595 	void *karg;  in fb_ioctl_trans()  local
601 		karg = &fix;  in fb_ioctl_trans()
605 		karg = &cmap;  in fb_ioctl_trans()
656 	err = sys_ioctl(fd, cmd, (unsigned long)karg);  in fb_ioctl_trans()
839 	void *karg = NULL;  in fd_ioctl_trans()  local
858 			f = karg = kmalloc(sizeof(struct floppy_struct), GFP_KERNEL);  in fd_ioctl_trans()
859 			if (!karg)  in fd_ioctl_trans()
884 			f = karg = kmalloc(sizeof(struct floppy_drive_params), GFP_KERNEL);  in fd_ioctl_trans()
885 			if (!karg)  in fd_ioctl_trans()
916 			karg = kmalloc(sizeof(struct floppy_drive_struct), GFP_KERNEL);  in fd_ioctl_trans()
917 			if (!karg)  in fd_ioctl_trans()
921 			karg = kmalloc(sizeof(struct floppy_fdc_state), GFP_KERNEL);  in fd_ioctl_trans()
922 			if (!karg)  in fd_ioctl_trans()
926 			karg = kmalloc(sizeof(struct floppy_write_errors), GFP_KERNEL);  in fd_ioctl_trans()
927 			if (!karg)  in fd_ioctl_trans()
934 	err = sys_ioctl (fd, kcmd, (unsigned long)karg);  in fd_ioctl_trans()
941 			struct floppy_struct *f = karg;  in fd_ioctl_trans()
957 			struct floppy_drive_params *f = karg;  in fd_ioctl_trans()
983 			struct floppy_drive_struct *f = karg;  in fd_ioctl_trans()
1004 			struct floppy_fdc_state *f = karg;  in fd_ioctl_trans()
1021 			struct floppy_write_errors *f = karg;  in fd_ioctl_trans()
1037 out:	if (karg) kfree(karg);  in fd_ioctl_trans()
1062 	void *karg;  in ppp_ioctl_trans()  local
1068 		karg = &idle;  in ppp_ioctl_trans()
1083 		karg = &data;  in ppp_ioctl_trans()
1097 	err = sys_ioctl (fd, kcmd, (unsigned long)karg);  in ppp_ioctl_trans()
1165 	void *karg;  in mt_ioctl_trans()  local
1171 		karg = &pos;  in mt_ioctl_trans()
1175 		karg = &get;  in mt_ioctl_trans()
1179 		karg = &info;  in mt_ioctl_trans()
1183 		karg = &info;  in mt_ioctl_trans()
1208 	err = sys_ioctl (fd, kcmd, (unsigned long)karg);  in mt_ioctl_trans()
1272 	void *karg;  in cdrom_ioctl_trans()  local
1280 		karg = &cdread;  in cdrom_ioctl_trans()
1292 		karg = &cdreadaudio;  in cdrom_ioctl_trans()
1305 		karg = &cgc;  in cdrom_ioctl_trans()
1327 	err = sys_ioctl (fd, cmd, (unsigned long)karg);  in cdrom_ioctl_trans()
2011 	void *karg = &u;  in do_lvm_ioctl()  local
2018 		karg = v;  in do_lvm_ioctl()
2037 		karg = v;  in do_lvm_ioctl()
2127 		karg = &p;  in do_lvm_ioctl()
2151         err = sys_ioctl (fd, cmd, (unsigned long)karg);  in do_lvm_ioctl()
2325 	drm_unique_t karg;  in drm32_getsetunique()  local
2331 	if (get_user(karg.unique_len, &uarg->unique_len))  in drm32_getsetunique()
2333 	karg.unique = NULL;  in drm32_getsetunique()
2341 		karg.unique = kmalloc(karg.unique_len, GFP_KERNEL);  in drm32_getsetunique()
2342 		if (!karg.unique)  in drm32_getsetunique()
2345 		    copy_from_user(karg.unique, uptr, karg.unique_len)) {  in drm32_getsetunique()
2346 			kfree(karg.unique);  in drm32_getsetunique()
2354 		ret = sys_ioctl (fd, DRM_IOCTL_GET_UNIQUE, (unsigned long)&karg);  in drm32_getsetunique()
2356 		ret = sys_ioctl (fd, DRM_IOCTL_SET_UNIQUE, (unsigned long)&karg);  in drm32_getsetunique()
2362 		    copy_to_user(uptr, karg.unique, karg.unique_len))  in drm32_getsetunique()
2364 		if (put_user(karg.unique_len, &uarg->unique_len))  in drm32_getsetunique()
2368 	if (karg.unique != NULL)  in drm32_getsetunique()
2369 		kfree(karg.unique);  in drm32_getsetunique()
2389 	drm_map_t karg;  in drm32_addmap()  local
2394 	ret  = get_user(karg.offset, &uarg->offset);  in drm32_addmap()
2395 	ret |= get_user(karg.size, &uarg->size);  in drm32_addmap()
2396 	ret |= get_user(karg.type, &uarg->type);  in drm32_addmap()
2397 	ret |= get_user(karg.flags, &uarg->flags);  in drm32_addmap()
2399 	ret |= get_user(karg.mtrr, &uarg->mtrr);  in drm32_addmap()
2403 	karg.handle = (void *) A(tmp);  in drm32_addmap()
2407 	ret = sys_ioctl(fd, DRM_IOCTL_ADD_MAP, (unsigned long) &karg);  in drm32_addmap()
2411 		ret  = put_user(karg.offset, &uarg->offset);  in drm32_addmap()
2412 		ret |= put_user(karg.size, &uarg->size);  in drm32_addmap()
2413 		ret |= put_user(karg.type, &uarg->type);  in drm32_addmap()
2414 		ret |= put_user(karg.flags, &uarg->flags);  in drm32_addmap()
2415 		tmp = (u32) (long)karg.handle;  in drm32_addmap()
2417 		ret |= put_user(karg.mtrr, &uarg->mtrr);  in drm32_addmap()
2435 	drm_buf_info_t karg;  in drm32_info_bufs()  local
2440 	if (get_user(karg.count, &uarg->count) ||  in drm32_info_bufs()
2446 	orig_count = karg.count;  in drm32_info_bufs()
2448 	karg.list = kmalloc(karg.count * sizeof(drm_buf_desc_t), GFP_KERNEL);  in drm32_info_bufs()
2449 	if (!karg.list)  in drm32_info_bufs()
2454 	ret = sys_ioctl(fd, DRM_IOCTL_INFO_BUFS, (unsigned long) &karg);  in drm32_info_bufs()
2458 		if (karg.count <= orig_count &&  in drm32_info_bufs()
2459 		    (copy_to_user(ulist, karg.list,  in drm32_info_bufs()
2460 				  karg.count * sizeof(drm_buf_desc_t))))  in drm32_info_bufs()
2462 		if (put_user(karg.count, &uarg->count))  in drm32_info_bufs()
2466 	kfree(karg.list);  in drm32_info_bufs()
2480 	drm_buf_free_t karg;  in drm32_free_bufs()  local
2486 	if (get_user(karg.count, &uarg->count) ||  in drm32_free_bufs()
2492 	karg.list = kmalloc(karg.count * sizeof(int), GFP_KERNEL);  in drm32_free_bufs()
2493 	if (!karg.list)  in drm32_free_bufs()
2497 	if (copy_from_user(karg.list, ulist, (karg.count * sizeof(int))))  in drm32_free_bufs()
2502 	ret = sys_ioctl(fd, DRM_IOCTL_FREE_BUFS, (unsigned long) &karg);  in drm32_free_bufs()
2506 	kfree(karg.list);  in drm32_free_bufs()
2529 	drm_buf_map_t karg;  in drm32_map_bufs()  local
2534 	if (get_user(karg.count, &uarg->count) ||  in drm32_map_bufs()
2539 	karg.virtual = (void *) A(tmp1);  in drm32_map_bufs()
2542 	orig_count = karg.count;  in drm32_map_bufs()
2544 	karg.list = kmalloc(karg.count * sizeof(drm_buf_pub_t), GFP_KERNEL);  in drm32_map_bufs()
2545 	if (!karg.list)  in drm32_map_bufs()
2549 	for (i = 0; i < karg.count; i++) {  in drm32_map_bufs()
2550 		if (get_user(karg.list[i].idx, &ulist[i].idx) ||  in drm32_map_bufs()
2551 		    get_user(karg.list[i].total, &ulist[i].total) ||  in drm32_map_bufs()
2552 		    get_user(karg.list[i].used, &ulist[i].used) ||  in drm32_map_bufs()
2556 		karg.list[i].address = (void *) A(tmp1);  in drm32_map_bufs()
2561 	ret = sys_ioctl(fd, DRM_IOCTL_MAP_BUFS, (unsigned long) &karg);  in drm32_map_bufs()
2566 			tmp1 = (u32) (long) karg.list[i].address;  in drm32_map_bufs()
2567 			if (put_user(karg.list[i].idx, &ulist[i].idx) ||  in drm32_map_bufs()
2568 			    put_user(karg.list[i].total, &ulist[i].total) ||  in drm32_map_bufs()
2569 			    put_user(karg.list[i].used, &ulist[i].used) ||  in drm32_map_bufs()
2575 		if (put_user(karg.count, &uarg->count))  in drm32_map_bufs()
2580 	kfree(karg.list);  in drm32_map_bufs()
2608 	drm_dma_t karg;  in drm32_dma()  local
2613 	karg.send_indices = karg.send_sizes = NULL;  in drm32_dma()
2614 	karg.request_indices = karg.request_sizes = NULL;  in drm32_dma()
2616 	if (get_user(karg.context, &uarg->context) ||  in drm32_dma()
2617 	    get_user(karg.send_count, &uarg->send_count) ||  in drm32_dma()
2620 	    get_user(karg.flags, &uarg->flags) ||  in drm32_dma()
2621 	    get_user(karg.request_count, &uarg->request_count) ||  in drm32_dma()
2622 	    get_user(karg.request_size, &uarg->request_size) ||  in drm32_dma()
2625 	    get_user(karg.granted_count, &uarg->granted_count))  in drm32_dma()
2633 	if (karg.send_count) {  in drm32_dma()
2634 		karg.send_indices = kmalloc(karg.send_count * sizeof(int), GFP_KERNEL);  in drm32_dma()
2635 		karg.send_sizes = kmalloc(karg.send_count * sizeof(int), GFP_KERNEL);  in drm32_dma()
2638 		if (!karg.send_indices || !karg.send_sizes)  in drm32_dma()
2642 		if (copy_from_user(karg.send_indices, u_si,  in drm32_dma()
2643 				   (karg.send_count * sizeof(int))) ||  in drm32_dma()
2644 		    copy_from_user(karg.send_sizes, u_ss,  in drm32_dma()
2645 				   (karg.send_count * sizeof(int))))  in drm32_dma()
2649 	if (karg.request_count) {  in drm32_dma()
2650 		karg.request_indices = kmalloc(karg.request_count * sizeof(int), GFP_KERNEL);  in drm32_dma()
2651 		karg.request_sizes = kmalloc(karg.request_count * sizeof(int), GFP_KERNEL);  in drm32_dma()
2654 		if (!karg.request_indices || !karg.request_sizes)  in drm32_dma()
2658 		if (copy_from_user(karg.request_indices, u_ri,  in drm32_dma()
2659 				   (karg.request_count * sizeof(int))) ||  in drm32_dma()
2660 		    copy_from_user(karg.request_sizes, u_rs,  in drm32_dma()
2661 				   (karg.request_count * sizeof(int))))  in drm32_dma()
2667 	ret = sys_ioctl(fd, DRM_IOCTL_DMA, (unsigned long) &karg);  in drm32_dma()
2671 		if (put_user(karg.context, &uarg->context) ||  in drm32_dma()
2672 		    put_user(karg.send_count, &uarg->send_count) ||  in drm32_dma()
2673 		    put_user(karg.flags, &uarg->flags) ||  in drm32_dma()
2674 		    put_user(karg.request_count, &uarg->request_count) ||  in drm32_dma()
2675 		    put_user(karg.request_size, &uarg->request_size) ||  in drm32_dma()
2676 		    put_user(karg.granted_count, &uarg->granted_count))  in drm32_dma()
2679 		if (karg.send_count) {  in drm32_dma()
2680 			if (copy_to_user(u_si, karg.send_indices,  in drm32_dma()
2681 					 (karg.send_count * sizeof(int))) ||  in drm32_dma()
2682 			    copy_to_user(u_ss, karg.send_sizes,  in drm32_dma()
2683 					 (karg.send_count * sizeof(int))))  in drm32_dma()
2686 		if (karg.request_count) {  in drm32_dma()
2687 			if (copy_to_user(u_ri, karg.request_indices,  in drm32_dma()
2688 					 (karg.request_count * sizeof(int))) ||  in drm32_dma()
2689 			    copy_to_user(u_rs, karg.request_sizes,  in drm32_dma()
2690 					 (karg.request_count * sizeof(int))))  in drm32_dma()
2696 	if (karg.send_indices)  in drm32_dma()
2697 		kfree(karg.send_indices);  in drm32_dma()
2698 	if (karg.send_sizes)  in drm32_dma()
2699 		kfree(karg.send_sizes);  in drm32_dma()
2700 	if (karg.request_indices)  in drm32_dma()
2701 		kfree(karg.request_indices);  in drm32_dma()
2702 	if (karg.request_sizes)  in drm32_dma()
2703 		kfree(karg.request_sizes);  in drm32_dma()
2718 	drm_ctx_res_t karg;  in drm32_res_ctx()  local
2723 	karg.contexts = NULL;  in drm32_res_ctx()
2724 	if (get_user(karg.count, &uarg->count) ||  in drm32_res_ctx()
2730 	orig_count = karg.count;  in drm32_res_ctx()
2731 	if (karg.count && ulist) {  in drm32_res_ctx()
2732 		karg.contexts = kmalloc((karg.count * sizeof(drm_ctx_t)), GFP_KERNEL);  in drm32_res_ctx()
2733 		if (!karg.contexts)  in drm32_res_ctx()
2735 		if (copy_from_user(karg.contexts, ulist,  in drm32_res_ctx()
2736 				   (karg.count * sizeof(drm_ctx_t)))) {  in drm32_res_ctx()
2737 			kfree(karg.contexts);  in drm32_res_ctx()
2744 	ret = sys_ioctl(fd, DRM_IOCTL_RES_CTX, (unsigned long) &karg);  in drm32_res_ctx()
2749 			if (copy_to_user(ulist, karg.contexts,  in drm32_res_ctx()
2753 		if (put_user(karg.count, &uarg->count))  in drm32_res_ctx()
2757 	if (karg.contexts)  in drm32_res_ctx()
2758 		kfree(karg.contexts);  in drm32_res_ctx()