[PATCH] sparse: net/bridge annotation

net/bridge partially annotated.

There are nasty problems with net/bridge/netfilter/* and they'll need to
be dealt with at some point - it mixes kernel and userland pointers a
lot and while it seems to avoid obvious breakage, it's not a nice code.

include/linux/if_bridge.h

@@ -104,7 +104,7 @@ struct __fdb_entry
 
 #include <linux/netdevice.h>
 
-extern void brioctl_set(int (*ioctl_hook)(unsigned int, unsigned long));
+extern void brioctl_set(int (*ioctl_hook)(unsigned int, void __user *));
 extern int (*br_handle_frame_hook)(struct sk_buff *skb);
 extern int (*br_should_route_hook)(struct sk_buff **pskb);
 

net/bridge/br_ioctl.c

@@ -143,7 +143,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 		b.gc_timer_value = br_timer_value(&br->gc_timer);
 	        rcu_read_unlock();
 
-		if (copy_to_user((void *)args[1], &b, sizeof(b)))
+		if (copy_to_user((void __user *)args[1], &b, sizeof(b)))
 			return -EFAULT;
 
 		return 0;
@@ -168,7 +168,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 		memset(indices, 0, num*sizeof(int));
 
 		get_port_ifindices(br, indices, num);
-		if (copy_to_user((void *)args[1], indices, num*sizeof(int)))
+		if (copy_to_user((void __user *)args[1], indices, num*sizeof(int)))
 			num =  -EFAULT;
 		kfree(indices);
 		return num;
@@ -241,7 +241,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 
 		rcu_read_unlock();
 
-		if (copy_to_user((void *)args[1], &p, sizeof(p)))
+		if (copy_to_user((void __user *)args[1], &p, sizeof(p)))
 			return -EFAULT;
 
 		return 0;
@@ -308,11 +308,11 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 	return -EOPNOTSUPP;
 }
 
-static int old_deviceless(unsigned long uarg)
+static int old_deviceless(void __user *uarg)
 {
 	unsigned long args[3];
 
-	if (copy_from_user(args, (void *)uarg, sizeof(args)))
+	if (copy_from_user(args, uarg, sizeof(args)))
 		return -EFAULT;
 
 	switch (args[0]) {
@@ -331,7 +331,7 @@ static int old_deviceless(unsigned long uarg)
 		memset(indices, 0, args[2]*sizeof(int));
 		args[2] = get_bridge_ifindices(indices, args[2]);
 
-		ret = copy_to_user((void *)args[1], indices, args[2]*sizeof(int))
+		ret = copy_to_user((void __user *)args[1], indices, args[2]*sizeof(int))
 			? -EFAULT : args[2];
 
 		kfree(indices);
@@ -346,7 +346,7 @@ static int old_deviceless(unsigned long uarg)
 		if (!capable(CAP_NET_ADMIN))
 			return -EPERM;
 
-		if (copy_from_user(buf, (void *)args[1], IFNAMSIZ))
+		if (copy_from_user(buf, (void __user *)args[1], IFNAMSIZ))
 			return -EFAULT;
 
 		buf[IFNAMSIZ-1] = 0;
@@ -361,7 +361,7 @@ static int old_deviceless(unsigned long uarg)
 	return -EOPNOTSUPP;
 }
 
-int br_ioctl_deviceless_stub(unsigned int cmd, unsigned long uarg)
+int br_ioctl_deviceless_stub(unsigned int cmd, void __user *uarg)
 {
 	switch (cmd) {
 	case SIOCGIFBR:
@@ -376,7 +376,7 @@ int br_ioctl_deviceless_stub(unsigned int cmd, unsigned long uarg)
 		if (!capable(CAP_NET_ADMIN))
 			return -EPERM;
 
-		if (copy_from_user(buf, (void __user *) uarg, IFNAMSIZ))
+		if (copy_from_user(buf, uarg, IFNAMSIZ))
 			return -EFAULT;
 
 		buf[IFNAMSIZ-1] = 0;

net/bridge/br_netfilter.c

@@ -800,7 +800,7 @@ static struct nf_hook_ops br_nf_ops[] = {
 #ifdef CONFIG_SYSCTL
 static
 int brnf_sysctl_call_tables(ctl_table *ctl, int write, struct file * filp,
-			void *buffer, size_t *lenp)
+			void __user *buffer, size_t *lenp)
 {
 	int ret;
 

net/bridge/br_private.h

@@ -175,7 +175,7 @@ extern int br_handle_frame(struct sk_buff *skb);
 
 /* br_ioctl.c */
 extern int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-extern int br_ioctl_deviceless_stub(unsigned int cmd, unsigned long arg);
+extern int br_ioctl_deviceless_stub(unsigned int cmd, void __user *arg);
 
 /* br_netfilter.c */
 extern int br_netfilter_init(void);

net/socket.c

@@ -729,9 +729,9 @@ static ssize_t sock_writev(struct file *file, const struct iovec *vector,
  */
 
 static DECLARE_MUTEX(br_ioctl_mutex);
-static int (*br_ioctl_hook)(unsigned int cmd, unsigned long arg) = NULL;
+static int (*br_ioctl_hook)(unsigned int cmd, void __user *arg) = NULL;
 
-void brioctl_set(int (*hook)(unsigned int, unsigned long))
+void brioctl_set(int (*hook)(unsigned int, void __user *))
 {
 	down(&br_ioctl_mutex);
 	br_ioctl_hook = hook;
@@ -770,6 +770,7 @@ static int sock_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 		      unsigned long arg)
 {
 	struct socket *sock;
+	void __user *argp = (void __user *)arg;
 	int pid, err;
 
 	unlock_kernel();
@@ -804,7 +805,7 @@ static int sock_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 
 			down(&br_ioctl_mutex);
 			if (br_ioctl_hook) 
-				err = br_ioctl_hook(cmd, arg);
+				err = br_ioctl_hook(cmd, argp);
 			up(&br_ioctl_mutex);
 			break;
 		case SIOCGIFVLAN: