if (mbuf) kfree(mbuf); 
kfree(mbuf); 
video_usercopy(struct inode *inode, struct file *file,	       unsigned int cmd, unsigned long arg,	       int (*func)(struct inode *inode, struct file *file,			   unsigned int cmd, void *arg)){	char	sbuf[128];	void    *mbuf = NULL;	void	*parg = NULL;	int	err  = -EINVAL;	cmd = video_fix_command(cmd);	/*  Copy arguments into temp kernel buffer  */	switch (_IOC_DIR(cmd)) {	case _IOC_NONE:		parg = NULL;		break;	case _IOC_READ:	case _IOC_WRITE:	case (_IOC_WRITE | _IOC_READ):		if (_IOC_SIZE(cmd) <= sizeof(sbuf)) {			parg = sbuf;		} else {			/* too big to allocate from stack */			mbuf = kmalloc(_IOC_SIZE(cmd),GFP_KERNEL);			if (NULL == mbuf)				return -ENOMEM;			parg = mbuf;		}				err = -EFAULT;		if (_IOC_DIR(cmd) & _IOC_WRITE)			if (copy_from_user(parg, (void __user *)arg, _IOC_SIZE(cmd)))				goto out;		break;	}	/* call driver */	err = func(inode, file, cmd, parg);	if (err == -ENOIOCTLCMD)		err = -EINVAL;	if (err < 0)		goto out;	/*  Copy results into user buffer  */	switch (_IOC_DIR(cmd))	{	case _IOC_READ:	case (_IOC_WRITE | _IOC_READ):		if (copy_to_user((void __user *)arg, parg, _IOC_SIZE(cmd)))			err = -EFAULT;		break;	}out:	if (mbuf)		kfree(mbuf);	return err;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/2ea7533060e361810c21b2f5ee02151c4dfb85d8/videodev.c/buggy/drivers/media/video/videodev.c