Staging: sep: potential buffer overflow in ioctl

tail_size is determined by several variables that come from the user
so we should verify that it's not too large.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: rtl8192e: Use kmemdup rather than duplicating its implementation

 Use kmemdup rather than duplicating its implementation

 The semantic patch that makes this change is available
 in scripts/coccinelle/api/memdup.cocci.

 More information about semantic patching is available at
 http://coccinelle.lip6.fr/

Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: rtl8192e: Use kmemdup rather than duplicating its implementation

 Use kmemdup rather than duplicating its implementation

 The semantic patch that makes this change is available
 in scripts/coccinelle/api/memdup.cocci.

 More information about semantic patching is available at
 http://coccinelle.lip6.fr/

Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: rtl8192e: Use kzalloc rather than kmalloc v2

Use kzalloc rather than kmalloc followed by memset with 0

This considers some simple cases that are common and easy to validate
Note in particular that there are no ...s in the rule, so all of the
matched code has to be contiguous

The semantic patch that makes this change is available
in scripts/coccinelle/api/alloc/kzalloc-simple.cocci.

Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

rtl8192e: drop alternate code paths for CONFIG_PM_RTL

It has always been enabled unconditionally by ccflags-y.

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

rtl8192e: use HAVE_NET_DEVICE_OPS unconditionally

Mainline provides NET_DEVICE_OPS, remove alternate code paths and now
obsolete defines from ccflags-y.

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

rtl8192e: remove stale defines from ccflags-y

Code paths using these defines have been removed long time ago,
now remove stale references from injected ccflags-y.

Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

rtl8192e: Don't copy huge struct by value (and make it const).

rtllib_is_shortslot() takes one argument - a struct that's more than a
kilobyte large. It should take a pointer instead of copying such a
huge struct - and the argument might as well be declared 'const' now
that we are at it, since it is not modified. This patch makes these
changes.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/rtl8712/rtl871x_mlme.c: eliminate a null pointer dereference

If ibss_wlan is NULL, it is not correct to memcpy into its field.

The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@r@
expression E, E1;
identifier f;
statement S1,S2,S3;
@@

if (E == NULL)
{
  ... when != if (E == NULL || ...) S1 else S2
      when != E = E1
*E->f
  ... when any
  return ...;
}
else S3
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: nvec: add device tree support

This adds device tree support to the nvec driver. By using this method
it is no longer necessary to specify platform data through a board
file.

Signed-off-by: Marc Dietrich <marvin24@gmx.de>
Acked-by: Stephen Warren <swarren@nvidia.com>
Cc: Julian Andres Klode <jak@jak-linux.org>
Cc: Grant Likely <grant.likely@secretlab.ca>
Acked-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: bcm: Fix semaphore locking error when downloading firmware.

This patch releases semaphore locks when
an error occurrs while attempting to
download firmware for the bcm driver.
When downloading firmware for this driver,
a process is expected to call
the following ioctl's in this order:
(1)IOCTL_BCM_BUFFER_DOWNLOAD_START,
(2)IOCTL_BCM_BUFFER_DOWNLOAD, and (3)
IOCTL_BCM_BUFFER_DOWNLOAD_STOP.
Semaphore, “Adapter->fw_download_sema” is
expected to be acquired in the first ioctl,
IOCTL_BCM_BUFFER_DOWNLOAD_START, and it should
block until IOCTL_BCM_BUFFER_DOWNLOAD_STOP
is called.  In this case, if an error
occurred before STOP finished, the semaphore
"Adapter->fw_download_sema" was not being released.

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: bcm: Fix semaphore locking bug in, IOCTL_BCM_BUFFER_DOWNLOAD

In this ioctl, we are testing to see if the lock is held.
If it is not held, that means this ioctl used incorrectly.
Therefore, we do not want to take the lock ourselves here.

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: bcm: Remove unnecessary "do while" statement in, IOCTL_BCM_BUFFER_DOWNLOAD

This patch removes a superfluous "do while"
statement in IOCTL_BCM_BUFFER_DOWNLOAD.

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: bcm: Clean up code in ioctl: IOCTL_BCM_EEPROM_REGISTER_READ

This patch verifies two conditions before executing
a kmalloc call. First, it checks to see that
IoBuffer.OutputLength is not greater than an
unsigned short. If so, an invalid value may be
returned. The second change is a check to make
sure IoBuffer.OutputLength is not equal to
zero. Which simply keeps this code inline with
the other ioctl, IOCTL_BCM_REGISTER_READ_PRIVATE.

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: bcm: Fix information leak in ioctl: IOCTL_BCM_REGISTER_READ_PRIVATE, IOCTL_BCM_EEPROM_REGISTER_READ

This patch fixes an information leak in ioctl
IOCTL_BCM_REGISTER_READ_PRIVATE and
IOCTL_BCM_EEPROM_REGISTER_READ when determining
the number of bytes to copy to user space.  Function,
usb_control_msg, returns the correct number of
bytes from the hardware.  Instead of using
this value, we were using a value derived from
user space. In this case, this value could be more
than the hardware allocated.  Therefore, this
patch copies the proper number of bytes from
the hardware, and uses this value as the maximum
number of bytes for user space.

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: bcm: hostmibs: Added temporary variable to shorten lines

Signed-off-by: Diego F. Marfil <diegomarfil@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: bcm: hostmibs: White spaces and indentation fixes.

Signed-off-by: Diego F. Marfil <diegomarfil@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: bcm: hostmibs: C99 comments replaced

Signed-off-by: Diego F. Marfil <diegomarfil@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: hv: Use kmemdup rather than duplicating its implementation

Use kmemdup rather than duplicating its implementation

The semantic patch that makes this change is available
in scripts/coccinelle/api/memdup.cocci.

Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: storvsc: Support hot-removing of scsi devices

Support hot-removing of scsi devices.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: storvsc: Support hot add of scsi disks

Support hot add of scsi disks.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: storvsc: Upgrade the vmstor protocol version

In preparation for supporting hot add/remove of scsi devices,
upgrade the vmstor protocol version.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: storvsc: Get rid of an unnecessary forward declaration

Get rid of an unnecessary forward declaration.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: storvsc: use the macro KBUILD_MODNAME

Use the macro KBUILD_MODNAME.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: storvsc: Use the unlocked version queuecommand

Use the unlocked version queuecommand.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: storvsc: Use the accessor function shost_priv()

Use the accessor function shost_priv().

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: storvsc: Fix error handling storvsc_host_reset()

Fix error handling storvsc_host_reset(). I would like to thank
Long Li <longli@microsoft.com> for reporting this.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Reported-by: Long Li <longli@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: storvsc: Fixup the error when processing SET_WINDOW command

Fixup the error when processing SET_WINDOW command.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: storvsc: Cleanup error handling in the probe function

Cleanup error handling in the probe function.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: storvsc: Use mempools to allocate struct storvsc_cmd_request

We intend to use the storage driver to manage the root device.
To avoid deadlocks, use mempools to allocate struct storvsc_cmd_request.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: mousevsc: Use the KBUILD_MODNAME macro

Use the KBUILD_MODNAME macro.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: mousevsc: Add a check to prevent memory corruption

Add a check to prevent memory corruption.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: mousevsc: Address some style issues

Deal with some style related issues. Also get rid of an unused macro.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: mousevsc: Get rid of unnecessary include files

Get rid of unnecessary include files.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: mousevsc: Add a new line to a debug string

Add a new line to a debug string.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: mousevsc: Cleanup mousevsc_on_channel_callback()

Cleanup mousevsc_on_channel_callback(). This is based on the code provided
by Joe Perches <joe@perches.com>.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: mousevsc: Inline the code for reportdesc_callback()

Inline the code for reportdesc_callback() as this function is called from
mousevsc_probe(). As part of this, cleanup the code in reportdesc_callback().

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: mousevsc: Inline the code for mousevsc_on_device_add()

Inline the code for mousevsc_on_device_add() as this only used from
the function mousevsc_probe().

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: mousevsc: Make boolean states boolean

Make some state that is boolean in nature, a boolean variable.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: iio: fix endian conversion in ad7298_scan_direct()

"tmp" is used to store the output from cpu_to_be16() so it should be
a __be16 bit type.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

iio: Don't OOPS if dummy evgen failed init

If the dummy evgen failed init, the irq allocation functions which assume
init succeeded may still be called - causing an OOPS due to wrong assumption.

Here's the oops:

[    3.914332] BUG: unable to handle kernel NULL pointer dereference at 0000000000000148
[    3.915310] IP: [<ffffffff810b3008>] __lock_acquire+0xac/0xe50
[    3.915310] PGD 0
[    3.915310] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[    3.915310] CPU 1
[    3.915310] Pid: 1, comm: swapper Not tainted 3.2.0-rc2-sasha-00279-gd7bfb12-dirty #20
[    3.915310] RIP: 0010:[<ffffffff810b3008>]  [<ffffffff810b3008>] __lock_acquire+0xac/0xe50
[    3.915310] RSP: 0018:ffff880012499bc0  EFLAGS: 00010046
[    3.915310] RAX: 0000000000000086 RBX: ffff880012490000 RCX: 0000000000000000
[    3.915310] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000148
[    3.915310] RBP: ffff880012499c90 R08: 0000000000000002 R09: 0000000000000000
[    3.915310] R10: 0000000000000148 R11: 0000000000000000 R12: 0000000000000148
[    3.915310] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000
[    3.915310] FS:  0000000000000000(0000) GS:ffff880013c00000(0000) knlGS:0000000000000000
[    3.915310] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[    3.915310] CR2: 0000000000000148 CR3: 0000000002605000 CR4: 00000000000406e0
[    3.915310] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    3.915310] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[    3.915310] Process swapper (pid: 1, threadinfo ffff880012498000, task ffff880012490000)
[    3.915310] Stack:
[    3.915310]  ffff880012490000 ffffffff81e6fd38 ffffffff00000000 0000000000000000
[    3.915310]  0000000000000148 0000000012499c08 ffffffff00000000 000000000000002e
[    3.915310]  0000000000000001 ffff880012499ce0 ffffffff8161620e 0000000000000000
[    3.915310] Call Trace:
[    3.915310]  [<ffffffff81e6fd38>] ? retint_restore_args+0x13/0x13
[    3.915310]  [<ffffffff8161620e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[    3.915310]  [<ffffffff81e6fd38>] ? retint_restore_args+0x13/0x13
[    3.915310]  [<ffffffff81af8883>] ? iio_dummy_evgen_get_irq+0x33/0x8a
[    3.915310]  [<ffffffff810b4255>] lock_acquire+0x8a/0xa7
[    3.915310]  [<ffffffff81af8883>] ? iio_dummy_evgen_get_irq+0x33/0x8a
[    3.915310]  [<ffffffff81e6db81>] __mutex_lock_common+0x63/0x491
[    3.915310]  [<ffffffff81af8883>] ? iio_dummy_evgen_get_irq+0x33/0x8a
[    3.915310]  [<ffffffff810b474d>] ? debug_check_no_locks_freed+0x135/0x14a
[    3.915310]  [<ffffffff810b2c3a>] ? lock_is_held+0x92/0x9d
[    3.915310]  [<ffffffff81e6dfe5>] mutex_lock_nested+0x36/0x3b
[    3.915310]  [<ffffffff81af8883>] iio_dummy_evgen_get_irq+0x33/0x8a
[    3.915310]  [<ffffffff81af8594>] iio_simple_dummy_events_register+0x1b/0x69
[    3.915310]  [<ffffffff82ad4a91>] iio_dummy_init+0x105/0x18d
[    3.915310]  [<ffffffff82ad498c>] ? iio_init+0x7d/0x7d
[    3.915310]  [<ffffffff82a8dc02>] do_one_initcall+0x7a/0x135
[    3.915310]  [<ffffffff82a8dda7>] kernel_init+0xea/0x16f
[    3.915310]  [<ffffffff81e727c4>] kernel_thread_helper+0x4/0x10
[    3.915310]  [<ffffffff81e6fd38>] ? retint_restore_args+0x13/0x13
[    3.915310]  [<ffffffff82a8dcbd>] ? do_one_initcall+0x135/0x135
[    3.915310]  [<ffffffff81e727c0>] ? gs_change+0x13/0x13
[    3.915310] Code: 95 50 ff ff ff 74 24 e8 1f 3f 56 00 85 c0 0f 84 4e 0d 00 00 be cf 0b 00 00 83 3d 63 7c 58 02 00 0f 85 3c 0d 00 00 e9 c1 0c 00 00
[    3.915310]  81 3a a0 17 ca 82 b8 01 00 00 00 44 0f 44 e8 83 fe 01 77 0c
[    3.915310] RIP  [<ffffffff810b3008>] __lock_acquire+0xac/0xe50
[    3.915310]  RSP <ffff880012499bc0>
[    3.915310] CR2: 0000000000000148

Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: Add missing MODULE_DEVICE_TABLE and MODULE_ALIAS

Quite a few iio drivers provide no MODULE_DEVICE_TABLE or MODULE_ALIAS or only
provide a MODULE_ALIAS while they have support for multiple device ids. This
prevents auto module loading from working correctly.

This patch fixes it by adding the missing MODULE_DEVICE_TABLEs and
MODULE_ALIAS'.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:dac:ad5624r: Convert to channel spec

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:dac:ad5504: Convert to channel spec

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:dac:ad5446: Convert to channel spec

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: iio: drop "select IIO_SIMPLE_DUMMY_EVGEN"

Commit e6477000fc ("staging:iio:dummy Add event support + fake event
generator") added "select IIO_SIMPLE_DUMMY_EVGEN if [...]". But there
is no Kconfig symbol named IIO_SIMPLE_DUMMY_EVGEN. The select statement
for that symbol is a nop. Drop it.

Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Acked-by: Jonathan Cameron <jic23@camd.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:dac:ad5446: Add support for the AD5662

The AD5662 is compatible to the AD5660, but uses an external reference instead
of an internal.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:dac: Add AD5421 driver

This patch adds support for the Analog Devices AD5421 Loop-Powered, 4mA to 20mA
DAC.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: IIO_EVENT_CODE: Clamp channel numbers

Make sure we only use the allotted space for channel numbers in the event mask
and do not let them override other fields.

Since negative values are valid channel number, cast the channel number to
signed when extracting it from an event mask.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: Make write_event_value callback optional

Some devices have fixed thresholds which can not be modified so make the
write_event_value callback optional, so the drivers for these devices do not
have to implement a boilerplate no-op callback.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: iio/dac/ad5360.c: signedness bug in ad5360_read_raw()

ad5360_get_channel_vref() returns an int and scale_uv should be the
same.  Making it unsigned here breaks the error handling.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: iio/dac/ad5064.c: signedness bug in ad5064_read_raw()

regulator_get_voltage() returns an int so "scale_uv" should be an
int.  Making it unsigned here breaks the error handling.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:treewide only use shared to decide on interfaces

Internally the fact that say scale is shared across channels is
actually of remarkably little interest.  Hence lets not store it.
Numerous devices have weird combinations of channels sharing
scale anyway so it is not as though this was really telling
us much. Note however that we do still use the shared sysfs
attrs thus massively reducing the number of attrs in complex
drivers.

Side effect is that certain drivers that were abusing this
(mostly my work) needed to do a few more checks on what the
channel they are being queried on actually is.

This is also helpful for in kernel interfaces where we
just want to query the scale and don't care whether it
is shared with other channels or not.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: Do not use bitmasks for channel info addresses

Currently the iio framework uses bitmasks for the address field of channel info
attributes. This is for historical reasons and no longer required since it will
only ever query a single info attribute at once. This patch changes the code to
use the non-shifted iio_chan_info_enum values for the info attribute address.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: Add documentation for IIO_EVENT_CODE

Document the different parameters of the IIO_EVENT_CODE macro and friends.

While we are at it standardise the name of channel type parameter.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: Use userspace types for iio_event_data

Since we want to export struct iio_event_data to userspace use the userspace
integer types. Also add a include to linux/types.h.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: header reorganization

Issue brought up by Lars-Peter Clausen. This is a varient of what
he suggested.

io/iio.h for driver stuff (has to include types.h)
Sub files for the bits drivers may or may not use
iio/sysfs.h
iio/buffer.h (contents of current buffer_generic.h)
(obviously anything offering events will need events.h as well)
iio/types.h for the enums that matter to both
iio_chan_type, iio_modifier
iio/events.h for the event code stuff
IIO_EVENT_CODE and friends.  + everything in chrdev.h  So this
is the stuff that userspace cares about.
Also include iio_event_type, iio_event_direction

Thus iio drivers include iio.h + as required
events.h
sysfs.h
buffer.h

in kernel users (once that interface is merged) will need inkern.h
which will pull in types.h

Userspace will need just events.h (which pulls in types.h) to get
everything they need to know about.  Buffer userspace access doesn't
currently need any core defines. All information about the data
format is passed through sysfs.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Subject: fix build breakage in drivers/staging/iio/industrialio-core.c

This was introduced in commit b46413367961c2e8bd827e067a231be982aaeee2
(iio: fix a leak due to improper use of anon_inode_getfd())

Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: core. Allow for event chrdev obtaining ioctl if no buffer present.

Logic bug meant the chrdev would fail to open if there was no buffer support
in a driver or in the core. This meant the ioctl to get the event chrdev
would fail and hence events were not available.

V2: change error to -EINVAL to mark as unsuitable for reading rather than
not there.  Both are true depending on how you look at it.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:iio_utils.h: Add missing include

iio_utils.h uses opendir and friends which need dirent.h

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:events: Make sure userspace buffer is large enough

Make sure that the userspace buffer is large enough to hold a iio_event_data
struct before writing to it.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:core shared attrs do not work with modifier.

The logic building the name had a small bug where
it did not verify if it was generic before applying the
modifier.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: trigger fixes for repeat request of same trigger and allocation failure

Both of these are decidedly silly bugs show up whilst testing
completely different code paths.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:kfifo remove entirely pointless code.

I really don't want to think about how this bit got
in there.  It allocates some storage - copies something
into it then frees it without making use of it.
Oops.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:industrialio-trigger.c Trivial code style brackets fix

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:triggers Remove unecessary existence checks and return val

Postenable and predisable are called via buffer->ops so  don't
need to check if buffer exists.

The return value of iio_device_register_trigger_consumer is
always zero and it isn't checked anyway so get rid of it.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:light:tsl2563 missing setting of id in get id function.

Signed-off-by: Maxin B. John <maxin.john@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:light:tsl2563 both intensity channels have same chan_spec.

Bug has been fixed for some time in the outofstaging tree, but
didn't propogate back to here.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

iio: adc: ad7280a: Fix memory leak

Free channels in case read fails with error.

Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

iio: introduce type casts to avoid __ucmpdi2 calls

This patch type casts the switch control variable to 32 bits in order to
prevent a call __ucmpdi2 generated by some versions of gcc.

This fixes an undefined reference to `__ucmpdi2' when compiled for arch/blackfin

Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: rtl8192u: remove api.c file

It wasn't being used, and had a hacked-up export symbol table which
wasn't very nice either.

Reported-by: James Morris <jmorris@namei.org>
Cc: Herbert Xu <herbert@gondor.hengli.com.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

m68k/serial: Remove obsolete IRQ_FLG_* users

The m68k core irq code stopped honoring these flags during the irq
restructuring in 2006.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: et131x: Remove section comments

Following the move to put the driver into one file, comments were added to identify which source file each set of functions originated from.
These no longer made sense after functions were moved around to remove some forward declarations, so remove them.

A function comment was previously not moved along with its function, now they are reunited.

Signed-off-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

et131x: uncloak PCIe capabilities.

FIXME: it should be possible to get rid of ET1310_PCI_L0L1LATENCY as well.

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Acked-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

et131x: kiss netdev.{base_addr, irq} goodbye.

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Acked-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

et131x: remove extraneous pci_save_state.

pci_{save, restore}_state are balanced in .suspend and .resume.
They are not used anywhere else in the driver.

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Acked-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

et131x: fix error paths in et131x_pci_setup.

Wrong status code and unbalanced phy_connect.

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Acked-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

et131x: uintxy_t removal.

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Acked-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

et131x: add static qualifiers.

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Acked-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: line6: Use kmemdup rather than duplicating its implementation

 Use kmemdup rather than duplicating its implementation

 The semantic patch that makes this change is available
 in scripts/coccinelle/api/memdup.cocci.

 More information about semantic patching is available at
 http://coccinelle.lip6.fr/

Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: line6: alloc/free buffers in hw_params/hw_free

It is unsafe to free buffers in line6_pcm_stop(), which is not allowed
to sleep, since urbs cannot be killed completely there and only
unlinked.  This means I/O may still be in progress and the URB
completion function still gets invoked.  This may result in memory
corruption when buffer_in is freed but I/O is still pending.

Additionally, line6_pcm_start() is not supposed to sleep so it should
not use kmalloc(GFP_KERNEL).

These issues can be resolved by performing buffer allocation/freeing in
the .hw_params/.hw_free callbacks instead.  The ALSA documentation also
recommends doing buffer allocation/freeing in these callbacks.

Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: line6: use smallest iso ep packet size

The POD HD300 isochronous endpoints have different max packet sizes for
read and write.  Using the read endpoint max packet size may be too
large for the write endpoint.  Instead we should use the minimum of both
endpoints to be sure the size is acceptable.

In theory we could decouple read and write packet sizes but the driver
currently uses a single size which I chose not to mess with since other
features like software monitoring may depend on a single packet size for
both endpoints.

Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: line6: add missing MIDI postprocessing case for POD HD300

The driver leaves MIDI processing up to userspace for the POD HD300
device.  Add a missing case statement to skip MIDI postprocessing in the
driver.  This change has no effect other than silencing a printk:

  line6usb driver bug: missing case in linux/drivers/staging/line6/midi.c:179

Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: line6: add Pod HD300 support

The Pod HD device family uses new MIDI SysEx messages and therefore
cannot reuse the existing Pod code.  Instead of hardcoding Pod HD MIDI
messages into the driver, leave MIDI up to userspace.  This driver
simply presents MIDI and pcm ALSA devices.

This device is similar to the Pod except that it has 48 kHz audio and
does not respond to Pod SysEx messages.

Signed-off-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

line6: fix memory leaks in line6_init_midi()

If the first call to line6_midibuf_init() fails we'll leak a little
bit of memory. If the second call fails we'll leak a bit more. This
happens when we return from the function and the local variable
'line6midi' goes out of scope.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging/mei: fix check for allocating host client id

MEI_CLIENTS_MAX is 255 and host_client_id is u8 therefore
for check to work we need to first assign the return value
of find_first_zero_bit to unsigned long variable

Fix warning

drivers/staging/mei/main.c: In function mei_open
drivers/staging/mei/main.c:260:2: warning: comparison is always false due to limited range of data type

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: mei: expose misc interface instead of char device

Misc device provides everything MEI needs for registration,
it doesn't required separate driver class.

Signed-off-by: Oren Weil <oren.jer.weil@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:mei: wd_ops and wd_info should be static

wd_ops and wd_info structures are local to wd.c so mark them static

Cc: Oren Weil <oren.jer.weil@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

gma500: mark staging broken

It now clashes with upstream DRM which we don't want to block.

We don't want to delete this code just yet as we want to keep it for
comparison and reference when debugging, but soon it will be a removal
candidate as well

Signed-off-by: Alan Cox <alan@linux.intel.com>
Cc: linux-next@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Linux 3.2-rc3

Merge git://github.com/rustyrussell/linux

* git://github.com/rustyrussell/linux:
  virtio-pci: make reset operation safer
  virtio-mmio: Correct the name of the guest features selector
  virtio: add HAS_IOMEM dependency to MMIO platform bus driver

virtio-pci: make reset operation safer

virtio pci device reset actually just does an I/O
write, which in PCI is really posted, that is it
can complete on CPU before the device has received it.

Further, interrupts might have been pending on
another CPU, so device callback might get invoked after reset.

This conflicts with how drivers use reset, which is typically:
reset
unregister
a callback running after reset completed can race with
unregister, potentially leading to use after free bugs.

Fix by flushing out the write, and flushing pending interrupts.

This assumes that device is never reset from
its vq/config callbacks, or in parallel with being
added/removed, document this assumption.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

virtio-mmio: Correct the name of the guest features selector

Guest features selector spelling mistake.

Cc: Pawel Moll <pawel.moll@arm.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: virtualization@lists.linux-foundation.org
Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

virtio: add HAS_IOMEM dependency to MMIO platform bus driver

Fix this compile error on s390:

  CC [M]  drivers/virtio/virtio_mmio.o
drivers/virtio/virtio_mmio.c: In function 'vm_get_features':
drivers/virtio/virtio_mmio.c:107:2: error: implicit declaration of function 'writel'

Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Acked-by: Pawel Moll <pawel.moll@arm.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

Merge branch 'upstream-linus' of git://github.com/jgarzik/libata-dev

* 'upstream-linus' of git://github.com/jgarzik/libata-dev:
  libata: fix build without BMDMA
  [libata] ahci_platform: fix DT probing

Merge branch 'for-linus' of git://git./linux/kernel/git/jbarnes/pci

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci:
  PCI hotplug: shpchp: don't blindly claim non-AMD 0x7450 device IDs
  PCI: pciehp: wait 100 ms after Link Training check
  PCI: pciehp: wait 1000 ms before Link Training check
  PCI: pciehp: Retrieve link speed after link is trained
  PCI: Let PCI_PRI depend on PCI
  PCI: Fix compile errors with PCI_ATS and !PCI_IOV
  PCI / ACPI: Make acpiphp ignore root bridges using PCIe native hotplug

Merge branch 'for-linus' of git://git./linux/kernel/git/tyhicks/ecryptfs

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
  eCryptfs: Extend array bounds for all filename chars
  eCryptfs: Flush file in vma close
  eCryptfs: Prevent file create race condition

eCryptfs: Extend array bounds for all filename chars

From mhalcrow's original commit message:

    Characters with ASCII values greater than the size of
    filename_rev_map[] are valid filename characters.
    ecryptfs_decode_from_filename() will access kernel memory beyond
    that array, and ecryptfs_parse_tag_70_packet() will then decrypt
    those characters. The attacker, using the FNEK of the crafted file,
    can then re-encrypt the characters to reveal the kernel memory past
    the end of the filename_rev_map[] array. I expect low security
    impact since this array is statically allocated in the text area,
    and the amount of memory past the array that is accessible is
    limited by the largest possible ASCII filename character.

This patch solves the issue reported by mhalcrow but with an
implementation suggested by Linus to simply extend the length of
filename_rev_map[] to 256. Characters greater than 0x7A are mapped to
0x00, which is how invalid characters less than 0x7A were previously
being handled.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Michael Halcrow <mhalcrow@google.com>
Cc: stable@kernel.org

eCryptfs: Flush file in vma close

Dirty pages weren't being written back when an mmap'ed eCryptfs file was
closed before the mapping was unmapped. Since f_ops->flush() is not
called by the munmap() path, the lower file was simply being released.
This patch flushes the eCryptfs file in the vm_ops->close() path.

https://launchpad.net/bugs/870326

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Cc: stable@kernel.org [2.6.39+]

eCryptfs: Prevent file create race condition

The file creation path prematurely called d_instantiate() and
unlock_new_inode() before the eCryptfs inode info was fully
allocated and initialized and before the eCryptfs metadata was written
to the lower file.

This could result in race conditions in subsequent file and inode
operations leading to unexpected error conditions or a null pointer
dereference while attempting to use the unallocated memory.

https://launchpad.net/bugs/813146

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Cc: stable@kernel.org