first set of __user annotations from kernel (Al Viro)

1 files changed, 8 insertions, 7 deletions

diff --git a/linux-core/drm_agpsupport.c b/linux-core/drm_agpsupport.c
index f83651af..c4f0e465 100644
--- a/linux-core/drm_agpsupport.c
+++ b/linux-core/drm_agpsupport.c
@@ -80,7 +80,7 @@ int DRM(agp_info)(struct inode *inode, struct file *filp,
 	info.id_vendor         = kern->device->vendor;
 	info.id_device         = kern->device->device;
 
-	if (copy_to_user((drm_agp_info_t *)arg, &info, sizeof(info)))
+	if (copy_to_user((drm_agp_info_t __user *)arg, &info, sizeof(info)))
 		return -EFAULT;
 	return 0;
 }
@@ -178,7 +178,7 @@ int DRM(agp_enable)(struct inode *inode, struct file *filp,
 	if (!dev->agp || !dev->agp->acquired || !drm_agp->enable)
 		return -EINVAL;
 
-	if (copy_from_user(&mode, (drm_agp_mode_t *)arg, sizeof(mode)))
+	if (copy_from_user(&mode, (drm_agp_mode_t __user *)arg, sizeof(mode)))
 		return -EFAULT;
 
 	dev->agp->mode    = mode.mode;
@@ -210,10 +210,11 @@ int DRM(agp_alloc)(struct inode *inode, struct file *filp,
 	DRM_AGP_MEM      *memory;
 	unsigned long    pages;
 	u32 		 type;
+	drm_agp_buffer_t __user *argp = (void __user *)arg;
 
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_buffer_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, argp, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(alloc)(sizeof(*entry), DRM_MEM_AGPLISTS)))
 		return -ENOMEM;
@@ -241,7 +242,7 @@ int DRM(agp_alloc)(struct inode *inode, struct file *filp,
 	request.handle   = entry->handle;
 	request.physical = memory->physical;
 
-	if (copy_to_user((drm_agp_buffer_t *)arg, &request, sizeof(request))) {
+	if (copy_to_user(argp, &request, sizeof(request))) {
 		dev->agp->memory       = entry->next;
 		dev->agp->memory->prev = NULL;
 		DRM(free_agp)(memory, pages);
@@ -295,7 +296,7 @@ int DRM(agp_unbind)(struct inode *inode, struct file *filp,
 
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_binding_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, (drm_agp_binding_t __user *)arg, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(agp_lookup_entry)(dev, request.handle)))
 		return -EINVAL;
@@ -332,7 +333,7 @@ int DRM(agp_bind)(struct inode *inode, struct file *filp,
 
 	if (!dev->agp || !dev->agp->acquired || !drm_agp->bind_memory)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_binding_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, (drm_agp_binding_t __user *)arg, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(agp_lookup_entry)(dev, request.handle)))
 		return -EINVAL;
@@ -371,7 +372,7 @@ int DRM(agp_free)(struct inode *inode, struct file *filp,
 
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
-	if (copy_from_user(&request, (drm_agp_buffer_t *)arg, sizeof(request)))
+	if (copy_from_user(&request, (drm_agp_buffer_t __user *)arg, sizeof(request)))
 		return -EFAULT;
 	if (!(entry = DRM(agp_lookup_entry)(dev, request.handle)))
 		return -EINVAL;