<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/staging, branch v3.2.29</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>Staging: speakup: fix an improperly-declared variable.</title>
<updated>2012-09-12T02:37:35+00:00</updated>
<author>
<name>Christopher Brannon</name>
<email>chris@the-brannons.com</email>
</author>
<published>2012-06-16T21:55:20+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=fc1dd47cd57da67691c13e1f2d3cde814d857ebe'/>
<id>fc1dd47cd57da67691c13e1f2d3cde814d857ebe</id>
<content type='text'>
commit 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b upstream.

A local static variable was declared as a pointer to a string
constant.  We're assigning to the underlying memory, so it
needs to be an array instead.

Signed-off-by: Christopher Brannon &lt;chris@the-brannons.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b upstream.

A local static variable was declared as a pointer to a string
constant.  We're assigning to the underlying memory, so it
needs to be an array instead.

Signed-off-by: Christopher Brannon &lt;chris@the-brannons.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB: winbond: remove __devinit* from the struct usb_device_id table</title>
<updated>2012-09-12T02:37:12+00:00</updated>
<author>
<name>Greg Kroah-Hartman</name>
<email>gregkh@linuxfoundation.org</email>
</author>
<published>2012-08-18T00:48:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=754e1f26df588c4fb52ecc915afbff6452f0ff98'/>
<id>754e1f26df588c4fb52ecc915afbff6452f0ff98</id>
<content type='text'>
commit 43a34695d9cd79c6659f09da6d3b0624f3dd169f upstream.

This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.

Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.

Reported-by: Fengguang Wu &lt;fengguang.wu@intel.com&gt;
Reported-by: Bjørn Mork &lt;bjorn@mork.no&gt;
CC: Pavel Machek &lt;pavel@ucw.cz&gt;
CC: Paul Gortmaker &lt;paul.gortmaker@windriver.com&gt;
CC: "John W. Linville" &lt;linville@tuxdriver.com&gt;
CC: Eliad Peller &lt;eliad@wizery.com&gt;
CC: Devendra Naga &lt;devendra.aaru@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 43a34695d9cd79c6659f09da6d3b0624f3dd169f upstream.

This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.

Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.

Reported-by: Fengguang Wu &lt;fengguang.wu@intel.com&gt;
Reported-by: Bjørn Mork &lt;bjorn@mork.no&gt;
CC: Pavel Machek &lt;pavel@ucw.cz&gt;
CC: Paul Gortmaker &lt;paul.gortmaker@windriver.com&gt;
CC: "John W. Linville" &lt;linville@tuxdriver.com&gt;
CC: Eliad Peller &lt;eliad@wizery.com&gt;
CC: Devendra Naga &lt;devendra.aaru@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>USB: vt6656: remove __devinit* from the struct usb_device_id table</title>
<updated>2012-09-12T02:37:12+00:00</updated>
<author>
<name>Greg Kroah-Hartman</name>
<email>gregkh@linuxfoundation.org</email>
</author>
<published>2012-08-18T00:48:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=e91f7b801664f7aa25d4cb7420885ee277b19b5c'/>
<id>e91f7b801664f7aa25d4cb7420885ee277b19b5c</id>
<content type='text'>
commit 4d088876f24887cd15a29db923f5f37db6a99f21 upstream.

This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.

Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.

Reported-by: Fengguang Wu &lt;fengguang.wu@intel.com&gt;
Reported-by: Bjørn Mork &lt;bjorn@mork.no&gt;
CC: Forest Bond &lt;forest@alittletooquiet.net&gt;
CC: Marcos Paulo de Souza &lt;marcos.souza.org@gmail.com&gt;
CC: "David S. Miller" &lt;davem@davemloft.net&gt;
CC: Jesper Juhl &lt;jj@chaosbits.net&gt;
CC: Jiri Pirko &lt;jpirko@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 4d088876f24887cd15a29db923f5f37db6a99f21 upstream.

This structure needs to always stick around, even if CONFIG_HOTPLUG
is disabled, otherwise we can oops when trying to probe a device that
was added after the structure is thrown away.

Thanks to Fengguang Wu and Bjørn Mork for tracking this issue down.

Reported-by: Fengguang Wu &lt;fengguang.wu@intel.com&gt;
Reported-by: Bjørn Mork &lt;bjorn@mork.no&gt;
CC: Forest Bond &lt;forest@alittletooquiet.net&gt;
CC: Marcos Paulo de Souza &lt;marcos.souza.org@gmail.com&gt;
CC: "David S. Miller" &lt;davem@davemloft.net&gt;
CC: Jesper Juhl &lt;jj@chaosbits.net&gt;
CC: Jiri Pirko &lt;jpirko@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>lirc_sir: make device registration work</title>
<updated>2012-08-09T23:24:35+00:00</updated>
<author>
<name>Jarod Wilson</name>
<email>jarod@redhat.com</email>
</author>
<published>2012-06-04T16:05:24+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=76a65f00049d773d4f508bc2a6c19f7bb546f49d'/>
<id>76a65f00049d773d4f508bc2a6c19f7bb546f49d</id>
<content type='text'>
commit 4b71ca6bce8fab3d08c61bf330e781f957934ae1 upstream.

For one, the driver device pointer needs to be filled in, or the lirc core
will refuse to load the driver. And we really need to wire up all the
platform_device bits. This has been tested via the lirc sourceforge tree
and verified to work, been sitting there for months, finally getting
around to sending it. :\

CC: Josh Boyer &lt;jwboyer@redhat.com&gt;
Signed-off-by: Jarod Wilson &lt;jarod@redhat.com&gt;
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab@redhat.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 4b71ca6bce8fab3d08c61bf330e781f957934ae1 upstream.

For one, the driver device pointer needs to be filled in, or the lirc core
will refuse to load the driver. And we really need to wire up all the
platform_device bits. This has been tested via the lirc sourceforge tree
and verified to work, been sitting there for months, finally getting
around to sending it. :\

CC: Josh Boyer &lt;jwboyer@redhat.com&gt;
Signed-off-by: Jarod Wilson &lt;jarod@redhat.com&gt;
Signed-off-by: Mauro Carvalho Chehab &lt;mchehab@redhat.com&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>staging:rts_pstor:Fix possible panic by NULL pointer dereference</title>
<updated>2012-07-04T04:44:14+00:00</updated>
<author>
<name>wwang</name>
<email>wei_wang@realsil.com.cn</email>
</author>
<published>2012-03-27T08:43:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c4a08668a15a03370b3ba7cae49d1017f2c8434d'/>
<id>c4a08668a15a03370b3ba7cae49d1017f2c8434d</id>
<content type='text'>
commit 0d05568ac79bfc595f1eadc3e0fd7a20a45f7b69 upstream.

rtsx_transport.c (rtsx_transfer_sglist_adma_partial):
pointer struct scatterlist *sg, which is mapped in dma_map_sg,
is used as an iterator in later transfer operation. It is corrupted and
passed to dma_unmap_sg, thus causing fatal unmap of some erroneous address.
Fix it by duplicating *sg_ptr for iterating.

Signed-off-by: wwang &lt;wei_wang@realsil.com.cn&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 0d05568ac79bfc595f1eadc3e0fd7a20a45f7b69 upstream.

rtsx_transport.c (rtsx_transfer_sglist_adma_partial):
pointer struct scatterlist *sg, which is mapped in dma_map_sg,
is used as an iterator in later transfer operation. It is corrupted and
passed to dma_unmap_sg, thus causing fatal unmap of some erroneous address.
Fix it by duplicating *sg_ptr for iterating.

Signed-off-by: wwang &lt;wei_wang@realsil.com.cn&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>staging: r8712u: Add new USB IDs</title>
<updated>2012-07-04T04:44:07+00:00</updated>
<author>
<name>Lubomir Schmidt</name>
<email>gentoo.lubomir@googlemail.com</email>
</author>
<published>2012-06-15T20:12:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=d01f95936e0c3902197307e6e62c2673fa629bf4'/>
<id>d01f95936e0c3902197307e6e62c2673fa629bf4</id>
<content type='text'>
commit 3026b0e942c65c65c8fc80d391d004228b52b916 upstream.

There are two new devices for this driver.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 3026b0e942c65c65c8fc80d391d004228b52b916 upstream.

There are two new devices for this driver.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>staging:iio:ad7606: Re-add missing scale attribute</title>
<updated>2012-07-04T04:44:04+00:00</updated>
<author>
<name>Lars-Peter Clausen</name>
<email>lars@metafoo.de</email>
</author>
<published>2012-06-05T16:16:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f3853ace1a3eeb934ab739704285a20598ef0644'/>
<id>f3853ace1a3eeb934ab739704285a20598ef0644</id>
<content type='text'>
commit 279bf2e57c30c9a4482b2b6ede11b31c41e35e78 upstream.

Commit 50ac23be ("staging:iio:adc:ad7606 add local define for chan_spec
structures.") accidentally removed the scale info_mask flag. This patch
adds it back again.

Signed-off-by: Lars-Peter Clausen &lt;lars@metafoo.de&gt;
Acked-by: Jonathan Cameron &lt;jic23@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
[bwh: Backported to 3.2:
 - info_mask was completely gone rather than set to another flag
 - IIO_CHAN_INFO_SCALE_SHARED_BIT was not defined; write it out as a shift]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 279bf2e57c30c9a4482b2b6ede11b31c41e35e78 upstream.

Commit 50ac23be ("staging:iio:adc:ad7606 add local define for chan_spec
structures.") accidentally removed the scale info_mask flag. This patch
adds it back again.

Signed-off-by: Lars-Peter Clausen &lt;lars@metafoo.de&gt;
Acked-by: Jonathan Cameron &lt;jic23@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
[bwh: Backported to 3.2:
 - info_mask was completely gone rather than set to another flag
 - IIO_CHAN_INFO_SCALE_SHARED_BIT was not defined; write it out as a shift]
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drivers/staging/comedi/comedi_fops.c: add missing vfree</title>
<updated>2012-05-30T23:43:31+00:00</updated>
<author>
<name>Julia Lawall</name>
<email>Julia.Lawall@lip6.fr</email>
</author>
<published>2012-04-22T11:37:09+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a756191d7f7f975492a9cc0f43829fcdbe366fe5'/>
<id>a756191d7f7f975492a9cc0f43829fcdbe366fe5</id>
<content type='text'>
commit abae41e6438b798e046d721b6ccdd55b4a398170 upstream.

aux_free is freed on all other exits from the function.  By removing the
return, we can benefit from the vfree already at the end of the function.

Signed-off-by: Julia Lawall &lt;Julia.Lawall@lip6.fr&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit abae41e6438b798e046d721b6ccdd55b4a398170 upstream.

aux_free is freed on all other exits from the function.  By removing the
return, we can benefit from the vfree already at the end of the function.

Signed-off-by: Julia Lawall &lt;Julia.Lawall@lip6.fr&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>staging: r8712u: Fix regression caused by commit 8c213fa</title>
<updated>2012-05-11T12:15:04+00:00</updated>
<author>
<name>Larry Finger</name>
<email>Larry.Finger@lwfinger.net</email>
</author>
<published>2012-02-26T00:10:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7d97c19bdbda447053a489811763837bbab20400'/>
<id>7d97c19bdbda447053a489811763837bbab20400</id>
<content type='text'>
commit 2080913e017ab9f88379d93fd09546ad95faf87b upstream.

In commit 8c213fa "staging: r8712u: Use asynchronous firmware loading",
the command to release the firmware was placed in the wrong routine.

In combination with the bug introduced in commit a5ee652 "staging: r8712u:
Interface-state not fully tracked", the driver attempts to upload firmware
that had already been released. This bug is the source of one of the
problems in https://bugs.archlinux.org/task/27996#comment89833.

Tested-by: Alberto Lago Ballesteros &lt;saniukeokusainaya@gmail.com&gt;
Tested-by: Adrian &lt;agib@gmx.de&gt;
Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 2080913e017ab9f88379d93fd09546ad95faf87b upstream.

In commit 8c213fa "staging: r8712u: Use asynchronous firmware loading",
the command to release the firmware was placed in the wrong routine.

In combination with the bug introduced in commit a5ee652 "staging: r8712u:
Interface-state not fully tracked", the driver attempts to upload firmware
that had already been released. This bug is the source of one of the
problems in https://bugs.archlinux.org/task/27996#comment89833.

Tested-by: Alberto Lago Ballesteros &lt;saniukeokusainaya@gmail.com&gt;
Tested-by: Adrian &lt;agib@gmx.de&gt;
Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Ben Hutchings &lt;ben@decadent.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>staging: iio: hmc5843: Fix crash in probe function.</title>
<updated>2012-04-22T22:30:59+00:00</updated>
<author>
<name>Marek Belisko</name>
<email>marek.belisko@open-nandra.com</email>
</author>
<published>2012-04-12T19:48:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c48fca494bc5af541161a95494453cafebda158f'/>
<id>c48fca494bc5af541161a95494453cafebda158f</id>
<content type='text'>
commit 62d2feb9803f18c4e3c8a1a2c7e30a54df8a1d72 upstream.

Fix crash after issuing:
	echo hmc5843 0x1e &gt; /sys/class/i2c-dev/i2c-2/device/new_device

	[   37.180999] device: '2-001e': device_add
	[   37.188293] bus: 'i2c': add device 2-001e
	[   37.194549] PM: Adding info for i2c:2-001e
	[   37.200958] bus: 'i2c': driver_probe_device: matched device 2-001e with driver hmc5843
	[   37.210815] bus: 'i2c': really_probe: probing driver hmc5843 with device 2-001e
	[   37.224884] HMC5843 initialized
	[   37.228759] ------------[ cut here ]------------
	[   37.233612] kernel BUG at mm/slab.c:505!
	[   37.237701] Internal error: Oops - BUG: 0 [#1] PREEMPT
	[   37.243103] Modules linked in:
	[   37.246337] CPU: 0    Not tainted  (3.3.1-gta04+ #28)
	[   37.251647] PC is at kfree+0x84/0x144
	[   37.255493] LR is at kfree+0x20/0x144
	[   37.259338] pc : [&lt;c00b408c&gt;]    lr : [&lt;c00b4028&gt;]    psr: 40000093
	[   37.259368] sp : de249cd8  ip : 0000000c  fp : 00000090
	[   37.271362] r10: 0000000a  r9 : de229eac  r8 : c0236274
	[   37.276855] r7 : c09d6490  r6 : a0000013  r5 : de229c00  r4 : de229c10
	[   37.283691] r3 : c0f00218  r2 : 00000400  r1 : c0eea000  r0 : c00b4028
	[   37.290527] Flags: nZcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
	[   37.298095] Control: 10c5387d  Table: 9e1d0019  DAC: 00000015
	[   37.304107] Process sh (pid: 91, stack limit = 0xde2482f0)
	[   37.309844] Stack: (0xde249cd8 to 0xde24a000)
	[   37.314422] 9cc0:                                                       de229c10 de229c00
	[   37.322998] 9ce0: de229c10 ffffffea 00000005 c0236274 de140a80 c00b4798 dec00080 de140a80
	[   37.331573] 9d00: c032f37c dec00080 000080d0 00000001 de229c00 de229c10 c048d578 00000005
	[   37.340148] 9d20: de229eac 0000000a 00000090 c032fa40 00000001 00000000 00000001 de229c10
	[   37.348724] 9d40: de229eac 00000029 c075b558 00000001 00000003 00000004 de229c10 c048d594
	[   37.357299] 9d60: 00000000 60000013 00000018 205b0007 37332020 3432322e 5d343838 c0060020
	[   37.365905] 9d80: de251600 00000001 00000000 de251600 00000001 c0065a84 de229c00 de229c48
	[   37.374481] 9da0: 00000006 0048d62c de229c38 de229c00 de229c00 de1f6c00 de1f6c20 00000001
	[   37.383056] 9dc0: 00000000 c048d62c 00000000 de229c00 de229c00 de1f6c00 de1f6c20 00000001
	[   37.391632] 9de0: 00000000 c048d62c 00000000 c0330164 00000000 de1f6c20 c048d62c de1f6c00
	[   37.400207] 9e00: c0330078 de1f6c04 c078d714 de189b58 00000000 c02ccfd8 de1f6c20 c0795f40
	[   37.408782] 9e20: c0238330 00000000 00000000 c02381a8 de1b9fc0 de1f6c20 de1f6c20 de249e48
	[   37.417358] 9e40: c0238330 c0236bb0 decdbed8 de7d0f14 de1f6c20 de1f6c20 de1f6c54 de1f6c20
	[   37.425933] 9e60: 00000000 c0238030 de1f6c20 c078d7bc de1f6c20 c02377ec de1f6c20 de1f6c28
	[   37.434509] 9e80: dee64cb0 c0236138 c047c554 de189b58 00000000 c004b45c de1f6c20 de1f6cd8
	[   37.443084] 9ea0: c0edfa6c de1f6c00 dee64c68 de1f6c04 de1f6c20 dee64cb8 c047c554 de189b58
	[   37.451690] 9ec0: 00000000 c02cd634 dee64c68 de249ef4 de23b008 dee64cb0 0000000d de23b000
	[   37.460266] 9ee0: de23b007 c02cd78c 00000002 00000000 00000000 35636d68 00333438 00000000
	[   37.468841] 9f00: 00000000 00000000 001e0000 00000000 00000000 00000000 00000000 0a10cec0
	[   37.477416] 9f20: 00000002 de249f80 0000000d dee62990 de189b40 c0234d88 0000000d c010c354
	[   37.485992] 9f40: 0000000d de210f28 000acc88 de249f80 0000000d de248000 00000000 c00b7bf8
	[   37.494567] 9f60: de210f28 000acc88 de210f28 000acc88 00000000 00000000 0000000d c00b7ed8
	[   37.503143] 9f80: 00000000 00000000 0000000d 00000000 0007fa28 0000000d 000acc88 00000004
	[   37.511718] 9fa0: c000e544 c000e380 0007fa28 0000000d 00000001 000acc88 0000000d 00000000
	[   37.520294] 9fc0: 0007fa28 0000000d 000acc88 00000004 00000001 00000020 00000002 00000000
	[   37.528869] 9fe0: 00000000 beab8624 0000ea05 b6eaebac 600d0010 00000001 00000000 00000000
	[   37.537475] [&lt;c00b408c&gt;] (kfree+0x84/0x144) from [&lt;c0236274&gt;] (device_add+0x530/0x57c)
	[   37.545806] [&lt;c0236274&gt;] (device_add+0x530/0x57c) from [&lt;c032fa40&gt;] (iio_device_register+0x8c8/0x990)
	[   37.555480] [&lt;c032fa40&gt;] (iio_device_register+0x8c8/0x990) from [&lt;c0330164&gt;] (hmc5843_probe+0xec/0x114)
	[   37.565338] [&lt;c0330164&gt;] (hmc5843_probe+0xec/0x114) from [&lt;c02ccfd8&gt;] (i2c_device_probe+0xc4/0xf8)
	[   37.574737] [&lt;c02ccfd8&gt;] (i2c_device_probe+0xc4/0xf8) from [&lt;c02381a8&gt;] (driver_probe_device+0x118/0x218)
	[   37.584777] [&lt;c02381a8&gt;] (driver_probe_device+0x118/0x218) from [&lt;c0236bb0&gt;] (bus_for_each_drv+0x4c/0x84)
	[   37.594818] [&lt;c0236bb0&gt;] (bus_for_each_drv+0x4c/0x84) from [&lt;c0238030&gt;] (device_attach+0x78/0xa4)
	[   37.604125] [&lt;c0238030&gt;] (device_attach+0x78/0xa4) from [&lt;c02377ec&gt;] (bus_probe_device+0x28/0x9c)
	[   37.613433] [&lt;c02377ec&gt;] (bus_probe_device+0x28/0x9c) from [&lt;c0236138&gt;] (device_add+0x3f4/0x57c)
	[   37.622650] [&lt;c0236138&gt;] (device_add+0x3f4/0x57c) from [&lt;c02cd634&gt;] (i2c_new_device+0xf8/0x19c)
	[   37.631805] [&lt;c02cd634&gt;] (i2c_new_device+0xf8/0x19c) from [&lt;c02cd78c&gt;] (i2c_sysfs_new_device+0xb4/0x130)
	[   37.641754] [&lt;c02cd78c&gt;] (i2c_sysfs_new_device+0xb4/0x130) from [&lt;c0234d88&gt;] (dev_attr_store+0x18/0x24)
	[   37.651611] [&lt;c0234d88&gt;] (dev_attr_store+0x18/0x24) from [&lt;c010c354&gt;] (sysfs_write_file+0x10c/0x140)
	[   37.661193] [&lt;c010c354&gt;] (sysfs_write_file+0x10c/0x140) from [&lt;c00b7bf8&gt;] (vfs_write+0xb0/0x178)
	[   37.670410] [&lt;c00b7bf8&gt;] (vfs_write+0xb0/0x178) from [&lt;c00b7ed8&gt;] (sys_write+0x3c/0x68)
	[   37.678833] [&lt;c00b7ed8&gt;] (sys_write+0x3c/0x68) from [&lt;c000e380&gt;] (ret_fast_syscall+0x0/0x3c)
	[   37.687683] Code: 1593301c e5932000 e3120080 1a000000 (e7f001f2)
	[   37.700775] ---[ end trace aaf805debdb69390 ]---

Client data was assigned to iio_dev structure in probe but in
hmc5843_init_client function casted to private driver data structure which
is wrong. Possibly calling mutex_init(&amp;data-&gt;lock); corrupt data
which the lead to above crash.

Signed-off-by: Marek Belisko &lt;marek.belisko@open-nandra.com&gt;
Acked-by: Jonathan Cameron &lt;jic23@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 62d2feb9803f18c4e3c8a1a2c7e30a54df8a1d72 upstream.

Fix crash after issuing:
	echo hmc5843 0x1e &gt; /sys/class/i2c-dev/i2c-2/device/new_device

	[   37.180999] device: '2-001e': device_add
	[   37.188293] bus: 'i2c': add device 2-001e
	[   37.194549] PM: Adding info for i2c:2-001e
	[   37.200958] bus: 'i2c': driver_probe_device: matched device 2-001e with driver hmc5843
	[   37.210815] bus: 'i2c': really_probe: probing driver hmc5843 with device 2-001e
	[   37.224884] HMC5843 initialized
	[   37.228759] ------------[ cut here ]------------
	[   37.233612] kernel BUG at mm/slab.c:505!
	[   37.237701] Internal error: Oops - BUG: 0 [#1] PREEMPT
	[   37.243103] Modules linked in:
	[   37.246337] CPU: 0    Not tainted  (3.3.1-gta04+ #28)
	[   37.251647] PC is at kfree+0x84/0x144
	[   37.255493] LR is at kfree+0x20/0x144
	[   37.259338] pc : [&lt;c00b408c&gt;]    lr : [&lt;c00b4028&gt;]    psr: 40000093
	[   37.259368] sp : de249cd8  ip : 0000000c  fp : 00000090
	[   37.271362] r10: 0000000a  r9 : de229eac  r8 : c0236274
	[   37.276855] r7 : c09d6490  r6 : a0000013  r5 : de229c00  r4 : de229c10
	[   37.283691] r3 : c0f00218  r2 : 00000400  r1 : c0eea000  r0 : c00b4028
	[   37.290527] Flags: nZcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
	[   37.298095] Control: 10c5387d  Table: 9e1d0019  DAC: 00000015
	[   37.304107] Process sh (pid: 91, stack limit = 0xde2482f0)
	[   37.309844] Stack: (0xde249cd8 to 0xde24a000)
	[   37.314422] 9cc0:                                                       de229c10 de229c00
	[   37.322998] 9ce0: de229c10 ffffffea 00000005 c0236274 de140a80 c00b4798 dec00080 de140a80
	[   37.331573] 9d00: c032f37c dec00080 000080d0 00000001 de229c00 de229c10 c048d578 00000005
	[   37.340148] 9d20: de229eac 0000000a 00000090 c032fa40 00000001 00000000 00000001 de229c10
	[   37.348724] 9d40: de229eac 00000029 c075b558 00000001 00000003 00000004 de229c10 c048d594
	[   37.357299] 9d60: 00000000 60000013 00000018 205b0007 37332020 3432322e 5d343838 c0060020
	[   37.365905] 9d80: de251600 00000001 00000000 de251600 00000001 c0065a84 de229c00 de229c48
	[   37.374481] 9da0: 00000006 0048d62c de229c38 de229c00 de229c00 de1f6c00 de1f6c20 00000001
	[   37.383056] 9dc0: 00000000 c048d62c 00000000 de229c00 de229c00 de1f6c00 de1f6c20 00000001
	[   37.391632] 9de0: 00000000 c048d62c 00000000 c0330164 00000000 de1f6c20 c048d62c de1f6c00
	[   37.400207] 9e00: c0330078 de1f6c04 c078d714 de189b58 00000000 c02ccfd8 de1f6c20 c0795f40
	[   37.408782] 9e20: c0238330 00000000 00000000 c02381a8 de1b9fc0 de1f6c20 de1f6c20 de249e48
	[   37.417358] 9e40: c0238330 c0236bb0 decdbed8 de7d0f14 de1f6c20 de1f6c20 de1f6c54 de1f6c20
	[   37.425933] 9e60: 00000000 c0238030 de1f6c20 c078d7bc de1f6c20 c02377ec de1f6c20 de1f6c28
	[   37.434509] 9e80: dee64cb0 c0236138 c047c554 de189b58 00000000 c004b45c de1f6c20 de1f6cd8
	[   37.443084] 9ea0: c0edfa6c de1f6c00 dee64c68 de1f6c04 de1f6c20 dee64cb8 c047c554 de189b58
	[   37.451690] 9ec0: 00000000 c02cd634 dee64c68 de249ef4 de23b008 dee64cb0 0000000d de23b000
	[   37.460266] 9ee0: de23b007 c02cd78c 00000002 00000000 00000000 35636d68 00333438 00000000
	[   37.468841] 9f00: 00000000 00000000 001e0000 00000000 00000000 00000000 00000000 0a10cec0
	[   37.477416] 9f20: 00000002 de249f80 0000000d dee62990 de189b40 c0234d88 0000000d c010c354
	[   37.485992] 9f40: 0000000d de210f28 000acc88 de249f80 0000000d de248000 00000000 c00b7bf8
	[   37.494567] 9f60: de210f28 000acc88 de210f28 000acc88 00000000 00000000 0000000d c00b7ed8
	[   37.503143] 9f80: 00000000 00000000 0000000d 00000000 0007fa28 0000000d 000acc88 00000004
	[   37.511718] 9fa0: c000e544 c000e380 0007fa28 0000000d 00000001 000acc88 0000000d 00000000
	[   37.520294] 9fc0: 0007fa28 0000000d 000acc88 00000004 00000001 00000020 00000002 00000000
	[   37.528869] 9fe0: 00000000 beab8624 0000ea05 b6eaebac 600d0010 00000001 00000000 00000000
	[   37.537475] [&lt;c00b408c&gt;] (kfree+0x84/0x144) from [&lt;c0236274&gt;] (device_add+0x530/0x57c)
	[   37.545806] [&lt;c0236274&gt;] (device_add+0x530/0x57c) from [&lt;c032fa40&gt;] (iio_device_register+0x8c8/0x990)
	[   37.555480] [&lt;c032fa40&gt;] (iio_device_register+0x8c8/0x990) from [&lt;c0330164&gt;] (hmc5843_probe+0xec/0x114)
	[   37.565338] [&lt;c0330164&gt;] (hmc5843_probe+0xec/0x114) from [&lt;c02ccfd8&gt;] (i2c_device_probe+0xc4/0xf8)
	[   37.574737] [&lt;c02ccfd8&gt;] (i2c_device_probe+0xc4/0xf8) from [&lt;c02381a8&gt;] (driver_probe_device+0x118/0x218)
	[   37.584777] [&lt;c02381a8&gt;] (driver_probe_device+0x118/0x218) from [&lt;c0236bb0&gt;] (bus_for_each_drv+0x4c/0x84)
	[   37.594818] [&lt;c0236bb0&gt;] (bus_for_each_drv+0x4c/0x84) from [&lt;c0238030&gt;] (device_attach+0x78/0xa4)
	[   37.604125] [&lt;c0238030&gt;] (device_attach+0x78/0xa4) from [&lt;c02377ec&gt;] (bus_probe_device+0x28/0x9c)
	[   37.613433] [&lt;c02377ec&gt;] (bus_probe_device+0x28/0x9c) from [&lt;c0236138&gt;] (device_add+0x3f4/0x57c)
	[   37.622650] [&lt;c0236138&gt;] (device_add+0x3f4/0x57c) from [&lt;c02cd634&gt;] (i2c_new_device+0xf8/0x19c)
	[   37.631805] [&lt;c02cd634&gt;] (i2c_new_device+0xf8/0x19c) from [&lt;c02cd78c&gt;] (i2c_sysfs_new_device+0xb4/0x130)
	[   37.641754] [&lt;c02cd78c&gt;] (i2c_sysfs_new_device+0xb4/0x130) from [&lt;c0234d88&gt;] (dev_attr_store+0x18/0x24)
	[   37.651611] [&lt;c0234d88&gt;] (dev_attr_store+0x18/0x24) from [&lt;c010c354&gt;] (sysfs_write_file+0x10c/0x140)
	[   37.661193] [&lt;c010c354&gt;] (sysfs_write_file+0x10c/0x140) from [&lt;c00b7bf8&gt;] (vfs_write+0xb0/0x178)
	[   37.670410] [&lt;c00b7bf8&gt;] (vfs_write+0xb0/0x178) from [&lt;c00b7ed8&gt;] (sys_write+0x3c/0x68)
	[   37.678833] [&lt;c00b7ed8&gt;] (sys_write+0x3c/0x68) from [&lt;c000e380&gt;] (ret_fast_syscall+0x0/0x3c)
	[   37.687683] Code: 1593301c e5932000 e3120080 1a000000 (e7f001f2)
	[   37.700775] ---[ end trace aaf805debdb69390 ]---

Client data was assigned to iio_dev structure in probe but in
hmc5843_init_client function casted to private driver data structure which
is wrong. Possibly calling mutex_init(&amp;data-&gt;lock); corrupt data
which the lead to above crash.

Signed-off-by: Marek Belisko &lt;marek.belisko@open-nandra.com&gt;
Acked-by: Jonathan Cameron &lt;jic23@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
</feed>
