Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/bird

9 files changed, 121 insertions, 116 deletions

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 5959e36c3b4c..4a63a8e2e452 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -69,6 +69,9 @@ config GENERIC_ISA_DMA
 config FIQ
         bool
 
+config ARCH_MTD_XIP
+        bool
+
 source "init/Kconfig"
 
 menu "System Type"
@@ -136,6 +139,7 @@ config ARCH_L7200
 
 config ARCH_PXA
         bool "PXA2xx-based"
+        select ARCH_MTD_XIP
 
 config ARCH_RPC
         bool "RiscPC"
@@ -152,6 +156,7 @@ config ARCH_SA1100
         bool "SA1100-based"
         select ISA
         select ARCH_DISCONTIGMEM_ENABLE
+        select ARCH_MTD_XIP
 
 config ARCH_S3C2410
         bool "Samsung S3C2410"
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index c6d0595da6b5..bd837b5dbf06 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -142,11 +142,7 @@ static inline int get_old_sigaction(struct k_sigaction *new_ka,
         return 0;
 }
 
-static inline compat_uptr_t to_user_ptr(void *kp)
-{
-        return (compat_uptr_t)(u64)kp;
-}
-
+#define to_user_ptr(p)          ptr_to_compat(p)
 #define from_user_ptr(p)        compat_ptr(p)
 
 static inline int save_general_regs(struct pt_regs *regs,
@@ -213,8 +209,8 @@ static inline int get_old_sigaction(struct k_sigaction *new_ka,
         return 0;
 }
 
-#define to_user_ptr(p)          (p)
-#define from_user_ptr(p)        (p)
+#define to_user_ptr(p)          ((unsigned long)(p))
+#define from_user_ptr(p)        ((void __user *)(p))
 
 static inline int save_general_regs(struct pt_regs *regs,
                 struct mcontext __user *frame)
@@ -526,7 +522,7 @@ long compat_sys_rt_sigaction(int sig, const struct sigaction32 __user *act,
 
         ret = do_sigaction(sig, act ? &new_ka : NULL, oact ? &old_ka : NULL);
         if (!ret && oact) {
-                ret = put_user((long)old_ka.sa.sa_handler, &oact->sa_handler);
+                ret = put_user(to_user_ptr(old_ka.sa.sa_handler), &oact->sa_handler);
                 ret |= put_sigset_t(&oact->sa_mask, &old_ka.sa.sa_mask);
                 ret |= __put_user(old_ka.sa.sa_flags, &oact->sa_flags);
         }
@@ -675,8 +671,8 @@ long compat_sys_rt_sigqueueinfo(u32 pid, u32 sig, compat_siginfo_t __user *uinfo
 int compat_sys_sigaltstack(u32 __new, u32 __old, int r5,
                       int r6, int r7, int r8, struct pt_regs *regs)
 {
-        stack_32_t __user * newstack = (stack_32_t __user *)(long) __new;
-        stack_32_t __user * oldstack = (stack_32_t __user *)(long) __old;
+        stack_32_t __user * newstack = compat_ptr(__new);
+        stack_32_t __user * oldstack = compat_ptr(__old);
         stack_t uss, uoss;
         int ret;
         mm_segment_t old_fs;
@@ -708,7 +704,7 @@ int compat_sys_sigaltstack(u32 __new, u32 __old, int r5,
         set_fs(old_fs);
         /* Copy the stack information to the user output buffer */
         if (!ret && oldstack  &&
-                (put_user((long)uoss.ss_sp, &oldstack->ss_sp) ||
+                (put_user(ptr_to_compat(uoss.ss_sp), &oldstack->ss_sp) ||
                  __put_user(uoss.ss_flags, &oldstack->ss_flags) ||
                  __put_user(uoss.ss_size, &oldstack->ss_size)))
                 return -EFAULT;
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index b3193116e686..497a5d3df359 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -60,8 +60,8 @@ struct rt_sigframe {
         struct ucontext uc;
         unsigned long _unused[2];
         unsigned int tramp[TRAMP_SIZE];
-        struct siginfo *pinfo;
-        void *puc;
+        struct siginfo __user *pinfo;
+        void __user *puc;
         struct siginfo info;
         /* 64 bit ABI allows for 288 bytes below sp before decrementing it. */
         char abigap[288];
diff --git a/arch/powerpc/platforms/powermac/pci.c b/arch/powerpc/platforms/powermac/pci.c
index f671ed253901..de3f30e6b333 100644
--- a/arch/powerpc/platforms/powermac/pci.c
+++ b/arch/powerpc/platforms/powermac/pci.c
@@ -136,14 +136,14 @@ static void __init fixup_bus_range(struct device_node *bridge)
         |(((unsigned int)(off)) & 0xFCUL) \
         |1UL)
 
-static unsigned long macrisc_cfg_access(struct pci_controller* hose,
+static volatile void __iomem *macrisc_cfg_access(struct pci_controller* hose,
                                                u8 bus, u8 dev_fn, u8 offset)
 {
         unsigned int caddr;
 
         if (bus == hose->first_busno) {
                 if (dev_fn < (11 << 3))
-                        return 0;
+                        return NULL;
                 caddr = MACRISC_CFA0(dev_fn, offset);
         } else
                 caddr = MACRISC_CFA1(bus, dev_fn, offset);
@@ -154,14 +154,14 @@ static unsigned long macrisc_cfg_access(struct pci_controller* hose,
         } while (in_le32(hose->cfg_addr) != caddr);
 
         offset &= has_uninorth ? 0x07 : 0x03;
-        return ((unsigned long)hose->cfg_data) + offset;
+        return hose->cfg_data + offset;
 }
 
 static int macrisc_read_config(struct pci_bus *bus, unsigned int devfn,
                                       int offset, int len, u32 *val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -177,13 +177,13 @@ static int macrisc_read_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                *val = in_8((u8 *)addr);
+                *val = in_8(addr);
                 break;
         case 2:
-                *val = in_le16((u16 *)addr);
+                *val = in_le16(addr);
                 break;
         default:
-                *val = in_le32((u32 *)addr);
+                *val = in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -193,7 +193,7 @@ static int macrisc_write_config(struct pci_bus *bus, unsigned int devfn,
                                        int offset, int len, u32 val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -209,16 +209,16 @@ static int macrisc_write_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                out_8((u8 *)addr, val);
-                (void) in_8((u8 *)addr);
+                out_8(addr, val);
+                (void) in_8(addr);
                 break;
         case 2:
-                out_le16((u16 *)addr, val);
-                (void) in_le16((u16 *)addr);
+                out_le16(addr, val);
+                (void) in_le16(addr);
                 break;
         default:
-                out_le32((u32 *)addr, val);
-                (void) in_le32((u32 *)addr);
+                out_le32(addr, val);
+                (void) in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -348,25 +348,23 @@ static int u3_ht_skip_device(struct pci_controller *hose,
                 + (((unsigned int)bus) << 16) \
                 + 0x01000000UL)
 
-static unsigned long u3_ht_cfg_access(struct pci_controller* hose,
+static volatile void __iomem *u3_ht_cfg_access(struct pci_controller* hose,
                                              u8 bus, u8 devfn, u8 offset)
 {
         if (bus == hose->first_busno) {
                 /* For now, we don't self probe U3 HT bridge */
                 if (PCI_SLOT(devfn) == 0)
-                        return 0;
-                return ((unsigned long)hose->cfg_data) +
-                        U3_HT_CFA0(devfn, offset);
+                        return NULL;
+                return hose->cfg_data + U3_HT_CFA0(devfn, offset);
         } else
-                return ((unsigned long)hose->cfg_data) +
-                        U3_HT_CFA1(bus, devfn, offset);
+                return hose->cfg_data + U3_HT_CFA1(bus, devfn, offset);
 }
 
 static int u3_ht_read_config(struct pci_bus *bus, unsigned int devfn,
                                     int offset, int len, u32 *val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -400,13 +398,13 @@ static int u3_ht_read_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                *val = in_8((u8 *)addr);
+                *val = in_8(addr);
                 break;
         case 2:
-                *val = in_le16((u16 *)addr);
+                *val = in_le16(addr);
                 break;
         default:
-                *val = in_le32((u32 *)addr);
+                *val = in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -416,7 +414,7 @@ static int u3_ht_write_config(struct pci_bus *bus, unsigned int devfn,
                                      int offset, int len, u32 val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -442,16 +440,16 @@ static int u3_ht_write_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                out_8((u8 *)addr, val);
-                (void) in_8((u8 *)addr);
+                out_8(addr, val);
+                (void) in_8(addr);
                 break;
         case 2:
-                out_le16((u16 *)addr, val);
-                (void) in_le16((u16 *)addr);
+                out_le16(addr, val);
+                (void) in_le16(addr);
                 break;
         default:
-                out_le32((u32 *)addr, val);
-                (void) in_le32((u32 *)addr);
+                out_le32((u32 __iomem *)addr, val);
+                (void) in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -476,7 +474,7 @@ static struct pci_ops u3_ht_pci_ops =
          |(((unsigned int)(off)) & 0xfcU)       \
          |1UL)
 
-static unsigned long u4_pcie_cfg_access(struct pci_controller* hose,
+static volatile void __iomem *u4_pcie_cfg_access(struct pci_controller* hose,
                                         u8 bus, u8 dev_fn, int offset)
 {
         unsigned int caddr;
@@ -492,14 +490,14 @@ static unsigned long u4_pcie_cfg_access(struct pci_controller* hose,
         } while (in_le32(hose->cfg_addr) != caddr);
 
         offset &= 0x03;
-        return ((unsigned long)hose->cfg_data) + offset;
+        return hose->cfg_data + offset;
 }
 
 static int u4_pcie_read_config(struct pci_bus *bus, unsigned int devfn,
                                int offset, int len, u32 *val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -515,13 +513,13 @@ static int u4_pcie_read_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                *val = in_8((u8 *)addr);
+                *val = in_8(addr);
                 break;
         case 2:
-                *val = in_le16((u16 *)addr);
+                *val = in_le16(addr);
                 break;
         default:
-                *val = in_le32((u32 *)addr);
+                *val = in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -531,7 +529,7 @@ static int u4_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
                                 int offset, int len, u32 val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -547,16 +545,16 @@ static int u4_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                out_8((u8 *)addr, val);
-                (void) in_8((u8 *)addr);
+                out_8(addr, val);
+                (void) in_8(addr);
                 break;
         case 2:
-                out_le16((u16 *)addr, val);
-                (void) in_le16((u16 *)addr);
+                out_le16(addr, val);
+                (void) in_le16(addr);
                 break;
         default:
-                out_le32((u32 *)addr, val);
-                (void) in_le32((u32 *)addr);
+                out_le32(addr, val);
+                (void) in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -773,8 +771,7 @@ static void __init setup_u3_ht(struct pci_controller* hose)
          * the reg address cell, we shall fix that by killing struct
          * reg_property and using some accessor functions instead
          */
-        hose->cfg_data = (volatile unsigned char *)ioremap(0xf2000000,
-                                                           0x02000000);
+        hose->cfg_data = ioremap(0xf2000000, 0x02000000);
 
         /*
          * /ht node doesn't expose a "ranges" property, so we "remove"
diff --git a/arch/powerpc/sysdev/dart_iommu.c b/arch/powerpc/sysdev/dart_iommu.c
index 977de9db8754..6298264efe36 100644
--- a/arch/powerpc/sysdev/dart_iommu.c
+++ b/arch/powerpc/sysdev/dart_iommu.c
@@ -59,7 +59,7 @@ static unsigned long dart_tablesize;
 static u32 *dart_vbase;
 
 /* Mapped base address for the dart */
-static unsigned int *__iomem dart;
+static unsigned int __iomem *dart;
 
 /* Dummy val that entries are set to when unused */
 static unsigned int dart_emptyval;
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
index bf9a7a361b34..cc20f0e3a7d3 100644
--- a/arch/s390/kernel/compat_linux.c
+++ b/arch/s390/kernel/compat_linux.c
@@ -100,12 +100,12 @@
 #define SET_STAT_UID(stat, uid)         (stat).st_uid = high2lowuid(uid)
 #define SET_STAT_GID(stat, gid)         (stat).st_gid = high2lowgid(gid)
 
-asmlinkage long sys32_chown16(const char * filename, u16 user, u16 group)
+asmlinkage long sys32_chown16(const char __user * filename, u16 user, u16 group)
 {
         return sys_chown(filename, low2highuid(user), low2highgid(group));
 }
 
-asmlinkage long sys32_lchown16(const char * filename, u16 user, u16 group)
+asmlinkage long sys32_lchown16(const char __user * filename, u16 user, u16 group)
 {
         return sys_lchown(filename, low2highuid(user), low2highgid(group));
 }
@@ -141,7 +141,7 @@ asmlinkage long sys32_setresuid16(u16 ruid, u16 euid, u16 suid)
                 low2highuid(suid));
 }
 
-asmlinkage long sys32_getresuid16(u16 *ruid, u16 *euid, u16 *suid)
+asmlinkage long sys32_getresuid16(u16 __user *ruid, u16 __user *euid, u16 __user *suid)
 {
         int retval;
 
@@ -158,7 +158,7 @@ asmlinkage long sys32_setresgid16(u16 rgid, u16 egid, u16 sgid)
                 low2highgid(sgid));
 }
 
-asmlinkage long sys32_getresgid16(u16 *rgid, u16 *egid, u16 *sgid)
+asmlinkage long sys32_getresgid16(u16 __user *rgid, u16 __user *egid, u16 __user *sgid)
 {
         int retval;
 
@@ -179,7 +179,7 @@ asmlinkage long sys32_setfsgid16(u16 gid)
         return sys_setfsgid((gid_t)gid);
 }
 
-static int groups16_to_user(u16 *grouplist, struct group_info *group_info)
+static int groups16_to_user(u16 __user *grouplist, struct group_info *group_info)
 {
         int i;
         u16 group;
@@ -193,7 +193,7 @@ static int groups16_to_user(u16 *grouplist, struct group_info *group_info)
         return 0;
 }
 
-static int groups16_from_user(struct group_info *group_info, u16 *grouplist)
+static int groups16_from_user(struct group_info *group_info, u16 __user *grouplist)
 {
         int i;
         u16 group;
@@ -207,7 +207,7 @@ static int groups16_from_user(struct group_info *group_info, u16 *grouplist)
         return 0;
 }
 
-asmlinkage long sys32_getgroups16(int gidsetsize, u16 *grouplist)
+asmlinkage long sys32_getgroups16(int gidsetsize, u16 __user *grouplist)
 {
         int i;
 
@@ -231,7 +231,7 @@ out:
         return i;
 }
 
-asmlinkage long sys32_setgroups16(int gidsetsize, u16 *grouplist)
+asmlinkage long sys32_setgroups16(int gidsetsize, u16 __user *grouplist)
 {
         struct group_info *group_info;
         int retval;
@@ -278,14 +278,14 @@ asmlinkage long sys32_getegid16(void)
 
 /* 32-bit timeval and related flotsam.  */
 
-static inline long get_tv32(struct timeval *o, struct compat_timeval *i)
+static inline long get_tv32(struct timeval *o, struct compat_timeval __user *i)
 {
         return (!access_ok(VERIFY_READ, o, sizeof(*o)) ||
                 (__get_user(o->tv_sec, &i->tv_sec) ||
                  __get_user(o->tv_usec, &i->tv_usec)));
 }
 
-static inline long put_tv32(struct compat_timeval *o, struct timeval *i)
+static inline long put_tv32(struct compat_timeval __user *o, struct timeval *i)
 {
         return (!access_ok(VERIFY_WRITE, o, sizeof(*o)) ||
                 (__put_user(i->tv_sec, &o->tv_sec) ||
@@ -341,7 +341,7 @@ asmlinkage long sys32_ipc(u32 call, int first, int second, int third, u32 ptr)
         return -ENOSYS;
 }
 
-asmlinkage long sys32_truncate64(const char * path, unsigned long high, unsigned long low)
+asmlinkage long sys32_truncate64(const char __user * path, unsigned long high, unsigned long low)
 {
         if ((int)high < 0)
                 return -EINVAL;
@@ -357,7 +357,7 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long high, unsigned
                 return sys_ftruncate(fd, (high << 32) | low);
 }
 
-int cp_compat_stat(struct kstat *stat, struct compat_stat *statbuf)
+int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
         int err;
 
@@ -591,7 +591,7 @@ sys32_delete_module(const char __user *name_user, unsigned int flags)
 
 extern struct timezone sys_tz;
 
-asmlinkage long sys32_gettimeofday(struct compat_timeval *tv, struct timezone *tz)
+asmlinkage long sys32_gettimeofday(struct compat_timeval __user *tv, struct timezone __user *tz)
 {
         if (tv) {
                 struct timeval ktv;
@@ -606,7 +606,7 @@ asmlinkage long sys32_gettimeofday(struct compat_timeval *tv, struct timezone *t
         return 0;
 }
 
-static inline long get_ts32(struct timespec *o, struct compat_timeval *i)
+static inline long get_ts32(struct timespec *o, struct compat_timeval __user *i)
 {
         long usec;
 
@@ -620,7 +620,7 @@ static inline long get_ts32(struct timespec *o, struct compat_timeval *i)
         return 0;
 }
 
-asmlinkage long sys32_settimeofday(struct compat_timeval *tv, struct timezone *tz)
+asmlinkage long sys32_settimeofday(struct compat_timeval __user *tv, struct timezone __user *tz)
 {
         struct timespec kts;
         struct timezone ktz;
@@ -645,7 +645,7 @@ asmlinkage long sys32_pause(void)
         return -ERESTARTNOHAND;
 }
 
-asmlinkage long sys32_pread64(unsigned int fd, char *ubuf,
+asmlinkage long sys32_pread64(unsigned int fd, char __user *ubuf,
                                 size_t count, u32 poshi, u32 poslo)
 {
         if ((compat_ssize_t) count < 0)
@@ -653,7 +653,7 @@ asmlinkage long sys32_pread64(unsigned int fd, char *ubuf,
         return sys_pread64(fd, ubuf, count, ((loff_t)AA(poshi) << 32) | AA(poslo));
 }
 
-asmlinkage long sys32_pwrite64(unsigned int fd, const char *ubuf,
+asmlinkage long sys32_pwrite64(unsigned int fd, const char __user *ubuf,
                                 size_t count, u32 poshi, u32 poslo)
 {
         if ((compat_ssize_t) count < 0)
@@ -666,7 +666,7 @@ asmlinkage compat_ssize_t sys32_readahead(int fd, u32 offhi, u32 offlo, s32 coun
         return sys_readahead(fd, ((loff_t)AA(offhi) << 32) | AA(offlo), count);
 }
 
-asmlinkage long sys32_sendfile(int out_fd, int in_fd, compat_off_t *offset, size_t count)
+asmlinkage long sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset, size_t count)
 {
         mm_segment_t old_fs = get_fs();
         int ret;
@@ -686,7 +686,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd, compat_off_t *offset, size
 }
 
 asmlinkage long sys32_sendfile64(int out_fd, int in_fd,
-                                compat_loff_t *offset, s32 count)
+                                compat_loff_t __user *offset, s32 count)
 {
         mm_segment_t old_fs = get_fs();
         int ret;
@@ -722,7 +722,7 @@ struct timex32 {
 
 extern int do_adjtimex(struct timex *);
 
-asmlinkage long sys32_adjtimex(struct timex32 *utp)
+asmlinkage long sys32_adjtimex(struct timex32 __user *utp)
 {
         struct timex txc;
         int ret;
@@ -789,12 +789,13 @@ struct __sysctl_args32 {
         u32 __unused[4];
 };
 
-asmlinkage long sys32_sysctl(struct __sysctl_args32 *args)
+asmlinkage long sys32_sysctl(struct __sysctl_args32 __user *args)
 {
         struct __sysctl_args32 tmp;
         int error;
-        size_t oldlen, *oldlenp = NULL;
-        unsigned long addr = (((long)&args->__unused[0]) + 7) & ~7;
+        size_t oldlen;
+        size_t __user *oldlenp = NULL;
+        unsigned long addr = (((unsigned long)&args->__unused[0]) + 7) & ~7;
 
         if (copy_from_user(&tmp, args, sizeof(tmp)))
                 return -EFAULT;
@@ -806,20 +807,20 @@ asmlinkage long sys32_sysctl(struct __sysctl_args32 *args)
                    basically copy the whole sysctl.c here, and
                    glibc's __sysctl uses rw memory for the structure
                    anyway.  */
-                if (get_user(oldlen, (u32 *)A(tmp.oldlenp)) ||
-                    put_user(oldlen, (size_t *)addr))
+                if (get_user(oldlen, (u32 __user *)compat_ptr(tmp.oldlenp)) ||
+                    put_user(oldlen, (size_t __user *)addr))
                         return -EFAULT;
-                oldlenp = (size_t *)addr;
+                oldlenp = (size_t __user *)addr;
         }
 
         lock_kernel();
-        error = do_sysctl((int *)A(tmp.name), tmp.nlen, (void *)A(tmp.oldval),
-                          oldlenp, (void *)A(tmp.newval), tmp.newlen);
+        error = do_sysctl(compat_ptr(tmp.name), tmp.nlen, compat_ptr(tmp.oldval),
+                          oldlenp, compat_ptr(tmp.newval), tmp.newlen);
         unlock_kernel();
         if (oldlenp) {
                 if (!error) {
-                        if (get_user(oldlen, (size_t *)addr) ||
-                            put_user(oldlen, (u32 *)A(tmp.oldlenp)))
+                        if (get_user(oldlen, (size_t __user *)addr) ||
+                            put_user(oldlen, (u32 __user *)compat_ptr(tmp.oldlenp)))
                                 error = -EFAULT;
                 }
                 copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
@@ -853,7 +854,7 @@ struct stat64_emu31 {
         unsigned long   st_ino;
 };      
 
-static int cp_stat64(struct stat64_emu31 *ubuf, struct kstat *stat)
+static int cp_stat64(struct stat64_emu31 __user *ubuf, struct kstat *stat)
 {
         struct stat64_emu31 tmp;
 
@@ -877,7 +878,7 @@ static int cp_stat64(struct stat64_emu31 *ubuf, struct kstat *stat)
         return copy_to_user(ubuf,&tmp,sizeof(tmp)) ? -EFAULT : 0; 
 }
 
-asmlinkage long sys32_stat64(char * filename, struct stat64_emu31 * statbuf)
+asmlinkage long sys32_stat64(char __user * filename, struct stat64_emu31 __user * statbuf)
 {
         struct kstat stat;
         int ret = vfs_stat(filename, &stat);
@@ -886,7 +887,7 @@ asmlinkage long sys32_stat64(char * filename, struct stat64_emu31 * statbuf)
         return ret;
 }
 
-asmlinkage long sys32_lstat64(char * filename, struct stat64_emu31 * statbuf)
+asmlinkage long sys32_lstat64(char __user * filename, struct stat64_emu31 __user * statbuf)
 {
         struct kstat stat;
         int ret = vfs_lstat(filename, &stat);
@@ -895,7 +896,7 @@ asmlinkage long sys32_lstat64(char * filename, struct stat64_emu31 * statbuf)
         return ret;
 }
 
-asmlinkage long sys32_fstat64(unsigned long fd, struct stat64_emu31 * statbuf)
+asmlinkage long sys32_fstat64(unsigned long fd, struct stat64_emu31 __user * statbuf)
 {
         struct kstat stat;
         int ret = vfs_fstat(fd, &stat);
@@ -952,7 +953,7 @@ out:
 
 
 asmlinkage unsigned long
-old32_mmap(struct mmap_arg_struct_emu31 *arg)
+old32_mmap(struct mmap_arg_struct_emu31 __user *arg)
 {
         struct mmap_arg_struct_emu31 a;
         int error = -EFAULT;
@@ -970,7 +971,7 @@ out:
 }
 
 asmlinkage long 
-sys32_mmap2(struct mmap_arg_struct_emu31 *arg)
+sys32_mmap2(struct mmap_arg_struct_emu31 __user *arg)
 {
         struct mmap_arg_struct_emu31 a;
         int error = -EFAULT;
@@ -982,7 +983,7 @@ out:
         return error;
 }
 
-asmlinkage long sys32_read(unsigned int fd, char * buf, size_t count)
+asmlinkage long sys32_read(unsigned int fd, char __user * buf, size_t count)
 {
         if ((compat_ssize_t) count < 0)
                 return -EINVAL; 
@@ -990,7 +991,7 @@ asmlinkage long sys32_read(unsigned int fd, char * buf, size_t count)
         return sys_read(fd, buf, count);
 }
 
-asmlinkage long sys32_write(unsigned int fd, char * buf, size_t count)
+asmlinkage long sys32_write(unsigned int fd, char __user * buf, size_t count)
 {
         if ((compat_ssize_t) count < 0)
                 return -EINVAL; 
@@ -1002,12 +1003,12 @@ asmlinkage long sys32_clone(struct pt_regs regs)
 {
         unsigned long clone_flags;
         unsigned long newsp;
-        int *parent_tidptr, *child_tidptr;
+        int __user *parent_tidptr, *child_tidptr;
 
         clone_flags = regs.gprs[3] & 0xffffffffUL;
         newsp = regs.orig_gpr2 & 0x7fffffffUL;
-        parent_tidptr = (int *) (regs.gprs[4] & 0x7fffffffUL);
-        child_tidptr = (int *) (regs.gprs[5] & 0x7fffffffUL);
+        parent_tidptr = compat_ptr(regs.gprs[4]);
+        child_tidptr = compat_ptr(regs.gprs[5]);
         if (!newsp)
                 newsp = regs.gprs[15];
         return do_fork(clone_flags, newsp, &regs, 0,
diff --git a/arch/s390/kernel/sys_s390.c b/arch/s390/kernel/sys_s390.c
index 6a63553493c5..e351780bb660 100644
--- a/arch/s390/kernel/sys_s390.c
+++ b/arch/s390/kernel/sys_s390.c
@@ -122,8 +122,8 @@ out:
 #ifndef CONFIG_64BIT
 struct sel_arg_struct {
         unsigned long n;
-        fd_set *inp, *outp, *exp;
-        struct timeval *tvp;
+        fd_set __user *inp, *outp, *exp;
+        struct timeval __user *tvp;
 };
 
 asmlinkage long old_select(struct sel_arg_struct __user *arg)
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index 5d21e9e6e7b4..a46793beeddd 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -486,7 +486,7 @@ asmlinkage void illegal_op(struct pt_regs * regs, long interruption_code)
                 info.si_signo = signal;
                 info.si_errno = 0;
                 info.si_code = ILL_ILLOPC;
-                info.si_addr = (void *) location;
+                info.si_addr = (void __user *) location;
                 do_trap(interruption_code, signal,
                         "illegal operation", regs, &info);
         }
diff --git a/arch/sh/boards/renesas/rts7751r2d/io.c b/arch/sh/boards/renesas/rts7751r2d/io.c
index c46f9154cfd5..123abbbc91e0 100644
--- a/arch/sh/boards/renesas/rts7751r2d/io.c
+++ b/arch/sh/boards/renesas/rts7751r2d/io.c
@@ -216,24 +216,26 @@ void rts7751r2d_insb(unsigned long port, void *addr, unsigned long count)
 {
         volatile __u8 *bp;
         volatile __u16 *p;
+        unsigned char *s = addr;
 
         if (CHECK_AX88796L_PORT(port)) {
                 p = (volatile unsigned short *)port88796l(port, 0);
-                while (count--) *((unsigned char *) addr)++ = *p & 0xff;
+                while (count--) *s++ = *p & 0xff;
         } else if (PXSEG(port))
-                while (count--) *((unsigned char *) addr)++ = *(volatile unsigned char *)port;
+                while (count--) *s++ = *(volatile unsigned char *)port;
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 bp = (__u8 *)PCI_IOMAP(port);
-                while (count--) *((volatile unsigned char *) addr)++ = *bp;
+                while (count--) *s++ = *bp;
         } else {
                 p = (volatile unsigned short *)port2adr(port);
-                while (count--) *((unsigned char *) addr)++ = *p & 0xff;
+                while (count--) *s++ = *p & 0xff;
         }
 }
 
 void rts7751r2d_insw(unsigned long port, void *addr, unsigned long count)
 {
         volatile __u16 *p;
+        __u16 *s = addr;
 
         if (CHECK_AX88796L_PORT(port))
                 p = (volatile unsigned short *)port88796l(port, 1);
@@ -243,7 +245,7 @@ void rts7751r2d_insw(unsigned long port, void *addr, unsigned long count)
                 p = (volatile unsigned short *)PCI_IOMAP(port);
         else
                 p = (volatile unsigned short *)port2adr(port);
-        while (count--) *((__u16 *) addr)++ = *p;
+        while (count--) *s++ = *p;
 }
 
 void rts7751r2d_insl(unsigned long port, void *addr, unsigned long count)
@@ -252,8 +254,9 @@ void rts7751r2d_insl(unsigned long port, void *addr, unsigned long count)
                 maybebadio(insl, port);
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 volatile __u32 *p = (__u32 *)PCI_IOMAP(port);
+                __u32 *s = addr;
 
-                while (count--) *((__u32 *) addr)++ = *p;
+                while (count--) *s++ = *p;
         } else
                 maybebadio(insl, port);
 }
@@ -262,24 +265,26 @@ void rts7751r2d_outsb(unsigned long port, const void *addr, unsigned long count)
 {
         volatile __u8 *bp;
         volatile __u16 *p;
+        const __u8 *s = addr;
 
         if (CHECK_AX88796L_PORT(port)) {
                 p = (volatile unsigned short *)port88796l(port, 0);
-                while (count--) *p = *((unsigned char *) addr)++;
+                while (count--) *p = *s++;
         } else if (PXSEG(port))
-                while (count--) *(volatile unsigned char *)port = *((unsigned char *) addr)++;
+                while (count--) *(volatile unsigned char *)port = *s++;
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 bp = (__u8 *)PCI_IOMAP(port);
-                while (count--) *bp = *((volatile unsigned char *) addr)++;
+                while (count--) *bp = *s++;
         } else {
                 p = (volatile unsigned short *)port2adr(port);
-                while (count--) *p = *((unsigned char *) addr)++;
+                while (count--) *p = *s++;
         }
 }
 
 void rts7751r2d_outsw(unsigned long port, const void *addr, unsigned long count)
 {
         volatile __u16 *p;
+        const __u16 *s = addr;
 
         if (CHECK_AX88796L_PORT(port))
                 p = (volatile unsigned short *)port88796l(port, 1);
@@ -289,7 +294,7 @@ void rts7751r2d_outsw(unsigned long port, const void *addr, unsigned long count)
                 p = (volatile unsigned short *)PCI_IOMAP(port);
         else
                 p = (volatile unsigned short *)port2adr(port);
-        while (count--) *p = *((__u16 *) addr)++;
+        while (count--) *p = *s++;
 }
 
 void rts7751r2d_outsl(unsigned long port, const void *addr, unsigned long count)
@@ -298,8 +303,9 @@ void rts7751r2d_outsl(unsigned long port, const void *addr, unsigned long count)
                 maybebadio(outsl, port);
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 volatile __u32 *p = (__u32 *)PCI_IOMAP(port);
+                const __u32 *s = addr;
 
-                while (count--) *p = *((__u32 *) addr)++;
+                while (count--) *p = *s++;
         } else
                 maybebadio(outsl, port);
 }