Re: [git pull] vfs.git regression fix Re: Regression related to ipc shmctl compat

[Al Viro]

On Wed, Oct 11, 2017 at 06:03:35PM +0100, Al Viro wrote:
> On Mon, Sep 25, 2017 at 07:02:16PM -0700, Linus Torvalds wrote:
> > On Mon, Sep 25, 2017 at 6:46 PM, Al Viro <v...@zeniv.linux.org.uk> wrote:
> > >
> > > Which tree do you prefer it to go through?  Direct to mainline, or vfs.git
> > > #for-next?
> > 
> > for-next, it's not like it's in any way urgent.
> 
> Can I assume your normal S-o-b on that?  Just noticed that thing sitting
> in misc queue with mismatched Author: and Signed-off-by:...

FWIW, what I've got in there is

Author: Linus Torvalds <torva...@linux-foundation.org>
Date:   Mon Sep 25 18:37:28 2017 -0700

    fix address space warnings in ipc/
    
    Signed-off-by: Al Viro <v...@zeniv.linux.org.uk>

diff --git a/ipc/msg.c b/ipc/msg.c
index 06be5a9adfa4..ebb7ea24ee28 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -590,13 +590,13 @@ static int copy_compat_msqid_from_user(struct msqid64_ds 
*out, void __user *buf,
 {
        memset(out, 0, sizeof(*out));
        if (version == IPC_64) {
-               struct compat_msqid64_ds *p = buf;
+               struct compat_msqid64_ds __user *p = buf;
                if (get_compat_ipc64_perm(&out->msg_perm, &p->msg_perm))
                        return -EFAULT;
                if (get_user(out->msg_qbytes, &p->msg_qbytes))
                        return -EFAULT;
        } else {
-               struct compat_msqid_ds *p = buf;
+               struct compat_msqid_ds __user *p = buf;
                if (get_compat_ipc_perm(&out->msg_perm, &p->msg_perm))
                        return -EFAULT;
                if (get_user(out->msg_qbytes, &p->msg_qbytes))
diff --git a/ipc/sem.c b/ipc/sem.c
index f7385bce5fd3..6220e9616207 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1636,10 +1636,10 @@ static int copy_compat_semid_from_user(struct 
semid64_ds *out, void __user *buf,
 {
        memset(out, 0, sizeof(*out));
        if (version == IPC_64) {
-               struct compat_semid64_ds *p = buf;
+               struct compat_semid64_ds __user *p = buf;
                return get_compat_ipc64_perm(&out->sem_perm, &p->sem_perm);
        } else {
-               struct compat_semid_ds *p = buf;
+               struct compat_semid_ds __user *p = buf;
                return get_compat_ipc_perm(&out->sem_perm, &p->sem_perm);
        }
 }
diff --git a/ipc/shm.c b/ipc/shm.c
index 1b3adfe3c60e..41706416a3c4 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1193,10 +1193,10 @@ static int copy_compat_shmid_from_user(struct 
shmid64_ds *out, void __user *buf,
 {
        memset(out, 0, sizeof(*out));
        if (version == IPC_64) {
-               struct compat_shmid64_ds *p = buf;
+               struct compat_shmid64_ds __user *p = buf;
                return get_compat_ipc64_perm(&out->shm_perm, &p->shm_perm);
        } else {
-               struct compat_shmid_ds *p = buf;
+               struct compat_shmid_ds __user *p = buf;
                return get_compat_ipc_perm(&out->shm_perm, &p->shm_perm);
        }
 }
diff --git a/ipc/syscall.c b/ipc/syscall.c
index 667022746ca5..977bffd5a7f8 100644
--- a/ipc/syscall.c
+++ b/ipc/syscall.c
@@ -171,7 +171,7 @@ COMPAT_SYSCALL_DEFINE6(ipc, u32, call, int, first, int, 
second,
                               COMPAT_SHMLBA);
                if (err < 0)
                        return err;
-               return put_user(raddr, (compat_ulong_t *)compat_ptr(third));
+               return put_user(raddr, (compat_ulong_t __user 
*)compat_ptr(third));
        }
        case SHMDT:
                return sys_shmdt(compat_ptr(ptr));