Staging: bcm: Add min/max restrictions for IOCTL_BCM_REGISTER_READ_PRIVATE

This patch fixes two issues within bcm/Bcmchar.c. The
first condition in the or statement checks if variable
IoBuffer.OutputLength, defined from user space, is
greater than the maximum value allowed for an
unsigned short. IoBuffer.OutputLength is then used
in a kmalloc call to return a pointer to memory. If
this size is greater than an unsigned short, it
becomes useless. The second condition in the or statement
checks if the same variable, IoBuffer.OutputLength is
equal to zero before invoking the kmalloc call. In
this case, if a zero size is sent to kmalloc, a valid
pointer to memory is returned instead of the expected NULL.

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: hv: remove the carrier status check from netvsc_open()

Checking carrier status in netvsc_open() is not necessary.

Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: vt6656: potential memory corruption

param->u.wpa_key.key_len comes from the user.  If it's too large we
would write past the end of the array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: unwind the IIO_IN -> IIO_VOLTAGE define

This was originally there to avoid churn during a complex change.
Now everything is stable lets get rid of this as it is missleading
and confusing.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: Update the TODO file

Now that all vmbus audit related comments have been addressed,
update the TODO file to reflect this.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: wlags49_h2: Use IW_HANDLER macro

to declare wireless handlers.

Signed-off-by: David Kilroy <kilroyd@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: wlags49_h2: Stop playing with length in GIWESSID handler

WE21 clarified that ESSID should not be NULL terminated.
The existing code didn't NULL terminate, but did play with length
and then reset it again. Just stop it.

Signed-off-by: David Kilroy <kilroyd@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: wlags49_h2: Declare support for WEXT 21

WEXT changes between versions 15 and 21 have been taken care of,
so update the declared support.

Signed-off-by: David Kilroy <kilroyd@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: wlags49_h2: Fixup WEXT capabilities

Add recently added events to the capabilities reported in iw_range.
Use capability macros instead of assuming the array offsets.

Explicitly list scan capabilities.

Signed-off-by: David Kilroy <kilroyd@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers:staging:comedi:drivers:cb_das_cs.c codeing style issue

drivers: staging: comedi: cb_das16_cs.c
fixed over 80 line issue, and removed a space before tab issue.

Signed-off-by: Christopher Rice <rice.christopher.a@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: comedi: Added log subjects to printk()s in pcmmio

Added log subject to printk()s in drivers/staging/comedi/drivers/pcmmio.c.

Signed-off-by: Johannes Thumshirn <morbidrsa@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: vt6655-6: potential info leak in private_ioctl()

Smatch has a new check for Rosenberg type information leaks where
structs are copied to the user with uninitialized stack data in them.

In this path, the .uLinkRate member doesn't get initialized so I've
set it to zero.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/bcm/InterfaceDld.c: Fix checkpatch warnings

In the source file there are a lot of warnings. I will send it in parts to be more easy to
review. All the changes in this file its just alignment, and things like that.

Signed-off-by: Marcos Paulo de Souza <marcos.mage@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: et131x: Bugfix - driver doesn't autoreneg after cable unplug/plug events

This driver has a long standing bug where removing and inserting the ethernet cable results in no packets being
trnasmitted / received and hence no autonegotiation occurring.

Fixed by resetting the rx/tx engines and queue on detecting a cable being removed.

Signed-off-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: et131x: Remove header declaration of et131x_check_mii()

et131x_check_mii no longer exists, remove its declaration from the header file

Signed-off-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: et131x: Create et131x_[dis|en]able_txrx() calls

In et131x_netdev.c, a series of calls to enable and diasble the rx/tx engine and queue are being used in several different places.
Create two functions to encapsulate these calls, and replace many calls with just the one.

Signed-off-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: et131x: Remove et131x_check_mii() and move functionality into et131x_adjust_link()

et131x_check_mii() is now only being called from et131x_adjust_link.
Removed this call and associated subroutines, putting the functionality directly into et131x_adjust_link(), in preparation for further simplification.
Changed register checks from bare BMSR checks to use phydev/netif versions, also now uses adapter->link to track link state changes.

Signed-off-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: et131x: Add link status to adapter struct

This will be used to determine if the link state has changed when the phydev
informs the et131x that a change has occurred (in et131x_adjust_link)

Signed-off-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: et131x: support register dump in ethtool ops

Not an exhaustive dump of the et131x registers, used while debugging a specific problem - seems a shame not to keep it around.

Signed-off-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: gma500: gtt based hardware scrolling console

Add support for GTT based scrolling. Instead of pushing bits around we simply
use the GTT to change the mappings. This provides us with a very fast way to
scroll the display providing we have enough memory to allocate on 4K line
boundaries. In practice this seems to be the case except for very big displays
such as HDMI. It works out nicely on the usual configurations are netbooks and
tablets.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: gma500: frame buffer locking

If we are the console then a printk can hit us with a spin lock held (and
in fact the kernel will do its best to take printing lock).

In that case we cannot politely sleep when synching after an accelerated op
but must behave obnixously to be sure of getting the bits out.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: Prevent reading from buffer chrdev when device has no buffer.

Silly bug introduced during the chrdev merge series.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:magnetometer:ak8975: Fix probe() error-handling

Fix ak8975_probe() to jump to the appropriate exit labels when an error
occurs. With the previous code, some cleanup actions were being skipped
for some error conditions.

Signed-off-by: Stephen Warren <swarren@nvidia.com>
Acked-by: Andrew Chew <achew@nvidia.com>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:magnetometer:ak8975: Don't assume 0 is an invalid GPIO

gpio_is_valid() is the defined mechanism to determine whether a GPIO is
valid. Use this instead of assuming that 0 is an invalid GPIO.

Signed-off-by: Stephen Warren <swarren@nvidia.com>
Acked-by: Andrew Chew <achew@nvidia.com>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:magnetometer:ak8975 use platform_data to pass the gpio number.

Tegra doesn't have irq_to_gpio() any more, and ak8975 is included in
tegra_defconfig. This causes a build failure. Instead, pass the GPIO name
through platform data.

[swarren: Rewrote commit description when I squashed this with my patch
to remove the irq_to_gpio() call]

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:accel:lis3l02dq ring->buffer renames.

This driver already supports kfifo usage, so the term ring is
misleading and hence replaced.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: replacing term ring with buffer in the IIO core.

They aren't always ring buffers, so just use buffer for all naming.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: rename ring_generic.h -> buffer_generic.h

Nothing in this file is specific to RING buffers so rename it.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: tree wide IIO_RING_BUFFER config symbol to IIO_BUFFER

Functionality is generic, so name is missleading.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: tree wide IIO_RING_TRIGGERED -> IIO_BUFFER_TRIGGERED

also, IIO_RING_HARDWARE_BUFFER -> IIO_BUFFER_HARDWARE

These aren't always rings so the naming should not imply that.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio: treewide rename iio_triggered_ring_* to iio_triggered_buffer_*

Not always a ring so naming is missleading.
Also, kfifo_buf is probably first buffer to take out of staging and it
definitely isn't a ring.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:documentation Add abi docs for capacitance adcs.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging:iio:documentation general refresh of abi docs.

Numerous small fixes and additions of missing elements.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: iio: Move sensor drivers to sub menus

We have a lot of drivers now, so the iio sub menu becomes quite large.
This patch creates sub menus for the different sensors.

Signed-off-by: Manuel Stahl <manuel.stahl@iis.fraunhofer.de>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: iio: adc: Replace, rewrite ad7745 from scratch.

The existing ad7745 driver didn't conform with the IIO spec for such devices.
It was way simpler to rewrite the existing driver, than actually fixing it.

Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: intel_sst: instel_sst: fixed some coding style issues.

Fixed a coding style issue.

Signed-off-by: Jaap Crezee <jaap@jcz.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: mei: Organize the initialization state machine.

moving the final state, clearing of the client maps and
updating of mei state out from mei_host_client_properties function.

Acked-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Oren Weil <oren.jer.weil@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: rtl8192e: off by one in rtl8192_get_channel_map()

COUNTRY_CODE_MAX is not a valid country code.  We're off by one here.
This gets passed to Dot11d_Channelmap() where it's used as an offset
into the ChannelPlan[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: simplified internal ioctl function once more

Code cleanup. Merged two functions.

Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: consistent naming of struct net_device *ndev

Code cleanup. Various names (ndev, net, dev) were used for the
same structure. Settled for 'ndev'.

Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: clarified fullmac io and event codes

Added comments to make code more readable.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: removed log after kzalloc()/kmalloc() failure

kzalloc/kmalloc already reports an allocation failure themselves.

Reported-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: removed likely/unlikely calls

There was no performance rationale to use these guys.

Reported-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: added endianness check flag to fullmac Makefile

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: removed two fullmac sparse spinlock warnings

By deleting three redundant functions. The spinlock was related to
event queue operation. Event queue data members were also renamed
to make their function more clear.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove global variables for data frame boundary

Put boundary settings in brcmf_bus structure

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove fullmac module_param brcmf_idletime

Use constant for idle time setting.

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove fullmac module_param for watchdog

Use constant to replace global variable used for watchdog polling

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove fullmac module_param brcmf_sdiod_drive_strength

Replaced the global variable with constant

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove fullmac module_param brcmf_dongle_memsize

remove unused module parameter brcmf_dongle_memsize and related code

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove event handler thread from fullmac

Use work queue to defer cfg80211 event handle jobs

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove unconditional code blocks from brcmfmac

Using a block statement to scope function variables is not
common in linux kernel development. Browsed through the brcmfmac
to remove those.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: more fullmac sparse endianness scan related changes

Annotated endianness on structures send/received to/from dongle.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: sparse endianness warnings for struct sdpcm_shared

Structure that is received from dongle has been annotated.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: sparse endianness warnings for struct brcmf_proto_cdc_ioctl

Structure that is send/received to/from dongle has been annotated.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: various fulmac sparse endianness fixes

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: sparse endianness warnings on dongle events

Structures received from dongle have been annotated.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: vmbus: Get rid of hv_cb_utils[] and other unneeded code

Now that the transformation of the util driver is complete,
get rid of hv_cb_utils[] and other unneeded code.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: util: Properly handle util services in the util driver

Now, properly handle util services in the util driver and eliminate code
that will not be necessary. In the current code, util services were
all handled not as other vmbus devices (net, block) but rather through
special handling (channel setup etc.). In this patch we handle all
services using the standard Linux Driver Model.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: hv: util: Perform some service specific init/deinit in probe/remove

In preparation for modifying the util driver to fully conform to the
Linux Driver Model, perform some service specific init and de-init
operations in util_probe()/util_remove()  as opposed to in
init_hyperv_utils()/exit_hyperv_utils() as is currently done.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: wlags49_h2: Support standard WEXT events

... instead of using IWEVCUSTOM. Use the defined events for
michael mic failure, association request info and association
response info.

Signed-off-by: David Kilroy <kilroyd@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: wlags49_h2: Remove old WIRELESS_EXT support

Since the driver is now in-kernel remove support for building
against ancient WIRELESS_EXT versions.

Signed-off-by: David Kilroy <kilroyd@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: quatech_usb2: Potential lost wakeup scenario in TIOCMIWAIT

If the usermode app does an ioctl over this serial device  by
using TIOCMIWAIT, then the code will wait by setting the current
task state to TASK_INTERRUPTIBLE and then calling schedule().
This will be woken up by the qt2_process_modem_status on URB
completion when the port_extra->shadowMSR is set to the new
modem status.

However, this could result in a lost wakeup scenario due to a race
in the logic in the qt2_ioctl(TIOCMIWAIT) loop and the URB completion
for new modem status in qt2_process_modem_status.
Due to this, the usermode app's task will continue to sleep despite a
change in the modem status.

Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: bcm: Add size maximum size restrictions for IOCTL_IDLE_REQ

In the first alteration, the MAX_CNTL_PKT_SIZE is the
maximum size of the control packet in ->Adapter->txctlpacket[]
which is defined in InitAdapter(). This caps the size of
kmalloc memory allocation. In the second change, this max
cap fixes a potential memory corruption bug when subsequent
memset and memcpy calls are invoked.

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: bcm: Add size minimum size restrictions for IOCTL_IDLE_REQ

If IoBuffer.InputLength is zero then this will cause an Oops when
we dereference the ZERO_SIZE_PTR.  Or if it's smaller than
sizeof(struct link_request) then we would get memory corruption
when we set ->PLength in CopyBufferToControlPacket().

Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: usbip: fix up api changes that broke windows clients

Revert changes in definitions that were submitted on May 11 2011 and
committed on June 7 2011. No reason for the change in these values was
given in the patch comment, it broke compatibility with older
versions, and was difficult to detect by the simultaneous move of the
lines of code.

Signed-off-by: Alexander Thomas <alexander.thomas@esaturnus.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: sparse endianness warnings on fullmac bss info

Structure that is received from dongle has been annotated.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove static global variables from dhd_sdio.c

Several global variables that were set but never initialized have
been removed.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove global variable from bcmsdh_sdmmc.c

The source file contained some static global variables that were
needed per device handled by the driver. They have moved to the
struct brcmf_sdio_dev for that reason.

Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove for_each_bss() macro from brcmfmac driver

The macro was only used once in the code and has been removed for
clarity reading the code.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove brcmfmac interface name override

The brcmfmac had a module parameter which could be used to override
the name of the wireless net device name and it defaults to 'wlan'.
This is considered rather useless, because what is in a name.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove fullmac module_param for ARP offload feature

Use macro to replace global variable for ARP offload configuration

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove _brcmf_sysioc_thread in fullmac

_brcmf_sysioc_thread is handling deferred jobs from 4 callers. Use
work queue to handle set_mac_address/set_multicast_list requests.
brcmf_add_if/brcmf_del_if never run in atomic context and can call
brcmf_op_if directly.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: fixed sparse endianness warnings on fullmac ratespec

Structure that is sent to the dongle has been annotated.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: fixed sparse endianness warnings on fullmac scb pars

Structure that is sent to the dongle has been annotated.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: fixed sparse endianness warnings on fullmac assoc pars

Structures that are sent to the dongle have been annotated.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: fixed sparse endianness warnings on fullmac scan pars

Three structures that are sent to the dongle have been annotated for correct
endianness:  struct brcmf_iscan_params, brcmf_scan_params,
brcmf_cfg80211_scan_req.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: removed set_fs/get_fs/get_ds calls from brcmf_dev_ioctl()

brcmf_dev_ioctl() does not provide a user space buffer to
brcmf_netdev_ioctl_priv. Hence these calls are not necessary.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: simplified brcmf_proto_ioctl()

Removed a function parameter since it was redundant.

Reviewed-by: Arend van Spriel <arend@broadcom.com>
Reviewed-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove global variable brcmf_radio_up from fullmac

Remove unnecessary global variable

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove global variable brcmf_roam from fullmac

Remove unnecessary global variable

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove fullmac module_param for packet filter feature

Use constant values for packet filter configuration

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove fullmac module_param brcmf_deferred_tx

Remove brcmf_deferred_tx as it should be always 1

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove fullmac module_param sd_f2_blocksize

Replaced the global variable with macro.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

staging: brcm80211: remove SOFTAP code from fullmac

Dead code removal.

Reviewed-by: Roland Vossen <rvossen@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/staging/mei/interface.c: take size of pointed value, not pointer

Sizeof a pointer-typed expression returns the size of the pointer, not that
of the pointed data.

The semantic patch that fixes this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression *e;
type T;
identifier f;
@@

f(...,(T)e,...,
-sizeof(e)
+sizeof(*e)
,...)
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: cx25821-video.h: Fix long lines

Fix long function prototypes and line up arguments nicely.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: cx25821-video.h: Fix indent

Fix indent of function arguments.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: cx25821-video.h: Line up constant

Line up integer constant with others.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: Replace :? by if-else in cx25821-video.c

Replace :? operator by equivalent if-else statement where in improves
readability. Don't add else branch if it is not needed.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: Fix braces around statements in cx25821-video.c

Delete braces around single statements.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: Change indent with spaces to tabs 35

Change indent with spaces to tabs.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: Change indent with spaces to tabs 34

Change indent with spaces to tabs.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: Change indent with spaces to tabs 33

Change indent with spaces to tabs.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: Change indent with spaces to tabs 32

Change indent with spaces to tabs.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: Change indent with spaces to tabs 31

Change indent with spaces to tabs.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: Change indent with spaces to tabs 30

Change indent with spaces to tabs.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: Change indent with spaces to tabs 29

Change indent with spaces to tabs.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: Change indent with spaces to tabs 28

Change indent with spaces to tabs.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Staging: cx25821: Change indent with spaces to tabs 27

Change indent with spaces to tabs.

Signed-off-by: Leonid V. Fedorenchik <leonidsbox@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>