1034 	uint64_t *points;  in drm_syncobj_array_wait_timeout()  local
1040 	points = kmalloc_array(count, sizeof(*points), GFP_KERNEL);  in drm_syncobj_array_wait_timeout()
1041 	if (points == NULL)  in drm_syncobj_array_wait_timeout()
1045 		memset(points, 0, count * sizeof(uint64_t));  in drm_syncobj_array_wait_timeout()
1047 	} else if (copy_from_user(points, user_points,  in drm_syncobj_array_wait_timeout()
1068 		entries[i].point = points[i];  in drm_syncobj_array_wait_timeout()
1070 		if (!fence || dma_fence_chain_find_seqno(&fence, points[i])) {  in drm_syncobj_array_wait_timeout()
1166 	kfree(points);  in drm_syncobj_array_wait_timeout()
1226 							 u64_to_user_ptr(timeline_wait->points),  in drm_syncobj_array_wait()
1520 	uint64_t *points;  in drm_syncobj_timeline_signal_ioctl()  local
1540 	points = kmalloc_array(args->count_handles, sizeof(*points),  in drm_syncobj_timeline_signal_ioctl()
1542 	if (!points) {  in drm_syncobj_timeline_signal_ioctl()
1546 	if (!u64_to_user_ptr(args->points)) {  in drm_syncobj_timeline_signal_ioctl()
1547 		memset(points, 0, args->count_handles * sizeof(uint64_t));  in drm_syncobj_timeline_signal_ioctl()
1548 	} else if (copy_from_user(points, u64_to_user_ptr(args->points),  in drm_syncobj_timeline_signal_ioctl()
1573 				      fence, points[i]);  in drm_syncobj_timeline_signal_ioctl()
1579 	kfree(points);  in drm_syncobj_timeline_signal_ioctl()
1591 	uint64_t __user *points = u64_to_user_ptr(args->points);  in drm_syncobj_query_ioctl()  local
1645 		ret = copy_to_user(&points[i], &point, sizeof(uint64_t));  in drm_syncobj_query_ioctl()