236 		unsigned nmsgs, struct i2c_msg *msgs)  in i2cdev_ioctl_rdwr()  argument
243 		kfree(msgs);  in i2cdev_ioctl_rdwr()
250 		if (msgs[i].len > 8192) {  in i2cdev_ioctl_rdwr()
255 		data_ptrs[i] = (u8 __user *)msgs[i].buf;  in i2cdev_ioctl_rdwr()
256 		msgs[i].buf = memdup_user(data_ptrs[i], msgs[i].len);  in i2cdev_ioctl_rdwr()
257 		if (IS_ERR(msgs[i].buf)) {  in i2cdev_ioctl_rdwr()
258 			res = PTR_ERR(msgs[i].buf);  in i2cdev_ioctl_rdwr()
262 		msgs[i].flags |= I2C_M_DMA_SAFE;  in i2cdev_ioctl_rdwr()
275 		if (msgs[i].flags & I2C_M_RECV_LEN) {  in i2cdev_ioctl_rdwr()
276 			if (!(msgs[i].flags & I2C_M_RD) ||  in i2cdev_ioctl_rdwr()
277 			    msgs[i].len < 1 || msgs[i].buf[0] < 1 ||  in i2cdev_ioctl_rdwr()
278 			    msgs[i].len < msgs[i].buf[0] +  in i2cdev_ioctl_rdwr()
285 			msgs[i].len = msgs[i].buf[0];  in i2cdev_ioctl_rdwr()
291 			kfree(msgs[j].buf);  in i2cdev_ioctl_rdwr()
293 		kfree(msgs);  in i2cdev_ioctl_rdwr()
297 	res = i2c_transfer(client->adapter, msgs, nmsgs);  in i2cdev_ioctl_rdwr()
299 		if (res >= 0 && (msgs[i].flags & I2C_M_RD)) {  in i2cdev_ioctl_rdwr()
300 			if (copy_to_user(data_ptrs[i], msgs[i].buf,  in i2cdev_ioctl_rdwr()
301 					 msgs[i].len))  in i2cdev_ioctl_rdwr()
304 		kfree(msgs[i].buf);  in i2cdev_ioctl_rdwr()
307 	kfree(msgs);  in i2cdev_ioctl_rdwr()
443 		if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0)  in i2cdev_ioctl()
453 		rdwr_pa = memdup_user(rdwr_arg.msgs,  in i2cdev_ioctl()
515 	compat_caddr_t msgs; /* struct i2c_msg __user *msgs */  member
538 		if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0)  in compat_i2cdev_ioctl()
549 		p = compat_ptr(rdwr_arg.msgs);  in compat_i2cdev_ioctl()