Staging: Merge 2.6.37-rc2 into staging-next

This was necessary in order  to resolve some conflicts that happened
between -rc1 and -rc2 with the following files:
	drivers/staging/bcm/Bcmchar.c
	drivers/staging/intel_sst/intel_sst_app_interface.c

All should be resolved now.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --cc drivers/staging/bcm/Bcmchar.c
index 8089d19e6c1b5ff493c74ba0efe2548043d9d95b,fead9c56162e1f629648ca1a8d94aca0887e8cc1..31674ea1cd480d2926d556e4ff46289906d678f0
--- 1/drivers/staging/bcm/Bcmchar.c
--- 2/drivers/staging/bcm/Bcmchar.c
+++ b/drivers/staging/bcm/Bcmchar.c
@@@ -907,9 -999,11 +907,10 @@@ static long bcm_char_ioctl(struct file 
                        up(&Adapter->NVMRdmWrmLock);
                        break;
                }
 -#endif
                case IOCTL_BE_BUCKET_SIZE:
-                       Adapter->BEBucketSize = *(PULONG)arg;
-                       Status = STATUS_SUCCESS;
+                       Status = 0;
+                       if (get_user(Adapter->BEBucketSize, (unsigned long __user *)arg))
+                               Status = -EFAULT;
                        break;
  
                case IOCTL_RTPS_BUCKET_SIZE:
@@@ -997,16 -1108,19 +1003,19 @@@
                                Status = -EFAULT;
                                break;
                        }
- 
 -                      if (IoBuffer.OutputLength != sizeof(plink_state)) {
++                      if (IoBuffer.OutputLength != sizeof(link_state)) {
+                               Status = -EINVAL;
+                               break;
+                       }
  
 -                      if (copy_from_user(&plink_state, (void __user *)arg, sizeof(plink_state))) {
 -                              Status = -EFAULT;
 -                              break;
 -                      }
 -                      plink_state.bIdleMode = (UCHAR)Adapter->IdleMode;
 -                      plink_state.bShutdownMode = Adapter->bShutStatus;
 -                      plink_state.ucLinkStatus = (UCHAR)Adapter->LinkStatus;
 -                      if (copy_to_user(IoBuffer.OutputBuffer, &plink_state, IoBuffer.OutputLength)) {
 +                      memset(&link_state, 0, sizeof(link_state));
 +                      link_state.bIdleMode = Adapter->IdleMode;
 +                      link_state.bShutdownMode = Adapter->bShutStatus;
 +                      link_state.ucLinkStatus = Adapter->LinkStatus;
 +
 +                      if (copy_to_user(IoBuffer.OutputBuffer, &link_state,
 +                                       min_t(size_t, sizeof(link_state), IoBuffer.OutputLength)))
 +                      {
                                BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0, "Copy_to_user Failed..\n");
                                Status = -EFAULT;
                                break;

diff --cc drivers/staging/brcm80211/brcmfmac/dhd_linux.c
Simple merge

diff --cc drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
Simple merge

diff --cc drivers/staging/ft1000/ft1000-usb/ft1000_chdev.c
Simple merge

diff --cc drivers/staging/hv/hv_utils.c
Simple merge

diff --cc drivers/staging/intel_sst/intel_sst_app_interface.c
index fb718d47f54b31f2eb523a7d3fcf3f0feb14c1c7,9618c79974611f682a8d4dd575f704cf00f92443..09909559a92202e7f92897325f47035fdba182b9
--- 1/drivers/staging/intel_sst/intel_sst_app_interface.c
--- 2/drivers/staging/intel_sst/intel_sst_app_interface.c
+++ b/drivers/staging/intel_sst/intel_sst_app_interface.c
@@@ -246,8 -244,9 +246,9 @@@ static int intel_sst_mmap_play_capture(
        int retval, i;
        struct stream_info *stream;
        struct snd_sst_mmap_buff_entry *buf_entry;
+       struct snd_sst_mmap_buff_entry *tmp_buf;
  
 -      pr_debug("sst:called for str_id %d\n", str_id);
 +      pr_debug("called for str_id %d\n", str_id);
        retval = sst_validate_strid(str_id);
        if (retval)
                return -EINVAL;
@@@ -264,14 -262,24 +264,24 @@@
        stream->curr_bytes = 0;
        stream->cumm_bytes = 0;
  
 -      pr_debug("sst:new buffers count %d status %d\n",
+       tmp_buf = kcalloc(mmap_buf->entries, sizeof(*tmp_buf), GFP_KERNEL);
+       if (!tmp_buf)
+               return -ENOMEM;
+       if (copy_from_user(tmp_buf, (void __user *)mmap_buf->buff,
+                       mmap_buf->entries * sizeof(*tmp_buf))) {
+               retval = -EFAULT;
+               goto out_free;
+       }
+ 
 +      pr_debug("new buffers count %d status %d\n",
                        mmap_buf->entries, stream->status);
-       buf_entry = mmap_buf->buff;
+       buf_entry = tmp_buf;
        for (i = 0; i < mmap_buf->entries; i++) {
-               BUG_ON(!buf_entry);
                bufs = kzalloc(sizeof(*bufs), GFP_KERNEL);
-               if (!bufs)
-                       return -ENOMEM;
+               if (!bufs) {
+                       retval = -ENOMEM;
+                       goto out_free;
+               }
                bufs->size = buf_entry->size;
                bufs->offset = buf_entry->offset;
                bufs->addr = sst_drv_ctx->mmap_mem;
@@@ -293,15 -301,17 +303,17 @@@
                stream->status = STREAM_RUNNING;
                if (stream->ops == STREAM_OPS_PLAYBACK) {
                        if (sst_play_frame(str_id) < 0) {
 -                              pr_warn("sst: play frames fail\n");
 +                              pr_warn("play frames fail\n");
                                mutex_unlock(&stream->lock);
-                               return -EIO;
+                               retval = -EIO;
+                               goto out_free;
                        }
                } else if (stream->ops == STREAM_OPS_CAPTURE) {
                        if (sst_capture_frame(str_id) < 0) {
 -                              pr_warn("sst: capture frame fail\n");
 +                              pr_warn("capture frame fail\n");
                                mutex_unlock(&stream->lock);
-                               return -EIO;
+                               retval = -EIO;
+                               goto out_free;
                        }
                }
        }
@@@ -315,7 -325,10 +327,10 @@@
  
        if (retval >= 0)
                retval = stream->cumm_bytes;
 -      pr_debug("sst:end of play/rec ioctl bytes = %d!!\n", retval);
 +      pr_debug("end of play/rec ioctl bytes = %d!!\n", retval);
+ 
+ out_free:
+       kfree(tmp_buf);
        return retval;
  }
  
@@@ -840,9 -851,9 +853,9 @@@ long intel_sst_ioctl(struct file *file_
                break;
  
        case _IOC_NR(SNDRV_SST_STREAM_SET_PARAMS): {
-               struct snd_sst_params *str_param = (struct snd_sst_params *)arg;
+               struct snd_sst_params str_param;
  
 -              pr_debug("sst: IOCTL_SET_PARAMS recieved!\n");
 +              pr_debug("IOCTL_SET_PARAMS received!\n");
                if (minor != STREAM_MODULE) {
                        retval = -EBADRQC;
                        break;
@@@ -866,9 -885,9 +887,9 @@@
                                        retval = -EINVAL;
                        }
                } else {
 -                      pr_debug("sst: SET_STREAM_PARAMS recieved!\n");
 +                      pr_debug("SET_STREAM_PARAMS received!\n");
                        /* allocated set params only */
-                       retval = sst_set_stream_param(str_id, str_param);
+                       retval = sst_set_stream_param(str_id, &str_param);
                        /* Block the call for reply */
                        if (!retval) {
                                int sfreq = 0, word_size = 0, num_channel = 0;
@@@ -887,37 -904,36 +906,36 @@@
                break;
        }
        case _IOC_NR(SNDRV_SST_SET_VOL): {
-               struct snd_sst_vol *set_vol;
-               struct snd_sst_vol *rec_vol = (struct snd_sst_vol *)arg;
-               pr_debug("SET_VOLUME received for %d!\n",
-                               rec_vol->stream_id);
-               if (minor == STREAM_MODULE && rec_vol->stream_id == 0) {
-                       pr_debug("invalid operation!\n");
-                       retval = -EPERM;
-                       break;
-               }
-               set_vol = kzalloc(sizeof(*set_vol), GFP_ATOMIC);
-               if (!set_vol) {
-                       pr_debug("mem allocation failed\n");
-                       retval = -ENOMEM;
-                       break;
-               }
-               if (copy_from_user(set_vol, rec_vol, sizeof(*set_vol))) {
+               struct snd_sst_vol set_vol;
+ 
+               if (copy_from_user(&set_vol, (void __user *)arg,
+                               sizeof(set_vol))) {
 -                      pr_debug("sst: copy failed\n");
 +                      pr_debug("copy failed\n");
                        retval = -EFAULT;
                        break;
                }
-               retval = sst_set_vol(set_vol);
-               kfree(set_vol);
 -              pr_debug("sst: SET_VOLUME recieved for %d!\n",
++              pr_debug("SET_VOLUME recieved for %d!\n",
+                               set_vol.stream_id);
+               if (minor == STREAM_MODULE && set_vol.stream_id == 0) {
 -                      pr_debug("sst: invalid operation!\n");
++                      pr_debug("invalid operation!\n");
+                       retval = -EPERM;
+                       break;
+               }
+               retval = sst_set_vol(&set_vol);
                break;
        }
        case _IOC_NR(SNDRV_SST_GET_VOL): {
-               struct snd_sst_vol *rec_vol = (struct snd_sst_vol *)arg;
                struct snd_sst_vol get_vol;
-               pr_debug("IOCTL_GET_VOLUME received for stream = %d!\n",
-                               rec_vol->stream_id);
-               if (minor == STREAM_MODULE && rec_vol->stream_id == 0) {
+ 
+               if (copy_from_user(&get_vol, (void __user *)arg,
+                               sizeof(get_vol))) {
+                       retval = -EFAULT;
+                       break;
+               }
 -              pr_debug("sst: IOCTL_GET_VOLUME recieved for stream = %d!\n",
++              pr_debug("IOCTL_GET_VOLUME recieved for stream = %d!\n",
+                               get_vol.stream_id);
+               if (minor == STREAM_MODULE && get_vol.stream_id == 0) {
 -                      pr_debug("sst: invalid operation!\n");
 +                      pr_debug("invalid operation!\n");
                        retval = -EPERM;
                        break;
                }
@@@ -927,10 -942,10 +944,10 @@@
                        retval = -EIO;
                        break;
                }
 -              pr_debug("sst: id:%d\n, vol:%d, ramp_dur:%d, ramp_type:%d\n",
 +              pr_debug("id:%d\n, vol:%d, ramp_dur:%d, ramp_type:%d\n",
                                get_vol.stream_id, get_vol.volume,
                                get_vol.ramp_duration, get_vol.ramp_type);
-               if (copy_to_user((struct snd_sst_vol *)arg,
+               if (copy_to_user((struct snd_sst_vol __user *)arg,
                                &get_vol, sizeof(get_vol))) {
                        retval = -EFAULT;
                        break;
@@@ -940,25 -955,20 +957,20 @@@
        }
  
        case _IOC_NR(SNDRV_SST_MUTE): {
-               struct snd_sst_mute *set_mute;
-               struct snd_sst_vol *rec_mute = (struct snd_sst_vol *)arg;
-               pr_debug("SNDRV_SST_SET_VOLUME received for %d!\n",
-                       rec_mute->stream_id);
-               if (minor == STREAM_MODULE && rec_mute->stream_id == 0) {
-                       retval = -EPERM;
-                       break;
-               }
-               set_mute = kzalloc(sizeof(*set_mute), GFP_ATOMIC);
-               if (!set_mute) {
-                       retval = -ENOMEM;
+               struct snd_sst_mute set_mute;
+ 
+               if (copy_from_user(&set_mute, (void __user *)arg,
+                               sizeof(set_mute))) {
+                       retval = -EFAULT;
                        break;
                }
-               if (copy_from_user(set_mute, rec_mute, sizeof(*set_mute))) {
-                       retval = -EFAULT;
 -              pr_debug("sst: SNDRV_SST_SET_VOLUME recieved for %d!\n",
++              pr_debug("SNDRV_SST_SET_VOLUME recieved for %d!\n",
+                       set_mute.stream_id);
+               if (minor == STREAM_MODULE && set_mute.stream_id == 0) {
+                       retval = -EPERM;
                        break;
                }
-               retval = sst_set_mute(set_mute);
-               kfree(set_mute);
+               retval = sst_set_mute(&set_mute);
                break;
        }
        case _IOC_NR(SNDRV_SST_STREAM_GET_PARAMS): {
@@@ -985,18 -995,24 +997,24 @@@
        }
  
        case _IOC_NR(SNDRV_SST_MMAP_PLAY):
-       case _IOC_NR(SNDRV_SST_MMAP_CAPTURE):
-               pr_debug("SNDRV_SST_MMAP_PLAY/CAPTURE received!\n");
+       case _IOC_NR(SNDRV_SST_MMAP_CAPTURE): {
+               struct snd_sst_mmap_buffs mmap_buf;
+ 
 -              pr_debug("sst: SNDRV_SST_MMAP_PLAY/CAPTURE recieved!\n");
++              pr_debug("SNDRV_SST_MMAP_PLAY/CAPTURE recieved!\n");
                if (minor != STREAM_MODULE) {
                        retval = -EBADRQC;
                        break;
                }
-               retval = intel_sst_mmap_play_capture(str_id,
-                               (struct snd_sst_mmap_buffs *)arg);
+               if (copy_from_user(&mmap_buf, (void __user *)arg,
+                               sizeof(mmap_buf))) {
+                       retval = -EFAULT;
+                       break;
+               }
+               retval = intel_sst_mmap_play_capture(str_id, &mmap_buf);
                break;
- 
+       }
        case _IOC_NR(SNDRV_SST_STREAM_DROP):
 -              pr_debug("sst: SNDRV_SST_IOCTL_DROP recieved!\n");
 +              pr_debug("SNDRV_SST_IOCTL_DROP received!\n");
                if (minor != STREAM_MODULE) {
                        retval = -EINVAL;
                        break;
@@@ -1067,11 -1082,14 +1084,14 @@@
        }
  
        case _IOC_NR(SNDRV_SST_SET_TARGET_DEVICE): {
-               struct snd_sst_target_device *target_device;
+               struct snd_sst_target_device target_device;
  
-               pr_debug("SET_TARGET_DEVICE received!\n");
-               target_device = (struct snd_sst_target_device *)arg;
-               BUG_ON(!target_device);
 -              pr_debug("sst: SET_TARGET_DEVICE recieved!\n");
++              pr_debug("SET_TARGET_DEVICE recieved!\n");
+               if (copy_from_user(&target_device, (void __user *)arg,
+                               sizeof(target_device))) {
+                       retval = -EFAULT;
+                       break;
+               }
                if (minor != AM_MODULE) {
                        retval = -EBADRQC;
                        break;
@@@ -1081,30 -1099,31 +1101,31 @@@
        }
  
        case _IOC_NR(SNDRV_SST_DRIVER_INFO): {
-               struct snd_sst_driver_info *info =
-                       (struct snd_sst_driver_info *)arg;
+               struct snd_sst_driver_info info;
  
-               pr_debug("SNDRV_SST_DRIVER_INFO received\n");
-               info->version = SST_VERSION_NUM;
 -              pr_debug("sst: SNDRV_SST_DRIVER_INFO recived\n");
++              pr_debug("SNDRV_SST_DRIVER_INFO recived\n");
+               info.version = SST_VERSION_NUM;
                /* hard coding, shud get sumhow later */
-               info->active_pcm_streams = sst_drv_ctx->stream_cnt -
+               info.active_pcm_streams = sst_drv_ctx->stream_cnt -
                                                sst_drv_ctx->encoded_cnt;
-               info->active_enc_streams = sst_drv_ctx->encoded_cnt;
-               info->max_pcm_streams = MAX_ACTIVE_STREAM - MAX_ENC_STREAM;
-               info->max_enc_streams = MAX_ENC_STREAM;
-               info->buf_per_stream = sst_drv_ctx->mmap_len;
+               info.active_enc_streams = sst_drv_ctx->encoded_cnt;
+               info.max_pcm_streams = MAX_ACTIVE_STREAM - MAX_ENC_STREAM;
+               info.max_enc_streams = MAX_ENC_STREAM;
+               info.buf_per_stream = sst_drv_ctx->mmap_len;
+               if (copy_to_user((void __user *)arg, &info,
+                               sizeof(info)))
+                       retval = -EFAULT;
                break;
        }
  
        case _IOC_NR(SNDRV_SST_STREAM_DECODE): {
-               struct snd_sst_dbufs *param =
-                               (struct snd_sst_dbufs *)arg, dbufs_local;
-               int i;
+               struct snd_sst_dbufs param;
+               struct snd_sst_dbufs dbufs_local;
                struct snd_sst_buffs ibufs, obufs;
-               struct snd_sst_buff_entry ibuf_temp[param->ibufs->entries],
-                               obuf_temp[param->obufs->entries];
+               struct snd_sst_buff_entry *ibuf_tmp, *obuf_tmp;
+               char __user *dest;
  
 -              pr_debug("sst: SNDRV_SST_STREAM_DECODE recived\n");
 +              pr_debug("SNDRV_SST_STREAM_DECODE received\n");
                if (minor != STREAM_MODULE) {
                        retval = -EBADRQC;
                        break;
@@@ -1166,10 -1207,10 +1209,10 @@@ free_iobufs
                break;
  
        case _IOC_NR(SNDRV_SST_STREAM_BYTES_DECODED): {
-               unsigned long long *bytes = (unsigned long long *)arg;
+               unsigned long long __user *bytes = (unsigned long long __user *)arg;
                struct snd_sst_tstamp tstamp = {0};
  
 -              pr_debug("sst: STREAM_BYTES_DECODED recieved!\n");
 +              pr_debug("STREAM_BYTES_DECODED received!\n");
                if (minor != STREAM_MODULE) {
                        retval = -EINVAL;
                        break;

diff --cc drivers/staging/keucr/ms.c
Simple merge

diff --cc drivers/staging/rt2860/usb_main_dev.c
Simple merge

diff --cc drivers/staging/rtl8192e/r8192E_core.c
Simple merge

diff --cc drivers/staging/udlfb/udlfb.c
Simple merge

diff --cc drivers/staging/wlan-ng/p80211netdev.c
Simple merge

diff --cc drivers/usb/serial/option.c
Simple merge