Merge tag 'staging-3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver fixes from Greg KH:
 "Here are a few staging driver fixes for issues that have been reported
  for 3.15-rc2.

  Also dominating the diffstat for the pull request is the removal of
  the rtl8187se driver.  It's no longer needed in staging as a "real"
  driver for this hardware is now merged in the tree in the "correct"
  location in drivers/net/

  All of these patches have been tested in linux-next"

* tag 'staging-3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: r8188eu: Fix case where ethtype was never obtained and always be checked against 0
  staging: r8712u: Fix case where ethtype was never obtained and always be checked against 0
  staging: r8188eu: Calling rtw_get_stainfo() with a NULL sta_addr will return NULL
  staging: comedi: fix circular locking dependency in comedi_mmap()
  staging: r8723au: Add missing initialization of change_inx in sort algorithm
  Staging: unisys: use after free in list_for_each()
  staging: unisys: use after free in error messages
  staging: speakup: fix misuse of kstrtol() in handle_goto()
  staging: goldfish: Call free_irq in error path
  staging: delete rtl8187se wireless driver
  staging: rtl8723au: Fix buffer overflow in rtw_get_wfd_ie()
  staging: gs_fpgaboot: remove __TIMESTAMP__ macro
  staging: vme: fix memory leak in vme_user_probe()
  staging: fpgaboot: clean up Makefile
  staging/usbip: fix store_attach() sscanf return value check
  staging/usbip: userspace - fix usbipd SIGSEGV from refresh_exported_devices()
  staging: rtl8188eu: remove spaces, correct counts to unbreak P2P ioctls
  staging/rtl8821ae: Fix OOM handling in _rtl_init_deferred_work()

52 files changed, 154 insertions, 19978 deletions

diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index ea5efb426f75..22365f140bec 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -40,8 +40,6 @@ source "drivers/staging/olpc_dcon/Kconfig"
 
 source "drivers/staging/panel/Kconfig"
 
-source "drivers/staging/rtl8187se/Kconfig"
-
 source "drivers/staging/rtl8192u/Kconfig"
 
 source "drivers/staging/rtl8192e/Kconfig"
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index 86e020c2ad0d..fbe84ed2d048 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -12,7 +12,6 @@ obj-$(CONFIG_PRISM2_USB)	+= wlan-ng/
 obj-$(CONFIG_COMEDI)            += comedi/
 obj-$(CONFIG_FB_OLPC_DCON)      += olpc_dcon/
 obj-$(CONFIG_PANEL)             += panel/
-obj-$(CONFIG_R8187SE)           += rtl8187se/
 obj-$(CONFIG_RTL8192U)          += rtl8192u/
 obj-$(CONFIG_RTL8192E)          += rtl8192e/
 obj-$(CONFIG_R8712U)            += rtl8712/
diff --git a/drivers/staging/comedi/comedi_buf.c b/drivers/staging/comedi/comedi_buf.c
index 924fce977985..257595016161 100644
--- a/drivers/staging/comedi/comedi_buf.c
+++ b/drivers/staging/comedi/comedi_buf.c
@@ -61,6 +61,8 @@ static void __comedi_buf_free(struct comedi_device *dev,
                               struct comedi_subdevice *s)
 {
         struct comedi_async *async = s->async;
+        struct comedi_buf_map *bm;
+        unsigned long flags;
 
         if (async->prealloc_buf) {
                 vunmap(async->prealloc_buf);
@@ -68,8 +70,11 @@ static void __comedi_buf_free(struct comedi_device *dev,
                 async->prealloc_bufsz = 0;
         }
 
-        comedi_buf_map_put(async->buf_map);
+        spin_lock_irqsave(&s->spin_lock, flags);
+        bm = async->buf_map;
         async->buf_map = NULL;
+        spin_unlock_irqrestore(&s->spin_lock, flags);
+        comedi_buf_map_put(bm);
 }
 
 static void __comedi_buf_alloc(struct comedi_device *dev,
@@ -80,6 +85,7 @@ static void __comedi_buf_alloc(struct comedi_device *dev,
         struct page **pages = NULL;
         struct comedi_buf_map *bm;
         struct comedi_buf_page *buf;
+        unsigned long flags;
         unsigned i;
 
         if (!IS_ENABLED(CONFIG_HAS_DMA) && s->async_dma_dir != DMA_NONE) {
@@ -92,8 +98,10 @@ static void __comedi_buf_alloc(struct comedi_device *dev,
         if (!bm)
                 return;
 
-        async->buf_map = bm;
         kref_init(&bm->refcount);
+        spin_lock_irqsave(&s->spin_lock, flags);
+        async->buf_map = bm;
+        spin_unlock_irqrestore(&s->spin_lock, flags);
         bm->dma_dir = s->async_dma_dir;
         if (bm->dma_dir != DMA_NONE)
                 /* Need ref to hardware device to free buffer later. */
@@ -127,7 +135,9 @@ static void __comedi_buf_alloc(struct comedi_device *dev,
 
                 pages[i] = virt_to_page(buf->virt_addr);
         }
+        spin_lock_irqsave(&s->spin_lock, flags);
         bm->n_pages = i;
+        spin_unlock_irqrestore(&s->spin_lock, flags);
 
         /* vmap the prealloc_buf if all the pages were allocated */
         if (i == n_pages)
@@ -150,6 +160,29 @@ int comedi_buf_map_put(struct comedi_buf_map *bm)
         return 1;
 }