imamnurby/smpl_train_seed8 huggingface dataset:
--- initial
+++ final
@@ -1,24 +1,20 @@
 static int get_filter(void __user *arg, struct sock_filter **p) {
   struct sock_fprog uprog;
   struct sock_filter *code = NULL;
   int len, err;
   if (copy_from_user(&uprog, arg, sizeof(uprog))) return -EFAULT;
   if (!uprog.len) {
     *p = NULL;
     return 0;
   }
   len = uprog.len * sizeof(struct sock_filter);
-  code = kmalloc(len, GFP_KERNEL);
-  if (code == NULL) return -ENOMEM;
-  if (copy_from_user(code, uprog.filter, len)) {
-    kfree(code);
-    return -EFAULT;
-  }
+  code = memdup_user(uprog.filter, len);
+  if (IS_ERR(code)) return PTR_ERR(code);
   err = sk_chk_filter(code, uprog.len);
   if (err) {
     kfree(code);
     return err;
   }
   *p = code;
   return uprog.len;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,26 +1,22 @@
 static int sdla_xfer(struct net_device *dev, struct sdla_mem __user *info, int read) {
   struct sdla_mem mem;
   char *temp;
   if (copy_from_user(&mem, info, sizeof(mem))) return -EFAULT;
 
   if (read) {
     temp = kzalloc(mem.len, GFP_KERNEL);
     if (!temp) return (-ENOMEM);
     sdla_read(dev, mem.addr, temp, mem.len);
     if (copy_to_user(mem.data, temp, mem.len)) {
       kfree(temp);
       return -EFAULT;
     }
     kfree(temp);
   } else {
-    temp = kmalloc(mem.len, GFP_KERNEL);
-    if (!temp) return (-ENOMEM);
-    if (copy_from_user(temp, mem.data, mem.len)) {
-      kfree(temp);
-      return -EFAULT;
-    }
+    temp = memdup_user(mem.data, mem.len);
+    if (IS_ERR(temp)) return PTR_ERR(temp);
     sdla_write(dev, mem.addr, temp, mem.len);
     kfree(temp);
   }
   return (0);
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,17 +1,13 @@
 static int dccp_setsockopt_ccid(struct sock *sk, int type, char __user *optval, unsigned int optlen) {
   u8 *val;
   int rc = 0;
   if (optlen < 1 || optlen > DCCP_FEAT_MAX_SP_VALS) return -EINVAL;
-  val = kmalloc(optlen, GFP_KERNEL);
-  if (val == NULL) return -ENOMEM;
-  if (copy_from_user(val, optval, optlen)) {
-    kfree(val);
-    return -EFAULT;
-  }
+  val = memdup_user(optval, optlen);
+  if (IS_ERR(val)) return PTR_ERR(val);
   lock_sock(sk);
   if (type == DCCP_SOCKOPT_TX_CCID || type == DCCP_SOCKOPT_CCID) rc = dccp_feat_register_sp(sk, DCCPF_CCID, 1, val, optlen);
   if (!rc && (type == DCCP_SOCKOPT_RX_CCID || type == DCCP_SOCKOPT_CCID)) rc = dccp_feat_register_sp(sk, DCCPF_CCID, 0, val, optlen);
   release_sock(sk);
   kfree(val);
   return rc;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,58 +1,54 @@
 static int pcbit_writecmd(const u_char __user *buf, int len, int driver, int channel) {
   struct pcbit_dev *dev;
   int i, j;
   const u_char *loadbuf;
   u_char *ptr = NULL;
   u_char *cbuf;
   int errstat;
   dev = finddev(driver);
   if (!dev) {
     printk("pcbit_writecmd: couldn't find device");
     return -ENODEV;
   }
   switch (dev->l2_state) {
   case L2_LWMODE:
     /* check (size <= rdp_size); write buf into board */
     if (len < 0 || len > BANK4 + 1 || len > 1024) {
       printk("pcbit_writecmd: invalid length %d\n", len);
       return -EINVAL;
     }
-    cbuf = kmalloc(len, GFP_KERNEL);
-    if (!cbuf) return -ENOMEM;
-    if (copy_from_user(cbuf, buf, len)) {
-      kfree(cbuf);
-      return -EFAULT;
-    }
+    cbuf = memdup_user(buf, len);
+    if (IS_ERR(cbuf)) return PTR_ERR(cbuf);
     memcpy_toio(dev->sh_mem, cbuf, len);
     kfree(cbuf);
     return len;
   case L2_FWMODE:
     /* this is the hard part */
     /* dumb board */
     /* get it into kernel space */
     if ((ptr = kmalloc(len, GFP_KERNEL)) == NULL) return -ENOMEM;
     if (copy_from_user(ptr, buf, len)) {
       kfree(ptr);
       return -EFAULT;
     }
     loadbuf = ptr;
 
     errstat = 0;
     for (i = 0; i < len; i++) {
       for (j = 0; j < LOAD_RETRY; j++)
         if (!(readb(dev->sh_mem + dev->loadptr))) break;
       if (j == LOAD_RETRY) {
         errstat = -ETIME;
         printk("TIMEOUT i=%d\n", i);
         break;
       }
       writeb(loadbuf[i], dev->sh_mem + dev->loadptr + 1);
       writeb(0x01, dev->sh_mem + dev->loadptr);
       dev->loadptr += 2;
       if (dev->loadptr > LOAD_ZONE_END) dev->loadptr = LOAD_ZONE_START;
     }
     kfree(ptr);
     return errstat ? errstat : len;
   default: return -EBUSY;
   }
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,25 +1,21 @@
 static int get_filter(void __user *arg, struct sock_filter **p) {
   struct sock_fprog uprog;
   struct sock_filter *code = NULL;
   int len, err;
   if (copy_from_user(&uprog, arg, sizeof(uprog))) return -EFAULT;
   if (!uprog.len) {
     *p = NULL;
     return 0;
   }
   /* uprog.len is unsigned short, so no overflow here */
   len = uprog.len * sizeof(struct sock_filter);
-  code = kmalloc(len, GFP_KERNEL);
-  if (code == NULL) return -ENOMEM;
-  if (copy_from_user(code, uprog.filter, len)) {
-    kfree(code);
-    return -EFAULT;
-  }
+  code = memdup_user(uprog.filter, len);
+  if (IS_ERR(code)) return PTR_ERR(code);
   err = sk_chk_filter(code, uprog.len);
   if (err) {
     kfree(code);
     return err;
   }
   *p = code;
   return uprog.len;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,42 +1,37 @@
 static long dabusb_ioctl(struct file *file, unsigned int cmd, unsigned long arg) {
   pdabusb_t s = (pdabusb_t)file->private_data;
   pbulk_transfer_t pbulk;
   int ret = 0;
   int version = DABUSB_VERSION;
   dbg("dabusb_ioctl");
   lock_kernel();
   if (s->remove_pending) {
     unlock_kernel();
     return -EIO;
   }
   mutex_lock(&s->mutex);
   if (!s->usbdev) {
     mutex_unlock(&s->mutex);
     unlock_kernel();
     return -EIO;
   }
   switch (cmd) {
   case IOCTL_DAB_BULK:
-    pbulk = kmalloc(sizeof(bulk_transfer_t), GFP_KERNEL);
-    if (!pbulk) {
-      ret = -ENOMEM;
-      break;
-    }
-    if (copy_from_user(pbulk, (void __user *)arg, sizeof(bulk_transfer_t))) {
-      ret = -EFAULT;
-      kfree(pbulk);
+    pbulk = memdup_user((void __user *)arg, sizeof(bulk_transfer_t));
+    if (IS_ERR(pbulk)) {
+      ret = PTR_ERR(pbulk);
       break;
     }
     ret = dabusb_bulk(s, pbulk);
     if (ret == 0)
       if (copy_to_user((void __user *)arg, pbulk, sizeof(bulk_transfer_t))) ret = -EFAULT;
     kfree(pbulk);
     break;
   case IOCTL_DAB_OVERRUNS: ret = put_user(s->overruns, (unsigned int __user *)arg); break;
   case IOCTL_DAB_VERSION: ret = put_user(version, (unsigned int __user *)arg); break;
   default: ret = -ENOIOCTLCMD; break;
   }
   mutex_unlock(&s->mutex);
   unlock_kernel();
   return ret;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant C;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
        {
-		r = -C;
+		r = PTR_ERR(e1);
-		kfree(e1);
		...
	}
--- initial
+++ final
@@ -1,20 +1,16 @@
 static int dvbdmx_write(struct dmx_demux *demux, const char __user *buf, size_t count) {
   struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
   void *p;
   if ((!demux->frontend) || (demux->frontend->source != DMX_MEMORY_FE)) return -EINVAL;
-  p = kmalloc(count, GFP_USER);
-  if (!p) return -ENOMEM;
-  if (copy_from_user(p, buf, count)) {
-    kfree(p);
-    return -EFAULT;
-  }
+  p = memdup_user(buf, count);
+  if (IS_ERR(p)) return PTR_ERR(p);
   if (mutex_lock_interruptible(&dvbdemux->mutex)) {
     kfree(p);
     return -ERESTARTSYS;
   }
   dvb_dmx_swfilter(dvbdemux, p, count);
   kfree(p);
   mutex_unlock(&dvbdemux->mutex);
   if (signal_pending(current)) return -EINTR;
   return count;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,13 +1,9 @@
 static int ib_ucm_alloc_data(const void **dest, u64 src, u32 len) {
   void *data;
   *dest = NULL;
   if (!len) return 0;
-  data = kmalloc(len, GFP_KERNEL);
-  if (!data) return -ENOMEM;
-  if (copy_from_user(data, (void __user *)(unsigned long)src, len)) {
-    kfree(data);
-    return -EFAULT;
-  }
+  data = memdup_user((void __user *)(unsigned long)src, len);
+  if (IS_ERR(data)) return PTR_ERR(data);
   *dest = data;
   return 0;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,30 +1,26 @@
 static int mtd_do_writeoob(struct file *file, struct mtd_info *mtd, uint64_t start, uint32_t length, void __user *ptr, uint32_t __user *retp) {
   struct mtd_oob_ops ops;
   uint32_t retlen;
   int ret = 0;
   if (!(file->f_mode & FMODE_WRITE)) return -EPERM;
   if (length > 4096) return -EINVAL;
   if (!mtd->write_oob)
     ret = -EOPNOTSUPP;
   else
     ret = access_ok(VERIFY_READ, ptr, length) ? 0 : -EFAULT;
   if (ret) return ret;
   ops.ooblen = length;
   ops.ooboffs = start & (mtd->oobsize - 1);
   ops.datbuf = NULL;
   ops.mode = MTD_OOB_PLACE;
   if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs)) return -EINVAL;
-  ops.oobbuf = kmalloc(length, GFP_KERNEL);
-  if (!ops.oobbuf) return -ENOMEM;
-  if (copy_from_user(ops.oobbuf, ptr, length)) {
-    kfree(ops.oobbuf);
-    return -EFAULT;
-  }
+  ops.oobbuf = memdup_user(ptr, length);
+  if (IS_ERR(ops.oobbuf)) return PTR_ERR(ops.oobbuf);
   start &= ~((uint64_t)mtd->oobsize - 1);
   ret = mtd->write_oob(mtd, start, &ops);
   if (ops.oobretlen > 0xFFFFFFFFU) ret = -EOVERFLOW;
   retlen = ops.oobretlen;
   if (copy_to_user(retp, &retlen, sizeof(length))) ret = -EFAULT;
   kfree(ops.oobbuf);
   return ret;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,54 +1,50 @@
 static int prism54_hostapd(struct net_device *ndev, struct iw_point *p) {
   struct prism2_hostapd_param *param;
   int ret = 0;
   u32 uwrq;
   printk(KERN_DEBUG "prism54_hostapd - len=%d\n", p->length);
   if (p->length < sizeof(struct prism2_hostapd_param) || p->length > PRISM2_HOSTAPD_MAX_BUF_SIZE || !p->pointer) return -EINVAL;
-  param = kmalloc(p->length, GFP_KERNEL);
-  if (param == NULL) return -ENOMEM;
-  if (copy_from_user(param, p->pointer, p->length)) {
-    kfree(param);
-    return -EFAULT;
-  }
+  param = memdup_user(p->pointer, p->length);
+  if (IS_ERR(param)) return PTR_ERR(param);
   switch (param->cmd) {
   case PRISM2_SET_ENCRYPTION:
     printk(KERN_DEBUG "%s: Caught WPA supplicant set encryption request\n", ndev->name);
     ret = prism2_ioctl_set_encryption(ndev, param, p->length);
     break;
   case PRISM2_HOSTAPD_SET_GENERIC_ELEMENT:
     printk(KERN_DEBUG "%s: Caught WPA supplicant set WPA IE request\n", ndev->name);
     ret = prism2_ioctl_set_generic_element(ndev, param, p->length);
     break;
   case PRISM2_HOSTAPD_MLME:
     printk(KERN_DEBUG "%s: Caught WPA supplicant MLME request\n", ndev->name);
     ret = prism2_ioctl_mlme(ndev, param);
     break;
   case PRISM2_HOSTAPD_SCAN_REQ:
     printk(KERN_DEBUG "%s: Caught WPA supplicant scan request\n", ndev->name);
     ret = prism2_ioctl_scan_req(ndev, param);
     break;
   case PRISM54_SET_WPA:
     printk(KERN_DEBUG "%s: Caught WPA supplicant wpa init request\n", ndev->name);
     uwrq = 1;
     ret = prism54_set_wpa(ndev, NULL, &uwrq, NULL);
     break;
   case PRISM54_DROP_UNENCRYPTED: printk(KERN_DEBUG "%s: Caught WPA drop unencrypted request\n", ndev->name);
 #if 0
 	       uwrq = 0x01;
 	       mgt_set(priv, DOT11_OID_EXUNENCRYPTED, &uwrq);
 	       down_write(&priv->mib_sem);
 	       mgt_commit(priv);
 	       up_write(&priv->mib_sem);
 #endif
     /* Not necessary, as set_wpa does it, should we just do it here though? */
     ret = 0;
     break;
   default:
     printk(KERN_DEBUG "%s: Caught a WPA supplicant request that is not supported\n", ndev->name);
     ret = -EOPNOTSUPP;
     break;
   }
   if (ret == 0 && copy_to_user(p->pointer, param, p->length)) ret = -EFAULT;
   kfree(param);
   return ret;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,70 +1,66 @@
 static ssize_t dev_config(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) {
   struct dev_data *dev = fd->private_data;
   ssize_t value = len, length = len;
   unsigned total;
   u32 tag;
   char *kbuf;
   if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) return -EINVAL;
   /* we might need to change message format someday */
   if (copy_from_user(&tag, buf, 4)) return -EFAULT;
   if (tag != 0) return -EINVAL;
   buf += 4;
   length -= 4;
-  kbuf = kmalloc(length, GFP_KERNEL);
-  if (!kbuf) return -ENOMEM;
-  if (copy_from_user(kbuf, buf, length)) {
-    kfree(kbuf);
-    return -EFAULT;
-  }
+  kbuf = memdup_user(buf, length);
+  if (IS_ERR(kbuf)) return PTR_ERR(kbuf);
   spin_lock_irq(&dev->lock);
   value = -EINVAL;
   if (dev->buf) goto fail;
   dev->buf = kbuf;
   /* full or low speed config */
   dev->config = (void *)kbuf;
   total = le16_to_cpu(dev->config->wTotalLength);
   if (!is_valid_config(dev->config) || total >= length) goto fail;
   kbuf += total;
   length -= total;
   /* optional high speed config */
   if (kbuf[1] == USB_DT_CONFIG) {
     dev->hs_config = (void *)kbuf;
     total = le16_to_cpu(dev->hs_config->wTotalLength);
     if (!is_valid_config(dev->hs_config) || total >= length) goto fail;
     kbuf += total;
     length -= total;
   }
   /* could support multiple configs, using another encoding! */
   /* device descriptor (tweaked for paranoia) */
   if (length != USB_DT_DEVICE_SIZE) goto fail;
   dev->dev = (void *)kbuf;
   if (dev->dev->bLength != USB_DT_DEVICE_SIZE || dev->dev->bDescriptorType != USB_DT_DEVICE || dev->dev->bNumConfigurations != 1) goto fail;
   dev->dev->bNumConfigurations = 1;
   dev->dev->bcdUSB = cpu_to_le16(0x0200);
   /* triggers gadgetfs_bind(); then we can enumerate. */
   spin_unlock_irq(&dev->lock);
   value = usb_gadget_register_driver(&gadgetfs_driver);
   if (value != 0) {
     kfree(dev->buf);
     dev->buf = NULL;
   } else {
     /* at this point "good" hardware has for the first time
      * let the USB the host see us.  alternatively, if users
      * unplug/replug that will clear all the error state.
      *
      * note:  everything running before here was guaranteed
      * to choke driver model style diagnostics.  from here
      * on, they can work ... except in cleanup paths that
      * kick in after the ep0 descriptor is closed.
      */
     fd->f_op = &ep0_io_operations;
     value = len;
   }
   return value;
 fail:
   spin_unlock_irq(&dev->lock);
   pr_debug("%s: %s fail %Zd, %p\n", shortname, __func__, value, dev);
   kfree(dev->buf);
   dev->buf = NULL;
   return value;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,30 +1,28 @@
 static ssize_t ep_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) {
   struct ep_data *data = fd->private_data;
   void *kbuf;
   ssize_t value;
   if ((value = get_ready_ep(fd->f_flags, data)) < 0) return value;
   /* halt any endpoint by doing a "wrong direction" i/o call */
   if (!usb_endpoint_dir_in(&data->desc)) {
     if (usb_endpoint_xfer_isoc(&data->desc)) return -EINVAL;
     DBG(data->dev, "%s halt\n", data->name);
     spin_lock_irq(&data->dev->lock);
     if (likely(data->ep != NULL)) usb_ep_set_halt(data->ep);
     spin_unlock_irq(&data->dev->lock);
     mutex_unlock(&data->lock);
     return -EBADMSG;
   }
   /* FIXME writebehind for O_NONBLOCK and poll(), qlen = 1 */
   value = -ENOMEM;
-  kbuf = kmalloc(len, GFP_KERNEL);
-  if (!kbuf) goto free1;
-  if (copy_from_user(kbuf, buf, len)) {
+  kbuf = memdup_user(buf, len);
+  if (IS_ERR(kbuf)) {
     value = -EFAULT;
     goto free1;
   }
   value = ep_io(data, kbuf, len);
   VDEBUG(data->dev, "%s write %zu IN, status %d\n", data->name, len, (int)value);
 free1:
   mutex_unlock(&data->lock);
-  kfree(kbuf);
-  return value;
+  return PTR_ERR(kbuf);
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
        {
		...
-		kfree(e1);
		...
-		return r;
+		return PTR_ERR(e1);
	}
--- initial
+++ final
@@ -1,45 +1,41 @@
 static int con_font_set(struct vc_data *vc, struct console_font_op *op) {
   struct console_font font;
   int rc = -EINVAL;
   int size;
   if (vc->vc_mode != KD_TEXT) return -EINVAL;
   if (!op->data) return -EINVAL;
   if (op->charcount > 512) return -EINVAL;
   if (!op->height) { /* Need to guess font height [compat] */
     int h, i;
     u8 __user *charmap = op->data;
     u8 tmp;
 
     /* If from KDFONTOP ioctl, don't allow things which can be done in userland,
        so that we can get rid of this soon */
     if (!(op->flags & KD_FONT_FLAG_OLD)) return -EINVAL;
     for (h = 32; h > 0; h--)
       for (i = 0; i < op->charcount; i++) {
         if (get_user(tmp, &charmap[32 * i + h - 1])) return -EFAULT;
         if (tmp) goto nonzero;
       }
     return -EINVAL;
   nonzero:
     op->height = h;
   }
   if (op->width <= 0 || op->width > 32 || op->height > 32) return -EINVAL;
   size = (op->width + 7) / 8 * 32 * op->charcount;
   if (size > max_font_size) return -ENOSPC;
   font.charcount = op->charcount;
   font.height = op->height;
   font.width = op->width;
-  font.data = kmalloc(size, GFP_KERNEL);
-  if (!font.data) return -ENOMEM;
-  if (copy_from_user(font.data, op->data, size)) {
-    kfree(font.data);
-    return -EFAULT;
-  }
+  font.data = memdup_user(op->data, size);
+  if (IS_ERR(font.data)) return PTR_ERR(font.data);
   acquire_console_sem();
   if (vc->vc_sw->con_font_set)
     rc = vc->vc_sw->con_font_set(vc, &font, op->flags);
   else
     rc = -ENOSYS;
   release_console_sem();
   kfree(font.data);
   return rc;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,46 +1,42 @@
 static int i2o_cfg_parms(unsigned long arg, unsigned int type) {
   int ret = 0;
   struct i2o_controller *c;
   struct i2o_device *dev;
   struct i2o_cmd_psetget __user *cmd = (struct i2o_cmd_psetget __user *)arg;
   struct i2o_cmd_psetget kcmd;
   u32 reslen;
   u8 *ops;
   u8 *res;
   int len = 0;
   u32 i2o_cmd = (type == I2OPARMGET ? I2O_CMD_UTIL_PARAMS_GET : I2O_CMD_UTIL_PARAMS_SET);
   if (copy_from_user(&kcmd, cmd, sizeof(struct i2o_cmd_psetget))) return -EFAULT;
   if (get_user(reslen, kcmd.reslen)) return -EFAULT;
   c = i2o_find_iop(kcmd.iop);
   if (!c) return -ENXIO;
   dev = i2o_iop_find_device(c, kcmd.tid);
   if (!dev) return -ENXIO;
-  ops = kmalloc(kcmd.oplen, GFP_KERNEL);
-  if (!ops) return -ENOMEM;
-  if (copy_from_user(ops, kcmd.opbuf, kcmd.oplen)) {
-    kfree(ops);
-    return -EFAULT;
-  }
+  ops = memdup_user(kcmd.opbuf, kcmd.oplen);
+  if (IS_ERR(ops)) return PTR_ERR(ops);
   /*
    * It's possible to have a _very_ large table
    * and that the user asks for all of it at once...
    */
   res = kmalloc(65536, GFP_KERNEL);
   if (!res) {
     kfree(ops);
     return -ENOMEM;
   }
   len = i2o_parm_issue(dev, i2o_cmd, ops, kcmd.oplen, res, 65536);
   kfree(ops);
   if (len < 0) {
     kfree(res);
     return -EAGAIN;
   }
   put_user(len, kcmd.reslen);
   if (len > reslen)
     ret = -ENOBUFS;
   else if (copy_to_user(kcmd.resbuf, res, len))
     ret = -EFAULT;
   kfree(res);
   return ret;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}
--- initial
+++ final
@@ -1,12 +1,8 @@
 static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in) {
   struct autofs_dev_ioctl tmp, *ads;
   if (copy_from_user(&tmp, in, sizeof(tmp))) return ERR_PTR(-EFAULT);
   if (tmp.size < sizeof(tmp)) return ERR_PTR(-EINVAL);
-  ads = kmalloc(tmp.size, GFP_KERNEL);
-  if (!ads) return ERR_PTR(-ENOMEM);
-  if (copy_from_user(ads, in, tmp.size)) {
-    kfree(ads);
-    return ERR_PTR(-EFAULT);
-  }
+  ads = memdup_user(in, tmp.size);
+  if (IS_ERR(ads)) return PTR_ERR(ads);
   return ads;
 }<sep>@@
expression e1,e2,e3,r;
statement S;
constant GFP_KERNEL;
@@

-	e1 = kmalloc(e3, GFP_KERNEL);
-	if (e1 == NULL)
-		S

-	if (copy_from_user(e1, e2, e3))
+	e1 = memdup_user(e2, e3);
+	if (IS_ERR(e1))
-       {
-		kfree(e1);
-		return r;
+		return PTR_ERR(e1);
-	}