/* N.B. Use kfree here, as kern_msg.msg_controllen might change? */ if(ctl_buf != ctl) kfree(ctl_buf); 
if (ctl_buf != ctl) sock_kfree_s(sock->sk, ctl_buf, ctl_len); 
asmlinkage int solaris_sendmsg(int fd, struct sol_nmsghdr __user *user_msg, unsigned user_flags){	struct socket *sock;	char address[MAX_SOCK_ADDR];	struct iovec iov[UIO_FASTIOV];	unsigned char ctl[sizeof(struct cmsghdr) + 20];	unsigned char *ctl_buf = ctl;	struct msghdr kern_msg;	int err, total_len;	if(msghdr_from_user32_to_kern(&kern_msg, user_msg))		return -EFAULT;	if(kern_msg.msg_iovlen > UIO_MAXIOV)		return -EINVAL;	err = verify_compat_iovec(&kern_msg, iov, address, VERIFY_READ);	if (err < 0)		goto out;	total_len = err;	if(kern_msg.msg_controllen) {		struct sol_cmsghdr __user *ucmsg = kern_msg.msg_control;		unsigned long *kcmsg;		compat_size_t cmlen;		if (kern_msg.msg_controllen <= sizeof(compat_size_t))			return -EINVAL;		if(kern_msg.msg_controllen > sizeof(ctl)) {			err = -ENOBUFS;			ctl_buf = kmalloc(kern_msg.msg_controllen, GFP_KERNEL);			if(!ctl_buf)				goto out_freeiov;		}		__get_user(cmlen, &ucmsg->cmsg_len);		kcmsg = (unsigned long *) ctl_buf;		*kcmsg++ = (unsigned long)cmlen;		err = -EFAULT;		if(copy_from_user(kcmsg, &ucmsg->cmsg_level,				  kern_msg.msg_controllen - sizeof(compat_size_t)))			goto out_freectl;		kern_msg.msg_control = ctl_buf;	}	kern_msg.msg_flags = solaris_to_linux_msgflags(user_flags);	lock_kernel();	sock = sockfd_lookup(fd, &err);	if (sock != NULL) {		if (sock->file->f_flags & O_NONBLOCK)			kern_msg.msg_flags |= MSG_DONTWAIT;		err = sock_sendmsg(sock, &kern_msg, total_len);		sockfd_put(sock);	}	unlock_kernel();out_freectl:	/* N.B. Use kfree here, as kern_msg.msg_controllen might change? */	if(ctl_buf != ctl)		kfree(ctl_buf);out_freeiov:	if(kern_msg.msg_iov != iov)		kfree(kern_msg.msg_iov);out:	return err;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/d64d3873721cfe870d49d73c3744f06260779ce7/socket.c/buggy/arch/sparc64/solaris/socket.c