298 	unsigned char __user *data_ptr;  in snd_sb_csp_riff_load()  local
311 	data_ptr = mcode->data;  in snd_sb_csp_riff_load()
313 	if (copy_from_user(&file_h, data_ptr, sizeof(file_h)))  in snd_sb_csp_riff_load()
320 	data_ptr += sizeof(file_h);  in snd_sb_csp_riff_load()
321 	data_end = data_ptr + le32_to_cpu(file_h.len);  in snd_sb_csp_riff_load()
323 	if (copy_from_user(&item_type, data_ptr, sizeof(item_type)))  in snd_sb_csp_riff_load()
329 	data_ptr += sizeof (item_type);  in snd_sb_csp_riff_load()
331 	for (; data_ptr < data_end; data_ptr += le32_to_cpu(item_h.len)) {  in snd_sb_csp_riff_load()
332 		if (copy_from_user(&item_h, data_ptr, sizeof(item_h)))  in snd_sb_csp_riff_load()
334 		data_ptr += sizeof(item_h);  in snd_sb_csp_riff_load()
338 		if (copy_from_user(&item_type, data_ptr, sizeof(item_type)))  in snd_sb_csp_riff_load()
342 			if (copy_from_user(&funcdesc_h, data_ptr + sizeof(item_type), sizeof(funcdesc_h)))  in snd_sb_csp_riff_load()
349 			data_ptr += sizeof(item_type);  in snd_sb_csp_riff_load()
361 				if (data_ptr >= data_end)  in snd_sb_csp_riff_load()
363 				if (copy_from_user(&code_h, data_ptr, sizeof(code_h)))  in snd_sb_csp_riff_load()
369 				data_ptr += sizeof(code_h);  in snd_sb_csp_riff_load()
370 				err = snd_sb_csp_load_user(p, data_ptr, le32_to_cpu(code_h.len),  in snd_sb_csp_riff_load()
374 				data_ptr += le32_to_cpu(code_h.len);  in snd_sb_csp_riff_load()
377 			if (copy_from_user(&code_h, data_ptr, sizeof(code_h)))  in snd_sb_csp_riff_load()
384 			data_ptr += sizeof(code_h);  in snd_sb_csp_riff_load()
385 			err = snd_sb_csp_load_user(p, data_ptr,  in snd_sb_csp_riff_load()