[PATCH] sparse: misc ->read()/->write() __user annotation

a bunch of trivial ->read() and ->write() instances (and their procfs
relatives) __user-annotated.  All chunks are independent, but IMO not
worth splitting.

diff --git a/arch/alpha/kernel/irq.c b/arch/alpha/kernel/irq.c
index c51bf8dbfc8a83da193d5dbf0ff3b0144a3ddd8e..9e8eab6dcc0ac046e21fe07fd60f048e3d7d3136 100644 (file)
--- a/arch/alpha/kernel/irq.c
+++ b/arch/alpha/kernel/irq.c
@@ -260,7 +260,7 @@ irq_affinity_read_proc (char *page, char **start, off_t off,
 }
 
 static unsigned int
-parse_hex_value (const char *buffer,
+parse_hex_value (const char __user *buffer,
                 unsigned long count, unsigned long *ret)
 {
        unsigned char hexnum [HEX_DIGITS];
@@ -298,7 +298,7 @@ out:
 }
 
 static int
-irq_affinity_write_proc(struct file *file, const char *buffer,
+irq_affinity_write_proc(struct file *file, const char __user *buffer,
                        unsigned long count, void *data)
 {
        int irq = (long) data, full_count = count, err;
@@ -341,7 +341,7 @@ prof_cpu_mask_read_proc(char *page, char **start, off_t off,
 }
 
 static int
-prof_cpu_mask_write_proc(struct file *file, const char *buffer,
+prof_cpu_mask_write_proc(struct file *file, const char __user *buffer,
                         unsigned long count, void *data)
 {
        unsigned long *mask = (unsigned long *) data, full_count = count, err;

diff --git a/arch/alpha/kernel/srm_env.c b/arch/alpha/kernel/srm_env.c
index 08241c44123a523839593f84e74c40a5545f6788..e98b02c273b308b27f41dd7d72ad4aa8cc2aec51 100644 (file)
--- a/arch/alpha/kernel/srm_env.c
+++ b/arch/alpha/kernel/srm_env.c
@@ -132,7 +132,7 @@ srm_env_read(char *page, char **start, off_t off, int count, int *eof,
 
 
 static int
-srm_env_write(struct file *file, const char *buffer, unsigned long count,
+srm_env_write(struct file *file, const char __user *buffer, unsigned long count,
                void *data)
 {
        int res;

diff --git a/arch/i386/kernel/cpuid.c b/arch/i386/kernel/cpuid.c
index b393adea236a514116acb3d6b5212ba1d35d7f4a..5a997a3716fc317476148fbe462efbdac5aba6a2 100644 (file)
--- a/arch/i386/kernel/cpuid.c
+++ b/arch/i386/kernel/cpuid.c
@@ -107,10 +107,10 @@ static loff_t cpuid_seek(struct file *file, loff_t offset, int orig)
        return ret;
 }
 
-static ssize_t cpuid_read(struct file *file, char *buf,
+static ssize_t cpuid_read(struct file *file, char __user *buf,
                          size_t count, loff_t * ppos)
 {
-       u32 *tmp = (u32 *) buf;
+       char __user *tmp = buf;
        u32 data[4];
        size_t rv;
        u32 reg = *ppos;
@@ -123,11 +123,11 @@ static ssize_t cpuid_read(struct file *file, char *buf,
                do_cpuid(cpu, reg, data);
                if (copy_to_user(tmp, &data, 16))
                        return -EFAULT;
-               tmp += 4;
+               tmp += 16;
                *ppos = reg++;
        }
 
-       return ((char *)tmp) - buf;
+       return tmp - buf;
 }
 
 static int cpuid_open(struct inode *inode, struct file *file)

diff --git a/arch/x86_64/kernel/irq.c b/arch/x86_64/kernel/irq.c
index 732a6f4d32f969b9dd343cf2debadab4728f38a3..bfdb95e8bf950bf897bcfe3ba212f3421bb0532f 100644 (file)
--- a/arch/x86_64/kernel/irq.c
+++ b/arch/x86_64/kernel/irq.c
@@ -833,7 +833,8 @@ static int irq_affinity_read_proc (char *page, char **start, off_t off,
        return len;
 }
 
-static int irq_affinity_write_proc (struct file *file, const char *buffer,
+static int irq_affinity_write_proc (struct file *file,
+                                       const char __user *buffer,
                                        unsigned long count, void *data)
 {
        int irq = (long) data, full_count = count, err;
@@ -871,7 +872,8 @@ static int prof_cpu_mask_read_proc (char *page, char **start, off_t off,
        return len;
 }
 
-static int prof_cpu_mask_write_proc (struct file *file, const char *buffer,
+static int prof_cpu_mask_write_proc (struct file *file,
+                                       const char __user *buffer,
                                        unsigned long count, void *data)
 {
        unsigned long full_count = count, err;

diff --git a/arch/x86_64/kernel/mce.c b/arch/x86_64/kernel/mce.c
index 922d62fcf7821a42bf6f5b654017fe10cf396011..d5447683cdbbb5bfc69d3deb7548a28976e41e7c 100644 (file)
--- a/arch/x86_64/kernel/mce.c
+++ b/arch/x86_64/kernel/mce.c
@@ -297,12 +297,12 @@ static void collect_tscs(void *data)
        rdtscll(cpu_tsc[smp_processor_id()]);
 } 
 
-static ssize_t mce_read(struct file *filp, char *ubuf, size_t usize, loff_t *off)
+static ssize_t mce_read(struct file *filp, char __user *ubuf, size_t usize, loff_t *off)
 {
        unsigned long cpu_tsc[NR_CPUS];
        static DECLARE_MUTEX(mce_read_sem);
        unsigned next;
-       char *buf = ubuf;
+       char __user *buf = ubuf;
        int i, err;
 
        down(&mce_read_sem); 
@@ -348,19 +348,20 @@ static ssize_t mce_read(struct file *filp, char *ubuf, size_t usize, loff_t *off
 
 static int mce_ioctl(struct inode *i, struct file *f,unsigned int cmd, unsigned long arg)
 {
+       int __user *p = (int __user *)arg;
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM; 
        switch (cmd) {
        case MCE_GET_RECORD_LEN: 
-               return put_user(sizeof(struct mce), (int *)arg);
+               return put_user(sizeof(struct mce), p);
        case MCE_GET_LOG_LEN:
-               return put_user(MCE_LOG_LEN, (int *)arg);               
+               return put_user(MCE_LOG_LEN, p);                
        case MCE_GETCLEAR_FLAGS: {
                unsigned flags;
                do { 
                        flags = mcelog.flags;
                } while (cmpxchg(&mcelog.flags, flags, 0) != flags); 
-               return put_user(flags, (int *)arg); 
+               return put_user(flags, p); 
        }
        default:
                return -ENOTTY; 

diff --git a/arch/x86_64/kernel/msr.c b/arch/x86_64/kernel/msr.c
index d2e6fff1b8bf65daaefb6aed4606af43230e3171..a0be6f84ca00f19ed50ba4b69c13995775331021 100644 (file)
--- a/arch/x86_64/kernel/msr.c
+++ b/arch/x86_64/kernel/msr.c
@@ -186,10 +186,10 @@ static loff_t msr_seek(struct file *file, loff_t offset, int orig)
   return ret;
 }
 
-static ssize_t msr_read(struct file * file, char * buf,
+static ssize_t msr_read(struct file * file, char __user * buf,
                        size_t count, loff_t *ppos)
 {
-  u32 *tmp = (u32 *)buf;
+  char __user *tmp = buf;
   u32 data[2];
   size_t rv;
   u32 reg = *ppos;
@@ -205,16 +205,16 @@ static ssize_t msr_read(struct file * file, char * buf,
       return err;
     if ( copy_to_user(tmp,&data,8) )
       return -EFAULT;
-    tmp += 2;
+    tmp += 8;
   }
 
-  return ((char *)tmp) - buf;
+  return tmp - buf;
 }
 
-static ssize_t msr_write(struct file * file, const char * buf,
+static ssize_t msr_write(struct file * file, const char __user * buf,
                         size_t count, loff_t *ppos)
 {
-  const u32 *tmp = (const u32 *)buf;
+  const char __user *tmp = buf;
   u32 data[2];
   size_t rv;
   u32 reg = *ppos;
@@ -230,10 +230,10 @@ static ssize_t msr_write(struct file * file, const char * buf,
     err = do_wrmsr(cpu, reg, data[0], data[1]);
     if ( err )
       return err;
-    tmp += 2;
+    tmp += 8;
   }
 
-  return ((char *)tmp) - buf;
+  return tmp - buf;
 }
 
 static int msr_open(struct inode *inode, struct file *file)

diff --git a/drivers/usb/host/uhci-debug.c b/drivers/usb/host/uhci-debug.c
index c2e63e29b75a43c36933a1040d4f24d69c057671..86e4c3a11e06527155f608ce10650441094d1944 100644 (file)
--- a/drivers/usb/host/uhci-debug.c
+++ b/drivers/usb/host/uhci-debug.c
@@ -567,8 +567,8 @@ static loff_t uhci_proc_lseek(struct file *file, loff_t off, int whence)
        return (file->f_pos = new);
 }
 
-static ssize_t uhci_proc_read(struct file *file, char *buf, size_t nbytes,
-                       loff_t *ppos)
+static ssize_t uhci_proc_read(struct file *file, char __user *buf,
+                               size_t nbytes, loff_t *ppos)
 {
        struct uhci_proc *up = file->private_data;
        unsigned int pos;
@@ -578,14 +578,9 @@ static ssize_t uhci_proc_read(struct file *file, char *buf, size_t nbytes,
        size = up->size;
        if (pos >= size)
                return 0;
-       if (nbytes >= size)
-               nbytes = size;
-       if (pos + nbytes > size)
+       if (nbytes > size - pos)
                nbytes = size - pos;
 
-       if (!access_ok(VERIFY_WRITE, buf, nbytes))
-               return -EINVAL;
-
        if (copy_to_user(buf, up->data + pos, nbytes))
                return -EFAULT;