14 files changed, 28 insertions, 391 deletions

diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 6dbba5aff191..86580b6df33d 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -326,24 +326,23 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin)
 	mutex_lock(&ashmem_mutex);
 
 	if (asma->size == 0) {
-		ret = -EINVAL;
-		goto out;
+		mutex_unlock(&ashmem_mutex);
+		return -EINVAL;
 	}
 
 	if (!asma->file) {
-		ret = -EBADF;
-		goto out;
+		mutex_unlock(&ashmem_mutex);
+		return -EBADF;
 	}
 
+	mutex_unlock(&ashmem_mutex);
+
 	ret = vfs_llseek(asma->file, offset, origin);
 	if (ret < 0)
-		goto out;
+		return ret;
 
 	/** Copy f_pos from backing file, since f_ops->llseek() sets it */
 	file->f_pos = asma->file->f_pos;
-
-out:
-	mutex_unlock(&ashmem_mutex);
 	return ret;
 }
 
@@ -702,16 +701,14 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
 	size_t pgstart, pgend;
 	int ret = -EINVAL;
 
+	if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
+		return -EFAULT;
+
 	mutex_lock(&ashmem_mutex);
 
 	if (unlikely(!asma->file))
 		goto out_unlock;
 
-	if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
-		ret = -EFAULT;
-		goto out_unlock;
-	}
-
 	/* per custom, you can pass zero for len to mean "everything onward" */
 	if (!pin.len)
 		pin.len = PAGE_ALIGN(asma->size) - pin.offset;
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index e618a87521a3..9d733471ca2e 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -475,8 +475,7 @@ unsigned int comedi_nsamples_left(struct comedi_subdevice *s,
 	struct comedi_cmd *cmd = &async->cmd;
 
 	if (cmd->stop_src == TRIG_COUNT) {
-		unsigned int nscans = nsamples / cmd->scan_end_arg;
-		unsigned int scans_left = __comedi_nscans_left(s, nscans);
+		unsigned int scans_left = __comedi_nscans_left(s, cmd->stop_arg);
 		unsigned int scan_pos =
 		    comedi_bytes_to_samples(s, async->scan_progress);
 		unsigned long long samples_left = 0;
diff --git a/drivers/staging/iio/Kconfig b/drivers/staging/iio/Kconfig
index 8abc1ab3c0c7..bd9445956511 100644
--- a/drivers/staging/iio/Kconfig
+++ b/drivers/staging/iio/Kconfig
@@ -14,6 +14,5 @@ source "drivers/staging/iio/impedance-analyzer/Kconfig"
 source "drivers/staging/iio/light/Kconfig"
 source "drivers/staging/iio/meter/Kconfig"
 source "drivers/staging/iio/resolver/Kconfig"
-source "drivers/staging/iio/trigger/Kconfig"
 
 endmenu
diff --git a/drivers/staging/iio/Makefile b/drivers/staging/iio/Makefile
index 455bffc29649..e99a375c07b9 100644
--- a/drivers/staging/iio/Makefile
+++ b/drivers/staging/iio/Makefile
@@ -13,4 +13,3 @@ obj-y += impedance-analyzer/
 obj-y += light/
 obj-y += meter/
 obj-y += resolver/
-obj-y += trigger/
diff --git a/drivers/staging/iio/trigger/Kconfig b/drivers/staging/iio/trigger/Kconfig
deleted file mode 100644
index 0b01d24cea51..000000000000
--- a/drivers/staging/iio/trigger/Kconfig
+++ /dev/null
@@ -1,19 +0,0 @@
-  #
-# Industrial I/O standalone triggers
-#
-comment "Triggers - standalone"
-
-if IIO_TRIGGER
-
-config IIO_BFIN_TMR_TRIGGER
-	tristate "Blackfin TIMER trigger"
-	depends on BLACKFIN
-	select BFIN_GPTIMERS
-	help
-	  Provides support for using a Blackfin timer as IIO triggers.
-	  If unsure, say N (but it's safe to say "Y").
-
-	  To compile this driver as a module, choose M here: the
-	  module will be called iio-trig-bfin-timer.
-
-endif # IIO_TRIGGER
diff --git a/drivers/staging/iio/trigger/Makefile b/drivers/staging/iio/trigger/Makefile
deleted file mode 100644
index 1300a21363db..000000000000
--- a/drivers/staging/iio/trigger/Makefile
+++ /dev/null
@@ -1,5 +0,0 @@
-#
-# Makefile for triggers not associated with iio-devices
-#
-
-obj-$(CONFIG_IIO_BFIN_TMR_TRIGGER) += iio-trig-bfin-timer.o
diff --git a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
deleted file mode 100644
index 71f11d7472c0..000000000000
--- a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
+++ /dev/null
@@ -1,292 +0,0 @@
-/*
- * Copyright 2011 Analog Devices Inc.
- *
- * Licensed under the GPL-2.
- *
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/slab.h>
-#include <linux/interrupt.h>
-#include <linux/irq.h>
-#include <linux/delay.h>
-
-#include <asm/gptimers.h>
-#include <asm/portmux.h>
-
-#include <linux/iio/iio.h>
-#include <linux/iio/trigger.h>
-
-#include "iio-trig-bfin-timer.h"
-
-struct bfin_timer {
-	unsigned short id, bit;
-	unsigned long irqbit;
-	int irq;
-	int pin;
-};
-
-/*
- * this covers all hardware timer configurations on
- * all Blackfin derivatives out there today
- */
-
-static struct bfin_timer iio_bfin_timer_code[MAX_BLACKFIN_GPTIMERS] = {
-	{TIMER0_id,  TIMER0bit,  TIMER_STATUS_TIMIL0,  IRQ_TIMER0, P_TMR0},
-	{TIMER1_id,  TIMER1bit,  TIMER_STATUS_TIMIL1,  IRQ_TIMER1, P_TMR1},
-	{TIMER2_id,  TIMER2bit,  TIMER_STATUS_TIMIL2,  IRQ_TIMER2, P_TMR2},
-#if (MAX_BLACKFIN_GPTIMERS > 3)
-	{TIMER3_id,  TIMER3bit,  TIMER_STATUS_TIMIL3,  IRQ_TIMER3, P_TMR3},
-	{TIMER4_id,  TIMER4bit,  TIMER_STATUS_TIMIL4,  IRQ_TIMER4, P_TMR4},
-	{TIMER5_id,  TIMER5bit,  TIMER_STATUS_TIMIL5,  IRQ_TIMER5, P_TMR5},
-	{TIMER6_id,  TIMER6bit,  TIMER_STATUS_TIMIL6,  IRQ_TIMER6, P_TMR6},
-	{TIMER7_id,  TIMER7bit,  TIMER_STATUS_TIMIL7,  IRQ_TIMER7, P_TMR7},
-#endif
-#if (MAX_BLACKFIN_GPTIMERS > 8)
-	{TIMER8_id,  TIMER8bit,  TIMER_STATUS_TIMIL8,  IRQ_TIMER8, P_TMR8},
-	{TIMER9_id,  TIMER9bit,  TIMER_STATUS_TIMIL9,  IRQ_TIMER9, P_TMR9},
-	{TIMER10_id, TIMER10bit, TIMER_STATUS_TIMIL10, IRQ_TIMER10, P_TMR10},
-#if (MAX_BLACKFIN_GPTIMERS > 11)
-	{TIMER11_id, TIMER11bit, TIMER_STATUS_TIMIL11, IRQ_TIMER11, P_TMR11},
-#endif
-#endif
-};
-
-struct bfin_tmr_state {
-	struct iio_trigger	*trig;
-	struct bfin_timer	*t;
-	unsigned int		timer_num;
-	bool			output_enable;
-	unsigned int		duty;
-	int			irq;
-};
-
-static int iio_bfin_tmr_set_state(struct iio_trigger *trig, bool state)
-{
-	struct bfin_tmr_state *st = iio_trigger_get_drvdata(trig);
-
-	if (get_gptimer_period(st->t->id) == 0)
-		return -EINVAL;
-
-	if (state)
-		enable_gptimers(st->t->bit);
-	else
-		disable_gptimers(st->t->bit);
-
-	return 0;
-}
-
-static ssize_t frequency_store(struct device *dev,
-			       struct device_attribute *attr,
-			       const char *buf, size_t count)
-{
-	struct iio_trigger *trig = to_iio_trigger(dev);
-	struct bfin_tmr_state *st = iio_trigger_get_drvdata(trig);
-	unsigned int val;
-	bool enabled;
-	int ret;
-
-	ret = kstrtouint(buf, 10, &val);
-	if (ret)
-		return ret;
-
-	if (val > 100000)
-		return -EINVAL;
-
-	enabled = get_enabled_gptimers() & st->t->bit;
-
-	if (enabled)
-		disable_gptimers(st->t->bit);
-
-	if (!val)
-		return count;
-
-	val = get_sclk() / val;
-	if (val <= 4 || val <= st->duty)
-		return -EINVAL;
-
-	set_gptimer_period(st->t->id, val);
-	set_gptimer_pwidth(st->t->id, val - st->duty);
-
-	if (enabled)
-		enable_gptimers(st->t->bit);
-
-	return count;
-}
-
-static ssize_t frequency_show(struct device *dev,
-			      struct device_attribute *attr,
-			      char *buf)
-{
-	struct iio_trigger *trig = to_iio_trigger(dev);
-	struct bfin_tmr_state *st = iio_trigger_get_drvdata(trig);
-	unsigned int period = get_gptimer_period(st->t->id);
-	unsigned long val;
-
-	if (!period)
-		val = 0;
-	else
-		val = get_sclk() / get_gptimer_period(st->t->id);
-
-	return sprintf(buf, "%lu\n", val);
-}
-
-static DEVICE_ATTR_RW(frequency);
-
-static struct attribute *iio_bfin_tmr_trigger_attrs[] = {
-	&dev_attr_frequency.attr,
-	NULL,
-};
-
-static const struct attribute_group iio_bfin_tmr_trigger_attr_group = {
-	.attrs = iio_bfin_tmr_trigger_attrs,
-};
-
-static const struct attribute_group *iio_bfin_tmr_trigger_attr_groups[] = {
-	&iio_bfin_tmr_trigger_attr_group,
-	NULL
-};
-
-static irqreturn_t iio_bfin_tmr_trigger_isr(int irq, void *devid)
-{
-	struct bfin_tmr_state *st = devid;
-
-	clear_gptimer_intr(st->t->id);
-	iio_trigger_poll(st->trig);
-
-	return IRQ_HANDLED;
-}
-
-static int iio_bfin_tmr_get_number(int irq)
-{
-	int i;
-
-	for (i = 0; i < MAX_BLACKFIN_GPTIMERS; i++)
-		if (iio_bfin_timer_code[i].irq == irq)
-			return i;
-
-	return -ENODEV;
-}
-
-static const struct iio_trigger_ops iio_bfin_tmr_trigger_ops = {
-	.set_trigger_state = iio_bfin_tmr_set_state,
-};
-
-static int iio_bfin_tmr_trigger_probe(struct platform_device *pdev)
-{
-	struct iio_bfin_timer_trigger_pdata *pdata;
-	struct bfin_tmr_state *st;
-	unsigned int config;
-	int ret;
-
-	st = devm_kzalloc(&pdev->dev, sizeof(*st), GFP_KERNEL);
-	if (!st)
-		return -ENOMEM;
-
-	st->irq = platform_get_irq(pdev, 0);
-	if (st->irq < 0) {
-		dev_err(&pdev->dev, "No IRQs specified");
-		return st->irq;
-	}
-
-	ret = iio_bfin_tmr_get_number(st->irq);
-	if (ret < 0)
-		return ret;
-
-	st->timer_num = ret;
-	st->t = &iio_bfin_timer_code[st->timer_num];
-
-	st->trig = iio_trigger_alloc("bfintmr%d", st->timer_num);
-	if (!st->trig)
-		return -ENOMEM;
-
-	st->trig->ops = &iio_bfin_tmr_trigger_ops;
-	st->trig->dev.groups = iio_bfin_tmr_trigger_attr_groups;
-	iio_trigger_set_drvdata(st->trig, st);
-	ret = iio_trigger_register(st->trig);
-	if (ret)
-		goto out;
-
-	ret = request_irq(st->irq, iio_bfin_tmr_trigger_isr,
-			  0, st->trig->name, st);
-	if (ret) {
-		dev_err(&pdev->dev,
-			"request IRQ-%d failed", st->irq);
-		goto out1;
-	}
-
-	config = PWM_OUT | PERIOD_CNT | IRQ_ENA;
-
-	pdata =	dev_get_platdata(&pdev->dev);
-	if (pdata && pdata->output_enable) {
-		unsigned long long val;
-
-		st->output_enable = true;
-
-		ret = peripheral_request(st->t->pin, st->trig->name);
-		if (ret)
-			goto out_free_irq;
-
-		val = (unsigned long long)get_sclk() * pdata->duty_ns;
-		do_div(val, NSEC_PER_SEC);
-		st->duty = val;
-
-		/**
-		 * The interrupt will be generated at the end of the period,
-		 * since we want the interrupt to be generated at end of the
-		 * pulse we invert both polarity and duty cycle, so that the
-		 * pulse will be generated directly before the interrupt.
-		 */
-		if (pdata->active_low)
-			config |= PULSE_HI;
-	} else {
-		st->duty = 1;
-		config |= OUT_DIS;
-	}
-
-	set_gptimer_config(st->t->id, config);
-
-	dev_info(&pdev->dev, "iio trigger Blackfin TMR%d, IRQ-%d",
-		 st->timer_num, st->irq);
-	platform_set_drvdata(pdev, st);
-
-	return 0;
-out_free_irq:
-	free_irq(st->irq, st);
-out1:
-	iio_trigger_unregister(st->trig);
-out:
-	iio_trigger_free(st->trig);
-	return ret;
-}
-
-static int iio_bfin_tmr_trigger_remove(struct platform_device *pdev)
-{
-	struct bfin_tmr_state *st = platform_get_drvdata(pdev);
-
-	disable_gptimers(st->t->bit);
-	if (st->output_enable)
-		peripheral_free(st->t->pin);
-	free_irq(st->irq, st);
-	iio_trigger_unregister(st->trig);
-	iio_trigger_free(st->trig);
-
-	return 0;
-}
-
-static struct platform_driver iio_bfin_tmr_trigger_driver = {
-	.driver = {
-		.name = "iio_bfin_tmr_trigger",
-	},
-	.probe = iio_bfin_tmr_trigger_probe,
-	.remove = iio_bfin_tmr_trigger_remove,
-};
-
-module_platform_driver(iio_bfin_tmr_trigger_driver);
-
-MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
-MODULE_DESCRIPTION("Blackfin system timer based trigger for the iio subsystem");
-MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:iio-trig-bfin-timer");
diff --git a/drivers/staging/iio/trigger/iio-trig-bfin-timer.h b/drivers/staging/iio/trigger/iio-trig-bfin-timer.h
deleted file mode 100644
index fb05a2a8397c..000000000000
--- a/drivers/staging/iio/trigger/iio-trig-bfin-timer.h
+++ /dev/null
@@ -1,25 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef __IIO_BFIN_TIMER_TRIGGER_H__
-#define __IIO_BFIN_TIMER_TRIGGER_H__
-
-/**
- * struct iio_bfin_timer_trigger_pdata - timer trigger platform data
- * @output_enable: Enable external trigger pulse generation.
- * @active_low: Whether the trigger pulse is active low.
- * @duty_ns: Length of the trigger pulse in nanoseconds.
- *
- * This struct is used to configure the output pulse generation of the blackfin
- * timer trigger. If output_enable is set to true an external trigger signal
- * will generated on the pin corresponding to the timer. This is useful for
- * converters which needs an external signal to start conversion. active_low and
- * duty_ns are used to configure the type of the trigger pulse. If output_enable
- * is set to false no external trigger pulse will be generated and active_low
- * and duty_ns are ignored.
- **/
-struct iio_bfin_timer_trigger_pdata {
-	bool output_enable;
-	bool active_low;
-	unsigned int duty_ns;
-};
-
-#endif
diff --git a/drivers/staging/ipx/af_ipx.c b/drivers/staging/ipx/af_ipx.c
index d21a9d128d3e..5703dd176787 100644
--- a/drivers/staging/ipx/af_ipx.c
+++ b/drivers/staging/ipx/af_ipx.c
@@ -1577,7 +1577,7 @@ out:
 
 
 static int ipx_getname(struct socket *sock, struct sockaddr *uaddr,
-			int *uaddr_len, int peer)
+			int peer)
 {
 	struct ipx_address *addr;
 	struct sockaddr_ipx sipx;
@@ -1585,8 +1585,6 @@ static int ipx_getname(struct socket *sock, struct sockaddr *uaddr,
 	struct ipx_sock *ipxs = ipx_sk(sk);
 	int rc;
 
-	*uaddr_len = sizeof(struct sockaddr_ipx);
-
 	lock_sock(sk);
 	if (peer) {
 		rc = -ENOTCONN;
@@ -1620,7 +1618,7 @@ static int ipx_getname(struct socket *sock, struct sockaddr *uaddr,
 	sipx.sipx_zero	 = 0;
 	memcpy(uaddr, &sipx, sizeof(sipx));
 
-	rc = 0;
+	rc = sizeof(struct sockaddr_ipx);
 out:
 	release_sock(sk);
 	return rc;
diff --git a/drivers/staging/irda/net/af_irda.c b/drivers/staging/irda/net/af_irda.c
index 2f1e9ab3d6d0..c13553a9ee11 100644
--- a/drivers/staging/irda/net/af_irda.c
+++ b/drivers/staging/irda/net/af_irda.c
@@ -697,7 +697,7 @@ static int irda_discover_daddr_and_lsap_sel(struct irda_sock *self, char *name)
  *
  */
 static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
-			int *uaddr_len, int peer)
+			int peer)
 {
 	struct sockaddr_irda saddr;
 	struct sock *sk = sock->sk;
@@ -720,11 +720,9 @@ static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
 	pr_debug("%s(), tsap_sel = %#x\n", __func__, saddr.sir_lsap_sel);
 	pr_debug("%s(), addr = %08x\n", __func__, saddr.sir_addr);
 
-	/* uaddr_len come to us uninitialised */
-	*uaddr_len = sizeof (struct sockaddr_irda);
-	memcpy(uaddr, &saddr, *uaddr_len);
+	memcpy(uaddr, &saddr, sizeof (struct sockaddr_irda));
 
-	return 0;
+	return sizeof (struct sockaddr_irda);
 }
 
 /*
diff --git a/drivers/staging/lustre/lnet/lnet/lib-socket.c b/drivers/staging/lustre/lnet/lnet/lib-socket.c
index ce93806eefca..1bee667802b0 100644
--- a/drivers/staging/lustre/lnet/lnet/lib-socket.c
+++ b/drivers/staging/lustre/lnet/lnet/lib-socket.c
@@ -448,14 +448,13 @@ int
 lnet_sock_getaddr(struct socket *sock, bool remote, __u32 *ip, int *port)
 {
 	struct sockaddr_in sin;
-	int len = sizeof(sin);
 	int rc;
 
 	if (remote)
-		rc = kernel_getpeername(sock, (struct sockaddr *)&sin, &len);
+		rc = kernel_getpeername(sock, (struct sockaddr *)&sin);
 	else
-		rc = kernel_getsockname(sock, (struct sockaddr *)&sin, &len);
-	if (rc) {
+		rc = kernel_getsockname(sock, (struct sockaddr *)&sin);
+	if (rc < 0) {
 		CERROR("Error %d getting sock %s IP/port\n",
 		       rc, remote ? "peer" : "local");
 		return rc;
diff --git a/drivers/staging/ncpfs/ncplib_kernel.c b/drivers/staging/ncpfs/ncplib_kernel.c
index 804adfebba2f..3e047eb4cc7c 100644
--- a/drivers/staging/ncpfs/ncplib_kernel.c
+++ b/drivers/staging/ncpfs/ncplib_kernel.c
@@ -981,6 +981,10 @@ ncp_read_kernel(struct ncp_server *server, const char *file_id,
 		goto out;
 	}
 	*bytes_read = ncp_reply_be16(server, 0);
+	if (*bytes_read > to_read) {
+		result = -EINVAL;
+		goto out;
+	}
 	source = ncp_reply_data(server, 2 + (offset & 1));
 
 	memcpy(target, source, *bytes_read);
diff --git a/drivers/staging/speakup/Kconfig b/drivers/staging/speakup/Kconfig
index 7e8037e230b8..efd6f4560d3e 100644
--- a/drivers/staging/speakup/Kconfig
+++ b/drivers/staging/speakup/Kconfig
@@ -1,7 +1,7 @@
 menu "Speakup console speech"
 
 config SPEAKUP
-	depends on VT && !MN10300
+	depends on VT
 	tristate "Speakup core"
 	---help---
 		This is the Speakup screen reader.  Think of it as a
diff --git a/drivers/staging/vboxvideo/vbox_ttm.c b/drivers/staging/vboxvideo/vbox_ttm.c
index 2ea31589d773..548edb7c494b 100644
--- a/drivers/staging/vboxvideo/vbox_ttm.c
+++ b/drivers/staging/vboxvideo/vbox_ttm.c
@@ -193,10 +193,8 @@ static struct ttm_backend_func vbox_tt_backend_func = {
 	.destroy = &vbox_ttm_backend_destroy,
 };
 
-static struct ttm_tt *vbox_ttm_tt_create(struct ttm_bo_device *bdev,
-					 unsigned long size,
-					 u32 page_flags,
-					 struct page *dummy_read_page)
+static struct ttm_tt *vbox_ttm_tt_create(struct ttm_buffer_object *bo,
+					 u32 page_flags)
 {
 	struct ttm_tt *tt;
 
@@ -205,7 +203,7 @@ static struct ttm_tt *vbox_ttm_tt_create(struct ttm_bo_device *bdev,
 		return NULL;
 
 	tt->func = &vbox_tt_backend_func;
-	if (ttm_tt_init(tt, bdev, size, page_flags, dummy_read_page)) {
+	if (ttm_tt_init(tt, bo, page_flags)) {
 		kfree(tt);
 		return NULL;
 	}
@@ -213,21 +211,8 @@ static struct ttm_tt *vbox_ttm_tt_create(struct ttm_bo_device *bdev,
 	return tt;
 }
 
-static int vbox_ttm_tt_populate(struct ttm_tt *ttm,
-				struct ttm_operation_ctx *ctx)
-{
-	return ttm_pool_populate(ttm, ctx);
-}
-
-static void vbox_ttm_tt_unpopulate(struct ttm_tt *ttm)
-{
-	ttm_pool_unpopulate(ttm);
-}
-
 static struct ttm_bo_driver vbox_bo_driver = {
 	.ttm_tt_create = vbox_ttm_tt_create,
-	.ttm_tt_populate = vbox_ttm_tt_populate,
-	.ttm_tt_unpopulate = vbox_ttm_tt_unpopulate,
 	.init_mem_type = vbox_bo_init_mem_type,
 	.eviction_valuable = ttm_bo_eviction_valuable,
 	.evict_flags = vbox_bo_evict_flags,
@@ -345,7 +330,7 @@ int vbox_bo_create(struct drm_device *dev, int size, int align,
 
 	ret = ttm_bo_init(&vbox->ttm.bdev, &vboxbo->bo, size,
 			  ttm_bo_type_device, &vboxbo->placement,
-			  align >> PAGE_SHIFT, false, NULL, acc_size,
+			  align >> PAGE_SHIFT, false, acc_size,
 			  NULL, NULL, vbox_bo_ttm_destroy);
 	if (ret)
 		goto err_free_vboxbo;