5 files changed, 20 insertions, 16 deletions

diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 01a1f6badb53..beea450ee4b2 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2399,7 +2399,8 @@ static int init_one_smi(int intf_num, struct smi_info **smi)
                         new_smi->handlers->cleanup(new_smi->si_sm);
                 kfree(new_smi->si_sm);
         }
-        new_smi->io_cleanup(new_smi);
+        if (new_smi->io_cleanup)
+                new_smi->io_cleanup(new_smi);
 
         return rv;
 }
@@ -2518,7 +2519,8 @@ static void __exit cleanup_one_si(struct smi_info *to_clean)
 
         kfree(to_clean->si_sm);
 
-        to_clean->io_cleanup(to_clean);
+        if (to_clean->io_cleanup)
+                to_clean->io_cleanup(to_clean);
 }
 
 static __exit void cleanup_ipmi_si(void)
diff --git a/drivers/char/mwave/mwavepub.h b/drivers/char/mwave/mwavepub.h
index f1f9da7a65c1..60c961ae23b4 100644
--- a/drivers/char/mwave/mwavepub.h
+++ b/drivers/char/mwave/mwavepub.h
@@ -69,7 +69,7 @@ typedef struct _MW_ABILITIES {
 typedef struct _MW_READWRITE {
         unsigned short usDspAddress;    /* The dsp address */
         unsigned long ulDataLength;     /* The size in bytes of the data or user buffer */
-        void *pBuf;             /* Input:variable sized buffer */
+        void __user *pBuf;              /* Input:variable sized buffer */
 } MW_READWRITE, *pMW_READWRITE;
 
 #define IOCTL_MW_RESET           _IO(MWAVE_MINOR,1)
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index ef011ef5dc46..61681c9f3f72 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -1444,6 +1444,7 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
         dev_link_t *link;
         int size;
         int rc;
+        void __user *argp = (void __user *)arg;
 #ifdef PCMCIA_DEBUG
         char *ioctl_names[CM_IOC_MAXNR + 1] = {
                 [_IOC_NR(CM_IOCGSTATUS)] "CM_IOCGSTATUS",
@@ -1481,11 +1482,11 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
               _IOC_DIR(cmd), _IOC_READ, _IOC_WRITE, size, cmd);
 
         if (_IOC_DIR(cmd) & _IOC_READ) {
-                if (!access_ok(VERIFY_WRITE, (void *)arg, size))
+                if (!access_ok(VERIFY_WRITE, argp, size))
                         return -EFAULT;
         }
         if (_IOC_DIR(cmd) & _IOC_WRITE) {
-                if (!access_ok(VERIFY_READ, (void *)arg, size))
+                if (!access_ok(VERIFY_READ, argp, size))
                         return -EFAULT;
         }
 
@@ -1506,14 +1507,14 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                                 status |= CM_NO_READER;
                         if (test_bit(IS_BAD_CARD, &dev->flags))
                                 status |= CM_BAD_CARD;
-                        if (copy_to_user((int *)arg, &status, sizeof(int)))
+                        if (copy_to_user(argp, &status, sizeof(int)))
                                 return -EFAULT;
                 }
                 return 0;
         case CM_IOCGATR:
                 DEBUGP(4, dev, "... in CM_IOCGATR\n");
                 {
-                        struct atreq *atreq = (struct atreq *) arg;
+                        struct atreq __user *atreq = argp;
                         int tmp;
                         /* allow nonblocking io and being interrupted */
                         if (wait_event_interruptible
@@ -1597,7 +1598,7 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                 {
                         struct ptsreq krnptsreq;
 
-                        if (copy_from_user(&krnptsreq, (struct ptsreq *) arg,
+                        if (copy_from_user(&krnptsreq, argp,
                                            sizeof(struct ptsreq)))
                                 return -EFAULT;
 
@@ -1641,7 +1642,7 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                         int old_pc_debug = 0;
 
                         old_pc_debug = pc_debug;
-                        if (copy_from_user(&pc_debug, (int *)arg, sizeof(int)))
+                        if (copy_from_user(&pc_debug, argp, sizeof(int)))
                                 return -EFAULT;
 
                         if (old_pc_debug != pc_debug)
diff --git a/drivers/char/watchdog/booke_wdt.c b/drivers/char/watchdog/booke_wdt.c
index 65830ec71042..c800cce73c1e 100644
--- a/drivers/char/watchdog/booke_wdt.c
+++ b/drivers/char/watchdog/booke_wdt.c
@@ -72,7 +72,7 @@ static __inline__ void booke_wdt_ping(void)
 /*
  * booke_wdt_write:
  */
-static ssize_t booke_wdt_write (struct file *file, const char *buf,
+static ssize_t booke_wdt_write (struct file *file, const char __user *buf,
                                 size_t count, loff_t *ppos)
 {
         booke_wdt_ping();
@@ -92,14 +92,15 @@ static int booke_wdt_ioctl (struct inode *inode, struct file *file,
                             unsigned int cmd, unsigned long arg)
 {
         u32 tmp = 0;
+        u32 __user *p = (u32 __user *)arg;
 
         switch (cmd) {
         case WDIOC_GETSUPPORT:
-                if (copy_to_user ((struct watchdog_info *) arg, &ident,
+                if (copy_to_user ((struct watchdog_info __user *) arg, &ident,
                                 sizeof(struct watchdog_info)))
                         return -EFAULT;
         case WDIOC_GETSTATUS:
-                return put_user(ident.options, (u32 *) arg);
+                return put_user(ident.options, p);
         case WDIOC_GETBOOTSTATUS:
                 /* XXX: something is clearing TSR */
                 tmp = mfspr(SPRN_TSR) & TSR_WRS(3);
@@ -109,14 +110,14 @@ static int booke_wdt_ioctl (struct inode *inode, struct file *file,
                 booke_wdt_ping();
                 return 0;
         case WDIOC_SETTIMEOUT:
-                if (get_user(booke_wdt_period, (u32 *) arg))
+                if (get_user(booke_wdt_period, p))
                         return -EFAULT;
                 mtspr(SPRN_TCR, (mfspr(SPRN_TCR)&~WDTP(0))|WDTP(booke_wdt_period));
                 return 0;
         case WDIOC_GETTIMEOUT:
-                return put_user(booke_wdt_period, (u32 *) arg);
+                return put_user(booke_wdt_period, p);
         case WDIOC_SETOPTIONS:
-                if (get_user(tmp, (u32 *) arg))
+                if (get_user(tmp, p))
                         return -EINVAL;
                 if (tmp == WDIOS_ENABLECARD) {
                         booke_wdt_ping();
diff --git a/drivers/char/watchdog/wdrtas.c b/drivers/char/watchdog/wdrtas.c
index 619e2ffca33f..dacfe31caccf 100644
--- a/drivers/char/watchdog/wdrtas.c
+++ b/drivers/char/watchdog/wdrtas.c
@@ -320,7 +320,7 @@ static int
 wdrtas_ioctl(struct inode *inode, struct file *file,
              unsigned int cmd, unsigned long arg)
 {
-        int __user *argp = (void *)arg;
+        int __user *argp = (void __user *)arg;
         int i;
         static struct watchdog_info wdinfo = {
                 .options = WDRTAS_SUPPORTED_MASK,