staging/bcm: add sparse annotations

This marks up the code where sparse complains in most cases.
Most of the changes are in the ioctl handling code, which
gets __user annotations, finding one unchecked user access.

The rest is mostly about marking functions static when they
are only used in one file.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/bcm/Adapter.h

@@ -652,7 +652,7 @@ typedef struct _ETH_HEADER_STRUC ETH_HEADER_STRUC, *PETH_HEADER_STRUC;
 
 typedef struct FirmwareInfo
 {
-	PVOID		pvMappedFirmwareAddress;
+	void __user *	pvMappedFirmwareAddress;
 	ULONG		u32FirmwareLength;
 	ULONG		u32StartingAddress;
 }__attribute__((packed)) FIRMWARE_INFO, *PFIRMWARE_INFO;

drivers/staging/bcm/Bcmnet.c

@@ -111,7 +111,7 @@ static struct net_device_stats *bcm_get_stats(struct net_device *dev)
 Register other driver entry points with the kernel
 */
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
-struct net_device_ops bcmNetDevOps = {
+static struct net_device_ops bcmNetDevOps = {
     .ndo_open		= bcm_open,
     .ndo_stop 		= bcm_close,
     .ndo_get_stats 	= bcm_get_stats,

drivers/staging/bcm/CmHost.c

@@ -1014,7 +1014,7 @@ static VOID CopyToAdapter( register PMINI_ADAPTER Adapter,		/**<Pointer to the A
 *
 * Returns	  - None
 *************************************************************************/
-VOID DumpCmControlPacket(PVOID pvBuffer)
+static VOID DumpCmControlPacket(PVOID pvBuffer)
 {
 	UINT 					uiLoopIndex;
 	UINT                    nIndex;
@@ -2362,7 +2362,7 @@ BOOLEAN CmControlResponseMessage(PMINI_ADAPTER Adapter,  /**<Pointer to the Adap
 	return TRUE;
 }
 
-int get_dsx_sf_data_to_application(PMINI_ADAPTER Adapter, UINT uiSFId, PUCHAR user_buffer)
+int get_dsx_sf_data_to_application(PMINI_ADAPTER Adapter, UINT uiSFId, void __user *user_buffer)
 {
 	int status = 0;
 	struct _packet_info *psSfInfo=NULL;
@@ -2375,8 +2375,8 @@ int get_dsx_sf_data_to_application(PMINI_ADAPTER Adapter, UINT uiSFId, PUCHAR us
 	}
 	BCM_DEBUG_PRINT( Adapter,DBG_TYPE_OTHERS, CONN_MSG, DBG_LVL_ALL, "status =%d",status);
 	psSfInfo=&Adapter->PackInfo[status];
-	if(psSfInfo->pstSFIndication && copy_to_user((PCHAR)user_buffer,
-		(PCHAR)psSfInfo->pstSFIndication, sizeof(stLocalSFAddIndicationAlt)))
+	if(psSfInfo->pstSFIndication && copy_to_user(user_buffer,
+		psSfInfo->pstSFIndication, sizeof(stLocalSFAddIndicationAlt)))
 	{
 		BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0, "copy to user failed SFID %d, present in queue !!!", uiSFId );
 		status = -EFAULT;

drivers/staging/bcm/Debug.c

@@ -3,7 +3,7 @@
 static UINT current_debug_level=BCM_SCREAM;
 
 int bcm_print_buffer( UINT debug_level, const char *function_name,
-				  char *file_name, int line_number, unsigned char *buffer, int bufferlen, unsigned int base)
+				  char *file_name, int line_number, unsigned char *buffer, int bufferlen, enum _BASE_TYPE base)
 {
 	static const char * const buff_dump_base[] = {
 		"DEC", "HEX", "OCT", "BIN"

drivers/staging/bcm/HandleControlPacket.c

@@ -223,7 +223,7 @@ int control_packet_handler  (PMINI_ADAPTER Adapter  /**< pointer to adapter obje
 	return STATUS_SUCCESS;
 }
 
-INT flushAllAppQ()
+INT flushAllAppQ(void)
 {
 	PMINI_ADAPTER Adapter = GET_BCM_ADAPTER(gblpnetdev);
 	PPER_TARANG_DATA	pTarang = NULL;

drivers/staging/bcm/IPv6Protocol.c

@@ -1,6 +1,6 @@
 #include "headers.h"
 
-UCHAR * GetNextIPV6ChainedHeader(UCHAR **ppucPayload,UCHAR *pucNextHeader,BOOLEAN *bParseDone,USHORT *pusPayloadLength)
+static UCHAR * GetNextIPV6ChainedHeader(UCHAR **ppucPayload,UCHAR *pucNextHeader,BOOLEAN *bParseDone,USHORT *pusPayloadLength)
 {
 	UCHAR *pucRetHeaderPtr = NULL;
 	UCHAR *pucPayloadPtr = NULL;
@@ -130,7 +130,7 @@ UCHAR * GetNextIPV6ChainedHeader(UCHAR **ppucPayload,UCHAR *pucNextHeader,BOOLEA
 }
 
 
-UCHAR GetIpv6ProtocolPorts(UCHAR *pucPayload,USHORT *pusSrcPort,USHORT *pusDestPort,USHORT usPayloadLength,UCHAR ucNextHeader)
+static UCHAR GetIpv6ProtocolPorts(UCHAR *pucPayload,USHORT *pusSrcPort,USHORT *pusDestPort,USHORT usPayloadLength,UCHAR ucNextHeader)
 {
 	UCHAR *pIpv6HdrScanContext = pucPayload;
 	BOOLEAN bDone = FALSE;

drivers/staging/bcm/InterfaceDld.c

@@ -22,7 +22,7 @@ int InterfaceFileDownload( PVOID arg,
     while(1)
     {
         oldfs=get_fs(); set_fs(get_ds());
-        len=vfs_read(flp, buff, MAX_TRANSFER_CTRL_BYTE_USB, &pos);
+        len=vfs_read(flp, (void __force __user *)buff, MAX_TRANSFER_CTRL_BYTE_USB, &pos);
         set_fs(oldfs);
         if(len<=0)
         {
@@ -83,7 +83,7 @@ int InterfaceFileReadbackFromChip( PVOID arg,
     while(1)
     {
         oldfs=get_fs(); set_fs(get_ds());
-        len=vfs_read(flp, buff, MAX_TRANSFER_CTRL_BYTE_USB, &pos);
+        len=vfs_read(flp, (void __force __user *)buff, MAX_TRANSFER_CTRL_BYTE_USB, &pos);
         set_fs(oldfs);
         fw_down++;
         if(len<=0)
@@ -381,7 +381,7 @@ int bcm_ioctl_fw_download(PMINI_ADAPTER Adapter, FIRMWARE_INFO *psFwInfo)
 			BCM_DEBUG_PRINT(Adapter,DBG_TYPE_INITEXIT, MP_INIT, DBG_LVL_ALL,"Failed in allocation memory");
 			return -ENOMEM;
 		}
-		retval = copy_from_user(buff,(PUCHAR)psFwInfo->pvMappedFirmwareAddress, psFwInfo->u32FirmwareLength);
+		retval = copy_from_user(buff,psFwInfo->pvMappedFirmwareAddress, psFwInfo->u32FirmwareLength);
 		if(retval != STATUS_SUCCESS)
 		{
 			BCM_DEBUG_PRINT(Adapter,DBG_TYPE_INITEXIT, MP_INIT, DBG_LVL_ALL, "copying buffer from user space failed");

drivers/staging/bcm/InterfaceIdleMode.c

@@ -42,7 +42,7 @@ send to f/w with in 200 ms after the Idle/Shutdown req issued
 */
 
 
-int InterfaceIdleModeRespond(PMINI_ADAPTER Adapter,int* puiBuffer)
+int InterfaceIdleModeRespond(PMINI_ADAPTER Adapter, unsigned int* puiBuffer)
 {
 	int	status = STATUS_SUCCESS;
 	unsigned int	uiRegRead = 0;

drivers/staging/bcm/InterfaceIdleMode.h

@@ -3,7 +3,7 @@
 
 INT InterfaceIdleModeWakeup(PMINI_ADAPTER Adapter);
 
-INT InterfaceIdleModeRespond(PMINI_ADAPTER Adapter,PINT puiBuffer);
+INT InterfaceIdleModeRespond(PMINI_ADAPTER Adapter, unsigned int *puiBuffer);
 
 VOID InterfaceWriteIdleModeWakePattern(PMINI_ADAPTER Adapter);
 

drivers/staging/bcm/InterfaceInit.c

@@ -68,12 +68,12 @@ static int usbbcm_release(struct inode *inode, struct file *file)
 	return 0;
 }
 
-static ssize_t usbbcm_read(struct file *file, char *buffer, size_t count, loff_t *ppos)
+static ssize_t usbbcm_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 {
 	return 0;
 }
 
-static ssize_t usbbcm_write(struct file *file, const char *user_buffer, size_t count, loff_t *ppos)
+static ssize_t usbbcm_write(struct file *file, const char __user *user_buffer, size_t count, loff_t *ppos)
 {
 	return 0;
 }
@@ -188,14 +188,12 @@ usbbcm_device_probe(struct usb_interface *intf, const struct usb_device_id *id)
 	}
 
 	/* Allocate Adapter structure */
-	if((psAdapter = kmalloc(sizeof(MINI_ADAPTER), GFP_KERNEL)) == NULL)
+	if((psAdapter = kzalloc(sizeof(MINI_ADAPTER), GFP_KERNEL)) == NULL)
 	{
-		//BCM_DEBUG_PRINT(psAdapter,DBG_TYPE_PRINTK, 0, 0, "Out of memory");
+		BCM_DEBUG_PRINT(psAdapter,DBG_TYPE_PRINTK, 0, 0, "Out of memory");
 		return -ENOMEM;
 	}
 
-	memset(psAdapter, 0, sizeof(MINI_ADAPTER));
-
     /* Init default driver debug state */
 
     psAdapter->stDebugState.debug_level = DBG_LVL_CURR;
@@ -618,9 +616,9 @@ INT InterfaceAdapterInit(PS_INTERFACE_ADAPTER psIntfAdapter)
 				if((psIntfAdapter->bHighSpeedDevice == FALSE) && bcm_usb_endpoint_is_bulk_out(endpoint))
 				{
 					// Once BULK is selected in FS mode. Revert it back to INT. Else USB_IF will fail.
-					UINT uiData = ntohl(EP2_CFG_INT);
+					UINT _uiData = ntohl(EP2_CFG_INT);
 					BCM_DEBUG_PRINT(psIntfAdapter->psAdapter,DBG_TYPE_INITEXIT, DRV_ENTRY, DBG_LVL_ALL,"Reverting Bulk to INT as it is FS MODE");
-					BeceemEEPROMBulkWrite(psIntfAdapter->psAdapter,(PUCHAR)&uiData,0x136,4,TRUE);
+					BeceemEEPROMBulkWrite(psIntfAdapter->psAdapter,(PUCHAR)&_uiData,0x136,4,TRUE);
 				}
 			}
 			else
@@ -773,7 +771,8 @@ INT InterfaceAdapterInit(PS_INTERFACE_ADAPTER psIntfAdapter)
 
 	return 0;
 }
-int InterfaceSuspend (struct usb_interface *intf, pm_message_t message)
+
+static int InterfaceSuspend (struct usb_interface *intf, pm_message_t message)
 {
 	PS_INTERFACE_ADAPTER  psIntfAdapter = usb_get_intfdata(intf);
 	BCM_DEBUG_PRINT(psIntfAdapter->psAdapter,DBG_TYPE_INITEXIT, DRV_ENTRY, DBG_LVL_ALL, "=================================\n");
@@ -802,7 +801,8 @@ int InterfaceSuspend (struct usb_interface *intf, pm_message_t message)
 
 	return 0;
 }
-int InterfaceResume (struct usb_interface *intf)
+
+static int InterfaceResume (struct usb_interface *intf)
 {
     PS_INTERFACE_ADAPTER  psIntfAdapter = usb_get_intfdata(intf);
 	printk("=================================\n");
@@ -816,12 +816,14 @@ int InterfaceResume (struct usb_interface *intf)
 	InterfaceRx(psIntfAdapter);
 	return 0;
 }
-int InterfacePreReset(struct usb_interface *intf)
+
+static int InterfacePreReset(struct usb_interface *intf)
 {
     printk("====================>");
 	return STATUS_SUCCESS;
 }
-int InterfacePostReset(struct usb_interface *intf)
+
+static int InterfacePostReset(struct usb_interface *intf)
 {
     printk("Do Post chip reset setting here if it is required");
    	return STATUS_SUCCESS;

drivers/staging/bcm/Ioctl.h

@@ -18,9 +18,9 @@ typedef struct wrmbuffer
 
 typedef struct ioctlbuffer
 {
-	PVOID	InputBuffer;
+	void __user *InputBuffer;
 	ULONG	InputLength;
-	PVOID	OutputBuffer;
+	void __user *OutputBuffer;
 	ULONG	OutputLength;
 }__attribute__((packed)) IOCTL_BUFFER, *PIOCTL_BUFFER;
 
@@ -209,7 +209,7 @@ typedef struct _DEVICE_DRIVER_INFO
 typedef  struct _NVM_READWRITE
 {
 
-	void *pBuffer;
+	void __user *pBuffer;
 // Data to be written from|read to. Memory should be allocated by the caller.
 
 	uint32_t  uiOffset;
@@ -269,7 +269,7 @@ typedef struct _FLASH2X_READWRITE
 	B_UINT32 offset;		//Offset within Section.
 	B_UINT32 numOfBytes;	//NOB from the offset
 	B_UINT32  bVerify;
-	PVOID pDataBuff;	//Buffer for reading/writing
+	void __user *pDataBuff;	//Buffer for reading/writing
 
 }FLASH2X_READWRITE, *PFLASH2X_READWRITE;
 /*

drivers/staging/bcm/LeakyBucket.c

@@ -15,7 +15,7 @@
 * Returns     - None
 **********************************************************************/
 
-VOID UpdateTokenCount(register PMINI_ADAPTER Adapter)
+static VOID UpdateTokenCount(register PMINI_ADAPTER Adapter)
 {
 	ULONG 	liCurrentTime;
 	INT 	i = 0;

drivers/staging/bcm/Misc.c

@@ -503,6 +503,7 @@ INT CopyBufferToControlPacket(PMINI_ADAPTER Adapter,/**<Logical Adapter*/
 	return Status;
 }
 
+#if 0
 /*****************************************************************
 * Function    - SendStatisticsPointerRequest()
 *
@@ -514,7 +515,7 @@ INT CopyBufferToControlPacket(PMINI_ADAPTER Adapter,/**<Logical Adapter*/
 *
 * Returns     - None.
 *****************************************************************/
-VOID SendStatisticsPointerRequest(PMINI_ADAPTER Adapter,
+static VOID SendStatisticsPointerRequest(PMINI_ADAPTER Adapter,
 								PLINK_REQUEST	pstStatisticsPtrRequest)
 {
 	BCM_DEBUG_PRINT(Adapter,DBG_TYPE_RX, RX_DPC, DBG_LVL_ALL, "======>");
@@ -526,7 +527,7 @@ VOID SendStatisticsPointerRequest(PMINI_ADAPTER Adapter,
 	BCM_DEBUG_PRINT(Adapter,DBG_TYPE_RX, RX_DPC, DBG_LVL_ALL, "<=====");
 	return;
 }
-
+#endif
 
 
 void SendLinkDown(PMINI_ADAPTER Adapter)
@@ -1379,7 +1380,7 @@ int bcm_parse_target_params(PMINI_ADAPTER Adapter)
 		return -ENOENT;
 	}
 	oldfs=get_fs();	set_fs(get_ds());
-	len=vfs_read(flp, buff, BUFFER_1K, &pos);
+	len=vfs_read(flp, (void __user __force *)buff, BUFFER_1K, &pos);
 	set_fs(oldfs);
 
 	if(len != sizeof(STARGETPARAMS))
@@ -1535,7 +1536,9 @@ VOID doPowerAutoCorrection(PMINI_ADAPTER psAdapter)
 		BCM_DEBUG_PRINT(psAdapter,DBG_TYPE_INITEXIT, MP_INIT, DBG_LVL_ALL,"Using Forced User Choice: %lx\n", psAdapter->ulPowerSaveMode);
 	}
 }
-unsigned char *ReadMacAddrEEPROM(PMINI_ADAPTER Adapter, ulong dwAddress)
+
+#if 0
+static unsigned char *ReadMacAddrEEPROM(PMINI_ADAPTER Adapter, ulong dwAddress)
 {
 	unsigned char *pucmacaddr = NULL;
 	int status = 0, i=0;
@@ -1575,6 +1578,7 @@ unsigned char *ReadMacAddrEEPROM(PMINI_ADAPTER Adapter, ulong dwAddress)
 OUT:
 	return pucmacaddr;
 }
+#endif
 
 #if 0
 INT ReadMacAddressFromEEPROM(PMINI_ADAPTER Adapter)
@@ -1614,7 +1618,7 @@ INT ReadMacAddressFromEEPROM(PMINI_ADAPTER Adapter)
 }
 #endif
 
-void convertEndian(B_UINT8 rwFlag, PUINT puiBuffer, UINT uiByteCount)
+static void convertEndian(B_UINT8 rwFlag, PUINT puiBuffer, UINT uiByteCount)
 {
 	UINT uiIndex = 0;
 
@@ -1814,7 +1818,7 @@ int rdmaltWithLock (PMINI_ADAPTER Adapter, UINT uiAddress, PUINT pucBuff, size_t
 }
 
 
-VOID HandleShutDownModeWakeup(PMINI_ADAPTER Adapter)
+static VOID HandleShutDownModeWakeup(PMINI_ADAPTER Adapter)
 {
 	int clear_abort_pattern = 0,Status = 0;
 	BCM_DEBUG_PRINT(Adapter,DBG_TYPE_OTHERS, MP_SHUTDOWN, DBG_LVL_ALL, "====>\n");
@@ -1844,7 +1848,7 @@ VOID HandleShutDownModeWakeup(PMINI_ADAPTER Adapter)
 	BCM_DEBUG_PRINT(Adapter,DBG_TYPE_OTHERS, MP_SHUTDOWN, DBG_LVL_ALL, "<====\n");
 }
 
-VOID SendShutModeResponse(PMINI_ADAPTER Adapter)
+static VOID SendShutModeResponse(PMINI_ADAPTER Adapter)
 {
 	CONTROL_MESSAGE		stShutdownResponse;
 	UINT NVMAccess = 0,lowPwrAbortMsg = 0;

drivers/staging/bcm/PHSModule.c

@@ -1345,7 +1345,7 @@ BOOLEAN DerefPhsRule(IN B_UINT16  uiClsId,S_CLASSIFIER_TABLE *psaClassifiertable
 	}
 }
 
-void DumpBuffer(PVOID BuffVAddress, int xferSize)
+static void DumpBuffer(PVOID BuffVAddress, int xferSize)
 {
 	int i;
 	int iPrintLength;

drivers/staging/bcm/Prototypes.h

@@ -108,8 +108,7 @@ int wrmalt (PMINI_ADAPTER Adapter, UINT uiAddress, PUINT pucBuff, size_t sSize);
 
 int rdmalt (PMINI_ADAPTER Adapter, UINT uiAddress, PUINT pucBuff, size_t sSize);
 
-int get_dsx_sf_data_to_application(PMINI_ADAPTER Adapter, UINT uiSFId,
-	PUCHAR user_buffer);
+int get_dsx_sf_data_to_application(PMINI_ADAPTER Adapter, UINT uiSFId, void __user * user_buffer);
 
 void SendLinkDown(PMINI_ADAPTER Adapter);
 

drivers/staging/bcm/Qos.c

@@ -692,7 +692,7 @@ USHORT ClassifyPacket(PMINI_ADAPTER Adapter,struct sk_buff* skb)
 		return INVALID_QUEUE_INDEX;
 }
 
-BOOLEAN EthCSMatchSrcMACAddress(S_CLASSIFIER_RULE *pstClassifierRule,PUCHAR Mac)
+static BOOLEAN EthCSMatchSrcMACAddress(S_CLASSIFIER_RULE *pstClassifierRule,PUCHAR Mac)
 {
 	UINT i=0;
     PMINI_ADAPTER Adapter = GET_BCM_ADAPTER(gblpnetdev);
@@ -709,7 +709,7 @@ BOOLEAN EthCSMatchSrcMACAddress(S_CLASSIFIER_RULE *pstClassifierRule,PUCHAR Mac)
 	return TRUE;
 }
 
-BOOLEAN EthCSMatchDestMACAddress(S_CLASSIFIER_RULE *pstClassifierRule,PUCHAR Mac)
+static BOOLEAN EthCSMatchDestMACAddress(S_CLASSIFIER_RULE *pstClassifierRule,PUCHAR Mac)
 {
 	UINT i=0;
     PMINI_ADAPTER Adapter = GET_BCM_ADAPTER(gblpnetdev);
@@ -726,7 +726,7 @@ BOOLEAN EthCSMatchDestMACAddress(S_CLASSIFIER_RULE *pstClassifierRule,PUCHAR Mac
 	return TRUE;
 }
 
-BOOLEAN EthCSMatchEThTypeSAP(S_CLASSIFIER_RULE *pstClassifierRule,struct sk_buff* skb,PS_ETHCS_PKT_INFO pstEthCsPktInfo)
+static BOOLEAN EthCSMatchEThTypeSAP(S_CLASSIFIER_RULE *pstClassifierRule,struct sk_buff* skb,PS_ETHCS_PKT_INFO pstEthCsPktInfo)
 {
     PMINI_ADAPTER Adapter = GET_BCM_ADAPTER(gblpnetdev);
 	if((pstClassifierRule->ucEtherTypeLen==0)||
@@ -761,7 +761,7 @@ BOOLEAN EthCSMatchEThTypeSAP(S_CLASSIFIER_RULE *pstClassifierRule,struct sk_buff
 
 }
 
-BOOLEAN EthCSMatchVLANRules(S_CLASSIFIER_RULE *pstClassifierRule,struct sk_buff* skb,PS_ETHCS_PKT_INFO pstEthCsPktInfo)
+static BOOLEAN EthCSMatchVLANRules(S_CLASSIFIER_RULE *pstClassifierRule,struct sk_buff* skb,PS_ETHCS_PKT_INFO pstEthCsPktInfo)
 {
 	BOOLEAN bClassificationSucceed = FALSE;
 	USHORT usVLANID;