loop * sizeof(klist->keys[0])); 
loop * sizeof(struct key *)); 
int key_unlink(struct key *keyring, struct key *key){	struct keyring_list *klist, *nklist;	int loop, ret;	key_check(keyring);	key_check(key);	ret = -ENOTDIR;	if (keyring->type != &key_type_keyring)		goto error;	down_write(&keyring->sem);	klist = keyring->payload.subscriptions;	if (klist) {		/* search the keyring for the key */		for (loop = 0; loop < klist->nkeys; loop++)			if (klist->keys[loop] == key)				goto key_is_present;	}	up_write(&keyring->sem);	ret = -ENOENT;	goto error;key_is_present:	/* we need to copy the key list for RCU purposes */	nklist = kmalloc(sizeof(*klist) + sizeof(*key) * klist->maxkeys,			 GFP_KERNEL);	if (!nklist)		goto nomem;	nklist->maxkeys = klist->maxkeys;	nklist->nkeys = klist->nkeys - 1;	if (loop > 0)		memcpy(&nklist->keys[0],		       &klist->keys[0],		       loop * sizeof(klist->keys[0]));	if (loop < nklist->nkeys)		memcpy(&nklist->keys[loop],		       &klist->keys[loop + 1],		       (nklist->nkeys - loop) * sizeof(klist->keys[0]));	/* adjust the user's quota */	key_payload_reserve(keyring,			    keyring->datalen - KEYQUOTA_LINK_BYTES);	rcu_assign_pointer(keyring->payload.subscriptions, nklist);	up_write(&keyring->sem);	/* schedule for later cleanup */	klist->delkey = loop;	call_rcu(&klist->rcu, keyring_unlink_rcu_disposal);	ret = 0;error:	return ret;nomem:	ret = -ENOMEM;	up_write(&keyring->sem);	goto error;} /* end key_unlink() */
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/a4014d8f61a6a136d22422cf8aa978e6495dbad9/keyring.c/buggy/security/keys/keyring.c