if (outbuf != NULL) kfree(outbuf); if (inbuf != NULL) kfree(inbuf); 
kfree(outbuf); kfree(inbuf); 
int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg){	ide_task_request_t	*req_task;	ide_task_t		args;	u8 *outbuf		= NULL;	u8 *inbuf		= NULL;	task_ioreg_t *argsptr	= args.tfRegister;	task_ioreg_t *hobsptr	= args.hobRegister;	int err			= 0;	int tasksize		= sizeof(struct ide_task_request_s);	int taskin		= 0;	int taskout		= 0;	u8 io_32bit		= drive->io_32bit;	char __user *buf = (char __user *)arg;//	printk("IDE Taskfile ...\n");	req_task = kzalloc(tasksize, GFP_KERNEL);	if (req_task == NULL) return -ENOMEM;	if (copy_from_user(req_task, buf, tasksize)) {		kfree(req_task);		return -EFAULT;	}	taskout = (int) req_task->out_size;	taskin  = (int) req_task->in_size;	if (taskout) {		int outtotal = tasksize;		outbuf = kzalloc(taskout, GFP_KERNEL);		if (outbuf == NULL) {			err = -ENOMEM;			goto abort;		}		if (copy_from_user(outbuf, buf + outtotal, taskout)) {			err = -EFAULT;			goto abort;		}	}	if (taskin) {		int intotal = tasksize + taskout;		inbuf = kzalloc(taskin, GFP_KERNEL);		if (inbuf == NULL) {			err = -ENOMEM;			goto abort;		}		if (copy_from_user(inbuf, buf + intotal, taskin)) {			err = -EFAULT;			goto abort;		}	}	memset(&args, 0, sizeof(ide_task_t));	memcpy(argsptr, req_task->io_ports, HDIO_DRIVE_TASK_HDR_SIZE);	memcpy(hobsptr, req_task->hob_ports, HDIO_DRIVE_HOB_HDR_SIZE);	args.tf_in_flags  = req_task->in_flags;	args.tf_out_flags = req_task->out_flags;	args.data_phase   = req_task->data_phase;	args.command_type = req_task->req_cmd;	drive->io_32bit = 0;	switch(req_task->data_phase) {		case TASKFILE_OUT_DMAQ:		case TASKFILE_OUT_DMA:			err = ide_diag_taskfile(drive, &args, taskout, outbuf);			break;		case TASKFILE_IN_DMAQ:		case TASKFILE_IN_DMA:			err = ide_diag_taskfile(drive, &args, taskin, inbuf);			break;		case TASKFILE_MULTI_OUT:			if (!drive->mult_count) {				/* (hs): give up if multcount is not set */				printk(KERN_ERR "%s: %s Multimode Write " \					"multcount is not set\n",					drive->name, __FUNCTION__);				err = -EPERM;				goto abort;			}			/* fall through */		case TASKFILE_OUT:			args.prehandler = &pre_task_out_intr;			args.handler = &task_out_intr;			err = ide_diag_taskfile(drive, &args, taskout, outbuf);			break;		case TASKFILE_MULTI_IN:			if (!drive->mult_count) {				/* (hs): give up if multcount is not set */				printk(KERN_ERR "%s: %s Multimode Read failure " \					"multcount is not set\n",					drive->name, __FUNCTION__);				err = -EPERM;				goto abort;			}			/* fall through */		case TASKFILE_IN:			args.handler = &task_in_intr;			err = ide_diag_taskfile(drive, &args, taskin, inbuf);			break;		case TASKFILE_NO_DATA:			args.handler = &task_no_data_intr;			err = ide_diag_taskfile(drive, &args, 0, NULL);			break;		default:			err = -EFAULT;			goto abort;	}	memcpy(req_task->io_ports, &(args.tfRegister), HDIO_DRIVE_TASK_HDR_SIZE);	memcpy(req_task->hob_ports, &(args.hobRegister), HDIO_DRIVE_HOB_HDR_SIZE);	req_task->in_flags  = args.tf_in_flags;	req_task->out_flags = args.tf_out_flags;	if (copy_to_user(buf, req_task, tasksize)) {		err = -EFAULT;		goto abort;	}	if (taskout) {		int outtotal = tasksize;		if (copy_to_user(buf + outtotal, outbuf, taskout)) {			err = -EFAULT;			goto abort;		}	}	if (taskin) {		int intotal = tasksize + taskout;		if (copy_to_user(buf + intotal, inbuf, taskin)) {			err = -EFAULT;			goto abort;		}	}abort:	kfree(req_task);	if (outbuf != NULL)		kfree(outbuf);	if (inbuf != NULL)		kfree(inbuf);//	printk("IDE Taskfile ioctl ended. rc = %i\n", err);	drive->io_32bit = io_32bit;	return err;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/6044ec8882c726e325017bd948aa0cd94ad33abc/ide-taskfile.c/buggy/drivers/ide/ide-taskfile.c