[PATCH] sparse: emu10k1 annotation

emu10k1 annotated.

include/sound/emu10k1.h

@@ -1317,14 +1317,14 @@ typedef struct {
 	unsigned int gpr_map[0x100];	  /* initializers */
 
 	unsigned int gpr_add_control_count; /* count of GPR controls to add/replace */
-	emu10k1_fx8010_control_gpr_t *gpr_add_controls; /* GPR controls to add/replace */
+	emu10k1_fx8010_control_gpr_t __user *gpr_add_controls; /* GPR controls to add/replace */
 
 	unsigned int gpr_del_control_count; /* count of GPR controls to remove */
-	snd_ctl_elem_id_t *gpr_del_controls; /* IDs of GPR controls to remove */
+	snd_ctl_elem_id_t __user *gpr_del_controls; /* IDs of GPR controls to remove */
 
 	unsigned int gpr_list_control_count; /* count of GPR controls to list */
 	unsigned int gpr_list_control_total; /* total count of GPR controls */
-	emu10k1_fx8010_control_gpr_t *gpr_list_controls; /* listed GPR controls */
+	emu10k1_fx8010_control_gpr_t __user *gpr_list_controls; /* listed GPR controls */
 
 	unsigned long tram_valid[0xa0/(sizeof(unsigned long)*8)]; /* bitmask of valid initializers */
 	unsigned int tram_data_map[0xa0]; /* data initializers */

sound/oss/emu10k1/audio.c

@@ -50,7 +50,7 @@ static void calculate_ofrag(struct woinst *);
 static void calculate_ifrag(struct wiinst *);
 
 /* Audio file operations */
-static ssize_t emu10k1_audio_read(struct file *file, char *buffer, size_t count, loff_t * ppos)
+static ssize_t emu10k1_audio_read(struct file *file, char __user *buffer, size_t count, loff_t * ppos)
 {
 	struct emu10k1_wavedevice *wave_dev = (struct emu10k1_wavedevice *) file->private_data;
 	struct wiinst *wiinst = wave_dev->wiinst;
@@ -112,7 +112,7 @@ static ssize_t emu10k1_audio_read(struct file *file, char *buffer, size_t count,
 		    || (bytestocopy >= count)) {
 			bytestocopy = min_t(u32, bytestocopy, count);
 
-			emu10k1_wavein_xferdata(wiinst, (u8 *) buffer, &bytestocopy);
+			emu10k1_wavein_xferdata(wiinst, (u8 __user *)buffer, &bytestocopy);
 
 			count -= bytestocopy;
 			buffer += bytestocopy;
@@ -137,7 +137,7 @@ static ssize_t emu10k1_audio_read(struct file *file, char *buffer, size_t count,
 	return ret;
 }
 
-static ssize_t emu10k1_audio_write(struct file *file, const char *buffer, size_t count, loff_t * ppos)
+static ssize_t emu10k1_audio_write(struct file *file, const char __user *buffer, size_t count, loff_t * ppos)
 {
 	struct emu10k1_wavedevice *wave_dev = (struct emu10k1_wavedevice *) file->private_data;
 	struct woinst *woinst = wave_dev->woinst;
@@ -212,7 +212,7 @@ static ssize_t emu10k1_audio_write(struct file *file, const char *buffer, size_t
 
 			bytestocopy = min_t(u32, bytestocopy, count);
 
-			emu10k1_waveout_xferdata(woinst, (u8 *) buffer, &bytestocopy);
+			emu10k1_waveout_xferdata(woinst, (u8 __user *) buffer, &bytestocopy);
 
 			count -= bytestocopy;
 			buffer += bytestocopy * woinst->num_voices;
@@ -254,6 +254,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 	int val = 0;
 	u32 bytestocopy;
 	unsigned long flags;
+	int __user *p = (int __user *)arg;
 
 	DPF(4, "emu10k1_audio_ioctl()\n");
 
@@ -266,7 +267,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 	switch (cmd) {
 	case OSS_GETVERSION:
 		DPF(2, "OSS_GETVERSION:\n");
-		return put_user(SOUND_VERSION, (int *) arg);
+		return put_user(SOUND_VERSION, p);
 
 	case SNDCTL_DSP_RESET:
 		DPF(2, "SNDCTL_DSP_RESET:\n");
@@ -352,11 +353,11 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 		DPF(2, "SNDCTL_DSP_GETCAPS:\n");
 		return put_user(DSP_CAP_DUPLEX | DSP_CAP_REALTIME |
 				DSP_CAP_TRIGGER | DSP_CAP_MMAP |
-				DSP_CAP_COPROC| DSP_CAP_MULTI, (int *) arg);
+				DSP_CAP_COPROC| DSP_CAP_MULTI, p);
 	case SNDCTL_DSP_SPEED:
 		DPF(2, "SNDCTL_DSP_SPEED:\n");
 
-		if (get_user(val, (int *) arg))
+		if (get_user(val, p))
 			return -EFAULT;
 
 		DPD(2, "val is %d\n", val);
@@ -402,21 +403,21 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 				DPD(2, "set playback sampling rate -> %d\n", val);
 			}
 
-			return put_user(val, (int *) arg);
+			return put_user(val, p);
 		} else {
 			if (file->f_mode & FMODE_READ)
 				val = wiinst->format.samplingrate;
 			else if (file->f_mode & FMODE_WRITE)
 				val = woinst->format.samplingrate;
 
-			return put_user(val, (int *) arg);
+			return put_user(val, p);
 		}
 		break;
 
 	case SNDCTL_DSP_STEREO:
 		DPF(2, "SNDCTL_DSP_STEREO:\n");
 
-		if (get_user(val, (int *) arg))
+		if (get_user(val, p))
 			return -EFAULT;
 
 		DPD(2, " val is %d\n", val);
@@ -460,14 +461,14 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 			DPD(2, "set playback stereo -> %d\n", val);
 		}
 
-		return put_user(val, (int *) arg);
+		return put_user(val, p);
 
 		break;
 
 	case SNDCTL_DSP_CHANNELS:
 		DPF(2, "SNDCTL_DSP_CHANNELS:\n");
 
-		if (get_user(val, (int *) arg))
+		if (get_user(val, p))
 			return -EFAULT;
 
 		DPD(2, " val is %d\n", val);
@@ -510,14 +511,14 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 				DPD(2, "set playback number of channels -> %d\n", val);
 			}
 
-			return put_user(val, (int *) arg);
+			return put_user(val, p);
 		} else {
 			if (file->f_mode & FMODE_READ)
 				val = wiinst->format.channels;
 			else if (file->f_mode & FMODE_WRITE)
 				val = woinst->format.channels;
 
-			return put_user(val, (int *) arg);
+			return put_user(val, p);
 		}
 		break;
 
@@ -533,12 +534,12 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 						     wave_dev->card->pt.enable_gpr_name) >= 0)
 				val |= AFMT_AC3;
 		}
-		return put_user(val, (int *) arg);
+		return put_user(val, p);
 
 	case SNDCTL_DSP_SETFMT:	/* Same as SNDCTL_DSP_SAMPLESIZE */
 		DPF(2, "SNDCTL_DSP_SETFMT:\n");
 
-		if (get_user(val, (int *) arg))
+		if (get_user(val, p))
 			return -EFAULT;
 
 		DPD(2, " val is %d\n", val);
@@ -582,14 +583,14 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 				DPD(2, "set playback format -> %d\n", val);
 			}
 
-			return put_user(val, (int *) arg);
+			return put_user(val, p);
 		} else {
 			if (file->f_mode & FMODE_READ)
 				val = wiinst->format.id;
 			else if (file->f_mode & FMODE_WRITE)
 				val = woinst->format.id;
 
-			return put_user(val, (int *) arg);
+			return put_user(val, p);
 		}
 		break;
 
@@ -600,7 +601,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 		else if (file->f_mode & FMODE_WRITE)
 			val = woinst->format.bitsperchannel;
 
-		return put_user(val, (int *) arg);
+		return put_user(val, p);
 
 	case SOUND_PCM_READ_RATE:
 
@@ -609,7 +610,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 		else if (file->f_mode & FMODE_WRITE)
 			val = woinst->format.samplingrate;
 
-		return put_user(val, (int *) arg);
+		return put_user(val, p);
 
 	case SOUND_PCM_READ_CHANNELS:
 
@@ -618,7 +619,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 		else if (file->f_mode & FMODE_WRITE)
 			val = woinst->format.channels;
 
-		return put_user(val, (int *) arg);
+		return put_user(val, p);
 
 	case SOUND_PCM_WRITE_FILTER:
 		DPF(2, "SOUND_PCM_WRITE_FILTER: not implemented\n");
@@ -641,12 +642,12 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 		if (file->f_mode & FMODE_READ && (wave_dev->enablebits & PCM_ENABLE_INPUT))
 			val |= PCM_ENABLE_INPUT;
 
-		return put_user(val, (int *) arg);
+		return put_user(val, p);
 
 	case SNDCTL_DSP_SETTRIGGER:
 		DPF(2, "SNDCTL_DSP_SETTRIGGER:\n");
 
-		if (get_user(val, (int *) arg))
+		if (get_user(val, p))
 			return -EFAULT;
 
 		if (file->f_mode & FMODE_WRITE) {
@@ -708,7 +709,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 			info.fragstotal = woinst->buffer.numfrags * woinst->num_voices;
 			info.fragments = info.bytes / info.fragsize;
 
-			if (copy_to_user((int *) arg, &info, sizeof(info)))
+			if (copy_to_user(p, &info, sizeof(info)))
 				return -EFAULT;
 		}
 		break;
@@ -737,7 +738,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 			info.fragments = info.bytes / wiinst->buffer.fragment_size;
 			info.fragsize = wiinst->buffer.fragment_size;
 
-			if (copy_to_user((int *) arg, &info, sizeof(info)))
+			if (copy_to_user(p, &info, sizeof(info)))
 				return -EFAULT;
 		}
 		break;
@@ -765,7 +766,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 		val *= woinst->num_voices;
 		spin_unlock_irqrestore(&woinst->lock, flags);
 
-		return put_user(val, (int *) arg);
+		return put_user(val, p);
 
 	case SNDCTL_DSP_GETIPTR:
 		{
@@ -795,7 +796,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 
 			spin_unlock_irqrestore(&wiinst->lock, flags);
 
-			if (copy_to_user((void *) arg, &cinfo, sizeof(cinfo)))
+			if (copy_to_user(p, &cinfo, sizeof(cinfo)))
 				return -EFAULT;
 		}
 		break;
@@ -841,7 +842,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 
 			spin_unlock_irqrestore(&woinst->lock, flags);
 
-			if (copy_to_user((void *) arg, &cinfo, sizeof(cinfo)))
+			if (copy_to_user(p, &cinfo, sizeof(cinfo)))
 				return -EFAULT;
 		}
 		break;
@@ -867,7 +868,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 			spin_unlock_irqrestore(&wiinst->lock, flags);
 		}
 
-		return put_user(val, (int *) arg);
+		return put_user(val, p);
 
 		break;
 
@@ -892,7 +893,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 	case SNDCTL_DSP_SETFRAGMENT:
 		DPF(2, "SNDCTL_DSP_SETFRAGMENT:\n");
 
-		if (get_user(val, (int *) arg))
+		if (get_user(val, p))
 			return -EFAULT;
 
 		DPD(2, "val is %#x\n", val);
@@ -930,7 +931,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 			if (!buf)
 				return -ENOMEM;
 
-			if (copy_from_user(buf, (copr_buffer *) arg, sizeof(copr_buffer))) {
+			if (copy_from_user(buf, p, sizeof(copr_buffer))) {
 				kfree (buf);
 				return -EFAULT;
 			}
@@ -969,7 +970,7 @@ static int emu10k1_audio_ioctl(struct inode *inode, struct file *file, unsigned
 				for (i = 0; i < buf->len; i++)
 					((u32 *) buf->data)[i] = sblive_readptr(wave_dev->card, buf->offs + i, buf->flags);
 
-				if (copy_to_user((copr_buffer *) arg, buf, sizeof(copr_buffer))) {
+				if (copy_to_user(p, buf, sizeof(copr_buffer))) {
 					kfree(buf);
 					return -EFAULT;
 				}

sound/oss/emu10k1/cardwi.c

@@ -304,7 +304,7 @@ void emu10k1_wavein_getxfersize(struct wiinst *wiinst, u32 * size)
 	}
 }
 
-static void copy_block(u8 *dst, u8 * src, u32 str, u32 len, u8 cov)
+static void copy_block(u8 __user *dst, u8 * src, u32 str, u32 len, u8 cov)
 {
 	if (cov == 1)
 		__copy_to_user(dst, src + str, len);
@@ -321,7 +321,7 @@ static void copy_block(u8 *dst, u8 * src, u32 str, u32 len, u8 cov)
 	}
 }
 
-void emu10k1_wavein_xferdata(struct wiinst *wiinst, u8 * data, u32 * size)
+void emu10k1_wavein_xferdata(struct wiinst *wiinst, u8 __user *data, u32 * size)
 {
 	struct wavein_buffer *buffer = &wiinst->buffer;
 	u32 sizetocopy, sizetocopy_now, start;

sound/oss/emu10k1/cardwi.h

@@ -83,7 +83,7 @@ void emu10k1_wavein_close(struct emu10k1_wavedevice *);
 void emu10k1_wavein_start(struct emu10k1_wavedevice *);
 void emu10k1_wavein_stop(struct emu10k1_wavedevice *);
 void emu10k1_wavein_getxfersize(struct wiinst *, u32 *);
-void emu10k1_wavein_xferdata(struct wiinst *, u8 *, u32 *);
+void emu10k1_wavein_xferdata(struct wiinst *, u8 __user *, u32 *);
 int emu10k1_wavein_setformat(struct emu10k1_wavedevice *, struct wave_format *);
 void emu10k1_wavein_update(struct emu10k1_card *, struct wiinst *);
 

sound/oss/emu10k1/cardwo.c

@@ -417,7 +417,7 @@ void emu10k1_waveout_getxfersize(struct woinst *woinst, u32 *total_free_bytes)
  * Notice that the voice buffer is actually a set of disjointed memory pages.
  *
  */
-static void copy_block(void **dst, u32 str, u8 *src, u32 len)
+static void copy_block(void **dst, u32 str, u8 __user *src, u32 len)
 {
 	unsigned int pg;
 	unsigned int pgoff;
@@ -451,7 +451,7 @@ static void copy_block(void **dst, u32 str, u8 *src, u32 len)
  * Notice that the voice buffer is actually a set of disjointed memory pages.
  *
  */
-static void copy_ilv_block(struct woinst *woinst, u32 str, u8 *src, u32 len) 
+static void copy_ilv_block(struct woinst *woinst, u32 str, u8 __user *src, u32 len) 
 {
         unsigned int pg;
 	unsigned int pgoff;
@@ -524,7 +524,7 @@ static void fill_block(struct woinst *woinst, u32 str, u8 data, u32 len)
  * previously added to the buffer are overwritten.
  *
  */
-void emu10k1_waveout_xferdata(struct woinst *woinst, u8 *data, u32 *size)
+void emu10k1_waveout_xferdata(struct woinst *woinst, u8 __user *data, u32 *size)
 {
 	struct waveout_buffer *buffer = &woinst->buffer;
 	struct voice_mem *mem = &woinst->voice[0].mem;

sound/oss/emu10k1/cardwo.h

@@ -82,7 +82,7 @@ void emu10k1_waveout_close(struct emu10k1_wavedevice *);
 void emu10k1_waveout_start(struct emu10k1_wavedevice *);
 void emu10k1_waveout_stop(struct emu10k1_wavedevice *);
 void emu10k1_waveout_getxfersize(struct woinst*, u32 *);
-void emu10k1_waveout_xferdata(struct woinst*, u8*, u32 *);
+void emu10k1_waveout_xferdata(struct woinst*, u8 __user *, u32 *);
 void emu10k1_waveout_fillsilence(struct woinst*);
 int emu10k1_waveout_setformat(struct emu10k1_wavedevice*, struct wave_format*);
 void emu10k1_waveout_update(struct woinst*);

sound/oss/emu10k1/midi.c

@@ -244,7 +244,7 @@ static int emu10k1_midi_release(struct inode *inode, struct file *file)
 	return 0;
 }
 
-static ssize_t emu10k1_midi_read(struct file *file, char *buffer, size_t count, loff_t * pos)
+static ssize_t emu10k1_midi_read(struct file *file, char __user *buffer, size_t count, loff_t * pos)
 {
 	struct emu10k1_mididevice *midi_dev = (struct emu10k1_mididevice *) file->private_data;
 	ssize_t ret = 0;
@@ -319,7 +319,7 @@ static ssize_t emu10k1_midi_read(struct file *file, char *buffer, size_t count,
 	return ret;
 }
 
-static ssize_t emu10k1_midi_write(struct file *file, const char *buffer, size_t count, loff_t * pos)
+static ssize_t emu10k1_midi_write(struct file *file, const char __user *buffer, size_t count, loff_t * pos)
 {
 	struct emu10k1_mididevice *midi_dev = (struct emu10k1_mididevice *) file->private_data;
 	struct midi_hdr *midihdr;

sound/oss/emu10k1/mixer.c

@@ -188,6 +188,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 	u32 size, page;
 	int addr, size_reg, i, ret;
 	unsigned int id, ch;
+	void __user *argp = (void __user *)arg;
 
 	switch (cmd) {
 
@@ -197,7 +198,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 		if (ctl == NULL)
 			return -ENOMEM;
 
-		if (copy_from_user(ctl, (void *) arg, sizeof(struct mixer_private_ioctl))) {
+		if (copy_from_user(ctl, argp, sizeof(struct mixer_private_ioctl))) {
 			kfree(ctl);
 			return -EFAULT;
 		}
@@ -228,7 +229,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 		case CMD_READFN0:
 			ctl->val[2] = emu10k1_readfn0(card, ctl->val[0]);
 
-			if (copy_to_user((void *) arg, ctl, sizeof(struct mixer_private_ioctl)))
+			if (copy_to_user(argp, ctl, sizeof(struct mixer_private_ioctl)))
 				ret = -EFAULT;
 
 			break;
@@ -244,7 +245,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 
 			ctl->val[2] = sblive_readptr(card, ctl->val[0], ctl->val[1]);
 
-			if (copy_to_user((void *) arg, ctl, sizeof(struct mixer_private_ioctl)))
+			if (copy_to_user(argp, ctl, sizeof(struct mixer_private_ioctl)))
 				ret = -EFAULT;
 
 			break;
@@ -282,7 +283,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 		case CMD_GETRECSRC:
 			ctl->val[0] = card->wavein.recsrc;
 			ctl->val[1] = card->wavein.fxwc;
-			if (copy_to_user((void *) arg, ctl, sizeof(struct mixer_private_ioctl)))
+			if (copy_to_user(argp, ctl, sizeof(struct mixer_private_ioctl)))
 				ret = -EFAULT;
 
 			break;
@@ -297,7 +298,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 			ctl->val[4] = card->waveout.send_routing[2];
 			ctl->val[5] = card->waveout.send_dcba[2];
 
-			if (copy_to_user((void *) arg, ctl, sizeof(struct mixer_private_ioctl)))
+			if (copy_to_user(argp, ctl, sizeof(struct mixer_private_ioctl)))
 				ret = -EFAULT;
 
 			break;
@@ -320,7 +321,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 		
 		case CMD_GETPATCH:
 			if (ctl->val[0] == 0) {
-				if (copy_to_user((void *) arg, &card->mgr.rpatch, sizeof(struct dsp_rpatch)))
+				if (copy_to_user(argp, &card->mgr.rpatch, sizeof(struct dsp_rpatch)))
                                 	ret = -EFAULT;
 			} else {
 				if ((ctl->val[0] - 1) / PATCHES_PER_PAGE >= card->mgr.current_pages) {
@@ -328,7 +329,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 					break;
 				}
 
-				if (copy_to_user((void *) arg, PATCH(&card->mgr, ctl->val[0] - 1), sizeof(struct dsp_patch)))
+				if (copy_to_user(argp, PATCH(&card->mgr, ctl->val[0] - 1), sizeof(struct dsp_patch)))
 					ret = -EFAULT;
 			}
 
@@ -342,7 +343,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 				break;
 			}
 
-			if (copy_to_user((void *) arg, &card->mgr.gpr[id], sizeof(struct dsp_gpr)))
+			if (copy_to_user(argp, &card->mgr.gpr[id], sizeof(struct dsp_gpr)))
 				ret = -EFAULT;
 
 			break;
@@ -351,7 +352,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 			addr = emu10k1_find_control_gpr(&card->mgr, (char *) ctl->val, &((char *) ctl->val)[PATCH_NAME_SIZE]);
 			ctl->val[0] = sblive_readptr(card, addr, 0);
 
-			if (copy_to_user((void *) arg, ctl, sizeof(struct mixer_private_ioctl)))
+			if (copy_to_user(argp, ctl, sizeof(struct mixer_private_ioctl)))
 				ret = -EFAULT;
 
 			break;
@@ -430,7 +431,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 
 			ctl->val[2] = card->mgr.ctrl_gpr[id][ch];
 
-			if (copy_to_user((void *) arg, ctl, sizeof(struct mixer_private_ioctl)))
+			if (copy_to_user(argp, ctl, sizeof(struct mixer_private_ioctl)))
 				ret = -EFAULT;
 
 			break;
@@ -496,7 +497,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 			if (card->is_audigy)
 				ctl->val[4]=emu10k1_readfn0(card, 0x18);
 
-			if (copy_to_user((void *) arg, ctl, sizeof(struct mixer_private_ioctl)))
+			if (copy_to_user(argp, ctl, sizeof(struct mixer_private_ioctl)))
 				ret = -EFAULT;
 			break;
 
@@ -517,7 +518,7 @@ static int emu10k1_private_mixer(struct emu10k1_card *card, unsigned int cmd, un
 
 	case SOUND_MIXER_PRIVATE4:
 
-		if (copy_from_user(&size, (void *) arg, sizeof(size)))
+		if (copy_from_user(&size, argp, sizeof(size)))
 			return -EFAULT;
 
 		DPD(2, "External tram size %#x\n", size);
@@ -581,7 +582,7 @@ static int emu10k1_dsp_mixer(struct emu10k1_card *card, unsigned int oss_mixer,
 
 	card->ac97->modcnt++;
 
-	if (get_user(val, (int *)arg))
+	if (get_user(val, (int __user *)arg))
 		return -EFAULT;
 
 	/* cleanse input a little */
@@ -634,7 +635,7 @@ static int emu10k1_mixer_ioctl(struct inode *inode, struct file *file, unsigned
 				
 			info.modify_counter = card->ac97->modcnt;
 
-			if (copy_to_user((void *)arg, &info, sizeof(info)))
+			if (copy_to_user((void __user *)arg, &info, sizeof(info)))
 				return -EFAULT;
 
 			return 0;

sound/oss/emu10k1/passthrough.c

@@ -131,7 +131,7 @@ int emu10k1_pt_setup(struct emu10k1_wavedevice *wave_dev)
 	return 0;
 }
 
-ssize_t emu10k1_pt_write(struct file *file, const char *buffer, size_t count)
+ssize_t emu10k1_pt_write(struct file *file, const char __user *buffer, size_t count)
 {
 	struct emu10k1_wavedevice *wave_dev = (struct emu10k1_wavedevice *) file->private_data;
 	struct emu10k1_card *card = wave_dev->card;
@@ -177,10 +177,9 @@ ssize_t emu10k1_pt_write(struct file *file, const char *buffer, size_t count)
 	blocks = (count-bytes_copied)/PT_BLOCKSIZE;
 	blocks_copied = 0;
 	while (blocks > 0) {
-		u16 *bufptr = (u16 *) buffer + (bytes_copied/2);
+		u16 __user *bufptr = (u16 __user *) buffer + (bytes_copied/2);
 		copy_from_user(pt->buf, bufptr, PT_BLOCKSIZE);
-		bufptr = (u16 *) pt->buf;
-		r = pt_putblock(wave_dev, bufptr, nonblock);
+		r = pt_putblock(wave_dev, (u16 *)pt->buf, nonblock);
 		if (r) {
 			if (bytes_copied)
 				return bytes_copied;

sound/oss/emu10k1/passthrough.h

@@ -90,7 +90,7 @@ struct pt_data
 #define USE_PT_METHOD2  (card->is_audigy)
 #define USE_PT_METHOD1	!USE_PT_METHOD2
 
-ssize_t emu10k1_pt_write(struct file *file, const char *buf, size_t count);
+ssize_t emu10k1_pt_write(struct file *file, const char __user *buf, size_t count);
 
 int emu10k1_pt_setup(struct emu10k1_wavedevice *wave_dev);
 void emu10k1_pt_stop(struct emu10k1_card *card);

sound/pci/emu10k1/emufx.c

@@ -898,8 +898,10 @@ static snd_emu10k1_fx8010_ctl_t *snd_emu10k1_look_for_ctl(emu10k1_t *emu, snd_ct
 static int snd_emu10k1_verify_controls(emu10k1_t *emu, emu10k1_fx8010_code_t *icode)
 {
 	unsigned int i;
-	snd_ctl_elem_id_t *_id, id;
-	emu10k1_fx8010_control_gpr_t *_gctl, gctl;
+	snd_ctl_elem_id_t __user *_id;
+	snd_ctl_elem_id_t id;
+	emu10k1_fx8010_control_gpr_t __user *_gctl;
+	emu10k1_fx8010_control_gpr_t gctl;
 	
 	for (i = 0, _id = icode->gpr_del_controls;
 	     i < icode->gpr_del_control_count; i++, _id++) {
@@ -946,7 +948,8 @@ static void snd_emu10k1_ctl_private_free(snd_kcontrol_t *kctl)
 static void snd_emu10k1_add_controls(emu10k1_t *emu, emu10k1_fx8010_code_t *icode)
 {
 	unsigned int i, j;
-	emu10k1_fx8010_control_gpr_t *_gctl, gctl;
+	emu10k1_fx8010_control_gpr_t __user *_gctl;
+	emu10k1_fx8010_control_gpr_t gctl;
 	snd_emu10k1_fx8010_ctl_t *ctl, nctl;
 	snd_kcontrol_new_t knew;
 	snd_kcontrol_t *kctl;
@@ -1012,7 +1015,8 @@ static void snd_emu10k1_add_controls(emu10k1_t *emu, emu10k1_fx8010_code_t *icod
 static void snd_emu10k1_del_controls(emu10k1_t *emu, emu10k1_fx8010_code_t *icode)
 {
 	unsigned int i;
-	snd_ctl_elem_id_t *_id, id;
+	snd_ctl_elem_id_t id;
+	snd_ctl_elem_id_t __user *_id;
 	snd_emu10k1_fx8010_ctl_t *ctl;
 	snd_card_t *card = emu->card;
 	
@@ -1031,7 +1035,8 @@ static int snd_emu10k1_list_controls(emu10k1_t *emu, emu10k1_fx8010_code_t *icod
 {
 	unsigned int i = 0, j;
 	unsigned int total = 0;
-	emu10k1_fx8010_control_gpr_t *_gctl, gctl;
+	emu10k1_fx8010_control_gpr_t gctl;
+	emu10k1_fx8010_control_gpr_t __user *_gctl;
 	snd_emu10k1_fx8010_ctl_t *ctl;
 	snd_ctl_elem_id_t *id;
 	struct list_head *list;
@@ -2297,6 +2302,7 @@ static int snd_emu10k1_fx8010_ioctl(snd_hwdep_t * hw, struct file *file, unsigne
 	emu10k1_fx8010_code_t *icode;
 	emu10k1_fx8010_pcm_t *ipcm;
 	unsigned int addr;
+	void __user *argp = (void __user *)arg;
 	int res;
 	
 	switch (cmd) {
@@ -2308,7 +2314,7 @@ static int snd_emu10k1_fx8010_ioctl(snd_hwdep_t * hw, struct file *file, unsigne
 			kfree(info);
 			return res;
 		}
-		if (copy_to_user((void *)arg, info, sizeof(*info))) {
+		if (copy_to_user(argp, info, sizeof(*info))) {
 			kfree(info);
 			return -EFAULT;
 		}
@@ -2320,7 +2326,7 @@ static int snd_emu10k1_fx8010_ioctl(snd_hwdep_t * hw, struct file *file, unsigne
 		icode = (emu10k1_fx8010_code_t *)kmalloc(sizeof(*icode), GFP_KERNEL);
 		if (icode == NULL)
 			return -ENOMEM;
-		if (copy_from_user(icode, (void *)arg, sizeof(*icode))) {
+		if (copy_from_user(icode, argp, sizeof(*icode))) {
 			kfree(icode);
 			return -EFAULT;
 		}
@@ -2331,12 +2337,12 @@ static int snd_emu10k1_fx8010_ioctl(snd_hwdep_t * hw, struct file *file, unsigne
 		icode = (emu10k1_fx8010_code_t *)kmalloc(sizeof(*icode), GFP_KERNEL);
 		if (icode == NULL)
 			return -ENOMEM;
-		if (copy_from_user(icode, (void *)arg, sizeof(*icode))) {
+		if (copy_from_user(icode, argp, sizeof(*icode))) {
 			kfree(icode);
 			return -EFAULT;
 		}
 		res = snd_emu10k1_icode_peek(emu, icode);
-		if (res == 0 && copy_to_user((void *)arg, icode, sizeof(*icode))) {
+		if (res == 0 && copy_to_user(argp, icode, sizeof(*icode))) {
 			kfree(icode);
 			return -EFAULT;
 		}
@@ -2348,7 +2354,7 @@ static int snd_emu10k1_fx8010_ioctl(snd_hwdep_t * hw, struct file *file, unsigne
 		ipcm = (emu10k1_fx8010_pcm_t *)kmalloc(sizeof(*ipcm), GFP_KERNEL);
 		if (ipcm == NULL)
 			return -ENOMEM;
-		if (copy_from_user(ipcm, (void *)arg, sizeof(*ipcm))) {
+		if (copy_from_user(ipcm, argp, sizeof(*ipcm))) {
 			kfree(ipcm);
 			return -EFAULT;
 		}
@@ -2361,12 +2367,12 @@ static int snd_emu10k1_fx8010_ioctl(snd_hwdep_t * hw, struct file *file, unsigne
 		ipcm = (emu10k1_fx8010_pcm_t *)snd_kcalloc(sizeof(*ipcm), GFP_KERNEL);
 		if (ipcm == NULL)
 			return -ENOMEM;
-		if (copy_from_user(ipcm, (void *)arg, sizeof(*ipcm))) {
+		if (copy_from_user(ipcm, argp, sizeof(*ipcm))) {
 			kfree(ipcm);
 			return -EFAULT;
 		}
 		res = snd_emu10k1_ipcm_peek(emu, ipcm);
-		if (res == 0 && copy_to_user((void *)arg, ipcm, sizeof(*ipcm))) {
+		if (res == 0 && copy_to_user(argp, ipcm, sizeof(*ipcm))) {
 			kfree(ipcm);
 			return -EFAULT;
 		}
@@ -2377,7 +2383,7 @@ static int snd_emu10k1_fx8010_ioctl(snd_hwdep_t * hw, struct file *file, unsigne
 			return -EINVAL;
 		if (!capable(CAP_SYS_ADMIN))
 			return -EPERM;
-		if (get_user(addr, (unsigned int *)arg))
+		if (get_user(addr, (unsigned int __user *)argp))
 			return -EFAULT;
 		down(&emu->fx8010.lock);
 		res = snd_emu10k1_fx8010_tram_setup(emu, addr);
@@ -2415,7 +2421,7 @@ static int snd_emu10k1_fx8010_ioctl(snd_hwdep_t * hw, struct file *file, unsigne
 	case SNDRV_EMU10K1_IOCTL_SINGLE_STEP:
 		if (!capable(CAP_SYS_ADMIN))
 			return -EPERM;
-		if (get_user(addr, (unsigned int *)arg))
+		if (get_user(addr, (unsigned int __user *)argp))
 			return -EFAULT;
 		if (addr > 0x1ff)
 			return -EINVAL;
@@ -2434,7 +2440,7 @@ static int snd_emu10k1_fx8010_ioctl(snd_hwdep_t * hw, struct file *file, unsigne
 			addr = snd_emu10k1_ptr_read(emu, A_DBG, 0);
 		else
 			addr = snd_emu10k1_ptr_read(emu, DBG, 0);
-		if (put_user(addr, (unsigned int *)arg))
+		if (put_user(addr, (unsigned int __user *)argp))
 			return -EFAULT;
 		return 0;
 	}

sound/pci/emu10k1/emuproc.c

@@ -191,7 +191,7 @@ static void snd_emu10k1_proc_acode_read(snd_info_entry_t *entry,
 #define TOTAL_SIZE_CODE		(0x200*8)
 
 static long snd_emu10k1_fx8010_read(snd_info_entry_t *entry, void *file_private_data,
-				    struct file *file, char *buf, long count)
+				    struct file *file, char __user *buf, long count)
 {
 	long size;
 	emu10k1_t *emu = snd_magic_cast(emu10k1_t, entry->private_data, return -ENXIO);