snoop(&dev->dev, "bulk write: len=0x%02x timeout=%04d\n", bulk.len, bulk.timeout); if (usbfs_snoop) { dev_info(&dev->dev, "bulk write: data: "); for (j = 0; j < len1; ++j) printk("%02x ", (unsigned char)(tbuf)[j]); printk("\n"); } 
static int proc_bulk(struct dev_state *ps, void __user *arg){	struct usb_device *dev = ps->dev;	struct usbdevfs_bulktransfer bulk;	unsigned int tmo, len1, pipe;	int len2;	unsigned char *tbuf;	int i, ret;	if (copy_from_user(&bulk, arg, sizeof(bulk)))		return -EFAULT;	if ((ret = findintfep(ps->dev, bulk.ep)) < 0)		return ret;	if ((ret = checkintf(ps, ret)))		return ret;	if (bulk.ep & USB_DIR_IN)		pipe = usb_rcvbulkpipe(dev, bulk.ep & 0x7f);	else		pipe = usb_sndbulkpipe(dev, bulk.ep & 0x7f);	if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))		return -EINVAL;	len1 = bulk.len;	if (len1 > MAX_USBFS_BUFFER_SIZE)		return -EINVAL;	if (!(tbuf = kmalloc(len1, GFP_KERNEL)))		return -ENOMEM;	tmo = bulk.timeout;	if (bulk.ep & 0x80) {		if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) {			kfree(tbuf);			return -EINVAL;		}		usb_unlock_device(dev);		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);		usb_lock_device(dev);		if (!i && len2) {			if (copy_to_user(bulk.data, tbuf, len2)) {				kfree(tbuf);				return -EFAULT;			}		}	} else {		if (len1) {			if (copy_from_user(tbuf, bulk.data, len1)) {				kfree(tbuf);				return -EFAULT;			}		}		usb_unlock_device(dev);		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);		usb_lock_device(dev);	}	kfree(tbuf);	if (i < 0)		return i;	return len2;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/e639dd3f4edd4847d160899b19e95ee1a06a6dcb/devio.c/buggy/drivers/usb/core/devio.c