Merge tag 'staging-4.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging / IIO driver fixes from Greg KH:
 "Here's some staging and iio driver fixes to resolve a number of
  reported issues.

  All of these have been in linux-next for a while"

* tag 'staging-4.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (31 commits)
  iio: light: hid-sensor-prox: Fix memory leak in probe()
  iio: adc: cc10001: Add delay before setting START bit
  iio: adc: cc10001: Fix regulator_get_voltage() return value check
  iio: adc: cc10001: Fix incorrect use of power-up/power-down register
  staging: gdm724x: Correction of variable usage after applying ALIGN()
  iio: adc: cc10001: Fix the channel number mapping
  staging: vt6655: lock MACvWriteBSSIDAddress.
  staging: vt6655: CARDbUpdateTSF bss timestamp correct tsf counter value.
  staging: vt6655: vnt_tx_packet Correct TX order of OWNED_BY_NIC
  staging: vt6655: Fix 80211 control and management status reporting.
  staging: vt6655: implement IEEE80211_TX_STAT_NOACK_TRANSMITTED
  staging: vt6655: device_free_tx_buf use only ieee80211_tx_status_irqsafe
  staging: vt6656: use ieee80211_tx_info to select packet type.
  staging: rtl8712: freeing an ERR_PTR
  staging: sm750: remove incorrect __exit annotation
  iio: kfifo: Set update_needed to false only if a buffer was allocated
  iio: mcp320x: Fix occasional incorrect readings
  iio: accel: mma9553: check input value for activity period
  iio: accel: mma9553: add enable channel for activity
  iio: accel: mma9551_core: prevent buffer overrun
  ...

7 files changed, 59 insertions, 44 deletions

diff --git a/drivers/staging/gdm724x/gdm_mux.c b/drivers/staging/gdm724x/gdm_mux.c
index 8199b0a697bb..1cf24e4edf25 100644
--- a/drivers/staging/gdm724x/gdm_mux.c
+++ b/drivers/staging/gdm724x/gdm_mux.c
@@ -158,7 +158,7 @@ static int up_to_host(struct mux_rx *r)
         unsigned int start_flag;
         unsigned int payload_size;
         unsigned short packet_type;
-        int dummy_cnt;
+        int total_len;
         u32 packet_size_sum = r->offset;
         int index;
         int ret = TO_HOST_INVALID_PACKET;
@@ -176,10 +176,10 @@ static int up_to_host(struct mux_rx *r)
                         break;
                 }
 
-                dummy_cnt = ALIGN(MUX_HEADER_SIZE + payload_size, 4);
+                total_len = ALIGN(MUX_HEADER_SIZE + payload_size, 4);
 
                 if (len - packet_size_sum <
-                        MUX_HEADER_SIZE + payload_size + dummy_cnt) {
+                        total_len) {
                         pr_err("invalid payload : %d %d %04x\n",
                                payload_size, len, packet_type);
                         break;
@@ -202,7 +202,7 @@ static int up_to_host(struct mux_rx *r)
                         break;
                 }
 
-                packet_size_sum += MUX_HEADER_SIZE + payload_size + dummy_cnt;
+                packet_size_sum += total_len;
                 if (len - packet_size_sum <= MUX_HEADER_SIZE + 2) {
                         ret = r->callback(NULL,
                                         0,
@@ -361,7 +361,6 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index,
         struct mux_pkt_header *mux_header;
         struct mux_tx *t = NULL;
         static u32 seq_num = 1;
-        int dummy_cnt;
         int total_len;
         int ret;
         unsigned long flags;
@@ -374,9 +373,7 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index,
 
         spin_lock_irqsave(&mux_dev->write_lock, flags);
 
-        dummy_cnt = ALIGN(MUX_HEADER_SIZE + len, 4);
-
-        total_len = len + MUX_HEADER_SIZE + dummy_cnt;
+        total_len = ALIGN(MUX_HEADER_SIZE + len, 4);
 
         t = alloc_mux_tx(total_len);
         if (!t) {
@@ -392,7 +389,8 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index,
         mux_header->packet_type = __cpu_to_le16(packet_type[tty_index]);
 
         memcpy(t->buf+MUX_HEADER_SIZE, data, len);
-        memset(t->buf+MUX_HEADER_SIZE+len, 0, dummy_cnt);
+        memset(t->buf+MUX_HEADER_SIZE+len, 0, total_len - MUX_HEADER_SIZE -
+               len);
 
         t->len = total_len;
         t->callback = cb;
diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
index 42fba3f5b593..cb0b6387789f 100644
--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
@@ -1900,23 +1900,20 @@ static int r871x_mp_ioctl_hdl(struct net_device *dev,
         struct mp_ioctl_handler *phandler;
         struct mp_ioctl_param *poidparam;
         unsigned long BytesRead, BytesWritten, BytesNeeded;
-        u8 *pparmbuf = NULL, bset;
+        u8 *pparmbuf, bset;
         u16 len;
         uint status;
         int ret = 0;
 
-        if ((!p->length) || (!p->pointer)) {
-                ret = -EINVAL;
-                goto _r871x_mp_ioctl_hdl_exit;
-        }
+        if ((!p->length) || (!p->pointer))
+                return -EINVAL;
+
         bset = (u8)(p->flags & 0xFFFF);
         len = p->length;
-        pparmbuf = NULL;
         pparmbuf = memdup_user(p->pointer, len);
-        if (IS_ERR(pparmbuf)) {
-                ret = PTR_ERR(pparmbuf);
-                goto _r871x_mp_ioctl_hdl_exit;
-        }
+        if (IS_ERR(pparmbuf))
+                return PTR_ERR(pparmbuf);
+
         poidparam = (struct mp_ioctl_param *)pparmbuf;
         if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
                 ret = -EINVAL;
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 3c7ea95dd9f9..dbbb2f879a29 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -1250,7 +1250,7 @@ err_enable:
         return -ENODEV;
 }
 
-static void __exit lynxfb_pci_remove(struct pci_dev *pdev)
+static void lynxfb_pci_remove(struct pci_dev *pdev)
 {
         struct fb_info *info;
         struct lynx_share *share;
diff --git a/drivers/staging/vt6655/card.c b/drivers/staging/vt6655/card.c
index 1cdcf49b2445..e00c0605d154 100644
--- a/drivers/staging/vt6655/card.c
+++ b/drivers/staging/vt6655/card.c
@@ -362,12 +362,16 @@ bool CARDbSetPhyParameter(struct vnt_private *pDevice, u8 bb_type)
  * Return Value: none
  */
 bool CARDbUpdateTSF(struct vnt_private *pDevice, unsigned char byRxRate,
-                    u64 qwBSSTimestamp, u64 qwLocalTSF)
+                    u64 qwBSSTimestamp)
 {
+        u64 local_tsf;
         u64 qwTSFOffset = 0;
 
-        if (qwBSSTimestamp != qwLocalTSF) {
-                qwTSFOffset = CARDqGetTSFOffset(byRxRate, qwBSSTimestamp, qwLocalTSF);
+        CARDbGetCurrentTSF(pDevice, &local_tsf);
+
+        if (qwBSSTimestamp != local_tsf) {
+                qwTSFOffset = CARDqGetTSFOffset(byRxRate, qwBSSTimestamp,
+                                                local_tsf);
                 /* adjust TSF, HW's TSF add TSF Offset reg */
                 VNSvOutPortD(pDevice->PortOffset + MAC_REG_TSFOFST, (u32)qwTSFOffset);
                 VNSvOutPortD(pDevice->PortOffset + MAC_REG_TSFOFST + 4, (u32)(qwTSFOffset >> 32));
diff --git a/drivers/staging/vt6655/card.h b/drivers/staging/vt6655/card.h
index 2dfc41952271..16cca49e680a 100644
--- a/drivers/staging/vt6655/card.h
+++ b/drivers/staging/vt6655/card.h
@@ -83,7 +83,7 @@ bool CARDbRadioPowerOff(struct vnt_private *);
 bool CARDbRadioPowerOn(struct vnt_private *);
 bool CARDbSetPhyParameter(struct vnt_private *, u8);
 bool CARDbUpdateTSF(struct vnt_private *, unsigned char byRxRate,
-                    u64 qwBSSTimestamp, u64 qwLocalTSF);
+                    u64 qwBSSTimestamp);
 bool CARDbSetBeaconPeriod(struct vnt_private *, unsigned short wBeaconInterval);
 
 #endif /* __CARD_H__ */
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index 4bb4f8ee4132..0343ae386f03 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -912,7 +912,11 @@ static int vnt_int_report_rate(struct vnt_private *priv,
 
         if (!(tsr1 & TSR1_TERR)) {
                 info->status.rates[0].idx = idx;
-                info->flags |= IEEE80211_TX_STAT_ACK;
+
+                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
+                else
+                        info->flags |= IEEE80211_TX_STAT_ACK;
         }
 
         return 0;
@@ -937,9 +941,6 @@ static int device_tx_srv(struct vnt_private *pDevice, unsigned int uIdx)
                 /* Only the status of first TD in the chain is correct */
                 if (pTD->m_td1TD1.byTCR & TCR_STP) {
                         if ((pTD->pTDInfo->byFlags & TD_FLAGS_NETIF_SKB) != 0) {
-
-                                vnt_int_report_rate(pDevice, pTD->pTDInfo, byTsr0, byTsr1);
-
                                 if (!(byTsr1 & TSR1_TERR)) {
                                         if (byTsr0 != 0) {
                                                 pr_debug(" Tx[%d] OK but has error. tsr1[%02X] tsr0[%02X]\n",
@@ -958,6 +959,9 @@ static int device_tx_srv(struct vnt_private *pDevice, unsigned int uIdx)
                                                  (int)uIdx, byTsr1, byTsr0);
                                 }
                         }
+
+                        vnt_int_report_rate(pDevice, pTD->pTDInfo, byTsr0, byTsr1);
+
                         device_free_tx_buf(pDevice, pTD);
                         pDevice->iTDUsed[uIdx]--;
                 }
@@ -989,10 +993,8 @@ static void device_free_tx_buf(struct vnt_private *pDevice, PSTxDesc pDesc)
                                  skb->len, DMA_TO_DEVICE);
         }
 
-        if (pTDInfo->byFlags & TD_FLAGS_NETIF_SKB)
+        if (skb)
                 ieee80211_tx_status_irqsafe(pDevice->hw, skb);
-        else
-                dev_kfree_skb_irq(skb);
 
         pTDInfo->skb_dma = 0;
         pTDInfo->skb = NULL;
@@ -1204,14 +1206,6 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
         if (dma_idx == TYPE_AC0DMA)
                 head_td->pTDInfo->byFlags = TD_FLAGS_NETIF_SKB;
 
-        priv->iTDUsed[dma_idx]++;
-
-        /* Take ownership */
-        wmb();
-        head_td->m_td0TD0.f1Owner = OWNED_BY_NIC;
-
-        /* get Next */
-        wmb();
         priv->apCurrTD[dma_idx] = head_td->next;
 
         spin_unlock_irqrestore(&priv->lock, flags);
@@ -1232,11 +1226,18 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
 
         head_td->buff_addr = cpu_to_le32(head_td->pTDInfo->skb_dma);
 
+        /* Poll Transmit the adapter */
+        wmb();
+        head_td->m_td0TD0.f1Owner = OWNED_BY_NIC;
+        wmb(); /* second memory barrier */
+
         if (head_td->pTDInfo->byFlags & TD_FLAGS_NETIF_SKB)
                 MACvTransmitAC0(priv->PortOffset);
         else
                 MACvTransmit0(priv->PortOffset);
 
+        priv->iTDUsed[dma_idx]++;
+
         spin_unlock_irqrestore(&priv->lock, flags);
 
         return 0;
@@ -1416,9 +1417,16 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
 
         priv->current_aid = conf->aid;
 
-        if (changed & BSS_CHANGED_BSSID)
+        if (changed & BSS_CHANGED_BSSID) {
+                unsigned long flags;
+
+                spin_lock_irqsave(&priv->lock, flags);
+
                 MACvWriteBSSIDAddress(priv->PortOffset, (u8 *)conf->bssid);
 
+                spin_unlock_irqrestore(&priv->lock, flags);
+        }
+
         if (changed & BSS_CHANGED_BASIC_RATES) {
                 priv->basic_rates = conf->basic_rates;
 
@@ -1477,7 +1485,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
         if (changed & BSS_CHANGED_ASSOC && priv->op_mode != NL80211_IFTYPE_AP) {
                 if (conf->assoc) {
                         CARDbUpdateTSF(priv, conf->beacon_rate->hw_value,
-                                       conf->sync_device_ts, conf->sync_tsf);
+                                       conf->sync_tsf);
 
                         CARDbSetBeaconPeriod(priv, conf->beacon_int);
 
diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
index f6c2cf8590c4..5c589962a1e8 100644
--- a/drivers/staging/vt6656/rxtx.c
+++ b/drivers/staging/vt6656/rxtx.c
@@ -805,10 +805,18 @@ int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
                 vnt_schedule_command(priv, WLAN_CMD_SETPOWER);
         }
 
-        if (current_rate > RATE_11M)
-                pkt_type = priv->packet_type;
-        else
+        if (current_rate > RATE_11M) {
+                if (info->band == IEEE80211_BAND_5GHZ) {
+                        pkt_type = PK_TYPE_11A;
+                } else {
+                        if (tx_rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
+                                pkt_type = PK_TYPE_11GB;
+                        else
+                                pkt_type = PK_TYPE_11GA;
+                }
+        } else {
                 pkt_type = PK_TYPE_11B;
+        }
 
         spin_lock_irqsave(&priv->lock, flags);