[PATCH] sparse: drivers/sbus annotation

drivers/sbus/char/bpp.c

@@ -482,7 +482,7 @@ static int bpp_release(struct inode *inode, struct file *f)
       return 0;
 }
 
-static long read_nibble(unsigned minor, char *c, unsigned long cnt)
+static long read_nibble(unsigned minor, char __user *c, unsigned long cnt)
 {
       unsigned long remaining = cnt;
       long rc;
@@ -535,7 +535,7 @@ static long read_nibble(unsigned minor, char *c, unsigned long cnt)
       return cnt - remaining;
 }
 
-static long read_ecp(unsigned minor, char *c, unsigned long cnt)
+static long read_ecp(unsigned minor, char __user *c, unsigned long cnt)
 {
       unsigned long remaining;
       long rc;
@@ -630,7 +630,7 @@ static long read_ecp(unsigned minor, char *c, unsigned long cnt)
       return cnt - remaining;
 }
 
-static ssize_t bpp_read(struct file *f, char *c, size_t cnt, loff_t * ppos)
+static ssize_t bpp_read(struct file *f, char __user *c, size_t cnt, loff_t * ppos)
 {
       long rc;
       unsigned minor = iminor(f->f_dentry->d_inode);
@@ -692,7 +692,7 @@ static ssize_t bpp_read(struct file *f, char *c, size_t cnt, loff_t * ppos)
  * Compatibility mode handshaking is a matter of writing data,
  * strobing it, and waiting for the printer to stop being busy.
  */
-static long write_compat(unsigned minor, const char *c, unsigned long cnt)
+static long write_compat(unsigned minor, const char __user *c, unsigned long cnt)
 {
       long rc;
       unsigned short pins = get_pins(minor);
@@ -730,7 +730,7 @@ static long write_compat(unsigned minor, const char *c, unsigned long cnt)
  * Write data using ECP mode. Watch out that the port may be set up
  * for reading. If so, turn the port around.
  */
-static long write_ecp(unsigned minor, const char *c, unsigned long cnt)
+static long write_ecp(unsigned minor, const char __user *c, unsigned long cnt)
 {
       unsigned short pins = get_pins(minor);
       unsigned long remaining = cnt;
@@ -783,7 +783,7 @@ static long write_ecp(unsigned minor, const char *c, unsigned long cnt)
  * that. Otherwise, terminate and do my writing in compat mode. This
  * is the safest course as any device can handle it.
  */
-static ssize_t bpp_write(struct file *f, const char *c, size_t cnt, loff_t * ppos)
+static ssize_t bpp_write(struct file *f, const char __user *c, size_t cnt, loff_t * ppos)
 {
       long errno = 0;
       unsigned minor = iminor(f->f_dentry->d_inode);

drivers/sbus/char/cpwatchdog.c

@@ -337,6 +337,7 @@ static int wd_ioctl(struct inode *inode, struct file *file,
 {
 	int 	setopt 				= 0;
 	struct 	wd_timer* pTimer 	= (struct wd_timer*)file->private_data;
+	void __user *argp = (void __user *)arg;
 	struct 	watchdog_info info 	= {
 		0,
 		0,
@@ -351,22 +352,20 @@ static int wd_ioctl(struct inode *inode, struct file *file,
 	{
 		/* Generic Linux IOCTLs */
 		case WDIOC_GETSUPPORT:
-			if(copy_to_user((struct watchdog_info *)arg, 
-							(struct watchdog_info *)&info, 
-							sizeof(struct watchdog_info))) {
+			if(copy_to_user(argp, &info, sizeof(struct watchdog_info))) {
 				return(-EFAULT);
 			}
 			break;
 		case WDIOC_GETSTATUS:
 		case WDIOC_GETBOOTSTATUS:
-			if (put_user(0, (int *) arg))
+			if (put_user(0, (int __user *)argp))
 				return -EFAULT;
 			break;
 		case WDIOC_KEEPALIVE:
 			wd_pingtimer(pTimer);
 			break;
 		case WDIOC_SETOPTIONS:
-			if(copy_from_user(&setopt, (void*) arg, sizeof(unsigned int))) {
+			if(copy_from_user(&setopt, argp, sizeof(unsigned int))) {
 				return -EFAULT;
 			}
 			if(setopt & WDIOS_DISABLECARD) {
@@ -388,7 +387,7 @@ static int wd_ioctl(struct inode *inode, struct file *file,
 		/* Solaris-compatible IOCTLs */
 		case WIOCGSTAT:
 			setopt = wd_getstatus(pTimer);
-			if(copy_to_user((void*)arg, &setopt, sizeof(unsigned int))) {
+			if(copy_to_user(argp, &setopt, sizeof(unsigned int))) {
 				return(-EFAULT);
 			}
 			break;
@@ -409,8 +408,8 @@ static int wd_ioctl(struct inode *inode, struct file *file,
 	return(0);
 }
 
-static ssize_t wd_write(	struct file 	*file, 
-							const char		*buf, 
+static ssize_t wd_write(struct file 	*file, 
+			const char	__user *buf, 
 			size_t 		count, 
 			loff_t 		*ppos)
 {
@@ -430,7 +429,7 @@ static ssize_t wd_write(	struct file 	*file,
 	return 0;
 }
 
-static ssize_t wd_read(struct file * file, char * buffer,
+static ssize_t wd_read(struct file * file, char __user *buffer,
 		        size_t count, loff_t *ppos)
 {
 #ifdef WD_DEBUG

drivers/sbus/char/display7seg.c

@@ -128,7 +128,7 @@ static int d7s_ioctl(struct inode *inode, struct file *f,
 		/* assign device register values
 		 * we mask-out D7S_FLIP if in sol_compat mode
 		 */
-		if (get_user(ireg, (int *) arg))
+		if (get_user(ireg, (int __user *) arg))
 			return -EFAULT;
 		if (0 != sol_compat) {
 			(regs & D7S_FLIP) ? 
@@ -144,7 +144,7 @@ static int d7s_ioctl(struct inode *inode, struct file *f,
 		 * This driver will not misinform you about the state
 		 * of your hardware while in sol_compat mode
 		 */
-		if (put_user(regs, (int *) arg))
+		if (put_user(regs, (int __user *) arg))
 			return -EFAULT;
 		break;
 

drivers/sbus/char/envctrl.c

@@ -556,7 +556,7 @@ static unsigned char envctrl_i2c_voltage_status(struct i2c_child_t *pchild,
  * Return: Number of read bytes. 0 for error.
  */
 static ssize_t
-envctrl_read(struct file *file, char *buf, size_t count, loff_t *ppos)
+envctrl_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 {
 	struct i2c_child_t *pchild;
 	unsigned char data[10];
@@ -574,7 +574,7 @@ envctrl_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 
 		data[0] = (unsigned char)(warning_temperature);
 		ret = 1;
-		if (copy_to_user((unsigned char *)buf, data, ret))
+		if (copy_to_user(buf, data, ret))
 			ret = -EFAULT;
 		break;
 
@@ -584,7 +584,7 @@ envctrl_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 
 		data[0] = (unsigned char)(shutdown_temperature);
 		ret = 1;
-		if (copy_to_user((unsigned char *)buf, data, ret))
+		if (copy_to_user(buf, data, ret))
 			ret = -EFAULT;
 		break;
 
@@ -592,7 +592,7 @@ envctrl_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 		if (!(pchild = envctrl_get_i2c_child(ENVCTRL_MTHRBDTEMP_MON)))
 			return 0;
 		ret = envctrl_read_noncpu_info(pchild, ENVCTRL_MTHRBDTEMP_MON, data);
-		if (copy_to_user((unsigned char *)buf, data, ret))
+		if (copy_to_user(buf, data, ret))
 			ret = -EFAULT;
 		break;
 
@@ -602,7 +602,7 @@ envctrl_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 		ret = envctrl_read_cpu_info(read_cpu, pchild, ENVCTRL_CPUTEMP_MON, data);
 
 		/* Reset cpu to the default cpu0. */
-		if (copy_to_user((unsigned char *)buf, data, ret))
+		if (copy_to_user(buf, data, ret))
 			ret = -EFAULT;
 		break;
 
@@ -612,7 +612,7 @@ envctrl_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 		ret = envctrl_read_cpu_info(read_cpu, pchild, ENVCTRL_CPUVOLTAGE_MON, data);
 
 		/* Reset cpu to the default cpu0. */
-		if (copy_to_user((unsigned char *)buf, data, ret))
+		if (copy_to_user(buf, data, ret))
 			ret = -EFAULT;
 		break;
 
@@ -620,7 +620,7 @@ envctrl_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 		if (!(pchild = envctrl_get_i2c_child(ENVCTRL_SCSITEMP_MON)))
 			return 0;
 		ret = envctrl_read_noncpu_info(pchild, ENVCTRL_SCSITEMP_MON, data);
-		if (copy_to_user((unsigned char *)buf, data, ret))
+		if (copy_to_user(buf, data, ret))
 			ret = -EFAULT;
 		break;
 
@@ -628,7 +628,7 @@ envctrl_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 		if (!(pchild = envctrl_get_i2c_child(ENVCTRL_ETHERTEMP_MON)))
 			return 0;
 		ret = envctrl_read_noncpu_info(pchild, ENVCTRL_ETHERTEMP_MON, data);
-		if (copy_to_user((unsigned char *)buf, data, ret))
+		if (copy_to_user(buf, data, ret))
 			ret = -EFAULT;
 		break;
 
@@ -637,7 +637,7 @@ envctrl_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 			return 0;
 		data[0] = envctrl_i2c_read_8574(pchild->addr);
 		ret = envctrl_i2c_fan_status(pchild,data[0], data);
-		if (copy_to_user((unsigned char *)buf, data, ret))
+		if (copy_to_user(buf, data, ret))
 			ret = -EFAULT;
 		break;
 	
@@ -646,7 +646,7 @@ envctrl_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 			return 0;
 		data[0] = envctrl_i2c_read_8574(pchild->addr);
 		ret = envctrl_i2c_globaladdr(pchild, data[0], data);
-		if (copy_to_user((unsigned char *)buf, data, ret))
+		if (copy_to_user(buf, data, ret))
 			ret = -EFAULT;
 		break;
 
@@ -657,7 +657,7 @@ envctrl_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 				return 0;
 		data[0] = envctrl_i2c_read_8574(pchild->addr);
 		ret = envctrl_i2c_voltage_status(pchild, data[0], data);
-		if (copy_to_user((unsigned char *)buf, data, ret))
+		if (copy_to_user(buf, data, ret))
 			ret = -EFAULT;
 		break;
 
@@ -676,7 +676,7 @@ static int
 envctrl_ioctl(struct inode *inode, struct file *file,
 	      unsigned int cmd, unsigned long arg)
 {
-	char *infobuf;
+	char __user *infobuf;
 
 	switch (cmd) {
 	case ENVCTRL_RD_WARNING_TEMPERATURE:
@@ -695,7 +695,7 @@ envctrl_ioctl(struct inode *inode, struct file *file,
 		/* Check to see if application passes in any cpu number,
 		 * the default is cpu0.
 		 */
-		infobuf = (char *) arg;
+		infobuf = (char __user *) arg;
 		if (infobuf == NULL) {
 			read_cpu = 0;
 		}else {

drivers/sbus/char/flash.c

@@ -105,7 +105,7 @@ flash_llseek(struct file *file, long long offset, int origin)
 }
 
 static ssize_t
-flash_read(struct file * file, char * buf,
+flash_read(struct file * file, char __user * buf,
 	   size_t count, loff_t *ppos)
 {
 	unsigned long p = file->f_pos;

drivers/sbus/char/openprom.c

@@ -67,7 +67,7 @@ static int options_node = 0;
  * structure will be placed in "*opp_p". Return value is the length
  * of the user supplied buffer.
  */
-static int copyin(struct openpromio *info, struct openpromio **opp_p)
+static int copyin(struct openpromio __user *info, struct openpromio **opp_p)
 {
 	unsigned int bufsize;
 
@@ -98,7 +98,7 @@ static int copyin(struct openpromio *info, struct openpromio **opp_p)
 	return bufsize;
 }
 
-static int getstrings(struct openpromio *info, struct openpromio **opp_p)
+static int getstrings(struct openpromio __user *info, struct openpromio **opp_p)
 {
 	int n, bufsize;
 	char c;
@@ -132,7 +132,7 @@ static int getstrings(struct openpromio *info, struct openpromio **opp_p)
 /*
  * Copy an openpromio structure in kernel space back to user space.
  */
-static int copyout(void *info, struct openpromio *opp, int len)
+static int copyout(void __user *info, struct openpromio *opp, int len)
 {
 	if (copy_to_user(info, opp, len))
 		return -EFAULT;
@@ -150,11 +150,12 @@ static int openprom_sunos_ioctl(struct inode * inode, struct file * file,
 	struct openpromio *opp;
 	int bufsize, len, error = 0;
 	static int cnt;
+	void __user *argp = (void __user *)arg;
 
 	if (cmd == OPROMSETOPT)
-		bufsize = getstrings((void *)arg, &opp);
+		bufsize = getstrings(argp, &opp);
 	else
-		bufsize = copyin((void *)arg, &opp);
+		bufsize = copyin(argp, &opp);
 
 	if (bufsize < 0)
 		return bufsize;
@@ -165,7 +166,7 @@ static int openprom_sunos_ioctl(struct inode * inode, struct file * file,
 		len = prom_getproplen(node, opp->oprom_array);
 
 		if (len <= 0 || len > bufsize) {
-			error = copyout((void *)arg, opp, sizeof(int));
+			error = copyout(argp, opp, sizeof(int));
 			break;
 		}
 
@@ -175,7 +176,7 @@ static int openprom_sunos_ioctl(struct inode * inode, struct file * file,
 		opp->oprom_array[len] = '\0';
 		opp->oprom_size = len;
 
-		error = copyout((void *)arg, opp, sizeof(int) + bufsize);
+		error = copyout(argp, opp, sizeof(int) + bufsize);
 		break;
 
 	case OPROMNXTOPT:
@@ -184,7 +185,7 @@ static int openprom_sunos_ioctl(struct inode * inode, struct file * file,
 
 		len = strlen(buf);
 		if (len == 0 || len + 1 > bufsize) {
-			error = copyout((void *)arg, opp, sizeof(int));
+			error = copyout(argp, opp, sizeof(int));
 			break;
 		}
 
@@ -192,7 +193,7 @@ static int openprom_sunos_ioctl(struct inode * inode, struct file * file,
 		opp->oprom_array[len] = '\0';
 		opp->oprom_size = ++len;
 
-		error = copyout((void *)arg, opp, sizeof(int) + bufsize);
+		error = copyout(argp, opp, sizeof(int) + bufsize);
 		break;
 
 	case OPROMSETOPT:
@@ -227,7 +228,7 @@ static int openprom_sunos_ioctl(struct inode * inode, struct file * file,
 		*((int *)opp->oprom_array) = node;
 		opp->oprom_size = sizeof(int);
 
-		error = copyout((void *)arg, opp, bufsize + sizeof(int));
+		error = copyout(argp, opp, bufsize + sizeof(int));
 		break;
 
 	case OPROMPCI2NODE:
@@ -246,7 +247,7 @@ static int openprom_sunos_ioctl(struct inode * inode, struct file * file,
 				data->current_node = node;
 				*((int *)opp->oprom_array) = node;
 				opp->oprom_size = sizeof(int);
-				error = copyout((void *)arg, opp, bufsize + sizeof(int));
+				error = copyout(argp, opp, bufsize + sizeof(int));
 			}
 #endif
 		}
@@ -258,7 +259,7 @@ static int openprom_sunos_ioctl(struct inode * inode, struct file * file,
 		*((int *)opp->oprom_array) = node;
 		opp->oprom_size = sizeof(int);
 
-		error = copyout((void *)arg, opp, bufsize + sizeof(int));
+		error = copyout(argp, opp, bufsize + sizeof(int));
 		break;
 
 	case OPROMGETBOOTARGS:
@@ -274,7 +275,7 @@ static int openprom_sunos_ioctl(struct inode * inode, struct file * file,
 		strcpy(opp->oprom_array, buf);
 		opp->oprom_size = len;
 
-		error = copyout((void *)arg, opp, bufsize + sizeof(int));
+		error = copyout(argp, opp, bufsize + sizeof(int));
 		break;
 
 	case OPROMU2P:
@@ -317,7 +318,7 @@ static int goodnode(int n, DATA *data)
 }
 
 /* Copy in a whole string from userspace into kernelspace. */
-static int copyin_string(char *user, size_t len, char **ptr)
+static int copyin_string(char __user *user, size_t len, char **ptr)
 {
 	char *tmp;
 
@@ -347,6 +348,7 @@ static int openprom_bsd_ioctl(struct inode * inode, struct file * file,
 			      unsigned int cmd, unsigned long arg)
 {
 	DATA *data = (DATA *) file->private_data;
+	void __user *argp = (void __user *)arg;
 	struct opiocdesc op;
 	int error, node, len;
 	char *str, *tmp;
@@ -355,7 +357,7 @@ static int openprom_bsd_ioctl(struct inode * inode, struct file * file,
 
 	switch (cmd) {
 	case OPIOCGET:
-		if (copy_from_user(&op, (void *)arg, sizeof(op)))
+		if (copy_from_user(&op, argp, sizeof(op)))
 			return -EFAULT;
 
 		if (!goodnode(op.op_nodeid,data))
@@ -377,7 +379,7 @@ static int openprom_bsd_ioctl(struct inode * inode, struct file * file,
 		if (len <= 0) {
 			kfree(str);
 			/* Verified by the above copy_from_user */
-			if (__copy_to_user((void *)arg, &op,
+			if (__copy_to_user(argp, &op,
 				       sizeof(op)))
 				return -EFAULT;
 			return 0;
@@ -393,7 +395,7 @@ static int openprom_bsd_ioctl(struct inode * inode, struct file * file,
 
 		tmp[len] = '\0';
 
-		if (__copy_to_user((void *)arg, &op, sizeof(op)) != 0
+		if (__copy_to_user(argp, &op, sizeof(op)) != 0
 		    || copy_to_user(op.op_buf, tmp, len) != 0)
 			error = -EFAULT;
 
@@ -403,7 +405,7 @@ static int openprom_bsd_ioctl(struct inode * inode, struct file * file,
 		return error;
 
 	case OPIOCNEXTPROP:
-		if (copy_from_user(&op, (void *)arg, sizeof(op)))
+		if (copy_from_user(&op, argp, sizeof(op)))
 			return -EFAULT;
 
 		if (!goodnode(op.op_nodeid,data))
@@ -425,7 +427,7 @@ static int openprom_bsd_ioctl(struct inode * inode, struct file * file,
 			len = op.op_buflen = 0;
 		}
 
-		error = verify_area(VERIFY_WRITE, (void *)arg, sizeof(op));
+		error = verify_area(VERIFY_WRITE, argp, sizeof(op));
 		if (error) {
 			kfree(str);
 			return error;
@@ -437,7 +439,7 @@ static int openprom_bsd_ioctl(struct inode * inode, struct file * file,
 			return error;
 		}
 
-		error = __copy_to_user((void *)arg, &op, sizeof(op));
+		error = __copy_to_user(argp, &op, sizeof(op));
 		if (!error) error = __copy_to_user(op.op_buf, tmp, len);
 
 		kfree(str);
@@ -445,7 +447,7 @@ static int openprom_bsd_ioctl(struct inode * inode, struct file * file,
 		return error;
 
 	case OPIOCSET:
-		if (copy_from_user(&op, (void *)arg, sizeof(op)))
+		if (copy_from_user(&op, argp, sizeof(op)))
 			return -EFAULT;
 
 		if (!goodnode(op.op_nodeid,data))
@@ -472,13 +474,13 @@ static int openprom_bsd_ioctl(struct inode * inode, struct file * file,
 		return 0;
 
 	case OPIOCGETOPTNODE:
-		if (copy_to_user((void *)arg, &options_node, sizeof(int)))
+		if (copy_to_user(argp, &options_node, sizeof(int)))
 			return -EFAULT;
 		return 0;
 
 	case OPIOCGETNEXT:
 	case OPIOCGETCHILD:
-		if (copy_from_user(&node, (void *)arg, sizeof(int)))
+		if (copy_from_user(&node, argp, sizeof(int)))
 			return -EFAULT;
 
 		if (cmd == OPIOCGETNEXT)
@@ -486,7 +488,7 @@ static int openprom_bsd_ioctl(struct inode * inode, struct file * file,
 		else
 			node = __prom_getchild(node);
 
-		if (__copy_to_user((void *)arg, &node, sizeof(int)))
+		if (__copy_to_user(argp, &node, sizeof(int)))
 			return -EFAULT;
 
 		return 0;

drivers/sbus/char/riowatchdog.c

@@ -130,18 +130,19 @@ static int riowd_ioctl(struct inode *inode, struct file *filp,
 	static struct watchdog_info info = {
 	       	WDIOF_SETTIMEOUT, 0, "Natl. Semiconductor PC97317"
 	};
+	void __user *argp = (void __user *)arg;
 	unsigned int options;
 	int new_margin;
 
 	switch (cmd) {
 	case WDIOC_GETSUPPORT:
-		if (copy_to_user((struct watchdog_info *) arg, &info, sizeof(info)))
+		if (copy_to_user(argp, &info, sizeof(info)))
 			return -EFAULT;
 		break;
 
 	case WDIOC_GETSTATUS:
 	case WDIOC_GETBOOTSTATUS:
-		if (put_user(0, (int *) arg))
+		if (put_user(0, (int __user *)argp))
 			return -EFAULT;
 		break;
 
@@ -150,7 +151,7 @@ static int riowd_ioctl(struct inode *inode, struct file *filp,
 		break;
 
 	case WDIOC_SETOPTIONS:
-		if (copy_from_user(&options, (void *) arg, sizeof(options)))
+		if (copy_from_user(&options, argp, sizeof(options)))
 			return -EFAULT;
 
 		if (options & WDIOS_DISABLECARD)
@@ -163,7 +164,7 @@ static int riowd_ioctl(struct inode *inode, struct file *filp,
 		break;
 
 	case WDIOC_SETTIMEOUT:
-		if (get_user(new_margin, (int *)arg))
+		if (get_user(new_margin, (int __user *)argp))
 			return -EFAULT;
 		if ((new_margin < 60) || (new_margin > (255 * 60)))
 		    return -EINVAL;
@@ -172,7 +173,7 @@ static int riowd_ioctl(struct inode *inode, struct file *filp,
 		/* Fall */
 
 	case WDIOC_GETTIMEOUT:
-		return put_user(riowd_timeout * 60, (int *)arg);
+		return put_user(riowd_timeout * 60, (int __user *)argp);
 
 	default:
 		return -EINVAL;
@@ -181,7 +182,7 @@ static int riowd_ioctl(struct inode *inode, struct file *filp,
 	return 0;
 }
 
-static ssize_t riowd_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
+static ssize_t riowd_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 {
 	if (ppos != &file->f_pos)
 		return -ESPIPE;

drivers/sbus/char/rtc.c

@@ -85,6 +85,7 @@ static int rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 	unsigned long arg)
 {
 	struct rtc_time rtc_tm;
+	void __user *argp = (void __user *)arg;
 
 	switch (cmd)
 	{
@@ -92,7 +93,7 @@ static int rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 		memset(&rtc_tm, 0, sizeof(struct rtc_time));
 		get_rtc_time(&rtc_tm);
 
-		if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
+		if (copy_to_user(argp, &rtc_tm, sizeof(struct rtc_time)))
 			return -EFAULT;
 
 		return 0;
@@ -102,7 +103,7 @@ static int rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 		if (!capable(CAP_SYS_TIME))
 			return -EPERM;
 
-		if (copy_from_user(&rtc_tm, (struct rtc_time*)arg, sizeof(struct rtc_time)))
+		if (copy_from_user(&rtc_tm, argp, sizeof(struct rtc_time)))
 			return -EFAULT;
 
 		set_rtc_time(&rtc_tm);

drivers/sbus/char/vfc_dev.c

@@ -226,7 +226,7 @@ static int vfc_release(struct inode *inode,struct file *file)
 	return 0;
 }
 
-static int vfc_debug(struct vfc_dev *dev, int cmd, unsigned long arg) 
+static int vfc_debug(struct vfc_dev *dev, int cmd, void __user *argp)
 {
 	struct vfc_debug_inout inout;
 	unsigned char *buffer;
@@ -236,15 +236,14 @@ static int vfc_debug(struct vfc_dev *dev, int cmd, unsigned long arg)
 
 	switch(cmd) {
 	case VFC_I2C_SEND:
-		if(copy_from_user(&inout, (void *)arg, sizeof(inout)))
+		if(copy_from_user(&inout, argp, sizeof(inout)))
 			return -EFAULT;
 
-		buffer = kmalloc(inout.len*sizeof(char), GFP_KERNEL);
+		buffer = kmalloc(inout.len, GFP_KERNEL);
 		if (buffer == NULL)
 			return -ENOMEM;
 
-		if(copy_from_user(buffer, inout.buffer, 
-				  inout.len*sizeof(char))) {
+		if(copy_from_user(buffer, inout.buffer, inout.len)) {
 			kfree(buffer);
 			return -EFAULT;
 		}
@@ -255,7 +254,7 @@ static int vfc_debug(struct vfc_dev *dev, int cmd, unsigned long arg)
 			vfc_i2c_sendbuf(dev,inout.addr & 0xff,
 					buffer,inout.len);
 
-		if (copy_to_user((void *)arg,&inout,sizeof(inout))) {
+		if (copy_to_user(argp,&inout,sizeof(inout))) {
 			kfree(buffer);
 			return -EFAULT;
 		}
@@ -263,14 +262,14 @@ static int vfc_debug(struct vfc_dev *dev, int cmd, unsigned long arg)
 
 		break;
 	case VFC_I2C_RECV:
-		if (copy_from_user(&inout, (void *)arg, sizeof(inout)))
+		if (copy_from_user(&inout, argp, sizeof(inout)))
 			return -EFAULT;
 
 		buffer = kmalloc(inout.len, GFP_KERNEL);
 		if (buffer == NULL)
 			return -ENOMEM;
 
-		memset(buffer,0,inout.len*sizeof(char));
+		memset(buffer,0,inout.len);
 		vfc_lock_device(dev);
 		inout.ret=
 			vfc_i2c_recvbuf(dev,inout.addr & 0xff
@@ -281,7 +280,7 @@ static int vfc_debug(struct vfc_dev *dev, int cmd, unsigned long arg)
 			kfree(buffer);
 			return -EFAULT;
 		}
-		if (copy_to_user((void *)arg,&inout,sizeof(inout))) {
+		if (copy_to_user(argp,&inout,sizeof(inout))) {
 			kfree(buffer);
 			return -EFAULT;
 		}
@@ -340,7 +339,7 @@ static int vfc_set_control_ioctl(struct inode *inode, struct file *file,
 {
 	int setcmd, ret = 0;
 
-	if (copy_from_user(&setcmd,(void *)arg,sizeof(unsigned int)))
+	if (copy_from_user(&setcmd,(void __user *)arg,sizeof(unsigned int)))
 		return -EFAULT;
 
 	VFC_IOCTL_DEBUG_PRINTK(("vfc%d: IOCTL(VFCSCTRL) arg=0x%x\n",
@@ -398,7 +397,7 @@ int vfc_port_change_ioctl(struct inode *inode, struct file *file,
 	int ret = 0;
 	int cmd;
 
-	if(copy_from_user(&cmd, (void *)arg, sizeof(unsigned int))) {
+	if(copy_from_user(&cmd, (void __user *)arg, sizeof(unsigned int))) {
 		VFC_IOCTL_DEBUG_PRINTK(("vfc%d: User passed bogus pointer to "
 					"vfc_port_change_ioctl\n",
 					dev->instance));
@@ -468,7 +467,7 @@ int vfc_set_video_ioctl(struct inode *inode, struct file *file,
 	int ret = 0;
 	int cmd;
 
-	if(copy_from_user(&cmd, (void *)arg, sizeof(unsigned int))) {
+	if(copy_from_user(&cmd, (void __user *)arg, sizeof(unsigned int))) {
 		VFC_IOCTL_DEBUG_PRINTK(("vfc%d: User passed bogus pointer to "
 					"vfc_set_video_ioctl\n",
 					dev->instance));
@@ -542,7 +541,7 @@ int vfc_get_video_ioctl(struct inode *inode, struct file *file,
 	VFC_IOCTL_DEBUG_PRINTK(("vfc%d: IOCTL(VFCGVID) returning status 0x%x; "
 				"buf[0]=%x\n", dev->instance, status, buf[0]));
 
-	if (copy_to_user((void *)arg,&status,sizeof(unsigned int))) {
+	if (copy_to_user((void __user *)arg,&status,sizeof(unsigned int))) {
 		VFC_IOCTL_DEBUG_PRINTK(("vfc%d: User passed bogus pointer to "
 					"vfc_get_video_ioctl\n",
 					dev->instance));
@@ -557,6 +556,7 @@ static int vfc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 	int ret = 0;
 	unsigned int tmp;
 	struct vfc_dev *dev;
+	void __user *argp = (void __user *)arg;
 
 	dev = vfc_get_dev_ptr(iminor(inode));
 	if(dev == NULL)
@@ -568,7 +568,7 @@ static int vfc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 		VFC_IOCTL_DEBUG_PRINTK(("vfc%d: IOCTL(VFCGCTRL)\n", dev->instance));
 #endif
 		tmp = sbus_readl(&dev->regs->control);
-		if(copy_to_user((void *)arg, &tmp, sizeof(unsigned int))) {
+		if(copy_to_user(argp, &tmp, sizeof(unsigned int))) {
 			ret = -EFAULT;
 			break;
 		}
@@ -585,7 +585,7 @@ static int vfc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 		break;
 	case VFCHUE:
 		VFC_IOCTL_DEBUG_PRINTK(("vfc%d: IOCTL(VFCHUE)\n", dev->instance));
-		if(copy_from_user(&tmp,(void *)arg,sizeof(unsigned int))) {
+		if(copy_from_user(&tmp,argp,sizeof(unsigned int))) {
 			VFC_IOCTL_DEBUG_PRINTK(("vfc%d: User passed bogus pointer "
 						"to IOCTL(VFCHUE)", dev->instance));
 			ret = -EFAULT;
@@ -603,8 +603,7 @@ static int vfc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 		VFC_IOCTL_DEBUG_PRINTK(("vfc%d: IOCTL(VFCRDINFO)\n", dev->instance));
 		break;
 	default:
-		ret = vfc_debug(vfc_get_dev_ptr(iminor(inode)),
-				cmd, arg);
+		ret = vfc_debug(vfc_get_dev_ptr(iminor(inode)), cmd, argp);
 		break;
 	};
 

include/asm-sparc/vfc_ioctls.h

@@ -52,7 +52,7 @@ struct vfc_debug_inout
 	unsigned long addr;
 	unsigned long ret;
 	unsigned long len;
-	unsigned char *buffer;
+	unsigned char __user *buffer;
 };
 
 #endif /* _LINUX_VFC_IOCTLS_H_ */