struct ubd_aio *aio; struct bitmap_io *bitmap_io = NULL; char *buf; void *bitmap_buf = NULL; unsigned long len, sector; int nsectors, start, end, bit, err; __u64 off; 
char *buf; unsigned long len; int n, nsectors, start, end, bit; int err; __u64 off; 
void do_io(struct io_thread_req *req, struct request *r, unsigned long *bitmap){        struct ubd_aio *aio;        struct bitmap_io *bitmap_io = NULL;        char *buf;        void *bitmap_buf = NULL;        unsigned long len, sector;        int nsectors, start, end, bit, err;        __u64 off;        if(req->bitmap_start != -1){                /* Round up to the nearest word */                int round = sizeof(unsigned long);                len = (req->bitmap_end - req->bitmap_start +                       round * 8 - 1) / (round * 8);                len *= round;                off = req->bitmap_start / (8 * round);                off *= round;                bitmap_io = kmalloc(sizeof(*bitmap_io), GFP_KERNEL);                if(bitmap_io == NULL){                        printk("Failed to kmalloc bitmap IO\n");                        req->error = 1;                        return;                }                bitmap_buf = kmalloc(len, GFP_KERNEL);                if(bitmap_buf == NULL){                        printk("do_io : kmalloc of bitmap chunk "                               "failed\n");                        kfree(bitmap_io);                        req->error = 1;                        return;                }                memcpy(bitmap_buf, &bitmap[off / sizeof(bitmap[0])], len);                *bitmap_io = ((struct bitmap_io)                        { .count	= ATOMIC_INIT(0),                          .aio		= INIT_AIO(AIO_WRITE, req->fds[1],                                                   bitmap_buf, len,                                                   req->bitmap_offset + off,                                                   ubd_reply_fd) } );        }        nsectors = req->length / req->sectorsize;        start = 0;        end = nsectors;        bit = 0;        do {                if(bitmap != NULL){                        sector = req->offset / req->sectorsize;                        bit = ubd_test_bit(sector + start, bitmap);                        end = start;                        while((end < nsectors) &&                              (ubd_test_bit(sector + end, bitmap) == bit))                                end++;                }                off = req->offsets[bit] + req->offset +                        start * req->sectorsize;                len = (end - start) * req->sectorsize;                buf = &req->buffer[start * req->sectorsize];                aio = kmalloc(sizeof(*aio), GFP_KERNEL);                if(aio == NULL){                        req->error = 1;                        return;                }                *aio = ((struct ubd_aio)                        { .aio		= INIT_AIO(req->op, req->fds[bit], buf,                                                   len, off, ubd_reply_fd),                          .len		= len,                          .req		= r,                          .bitmap	= bitmap_io,                          .bitmap_buf 	= bitmap_buf });                if(aio->bitmap != NULL)                        atomic_inc(&aio->bitmap->count);                err = submit_aio(&aio->aio);                if(err){                        printk("do_io - submit_aio failed, "                               "err = %d\n", err);                        req->error = 1;                        return;                }                start = end;        } while(start < nsectors);}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/91acb21f084aa244f26839406ae7ed8aa3668058/ubd_kern.c/buggy/arch/um/drivers/ubd_kern.c