Q: Given the following code slice:
```
1 static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)
2 {
3 	long rval = -EINVAL;
4 	struct mpi3mr_ioc *mrioc = NULL;
5 	u8 *mpi_req = NULL, *sense_buff_k = NULL;
6 	u8 mpi_msg_size = 0;
7 	struct mpi3mr_bsg_packet *bsg_req = NULL;
8 	struct mpi3mr_bsg_mptcmd *karg;
9 	struct mpi3mr_buf_entry *buf_entries = NULL;
10 	struct mpi3mr_buf_map *drv_bufs = NULL, *drv_buf_iter = NULL;
11 	u8 count, bufcnt = 0, is_rmcb = 0, is_rmrb = 0;
12 	u8 din_cnt = 0, dout_cnt = 0;
13 	u8 invalid_be = 0, erb_offset = 0xFF, mpirep_offset = 0xFF;
14 	u8 block_io = 0, nvme_fmt = 0, resp_code = 0;
15 	struct mpi3_request_header *mpi_header = NULL;
16 	struct mpi3_status_reply_descriptor *status_desc;
17 	struct mpi3_scsi_task_mgmt_request *tm_req;
18 	u32 erbsz = MPI3MR_SENSE_BUF_SZ, tmplen;
19 	u16 dev_handle;
20 	struct mpi3mr_tgt_dev *tgtdev;
21 	struct mpi3mr_stgt_priv_data *stgt_priv = NULL;
22 	struct mpi3mr_bsg_in_reply_buf *bsg_reply_buf = NULL;
23 	u32 din_size = 0, dout_size = 0;
24 	u8 *din_buf = NULL, *dout_buf = NULL;
25 	u8 *sgl_iter = NULL, *sgl_din_iter = NULL, *sgl_dout_iter = NULL;
26 	u16 rmc_size  = 0, desc_count = 0;
27 
28 	bsg_req = job->request;
29 	karg = (struct mpi3mr_bsg_mptcmd *)&bsg_req->cmd.mptcmd;
30 
31 	mrioc = mpi3mr_bsg_verify_adapter(karg->mrioc_id);
32 	if (!mrioc)
33 		return -ENODEV;
34 
35 	if (!mrioc->ioctl_sges_allocated) {
36 		dprint_bsg_err(mrioc, "%s: DMA memory was not allocated\n",
37 			       __func__);
38 		return -ENOMEM;
39 	}
40 
41 	if (karg->timeout < MPI3MR_APP_DEFAULT_TIMEOUT)
42 		karg->timeout = MPI3MR_APP_DEFAULT_TIMEOUT;
43 
44 	mpi_req = kzalloc(MPI3MR_ADMIN_REQ_FRAME_SZ, GFP_KERNEL);
45 	if (!mpi_req)
46 		return -ENOMEM;
47 	mpi_header = (struct mpi3_request_header *)mpi_req;
48 
49 	bufcnt = karg->buf_entry_list.num_of_entries;
50 	drv_bufs = kzalloc((sizeof(*drv_bufs) * bufcnt), GFP_KERNEL);
51 	if (!drv_bufs) {
52 		rval = -ENOMEM;
53 		goto out;
54 	}
55 
56 	dout_buf = kzalloc(job->request_payload.payload_len,
57 				      GFP_KERNEL);
58 	if (!dout_buf) {
59 		rval = -ENOMEM;
60 		goto out;
61 	}
62 
63 	din_buf = kzalloc(job->reply_payload.payload_len,
64 				     GFP_KERNEL);
65 	if (!din_buf) {
66 		rval = -ENOMEM;
67 		goto out;
68 	}
69 
70 	sg_copy_to_buffer(job->request_payload.sg_list,
71 			  job->request_payload.sg_cnt,
72 			  dout_buf, job->request_payload.payload_len);
73 
74 	buf_entries = karg->buf_entry_list.buf_entry;
75 	sgl_din_iter = din_buf;
76 	sgl_dout_iter = dout_buf;
77 	drv_buf_iter = drv_bufs;
78 
79 	for (count = 0; count < bufcnt; count++, buf_entries++, drv_buf_iter++) {
80 
81 		switch (buf_entries->buf_type) {
82 		case MPI3MR_BSG_BUFTYPE_RAIDMGMT_CMD:
83 			sgl_iter = sgl_dout_iter;
84 			sgl_dout_iter += buf_entries->buf_len;
85 			drv_buf_iter->data_dir = DMA_TO_DEVICE;
86 			is_rmcb = 1;
87 			if ((count != 0) || !buf_entries->buf_len)
88 				invalid_be = 1;
89 			break;
90 		case MPI3MR_BSG_BUFTYPE_RAIDMGMT_RESP:
91 			sgl_iter = sgl_din_iter;
92 			sgl_din_iter += buf_entries->buf_len;
93 			drv_buf_iter->data_dir = DMA_FROM_DEVICE;
94 			is_rmrb = 1;
95 			if (count != 1 || !is_rmcb || !buf_entries->buf_len)
96 				invalid_be = 1;
97 			break;
98 		case MPI3MR_BSG_BUFTYPE_DATA_IN:
99 			sgl_iter = sgl_din_iter;
100 			sgl_din_iter += buf_entries->buf_len;
101 			drv_buf_iter->data_dir = DMA_FROM_DEVICE;
102 			din_cnt++;
103 			din_size += buf_entries->buf_len;
104 			if ((din_cnt > 1) && !is_rmcb)
105 				invalid_be = 1;
106 			break;
107 		case MPI3MR_BSG_BUFTYPE_DATA_OUT:
108 			sgl_iter = sgl_dout_iter;
109 			sgl_dout_iter += buf_entries->buf_len;
110 			drv_buf_iter->data_dir = DMA_TO_DEVICE;
111 			dout_cnt++;
112 			dout_size += buf_entries->buf_len;
113 			if ((dout_cnt > 1) && !is_rmcb)
114 				invalid_be = 1;
115 			break;
116 		case MPI3MR_BSG_BUFTYPE_MPI_REPLY:
117 			sgl_iter = sgl_din_iter;
118 			sgl_din_iter += buf_entries->buf_len;
119 			drv_buf_iter->data_dir = DMA_NONE;
120 			mpirep_offset = count;
121 			if (!buf_entries->buf_len)
122 				invalid_be = 1;
123 			break;
124 		case MPI3MR_BSG_BUFTYPE_ERR_RESPONSE:
125 			sgl_iter = sgl_din_iter;
126 			sgl_din_iter += buf_entries->buf_len;
127 			drv_buf_iter->data_dir = DMA_NONE;
128 			erb_offset = count;
129 			if (!buf_entries->buf_len)
130 				invalid_be = 1;
131 			break;
132 		case MPI3MR_BSG_BUFTYPE_MPI_REQUEST:
133 			sgl_iter = sgl_dout_iter;
134 			sgl_dout_iter += buf_entries->buf_len;
135 			drv_buf_iter->data_dir = DMA_NONE;
136 			mpi_msg_size = buf_entries->buf_len;
137 			if ((!mpi_msg_size || (mpi_msg_size % 4)) ||
138 					(mpi_msg_size > MPI3MR_ADMIN_REQ_FRAME_SZ)) {
139 				dprint_bsg_err(mrioc, "%s: invalid MPI message size\n",
140 					__func__);
141 				rval = -EINVAL;
142 				goto out;
143 			}
144 			memcpy(mpi_req, sgl_iter, buf_entries->buf_len);
145 			break;
146 		default:
147 			invalid_be = 1;
148 			break;
149 		}
150 		if (invalid_be) {
151 			dprint_bsg_err(mrioc, "%s: invalid buffer entries passed\n",
152 				__func__);
153 			rval = -EINVAL;
154 			goto out;
155 		}
156 
157 		if (sgl_dout_iter > (dout_buf + job->request_payload.payload_len)) {
158 			dprint_bsg_err(mrioc, "%s: data_out buffer length mismatch\n",
159 				       __func__);
160 			rval = -EINVAL;
161 			goto out;
162 		}
163 		if (sgl_din_iter > (din_buf + job->reply_payload.payload_len)) {
164 			dprint_bsg_err(mrioc, "%s: data_in buffer length mismatch\n",
165 				       __func__);
166 			rval = -EINVAL;
167 			goto out;
168 		}
169 
170 		drv_buf_iter->bsg_buf = sgl_iter;
171 		drv_buf_iter->bsg_buf_len = buf_entries->buf_len;
172 	}
173 
174 	if (is_rmcb && ((din_size + dout_size) > MPI3MR_MAX_APP_XFER_SIZE)) {
175 		dprint_bsg_err(mrioc, "%s:%d: invalid data transfer size passed for function 0x%x din_size = %d, dout_size = %d\n",
176 			       __func__, __LINE__, mpi_header->function, din_size,
177 			       dout_size);
178 		rval = -EINVAL;
179 		goto out;
180 	}
181 
182 	if (din_size > MPI3MR_MAX_APP_XFER_SIZE) {
183 		dprint_bsg_err(mrioc,
184 		    "%s:%d: invalid data transfer size passed for function 0x%x din_size=%d\n",
185 		    __func__, __LINE__, mpi_header->function, din_size);
186 		rval = -EINVAL;
187 		goto out;
188 	}
189 	if (dout_size > MPI3MR_MAX_APP_XFER_SIZE) {
190 		dprint_bsg_err(mrioc,
191 		    "%s:%d: invalid data transfer size passed for function 0x%x dout_size = %d\n",
192 		    __func__, __LINE__, mpi_header->function, dout_size);
193 		rval = -EINVAL;
194 		goto out;
195 	}
196 
197 	if (mpi_header->function == MPI3_BSG_FUNCTION_SMP_PASSTHROUGH) {
198 		if (din_size > MPI3MR_IOCTL_SGE_SIZE ||
199 		    dout_size > MPI3MR_IOCTL_SGE_SIZE) {
200 			dprint_bsg_err(mrioc, "%s:%d: invalid message size passed:%d:%d:%d:%d\n",
201 				       __func__, __LINE__, din_cnt, dout_cnt, din_size,
202 			    dout_size);
203 			rval = -EINVAL;
204 			goto out;
205 		}
206 	}
207 
208 	drv_buf_iter = drv_bufs;
209 	for (count = 0; count < bufcnt; count++, drv_buf_iter++) {
210 		if (drv_buf_iter->data_dir == DMA_NONE)
211 			continue;
212 
213 		drv_buf_iter->kern_buf_len = drv_buf_iter->bsg_buf_len;
214 		if (is_rmcb && !count) {
215 			drv_buf_iter->kern_buf_len =
216 			    mrioc->ioctl_chain_sge.size;
217 			drv_buf_iter->kern_buf =
218 			    mrioc->ioctl_chain_sge.addr;
219 			drv_buf_iter->kern_buf_dma =
220 			    mrioc->ioctl_chain_sge.dma_addr;
221 			drv_buf_iter->dma_desc = NULL;
222 			drv_buf_iter->num_dma_desc = 0;
223 			memset(drv_buf_iter->kern_buf, 0,
224 			       drv_buf_iter->kern_buf_len);
225 			tmplen = min(drv_buf_iter->kern_buf_len,
226 				     drv_buf_iter->bsg_buf_len);
227 			rmc_size = tmplen;
228 			memcpy(drv_buf_iter->kern_buf, drv_buf_iter->bsg_buf, tmplen);
229 		} else if (is_rmrb && (count == 1)) {
230 			drv_buf_iter->kern_buf_len =
231 			    mrioc->ioctl_resp_sge.size;
232 			drv_buf_iter->kern_buf =
233 			    mrioc->ioctl_resp_sge.addr;
234 			drv_buf_iter->kern_buf_dma =
235 			    mrioc->ioctl_resp_sge.dma_addr;
236 			drv_buf_iter->dma_desc = NULL;
237 			drv_buf_iter->num_dma_desc = 0;
238 			memset(drv_buf_iter->kern_buf, 0,
239 			       drv_buf_iter->kern_buf_len);
240 			tmplen = min(drv_buf_iter->kern_buf_len,
241 				     drv_buf_iter->bsg_buf_len);
242 			drv_buf_iter->kern_buf_len = tmplen;
243 			memset(drv_buf_iter->bsg_buf, 0,
244 			       drv_buf_iter->bsg_buf_len);
245 		} else {
246 			if (!drv_buf_iter->kern_buf_len)
247 				continue;
248 			if (mpi3mr_map_data_buffer_dma(mrioc, drv_buf_iter, desc_count)) {
249 				rval = -ENOMEM;
250 				dprint_bsg_err(mrioc, "%s:%d: mapping data buffers failed\n",
251 					       __func__, __LINE__);
252 			goto out;
253 		}
254 			desc_count += drv_buf_iter->num_dma_desc;
255 		}
256 	}
257 
258 	if (erb_offset != 0xFF) {
259 		sense_buff_k = kzalloc(erbsz, GFP_KERNEL);
260 		if (!sense_buff_k) {
261 			rval = -ENOMEM;
262 			goto out;
263 		}
264 	}
265 
266 	if (mutex_lock_interruptible(&mrioc->bsg_cmds.mutex)) {
267 		rval = -ERESTARTSYS;
268 		goto out;
269 	}
270 	if (mrioc->bsg_cmds.state & MPI3MR_CMD_PENDING) {
271 		rval = -EAGAIN;
272 		dprint_bsg_err(mrioc, "%s: command is in use\n", __func__);
273 		mutex_unlock(&mrioc->bsg_cmds.mutex);
274 		goto out;
275 	}
276 	if (mrioc->unrecoverable) {
277 		dprint_bsg_err(mrioc, "%s: unrecoverable controller\n",
278 		    __func__);
279 		rval = -EFAULT;
280 		mutex_unlock(&mrioc->bsg_cmds.mutex);
281 		goto out;
282 	}
283 	if (mrioc->reset_in_progress) {
284 		dprint_bsg_err(mrioc, "%s: reset in progress\n", __func__);
285 		rval = -EAGAIN;
286 		mutex_unlock(&mrioc->bsg_cmds.mutex);
287 		goto out;
288 	}
289 	if (mrioc->stop_bsgs) {
290 		dprint_bsg_err(mrioc, "%s: bsgs are blocked\n", __func__);
291 		rval = -EAGAIN;
292 		mutex_unlock(&mrioc->bsg_cmds.mutex);
293 		goto out;
294 	}
295 
296 	if (mpi_header->function == MPI3_BSG_FUNCTION_NVME_ENCAPSULATED) {
297 		nvme_fmt = mpi3mr_get_nvme_data_fmt(
298 			(struct mpi3_nvme_encapsulated_request *)mpi_req);
299 		if (nvme_fmt == MPI3MR_NVME_DATA_FORMAT_PRP) {
300 			if (mpi3mr_build_nvme_prp(mrioc,
301 			    (struct mpi3_nvme_encapsulated_request *)mpi_req,
302 			    drv_bufs, bufcnt)) {
303 				rval = -ENOMEM;
304 				mutex_unlock(&mrioc->bsg_cmds.mutex);
305 				goto out;
306 			}
307 		} else if (nvme_fmt == MPI3MR_NVME_DATA_FORMAT_SGL1 ||
308 			nvme_fmt == MPI3MR_NVME_DATA_FORMAT_SGL2) {
309 			if (mpi3mr_build_nvme_sgl(mrioc,
310 			    (struct mpi3_nvme_encapsulated_request *)mpi_req,
311 			    drv_bufs, bufcnt)) {
312 				rval = -EINVAL;
313 				mutex_unlock(&mrioc->bsg_cmds.mutex);
314 				goto out;
315 			}
316 		} else {
317 			dprint_bsg_err(mrioc,
318 			    "%s:invalid NVMe command format\n", __func__);
319 			rval = -EINVAL;
320 			mutex_unlock(&mrioc->bsg_cmds.mutex);
321 			goto out;
322 		}
323 	} else {
324 		if (mpi3mr_bsg_build_sgl(mrioc, mpi_req, mpi_msg_size,
325 					 drv_bufs, bufcnt, is_rmcb, is_rmrb,
326 					 (dout_cnt + din_cnt))) {
327 			dprint_bsg_err(mrioc, "%s: sgl build failed\n", __func__);
328 			rval = -EAGAIN;
329 			mutex_unlock(&mrioc->bsg_cmds.mutex);
330 			goto out;
331 		}
332 	}
333 
334 	if (mpi_header->function == MPI3_BSG_FUNCTION_SCSI_TASK_MGMT) {
335 		tm_req = (struct mpi3_scsi_task_mgmt_request *)mpi_req;
336 		if (tm_req->task_type !=
337 		    MPI3_SCSITASKMGMT_TASKTYPE_ABORT_TASK) {
338 			dev_handle = tm_req->dev_handle;
339 			block_io = 1;
340 		}
341 	}
342 	if (block_io) {
343 		tgtdev = mpi3mr_get_tgtdev_by_handle(mrioc, dev_handle);
344 		if (tgtdev && tgtdev->starget && tgtdev->starget->hostdata) {
345 			stgt_priv = (struct mpi3mr_stgt_priv_data *)
346 			    tgtdev->starget->hostdata;
347 			atomic_inc(&stgt_priv->block_io);
348 			mpi3mr_tgtdev_put(tgtdev);
349 		}
350 	}
351 
352 	mrioc->bsg_cmds.state = MPI3MR_CMD_PENDING;
353 	mrioc->bsg_cmds.is_waiting = 1;
354 	mrioc->bsg_cmds.callback = NULL;
355 	mrioc->bsg_cmds.is_sense = 0;
356 	mrioc->bsg_cmds.sensebuf = sense_buff_k;
357 	memset(mrioc->bsg_cmds.reply, 0, mrioc->reply_sz);
358 	mpi_header->host_tag = cpu_to_le16(MPI3MR_HOSTTAG_BSG_CMDS);
359 	if (mrioc->logging_level & MPI3_DEBUG_BSG_INFO) {
360 		dprint_bsg_info(mrioc,
361 		    "%s: posting bsg request to the controller\n", __func__);
362 		dprint_dump(mpi_req, MPI3MR_ADMIN_REQ_FRAME_SZ,
363 		    "bsg_mpi3_req");
364 		if (mpi_header->function == MPI3_BSG_FUNCTION_MGMT_PASSTHROUGH) {
365 			drv_buf_iter = &drv_bufs[0];
366 			dprint_dump(drv_buf_iter->kern_buf,
367 			    rmc_size, "mpi3_mgmt_req");
368 		}
369 	}
370 
371 	init_completion(&mrioc->bsg_cmds.done);
372 	rval = mpi3mr_admin_request_post(mrioc, mpi_req,
373 	    MPI3MR_ADMIN_REQ_FRAME_SZ, 0);
374 
375 
376 	if (rval) {
377 		mrioc->bsg_cmds.is_waiting = 0;
378 		dprint_bsg_err(mrioc,
379 		    "%s: posting bsg request is failed\n", __func__);
380 		rval = -EAGAIN;
381 		goto out_unlock;
382 	}
383 	wait_for_completion_timeout(&mrioc->bsg_cmds.done,
384 	    (karg->timeout * HZ));
385 	if (block_io && stgt_priv)
386 		atomic_dec(&stgt_priv->block_io);
387 	if (!(mrioc->bsg_cmds.state & MPI3MR_CMD_COMPLETE)) {
388 		mrioc->bsg_cmds.is_waiting = 0;
389 		rval = -EAGAIN;
390 		if (mrioc->bsg_cmds.state & MPI3MR_CMD_RESET)
391 			goto out_unlock;
392 		dprint_bsg_err(mrioc,
393 		    "%s: bsg request timedout after %d seconds\n", __func__,
394 		    karg->timeout);
395 		if (mrioc->logging_level & MPI3_DEBUG_BSG_ERROR) {
396 			dprint_dump(mpi_req, MPI3MR_ADMIN_REQ_FRAME_SZ,
397 			    "bsg_mpi3_req");
398 			if (mpi_header->function ==
399 			    MPI3_BSG_FUNCTION_MGMT_PASSTHROUGH) {
400 				drv_buf_iter = &drv_bufs[0];
401 				dprint_dump(drv_buf_iter->kern_buf,
402 				    rmc_size, "mpi3_mgmt_req");
403 			}
404 		}
405 		if ((mpi_header->function == MPI3_BSG_FUNCTION_NVME_ENCAPSULATED) ||
406 		    (mpi_header->function == MPI3_BSG_FUNCTION_SCSI_IO))
407 			mpi3mr_issue_tm(mrioc,
408 			    MPI3_SCSITASKMGMT_TASKTYPE_TARGET_RESET,
409 			    mpi_header->function_dependent, 0,
410 			    MPI3MR_HOSTTAG_BLK_TMS, MPI3MR_RESETTM_TIMEOUT,
411 			    &mrioc->host_tm_cmds, &resp_code, NULL);
412 		if (!(mrioc->bsg_cmds.state & MPI3MR_CMD_COMPLETE) &&
413 		    !(mrioc->bsg_cmds.state & MPI3MR_CMD_RESET))
414 			mpi3mr_soft_reset_handler(mrioc,
415 			    MPI3MR_RESET_FROM_APP_TIMEOUT, 1);
416 		goto out_unlock;
417 	}
418 	dprint_bsg_info(mrioc, "%s: bsg request is completed\n", __func__);
419 
420 	if (mrioc->prp_list_virt) {
421 		dma_free_coherent(&mrioc->pdev->dev, mrioc->prp_sz,
422 		    mrioc->prp_list_virt, mrioc->prp_list_dma);
423 		mrioc->prp_list_virt = NULL;
424 	}
425 
426 	if ((mrioc->bsg_cmds.ioc_status & MPI3_IOCSTATUS_STATUS_MASK)
427 	     != MPI3_IOCSTATUS_SUCCESS) {
428 		dprint_bsg_info(mrioc,
429 		    "%s: command failed, ioc_status(0x%04x) log_info(0x%08x)\n",
430 		    __func__,
431 		    (mrioc->bsg_cmds.ioc_status & MPI3_IOCSTATUS_STATUS_MASK),
432 		    mrioc->bsg_cmds.ioc_loginfo);
433 	}
434 
435 	if ((mpirep_offset != 0xFF) &&
436 	    drv_bufs[mpirep_offset].bsg_buf_len) {
437 		drv_buf_iter = &drv_bufs[mpirep_offset];
438 		drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) - 1 +
439 					   mrioc->reply_sz);
440 		bsg_reply_buf = kzalloc(drv_buf_iter->kern_buf_len, GFP_KERNEL);
441 
442 		if (!bsg_reply_buf) {
443 			rval = -ENOMEM;
444 			goto out_unlock;
445 		}
446 		if (mrioc->bsg_cmds.state & MPI3MR_CMD_REPLY_VALID) {
447 			bsg_reply_buf->mpi_reply_type =
448 				MPI3MR_BSG_MPI_REPLY_BUFTYPE_ADDRESS;
449 			memcpy(bsg_reply_buf->reply_buf,
450 			    mrioc->bsg_cmds.reply, mrioc->reply_sz);
451 		} else {
452 			bsg_reply_buf->mpi_reply_type =
453 				MPI3MR_BSG_MPI_REPLY_BUFTYPE_STATUS;
454 			status_desc = (struct mpi3_status_reply_descriptor *)
455 			    bsg_reply_buf->reply_buf;
456 			status_desc->ioc_status = mrioc->bsg_cmds.ioc_status;
457 			status_desc->ioc_log_info = mrioc->bsg_cmds.ioc_loginfo;
458 		}
459 		tmplen = min(drv_buf_iter->kern_buf_len,
460 			drv_buf_iter->bsg_buf_len);
461 		memcpy(drv_buf_iter->bsg_buf, bsg_reply_buf, tmplen);
462 	}
463 
464 	if (erb_offset != 0xFF && mrioc->bsg_cmds.sensebuf &&
465 	    mrioc->bsg_cmds.is_sense) {
466 		drv_buf_iter = &drv_bufs[erb_offset];
467 		tmplen = min(erbsz, drv_buf_iter->bsg_buf_len);
468 		memcpy(drv_buf_iter->bsg_buf, sense_buff_k, tmplen);
469 	}
470 
471 	drv_buf_iter = drv_bufs;
472 	for (count = 0; count < bufcnt; count++, drv_buf_iter++) {
473 		if (drv_buf_iter->data_dir == DMA_NONE)
474 			continue;
475 		if ((count == 1) && is_rmrb) {
476 			memcpy(drv_buf_iter->bsg_buf,
477 			    drv_buf_iter->kern_buf,
478 			    drv_buf_iter->kern_buf_len);
479 		} else if (drv_buf_iter->data_dir == DMA_FROM_DEVICE) {
480 			tmplen = 0;
481 			for (desc_count = 0;
482 			    desc_count < drv_buf_iter->num_dma_desc;
483 			    desc_count++) {
484 				memcpy(((u8 *)drv_buf_iter->bsg_buf + tmplen),
485 				       drv_buf_iter->dma_desc[desc_count].addr,
486 				       drv_buf_iter->dma_desc[desc_count].size);
487 				tmplen +=
488 				    drv_buf_iter->dma_desc[desc_count].size;
489 		}
490 	}
491 	}
492 
493 out_unlock:
494 	if (din_buf) {
495 		job->reply_payload_rcv_len =
496 			sg_copy_from_buffer(job->reply_payload.sg_list,
497 					    job->reply_payload.sg_cnt,
498 					    din_buf, job->reply_payload.payload_len);
499 	}
500 	mrioc->bsg_cmds.is_sense = 0;
501 	mrioc->bsg_cmds.sensebuf = NULL;
502 	mrioc->bsg_cmds.state = MPI3MR_CMD_NOTUSED;
503 	mutex_unlock(&mrioc->bsg_cmds.mutex);
504 out:
505 	kfree(sense_buff_k);
506 	kfree(dout_buf);
507 	kfree(din_buf);
508 	kfree(mpi_req);
509 	if (drv_bufs) {
510 		drv_buf_iter = drv_bufs;
511 		for (count = 0; count < bufcnt; count++, drv_buf_iter++)
512 			kfree(drv_buf_iter->dma_desc);
513 		kfree(drv_bufs);
514 	}
515 	kfree(bsg_reply_buf);
516 	return rval;
517 }
```
which has a vulnerability among CWE-787 and among lines:
```
461 		memcpy(drv_buf_iter->bsg_buf, bsg_reply_buf, tmplen);
```
Please generate five possible patches for the vulnerability.