Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git

[pandora-kernel.git] / drivers / mtd / mtdchar.c

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index d091b24..5d3ac51 100644 (file)
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -27,12 +27,10 @@ static void mtd_notify_add(struct mtd_info* mtd)
        if (!mtd)
                return;
 
-       class_device_create(mtd_class, NULL, MKDEV(MTD_CHAR_MAJOR, mtd->index*2),
-                           NULL, "mtd%d", mtd->index);
+       device_create(mtd_class, NULL, MKDEV(MTD_CHAR_MAJOR, mtd->index*2), "mtd%d", mtd->index);
 
-       class_device_create(mtd_class, NULL,
-                           MKDEV(MTD_CHAR_MAJOR, mtd->index*2+1),
-                           NULL, "mtd%dro", mtd->index);
+       device_create(mtd_class, NULL,
+                     MKDEV(MTD_CHAR_MAJOR, mtd->index*2+1), "mtd%dro", mtd->index);
 }
 
 static void mtd_notify_remove(struct mtd_info* mtd)
@@ -40,8 +38,8 @@ static void mtd_notify_remove(struct mtd_info* mtd)
        if (!mtd)
                return;
 
-       class_device_destroy(mtd_class, MKDEV(MTD_CHAR_MAJOR, mtd->index*2));
-       class_device_destroy(mtd_class, MKDEV(MTD_CHAR_MAJOR, mtd->index*2+1));
+       device_destroy(mtd_class, MKDEV(MTD_CHAR_MAJOR, mtd->index*2));
+       device_destroy(mtd_class, MKDEV(MTD_CHAR_MAJOR, mtd->index*2+1));
 }
 
 static struct mtd_notifier notifier = {
@@ -136,7 +134,8 @@ static int mtd_close(struct inode *inode, struct file *file)
 
        DEBUG(MTD_DEBUG_LEVEL0, "MTD_close\n");
 
-       if (mtd->sync)
+       /* Only sync if opened RW */
+       if ((file->f_mode & 2) && mtd->sync)
                mtd->sync(mtd);
 
        put_mtd_device(mtd);
@@ -482,6 +481,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
        {
                struct mtd_oob_buf buf;
                struct mtd_oob_ops ops;
+               uint32_t retlen;
 
                if(!(file->f_mode & 2))
                        return -EPERM;
@@ -521,8 +521,11 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
                buf.start &= ~(mtd->oobsize - 1);
                ret = mtd->write_oob(mtd, buf.start, &ops);
 
-               if (copy_to_user(argp + sizeof(uint32_t), &ops.oobretlen,
-                                sizeof(uint32_t)))
+               if (ops.oobretlen > 0xFFFFFFFFU)
+                       ret = -EOVERFLOW;
+               retlen = ops.oobretlen;
+               if (copy_to_user(&((struct mtd_oob_buf *)argp)->length,
+                                &retlen, sizeof(buf.length)))
                        ret = -EFAULT;
 
                kfree(ops.oobbuf);