commit 7237ebd59bf1cd8bcc9508ec4bc5674dc7cc6c58
Author: Phil Endecott <git@chezphil.org>
Date:   Tue Nov 1 18:16:56 2011 +0000

    Sanitise ipu interrupt return value, and loop waiting for interrupt

diff --git a/drivers/mxc/ipu3/ipu_device.c b/drivers/mxc/ipu3/ipu_device.c
index 1955f09..d66b8f8 100644
--- a/drivers/mxc/ipu3/ipu_device.c
+++ b/drivers/mxc/ipu3/ipu_device.c
@@ -311,7 +311,7 @@ static int mxc_ipu_ioctl(struct inode *inode, struct file *file,
 		structure and pass the pointer in arg */
 		{
 			ipu_event_info info;
-			int r = -1;
+			int r;
 
 			if (copy_from_user
 					(&info, (ipu_event_info *) arg,
@@ -319,7 +319,7 @@ static int mxc_ipu_ioctl(struct inode *inode, struct file *file,
 				return -EFAULT;
 
 			r = get_events(&info);
-			if (r == -1) {
+			while (r == -1) {
 				if ((file->f_flags & O_NONBLOCK) &&
 					(irq_info[info.irq].irq_pending == 0))
 					return -EAGAIN;
@@ -328,13 +328,15 @@ static int mxc_ipu_ioctl(struct inode *inode, struct file *file,
 					return -ERESTARTSYS;
 				}
 				r = get_events(&info);
+				if (r == -1) {
+					/* Shouldn't happen? */
+					printk(KERN_ERR "no events after waiting\n");
+				}
 			}
-			ret = -1;
-			if (r == 0) {
-				if (!copy_to_user((ipu_event_info *) arg,
-					&info, sizeof(ipu_event_info)))
-					ret = 0;
-			}
+			if (copy_to_user((ipu_event_info *) arg,
+				&info, sizeof(ipu_event_info)))
+				return -EFAULT;
+			ret = 0;
 		}
 		break;
 	case IPU_ALOC_MEM: