Merge kroah.com:/home/greg/linux/BK/bleed-2.6

into kroah.com:/home/greg/linux/BK/driver-2.6

arch/i386/kernel/mpparse.c

@@ -1015,15 +1015,23 @@ void __init mp_config_acpi_legacy_irqs (void)
 	for (i = 0; i < 16; i++) {
 		int idx;
 
-		for (idx = 0; idx < mp_irq_entries; idx++)
-			if (mp_irqs[idx].mpc_srcbus == MP_ISA_BUS &&
-				(mp_irqs[idx].mpc_dstapic == ioapic) &&
-				(mp_irqs[idx].mpc_srcbusirq == i ||
-				mp_irqs[idx].mpc_dstirq == i))
+		for (idx = 0; idx < mp_irq_entries; idx++) {
+			struct mpc_config_intsrc *irq = mp_irqs + idx;
+
+			/* Do we already have a mapping for this ISA IRQ? */
+			if (irq->mpc_srcbus == MP_ISA_BUS && irq->mpc_srcbusirq == i)
 				break;
 
-		if (idx != mp_irq_entries)
+			/* Do we already have a mapping for this IOAPIC pin */
+			if ((irq->mpc_dstapic == intsrc.mpc_dstapic) &&
+				(irq->mpc_dstirq == i))
+				break;
+		}
+
+		if (idx != mp_irq_entries) {
+			printk(KERN_DEBUG "ACPI: IRQ%d used by override.\n", i);
 			continue;			/* IRQ already used */
+		}
 
 		intsrc.mpc_irqtype = mp_INT;
 		intsrc.mpc_srcbusirq = i;		   /* Identity mapped */

arch/x86_64/kernel/mpparse.c

@@ -859,12 +859,18 @@ void __init mp_config_acpi_legacy_irqs (void)
 	for (i = 0; i < 16; i++) {
 		int idx;
 
-		for (idx = 0; idx < mp_irq_entries; idx++)
-			if (mp_irqs[idx].mpc_srcbus == MP_ISA_BUS &&
-				(mp_irqs[idx].mpc_dstapic == ioapic) &&
-				(mp_irqs[idx].mpc_srcbusirq == i ||
-				mp_irqs[idx].mpc_dstirq == i))
+		for (idx = 0; idx < mp_irq_entries; idx++) {
+			struct mpc_config_intsrc *irq = mp_irqs + idx;
+
+			/* Do we already have a mapping for this ISA IRQ? */
+			if (irq->mpc_srcbus == MP_ISA_BUS && irq->mpc_srcbusirq == i)
+				break;
+
+			/* Do we already have a mapping for this IOAPIC pin */
+			if ((irq->mpc_dstapic == intsrc.mpc_dstapic) &&
+				(irq->mpc_dstirq == i))
 				break;
+		}
 
 		if (idx != mp_irq_entries) {
 			printk(KERN_DEBUG "ACPI: IRQ%d used by override.\n", i);

drivers/block/ll_rw_blk.c

@@ -2667,7 +2667,7 @@ static int __end_that_request_first(struct request *req, int uptodate,
 	}
 
 	total_bytes = bio_nbytes = 0;
-	while ((bio = req->bio)) {
+	while ((bio = req->bio) != NULL) {
 		int nbytes;
 
 		if (nr_bytes >= bio->bi_size) {

drivers/firmware/efivars.c

@@ -134,7 +134,7 @@ struct efivar_attribute {
 
 #define EFI_ATTR(_name, _mode, _show, _store) \
 struct subsys_attribute efi_attr_##_name = { \
-	.attr {.name = __stringify(_name), .mode = _mode, .owner = THIS_MODULE}, \
+	.attr = {.name = __stringify(_name), .mode = _mode, .owner = THIS_MODULE}, \
 	.show = _show, \
 	.store = _store, \
 };

drivers/ide/legacy/hd.c

@@ -660,7 +660,7 @@ static int hd_ioctl(struct inode * inode, struct file * file,
 	unsigned int cmd, unsigned long arg)
 {
 	struct hd_i_struct *disk = inode->i_bdev->bd_disk->private_data;
-	struct hd_geometry *loc = (struct hd_geometry *) arg;
+	struct hd_geometry __user *loc = (struct hd_geometry __user *) arg;
 	struct hd_geometry g; 
 
 	if (cmd != HDIO_GETGEO)

drivers/ieee1394/amdtp.c

@@ -1095,7 +1095,7 @@ void stream_free(struct stream *s)
 
 /* File operations */
 
-static ssize_t amdtp_write(struct file *file, const char *buffer, size_t count,
+static ssize_t amdtp_write(struct file *file, const char __user *buffer, size_t count,
 			   loff_t *offset_is_ignored)
 {
 	struct stream *s = file->private_data;
@@ -1150,7 +1150,7 @@ static int amdtp_ioctl(struct inode *inode, struct file *file,
 	{
 	case AMDTP_IOC_PLUG:
 	case AMDTP_IOC_CHANNEL:
-		if (copy_from_user(&cfg, (struct amdtp_ioctl *) arg, sizeof cfg))
+		if (copy_from_user(&cfg, (struct amdtp_ioctl __user *) arg, sizeof cfg))
 			return -EFAULT;
 		else
 			return stream_configure(s, cmd, &cfg);

drivers/ieee1394/dv1394.c

@@ -1333,7 +1333,7 @@ static int dv1394_fasync(int fd, struct file *file, int on)
         return 0;
 }
 
-static ssize_t dv1394_write(struct file *file, const char *buffer, size_t count, loff_t *ppos)
+static ssize_t dv1394_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
 {
 	struct video_card *video = file_to_video_card(file);
 	DECLARE_WAITQUEUE(wait, current);
@@ -1430,7 +1430,7 @@ static ssize_t dv1394_write(struct file *file, const char *buffer, size_t count,
 }
 
 
-static ssize_t dv1394_read(struct file *file,  char *buffer, size_t count, loff_t *ppos)
+static ssize_t dv1394_read(struct file *file,  char __user *buffer, size_t count, loff_t *ppos)
 {
 	struct video_card *video = file_to_video_card(file);
 	DECLARE_WAITQUEUE(wait, current);
@@ -1549,6 +1549,7 @@ static int dv1394_ioctl(struct inode *inode, struct file *file,
 	struct video_card *video = file_to_video_card(file);
 	unsigned long flags;
 	int ret = -EINVAL;
+	void __user *argp = (void __user *)arg;
 
 	DECLARE_WAITQUEUE(wait, current);
 
@@ -1718,10 +1719,10 @@ static int dv1394_ioctl(struct inode *inode, struct file *file,
 
 	case DV1394_IOC_INIT: {
 		struct dv1394_init init;
-		if (arg == (unsigned long) NULL) {
+		if (!argp) {
 			ret = do_dv1394_init_default(video);
 		} else {
-			if (copy_from_user(&init, (void*)arg, sizeof(init))) {
+			if (copy_from_user(&init, argp, sizeof(init))) {
 				ret = -EFAULT;
 				goto out;
 			}
@@ -1767,7 +1768,7 @@ static int dv1394_ioctl(struct inode *inode, struct file *file,
 
 		spin_unlock_irqrestore(&video->spinlock, flags);
 
-		if (copy_to_user((void*)arg, &status, sizeof(status))) {
+		if (copy_to_user(argp, &status, sizeof(status))) {
 			ret = -EFAULT;
 			goto out;
 		}

drivers/ieee1394/raw1394-private.h

@@ -35,11 +35,11 @@ struct file_info {
 
         struct list_head addr_list;
 
-        u8 *fcp_buffer;
+        u8 __user *fcp_buffer;
 
 	/* old ISO API */
         u64 listen_channels;
-        quadlet_t *iso_buffer;
+        quadlet_t __user *iso_buffer;
         size_t iso_buffer_length;
 
         u8 notification; /* (busreset-notification) RAW1394_NOTIFY_OFF/ON */

drivers/ieee1394/raw1394.h

@@ -105,18 +105,18 @@ typedef struct arm_request {
         __u8            extended_transaction_code;
         __u32           generation;
         __u16           buffer_length;
-        __u8            *buffer;
+        __u8            __user *buffer;
 } *arm_request_t;
 
 typedef struct arm_response {
         __s32           response_code;
         __u16           buffer_length;
-        __u8            *buffer;
+        __u8            __user *buffer;
 } *arm_response_t;
 
 typedef struct arm_request_response {
-        struct arm_request  *request;
-        struct arm_response *response;
+        struct arm_request  __user *request;
+        struct arm_response __user *response;
 } *arm_request_response_t;
 
 /* rawiso API */
@@ -136,7 +136,7 @@ struct raw1394_iso_packet_info {
 /* argument for RAW1394_ISO_RECV/XMIT_PACKETS ioctls */
 struct raw1394_iso_packets {
 	__u32 n_packets;
-	struct raw1394_iso_packet_info *infos;
+	struct raw1394_iso_packet_info __user *infos;
 };
 
 struct raw1394_iso_config {

drivers/ieee1394/video1394.c

@@ -705,6 +705,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
 	struct file_ctx *ctx = (struct file_ctx *)file->private_data;
 	struct ti_ohci *ohci = ctx->ohci;
 	unsigned long flags;
+	void __user *argp = (void __user *)arg;
 
 	switch(cmd)
 	{
@@ -716,7 +717,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
 		struct dma_iso_ctx *d;
 		int i;
 
-		if (copy_from_user(&v, (void *)arg, sizeof(v)))
+		if (copy_from_user(&v, argp, sizeof(v)))
 			return -EFAULT;
 
 		/* if channel < 0, find lowest available one */
@@ -813,7 +814,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
 			      v.channel);
 		}
 
-		if (copy_to_user((void *)arg, &v, sizeof(v)))
+		if (copy_to_user(argp, &v, sizeof(v)))
 			return -EFAULT;
 
 		return 0;
@@ -825,7 +826,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
 		u64 mask;
 		struct dma_iso_ctx *d;
 
-		if (copy_from_user(&channel, (void *)arg, sizeof(int)))
+		if (copy_from_user(&channel, argp, sizeof(int)))
 			return -EFAULT;
 
 		if (channel<0 || channel>(ISO_CHANNELS-1)) {
@@ -860,7 +861,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
 		struct video1394_wait v;
 		struct dma_iso_ctx *d;
 
-		if (copy_from_user(&v, (void *)arg, sizeof(v)))
+		if (copy_from_user(&v, argp, sizeof(v)))
 			return -EFAULT;
 
 		d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel);
@@ -923,7 +924,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
 		struct dma_iso_ctx *d;
 		int i;
 
-		if (copy_from_user(&v, (void *)arg, sizeof(v)))
+		if (copy_from_user(&v, argp, sizeof(v)))
 			return -EFAULT;
 
 		d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel);
@@ -994,7 +995,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
 		spin_unlock_irqrestore(&d->lock, flags);
 
 		v.buffer=i;
-		if (copy_to_user((void *)arg, &v, sizeof(v)))
+		if (copy_to_user(argp, &v, sizeof(v)))
 			return -EFAULT;
 
 		return 0;
@@ -1007,7 +1008,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
 
 		qv.packet_sizes = NULL;
 
-		if (copy_from_user(&v, (void *)arg, sizeof(v)))
+		if (copy_from_user(&v, argp, sizeof(v)))
 			return -EFAULT;
 
 		d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel);
@@ -1023,7 +1024,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
 			unsigned int *psizes;
 			int buf_size = d->nb_cmd * sizeof(unsigned int);
 
-			if (copy_from_user(&qv, (void *)arg, sizeof(qv)))
+			if (copy_from_user(&qv, argp, sizeof(qv)))
 				return -EFAULT;
 
 			psizes = kmalloc(buf_size, GFP_KERNEL);
@@ -1111,7 +1112,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
 		struct video1394_wait v;
 		struct dma_iso_ctx *d;
 
-		if (copy_from_user(&v, (void *)arg, sizeof(v)))
+		if (copy_from_user(&v, argp, sizeof(v)))
 			return -EFAULT;
 
 		d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel);

drivers/isdn/i4l/isdn_ppp.h

@@ -12,8 +12,8 @@
 #include <linux/ppp_defs.h>     /* for PPP_PROTOCOL */
 #include <linux/isdn_ppp.h>	/* for isdn_ppp info */
 
-extern int isdn_ppp_read(int, struct file *, char *, int);
-extern int isdn_ppp_write(int, struct file *, const char *, int);
+extern int isdn_ppp_read(int, struct file *, char __user *, int);
+extern int isdn_ppp_write(int, struct file *, const char __user *, int);
 extern int isdn_ppp_open(int, struct file *);
 extern int isdn_ppp_init(void);
 extern void isdn_ppp_cleanup(void);

drivers/net/ppp_generic.c

@@ -129,8 +129,9 @@ struct ppp {
 #endif /* CONFIG_PPP_MULTILINK */
 	struct net_device_stats stats;	/* statistics */
 #ifdef CONFIG_PPP_FILTER
-	struct sock_fprog pass_filter;	/* filter for packets to pass */
-	struct sock_fprog active_filter;/* filter for pkts to reset idle */
+	struct sock_filter *pass_filter;	/* filter for packets to pass */
+	struct sock_filter *active_filter;/* filter for pkts to reset idle */
+	unsigned pass_len, active_len;
 #endif /* CONFIG_PPP_FILTER */
 };
 
@@ -493,6 +494,43 @@ static unsigned int ppp_poll(struct file *file, poll_table *wait)
 	return mask;
 }
 
+static int get_filter(void __user *arg, struct sock_filter **p)
+{
+	struct sock_fprog uprog;
+	struct sock_filter *code = NULL;
+	int len, err;
+
+	if (copy_from_user(&uprog, arg, sizeof(uprog)))
+		return -EFAULT;
+
+	if (uprog.len > BPF_MAXINSNS)
+		return -EINVAL;
+
+	if (!uprog.len) {
+		*p = NULL;
+		return 0;
+	}
+
+	len = uprog.len * sizeof(struct sock_filter);
+	code = kmalloc(len, GFP_KERNEL);
+	if (code == NULL)
+		return -ENOMEM;
+
+	if (copy_from_user(code, uprog.filter, len)) {
+		kfree(code);
+		return -EFAULT;
+	}
+
+	err = sk_chk_filter(code, uprog.len);
+	if (err) {
+		kfree(code);
+		return err;
+	}
+
+	*p = code;
+	return uprog.len;
+}
+
 static int ppp_ioctl(struct inode *inode, struct file *file,
 		     unsigned int cmd, unsigned long arg)
 {
@@ -503,6 +541,8 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 	struct npioctl npi;
 	int unit, cflags;
 	struct slcompress *vj;
+	void __user *argp = (void __user *)arg;
+	int __user *p = argp;
 
 	if (pf == 0)
 		return ppp_unattached_ioctl(pf, file, cmd, arg);
@@ -540,7 +580,7 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 
 		switch (cmd) {
 		case PPPIOCCONNECT:
-			if (get_user(unit, (int *) arg))
+			if (get_user(unit, p))
 				break;
 			err = ppp_connect_channel(pch, unit);
 			break;
@@ -569,14 +609,14 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 	ppp = PF_TO_PPP(pf);
 	switch (cmd) {
 	case PPPIOCSMRU:
-		if (get_user(val, (int *) arg))
+		if (get_user(val, p))
 			break;
 		ppp->mru = val;
 		err = 0;
 		break;
 
 	case PPPIOCSFLAGS:
-		if (get_user(val, (int *) arg))
+		if (get_user(val, p))
 			break;
 		ppp_lock(ppp);
 		cflags = ppp->flags & ~val;
@@ -589,7 +629,7 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 
 	case PPPIOCGFLAGS:
 		val = ppp->flags | ppp->xstate | ppp->rstate;
-		if (put_user(val, (int *) arg))
+		if (put_user(val, p))
 			break;
 		err = 0;
 		break;
@@ -599,20 +639,20 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 		break;
 
 	case PPPIOCGUNIT:
-		if (put_user(ppp->file.index, (int *) arg))
+		if (put_user(ppp->file.index, p))
 			break;
 		err = 0;
 		break;
 
 	case PPPIOCSDEBUG:
-		if (get_user(val, (int *) arg))
+		if (get_user(val, p))
 			break;
 		ppp->debug = val;
 		err = 0;
 		break;
 
 	case PPPIOCGDEBUG:
-		if (put_user(ppp->debug, (int *) arg))
+		if (put_user(ppp->debug, p))
 			break;
 		err = 0;
 		break;
@@ -620,13 +660,13 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 	case PPPIOCGIDLE:
 		idle.xmit_idle = (jiffies - ppp->last_xmit) / HZ;
 		idle.recv_idle = (jiffies - ppp->last_recv) / HZ;
-		if (copy_to_user((void __user *) arg, &idle, sizeof(idle)))
+		if (copy_to_user(argp, &idle, sizeof(idle)))
 			break;
 		err = 0;
 		break;
 
 	case PPPIOCSMAXCID:
-		if (get_user(val, (int *) arg))
+		if (get_user(val, p))
 			break;
 		val2 = 15;
 		if ((val >> 16) != 0) {
@@ -649,7 +689,7 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 
 	case PPPIOCGNPMODE:
 	case PPPIOCSNPMODE:
-		if (copy_from_user(&npi, (void __user *) arg, sizeof(npi)))
+		if (copy_from_user(&npi, argp, sizeof(npi)))
 			break;
 		err = proto_to_npindex(npi.protocol);
 		if (err < 0)
@@ -658,7 +698,7 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 		if (cmd == PPPIOCGNPMODE) {
 			err = -EFAULT;
 			npi.mode = ppp->npmode[i];
-			if (copy_to_user((void __user *) arg, &npi, sizeof(npi)))
+			if (copy_to_user(argp, &npi, sizeof(npi)))
 				break;
 		} else {
 			ppp->npmode[i] = npi.mode;
@@ -670,49 +710,38 @@ static int ppp_ioctl(struct inode *inode, struct file *file,
 
 #ifdef CONFIG_PPP_FILTER
 	case PPPIOCSPASS:
-	case PPPIOCSACTIVE:
 	{
-		struct sock_fprog uprog, *filtp;
-		struct sock_filter *code = NULL;
-		int len;
-
-		if (copy_from_user(&uprog, (void __user *) arg, sizeof(uprog)))
-			break;
-		err = -EINVAL;
-		if (uprog.len > BPF_MAXINSNS)
-			break;
-		err = -ENOMEM;
-		if (uprog.len > 0) {
-			len = uprog.len * sizeof(struct sock_filter);
-			code = kmalloc(len, GFP_KERNEL);
-			if (code == NULL)
-				break;
-			err = -EFAULT;
-			if (copy_from_user(code, (void __user *) uprog.filter, len)) {
-				kfree(code);
-				break;
+		struct sock_filter *code;
+		err = get_filter(argp, &code);
+		if (err >= 0) {
+			ppp_lock(ppp);
+			kfree(ppp->pass_filter);
+			ppp->pass_filter = code;
+			ppp->pass_len = err;
+			ppp_unlock(ppp);
+			err = 0;
 		}
-			err = sk_chk_filter(code, uprog.len);
-			if (err) {
-				kfree(code);
 		break;
 	}
-		}
-		filtp = (cmd == PPPIOCSPASS)? &ppp->pass_filter: &ppp->active_filter;
+	case PPPIOCSACTIVE:
+	{
+		struct sock_filter *code;
+		err = get_filter(argp, &code);
+		if (err >= 0) {
 			ppp_lock(ppp);
-		if (filtp->filter)
-			kfree(filtp->filter);
-		filtp->filter = code;
-		filtp->len = uprog.len;
+			kfree(ppp->active_filter);
+			ppp->active_filter = code;
+			ppp->active_len = err;
 			ppp_unlock(ppp);
 			err = 0;
+		}
 		break;
 	}
 #endif /* CONFIG_PPP_FILTER */
 
 #ifdef CONFIG_PPP_MULTILINK
 	case PPPIOCSMRRU:
-		if (get_user(val, (int *) arg))
+		if (get_user(val, p))
 			break;
 		ppp_recv_lock(ppp);
 		ppp->mrru = val;
@@ -734,11 +763,12 @@ static int ppp_unattached_ioctl(struct ppp_file *pf, struct file *file,
 	int unit, err = -EFAULT;
 	struct ppp *ppp;
 	struct channel *chan;
+	int __user *p = (int __user *)arg;
 
 	switch (cmd) {
 	case PPPIOCNEWUNIT:
 		/* Create a new ppp unit */
-		if (get_user(unit, (int *) arg))
+		if (get_user(unit, p))
 			break;
 		ppp = ppp_create_interface(unit, &err);
 		if (ppp == 0)
@@ -746,14 +776,14 @@ static int ppp_unattached_ioctl(struct ppp_file *pf, struct file *file,
 		file->private_data = &ppp->file;
 		ppp->owner = file;
 		err = -EFAULT;
-		if (put_user(ppp->file.index, (int *) arg))
+		if (put_user(ppp->file.index, p))
 			break;
 		err = 0;
 		break;
 
 	case PPPIOCATTACH:
 		/* Attach to an existing ppp unit */
-		if (get_user(unit, (int *) arg))
+		if (get_user(unit, p))
 			break;
 		down(&all_ppp_sem);
 		err = -ENXIO;
@@ -767,7 +797,7 @@ static int ppp_unattached_ioctl(struct ppp_file *pf, struct file *file,
 		break;
 
 	case PPPIOCATTCHAN:
-		if (get_user(unit, (int *) arg))
+		if (get_user(unit, p))
 			break;
 		spin_lock_bh(&all_channels_lock);
 		err = -ENXIO;
@@ -999,18 +1029,18 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
 
 			*p = htons(4); /* indicate outbound in DLT_LINUX_SLL */;
 		}
-		if (ppp->pass_filter.filter
-		    && sk_run_filter(skb, ppp->pass_filter.filter,
-				     ppp->pass_filter.len) == 0) {
+		if (ppp->pass_filter
+		    && sk_run_filter(skb, ppp->pass_filter,
+				     ppp->pass_len) == 0) {
 			if (ppp->debug & 1)
 				printk(KERN_DEBUG "PPP: outbound frame not passed\n");
 			kfree_skb(skb);
 			return;
 		}
 		/* if this packet passes the active filter, record the time */
-		if (!(ppp->active_filter.filter
-		      && sk_run_filter(skb, ppp->active_filter.filter,
-				       ppp->active_filter.len) == 0))
+		if (!(ppp->active_filter
+		      && sk_run_filter(skb, ppp->active_filter,
+				       ppp->active_len) == 0))
 			ppp->last_xmit = jiffies;
 		skb_pull(skb, 2);
 #else
@@ -1546,17 +1576,17 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
 
 			*p = 0; /* indicate inbound in DLT_LINUX_SLL */
 		}
-		if (ppp->pass_filter.filter
-		    && sk_run_filter(skb, ppp->pass_filter.filter,
-				     ppp->pass_filter.len) == 0) {
+		if (ppp->pass_filter
+		    && sk_run_filter(skb, ppp->pass_filter,
+				     ppp->pass_len) == 0) {
 			if (ppp->debug & 1)
 				printk(KERN_DEBUG "PPP: inbound frame not passed\n");
 			kfree_skb(skb);
 			return;
 		}
-		if (!(ppp->active_filter.filter
-		      && sk_run_filter(skb, ppp->active_filter.filter,
-				       ppp->active_filter.len) == 0))
+		if (!(ppp->active_filter
+		      && sk_run_filter(skb, ppp->active_filter,
+				       ppp->active_len) == 0))
 			ppp->last_recv = jiffies;
 		skb_pull(skb, 2);
 #else
@@ -2423,13 +2453,13 @@ static void ppp_destroy_interface(struct ppp *ppp)
 	skb_queue_purge(&ppp->mrq);
 #endif /* CONFIG_PPP_MULTILINK */
 #ifdef CONFIG_PPP_FILTER
-	if (ppp->pass_filter.filter) {
-		kfree(ppp->pass_filter.filter);
-		ppp->pass_filter.filter = NULL;
+	if (ppp->pass_filter) {
+		kfree(ppp->pass_filter);
+		ppp->pass_filter = NULL;
 	}
-	if (ppp->active_filter.filter) {
-		kfree(ppp->active_filter.filter);
-		ppp->active_filter.filter = 0;
+	if (ppp->active_filter) {
+		kfree(ppp->active_filter);
+		ppp->active_filter = 0;
 	}
 #endif /* CONFIG_PPP_FILTER */
 

drivers/net/tokenring/ibmtr.c

@@ -127,6 +127,7 @@ in the event that chatty debug messages are desired - jjs 12/30/98 */
 
 #include <linux/ioport.h>
 #include <linux/netdevice.h>
+#include <linux/ip.h>
 #include <linux/trdevice.h>
 #include <linux/ibmtr.h>
 

drivers/net/wan/c101.c

@@ -220,7 +220,8 @@ static int c101_close(struct net_device *dev)
 static int c101_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
 	const size_t size = sizeof(sync_serial_settings);
-	sync_serial_settings new_line, *line = ifr->ifr_settings.ifs_ifsu.sync;
+	sync_serial_settings new_line;
+	sync_serial_settings __user *line = ifr->ifr_settings.ifs_ifsu.sync;
 	port_t *port = dev_to_port(dev);
 
 #ifdef DEBUG_RINGS

drivers/net/wan/cosa.c

@@ -301,9 +301,9 @@ static char *chrdev_setup_rx(struct channel_data *channel, int size);
 static int chrdev_rx_done(struct channel_data *channel);
 static int chrdev_tx_done(struct channel_data *channel, int size);
 static ssize_t cosa_read(struct file *file,
-	char *buf, size_t count, loff_t *ppos);
+	char __user *buf, size_t count, loff_t *ppos);
 static ssize_t cosa_write(struct file *file,
-	const char *buf, size_t count, loff_t *ppos);
+	const char __user *buf, size_t count, loff_t *ppos);
 static unsigned int cosa_poll(struct file *file, poll_table *poll);
 static int cosa_open(struct inode *inode, struct file *file);
 static int cosa_release(struct inode *inode, struct file *file);
@@ -330,13 +330,13 @@ static struct file_operations cosa_fops = {
 /* Ioctls */
 static int cosa_start(struct cosa_data *cosa, int address);
 static int cosa_reset(struct cosa_data *cosa);
-static int cosa_download(struct cosa_data *cosa, unsigned long a);
-static int cosa_readmem(struct cosa_data *cosa, unsigned long a);
+static int cosa_download(struct cosa_data *cosa, void __user *a);
+static int cosa_readmem(struct cosa_data *cosa, void __user *a);
 
 /* COSA/SRP ROM monitor */
-static int download(struct cosa_data *cosa, const char *data, int addr, int len);
+static int download(struct cosa_data *cosa, const char __user *data, int addr, int len);
 static int startmicrocode(struct cosa_data *cosa, int address);
-static int readmem(struct cosa_data *cosa, char *data, int addr, int len);
+static int readmem(struct cosa_data *cosa, char __user *data, int addr, int len);
 static int cosa_reset_and_read_id(struct cosa_data *cosa, char *id);
 
 /* Auxilliary functions */
@@ -830,7 +830,7 @@ static void chardev_channel_init(struct channel_data *chan)
 }
 
 static ssize_t cosa_read(struct file *file,
-	char *buf, size_t count, loff_t *ppos)
+	char __user *buf, size_t count, loff_t *ppos)
 {
 	DECLARE_WAITQUEUE(wait, current);
 	unsigned long flags;
@@ -905,7 +905,7 @@ static int chrdev_rx_done(struct channel_data *chan)
 
 
 static ssize_t cosa_write(struct file *file,
-	const char *buf, size_t count, loff_t *ppos)
+	const char __user *buf, size_t count, loff_t *ppos)
 {
 	DECLARE_WAITQUEUE(wait, current);
 	struct channel_data *chan = file->private_data;
@@ -1066,7 +1066,7 @@ static inline int cosa_reset(struct cosa_data *cosa)
 }
 
 /* High-level function to download data into COSA memory. Calls download() */
-static inline int cosa_download(struct cosa_data *cosa, unsigned long arg)
+static inline int cosa_download(struct cosa_data *cosa, void __user *arg)
 {
 	struct cosa_download d;
 	int i;
@@ -1080,7 +1080,7 @@ static inline int cosa_download(struct cosa_data *cosa, unsigned long arg)
 		return -EPERM;
 	}
 	
-	if (copy_from_user(&d, (void __user *) arg, sizeof(d)))
+	if (copy_from_user(&d, arg, sizeof(d)))
 		return -EFAULT;
 
 	if (d.addr < 0 || d.addr > COSA_MAX_FIRMWARE_SIZE)
@@ -1105,7 +1105,7 @@ static inline int cosa_download(struct cosa_data *cosa, unsigned long arg)
 }
 
 /* High-level function to read COSA memory. Calls readmem() */
-static inline int cosa_readmem(struct cosa_data *cosa, unsigned long arg)
+static inline int cosa_readmem(struct cosa_data *cosa, void __user *arg)
 {
 	struct cosa_download d;
 	int i;
@@ -1120,7 +1120,7 @@ static inline int cosa_readmem(struct cosa_data *cosa, unsigned long arg)
 		return -EPERM;
 	}
 
-	if (copy_from_user(&d, (void __user *) arg, sizeof(d)))
+	if (copy_from_user(&d, arg, sizeof(d)))
 		return -EFAULT;
 
 	/* If something fails, force the user to reset the card */
@@ -1167,7 +1167,7 @@ static inline int cosa_start(struct cosa_data *cosa, int address)
 }
 		
 /* Buffer of size at least COSA_MAX_ID_STRING is expected */
-static inline int cosa_getidstr(struct cosa_data *cosa, char *string)
+static inline int cosa_getidstr(struct cosa_data *cosa, char __user *string)
 {
 	int l = strlen(cosa->id_string)+1;
 	if (copy_to_user(string, cosa->id_string, l))
@@ -1176,7 +1176,7 @@ static inline int cosa_getidstr(struct cosa_data *cosa, char *string)
 }
 
 /* Buffer of size at least COSA_MAX_ID_STRING is expected */
-static inline int cosa_gettype(struct cosa_data *cosa, char *string)
+static inline int cosa_gettype(struct cosa_data *cosa, char __user *string)
 {
 	int l = strlen(cosa->type)+1;
 	if (copy_to_user(string, cosa->type, l))
@@ -1187,6 +1187,7 @@ static inline int cosa_gettype(struct cosa_data *cosa, char *string)
 static int cosa_ioctl_common(struct cosa_data *cosa,
 	struct channel_data *channel, unsigned int cmd, unsigned long arg)
 {
+	void __user *argp = (void __user *)arg;
 	switch(cmd) {
 	case COSAIORSET:	/* Reset the device */
 		if (!capable(CAP_NET_ADMIN))
@@ -1200,15 +1201,15 @@ static int cosa_ioctl_common(struct cosa_data *cosa,
 		if (!capable(CAP_SYS_RAWIO))
 			return -EACCES;
 		
-		return cosa_download(cosa, arg);
+		return cosa_download(cosa, argp);
 	case COSAIORMEM:
 		if (!capable(CAP_SYS_RAWIO))
 			return -EACCES;
-		return cosa_readmem(cosa, arg);
+		return cosa_readmem(cosa, argp);
 	case COSAIORTYPE:
-		return cosa_gettype(cosa, (char *)arg);
+		return cosa_gettype(cosa, argp);
 	case COSAIORIDSTR:
-		return cosa_getidstr(cosa, (char *)arg);
+		return cosa_getidstr(cosa, argp);
 	case COSAIONRCARDS:
 		return nr_cards;
 	case COSAIONRCHANS:
@@ -1434,7 +1435,7 @@ static int cosa_dma_able(struct channel_data *chan, char *buf, int len)
  * by a single space. Monitor has to reply with a space. Now the download
  * begins. After the download monitor replies with "\r\n." (CR LF dot).
  */
-static int download(struct cosa_data *cosa, const char *microcode, int length, int address)
+static int download(struct cosa_data *cosa, const char __user *microcode, int length, int address)
 {
 	int i;
 
@@ -1508,7 +1509,7 @@ static int startmicrocode(struct cosa_data *cosa, int address)
  * This routine is not needed during the normal operation and serves
  * for debugging purposes only.
  */
-static int readmem(struct cosa_data *cosa, char *microcode, int length, int address)
+static int readmem(struct cosa_data *cosa, char __user *microcode, int length, int address)
 {
 	if (put_wait_data(cosa, 'r') == -1) return -1;
 	if ((get_wait_data(cosa)) != 'r') return -2;

drivers/net/wan/cosa.h

@@ -66,7 +66,7 @@
 /* ioctls */
 struct cosa_download {
 	int addr, len;
-	char *code;
+	char __user *code;
 };
 
 /* Reset the device */

drivers/net/wan/dscc4.c

@@ -1296,7 +1296,7 @@ static int dscc4_set_clock(struct net_device *dev, u32 *bps, u32 *state)
 
 static int dscc4_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
-	sync_serial_settings *line = ifr->ifr_settings.ifs_ifsu.sync;
+	sync_serial_settings __user *line = ifr->ifr_settings.ifs_ifsu.sync;
 	struct dscc4_dev_priv *dpriv = dscc4_priv(dev);
 	const size_t size = sizeof(dpriv->settings);
 	int ret = 0;

drivers/net/wan/hdlc_cisco.c

@@ -272,7 +272,7 @@ static void cisco_stop(struct net_device *dev)
 
 int hdlc_cisco_ioctl(struct net_device *dev, struct ifreq *ifr)
 {
-	cisco_proto *cisco_s = ifr->ifr_settings.ifs_ifsu.cisco;
+	cisco_proto __user *cisco_s = ifr->ifr_settings.ifs_ifsu.cisco;
 	const size_t size = sizeof(cisco_proto);
 	cisco_proto new_settings;
 	hdlc_device *hdlc = dev_to_hdlc(dev);

drivers/net/wan/hdlc_fr.c

@@ -1137,7 +1137,7 @@ static void fr_destroy(hdlc_device *hdlc)
 
 int hdlc_fr_ioctl(struct net_device *dev, struct ifreq *ifr)
 {
-	fr_proto *fr_s = ifr->ifr_settings.ifs_ifsu.fr;
+	fr_proto __user *fr_s = ifr->ifr_settings.ifs_ifsu.fr;
 	const size_t size = sizeof(fr_proto);
 	fr_proto new_settings;
 	hdlc_device *hdlc = dev_to_hdlc(dev);

drivers/net/wan/hdlc_raw.c

@@ -34,7 +34,7 @@ static unsigned short raw_type_trans(struct sk_buff *skb,
 
 int hdlc_raw_ioctl(struct net_device *dev, struct ifreq *ifr)
 {
-	raw_hdlc_proto *raw_s = ifr->ifr_settings.ifs_ifsu.raw_hdlc;
+	raw_hdlc_proto __user *raw_s = ifr->ifr_settings.ifs_ifsu.raw_hdlc;
 	const size_t size = sizeof(raw_hdlc_proto);
 	raw_hdlc_proto new_settings;
 	hdlc_device *hdlc = dev_to_hdlc(dev);

drivers/net/wan/hdlc_raw_eth.c

@@ -46,7 +46,7 @@ static int eth_tx(struct sk_buff *skb, struct net_device *dev)
 
 int hdlc_raw_eth_ioctl(struct net_device *dev, struct ifreq *ifr)
 {
-	raw_hdlc_proto *raw_s = ifr->ifr_settings.ifs_ifsu.raw_hdlc;
+	raw_hdlc_proto __user *raw_s = ifr->ifr_settings.ifs_ifsu.raw_hdlc;
 	const size_t size = sizeof(raw_hdlc_proto);
 	raw_hdlc_proto new_settings;
 	hdlc_device *hdlc = dev_to_hdlc(dev);

drivers/net/wan/lmc/lmc_ioctl.h

@@ -234,7 +234,7 @@ typedef struct lmc_st1f_control {
   int command;
   int address;
   int value;
-  char *data;
+  char __user *data;
 } lmc_t1f_control;
 
 enum lmc_xilinx_c {
@@ -246,7 +246,7 @@ enum lmc_xilinx_c {
 struct lmc_xilinx_control {
     enum lmc_xilinx_c command;
     int len;
-    char *data;
+    char __user *data;
 };
 
 /* ------------------ end T1 defs ------------------- */

drivers/net/wan/n2.c

@@ -254,7 +254,8 @@ static int n2_close(struct net_device *dev)
 static int n2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
 	const size_t size = sizeof(sync_serial_settings);
-	sync_serial_settings new_line, *line = ifr->ifr_settings.ifs_ifsu.sync;
+	sync_serial_settings new_line;
+	sync_serial_settings __user *line = ifr->ifr_settings.ifs_ifsu.sync;
 	port_t *port = dev_to_port(dev);
 
 #ifdef DEBUG_RINGS

drivers/net/wan/pci200syn.c

@@ -204,7 +204,8 @@ static int pci200_close(struct net_device *dev)
 static int pci200_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
 	const size_t size = sizeof(sync_serial_settings);
-	sync_serial_settings new_line, *line = ifr->ifr_settings.ifs_ifsu.sync;
+	sync_serial_settings new_line;
+	sync_serial_settings __user *line = ifr->ifr_settings.ifs_ifsu.sync;
 	port_t *port = dev_to_port(dev);
 
 #ifdef DEBUG_RINGS

drivers/net/wan/x25_asy.c

@@ -733,7 +733,7 @@ static int x25_asy_ioctl(struct tty_struct *tty, struct file *file,
 
 	switch(cmd) {
 	case SIOCGIFNAME:
-		if (copy_to_user((void *)arg, sl->dev->name,
+		if (copy_to_user((void __user *)arg, sl->dev->name,
 					strlen(sl->dev->name) + 1))
 			return -EFAULT;
 		return 0;

fs/devfs/base.c

@@ -2490,7 +2490,8 @@ static int devfs_mknod(struct inode *dir, struct dentry *dentry, int mode,
 	return 0;
 }				/*  End Function devfs_mknod  */
 
-static int devfs_readlink(struct dentry *dentry, char *buffer, int buflen)
+static int devfs_readlink(struct dentry *dentry, char __user *buffer,
+			  int buflen)
 {
 	int err;
 	struct devfs_entry *de;

fs/ncpfs/ioctl.c

@@ -30,7 +30,7 @@
 #define NCP_PACKET_SIZE_INTERNAL 65536
 
 static int
-ncp_get_fs_info(struct ncp_server* server, struct inode* inode, struct ncp_fs_info* arg)
+ncp_get_fs_info(struct ncp_server* server, struct inode* inode, struct ncp_fs_info __user *arg)
 {
 	struct ncp_fs_info info;
 
@@ -58,7 +58,7 @@ ncp_get_fs_info(struct ncp_server* server, struct inode* inode, struct ncp_fs_in
 }
 
 static int
-ncp_get_fs_info_v2(struct ncp_server* server, struct inode* inode, struct ncp_fs_info_v2* arg)
+ncp_get_fs_info_v2(struct ncp_server* server, struct inode* inode, struct ncp_fs_info_v2 __user * arg)
 {
 	struct ncp_fs_info_v2 info2;
 
@@ -90,7 +90,7 @@ ncp_get_fs_info_v2(struct ncp_server* server, struct inode* inode, struct ncp_fs
  * Thanks Petr Vandrovec for idea and many hints.
  */
 static int
-ncp_set_charsets(struct ncp_server* server, struct ncp_nls_ioctl* arg)
+ncp_set_charsets(struct ncp_server* server, struct ncp_nls_ioctl __user *arg)
 {
 	struct ncp_nls_ioctl user;
 	struct nls_table *codepage;
@@ -148,7 +148,7 @@ ncp_set_charsets(struct ncp_server* server, struct ncp_nls_ioctl* arg)
 }
 
 static int
-ncp_get_charsets(struct ncp_server* server, struct ncp_nls_ioctl* arg)
+ncp_get_charsets(struct ncp_server* server, struct ncp_nls_ioctl __user *arg)
 {
 	struct ncp_nls_ioctl user;
 	int len;
@@ -185,6 +185,7 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 	int result;
 	struct ncp_ioctl_request request;
 	char* bouncebuffer;
+	void __user *argp = (void __user *)arg;
 
 	switch (cmd) {
 	case NCP_IOC_NCPREQUEST:
@@ -193,8 +194,7 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 		    && (current->uid != server->m.mounted_uid)) {
 			return -EACCES;
 		}
-		if (copy_from_user(&request, (struct ncp_ioctl_request *) arg,
-			       sizeof(request)))
+		if (copy_from_user(&request, argp, sizeof(request)))
 			return -EFAULT;
 
 		if ((request.function > 255)
@@ -245,10 +245,10 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 		return ncp_conn_logged_in(inode->i_sb);
 
 	case NCP_IOC_GET_FS_INFO:
-		return ncp_get_fs_info(server, inode, (struct ncp_fs_info *)arg);
+		return ncp_get_fs_info(server, inode, argp);
 
 	case NCP_IOC_GET_FS_INFO_V2:
-		return ncp_get_fs_info_v2(server, inode, (struct ncp_fs_info_v2 *)arg);
+		return ncp_get_fs_info_v2(server, inode, argp);
 
 	case NCP_IOC_GETMOUNTUID2:
 		{
@@ -259,7 +259,7 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 			{
 				return -EACCES;
 			}
-			if (put_user(tmp, (unsigned long*) arg)) 
+			if (put_user(tmp, (unsigned long __user *)argp)) 
 				return -EFAULT;
 			return 0;
 		}
@@ -292,9 +292,8 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 				sr.namespace = 0;
 				sr.dirEntNum = 0;
 			}
-			if (copy_to_user((struct ncp_setroot_ioctl*)arg, 
-				    	  &sr, 
-					  sizeof(sr))) return -EFAULT;
+			if (copy_to_user(argp, &sr, sizeof(sr)))
+				return -EFAULT;
 			return 0;
 		}
 	case NCP_IOC_SETROOT:
@@ -308,9 +307,8 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 				return -EACCES;
 			}
 			if (server->root_setuped) return -EBUSY;
-			if (copy_from_user(&sr,
-					   (struct ncp_setroot_ioctl*)arg, 
-					   sizeof(sr))) return -EFAULT;
+			if (copy_from_user(&sr, argp, sizeof(sr)))
+				return -EFAULT;
 			if (sr.volNumber < 0) {
 				server->m.mounted_vol[0] = 0;
 				vnum = NCP_NUMBER_OF_VOLUMES;
@@ -348,13 +346,13 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 		{
 			return -EACCES;
 		}
-		if (arg) {
+		if (argp) {
 			if (server->sign_wanted)
 			{
 				struct ncp_sign_init sign;
 
-				if (copy_from_user(&sign, (struct ncp_sign_init *) arg,
-				      sizeof(sign))) return -EFAULT;
+				if (copy_from_user(&sign, argp, sizeof(sign)))
+					return -EFAULT;
 				memcpy(server->sign_root,sign.sign_root,8);
 				memcpy(server->sign_last,sign.sign_last,16);
 				server->sign_active = 1;
@@ -372,7 +370,7 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 			return -EACCES;
 		}
 		
-                if (put_user(server->sign_wanted, (int*) arg))
+                if (put_user(server->sign_wanted, (int __user *)argp))
 			return -EFAULT;
                 return 0;
 	case NCP_IOC_SET_SIGN_WANTED:
@@ -385,7 +383,7 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 				return -EACCES;
 			}
 			/* get only low 8 bits... */
-			if (get_user(newstate, (unsigned char *) arg))
+			if (get_user(newstate, (unsigned char __user *)argp))
 				return -EFAULT;
 			if (server->sign_active) {
 				/* cannot turn signatures OFF when active */
@@ -409,8 +407,8 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 			struct ncp_lock_ioctl	 rqdata;
 			int result;
 
-			if (copy_from_user(&rqdata, (struct ncp_lock_ioctl*)arg,
-				sizeof(rqdata))) return -EFAULT;
+			if (copy_from_user(&rqdata, argp, sizeof(rqdata)))
+				return -EFAULT;
 			if (rqdata.origin != 0)
 				return -EINVAL;
 			/* check for cmd */
@@ -480,9 +478,8 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 			struct ncp_objectname_ioctl user;
 			size_t outl;
 
-			if (copy_from_user(&user, 
-					   (struct ncp_objectname_ioctl*)arg,
-					   sizeof(user))) return -EFAULT;
+			if (copy_from_user(&user, argp, sizeof(user)))
+				return -EFAULT;
 			user.auth_type = server->auth.auth_type;
 			outl = user.object_name_len;
 			user.object_name_len = server->auth.object_name_len;
@@ -493,9 +490,8 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 						 server->auth.object_name,
 						 outl)) return -EFAULT;
 			}
-			if (copy_to_user((struct ncp_objectname_ioctl*)arg,
-					 &user,
-					 sizeof(user))) return -EFAULT;
+			if (copy_to_user(argp, &user, sizeof(user)))
+				return -EFAULT;
 			return 0;
 		}
 	case NCP_IOC_SETOBJECTNAME:
@@ -510,9 +506,8 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 			void* oldprivate;
 			size_t oldprivatelen;
 
-			if (copy_from_user(&user, 
-					   (struct ncp_objectname_ioctl*)arg,
-					   sizeof(user))) return -EFAULT;
+			if (copy_from_user(&user, argp, sizeof(user)))
+				return -EFAULT;
 			if (user.object_name_len > NCP_OBJECT_NAME_MAX_LEN)
 				return -ENOMEM;
 			if (user.object_name_len) {
@@ -550,9 +545,8 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 			struct ncp_privatedata_ioctl user;
 			size_t outl;
 
-			if (copy_from_user(&user, 
-					   (struct ncp_privatedata_ioctl*)arg,
-					   sizeof(user))) return -EFAULT;
+			if (copy_from_user(&user, argp, sizeof(user)))
+				return -EFAULT;
 			outl = user.len;
 			user.len = server->priv.len;
 			if (outl > user.len) outl = user.len;
@@ -561,9 +555,8 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 						 server->priv.data,
 						 outl)) return -EFAULT;
 			}
-			if (copy_to_user((struct ncp_privatedata_ioctl*)arg,
-					 &user,
-					 sizeof(user))) return -EFAULT;
+			if (copy_to_user(argp, &user, sizeof(user)))
+				return -EFAULT;
 			return 0;
 		}
 	case NCP_IOC_SETPRIVATEDATA:
@@ -576,9 +569,8 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 			void* old;
 			size_t oldlen;
 
-			if (copy_from_user(&user, 
-					   (struct ncp_privatedata_ioctl*)arg,
-					   sizeof(user))) return -EFAULT;
+			if (copy_from_user(&user, argp, sizeof(user)))
+				return -EFAULT;
 			if (user.len > NCP_PRIVATE_DATA_MAX_LEN)
 				return -ENOMEM;
 			if (user.len) {
@@ -603,10 +595,10 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 
 #ifdef CONFIG_NCPFS_NLS
 	case NCP_IOC_SETCHARSETS:
-		return ncp_set_charsets(server, (struct ncp_nls_ioctl *)arg);
+		return ncp_set_charsets(server, argp);
 		
 	case NCP_IOC_GETCHARSETS:
-		return ncp_get_charsets(server, (struct ncp_nls_ioctl *)arg);
+		return ncp_get_charsets(server, argp);
 
 #endif /* CONFIG_NCPFS_NLS */
 
@@ -617,7 +609,7 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 		{
 			u_int32_t user;
 
-			if (copy_from_user(&user, (u_int32_t*)arg, sizeof(user)))
+			if (copy_from_user(&user, argp, sizeof(user)))
 				return -EFAULT;
 			/* 20 secs at most... */
 			if (user > 20000)
@@ -630,7 +622,7 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 	case NCP_IOC_GETDENTRYTTL:
 		{
 			u_int32_t user = (server->dentry_ttl * 1000) / HZ;
-			if (copy_to_user((u_int32_t*)arg, &user, sizeof(user)))
+			if (copy_to_user(argp, &user, sizeof(user)))
 				return -EFAULT;
 			return 0;
 		}
@@ -646,7 +638,7 @@ int ncp_ioctl(struct inode *inode, struct file *filp,
 			return -EACCES;
 		}
 		SET_UID(uid, server->m.mounted_uid);
-		if (put_user(uid, (__kernel_uid_t *) arg))
+		if (put_user(uid, (__kernel_uid_t __user *)argp))
 			return -EFAULT;
 		return 0;
 	}

fs/proc/base.c

@@ -1463,7 +1463,8 @@ static struct inode_operations proc_tid_attr_inode_operations = {
 /*
  * /proc/self:
  */
-static int proc_self_readlink(struct dentry *dentry, char *buffer, int buflen)
+static int proc_self_readlink(struct dentry *dentry, char __user *buffer,
+			      int buflen)
 {
 	char tmp[30];
 	sprintf(tmp, "%d", current->tgid);
@@ -1747,7 +1748,9 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
 		ino_t ino = fake_ino(tgid,PROC_TGID_INO);
 		unsigned long j = PROC_NUMBUF;
 
-		do buf[--j] = '0' + (tgid % 10); while (tgid/=10);
+		do
+			buf[--j] = '0' + (tgid % 10);
+		while ((tgid /= 10) != 0);
 
 		if (filldir(dirent, buf+j, PROC_NUMBUF-j, filp->f_pos, ino, DT_DIR) < 0) {
 			filp->f_version = tgid;
@@ -1799,7 +1802,7 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
 
 		do
 			buf[--j] = '0' + (tid % 10);
-		while (tid /= 10);
+		while ((tid /= 10) != 0);
 
 		if (filldir(dirent, buf+j, PROC_NUMBUF-j, pos, ino, DT_DIR) < 0)
 			break;

fs/quota.c

@@ -150,7 +150,7 @@ void sync_dquots(struct super_block *sb, int type)
 }
 
 /* Copy parameters and call proper function */
-static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id, caddr_t addr)
+static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id, void __user *addr)
 {
 	int ret;
 
@@ -264,7 +264,7 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id, cadd
  * calls. Maybe we need to add the process quotas etc. in the future,
  * but we probably should use rlimits for that.
  */
-asmlinkage long sys_quotactl(unsigned int cmd, const char __user *special, qid_t id, caddr_t addr)
+asmlinkage long sys_quotactl(unsigned int cmd, const char __user *special, qid_t id, void __user *addr)
 {
 	uint cmds, type;
 	struct super_block *sb = NULL;

include/linux/if.h

@@ -108,15 +108,15 @@ struct if_settings
 	unsigned int size;	/* Size of the data allocated by the caller */
 	union {
 		/* {atm/eth/dsl}_settings anyone ? */
-		raw_hdlc_proto		*raw_hdlc;
-		cisco_proto		*cisco;
-		fr_proto		*fr;
-		fr_proto_pvc		*fr_pvc;
-		fr_proto_pvc_info	*fr_pvc_info;
+		raw_hdlc_proto		__user *raw_hdlc;
+		cisco_proto		__user *cisco;
+		fr_proto		__user *fr;
+		fr_proto_pvc		__user *fr_pvc;
+		fr_proto_pvc_info	__user *fr_pvc_info;
 
 		/* interface settings */
-		sync_serial_settings	*sync;
-		te1_settings		*te1;
+		sync_serial_settings	__user *sync;
+		te1_settings		__user *te1;
 	} ifs_ifsu;
 };
 

include/linux/isdn_ppp.h

@@ -233,8 +233,9 @@ struct ippp_struct {
   struct slcompress *slcomp;
 #endif
 #ifdef CONFIG_IPPP_FILTER
-  struct sock_fprog pass_filter;	/* filter for packets to pass */
-  struct sock_fprog active_filter;	/* filter for pkts to reset idle */
+  struct sock_filter *pass_filter;	/* filter for packets to pass */
+  struct sock_filter *active_filter;	/* filter for pkts to reset idle */
+  unsigned pass_len, active_len;
 #endif
   unsigned long debug;
   struct isdn_ppp_compressor *compressor,*decompressor;

include/linux/ncp_fs.h

@@ -24,7 +24,7 @@
 struct ncp_ioctl_request {
 	unsigned int function;
 	unsigned int size;
-	char *data;
+	char __user *data;
 };
 
 struct ncp_fs_info {
@@ -88,13 +88,13 @@ struct ncp_objectname_ioctl
 #define NCP_AUTH_NDS	0x32
 	int		auth_type;
 	size_t		object_name_len;
-	void*		object_name;	/* an userspace data, in most cases user name */
+	void __user *	object_name;	/* an userspace data, in most cases user name */
 };
 
 struct ncp_privatedata_ioctl
 {
 	size_t		len;
-	void*		data;		/* ~1000 for NDS */
+	void __user *	data;		/* ~1000 for NDS */
 };
 
 /* NLS charsets by ioctl */

include/linux/syscalls.h

@@ -382,7 +382,7 @@ asmlinkage long sys_fchdir(unsigned int fd);
 asmlinkage long sys_rmdir(const char __user *pathname);
 asmlinkage long sys_lookup_dcookie(u64 cookie64, char __user *buf, size_t len);
 asmlinkage long sys_quotactl(unsigned int cmd, const char __user *special,
-				qid_t id, caddr_t addr);
+				qid_t id, void __user *addr);
 asmlinkage long sys_getdents(unsigned int fd,
 				struct linux_dirent __user *dirent,
 				unsigned int count);

lib/zlib_deflate/deflate.c

@@ -1262,7 +1262,7 @@ static block_state deflate_slow(
     return flush == Z_FINISH ? finish_done : block_done;
 }
 
-extern int zlib_deflate_workspacesize(void)
+int zlib_deflate_workspacesize(void)
 {
     return sizeof(deflate_workspace);
 }