From df37a3a3e51b4dec0cbb5c00af2c89006915338a Mon Sep 17 00:00:00 2001 From: Alexander Viro Date: Sat, 29 May 2004 04:42:48 -0700 Subject: [PATCH] [PATCH] sparse: compat_ioctl - easy part Easy parts of compat_ioctl fixes - pure __user annotation. In one place (SG_IO handling) replaced dereference of user pointer with put_user() (why whoever had noticed that just put a FIXME instead of obvios fix is a mistery...) --- fs/compat_ioctl.c | 248 +++++++++++++++++++++++----------------------- 1 file changed, 126 insertions(+), 122 deletions(-) diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c index 54e0a5004ff0f..3400bf05f248d 100644 --- a/fs/compat_ioctl.c +++ b/fs/compat_ioctl.c @@ -135,7 +135,7 @@ static int w_long(unsigned int fd, unsigned int cmd, unsigned long arg) set_fs (KERNEL_DS); err = sys_ioctl(fd, cmd, (unsigned long)&val); set_fs (old_fs); - if (!err && put_user(val, (u32 *)compat_ptr(arg))) + if (!err && put_user(val, (u32 __user *)compat_ptr(arg))) return -EFAULT; return err; } @@ -143,7 +143,7 @@ static int w_long(unsigned int fd, unsigned int cmd, unsigned long arg) static int rw_long(unsigned int fd, unsigned int cmd, unsigned long arg) { mm_segment_t old_fs = get_fs(); - u32 *argptr = compat_ptr(arg); + u32 __user *argptr = compat_ptr(arg); int err; unsigned long val; @@ -177,7 +177,7 @@ struct video_tuner32 { u16 mode, signal; }; -static int get_video_tuner32(struct video_tuner *kp, struct video_tuner32 *up) +static int get_video_tuner32(struct video_tuner *kp, struct video_tuner32 __user *up) { int i; @@ -193,7 +193,7 @@ static int get_video_tuner32(struct video_tuner *kp, struct video_tuner32 *up) return 0; } -static int put_video_tuner32(struct video_tuner *kp, struct video_tuner32 *up) +static int put_video_tuner32(struct video_tuner *kp, struct video_tuner32 __user *up) { int i; @@ -214,7 +214,7 @@ struct video_buffer32 { compat_int_t height, width, depth, bytesperline; }; -static int get_video_buffer32(struct video_buffer *kp, struct video_buffer32 *up) +static int get_video_buffer32(struct video_buffer *kp, struct video_buffer32 __user *up) { u32 tmp; @@ -228,7 +228,7 @@ static int get_video_buffer32(struct video_buffer *kp, struct video_buffer32 *up return 0; } -static int put_video_buffer32(struct video_buffer *kp, struct video_buffer32 *up) +static int put_video_buffer32(struct video_buffer *kp, struct video_buffer32 __user *up) { u32 tmp = (u32)((unsigned long)kp->base); @@ -261,9 +261,9 @@ static void free_kvideo_clips(struct video_window *kp) kfree(cp); } -static int get_video_window32(struct video_window *kp, struct video_window32 *up) +static int get_video_window32(struct video_window *kp, struct video_window32 __user *up) { - struct video_clip32 *ucp; + struct video_clip32 __user *ucp; struct video_clip *kcp; int nclips, err, i; u32 tmp; @@ -313,7 +313,7 @@ cleanup_and_err: } /* You get back everything except the clips... */ -static int put_video_window32(struct video_window *kp, struct video_window32 *up) +static int put_video_window32(struct video_window *kp, struct video_window32 __user *up) { if(put_user(kp->x, &up->x)) return -EFAULT; @@ -344,7 +344,7 @@ static int do_video_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) unsigned long vx; } karg; mm_segment_t old_fs = get_fs(); - void *up = compat_ptr(arg); + void __user *up = compat_ptr(arg); int err = 0; /* First, convert the command. */ @@ -374,7 +374,7 @@ static int do_video_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) break; case VIDIOCSFREQ: - err = get_user(karg.vx, (u32 *)up); + err = get_user(karg.vx, (u32 __user *)up); break; }; if(err) @@ -402,7 +402,7 @@ static int do_video_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) break; case VIDIOCGFREQ: - err = put_user(((u32)karg.vx), (u32 *)up); + err = put_user(((u32)karg.vx), (u32 __user *)up); break; }; } @@ -412,7 +412,7 @@ out: static int do_siocgstamp(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct compat_timeval *up = compat_ptr(arg); + struct compat_timeval __user *up = compat_ptr(arg); struct timeval ktv; mm_segment_t old_fs = get_fs(); int err; @@ -587,12 +587,12 @@ static int ethtool_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) static int bond_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) { struct ifreq kifr; - struct ifreq *uifr; - struct ifreq32 *ifr32 = compat_ptr(arg); + struct ifreq __user *uifr; + struct ifreq32 __user *ifr32 = compat_ptr(arg); mm_segment_t old_fs; int err; u32 data; - void *datap; + void __user *datap; switch (cmd) { case SIOCBONDENSLAVE: @@ -629,10 +629,10 @@ static int bond_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) int siocdevprivate_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct ifreq *u_ifreq64; - struct ifreq32 *u_ifreq32 = compat_ptr(arg); + struct ifreq __user *u_ifreq64; + struct ifreq32 __user *u_ifreq32 = compat_ptr(arg); char tmp_buf[IFNAMSIZ]; - void *data64; + void __user *data64; u32 data32; if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]), @@ -656,8 +656,8 @@ int siocdevprivate_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) static int dev_ifsioc(unsigned int fd, unsigned int cmd, unsigned long arg) { struct ifreq ifr; - struct ifreq32 *uifr32; - struct ifmap32 *uifmap32; + struct ifreq32 __user *uifr32; + struct ifmap32 __user *uifmap32; mm_segment_t old_fs; int err; @@ -761,7 +761,7 @@ static int routing_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) struct socket *mysock = sockfd_lookup(fd, &ret); if (mysock && mysock->sk && mysock->sk->sk_family == AF_INET6) { /* ipv6 */ - struct in6_rtmsg32 *ur6 = compat_ptr(arg); + struct in6_rtmsg32 __user *ur6 = compat_ptr(arg); ret = copy_from_user (&r6.rtmsg_dst, &(ur6->rtmsg_dst), 3 * sizeof(struct in6_addr)); ret |= __get_user (r6.rtmsg_type, &(ur6->rtmsg_type)); @@ -774,7 +774,7 @@ static int routing_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) r = (void *) &r6; } else { /* ipv4 */ - struct rtentry32 *ur4 = compat_ptr(arg); + struct rtentry32 __user *ur4 = compat_ptr(arg); ret = copy_from_user (&r4.rt_dst, &(ur4->rt_dst), 3 * sizeof(struct sockaddr)); ret |= __get_user (r4.rt_flags, &(ur4->rt_flags)); @@ -816,7 +816,7 @@ static int hdio_getgeo(unsigned int fd, unsigned int cmd, unsigned long arg) { mm_segment_t old_fs = get_fs(); struct hd_geometry geo; - struct hd_geometry32 *ugeo; + struct hd_geometry32 __user *ugeo; int err; set_fs (KERNEL_DS); @@ -899,7 +899,7 @@ static int fb_getput_cmap(unsigned int fd, unsigned int cmd, unsigned long arg) } static int do_fscreeninfo_to_user(struct fb_fix_screeninfo *fix, - struct fb_fix_screeninfo32 *fix32) + struct fb_fix_screeninfo32 __user *fix32) { __u32 data; int err; @@ -933,7 +933,7 @@ static int fb_get_fscreeninfo(unsigned int fd, unsigned int cmd, unsigned long a { mm_segment_t old_fs; struct fb_fix_screeninfo fix; - struct fb_fix_screeninfo32 *fix32; + struct fb_fix_screeninfo32 __user *fix32; int err; fix32 = compat_ptr(arg); @@ -982,7 +982,7 @@ static int hdio_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg { mm_segment_t old_fs = get_fs(); unsigned long kval; - unsigned int *uvp; + unsigned int __user *uvp; int error; set_fs(KERNEL_DS); @@ -1029,10 +1029,10 @@ typedef struct sg_iovec32 { compat_uint_t iov_len; } sg_iovec32_t; -static int sg_build_iovec(sg_io_hdr_t *sgio, void *dxferp, u16 iovec_count) +static int sg_build_iovec(sg_io_hdr_t __user *sgio, void __user *dxferp, u16 iovec_count) { - sg_iovec_t *iov = (sg_iovec_t *) (sgio + 1); - sg_iovec32_t *iov32 = dxferp; + sg_iovec_t __user *iov = (sg_iovec_t __user *) (sgio + 1); + sg_iovec32_t __user *iov32 = dxferp; int i; for (i = 0; i < iovec_count; i++) { @@ -1045,17 +1045,18 @@ static int sg_build_iovec(sg_io_hdr_t *sgio, void *dxferp, u16 iovec_count) return -EFAULT; } - sgio->dxferp = iov; /* FIXME: dereferencing user pointer? */ + if (put_user(iov, &sgio->dxferp)) + return -EFAULT; return 0; } static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) { - sg_io_hdr_t *sgio; - sg_io_hdr32_t *sgio32; + sg_io_hdr_t __user *sgio; + sg_io_hdr32_t __user *sgio32; u16 iovec_count; u32 data; - void *dxferp; + void __user *dxferp; int err; sgio32 = compat_ptr(arg); @@ -1063,12 +1064,9 @@ static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) return -EFAULT; { - void *new, *top; - - top = compat_alloc_user_space(0); - new = compat_alloc_user_space(sizeof(sg_io_hdr_t) + - (iovec_count * - sizeof(sg_iovec_t))); + void __user *top = compat_alloc_user_space(0); + void __user *new = compat_alloc_user_space(sizeof(sg_io_hdr_t) + + (iovec_count * sizeof(sg_iovec_t))); if (new > top) return -EINVAL; @@ -1095,7 +1093,8 @@ static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) } { - unsigned char *cmdp, *sbp; + unsigned char __user *cmdp; + unsigned char __user *sbp; if (get_user(data, &sgio32->cmdp)) return -EFAULT; @@ -1128,7 +1127,7 @@ static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) err = sys_ioctl(fd, cmd, (unsigned long) sgio); if (err >= 0) { - void *datap; + void __user *datap; if (copy_in_user(&sgio32->pack_id, &sgio->pack_id, sizeof(int)) || @@ -1155,9 +1154,9 @@ struct sock_fprog32 { static int ppp_sock_fprog_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct sock_fprog32 *u_fprog32 = compat_ptr(arg); - struct sock_fprog *u_fprog64 = compat_alloc_user_space(sizeof(struct sock_fprog)); - void *fptr64; + struct sock_fprog32 __user *u_fprog32 = compat_ptr(arg); + struct sock_fprog __user *u_fprog64 = compat_alloc_user_space(sizeof(struct sock_fprog)); + void __user *fptr64; u32 fptr32; u16 flen; @@ -1194,8 +1193,8 @@ struct ppp_idle32 { static int ppp_gidle(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct ppp_idle *idle; - struct ppp_idle32 *idle32; + struct ppp_idle __user *idle; + struct ppp_idle32 __user *idle32; __kernel_time_t xmit, recv; int err; @@ -1216,10 +1215,10 @@ static int ppp_gidle(unsigned int fd, unsigned int cmd, unsigned long arg) static int ppp_scompress(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct ppp_option_data *odata; - struct ppp_option_data32 *odata32; + struct ppp_option_data __user *odata; + struct ppp_option_data32 __user *odata32; __u32 data; - void *datap; + void __user *datap; odata = compat_alloc_user_space(sizeof(*odata)); odata32 = compat_ptr(arg); @@ -1311,11 +1310,11 @@ static int mt_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) { mm_segment_t old_fs = get_fs(); struct mtconfiginfo info; - struct mtconfiginfo32 *uinfo32; + struct mtconfiginfo32 __user *uinfo32; struct mtget get; - struct mtget32 *umget32; + struct mtget32 __user *umget32; struct mtpos pos; - struct mtpos32 *upos32; + struct mtpos32 __user *upos32; unsigned long kcmd; void *karg; int err = 0; @@ -1345,7 +1344,7 @@ static int mt_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) err |= __get_user(info.debug, &uinfo32->debug); err |= __copy_from_user((char *)&info.debug + sizeof(info.debug), - (char *)&uinfo32->debug + (char __user *)&uinfo32->debug + sizeof(uinfo32->debug), sizeof(__u32)); if (err) return -EFAULT; @@ -1388,7 +1387,7 @@ static int mt_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) err |= __put_user(info.dmanr, &uinfo32->dmanr); err |= __put_user(info.port, &uinfo32->port); err |= __put_user(info.debug, &uinfo32->debug); - err |= __copy_to_user((char *)&uinfo32->debug + err |= __copy_to_user((char __user *)&uinfo32->debug + sizeof(uinfo32->debug), (char *)&info.debug + sizeof(info.debug), sizeof(__u32)); break; @@ -1419,10 +1418,10 @@ struct cdrom_generic_command32 { static int cdrom_do_read_audio(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct cdrom_read_audio *cdread_audio; - struct cdrom_read_audio32 *cdread_audio32; + struct cdrom_read_audio __user *cdread_audio; + struct cdrom_read_audio32 __user *cdread_audio32; __u32 data; - void *datap; + void __user *datap; cdread_audio = compat_alloc_user_space(sizeof(*cdread_audio)); cdread_audio32 = compat_ptr(arg); @@ -1538,7 +1537,7 @@ static int loop_status(unsigned int fd, unsigned int cmd, unsigned long arg) { mm_segment_t old_fs = get_fs(); struct loop_info l; - struct loop_info32 *ul; + struct loop_info32 __user *ul; int err = -EINVAL; ul = compat_ptr(arg); @@ -1677,13 +1676,13 @@ struct console_font_op32 { static int do_kdfontop_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg, struct file *file) { struct console_font_op op; - struct console_font_op32 *fontop = compat_ptr(arg); + struct console_font_op32 __user *fontop = compat_ptr(arg); int perm = vt_check(file), i; struct vt_struct *vt; if (perm < 0) return perm; - if (copy_from_user(&op, (void *) fontop, sizeof(struct console_font_op32))) + if (copy_from_user(&op, fontop, sizeof(struct console_font_op32))) return -EFAULT; if (!perm && op.op != KD_FONT_OP_GET) return -EPERM; @@ -1693,7 +1692,7 @@ static int do_kdfontop_ioctl(unsigned int fd, unsigned int cmd, unsigned long ar i = con_font_op(vt->vc_num, &op); if (i) return i; ((struct console_font_op32 *)&op)->data = (unsigned long)op.data; - if (copy_to_user((void *) fontop, &op, sizeof(struct console_font_op32))) + if (copy_to_user(fontop, &op, sizeof(struct console_font_op32))) return -EFAULT; return 0; } @@ -1706,7 +1705,7 @@ struct unimapdesc32 { static int do_unimap_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg, struct file *file) { struct unimapdesc32 tmp; - struct unimapdesc32 *user_ud = compat_ptr(arg); + struct unimapdesc32 __user *user_ud = compat_ptr(arg); int perm = vt_check(file); if (perm < 0) return perm; @@ -1737,7 +1736,7 @@ static int do_smb_getmountuid(unsigned int fd, unsigned int cmd, unsigned long a set_fs(old_fs); if (err >= 0) - err = put_user(kuid, (compat_uid_t *)compat_ptr(arg)); + err = put_user(kuid, (compat_uid_t __user *)compat_ptr(arg)); return err; } @@ -1799,10 +1798,10 @@ static struct { static int do_atm_iobuf(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct atm_iobuf *iobuf; - struct atm_iobuf32 *iobuf32; + struct atm_iobuf __user *iobuf; + struct atm_iobuf32 __user *iobuf32; u32 data; - void *datap; + void __user *datap; int len, err; iobuf = compat_alloc_user_space(sizeof(*iobuf)); @@ -1829,10 +1828,10 @@ static int do_atm_iobuf(unsigned int fd, unsigned int cmd, unsigned long arg) static int do_atmif_sioc(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct atmif_sioc *sioc; - struct atmif_sioc32 *sioc32; + struct atmif_sioc __user *sioc; + struct atmif_sioc32 __user *sioc32; u32 data; - void *datap; + void __user *datap; int err; sioc = compat_alloc_user_space(sizeof(*sioc)); @@ -2128,7 +2127,7 @@ static int fd_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) case FDGETPRM32: { compat_uptr_t name; - struct floppy_struct32 *uf; + struct floppy_struct32 __user *uf; struct floppy_struct *f; uf = compat_ptr(arg); @@ -2157,7 +2156,7 @@ static int fd_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) case FDSETDRVPRM32: case FDGETDRVPRM32: { - struct floppy_drive_params32 *uf; + struct floppy_drive_params32 __user *uf; struct floppy_drive_params *f; uf = compat_ptr(arg); @@ -2219,22 +2218,23 @@ static int fd_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) case FDGETPRM32: { struct floppy_struct *f = karg; + struct floppy_struct32 __user *uf = compat_ptr(arg); - err = __put_user(f->size, &((struct floppy_struct32 *)arg)->size); - err |= __put_user(f->sect, &((struct floppy_struct32 *)arg)->sect); - err |= __put_user(f->head, &((struct floppy_struct32 *)arg)->head); - err |= __put_user(f->track, &((struct floppy_struct32 *)arg)->track); - err |= __put_user(f->stretch, &((struct floppy_struct32 *)arg)->stretch); - err |= __put_user(f->gap, &((struct floppy_struct32 *)arg)->gap); - err |= __put_user(f->rate, &((struct floppy_struct32 *)arg)->rate); - err |= __put_user(f->spec1, &((struct floppy_struct32 *)arg)->spec1); - err |= __put_user(f->fmt_gap, &((struct floppy_struct32 *)arg)->fmt_gap); - err |= __put_user((u64)f->name, (compat_caddr_t*)&((struct floppy_struct32 *)arg)->name); + err = __put_user(f->size, &uf->size); + err |= __put_user(f->sect, &uf->sect); + err |= __put_user(f->head, &uf->head); + err |= __put_user(f->track, &uf->track); + err |= __put_user(f->stretch, &uf->stretch); + err |= __put_user(f->gap, &uf->gap); + err |= __put_user(f->rate, &uf->rate); + err |= __put_user(f->spec1, &uf->spec1); + err |= __put_user(f->fmt_gap, &uf->fmt_gap); + err |= __put_user((u64)f->name, (compat_caddr_t __user *)&uf->name); break; } case FDGETDRVPRM32: { - struct floppy_drive_params32 *uf; + struct floppy_drive_params32 __user *uf; struct floppy_drive_params *f = karg; uf = compat_ptr(arg); @@ -2262,7 +2262,7 @@ static int fd_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) case FDGETDRVSTAT32: case FDPOLLDRVSTAT32: { - struct floppy_drive_struct32 *uf; + struct floppy_drive_struct32 __user *uf; struct floppy_drive_struct *f = karg; uf = compat_ptr(arg); @@ -2285,7 +2285,7 @@ static int fd_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) } case FDGETFDCSTAT32: { - struct floppy_fdc_state32 *uf; + struct floppy_fdc_state32 __user *uf; struct floppy_fdc_state *f = karg; uf = compat_ptr(arg); @@ -2295,7 +2295,7 @@ static int fd_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) err |= __put_user(f->version, &uf->version); err |= __put_user(f->dor, &uf->dor); err |= __put_user(f->address, &uf->address); - err |= __copy_to_user((char *)&uf->address + sizeof(uf->address), + err |= __copy_to_user((char __user *)&uf->address + sizeof(uf->address), (char *)&f->address + sizeof(f->address), sizeof(int)); err |= __put_user(f->driver_version, &uf->driver_version); err |= __copy_to_user(uf->track, f->track, sizeof(f->track)); @@ -2303,7 +2303,7 @@ static int fd_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg) } case FDWERRORGET32: { - struct floppy_write_errors32 *uf; + struct floppy_write_errors32 __user *uf; struct floppy_write_errors *f = karg; uf = compat_ptr(arg); @@ -2336,10 +2336,10 @@ struct mtd_oob_buf32 { static int mtd_rw_oob(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct mtd_oob_buf *buf = compat_alloc_user_space(sizeof(*buf)); - struct mtd_oob_buf32 *buf32 = compat_ptr(arg); + struct mtd_oob_buf __user *buf = compat_alloc_user_space(sizeof(*buf)); + struct mtd_oob_buf32 __user *buf32 = compat_ptr(arg); u32 data; - char *datap; + char __user *datap; unsigned int real_cmd; int err; @@ -2369,7 +2369,7 @@ static int mtd_rw_oob(unsigned int fd, unsigned int cmd, unsigned long arg) #define VFAT_IOCTL_READDIR_SHORT32 _IOR('r', 2, struct compat_dirent[2]) static long -put_dirent32 (struct dirent *d, struct compat_dirent *d32) +put_dirent32 (struct dirent *d, struct compat_dirent __user *d32) { int ret; @@ -2386,6 +2386,7 @@ put_dirent32 (struct dirent *d, struct compat_dirent *d32) static int vfat_ioctl32(unsigned fd, unsigned cmd, unsigned long arg) { + struct compat_dirent __user *p = compat_ptr(arg); int ret; mm_segment_t oldfs = get_fs(); struct dirent d[2]; @@ -2404,8 +2405,8 @@ static int vfat_ioctl32(unsigned fd, unsigned cmd, unsigned long arg) ret = sys_ioctl(fd,cmd,(unsigned long)&d); set_fs(oldfs); if (ret >= 0) { - ret |= put_dirent32(&d[0], (struct compat_dirent *)compat_ptr(arg)); - ret |= put_dirent32(&d[1], ((struct compat_dirent *)compat_ptr(arg)) + 1); + ret |= put_dirent32(&d[0], p); + ret |= put_dirent32(&d[1], p + 1); } return ret; } @@ -2521,7 +2522,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd, unsigned long arg) { typedef struct serial_struct SS; typedef struct serial_struct32 SS32; - struct serial_struct32 *ss32 = compat_ptr(arg); + struct serial_struct32 __user *ss32 = compat_ptr(arg); int err; struct serial_struct ss; mm_segment_t oldseg = get_fs(); @@ -2569,10 +2570,11 @@ struct usbdevfs_ctrltransfer32 { static int do_usbdevfs_control(unsigned int fd, unsigned int cmd, unsigned long arg) { struct usbdevfs_ctrltransfer kctrl; - struct usbdevfs_ctrltransfer32 *uctrl; + struct usbdevfs_ctrltransfer32 __user *uctrl; mm_segment_t old_fs; __u32 udata; - void *uptr, *kptr; + void __user *uptr; + void *kptr; int err; uctrl = compat_ptr(arg); @@ -2630,10 +2632,11 @@ struct usbdevfs_bulktransfer32 { static int do_usbdevfs_bulk(unsigned int fd, unsigned int cmd, unsigned long arg) { struct usbdevfs_bulktransfer kbulk; - struct usbdevfs_bulktransfer32 *ubulk; + struct usbdevfs_bulktransfer32 __user *ubulk; mm_segment_t old_fs; __u32 udata; - void *uptr, *kptr; + void __user *uptr; + void *kptr; int err; ubulk = compat_ptr(arg); @@ -2896,7 +2899,7 @@ static int do_usbdevfs_reapurb(unsigned int fd, unsigned int cmd, unsigned long set_fs(old_fs); if (err >= 0 && - put_user((u32)(u64)kptr, (u32 *)compat_ptr(arg))) + put_user((u32)(u64)kptr, (u32 __user *)compat_ptr(arg))) err = -EFAULT; return err; @@ -2912,7 +2915,7 @@ struct usbdevfs_disconnectsignal32 { static int do_usbdevfs_discsignal(unsigned int fd, unsigned int cmd, unsigned long arg) { struct usbdevfs_disconnectsignal kdis; - struct usbdevfs_disconnectsignal32 *udis; + struct usbdevfs_disconnectsignal32 __user *udis; mm_segment_t old_fs; u32 uctx; int err; @@ -2958,10 +2961,10 @@ struct i2c_smbus_ioctl_data32 { static int do_i2c_rdwr_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct i2c_rdwr_ioctl_data *tdata; - struct i2c_rdwr_ioctl_data32 *udata; - struct i2c_msg *tmsgs; - struct i2c_msg32 *umsgs; + struct i2c_rdwr_ioctl_data __user *tdata; + struct i2c_rdwr_ioctl_data32 __user *udata; + struct i2c_msg __user *tmsgs; + struct i2c_msg32 __user *umsgs; compat_caddr_t datap; int nmsgs, i; @@ -2971,7 +2974,7 @@ static int do_i2c_rdwr_ioctl(unsigned int fd, unsigned int cmd, unsigned long ar if (verify_area(VERIFY_WRITE, tdata, sizeof(*tdata))) return -EFAULT; - udata = (struct i2c_rdwr_ioctl_data32 *)compat_ptr(arg); + udata = compat_ptr(arg); if (verify_area(VERIFY_READ, udata, sizeof(*udata))) return -EFAULT; if (__get_user(nmsgs, &udata->nmsgs) || __put_user(nmsgs, &tdata->nmsgs)) @@ -2980,7 +2983,7 @@ static int do_i2c_rdwr_ioctl(unsigned int fd, unsigned int cmd, unsigned long ar return -EINVAL; if (__get_user(datap, &udata->msgs)) return -EFAULT; - umsgs = (struct i2c_msg32 *)compat_ptr(datap); + umsgs = compat_ptr(datap); if (verify_area(VERIFY_READ, umsgs, sizeof(struct i2c_msg) * nmsgs)) return -EFAULT; @@ -3005,8 +3008,8 @@ static int do_i2c_rdwr_ioctl(unsigned int fd, unsigned int cmd, unsigned long ar static int do_i2c_smbus_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct i2c_smbus_ioctl_data *tdata; - struct i2c_smbus_ioctl_data32 *udata; + struct i2c_smbus_ioctl_data __user *tdata; + struct i2c_smbus_ioctl_data32 __user *udata; compat_caddr_t datap; tdata = compat_alloc_user_space(sizeof(*tdata)); @@ -3015,7 +3018,7 @@ static int do_i2c_smbus_ioctl(unsigned int fd, unsigned int cmd, unsigned long a if (verify_area(VERIFY_WRITE, tdata, sizeof(*tdata))) return -EFAULT; - udata = (struct i2c_smbus_ioctl_data32 *)compat_ptr(arg); + udata = compat_ptr(arg); if (verify_area(VERIFY_READ, udata, sizeof(*udata))) return -EFAULT; @@ -3038,14 +3041,15 @@ struct compat_iw_point { static int do_wireless_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct iwreq *iwr, *iwr_u; - struct iw_point *iwp; - struct compat_iw_point *iwp_u; + struct iwreq __user *iwr; + struct iwreq __user *iwr_u; + struct iw_point __user *iwp; + struct compat_iw_point __user *iwp_u; compat_caddr_t pointer; __u16 length, flags; - iwr_u = (struct iwreq *) compat_ptr(arg); - iwp_u = (struct compat_iw_point *) &iwr_u->u.data; + iwr_u = compat_ptr(arg); + iwp_u = (struct compat_iw_point __user *) &iwr_u->u.data; iwr = compat_alloc_user_space(sizeof(*iwr)); if (iwr == NULL) return -ENOMEM; @@ -3081,7 +3085,7 @@ static int old_bridge_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg { u32 tmp; - if (get_user(tmp, (u32 *) arg)) + if (get_user(tmp, (u32 __user *) arg)) return -EFAULT; if (tmp == BRCTL_GET_VERSION) return BRCTL_VERSION + 1; @@ -3133,7 +3137,7 @@ struct ncp_privatedata_ioctl_32 static int do_ncp_ncprequest(unsigned int fd, unsigned int cmd, unsigned long arg) { struct ncp_ioctl_request_32 n32; - struct ncp_ioctl_request *p = compat_alloc_user_space(sizeof(*p)); + struct ncp_ioctl_request __user *p = compat_alloc_user_space(sizeof(*p)); if (copy_from_user(&n32, compat_ptr(arg), sizeof(n32)) || put_user(n32.function, &p->function) || @@ -3196,8 +3200,8 @@ static int do_ncp_getfsinfo2(unsigned int fd, unsigned int cmd, unsigned long ar static int do_ncp_getobjectname(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct ncp_objectname_ioctl_32 n32, *p32 = compat_ptr(arg); - struct ncp_objectname_ioctl *p = compat_alloc_user_space(sizeof(*p)); + struct ncp_objectname_ioctl_32 n32, __user *p32 = compat_ptr(arg); + struct ncp_objectname_ioctl __user *p = compat_alloc_user_space(sizeof(*p)); s32 auth_type; u32 name_len; int err; @@ -3222,8 +3226,8 @@ static int do_ncp_getobjectname(unsigned int fd, unsigned int cmd, unsigned long static int do_ncp_setobjectname(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct ncp_objectname_ioctl_32 n32, *p32 = compat_ptr(arg); - struct ncp_objectname_ioctl *p = compat_alloc_user_space(sizeof(*p)); + struct ncp_objectname_ioctl_32 n32, __user *p32 = compat_ptr(arg); + struct ncp_objectname_ioctl __user *p = compat_alloc_user_space(sizeof(*p)); if (copy_from_user(&n32, p32, sizeof(n32)) || put_user(n32.auth_type, &p->auth_type) || @@ -3236,8 +3240,8 @@ static int do_ncp_setobjectname(unsigned int fd, unsigned int cmd, unsigned long static int do_ncp_getprivatedata(unsigned int fd, unsigned int cmd, unsigned long arg) { - struct ncp_privatedata_ioctl_32 n32, *p32 = compat_ptr(arg); - struct ncp_privatedata_ioctl *p = compat_alloc_user_space(sizeof(*p)); + struct ncp_privatedata_ioctl_32 n32, __user *p32 = compat_ptr(arg); + struct ncp_privatedata_ioctl *p = __user compat_alloc_user_space(sizeof(*p)); u32 len; int err; -- 2.53.0