first set of __user annotations from kernel (Al Viro)

1 files changed, 10 insertions, 9 deletions

diff --git a/linux/gamma_dma.c b/linux/gamma_dma.c
index 155275ce..ffa5ce1d 100644
--- a/linux/gamma_dma.c
+++ b/linux/gamma_dma.c
@@ -148,6 +148,7 @@ irqreturn_t gamma_irq_handler( DRM_IRQ_ARGS )
 		queue_task(&dev->tq, &tq_immediate);
 		mark_bh(IMMEDIATE_BH);
 #else
+		/* Dispatch new buffer */
 		schedule_work(&dev->work);
 #endif
 	}
@@ -571,9 +572,10 @@ int gamma_dma(struct inode *inode, struct file *filp, unsigned int cmd,
 	drm_device_t	  *dev	    = priv->dev;
 	drm_device_dma_t  *dma	    = dev->dma;
 	int		  retcode   = 0;
+	drm_dma_t         __user *argp = (void __user *)arg;
 	drm_dma_t	  d;
 
-	if (copy_from_user(&d, (drm_dma_t *)arg, sizeof(d)))
+	if (copy_from_user(&d, argp, sizeof(d)))
 		return -EFAULT;
 
 	if (d.send_count < 0 || d.send_count > dma->buf_count) {
@@ -603,7 +605,7 @@ int gamma_dma(struct inode *inode, struct file *filp, unsigned int cmd,
 
 	DRM_DEBUG("%d returning, granted = %d\n",
 		  current->pid, d.granted_count);
-	if (copy_to_user((drm_dma_t *)arg, &d, sizeof(d)))
+	if (copy_to_user(argp, &d, sizeof(d)))
 		return -EFAULT;
 
 	return retcode;
@@ -726,7 +728,7 @@ int gamma_dma_init( struct inode *inode, struct file *filp,
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	if ( copy_from_user( &init, (drm_gamma_init_t *)arg, sizeof(init) ) )
+	if ( copy_from_user( &init, (drm_gamma_init_t __user *)arg, sizeof(init) ) )
 		return -EFAULT;
 
 	switch ( init.func ) {
@@ -795,7 +797,7 @@ int gamma_dma_copy( struct inode *inode, struct file *filp,
 	drm_device_t *dev = priv->dev;
 	drm_gamma_copy_t copy;
 
-	if ( copy_from_user( &copy, (drm_gamma_copy_t *)arg, sizeof(copy) ) )
+	if ( copy_from_user( &copy, (drm_gamma_copy_t __user *)arg, sizeof(copy) ) )
 		return -EFAULT;
 
 	return gamma_do_copy_dma( dev, &copy );
@@ -810,12 +812,11 @@ int gamma_getsareactx(struct inode *inode, struct file *filp,
 {
 	drm_file_t	*priv	= filp->private_data;
 	drm_device_t	*dev	= priv->dev;
+	drm_ctx_priv_map_t __user *argp = (void __user *)arg;
 	drm_ctx_priv_map_t request;
 	drm_map_t *map;
 
-	if (copy_from_user(&request,
-			   (drm_ctx_priv_map_t *)arg,
-			   sizeof(request)))
+	if (copy_from_user(&request, argp, sizeof(request)))
 		return -EFAULT;
 
 	down(&dev->struct_sem);
@@ -828,7 +829,7 @@ int gamma_getsareactx(struct inode *inode, struct file *filp,
 	up(&dev->struct_sem);
 
 	request.handle = map->handle;
-	if (copy_to_user((drm_ctx_priv_map_t *)arg, &request, sizeof(request)))
+	if (copy_to_user(argp, &request, sizeof(request)))
 		return -EFAULT;
 	return 0;
 }
@@ -844,7 +845,7 @@ int gamma_setsareactx(struct inode *inode, struct file *filp,
 	struct list_head *list;
 
 	if (copy_from_user(&request,
-			   (drm_ctx_priv_map_t *)arg,
+			   (drm_ctx_priv_map_t __user *)arg,
 			   sizeof(request)))
 		return -EFAULT;