lock_kiocb(kiocb); 
asmlinkage long sys_io_cancel(aio_context_t ctx_id, struct iocb __user *iocb,			      struct io_event __user *result){	int (*cancel)(struct kiocb *iocb, struct io_event *res);	struct kioctx *ctx;	struct kiocb *kiocb;	u32 key;	int ret;	ret = get_user(key, &iocb->aio_key);	if (unlikely(ret))		return -EFAULT;	ctx = lookup_ioctx(ctx_id);	if (unlikely(!ctx))		return -EINVAL;	spin_lock_irq(&ctx->ctx_lock);	ret = -EAGAIN;	kiocb = lookup_kiocb(ctx, iocb, key);	if (kiocb && kiocb->ki_cancel) {		cancel = kiocb->ki_cancel;		kiocb->ki_users ++;		kiocbSetCancelled(kiocb);	} else		cancel = NULL;	spin_unlock_irq(&ctx->ctx_lock);	if (NULL != cancel) {		struct io_event tmp;		pr_debug("calling cancel\n");		lock_kiocb(kiocb);		memset(&tmp, 0, sizeof(tmp));		tmp.obj = (u64)(unsigned long)kiocb->ki_obj.user;		tmp.data = kiocb->ki_user_data;		ret = cancel(kiocb, &tmp);		if (!ret) {			/* Cancellation succeeded -- copy the result			 * into the user's buffer.			 */			if (copy_to_user(result, &tmp, sizeof(tmp)))				ret = -EFAULT;		}		unlock_kiocb(kiocb);	} else		ret = -EINVAL;	put_ioctx(ctx);	return ret;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/4faa5285283fad081443e3612ca426a311bb6c7e/aio.c/buggy/fs/aio.c