4 files changed, 25 insertions, 32 deletions

diff --git a/drivers/input/misc/apanel.c b/drivers/input/misc/apanel.c
index 094bddf56755..c1e66f45d552 100644
--- a/drivers/input/misc/apanel.c
+++ b/drivers/input/misc/apanel.c
@@ -22,7 +22,6 @@
 #include <linux/io.h>
 #include <linux/input-polldev.h>
 #include <linux/i2c.h>
-#include <linux/workqueue.h>
 #include <linux/leds.h>
 
 #define APANEL_NAME     "Fujitsu Application Panel"
@@ -59,8 +58,6 @@ struct apanel {
         struct i2c_client *client;
         unsigned short keymap[MAX_PANEL_KEYS];
         u16    nkeys;
-        u16    led_bits;
-        struct work_struct led_work;
         struct led_classdev mail_led;
 };
 
@@ -109,25 +106,13 @@ static void apanel_poll(struct input_polled_dev *ipdev)
                         report_key(idev, ap->keymap[i]);
 }
 
-/* Track state changes of LED */
-static void led_update(struct work_struct *work)
-{
-        struct apanel *ap = container_of(work, struct apanel, led_work);
-
-        i2c_smbus_write_word_data(ap->client, 0x10, ap->led_bits);
-}
-
-static void mail_led_set(struct led_classdev *led,
+static int mail_led_set(struct led_classdev *led,
                          enum led_brightness value)
 {
         struct apanel *ap = container_of(led, struct apanel, mail_led);
+        u16 led_bits = value != LED_OFF ? 0x8000 : 0x0000;
 
-        if (value != LED_OFF)
-                ap->led_bits |= 0x8000;
-        else
-                ap->led_bits &= ~0x8000;
-
-        schedule_work(&ap->led_work);
+        return i2c_smbus_write_word_data(ap->client, 0x10, led_bits);
 }
 
 static int apanel_remove(struct i2c_client *client)
@@ -179,7 +164,7 @@ static struct apanel apanel = {
         },
         .mail_led = {
                 .name = "mail:blue",
-                .brightness_set = mail_led_set,
+                .brightness_set_blocking = mail_led_set,
         },
 };
 
@@ -235,7 +220,6 @@ static int apanel_probe(struct i2c_client *client,
         if (err)
                 goto out3;
 
-        INIT_WORK(&ap->led_work, led_update);
         if (device_chip[APANEL_DEV_LED] != CHIP_NONE) {
                 err = led_classdev_register(&client->dev, &ap->mail_led);
                 if (err)
diff --git a/drivers/input/misc/bma150.c b/drivers/input/misc/bma150.c
index 1efcfdf9f8a8..dd9dd4e40827 100644
--- a/drivers/input/misc/bma150.c
+++ b/drivers/input/misc/bma150.c
@@ -481,13 +481,14 @@ static int bma150_register_input_device(struct bma150_data *bma150)
         idev->close = bma150_irq_close;
         input_set_drvdata(idev, bma150);
 
+        bma150->input = idev;
+
         error = input_register_device(idev);
         if (error) {
                 input_free_device(idev);
                 return error;
         }
 
-        bma150->input = idev;
         return 0;
 }
 
@@ -510,15 +511,15 @@ static int bma150_register_polled_device(struct bma150_data *bma150)
 
         bma150_init_input_device(bma150, ipoll_dev->input);
 
+        bma150->input_polled = ipoll_dev;
+        bma150->input = ipoll_dev->input;
+
         error = input_register_polled_device(ipoll_dev);
         if (error) {
                 input_free_polled_device(ipoll_dev);
                 return error;
         }
 
-        bma150->input_polled = ipoll_dev;
-        bma150->input = ipoll_dev->input;
-
         return 0;
 }
 
diff --git a/drivers/input/misc/pwm-vibra.c b/drivers/input/misc/pwm-vibra.c
index 55da191ae550..dbb6d9e1b947 100644
--- a/drivers/input/misc/pwm-vibra.c
+++ b/drivers/input/misc/pwm-vibra.c
@@ -34,6 +34,7 @@ struct pwm_vibrator {
         struct work_struct play_work;
         u16 level;
         u32 direction_duty_cycle;
+        bool vcc_on;
 };
 
 static int pwm_vibrator_start(struct pwm_vibrator *vibrator)
@@ -42,10 +43,13 @@ static int pwm_vibrator_start(struct pwm_vibrator *vibrator)
         struct pwm_state state;
         int err;
 
-        err = regulator_enable(vibrator->vcc);
-        if (err) {
-                dev_err(pdev, "failed to enable regulator: %d", err);
-                return err;
+        if (!vibrator->vcc_on) {
+                err = regulator_enable(vibrator->vcc);
+                if (err) {
+                        dev_err(pdev, "failed to enable regulator: %d", err);
+                        return err;
+                }
+                vibrator->vcc_on = true;
         }
 
         pwm_get_state(vibrator->pwm, &state);
@@ -76,11 +80,14 @@ static int pwm_vibrator_start(struct pwm_vibrator *vibrator)
 
 static void pwm_vibrator_stop(struct pwm_vibrator *vibrator)
 {
-        regulator_disable(vibrator->vcc);
-
         if (vibrator->pwm_dir)
                 pwm_disable(vibrator->pwm_dir);
         pwm_disable(vibrator->pwm);
+
+        if (vibrator->vcc_on) {
+                regulator_disable(vibrator->vcc);
+                vibrator->vcc_on = false;
+        }
 }
 
 static void pwm_vibrator_play_work(struct work_struct *work)
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 8ec483e8688b..26ec603fe220 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -39,6 +39,7 @@
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/miscdevice.h>
+#include <linux/overflow.h>
 #include <linux/input/mt.h>
 #include "../input-compat.h"
 
@@ -405,7 +406,7 @@ static int uinput_open(struct inode *inode, struct file *file)
 static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
                                    const struct input_absinfo *abs)
 {
-        int min, max;
+        int min, max, range;
 
         min = abs->minimum;
         max = abs->maximum;
@@ -417,7 +418,7 @@ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
                 return -EINVAL;
         }
 
-        if (abs->flat > max - min) {
+        if (!check_sub_overflow(max, min, &range) && abs->flat > range) {
                 printk(KERN_DEBUG
                        "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
                        UINPUT_NAME, code, abs->flat, min, max);