func: long CVE_2010_2803_PATCHED_drm_ioctl(struct file unsigned int cmd, unsigned long arg) struct drm_file * file_priv = filp -> private_data ; struct drm_device * dev ; struct drm_ioctl_desc * ioctl ; drm_ioctl_t * func ; unsigned int nr = DRM_IOCTL_NR ( cmd ) ; char stack_kdata [ 128 ] ; char * kdata = NULL ; dev = file_priv -> minor -> dev; if ( ( nr >= DRM_CORE_IOCTL_COUNT ) && ( ( nr < DRM_COMMAND_BASE ) || ( nr >= DRM_COMMAND_END ) ) )  if ( ( nr >= DRM_COMMAND_BASE ) && ( nr < DRM_COMMAND_END ) && ( nr < DRM_COMMAND_BASE + dev -> driver -> num_ioctls ) )  ioctl = & dev -> driver -> ioctls [ nr - DRM_COMMAND_BASE ]; if ( ( nr >= DRM_COMMAND_END ) || ( nr < DRM_COMMAND_BASE ) )  ioctl = & drm_ioctls [ nr ]; cmd = ioctl -> cmd; func = ioctl -> func; if ( ( nr == DRM_IOCTL_NR ( DRM_IOCTL_DMA ) ) && dev -> driver -> dma_ioctl )  func = dev -> driver -> dma_ioctl; if ( ! func )  if ( ( ( ioctl -> flags & DRM_ROOT_ONLY ) && ! capable ( CAP_SYS_ADMIN ) ) || ( ( ioctl -> flags & DRM_AUTH ) && ! file_priv -> authenticated ) || ( ( ioctl -> flags & DRM_MASTER ) && ! file_priv -> is_master ) || ( ! ( ioctl -> flags & DRM_CONTROL_ALLOW ) && ( file_priv -> minor -> type == DRM_MINOR_CONTROL ) ) )  if ( cmd & ( IOC_IN | IOC_OUT ) )  if ( _IOC_SIZE ( cmd ) <= sizeof ( stack_kdata ) )  kdata = stack_kdata; kdata = kmalloc ( _IOC_SIZE ( cmd ) , GFP_KERNEL ); if ( ! kdata )  if ( cmd & IOC_IN )  memset ( kdata , 0 , _IOC_SIZE ( cmd ) ); retcode = func ( dev , kdata , file_priv ); retcode = func ( dev , kdata , file_priv ); if ( copy_to_user ( ( void __user * ) arg , kdata , _IOC_SIZE ( cmd ) ) != 0 )  if ( kdata != stack_kdata )  kfree ( kdata ); if ( retcode )  DRM_DEBUG ( "ret = %x\n" , retcode ); return retcode ; 