imamnurby/smpl_train_seed8 huggingface dataset:
--- initial
+++ final
@@ -1,83 +1,82 @@
 struct ieee80211_hw *wl1271_alloc_hw(void) {
   struct ieee80211_hw *hw;
   struct platform_device *plat_dev = NULL;
   struct wl1271 *wl;
   int i, ret;
   hw = ieee80211_alloc_hw(sizeof(*wl), &wl1271_ops);
   if (!hw) {
     wl1271_error("could not alloc ieee80211_hw");
     ret = -ENOMEM;
     goto err_hw_alloc;
   }
-  plat_dev = kmalloc(sizeof(wl1271_device), GFP_KERNEL);
+  plat_dev = kmemdup(&wl1271_device, sizeof(wl1271_device), GFP_KERNEL);
   if (!plat_dev) {
     wl1271_error("could not allocate platform_device");
     ret = -ENOMEM;
     goto err_plat_alloc;
   }
-  memcpy(plat_dev, &wl1271_device, sizeof(wl1271_device));
   wl = hw->priv;
   memset(wl, 0, sizeof(*wl));
   INIT_LIST_HEAD(&wl->list);
   wl->hw = hw;
   wl->plat_dev = plat_dev;
   skb_queue_head_init(&wl->tx_queue);
   INIT_DELAYED_WORK(&wl->elp_work, wl1271_elp_work);
   INIT_DELAYED_WORK(&wl->pspoll_work, wl1271_pspoll_work);
   wl->channel = WL1271_DEFAULT_CHANNEL;
   wl->beacon_int = WL1271_DEFAULT_BEACON_INT;
   wl->default_key = 0;
   wl->rx_counter = 0;
   wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
   wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
   wl->psm_entry_retry = 0;
   wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
   wl->basic_rate_set = CONF_TX_RATE_MASK_BASIC;
   wl->basic_rate = CONF_TX_RATE_MASK_BASIC;
   wl->rate_set = CONF_TX_RATE_MASK_BASIC;
   wl->sta_rate_set = 0;
   wl->band = IEEE80211_BAND_2GHZ;
   wl->vif = NULL;
   wl->flags = 0;
   wl->sg_enabled = true;
   wl->hw_pg_ver = -1;
   for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
     wl->tx_frames[i] = NULL;
   spin_lock_init(&wl->wl_lock);
   wl->state = WL1271_STATE_OFF;
   mutex_init(&wl->mutex);
   /* Apply default driver configuration. */
   wl1271_conf_init(wl);
   wl1271_debugfs_init(wl);
   /* Register platform device */
   ret = platform_device_register(wl->plat_dev);
   if (ret) {
     wl1271_error("couldn't register platform device");
     goto err_hw;
   }
   dev_set_drvdata(&wl->plat_dev->dev, wl);
   /* Create sysfs file to control bt coex state */
   ret = device_create_file(&wl->plat_dev->dev, &dev_attr_bt_coex_state);
   if (ret < 0) {
     wl1271_error("failed to create sysfs file bt_coex_state");
     goto err_platform;
   }
   /* Create sysfs file to get HW PG version */
   ret = device_create_file(&wl->plat_dev->dev, &dev_attr_hw_pg_ver);
   if (ret < 0) {
     wl1271_error("failed to create sysfs file hw_pg_ver");
     goto err_bt_coex_state;
   }
   return hw;
 err_bt_coex_state:
   device_remove_file(&wl->plat_dev->dev, &dev_attr_bt_coex_state);
 err_platform:
   platform_device_unregister(wl->plat_dev);
 err_hw:
   wl1271_debugfs_exit(wl);
   kfree(plat_dev);
 err_plat_alloc:
   ieee80211_free_hw(hw);
 err_hw_alloc:
   return ERR_PTR(ret);
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,17 +1,16 @@
 static struct iwm_rx_ticket_node *iwm_rx_ticket_node_alloc(struct iwm_priv *iwm, struct iwm_rx_ticket *ticket) {
   struct iwm_rx_ticket_node *ticket_node;
   ticket_node = kzalloc(sizeof(struct iwm_rx_ticket_node), GFP_KERNEL);
   if (!ticket_node) {
     IWM_ERR(iwm, "Couldn't allocate ticket node\n");
     return ERR_PTR(-ENOMEM);
   }
-  ticket_node->ticket = kzalloc(sizeof(struct iwm_rx_ticket), GFP_KERNEL);
+  ticket_node->ticket = kmemdup(ticket, sizeof(struct iwm_rx_ticket), GFP_KERNEL);
   if (!ticket_node->ticket) {
     IWM_ERR(iwm, "Couldn't allocate RX ticket\n");
     kfree(ticket_node);
     return ERR_PTR(-ENOMEM);
   }
-  memcpy(ticket_node->ticket, ticket, sizeof(struct iwm_rx_ticket));
   INIT_LIST_HEAD(&ticket_node->node);
   return ticket_node;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,11 +1,10 @@
 static void ath9k_hif_usb_reboot(struct usb_device *udev) {
   u32 reboot_cmd = 0xffffffff;
   void *buf;
   int ret;
-  buf = kmalloc(4, GFP_KERNEL);
+  buf = kmemdup(&reboot_cmd, 4, GFP_KERNEL);
   if (!buf) return;
-  memcpy(buf, &reboot_cmd, 4);
   ret = usb_bulk_msg(udev, usb_sndbulkpipe(udev, USB_REG_OUT_PIPE), buf, 4, NULL, HZ);
   if (ret) dev_err(&udev->dev, "ath9k_htc: USB reboot failed\n");
   kfree(buf);
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,64 +1,62 @@
 int nouveau_grctx_prog_load(struct drm_device *dev) {
   struct drm_nouveau_private *dev_priv = dev->dev_private;
   struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
   const int chipset = dev_priv->chipset;
   const struct firmware *fw;
   const struct nouveau_ctxprog *cp;
   const struct nouveau_ctxvals *cv;
   char name[32];
   int ret, i;
   if (pgraph->accel_blocked) return -ENODEV;
   if (!pgraph->ctxprog) {
     sprintf(name, "nouveau/nv%02x.ctxprog", chipset);
     ret = request_firmware(&fw, name, &dev->pdev->dev);
     if (ret) {
       NV_ERROR(dev, "No ctxprog for NV%02x\n", chipset);
       return ret;
     }
-    pgraph->ctxprog = kmalloc(fw->size, GFP_KERNEL);
+    pgraph->ctxprog = kmemdup(fw->data, fw->size, GFP_KERNEL);
     if (!pgraph->ctxprog) {
       NV_ERROR(dev, "OOM copying ctxprog\n");
       release_firmware(fw);
       return -ENOMEM;
     }
-    memcpy(pgraph->ctxprog, fw->data, fw->size);
     cp = pgraph->ctxprog;
     if (le32_to_cpu(cp->signature) != 0x5043564e || cp->version != 0 || le16_to_cpu(cp->length) != ((fw->size - 7) / 4)) {
       NV_ERROR(dev, "ctxprog invalid\n");
       release_firmware(fw);
       nouveau_grctx_fini(dev);
       return -EINVAL;
     }
     release_firmware(fw);
   }
   if (!pgraph->ctxvals) {
     sprintf(name, "nouveau/nv%02x.ctxvals", chipset);
     ret = request_firmware(&fw, name, &dev->pdev->dev);
     if (ret) {
       NV_ERROR(dev, "No ctxvals for NV%02x\n", chipset);
       nouveau_grctx_fini(dev);
       return ret;
     }
-    pgraph->ctxvals = kmalloc(fw->size, GFP_KERNEL);
+    pgraph->ctxvals = kmemdup(fw->data, fw->size, GFP_KERNEL);
     if (!pgraph->ctxvals) {
       NV_ERROR(dev, "OOM copying ctxvals\n");
       release_firmware(fw);
       nouveau_grctx_fini(dev);
       return -ENOMEM;
     }
-    memcpy(pgraph->ctxvals, fw->data, fw->size);
     cv = (void *)pgraph->ctxvals;
     if (le32_to_cpu(cv->signature) != 0x5643564e || cv->version != 0 || le32_to_cpu(cv->length) != ((fw->size - 9) / 8)) {
       NV_ERROR(dev, "ctxvals invalid\n");
       release_firmware(fw);
       nouveau_grctx_fini(dev);
       return -EINVAL;
     }
     release_firmware(fw);
   }
   cp = pgraph->ctxprog;
   nv_wr32(dev, NV40_PGRAPH_CTXCTL_UCODE_INDEX, 0);
   for (i = 0; i < le16_to_cpu(cp->length); i++)
     nv_wr32(dev, NV40_PGRAPH_CTXCTL_UCODE_DATA, le32_to_cpu(cp->data[i]));
   return 0;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,20 +1,19 @@
 static bool radeon_read_bios(struct radeon_device *rdev) {
   uint8_t __iomem *bios;
   size_t size;
   rdev->bios = NULL;
   /* XXX: some cards may return 0 for rom size? ddx has a workaround */
   bios = pci_map_rom(rdev->pdev, &size);
   if (!bios) { return false; }
   if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
     pci_unmap_rom(rdev->pdev, bios);
     return false;
   }
-  rdev->bios = kmalloc(size, GFP_KERNEL);
+  rdev->bios = kmemdup(bios, size, GFP_KERNEL);
   if (rdev->bios == NULL) {
     pci_unmap_rom(rdev->pdev, bios);
     return false;
   }
-  memcpy(rdev->bios, bios, size);
   pci_unmap_rom(rdev->pdev, bios);
   return true;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,65 +1,64 @@
 static int bcm203x_probe(struct usb_interface *intf, const struct usb_device_id *id) {
   const struct firmware *firmware;
   struct usb_device *udev = interface_to_usbdev(intf);
   struct bcm203x_data *data;
   int size;
   BT_DBG("intf %p id %p", intf, id);
   if (intf->cur_altsetting->desc.bInterfaceNumber != 0) return -ENODEV;
   data = kzalloc(sizeof(*data), GFP_KERNEL);
   if (!data) {
     BT_ERR("Can't allocate memory for data structure");
     return -ENOMEM;
   }
   data->udev = udev;
   data->state = BCM203X_LOAD_MINIDRV;
   data->urb = usb_alloc_urb(0, GFP_KERNEL);
   if (!data->urb) {
     BT_ERR("Can't allocate URB");
     kfree(data);
     return -ENOMEM;
   }
   if (request_firmware(&firmware, "BCM2033-MD.hex", &udev->dev) < 0) {
     BT_ERR("Mini driver request failed");
     usb_free_urb(data->urb);
     kfree(data);
     return -EIO;
   }
   BT_DBG("minidrv data %p size %zu", firmware->data, firmware->size);
   size = max_t(uint, firmware->size, 4096);
   data->buffer = kmalloc(size, GFP_KERNEL);
   if (!data->buffer) {
     BT_ERR("Can't allocate memory for mini driver");
     release_firmware(firmware);
     usb_free_urb(data->urb);
     kfree(data);
     return -ENOMEM;
   }
   memcpy(data->buffer, firmware->data, firmware->size);
   usb_fill_bulk_urb(data->urb, udev, usb_sndbulkpipe(udev, BCM203X_OUT_EP), data->buffer, firmware->size, bcm203x_complete, data);
   release_firmware(firmware);
   if (request_firmware(&firmware, "BCM2033-FW.bin", &udev->dev) < 0) {
     BT_ERR("Firmware request failed");
     usb_free_urb(data->urb);
     kfree(data->buffer);
     kfree(data);
     return -EIO;
   }
   BT_DBG("firmware data %p size %zu", firmware->data, firmware->size);
-  data->fw_data = kmalloc(firmware->size, GFP_KERNEL);
+  data->fw_data = kmemdup(firmware->data, firmware->size, GFP_KERNEL);
   if (!data->fw_data) {
     BT_ERR("Can't allocate memory for firmware image");
     release_firmware(firmware);
     usb_free_urb(data->urb);
     kfree(data->buffer);
     kfree(data);
     return -ENOMEM;
   }
-  memcpy(data->fw_data, firmware->data, firmware->size);
   data->fw_size = firmware->size;
   data->fw_sent = 0;
   release_firmware(firmware);
   INIT_WORK(&data->work, bcm203x_work);
   usb_set_intfdata(intf, data);
   schedule_work(&data->work);
   return 0;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,47 +1,46 @@
 int hid_parse_report(struct hid_device *device, __u8 *start, unsigned size) {
   struct hid_parser *parser;
   struct hid_item item;
   __u8 *end;
   int ret;
   static int (*dispatch_type[])(struct hid_parser * parser, struct hid_item * item) = {hid_parser_main, hid_parser_global, hid_parser_local, hid_parser_reserved};
   if (device->driver->report_fixup) device->driver->report_fixup(device, start, size);
-  device->rdesc = kmalloc(size, GFP_KERNEL);
+  device->rdesc = kmemdup(start, size, GFP_KERNEL);
   if (device->rdesc == NULL) return -ENOMEM;
-  memcpy(device->rdesc, start, size);
   device->rsize = size;
   parser = vmalloc(sizeof(struct hid_parser));
   if (!parser) {
     ret = -ENOMEM;
     goto err;
   }
   memset(parser, 0, sizeof(struct hid_parser));
   parser->device = device;
   end = start + size;
   ret = -EINVAL;
   while ((start = fetch_item(start, end, &item)) != NULL) {
     if (item.format != HID_ITEM_FORMAT_SHORT) {
       dbg_hid("unexpected long global item\n");
       goto err;
     }
     if (dispatch_type[item.type](parser, &item)) {
       dbg_hid("item %u %u %u %u parsing failed\n", item.format, (unsigned)item.size, (unsigned)item.type, (unsigned)item.tag);
       goto err;
     }
     if (start == end) {
       if (parser->collection_stack_ptr) {
         dbg_hid("unbalanced collection at end of report description\n");
         goto err;
       }
       if (parser->local.delimiter_depth) {
         dbg_hid("unbalanced delimiter at end of report description\n");
         goto err;
       }
       vfree(parser);
       return 0;
     }
   }
   dbg_hid("item fetching failed at offset %d\n", (int)(end - start));
 err:
   vfree(parser);
   return ret;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,25 +1,24 @@
 static int ipw_wx_set_genie(struct net_device *dev, struct iw_request_info *info, union iwreq_data *wrqu, char *extra) {
   struct ipw_priv *priv = libipw_priv(dev);
   struct libipw_device *ieee = priv->ieee;
   u8 *buf;
   int err = 0;
   if (wrqu->data.length > MAX_WPA_IE_LEN || (wrqu->data.length && extra == NULL)) return -EINVAL;
   if (wrqu->data.length) {
-    buf = kmalloc(wrqu->data.length, GFP_KERNEL);
+    buf = kmemdup(extra, wrqu->data.length, GFP_KERNEL);
     if (buf == NULL) {
       err = -ENOMEM;
       goto out;
     }
-    memcpy(buf, extra, wrqu->data.length);
     kfree(ieee->wpa_ie);
     ieee->wpa_ie = buf;
     ieee->wpa_ie_len = wrqu->data.length;
   } else {
     kfree(ieee->wpa_ie);
     ieee->wpa_ie = NULL;
     ieee->wpa_ie_len = 0;
   }
   ipw_wpa_assoc_frame(priv, ieee->wpa_ie, ieee->wpa_ie_len);
 out:
   return err;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,41 +1,39 @@
 int pohmelfs_copy_crypto(struct pohmelfs_sb *psb) {
   struct pohmelfs_config_group *g;
   int err = -ENOENT;
   mutex_lock(&pohmelfs_config_lock);
   g = pohmelfs_find_config_group(psb->idx);
   if (!g) goto err_out_exit;
   if (g->hash_string) {
     err = -ENOMEM;
     psb->hash_string = kstrdup(g->hash_string, GFP_KERNEL);
     if (!psb->hash_string) goto err_out_exit;
     psb->hash_strlen = g->hash_strlen;
   }
   if (g->cipher_string) {
     psb->cipher_string = kstrdup(g->cipher_string, GFP_KERNEL);
     if (!psb->cipher_string) goto err_out_free_hash_string;
     psb->cipher_strlen = g->cipher_strlen;
   }
   if (g->hash_keysize) {
-    psb->hash_key = kmalloc(g->hash_keysize, GFP_KERNEL);
+    psb->hash_key = kmemdup(g->hash_key, g->hash_keysize, GFP_KERNEL);
     if (!psb->hash_key) goto err_out_free_cipher_string;
-    memcpy(psb->hash_key, g->hash_key, g->hash_keysize);
     psb->hash_keysize = g->hash_keysize;
   }
   if (g->cipher_keysize) {
-    psb->cipher_key = kmalloc(g->cipher_keysize, GFP_KERNEL);
+    psb->cipher_key = kmemdup(g->cipher_key, g->cipher_keysize, GFP_KERNEL);
     if (!psb->cipher_key) goto err_out_free_hash;
-    memcpy(psb->cipher_key, g->cipher_key, g->cipher_keysize);
     psb->cipher_keysize = g->cipher_keysize;
   }
   mutex_unlock(&pohmelfs_config_lock);
   return 0;
 err_out_free_hash:
   kfree(psb->hash_key);
 err_out_free_cipher_string:
   kfree(psb->cipher_string);
 err_out_free_hash_string:
   kfree(psb->hash_string);
 err_out_exit:
   mutex_unlock(&pohmelfs_config_lock);
   return err;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,16 +1,15 @@
 static int pohmelfs_crypto_cipher_init(struct pohmelfs_config_group *g, struct pohmelfs_crypto *c) {
   char *algo = (char *)c->data;
   u8 *key = (u8 *)(algo + c->strlen);
   if (g->cipher_string) return -EEXIST;
   g->cipher_string = kstrdup(algo, GFP_KERNEL);
   if (!g->cipher_string) return -ENOMEM;
   g->cipher_strlen = c->strlen;
   g->cipher_keysize = c->keysize;
-  g->cipher_key = kmalloc(c->keysize, GFP_KERNEL);
+  g->cipher_key = kmemdup(key, c->keysize, GFP_KERNEL);
   if (!g->cipher_key) {
     kfree(g->cipher_string);
     return -ENOMEM;
   }
-  memcpy(g->cipher_key, key, c->keysize);
   return 0;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,16 +1,15 @@
 static int pohmelfs_crypto_hash_init(struct pohmelfs_config_group *g, struct pohmelfs_crypto *c) {
   char *algo = (char *)c->data;
   u8 *key = (u8 *)(algo + c->strlen);
   if (g->hash_string) return -EEXIST;
   g->hash_string = kstrdup(algo, GFP_KERNEL);
   if (!g->hash_string) return -ENOMEM;
   g->hash_strlen = c->strlen;
   g->hash_keysize = c->keysize;
-  g->hash_key = kmalloc(c->keysize, GFP_KERNEL);
+  g->hash_key = kmemdup(key, c->keysize, GFP_KERNEL);
   if (!g->hash_key) {
     kfree(g->hash_string);
     return -ENOMEM;
   }
-  memcpy(g->hash_key, key, c->keysize);
   return 0;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,7 +1,6 @@
 int line6_dumpreq_initbuf(struct line6_dump_request *l6dr, const void *buf, size_t len, int num) {
-  l6dr->reqbufs[num].buffer = kmalloc(len, GFP_KERNEL);
+  l6dr->reqbufs[num].buffer = kmemdup(buf, len, GFP_KERNEL);
   if (l6dr->reqbufs[num].buffer == NULL) return -ENOMEM;
-  memcpy(l6dr->reqbufs[num].buffer, buf, len);
   l6dr->reqbufs[num].length = len;
   return 0;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,18 +1,17 @@
 static int ieee80211_wpa_set_wpa_ie(struct ieee80211_device *ieee, struct ieee_param *param, int plen) {
   u8 *buf;
   if (param->u.wpa_ie.len > MAX_WPA_IE_LEN || (param->u.wpa_ie.len && param->u.wpa_ie.data == NULL)) return -EINVAL;
   if (param->u.wpa_ie.len) {
-    buf = kmalloc(param->u.wpa_ie.len, GFP_KERNEL);
+    buf = kmemdup(param->u.wpa_ie.data, param->u.wpa_ie.len, GFP_KERNEL);
     if (buf == NULL) return -ENOMEM;
-    memcpy(buf, param->u.wpa_ie.data, param->u.wpa_ie.len);
     kfree(ieee->wpa_ie);
     ieee->wpa_ie = buf;
     ieee->wpa_ie_len = param->u.wpa_ie.len;
   } else {
     kfree(ieee->wpa_ie);
     ieee->wpa_ie = NULL;
     ieee->wpa_ie_len = 0;
   }
   ieee80211_wpa_assoc_frame(ieee, ieee->wpa_ie, ieee->wpa_ie_len);
   return 0;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,24 +1,23 @@
 int ieee80211_wx_set_gen_ie(struct ieee80211_device *ieee, u8 *ie, size_t len) {
   u8 *buf;
   if (len > MAX_WPA_IE_LEN || (len && ie == NULL)) {
     //	printk("return error out, len:%d\n", len);
     return -EINVAL;
   }
   if (len) {
     if (len != ie[1] + 2) {
       printk("len: %Zd, ie:%d\n", len, ie[1]);
       return -EINVAL;
     }
-    buf = kmalloc(len, GFP_KERNEL);
+    buf = kmemdup(ie, len, GFP_KERNEL);
     if (buf == NULL) return -ENOMEM;
-    memcpy(buf, ie, len);
     kfree(ieee->wpa_ie);
     ieee->wpa_ie = buf;
     ieee->wpa_ie_len = len;
   } else {
     if (ieee->wpa_ie) kfree(ieee->wpa_ie);
     ieee->wpa_ie = NULL;
     ieee->wpa_ie_len = 0;
   }
   return 0;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,20 +1,19 @@
 static inline u16 auth_parse(struct sk_buff *skb, u8 **challenge, int *chlen) {
   struct ieee80211_authentication *a;
   u8 *t;
   if (skb->len < (sizeof(struct ieee80211_authentication) - sizeof(struct ieee80211_info_element))) {
     IEEE80211_DEBUG_MGMT("invalid len in auth resp: %d\n", skb->len);
     return 0xcafe;
   }
   *challenge = NULL;
   a = (struct ieee80211_authentication *)skb->data;
   if (skb->len > (sizeof(struct ieee80211_authentication) + 3)) {
     t = skb->data + sizeof(struct ieee80211_authentication);
     if (*(t++) == MFIE_TYPE_CHALLENGE) {
       *chlen = *(t++);
-      *challenge = kmalloc(*chlen, GFP_ATOMIC);
+      *challenge = kmemdup(t, *chlen, GFP_ATOMIC);
       if (!*challenge) return -ENOMEM;
-      memcpy(*challenge, t, *chlen);
     }
   }
   return cpu_to_le16(a->status);
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,24 +1,23 @@
 int ieee80211_wx_set_gen_ie(struct ieee80211_device *ieee, u8 *ie, size_t len) {
   u8 *buf;
   if (len > MAX_WPA_IE_LEN || (len && ie == NULL)) {
     //	printk("return error out, len:%d\n", len);
     return -EINVAL;
   }
   if (len) {
     if (len != ie[1] + 2) {
       printk("len:%zu, ie:%d\n", len, ie[1]);
       return -EINVAL;
     }
-    buf = kmalloc(len, GFP_KERNEL);
+    buf = kmemdup(ie, len, GFP_KERNEL);
     if (buf == NULL) return -ENOMEM;
-    memcpy(buf, ie, len);
     kfree(ieee->wpa_ie);
     ieee->wpa_ie = buf;
     ieee->wpa_ie_len = len;
   } else {
     if (ieee->wpa_ie) kfree(ieee->wpa_ie);
     ieee->wpa_ie = NULL;
     ieee->wpa_ie_len = 0;
   }
   return 0;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);
--- initial
+++ final
@@ -1,65 +1,64 @@
 int pod_init(struct usb_interface *interface, struct usb_line6_pod *pod) {
   int err;
   struct usb_line6 *line6 = &pod->line6;
   if ((interface == NULL) || (pod == NULL)) return -ENODEV;
   pod->channel_num = 255;
   /* initialize wait queues: */
   init_waitqueue_head(&pod->monitor_level.wait);
   init_waitqueue_head(&pod->routing.wait);
   init_waitqueue_head(&pod->tuner_mute.wait);
   init_waitqueue_head(&pod->tuner_freq.wait);
   init_waitqueue_head(&pod->tuner_note.wait);
   init_waitqueue_head(&pod->tuner_pitch.wait);
   init_waitqueue_head(&pod->clipping.wait);
   memset(pod->param_dirty, 0xff, sizeof(pod->param_dirty));
   /* initialize USB buffers: */
   err = line6_dumpreq_init(&pod->dumpreq, pod_request_channel, sizeof(pod_request_channel));
   if (err < 0) {
     dev_err(&interface->dev, "Out of memory\n");
     pod_destruct(interface);
     return -ENOMEM;
   }
-  pod->buffer_versionreq = kmalloc(sizeof(pod_request_version), GFP_KERNEL);
+  pod->buffer_versionreq = kmemdup(pod_request_version, sizeof(pod_request_version), GFP_KERNEL);
   if (pod->buffer_versionreq == NULL) {
     dev_err(&interface->dev, "Out of memory\n");
     pod_destruct(interface);
     return -ENOMEM;
   }
-  memcpy(pod->buffer_versionreq, pod_request_version, sizeof(pod_request_version));
   /* create sysfs entries: */
   err = pod_create_files2(&interface->dev);
   if (err < 0) {
     pod_destruct(interface);
     return err;
   }
   /* initialize audio system: */
   err = line6_init_audio(line6);
   if (err < 0) {
     pod_destruct(interface);
     return err;
   }
   /* initialize MIDI subsystem: */
   err = line6_init_midi(line6);
   if (err < 0) {
     pod_destruct(interface);
     return err;
   }
   /* initialize PCM subsystem: */
   err = line6_init_pcm(line6, &pod_pcm_properties);
   if (err < 0) {
     pod_destruct(interface);
     return err;
   }
   /* register audio system: */
   err = line6_register_audio(line6);
   if (err < 0) {
     pod_destruct(interface);
     return err;
   }
   if (pod->line6.properties->capabilities & LINE6_BIT_CONTROL) {
     /* query some data: */
     line6_startup_delayed(&pod->dumpreq, POD_STARTUP_DELAY, pod_startup_timeout, pod);
     line6_read_serial_number(&pod->line6, &pod->serial_number);
   }
   return 0;
 }<sep>@@
expression from,to,size,flag;
statement S;
@@
    
-  to = \(kmalloc\|kzalloc\)(size,flag);
+  to = kmemdup(from,size,flag);
       if (to==NULL || ...) S
-  memcpy(to, from, size);