From a776c5ec0464e264bba3f3a4794a067d3c667097 Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Tue, 20 Jul 2004 12:43:12 +0000 Subject: first set of __user annotations from kernel (Al Viro) --- linux-core/drmP.h | 2 +- linux-core/drm_agpsupport.c | 15 +++++++------ linux-core/drm_auth.c | 4 ++-- linux-core/drm_bufs.c | 54 +++++++++++++++++++++++---------------------- linux-core/drm_context.c | 30 +++++++++++++------------ linux-core/drm_dma.c | 2 +- linux-core/drm_drawable.c | 2 +- linux-core/drm_drv.c | 13 +++++------ linux-core/drm_fops.c | 2 +- linux-core/drm_ioctl.c | 25 ++++++++++++--------- linux-core/drm_irq.c | 14 ++++++------ linux-core/drm_scatter.c | 11 ++++----- linux/drmP.h | 2 +- linux/drm_agpsupport.h | 15 +++++++------ linux/drm_auth.h | 4 ++-- linux/drm_bufs.h | 54 +++++++++++++++++++++++---------------------- linux/drm_context.h | 30 +++++++++++++------------ linux/drm_dma.h | 2 +- linux/drm_drawable.h | 2 +- linux/drm_drv.h | 13 +++++------ linux/drm_fops.h | 2 +- linux/drm_ioctl.h | 25 ++++++++++++--------- linux/drm_irq.h | 14 ++++++------ linux/drm_scatter.h | 11 ++++----- linux/gamma_context.h | 25 ++++++++++++--------- linux/gamma_dma.c | 19 ++++++++-------- linux/gamma_lock.h | 2 +- 27 files changed, 203 insertions(+), 191 deletions(-) diff --git a/linux-core/drmP.h b/linux-core/drmP.h index d3564d06..066b185d 100644 --- a/linux-core/drmP.h +++ b/linux-core/drmP.h @@ -740,7 +740,7 @@ extern int DRM(mmap_dma)(struct file *filp, struct vm_area_struct *vma); extern int DRM(mmap)(struct file *filp, struct vm_area_struct *vma); extern unsigned int DRM(poll)(struct file *filp, struct poll_table_struct *wait); -extern ssize_t DRM(read)(struct file *filp, char *buf, size_t count, loff_t *off); +extern ssize_t DRM(read)(struct file *filp, char __user *buf, size_t count, loff_t *off); /* Memory management support (drm_memory.h) */ extern void DRM(mem_init)(void); diff --git a/linux-core/drm_agpsupport.c b/linux-core/drm_agpsupport.c index f83651af..c4f0e465 100644 --- a/linux-core/drm_agpsupport.c +++ b/linux-core/drm_agpsupport.c @@ -80,7 +80,7 @@ int DRM(agp_info)(struct inode *inode, struct file *filp, info.id_vendor = kern->device->vendor; info.id_device = kern->device->device; - if (copy_to_user((drm_agp_info_t *)arg, &info, sizeof(info))) + if (copy_to_user((drm_agp_info_t __user *)arg, &info, sizeof(info))) return -EFAULT; return 0; } @@ -178,7 +178,7 @@ int DRM(agp_enable)(struct inode *inode, struct file *filp, if (!dev->agp || !dev->agp->acquired || !drm_agp->enable) return -EINVAL; - if (copy_from_user(&mode, (drm_agp_mode_t *)arg, sizeof(mode))) + if (copy_from_user(&mode, (drm_agp_mode_t __user *)arg, sizeof(mode))) return -EFAULT; dev->agp->mode = mode.mode; @@ -210,10 +210,11 @@ int DRM(agp_alloc)(struct inode *inode, struct file *filp, DRM_AGP_MEM *memory; unsigned long pages; u32 type; + drm_agp_buffer_t __user *argp = (void __user *)arg; if (!dev->agp || !dev->agp->acquired) return -EINVAL; - if (copy_from_user(&request, (drm_agp_buffer_t *)arg, sizeof(request))) + if (copy_from_user(&request, argp, sizeof(request))) return -EFAULT; if (!(entry = DRM(alloc)(sizeof(*entry), DRM_MEM_AGPLISTS))) return -ENOMEM; @@ -241,7 +242,7 @@ int DRM(agp_alloc)(struct inode *inode, struct file *filp, request.handle = entry->handle; request.physical = memory->physical; - if (copy_to_user((drm_agp_buffer_t *)arg, &request, sizeof(request))) { + if (copy_to_user(argp, &request, sizeof(request))) { dev->agp->memory = entry->next; dev->agp->memory->prev = NULL; DRM(free_agp)(memory, pages); @@ -295,7 +296,7 @@ int DRM(agp_unbind)(struct inode *inode, struct file *filp, if (!dev->agp || !dev->agp->acquired) return -EINVAL; - if (copy_from_user(&request, (drm_agp_binding_t *)arg, sizeof(request))) + if (copy_from_user(&request, (drm_agp_binding_t __user *)arg, sizeof(request))) return -EFAULT; if (!(entry = DRM(agp_lookup_entry)(dev, request.handle))) return -EINVAL; @@ -332,7 +333,7 @@ int DRM(agp_bind)(struct inode *inode, struct file *filp, if (!dev->agp || !dev->agp->acquired || !drm_agp->bind_memory) return -EINVAL; - if (copy_from_user(&request, (drm_agp_binding_t *)arg, sizeof(request))) + if (copy_from_user(&request, (drm_agp_binding_t __user *)arg, sizeof(request))) return -EFAULT; if (!(entry = DRM(agp_lookup_entry)(dev, request.handle))) return -EINVAL; @@ -371,7 +372,7 @@ int DRM(agp_free)(struct inode *inode, struct file *filp, if (!dev->agp || !dev->agp->acquired) return -EINVAL; - if (copy_from_user(&request, (drm_agp_buffer_t *)arg, sizeof(request))) + if (copy_from_user(&request, (drm_agp_buffer_t __user *)arg, sizeof(request))) return -EFAULT; if (!(entry = DRM(agp_lookup_entry)(dev, request.handle))) return -EINVAL; diff --git a/linux-core/drm_auth.c b/linux-core/drm_auth.c index e027303a..a6d174cd 100644 --- a/linux-core/drm_auth.c +++ b/linux-core/drm_auth.c @@ -195,7 +195,7 @@ int DRM(getmagic)(struct inode *inode, struct file *filp, } DRM_DEBUG("%u\n", auth.magic); - if (copy_to_user((drm_auth_t *)arg, &auth, sizeof(auth))) + if (copy_to_user((drm_auth_t __user *)arg, &auth, sizeof(auth))) return -EFAULT; return 0; } @@ -219,7 +219,7 @@ int DRM(authmagic)(struct inode *inode, struct file *filp, drm_auth_t auth; drm_file_t *file; - if (copy_from_user(&auth, (drm_auth_t *)arg, sizeof(auth))) + if (copy_from_user(&auth, (drm_auth_t __user *)arg, sizeof(auth))) return -EFAULT; DRM_DEBUG("%u\n", auth.magic); if ((file = DRM(find_file)(dev, auth.magic))) { diff --git a/linux-core/drm_bufs.c b/linux-core/drm_bufs.c index 38ddb790..7270ff4a 100644 --- a/linux-core/drm_bufs.c +++ b/linux-core/drm_bufs.c @@ -71,9 +71,10 @@ int DRM(order)( unsigned long size ) int order; unsigned long tmp; - for ( order = 0, tmp = size ; tmp >>= 1 ; ++order ); + for (order = 0, tmp = size >> 1; tmp; tmp >>= 1, order++) + ; - if ( size & ~(1 << order) ) + if (size & (size - 1)) ++order; return order; @@ -98,6 +99,7 @@ int DRM(addmap)( struct inode *inode, struct file *filp, drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; drm_map_t *map; + drm_map_t __user *argp = (void __user *)arg; drm_map_list_t *list; if ( !(filp->f_mode & 3) ) return -EACCES; /* Require read/write */ @@ -106,7 +108,7 @@ int DRM(addmap)( struct inode *inode, struct file *filp, if ( !map ) return -ENOMEM; - if ( copy_from_user( map, (drm_map_t *)arg, sizeof(*map) ) ) { + if ( copy_from_user( map, argp, sizeof(*map) ) ) { DRM(free)( map, sizeof(*map), DRM_MEM_MAPS ); return -EFAULT; } @@ -207,10 +209,10 @@ int DRM(addmap)( struct inode *inode, struct file *filp, list_add(&list->head, &dev->maplist->head); up(&dev->struct_sem); - if ( copy_to_user( (drm_map_t *)arg, map, sizeof(*map) ) ) + if ( copy_to_user( argp, map, sizeof(*map) ) ) return -EFAULT; if ( map->type != _DRM_SHM ) { - if ( copy_to_user( &((drm_map_t *)arg)->handle, + if ( copy_to_user( &argp->handle, &map->offset, sizeof(map->offset) ) ) return -EFAULT; @@ -247,7 +249,7 @@ int DRM(rmmap)(struct inode *inode, struct file *filp, drm_map_t request; int found_maps = 0; - if (copy_from_user(&request, (drm_map_t *)arg, + if (copy_from_user(&request, (drm_map_t __user *)arg, sizeof(request))) { return -EFAULT; } @@ -389,10 +391,11 @@ int DRM(addbufs_agp)( struct inode *inode, struct file *filp, int byte_count; int i; drm_buf_t **temp_buflist; + drm_buf_desc_t __user *argp = (void __user *)arg; if ( !dma ) return -EINVAL; - if ( copy_from_user( &request, (drm_buf_desc_t *)arg, + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; @@ -529,7 +532,7 @@ int DRM(addbufs_agp)( struct inode *inode, struct file *filp, request.count = entry->buf_count; request.size = size; - if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) ) + if ( copy_to_user( argp, &request, sizeof(request) ) ) return -EFAULT; dma->flags = _DRM_DMA_USE_AGP; @@ -562,10 +565,11 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp, int page_count; unsigned long *temp_pagelist; drm_buf_t **temp_buflist; + drm_buf_desc_t __user *argp = (void __user *)arg; if ( !dma ) return -EINVAL; - if ( copy_from_user( &request, (drm_buf_desc_t *)arg, + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; @@ -767,7 +771,7 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp, request.count = entry->buf_count; request.size = size; - if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) ) + if ( copy_to_user( argp, &request, sizeof(request) ) ) return -EFAULT; atomic_dec( &dev->buf_alloc ); @@ -783,6 +787,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp, drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; drm_device_dma_t *dma = dev->dma; + drm_buf_desc_t __user *argp = (void __user *)arg; drm_buf_desc_t request; drm_buf_entry_t *entry; drm_buf_t *buf; @@ -800,7 +805,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp, if ( !dma ) return -EINVAL; - if ( copy_from_user( &request, (drm_buf_desc_t *)arg, + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; @@ -938,7 +943,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp, request.count = entry->buf_count; request.size = size; - if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) ) + if ( copy_to_user( argp, &request, sizeof(request) ) ) return -EFAULT; dma->flags = _DRM_DMA_USE_SG; @@ -967,7 +972,7 @@ int DRM(addbufs)( struct inode *inode, struct file *filp, { drm_buf_desc_t request; - if ( copy_from_user( &request, (drm_buf_desc_t *)arg, + if ( copy_from_user( &request, (drm_buf_desc_t __user *)arg, sizeof(request) ) ) return -EFAULT; @@ -1013,6 +1018,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_device_dma_t *dma = dev->dma; drm_buf_info_t request; + drm_buf_info_t __user *argp = (void __user *)arg; int i; int count; @@ -1026,9 +1032,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp, ++dev->buf_use; /* Can't allocate more after this call */ spin_unlock( &dev->count_lock ); - if ( copy_from_user( &request, - (drm_buf_info_t *)arg, - sizeof(request) ) ) + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; for ( i = 0, count = 0 ; i < DRM_MAX_ORDER + 1 ; i++ ) { @@ -1040,7 +1044,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp, if ( request.count >= count ) { for ( i = 0, count = 0 ; i < DRM_MAX_ORDER + 1 ; i++ ) { if ( dma->bufs[i].buf_count ) { - drm_buf_desc_t *to = &request.list[count]; + drm_buf_desc_t __user *to = &request.list[count]; drm_buf_entry_t *from = &dma->bufs[i]; drm_freelist_t *list = &dma->bufs[i].freelist; if ( copy_to_user( &to->count, @@ -1069,9 +1073,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp, } request.count = count; - if ( copy_to_user( (drm_buf_info_t *)arg, - &request, - sizeof(request) ) ) + if ( copy_to_user( argp, &request, sizeof(request) ) ) return -EFAULT; return 0; @@ -1104,7 +1106,7 @@ int DRM(markbufs)( struct inode *inode, struct file *filp, if ( !dma ) return -EINVAL; if ( copy_from_user( &request, - (drm_buf_desc_t *)arg, + (drm_buf_desc_t __user *)arg, sizeof(request) ) ) return -EFAULT; @@ -1151,7 +1153,7 @@ int DRM(freebufs)( struct inode *inode, struct file *filp, if ( !dma ) return -EINVAL; if ( copy_from_user( &request, - (drm_buf_free_t *)arg, + (drm_buf_free_t __user *)arg, sizeof(request) ) ) return -EFAULT; @@ -1197,6 +1199,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp, drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; drm_device_dma_t *dma = dev->dma; + drm_buf_map_t __user *argp = (void __user *)arg; int retcode = 0; const int zero = 0; unsigned long virtual; @@ -1214,8 +1217,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp, dev->buf_use++; /* Can't allocate more after this call */ spin_unlock( &dev->count_lock ); - if ( copy_from_user( &request, (drm_buf_map_t *)arg, - sizeof(request) ) ) + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; if ( request.count >= dma->buf_count ) { @@ -1262,7 +1264,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp, retcode = (signed long)virtual; goto done; } - request.virtual = (void *)virtual; + request.virtual = (void __user *)virtual; for ( i = 0 ; i < dma->buf_count ; i++ ) { if ( copy_to_user( &request.list[i].idx, @@ -1296,7 +1298,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp, request.count = dma->buf_count; DRM_DEBUG( "%d buffers, retcode = %d\n", request.count, retcode ); - if ( copy_to_user( (drm_buf_map_t *)arg, &request, sizeof(request) ) ) + if ( copy_to_user( argp, &request, sizeof(request) ) ) return -EFAULT; return retcode; diff --git a/linux-core/drm_context.c b/linux-core/drm_context.c index 474b5ba0..8795198a 100644 --- a/linux-core/drm_context.c +++ b/linux-core/drm_context.c @@ -215,12 +215,11 @@ int DRM(getsareactx)(struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_ctx_priv_map_t __user *argp = (void __user *)arg; drm_ctx_priv_map_t request; drm_map_t *map; - if (copy_from_user(&request, - (drm_ctx_priv_map_t *)arg, - sizeof(request))) + if (copy_from_user(&request, argp, sizeof(request))) return -EFAULT; down(&dev->struct_sem); @@ -233,7 +232,7 @@ int DRM(getsareactx)(struct inode *inode, struct file *filp, up(&dev->struct_sem); request.handle = map->handle; - if (copy_to_user((drm_ctx_priv_map_t *)arg, &request, sizeof(request))) + if (copy_to_user(argp, &request, sizeof(request))) return -EFAULT; return 0; } @@ -261,7 +260,7 @@ int DRM(setsareactx)(struct inode *inode, struct file *filp, struct list_head *list; if (copy_from_user(&request, - (drm_ctx_priv_map_t *)arg, + (drm_ctx_priv_map_t __user *)arg, sizeof(request))) return -EFAULT; @@ -364,10 +363,11 @@ int DRM(resctx)( struct inode *inode, struct file *filp, unsigned int cmd, unsigned long arg ) { drm_ctx_res_t res; + drm_ctx_t __user *argp = (void __user *)arg; drm_ctx_t ctx; int i; - if ( copy_from_user( &res, (drm_ctx_res_t *)arg, sizeof(res) ) ) + if ( copy_from_user( &res, argp, sizeof(res) ) ) return -EFAULT; if ( res.count >= DRM_RESERVED_CONTEXTS ) { @@ -381,7 +381,7 @@ int DRM(resctx)( struct inode *inode, struct file *filp, } res.count = DRM_RESERVED_CONTEXTS; - if ( copy_to_user( (drm_ctx_res_t *)arg, &res, sizeof(res) ) ) + if ( copy_to_user( argp, &res, sizeof(res) ) ) return -EFAULT; return 0; } @@ -403,9 +403,10 @@ int DRM(addctx)( struct inode *inode, struct file *filp, drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; drm_ctx_list_t * ctx_entry; + drm_ctx_t __user *argp = (void __user *)arg; drm_ctx_t ctx; - if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) ) + if ( copy_from_user( &ctx, argp, sizeof(ctx) ) ) return -EFAULT; ctx.handle = DRM(ctxbitmap_next)( dev ); @@ -438,7 +439,7 @@ int DRM(addctx)( struct inode *inode, struct file *filp, ++dev->ctx_count; up( &dev->ctxlist_sem ); - if ( copy_to_user( (drm_ctx_t *)arg, &ctx, sizeof(ctx) ) ) + if ( copy_to_user( argp, &ctx, sizeof(ctx) ) ) return -EFAULT; return 0; } @@ -462,15 +463,16 @@ int DRM(modctx)( struct inode *inode, struct file *filp, int DRM(getctx)( struct inode *inode, struct file *filp, unsigned int cmd, unsigned long arg ) { + drm_ctx_t __user *argp = (void __user *)arg; drm_ctx_t ctx; - if ( copy_from_user( &ctx, (drm_ctx_t*)arg, sizeof(ctx) ) ) + if ( copy_from_user( &ctx, argp, sizeof(ctx) ) ) return -EFAULT; /* This is 0, because we don't handle any context flags */ ctx.flags = 0; - if ( copy_to_user( (drm_ctx_t*)arg, &ctx, sizeof(ctx) ) ) + if ( copy_to_user( argp, &ctx, sizeof(ctx) ) ) return -EFAULT; return 0; } @@ -493,7 +495,7 @@ int DRM(switchctx)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_ctx_t ctx; - if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) ) + if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) ) return -EFAULT; DRM_DEBUG( "%d\n", ctx.handle ); @@ -518,7 +520,7 @@ int DRM(newctx)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_ctx_t ctx; - if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) ) + if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) ) return -EFAULT; DRM_DEBUG( "%d\n", ctx.handle ); @@ -545,7 +547,7 @@ int DRM(rmctx)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_ctx_t ctx; - if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) ) + if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) ) return -EFAULT; DRM_DEBUG( "%d\n", ctx.handle ); diff --git a/linux-core/drm_dma.c b/linux-core/drm_dma.c index 14ae5545..04467342 100644 --- a/linux-core/drm_dma.c +++ b/linux-core/drm_dma.c @@ -215,7 +215,7 @@ int DRM(control)( struct inode *inode, struct file *filp, { drm_control_t ctl; - if ( copy_from_user( &ctl, (drm_control_t *)arg, sizeof(ctl) ) ) + if ( copy_from_user( &ctl, (drm_control_t __user *)arg, sizeof(ctl) ) ) return -EFAULT; switch ( ctl.func ) { diff --git a/linux-core/drm_drawable.c b/linux-core/drm_drawable.c index 892ae4e0..59c13ef8 100644 --- a/linux-core/drm_drawable.c +++ b/linux-core/drm_drawable.c @@ -44,7 +44,7 @@ int DRM(adddraw)(struct inode *inode, struct file *filp, draw.handle = 0; /* NOOP */ DRM_DEBUG("%d\n", draw.handle); - if (copy_to_user((drm_draw_t *)arg, &draw, sizeof(draw))) + if (copy_to_user((drm_draw_t __user *)arg, &draw, sizeof(draw))) return -EFAULT; return 0; } diff --git a/linux-core/drm_drv.c b/linux-core/drm_drv.c index 42831be0..706d762f 100644 --- a/linux-core/drm_drv.c +++ b/linux-core/drm_drv.c @@ -817,12 +817,11 @@ module_exit( drm_exit ); int DRM(version)( struct inode *inode, struct file *filp, unsigned int cmd, unsigned long arg ) { + drm_version_t __user *argp = (void __user *)arg; drm_version_t version; int len; - if ( copy_from_user( &version, - (drm_version_t *)arg, - sizeof(version) ) ) + if ( copy_from_user( &version, argp, sizeof(version) ) ) return -EFAULT; #define DRM_COPY( name, value ) \ @@ -842,9 +841,7 @@ int DRM(version)( struct inode *inode, struct file *filp, DRM_COPY( version.date, DRIVER_DATE ); DRM_COPY( version.desc, DRIVER_DESC ); - if ( copy_to_user( (drm_version_t *)arg, - &version, - sizeof(version) ) ) + if ( copy_to_user( argp, &version, sizeof(version) ) ) return -EFAULT; return 0; } @@ -1124,7 +1121,7 @@ int DRM(lock)( struct inode *inode, struct file *filp, ++priv->lock_count; - if ( copy_from_user( &lock, (drm_lock_t *)arg, sizeof(lock) ) ) + if ( copy_from_user( &lock, (drm_lock_t __user *)arg, sizeof(lock) ) ) return -EFAULT; if ( lock.context == DRM_KERNEL_CONTEXT ) { @@ -1237,7 +1234,7 @@ int DRM(unlock)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_lock_t lock; - if ( copy_from_user( &lock, (drm_lock_t *)arg, sizeof(lock) ) ) + if ( copy_from_user( &lock, (drm_lock_t __user *)arg, sizeof(lock) ) ) return -EFAULT; if ( lock.context == DRM_KERNEL_CONTEXT ) { diff --git a/linux-core/drm_fops.c b/linux-core/drm_fops.c index 152cb4d7..869736a4 100644 --- a/linux-core/drm_fops.c +++ b/linux-core/drm_fops.c @@ -142,7 +142,7 @@ unsigned int DRM(poll)(struct file *filp, struct poll_table_struct *wait) #if !__HAVE_DRIVER_FOPS_READ /** No-op. */ -ssize_t DRM(read)(struct file *filp, char *buf, size_t count, loff_t *off) +ssize_t DRM(read)(struct file *filp, char __user *buf, size_t count, loff_t *off) { return 0; } diff --git a/linux-core/drm_ioctl.c b/linux-core/drm_ioctl.c index 5fa7694c..379a4f05 100644 --- a/linux-core/drm_ioctl.c +++ b/linux-core/drm_ioctl.c @@ -54,16 +54,17 @@ int DRM(getunique)(struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_unique_t __user *argp = (void __user *)arg; drm_unique_t u; - if (copy_from_user(&u, (drm_unique_t *)arg, sizeof(u))) + if (copy_from_user(&u, argp, sizeof(u))) return -EFAULT; if (u.unique_len >= dev->unique_len) { if (copy_to_user(u.unique, dev->unique, dev->unique_len)) return -EFAULT; } u.unique_len = dev->unique_len; - if (copy_to_user((drm_unique_t *)arg, &u, sizeof(u))) + if (copy_to_user(argp, &u, sizeof(u))) return -EFAULT; return 0; } @@ -92,7 +93,8 @@ int DRM(setunique)(struct inode *inode, struct file *filp, if (dev->unique_len || dev->unique) return -EBUSY; - if (copy_from_user(&u, (drm_unique_t *)arg, sizeof(u))) return -EFAULT; + if (copy_from_user(&u, (drm_unique_t __user *)arg, sizeof(u))) + return -EFAULT; if (!u.unique_len || u.unique_len > 1024) return -EINVAL; @@ -172,13 +174,14 @@ int DRM(getmap)( struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_map_t __user *argp = (void __user *)arg; drm_map_t map; drm_map_list_t *r_list = NULL; struct list_head *list; int idx; int i; - if (copy_from_user(&map, (drm_map_t *)arg, sizeof(map))) + if (copy_from_user(&map, argp, sizeof(map))) return -EFAULT; idx = map.offset; @@ -209,7 +212,7 @@ int DRM(getmap)( struct inode *inode, struct file *filp, map.mtrr = r_list->map->mtrr; up(&dev->struct_sem); - if (copy_to_user((drm_map_t *)arg, &map, sizeof(map))) return -EFAULT; + if (copy_to_user(argp, &map, sizeof(map))) return -EFAULT; return 0; } @@ -231,12 +234,13 @@ int DRM(getclient)( struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_client_t __user *argp = (void __user *)arg; drm_client_t client; drm_file_t *pt; int idx; int i; - if (copy_from_user(&client, (drm_client_t *)arg, sizeof(client))) + if (copy_from_user(&client, argp, sizeof(client))) return -EFAULT; idx = client.idx; down(&dev->struct_sem); @@ -254,7 +258,7 @@ int DRM(getclient)( struct inode *inode, struct file *filp, client.iocs = pt->ioctl_count; up(&dev->struct_sem); - if (copy_to_user((drm_client_t *)arg, &client, sizeof(client))) + if (copy_to_user(argp, &client, sizeof(client))) return -EFAULT; return 0; } @@ -295,7 +299,7 @@ int DRM(getstats)( struct inode *inode, struct file *filp, up(&dev->struct_sem); - if (copy_to_user((drm_stats_t *)arg, &stats, sizeof(stats))) + if (copy_to_user((drm_stats_t __user *)arg, &stats, sizeof(stats))) return -EFAULT; return 0; } @@ -309,15 +313,16 @@ int DRM(setversion)(DRM_IOCTL_ARGS) drm_set_version_t sv; drm_set_version_t retv; int if_version; + drm_set_version_t __user *argp = (void __user *)data; - DRM_COPY_FROM_USER_IOCTL(sv, (drm_set_version_t *)data, sizeof(sv)); + DRM_COPY_FROM_USER_IOCTL(sv, argp, sizeof(sv)); retv.drm_di_major = DRM_IF_MAJOR; retv.drm_di_minor = DRM_IF_MINOR; retv.drm_dd_major = DRIVER_MAJOR; retv.drm_dd_minor = DRIVER_MINOR; - DRM_COPY_TO_USER_IOCTL((drm_set_version_t *)data, retv, sizeof(sv)); + DRM_COPY_TO_USER_IOCTL(argp, retv, sizeof(sv)); if (sv.drm_di_major != -1) { if (sv.drm_di_major != DRM_IF_MAJOR || diff --git a/linux-core/drm_irq.c b/linux-core/drm_irq.c index f53f142a..035eb70f 100644 --- a/linux-core/drm_irq.c +++ b/linux-core/drm_irq.c @@ -66,9 +66,10 @@ int DRM(irq_by_busid)(struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_irq_busid_t __user *argp = (void __user *)arg; drm_irq_busid_t p; - if (copy_from_user(&p, (drm_irq_busid_t *)arg, sizeof(p))) + if (copy_from_user(&p, argp, sizeof(p))) return -EFAULT; if ((p.busnum >> 8) != dev->pci_domain || @@ -81,7 +82,7 @@ int DRM(irq_by_busid)(struct inode *inode, struct file *filp, DRM_DEBUG("%d:%d:%d => IRQ %d\n", p.busnum, p.devnum, p.funcnum, p.irq); - if (copy_to_user((drm_irq_busid_t *)arg, &p, sizeof(p))) + if (copy_to_user(argp, &p, sizeof(p))) return -EFAULT; return 0; } @@ -214,7 +215,7 @@ int DRM(control)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_control_t ctl; - if ( copy_from_user( &ctl, (drm_control_t *)arg, sizeof(ctl) ) ) + if ( copy_from_user( &ctl, (drm_control_t __user *)arg, sizeof(ctl) ) ) return -EFAULT; switch ( ctl.func ) { @@ -255,6 +256,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS ) { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_wait_vblank_t __user *argp = (void __user *)data; drm_wait_vblank_t vblwait; struct timeval now; int ret = 0; @@ -263,8 +265,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS ) if (!dev->irq) return -EINVAL; - DRM_COPY_FROM_USER_IOCTL( vblwait, (drm_wait_vblank_t *)data, - sizeof(vblwait) ); + DRM_COPY_FROM_USER_IOCTL( vblwait, argp, sizeof(vblwait) ); switch ( vblwait.request.type & ~_DRM_VBLANK_FLAGS_MASK ) { case _DRM_VBLANK_RELATIVE: @@ -333,8 +334,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS ) } done: - DRM_COPY_TO_USER_IOCTL( (drm_wait_vblank_t *)data, vblwait, - sizeof(vblwait) ); + DRM_COPY_TO_USER_IOCTL( argp, vblwait, sizeof(vblwait) ); return ret; } diff --git a/linux-core/drm_scatter.c b/linux-core/drm_scatter.c index 45a30fc3..4aaf89d4 100644 --- a/linux-core/drm_scatter.c +++ b/linux-core/drm_scatter.c @@ -67,6 +67,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_scatter_gather_t __user *argp = (void __user *)arg; drm_scatter_gather_t request; drm_sg_mem_t *entry; unsigned long pages, i, j; @@ -76,9 +77,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp, if ( dev->sg ) return -EINVAL; - if ( copy_from_user( &request, - (drm_scatter_gather_t *)arg, - sizeof(request) ) ) + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; entry = DRM(alloc)( sizeof(*entry), DRM_MEM_SGLISTS ); @@ -146,9 +145,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp, request.handle = entry->handle; - if ( copy_to_user( (drm_scatter_gather_t *)arg, - &request, - sizeof(request) ) ) { + if ( copy_to_user( argp, &request, sizeof(request) ) ) { DRM(sg_cleanup)( entry ); return -EFAULT; } @@ -211,7 +208,7 @@ int DRM(sg_free)( struct inode *inode, struct file *filp, drm_sg_mem_t *entry; if ( copy_from_user( &request, - (drm_scatter_gather_t *)arg, + (drm_scatter_gather_t __user *)arg, sizeof(request) ) ) return -EFAULT; diff --git a/linux/drmP.h b/linux/drmP.h index d3564d06..066b185d 100644 --- a/linux/drmP.h +++ b/linux/drmP.h @@ -740,7 +740,7 @@ extern int DRM(mmap_dma)(struct file *filp, struct vm_area_struct *vma); extern int DRM(mmap)(struct file *filp, struct vm_area_struct *vma); extern unsigned int DRM(poll)(struct file *filp, struct poll_table_struct *wait); -extern ssize_t DRM(read)(struct file *filp, char *buf, size_t count, loff_t *off); +extern ssize_t DRM(read)(struct file *filp, char __user *buf, size_t count, loff_t *off); /* Memory management support (drm_memory.h) */ extern void DRM(mem_init)(void); diff --git a/linux/drm_agpsupport.h b/linux/drm_agpsupport.h index f83651af..c4f0e465 100644 --- a/linux/drm_agpsupport.h +++ b/linux/drm_agpsupport.h @@ -80,7 +80,7 @@ int DRM(agp_info)(struct inode *inode, struct file *filp, info.id_vendor = kern->device->vendor; info.id_device = kern->device->device; - if (copy_to_user((drm_agp_info_t *)arg, &info, sizeof(info))) + if (copy_to_user((drm_agp_info_t __user *)arg, &info, sizeof(info))) return -EFAULT; return 0; } @@ -178,7 +178,7 @@ int DRM(agp_enable)(struct inode *inode, struct file *filp, if (!dev->agp || !dev->agp->acquired || !drm_agp->enable) return -EINVAL; - if (copy_from_user(&mode, (drm_agp_mode_t *)arg, sizeof(mode))) + if (copy_from_user(&mode, (drm_agp_mode_t __user *)arg, sizeof(mode))) return -EFAULT; dev->agp->mode = mode.mode; @@ -210,10 +210,11 @@ int DRM(agp_alloc)(struct inode *inode, struct file *filp, DRM_AGP_MEM *memory; unsigned long pages; u32 type; + drm_agp_buffer_t __user *argp = (void __user *)arg; if (!dev->agp || !dev->agp->acquired) return -EINVAL; - if (copy_from_user(&request, (drm_agp_buffer_t *)arg, sizeof(request))) + if (copy_from_user(&request, argp, sizeof(request))) return -EFAULT; if (!(entry = DRM(alloc)(sizeof(*entry), DRM_MEM_AGPLISTS))) return -ENOMEM; @@ -241,7 +242,7 @@ int DRM(agp_alloc)(struct inode *inode, struct file *filp, request.handle = entry->handle; request.physical = memory->physical; - if (copy_to_user((drm_agp_buffer_t *)arg, &request, sizeof(request))) { + if (copy_to_user(argp, &request, sizeof(request))) { dev->agp->memory = entry->next; dev->agp->memory->prev = NULL; DRM(free_agp)(memory, pages); @@ -295,7 +296,7 @@ int DRM(agp_unbind)(struct inode *inode, struct file *filp, if (!dev->agp || !dev->agp->acquired) return -EINVAL; - if (copy_from_user(&request, (drm_agp_binding_t *)arg, sizeof(request))) + if (copy_from_user(&request, (drm_agp_binding_t __user *)arg, sizeof(request))) return -EFAULT; if (!(entry = DRM(agp_lookup_entry)(dev, request.handle))) return -EINVAL; @@ -332,7 +333,7 @@ int DRM(agp_bind)(struct inode *inode, struct file *filp, if (!dev->agp || !dev->agp->acquired || !drm_agp->bind_memory) return -EINVAL; - if (copy_from_user(&request, (drm_agp_binding_t *)arg, sizeof(request))) + if (copy_from_user(&request, (drm_agp_binding_t __user *)arg, sizeof(request))) return -EFAULT; if (!(entry = DRM(agp_lookup_entry)(dev, request.handle))) return -EINVAL; @@ -371,7 +372,7 @@ int DRM(agp_free)(struct inode *inode, struct file *filp, if (!dev->agp || !dev->agp->acquired) return -EINVAL; - if (copy_from_user(&request, (drm_agp_buffer_t *)arg, sizeof(request))) + if (copy_from_user(&request, (drm_agp_buffer_t __user *)arg, sizeof(request))) return -EFAULT; if (!(entry = DRM(agp_lookup_entry)(dev, request.handle))) return -EINVAL; diff --git a/linux/drm_auth.h b/linux/drm_auth.h index e027303a..a6d174cd 100644 --- a/linux/drm_auth.h +++ b/linux/drm_auth.h @@ -195,7 +195,7 @@ int DRM(getmagic)(struct inode *inode, struct file *filp, } DRM_DEBUG("%u\n", auth.magic); - if (copy_to_user((drm_auth_t *)arg, &auth, sizeof(auth))) + if (copy_to_user((drm_auth_t __user *)arg, &auth, sizeof(auth))) return -EFAULT; return 0; } @@ -219,7 +219,7 @@ int DRM(authmagic)(struct inode *inode, struct file *filp, drm_auth_t auth; drm_file_t *file; - if (copy_from_user(&auth, (drm_auth_t *)arg, sizeof(auth))) + if (copy_from_user(&auth, (drm_auth_t __user *)arg, sizeof(auth))) return -EFAULT; DRM_DEBUG("%u\n", auth.magic); if ((file = DRM(find_file)(dev, auth.magic))) { diff --git a/linux/drm_bufs.h b/linux/drm_bufs.h index 38ddb790..7270ff4a 100644 --- a/linux/drm_bufs.h +++ b/linux/drm_bufs.h @@ -71,9 +71,10 @@ int DRM(order)( unsigned long size ) int order; unsigned long tmp; - for ( order = 0, tmp = size ; tmp >>= 1 ; ++order ); + for (order = 0, tmp = size >> 1; tmp; tmp >>= 1, order++) + ; - if ( size & ~(1 << order) ) + if (size & (size - 1)) ++order; return order; @@ -98,6 +99,7 @@ int DRM(addmap)( struct inode *inode, struct file *filp, drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; drm_map_t *map; + drm_map_t __user *argp = (void __user *)arg; drm_map_list_t *list; if ( !(filp->f_mode & 3) ) return -EACCES; /* Require read/write */ @@ -106,7 +108,7 @@ int DRM(addmap)( struct inode *inode, struct file *filp, if ( !map ) return -ENOMEM; - if ( copy_from_user( map, (drm_map_t *)arg, sizeof(*map) ) ) { + if ( copy_from_user( map, argp, sizeof(*map) ) ) { DRM(free)( map, sizeof(*map), DRM_MEM_MAPS ); return -EFAULT; } @@ -207,10 +209,10 @@ int DRM(addmap)( struct inode *inode, struct file *filp, list_add(&list->head, &dev->maplist->head); up(&dev->struct_sem); - if ( copy_to_user( (drm_map_t *)arg, map, sizeof(*map) ) ) + if ( copy_to_user( argp, map, sizeof(*map) ) ) return -EFAULT; if ( map->type != _DRM_SHM ) { - if ( copy_to_user( &((drm_map_t *)arg)->handle, + if ( copy_to_user( &argp->handle, &map->offset, sizeof(map->offset) ) ) return -EFAULT; @@ -247,7 +249,7 @@ int DRM(rmmap)(struct inode *inode, struct file *filp, drm_map_t request; int found_maps = 0; - if (copy_from_user(&request, (drm_map_t *)arg, + if (copy_from_user(&request, (drm_map_t __user *)arg, sizeof(request))) { return -EFAULT; } @@ -389,10 +391,11 @@ int DRM(addbufs_agp)( struct inode *inode, struct file *filp, int byte_count; int i; drm_buf_t **temp_buflist; + drm_buf_desc_t __user *argp = (void __user *)arg; if ( !dma ) return -EINVAL; - if ( copy_from_user( &request, (drm_buf_desc_t *)arg, + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; @@ -529,7 +532,7 @@ int DRM(addbufs_agp)( struct inode *inode, struct file *filp, request.count = entry->buf_count; request.size = size; - if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) ) + if ( copy_to_user( argp, &request, sizeof(request) ) ) return -EFAULT; dma->flags = _DRM_DMA_USE_AGP; @@ -562,10 +565,11 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp, int page_count; unsigned long *temp_pagelist; drm_buf_t **temp_buflist; + drm_buf_desc_t __user *argp = (void __user *)arg; if ( !dma ) return -EINVAL; - if ( copy_from_user( &request, (drm_buf_desc_t *)arg, + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; @@ -767,7 +771,7 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp, request.count = entry->buf_count; request.size = size; - if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) ) + if ( copy_to_user( argp, &request, sizeof(request) ) ) return -EFAULT; atomic_dec( &dev->buf_alloc ); @@ -783,6 +787,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp, drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; drm_device_dma_t *dma = dev->dma; + drm_buf_desc_t __user *argp = (void __user *)arg; drm_buf_desc_t request; drm_buf_entry_t *entry; drm_buf_t *buf; @@ -800,7 +805,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp, if ( !dma ) return -EINVAL; - if ( copy_from_user( &request, (drm_buf_desc_t *)arg, + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; @@ -938,7 +943,7 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp, request.count = entry->buf_count; request.size = size; - if ( copy_to_user( (drm_buf_desc_t *)arg, &request, sizeof(request) ) ) + if ( copy_to_user( argp, &request, sizeof(request) ) ) return -EFAULT; dma->flags = _DRM_DMA_USE_SG; @@ -967,7 +972,7 @@ int DRM(addbufs)( struct inode *inode, struct file *filp, { drm_buf_desc_t request; - if ( copy_from_user( &request, (drm_buf_desc_t *)arg, + if ( copy_from_user( &request, (drm_buf_desc_t __user *)arg, sizeof(request) ) ) return -EFAULT; @@ -1013,6 +1018,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_device_dma_t *dma = dev->dma; drm_buf_info_t request; + drm_buf_info_t __user *argp = (void __user *)arg; int i; int count; @@ -1026,9 +1032,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp, ++dev->buf_use; /* Can't allocate more after this call */ spin_unlock( &dev->count_lock ); - if ( copy_from_user( &request, - (drm_buf_info_t *)arg, - sizeof(request) ) ) + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; for ( i = 0, count = 0 ; i < DRM_MAX_ORDER + 1 ; i++ ) { @@ -1040,7 +1044,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp, if ( request.count >= count ) { for ( i = 0, count = 0 ; i < DRM_MAX_ORDER + 1 ; i++ ) { if ( dma->bufs[i].buf_count ) { - drm_buf_desc_t *to = &request.list[count]; + drm_buf_desc_t __user *to = &request.list[count]; drm_buf_entry_t *from = &dma->bufs[i]; drm_freelist_t *list = &dma->bufs[i].freelist; if ( copy_to_user( &to->count, @@ -1069,9 +1073,7 @@ int DRM(infobufs)( struct inode *inode, struct file *filp, } request.count = count; - if ( copy_to_user( (drm_buf_info_t *)arg, - &request, - sizeof(request) ) ) + if ( copy_to_user( argp, &request, sizeof(request) ) ) return -EFAULT; return 0; @@ -1104,7 +1106,7 @@ int DRM(markbufs)( struct inode *inode, struct file *filp, if ( !dma ) return -EINVAL; if ( copy_from_user( &request, - (drm_buf_desc_t *)arg, + (drm_buf_desc_t __user *)arg, sizeof(request) ) ) return -EFAULT; @@ -1151,7 +1153,7 @@ int DRM(freebufs)( struct inode *inode, struct file *filp, if ( !dma ) return -EINVAL; if ( copy_from_user( &request, - (drm_buf_free_t *)arg, + (drm_buf_free_t __user *)arg, sizeof(request) ) ) return -EFAULT; @@ -1197,6 +1199,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp, drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; drm_device_dma_t *dma = dev->dma; + drm_buf_map_t __user *argp = (void __user *)arg; int retcode = 0; const int zero = 0; unsigned long virtual; @@ -1214,8 +1217,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp, dev->buf_use++; /* Can't allocate more after this call */ spin_unlock( &dev->count_lock ); - if ( copy_from_user( &request, (drm_buf_map_t *)arg, - sizeof(request) ) ) + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; if ( request.count >= dma->buf_count ) { @@ -1262,7 +1264,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp, retcode = (signed long)virtual; goto done; } - request.virtual = (void *)virtual; + request.virtual = (void __user *)virtual; for ( i = 0 ; i < dma->buf_count ; i++ ) { if ( copy_to_user( &request.list[i].idx, @@ -1296,7 +1298,7 @@ int DRM(mapbufs)( struct inode *inode, struct file *filp, request.count = dma->buf_count; DRM_DEBUG( "%d buffers, retcode = %d\n", request.count, retcode ); - if ( copy_to_user( (drm_buf_map_t *)arg, &request, sizeof(request) ) ) + if ( copy_to_user( argp, &request, sizeof(request) ) ) return -EFAULT; return retcode; diff --git a/linux/drm_context.h b/linux/drm_context.h index 474b5ba0..8795198a 100644 --- a/linux/drm_context.h +++ b/linux/drm_context.h @@ -215,12 +215,11 @@ int DRM(getsareactx)(struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_ctx_priv_map_t __user *argp = (void __user *)arg; drm_ctx_priv_map_t request; drm_map_t *map; - if (copy_from_user(&request, - (drm_ctx_priv_map_t *)arg, - sizeof(request))) + if (copy_from_user(&request, argp, sizeof(request))) return -EFAULT; down(&dev->struct_sem); @@ -233,7 +232,7 @@ int DRM(getsareactx)(struct inode *inode, struct file *filp, up(&dev->struct_sem); request.handle = map->handle; - if (copy_to_user((drm_ctx_priv_map_t *)arg, &request, sizeof(request))) + if (copy_to_user(argp, &request, sizeof(request))) return -EFAULT; return 0; } @@ -261,7 +260,7 @@ int DRM(setsareactx)(struct inode *inode, struct file *filp, struct list_head *list; if (copy_from_user(&request, - (drm_ctx_priv_map_t *)arg, + (drm_ctx_priv_map_t __user *)arg, sizeof(request))) return -EFAULT; @@ -364,10 +363,11 @@ int DRM(resctx)( struct inode *inode, struct file *filp, unsigned int cmd, unsigned long arg ) { drm_ctx_res_t res; + drm_ctx_t __user *argp = (void __user *)arg; drm_ctx_t ctx; int i; - if ( copy_from_user( &res, (drm_ctx_res_t *)arg, sizeof(res) ) ) + if ( copy_from_user( &res, argp, sizeof(res) ) ) return -EFAULT; if ( res.count >= DRM_RESERVED_CONTEXTS ) { @@ -381,7 +381,7 @@ int DRM(resctx)( struct inode *inode, struct file *filp, } res.count = DRM_RESERVED_CONTEXTS; - if ( copy_to_user( (drm_ctx_res_t *)arg, &res, sizeof(res) ) ) + if ( copy_to_user( argp, &res, sizeof(res) ) ) return -EFAULT; return 0; } @@ -403,9 +403,10 @@ int DRM(addctx)( struct inode *inode, struct file *filp, drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; drm_ctx_list_t * ctx_entry; + drm_ctx_t __user *argp = (void __user *)arg; drm_ctx_t ctx; - if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) ) + if ( copy_from_user( &ctx, argp, sizeof(ctx) ) ) return -EFAULT; ctx.handle = DRM(ctxbitmap_next)( dev ); @@ -438,7 +439,7 @@ int DRM(addctx)( struct inode *inode, struct file *filp, ++dev->ctx_count; up( &dev->ctxlist_sem ); - if ( copy_to_user( (drm_ctx_t *)arg, &ctx, sizeof(ctx) ) ) + if ( copy_to_user( argp, &ctx, sizeof(ctx) ) ) return -EFAULT; return 0; } @@ -462,15 +463,16 @@ int DRM(modctx)( struct inode *inode, struct file *filp, int DRM(getctx)( struct inode *inode, struct file *filp, unsigned int cmd, unsigned long arg ) { + drm_ctx_t __user *argp = (void __user *)arg; drm_ctx_t ctx; - if ( copy_from_user( &ctx, (drm_ctx_t*)arg, sizeof(ctx) ) ) + if ( copy_from_user( &ctx, argp, sizeof(ctx) ) ) return -EFAULT; /* This is 0, because we don't handle any context flags */ ctx.flags = 0; - if ( copy_to_user( (drm_ctx_t*)arg, &ctx, sizeof(ctx) ) ) + if ( copy_to_user( argp, &ctx, sizeof(ctx) ) ) return -EFAULT; return 0; } @@ -493,7 +495,7 @@ int DRM(switchctx)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_ctx_t ctx; - if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) ) + if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) ) return -EFAULT; DRM_DEBUG( "%d\n", ctx.handle ); @@ -518,7 +520,7 @@ int DRM(newctx)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_ctx_t ctx; - if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) ) + if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) ) return -EFAULT; DRM_DEBUG( "%d\n", ctx.handle ); @@ -545,7 +547,7 @@ int DRM(rmctx)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_ctx_t ctx; - if ( copy_from_user( &ctx, (drm_ctx_t *)arg, sizeof(ctx) ) ) + if ( copy_from_user( &ctx, (drm_ctx_t __user *)arg, sizeof(ctx) ) ) return -EFAULT; DRM_DEBUG( "%d\n", ctx.handle ); diff --git a/linux/drm_dma.h b/linux/drm_dma.h index 14ae5545..04467342 100644 --- a/linux/drm_dma.h +++ b/linux/drm_dma.h @@ -215,7 +215,7 @@ int DRM(control)( struct inode *inode, struct file *filp, { drm_control_t ctl; - if ( copy_from_user( &ctl, (drm_control_t *)arg, sizeof(ctl) ) ) + if ( copy_from_user( &ctl, (drm_control_t __user *)arg, sizeof(ctl) ) ) return -EFAULT; switch ( ctl.func ) { diff --git a/linux/drm_drawable.h b/linux/drm_drawable.h index 892ae4e0..59c13ef8 100644 --- a/linux/drm_drawable.h +++ b/linux/drm_drawable.h @@ -44,7 +44,7 @@ int DRM(adddraw)(struct inode *inode, struct file *filp, draw.handle = 0; /* NOOP */ DRM_DEBUG("%d\n", draw.handle); - if (copy_to_user((drm_draw_t *)arg, &draw, sizeof(draw))) + if (copy_to_user((drm_draw_t __user *)arg, &draw, sizeof(draw))) return -EFAULT; return 0; } diff --git a/linux/drm_drv.h b/linux/drm_drv.h index 42831be0..706d762f 100644 --- a/linux/drm_drv.h +++ b/linux/drm_drv.h @@ -817,12 +817,11 @@ module_exit( drm_exit ); int DRM(version)( struct inode *inode, struct file *filp, unsigned int cmd, unsigned long arg ) { + drm_version_t __user *argp = (void __user *)arg; drm_version_t version; int len; - if ( copy_from_user( &version, - (drm_version_t *)arg, - sizeof(version) ) ) + if ( copy_from_user( &version, argp, sizeof(version) ) ) return -EFAULT; #define DRM_COPY( name, value ) \ @@ -842,9 +841,7 @@ int DRM(version)( struct inode *inode, struct file *filp, DRM_COPY( version.date, DRIVER_DATE ); DRM_COPY( version.desc, DRIVER_DESC ); - if ( copy_to_user( (drm_version_t *)arg, - &version, - sizeof(version) ) ) + if ( copy_to_user( argp, &version, sizeof(version) ) ) return -EFAULT; return 0; } @@ -1124,7 +1121,7 @@ int DRM(lock)( struct inode *inode, struct file *filp, ++priv->lock_count; - if ( copy_from_user( &lock, (drm_lock_t *)arg, sizeof(lock) ) ) + if ( copy_from_user( &lock, (drm_lock_t __user *)arg, sizeof(lock) ) ) return -EFAULT; if ( lock.context == DRM_KERNEL_CONTEXT ) { @@ -1237,7 +1234,7 @@ int DRM(unlock)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_lock_t lock; - if ( copy_from_user( &lock, (drm_lock_t *)arg, sizeof(lock) ) ) + if ( copy_from_user( &lock, (drm_lock_t __user *)arg, sizeof(lock) ) ) return -EFAULT; if ( lock.context == DRM_KERNEL_CONTEXT ) { diff --git a/linux/drm_fops.h b/linux/drm_fops.h index 152cb4d7..869736a4 100644 --- a/linux/drm_fops.h +++ b/linux/drm_fops.h @@ -142,7 +142,7 @@ unsigned int DRM(poll)(struct file *filp, struct poll_table_struct *wait) #if !__HAVE_DRIVER_FOPS_READ /** No-op. */ -ssize_t DRM(read)(struct file *filp, char *buf, size_t count, loff_t *off) +ssize_t DRM(read)(struct file *filp, char __user *buf, size_t count, loff_t *off) { return 0; } diff --git a/linux/drm_ioctl.h b/linux/drm_ioctl.h index 5fa7694c..379a4f05 100644 --- a/linux/drm_ioctl.h +++ b/linux/drm_ioctl.h @@ -54,16 +54,17 @@ int DRM(getunique)(struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_unique_t __user *argp = (void __user *)arg; drm_unique_t u; - if (copy_from_user(&u, (drm_unique_t *)arg, sizeof(u))) + if (copy_from_user(&u, argp, sizeof(u))) return -EFAULT; if (u.unique_len >= dev->unique_len) { if (copy_to_user(u.unique, dev->unique, dev->unique_len)) return -EFAULT; } u.unique_len = dev->unique_len; - if (copy_to_user((drm_unique_t *)arg, &u, sizeof(u))) + if (copy_to_user(argp, &u, sizeof(u))) return -EFAULT; return 0; } @@ -92,7 +93,8 @@ int DRM(setunique)(struct inode *inode, struct file *filp, if (dev->unique_len || dev->unique) return -EBUSY; - if (copy_from_user(&u, (drm_unique_t *)arg, sizeof(u))) return -EFAULT; + if (copy_from_user(&u, (drm_unique_t __user *)arg, sizeof(u))) + return -EFAULT; if (!u.unique_len || u.unique_len > 1024) return -EINVAL; @@ -172,13 +174,14 @@ int DRM(getmap)( struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_map_t __user *argp = (void __user *)arg; drm_map_t map; drm_map_list_t *r_list = NULL; struct list_head *list; int idx; int i; - if (copy_from_user(&map, (drm_map_t *)arg, sizeof(map))) + if (copy_from_user(&map, argp, sizeof(map))) return -EFAULT; idx = map.offset; @@ -209,7 +212,7 @@ int DRM(getmap)( struct inode *inode, struct file *filp, map.mtrr = r_list->map->mtrr; up(&dev->struct_sem); - if (copy_to_user((drm_map_t *)arg, &map, sizeof(map))) return -EFAULT; + if (copy_to_user(argp, &map, sizeof(map))) return -EFAULT; return 0; } @@ -231,12 +234,13 @@ int DRM(getclient)( struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_client_t __user *argp = (void __user *)arg; drm_client_t client; drm_file_t *pt; int idx; int i; - if (copy_from_user(&client, (drm_client_t *)arg, sizeof(client))) + if (copy_from_user(&client, argp, sizeof(client))) return -EFAULT; idx = client.idx; down(&dev->struct_sem); @@ -254,7 +258,7 @@ int DRM(getclient)( struct inode *inode, struct file *filp, client.iocs = pt->ioctl_count; up(&dev->struct_sem); - if (copy_to_user((drm_client_t *)arg, &client, sizeof(client))) + if (copy_to_user(argp, &client, sizeof(client))) return -EFAULT; return 0; } @@ -295,7 +299,7 @@ int DRM(getstats)( struct inode *inode, struct file *filp, up(&dev->struct_sem); - if (copy_to_user((drm_stats_t *)arg, &stats, sizeof(stats))) + if (copy_to_user((drm_stats_t __user *)arg, &stats, sizeof(stats))) return -EFAULT; return 0; } @@ -309,15 +313,16 @@ int DRM(setversion)(DRM_IOCTL_ARGS) drm_set_version_t sv; drm_set_version_t retv; int if_version; + drm_set_version_t __user *argp = (void __user *)data; - DRM_COPY_FROM_USER_IOCTL(sv, (drm_set_version_t *)data, sizeof(sv)); + DRM_COPY_FROM_USER_IOCTL(sv, argp, sizeof(sv)); retv.drm_di_major = DRM_IF_MAJOR; retv.drm_di_minor = DRM_IF_MINOR; retv.drm_dd_major = DRIVER_MAJOR; retv.drm_dd_minor = DRIVER_MINOR; - DRM_COPY_TO_USER_IOCTL((drm_set_version_t *)data, retv, sizeof(sv)); + DRM_COPY_TO_USER_IOCTL(argp, retv, sizeof(sv)); if (sv.drm_di_major != -1) { if (sv.drm_di_major != DRM_IF_MAJOR || diff --git a/linux/drm_irq.h b/linux/drm_irq.h index f53f142a..035eb70f 100644 --- a/linux/drm_irq.h +++ b/linux/drm_irq.h @@ -66,9 +66,10 @@ int DRM(irq_by_busid)(struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_irq_busid_t __user *argp = (void __user *)arg; drm_irq_busid_t p; - if (copy_from_user(&p, (drm_irq_busid_t *)arg, sizeof(p))) + if (copy_from_user(&p, argp, sizeof(p))) return -EFAULT; if ((p.busnum >> 8) != dev->pci_domain || @@ -81,7 +82,7 @@ int DRM(irq_by_busid)(struct inode *inode, struct file *filp, DRM_DEBUG("%d:%d:%d => IRQ %d\n", p.busnum, p.devnum, p.funcnum, p.irq); - if (copy_to_user((drm_irq_busid_t *)arg, &p, sizeof(p))) + if (copy_to_user(argp, &p, sizeof(p))) return -EFAULT; return 0; } @@ -214,7 +215,7 @@ int DRM(control)( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_control_t ctl; - if ( copy_from_user( &ctl, (drm_control_t *)arg, sizeof(ctl) ) ) + if ( copy_from_user( &ctl, (drm_control_t __user *)arg, sizeof(ctl) ) ) return -EFAULT; switch ( ctl.func ) { @@ -255,6 +256,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS ) { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_wait_vblank_t __user *argp = (void __user *)data; drm_wait_vblank_t vblwait; struct timeval now; int ret = 0; @@ -263,8 +265,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS ) if (!dev->irq) return -EINVAL; - DRM_COPY_FROM_USER_IOCTL( vblwait, (drm_wait_vblank_t *)data, - sizeof(vblwait) ); + DRM_COPY_FROM_USER_IOCTL( vblwait, argp, sizeof(vblwait) ); switch ( vblwait.request.type & ~_DRM_VBLANK_FLAGS_MASK ) { case _DRM_VBLANK_RELATIVE: @@ -333,8 +334,7 @@ int DRM(wait_vblank)( DRM_IOCTL_ARGS ) } done: - DRM_COPY_TO_USER_IOCTL( (drm_wait_vblank_t *)data, vblwait, - sizeof(vblwait) ); + DRM_COPY_TO_USER_IOCTL( argp, vblwait, sizeof(vblwait) ); return ret; } diff --git a/linux/drm_scatter.h b/linux/drm_scatter.h index 45a30fc3..4aaf89d4 100644 --- a/linux/drm_scatter.h +++ b/linux/drm_scatter.h @@ -67,6 +67,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_scatter_gather_t __user *argp = (void __user *)arg; drm_scatter_gather_t request; drm_sg_mem_t *entry; unsigned long pages, i, j; @@ -76,9 +77,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp, if ( dev->sg ) return -EINVAL; - if ( copy_from_user( &request, - (drm_scatter_gather_t *)arg, - sizeof(request) ) ) + if ( copy_from_user( &request, argp, sizeof(request) ) ) return -EFAULT; entry = DRM(alloc)( sizeof(*entry), DRM_MEM_SGLISTS ); @@ -146,9 +145,7 @@ int DRM(sg_alloc)( struct inode *inode, struct file *filp, request.handle = entry->handle; - if ( copy_to_user( (drm_scatter_gather_t *)arg, - &request, - sizeof(request) ) ) { + if ( copy_to_user( argp, &request, sizeof(request) ) ) { DRM(sg_cleanup)( entry ); return -EFAULT; } @@ -211,7 +208,7 @@ int DRM(sg_free)( struct inode *inode, struct file *filp, drm_sg_mem_t *entry; if ( copy_from_user( &request, - (drm_scatter_gather_t *)arg, + (drm_scatter_gather_t __user *)arg, sizeof(request) ) ) return -EFAULT; diff --git a/linux/gamma_context.h b/linux/gamma_context.h index df319c03..1c854066 100644 --- a/linux/gamma_context.h +++ b/linux/gamma_context.h @@ -42,7 +42,7 @@ the circular buffer), is based on Alessandro Rubini's LINUX DEVICE DRIVERS (Cambridge: O'Reilly, 1998), pages 111-113. */ -ssize_t DRM(read)(struct file *filp, char *buf, size_t count, loff_t *off) +ssize_t DRM(read)(struct file *filp, char __user *buf, size_t count, loff_t *off) { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; @@ -295,12 +295,13 @@ static int DRM(alloc_queue)(drm_device_t *dev) int DRM(resctx)(struct inode *inode, struct file *filp, unsigned int cmd, unsigned long arg) { + drm_ctx_res_t __user *argp = (void __user *)arg; drm_ctx_res_t res; drm_ctx_t ctx; int i; DRM_DEBUG("%d\n", DRM_RESERVED_CONTEXTS); - if (copy_from_user(&res, (drm_ctx_res_t *)arg, sizeof(res))) + if (copy_from_user(&res, argp, sizeof(res))) return -EFAULT; if (res.count >= DRM_RESERVED_CONTEXTS) { memset(&ctx, 0, sizeof(ctx)); @@ -313,7 +314,7 @@ int DRM(resctx)(struct inode *inode, struct file *filp, } } res.count = DRM_RESERVED_CONTEXTS; - if (copy_to_user((drm_ctx_res_t *)arg, &res, sizeof(res))) + if (copy_to_user(argp, &res, sizeof(res))) return -EFAULT; return 0; } @@ -324,8 +325,9 @@ int DRM(addctx)(struct inode *inode, struct file *filp, drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; drm_ctx_t ctx; + drm_ctx_t __user *argp = (void __user *)arg; - if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx))) + if (copy_from_user(&ctx, argp, sizeof(ctx))) return -EFAULT; if ((ctx.handle = DRM(alloc_queue)(dev)) == DRM_KERNEL_CONTEXT) { /* Init kernel's context and get a new one. */ @@ -334,7 +336,7 @@ int DRM(addctx)(struct inode *inode, struct file *filp, } DRM(init_queue)(dev, dev->queuelist[ctx.handle], &ctx); DRM_DEBUG("%d\n", ctx.handle); - if (copy_to_user((drm_ctx_t *)arg, &ctx, sizeof(ctx))) + if (copy_to_user(argp, &ctx, sizeof(ctx))) return -EFAULT; return 0; } @@ -347,7 +349,7 @@ int DRM(modctx)(struct inode *inode, struct file *filp, drm_ctx_t ctx; drm_queue_t *q; - if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx))) + if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx))) return -EFAULT; DRM_DEBUG("%d\n", ctx.handle); @@ -378,10 +380,11 @@ int DRM(getctx)(struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_ctx_t __user *argp = (void __user *)arg; drm_ctx_t ctx; drm_queue_t *q; - if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx))) + if (copy_from_user(&ctx, argp, sizeof(ctx))) return -EFAULT; DRM_DEBUG("%d\n", ctx.handle); @@ -399,7 +402,7 @@ int DRM(getctx)(struct inode *inode, struct file *filp, ctx.flags = q->flags; atomic_dec(&q->use_count); - if (copy_to_user((drm_ctx_t *)arg, &ctx, sizeof(ctx))) + if (copy_to_user(argp, &ctx, sizeof(ctx))) return -EFAULT; return 0; @@ -412,7 +415,7 @@ int DRM(switchctx)(struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_ctx_t ctx; - if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx))) + if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx))) return -EFAULT; DRM_DEBUG("%d\n", ctx.handle); return DRM(context_switch)(dev, dev->last_context, ctx.handle); @@ -425,7 +428,7 @@ int DRM(newctx)(struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_ctx_t ctx; - if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx))) + if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx))) return -EFAULT; DRM_DEBUG("%d\n", ctx.handle); DRM(context_switch_complete)(dev, ctx.handle); @@ -442,7 +445,7 @@ int DRM(rmctx)(struct inode *inode, struct file *filp, drm_queue_t *q; drm_buf_t *buf; - if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx))) + if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx))) return -EFAULT; DRM_DEBUG("%d\n", ctx.handle); diff --git a/linux/gamma_dma.c b/linux/gamma_dma.c index 155275ce..ffa5ce1d 100644 --- a/linux/gamma_dma.c +++ b/linux/gamma_dma.c @@ -148,6 +148,7 @@ irqreturn_t gamma_irq_handler( DRM_IRQ_ARGS ) queue_task(&dev->tq, &tq_immediate); mark_bh(IMMEDIATE_BH); #else + /* Dispatch new buffer */ schedule_work(&dev->work); #endif } @@ -571,9 +572,10 @@ int gamma_dma(struct inode *inode, struct file *filp, unsigned int cmd, drm_device_t *dev = priv->dev; drm_device_dma_t *dma = dev->dma; int retcode = 0; + drm_dma_t __user *argp = (void __user *)arg; drm_dma_t d; - if (copy_from_user(&d, (drm_dma_t *)arg, sizeof(d))) + if (copy_from_user(&d, argp, sizeof(d))) return -EFAULT; if (d.send_count < 0 || d.send_count > dma->buf_count) { @@ -603,7 +605,7 @@ int gamma_dma(struct inode *inode, struct file *filp, unsigned int cmd, DRM_DEBUG("%d returning, granted = %d\n", current->pid, d.granted_count); - if (copy_to_user((drm_dma_t *)arg, &d, sizeof(d))) + if (copy_to_user(argp, &d, sizeof(d))) return -EFAULT; return retcode; @@ -726,7 +728,7 @@ int gamma_dma_init( struct inode *inode, struct file *filp, LOCK_TEST_WITH_RETURN( dev, filp ); - if ( copy_from_user( &init, (drm_gamma_init_t *)arg, sizeof(init) ) ) + if ( copy_from_user( &init, (drm_gamma_init_t __user *)arg, sizeof(init) ) ) return -EFAULT; switch ( init.func ) { @@ -795,7 +797,7 @@ int gamma_dma_copy( struct inode *inode, struct file *filp, drm_device_t *dev = priv->dev; drm_gamma_copy_t copy; - if ( copy_from_user( ©, (drm_gamma_copy_t *)arg, sizeof(copy) ) ) + if ( copy_from_user( ©, (drm_gamma_copy_t __user *)arg, sizeof(copy) ) ) return -EFAULT; return gamma_do_copy_dma( dev, © ); @@ -810,12 +812,11 @@ int gamma_getsareactx(struct inode *inode, struct file *filp, { drm_file_t *priv = filp->private_data; drm_device_t *dev = priv->dev; + drm_ctx_priv_map_t __user *argp = (void __user *)arg; drm_ctx_priv_map_t request; drm_map_t *map; - if (copy_from_user(&request, - (drm_ctx_priv_map_t *)arg, - sizeof(request))) + if (copy_from_user(&request, argp, sizeof(request))) return -EFAULT; down(&dev->struct_sem); @@ -828,7 +829,7 @@ int gamma_getsareactx(struct inode *inode, struct file *filp, up(&dev->struct_sem); request.handle = map->handle; - if (copy_to_user((drm_ctx_priv_map_t *)arg, &request, sizeof(request))) + if (copy_to_user(argp, &request, sizeof(request))) return -EFAULT; return 0; } @@ -844,7 +845,7 @@ int gamma_setsareactx(struct inode *inode, struct file *filp, struct list_head *list; if (copy_from_user(&request, - (drm_ctx_priv_map_t *)arg, + (drm_ctx_priv_map_t __user *)arg, sizeof(request))) return -EFAULT; diff --git a/linux/gamma_lock.h b/linux/gamma_lock.h index 1ecbf8f9..ddec67e4 100644 --- a/linux/gamma_lock.h +++ b/linux/gamma_lock.h @@ -132,7 +132,7 @@ int DRM(finish)(struct inode *inode, struct file *filp, unsigned int cmd, DRM_DEBUG("\n"); - if (copy_from_user(&lock, (drm_lock_t *)arg, sizeof(lock))) + if (copy_from_user(&lock, (drm_lock_t __user *)arg, sizeof(lock))) return -EFAULT; ret = DRM(flush_block_and_flush)(dev, lock.context, lock.flags); DRM(flush_unblock)(dev, lock.context, lock.flags); -- cgit v1.2.3