kfree (urb->transfer_buffer); 
kfree(urb->transfer_buffer); 
static int bluetooth_ctrl_msg (struct usb_bluetooth *bluetooth, int request, int value, const unsigned char *buf, int len){	struct urb *urb = NULL;	struct usb_ctrlrequest *dr = NULL;	int i;	int status;	dbg ("%s", __FUNCTION__);	/* try to find a free urb in our list */	for (i = 0; i < NUM_CONTROL_URBS; ++i) {		if (bluetooth->control_urb_pool[i]->status != -EINPROGRESS) {			urb = bluetooth->control_urb_pool[i];			dr = &bluetooth->dr[i];			break;		}	}	if (urb == NULL) {		dbg ("%s - no free urbs", __FUNCTION__);		return -ENOMEM;	}	/* keep increasing the urb transfer buffer to fit the size of the message */	if (urb->transfer_buffer == NULL) {		urb->transfer_buffer = kmalloc (len, GFP_KERNEL);		if (urb->transfer_buffer == NULL) {			err ("%s - out of memory", __FUNCTION__);			return -ENOMEM;		}	}	if (urb->transfer_buffer_length < len) {		kfree (urb->transfer_buffer);		urb->transfer_buffer = kmalloc (len, GFP_KERNEL);		if (urb->transfer_buffer == NULL) {			err ("%s - out of memory", __FUNCTION__);			return -ENOMEM;		}	}	memcpy (urb->transfer_buffer, buf, len);	dr->bRequestType= BLUETOOTH_CONTROL_REQUEST_TYPE;	dr->bRequest = request;	dr->wValue = cpu_to_le16((u16) value);	dr->wIndex = cpu_to_le16((u16) bluetooth->control_out_bInterfaceNum);	dr->wLength = cpu_to_le16((u16) len);		usb_fill_control_urb (urb, bluetooth->dev, usb_sndctrlpipe(bluetooth->dev, 0),			  (unsigned char*)dr, urb->transfer_buffer, len, bluetooth_ctrl_callback, bluetooth);	/* send it down the pipe */	status = usb_submit_urb(urb, GFP_KERNEL);	if (status)		dbg("%s - usb_submit_urb(control) failed with status = %d", __FUNCTION__, status);		return status;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/1bc3c9e1e44c2059fe2ffa6ff70ad0a925d7b05f/bluetty.c/buggy/drivers/usb/class/bluetty.c