From: Al Viro Signed-off-by: Al Viro Cc: Roman Zippel Signed-off-by: Andrew Morton --- drivers/char/amiserial.c | 19 +++++++++---------- 1 files changed, 9 insertions(+), 10 deletions(-) diff -puN drivers/char/amiserial.c~m68k-amiserial-__user-annotations drivers/char/amiserial.c --- devel/drivers/char/amiserial.c~m68k-amiserial-__user-annotations 2006-01-04 22:24:37.000000000 -0800 +++ devel-akpm/drivers/char/amiserial.c 2006-01-04 22:24:37.000000000 -0800 @@ -1096,7 +1096,7 @@ static void rs_unthrottle(struct tty_str */ static int get_serial_info(struct async_struct * info, - struct serial_struct * retinfo) + struct serial_struct __user * retinfo) { struct serial_struct tmp; struct serial_state *state = info->state; @@ -1120,7 +1120,7 @@ static int get_serial_info(struct async_ } static int set_serial_info(struct async_struct * info, - struct serial_struct * new_info) + struct serial_struct __user * new_info) { struct serial_struct new_serial; struct serial_state old_state, *state; @@ -1201,7 +1201,7 @@ check_and_exit: * transmit holding register is empty. This functionality * allows an RS485 driver to be written in user space. */ -static int get_lsr_info(struct async_struct * info, unsigned int *value) +static int get_lsr_info(struct async_struct * info, unsigned int __user *value) { unsigned char status; unsigned int result; @@ -1292,6 +1292,7 @@ static int rs_ioctl(struct tty_struct *t struct async_struct * info = (struct async_struct *)tty->driver_data; struct async_icount cprev, cnow; /* kernel counter temps */ struct serial_icounter_struct icount; + void __user *argp = (void __user *)arg; unsigned long flags; if (serial_paranoia_check(info, tty->name, "rs_ioctl")) @@ -1306,19 +1307,17 @@ static int rs_ioctl(struct tty_struct *t switch (cmd) { case TIOCGSERIAL: - return get_serial_info(info, - (struct serial_struct *) arg); + return get_serial_info(info, argp); case TIOCSSERIAL: - return set_serial_info(info, - (struct serial_struct *) arg); + return set_serial_info(info, argp); case TIOCSERCONFIG: return 0; case TIOCSERGETLSR: /* Get line status register */ - return get_lsr_info(info, (unsigned int *) arg); + return get_lsr_info(info, argp); case TIOCSERGSTRUCT: - if (copy_to_user((struct async_struct *) arg, + if (copy_to_user(argp, info, sizeof(struct async_struct))) return -EFAULT; return 0; @@ -1377,7 +1376,7 @@ static int rs_ioctl(struct tty_struct *t icount.brk = cnow.brk; icount.buf_overrun = cnow.buf_overrun; - if (copy_to_user((void *)arg, &icount, sizeof(icount))) + if (copy_to_user(argp, &icount, sizeof(icount))) return -EFAULT; return 0; case TIOCSERGWILD: _