[PATCH] sparse: ->[gs]etsockopt() annotation

	optval (and in case of getsockopt - optlen) made __user, changes
percolated down into the instances.

include/linux/igmp.h

@@ -204,9 +204,9 @@ extern int ip_mc_source(int add, int omode, struct sock *sk,
 		struct ip_mreq_source *mreqs, int ifindex);
 extern int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf,int ifindex);
 extern int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
-		struct ip_msfilter *optval, int *optlen);
+		struct ip_msfilter __user *optval, int __user *optlen);
 extern int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
-		struct group_filter *optval, int *optlen);
+		struct group_filter __user *optval, int __user *optlen);
 extern int ip_mc_sf_allow(struct sock *sk, u32 local, u32 rmt, int dif);
 extern void ip_mr_init(void);
 extern void ip_mc_init_dev(struct in_device *);

include/linux/mroute.h

@@ -128,8 +128,8 @@ struct igmpmsg
 #ifdef __KERNEL__
 #include <net/sock.h>
 
-extern int ip_mroute_setsockopt(struct sock *, int, char *, int);
-extern int ip_mroute_getsockopt(struct sock *, int, char *, int *);
+extern int ip_mroute_setsockopt(struct sock *, int, char __user *, int);
+extern int ip_mroute_getsockopt(struct sock *, int, char __user *, int __user *);
 extern int ipmr_ioctl(struct sock *sk, int cmd, unsigned long arg);
 extern void ip_mr_init(void);
 

include/net/inet_common.h

@@ -31,11 +31,13 @@ extern int			inet_sendmsg(struct kiocb *iocb,
 extern int			inet_shutdown(struct socket *sock, int how);
 extern unsigned int		inet_poll(struct file * file, struct socket *sock, struct poll_table_struct *wait);
 extern int			inet_setsockopt(struct socket *sock, int level,
-						int optname, char *optval, 
+						int optname,
+						char __user *optval, 
 						int optlen);
 extern int			inet_getsockopt(struct socket *sock, int level,
-						int optname, char *optval, 
-						int *optlen);
+						int optname,
+						char __user *optval, 
+						int __user *optlen);
 extern int			inet_listen(struct socket *sock, int backlog);
 
 extern void			inet_sock_release(struct sock *sk);

include/net/ip.h

@@ -284,8 +284,8 @@ extern int ip_options_rcv_srr(struct sk_buff *skb);
 
 extern void	ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb);
 extern int	ip_cmsg_send(struct msghdr *msg, struct ipcm_cookie *ipc);
-extern int	ip_setsockopt(struct sock *sk, int level, int optname, char *optval, int optlen);
-extern int	ip_getsockopt(struct sock *sk, int level, int optname, char *optval, int *optlen);
+extern int	ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval, int optlen);
+extern int	ip_getsockopt(struct sock *sk, int level, int optname, char __user *optval, int __user *optlen);
 extern int	ip_ra_control(struct sock *sk, unsigned char on, void (*destructor)(struct sock *));
 
 extern int 	ip_recv_error(struct sock *sk, struct msghdr *msg, int len);

include/net/ipv6.h

@@ -215,7 +215,7 @@ extern struct ipv6_txoptions	*fl6_merge_options(struct ipv6_txoptions * opt_spac
 						   struct ip6_flowlabel * fl,
 						   struct ipv6_txoptions * fopt);
 extern void			fl6_free_socklist(struct sock *sk);
-extern int			ipv6_flowlabel_opt(struct sock *sk, char *optval, int optlen);
+extern int			ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen);
 extern void			ip6_flowlabel_init(void);
 extern void			ip6_flowlabel_cleanup(void);
 
@@ -395,11 +395,13 @@ extern struct ipv6_txoptions *	ipv6_invert_rthdr(struct sock *sk,
  */
 
 extern int			ipv6_setsockopt(struct sock *sk, int level, 
-						int optname, char *optval, 
+						int optname,
+						char __user *optval, 
 						int optlen);
 extern int			ipv6_getsockopt(struct sock *sk, int level, 
-						int optname, char *optval, 
-						int *optlen);
+						int optname,
+						char __user *optval, 
+						int __user *optlen);
 
 extern void			ipv6_packet_init(void);
 

include/net/sock.h

@@ -430,10 +430,11 @@ struct proto {
 	int			(*destroy)(struct sock *sk);
 	void			(*shutdown)(struct sock *sk, int how);
 	int			(*setsockopt)(struct sock *sk, int level, 
-					int optname, char *optval, int optlen);
+					int optname, char __user *optval,
+					int optlen);
 	int			(*getsockopt)(struct sock *sk, int level, 
-					int optname, char *optval, 
-					int *option);  	 
+					int optname, char __user *optval, 
+					int __user *option);  	 
 	int			(*sendmsg)(struct kiocb *iocb, struct sock *sk,
 					   struct msghdr *msg, size_t len);
 	int			(*recvmsg)(struct kiocb *iocb, struct sock *sk,

include/net/tcp.h

@@ -722,14 +722,14 @@ struct tcp_func {
 	int			(*setsockopt)		(struct sock *sk, 
 							 int level, 
 							 int optname, 
-							 char *optval, 
+							 char __user *optval, 
 							 int optlen);
 
 	int			(*getsockopt)		(struct sock *sk, 
 							 int level, 
 							 int optname, 
-							 char *optval, 
-							 int *optlen);
+							 char __user *optval, 
+							 int __user *optlen);
 
 
 	void			(*addr2sockaddr)	(struct sock *sk,
@@ -873,10 +873,11 @@ extern unsigned int		tcp_poll(struct file * file, struct socket *sock, struct po
 extern void			tcp_write_space(struct sock *sk); 
 
 extern int			tcp_getsockopt(struct sock *sk, int level, 
-					       int optname, char *optval, 
-					       int *optlen);
+					       int optname,
+					       char __user *optval, 
+					       int __user *optlen);
 extern int			tcp_setsockopt(struct sock *sk, int level, 
-					       int optname, char *optval, 
+					       int optname, char __user *optval, 
 					       int optlen);
 extern void			tcp_set_keepalive(struct sock *sk, int val);
 extern int			tcp_recvmsg(struct kiocb *iocb, struct sock *sk,

include/net/xfrm.h

@@ -821,10 +821,10 @@ extern int xfrm6_rcv(struct sk_buff **pskb, unsigned int *nhoffp);
 
 #ifdef CONFIG_XFRM
 extern int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type);
-extern int xfrm_user_policy(struct sock *sk, int optname, u8 *optval, int optlen);
+extern int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen);
 extern int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsigned short family);
 #else
-static inline int xfrm_user_policy(struct sock *sk, int optname, u8 *optval, int optlen)
+static inline int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
 {
  	return -ENOPROTOOPT;
 } 

net/atm/pvc.c

@@ -60,7 +60,7 @@ static int pvc_connect(struct socket *sock,struct sockaddr *sockaddr,
 }
 
 static int pvc_setsockopt(struct socket *sock, int level, int optname,
-			  char *optval, int optlen)
+			  char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	int error;
@@ -73,7 +73,7 @@ static int pvc_setsockopt(struct socket *sock, int level, int optname,
 
 
 static int pvc_getsockopt(struct socket *sock, int level, int optname,
-		          char *optval, int *optlen)
+		          char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	int error;

net/atm/svc.c

@@ -459,7 +459,7 @@ int svc_change_qos(struct atm_vcc *vcc,struct atm_qos *qos)
 
 
 static int svc_setsockopt(struct socket *sock,int level,int optname,
-    char *optval,int optlen)
+    char __user *optval,int optlen)
 {
 	struct sock *sk = sock->sk;
 	struct atm_vcc *vcc;
@@ -483,7 +483,7 @@ static int svc_setsockopt(struct socket *sock,int level,int optname,
 
 
 static int svc_getsockopt(struct socket *sock,int level,int optname,
-    char *optval,int *optlen)
+    char __user *optval,int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	int error = 0, len;

net/ax25/af_ax25.c

@@ -508,7 +508,7 @@ ax25_cb *ax25_create_cb(void)
  */
 
 static int ax25_setsockopt(struct socket *sock, int level, int optname,
-	char *optval, int optlen)
+	char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	ax25_cb *ax25;
@@ -522,7 +522,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 	if (optlen < sizeof(int))
 		return -EINVAL;
 
-	if (get_user(opt, (int *)optval))
+	if (get_user(opt, (int __user *)optval))
 		return -EFAULT;
 
 	lock_sock(sk);
@@ -648,7 +648,7 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 }
 
 static int ax25_getsockopt(struct socket *sock, int level, int optname,
-	char *optval, int *optlen)
+	char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	ax25_cb *ax25;

net/bluetooth/hci_sock.c

@@ -439,7 +439,7 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 	goto done;
 }
 
-int hci_sock_setsockopt(struct socket *sock, int level, int optname, char *optval, int len)
+int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int len)
 {
 	struct hci_ufilter uf = { .opcode = 0 };
 	struct sock *sk = sock->sk;
@@ -451,7 +451,7 @@ int hci_sock_setsockopt(struct socket *sock, int level, int optname, char *optva
 
 	switch (optname) {
 	case HCI_DATA_DIR:
-		if (get_user(opt, (int *)optval)) {
+		if (get_user(opt, (int __user *)optval)) {
 			err = -EFAULT;
 			break;
 		}
@@ -463,7 +463,7 @@ int hci_sock_setsockopt(struct socket *sock, int level, int optname, char *optva
 		break;
 
 	case HCI_TIME_STAMP:
-		if (get_user(opt, (int *)optval)) {
+		if (get_user(opt, (int __user *)optval)) {
 			err = -EFAULT;
 			break;
 		}
@@ -506,7 +506,7 @@ int hci_sock_setsockopt(struct socket *sock, int level, int optname, char *optva
 	return err;
 }
 
-int hci_sock_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen)
+int hci_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 {
 	struct hci_ufilter uf;
 	struct sock *sk = sock->sk;

net/bluetooth/l2cap.c

@@ -735,7 +735,7 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 	return err;
 }
 
-static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen)
+static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	struct l2cap_options opts;
@@ -758,7 +758,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
 		break;
 
 	case L2CAP_LM:
-		if (get_user(opt, (u32 *)optval)) {
+		if (get_user(opt, (u32 __user *)optval)) {
 			err = -EFAULT;
 			break;
 		}
@@ -775,7 +775,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
 	return err;
 }
 
-static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen)
+static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	struct l2cap_options opts;
@@ -800,7 +800,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
 		break;
 
 	case L2CAP_LM:
-		if (put_user(l2cap_pi(sk)->link_mode, (u32 *)optval))
+		if (put_user(l2cap_pi(sk)->link_mode, (u32 __user *)optval))
 			err = -EFAULT;
 		break;
 

net/bluetooth/rfcomm/sock.c

@@ -637,7 +637,7 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 	return copied ? : err;
 }
 
-static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen)
+static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	int err = 0;
@@ -656,7 +656,7 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 	return err;
 }
 
-static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen)
+static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	int len, err = 0; 

net/bluetooth/sco.c

@@ -655,7 +655,7 @@ static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 	return err;
 }
 
-static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen)
+static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	int err = 0;
@@ -674,7 +674,7 @@ static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char
 	return err;
 }
 
-static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen)
+static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	struct sco_options opts;

net/decnet/af_decnet.c

@@ -155,8 +155,8 @@ static rwlock_t dn_hash_lock = RW_LOCK_UNLOCKED;
 static struct hlist_head dn_sk_hash[DN_SK_HASH_SIZE];
 static struct hlist_head dn_wild_sk;
 
-static int __dn_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen, int flags);
-static int __dn_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen, int flags);
+static int __dn_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen, int flags);
+static int __dn_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen, int flags);
 
 static struct hlist_head *dn_find_list(struct sock *sk)
 {
@@ -1313,7 +1313,7 @@ static int dn_shutdown(struct socket *sock, int how)
 	return err;
 }
 
-static int dn_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen)
+static int dn_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	int err;
@@ -1325,7 +1325,7 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char *optv
 	return err;
 }
 
-static int __dn_setsockopt(struct socket *sock, int level,int optname, char *optval, int optlen, int flags) 
+static int __dn_setsockopt(struct socket *sock, int level,int optname, char __user __user *optval, int optlen, int flags) 
 {
 	struct	sock *sk = sock->sk;
 	struct dn_scp *scp = DN_SK(sk);
@@ -1490,7 +1490,7 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char *opt
 	return 0;
 }
 
-static int dn_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen)
+static int dn_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	int err;
@@ -1502,7 +1502,7 @@ static int dn_getsockopt(struct socket *sock, int level, int optname, char *optv
 	return err;
 }
 
-static int __dn_getsockopt(struct socket *sock, int level,int optname, char *optval,int *optlen, int flags)
+static int __dn_getsockopt(struct socket *sock, int level,int optname, char __user *optval,int __user *optlen, int flags)
 {
 	struct	sock *sk = sock->sk;
 	struct dn_scp *scp = DN_SK(sk);

net/ipv4/af_inet.c

@@ -216,7 +216,7 @@ void inet_sock_release(struct sock *sk)
  *	Set socket options on an inet socket.
  */
 int inet_setsockopt(struct socket *sock, int level, int optname,
-		    char *optval, int optlen)
+		    char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 
@@ -232,7 +232,7 @@ int inet_setsockopt(struct socket *sock, int level, int optname,
  */
 
 int inet_getsockopt(struct socket *sock, int level, int optname,
-		    char *optval, int *optlen)
+		    char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 

net/ipv4/igmp.c

@@ -1913,7 +1913,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
 }
 
 int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
-	struct ip_msfilter *optval, int *optlen)
+	struct ip_msfilter __user *optval, int __user *optlen)
 {
 	int err, len, count, copycount;
 	struct ip_mreqn	imr;
@@ -1959,11 +1959,11 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
 	len = copycount * sizeof(psl->sl_addr[0]);
 	msf->imsf_numsrc = count;
 	if (put_user(IP_MSFILTER_SIZE(copycount), optlen) ||
-	    copy_to_user((void *)optval, msf, IP_MSFILTER_SIZE(0))) {
+	    copy_to_user(optval, msf, IP_MSFILTER_SIZE(0))) {
 		return -EFAULT;
 	}
 	if (len &&
-	    copy_to_user((void *)&optval->imsf_slist[0], psl->sl_addr, len))
+	    copy_to_user(&optval->imsf_slist[0], psl->sl_addr, len))
 		return -EFAULT;
 	return 0;
 done:
@@ -1972,7 +1972,7 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
 }
 
 int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
-	struct group_filter *optval, int *optlen)
+	struct group_filter __user *optval, int __user *optlen)
 {
 	int err, i, count, copycount;
 	struct sockaddr_in *psin;
@@ -2006,7 +2006,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
 	copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
 	gsf->gf_numsrc = count;
 	if (put_user(GROUP_FILTER_SIZE(copycount), optlen) ||
-	    copy_to_user((void *)optval, gsf, GROUP_FILTER_SIZE(0))) {
+	    copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
 		return -EFAULT;
 	}
 	for (i=0; i<copycount; i++) {
@@ -2017,7 +2017,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
 		memset(&ss, 0, sizeof(ss));
 		psin->sin_family = AF_INET;
 		psin->sin_addr.s_addr = psl->sl_addr[i];
-		if (copy_to_user((void *)&optval->gf_slist[i], &ss, sizeof(ss)))
+		if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss)))
 			return -EFAULT;
 	}
 	return 0;

net/ipv4/ip_sockglue.c

@@ -384,7 +384,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
  *	an IP socket.
  */
 
-int ip_setsockopt(struct sock *sk, int level, int optname, char *optval, int optlen)
+int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval, int optlen)
 {
 	struct inet_opt *inet = inet_sk(sk);
 	int val=0,err;
@@ -401,12 +401,12 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char *optval, int opt
 				optname == IP_MULTICAST_TTL || 
 				optname == IP_MULTICAST_LOOP) { 
 		if (optlen >= sizeof(int)) {
-			if (get_user(val, (int *) optval))
+			if (get_user(val, (int __user *) optval))
 				return -EFAULT;
 		} else if (optlen >= sizeof(char)) {
 			unsigned char ucval;
 
-			if (get_user(ucval, (unsigned char *) optval))
+			if (get_user(ucval, (unsigned char __user *) optval))
 				return -EFAULT;
 			val = (int) ucval;
 		}
@@ -875,7 +875,7 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char *optval, int opt
  *	_received_ ones. The set sets the _sent_ ones.
  */
 
-int ip_getsockopt(struct sock *sk, int level, int optname, char *optval, int *optlen)
+int ip_getsockopt(struct sock *sk, int level, int optname, char __user *optval, int __user *optlen)
 {
 	struct inet_opt *inet = inet_sk(sk);
 	int val;
@@ -984,7 +984,7 @@ int ip_getsockopt(struct sock *sk, int level, int optname, char *optval, int *op
 
   			if(put_user(len, optlen))
   				return -EFAULT;
-			if(copy_to_user((void *)optval, &addr, len))
+			if(copy_to_user(optval, &addr, len))
 				return -EFAULT;
 			return 0;
 		}
@@ -1002,7 +1002,7 @@ int ip_getsockopt(struct sock *sk, int level, int optname, char *optval, int *op
 				return -EFAULT;
 			}
 			err = ip_mc_msfget(sk, &msf,
-				(struct ip_msfilter *)optval, optlen);
+				(struct ip_msfilter __user *)optval, optlen);
 			release_sock(sk);
 			return err;
 		}
@@ -1020,7 +1020,7 @@ int ip_getsockopt(struct sock *sk, int level, int optname, char *optval, int *op
 				return -EFAULT;
 			}
 			err = ip_mc_gsfget(sk, &gsf,
-				(struct group_filter *)optval, optlen);
+				(struct group_filter __user *)optval, optlen);
 			release_sock(sk);
 			return err;
 		}

net/ipv4/ipmr.c

@@ -844,7 +844,7 @@ static void mrtsock_destruct(struct sock *sk)
  *	MOSPF/PIM router set up we can clean this up.
  */
  
-int ip_mroute_setsockopt(struct sock *sk,int optname,char *optval,int optlen)
+int ip_mroute_setsockopt(struct sock *sk,int optname,char __user *optval,int optlen)
 {
 	int ret;
 	struct vifctl vif;
@@ -925,7 +925,7 @@ int ip_mroute_setsockopt(struct sock *sk,int optname,char *optval,int optlen)
 		case MRT_ASSERT:
 		{
 			int v;
-			if(get_user(v,(int *)optval))
+			if(get_user(v,(int __user *)optval))
 				return -EFAULT;
 			mroute_do_assert=(v)?1:0;
 			return 0;
@@ -934,7 +934,7 @@ int ip_mroute_setsockopt(struct sock *sk,int optname,char *optval,int optlen)
 		case MRT_PIM:
 		{
 			int v, ret;
-			if(get_user(v,(int *)optval))
+			if(get_user(v,(int __user *)optval))
 				return -EFAULT;
 			v = (v)?1:0;
 			rtnl_lock();
@@ -970,7 +970,7 @@ int ip_mroute_setsockopt(struct sock *sk,int optname,char *optval,int optlen)
  *	Getsock opt support for the multicast routing system.
  */
  
-int ip_mroute_getsockopt(struct sock *sk,int optname,char *optval,int *optlen)
+int ip_mroute_getsockopt(struct sock *sk,int optname,char __user *optval,int __user *optlen)
 {
 	int olr;
 	int val;

net/ipv4/raw.c

@@ -568,7 +568,7 @@ static int raw_init(struct sock *sk)
 	return 0;
 }
 
-static int raw_seticmpfilter(struct sock *sk, char *optval, int optlen)
+static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
 {
 	if (optlen > sizeof(struct icmp_filter))
 		optlen = sizeof(struct icmp_filter);
@@ -577,7 +577,7 @@ static int raw_seticmpfilter(struct sock *sk, char *optval, int optlen)
 	return 0;
 }
 
-static int raw_geticmpfilter(struct sock *sk, char *optval, int *optlen)
+static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
 {
 	int len, ret = -EFAULT;
 
@@ -597,7 +597,7 @@ out:	return ret;
 }
 
 static int raw_setsockopt(struct sock *sk, int level, int optname, 
-			  char *optval, int optlen)
+			  char __user *optval, int optlen)
 {
 	if (level != SOL_RAW)
 		return ip_setsockopt(sk, level, optname, optval, optlen);
@@ -612,7 +612,7 @@ static int raw_setsockopt(struct sock *sk, int level, int optname,
 }
 
 static int raw_getsockopt(struct sock *sk, int level, int optname, 
-			  char *optval, int *optlen)
+			  char __user *optval, int __user *optlen)
 {
 	if (level != SOL_RAW)
 		return ip_getsockopt(sk, level, optname, optval, optlen);

net/ipv4/tcp.c

@@ -2278,7 +2278,7 @@ struct sock *tcp_accept(struct sock *sk, int flags, int *err)
 /*
  *	Socket option code for TCP.
  */
-int tcp_setsockopt(struct sock *sk, int level, int optname, char *optval,
+int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 		   int optlen)
 {
 	struct tcp_opt *tp = tcp_sk(sk);
@@ -2292,7 +2292,7 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char *optval,
 	if (optlen < sizeof(int))
 		return -EINVAL;
 
-	if (get_user(val, (int *)optval))
+	if (get_user(val, (int __user *)optval))
 		return -EFAULT;
 
 	lock_sock(sk);
@@ -2442,8 +2442,8 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char *optval,
 	return err;
 }
 
-int tcp_getsockopt(struct sock *sk, int level, int optname, char *optval,
-		   int *optlen)
+int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
+		   int __user *optlen)
 {
 	struct tcp_opt *tp = tcp_sk(sk);
 	int val, len;

net/ipv4/udp.c

@@ -1269,7 +1269,7 @@ static int udp_destroy_sock(struct sock *sk)
  *	Socket option code for UDP
  */
 static int udp_setsockopt(struct sock *sk, int level, int optname, 
-			  char *optval, int optlen)
+			  char __user *optval, int optlen)
 {
 	struct udp_opt *up = udp_sk(sk);
 	int val;
@@ -1281,7 +1281,7 @@ static int udp_setsockopt(struct sock *sk, int level, int optname,
 	if(optlen<sizeof(int))
 		return -EINVAL;
 
-	if (get_user(val, (int *)optval))
+	if (get_user(val, (int __user *)optval))
 		return -EFAULT;
 
 	switch(optname) {
@@ -1309,7 +1309,7 @@ static int udp_setsockopt(struct sock *sk, int level, int optname,
 }
 
 static int udp_getsockopt(struct sock *sk, int level, int optname, 
-			  char *optval, int *optlen)
+			  char __user *optval, int __user *optlen)
 {
 	struct udp_opt *up = udp_sk(sk);
 	int val, len;

net/ipv6/ip6_flowlabel.c

@@ -277,7 +277,7 @@ static int fl6_renew(struct ip6_flowlabel *fl, unsigned long linger, unsigned lo
 }
 
 static struct ip6_flowlabel *
-fl_create(struct in6_flowlabel_req *freq, char *optval, int optlen, int *err_p)
+fl_create(struct in6_flowlabel_req *freq, char __user *optval, int optlen, int *err_p)
 {
 	struct ip6_flowlabel *fl;
 	int olen;
@@ -407,7 +407,7 @@ static int ipv6_opt_cmp(struct ipv6_txoptions *o1, struct ipv6_txoptions *o2)
 	return 0;
 }
 
-int ipv6_flowlabel_opt(struct sock *sk, char *optval, int optlen)
+int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
 {
 	int err;
 	struct ipv6_pinfo *np = inet6_sk(sk);

net/ipv6/ipv6_sockglue.c

@@ -113,11 +113,11 @@ extern int ip6_mc_source(int add, int omode, struct sock *sk,
 	struct group_source_req *pgsr);
 extern int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf);
 extern int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
-	struct group_filter *optval, int *optlen);
+	struct group_filter __user *optval, int __user *optlen);
 
 
-int ipv6_setsockopt(struct sock *sk, int level, int optname, char *optval, 
-		    int optlen)
+int ipv6_setsockopt(struct sock *sk, int level, int optname,
+		    char __user *optval, int optlen)
 {
 	struct ipv6_pinfo *np = inet6_sk(sk);
 	int val, valbool;
@@ -131,7 +131,7 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname, char *optval,
 
 	if (optval == NULL)
 		val=0;
-	else if (get_user(val, (int *) optval))
+	else if (get_user(val, (int __user *) optval))
 		return -EFAULT;
 
 	valbool = (val!=0);
@@ -524,8 +524,8 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname, char *optval,
 	return -EINVAL;
 }
 
-int ipv6_getsockopt(struct sock *sk, int level, int optname, char *optval, 
-		    int *optlen)
+int ipv6_getsockopt(struct sock *sk, int level, int optname,
+		    char __user *optval, int __user *optlen)
 {
 	struct ipv6_pinfo *np = inet6_sk(sk);
 	int len;
@@ -557,7 +557,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname, char *optval,
 			return -EFAULT;
 		lock_sock(sk);
 		err = ip6_mc_msfget(sk, &gsf,
-			(struct group_filter *)optval, optlen);
+			(struct group_filter __user *)optval, optlen);
 		release_sock(sk);
 		return err;
 	}

net/ipv6/mcast.c

@@ -527,7 +527,7 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
 }
 
 int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
-	struct group_filter *optval, int *optlen)
+	struct group_filter __user *optval, int __user *optlen)
 {
 	int err, i, count, copycount;
 	struct in6_addr *group;
@@ -569,7 +569,7 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
 	copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
 	gsf->gf_numsrc = count;
 	if (put_user(GROUP_FILTER_SIZE(copycount), optlen) ||
-	    copy_to_user((void *)optval, gsf, GROUP_FILTER_SIZE(0))) {
+	    copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
 		return -EFAULT;
 	}
 	for (i=0; i<copycount; i++) {
@@ -580,7 +580,7 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
 		memset(&ss, 0, sizeof(ss));
 		psin6->sin6_family = AF_INET6;
 		psin6->sin6_addr = psl->sl_addr[i];
-	    	if (copy_to_user((void *)&optval->gf_slist[i], &ss, sizeof(ss)))
+	    	if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss)))
 			return -EFAULT;
 	}
 	return 0;

net/ipv6/raw.c

@@ -733,7 +733,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
 }
 
 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname, 
-			       char *optval, int optlen)
+			       char __user *optval, int optlen)
 {
 	switch (optname) {
 	case ICMPV6_FILTER:
@@ -750,7 +750,7 @@ static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
 }
 
 static int rawv6_geticmpfilter(struct sock *sk, int level, int optname, 
-			       char *optval, int *optlen)
+			       char __user *optval, int __user *optlen)
 {
 	int len;
 
@@ -776,7 +776,7 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
 
 
 static int rawv6_setsockopt(struct sock *sk, int level, int optname, 
-			    char *optval, int optlen)
+			    char __user *optval, int optlen)
 {
 	struct raw6_opt *opt = raw6_sk(sk);
 	int val;
@@ -798,7 +798,7 @@ static int rawv6_setsockopt(struct sock *sk, int level, int optname,
 					       optlen);
 	};
 
-  	if (get_user(val, (int *)optval))
+  	if (get_user(val, (int __user *)optval))
 		return -EFAULT;
 
 	switch (optname) {
@@ -823,7 +823,7 @@ static int rawv6_setsockopt(struct sock *sk, int level, int optname,
 }
 
 static int rawv6_getsockopt(struct sock *sk, int level, int optname, 
-			    char *optval, int *optlen)
+			    char __user *optval, int __user *optlen)
 {
 	struct raw6_opt *opt = raw6_sk(sk);
 	int val, len;

net/ipv6/udp.c

@@ -1026,7 +1026,7 @@ static int udpv6_destroy_sock(struct sock *sk)
  *	Socket option code for UDP
  */
 static int udpv6_setsockopt(struct sock *sk, int level, int optname, 
-			  char *optval, int optlen)
+			  char __user *optval, int optlen)
 {
 	struct udp_opt *up = udp_sk(sk);
 	int val;
@@ -1038,7 +1038,7 @@ static int udpv6_setsockopt(struct sock *sk, int level, int optname,
 	if(optlen<sizeof(int))
 		return -EINVAL;
 
-	if (get_user(val, (int *)optval))
+	if (get_user(val, (int __user *)optval))
 		return -EFAULT;
 
 	switch(optname) {
@@ -1066,7 +1066,7 @@ static int udpv6_setsockopt(struct sock *sk, int level, int optname,
 }
 
 static int udpv6_getsockopt(struct sock *sk, int level, int optname, 
-			  char *optval, int *optlen)
+			  char __user *optval, int __user *optlen)
 {
 	struct udp_opt *up = udp_sk(sk);
 	int val, len;

net/ipx/af_ipx.c

@@ -1285,7 +1285,7 @@ const char *ipx_device_name(struct ipx_interface *intrfc)
  * socket object. */
 
 static int ipx_setsockopt(struct socket *sock, int level, int optname,
-			  char *optval, int optlen)
+			  char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	int opt;
@@ -1295,7 +1295,7 @@ static int ipx_setsockopt(struct socket *sock, int level, int optname,
 		goto out;
 
 	rc = -EFAULT;
-	if (get_user(opt, (unsigned int *)optval))
+	if (get_user(opt, (unsigned int __user *)optval))
 		goto out;
 
 	rc = -ENOPROTOOPT;
@@ -1309,7 +1309,7 @@ static int ipx_setsockopt(struct socket *sock, int level, int optname,
 }
 
 static int ipx_getsockopt(struct socket *sock, int level, int optname,
-	char *optval, int *optlen)
+	char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	int val = 0;

net/irda/af_irda.c

@@ -1827,7 +1827,7 @@ static int irda_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
  *
  */
 static int irda_setsockopt(struct socket *sock, int level, int optname,
-			   char *optval, int optlen)
+			   char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	struct irda_sock *self = irda_sk(sk);
@@ -1860,7 +1860,7 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
 			return -ENOMEM;
 
 		/* Copy query to the driver. */
-		if (copy_from_user(ias_opt, (char *)optval, optlen)) {
+		if (copy_from_user(ias_opt, optval, optlen)) {
 			kfree(ias_opt);
 			return -EFAULT;
 		}
@@ -1962,7 +1962,7 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
 			return -ENOMEM;
 
 		/* Copy query to the driver. */
-		if (copy_from_user(ias_opt, (char *)optval, optlen)) {
+		if (copy_from_user(ias_opt, optval, optlen)) {
 			kfree(ias_opt);
 			return -EFAULT;
 		}
@@ -2012,7 +2012,7 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
 		if (optlen < sizeof(int))
 			return -EINVAL;
 
-		if (get_user(opt, (int *)optval))
+		if (get_user(opt, (int __user *)optval))
 			return -EFAULT;
 
 		/* Only possible for a seqpacket service (TTP with SAR) */
@@ -2031,7 +2031,7 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
 			return -EINVAL;
 
 		/* The input is really a (__u8 hints[2]), easier as an int */
-		if (get_user(opt, (int *)optval))
+		if (get_user(opt, (int __user *)optval))
 			return -EFAULT;
 
 		/* Unregister any old registration */
@@ -2050,7 +2050,7 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
 			return -EINVAL;
 
 		/* The input is really a (__u8 hints[2]), easier as an int */
-		if (get_user(opt, (int *)optval))
+		if (get_user(opt, (int __user *)optval))
 			return -EFAULT;
 
 		/* Set the new hint mask */
@@ -2121,7 +2121,7 @@ static int irda_extract_ias_value(struct irda_ias_set *ias_opt,
  * Function irda_getsockopt (sock, level, optname, optval, optlen)
  */
 static int irda_getsockopt(struct socket *sock, int level, int optname,
-			   char *optval, int *optlen)
+			   char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	struct irda_sock *self = irda_sk(sk);
@@ -2211,7 +2211,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 			return -ENOMEM;
 
 		/* Copy query to the driver. */
-		if (copy_from_user((char *) ias_opt, (char *)optval, len)) {
+		if (copy_from_user(ias_opt, optval, len)) {
 			kfree(ias_opt);
 			return -EFAULT;
 		}
@@ -2245,7 +2245,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 		}
 
 		/* Copy reply to the user */
-		if (copy_to_user((char *)optval, (char *) ias_opt,
+		if (copy_to_user(optval, ias_opt,
 				 sizeof(struct irda_ias_set))) {
 			kfree(ias_opt);
 			return -EFAULT;
@@ -2267,7 +2267,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 			return -ENOMEM;
 
 		/* Copy query to the driver. */
-		if (copy_from_user((char *) ias_opt, (char *)optval, len)) {
+		if (copy_from_user(ias_opt, optval, len)) {
 			kfree(ias_opt);
 			return -EFAULT;
 		}
@@ -2351,7 +2351,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 		}
 
 		/* Copy reply to the user */
-		if (copy_to_user((char *)optval, (char *) ias_opt,
+		if (copy_to_user(optval, ias_opt,
 				 sizeof(struct irda_ias_set))) {
 			kfree(ias_opt);
 			return -EFAULT;
@@ -2378,7 +2378,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 		if (len != sizeof(int))
 			return -EINVAL;
 		/* Get timeout in ms (max time we block the caller) */
-		if (get_user(val, (int *)optval))
+		if (get_user(val, (int __user *)optval))
 			return -EFAULT;
 
 		/* Tell IrLMP we want to be notified */
@@ -2438,7 +2438,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 		 * If the user want more details, he should query
 		 * the whole discovery log and pick one device...
 		 */
-		if (put_user(daddr, (int *)optval))
+		if (put_user(daddr, (int __user *)optval))
 			return -EFAULT;
 
 		break;

net/llc/af_llc.c

@@ -881,7 +881,7 @@ static int llc_ui_ioctl(struct socket *sock, unsigned int cmd,
  *	Set various connection specific parameters.
  */
 static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
-			     char *optval, int optlen)
+			     char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	struct llc_opt *llc = llc_sk(sk);
@@ -890,7 +890,7 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
 	lock_sock(sk);
 	if (level != SOL_LLC || optlen != sizeof(int))
 		goto out;
-	rc = get_user(opt, (int *)optval);
+	rc = get_user(opt, (int __user *)optval);
 	if (rc)
 		goto out;
 	rc = -EINVAL;
@@ -956,7 +956,7 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
  *	Get connection specific socket information.
  */
 static int llc_ui_getsockopt(struct socket *sock, int level, int optname,
-			     char *optval, int *optlen)
+			     char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	struct llc_opt *llc = llc_sk(sk);

net/netrom/af_netrom.c

@@ -297,7 +297,7 @@ void nr_destroy_socket(struct sock *sk)
  */
 
 static int nr_setsockopt(struct socket *sock, int level, int optname,
-	char *optval, int optlen)
+	char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	nr_cb *nr = nr_sk(sk);
@@ -309,7 +309,7 @@ static int nr_setsockopt(struct socket *sock, int level, int optname,
 	if (optlen < sizeof(int))
 		return -EINVAL;
 
-	if (get_user(opt, (int *)optval))
+	if (get_user(opt, (int __user *)optval))
 		return -EFAULT;
 
 	switch (optname) {
@@ -349,7 +349,7 @@ static int nr_setsockopt(struct socket *sock, int level, int optname,
 }
 
 static int nr_getsockopt(struct socket *sock, int level, int optname,
-	char *optval, int *optlen)
+	char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	nr_cb *nr = nr_sk(sk);

net/packet/af_packet.c

@@ -1292,7 +1292,7 @@ static void packet_flush_mclist(struct sock *sk)
 #endif
 
 static int
-packet_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen)
+packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	int ret;
@@ -1347,7 +1347,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char *optval, int
 }
 
 int packet_getsockopt(struct socket *sock, int level, int optname,
-		      char *optval, int *optlen)
+		      char __user *optval, int __user *optlen)
 {
 	int len;
 	struct sock *sk = sock->sk;

net/rose/af_rose.c

@@ -368,7 +368,7 @@ void rose_destroy_socket(struct sock *sk)
  */
 
 static int rose_setsockopt(struct socket *sock, int level, int optname,
-	char *optval, int optlen)
+	char __user *optval, int optlen)
 {
 	struct sock *sk = sock->sk;
 	rose_cb *rose = rose_sk(sk);
@@ -380,7 +380,7 @@ static int rose_setsockopt(struct socket *sock, int level, int optname,
 	if (optlen < sizeof(int))
 		return -EINVAL;
 
-	if (get_user(opt, (int *)optval))
+	if (get_user(opt, (int __user *)optval))
 		return -EFAULT;
 
 	switch (optname) {
@@ -428,7 +428,7 @@ static int rose_setsockopt(struct socket *sock, int level, int optname,
 }
 
 static int rose_getsockopt(struct socket *sock, int level, int optname,
-	char *optval, int *optlen)
+	char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	rose_cb *rose = rose_sk(sk);

net/x25/af_x25.c

@@ -363,7 +363,7 @@ void x25_destroy_socket(struct sock *sk)
  */
 
 static int x25_setsockopt(struct socket *sock, int level, int optname,
-			  char *optval, int optlen)
+			  char __user *optval, int optlen)
 {
 	int opt;
 	struct sock *sk = sock->sk;
@@ -377,7 +377,7 @@ static int x25_setsockopt(struct socket *sock, int level, int optname,
 		goto out;
 
 	rc = -EFAULT;
-	if (get_user(opt, (int *)optval))
+	if (get_user(opt, (int __user *)optval))
 		goto out;
 
 	x25_sk(sk)->qbitincl = !!opt;
@@ -387,7 +387,7 @@ static int x25_setsockopt(struct socket *sock, int level, int optname,
 }
 
 static int x25_getsockopt(struct socket *sock, int level, int optname,
-			  char *optval, int *optlen)
+			  char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	int val, len, rc = -ENOPROTOOPT;

net/xfrm/xfrm_state.c

@@ -795,7 +795,7 @@ void km_policy_expired(struct xfrm_policy *pol, int dir, int hard)
 		wake_up(&km_waitq);
 }
 
-int xfrm_user_policy(struct sock *sk, int optname, u8 *optval, int optlen)
+int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen)
 {
 	int err;
 	u8 *data;