if (length > 0xffff || vary >= length) 
if (length < 1 || length > 0xffff || vary >= length) 
static int ctrl_out (struct usbtest_dev *dev,		unsigned count, unsigned length, unsigned vary){	unsigned		i, j, len, retval;	u8			*buf;	char			*what = "?";	struct usb_device	*udev;		if (length > 0xffff || vary >= length)		return -EINVAL;	buf = kmalloc(length, SLAB_KERNEL);	if (!buf)		return -ENOMEM;	udev = testdev_to_usbdev (dev);	len = length;	retval = 0;	/* NOTE:  hardware might well act differently if we pushed it	 * with lots back-to-back queued requests.	 */	for (i = 0; i < count; i++) {		/* write patterned data */		for (j = 0; j < len; j++)			buf [j] = i + j;		retval = usb_control_msg (udev, usb_sndctrlpipe (udev,0),				0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,				0, 0, buf, len, USB_CTRL_SET_TIMEOUT);		if (retval != len) {			what = "write";			break;		}		/* read it back -- assuming nothing intervened!!  */		retval = usb_control_msg (udev, usb_rcvctrlpipe (udev,0),				0x5c, USB_DIR_IN|USB_TYPE_VENDOR,				0, 0, buf, len, USB_CTRL_GET_TIMEOUT);		if (retval != len) {			what = "read";			break;		}		/* fail if we can't verify */		for (j = 0; j < len; j++) {			if (buf [j] != (u8) (i + j)) {				INFO (dev, "ctrl_out, byte %d is %d not %d\n",					j, buf [j], (u8) i + j);				retval = -EBADMSG;				break;			}		}		if (retval < 0) {			what = "verify";			break;		}		len += vary;		if (len > length)			len = 0;	}	if (retval < 0)		INFO (dev, "ctrl_out %s failed, code %d, count %d\n",			what, retval, i);	kfree (buf);	return retval;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/ff7c79e4f37821235b51fb8e19088c08938cc8fc/usbtest.c/clean/drivers/usb/misc/usbtest.c