--- zzzz-none-000/linux-2.6.19.2/init/do_mounts.c	2007-01-10 19:10:37.000000000 +0000
+++ davinci-8020-5505/linux-2.6.19.2/init/do_mounts.c	2007-01-19 14:42:56.000000000 +0000
@@ -65,11 +65,12 @@
 
 	/* read device number from .../dev */
 
-	sprintf(path, "/sys/block/%s/dev", name);
-	fd = sys_open(path, 0, 0);
+	if (sizeof path <= snprintf(path, sizeof path, "/sys/block/%s/dev", name))
+		goto fail;
+	fd = sys_open((char __user *)path, 0, 0);
 	if (fd < 0)
 		goto fail;
-	len = sys_read(fd, buf, 32);
+	len = sys_read(fd, (char __user *)buf, 32);
 	sys_close(fd);
 	if (len <= 0 || len == 32 || buf[len - 1] != '\n')
 		goto fail;
@@ -95,11 +96,12 @@
 		return res;
 
 	/* otherwise read range from .../range */
-	sprintf(path, "/sys/block/%s/range", name);
-	fd = sys_open(path, 0, 0);
+	if (sizeof path <= snprintf(path, sizeof path, "/sys/block/%s/range", name))
+		goto fail;
+	fd = sys_open((char __user *)path, 0, 0);
 	if (fd < 0)
 		goto fail;
-	len = sys_read(fd, buf, 32);
+	len = sys_read(fd, (char __user *)buf, 32);
 	sys_close(fd);
 	if (len <= 0 || len == 32 || buf[len - 1] != '\n')
 		goto fail;
@@ -142,8 +144,8 @@
 	int part;
 
 #ifdef CONFIG_SYSFS
-	int mkdir_err = sys_mkdir("/sys", 0700);
-	if (sys_mount("sysfs", "/sys", "sysfs", 0, NULL) < 0)
+	int mkdir_err = sys_mkdir((char __user *)"/sys", 0700);
+	if (sys_mount((char __user *)"sysfs", (char __user *)"/sys", (char __user *)"sysfs", 0, NULL) < 0)
 		goto out;
 #endif
 
@@ -195,10 +197,10 @@
 	res = try_name(s, part);
 done:
 #ifdef CONFIG_SYSFS
-	sys_umount("/sys", 0);
+	sys_umount((char __user *)"/sys", 0);
 out:
 	if (!mkdir_err)
-		sys_rmdir("/sys");
+		sys_rmdir((char __user *)"/sys");
 #endif
 	return res;
 fail:
@@ -206,7 +208,7 @@
 	goto done;
 }
 
-static int __init root_dev_setup(char *line)
+int __init root_dev_setup(char *line)
 {
 	strlcpy(saved_root_name, line, sizeof(saved_root_name));
 	return 1;
@@ -268,11 +270,11 @@
 
 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
 {
-	int err = sys_mount(name, "/root", fs, flags, data);
+	int err = sys_mount((char __user *)name, (char __user *)"/root", (char __user *)fs, flags, (void __user *)data);
 	if (err)
 		return err;
 
-	sys_chdir("/root");
+	sys_chdir((char __user *)"/root");
 	ROOT_DEV = current->fs->pwdmnt->mnt_sb->s_dev;
 	printk("VFS: Mounted root (%s filesystem)%s.\n",
 	       current->fs->pwdmnt->mnt_sb->s_type->name,
@@ -354,18 +356,18 @@
 	va_start(args, fmt);
 	vsprintf(buf, fmt, args);
 	va_end(args);
-	fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
+	fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
 	if (fd >= 0) {
 		sys_ioctl(fd, FDEJECT, 0);
 		sys_close(fd);
 	}
 	printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
-	fd = sys_open("/dev/console", O_RDWR, 0);
+	fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
 	if (fd >= 0) {
 		sys_ioctl(fd, TCGETS, (long)&termios);
 		termios.c_lflag &= ~ICANON;
 		sys_ioctl(fd, TCSETSF, (long)&termios);
-		sys_read(fd, &c, 1);
+		sys_read(fd, (char __user *)&c, 1);
 		termios.c_lflag |= ICANON;
 		sys_ioctl(fd, TCSETSF, (long)&termios);
 		sys_close(fd);
@@ -442,8 +444,8 @@
 
 	mount_root();
 out:
-	sys_mount(".", "/", NULL, MS_MOVE, NULL);
-	sys_chroot(".");
+	sys_mount((char __user *)".", (char __user *)"/", NULL, MS_MOVE, NULL);
+	sys_chroot((char __user *)".");
 	security_sb_post_mountroot();
 }