Merge branch 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6

* 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6:
  Connector: Correctly set the error code in case of success when dispatching receive callbacks
  Connector: Set the CN_NETLINK_USERS correctly
  pti: PTI semantics fix in pti_tty_cleanup.
  pti: ENXIO error case memory leak PTI fix.
  pti: double-free security PTI fix
  drivers:misc: ti-st: fix skipping of change remote baud
  drivers/base/platform.c: don't mark platform_device_register_resndata() as __init_or_module
  st_kim: Handle case of no device found for ID 0
  firmware: fix GOOGLE_SMI kconfig dependency warning

7 files changed, 18 insertions, 9 deletions

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 1c291af637b3..6040717b62bb 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -367,7 +367,7 @@ EXPORT_SYMBOL_GPL(platform_device_unregister);
  *
  * Returns &struct platform_device pointer on success, or ERR_PTR() on error.
  */
-struct platform_device *__init_or_module platform_device_register_resndata(
+struct platform_device *platform_device_register_resndata(
                 struct device *parent,
                 const char *name, int id,
                 const struct resource *res, unsigned int num,
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index 219d88a0eeae..dde6a0fad408 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -139,6 +139,7 @@ static int cn_call_callback(struct sk_buff *skb)
         spin_unlock_bh(&dev->cbdev->queue_lock);
 
         if (cbq != NULL) {
+                err = 0;
                 cbq->callback(msg, nsp);
                 kfree_skb(skb);
                 cn_queue_release_callback(cbq);
diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig
index 87096b6ca5c9..2f21b0bfe653 100644
--- a/drivers/firmware/google/Kconfig
+++ b/drivers/firmware/google/Kconfig
@@ -13,6 +13,7 @@ menu "Google Firmware Drivers"
 config GOOGLE_SMI
         tristate "SMI interface for Google platforms"
         depends on ACPI && DMI
+        select EFI
         select EFI_VARS
         help
           Say Y here if you want to enable SMI callbacks for Google
diff --git a/drivers/misc/pti.c b/drivers/misc/pti.c
index bb6f9255c17c..374dfcfccd07 100644
--- a/drivers/misc/pti.c
+++ b/drivers/misc/pti.c
@@ -317,7 +317,8 @@ EXPORT_SYMBOL_GPL(pti_request_masterchannel);
  *                              a master, channel ID address
  *                              used to write to PTI HW.
  *
- * @mc: master, channel apeture ID address to be released.
+ * @mc: master, channel apeture ID address to be released.  This
+ *      will de-allocate the structure via kfree().
  */
 void pti_release_masterchannel(struct pti_masterchannel *mc)
 {
@@ -475,8 +476,10 @@ static int pti_tty_install(struct tty_driver *driver, struct tty_struct *tty)
                 else
                         pti_tty_data->mc = pti_request_masterchannel(2);
 
-                if (pti_tty_data->mc == NULL)
+                if (pti_tty_data->mc == NULL) {
+                        kfree(pti_tty_data);
                         return -ENXIO;
+                }
                 tty->driver_data = pti_tty_data;
         }
 
@@ -495,7 +498,7 @@ static void pti_tty_cleanup(struct tty_struct *tty)
         if (pti_tty_data == NULL)
                 return;
         pti_release_masterchannel(pti_tty_data->mc);
-        kfree(tty->driver_data);
+        kfree(pti_tty_data);
         tty->driver_data = NULL;
 }
 
@@ -581,7 +584,7 @@ static int pti_char_open(struct inode *inode, struct file *filp)
 static int pti_char_release(struct inode *inode, struct file *filp)
 {
         pti_release_masterchannel(filp->private_data);
-        kfree(filp->private_data);
+        filp->private_data = NULL;
         return 0;
 }
 
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index f91f82eabda7..54c91ffe4a91 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -605,7 +605,7 @@ long st_unregister(struct st_proto_s *proto)
         pr_debug("%s: %d ", __func__, proto->chnl_id);
 
         st_kim_ref(&st_gdata, 0);
-        if (proto->chnl_id >= ST_MAX_CHANNELS) {
+        if (!st_gdata || proto->chnl_id >= ST_MAX_CHANNELS) {
                 pr_err(" chnl_id %d not supported", proto->chnl_id);
                 return -EPROTONOSUPPORT;
         }
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index 5da93ee6f6be..38fd2f04c07e 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -245,9 +245,9 @@ void skip_change_remote_baud(unsigned char **ptr, long *len)
                 pr_err("invalid action after change remote baud command");
         } else {
                 *ptr = *ptr + sizeof(struct bts_action) +
-                        ((struct bts_action *)nxt_action)->size;
+                        ((struct bts_action *)cur_action)->size;
                 *len = *len - (sizeof(struct bts_action) +
-                                ((struct bts_action *)nxt_action)->size);
+                                ((struct bts_action *)cur_action)->size);
                 /* warn user on not commenting these in firmware */
                 pr_warn("skipping the wait event of change remote baud");
         }
@@ -604,6 +604,10 @@ void st_kim_ref(struct st_data_s **core_data, int id)
         struct kim_data_s       *kim_gdata;
         /* get kim_gdata reference from platform device */
         pdev = st_get_plat_device(id);
+        if (!pdev) {
+                *core_data = NULL;
+                return;
+        }
         kim_gdata = dev_get_drvdata(&pdev->dev);
         *core_data = kim_gdata->core_data;
 }
diff --git a/include/linux/connector.h b/include/linux/connector.h
index 7c60d0942adb..f696bccd48cb 100644
--- a/include/linux/connector.h
+++ b/include/linux/connector.h
@@ -44,7 +44,7 @@
 #define CN_VAL_DRBD                     0x1
 #define CN_KVP_IDX                      0x9     /* HyperV KVP */
 
-#define CN_NETLINK_USERS                9
+#define CN_NETLINK_USERS                10      /* Highest index + 1 */
 
 /*
  * Maximum connector's message size.