char __user *orig_buf = cmdbuf->buf; 
char *orig_buf = cmdbuf->buf; 
static __inline__ int r300_emit_packet3(drm_radeon_private_t * dev_priv,					drm_radeon_cmd_buffer_t * cmdbuf,					drm_r300_cmd_header_t header){	int n;	int ret;	char __user *orig_buf = cmdbuf->buf;	int orig_bufsz = cmdbuf->bufsz;	/* This is a do-while-loop so that we run the interior at least once,	 * even if cmdbuf->nbox is 0. Compare r300_emit_cliprects for rationale.	 */	n = 0;	do {		if (cmdbuf->nbox > R300_SIMULTANEOUS_CLIPRECTS) {			ret = r300_emit_cliprects(dev_priv, cmdbuf, n);			if (ret)				return ret;			cmdbuf->buf = orig_buf;			cmdbuf->bufsz = orig_bufsz;		}		switch (header.packet3.packet) {		case R300_CMD_PACKET3_CLEAR:			DRM_DEBUG("R300_CMD_PACKET3_CLEAR\n");			ret = r300_emit_clear(dev_priv, cmdbuf);			if (ret) {				DRM_ERROR("r300_emit_clear failed\n");				return ret;			}			break;		case R300_CMD_PACKET3_RAW:			DRM_DEBUG("R300_CMD_PACKET3_RAW\n");			ret = r300_emit_raw_packet3(dev_priv, cmdbuf);			if (ret) {				DRM_ERROR("r300_emit_raw_packet3 failed\n");				return ret;			}			break;		default:			DRM_ERROR("bad packet3 type %i at %p\n",				  header.packet3.packet,				  cmdbuf->buf - sizeof(header));			return DRM_ERR(EINVAL);		}		n += R300_SIMULTANEOUS_CLIPRECTS;	} while (n < cmdbuf->nbox);	return 0;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/b3a83639895a422b25f72eec0a5d1d88c3ac4e9e/r300_cmdbuf.c/buggy/drivers/char/drm/r300_cmdbuf.c