kfree (temp_buffer); 
kfree(temp_buffer); 
static int bluetooth_write (struct tty_struct * tty, const unsigned char *buf, int count){	struct usb_bluetooth *bluetooth = get_usb_bluetooth ((struct usb_bluetooth *)tty->driver_data, __FUNCTION__);	struct urb *urb = NULL;	unsigned char *temp_buffer = NULL;	const unsigned char *current_buffer;	unsigned char *urb_buffer;	int i;	int retval = 0;	if (!bluetooth) {		return -ENODEV;	}	dbg("%s - %d byte(s)", __FUNCTION__, count);	if (!bluetooth->open_count) {		dbg ("%s - device not opened", __FUNCTION__);		return -EINVAL;	}	if (count == 0) {		dbg("%s - write request of 0 bytes", __FUNCTION__);		return 0;	}	if (count == 1) {		dbg("%s - write request only included type %d", __FUNCTION__, buf[0]);		return 1;	}#ifdef DEBUG	printk (KERN_DEBUG __FILE__ ": %s - length = %d, data = ", __FUNCTION__, count);	for (i = 0; i < count; ++i) {		printk ("%.2x ", buf[i]);	}	printk ("\n");#endif	current_buffer = buf;	switch (*current_buffer) {		/* First byte indicates the type of packet */		case CMD_PKT:			/* dbg("%s- Send cmd_pkt len:%d", __FUNCTION__, count);*/			retval = bluetooth_ctrl_msg (bluetooth, 0x00, 0x00, &current_buffer[1], count-1);			if (retval) {				goto exit;			}			retval = count;			break;		case ACL_PKT:			++current_buffer;			--count;			urb_buffer = kmalloc (count, GFP_ATOMIC);			if (!urb_buffer) {				dev_err(&bluetooth->dev->dev, "out of memory\n");				retval = -ENOMEM;				goto exit;			}			urb = usb_alloc_urb(0, GFP_ATOMIC);			if (!urb) {				dev_err(&bluetooth->dev->dev, "no more free urbs\n");				kfree(urb_buffer);				retval = -ENOMEM;				goto exit;			}			memcpy (urb_buffer, current_buffer, count);			/* build up our urb */			usb_fill_bulk_urb(urb, bluetooth->dev, 					  usb_sndbulkpipe(bluetooth->dev,						  	  bluetooth->bulk_out_endpointAddress),					  urb_buffer,					  count,					  bluetooth_write_bulk_callback,					  bluetooth);			/* send it down the pipe */			retval = usb_submit_urb(urb, GFP_KERNEL);			if (retval) {				dbg("%s - usb_submit_urb(write bulk) failed with error = %d", __FUNCTION__, retval);				goto exit;			}			/* we are done with this urb, so let the host driver			 * really free it when it is finished with it */			usb_free_urb (urb);			retval = count + 1;			break;				default :			dbg("%s - unsupported (at this time) write type", __FUNCTION__);			retval = -EINVAL;			break;	}exit:	kfree (temp_buffer);	return retval;} 
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/1bc3c9e1e44c2059fe2ffa6ff70ad0a925d7b05f/bluetty.c/buggy/drivers/usb/class/bluetty.c