237 		unsigned nmsgs, struct i2c_msg *msgs)  in i2cdev_ioctl_rdwr()  argument
244 		kfree(msgs);  in i2cdev_ioctl_rdwr()
251 		if (msgs[i].len > 8192) {  in i2cdev_ioctl_rdwr()
256 		data_ptrs[i] = (u8 __user *)msgs[i].buf;  in i2cdev_ioctl_rdwr()
257 		msgs[i].buf = memdup_user(data_ptrs[i], msgs[i].len);  in i2cdev_ioctl_rdwr()
258 		if (IS_ERR(msgs[i].buf)) {  in i2cdev_ioctl_rdwr()
259 			res = PTR_ERR(msgs[i].buf);  in i2cdev_ioctl_rdwr()
263 		msgs[i].flags |= I2C_M_DMA_SAFE;  in i2cdev_ioctl_rdwr()
276 		if (msgs[i].flags & I2C_M_RECV_LEN) {  in i2cdev_ioctl_rdwr()
277 			if (!(msgs[i].flags & I2C_M_RD) ||  in i2cdev_ioctl_rdwr()
278 			    msgs[i].len < 1 || msgs[i].buf[0] < 1 ||  in i2cdev_ioctl_rdwr()
279 			    msgs[i].len < msgs[i].buf[0] +  in i2cdev_ioctl_rdwr()
286 			msgs[i].len = msgs[i].buf[0];  in i2cdev_ioctl_rdwr()
292 			kfree(msgs[j].buf);  in i2cdev_ioctl_rdwr()
294 		kfree(msgs);  in i2cdev_ioctl_rdwr()
298 	res = i2c_transfer(client->adapter, msgs, nmsgs);  in i2cdev_ioctl_rdwr()
300 		if (res >= 0 && (msgs[i].flags & I2C_M_RD)) {  in i2cdev_ioctl_rdwr()
301 			if (copy_to_user(data_ptrs[i], msgs[i].buf,  in i2cdev_ioctl_rdwr()
302 					 msgs[i].len))  in i2cdev_ioctl_rdwr()
305 		kfree(msgs[i].buf);  in i2cdev_ioctl_rdwr()
308 	kfree(msgs);  in i2cdev_ioctl_rdwr()
444 		if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0)  in i2cdev_ioctl()
454 		rdwr_pa = memdup_user(rdwr_arg.msgs,  in i2cdev_ioctl()
516 	compat_caddr_t msgs; /* struct i2c_msg __user *msgs */  member
539 		if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0)  in compat_i2cdev_ioctl()
550 		p = compat_ptr(rdwr_arg.msgs);  in compat_i2cdev_ioctl()