--- /dev/null
+From fd3ba42c76d3d4b776120c2b24c1791e7bb3deb1 Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <frediano.ziglio@citrix.com>
+Date: Tue, 7 Aug 2012 04:33:03 -0500
+Subject: Convert properly UTF-8 to UTF-16
+
+From: Frediano Ziglio <frediano.ziglio@citrix.com>
+
+commit fd3ba42c76d3d4b776120c2b24c1791e7bb3deb1 upstream.
+
+wchar_t is currently 16bit so converting a utf8 encoded characters not
+in plane 0 (>= 0x10000) to wchar_t (that is calling char2uni) lead to a
+-EINVAL return. This patch detect utf8 in cifs_strtoUTF16 and add special
+code calling utf8s_to_utf16s.
+
+Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
+Acked-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <smfrench@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/cifs_unicode.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/fs/cifs/cifs_unicode.c
++++ b/fs/cifs/cifs_unicode.c
+@@ -203,6 +203,27 @@ cifs_strtoUCS(__le16 *to, const char *fr
+ int i;
+ wchar_t wchar_to; /* needed to quiet sparse */
+
++ /* special case for utf8 to handle no plane0 chars */
++ if (!strcmp(codepage->charset, "utf8")) {
++ /*
++ * convert utf8 -> utf16, we assume we have enough space
++ * as caller should have assumed conversion does not overflow
++ * in destination len is length in wchar_t units (16bits)
++ */
++ i = utf8s_to_utf16s(from, len, UTF16_LITTLE_ENDIAN,
++ (wchar_t *) to, len);
++
++ /* if success terminate and exit */
++ if (i >= 0)
++ goto success;
++ /*
++ * if fails fall back to UCS encoding as this
++ * function should not return negative values
++ * currently can fail only if source contains
++ * invalid encoded characters
++ */
++ }
++
+ for (i = 0; len && *from; i++, from += charlen, len -= charlen) {
+ charlen = codepage->char2uni(from, len, &wchar_to);
+ if (charlen < 1) {
+@@ -215,6 +236,7 @@ cifs_strtoUCS(__le16 *to, const char *fr
+ put_unaligned_le16(wchar_to, &to[i]);
+ }
+
++success:
+ put_unaligned_le16(0, &to[i]);
+ return i;
+ }
--- /dev/null
+From d1f55c680e5d021e7066f4461dd678d42af18898 Mon Sep 17 00:00:00 2001
+From: Alexander Shiyan <shc_work@mail.ru>
+Date: Wed, 15 Aug 2012 20:28:05 +0400
+Subject: mtd: autcpu12-nvram: Fix compile breakage
+
+From: Alexander Shiyan <shc_work@mail.ru>
+
+commit d1f55c680e5d021e7066f4461dd678d42af18898 upstream.
+
+Update driver autcpu12-nvram.c so it compiles; map_read32/map_write32
+no longer exist in the kernel so the driver is totally broken.
+Additionally, map_info name passed to simple_map_init is incorrect.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/maps/autcpu12-nvram.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/mtd/maps/autcpu12-nvram.c
++++ b/drivers/mtd/maps/autcpu12-nvram.c
+@@ -43,7 +43,8 @@ struct map_info autcpu12_sram_map = {
+
+ static int __init init_autcpu12_sram (void)
+ {
+- int err, save0, save1;
++ map_word tmp, save0, save1;
++ int err;
+
+ autcpu12_sram_map.virt = ioremap(0x12000000, SZ_128K);
+ if (!autcpu12_sram_map.virt) {
+@@ -51,7 +52,7 @@ static int __init init_autcpu12_sram (vo
+ err = -EIO;
+ goto out;
+ }
+- simple_map_init(&autcpu_sram_map);
++ simple_map_init(&autcpu12_sram_map);
+
+ /*
+ * Check for 32K/128K
+@@ -61,20 +62,22 @@ static int __init init_autcpu12_sram (vo
+ * Read and check result on ofs 0x0
+ * Restore contents
+ */
+- save0 = map_read32(&autcpu12_sram_map,0);
+- save1 = map_read32(&autcpu12_sram_map,0x10000);
+- map_write32(&autcpu12_sram_map,~save0,0x10000);
++ save0 = map_read(&autcpu12_sram_map, 0);
++ save1 = map_read(&autcpu12_sram_map, 0x10000);
++ tmp.x[0] = ~save0.x[0];
++ map_write(&autcpu12_sram_map, tmp, 0x10000);
+ /* if we find this pattern on 0x0, we have 32K size
+ * restore contents and exit
+ */
+- if ( map_read32(&autcpu12_sram_map,0) != save0) {
+- map_write32(&autcpu12_sram_map,save0,0x0);
++ tmp = map_read(&autcpu12_sram_map, 0);
++ if (!map_word_equal(&autcpu12_sram_map, tmp, save0)) {
++ map_write(&autcpu12_sram_map, save0, 0x0);
+ goto map;
+ }
+ /* We have a 128K found, restore 0x10000 and set size
+ * to 128K
+ */
+- map_write32(&autcpu12_sram_map,save1,0x10000);
++ map_write(&autcpu12_sram_map, save1, 0x10000);
+ autcpu12_sram_map.size = SZ_128K;
+
+ map:
--- /dev/null
+From 7bb9c75436212813b38700c34df4bbb6eb82debe Mon Sep 17 00:00:00 2001
+From: Shmulik Ladkani <shmulik.ladkani@gmail.com>
+Date: Sun, 10 Jun 2012 13:58:12 +0300
+Subject: mtd: nand: Use the mirror BBT descriptor when reading its version
+
+From: Shmulik Ladkani <shmulik.ladkani@gmail.com>
+
+commit 7bb9c75436212813b38700c34df4bbb6eb82debe upstream.
+
+The code responsible for reading the version of the mirror bbt was
+incorrectly using the descriptor of the main bbt.
+
+Pass the mirror bbt descriptor to 'scan_read_raw' when reading the
+version of the mirror bbt.
+
+Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
+Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/nand_bbt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/nand_bbt.c
++++ b/drivers/mtd/nand/nand_bbt.c
+@@ -429,7 +429,7 @@ static int read_abs_bbts(struct mtd_info
+ /* Read the mirror version, if available */
+ if (md && (md->options & NAND_BBT_VERSION)) {
+ scan_read_raw(mtd, buf, (loff_t)md->pages[0] << this->page_shift,
+- mtd->writesize, td);
++ mtd->writesize, md);
+ md->version[0] = buf[bbt_get_ver_offs(mtd, md)];
+ printk(KERN_DEBUG "Bad block table at page %d, version 0x%02X\n",
+ md->pages[0], md->version[0]);
--- /dev/null
+From bb0a13a13411c4ce24c48c8ff3cdf7b48d237240 Mon Sep 17 00:00:00 2001
+From: Richard Genoud <richard.genoud@gmail.com>
+Date: Wed, 12 Sep 2012 14:26:26 +0200
+Subject: mtd: nandsim: bugfix: fail if overridesize is too big
+
+From: Richard Genoud <richard.genoud@gmail.com>
+
+commit bb0a13a13411c4ce24c48c8ff3cdf7b48d237240 upstream.
+
+If override size is too big, the module was actually loaded instead of
+failing, because retval was not set.
+
+This lead to memory corruption with the use of the freed structs nandsim
+and nand_chip.
+
+Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/nandsim.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/nand/nandsim.c
++++ b/drivers/mtd/nand/nandsim.c
+@@ -2355,6 +2355,7 @@ static int __init ns_init_module(void)
+ uint64_t new_size = (uint64_t)nsmtd->erasesize << overridesize;
+ if (new_size >> overridesize != nsmtd->erasesize) {
+ NS_ERR("overridesize is too big\n");
++ retval = -EINVAL;
+ goto err_exit;
+ }
+ /* N.B. This relies on nand_scan not doing anything with the size before we change it */
--- /dev/null
+From 4d3d688da8e7016f15483e9319b41311e1db9515 Mon Sep 17 00:00:00 2001
+From: Andreas Bießmann <andreas@biessmann.de>
+Date: Fri, 31 Aug 2012 13:35:42 +0200
+Subject: mtd: omap2: fix module loading
+
+From: Andreas Bießmann <andreas@biessmann.de>
+
+commit 4d3d688da8e7016f15483e9319b41311e1db9515 upstream.
+
+Unloading the omap2 nand driver missed to release the memory region which will
+result in not being able to request it again if one want to load the driver
+later on.
+
+This patch fixes following error when loading omap2 module after unloading:
+---8<---
+~ $ rmmod omap2
+~ $ modprobe omap2
+[ 37.420928] omap2-nand: probe of omap2-nand.0 failed with error -16
+~ $
+--->8---
+
+This error was introduced in 67ce04bf2746f8a1f8c2a104b313d20c63f68378 which
+was the first commit of this driver.
+
+Signed-off-by: Andreas Bießmann <andreas@biessmann.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/omap2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mtd/nand/omap2.c
++++ b/drivers/mtd/nand/omap2.c
+@@ -1139,6 +1139,7 @@ static int omap_nand_remove(struct platf
+ /* Release NAND device, its internal structures and partitions */
+ nand_release(&info->mtd);
+ iounmap(info->nand.IO_ADDR_R);
++ release_mem_region(info->phys_base, NAND_IO_SIZE);
+ kfree(info);
+ return 0;
+ }
--- /dev/null
+From 7d9b110269253b1d5858cfa57d68dfc7bf50dd77 Mon Sep 17 00:00:00 2001
+From: Andreas Bießmann <andreas@biessmann.de>
+Date: Fri, 31 Aug 2012 13:35:41 +0200
+Subject: mtd: omap2: fix omap_nand_remove segfault
+
+From: Andreas Bießmann <andreas@biessmann.de>
+
+commit 7d9b110269253b1d5858cfa57d68dfc7bf50dd77 upstream.
+
+Do not kfree() the mtd_info; it is handled in the mtd subsystem and
+already freed by nand_release(). Instead kfree() the struct
+omap_nand_info allocated in omap_nand_probe which was not freed before.
+
+This patch fixes following error when unloading the omap2 module:
+
+---8<---
+~ $ rmmod omap2
+------------[ cut here ]------------
+kernel BUG at mm/slab.c:3126!
+Internal error: Oops - BUG: 0 [#1] PREEMPT ARM
+Modules linked in: omap2(-)
+CPU: 0 Not tainted (3.6.0-rc3-00230-g155e36d-dirty #3)
+PC is at cache_free_debugcheck+0x2d4/0x36c
+LR is at kfree+0xc8/0x2ac
+pc : [<c01125a0>] lr : [<c0112efc>] psr: 200d0193
+sp : c521fe08 ip : c0e8ef90 fp : c521fe5c
+r10: bf0001fc r9 : c521e000 r8 : c0d99c8c
+r7 : c661ebc0 r6 : c065d5a4 r5 : c65c4060 r4 : c78005c0
+r3 : 00000000 r2 : 00001000 r1 : c65c4000 r0 : 00000001
+Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
+Control: 10c5387d Table: 86694019 DAC: 00000015
+Process rmmod (pid: 549, stack limit = 0xc521e2f0)
+Stack: (0xc521fe08 to 0xc5220000)
+fe00: c008a874 c00bf44c c515c6d0 200d0193 c65c4860 c515c240
+fe20: c521fe3c c521fe30 c008a9c0 c008a854 c521fe5c c65c4860 c78005c0 bf0001fc
+fe40: c780ff40 a00d0113 c521e000 00000000 c521fe84 c521fe60 c0112efc c01122d8
+fe60: c65c4860 c0673778 c06737ac 00000000 00070013 00000000 c521fe9c c521fe88
+fe80: bf0001fc c0112e40 c0673778 bf001ca8 c521feac c521fea0 c02ca11c bf0001ac
+fea0: c521fec4 c521feb0 c02c82c4 c02ca100 c0673778 bf001ca8 c521fee4 c521fec8
+fec0: c02c8dd8 c02c8250 00000000 bf001ca8 bf001ca8 c0804ee0 c521ff04 c521fee8
+fee0: c02c804c c02c8d20 bf001924 00000000 bf001ca8 c521e000 c521ff1c c521ff08
+ff00: c02c950c c02c7fbc bf001d48 00000000 c521ff2c c521ff20 c02ca3a4 c02c94b8
+ff20: c521ff3c c521ff30 bf001938 c02ca394 c521ffa4 c521ff40 c009beb4 bf001930
+ff40: c521ff6c 70616d6f b6fe0032 c0014f84 70616d6f b6fe0032 00000081 60070010
+ff60: c521ff84 c521ff70 c008e1f4 c00bf328 0001a004 70616d6f c521ff94 0021ff88
+ff80: c008e368 0001a004 70616d6f b6fe0032 00000081 c0015028 00000000 c521ffa8
+ffa0: c0014dc0 c009bcd0 0001a004 70616d6f bec2ab38 00000880 bec2ab38 00000880
+ffc0: 0001a004 70616d6f b6fe0032 00000081 00000319 00000000 b6fe1000 00000000
+ffe0: bec2ab30 bec2ab20 00019f00 b6f539c0 60070010 bec2ab38 aaaaaaaa aaaaaaaa
+Backtrace:
+[<c01122cc>] (cache_free_debugcheck+0x0/0x36c) from [<c0112efc>] (kfree+0xc8/0x2ac)
+[<c0112e34>] (kfree+0x0/0x2ac) from [<bf0001fc>] (omap_nand_remove+0x5c/0x64 [omap2])
+[<bf0001a0>] (omap_nand_remove+0x0/0x64 [omap2]) from [<c02ca11c>] (platform_drv_remove+0x28/0x2c)
+ r5:bf001ca8 r4:c0673778
+[<c02ca0f4>] (platform_drv_remove+0x0/0x2c) from [<c02c82c4>] (__device_release_driver+0x80/0xdc)
+[<c02c8244>] (__device_release_driver+0x0/0xdc) from [<c02c8dd8>] (driver_detach+0xc4/0xc8)
+ r5:bf001ca8 r4:c0673778
+[<c02c8d14>] (driver_detach+0x0/0xc8) from [<c02c804c>] (bus_remove_driver+0x9c/0x104)
+ r6:c0804ee0 r5:bf001ca8 r4:bf001ca8 r3:00000000
+[<c02c7fb0>] (bus_remove_driver+0x0/0x104) from [<c02c950c>] (driver_unregister+0x60/0x80)
+ r6:c521e000 r5:bf001ca8 r4:00000000 r3:bf001924
+[<c02c94ac>] (driver_unregister+0x0/0x80) from [<c02ca3a4>] (platform_driver_unregister+0x1c/0x20)
+ r5:00000000 r4:bf001d48
+[<c02ca388>] (platform_driver_unregister+0x0/0x20) from [<bf001938>] (omap_nand_driver_exit+0x14/0x1c [omap2])
+[<bf001924>] (omap_nand_driver_exit+0x0/0x1c [omap2]) from [<c009beb4>] (sys_delete_module+0x1f0/0x2ec)
+[<c009bcc4>] (sys_delete_module+0x0/0x2ec) from [<c0014dc0>] (ret_fast_syscall+0x0/0x48)
+ r8:c0015028 r7:00000081 r6:b6fe0032 r5:70616d6f r4:0001a004
+Code: e1a00005 eb0d9172 e7f001f2 e7f001f2 (e7f001f2)
+---[ end trace 6a30b24d8c0cc2ee ]---
+Segmentation fault
+--->8---
+
+This error was introduced in 67ce04bf2746f8a1f8c2a104b313d20c63f68378 which
+was the first commit of this driver.
+
+Signed-off-by: Andreas Bießmann <andreas@biessmann.de>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/omap2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/omap2.c
++++ b/drivers/mtd/nand/omap2.c
+@@ -1139,7 +1139,7 @@ static int omap_nand_remove(struct platf
+ /* Release NAND device, its internal structures and partitions */
+ nand_release(&info->mtd);
+ iounmap(info->nand.IO_ADDR_R);
+- kfree(&info->mtd);
++ kfree(info);
+ return 0;
+ }
+
mempolicy-fix-refcount-leak-in-mpol_set_shared_policy.patch
mempolicy-fix-a-memory-corruption-by-refcount-imbalance-in-alloc_pages_vma.patch
cpu-hotplug-cpusets-suspend-don-t-modify-cpusets-during-suspend-resume.patch
+mtd-autcpu12-nvram-fix-compile-breakage.patch
+mtd-nandsim-bugfix-fail-if-overridesize-is-too-big.patch
+mtd-nand-use-the-mirror-bbt-descriptor-when-reading-its-version.patch
+mtd-omap2-fix-omap_nand_remove-segfault.patch
+mtd-omap2-fix-module-loading.patch
+convert-properly-utf-8-to-utf-16.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
