Source code review around jump label usage

index 5942917..c37b0bb 100644
@@ -2895,7 +2895,7 @@ static int prism2_ioctl_priv_monitor(struct net_device *dev, int *i)
 {
 	struct hostap_interface *iface;
 	local_info_t *local;
-	int ret = 0;
+	int ret;
 	u32 mode;
 
 	iface = netdev_priv(dev);

@@ -3035,7 +3035,7 @@ static int ap_mac_cmd_ioctl(local_info_t *local, int *cmd)
 static int prism2_ioctl_priv_download(local_info_t *local, struct iw_point *p)
 {
 	struct prism2_download_param *param;
-	int ret = 0;
+	int ret;
 
 	if (p->length < sizeof(struct prism2_download_param) ||
 	    p->length > 1024 || !p->pointer)

@@ -3791,7 +3791,7 @@ static int prism2_ioctl_scan_req(local_info_t *local,
 static int prism2_ioctl_priv_hostapd(local_info_t *local, struct iw_point *p)
 {
 	struct prism2_hostapd_param *param;
-	int ret = 0;
+	int ret;
 	int ap_ioctl = 0;
 
 	if (p->length < sizeof(struct prism2_hostapd_param) ||

@@ -3954,7 +3954,7 @@ int hostap_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 	struct iwreq *wrq = (struct iwreq *) ifr;
 	struct hostap_interface *iface;
 	local_info_t *local;
-	int ret = 0;
+	int ret;
 
 	iface = netdev_priv(dev);
 	local = iface->local;

index d3d1936..e352047 100644
@@ -312,15 +312,10 @@ static int tape_3592_ioctl_kekl_set(struct tape_device *device,
 		return -ENOSYS;
 	if (!crypt_enabled(device))
 		return -EUNATCH;
-	ext_kekls = kmalloc(sizeof(*ext_kekls), GFP_KERNEL);
-	if (!ext_kekls)
-		return -ENOMEM;
-	if (copy_from_user(ext_kekls, (char __user *)arg, sizeof(*ext_kekls))) {
-		rc = -EFAULT;
-		goto out;
-	}
+	ext_kekls = memdup_user((char __user *)arg, sizeof(*ext_kekls));
+	if (IS_ERR(ext_kekls))
+		return PTR_ERR(ext_kekls);
 	rc = tape_3592_kekl_set(device, ext_kekls);
-out:
 	kfree(ext_kekls);
 	return rc;
 }

index 5648b71..1af3084 100644
@@ -526,15 +526,9 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 		goto cleanup;
 	}
 
-	user_srbcmd = kmalloc(fibsize, GFP_KERNEL);
-	if (!user_srbcmd) {
-		dprintk((KERN_DEBUG"aacraid: Could not make a copy of the srb\n"));
-		rcode = -ENOMEM;
-		goto cleanup;
-	}
-	if(copy_from_user(user_srbcmd, user_srb,fibsize)){
-		dprintk((KERN_DEBUG"aacraid: Could not copy srb from user\n"));
-		rcode = -EFAULT;
+	user_srbcmd = memdup_user(user_srb, fibsize);
+	if (IS_ERR(user_srbcmd)) {
+		rcode = PTR_ERR(user_srbcmd);
 		goto cleanup;
 	}
 

index 1af3084..6dcdf91 100644
@@ -517,19 +517,19 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 	if(copy_from_user(&fibsize, &user_srb->count,sizeof(u32))){
 		dprintk((KERN_DEBUG"aacraid: Could not copy data size from user\n"));
 		rcode = -EFAULT;
-		goto cleanup;
+		goto free_sg_list;
 	}
 
 	if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) ||
 	    (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) {
 		rcode = -EINVAL;
-		goto cleanup;
+		goto free_sg_list;
 	}
 
 	user_srbcmd = memdup_user(user_srb, fibsize);
 	if (IS_ERR(user_srbcmd)) {
 		rcode = PTR_ERR(user_srbcmd);
-		goto cleanup;
+		goto free_sg_list;
 	}
 
 	user_reply = arg+fibsize;

@@ -564,7 +564,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 		dprintk((KERN_DEBUG"aacraid: too many sg entries %d\n",
 		  le32_to_cpu(srbcmd->sg.count)));
 		rcode = -EINVAL;
-		goto cleanup;
+		goto free_user_srbcmd;
 	}
 	actual_fibsize = sizeof(struct aac_srb) - sizeof(struct sgentry) +
 		((user_srbcmd->sg.count & 0xff) * sizeof(struct sgentry));

@@ -580,12 +580,12 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 		  sizeof(struct aac_srb), sizeof(struct sgentry),
 		  sizeof(struct sgentry64), fibsize));
 		rcode = -EINVAL;
-		goto cleanup;
+		goto free_user_srbcmd;
 	}
 	if ((data_dir = DMA_NONE) && user_srbcmd->sg.count) {
 		dprintk((KERN_DEBUG"aacraid: SG with no direction specified in Raw SRB command\n"));
 		rcode = -EINVAL;
-		goto cleanup;
+		goto free_user_srbcmd;
 	}
 	byte_count = 0;
 	if (dev->adapter_info.options & AAC_OPT_SGMAP_HOST64) {

@@ -606,7 +606,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 				      (dev->scsi_host_ptr->max_sectors << 9) :
 				      65536)) {
 					rcode = -EINVAL;
-					goto cleanup;
+					goto free_user_srbcmd;
 				}
 				/* Does this really need to be GFP_DMA? */
 				p = kmalloc(upsg->sg[i].count,GFP_KERNEL|__GFP_DMA);

@@ -614,7 +614,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 					dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
 					  upsg->sg[i].count,i,upsg->count));
 					rcode = -ENOMEM;
-					goto cleanup;
+					goto free_user_srbcmd;
 				}
 				addr = (u64)upsg->sg[i].addr[0];
 				addr += ((u64)upsg->sg[i].addr[1]) << 32;

@@ -626,7 +626,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 					if(copy_from_user(p,sg_user[i],upsg->sg[i].count)){
 						dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n"));
 						rcode = -EFAULT;
-						goto cleanup;
+						goto free_user_srbcmd;
 					}
 				}
 				addr = pci_map_single(dev->pdev, p, upsg->sg[i].count, data_dir);

@@ -644,7 +644,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 			if (!usg) {
 				dprintk((KERN_DEBUG"aacraid: Allocation error in Raw SRB command\n"));
 				rcode = -ENOMEM;
-				goto cleanup;
+				goto free_user_srbcmd;
 			}
 			actual_fibsize = actual_fibsize64;
 

@@ -658,7 +658,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 				      65536)) {
 					kfree(usg);
 					rcode = -EINVAL;
-					goto cleanup;
+					goto free_user_srbcmd;
 				}
 				/* Does this really need to be GFP_DMA? */
 				p = kmalloc(usg->sg[i].count,GFP_KERNEL|__GFP_DMA);

@@ -667,7 +667,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 					  usg->sg[i].count,i,usg->count));
 					kfree(usg);
 					rcode = -ENOMEM;
-					goto cleanup;
+					goto free_user_srbcmd;
 				}
 				sg_user[i] = (void __user *)(uintptr_t)usg->sg[i].addr;
 				sg_list[i] = p; // save so we can clean up later

@@ -678,7 +678,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 						kfree (usg);
 						dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n"));
 						rcode = -EFAULT;
-						goto cleanup;
+						goto free_user_srbcmd;
 					}
 				}
 				addr = pci_map_single(dev->pdev, p, usg->sg[i].count, data_dir);

@@ -711,7 +711,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 				      (dev->scsi_host_ptr->max_sectors << 9) :
 				      65536)) {
 					rcode = -EINVAL;
-					goto cleanup;
+					goto free_user_srbcmd;
 				}
 				/* Does this really need to be GFP_DMA? */
 				p = kmalloc(usg->sg[i].count,GFP_KERNEL|__GFP_DMA);

@@ -719,7 +719,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 					dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
 					  usg->sg[i].count,i,usg->count));
 					rcode = -ENOMEM;
-					goto cleanup;
+					goto free_user_srbcmd;
 				}
 				addr = (u64)usg->sg[i].addr[0];
 				addr += ((u64)usg->sg[i].addr[1]) << 32;

@@ -731,7 +731,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 					if(copy_from_user(p,sg_user[i],usg->sg[i].count)){
 						dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n"));
 						rcode = -EFAULT;
-						goto cleanup;
+						goto free_user_srbcmd;
 					}
 				}
 				addr = pci_map_single(dev->pdev, p, usg->sg[i].count, data_dir);

@@ -750,14 +750,14 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 				      (dev->scsi_host_ptr->max_sectors << 9) :
 				      65536)) {
 					rcode = -EINVAL;
-					goto cleanup;
+					goto free_user_srbcmd;
 				}
 				p = kmalloc(upsg->sg[i].count, GFP_KERNEL);
 				if (!p) {
 					dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
 					  upsg->sg[i].count, i, upsg->count));
 					rcode = -ENOMEM;
-					goto cleanup;
+					goto free_user_srbcmd;
 				}
 				sg_user[i] = (void __user *)(uintptr_t)upsg->sg[i].addr;
 				sg_list[i] = p; // save so we can clean up later

@@ -768,7 +768,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 							upsg->sg[i].count)) {
 						dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n"));
 						rcode = -EFAULT;
-						goto cleanup;
+						goto free_user_srbcmd;
 					}
 				}
 				addr = pci_map_single(dev->pdev, p,

@@ -788,13 +788,13 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 	}
 	if (status = -ERESTARTSYS) {
 		rcode = -ERESTARTSYS;
-		goto cleanup;
+		goto free_user_srbcmd;
 	}
 
 	if (status != 0){
 		dprintk((KERN_DEBUG"aacraid: Could not send raw srb fib to hba\n"));
 		rcode = -ENXIO;
-		goto cleanup;
+		goto free_user_srbcmd;
 	}
 
 	if (flags & SRB_DataIn) {

@@ -806,7 +806,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 			if(copy_to_user(sg_user[i], sg_list[i], byte_count)){
 				dprintk((KERN_DEBUG"aacraid: Could not copy sg data to user\n"));
 				rcode = -EFAULT;
-				goto cleanup;
+				goto free_user_srbcmd;
 
 			}
 		}

@@ -816,11 +816,10 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 	if(copy_to_user(user_reply,reply,sizeof(struct aac_srb_reply))){
 		dprintk((KERN_DEBUG"aacraid: Could not copy reply to user\n"));
 		rcode = -EFAULT;
-		goto cleanup;
 	}
-
-cleanup:
+free_user_srbcmd:
 	kfree(user_srbcmd);
+free_sg_list:
 	for(i=0; i <= sg_indx; i++){
 		kfree(sg_list[i]);
 	}

index 6dcdf91..49a664f 100644
@@ -476,20 +476,20 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 {
 	struct fib* srbfib;
 	int status;
-	struct aac_srb *srbcmd = NULL;
-	struct user_aac_srb *user_srbcmd = NULL;
+	struct aac_srb *srbcmd;
+	struct user_aac_srb *user_srbcmd;
 	struct user_aac_srb __user *user_srb = arg;
 	struct aac_srb_reply __user *user_reply;
 	struct aac_srb_reply* reply;
-	u32 fibsize = 0;
-	u32 flags = 0;
+	u32 fibsize;
+	u32 flags;
 	s32 rcode = 0;
 	u32 data_dir;
 	void __user *sg_user[32];
 	void *sg_list[32];
 	u32 sg_indx = 0;
-	u32 byte_count = 0;
-	u32 actual_fibsize64, actual_fibsize = 0;
+	u32 byte_count;
+	u32 actual_fibsize64, actual_fibsize;
 	int i;
 
 

index 49a664f..9f4ddb0 100644
@@ -66,13 +66,11 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
 	unsigned int size, osize;
 	int retval;
 
-	if (dev->in_reset) {
+	if (dev->in_reset)
 		return -EBUSY;
-	}
 	fibptr = aac_fib_alloc(dev);
-	if(fibptr = NULL) {
+	if (!fibptr)
 		return -ENOMEM;
-	}
 
 	kfib = fibptr->hw_fib_va;
 	/*

@@ -138,9 +136,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
 		retval = aac_fib_send(le16_to_cpu(kfib->header.Command), fibptr,
 				le16_to_cpu(kfib->header.Size) , FsaNormal,
 				1, 1, NULL, NULL);
-		if (retval) {
+		if (retval)
 			goto cleanup;
-		}
 		if (aac_fib_complete(fibptr) != 0) {
 			retval = -EINVAL;
 			goto cleanup;

@@ -228,12 +225,10 @@ static int open_getadapter_fib(struct aac_dev * dev, void __user *arg)
 		}
 		list_add_tail(&fibctx->next, &dev->fib_list);
 		spin_unlock_irqrestore(&dev->fib_lock, flags);
-		if (copy_to_user(arg, &fibctx->unique,
-						sizeof(fibctx->unique))) {
+		if (copy_to_user(arg, &fibctx->unique, sizeof(fibctx->unique)))
 			status = -EFAULT;
-		} else {
+		else
 			status = 0;
-		}
 	}
 	return status;
 }

@@ -820,9 +815,8 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 free_user_srbcmd:
 	kfree(user_srbcmd);
 free_sg_list:
-	for(i=0; i <= sg_indx; i++){
+	for (i = 0; i <= sg_indx; i++)
 		kfree(sg_list[i]);
-	}
 	if (rcode != -ERESTARTSYS) {
 		aac_fib_complete(srbfib);
 		aac_fib_free(srbfib);

index 9f4ddb0..cda03f0 100644
@@ -251,7 +251,7 @@ static int next_getadapter_fib(struct aac_dev * dev, void __user *arg)
 	struct list_head * entry;
 	unsigned long flags;
 
-	if(copy_from_user((void *)&f, arg, sizeof(struct fib_ioctl)))
+	if (copy_from_user((void *)&f, arg, sizeof(struct fib_ioctl)))
 		return -EFAULT;
 	/*
 	 *	Verify that the HANDLE passed in was a valid AdapterFibContext

@@ -280,7 +280,7 @@ static int next_getadapter_fib(struct aac_dev * dev, void __user *arg)
 		return -EINVAL;
 	}
 
-	if((fibctx->type != FSAFS_NTC_GET_ADAPTER_FIB_CONTEXT) ||
+	if ((fibctx->type != FSAFS_NTC_GET_ADAPTER_FIB_CONTEXT) ||
 		 (fibctx->size != sizeof(struct aac_fib_context))) {
 		spin_unlock_irqrestore(&dev->fib_lock, flags);
 		dprintk ((KERN_INFO "Fib Context corrupt?\n"));

@@ -327,7 +327,7 @@ return_fib:
 			ssleep(1);
 		}
 		if (f.wait) {
-			if(down_interruptible(&fibctx->wait_sem) < 0) {
+			if (down_interruptible(&fibctx->wait_sem) < 0) {
 				status = -ERESTARTSYS;
 			} else {
 				/* Lock again and retry */

@@ -404,7 +404,7 @@ static int close_getadapter_fib(struct aac_dev * dev, void __user *arg)
 	entry = dev->fib_list.next;
 	fibctx = NULL;
 
-	while(entry != &dev->fib_list) {
+	while (entry != &dev->fib_list) {
 		fibctx = list_entry(entry, struct aac_fib_context, next);
 		/*
 		 *	Extract the fibctx from the input parameters

@@ -418,7 +418,7 @@ static int close_getadapter_fib(struct aac_dev * dev, void __user *arg)
 	if (!fibctx)
 		return 0; /* Already gone */
 
-	if((fibctx->type != FSAFS_NTC_GET_ADAPTER_FIB_CONTEXT) ||
+	if ((fibctx->type != FSAFS_NTC_GET_ADAPTER_FIB_CONTEXT) ||
 		 (fibctx->size != sizeof(struct aac_fib_context)))
 		return -EINVAL;
 	spin_lock_irqsave(&dev->fib_lock, flags);

@@ -509,7 +509,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 	srbcmd = (struct aac_srb*) fib_data(srbfib);
 
 	memset(sg_list, 0, sizeof(sg_list)); /* cleanup may take issue */
-	if(copy_from_user(&fibsize, &user_srb->count,sizeof(u32))){
+	if (copy_from_user(&fibsize, &user_srb->count, sizeof(u32))) {
 		dprintk((KERN_DEBUG"aacraid: Could not copy data size from user\n"));
 		rcode = -EFAULT;
 		goto free_sg_list;

@@ -605,7 +605,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 				}
 				/* Does this really need to be GFP_DMA? */
 				p = kmalloc(upsg->sg[i].count,GFP_KERNEL|__GFP_DMA);
-				if(!p) {
+				if (!p) {
 					dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
 					  upsg->sg[i].count,i,upsg->count));
 					rcode = -ENOMEM;

@@ -618,7 +618,9 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 				sg_indx = i;
 
 				if (flags & SRB_DataOut) {
-					if(copy_from_user(p,sg_user[i],upsg->sg[i].count)){
+					if (copy_from_user(p,
+							   sg_user[i],
+							   upsg->sg[i].count)) {
 						dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n"));
 						rcode = -EFAULT;
 						goto free_user_srbcmd;

@@ -657,7 +659,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 				}
 				/* Does this really need to be GFP_DMA? */
 				p = kmalloc(usg->sg[i].count,GFP_KERNEL|__GFP_DMA);
-				if(!p) {
+				if (!p) {
 					dprintk((KERN_DEBUG "aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
 					  usg->sg[i].count,i,usg->count));
 					kfree(usg);

@@ -669,7 +671,9 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 				sg_indx = i;
 
 				if (flags & SRB_DataOut) {
-					if(copy_from_user(p,sg_user[i],upsg->sg[i].count)){
+					if (copy_from_user(p,
+							   sg_user[i],
+							   upsg->sg[i].count)) {
 						kfree (usg);
 						dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n"));
 						rcode = -EFAULT;

@@ -710,7 +714,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 				}
 				/* Does this really need to be GFP_DMA? */
 				p = kmalloc(usg->sg[i].count,GFP_KERNEL|__GFP_DMA);
-				if(!p) {
+				if (!p) {
 					dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
 					  usg->sg[i].count,i,usg->count));
 					rcode = -ENOMEM;

@@ -723,7 +727,9 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 				sg_indx = i;
 
 				if (flags & SRB_DataOut) {
-					if(copy_from_user(p,sg_user[i],usg->sg[i].count)){
+					if (copy_from_user(p,
+							   sg_user[i],
+							   usg->sg[i].count)) {
 						dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n"));
 						rcode = -EFAULT;
 						goto free_user_srbcmd;

@@ -759,8 +765,9 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 				sg_indx = i;
 
 				if (flags & SRB_DataOut) {
-					if(copy_from_user(p, sg_user[i],
-							upsg->sg[i].count)) {
+					if (copy_from_user(p,
+							   sg_user[i],
+							   upsg->sg[i].count)) {
 						dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n"));
 						rcode = -EFAULT;
 						goto free_user_srbcmd;

@@ -793,12 +800,12 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 	}
 
 	if (flags & SRB_DataIn) {
-		for(i = 0 ; i <= sg_indx; i++){
+		for (i = 0 ; i <= sg_indx; i++) {
 			byte_count = le32_to_cpu(
 			  (dev->adapter_info.options & AAC_OPT_SGMAP_HOST64)
 			      ? ((struct sgmap64*)&srbcmd->sg)->sg[i].count
 			      : srbcmd->sg.sg[i].count);
-			if(copy_to_user(sg_user[i], sg_list[i], byte_count)){
+			if (copy_to_user(sg_user[i], sg_list[i], byte_count)) {
 				dprintk((KERN_DEBUG"aacraid: Could not copy sg data to user\n"));
 				rcode = -EFAULT;
 				goto free_user_srbcmd;

@@ -808,7 +815,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 	}
 
 	reply = (struct aac_srb_reply *) fib_data(srbfib);
-	if(copy_to_user(user_reply,reply,sizeof(struct aac_srb_reply))){
+	if (copy_to_user(user_reply, reply, sizeof(struct aac_srb_reply))) {
 		dprintk((KERN_DEBUG"aacraid: Could not copy reply to user\n"));
 		rcode = -EFAULT;
 	}

index cda03f0..d2029db 100644
@@ -177,7 +177,7 @@ static int open_getadapter_fib(struct aac_dev * dev, void __user *arg)
 	struct aac_fib_context * fibctx;
 	int status;
 
-	fibctx = kmalloc(sizeof(struct aac_fib_context), GFP_KERNEL);
+	fibctx = kmalloc(sizeof(*fibctx), GFP_KERNEL);
 	if (fibctx = NULL) {
 		status = -ENOMEM;
 	} else {

@@ -186,7 +186,7 @@ static int open_getadapter_fib(struct aac_dev * dev, void __user *arg)
 		struct aac_fib_context * context;
 
 		fibctx->type = FSAFS_NTC_GET_ADAPTER_FIB_CONTEXT;
-		fibctx->size = sizeof(struct aac_fib_context);
+		fibctx->size = sizeof(*fibctx);
 		/*
 		 *	Yes yes, I know this could be an index, but we have a
 		 * better guarantee of uniqueness for the locked loop below.

@@ -251,7 +251,7 @@ static int next_getadapter_fib(struct aac_dev * dev, void __user *arg)
 	struct list_head * entry;
 	unsigned long flags;
 
-	if (copy_from_user((void *)&f, arg, sizeof(struct fib_ioctl)))
+	if (copy_from_user(&f, arg, sizeof(f)))
 		return -EFAULT;
 	/*
 	 *	Verify that the HANDLE passed in was a valid AdapterFibContext

@@ -509,7 +509,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 	srbcmd = (struct aac_srb*) fib_data(srbfib);
 
 	memset(sg_list, 0, sizeof(sg_list)); /* cleanup may take issue */
-	if (copy_from_user(&fibsize, &user_srb->count, sizeof(u32))) {
+	if (copy_from_user(&fibsize, &user_srb->count, sizeof(fibsize))) {
 		dprintk((KERN_DEBUG"aacraid: Could not copy data size from user\n"));
 		rcode = -EFAULT;
 		goto free_sg_list;

index d2029db..7e6c76d 100644
@@ -499,9 +499,9 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 	/*
 	 *	Allocate and initialize a Fib then setup a SRB command
 	 */
-	if (!(srbfib = aac_fib_alloc(dev))) {
+	srbfib = aac_fib_alloc(dev);
+	if (!srbfib)
 		return -ENOMEM;
-	}
 	aac_fib_init(srbfib);
 	/* raw_srb FIB is not FastResponseCapable */
 	srbfib->hw_fib_va->header.XferState &= ~cpu_to_le32(FastResponseCapable);

index c1ed25a..9a2fe4e 100644
@@ -6711,14 +6711,9 @@ static int megasas_mgmt_ioctl_fw(struct file *file, unsigned long arg)
 	unsigned long flags;
 	u32 wait_time = MEGASAS_RESET_WAIT_TIME;
 
-	ioc = kmalloc(sizeof(*ioc), GFP_KERNEL);
-	if (!ioc)
-		return -ENOMEM;
-
-	if (copy_from_user(ioc, user_ioc, sizeof(*ioc))) {
-		error = -EFAULT;
-		goto out_kfree_ioc;
-	}
+	ioc = memdup_user(user_ioc, sizeof(*ioc));
+	if (IS_ERR(ioc))
+		return PTR_ERR(ioc);
 
 	instance = megasas_lookup_instance(ioc->host_no);
 	if (!instance) {

index 031c9e4..8b70e42 100644
@@ -1676,14 +1676,9 @@ out_poll:
 	case LL_IOC_QUOTACTL: {
 		struct if_quotactl *qctl;
 
-		qctl = kzalloc(sizeof(*qctl), GFP_NOFS);
-		if (!qctl)
-			return -ENOMEM;
-
-		if (copy_from_user(qctl, (void __user *)arg, sizeof(*qctl))) {
-			rc = -EFAULT;
-			goto out_quotactl;
-		}
+		qctl = memdup_user((void __user *)arg, sizeof(*qctl));
+		if (IS_ERR(qctl))
+			return PTR_ERR(qctl);
 
 		rc = quotactl_ioctl(sbi, qctl);
 

@@ -1691,7 +1686,6 @@ out_poll:
 					    sizeof(*qctl)))
 			rc = -EFAULT;
 
-out_quotactl:
 		kfree(qctl);
 		return rc;
 	}

index 7defa34..8ae01b0 100644
@@ -368,14 +368,9 @@ static ssize_t iowarrior_write(struct file *file,
 	case USB_DEVICE_ID_CODEMERCS_IOWPV2:
 	case USB_DEVICE_ID_CODEMERCS_IOW40:
 		/* IOW24 and IOW40 use a synchronous call */
-		buf = kmalloc(count, GFP_KERNEL);
-		if (!buf) {
-			retval = -ENOMEM;
-			goto exit;
-		}
-		if (copy_from_user(buf, user_buffer, count)) {
-			retval = -EFAULT;
-			kfree(buf);
+		buf = memdup_user(user_buffer, count);
+		if (IS_ERR(buf)) {
+			retval = PTR_ERR(buf);
 			goto exit;
 		}
 		retval = usb_set_report(dev->interface, 2, 0, buf, count);

index 8ae01b0..6048f97 100644
@@ -468,7 +468,7 @@ exit:
 static long iowarrior_ioctl(struct file *file, unsigned int cmd,
 							unsigned long arg)
 {
-	struct iowarrior *dev = NULL;
+	struct iowarrior *dev;
 	__u8 *buffer;
 	__u8 __user *user_buffer;
 	int retval;

@@ -751,7 +751,7 @@ static int iowarrior_probe(struct usb_interface *interface,
 			   const struct usb_device_id *id)
 {
 	struct usb_device *udev = interface_to_usbdev(interface);
-	struct iowarrior *dev = NULL;
+	struct iowarrior *dev;
 	struct usb_host_interface *iface_desc;
 	struct usb_endpoint_descriptor *endpoint;
 	int i;

index 6048f97..449bf64 100644
@@ -644,7 +644,7 @@ out:
 static int iowarrior_release(struct inode *inode, struct file *file)
 {
 	struct iowarrior *dev;
-	int retval = 0;
+	int retval;
 
 	dev = file->private_data;
 	if (dev = NULL) {

index 449bf64..e3564d8 100644
@@ -587,10 +587,10 @@ error_out:
  */
 static int iowarrior_open(struct inode *inode, struct file *file)
 {
-	struct iowarrior *dev = NULL;
+	struct iowarrior *dev;
 	struct usb_interface *interface;
 	int subminor;
-	int retval = 0;
+	int retval;
 
 	mutex_lock(&iowarrior_mutex);
 	subminor = iminor(inode);

index e3564d8..ffbbb74 100644
@@ -338,8 +338,8 @@ static ssize_t iowarrior_write(struct file *file,
 			       size_t count, loff_t *ppos)
 {
 	struct iowarrior *dev;
-	int retval = 0;
-	char *buf = NULL;	/* for IOW24 and IOW56 we need a buffer */
+	int retval;
+	char *buf;	/* for IOW24 and IOW56 we need a buffer */
 	struct urb *int_out_urb = NULL;
 
 	dev = file->private_data;

index ffbbb74..132c8cf 100644
@@ -227,10 +227,10 @@ static void iowarrior_write_callback(struct urb *urb)
 	/* sync/async unlink faults aren't errors */
 	if (status &&
 	    !(status = -ENOENT ||
-	      status = -ECONNRESET || status = -ESHUTDOWN)) {
+	      status = -ECONNRESET || status = -ESHUTDOWN))
 		dev_dbg(&dev->interface->dev,
 			"nonzero write bulk status received: %d\n", status);
-	}
+
 	/* free up our allocated buffer */
 	usb_free_coherent(urb->dev, urb->transfer_buffer_length,
 			  urb->transfer_buffer, urb->transfer_dma);

@@ -304,25 +304,21 @@ static ssize_t iowarrior_read(struct file *file, char __user *buffer,
 								      read_index
 								      (dev)) ! 								  -1));
-				if (r) {
+				if (r)
 					//we were interrupted by a signal
 					return -ERESTART;
-				}
-				if (!dev->present) {
+				if (!dev->present)
 					//The device was unplugged
 					return -ENODEV;
-				}
-				if (read_idx = -1) {
+				if (read_idx = -1)
 					// Can this happen ???
 					return 0;
-				}
 			}
 		}
 
 		offset = read_idx * (dev->report_size + 1);
-		if (copy_to_user(buffer, dev->read_queue + offset, count)) {
+		if (copy_to_user(buffer, dev->read_queue + offset, count))
 			return -EFAULT;
-		}
 	} while (atomic_read(&dev->overflow_flag));
 
 	read_idx = ++read_idx = MAX_INTERRUPT_BUFFER ? 0 : read_idx;

@@ -475,9 +471,8 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd,
 	int io_res;		/* checks for bytes read/written and copy_to/from_user results */
 
 	dev = file->private_data;
-	if (dev = NULL) {
+	if (!dev)
 		return -ENODEV;
-	}
 
 	buffer = kzalloc(dev->report_size, GFP_KERNEL);
 	if (!buffer)

@@ -647,9 +642,8 @@ static int iowarrior_release(struct inode *inode, struct file *file)
 	int retval;
 
 	dev = file->private_data;
-	if (dev = NULL) {
+	if (!dev)
 		return -ENODEV;
-	}
 
 	dev_dbg(&dev->interface->dev, "minor %d\n", dev->minor);
 

index 132c8cf..78b5d65 100644
@@ -292,7 +292,8 @@ static ssize_t iowarrior_read(struct file *file, char __user *buffer,
 	/* repeat until no buffer overrun in callback handler occur */
 	do {
 		atomic_set(&dev->overflow_flag, 0);
-		if ((read_idx = read_index(dev)) = -1) {
+		read_idx = read_index(dev);
+		if (read_idx = -1) {
 			/* queue empty */
 			if (file->f_flags & O_NONBLOCK)
 				return -EAGAIN;

@@ -616,7 +617,8 @@ static int iowarrior_open(struct inode *inode, struct file *file)
 	}
 
 	/* setup interrupt handler for receiving values */
-	if ((retval = usb_submit_urb(dev->int_in_urb, GFP_KERNEL)) < 0) {
+	retval = usb_submit_urb(dev->int_in_urb, GFP_KERNEL);
+	if (retval < 0) {
 		dev_err(&interface->dev, "Error %d while submitting URB\n", retval);
 		retval = -EFAULT;
 		goto out;

index 6f667dd..033610b 100644
@@ -2205,16 +2205,11 @@ static inline bool ib_is_udata_cleared(struct ib_udata *udata,
 	if (len > USHRT_MAX)
 		return false;
 
-	buf = kmalloc(len, GFP_KERNEL);
-	if (!buf)
+	buf = memdup_user(p, len);
+	if (IS_ERR(buf))
 		return false;
 
-	if (copy_from_user(buf, p, len))
-		goto free;
-
 	ret = !memchr_inv(buf, 0, len);
-
-free:
 	kfree(buf);
 	return ret;
 }

index 033610b..0d8100f 100644
@@ -2199,7 +2199,7 @@ static inline bool ib_is_udata_cleared(struct ib_udata *udata,
 				       size_t len)
 {
 	const void __user *p = udata->inbuf + offset;
-	bool ret = false;
+	bool ret;
 	u8 *buf;
 
 	if (len > USHRT_MAX)

index 6f667dd..0d8100f 100644
@@ -2199,22 +2199,17 @@ static inline bool ib_is_udata_cleared(struct ib_udata *udata,
 				       size_t len)
 {
 	const void __user *p = udata->inbuf + offset;
-	bool ret = false;
+	bool ret;
 	u8 *buf;
 
 	if (len > USHRT_MAX)
 		return false;
 
-	buf = kmalloc(len, GFP_KERNEL);
-	if (!buf)
+	buf = memdup_user(p, len);
+	if (IS_ERR(buf))
 		return false;
 
-	if (copy_from_user(buf, p, len))
-		goto free;
-
 	ret = !memchr_inv(buf, 0, len);
-
-free:
 	kfree(buf);
 	return ret;
 }

index e249a66..6492fe9 100644
@@ -2523,14 +2523,9 @@ static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
 	if (count = 0 || count > SMK_LONGLABEL)
 		return -EINVAL;
 
-	data = kzalloc(count, GFP_KERNEL);
-	if (data = NULL)
-		return -ENOMEM;
-
-	if (copy_from_user(data, buf, count) != 0) {
-		rc = -EFAULT;
-		goto out_data;
-	}
+	data = memdup_user(buf, count);
+	if (IS_ERR(data))
+		return PTR_ERR(data);
 
 	cp = smk_parse_smack(data, count);
 	if (IS_ERR(cp)) {

index 2c49848..583d407 100644
@@ -553,13 +553,9 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
 		 * we should allow parameter change only when stream has been
 		 * opened not in other cases
 		 */
-		params = kmalloc(sizeof(*params), GFP_KERNEL);
-		if (!params)
-			return -ENOMEM;
-		if (copy_from_user(params, (void __user *)arg, sizeof(*params))) {
-			retval = -EFAULT;
-			goto out;
-		}
+		params = memdup_user((void __user *)arg, sizeof(*params));
+		if (IS_ERR(params))
+			return PTR_ERR(params);
 
 		retval = snd_compress_check_input(params);
 		if (retval)

index 583d407..b43aec5 100644
@@ -545,14 +545,14 @@ static int snd_compress_check_input(struct snd_compr_params *params)
 static int
 snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
 {
-	struct snd_compr_params *params;
-	int retval;
-
 	if (stream->runtime->state == SNDRV_PCM_STATE_OPEN) {
 		/*
 		 * we should allow parameter change only when stream has been
 		 * opened not in other cases
 		 */
+		int retval;
+		struct snd_compr_params *params;
+
 		params = memdup_user((void __user *)arg, sizeof(*params));
 		if (IS_ERR(params))
 			return PTR_ERR(params);

@@ -578,12 +578,12 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
 			stream->runtime->state = SNDRV_PCM_STATE_SETUP;
 		else
 			stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
+out:
+		kfree(params);
+		return retval;
 	} else {
 		return -EPERM;
 	}
-out:
-	kfree(params);
-	return retval;
 }
 
 static int

index 2c49848..a10d139 100644
@@ -548,43 +548,41 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
 	struct snd_compr_params *params;
 	int retval;
 
-	if (stream->runtime->state == SNDRV_PCM_STATE_OPEN) {
-		/*
-		 * we should allow parameter change only when stream has been
-		 * opened not in other cases
-		 */
-		params = kmalloc(sizeof(*params), GFP_KERNEL);
-		if (!params)
-			return -ENOMEM;
-		if (copy_from_user(params, (void __user *)arg, sizeof(*params))) {
-			retval = -EFAULT;
-			goto out;
-		}
+	if (stream->runtime->state != SNDRV_PCM_STATE_OPEN)
+		return -EPERM;
+	/*
+	 * we should allow parameter change only when stream has been
+	 * opened not in other cases
+	 */
+	params = kmalloc(sizeof(*params), GFP_KERNEL);
+	if (!params)
+		return -ENOMEM;
+	if (copy_from_user(params, (void __user *)arg, sizeof(*params))) {
+		retval = -EFAULT;
+		goto out;
+	}
 
-		retval = snd_compress_check_input(params);
-		if (retval)
-			goto out;
+	retval = snd_compress_check_input(params);
+	if (retval)
+		goto out;
 
-		retval = snd_compr_allocate_buffer(stream, params);
-		if (retval) {
-			retval = -ENOMEM;
-			goto out;
-		}
+	retval = snd_compr_allocate_buffer(stream, params);
+	if (retval) {
+		retval = -ENOMEM;
+		goto out;
+	}
 
-		retval = stream->ops->set_params(stream, params);
-		if (retval)
-			goto out;
+	retval = stream->ops->set_params(stream, params);
+	if (retval)
+		goto out;
 
-		stream->metadata_set = false;
-		stream->next_track = false;
+	stream->metadata_set = false;
+	stream->next_track = false;
 
-		if (stream->direction == SND_COMPRESS_PLAYBACK)
-			stream->runtime->state = SNDRV_PCM_STATE_SETUP;
-		else
-			stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
-	} else {
-		return -EPERM;
-	}
+	if (stream->direction == SND_COMPRESS_PLAYBACK)
+		stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+	else
+		stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
 out:
 	kfree(params);
 	return retval;

index a10d139..786989b 100644
@@ -554,13 +554,9 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
 	 * we should allow parameter change only when stream has been
 	 * opened not in other cases
 	 */
-	params = kmalloc(sizeof(*params), GFP_KERNEL);
-	if (!params)
-		return -ENOMEM;
-	if (copy_from_user(params, (void __user *)arg, sizeof(*params))) {
-		retval = -EFAULT;
-		goto out;
-	}
+	params = memdup_user((void __user *)arg, sizeof(*params));
+	if (IS_ERR(params))
+		return PTR_ERR(params);
 
 	retval = snd_compress_check_input(params);
 	if (retval)

index 2081d8b..1632abc 100644
@@ -1532,7 +1532,9 @@ int cryptocop_new_session(cryptocop_session_id *sid, struct cryptocop_transform_
 		return -ENOMEM;
 	}
 
-	sess->tfrm_ctx = kmalloc(no_tfrms * sizeof(struct cryptocop_transform_ctx), alloc_flag);
+	sess->tfrm_ctx = kmalloc_array(no_tfrms,
+				       sizeof(*sess->tfrm_ctx),
+				       alloc_flag);
 	if (!sess->tfrm_ctx) {
 		DEBUG_API(printk("cryptocop_new_session, kmalloc cryptocop_transform_ctx\n"));
 		kfree(sess);

@@ -2697,7 +2699,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 	/* Map user pages for in and out data of the operation. */
 	noinpages = (((unsigned long int)(oper.indata + prev_ix) & ~PAGE_MASK) + oper.inlen - 1 - prev_ix + ~PAGE_MASK) >> PAGE_SHIFT;
 	DEBUG(printk("cryptocop_ioctl_process: noinpages=%d\n", noinpages));
-	inpages = kmalloc(noinpages * sizeof(struct page*), GFP_KERNEL);
+	inpages = kmalloc_array(noinpages, sizeof(*inpages), GFP_KERNEL);
 	if (!inpages){
 		DEBUG_API(printk("cryptocop_ioctl_process: kmalloc inpages\n"));
 		nooutpages = noinpages = 0;

@@ -2707,7 +2709,9 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 	if (oper.do_cipher){
 		nooutpages = (((unsigned long int)oper.cipher_outdata & ~PAGE_MASK) + oper.cipher_outlen - 1 + ~PAGE_MASK) >> PAGE_SHIFT;
 		DEBUG(printk("cryptocop_ioctl_process: nooutpages=%d\n", nooutpages));
-		outpages = kmalloc(nooutpages * sizeof(struct page*), GFP_KERNEL);
+		outpages = kmalloc_array(nooutpages,
+					 sizeof(*outpages),
+					 GFP_KERNEL);
 		if (!outpages){
 			DEBUG_API(printk("cryptocop_ioctl_process: kmalloc outpages\n"));
 			nooutpages = noinpages = 0;

@@ -2753,8 +2757,12 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 
 	/* Add 6 to nooutpages to make room for possibly inserted buffers for storing digest and
 	 * csum output and splits when units are (dis-)connected. */
-	cop->tfrm_op.indata = kmalloc((noinpages) * sizeof(struct iovec), GFP_KERNEL);
-	cop->tfrm_op.outdata = kmalloc((6 + nooutpages) * sizeof(struct iovec), GFP_KERNEL);
+	cop->tfrm_op.indata = kmalloc_array(noinpages,
+					    sizeof(*cop->tfrm_op.indata),
+					    GFP_KERNEL);
+	cop->tfrm_op.outdata = kmalloc_array(6 + nooutpages,
+					     sizeof(*cop->tfrm_op.outdata),
+					     GFP_KERNEL);
 	if (!cop->tfrm_op.indata || !cop->tfrm_op.outdata) {
 		DEBUG_API(printk("cryptocop_ioctl_process: kmalloc iovecs\n"));
 		err = -ENOMEM;

index 1632abc..8e04b92 100644
@@ -323,7 +323,7 @@ static struct cryptocop_dma_desc *alloc_cdesc(int alloc_flag)
 		spin_unlock_irqrestore(&descr_pool_lock, flags);
 		cdesc->from_pool = 1;
 	} else {
-		cdesc = kmalloc(sizeof(struct cryptocop_dma_desc), alloc_flag);
+		cdesc = kmalloc(sizeof(*cdesc), alloc_flag);
 		if (!cdesc) {
 			DEBUG_API(printk("alloc_cdesc: kmalloc\n"));
 			return NULL;

@@ -1526,7 +1526,7 @@ int cryptocop_new_session(cryptocop_session_id *sid, struct cryptocop_transform_
 		return -EINVAL;
 	}
 
-	sess = kmalloc(sizeof(struct cryptocop_session), alloc_flag);
+	sess = kmalloc(sizeof(*sess), alloc_flag);
 	if (!sess){
 		DEBUG_API(printk("cryptocop_new_session, kmalloc cryptocop_session\n"));
 		return -ENOMEM;

@@ -2247,7 +2247,7 @@ static int cryptocop_job_setup(struct cryptocop_prio_job **pj, struct cryptocop_
 	int  alloc_flag = operation->in_interrupt ? GFP_ATOMIC : GFP_KERNEL;
 	void *iop_alloc_ptr = NULL;
 
-	*pj = kmalloc(sizeof (struct cryptocop_prio_job), alloc_flag);
+	*pj = kmalloc(sizeof(**pj), alloc_flag);
 	if (!*pj) return -ENOMEM;
 
 	DEBUG(printk("cryptocop_job_setup: operation=0x%p\n", operation));

@@ -2552,12 +2552,12 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 		return -EFAULT;
 	}
 
-	cop = kmalloc(sizeof(struct cryptocop_operation), GFP_KERNEL);
+	cop = kmalloc(sizeof(*cop), GFP_KERNEL);
 	if (!cop) {
 		DEBUG_API(printk("cryptocop_ioctl_process: kmalloc\n"));
 		return -ENOMEM;
 	}
-	jc = kmalloc(sizeof(struct ioctl_job_cb_ctx), GFP_KERNEL);
+	jc = kmalloc(sizeof(*jc), GFP_KERNEL);
 	if (!jc) {
 		DEBUG_API(printk("cryptocop_ioctl_process: kmalloc\n"));
 		err = -ENOMEM;

@@ -3082,7 +3082,7 @@ static int cryptocop_ioctl_create_session(struct inode *inode, struct file *filp
 		ti_csum.next = tis;
 		tis = &ti_csum;
 	} /* (sop.csum != cryptocop_csum_none) */
-	dev = kmalloc(sizeof(struct cryptocop_private), GFP_KERNEL);
+	dev = kmalloc(sizeof(*dev), GFP_KERNEL);
 	if (!dev){
 		DEBUG_API(printk("create session, alloc dev\n"));
 		return -ENOMEM;

index 8e04b92..1165639 100644
@@ -352,11 +352,10 @@ static void setup_descr_chain(struct cryptocop_dma_desc *cd)
 {
 	DEBUG(printk("setup_descr_chain: entering\n"));
 	while (cd) {
-		if (cd->next) {
+		if (cd->next)
 			cd->dma_descr->next = (dma_descr_data*)virt_to_phys(cd->next->dma_descr);
-		} else {
+		else
 			cd->dma_descr->next = NULL;
-		}
 		cd = cd->next;
 	}
 	DEBUG(printk("setup_descr_chain: exit\n"));

@@ -996,13 +995,15 @@ static int cryptocop_setup_dma_list(struct cryptocop_operation *operation, struc
 
 			DEBUG(printk("cryptocop_setup_dma_list: parsing an operation descriptor configuration.\n"));
 			/* Get the local context for the transform and mark it as the output unit if it produces output. */
-			if (digest_ctx.tcfg && (digest_ctx.tcfg->tid = dcfg->tid)){
+			if (digest_ctx.tcfg &&
+			   (digest_ctx.tcfg->tid = dcfg->tid))
 				tc = &digest_ctx;
-			} else if (cipher_ctx.tcfg && (cipher_ctx.tcfg->tid = dcfg->tid)){
+			else if (cipher_ctx.tcfg &&
+				(cipher_ctx.tcfg->tid = dcfg->tid))
 				tc = &cipher_ctx;
-			} else if (csum_ctx.tcfg && (csum_ctx.tcfg->tid = dcfg->tid)){
+			else if (csum_ctx.tcfg &&
+				(csum_ctx.tcfg->tid = dcfg->tid))
 				tc = &csum_ctx;
-			}
 			if (!tc) {
 				DEBUG_API(printk("cryptocop_setup_dma_list: invalid transform %d specified in descriptor.\n", dcfg->tid));
 				failed = -EINVAL;

@@ -1047,13 +1048,12 @@ static int cryptocop_setup_dma_list(struct cryptocop_operation *operation, struc
 			}
 			if (tc->current_src != src_dma) {
 				/* Find the unit we are sourcing from. */
-				if (digest_ctx.unit_no = tc->current_src){
+				if (digest_ctx.unit_no = tc->current_src)
 					tc->curr_src = &digest_ctx;
-				} else if (cipher_ctx.unit_no = tc->current_src){
+				else if (cipher_ctx.unit_no = tc->current_src)
 					tc->curr_src = &cipher_ctx;
-				} else if (csum_ctx.unit_no = tc->current_src){
+				else if (csum_ctx.unit_no = tc->current_src)
 					tc->curr_src = &csum_ctx;
-				}
 				if ((tc->curr_src = tc) && (tc->unit_no != src_dma)){
 					DEBUG_API(printk("cryptocop_setup_dma_list: unit %d configured to source from itself.\n", tc->unit_no));
 					failed = -EINVAL;

@@ -1065,7 +1065,7 @@ static int cryptocop_setup_dma_list(struct cryptocop_operation *operation, struc
 
 			/* Detect source switch. */
 			DEBUG(printk("cryptocop_setup_dma_list: tc->active=%d tc->unit_no=%d tc->current_src=%d tc->previous_src=%d, tc->curr_src=0x%p, tc->prev_srv=0x%p\n", tc->active, tc->unit_no, tc->current_src, tc->previous_src, tc->curr_src, tc->prev_src));
-			if (tc->active && (tc->current_src != tc->previous_src)) {
+			if (tc->active && (tc->current_src != tc->previous_src))
 				/* Only allow source switch when both the old source unit and the new one have
 				 * no pending data to process (i.e. the consumed length must be a multiple of the
 				 * transform blocklength). */

@@ -1077,12 +1077,10 @@ static int cryptocop_setup_dma_list(struct cryptocop_operation *operation, struc
 					failed = -EINVAL;
 					goto error_cleanup;
 				}
-			}
 			/* Detect unit deactivation. */
-			if (dcfg->last) {
+			if (dcfg->last)
 				/* Length check of this is handled below. */
 				tc->done = 1;
-			}
 			dcfg = dcfg->next;
 		} /* while (dcfg) */
 		DEBUG(printk("cryptocop_setup_dma_list: parsing operation descriptor configuration complete.\n"));

@@ -1116,20 +1114,17 @@ static int cryptocop_setup_dma_list(struct cryptocop_operation *operation, struc
 
 		if (csum_ctx.active) {
 			csum_ctx.consumed += desc_len;
-			if (csum_ctx.done) {
+			if (csum_ctx.done)
 				csum_ctx.produced = 2;
-			}
 			DEBUG(printk("cryptocop_setup_dma_list: csum_ctx producing: consumed=%d, produced=%d, blocklength=%d.\n", csum_ctx.consumed, csum_ctx.produced, csum_ctx.blocklength));
 		}
 		if (digest_ctx.active) {
 			digest_ctx.consumed += desc_len;
-			if (digest_ctx.done) {
-				if (digest_ctx.unit_no = src_md5) {
+			if (digest_ctx.done)
+				if (digest_ctx.unit_no = src_md5)
 					digest_ctx.produced = MD5_STATE_LENGTH;
-				} else {
+				else
 					digest_ctx.produced = SHA1_STATE_LENGTH;
-				}
-			}
 			DEBUG(printk("cryptocop_setup_dma_list: digest_ctx producing: consumed=%d, produced=%d, blocklength=%d.\n", digest_ctx.consumed, digest_ctx.produced, digest_ctx.blocklength));
 		}
 		if (cipher_ctx.active) {

@@ -1137,9 +1132,11 @@ static int cryptocop_setup_dma_list(struct cryptocop_operation *operation, struc
 			assert(cipher_ctx.current_src = src_dma);
 			cipher_ctx.consumed += desc_len;
 			cipher_ctx.produced = cipher_ctx.blocklength * (cipher_ctx.consumed / cipher_ctx.blocklength);
-			if (cipher_ctx.cbcmode && !(cipher_ctx.tcfg->flags & CRYPTOCOP_EXPLICIT_IV) && cipher_ctx.produced){
+			if (cipher_ctx.cbcmode &&
+			    !(cipher_ctx.tcfg->flags
+			     & CRYPTOCOP_EXPLICIT_IV) &&
+			    cipher_ctx.produced)
 				cipher_ctx.produced -= cipher_ctx.blocklength; /* Compensate for CBC iv. */
-			}
 			DEBUG(printk("cryptocop_setup_dma_list: cipher_ctx producing: consumed=%d, produced=%d, blocklength=%d.\n", cipher_ctx.consumed, cipher_ctx.produced, cipher_ctx.blocklength));
 		}
 

@@ -1149,12 +1146,11 @@ static int cryptocop_setup_dma_list(struct cryptocop_operation *operation, struc
 		eop_needed_count = 0;
 		if (cipher_ctx.active) {
 			++active_count;
-			if (cipher_ctx.unit_no = src_dma){
+			if (cipher_ctx.unit_no = src_dma)
 				/* mem2mem */
 				meta_out.ciphsel = src_none;
-			} else {
+			else
 				meta_out.ciphsel = cipher_ctx.current_src;
-			}
 			meta_out.ciphconf = cipher_ctx.ciph_conf;
 			meta_out.cbcmode = cipher_ctx.cbcmode;
 			meta_out.decrypt = cipher_ctx.decrypt;

@@ -1223,12 +1219,11 @@ static int cryptocop_setup_dma_list(struct cryptocop_operation *operation, struc
 
 				assert(cipher_ctx.active && cipher_ctx.done);
 
-				if (cipher_ctx.unit_no = src_dma){
+				if (cipher_ctx.unit_no = src_dma)
 					/* mem2mem */
 					ed_mo.ciphsel = src_none;
-				} else {
+				else
 					ed_mo.ciphsel = cipher_ctx.current_src;
-				}
 				ed_mo.ciphconf = cipher_ctx.ciph_conf;
 				ed_mo.cbcmode = cipher_ctx.cbcmode;
 				ed_mo.decrypt = cipher_ctx.decrypt;

@@ -1596,13 +1591,11 @@ int cryptocop_free_session(cryptocop_session_id sid)
 		psess = sess;
 		sess = sess->next;
 	}
-	if (sess){
-		if (psess){
+	if (sess)
+		if (psess)
 			psess->next = sess->next;
-		} else {
+		else
 			cryptocop_sessions = sess->next;
-		}
-	}
 	spin_unlock_irqrestore(&cryptocop_sessions_lock, flags);
 
 	if (!sess) return -EINVAL;

@@ -1610,16 +1603,13 @@ int cryptocop_free_session(cryptocop_session_id sid)
 	/* Remove queued jobs. */
 	spin_lock_irqsave(&cryptocop_job_queue_lock, flags);
 
-	for (i = 0; i < cryptocop_prio_no_prios; i++){
-		if (!list_empty(&(cryptocop_job_queues[i].jobs))){
+	for (i = 0; i < cryptocop_prio_no_prios; i++)
+		if (!list_empty(&(cryptocop_job_queues[i].jobs)))
 			list_for_each_safe(node, tmp, &(cryptocop_job_queues[i].jobs)) {
 				pj = list_entry(node, struct cryptocop_prio_job, node);
-				if (pj->oper->sid = sid) {
+				if (pj->oper->sid = sid)
 					list_move_tail(node, &remove_list);
-				}
 			}
-		}
-	}
 	spin_unlock_irqrestore(&cryptocop_job_queue_lock, flags);
 
 	list_for_each_safe(node, tmp, &remove_list) {

@@ -1653,9 +1643,8 @@ static struct cryptocop_session *get_session(cryptocop_session_id sid)
 
 	spin_lock_irqsave(&cryptocop_sessions_lock, flags);
 	sess = cryptocop_sessions;
-	while (sess && (sess->sid != sid)){
+	while (sess && (sess->sid != sid))
 		sess = sess->next;
-	}
 	spin_unlock_irqrestore(&cryptocop_sessions_lock, flags);
 
 	return sess;

@@ -1779,9 +1768,8 @@ static void get_aes_decrypt_key(unsigned char *dec_key, const unsigned  char *ke
 
 	/* Need to do host byte order correction here since key is byte oriented and the
 	 * kx algorithm is word (u32) oriented. */
-	for (i = 0; i < nk; i+=1) {
+	for (i = 0; i < nk; ++i)
 		w_ring[i] = be32_to_cpu(*(u32*)&key[4*i]);
-	}
 
 	i = (int)nk;
 	w_last_ix = i - 1;

@@ -2055,8 +2043,8 @@ static void cryptocop_job_queue_close(void)
 	spin_lock_irqsave(&cryptocop_process_lock, process_flags);
 
 	/* Empty the job queue. */
-	for (i = 0; i < cryptocop_prio_no_prios; i++){
-		if (!list_empty(&(cryptocop_job_queues[i].jobs))){
+	for (i = 0; i < cryptocop_prio_no_prios; i++)
+		if (!list_empty(&(cryptocop_job_queues[i].jobs)))
 			list_for_each_safe(node, tmp, &(cryptocop_job_queues[i].jobs)) {
 				pj = list_entry(node, struct cryptocop_prio_job, node);
 				list_del(node);

@@ -2069,8 +2057,6 @@ static void cryptocop_job_queue_close(void)
 				delete_internal_operation(pj->iop);
 				kfree(pj);
 			}
-		}
-	}
 	spin_unlock_irqrestore(&cryptocop_process_lock, process_flags);
 
 	/* Remove the running job, if any. */

@@ -2321,9 +2307,8 @@ static int cryptocop_release(struct inode *inode, struct file *filp)
 
 	while (dev){
 		dev_next = dev->next;
-		if (dev->sid != CRYPTOCOP_SESSION_ID_NONE) {
+		if (dev->sid != CRYPTOCOP_SESSION_ID_NONE)
 			(void)cryptocop_free_session(dev->sid);
-		}
 		kfree(dev);
 		dev = dev_next;
 	}

@@ -2353,11 +2338,10 @@ static int cryptocop_ioctl_close_session(struct inode *inode, struct file *filp,
 		dev = dev->next;
 	}
 	if (dev){
-		if (prev_dev){
+		if (prev_dev)
 			prev_dev->next = dev->next;
-		} else {
+		else
 			filp->private_data = dev->next;
-		}
 		err = cryptocop_free_session(dev->sid);
 		if (err) return -EFAULT;
 	} else {

@@ -2401,27 +2385,24 @@ static size_t next_cfg_change_ix(struct strcop_crypto_op *crp_op, size_t ix)
 	size_t ch_ix = INT_MAX;
 	size_t tmp_ix = 0;
 
-	if (crp_op->do_cipher && ((crp_op->cipher_start + crp_op->cipher_len) > ix)){
-		if (crp_op->cipher_start > ix) {
+	if (crp_op->do_cipher &&
+	   ((crp_op->cipher_start + crp_op->cipher_len) > ix))
+		if (crp_op->cipher_start > ix)
 			ch_ix = crp_op->cipher_start;
-		} else {
+		else
 			ch_ix = crp_op->cipher_start + crp_op->cipher_len;
-		}
-	}
 	if (crp_op->do_digest && ((crp_op->digest_start + crp_op->digest_len) > ix)){
-		if (crp_op->digest_start > ix) {
+		if (crp_op->digest_start > ix)
 			tmp_ix = crp_op->digest_start;
-		} else {
+		else
 			tmp_ix = crp_op->digest_start + crp_op->digest_len;
-		}
 		if (tmp_ix < ch_ix) ch_ix = tmp_ix;
 	}
 	if (crp_op->do_csum && ((crp_op->csum_start + crp_op->csum_len) > ix)){
-		if (crp_op->csum_start > ix) {
+		if (crp_op->csum_start > ix)
 			tmp_ix = crp_op->csum_start;
-		} else {
+		else
 			tmp_ix = crp_op->csum_start + crp_op->csum_len;
-		}
 		if (tmp_ix < ch_ix) ch_ix = tmp_ix;
 	}
 	if (ch_ix = INT_MAX) ch_ix = ix;

@@ -2635,11 +2616,10 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 			return -EINVAL;
 		}
 
-		if (oper.decrypt){
+		if (oper.decrypt)
 			ciph_tcfg.flags |= CRYPTOCOP_DECRYPT;
-		} else {
+		else
 			ciph_tcfg.flags |= CRYPTOCOP_ENCRYPT;
-		}
 		ciph_tcfg.next = cop->tfrm_op.tfrm_cfg;
 		cop->tfrm_op.tfrm_cfg = &ciph_tcfg;
 	}

@@ -2861,11 +2841,10 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 		prev_ix = next_ix;
 		next_ix = next_cfg_change_ix(&oper, prev_ix);
 	}
-	if (desc_ix > 0){
+	if (desc_ix > 0)
 		descs[desc_ix-1].next = NULL;
-	} else {
+	else
 		descs[0].next = NULL;
-	}
 	if (oper.do_digest) {
 		DEBUG(printk("cryptocop_ioctl_process: mapping %d byte digest output to iovec %d\n", digest_length, iovix));
 		/* Add outdata iovec, length = <length of type of digest> */

@@ -2881,13 +2860,12 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 		cop->tfrm_op.outdata[iovix].iov_len = 2;
 		++iovix;
 	}
-	if (oper.do_cipher) {
+	if (oper.do_cipher)
 		if (!map_pages_to_iovec(cop->tfrm_op.outdata, iovlen, &iovix, outpages, nooutpages, &pageix, &pageoffset, oper.cipher_outlen)){
 			DEBUG_API(printk("cryptocop_ioctl_process: failed to map pages to iovec.\n"));
 			err = -ENOSYS; /* This should be impossible barring bugs. */
 			goto error_cleanup;
 		}
-	}
 	DEBUG(printk("cryptocop_ioctl_process: setting cop->tfrm_op.outcount %d\n", iovix));
 	cop->tfrm_op.outcount = iovix;
 	assert(iovix <= (nooutpages + 6));

@@ -2942,19 +2920,16 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 
  error_cleanup:
 	/* Release page caches. */
-	for (i = 0; i < noinpages; i++){
+	for (i = 0; i < noinpages; i++)
 		put_page(inpages[i]);
-	}
 	for (i = 0; i < nooutpages; i++){
 		int spdl_err;
 		/* Mark output pages dirty. */
 		spdl_err = set_page_dirty_lock(outpages[i]);
 		DEBUG(if (spdl_err < 0)printk("cryptocop_ioctl_process: set_page_dirty_lock returned %d\n", spdl_err));
 	}
-	for (i = 0; i < nooutpages; i++){
+	for (i = 0; i < nooutpages; i++)
 		put_page(outpages[i]);
-	}
-
 	kfree(digest_result);
 	kfree(inpages);
 	kfree(outpages);

@@ -2987,9 +2962,8 @@ static int cryptocop_ioctl_create_session(struct inode *inode, struct file *filp
 		return -EFAULT;
 	err = copy_from_user(&sop, sess_op, sizeof(struct strcop_session_op));
 	if (err) return -EFAULT;
-	if (sop.cipher != cryptocop_cipher_none) {
+	if (sop.cipher != cryptocop_cipher_none)
 		if (!access_ok(VERIFY_READ, sop.key, sop.keylen)) return -EFAULT;
-	}
 	DEBUG(printk("cryptocop_ioctl_create_session, sess_op:\n"));
 
 	DEBUG(printk("\tcipher:%d\n"

@@ -3362,23 +3336,21 @@ static void print_cryptocop_operation(struct cryptocop_operation *cop)
 			d = d->next;
 		}
 		printk("\n==iniov\n");
-		for (i = 0; i < cop->tfrm_op.incount; i++){
+		for (i = 0; i < cop->tfrm_op.incount; i++)
 			printk("indata[%d]\n"
 			       "base=0x%p\n"
 			       "len=%d\n",
 			       i,
 			       cop->tfrm_op.indata[i].iov_base,
 			       cop->tfrm_op.indata[i].iov_len);
-		}
 		printk("\n==outiov\n");
-		for (i = 0; i < cop->tfrm_op.outcount; i++){
+		for (i = 0; i < cop->tfrm_op.outcount; i++)
 			printk("outdata[%d]\n"
 			       "base=0x%p\n"
 			       "len=%d\n",
 			       i,
 			       cop->tfrm_op.outdata[i].iov_base,
 			       cop->tfrm_op.outdata[i].iov_len);
-		}
 	}
 	printk("------------end print_cryptocop_operation\n");
 }

index 1165639..26347a2 100644
@@ -2542,7 +2542,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 	if (!jc) {
 		DEBUG_API(printk("cryptocop_ioctl_process: kmalloc\n"));
 		err = -ENOMEM;
-		goto error_cleanup;
+		goto free_cop;
 	}
 	jc->processed = 0;
 

@@ -2575,7 +2575,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 		if (!tc) {
 			DEBUG_API(printk("cryptocop_ioctl_process: no cipher transform in session.\n"));
 			err = -EINVAL;
-			goto error_cleanup;
+			goto free_jc;
 		}
 		ciph_tcfg.tid = CRYPTOCOP_IOCTL_CIPHER_TID;
 		ciph_tcfg.inject_ix = 0;

@@ -2628,14 +2628,14 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 		if (!tc) {
 			DEBUG_API(printk("cryptocop_ioctl_process: no digest transform in session.\n"));
 			err = -EINVAL;
-			goto error_cleanup;
+			goto free_jc;
 		}
 		digest_length = tc->init.alg = cryptocop_alg_md5 ? 16 : 20;
 		digest_result = kmalloc(digest_length, GFP_KERNEL);
 		if (!digest_result) {
 			DEBUG_API(printk("cryptocop_ioctl_process: kmalloc digest_result\n"));
 			err = -EINVAL;
-			goto error_cleanup;
+			goto free_jc;
 		}
 		DEBUG(memset(digest_result, 0xff, digest_length));
 

@@ -2645,7 +2645,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 		if ((oper.digest_start < 0) || (oper.digest_len <= 0) || (oper.digest_start > oper.inlen) || ((oper.digest_start + oper.digest_len) > oper.inlen)){
 			DEBUG_API(printk("cryptocop_ioctl_process: bad digest length\n"));
 			err = -EINVAL;
-			goto error_cleanup;
+			goto free_digest;
 		}
 
 		digest_tcfg.next = cop->tfrm_op.tfrm_cfg;

@@ -2670,9 +2670,8 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 	prev_ix = first_cfg_change_ix(&oper);
 	if (prev_ix > oper.inlen) {
 		DEBUG_API(printk("cryptocop_ioctl_process: length mismatch\n"));
-		nooutpages = noinpages = 0;
 		err = -EINVAL;
-		goto error_cleanup;
+		goto free_digest;
 	}
 	DEBUG(printk("cryptocop_ioctl_process: inlen=%d, cipher_outlen=%d\n", oper.inlen, oper.cipher_outlen));
 

@@ -2682,9 +2681,8 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 	inpages = kmalloc_array(noinpages, sizeof(*inpages), GFP_KERNEL);
 	if (!inpages){
 		DEBUG_API(printk("cryptocop_ioctl_process: kmalloc inpages\n"));
-		nooutpages = noinpages = 0;
 		err = -ENOMEM;
-		goto error_cleanup;
+		goto free_digest;
 	}
 	if (oper.do_cipher){
 		nooutpages = (((unsigned long int)oper.cipher_outdata & ~PAGE_MASK) + oper.cipher_outlen - 1 + ~PAGE_MASK) >> PAGE_SHIFT;

@@ -2694,9 +2692,8 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 					 GFP_KERNEL);
 		if (!outpages){
 			DEBUG_API(printk("cryptocop_ioctl_process: kmalloc outpages\n"));
-			nooutpages = noinpages = 0;
 			err = -ENOMEM;
-			goto error_cleanup;
+			goto free_inpages;
 		}
 	}
 

@@ -2712,9 +2709,8 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 
 	if (err < 0) {
 		up_read(&current->mm->mmap_sem);
-		nooutpages = noinpages = 0;
 		DEBUG_API(printk("cryptocop_ioctl_process: get_user_pages indata\n"));
-		goto error_cleanup;
+		goto free_outpages;
 	}
 	noinpages = err;
 	if (oper.do_cipher){

@@ -2726,9 +2722,8 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 				     NULL);
 		up_read(&current->mm->mmap_sem);
 		if (err < 0) {
-			nooutpages = 0;
 			DEBUG_API(printk("cryptocop_ioctl_process: get_user_pages outdata\n"));
-			goto error_cleanup;
+			goto put_inpages;
 		}
 		nooutpages = err;
 	} else {

@@ -2740,13 +2735,18 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 	cop->tfrm_op.indata = kmalloc_array(noinpages,
 					    sizeof(*cop->tfrm_op.indata),
 					    GFP_KERNEL);
+	if (!cop->tfrm_op.indata) {
+		DEBUG_API(printk("cryptocop_ioctl_process: kmalloc indata\n"));
+		err = -ENOMEM;
+		goto put_outpages;
+	}
 	cop->tfrm_op.outdata = kmalloc_array(6 + nooutpages,
 					     sizeof(*cop->tfrm_op.outdata),
 					     GFP_KERNEL);
-	if (!cop->tfrm_op.indata || !cop->tfrm_op.outdata) {
-		DEBUG_API(printk("cryptocop_ioctl_process: kmalloc iovecs\n"));
+	if (!cop->tfrm_op.outdata) {
+		DEBUG_API(printk("cryptocop_ioctl_process: kmalloc outdata\n"));
 		err = -ENOMEM;
-		goto error_cleanup;
+		goto free_indata;
 	}
 
 	cop->tfrm_op.inlen = oper.inlen - prev_ix;

@@ -2780,7 +2780,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 	if (prev_ix = next_ix){
 		DEBUG_API(printk("cryptocop_ioctl_process: length configuration broken.\n"));
 		err = -EINVAL;  /* This should be impossible barring bugs. */
-		goto error_cleanup;
+		goto free_outdata;
 	}
 	while (prev_ix != next_ix){
 		end_digest = end_csum = cipher_active = digest_active = csum_active = 0;

@@ -2834,7 +2834,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 		if (!descs[desc_ix].cfg){
 			DEBUG_API(printk("cryptocop_ioctl_process: data segment %d (%d to %d) had no active transforms\n", desc_ix, prev_ix, next_ix));
 			err = -EINVAL;
-			goto error_cleanup;
+			goto mark_outpages_dirty;
 		}
 		descs[desc_ix].next = &(descs[desc_ix]) + 1;
 		++desc_ix;

@@ -2864,7 +2864,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 		if (!map_pages_to_iovec(cop->tfrm_op.outdata, iovlen, &iovix, outpages, nooutpages, &pageix, &pageoffset, oper.cipher_outlen)){
 			DEBUG_API(printk("cryptocop_ioctl_process: failed to map pages to iovec.\n"));
 			err = -ENOSYS; /* This should be impossible barring bugs. */
-			goto error_cleanup;
+			goto mark_outpages_dirty;
 		}
 	DEBUG(printk("cryptocop_ioctl_process: setting cop->tfrm_op.outcount %d\n", iovix));
 	cop->tfrm_op.outcount = iovix;

@@ -2878,7 +2878,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 	if ((err = cryptocop_job_queue_insert_user_job(cop)) != 0) {
 		DEBUG_API(printk("cryptocop_ioctl_process: insert job %d\n", err));
 		err = -EINVAL;
-		goto error_cleanup;
+		goto mark_outpages_dirty;
 	}
 
 	DEBUG(printk("cryptocop_ioctl_process: begin wait for result\n"));

@@ -2888,7 +2888,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
         if (!jc->processed){
 		printk(KERN_WARNING "cryptocop_ioctl_process: job not processed at completion\n");
 		err = -EIO;
-		goto error_cleanup;
+		goto mark_outpages_dirty;
 	}
 
 	/* Job process done.  Cipher output should already be correct in job so no post processing of outdata. */

@@ -2900,7 +2900,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 			if (0 != err){
 				DEBUG_API(printk("cryptocop_ioctl_process: copy_to_user, digest length %d, err %d\n", digest_length, err));
 				err = -EFAULT;
-				goto error_cleanup;
+				goto mark_outpages_dirty;
 			}
 		}
 		if (oper.do_csum){

@@ -2909,7 +2909,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 			if (0 != err){
 				DEBUG_API(printk("cryptocop_ioctl_process: copy_to_user, csum, err %d\n", err));
 				err = -EFAULT;
-				goto error_cleanup;
+				goto mark_outpages_dirty;
 			}
 		}
 		err = 0;

@@ -2917,29 +2917,33 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 		DEBUG(printk("cryptocop_ioctl_process: returning err = operation_status = %d\n", cop->operation_status));
 		err = cop->operation_status;
 	}
-
- error_cleanup:
-	/* Release page caches. */
-	for (i = 0; i < noinpages; i++)
-		put_page(inpages[i]);
+ mark_outpages_dirty:
 	for (i = 0; i < nooutpages; i++){
 		int spdl_err;
 		/* Mark output pages dirty. */
 		spdl_err = set_page_dirty_lock(outpages[i]);
 		DEBUG(if (spdl_err < 0)printk("cryptocop_ioctl_process: set_page_dirty_lock returned %d\n", spdl_err));
 	}
+ free_outdata:
+	kfree(cop->tfrm_op.outdata);
+ free_indata:
+	kfree(cop->tfrm_op.indata);
+ put_outpages:
 	for (i = 0; i < nooutpages; i++)
 		put_page(outpages[i]);
-	kfree(digest_result);
-	kfree(inpages);
+ put_inpages:
+	for (i = 0; i < noinpages; i++)
+		put_page(inpages[i]);
+ free_outpages:
 	kfree(outpages);
-	if (cop){
-		kfree(cop->tfrm_op.indata);
-		kfree(cop->tfrm_op.outdata);
-		kfree(cop);
-	}
+ free_inpages:
+	kfree(inpages);
+ free_digest:
+	kfree(digest_result);
+ free_jc:
 	kfree(jc);
-
+ free_cop:
+	kfree(cop);
 	DEBUG(print_lock_status());
 
 	return err;

index 26347a2..cd34723 100644
@@ -2469,7 +2469,7 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 	struct page                     **inpages = NULL;
 	struct page                     **outpages = NULL;
 	int                             noinpages = 0;
-	int                             nooutpages = 0;
+	int                             nooutpages;
 
 	struct cryptocop_desc           descs[5]; /* Max 5 descriptors are needed, there are three transforms that
 						   * can get connected/disconnected on different places in the indata. */

@@ -2695,6 +2695,8 @@ static int cryptocop_ioctl_process(struct inode *inode, struct file *filp, unsig
 			err = -ENOMEM;
 			goto free_inpages;
 		}
+	} else {
+		nooutpages = 0;
 	}
 
 	/* Acquire the mm page semaphore. */