[PATCH] sparse: net/bridge annotation

net/bridge partially annotated.

There are nasty problems with net/bridge/netfilter/* and they'll need to
be dealt with at some point - it mixes kernel and userland pointers a
lot and while it seems to avoid obvious breakage, it's not a nice code.

diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
index 6af157c9763ce726b1eed49989e83343792827e7..58d6e606d27d7b778c8448a5623105fdef6aaef8 100644 (file)
--- a/include/linux/if_bridge.h
+++ b/include/linux/if_bridge.h
@@ -104,7 +104,7 @@ struct __fdb_entry
 
 #include <linux/netdevice.h>
 
-extern void brioctl_set(int (*ioctl_hook)(unsigned int, unsigned long));
+extern void brioctl_set(int (*ioctl_hook)(unsigned int, void __user *));
 extern int (*br_handle_frame_hook)(struct sk_buff *skb);
 extern int (*br_should_route_hook)(struct sk_buff **pskb);
 

diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index 17c7ee3b3aa6dc07e01cccce1d4c14c8ead71a99..cceb01866634f67633083e2b89d050bac9bbe113 100644 (file)
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -143,7 +143,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                b.gc_timer_value = br_timer_value(&br->gc_timer);
                rcu_read_unlock();
 
-               if (copy_to_user((void *)args[1], &b, sizeof(b)))
+               if (copy_to_user((void __user *)args[1], &b, sizeof(b)))
                        return -EFAULT;
 
                return 0;
@@ -168,7 +168,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                memset(indices, 0, num*sizeof(int));
 
                get_port_ifindices(br, indices, num);
-               if (copy_to_user((void *)args[1], indices, num*sizeof(int)))
+               if (copy_to_user((void __user *)args[1], indices, num*sizeof(int)))
                        num =  -EFAULT;
                kfree(indices);
                return num;
@@ -241,7 +241,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 
                rcu_read_unlock();
 
-               if (copy_to_user((void *)args[1], &p, sizeof(p)))
+               if (copy_to_user((void __user *)args[1], &p, sizeof(p)))
                        return -EFAULT;
 
                return 0;
@@ -308,11 +308,11 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
        return -EOPNOTSUPP;
 }
 
-static int old_deviceless(unsigned long uarg)
+static int old_deviceless(void __user *uarg)
 {
        unsigned long args[3];
 
-       if (copy_from_user(args, (void *)uarg, sizeof(args)))
+       if (copy_from_user(args, uarg, sizeof(args)))
                return -EFAULT;
 
        switch (args[0]) {
@@ -331,7 +331,7 @@ static int old_deviceless(unsigned long uarg)
                memset(indices, 0, args[2]*sizeof(int));
                args[2] = get_bridge_ifindices(indices, args[2]);
 
-               ret = copy_to_user((void *)args[1], indices, args[2]*sizeof(int))
+               ret = copy_to_user((void __user *)args[1], indices, args[2]*sizeof(int))
                        ? -EFAULT : args[2];
 
                kfree(indices);
@@ -346,7 +346,7 @@ static int old_deviceless(unsigned long uarg)
                if (!capable(CAP_NET_ADMIN))
                        return -EPERM;
 
-               if (copy_from_user(buf, (void *)args[1], IFNAMSIZ))
+               if (copy_from_user(buf, (void __user *)args[1], IFNAMSIZ))
                        return -EFAULT;
 
                buf[IFNAMSIZ-1] = 0;
@@ -361,7 +361,7 @@ static int old_deviceless(unsigned long uarg)
        return -EOPNOTSUPP;
 }
 
-int br_ioctl_deviceless_stub(unsigned int cmd, unsigned long uarg)
+int br_ioctl_deviceless_stub(unsigned int cmd, void __user *uarg)
 {
        switch (cmd) {
        case SIOCGIFBR:
@@ -376,7 +376,7 @@ int br_ioctl_deviceless_stub(unsigned int cmd, unsigned long uarg)
                if (!capable(CAP_NET_ADMIN))
                        return -EPERM;
 
-               if (copy_from_user(buf, (void __user *) uarg, IFNAMSIZ))
+               if (copy_from_user(buf, uarg, IFNAMSIZ))
                        return -EFAULT;
 
                buf[IFNAMSIZ-1] = 0;

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 9651cdfa87cfd4cc1d0f968f2243465a33bc8baf..1dec9809545613ec94f1572318dc424d06c99edf 100644 (file)
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -800,7 +800,7 @@ static struct nf_hook_ops br_nf_ops[] = {
 #ifdef CONFIG_SYSCTL
 static
 int brnf_sysctl_call_tables(ctl_table *ctl, int write, struct file * filp,
-                       void *buffer, size_t *lenp)
+                       void __user *buffer, size_t *lenp)
 {
        int ret;
 

diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 048e76179ea1eb1725b5defac4919a28b4228b30..d3cd7151706c94ea7e4c3177b1d1b2873dcdac98 100644 (file)
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -175,7 +175,7 @@ extern int br_handle_frame(struct sk_buff *skb);
 
 /* br_ioctl.c */
 extern int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-extern int br_ioctl_deviceless_stub(unsigned int cmd, unsigned long arg);
+extern int br_ioctl_deviceless_stub(unsigned int cmd, void __user *arg);
 
 /* br_netfilter.c */
 extern int br_netfilter_init(void);

diff --git a/net/socket.c b/net/socket.c
index caa5b746a646dda3eaee304a6f9a15b4e17d7ccf..a293bf13e095079e642392a3bb9a8cd1490ff7a3 100644 (file)
--- a/net/socket.c
+++ b/net/socket.c
@@ -729,9 +729,9 @@ static ssize_t sock_writev(struct file *file, const struct iovec *vector,
  */
 
 static DECLARE_MUTEX(br_ioctl_mutex);
-static int (*br_ioctl_hook)(unsigned int cmd, unsigned long arg) = NULL;
+static int (*br_ioctl_hook)(unsigned int cmd, void __user *arg) = NULL;
 
-void brioctl_set(int (*hook)(unsigned int, unsigned long))
+void brioctl_set(int (*hook)(unsigned int, void __user *))
 {
        down(&br_ioctl_mutex);
        br_ioctl_hook = hook;
@@ -770,6 +770,7 @@ static int sock_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                      unsigned long arg)
 {
        struct socket *sock;
+       void __user *argp = (void __user *)arg;
        int pid, err;
 
        unlock_kernel();
@@ -804,7 +805,7 @@ static int sock_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 
                        down(&br_ioctl_mutex);
                        if (br_ioctl_hook) 
-                               err = br_ioctl_hook(cmd, arg);
+                               err = br_ioctl_hook(cmd, argp);
                        up(&br_ioctl_mutex);
                        break;
                case SIOCGIFVLAN: