w = kmalloc(sizeof(*w), GFP_ATOMIC); 
w = kmalloc(sizeof(*w), GFP_KERNEL); 
int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb){	struct rt6_rtnl_dump_arg arg;	struct fib6_walker_t *w;	int res;	arg.skb = skb;	arg.cb = cb;	w = (void*)cb->args[0];	if (w == NULL) {		/* New dump:		 * 		 * 1. hook callback destructor.		 */		cb->args[1] = (long)cb->done;		cb->done = fib6_dump_done;		/*		 * 2. allocate and initialize walker.		 */		w = kmalloc(sizeof(*w), GFP_ATOMIC);		if (w == NULL)			return -ENOMEM;		RT6_TRACE("dump<%p", w);		memset(w, 0, sizeof(*w));		w->root = &ip6_routing_table;		w->func = fib6_dump_node;		w->args = &arg;		cb->args[0] = (long)w;		read_lock_bh(&rt6_lock);		res = fib6_walk(w);		read_unlock_bh(&rt6_lock);	} else {		w->args = &arg;		read_lock_bh(&rt6_lock);		res = fib6_walk_continue(w);		read_unlock_bh(&rt6_lock);	}#if RT6_DEBUG >= 3	if (res <= 0 && skb->len == 0)		RT6_TRACE("%p>dump end\n", w);#endif	res = res < 0 ? res : skb->len;	/* res < 0 is an error. (really, impossible)	   res == 0 means that dump is complete, but skb still can contain data.	   res > 0 dump is not complete, but frame is full.	 */	/* Destroy walker, if dump of this table is complete. */	if (res <= 0)		fib6_dump_end(cb);	return res;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/8225ccbaf01b459cf1e462047a51b2851e756bc1/route.c/buggy/net/ipv6/route.c