+ SMP_ALIGN(tmp.size) * num_possible_cpus()); 
+ SMP_ALIGN(tmp.size) * (highest_possible_processor_id()+1)); 
do_replace(void __user *user, unsigned int len){	int ret;	struct ipt_replace tmp;	struct ipt_table *t;	struct ipt_table_info *newinfo, *oldinfo;	struct ipt_counters *counters;	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)		return -EFAULT;	/* Hack: Causes ipchains to give correct error msg --RR */	if (len != sizeof(tmp) + tmp.size)		return -ENOPROTOOPT;	/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */	if ((SMP_ALIGN(tmp.size) >> PAGE_SHIFT) + 2 > num_physpages)		return -ENOMEM;	newinfo = vmalloc(sizeof(struct ipt_table_info)			  + SMP_ALIGN(tmp.size) * num_possible_cpus());	if (!newinfo)		return -ENOMEM;	if (copy_from_user(newinfo->entries, user + sizeof(tmp),			   tmp.size) != 0) {		ret = -EFAULT;		goto free_newinfo;	}	counters = vmalloc(tmp.num_counters * sizeof(struct ipt_counters));	if (!counters) {		ret = -ENOMEM;		goto free_newinfo;	}	memset(counters, 0, tmp.num_counters * sizeof(struct ipt_counters));	ret = translate_table(tmp.name, tmp.valid_hooks,			      newinfo, tmp.size, tmp.num_entries,			      tmp.hook_entry, tmp.underflow);	if (ret != 0)		goto free_newinfo_counters;	duprintf("ip_tables: Translated table\n");	t = try_then_request_module(find_table_lock(tmp.name),				    "iptable_%s", tmp.name);	if (!t || IS_ERR(t)) {		ret = t ? PTR_ERR(t) : -ENOENT;		goto free_newinfo_counters_untrans;	}	/* You lied! */	if (tmp.valid_hooks != t->valid_hooks) {		duprintf("Valid hook crap: %08X vs %08X\n",			 tmp.valid_hooks, t->valid_hooks);		ret = -EINVAL;		goto put_module;	}	oldinfo = replace_table(t, tmp.num_counters, newinfo, &ret);	if (!oldinfo)		goto put_module;	/* Update module usage count based on number of rules */	duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",		oldinfo->number, oldinfo->initial_entries, newinfo->number);	if ((oldinfo->number > oldinfo->initial_entries) || 	    (newinfo->number <= oldinfo->initial_entries)) 		module_put(t->me);	if ((oldinfo->number > oldinfo->initial_entries) &&	    (newinfo->number <= oldinfo->initial_entries))		module_put(t->me);	/* Get the old counters. */	get_counters(oldinfo, counters);	/* Decrease module usage counts and free resource */	IPT_ENTRY_ITERATE(oldinfo->entries, oldinfo->size, cleanup_entry,NULL);	vfree(oldinfo);	if (copy_to_user(tmp.counters, counters,			 sizeof(struct ipt_counters) * tmp.num_counters) != 0)		ret = -EFAULT;	vfree(counters);	up(&ipt_mutex);	return ret; put_module:	module_put(t->me);	up(&ipt_mutex); free_newinfo_counters_untrans:	IPT_ENTRY_ITERATE(newinfo->entries, newinfo->size, cleanup_entry,NULL); free_newinfo_counters:	vfree(counters); free_newinfo:	vfree(newinfo);	return ret;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/c8923c6b852d3a97c1faad0566e38fca330375a7/ip_tables.c/buggy/net/ipv4/netfilter/ip_tables.c