Signed-off-by: NSascha Hauer <s.hauer@pengutronix.de>

This factors the address cycle to a seperate function. This
becomes useful in a later patch where we can simplify the
command processing by making use of this function.
Signed-off-by: NSascha Hauer <s.hauer@pengutronix.de>

Signed-off-by: NSascha Hauer <s.hauer@pengutronix.de>

The oob layout was initialized several times. Instead, use
a smallpage layout by default and switch to a largepage
afterwards if necessary.
Signed-off-by: NSascha Hauer <s.hauer@pengutronix.de>

The original Freescale driver used to have eccoob descriptions like
this:

static struct nand_ecclayout nand_hw_eccoob_8 = {
	.eccbytes = 5,
	.eccpos = {6, 7, 8, 9, 10},
	.oobfree = {{0, 5}, {11, 5}}
};

static struct nand_ecclayout nand_hw_eccoob_16 = {
	.eccbytes = 5,
	.eccpos = {6, 7, 8, 9, 10},
	.oobfree = {{0, 6}, {12, 4}}
};

The former was used for 8bit flashes and the latter for 16bit flashes.
They honored the fact that the bad block marker on 8bit flashes is on byte 5
while on 16bit flashes it is on byte 11.
In the Kernel driver this was copied wrong and we ended up with two identical
descriptions.

Change it so that we have only one description which leaves byte 5 and byte
11 unspecified so that it won't be used by others.

Also, rename the descriptions to nand_hw_eccoob_smallpage and
nand_hw_eccoob_largepage so that it can't be confused with Nand chip bus
widths (what actually happened in this driver)
Signed-off-by: NSascha Hauer <s.hauer@pengutronix.de>

Commit 4b56ffca ("mtd: Fix kernel NULL
pointer dereference in physmap.c") introduced a couple of bugs.

It neglected to run the loop of map_destroy() calls in
physmap_flash_remove(), if !info->cmtd, which would happen if that
function was called to clean up errors during probe.

It also failed to compile if CONFIG_MTD_PARTITIONS was not defined.
Reported-By: NAtsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: NH Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

This reverts commit 71b7d0d9.

The problem which that commit attempted to fix was a bootloader issue,
which had been misunderstood. The 'fix' causes lots of false bad blocks
for existing users with sane firmware.

Thanks to Mathieu Berland for diagnosing the problem coherently.
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

In register_mtd_blktrans(), the symbol 'ret' is already declared
as an int at the start of the function.  The inner loop declaration
is unnecessary.  Quiets the following sparse warning:

  warning: symbol 'ret' shadows an earlier one
Signed-off-by: NH Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Signed-off-by: NLeo Hao Chen <leochen@broadcom.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

During the probe for physmap platform flash devices there are a
number error exit conditions that all do a goto err_out which
then calls physmap_flash_remove().  In that function one of the
cleanup steps is:

#ifdef CONFIG_MTD_CONCAT
	if (info->cmtd != info->mtd[0])
		mtd_concat_destroy(info->cmtd);
#endif

This test will succeed since info->cmtd == NULL and info->mtd[0] is
valid.

Fix this by exiting the remove function when info->cmtd == NULL.

Also, cleanup the #ifdef CONFIG_MTD_PARTITIONS stuff by using
mtd_has_partitions().
Signed-off-by: NH Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Add a request_mem_region() before doing the ioremap().  Also, use the
resource_size macro instead of doing the end - start + 1 calc by hand.
Signed-off-by: NH Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Convert the (broken) pcmciamtd driver to use the new CIS helpers.
Signed-off-by: NDominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

This driver seems to be obsolete and broken for a long time.
It depends on CONFIG_IPAQ_HANDHELD that simply doesn't exists
anywhere in kernel. Also, it seems that none of machines it
claims to support have any use of it:
 SA11xx-based iPAQs (h3100/h3600) use sa1100-flash
 iPAQ h5000 uses physmap-flash
 Jornada 720 uses sa1100-flash
 Jornada 560 and iPAQ h1910 are not in mainline
Signed-off-by: NDmitry Artamonow <mad_soft@inbox.ru>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Fix a potential memory leak in mtd_dataflash driver.

The private data that is allocated when registering a DataFlash
device with the MTD subsystem is not released if an error occurs
when add_mtd_partitions() or add_mtd_device() is called.  Fix this
by adding an error path.  The memory is already released during a
remove.

Also, add a dev_set_drvdata(&spi->dev, NULL) before the kfree() so
that the spi device does not reference invalid data.
Signed-off-by: NH Hartley Sweeten <hsweeten@visionengravers.com>
Cc: David Brownell <david-b@pacbell.net>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

- Remove unnecessary memset for bbt
  All entries will be initialized at a few lines below
- Remove unnecessary initialization for mtd->erasesize
- Use write_whole_device()
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Commit f0b1e589 changed sa1100_mtd_probe from __init to __devinit,
but missed to correct sa1100_setup_mtd definition accordingly, which
causes following warning:

WARNING: vmlinux.o(.devinit.text+0xf4): Section mismatch in reference from
 the function sa1100_mtd_probe() to the function .init.text:sa1100_setup_mtd()
The function __devinit sa1100_mtd_probe() references
a function __init sa1100_setup_mtd().
If sa1100_setup_mtd is only used by sa1100_mtd_probe then
annotate sa1100_setup_mtd with a matching annotation.
Signed-off-by: NDmitry Artamonow <mad_soft@inbox.ru>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

The function mxcnd_remove is used only wrapped by __exit_p so define it
using __exit.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: NSam Ravnborg <sam@ravnborg.org>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Vladimir Barinov <vova.barinov@gmail.com>
Cc: Vladimir Barinov <vbarinov@embeddedalley.com>
Signed-off-by: NArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Unused variable "eccpos" removed from atmel_nand driver.
Signed-off-by: NClaudio Scordino <claudio@evidence.eu.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

This patch resolves all the prints present in onenand_base.c
Primarily, it replaces the hard-coded function names in the prints,
and makes use of __func__.
Signed-off-by: NAmul Kumar Saha <amul.saha@samsung.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Correct typo to use mask_ale from platform data when set to non-zero.
Signed-off-by: NHemant Pedanekar <hemantp@ti.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

drivers/mtd/maps/sa1100-flash.c: In function 'sa1100_probe_subdev':
drivers/mtd/maps/sa1100-flash.c:214: warning: format '%d' expects type 'int', but argument 3 has type 'uint64_t'
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

The SST SPI flashes is like Atmel SPI flashes in that the software
protection bits are set by default at power up, so clear them at init
time.
Signed-off-by: NGraf Yang <graf.yang@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

The driver requires gpio functionality, so make sure we depend on that in
the Kconfig menu.
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Now that there are linux/ versions of gpio.h and io.h, include those
rather than hitting the asm/ versions.
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

Fixed following htmldocs warnings:

  DOCPROC Documentation/DocBook/mtdnand.xml
  Warning(drivers/mtd/nand/nand_base.c:769): No description found for parameter 'page'
  Warning(drivers/mtd/nand/nand_base.c:785): No description found for parameter 'page'
  Warning(drivers/mtd/nand/nand_base.c:824): No description found for parameter 'page'
  Warning(drivers/mtd/nand/nand_base.c:947): No description found for parameter 'page'
  Warning(drivers/mtd/nand/nand_base.c:996): No description found for parameter 'page'
  Warning(drivers/mtd/nand/nand_base.c:1040): No description found for parameter 'page'
Signed-off-by: NJaswinder Singh Rajput <jaswinderrajput@gmail.com>
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

The patch enables the driver to be used on platforms such as ARM where an
I/O address is a 32-bit memory address.

The patch avoids the following kernel oops:

debian:~# modprobe sisfb
[   73.070000] sisfb: Video ROM found
[   73.080000] sisfb: Video RAM at 0x80000000, mapped to 0xe0a00000, size 1024k
[   73.090000] sisfb: MMIO at 0x84080000, mapped to 0xe0b80000, size 256k
[   73.090000] sisfb: Memory heap starting at 800K, size 32K
[   73.360000] Unable to handle kernel paging request at virtual address 6e000844
[   73.380000] pgd = df230000
[   73.380000] [6e000844] *pgd=00000000
[   73.380000] Internal error: Oops: 8f5 [#1]
[   73.380000] Modules linked in: sisfb(+) fb cfbcopyarea cfbimgblt cfbfillrect
[   73.380000] CPU: 0    Not tainted  (2.6.31-iop32x #1)
[   73.380000] PC is at SiS_SetRegANDOR+0x10/0x38 [sisfb]
[   73.380000] LR is at SiS_SetSCLKHigh+0x38/0x94 [sisfb]
[   73.380000] pc : [<bf01dc00>]    lr : [<bf0238f8>]    psr: 60000013
[   73.380000] sp : df38fd00  ip : 6e000000  fp : 00000002
[   73.380000] r10: 00000108  r9 : 00000000  r8 : 00000108
[   73.380000] r7 : df064258  r6 : 00000110  r5 : 6e000844  r4 : 0000010a
[   73.380000] r3 : 00000001  r2 : 0000000e  r1 : 00000011  r0 : 00000844
[   73.380000] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   73.380000] Control: 0000397f  Table: bf230000  DAC: 00000015
[   73.380000] Process modprobe (pid: 1849, stack limit = 0xdf38e270)
[   73.380000] Stack: (0xdf38fd00 to 0xdf390000)
[   73.380000] fd00: 0000010a 00000108 df064258 df064258 df064258 00000000 00000000 bf02c4e0
[   73.380000] fd20: 00000114 bf02c50c 00000013 00000114 0000010a df064258 00000000 bf02c980
[   73.380000] fd40: 00009c66 00000004 00000001 df064250 a0010000 a6a2a0a0 df064250 00000003
[   73.380000] fd60: df064250 00000000 df064258 0000fffd 00000000 00000000 00000000 bf033948
[   73.380000] fd80: 00000000 00000000 00000000 bf019e2c 00000000 df064a70 bf03b470 00010000
[   73.380000] fda0: 00000000 df064250 00000000 df831c00 00000012 bf039f70 00000000 c00abed8
[   73.380000] fdc0: 000008a6 000008a4 df0649b0 df064878 df064258 df064000 00000000 00000000
[   73.380000] fde0: 00000001 00008000 00000001 00030000 df81c930 bf049f88 df831c00 00000000
[   73.380000] fe00: bf049f58 df3952a0 c0447708 bf049f88 bf049fe0 c0191980 df831c00 c0191b10
[   73.380000] fe20: df831c58 bf049f58 df831c00 bf04aca8 df3952a0 df831c58 df831c58 bf049f88
[   73.380000] fe40: c01ba1b4 c01ba0a0 df831c58 df831c8c bf049f88 c01ba1b4 df3952a0 00000000
[   73.380000] fe60: c03e265c c01ba240 00000000 df38fe78 bf049f88 c01b990c df812938 df81b8d0
[   73.380000] fe80: df3952a0 df807780 00000000 00000060 bf049f88 c01b9224 bf0429c8 00000000
[   73.380000] fea0: bf049f58 00000000 bf049f88 00000000 00000000 bf04aea8 00000000 c01ba4e4
[   73.380000] fec0: e09861a0 bf049f58 00000000 bf049f88 00000000 c0191f20 00000000 00000000
[   73.380000] fee0: c03f7bac bf04d418 0000fff2 0000fff1 bf04ad08 0002f260 0002f260 e0986038
[   73.380000] ff00: e0986150 e098568b df143340 e0990280 00000036 c03d8b00 fffffffd 00000000
[   73.380000] ff20: bf04acfc 00000000 fffffffc 0003cf4b 00018098 c03f7bac 00000000 bf04d000
[   73.380000] ff40: df38e000 00000000 bedc0984 c00272a4 ffffffff c005bc88 00000000 00000000
[   73.380000] ff60: 0003cf4b 0003cf4b 00018098 bf04acfc 00000000 c0027fe8 df38e000 00000000
[   73.380000] ff80: bedc0984 c006882c 00001000 00000003 00000000 00009064 00000000 00008edc
[   73.380000] ffa0: 00000080 c0027e20 00009064 00000000 4014e000 0003cf4b 00018098 0003cf4b
[   73.380000] ffc0: 00009064 00000000 00008edc 00000080 00000000 00000000 40025000 bedc0984
[   73.380000] ffe0: 00000000 bedc08fc 0000b6b0 400e8f34 60000010 4014e000 00000000 00000000
[   73.380000] [<bf01dc00>] (SiS_SetRegANDOR+0x10/0x38 [sisfb]) from [<df064258>] (0xdf064258)
[   73.380000] Code: e92d0030 e20110ff e280546e e3a0c46e (e5c51000)
[   73.680000] ---[ end trace 62a93e01df37a5f2 ]---
Signed-off-by: NAaro Koskinen <aaro.koskinen@iki.fi>
Cc: Thomas Winischhofer <thomas@winischhofer.net>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fixes `s3c_fb_remove' referenced in section `.data' of
drivers/built-in.o: defined in discarded section `.devexit.text' of
drivers/built-in.o

With CONFIG_HOTPLUG=n, functions marked with __devexit gets removed,
so make sure we use __devexit_p when referencing pointers to them.
Signed-off-by: NPeter Korsgaard <jacmet@sunsite.dk>
Acked-by: NBen Dooks <ben-linux@fluff.org>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

drivers/video/tmiofb.c: In function 'tmiofb_resume':
drivers/video/tmiofb.c:977: warning: 'retval' may be used uninitialized in this function
Acked-by: NDmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

fbcon makes the (reasonable) assumption that it only needs to program the
hardware once, when fbcon_init() is called for the foreground console.

This doesn't always play well with vgacon because vgacon_deinit() is only
doing its job when the last console it owns is closed (when switching from
vgacon to fbcon, that's usually *after* fbcon_init() has set the new
mode).

Depending on the hardware this can cause the wrong framebuffer location to
be scanned out (e.g.  reproduced on nv05 with the nouveau framebuffer
driver).
Signed-off-by: NFrancisco Jerez <currojerez@riseup.net>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Attempting to unload a framebuffer module calls unregister_framebuffer()
which in turn gets fbcon to release it.  If fbcon has no framebuffers
linked to a console, it will also unbind itself from the console driver.
However, if fbcon never registered itself as a console driver, the unbind
will fail causing the framebuffer device entry to persist.  In most cases
this failure will result in an oops when attempting to access the now
non-existent device.

This patch ensures that the fbcon unbind request will succeed even if a
bind was never done.  It tracks if a successful bind ever occurred & will
only attempt to unbind if needed.  If there never was a bind, it simply
returns with no error.
Signed-off-by: NIan Armstrong <ian@iarmst.demon.co.uk>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

CONFIG_FB_MATROX_32MB is always enabled, so there is no point in having
ifdefs all around.  And it is bad practice to use CONFIG_* as a name for
something which is not a Kconfig option.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NPetr Vandrovec <vandrove@vc.cvut.cz>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

With multihead support always enabled, macros MINFO_FROM and
MINFO_FROM_INFO are no longer needed and make the code harder to read.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NPetr Vandrovec <vandrove@vc.cvut.cz>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

With multihead support always enabled, these macros are no longer needed
and make the code harder to read.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NPetr Vandrovec <vandrove@vc.cvut.cz>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

With multihead support always enabled, these macros are no longer needed
and make the code harder to read.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NPetr Vandrovec <vandrove@vc.cvut.cz>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

I would like to get rid of option CONFIG_FB_MATROX_MULTIHEAD and just
always enable it.  There are many reasons for doing this:

* CONFIG_FB_MATROX_MULTIHEAD=y is what all x86 distributions do, so it
  definitely works or we would know by now.

* Building the matroxfb driver with CONFIG_FB_MATROX_MULTIHEAD not set
  results in the following build warning:

drivers/video/matrox/matroxfb_crtc2.c: In function 'matroxfb_dh_open':
drivers/video/matrox/matroxfb_crtc2.c:265: warning: the address of 'matroxfb_global_mxinfo' will always evaluate as 'true'
drivers/video/matrox/matroxfb_crtc2.c: In function 'matroxfb_dh_release':
drivers/video/matrox/matroxfb_crtc2.c:285: warning: the address of 'matroxfb_global_mxinfo' will always evaluate as 'true'

This is nothing to be worried about, the driver will work fine, but build
warnings are still annoying.

* The trick to get multihead support without CONFIG_FB_MATROX_MULTIHEAD,
  which is described in the config help text, no longer works: you can't
  load the same kernel module more than once.

* I fail to see how CONFIG_FB_MATROX_MULTIHEAD=y would make the code
  significantly slower, contrary to what the help text says.  A few extra
  parameters on the stack here and there can't really slow things down in
  comaprison to the rest of the code, and register access.

* The driver built without CONFIG_FB_MATROX_MULTIHEAD is larger than the
  driver build with CONFIG_FB_MATROX_MULTIHEAD=y by 8%.

* One less configuration option makes things simpler.  We add options
  all the time, being able to remove one for once is nice.  It improves
  testing coverage.  And I don't think the Matrox adapters are still
  popular enough to warrant overdetailed configuration settings.

* We should be able to unobfuscate the driver code quite a bit after
  this change (patches follow.)
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NPetr Vandrovec <vandrove@vc.cvut.cz>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

At the moment about half of the framebuffer drivers can return an error
code in fb_set_par. Until now it would be silently ignored by fbmem.c
and fbcon.c. This patch fixes fbmem.c to return the error code and
restore var on error.

But it is not clear in which video mode the device is when fb_set_par
fails.  It would be good and reasonable if it were in the old state but
there is no guarantee that this is true for all existing drivers.
Additionally print a message if a failing fb_set_par is detected in
fbmem.c or fbcon.c.

Although most errors should be caught by the previous fb_check_var some
errors can't as they are dynamic (memory allocations, ...) and can only be
detected while performing the operations which is forbidden in
fb_check_var.

This patch shouldn't have a negative impact on normal operation as all
drivers return 0 on success.  The impact in case of error depends heavily
on the driver and caller but it's expected to be better than before.
Signed-off-by: NFlorian Tobias Schandinat <FlorianSchandinat@gmx.de>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In the final part of the calculation for the tft display clockrate we
divide the output pf s3c2410fb_calc_pixclk() by 2 which leaves us with a
rounding error if the result is odd.

Change to using DIV_ROUND_UP() to ensure that we always choose a higher
divisor and thus a lower frequency.
Signed-off-by: NBen Dooks <ben@simtec.co.uk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Use DIV_ROUND_UP explicitly instead of manual shifts and adds.  It makes
the code more readable and consistent (sometimes there were shifts,
sometimes divs).

There is no change on the assembly level (compilers should do the right
job).
Signed-off-by: NJiri Slaby <jirislaby@gmail.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix the range check for panning.  The current code fails to detect some
invalid values (very high ones that can occur if an app tries to move
further up/left than 0,0) as the check uses the unknown values for
calculation so that an overflow can occur.

To fix this it is sufficient to move the calculation to the right side to
use only trusted values.

Kai Jiang detected this problem and proposed an initial patch.
Signed-off-by: NFlorian Tobias Schandinat <FlorianSchandinat@gmx.de>
Cc: Kai Jiang <b18973@freescale.com>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>