--- initial
+++ final
@@ -1,118 +1,117 @@
 static int jffs2_symlink(struct inode *dir_i, struct dentry *dentry, const char *target) {
   struct jffs2_inode_info *f, *dir_f;
   struct jffs2_sb_info *c;
   struct inode *inode;
   struct jffs2_raw_inode *ri;
   struct jffs2_raw_dirent *rd;
   struct jffs2_full_dnode *fn;
   struct jffs2_full_dirent *fd;
   int namelen;
   uint32_t alloclen;
   int ret, targetlen = strlen(target);
   /* FIXME: If you care. We'd need to use frags for the target
      if it grows much more than this */
   if (targetlen > 254) return -ENAMETOOLONG;
   ri = jffs2_alloc_raw_inode();
   if (!ri) return -ENOMEM;
   c = JFFS2_SB_INFO(dir_i->i_sb);
   /* Try to reserve enough space for both node and dirent.
    * Just the node will do for now, though
    */
   namelen = dentry->d_name.len;
   ret = jffs2_reserve_space(c, sizeof(*ri) + targetlen, &alloclen, ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
   if (ret) {
     jffs2_free_raw_inode(ri);
     return ret;
   }
   inode = jffs2_new_inode(dir_i, S_IFLNK | S_IRWXUGO, ri);
   if (IS_ERR(inode)) {
     jffs2_free_raw_inode(ri);
     jffs2_complete_reservation(c);
     return PTR_ERR(inode);
   }
   inode->i_op = &jffs2_symlink_inode_operations;
   f = JFFS2_INODE_INFO(inode);
   inode->i_size = targetlen;
   ri->isize = ri->dsize = ri->csize = cpu_to_je32(inode->i_size);
   ri->totlen = cpu_to_je32(sizeof(*ri) + inode->i_size);
   ri->hdr_crc = cpu_to_je32(crc32(0, ri, sizeof(struct jffs2_unknown_node) - 4));
   ri->compr = JFFS2_COMPR_NONE;
   ri->data_crc = cpu_to_je32(crc32(0, target, targetlen));
   ri->node_crc = cpu_to_je32(crc32(0, ri, sizeof(*ri) - 8));
   fn = jffs2_write_dnode(c, f, ri, target, targetlen, ALLOC_NORMAL);
   jffs2_free_raw_inode(ri);
   if (IS_ERR(fn)) {
     /* Eeek. Wave bye bye */
     mutex_unlock(&f->sem);
     jffs2_complete_reservation(c);
     ret = PTR_ERR(fn);
     goto fail;
   }
   /* We use f->target field to store the target path. */
-  f->target = kmalloc(targetlen + 1, GFP_KERNEL);
+  f->target = kmemdup(target, targetlen + 1, GFP_KERNEL);
   if (!f->target) {
     printk(KERN_WARNING "Can't allocate %d bytes of memory\n", targetlen + 1);
     mutex_unlock(&f->sem);
     jffs2_complete_reservation(c);
     ret = -ENOMEM;
     goto fail;
   }
-  memcpy(f->target, target, targetlen + 1);
   D1(printk(KERN_DEBUG "jffs2_symlink: symlink's target '%s' cached\n", (char *)f->target));
   /* No data here. Only a metadata node, which will be
      obsoleted by the first data write
   */
   f->metadata = fn;
   mutex_unlock(&f->sem);
   jffs2_complete_reservation(c);
   ret = jffs2_init_security(inode, dir_i);
   if (ret) goto fail;
   ret = jffs2_init_acl_post(inode);
   if (ret) goto fail;
   ret = jffs2_reserve_space(c, sizeof(*rd) + namelen, &alloclen, ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
   if (ret) goto fail;
   rd = jffs2_alloc_raw_dirent();
   if (!rd) {
     /* Argh. Now we treat it like a normal delete */
     jffs2_complete_reservation(c);
     ret = -ENOMEM;
     goto fail;
   }
   dir_f = JFFS2_INODE_INFO(dir_i);
   mutex_lock(&dir_f->sem);
   rd->magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
   rd->nodetype = cpu_to_je16(JFFS2_NODETYPE_DIRENT);
   rd->totlen = cpu_to_je32(sizeof(*rd) + namelen);
   rd->hdr_crc = cpu_to_je32(crc32(0, rd, sizeof(struct jffs2_unknown_node) - 4));
   rd->pino = cpu_to_je32(dir_i->i_ino);
   rd->version = cpu_to_je32(++dir_f->highest_version);
   rd->ino = cpu_to_je32(inode->i_ino);
   rd->mctime = cpu_to_je32(get_seconds());
   rd->nsize = namelen;
   rd->type = DT_LNK;
   rd->node_crc = cpu_to_je32(crc32(0, rd, sizeof(*rd) - 8));
   rd->name_crc = cpu_to_je32(crc32(0, dentry->d_name.name, namelen));
   fd = jffs2_write_dirent(c, dir_f, rd, dentry->d_name.name, namelen, ALLOC_NORMAL);
   if (IS_ERR(fd)) {
     /* dirent failed to write. Delete the inode normally
        as if it were the final unlink() */
     jffs2_complete_reservation(c);
     jffs2_free_raw_dirent(rd);
     mutex_unlock(&dir_f->sem);
     ret = PTR_ERR(fd);
     goto fail;
   }
   dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
   jffs2_free_raw_dirent(rd);
   /* Link the fd into the inode's list, obsoleting an old
      one if necessary. */
   jffs2_add_fd_to_list(c, fd, &dir_f->dents);
   mutex_unlock(&dir_f->sem);
   jffs2_complete_reservation(c);
   d_instantiate(dentry, inode);
   unlock_new_inode(inode);
   return 0;
 fail:
   iget_failed(inode);
   return ret;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);