Add a few initial user pointer annotations to sound driver.

Quite a few suspicious places here that pass kernel pointers
to the internal ioctl engine. 

include/sound/seq_kernel.h

@@ -158,7 +158,7 @@ extern int snd_seq_create_kernel_client(snd_card_t *card, int client_index, snd_
 extern int snd_seq_delete_kernel_client(int client);
 extern int snd_seq_kernel_client_enqueue(int client, snd_seq_event_t *ev, int atomic, int hop);
 extern int snd_seq_kernel_client_dispatch(int client, snd_seq_event_t *ev, int atomic, int hop);
-extern int snd_seq_kernel_client_ctl(int client, unsigned int cmd, void *arg);
+extern int snd_seq_kernel_client_ctl(int client, unsigned int cmd, void __user *arg);
 
 #define SNDRV_SEQ_EXT_MASK	0xc0000000
 #define SNDRV_SEQ_EXT_USRPTR	0x80000000

sound/core/seq/oss/seq_oss_device.h

@@ -135,8 +135,8 @@ int snd_seq_oss_delete_client(void);
 int snd_seq_oss_open(struct file *file, int level);
 void snd_seq_oss_release(seq_oss_devinfo_t *dp);
 int snd_seq_oss_ioctl(seq_oss_devinfo_t *dp, unsigned int cmd, unsigned long arg);
-int snd_seq_oss_read(seq_oss_devinfo_t *dev, char *buf, int count);
-int snd_seq_oss_write(seq_oss_devinfo_t *dp, const char *buf, int count, struct file *opt);
+int snd_seq_oss_read(seq_oss_devinfo_t *dev, char __user *buf, int count);
+int snd_seq_oss_write(seq_oss_devinfo_t *dp, const char __user *buf, int count, struct file *opt);
 unsigned int snd_seq_oss_poll(seq_oss_devinfo_t *dp, struct file *file, poll_table * wait);
 
 void snd_seq_oss_reset(seq_oss_devinfo_t *dp);

sound/core/seq/oss/seq_oss_ioctl.c

@@ -35,7 +35,7 @@ snd_seq_oss_ioctl(seq_oss_devinfo_t *dp, unsigned int cmd, unsigned long carg)
 	struct synth_info inf;
 	struct midi_info minf;
 	unsigned char ev[8];
-	void *arg = (void*)carg;
+	void __user *arg = (void __user *)carg;
 	snd_seq_event_t tmpev;
 
 	switch (cmd) {

sound/core/seq/oss/seq_oss_rw.c

@@ -41,7 +41,7 @@ static int insert_queue(seq_oss_devinfo_t *dp, evrec_t *rec, struct file *opt);
  */
 
 int
-snd_seq_oss_read(seq_oss_devinfo_t *dp, char *buf, int count)
+snd_seq_oss_read(seq_oss_devinfo_t *dp, char __user *buf, int count)
 {
 	seq_oss_readq_t *readq = dp->readq;
 	int cnt, pos;
@@ -81,7 +81,7 @@ snd_seq_oss_read(seq_oss_devinfo_t *dp, char *buf, int count)
  */
 
 int
-snd_seq_oss_write(seq_oss_devinfo_t *dp, const char *buf, int count, struct file *opt)
+snd_seq_oss_write(seq_oss_devinfo_t *dp, const char __user *buf, int count, struct file *opt)
 {
 	int rc, c, p, ev_size;
 	evrec_t rec;

sound/core/seq/oss/seq_oss_synth.c

@@ -450,7 +450,7 @@ snd_seq_oss_synth_reset(seq_oss_devinfo_t *dp, int dev)
  */
 int
 snd_seq_oss_synth_load_patch(seq_oss_devinfo_t *dp, int dev, int fmt,
-			    const char *buf, int p, int c)
+			    const char __user *buf, int p, int c)
 {
 	seq_oss_synth_t *rec;
 	int rc;

sound/core/seq/oss/seq_oss_timer.c

@@ -227,19 +227,19 @@ snd_seq_oss_timer_tempo(seq_oss_timer_t *timer, int value)
  * ioctls
  */
 int
-snd_seq_oss_timer_ioctl(seq_oss_timer_t *timer, unsigned int cmd, void *arg)
+snd_seq_oss_timer_ioctl(seq_oss_timer_t *timer, unsigned int cmd, int __user *arg)
 {
 	int value;
 
 	if (cmd == SNDCTL_SEQ_CTRLRATE) {
 		debug_printk(("ctrl rate\n"));
 		/* if *arg == 0, just return the current rate */
-		if (get_user(value, (int *)arg))
+		if (get_user(value, arg))
 			return -EFAULT;
 		if (value)
 			return -EINVAL;
 		value = ((timer->oss_tempo * timer->oss_timebase) + 30) / 60;
-		return put_user(value, (int *)arg) ? -EFAULT : 0;
+		return put_user(value, arg) ? -EFAULT : 0;
 	}
 
 	if (timer->dp->seq_mode == SNDRV_SEQ_OSS_MODE_SYNTH)
@@ -257,12 +257,12 @@ snd_seq_oss_timer_ioctl(seq_oss_timer_t *timer, unsigned int cmd, void *arg)
 		return snd_seq_oss_timer_continue(timer);
 	case SNDCTL_TMR_TEMPO:
 		debug_printk(("timer tempo\n"));
-		if (get_user(value, (int *)arg))
+		if (get_user(value, arg))
 			return -EFAULT;
 		return snd_seq_oss_timer_tempo(timer, value);
 	case SNDCTL_TMR_TIMEBASE:
 		debug_printk(("timer timebase\n"));
-		if (get_user(value, (int *)arg))
+		if (get_user(value, arg))
 			return -EFAULT;
 		if (value < MIN_OSS_TIMEBASE)
 			value = MIN_OSS_TIMEBASE;

sound/core/seq/oss/seq_oss_timer.h

@@ -46,7 +46,7 @@ int snd_seq_oss_timer_continue(seq_oss_timer_t *timer);
 int snd_seq_oss_timer_tempo(seq_oss_timer_t *timer, int value);
 #define snd_seq_oss_timer_reset  snd_seq_oss_timer_start
 
-int snd_seq_oss_timer_ioctl(seq_oss_timer_t *timer, unsigned int cmd, void *arg);
+int snd_seq_oss_timer_ioctl(seq_oss_timer_t *timer, unsigned int cmd, int __user *arg);
 
 /*
  * get current processed time