211 	void *buff, size_t size, u16 page_code, unsigned char *scsi3addr,
4886 	char *buff = NULL;  in hpsa_passthru_ioctl()  local
4901 		buff = kmalloc(iocommand.buf_size, GFP_KERNEL);  in hpsa_passthru_ioctl()
4902 		if (buff == NULL)  in hpsa_passthru_ioctl()
4906 			if (copy_from_user(buff, iocommand.buf,  in hpsa_passthru_ioctl()
4912 			memset(buff, 0, iocommand.buf_size);  in hpsa_passthru_ioctl()
4939 		temp64 = pci_map_single(h->pdev, buff,  in hpsa_passthru_ioctl()
4966 		if (copy_to_user(iocommand.buf, buff, iocommand.buf_size)) {  in hpsa_passthru_ioctl()
4974 	kfree(buff);  in hpsa_passthru_ioctl()
4982 	unsigned char **buff = NULL;  in hpsa_big_passthru_ioctl()  local
5019 	buff = kzalloc(SG_ENTRIES_IN_CMD * sizeof(char *), GFP_KERNEL);  in hpsa_big_passthru_ioctl()
5020 	if (!buff) {  in hpsa_big_passthru_ioctl()
5034 		buff[sg_used] = kmalloc(sz, GFP_KERNEL);  in hpsa_big_passthru_ioctl()
5035 		if (buff[sg_used] == NULL) {  in hpsa_big_passthru_ioctl()
5040 			if (copy_from_user(buff[sg_used], data_ptr, sz)) {  in hpsa_big_passthru_ioctl()
5045 			memset(buff[sg_used], 0, sz);  in hpsa_big_passthru_ioctl()
5064 			temp64 = pci_map_single(h->pdev, buff[i],  in hpsa_big_passthru_ioctl()
5097 			if (copy_to_user(ptr, buff[i], buff_size[i])) {  in hpsa_big_passthru_ioctl()
5108 	if (buff) {  in hpsa_big_passthru_ioctl()
5112 			kfree(buff[i]);  in hpsa_big_passthru_ioctl()
5113 		kfree(buff);  in hpsa_big_passthru_ioctl()
5188 	void *buff, size_t size, u16 page_code, unsigned char *scsi3addr,  in fill_cmd()  argument
5196 	if (buff != NULL && size > 0) {  in fill_cmd()
5308 			a = buff;       /* point to command to be aborted */  in fill_cmd()
5352 	if (hpsa_map_one(h->pdev, c, buff, size, pci_dir))  in fill_cmd()