Old sense buffer length */
 
 int scsi_ioctl_send_command(struct scsi_device *sdev,
-			    struct scsi_ioctl_command *sic)
+			    struct scsi_ioctl_command __user *sic)
 {
 	char *buf;
 	unsigned char cmd[MAX_COMMAND_SIZE];
-	char *cmd_in;
+	char __user *cmd_in;
 	struct scsi_request *sreq;
 	unsigned char opcode;
 	unsigned int inlen, outlen, cmdlen;
@@ -361,7 +361,7 @@ int scsi_ioctl_send_command(struct scsi_device *sdev,
  *                  device)
  *          any copy_to_user() error on failure there
  */
-static int scsi_ioctl_get_pci(struct scsi_device *sdev, void *arg)
+static int scsi_ioctl_get_pci(struct scsi_device *sdev, void __user *arg)
 {
 	struct device *dev = scsi_get_device(sdev->host);
 
@@ -376,7 +376,7 @@ static int scsi_ioctl_get_pci(struct scsi_device *sdev, void *arg)
  * not take a major/minor number as the dev field.  Rather, it takes
  * a pointer to a scsi_devices[] element, a structure. 
  */
-int scsi_ioctl(struct scsi_device *sdev, int cmd, void *arg)
+int scsi_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
 {
 	char scsi_cmd[MAX_COMMAND_SIZE];
 
@@ -402,19 +402,18 @@ int scsi_ioctl(struct scsi_device *sdev, int cmd, void *arg)
 			 + ((sdev->lun & 0xff) << 8)
 			 + ((sdev->channel & 0xff) << 16)
 			 + ((sdev->host->host_no & 0xff) << 24),
-			 &((struct scsi_idlun *)arg)->dev_id);
+			 &((struct scsi_idlun __user *)arg)->dev_id);
 		__put_user(sdev->host->unique_id,
-			 &((struct scsi_idlun *)arg)->host_unique_id);
+			 &((struct scsi_idlun __user *)arg)->host_unique_id);
 		return 0;
 	case SCSI_IOCTL_GET_BUS_NUMBER:
-		return put_user(sdev->host->host_no, (int *)arg);
+		return put_user(sdev->host->host_no, (int __user *)arg);
 	case SCSI_IOCTL_PROBE_HOST:
 		return ioctl_probe(sdev->host, arg);
 	case SCSI_IOCTL_SEND_COMMAND:
 		if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
 			return -EACCES;
-		return scsi_ioctl_send_command(sdev,
-				(struct scsi_ioctl_command *)arg);
+		return scsi_ioctl_send_command(sdev, arg);
 	case SCSI_IOCTL_DOORLOCK:
 		return scsi_set_medium_removal(sdev, SCSI_REMOVAL_PREVENT);
 	case SCSI_IOCTL_DOORUNLOCK:

drivers/scsi/sd.c

@@ -590,13 +590,13 @@ static int sd_ioctl(struct inode * inode, struct file * filp,
 	switch (cmd) {
 		case SCSI_IOCTL_GET_IDLUN:
 		case SCSI_IOCTL_GET_BUS_NUMBER:
-			return scsi_ioctl(sdp, cmd, (void *)arg);
+			return scsi_ioctl(sdp, cmd, p);
 		default:
 			error = scsi_cmd_ioctl(disk, cmd, p);
 			if (error != -ENOTTY)
 				return error;
 	}
-	return scsi_ioctl(sdp, cmd, (void *)arg);
+	return scsi_ioctl(sdp, cmd, p);
 }
 
 static void set_media_not_present(struct scsi_disk *sdkp)

drivers/scsi/sg.c

@@ -990,7 +990,7 @@ sg_ioctl(struct inode *inode, struct file *filp,
 			if (!sg_allow_access(opcode, sdp->device->type))
 				return -EPERM;
 		}
-		return scsi_ioctl_send_command(sdp->device, (void *) arg);
+		return scsi_ioctl_send_command(sdp->device, (void __user *) arg);
 	case SG_SET_DEBUG:
 		result = get_user(val, (int *) arg);
 		if (result)
@@ -1003,11 +1003,11 @@ sg_ioctl(struct inode *inode, struct file *filp,
 	case SG_GET_TRANSFORM:
 		if (sdp->detached)
 			return -ENODEV;
-		return scsi_ioctl(sdp->device, cmd_in, (void *) arg);
+		return scsi_ioctl(sdp->device, cmd_in, (void __user *)arg);
 	default:
 		if (read_only)
 			return -EPERM;	/* don't know so take safe approach */
-		return scsi_ioctl(sdp->device, cmd_in, (void *) arg);
+		return scsi_ioctl(sdp->device, cmd_in, (void __user *)arg);
 	}
 }
 

drivers/scsi/sr.c

@@ -499,7 +499,7 @@ static int sr_block_ioctl(struct inode *inode, struct file *file, unsigned cmd,
         switch (cmd) {
                 case SCSI_IOCTL_GET_IDLUN:
                 case SCSI_IOCTL_GET_BUS_NUMBER:
-                        return scsi_ioctl(sdev, cmd, (void *)arg);
+                        return scsi_ioctl(sdev, cmd, (void __user *)arg);
 	}
 	return cdrom_ioctl(&cd->cdi, inode, cmd, arg);
 }

drivers/scsi/sr_ioctl.c

@@ -541,5 +541,5 @@ int sr_dev_ioctl(struct cdrom_device_info *cdi,
 		 unsigned int cmd, unsigned long arg)
 {
 	Scsi_CD *cd = cdi->handle;
-	return scsi_ioctl(cd->device, cmd, (void *)arg);
+	return scsi_ioctl(cd->device, cmd, (void __user *)arg);
 }

drivers/scsi/st.c

@@ -3418,7 +3418,7 @@ static int st_ioctl(struct inode *inode, struct file *file,
 				return i;
 			break;
 	}
-	return scsi_ioctl(STp->device, cmd_in, (void *) arg);
+	return scsi_ioctl(STp->device, cmd_in, p);
 
  out:
 	up(&STp->lock);

include/scsi/scsi_ioctl.h

@@ -40,10 +40,10 @@ typedef struct scsi_fctargaddress {
 	unsigned char host_wwn[8]; // include NULL term.
 } Scsi_FCTargAddress;
 
-extern int scsi_ioctl(struct scsi_device *, int, void *);
+extern int scsi_ioctl(struct scsi_device *, int, void __user *);
 extern int kernel_scsi_ioctl(struct scsi_device *, int , void *);
 extern int scsi_ioctl_send_command(struct scsi_device *,
-				   struct scsi_ioctl_command *);
+				   struct scsi_ioctl_command __user *);
 
 #endif /* __KERNEL__ */
 #endif /* _SCSI_IOCTL_H */