Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3728d254 authored by Al Viro's avatar Al Viro Committed by Linus Torvalds
Browse files

[PATCH] m68k: amifb __user annotations 



Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Cc: Roman Zippel <zippel@linux-m68k.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent d85f6891

drivers/video/amifb.c

+17 −17
Original line number Diff line number Diff line
@@ -1166,8 +1166,8 @@ static void ami_update_display(void); 
static void ami_init_display(void);

static void ami_do_blank(void);

static int ami_get_fix_cursorinfo(struct fb_fix_cursorinfo *fix);

static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data);

static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data);

static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char __user *data);

static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char __user *data);

static int ami_get_cursorstate(struct fb_cursorstate *state);

static int ami_set_cursorstate(struct fb_cursorstate *state);

static void ami_set_sprite(void);
@@ -2181,6 +2181,7 @@ static int amifb_ioctl(struct inode *inode, struct file *file, 
		struct fb_var_cursorinfo var;

		struct fb_cursorstate state;

	} crsr;

	void __user *argp = (void __user *)arg;

	int i;



	switch (cmd) {
@@ -2188,33 +2189,32 @@ static int amifb_ioctl(struct inode *inode, struct file *file, 
			i = ami_get_fix_cursorinfo(&crsr.fix);

			if (i)

				return i;

			return copy_to_user((void *)arg, &crsr.fix,

			return copy_to_user(argp, &crsr.fix,

					    sizeof(crsr.fix)) ? -EFAULT : 0;



		case FBIOGET_VCURSORINFO:

			i = ami_get_var_cursorinfo(&crsr.var,

				((struct fb_var_cursorinfo *)arg)->data);

				((struct fb_var_cursorinfo __user *)arg)->data);

			if (i)

				return i;

			return copy_to_user((void *)arg, &crsr.var,

			return copy_to_user(argp, &crsr.var,

					    sizeof(crsr.var)) ? -EFAULT : 0;



		case FBIOPUT_VCURSORINFO:

			if (copy_from_user(&crsr.var, (void *)arg,

					   sizeof(crsr.var)))

			if (copy_from_user(&crsr.var, argp, sizeof(crsr.var)))

				return -EFAULT;

			return ami_set_var_cursorinfo(&crsr.var,

				((struct fb_var_cursorinfo *)arg)->data);

				((struct fb_var_cursorinfo __user *)arg)->data);



		case FBIOGET_CURSORSTATE:

			i = ami_get_cursorstate(&crsr.state);

			if (i)

				return i;

			return copy_to_user((void *)arg, &crsr.state,

			return copy_to_user(argp, &crsr.state,

					    sizeof(crsr.state)) ? -EFAULT : 0;



		case FBIOPUT_CURSORSTATE:

			if (copy_from_user(&crsr.state, (void *)arg,

			if (copy_from_user(&crsr.state, argp,

					   sizeof(crsr.state)))

				return -EFAULT;

			return ami_set_cursorstate(&crsr.state);
@@ -3327,7 +3327,7 @@ static int ami_get_fix_cursorinfo(struct fb_fix_cursorinfo *fix) 
	return 0;

}



static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data)

static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char __user *data)

{

	struct amifb_par *par = &currentpar;

	register u_short *lspr, *sspr;
@@ -3349,14 +3349,14 @@ static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data) 
	var->yspot = par->crsr.spot_y;

	if (size > var->height*var->width)

		return -ENAMETOOLONG;

	if (!access_ok(VERIFY_WRITE, (void *)data, size))

	if (!access_ok(VERIFY_WRITE, data, size))

		return -EFAULT;

	delta = 1<<par->crsr.fmode;

	lspr = lofsprite + (delta<<1);

	if (par->bplcon0 & BPC0_LACE)

		sspr = shfsprite + (delta<<1);

	else

		sspr = 0;

		sspr = NULL;

	for (height = (short)var->height-1; height >= 0; height--) {

		bits = 0; words = delta; datawords = 0;

		for (width = (short)var->width-1; width >= 0; width--) {
@@ -3402,7 +3402,7 @@ static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data) 
	return 0;

}



static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data)

static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char __user *data)

{

	struct amifb_par *par = &currentpar;

	register u_short *lspr, *sspr;
@@ -3429,7 +3429,7 @@ static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data) 
		return -EINVAL;

	if (!var->height)

		return -EINVAL;

	if (!access_ok(VERIFY_READ, (void *)data, var->width*var->height))

	if (!access_ok(VERIFY_READ, data, var->width*var->height))

		return -EFAULT;

	delta = 1<<fmode;

	lofsprite = shfsprite = (u_short *)spritememory;
@@ -3444,13 +3444,13 @@ static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var, u_char *data) 
		if (((var->height+2)<<fmode<<2) > SPRITEMEMSIZE)

			return -EINVAL;

		memset(lspr, 0, (var->height+2)<<fmode<<2);

		sspr = 0;

		sspr = NULL;

	}

	for (height = (short)var->height-1; height >= 0; height--) {

		bits = 16; words = delta; datawords = 0;

		for (width = (short)var->width-1; width >= 0; width--) {

			unsigned long tdata = 0;

			get_user(tdata, (char *)data);

			get_user(tdata, data);

			data++;

#ifdef __mc68000__

			asm volatile (