[PATCH] sparse: misc ->read()/->write() __user annotation

a bunch of trivial ->read() and ->write() instances (and their procfs
relatives) __user-annotated.  All chunks are independent, but IMO not
worth splitting.

arch/alpha/kernel/irq.c

@@ -260,7 +260,7 @@ irq_affinity_read_proc (char *page, char **start, off_t off,
 }
 
 static unsigned int
-parse_hex_value (const char *buffer,
+parse_hex_value (const char __user *buffer,
 		 unsigned long count, unsigned long *ret)
 {
 	unsigned char hexnum [HEX_DIGITS];
@@ -298,7 +298,7 @@ parse_hex_value (const char *buffer,
 }
 
 static int
-irq_affinity_write_proc(struct file *file, const char *buffer,
+irq_affinity_write_proc(struct file *file, const char __user *buffer,
 			unsigned long count, void *data)
 {
 	int irq = (long) data, full_count = count, err;
@@ -341,7 +341,7 @@ prof_cpu_mask_read_proc(char *page, char **start, off_t off,
 }
 
 static int
-prof_cpu_mask_write_proc(struct file *file, const char *buffer,
+prof_cpu_mask_write_proc(struct file *file, const char __user *buffer,
 			 unsigned long count, void *data)
 {
 	unsigned long *mask = (unsigned long *) data, full_count = count, err;

arch/alpha/kernel/srm_env.c

@@ -132,7 +132,7 @@ srm_env_read(char *page, char **start, off_t off, int count, int *eof,
 
 
 static int
-srm_env_write(struct file *file, const char *buffer, unsigned long count,
+srm_env_write(struct file *file, const char __user *buffer, unsigned long count,
 		void *data)
 {
 	int res;

arch/i386/kernel/cpuid.c

@@ -107,10 +107,10 @@ static loff_t cpuid_seek(struct file *file, loff_t offset, int orig)
 	return ret;
 }
 
-static ssize_t cpuid_read(struct file *file, char *buf,
+static ssize_t cpuid_read(struct file *file, char __user *buf,
 			  size_t count, loff_t * ppos)
 {
-	u32 *tmp = (u32 *) buf;
+	char __user *tmp = buf;
 	u32 data[4];
 	size_t rv;
 	u32 reg = *ppos;
@@ -123,11 +123,11 @@ static ssize_t cpuid_read(struct file *file, char *buf,
 		do_cpuid(cpu, reg, data);
 		if (copy_to_user(tmp, &data, 16))
 			return -EFAULT;
-		tmp += 4;
+		tmp += 16;
 		*ppos = reg++;
 	}
 
-	return ((char *)tmp) - buf;
+	return tmp - buf;
 }
 
 static int cpuid_open(struct inode *inode, struct file *file)

arch/x86_64/kernel/irq.c

@@ -833,7 +833,8 @@ static int irq_affinity_read_proc (char *page, char **start, off_t off,
 	return len;
 }
 
-static int irq_affinity_write_proc (struct file *file, const char *buffer,
+static int irq_affinity_write_proc (struct file *file,
+					const char __user *buffer,
 					unsigned long count, void *data)
 {
 	int irq = (long) data, full_count = count, err;
@@ -871,7 +872,8 @@ static int prof_cpu_mask_read_proc (char *page, char **start, off_t off,
 	return len;
 }
 
-static int prof_cpu_mask_write_proc (struct file *file, const char *buffer,
+static int prof_cpu_mask_write_proc (struct file *file,
+					const char __user *buffer,
 					unsigned long count, void *data)
 {
 	unsigned long full_count = count, err;

arch/x86_64/kernel/mce.c

@@ -297,12 +297,12 @@ static void collect_tscs(void *data)
 	rdtscll(cpu_tsc[smp_processor_id()]);
 } 
 
-static ssize_t mce_read(struct file *filp, char *ubuf, size_t usize, loff_t *off)
+static ssize_t mce_read(struct file *filp, char __user *ubuf, size_t usize, loff_t *off)
 {
 	unsigned long cpu_tsc[NR_CPUS];
 	static DECLARE_MUTEX(mce_read_sem);
 	unsigned next;
-	char *buf = ubuf;
+	char __user *buf = ubuf;
 	int i, err;
 
 	down(&mce_read_sem); 
@@ -348,19 +348,20 @@ static ssize_t mce_read(struct file *filp, char *ubuf, size_t usize, loff_t *off
 
 static int mce_ioctl(struct inode *i, struct file *f,unsigned int cmd, unsigned long arg)
 {
+	int __user *p = (int __user *)arg;
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM; 
 	switch (cmd) {
 	case MCE_GET_RECORD_LEN: 
-		return put_user(sizeof(struct mce), (int *)arg);
+		return put_user(sizeof(struct mce), p);
 	case MCE_GET_LOG_LEN:
-		return put_user(MCE_LOG_LEN, (int *)arg);		
+		return put_user(MCE_LOG_LEN, p);		
 	case MCE_GETCLEAR_FLAGS: {
 		unsigned flags;
 		do { 
 			flags = mcelog.flags;
 		} while (cmpxchg(&mcelog.flags, flags, 0) != flags); 
-		return put_user(flags, (int *)arg); 
+		return put_user(flags, p); 
 	}
 	default:
 		return -ENOTTY; 

arch/x86_64/kernel/msr.c

@@ -186,10 +186,10 @@ static loff_t msr_seek(struct file *file, loff_t offset, int orig)
   return ret;
 }
 
-static ssize_t msr_read(struct file * file, char * buf,
+static ssize_t msr_read(struct file * file, char __user * buf,
 			size_t count, loff_t *ppos)
 {
-  u32 *tmp = (u32 *)buf;
+  char __user *tmp = buf;
   u32 data[2];
   size_t rv;
   u32 reg = *ppos;
@@ -205,16 +205,16 @@ static ssize_t msr_read(struct file * file, char * buf,
       return err;
     if ( copy_to_user(tmp,&data,8) )
       return -EFAULT;
-    tmp += 2;
+    tmp += 8;
   }
 
-  return ((char *)tmp) - buf;
+  return tmp - buf;
 }
 
-static ssize_t msr_write(struct file * file, const char * buf,
+static ssize_t msr_write(struct file * file, const char __user * buf,
 			 size_t count, loff_t *ppos)
 {
-  const u32 *tmp = (const u32 *)buf;
+  const char __user *tmp = buf;
   u32 data[2];
   size_t rv;
   u32 reg = *ppos;
@@ -230,10 +230,10 @@ static ssize_t msr_write(struct file * file, const char * buf,
     err = do_wrmsr(cpu, reg, data[0], data[1]);
     if ( err )
       return err;
-    tmp += 2;
+    tmp += 8;
   }
 
-  return ((char *)tmp) - buf;
+  return tmp - buf;
 }
 
 static int msr_open(struct inode *inode, struct file *file)

drivers/usb/host/uhci-debug.c

@@ -567,8 +567,8 @@ static loff_t uhci_proc_lseek(struct file *file, loff_t off, int whence)
 	return (file->f_pos = new);
 }
 
-static ssize_t uhci_proc_read(struct file *file, char *buf, size_t nbytes,
-			loff_t *ppos)
+static ssize_t uhci_proc_read(struct file *file, char __user *buf,
+				size_t nbytes, loff_t *ppos)
 {
 	struct uhci_proc *up = file->private_data;
 	unsigned int pos;
@@ -578,14 +578,9 @@ static ssize_t uhci_proc_read(struct file *file, char *buf, size_t nbytes,
 	size = up->size;
 	if (pos >= size)
 		return 0;
-	if (nbytes >= size)
-		nbytes = size;
-	if (pos + nbytes > size)
+	if (nbytes > size - pos)
 		nbytes = size - pos;
 
-	if (!access_ok(VERIFY_WRITE, buf, nbytes))
-		return -EINVAL;
-
 	if (copy_to_user(buf, up->data + pos, nbytes))
 		return -EFAULT;