argbuf = kmalloc(argsize, GFP_KERNEL); 
argbuf = kzalloc(argsize, GFP_KERNEL); 
int ide_cmd_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg){	int err = 0;	u8 args[4], *argbuf = args;	u8 xfer_rate = 0;	int argsize = 4;	ide_task_t tfargs;	if (NULL == (void *) arg) {		struct request rq;		ide_init_drive_cmd(&rq);		return ide_do_drive_cmd(drive, &rq, ide_wait);	}	if (copy_from_user(args, (void __user *)arg, 4))		return -EFAULT;	memset(&tfargs, 0, sizeof(ide_task_t));	tfargs.tfRegister[IDE_FEATURE_OFFSET] = args[2];	tfargs.tfRegister[IDE_NSECTOR_OFFSET] = args[3];	tfargs.tfRegister[IDE_SECTOR_OFFSET]  = args[1];	tfargs.tfRegister[IDE_LCYL_OFFSET]    = 0x00;	tfargs.tfRegister[IDE_HCYL_OFFSET]    = 0x00;	tfargs.tfRegister[IDE_SELECT_OFFSET]  = 0x00;	tfargs.tfRegister[IDE_COMMAND_OFFSET] = args[0];	if (args[3]) {		argsize = 4 + (SECTOR_WORDS * 4 * args[3]);		argbuf = kmalloc(argsize, GFP_KERNEL);		if (argbuf == NULL)			return -ENOMEM;		memcpy(argbuf, args, 4);	}	if (set_transfer(drive, &tfargs)) {		xfer_rate = args[1];		if (ide_ata66_check(drive, &tfargs))			goto abort;	}	err = ide_wait_cmd(drive, args[0], args[1], args[2], args[3], argbuf);	if (!err && xfer_rate) {		/* active-retuning-calls future */		ide_set_xfer_rate(drive, xfer_rate);		ide_driveid_update(drive);	}abort:	if (copy_to_user((void __user *)arg, argbuf, argsize))		err = -EFAULT;	if (argsize > 4)		kfree(argbuf);	return err;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/f5e3c2faa20615e900ab26bd957f898400435924/ide-taskfile.c/buggy/drivers/ide/ide-taskfile.c