2109 			       unsigned long *sk_offset,  in copy_to_sk()  argument
2157 		if (sizeof(sh) + item_len + *sk_offset > *buf_size) {  in copy_to_sk()
2174 		if (copy_to_user_nofault(ubuf + *sk_offset, &sh, sizeof(sh))) {  in copy_to_sk()
2179 		*sk_offset += sizeof(sh);  in copy_to_sk()
2182 			char __user *up = ubuf + *sk_offset;  in copy_to_sk()
2190 				*sk_offset -= sizeof(sh);  in copy_to_sk()
2194 			*sk_offset += item_len;  in copy_to_sk()
2248 	unsigned long sk_offset = 0;  in search_ioctl()  local
2275 		ret = fault_in_pages_writeable(ubuf + sk_offset,  in search_ioctl()
2276 					       *buf_size - sk_offset);  in search_ioctl()
2287 				 &sk_offset, &num_found);  in search_ioctl()