[PATCH] sparse: ISDN ->readstat() and ->writecmd() annotation

	->readstat() and ->writecmd() are always getting a userland pointer;
marked argument as such, killed "user" flag, killed dead code.

drivers/isdn/act2000/module.c

@@ -463,18 +463,15 @@ act2000_sendbuf(act2000_card *card, int channel, int ack, struct sk_buff *skb)
 
 /* Read the Status-replies from the Interface */
 static int
-act2000_readstatus(u_char * buf, int len, int user, act2000_card * card)
+act2000_readstatus(u_char __user * buf, int len, act2000_card * card)
 {
         int count;
-        u_char *p;
+        u_char __user *p;
 
         for (p = buf, count = 0; count < len; p++, count++) {
                 if (card->status_buf_read == card->status_buf_write)
                         return count;
-                if (user)
-                        put_user(*card->status_buf_read++, p);
-                else
-                        *p = *card->status_buf_read++;
+		put_user(*card->status_buf_read++, p);
                 if (card->status_buf_read > card->status_buf_end)
                         card->status_buf_read = card->status_buf;
         }
@@ -514,7 +511,7 @@ if_command(isdn_ctrl * c)
 }
 
 static int
-if_writecmd(const u_char * buf, int len, int user, int id, int channel)
+if_writecmd(const u_char __user *buf, int len, int id, int channel)
 {
         act2000_card *card = act2000_findcard(id);
 
@@ -529,14 +526,14 @@ if_writecmd(const u_char * buf, int len, int user, int id, int channel)
 }
 
 static int
-if_readstatus(u_char * buf, int len, int user, int id, int channel)
+if_readstatus(u_char __user * buf, int len, int id, int channel)
 {
         act2000_card *card = act2000_findcard(id);
 	
         if (card) {
                 if (!card->flags & ACT2000_FLAGS_RUNNING)
                         return -ENODEV;
-                return (act2000_readstatus(buf, len, user, card));
+                return (act2000_readstatus(buf, len, card));
         }
         printk(KERN_ERR
                "act2000: if_readstatus called with invalid driverId!\n");

drivers/isdn/capi/capidrv.c

@@ -1892,11 +1892,11 @@ static int if_sendbuf(int id, int channel, int doack, struct sk_buff *skb)
 	}
 }
 
-static int if_readstat(u8 *buf, int len, int user, int id, int channel)
+static int if_readstat(u8 __user *buf, int len, int id, int channel)
 {
 	capidrv_contr *card = findcontrbydriverid(id);
 	int count;
-	u8 *p;
+	u8 __user *p;
 
 	if (!card) {
 		printk(KERN_ERR "capidrv: if_readstat called with invalid driverId %d!\n",
@@ -1905,10 +1905,7 @@ static int if_readstat(u8 *buf, int len, int user, int id, int channel)
 	}
 
 	for (p=buf, count=0; count < len; p++, count++) {
-	        if (user)
-	                put_user(*card->q931_read++, p);
-	        else
-	                *p = *card->q931_read++;
+		put_user(*card->q931_read++, p);
 	        if (card->q931_read > card->q931_end)
 	                card->q931_read = card->q931_buf;
 	}

drivers/isdn/hisax/config.c

@@ -618,10 +618,10 @@ struct IsdnCardState *hisax_get_card(int cardnr)
 	return NULL;
 }
 
-int HiSax_readstatus(u_char * buf, int len, int user, int id, int channel)
+int HiSax_readstatus(u_char __user *buf, int len, int id, int channel)
 {
 	int count, cnt;
-	u_char *p = buf;
+	u_char __user *p = buf;
 	struct IsdnCardState *cs = hisax_findcard(id);
 
 	if (cs) {
@@ -633,10 +633,7 @@ int HiSax_readstatus(u_char * buf, int len, int user, int id, int channel)
 		count = cs->status_end - cs->status_read + 1;
 		if (count >= len)
 			count = len;
-		if (user)
-			copy_to_user(p, cs->status_read, count);
-		else
-			memcpy(p, cs->status_read, count);
+		copy_to_user(p, cs->status_read, count);
 		cs->status_read += count;
 		if (cs->status_read > cs->status_end)
 			cs->status_read = cs->status_buf;
@@ -647,10 +644,7 @@ int HiSax_readstatus(u_char * buf, int len, int user, int id, int channel)
 				cnt = HISAX_STATUS_BUFSIZE;
 			else
 				cnt = count;
-			if (user)
-				copy_to_user(p, cs->status_read, cnt);
-			else
-				memcpy(p, cs->status_read, cnt);
+			copy_to_user(p, cs->status_read, cnt);
 			p += cnt;
 			cs->status_read += cnt % HISAX_STATUS_BUFSIZE;
 			count -= cnt;

drivers/isdn/i4l/isdn_common.c

@@ -1018,7 +1018,7 @@ isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off)
 			if (count > dev->drv[drvidx]->stavail)
 				count = dev->drv[drvidx]->stavail;
 			len = dev->drv[drvidx]->interface->
-				readstat(buf, count, 1, drvidx,
+				readstat(buf, count, drvidx,
 					 isdn_minor2chan(minor));
 		} else {
 			len = 0;
@@ -1091,7 +1091,7 @@ isdn_write(struct file *file, const char __user *buf, size_t count, loff_t * off
 		 */
 		if (dev->drv[drvidx]->interface->writecmd)
 			retval = dev->drv[drvidx]->interface->
-				writecmd(buf, count, 1, drvidx, isdn_minor2chan(minor));
+				writecmd(buf, count, drvidx, isdn_minor2chan(minor));
 		else
 			retval = count;
 		goto out;

drivers/isdn/icn/icn.c

@@ -1007,18 +1007,15 @@ icn_loadproto(u_char * buffer, icn_card * card)
 
 /* Read the Status-replies from the Interface */
 static int
-icn_readstatus(u_char * buf, int len, int user, icn_card * card)
+icn_readstatus(u_char __user *buf, int len, icn_card * card)
 {
 	int count;
-	u_char *p;
+	u_char __user *p;
 
 	for (p = buf, count = 0; count < len; p++, count++) {
 		if (card->msg_buf_read == card->msg_buf_write)
 			return count;
-		if (user)
-			put_user(*card->msg_buf_read++, p);
-		else
-			*p = *card->msg_buf_read++;
+		put_user(*card->msg_buf_read++, p);
 		if (card->msg_buf_read > card->msg_buf_end)
 			card->msg_buf_read = card->msg_buf;
 	}
@@ -1470,14 +1467,14 @@ if_command(isdn_ctrl * c)
 }
 
 static int
-if_writecmd(const u_char * buf, int len, int user, int id, int channel)
+if_writecmd(const u_char __user *buf, int len, int id, int channel)
 {
 	icn_card *card = icn_findcard(id);
 
 	if (card) {
 		if (!card->flags & ICN_FLAGS_RUNNING)
 			return -ENODEV;
-		return (icn_writecmd(buf, len, user, card));
+		return (icn_writecmd(buf, len, 1, card));
 	}
 	printk(KERN_ERR
 	       "icn: if_writecmd called with invalid driverId!\n");
@@ -1485,14 +1482,14 @@ if_writecmd(const u_char * buf, int len, int user, int id, int channel)
 }
 
 static int
-if_readstatus(u_char * buf, int len, int user, int id, int channel)
+if_readstatus(u_char __user *buf, int len, int id, int channel)
 {
 	icn_card *card = icn_findcard(id);
 
 	if (card) {
 		if (!card->flags & ICN_FLAGS_RUNNING)
 			return -ENODEV;
-		return (icn_readstatus(buf, len, user, card));
+		return (icn_readstatus(buf, len, card));
 	}
 	printk(KERN_ERR
 	       "icn: if_readstatus called with invalid driverId!\n");

drivers/isdn/isdnloop/isdnloop.c

@@ -443,18 +443,15 @@ isdnloop_sendbuf(int channel, struct sk_buff *skb, isdnloop_card * card)
  *   number of bytes actually transferred.
  */
 static int
-isdnloop_readstatus(u_char * buf, int len, int user, isdnloop_card * card)
+isdnloop_readstatus(u_char __user *buf, int len, isdnloop_card * card)
 {
 	int count;
-	u_char *p;
+	u_char __user *p;
 
 	for (p = buf, count = 0; count < len; p++, count++) {
 		if (card->msg_buf_read == card->msg_buf_write)
 			return count;
-		if (user)
-			put_user(*card->msg_buf_read++, p);
-		else
-			*p = *card->msg_buf_read++;
+		put_user(*card->msg_buf_read++, p);
 		if (card->msg_buf_read > card->msg_buf_end)
 			card->msg_buf_read = card->msg_buf;
 	}
@@ -1388,14 +1385,14 @@ if_command(isdn_ctrl * c)
 }
 
 static int
-if_writecmd(const u_char * buf, int len, int user, int id, int channel)
+if_writecmd(const u_char __user *buf, int len, int id, int channel)
 {
 	isdnloop_card *card = isdnloop_findcard(id);
 
 	if (card) {
 		if (!card->flags & ISDNLOOP_FLAGS_RUNNING)
 			return -ENODEV;
-		return (isdnloop_writecmd(buf, len, user, card));
+		return (isdnloop_writecmd(buf, len, 1, card));
 	}
 	printk(KERN_ERR
 	       "isdnloop: if_writecmd called with invalid driverId!\n");
@@ -1403,14 +1400,14 @@ if_writecmd(const u_char * buf, int len, int user, int id, int channel)
 }
 
 static int
-if_readstatus(u_char * buf, int len, int user, int id, int channel)
+if_readstatus(u_char __user *buf, int len, int id, int channel)
 {
 	isdnloop_card *card = isdnloop_findcard(id);
 
 	if (card) {
 		if (!card->flags & ISDNLOOP_FLAGS_RUNNING)
 			return -ENODEV;
-		return (isdnloop_readstatus(buf, len, user, card));
+		return (isdnloop_readstatus(buf, len, card));
 	}
 	printk(KERN_ERR
 	       "isdnloop: if_readstatus called with invalid driverId!\n");

drivers/isdn/pcbit/drv.c

@@ -57,9 +57,9 @@ static char* pcbit_devname[MAX_PCBIT_CARDS] = {
  */
 
 int pcbit_command(isdn_ctrl* ctl);
-int pcbit_stat(u_char* buf, int len, int user, int, int);
+int pcbit_stat(u_char __user * buf, int len, int, int);
 int pcbit_xmit(int driver, int chan, int ack, struct sk_buff *skb);
-int pcbit_writecmd(const u_char*, int, int, int, int);
+int pcbit_writecmd(const u_char __user *, int, int, int);
 
 static int set_protocol_running(struct pcbit_dev * dev);
 
@@ -389,12 +389,13 @@ int pcbit_xmit(int driver, int chnum, int ack, struct sk_buff *skb)
 	return len;
 }
 
-int pcbit_writecmd(const u_char* buf, int len, int user, int driver, int channel)
+int pcbit_writecmd(const u_char __user *buf, int len, int driver, int channel)
 {
 	struct pcbit_dev * dev;
 	int i, j;
 	const u_char * loadbuf;
 	u_char * ptr = NULL;
+	u_char *cbuf;
 
 	int errstat;
 
@@ -415,37 +416,28 @@ int pcbit_writecmd(const u_char* buf, int len, int user, int driver, int channel
 			return -EINVAL;
 		}
 
-		if (user)
-		{
-			u_char *cbuf = kmalloc(len, GFP_KERNEL);
-			if (!cbuf)
-				return -ENOMEM;
+		cbuf = kmalloc(len, GFP_KERNEL);
+		if (!cbuf)
+			return -ENOMEM;
 
-			if (copy_from_user(cbuf, buf, len)) {
-				kfree(cbuf);
-				return -EFAULT;
-			}
-			memcpy_toio(dev->sh_mem, cbuf, len);
+		if (copy_from_user(cbuf, buf, len)) {
 			kfree(cbuf);
+			return -EFAULT;
 		}
-		else
-			memcpy_toio(dev->sh_mem, buf, len);
+		memcpy_toio(dev->sh_mem, cbuf, len);
+		kfree(cbuf);
 		return len;
 	case L2_FWMODE:
 		/* this is the hard part */
 		/* dumb board */
-		if (user) {		
-			/* get it into kernel space */
-			if ((ptr = kmalloc(len, GFP_KERNEL))==NULL)
-				return -ENOMEM;
-			if (copy_from_user(ptr, buf, len)) {
-				kfree(ptr);
-				return -EFAULT;
-			}
-			loadbuf = ptr;
+		/* get it into kernel space */
+		if ((ptr = kmalloc(len, GFP_KERNEL))==NULL)
+			return -ENOMEM;
+		if (copy_from_user(ptr, buf, len)) {
+			kfree(ptr);
+			return -EFAULT;
 		}
-		else
-			loadbuf = buf;
+		loadbuf = ptr;
     
 		errstat = 0;
 
@@ -468,9 +460,7 @@ int pcbit_writecmd(const u_char* buf, int len, int user, int driver, int channel
 			if (dev->loadptr > LOAD_ZONE_END)
 				dev->loadptr = LOAD_ZONE_START;
 		}
-
-		if (user)
-			kfree(ptr);
+		kfree(ptr);
 
 		return errstat ? errstat : len;
 	default:
@@ -723,17 +713,7 @@ static char statbuf[STATBUF_LEN];
 static int stat_st = 0;
 static int stat_end = 0;
 
-
-static __inline void
-memcpy_to_COND(int flag, char *d, const char *s, int len) {
-	if (flag)
-		copy_to_user(d, s, len);
-	else
-		memcpy(d, s, len);
-}
-
-
-int pcbit_stat(u_char* buf, int len, int user, int driver, int channel)
+int pcbit_stat(u_char __user *buf, int len, int driver, int channel)
 {
 	int stat_count;
 	stat_count = stat_end - stat_st;
@@ -747,24 +727,23 @@ int pcbit_stat(u_char* buf, int len, int user, int driver, int channel)
 
 	if (stat_st < stat_end)
 	{
-		memcpy_to_COND(user, buf, statbuf + stat_st, len);
+		copy_to_user(buf, statbuf + stat_st, len);
 		stat_st += len;	   
 	}
 	else
 	{
 		if (len > STATBUF_LEN - stat_st)
 		{
-			memcpy_to_COND(user, buf, statbuf + stat_st, 
+			copy_to_user(buf, statbuf + stat_st, 
 				       STATBUF_LEN - stat_st);
-			memcpy_to_COND(user, buf, statbuf, 
+			copy_to_user(buf, statbuf, 
 				       len - (STATBUF_LEN - stat_st));
 
 			stat_st = len - (STATBUF_LEN - stat_st);
 		}
 		else
 		{
-			memcpy_to_COND(user, buf, statbuf + stat_st, 
-				       len);
+			copy_to_user(buf, statbuf + stat_st, len);
 
 			stat_st += len;
 			

include/linux/isdnif.h

@@ -502,26 +502,18 @@ typedef struct {
    * Parameters:
    *             u_char pointer data
    *             int    length of data
-   *             int    Flag: 0 = Call form Kernel-Space (use memcpy,
-   *                              no schedule allowed) 
-   *                          1 = Data is in User-Space (use memcpy_fromfs,
-   *                              may schedule)
    *             int    driverId
    *             int    local channel-number (0 ...)
    */
-  int (*writecmd)(const u_char*, int, int, int, int);
+  int (*writecmd)(const u_char __user *, int, int, int);
 
   /* Read raw Status replies
    *             u_char pointer data (volatile)
    *             int    length of buffer
-   *             int    Flag: 0 = Call form Kernel-Space (use memcpy,
-   *                              no schedule allowed) 
-   *                          1 = Data is in User-Space (use memcpy_fromfs,
-   *                              may schedule)
    *             int    driverId
    *             int    local channel-number (0 ...)
    */
-  int (*readstat)(u_char*, int, int, int, int);
+  int (*readstat)(u_char __user *, int, int, int);
 
   char id[20];
 } isdn_if;