Merge branch 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6

* 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6:
  Connector: Correctly set the error code in case of success when dispatching receive callbacks
  Connector: Set the CN_NETLINK_USERS correctly
  pti: PTI semantics fix in pti_tty_cleanup.
  pti: ENXIO error case memory leak PTI fix.
  pti: double-free security PTI fix
  drivers:misc: ti-st: fix skipping of change remote baud
  drivers/base/platform.c: don't mark platform_device_register_resndata() as __init_or_module
  st_kim: Handle case of no device found for ID 0
  firmware: fix GOOGLE_SMI kconfig dependency warning

3 files changed, 14 insertions, 7 deletions

diff --git a/drivers/misc/pti.c b/drivers/misc/pti.c
index bb6f9255c17..374dfcfccd0 100644
--- a/drivers/misc/pti.c
+++ b/drivers/misc/pti.c
@@ -317,7 +317,8 @@ EXPORT_SYMBOL_GPL(pti_request_masterchannel);
  *                              a master, channel ID address
  *                              used to write to PTI HW.
  *
- * @mc: master, channel apeture ID address to be released.
+ * @mc: master, channel apeture ID address to be released.  This
+ *      will de-allocate the structure via kfree().
  */
 void pti_release_masterchannel(struct pti_masterchannel *mc)
 {
@@ -475,8 +476,10 @@ static int pti_tty_install(struct tty_driver *driver, struct tty_struct *tty)
                 else
                         pti_tty_data->mc = pti_request_masterchannel(2);
 
-                if (pti_tty_data->mc == NULL)
+                if (pti_tty_data->mc == NULL) {
+                        kfree(pti_tty_data);
                         return -ENXIO;
+                }
                 tty->driver_data = pti_tty_data;
         }
 
@@ -495,7 +498,7 @@ static void pti_tty_cleanup(struct tty_struct *tty)
         if (pti_tty_data == NULL)
                 return;
         pti_release_masterchannel(pti_tty_data->mc);
-        kfree(tty->driver_data);
+        kfree(pti_tty_data);
         tty->driver_data = NULL;
 }
 
@@ -581,7 +584,7 @@ static int pti_char_open(struct inode *inode, struct file *filp)
 static int pti_char_release(struct inode *inode, struct file *filp)
 {
         pti_release_masterchannel(filp->private_data);
-        kfree(filp->private_data);
+        filp->private_data = NULL;
         return 0;
 }
 
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index f91f82eabda..54c91ffe4a9 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -605,7 +605,7 @@ long st_unregister(struct st_proto_s *proto)
         pr_debug("%s: %d ", __func__, proto->chnl_id);
 
         st_kim_ref(&st_gdata, 0);
-        if (proto->chnl_id >= ST_MAX_CHANNELS) {
+        if (!st_gdata || proto->chnl_id >= ST_MAX_CHANNELS) {
                 pr_err(" chnl_id %d not supported", proto->chnl_id);
                 return -EPROTONOSUPPORT;
         }
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index 5da93ee6f6b..38fd2f04c07 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -245,9 +245,9 @@ void skip_change_remote_baud(unsigned char **ptr, long *len)
                 pr_err("invalid action after change remote baud command");
         } else {
                 *ptr = *ptr + sizeof(struct bts_action) +
-                        ((struct bts_action *)nxt_action)->size;
+                        ((struct bts_action *)cur_action)->size;
                 *len = *len - (sizeof(struct bts_action) +
-                                ((struct bts_action *)nxt_action)->size);
+                                ((struct bts_action *)cur_action)->size);
                 /* warn user on not commenting these in firmware */
                 pr_warn("skipping the wait event of change remote baud");
         }
@@ -604,6 +604,10 @@ void st_kim_ref(struct st_data_s **core_data, int id)
         struct kim_data_s       *kim_gdata;
         /* get kim_gdata reference from platform device */
         pdev = st_get_plat_device(id);
+        if (!pdev) {
+                *core_data = NULL;
+                return;
+        }
         kim_gdata = dev_get_drvdata(&pdev->dev);
         *core_data = kim_gdata->core_data;
 }