[PATCH] sparse: amd64 annotations - trivial part

Annotation of amd64 code - just adding __user where needed...

arch/x86_64/ia32/fpu32.c

@@ -72,15 +72,15 @@ static inline unsigned long twd_fxsr_to_i387(struct i387_fxsave_struct *fxsave)
 
 
 static inline int convert_fxsr_from_user(struct i387_fxsave_struct *fxsave,
-					 struct _fpstate_ia32 *buf)
+					 struct _fpstate_ia32 __user *buf)
 {
 	struct _fpxreg *to;
-	struct _fpreg *from;
+	struct _fpreg __user *from;
 	int i;
 	u32 v;
 	int err = 0;
 
-#define G(num,val) err |= __get_user(val, num + (u32 *)buf)
+#define G(num,val) err |= __get_user(val, num + (u32 __user *)buf)
 	G(0, fxsave->cwd);
 	G(1, fxsave->swd);
 	G(2, fxsave->twd);
@@ -104,12 +104,12 @@ static inline int convert_fxsr_from_user(struct i387_fxsave_struct *fxsave,
 }
 
 
-static inline int convert_fxsr_to_user(struct _fpstate_ia32 *buf,
+static inline int convert_fxsr_to_user(struct _fpstate_ia32 __user *buf,
 				       struct i387_fxsave_struct *fxsave,
 				       struct pt_regs *regs,
 				       struct task_struct *tsk)
 {
-	struct _fpreg *to;
+	struct _fpreg __user *to;
 	struct _fpxreg *from;
 	int i;
 	u16 cs,ds; 
@@ -125,7 +125,7 @@ static inline int convert_fxsr_to_user(struct _fpstate_ia32 *buf,
 		cs = regs->cs;
 	} 
 
-#define P(num,val) err |= __put_user(val, num + (u32 *)buf)
+#define P(num,val) err |= __put_user(val, num + (u32 __user *)buf)
 	P(0, (u32)fxsave->cwd | 0xffff0000);
 	P(1, (u32)fxsave->swd | 0xffff0000);
 	P(2, twd_fxsr_to_i387(fxsave));
@@ -147,7 +147,7 @@ static inline int convert_fxsr_to_user(struct _fpstate_ia32 *buf,
 	return 0;
 }
 
-int restore_i387_ia32(struct task_struct *tsk, struct _fpstate_ia32 *buf, int fsave) 
+int restore_i387_ia32(struct task_struct *tsk, struct _fpstate_ia32 __user *buf, int fsave) 
 { 
 	clear_fpu(tsk);
 	if (!fsave) { 
@@ -162,7 +162,7 @@ int restore_i387_ia32(struct task_struct *tsk, struct _fpstate_ia32 *buf, int fs
 }  
 
 int save_i387_ia32(struct task_struct *tsk, 
-		   struct _fpstate_ia32 *buf, 
+		   struct _fpstate_ia32 __user *buf, 
 		   struct pt_regs *regs,
 		   int fsave)
 {

arch/x86_64/ia32/ia32_ioctl.c

@@ -21,7 +21,7 @@
 #ifndef TIOCGDEV
 #define TIOCGDEV       _IOR('T',0x32, unsigned int)
 #endif
-static int tiocgdev(unsigned fd, unsigned cmd,  unsigned int *ptr) 
+static int tiocgdev(unsigned fd, unsigned cmd,  unsigned int __user *ptr) 
 { 
 
 	struct file *file = fget(fd);
@@ -54,7 +54,7 @@ static int rtc32_ioctl(unsigned fd, unsigned cmd, unsigned long arg)
 		ret = sys_ioctl(fd, RTC_IRQP_READ, (unsigned long)&val); 
 		set_fs(oldfs); 
 		if (!ret)
-			ret = put_user(val, (unsigned int*) arg); 
+			ret = put_user(val, (unsigned int __user *) arg); 
 		return ret; 
 
 	case RTC_IRQP_SET32: 
@@ -66,7 +66,7 @@ static int rtc32_ioctl(unsigned fd, unsigned cmd, unsigned long arg)
 		ret = sys_ioctl(fd, RTC_EPOCH_READ, (unsigned long) &val); 
 		set_fs(oldfs); 
 		if (!ret)
-			ret = put_user(val, (unsigned int*) arg); 
+			ret = put_user(val, (unsigned int __user *) arg); 
 		return ret; 
 
 	case RTC_EPOCH_SET32:
@@ -113,7 +113,7 @@ static int mtrr_ioctl32(unsigned int fd, unsigned int cmd, unsigned long arg)
 	struct mtrr_gentry g;
 	struct mtrr_sentry s;
 	int get = 0, err = 0; 
-	struct mtrr_gentry32 *g32 = (struct mtrr_gentry32 *)arg; 
+	struct mtrr_gentry32 __user *g32 = (struct mtrr_gentry32 __user *)arg; 
 	mm_segment_t oldfs = get_fs(); 
 
 	switch (cmd) { 
@@ -139,7 +139,7 @@ static int mtrr_ioctl32(unsigned int fd, unsigned int cmd, unsigned long arg)
 
 		arg = (unsigned long)&g; 
 	} else { 
-		struct mtrr_sentry32 *s32 = (struct mtrr_sentry32 *)arg;
+		struct mtrr_sentry32 __user *s32 = (struct mtrr_sentry32 __user *)arg;
 		err = get_user(s.base, &s32->base);
 		err |= get_user(s.size, &s32->size);
 		err |= get_user(s.type, &s32->type);

arch/x86_64/ia32/ia32_signal.c

@@ -42,7 +42,7 @@
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 
 asmlinkage int do_signal(struct pt_regs *regs, sigset_t *oldset);
-void signal_fault(struct pt_regs *regs, void *frame, char *where);
+void signal_fault(struct pt_regs *regs, void __user *frame, char *where);
 
 int ia32_copy_siginfo_to_user(siginfo_t32 __user *to, siginfo_t *from)
 {
@@ -136,8 +136,9 @@ sys32_sigsuspend(int history0, int history1, old_sigset_t mask, struct pt_regs r
 }
 
 asmlinkage long
-sys32_sigaltstack(const stack_ia32_t *uss_ptr, stack_ia32_t *uoss_ptr, 
-				  struct pt_regs regs)
+sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
+		  stack_ia32_t __user *uoss_ptr, 
+		  struct pt_regs regs)
 {
 	stack_t uss,uoss; 
 	int ret;
@@ -193,7 +194,7 @@ struct rt_sigframe
 };
 
 static int
-ia32_restore_sigcontext(struct pt_regs *regs, struct sigcontext_ia32 *sc, unsigned int *peax)
+ia32_restore_sigcontext(struct pt_regs *regs, struct sigcontext_ia32 __user *sc, unsigned int *peax)
 {
 	unsigned int err = 0;
 	
@@ -252,9 +253,9 @@ ia32_restore_sigcontext(struct pt_regs *regs, struct sigcontext_ia32 *sc, unsign
 
 	{
 		u32 tmp;
-		struct _fpstate_ia32 * buf;
+		struct _fpstate_ia32 __user * buf;
 		err |= __get_user(tmp, &sc->fpstate);
-		buf = (struct _fpstate_ia32 *) (u64)tmp;
+		buf = compat_ptr(tmp);
 		if (buf) {
 			if (verify_area(VERIFY_READ, buf, sizeof(*buf)))
 				goto badframe;
@@ -275,7 +276,7 @@ ia32_restore_sigcontext(struct pt_regs *regs, struct sigcontext_ia32 *sc, unsign
 
 asmlinkage long sys32_sigreturn(struct pt_regs regs)
 {
-	struct sigframe *frame = (struct sigframe *)(regs.rsp - 8);
+	struct sigframe __user *frame = (struct sigframe __user *)(regs.rsp-8);
 	sigset_t set;
 	unsigned int eax;
 
@@ -304,7 +305,7 @@ asmlinkage long sys32_sigreturn(struct pt_regs regs)
 
 asmlinkage long sys32_rt_sigreturn(struct pt_regs regs)
 {
-	struct rt_sigframe *frame = (struct rt_sigframe *)(regs.rsp - 4);
+	struct rt_sigframe __user *frame = (struct rt_sigframe __user *)(regs.rsp - 4);
 	sigset_t set;
 	unsigned int eax;
 
@@ -322,8 +323,8 @@ asmlinkage long sys32_rt_sigreturn(struct pt_regs regs)
 	if (ia32_restore_sigcontext(&regs, &frame->uc.uc_mcontext, &eax))
 		goto badframe;
 
- 	if (sys32_sigaltstack(&frame->uc.uc_stack, NULL, regs) == -EFAULT)
-  		goto badframe;
+	if (sys32_sigaltstack(&frame->uc.uc_stack, NULL, regs) == -EFAULT)
+		goto badframe;
 
 	return eax;
 
@@ -337,20 +338,20 @@ asmlinkage long sys32_rt_sigreturn(struct pt_regs regs)
  */
 
 static int
-ia32_setup_sigcontext(struct sigcontext_ia32 *sc, struct _fpstate_ia32 *fpstate,
+ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc, struct _fpstate_ia32 __user *fpstate,
 		 struct pt_regs *regs, unsigned int mask)
 {
 	int tmp, err = 0;
 
 	tmp = 0;
 	__asm__("movl %%gs,%0" : "=r"(tmp): "0"(tmp));
-	err |= __put_user(tmp, (unsigned int *)&sc->gs);
+	err |= __put_user(tmp, (unsigned int __user *)&sc->gs);
 	__asm__("movl %%fs,%0" : "=r"(tmp): "0"(tmp));
-	err |= __put_user(tmp, (unsigned int *)&sc->fs);
+	err |= __put_user(tmp, (unsigned int __user *)&sc->fs);
 	__asm__("movl %%ds,%0" : "=r"(tmp): "0"(tmp));
-	err |= __put_user(tmp, (unsigned int *)&sc->ds);
+	err |= __put_user(tmp, (unsigned int __user *)&sc->ds);
 	__asm__("movl %%es,%0" : "=r"(tmp): "0"(tmp));
-	err |= __put_user(tmp, (unsigned int *)&sc->es);
+	err |= __put_user(tmp, (unsigned int __user *)&sc->es);
 
 	err |= __put_user((u32)regs->rdi, &sc->edi);
 	err |= __put_user((u32)regs->rsi, &sc->esi);
@@ -387,7 +388,7 @@ ia32_setup_sigcontext(struct sigcontext_ia32 *sc, struct _fpstate_ia32 *fpstate,
 /*
  * Determine which stack to use..
  */
-static void *
+static void __user *
 get_sigframe(struct k_sigaction *ka, struct pt_regs * regs, size_t frame_size)
 {
 	unsigned long rsp;
@@ -408,13 +409,13 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs * regs, size_t frame_size)
 		rsp = (unsigned long) ka->sa.sa_restorer;
 	}
 
-	return (void *)((rsp - frame_size) & -8UL);
+	return (void __user *)((rsp - frame_size) & -8UL);
 }
 
 void ia32_setup_frame(int sig, struct k_sigaction *ka,
 			compat_sigset_t *set, struct pt_regs * regs)
 {
-	struct sigframe *frame;
+	struct sigframe __user *frame;
 	int err = 0;
 
 	frame = get_sigframe(ka, regs, sizeof(*frame));
@@ -501,7 +502,7 @@ void ia32_setup_frame(int sig, struct k_sigaction *ka,
 void ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
 			   compat_sigset_t *set, struct pt_regs * regs)
 {
-	struct rt_sigframe *frame;
+	struct rt_sigframe __user *frame;
 	int err = 0;
 
 	frame = get_sigframe(ka, regs, sizeof(*frame));

arch/x86_64/ia32/ptrace32.c

@@ -19,6 +19,7 @@
 #include <linux/mm.h>
 #include <linux/ptrace.h>
 #include <asm/ptrace.h>
+#include <asm/compat.h>
 #include <asm/uaccess.h>
 #include <asm/user32.h>
 #include <asm/user.h>
@@ -228,6 +229,7 @@ asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
 {
 	struct task_struct *child;
 	struct pt_regs *childregs; 
+	void __user *datap = compat_ptr(data);
 	int ret;
 	__u32 val;
 
@@ -264,7 +266,7 @@ asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
 		if (access_process_vm(child, addr, &val, sizeof(u32), 0)!=sizeof(u32))
 			ret = -EIO;
 		else
-			ret = put_user(val, (unsigned int *)(u64)data); 
+			ret = put_user(val, (unsigned int __user *)datap); 
 		break; 
 
 	case PTRACE_POKEDATA:
@@ -277,7 +279,7 @@ asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
 	case PTRACE_PEEKUSR:
 		ret = getreg32(child, addr, &val);
 		if (ret == 0)
-			ret = put_user(val, (__u32 *)(unsigned long) data);
+			ret = put_user(val, (__u32 __user *)datap);
 		break;
 
 	case PTRACE_POKEUSR:
@@ -286,15 +288,15 @@ asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
 
 	case PTRACE_GETREGS: { /* Get all gp regs from the child. */
 		int i;
-	  	if (!access_ok(VERIFY_WRITE, (unsigned *)(unsigned long)data, 16*4)) {
+	  	if (!access_ok(VERIFY_WRITE, datap, 16*4)) {
 			ret = -EIO;
 			break;
 		}
 		ret = 0;
 		for ( i = 0; i <= 16*4 ; i += sizeof(__u32) ) {
 			getreg32(child, i, &val);
-			ret |= __put_user(val,(u32 *) (unsigned long) data);
-			data += sizeof(u32);
+			ret |= __put_user(val,(u32 __user *)datap);
+			datap += sizeof(u32);
 		}
 		break;
 	}
@@ -302,40 +304,40 @@ asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
 	case PTRACE_SETREGS: { /* Set all gp regs in the child. */
 		unsigned long tmp;
 		int i;
-	  	if (!access_ok(VERIFY_READ, (unsigned *)(unsigned long)data, 16*4)) {
+	  	if (!access_ok(VERIFY_READ, datap, 16*4)) {
 			ret = -EIO;
 			break;
 		}
 		ret = 0; 
 		for ( i = 0; i <= 16*4; i += sizeof(u32) ) {
-			ret |= __get_user(tmp, (u32 *) (unsigned long) data);
+			ret |= __get_user(tmp, (u32 __user *)datap);
 			putreg32(child, i, tmp);
-			data += sizeof(u32);
+			datap += sizeof(u32);
 		}
 		break;
 	}
 
 	case PTRACE_GETFPREGS:
 		ret = -EIO; 
-		if (!access_ok(VERIFY_READ, (void *)(u64)data, 
+		if (!access_ok(VERIFY_READ, compat_ptr(data), 
 			       sizeof(struct user_i387_struct)))
 			break;
-		save_i387_ia32(child, (void *)(u64)data, childregs, 1);
+		save_i387_ia32(child, datap, childregs, 1);
 		ret = 0; 
 			break;
 
 	case PTRACE_SETFPREGS:
 		ret = -EIO;
-		if (!access_ok(VERIFY_WRITE, (void *)(u64)data, 
+		if (!access_ok(VERIFY_WRITE, datap, 
 			       sizeof(struct user_i387_struct)))
 			break;
 		ret = 0;
 		/* don't check EFAULT to be bug-to-bug compatible to i386 */
-		restore_i387_ia32(child, (void *)(u64)data, 1);
+		restore_i387_ia32(child, datap, 1);
 		break;
 
 	case PTRACE_GETFPXREGS: { 
-		struct user32_fxsr_struct *u = (void *)(u64)data; 
+		struct user32_fxsr_struct __user *u = datap;
 		init_fpu(child); 
 		ret = -EIO;
 		if (!access_ok(VERIFY_WRITE, u, sizeof(*u)))
@@ -348,7 +350,7 @@ asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
 		break; 
 	} 
 	case PTRACE_SETFPXREGS: { 
-		struct user32_fxsr_struct *u = (void *)(u64)data; 
+		struct user32_fxsr_struct __user *u = datap;
 		unlazy_fpu(child);
 		ret = -EIO;
 		if (!access_ok(VERIFY_READ, u, sizeof(*u)))

arch/x86_64/kernel/i387.c

@@ -77,7 +77,7 @@ void init_fpu(struct task_struct *child)
  * Signal frame handlers.
  */
 
-int save_i387(struct _fpstate *buf)
+int save_i387(struct _fpstate __user *buf)
 {
 	struct task_struct *tsk = current;
 	int err = 0;
@@ -95,7 +95,7 @@ int save_i387(struct _fpstate *buf)
 		return 0;
 	tsk->used_math = 0; /* trigger finit */ 
 	if (tsk->thread_info->status & TS_USEDFPU) {
-		err = save_i387_checking((struct i387_fxsave_struct *)buf);
+		err = save_i387_checking((struct i387_fxsave_struct __user *)buf);
 		if (err) return err;
 		stts();
 		} else {
@@ -110,14 +110,14 @@ int save_i387(struct _fpstate *buf)
  * ptrace request handlers.
  */
 
-int get_fpregs(struct user_i387_struct *buf, struct task_struct *tsk)
+int get_fpregs(struct user_i387_struct __user *buf, struct task_struct *tsk)
 {
 	init_fpu(tsk);
-	return __copy_to_user((void *)buf, &tsk->thread.i387.fxsave,
+	return __copy_to_user(buf, &tsk->thread.i387.fxsave,
 			       sizeof(struct user_i387_struct)) ? -EFAULT : 0;
 }
 
-int set_fpregs(struct task_struct *tsk, struct user_i387_struct *buf)
+int set_fpregs(struct task_struct *tsk, struct user_i387_struct __user *buf)
 {
 	if (__copy_from_user(&tsk->thread.i387.fxsave, buf, 
 			     sizeof(struct user_i387_struct)))

arch/x86_64/kernel/ldt.c

@@ -125,7 +125,7 @@ void destroy_context(struct mm_struct *mm)
 	}
 }
 
-static int read_ldt(void * ptr, unsigned long bytecount)
+static int read_ldt(void __user * ptr, unsigned long bytecount)
 {
 	int err;
 	unsigned long size;
@@ -153,7 +153,7 @@ static int read_ldt(void * ptr, unsigned long bytecount)
 	return bytecount;
 }
 
-static int read_default_ldt(void * ptr, unsigned long bytecount)
+static int read_default_ldt(void __user * ptr, unsigned long bytecount)
 {
 	/* Arbitrary number */ 
 	/* x86-64 default LDT is all zeros */
@@ -164,7 +164,7 @@ static int read_default_ldt(void * ptr, unsigned long bytecount)
 	return bytecount; 
 }
 
-static int write_ldt(void * ptr, unsigned long bytecount, int oldmode)
+static int write_ldt(void __user * ptr, unsigned long bytecount, int oldmode)
 {
 	struct task_struct *me = current;
 	struct mm_struct * mm = me->mm;
@@ -225,7 +225,7 @@ static int write_ldt(void * ptr, unsigned long bytecount, int oldmode)
 	return error;
 }
 
-asmlinkage int sys_modify_ldt(int func, void *ptr, unsigned long bytecount)
+asmlinkage int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount)
 {
 	int ret = -ENOSYS;
 

arch/x86_64/kernel/process.c

@@ -521,7 +521,8 @@ struct task_struct *__switch_to(struct task_struct *prev_p, struct task_struct *
  * sys_execve() executes a new program.
  */
 asmlinkage 
-long sys_execve(char *name, char **argv,char **envp, struct pt_regs regs)
+long sys_execve(char __user *name, char __user * __user *argv,
+		char __user * __user *envp, struct pt_regs regs)
 {
 	long error;
 	char * filename;
@@ -550,7 +551,7 @@ asmlinkage long sys_fork(struct pt_regs regs)
 	return do_fork(SIGCHLD, regs.rsp, &regs, 0, NULL, NULL);
 }
 
-asmlinkage long sys_clone(unsigned long clone_flags, unsigned long newsp, void *parent_tid, void *child_tid, struct pt_regs regs)
+asmlinkage long sys_clone(unsigned long clone_flags, unsigned long newsp, void __user *parent_tid, void __user *child_tid, struct pt_regs regs)
 {
 	if (!newsp)
 		newsp = regs.rsp;
@@ -664,7 +665,7 @@ long do_arch_prctl(struct task_struct *task, int code, unsigned long addr)
 			rdmsrl(MSR_FS_BASE, base);
 		} else
 			base = task->thread.fs;
-		ret = put_user(base, (unsigned long *)addr); 
+		ret = put_user(base, (unsigned long __user *)addr); 
 		break; 
 	}
 	case ARCH_GET_GS: { 
@@ -675,7 +676,7 @@ long do_arch_prctl(struct task_struct *task, int code, unsigned long addr)
 			rdmsrl(MSR_KERNEL_GS_BASE, base);
 		} else
 			base = task->thread.gs;
-		ret = put_user(base, (unsigned long *)addr); 
+		ret = put_user(base, (unsigned long __user *)addr); 
 		break;
 	}
 

arch/x86_64/kernel/ptrace.c

@@ -232,7 +232,7 @@ asmlinkage long sys_ptrace(long request, long pid, unsigned long addr, long data
 		ret = -EIO;
 		if (copied != sizeof(tmp))
 			break;
-		ret = put_user(tmp,(unsigned long *) data);
+		ret = put_user(tmp,(unsigned long __user *) data);
 		break;
 	}
 
@@ -271,7 +271,7 @@ asmlinkage long sys_ptrace(long request, long pid, unsigned long addr, long data
 			tmp = 0;
 			break;
 		}
-		ret = put_user(tmp,(unsigned long *) data);
+		ret = put_user(tmp,(unsigned long __user *) data);
 		break;
 	}
 
@@ -360,19 +360,20 @@ asmlinkage long sys_ptrace(long request, long pid, unsigned long addr, long data
 		   don't use it against 64bit processes, use
 		   PTRACE_ARCH_PRCTL instead. */
 	case PTRACE_SET_THREAD_AREA: {
+		struct user_desc __user *p;
 		int old; 
-		get_user(old,  &((struct user_desc *)data)->entry_number); 
-		put_user(addr, &((struct user_desc *)data)->entry_number);
-		ret = do_set_thread_area(&child->thread, 
-					 (struct user_desc *)data);
-		put_user(old,  &((struct user_desc *)data)->entry_number); 
+		p = (struct user_desc __user *)data;
+		get_user(old,  &p->entry_number); 
+		put_user(addr, &p->entry_number);
+		ret = do_set_thread_area(&child->thread, p);
+		put_user(old,  &p->entry_number); 
 		break;
 	case PTRACE_GET_THREAD_AREA:
-		get_user(old,  &((struct user_desc *)data)->entry_number); 
-		put_user(addr, &((struct user_desc *)data)->entry_number);
-		ret = do_get_thread_area(&child->thread, 
-					 (struct user_desc *)data);
-		put_user(old,  &((struct user_desc *)data)->entry_number); 
+		p = (struct user_desc __user *)data;
+		get_user(old,  &p->entry_number); 
+		put_user(addr, &p->entry_number);
+		ret = do_get_thread_area(&child->thread, p);
+		put_user(old,  &p->entry_number); 
 		break;
 	} 
 #endif
@@ -428,12 +429,12 @@ asmlinkage long sys_ptrace(long request, long pid, unsigned long addr, long data
 		break;
 
 	case PTRACE_GETREGS: { /* Get all gp regs from the child. */
-	  	if (!access_ok(VERIFY_WRITE, (unsigned *)data, FRAME_SIZE)) {
+	  	if (!access_ok(VERIFY_WRITE, (unsigned __user *)data, FRAME_SIZE)) {
 			ret = -EIO;
 			break;
 		}
 		for (ui = 0; ui < sizeof(struct user_regs_struct); ui += sizeof(long)) {
-			__put_user(getreg(child, ui),(unsigned long *) data);
+			__put_user(getreg(child, ui),(unsigned long __user *) data);
 			data += sizeof(long);
 		}
 		ret = 0;
@@ -442,12 +443,12 @@ asmlinkage long sys_ptrace(long request, long pid, unsigned long addr, long data
 
 	case PTRACE_SETREGS: { /* Set all gp regs in the child. */
 		unsigned long tmp;
-	  	if (!access_ok(VERIFY_READ, (unsigned *)data, FRAME_SIZE)) {
+	  	if (!access_ok(VERIFY_READ, (unsigned __user *)data, FRAME_SIZE)) {
 			ret = -EIO;
 			break;
 		}
 		for (ui = 0; ui < sizeof(struct user_regs_struct); ui += sizeof(long)) {
-			__get_user(tmp, (unsigned long *) data);
+			__get_user(tmp, (unsigned long __user *) data);
 			putreg(child, ui, tmp);
 			data += sizeof(long);
 		}
@@ -456,23 +457,23 @@ asmlinkage long sys_ptrace(long request, long pid, unsigned long addr, long data
 	}
 
 	case PTRACE_GETFPREGS: { /* Get the child extended FPU state. */
-		if (!access_ok(VERIFY_WRITE, (unsigned *)data,
+		if (!access_ok(VERIFY_WRITE, (unsigned __user *)data,
 			       sizeof(struct user_i387_struct))) {
 			ret = -EIO;
 			break;
 		}
-		ret = get_fpregs((struct user_i387_struct *)data, child);
+		ret = get_fpregs((struct user_i387_struct __user *)data, child);
 		break;
 	}
 
 	case PTRACE_SETFPREGS: { /* Set the child extended FPU state. */
-		if (!access_ok(VERIFY_READ, (unsigned *)data,
+		if (!access_ok(VERIFY_READ, (unsigned __user *)data,
 			       sizeof(struct user_i387_struct))) {
 			ret = -EIO;
 			break;
 		}
 		child->used_math = 1;
-		ret = set_fpregs(child, (struct user_i387_struct *)data);
+		ret = set_fpregs(child, (struct user_i387_struct __user *)data);
 		break;
 	}
 

arch/x86_64/kernel/signal.c

@@ -40,7 +40,7 @@ void ia32_setup_frame(int sig, struct k_sigaction *ka,
             sigset_t *set, struct pt_regs * regs); 
 
 asmlinkage long
-sys_rt_sigsuspend(sigset_t *unewset, size_t sigsetsize, struct pt_regs regs)
+sys_rt_sigsuspend(sigset_t __user *unewset, size_t sigsetsize, struct pt_regs regs)
 {
 	sigset_t saveset, newset;
 
@@ -71,7 +71,7 @@ sys_rt_sigsuspend(sigset_t *unewset, size_t sigsetsize, struct pt_regs regs)
 }
 
 asmlinkage long
-sys_sigaltstack(const stack_t *uss, stack_t *uoss, struct pt_regs regs)
+sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss, struct pt_regs regs)
 {
 	return do_sigaltstack(uss, uoss, regs.rsp);
 }
@@ -89,7 +89,7 @@ struct rt_sigframe
 };
 
 static int
-restore_sigcontext(struct pt_regs *regs, struct sigcontext *sc, unsigned long *prax)
+restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, unsigned long *prax)
 {
 	unsigned int err = 0;
 
@@ -117,7 +117,7 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext *sc, unsigned long *p
 	}
 
 	{
-		struct _fpstate * buf;
+		struct _fpstate __user * buf;
 		err |= __get_user(buf, &sc->fpstate);
 
 		if (buf) {
@@ -136,10 +136,11 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext *sc, unsigned long *p
 
 asmlinkage long sys_rt_sigreturn(struct pt_regs regs)
 {
-	struct rt_sigframe *frame = (struct rt_sigframe *)(regs.rsp - 8);
+	struct rt_sigframe __user *frame;
 	sigset_t set;
 	long eax;
 
+	frame = (struct rt_sigframe __user *)(regs.rsp - 8);
 	if (verify_area(VERIFY_READ, frame, sizeof(*frame))) { 
 		goto badframe;
 	} 
@@ -176,7 +177,7 @@ asmlinkage long sys_rt_sigreturn(struct pt_regs regs)
  */
 
 static inline int
-setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs, unsigned long mask, struct task_struct *me)
+setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs, unsigned long mask, struct task_struct *me)
 {
 	int err = 0;
 
@@ -213,7 +214,7 @@ setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs, unsigned long mask
  * Determine which stack to use..
  */
 
-static void *
+static void __user *
 get_stack(struct k_sigaction *ka, struct pt_regs *regs, unsigned long size)
 {
 	unsigned long rsp;
@@ -228,20 +229,20 @@ get_stack(struct k_sigaction *ka, struct pt_regs *regs, unsigned long size)
 			rsp = current->sas_ss_sp + current->sas_ss_size;
 	}
 
-	return (void *)round_down(rsp - size, 16); 
+	return (void __user *)round_down(rsp - size, 16); 
 }
 
 static void setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
 			   sigset_t *set, struct pt_regs * regs)
 {
-	struct rt_sigframe *frame;
-	struct _fpstate *fp = NULL; 
+	struct rt_sigframe __user *frame;
+	struct _fpstate __user *fp = NULL; 
 	int err = 0;
 	struct task_struct *me = current;
 
 	if (me->used_math) {
 		fp = get_stack(ka, regs, sizeof(struct _fpstate)); 
-		frame = (void *)round_down((u64)fp - sizeof(struct rt_sigframe), 16) - 8;
+		frame = (void __user *)round_down((u64)fp - sizeof(struct rt_sigframe), 16) - 8;
 
 		if (!access_ok(VERIFY_WRITE, fp, sizeof(struct _fpstate))) { 
 		goto give_sigsegv;
@@ -470,7 +471,7 @@ void do_notify_resume(struct pt_regs *regs, sigset_t *oldset, __u32 thread_info_
 		do_signal(regs,oldset);
 }
 
-void signal_fault(struct pt_regs *regs, void *frame, char *where)
+void signal_fault(struct pt_regs *regs, void __user *frame, char *where)
 { 
 	struct task_struct *me = current; 
 	if (exception_trace)

arch/x86_64/kernel/sys_x86_64.c

@@ -25,7 +25,7 @@
  * sys_pipe() is the normal C calling standard for creating
  * a pipe. It's not the way Unix traditionally does this, though.
  */
-asmlinkage long sys_pipe(int *fildes)
+asmlinkage long sys_pipe(int __user *fildes)
 {
 	int fd[2];
 	int error;
@@ -142,7 +142,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 	}
 }
 
-asmlinkage long sys_uname(struct new_utsname * name)
+asmlinkage long sys_uname(struct new_utsname __user * name)
 {
 	int err;
 	down_read(&uts_sem);
@@ -153,13 +153,13 @@ asmlinkage long sys_uname(struct new_utsname * name)
 	return err ? -EFAULT : 0;
 }
 
-asmlinkage long wrap_sys_shmat(int shmid, char *shmaddr, int shmflg)
+asmlinkage long wrap_sys_shmat(int shmid, char __user *shmaddr, int shmflg)
 {
 	unsigned long raddr;
 	return do_shmat(shmid,shmaddr,shmflg,&raddr) ?: (long)raddr;
 }
 
-asmlinkage long sys_time64(long * tloc)
+asmlinkage long sys_time64(long __user * tloc)
 {
 	struct timeval now; 
 	int i; 

include/asm-x86_64/fpu32.h

@@ -3,8 +3,8 @@
 
 struct _fpstate_ia32;
 
-int restore_i387_ia32(struct task_struct *tsk, struct _fpstate_ia32 *buf, int fsave);
-int save_i387_ia32(struct task_struct *tsk, struct _fpstate_ia32 *buf, 
+int restore_i387_ia32(struct task_struct *tsk, struct _fpstate_ia32 __user *buf, int fsave);
+int save_i387_ia32(struct task_struct *tsk, struct _fpstate_ia32 __user *buf, 
 		   struct pt_regs *regs, int fsave);
 
 #endif

include/asm-x86_64/i387.h

@@ -23,7 +23,7 @@ extern void fpu_init(void);
 extern unsigned int mxcsr_feature_mask;
 extern void mxcsr_feature_mask_init(void);
 extern void init_fpu(struct task_struct *child);
-extern int save_i387(struct _fpstate *buf);
+extern int save_i387(struct _fpstate __user *buf);
 
 static inline int need_signal_i387(struct task_struct *me) 
 { 
@@ -57,10 +57,10 @@ static inline int need_signal_i387(struct task_struct *me)
 /*
  * ptrace request handers...
  */
-extern int get_fpregs(struct user_i387_struct *buf,
+extern int get_fpregs(struct user_i387_struct __user *buf,
 		      struct task_struct *tsk);
 extern int set_fpregs(struct task_struct *tsk,
-		      struct user_i387_struct *buf);
+		      struct user_i387_struct __user *buf);
 
 /*
  * i387 state interaction
@@ -93,7 +93,7 @@ static inline int restore_fpu_checking(struct i387_fxsave_struct *fx)
 	return err;
 } 
 
-static inline int save_i387_checking(struct i387_fxsave_struct *fx) 
+static inline int save_i387_checking(struct i387_fxsave_struct __user *fx) 
 { 
 	int err;
 	asm volatile("1:  rex64 ; fxsave (%[fx])\n\t"
@@ -136,7 +136,7 @@ static inline void save_init_fpu( struct task_struct *tsk )
 /* 
  * This restores directly out of user space. Exceptions are handled.
  */
-static inline int restore_i387(struct _fpstate *buf)
+static inline int restore_i387(struct _fpstate __user *buf)
 {
 	return restore_fpu_checking((struct i387_fxsave_struct *)buf);
 }

include/asm-x86_64/ia32.h

@@ -168,8 +168,8 @@ struct ustat32 {
 #ifdef __KERNEL__
 struct user_desc;
 struct siginfo_t;
-int do_get_thread_area(struct thread_struct *t, struct user_desc *u_info);
-int do_set_thread_area(struct thread_struct *t, struct user_desc *u_info);
+int do_get_thread_area(struct thread_struct *t, struct user_desc __user *info);
+int do_set_thread_area(struct thread_struct *t, struct user_desc __user *info);
 int ia32_child_tls(struct task_struct *p, struct pt_regs *childregs);
 int ia32_copy_siginfo_from_user(siginfo_t *to, siginfo_t32 __user *from);
 int ia32_copy_siginfo_to_user(siginfo_t32 __user *to, siginfo_t *from);

include/asm-x86_64/ptrace.h

@@ -83,7 +83,7 @@ struct pt_regs {
 #if defined(__KERNEL__) && !defined(__ASSEMBLY__) 
 #define user_mode(regs) (!!((regs)->cs & 3))
 #define instruction_pointer(regs) ((regs)->rip)
-void signal_fault(struct pt_regs *regs, void *frame, char *where);
+void signal_fault(struct pt_regs *regs, void __user *frame, char *where);
 
 enum {
         EF_CF   = 0x00000001,

include/asm-x86_64/sigcontext.h

@@ -2,6 +2,7 @@
 #define _ASM_X86_64_SIGCONTEXT_H
 
 #include <asm/types.h>
+#include <linux/compiler.h>
 
 /* FXSAVE frame */
 /* Note: reserved1/2 may someday contain valuable data. Always save/restore
@@ -47,7 +48,7 @@ struct sigcontext {
 	unsigned long trapno;
 	unsigned long oldmask;
 	unsigned long cr2;
-	struct _fpstate *fpstate;	/* zero when no FPU context */
+	struct _fpstate __user *fpstate;	/* zero when no FPU context */
 	unsigned long reserved1[8];
 };