[PATCH] sparse: ipc __user annotation

diff --git a/include/linux/sem.h b/include/linux/sem.h
index aaf45764a56e9d024f437d728e68709409e30737..c365f7989928f6d2ba7e09554d8e42653ac2e057 100644 (file)
--- a/include/linux/sem.h
+++ b/include/linux/sem.h
@@ -45,10 +45,10 @@ struct sembuf {
 /* arg for semctl system calls. */
 union semun {
        int val;                        /* value for SETVAL */
-       struct semid_ds *buf;           /* buffer for IPC_STAT & IPC_SET */
-       unsigned short *array;          /* array for GETALL & SETALL */
-       struct seminfo *__buf;          /* buffer for IPC_INFO */
-       void *__pad;
+       struct semid_ds __user *buf;    /* buffer for IPC_STAT & IPC_SET */
+       unsigned short __user *array;   /* array for GETALL & SETALL */
+       struct seminfo __user *__buf;   /* buffer for IPC_INFO */
+       void __user *__pad;
 };
 
 struct  seminfo {

diff --git a/ipc/compat.c b/ipc/compat.c
index 600fe597df33146f24aa507553798ef4659f6146..8cbbdc49d339ff9f50f03f445c375e423ecea97f 100644 (file)
--- a/ipc/compat.c
+++ b/ipc/compat.c
@@ -134,7 +134,7 @@ static inline int compat_ipc_parse_version(int *cmd)
 }
 
 static inline int __get_compat_ipc64_perm(struct ipc64_perm *p64,
-                                         struct compat_ipc64_perm *up64)
+                                         struct compat_ipc64_perm __user *up64)
 {
        int err;
 
@@ -145,7 +145,7 @@ static inline int __get_compat_ipc64_perm(struct ipc64_perm *p64,
 }
 
 static inline int __get_compat_ipc_perm(struct ipc64_perm *p,
-                                       struct compat_ipc_perm *up)
+                                       struct compat_ipc_perm __user *up)
 {
        int err;
 
@@ -156,7 +156,7 @@ static inline int __get_compat_ipc_perm(struct ipc64_perm *p,
 }
 
 static inline int __put_compat_ipc64_perm(struct ipc64_perm *p64,
-                                         struct compat_ipc64_perm *up64)
+                                         struct compat_ipc64_perm __user *up64)
 {
        int err;
 
@@ -171,7 +171,7 @@ static inline int __put_compat_ipc64_perm(struct ipc64_perm *p64,
 }
 
 static inline int __put_compat_ipc_perm(struct ipc64_perm *p,
-                                       struct compat_ipc_perm *up)
+                                       struct compat_ipc_perm __user *up)
 {
        int err;
        compat_uid_t u;
@@ -192,7 +192,7 @@ static inline int __put_compat_ipc_perm(struct ipc64_perm *p,
 }
 
 static inline int get_compat_semid64_ds(struct semid64_ds *s64,
-                                       struct compat_semid64_ds *up64)
+                                       struct compat_semid64_ds __user *up64)
 {
        if (!access_ok (VERIFY_READ, up64, sizeof(*up64)))
                return -EFAULT;
@@ -200,7 +200,7 @@ static inline int get_compat_semid64_ds(struct semid64_ds *s64,
 }
 
 static inline int get_compat_semid_ds(struct semid64_ds *s,
-                                     struct compat_semid_ds *up)
+                                     struct compat_semid_ds __user *up)
 {
        if (!access_ok (VERIFY_READ, up, sizeof(*up)))
                return -EFAULT;
@@ -208,7 +208,7 @@ static inline int get_compat_semid_ds(struct semid64_ds *s,
 }
 
 static inline int put_compat_semid64_ds(struct semid64_ds *s64,
-                                       struct compat_semid64_ds *up64)
+                                       struct compat_semid64_ds __user *up64)
 {
        int err;
 
@@ -222,7 +222,7 @@ static inline int put_compat_semid64_ds(struct semid64_ds *s64,
 }
 
 static inline int put_compat_semid_ds(struct semid64_ds *s,
-                                     struct compat_semid_ds *up)
+                                     struct compat_semid_ds __user *up)
 {
        int err;
 
@@ -413,7 +413,7 @@ static inline int get_compat_msqid(struct msqid64_ds *m,
 }
 
 static inline int put_compat_msqid64_ds(struct msqid64_ds *m64,
-                                struct compat_msqid64_ds __user __user *up64)
+                                struct compat_msqid64_ds __user *up64)
 {
        int err;
 
@@ -450,7 +450,7 @@ static inline int put_compat_msqid_ds(struct msqid64_ds *m,
        return err;
 }
 
-static inline int do_msgctl(int first, int second, void __user *buf)
+static inline int do_msgctl(int first, int second, void *buf)
 {
        mm_segment_t old_fs;
        int err;
@@ -712,7 +712,8 @@ long compat_sys_shmctl(int first, int second, void __user *uptr)
 long compat_sys_semtimedop(int semid, struct sembuf __user *tsems,
                unsigned nsops, const struct compat_timespec __user *timeout)
 {
-       struct timespec ts, __user *ts64;
+       struct timespec ts;
+       struct timespec __user *ts64;
 
        /* parameter checking precedence should mirror sys_semtimedop() */
        if (nsops < 1 || semid < 0)

diff --git a/ipc/compat_mq.c b/ipc/compat_mq.c
index 1520df89c424a252c8cebbe137ce45d0a2367f67..a411f4ebd2c860591f1a42b8e50c50b9736bc999 100644 (file)
--- a/ipc/compat_mq.c
+++ b/ipc/compat_mq.c
@@ -77,7 +77,8 @@ asmlinkage long compat_sys_mq_open(const char __user *u_name,
 static struct timespec __user *compat_prepare_timeout(
                        const struct compat_timespec __user *u_abs_timeout)
 {
-       struct timespec ts, __user *u_ts;
+       struct timespec ts;
+       struct timespec __user *u_ts;
 
        if (!u_abs_timeout)
                return 0;
@@ -110,7 +111,7 @@ asmlinkage ssize_t compat_sys_mq_timedreceive(mqd_t mqdes,
                        size_t msg_len, unsigned int __user *u_msg_prio,
                        const struct compat_timespec __user *u_abs_timeout)
 {
-       struct timespec *u_ts;
+       struct timespec __user *u_ts;
 
        u_ts = compat_prepare_timeout(u_abs_timeout);
        if (IS_ERR(u_ts))

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 3475a9992f561bb177ac953a9caaf9c45b55dfac..40a8d414e3ba545be2e4baddbc498e99f3863e06 100644 (file)
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -780,7 +780,7 @@ asmlinkage long sys_mq_timedsend(mqd_t mqdes, const char __user *u_msg_ptr,
 
        /* First try to allocate memory, before doing anything with
         * existing queues. */
-       msg_ptr = load_msg((void *)u_msg_ptr, msg_len);
+       msg_ptr = load_msg(u_msg_ptr, msg_len);
        if (unlikely(IS_ERR(msg_ptr))) {
                ret = PTR_ERR(msg_ptr);
                goto out_fput;

diff --git a/ipc/msg.c b/ipc/msg.c
index 37e2d3bb17cb951924669c9f476df5fd0aa0704f..5f256af8bdf7e07dfcf044fdb7c8c4c60dd4651a 100644 (file)
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -229,7 +229,7 @@ asmlinkage long sys_msgget (key_t key, int msgflg)
        return ret;
 }
 
-static inline unsigned long copy_msqid_to_user(void *buf, struct msqid64_ds *in, int version)
+static inline unsigned long copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
 {
        switch(version) {
        case IPC_64:
@@ -280,7 +280,7 @@ struct msq_setbuf {
        mode_t          mode;
 };
 
-static inline unsigned long copy_msqid_from_user(struct msq_setbuf *out, void *buf, int version)
+static inline unsigned long copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version)
 {
        switch(version) {
        case IPC_64:
@@ -320,7 +320,7 @@ static inline unsigned long copy_msqid_from_user(struct msq_setbuf *out, void *b
        }
 }
 
-asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds *buf)
+asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
 {
        int err, version;
        struct msg_queue *msq;
@@ -539,7 +539,7 @@ static inline int pipelined_send(struct msg_queue* msq, struct msg_msg* msg)
        return 0;
 }
 
-asmlinkage long sys_msgsnd (int msqid, struct msgbuf *msgp, size_t msgsz, int msgflg)
+asmlinkage long sys_msgsnd (int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg)
 {
        struct msg_queue *msq;
        struct msg_msg *msg;
@@ -645,7 +645,7 @@ static inline int convert_mode(long* msgtyp, int msgflg)
        return SEARCH_EQUAL;
 }
 
-asmlinkage long sys_msgrcv (int msqid, struct msgbuf *msgp, size_t msgsz,
+asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz,
                            long msgtyp, int msgflg)
 {
        struct msg_queue *msq;

diff --git a/ipc/msgutil.c b/ipc/msgutil.c
index e48d777de2a3b0167ad14cb216dd435b41b5309d..66cfb87646eb2cd2d207fd69ad895674931749d4 100644 (file)
--- a/ipc/msgutil.c
+++ b/ipc/msgutil.c
@@ -25,7 +25,7 @@ struct msg_msgseg {
 #define DATALEN_MSG    (PAGE_SIZE-sizeof(struct msg_msg))
 #define DATALEN_SEG    (PAGE_SIZE-sizeof(struct msg_msgseg))
 
-struct msg_msg *load_msg(void __user *src, int len)
+struct msg_msg *load_msg(const void __user *src, int len)
 {
        struct msg_msg *msg;
        struct msg_msgseg **pseg;
@@ -49,7 +49,7 @@ struct msg_msg *load_msg(void __user *src, int len)
        }
 
        len -= alen;
-       src = ((char *)src) + alen;
+       src = ((char __user *)src) + alen;
        pseg = &msg->next;
        while (len > 0) {
                struct msg_msgseg *seg;
@@ -70,7 +70,7 @@ struct msg_msg *load_msg(void __user *src, int len)
                }
                pseg = &seg->next;
                len -= alen;
-               src = ((char *)src) + alen;
+               src = ((char __user *)src) + alen;
        }
 
        err = security_msg_msg_alloc(msg);
@@ -96,7 +96,7 @@ int store_msg(void __user *dest, struct msg_msg *msg, int len)
                return -1;
 
        len -= alen;
-       dest = ((char *)dest) + alen;
+       dest = ((char __user *)dest) + alen;
        seg = msg->next;
        while (len > 0) {
                alen = len;
@@ -105,7 +105,7 @@ int store_msg(void __user *dest, struct msg_msg *msg, int len)
                if (copy_to_user(dest, seg + 1, alen))
                        return -1;
                len -= alen;
-               dest = ((char *)dest) + alen;
+               dest = ((char __user *)dest) + alen;
                seg = seg->next;
        }
        return 0;

diff --git a/ipc/sem.c b/ipc/sem.c
index 3725673556848f91900c9778c6fce4896fec7013..6316aca9cc19bd4bf5ded3c1a521b12a540dd1f5 100644 (file)
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -610,7 +610,7 @@ static int semctl_main(int semid, int semnum, int cmd, int version, union semun
        switch (cmd) {
        case GETALL:
        {
-               ushort *array = arg.array;
+               ushort __user *array = arg.array;
                int i;
 
                if(nsems > SEMMSL_FAST) {

diff --git a/ipc/util.h b/ipc/util.h
index e6434942c097212890455769e436a3211b7fecb2..8697df67b592d7177ce623ea07f0caa431fc41b4 100644 (file)
--- a/ipc/util.h
+++ b/ipc/util.h
@@ -68,7 +68,7 @@ int ipc_parse_version (int *cmd);
 #endif
 
 extern void free_msg(struct msg_msg *msg);
-extern struct msg_msg *load_msg(void __user *src, int len);
+extern struct msg_msg *load_msg(const void __user *src, int len);
 extern int store_msg(void __user *dest, struct msg_msg *msg, int len);
 
 #endif