14 files changed, 91 insertions, 17 deletions

diff --git a/drivers/iio/adc/npcm_adc.c b/drivers/iio/adc/npcm_adc.c
index 9e25bbec9c70..193b3b81de4d 100644
--- a/drivers/iio/adc/npcm_adc.c
+++ b/drivers/iio/adc/npcm_adc.c
@@ -149,7 +149,7 @@ static int npcm_adc_read_raw(struct iio_dev *indio_dev,
                 }
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_SCALE:
-                if (info->vref) {
+                if (!IS_ERR(info->vref)) {
                         vref_uv = regulator_get_voltage(info->vref);
                         *val = vref_uv / 1000;
                 } else {
diff --git a/drivers/iio/adc/ti-ads124s08.c b/drivers/iio/adc/ti-ads124s08.c
index 53f17e4f2f23..552c2be8d87a 100644
--- a/drivers/iio/adc/ti-ads124s08.c
+++ b/drivers/iio/adc/ti-ads124s08.c
@@ -202,7 +202,7 @@ static int ads124s_read(struct iio_dev *indio_dev, unsigned int chan)
         };
 
         priv->data[0] = ADS124S08_CMD_RDATA;
-        memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data));
+        memset(&priv->data[1], ADS124S08_CMD_NOP, sizeof(priv->data) - 1);
 
         ret = spi_sync_transfer(priv->spi, t, ARRAY_SIZE(t));
         if (ret < 0)
diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c
index f9461070a74a..8cb7a2034982 100644
--- a/drivers/iio/adc/ti-ads8688.c
+++ b/drivers/iio/adc/ti-ads8688.c
@@ -397,7 +397,7 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p)
         }
 
         iio_push_to_buffers_with_timestamp(indio_dev, buffer,
-                        pf->timestamp);
+                        iio_get_time_ns(indio_dev));
 
         iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/dac/ds4424.c b/drivers/iio/dac/ds4424.c
index 883a47562055..714a97f91319 100644
--- a/drivers/iio/dac/ds4424.c
+++ b/drivers/iio/dac/ds4424.c
@@ -166,7 +166,7 @@ static int ds4424_verify_chip(struct iio_dev *indio_dev)
 {
         int ret, val;
 
-        ret = ds4424_get_value(indio_dev, &val, DS4424_DAC_ADDR(0));
+        ret = ds4424_get_value(indio_dev, &val, 0);
         if (ret < 0)
                 dev_err(&indio_dev->dev,
                                 "%s failed. ret: %d\n", __func__, ret);
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index 6138a6d86afb..c2916d2d552c 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -471,7 +471,10 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev,
                         return IIO_VAL_INT_PLUS_MICRO;
                 case IIO_TEMP:
                         *val = 0;
-                        *val2 = INV_MPU6050_TEMP_SCALE;
+                        if (st->chip_type == INV_ICM20602)
+                                *val2 = INV_ICM20602_TEMP_SCALE;
+                        else
+                                *val2 = INV_MPU6050_TEMP_SCALE;
 
                         return IIO_VAL_INT_PLUS_MICRO;
                 default:
@@ -480,7 +483,10 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev,
         case IIO_CHAN_INFO_OFFSET:
                 switch (chan->type) {
                 case IIO_TEMP:
-                        *val = INV_MPU6050_TEMP_OFFSET;
+                        if (st->chip_type == INV_ICM20602)
+                                *val = INV_ICM20602_TEMP_OFFSET;
+                        else
+                                *val = INV_MPU6050_TEMP_OFFSET;
 
                         return IIO_VAL_INT;
                 default:
@@ -847,6 +853,32 @@ static const struct iio_chan_spec inv_mpu_channels[] = {
         INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_Z, INV_MPU6050_SCAN_ACCL_Z),
 };
 
+static const struct iio_chan_spec inv_icm20602_channels[] = {
+        IIO_CHAN_SOFT_TIMESTAMP(INV_ICM20602_SCAN_TIMESTAMP),
+        {
+                .type = IIO_TEMP,
+                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW)
+                                | BIT(IIO_CHAN_INFO_OFFSET)
+                                | BIT(IIO_CHAN_INFO_SCALE),
+                .scan_index = INV_ICM20602_SCAN_TEMP,
+                .scan_type = {
+                                .sign = 's',
+                                .realbits = 16,
+                                .storagebits = 16,
+                                .shift = 0,
+                                .endianness = IIO_BE,
+                             },
+        },
+
+        INV_MPU6050_CHAN(IIO_ANGL_VEL, IIO_MOD_X, INV_ICM20602_SCAN_GYRO_X),
+        INV_MPU6050_CHAN(IIO_ANGL_VEL, IIO_MOD_Y, INV_ICM20602_SCAN_GYRO_Y),
+        INV_MPU6050_CHAN(IIO_ANGL_VEL, IIO_MOD_Z, INV_ICM20602_SCAN_GYRO_Z),
+
+        INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_Y, INV_ICM20602_SCAN_ACCL_Y),
+        INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_X, INV_ICM20602_SCAN_ACCL_X),
+        INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_Z, INV_ICM20602_SCAN_ACCL_Z),
+};
+
 /*
  * The user can choose any frequency between INV_MPU6050_MIN_FIFO_RATE and
  * INV_MPU6050_MAX_FIFO_RATE, but only these frequencies are matched by the
@@ -1102,8 +1134,14 @@ int inv_mpu_core_probe(struct regmap *regmap, int irq, const char *name,
                 indio_dev->name = name;
         else
                 indio_dev->name = dev_name(dev);
-        indio_dev->channels = inv_mpu_channels;
-        indio_dev->num_channels = ARRAY_SIZE(inv_mpu_channels);
+
+        if (chip_type == INV_ICM20602) {
+                indio_dev->channels = inv_icm20602_channels;
+                indio_dev->num_channels = ARRAY_SIZE(inv_icm20602_channels);
+        } else {
+                indio_dev->channels = inv_mpu_channels;
+                indio_dev->num_channels = ARRAY_SIZE(inv_mpu_channels);
+        }
 
         indio_dev->info = &mpu_info;
         indio_dev->modes = INDIO_BUFFER_TRIGGERED;
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
index 325afd9f5f61..3d5fe4474378 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
@@ -208,6 +208,9 @@ struct inv_mpu6050_state {
 #define INV_MPU6050_BYTES_PER_3AXIS_SENSOR   6
 #define INV_MPU6050_FIFO_COUNT_BYTE          2
 
+/* ICM20602 FIFO samples include temperature readings */
+#define INV_ICM20602_BYTES_PER_TEMP_SENSOR   2
+
 /* mpu6500 registers */
 #define INV_MPU6500_REG_ACCEL_CONFIG_2      0x1D
 #define INV_MPU6500_REG_ACCEL_OFFSET        0x77
@@ -229,6 +232,9 @@ struct inv_mpu6050_state {
 #define INV_MPU6050_GYRO_CONFIG_FSR_SHIFT    3
 #define INV_MPU6050_ACCL_CONFIG_FSR_SHIFT    3
 
+#define INV_ICM20602_TEMP_OFFSET             8170
+#define INV_ICM20602_TEMP_SCALE              3060
+
 /* 6 + 6 round up and plus 8 */
 #define INV_MPU6050_OUTPUT_DATA_SIZE         24
 
@@ -270,7 +276,7 @@ struct inv_mpu6050_state {
 #define INV_ICM20608_WHOAMI_VALUE               0xAF
 #define INV_ICM20602_WHOAMI_VALUE               0x12
 
-/* scan element definition */
+/* scan element definition for generic MPU6xxx devices */
 enum inv_mpu6050_scan {
         INV_MPU6050_SCAN_ACCL_X,
         INV_MPU6050_SCAN_ACCL_Y,
@@ -281,6 +287,18 @@ enum inv_mpu6050_scan {
         INV_MPU6050_SCAN_TIMESTAMP,
 };
 
+/* scan element definition for ICM20602, which includes temperature */
+enum inv_icm20602_scan {
+        INV_ICM20602_SCAN_ACCL_X,
+        INV_ICM20602_SCAN_ACCL_Y,
+        INV_ICM20602_SCAN_ACCL_Z,
+        INV_ICM20602_SCAN_TEMP,
+        INV_ICM20602_SCAN_GYRO_X,
+        INV_ICM20602_SCAN_GYRO_Y,
+        INV_ICM20602_SCAN_GYRO_Z,
+        INV_ICM20602_SCAN_TIMESTAMP,
+};
+
 enum inv_mpu6050_filter_e {
         INV_MPU6050_FILTER_256HZ_NOLPF2 = 0,
         INV_MPU6050_FILTER_188HZ,
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
index 548e042f7b5b..57bd11bde56b 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
@@ -207,6 +207,9 @@ irqreturn_t inv_mpu6050_read_fifo(int irq, void *p)
         if (st->chip_config.gyro_fifo_enable)
                 bytes_per_datum += INV_MPU6050_BYTES_PER_3AXIS_SENSOR;
 
+        if (st->chip_type == INV_ICM20602)
+                bytes_per_datum += INV_ICM20602_BYTES_PER_TEMP_SENSOR;
+
         /*
          * read fifo_count register to know how many bytes are inside the FIFO
          * right now
diff --git a/drivers/staging/erofs/super.c b/drivers/staging/erofs/super.c
index 399847d21146..f580d4ef77a1 100644
--- a/drivers/staging/erofs/super.c
+++ b/drivers/staging/erofs/super.c
@@ -457,6 +457,7 @@ static int erofs_read_super(struct super_block *sb,
          */
 err_devname:
         dput(sb->s_root);
+        sb->s_root = NULL;
 err_iget:
 #ifdef EROFS_FS_HAS_MANAGED_CACHE
         iput(sbi->managed_cache);
diff --git a/drivers/staging/kpc2000/Kconfig b/drivers/staging/kpc2000/Kconfig
index fb5922928f47..3bb2efd511c4 100644
--- a/drivers/staging/kpc2000/Kconfig
+++ b/drivers/staging/kpc2000/Kconfig
@@ -2,7 +2,9 @@
 
 config KPC2000
         bool "Daktronics KPC Device support"
+        select MFD_CORE
         depends on PCI
+        depends on UIO
         help
           Select this if you wish to use the Daktronics KPC PCI devices
 
diff --git a/drivers/staging/kpc2000/kpc_dma/fileops.c b/drivers/staging/kpc2000/kpc_dma/fileops.c
index 5741d2b49a7d..616658709bd9 100644
--- a/drivers/staging/kpc2000/kpc_dma/fileops.c
+++ b/drivers/staging/kpc2000/kpc_dma/fileops.c
@@ -8,7 +8,7 @@
 #include <linux/errno.h>    /* error codes */
 #include <linux/types.h>    /* size_t */
 #include <linux/cdev.h>
-#include <asm/uaccess.h>    /* copy_*_user */
+#include <linux/uaccess.h>  /* copy_*_user */
 #include <linux/aio.h>      /* aio stuff */
 #include <linux/highmem.h>
 #include <linux/pagemap.h>
@@ -116,13 +116,11 @@ int  kpc_dma_transfer(struct dev_private_data *priv, struct kiocb *kcb, unsigned
         if (desc_needed >= ldev->desc_pool_cnt){
                 dev_warn(&priv->ldev->pldev->dev, "    mapped_entry_count = %d    num_descrs_needed = %d    num_descrs_avail = %d    TOO MANY to ever complete!\n", acd->mapped_entry_count, desc_needed, num_descrs_avail);
                 rv = -EAGAIN;
-                unlock_engine(ldev);
                 goto err_descr_too_many;
         }
         if (desc_needed > num_descrs_avail){
                 dev_warn(&priv->ldev->pldev->dev, "    mapped_entry_count = %d    num_descrs_needed = %d    num_descrs_avail = %d    Too many to complete right now.\n", acd->mapped_entry_count, desc_needed, num_descrs_avail);
                 rv = -EMSGSIZE;
-                unlock_engine(ldev);
                 goto err_descr_too_many;
         }
 
diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
index 9841c30450ce..dade79738a29 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
@@ -572,7 +572,7 @@ exit:
                                 dev->colourfx.enable ? "true" : "false",
                                 dev->colourfx.u, dev->colourfx.v,
                                 ret, (ret == 0 ? 0 : -EINVAL));
-        return (ret == 0 ? 0 : EINVAL);
+        return (ret == 0 ? 0 : -EINVAL);
 }
 
 static int ctrl_set_colfx(struct bm2835_mmal_dev *dev,
@@ -596,7 +596,7 @@ static int ctrl_set_colfx(struct bm2835_mmal_dev *dev,
                  "%s: After: mmal_ctrl:%p ctrl id:0x%x ctrl val:%d ret %d(%d)\n",
                         __func__, mmal_ctrl, ctrl->id, ctrl->val, ret,
                         (ret == 0 ? 0 : -EINVAL));
-        return (ret == 0 ? 0 : EINVAL);
+        return (ret == 0 ? 0 : -EINVAL);
 }
 
 static int ctrl_set_bitrate(struct bm2835_mmal_dev *dev,
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index a9a22917ecdb..c557c9953724 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -368,9 +368,18 @@ create_pagelist(char __user *buf, size_t count, unsigned short type)
         int dma_buffers;
         dma_addr_t dma_addr;
 
+        if (count >= INT_MAX - PAGE_SIZE)
+                return NULL;
+
         offset = ((unsigned int)(unsigned long)buf & (PAGE_SIZE - 1));
         num_pages = DIV_ROUND_UP(count + offset, PAGE_SIZE);
 
+        if (num_pages > (SIZE_MAX - sizeof(struct pagelist) -
+                         sizeof(struct vchiq_pagelist_info)) /
+                        (sizeof(u32) + sizeof(pages[0]) +
+                         sizeof(struct scatterlist)))
+                return NULL;
+
         pagelist_size = sizeof(struct pagelist) +
                         (num_pages * sizeof(u32)) +
                         (num_pages * sizeof(pages[0]) +
diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
index 0a713409ea98..95eaf8fdf4f2 100644
--- a/drivers/staging/wilc1000/wilc_wlan.c
+++ b/drivers/staging/wilc1000/wilc_wlan.c
@@ -1076,13 +1076,17 @@ void wilc_wlan_cleanup(struct net_device *dev)
         acquire_bus(wilc, WILC_BUS_ACQUIRE_AND_WAKEUP);
 
         ret = wilc->hif_func->hif_read_reg(wilc, WILC_GP_REG_0, &reg);
-        if (!ret)
+        if (!ret) {
                 release_bus(wilc, WILC_BUS_RELEASE_ALLOW_SLEEP);
+                return;
+        }
 
         ret = wilc->hif_func->hif_write_reg(wilc, WILC_GP_REG_0,
                                         (reg | ABORT_INT));
-        if (!ret)
+        if (!ret) {
                 release_bus(wilc, WILC_BUS_RELEASE_ALLOW_SLEEP);
+                return;
+        }
 
         release_bus(wilc, WILC_BUS_RELEASE_ALLOW_SLEEP);
         wilc->hif_func->hif_deinit(NULL);
diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
index 6fde75d4f064..ab734534093b 100644
--- a/drivers/staging/wlan-ng/hfa384x_usb.c
+++ b/drivers/staging/wlan-ng/hfa384x_usb.c
@@ -3119,7 +3119,9 @@ static void hfa384x_usbin_callback(struct urb *urb)
                 break;
         }
 
+        /* Save values from the RX URB before reposting overwrites it. */
         urb_status = urb->status;
+        usbin = (union hfa384x_usbin *)urb->transfer_buffer;
 
         if (action != ABORT) {
                 /* Repost the RX URB */
@@ -3136,7 +3138,6 @@ static void hfa384x_usbin_callback(struct urb *urb)
         /* Note: the check of the sw_support field, the type field doesn't
          *       have bit 12 set like the docs suggest.
          */
-        usbin = (union hfa384x_usbin *)urb->transfer_buffer;
         type = le16_to_cpu(usbin->type);
         if (HFA384x_USB_ISRXFRM(type)) {
                 if (action == HANDLE) {