static ssize_t rtas_flash_write(struct file *file, const char *buffer, 
static ssize_t rtas_flash_write(struct file *file, const char __user *buffer, 
static ssize_t rtas_flash_write(struct file *file, const char *buffer,				size_t count, loff_t *off){	struct proc_dir_entry *dp = PDE(file->f_dentry->d_inode);	struct rtas_update_flash_t *uf;	char *p;	int next_free;	struct flash_block_list *fl;	uf = (struct rtas_update_flash_t *) dp->data;	if (uf->status == FLASH_AUTH || count == 0)		return count;	/* discard data */	/* In the case that the image is not ready for flashing, the memory	 * allocated for the block list will be freed upon the release of the 	 * proc file	 */	if (uf->flist == NULL) {		uf->flist = (struct flash_block_list *) get_zeroed_page(GFP_KERNEL);		if (!uf->flist)			return -ENOMEM;	}	fl = uf->flist;	while (fl->next)		fl = fl->next; /* seek to last block_list for append */	next_free = fl->num_blocks;	if (next_free == FLASH_BLOCKS_PER_NODE) {		/* Need to allocate another block_list */		fl->next = (struct flash_block_list *)get_zeroed_page(GFP_KERNEL);		if (!fl->next)			return -ENOMEM;		fl = fl->next;		next_free = 0;	}	if (count > PAGE_SIZE)		count = PAGE_SIZE;	p = (char *)get_zeroed_page(GFP_KERNEL);	if (!p)		return -ENOMEM;		if(copy_from_user(p, buffer, count)) {		free_page((unsigned long)p);		return -EFAULT;	}	fl->blocks[next_free].data = p;	fl->blocks[next_free].length = count;	fl->num_blocks++;	return count;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/efa545791ff439d778f79d02255d59ff1f7ea0fc/rtas_flash.c/buggy/arch/ppc64/kernel/rtas_flash.c