Merge tag 'staging-4.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging / IIO driver fixes from Greg KH:
 "Here's some staging and iio driver fixes to resolve a number of
  reported issues.

  All of these have been in linux-next for a while"

* tag 'staging-4.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (31 commits)
  iio: light: hid-sensor-prox: Fix memory leak in probe()
  iio: adc: cc10001: Add delay before setting START bit
  iio: adc: cc10001: Fix regulator_get_voltage() return value check
  iio: adc: cc10001: Fix incorrect use of power-up/power-down register
  staging: gdm724x: Correction of variable usage after applying ALIGN()
  iio: adc: cc10001: Fix the channel number mapping
  staging: vt6655: lock MACvWriteBSSIDAddress.
  staging: vt6655: CARDbUpdateTSF bss timestamp correct tsf counter value.
  staging: vt6655: vnt_tx_packet Correct TX order of OWNED_BY_NIC
  staging: vt6655: Fix 80211 control and management status reporting.
  staging: vt6655: implement IEEE80211_TX_STAT_NOACK_TRANSMITTED
  staging: vt6655: device_free_tx_buf use only ieee80211_tx_status_irqsafe
  staging: vt6656: use ieee80211_tx_info to select packet type.
  staging: rtl8712: freeing an ERR_PTR
  staging: sm750: remove incorrect __exit annotation
  iio: kfifo: Set update_needed to false only if a buffer was allocated
  iio: mcp320x: Fix occasional incorrect readings
  iio: accel: mma9553: check input value for activity period
  iio: accel: mma9553: add enable channel for activity
  iio: accel: mma9551_core: prevent buffer overrun
  ...

24 files changed, 152 insertions, 110 deletions

diff --git a/drivers/iio/accel/mma9551_core.c b/drivers/iio/accel/mma9551_core.c
index 7f55a6d7cd03..c6d5a3a40b60 100644
--- a/drivers/iio/accel/mma9551_core.c
+++ b/drivers/iio/accel/mma9551_core.c
@@ -389,7 +389,12 @@ int mma9551_read_config_words(struct i2c_client *client, u8 app_id,
 {
         int ret, i;
         int len_words = len / sizeof(u16);
-        __be16 be_buf[MMA9551_MAX_MAILBOX_DATA_REGS];
+        __be16 be_buf[MMA9551_MAX_MAILBOX_DATA_REGS / 2];
+
+        if (len_words > ARRAY_SIZE(be_buf)) {
+                dev_err(&client->dev, "Invalid buffer size %d\n", len);
+                return -EINVAL;
+        }
 
         ret = mma9551_transfer(client, app_id, MMA9551_CMD_READ_CONFIG,
                                reg, NULL, 0, (u8 *) be_buf, len);
@@ -424,7 +429,12 @@ int mma9551_read_status_words(struct i2c_client *client, u8 app_id,
 {
         int ret, i;
         int len_words = len / sizeof(u16);
-        __be16 be_buf[MMA9551_MAX_MAILBOX_DATA_REGS];
+        __be16 be_buf[MMA9551_MAX_MAILBOX_DATA_REGS / 2];
+
+        if (len_words > ARRAY_SIZE(be_buf)) {
+                dev_err(&client->dev, "Invalid buffer size %d\n", len);
+                return -EINVAL;
+        }
 
         ret = mma9551_transfer(client, app_id, MMA9551_CMD_READ_STATUS,
                                reg, NULL, 0, (u8 *) be_buf, len);
@@ -459,7 +469,12 @@ int mma9551_write_config_words(struct i2c_client *client, u8 app_id,
 {
         int i;
         int len_words = len / sizeof(u16);
-        __be16 be_buf[MMA9551_MAX_MAILBOX_DATA_REGS];
+        __be16 be_buf[(MMA9551_MAX_MAILBOX_DATA_REGS - 1) / 2];
+
+        if (len_words > ARRAY_SIZE(be_buf)) {
+                dev_err(&client->dev, "Invalid buffer size %d\n", len);
+                return -EINVAL;
+        }
 
         for (i = 0; i < len_words; i++)
                 be_buf[i] = cpu_to_be16(buf[i]);
diff --git a/drivers/iio/accel/mma9553.c b/drivers/iio/accel/mma9553.c
index 2df1af7d43fc..365a109aaaef 100644
--- a/drivers/iio/accel/mma9553.c
+++ b/drivers/iio/accel/mma9553.c
@@ -54,6 +54,7 @@
 #define MMA9553_MASK_CONF_STEPCOALESCE          GENMASK(7, 0)
 
 #define MMA9553_REG_CONF_ACTTHD                 0x0E
+#define MMA9553_MAX_ACTTHD                      GENMASK(15, 0)
 
 /* Pedometer status registers (R-only) */
 #define MMA9553_REG_STATUS                      0x00
@@ -316,22 +317,19 @@ static int mma9553_set_config(struct mma9553_data *data, u16 reg,
 static int mma9553_read_activity_stepcnt(struct mma9553_data *data,
                                          u8 *activity, u16 *stepcnt)
 {
-        u32 status_stepcnt;
-        u16 status;
+        u16 buf[2];
         int ret;
 
         ret = mma9551_read_status_words(data->client, MMA9551_APPID_PEDOMETER,
-                                        MMA9553_REG_STATUS, sizeof(u32),
-                                        (u16 *) &status_stepcnt);
+                                        MMA9553_REG_STATUS, sizeof(u32), buf);
         if (ret < 0) {
                 dev_err(&data->client->dev,
                         "error reading status and stepcnt\n");
                 return ret;
         }
 
-        status = status_stepcnt & MMA9553_MASK_CONF_WORD;
-        *activity = mma9553_get_bits(status, MMA9553_MASK_STATUS_ACTIVITY);
-        *stepcnt = status_stepcnt >> 16;
+        *activity = mma9553_get_bits(buf[0], MMA9553_MASK_STATUS_ACTIVITY);
+        *stepcnt = buf[1];
 
         return 0;
 }
@@ -872,6 +870,9 @@ static int mma9553_write_event_value(struct iio_dev *indio_dev,
         case IIO_EV_INFO_PERIOD:
                 switch (chan->type) {
                 case IIO_ACTIVITY:
+                        if (val < 0 || val > MMA9553_ACTIVITY_THD_TO_SEC(
+                            MMA9553_MAX_ACTTHD))
+                                return -EINVAL;
                         mutex_lock(&data->mutex);
                         ret = mma9553_set_config(data, MMA9553_REG_CONF_ACTTHD,
                                                  &data->conf.actthd,
@@ -971,7 +972,8 @@ static const struct iio_chan_spec_ext_info mma9553_ext_info[] = {
         .modified = 1,                                                  \
         .channel2 = _chan2,                                             \
         .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED),             \
-        .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_CALIBHEIGHT),     \
+        .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_CALIBHEIGHT) |    \
+                                    BIT(IIO_CHAN_INFO_ENABLE),          \
         .event_spec = mma9553_activity_events,                          \
         .num_event_specs = ARRAY_SIZE(mma9553_activity_events),         \
         .ext_info = mma9553_ext_info,                                   \
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index 58d1d13d552a..211b13271c61 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -546,6 +546,7 @@ int st_accel_common_probe(struct iio_dev *indio_dev)
 
         indio_dev->modes = INDIO_DIRECT_MODE;
         indio_dev->info = &accel_info;
+        mutex_init(&adata->tb.buf_lock);
 
         st_sensors_power_enable(indio_dev);
 
diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
index 08bcfb061ca5..56008a86b78f 100644
--- a/drivers/iio/adc/axp288_adc.c
+++ b/drivers/iio/adc/axp288_adc.c
@@ -53,39 +53,42 @@ static const struct iio_chan_spec const axp288_adc_channels[] = {
                 .channel = 0,
                 .address = AXP288_TS_ADC_H,
                 .datasheet_name = "TS_PIN",
+                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
         }, {
                 .indexed = 1,
                 .type = IIO_TEMP,
                 .channel = 1,
                 .address = AXP288_PMIC_ADC_H,
                 .datasheet_name = "PMIC_TEMP",
+                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
         }, {
                 .indexed = 1,
                 .type = IIO_TEMP,
                 .channel = 2,
                 .address = AXP288_GP_ADC_H,
                 .datasheet_name = "GPADC",
+                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
         }, {
                 .indexed = 1,
                 .type = IIO_CURRENT,
                 .channel = 3,
                 .address = AXP20X_BATT_CHRG_I_H,
                 .datasheet_name = "BATT_CHG_I",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED),
+                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
         }, {
                 .indexed = 1,
                 .type = IIO_CURRENT,
                 .channel = 4,
                 .address = AXP20X_BATT_DISCHRG_I_H,
                 .datasheet_name = "BATT_DISCHRG_I",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED),
+                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
         }, {
                 .indexed = 1,
                 .type = IIO_VOLTAGE,
                 .channel = 5,
                 .address = AXP20X_BATT_V_H,
                 .datasheet_name = "BATT_V",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED),
+                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
         },
 };
 
@@ -151,9 +154,6 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
                                                 chan->address))
                         dev_err(&indio_dev->dev, "TS pin restore\n");
                 break;
-        case IIO_CHAN_INFO_PROCESSED:
-                ret = axp288_adc_read_channel(val, chan->address, info->regmap);
-                break;
         default:
                 ret = -EINVAL;
         }
diff --git a/drivers/iio/adc/cc10001_adc.c b/drivers/iio/adc/cc10001_adc.c
index 51e2a83c9404..115f6e99a7fa 100644
--- a/drivers/iio/adc/cc10001_adc.c
+++ b/drivers/iio/adc/cc10001_adc.c
@@ -35,8 +35,9 @@
 #define CC10001_ADC_EOC_SET             BIT(0)
 
 #define CC10001_ADC_CHSEL_SAMPLED       0x0c
-#define CC10001_ADC_POWER_UP            0x10
-#define CC10001_ADC_POWER_UP_SET        BIT(0)
+#define CC10001_ADC_POWER_DOWN          0x10
+#define CC10001_ADC_POWER_DOWN_SET      BIT(0)
+
 #define CC10001_ADC_DEBUG               0x14
 #define CC10001_ADC_DATA_COUNT          0x20
 
@@ -62,7 +63,6 @@ struct cc10001_adc_device {
         u16 *buf;
 
         struct mutex lock;
-        unsigned long channel_map;
         unsigned int start_delay_ns;
         unsigned int eoc_delay_ns;
 };
@@ -79,6 +79,18 @@ static inline u32 cc10001_adc_read_reg(struct cc10001_adc_device *adc_dev,
         return readl(adc_dev->reg_base + reg);
 }
 
+static void cc10001_adc_power_up(struct cc10001_adc_device *adc_dev)
+{
+        cc10001_adc_write_reg(adc_dev, CC10001_ADC_POWER_DOWN, 0);
+        ndelay(adc_dev->start_delay_ns);
+}
+
+static void cc10001_adc_power_down(struct cc10001_adc_device *adc_dev)
+{
+        cc10001_adc_write_reg(adc_dev, CC10001_ADC_POWER_DOWN,
+                              CC10001_ADC_POWER_DOWN_SET);
+}
+
 static void cc10001_adc_start(struct cc10001_adc_device *adc_dev,
                               unsigned int channel)
 {
@@ -88,6 +100,7 @@ static void cc10001_adc_start(struct cc10001_adc_device *adc_dev,
         val = (channel & CC10001_ADC_CH_MASK) | CC10001_ADC_MODE_SINGLE_CONV;
         cc10001_adc_write_reg(adc_dev, CC10001_ADC_CONFIG, val);
 
+        udelay(1);
         val = cc10001_adc_read_reg(adc_dev, CC10001_ADC_CONFIG);
         val = val | CC10001_ADC_START_CONV;
         cc10001_adc_write_reg(adc_dev, CC10001_ADC_CONFIG, val);
@@ -129,6 +142,7 @@ static irqreturn_t cc10001_adc_trigger_h(int irq, void *p)
         struct iio_dev *indio_dev;
         unsigned int delay_ns;
         unsigned int channel;
+        unsigned int scan_idx;
         bool sample_invalid;
         u16 *data;
         int i;
@@ -139,20 +153,17 @@ static irqreturn_t cc10001_adc_trigger_h(int irq, void *p)
 
         mutex_lock(&adc_dev->lock);
 
-        cc10001_adc_write_reg(adc_dev, CC10001_ADC_POWER_UP,
-                              CC10001_ADC_POWER_UP_SET);
-
-        /* Wait for 8 (6+2) clock cycles before activating START */
-        ndelay(adc_dev->start_delay_ns);
+        cc10001_adc_power_up(adc_dev);
 
         /* Calculate delay step for eoc and sampled data */
         delay_ns = adc_dev->eoc_delay_ns / CC10001_MAX_POLL_COUNT;
 
         i = 0;
         sample_invalid = false;
-        for_each_set_bit(channel, indio_dev->active_scan_mask,
+        for_each_set_bit(scan_idx, indio_dev->active_scan_mask,
                                   indio_dev->masklength) {
 
+                channel = indio_dev->channels[scan_idx].channel;
                 cc10001_adc_start(adc_dev, channel);
 
                 data[i] = cc10001_adc_poll_done(indio_dev, channel, delay_ns);
@@ -166,7 +177,7 @@ static irqreturn_t cc10001_adc_trigger_h(int irq, void *p)
         }
 
 done:
-        cc10001_adc_write_reg(adc_dev, CC10001_ADC_POWER_UP, 0);
+        cc10001_adc_power_down(adc_dev);
 
         mutex_unlock(&adc_dev->lock);
 
@@ -185,11 +196,7 @@ static u16 cc10001_adc_read_raw_voltage(struct iio_dev *indio_dev,
         unsigned int delay_ns;
         u16 val;
 
-        cc10001_adc_write_reg(adc_dev, CC10001_ADC_POWER_UP,
-                              CC10001_ADC_POWER_UP_SET);
-
-        /* Wait for 8 (6+2) clock cycles before activating START */
-        ndelay(adc_dev->start_delay_ns);
+        cc10001_adc_power_up(adc_dev);
 
         /* Calculate delay step for eoc and sampled data */
         delay_ns = adc_dev->eoc_delay_ns / CC10001_MAX_POLL_COUNT;
@@ -198,7 +205,7 @@ static u16 cc10001_adc_read_raw_voltage(struct iio_dev *indio_dev,
 
         val = cc10001_adc_poll_done(indio_dev, chan->channel, delay_ns);
 
-        cc10001_adc_write_reg(adc_dev, CC10001_ADC_POWER_UP, 0);
+        cc10001_adc_power_down(adc_dev);
 
         return val;
 }
@@ -224,7 +231,7 @@ static int cc10001_adc_read_raw(struct iio_dev *indio_dev,
 
         case IIO_CHAN_INFO_SCALE:
                 ret = regulator_get_voltage(adc_dev->reg);
-                if (ret)
+                if (ret < 0)
                         return ret;
 
                 *val = ret / 1000;
@@ -255,22 +262,22 @@ static const struct iio_info cc10001_adc_info = {
         .update_scan_mode = &cc10001_update_scan_mode,
 };
 
-static int cc10001_adc_channel_init(struct iio_dev *indio_dev)
+static int cc10001_adc_channel_init(struct iio_dev *indio_dev,
+                                    unsigned long channel_map)
 {
-        struct cc10001_adc_device *adc_dev = iio_priv(indio_dev);
         struct iio_chan_spec *chan_array, *timestamp;
         unsigned int bit, idx = 0;
 
-        indio_dev->num_channels = bitmap_weight(&adc_dev->channel_map,
-                                                CC10001_ADC_NUM_CHANNELS);
+        indio_dev->num_channels = bitmap_weight(&channel_map,
+                                                CC10001_ADC_NUM_CHANNELS) + 1;
 
-        chan_array = devm_kcalloc(&indio_dev->dev, indio_dev->num_channels + 1,
+        chan_array = devm_kcalloc(&indio_dev->dev, indio_dev->num_channels,
                                   sizeof(struct iio_chan_spec),
                                   GFP_KERNEL);
         if (!chan_array)
                 return -ENOMEM;
 
-        for_each_set_bit(bit, &adc_dev->channel_map, CC10001_ADC_NUM_CHANNELS) {
+        for_each_set_bit(bit, &channel_map, CC10001_ADC_NUM_CHANNELS) {
                 struct iio_chan_spec *chan = &chan_array[idx];
 
                 chan->type = IIO_VOLTAGE;
@@ -305,6 +312,7 @@ static int cc10001_adc_probe(struct platform_device *pdev)
         unsigned long adc_clk_rate;
         struct resource *res;
         struct iio_dev *indio_dev;
+        unsigned long channel_map;
         int ret;
 
         indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*adc_dev));
@@ -313,9 +321,9 @@ static int cc10001_adc_probe(struct platform_device *pdev)
 
         adc_dev = iio_priv(indio_dev);
 
-        adc_dev->channel_map = GENMASK(CC10001_ADC_NUM_CHANNELS - 1, 0);
+        channel_map = GENMASK(CC10001_ADC_NUM_CHANNELS - 1, 0);
         if (!of_property_read_u32(node, "adc-reserved-channels", &ret))
-                adc_dev->channel_map &= ~ret;
+                channel_map &= ~ret;
 
         adc_dev->reg = devm_regulator_get(&pdev->dev, "vref");
         if (IS_ERR(adc_dev->reg))
@@ -361,7 +369,7 @@ static int cc10001_adc_probe(struct platform_device *pdev)
         adc_dev->start_delay_ns = adc_dev->eoc_delay_ns * CC10001_WAIT_CYCLES;
 
         /* Setup the ADC channels available on the device */
-        ret = cc10001_adc_channel_init(indio_dev);
+        ret = cc10001_adc_channel_init(indio_dev, channel_map);
         if (ret < 0)
                 goto err_disable_clk;
 
diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c
index efbfd12a4bfd..8d9c9b9215dd 100644
--- a/drivers/iio/adc/mcp320x.c
+++ b/drivers/iio/adc/mcp320x.c
@@ -60,12 +60,12 @@ struct mcp320x {
         struct spi_message msg;
         struct spi_transfer transfer[2];
 
-        u8 tx_buf;
-        u8 rx_buf[2];
-
         struct regulator *reg;
         struct mutex lock;
         const struct mcp320x_chip_info *chip_info;
+
+        u8 tx_buf ____cacheline_aligned;
+        u8 rx_buf[2];
 };
 
 static int mcp320x_channel_to_tx_data(int device_index,
diff --git a/drivers/iio/adc/qcom-spmi-vadc.c b/drivers/iio/adc/qcom-spmi-vadc.c
index 3211729bcb0b..0c4618b4d515 100644
--- a/drivers/iio/adc/qcom-spmi-vadc.c
+++ b/drivers/iio/adc/qcom-spmi-vadc.c
@@ -18,6 +18,7 @@
 #include <linux/iio/iio.h>
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
+#include <linux/math64.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
@@ -471,11 +472,11 @@ static s32 vadc_calibrate(struct vadc_priv *vadc,
                           const struct vadc_channel_prop *prop, u16 adc_code)
 {
         const struct vadc_prescale_ratio *prescale;
-        s32 voltage;
+        s64 voltage;
 
         voltage = adc_code - vadc->graph[prop->calibration].gnd;
         voltage *= vadc->graph[prop->calibration].dx;
-        voltage = voltage / vadc->graph[prop->calibration].dy;
+        voltage = div64_s64(voltage, vadc->graph[prop->calibration].dy);
 
         if (prop->calibration == VADC_CALIB_ABSOLUTE)
                 voltage += vadc->graph[prop->calibration].dx;
@@ -487,7 +488,7 @@ static s32 vadc_calibrate(struct vadc_priv *vadc,
 
         voltage = voltage * prescale->den;
 
-        return voltage / prescale->num;
+        return div64_s64(voltage, prescale->num);
 }
 
 static int vadc_decimation_from_dt(u32 value)
diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index a221f7329b79..ce93bd8e3f68 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -856,6 +856,7 @@ static int xadc_read_raw(struct iio_dev *indio_dev,
                         switch (chan->address) {
                         case XADC_REG_VCCINT:
                         case XADC_REG_VCCAUX:
+                        case XADC_REG_VREFP:
                         case XADC_REG_VCCBRAM:
                         case XADC_REG_VCCPINT:
                         case XADC_REG_VCCPAUX:
@@ -996,7 +997,7 @@ static const struct iio_event_spec xadc_voltage_events[] = {
         .num_event_specs = (_alarm) ? ARRAY_SIZE(xadc_voltage_events) : 0, \
         .scan_index = (_scan_index), \
         .scan_type = { \
-                .sign = 'u', \
+                .sign = ((_addr) == XADC_REG_VREFN) ? 's' : 'u', \
                 .realbits = 12, \
                 .storagebits = 16, \
                 .shift = 4, \
@@ -1008,7 +1009,7 @@ static const struct iio_event_spec xadc_voltage_events[] = {
 static const struct iio_chan_spec xadc_channels[] = {
         XADC_CHAN_TEMP(0, 8, XADC_REG_TEMP),
         XADC_CHAN_VOLTAGE(0, 9, XADC_REG_VCCINT, "vccint", true),
-        XADC_CHAN_VOLTAGE(1, 10, XADC_REG_VCCINT, "vccaux", true),
+        XADC_CHAN_VOLTAGE(1, 10, XADC_REG_VCCAUX, "vccaux", true),
         XADC_CHAN_VOLTAGE(2, 14, XADC_REG_VCCBRAM, "vccbram", true),
         XADC_CHAN_VOLTAGE(3, 5, XADC_REG_VCCPINT, "vccpint", true),
         XADC_CHAN_VOLTAGE(4, 6, XADC_REG_VCCPAUX, "vccpaux", true),
diff --git a/drivers/iio/adc/xilinx-xadc.h b/drivers/iio/adc/xilinx-xadc.h
index c7487e8d7f80..54adc5087210 100644
--- a/drivers/iio/adc/xilinx-xadc.h
+++ b/drivers/iio/adc/xilinx-xadc.h
@@ -145,9 +145,9 @@ static inline int xadc_write_adc_reg(struct xadc *xadc, unsigned int reg,
 #define XADC_REG_MAX_VCCPINT    0x28
 #define XADC_REG_MAX_VCCPAUX    0x29
 #define XADC_REG_MAX_VCCO_DDR   0x2a
-#define XADC_REG_MIN_VCCPINT    0x2b
-#define XADC_REG_MIN_VCCPAUX    0x2c
-#define XADC_REG_MIN_VCCO_DDR   0x2d
+#define XADC_REG_MIN_VCCPINT    0x2c
+#define XADC_REG_MIN_VCCPAUX    0x2d
+#define XADC_REG_MIN_VCCO_DDR   0x2e
 
 #define XADC_REG_CONF0          0x40
 #define XADC_REG_CONF1          0x41
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index edd13d2b4121..8dd0477e201c 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -304,8 +304,6 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev,
         struct st_sensors_platform_data *of_pdata;
         int err = 0;
 
-        mutex_init(&sdata->tb.buf_lock);
-
         /* If OF/DT pdata exists, it will take precedence of anything else */
         of_pdata = st_sensors_of_probe(indio_dev->dev.parent, pdata);
         if (of_pdata)
diff --git a/drivers/iio/gyro/st_gyro_core.c b/drivers/iio/gyro/st_gyro_core.c
index 21395f26d227..ffe96642b6d0 100644
--- a/drivers/iio/gyro/st_gyro_core.c
+++ b/drivers/iio/gyro/st_gyro_core.c
@@ -400,6 +400,7 @@ int st_gyro_common_probe(struct iio_dev *indio_dev)
 
         indio_dev->modes = INDIO_DIRECT_MODE;
         indio_dev->info = &gyro_info;
+        mutex_init(&gdata->tb.buf_lock);
 
         st_sensors_power_enable(indio_dev);
 
diff --git a/drivers/iio/kfifo_buf.c b/drivers/iio/kfifo_buf.c
index 847ca561afe0..55c267bbfd2f 100644
--- a/drivers/iio/kfifo_buf.c
+++ b/drivers/iio/kfifo_buf.c
@@ -38,7 +38,8 @@ static int iio_request_update_kfifo(struct iio_buffer *r)
                 kfifo_free(&buf->kf);
                 ret = __iio_allocate_kfifo(buf, buf->buffer.bytes_per_datum,
                                    buf->buffer.length);
-                buf->update_needed = false;
+                if (ret >= 0)
+                        buf->update_needed = false;
         } else {
                 kfifo_reset_out(&buf->kf);
         }
diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c
index 91ecc46ffeaa..ef60bae738e3 100644
--- a/drivers/iio/light/hid-sensor-prox.c
+++ b/drivers/iio/light/hid-sensor-prox.c
@@ -43,8 +43,6 @@ struct prox_state {
 static const struct iio_chan_spec prox_channels[] = {
         {
                 .type = IIO_PROXIMITY,
-                .modified = 1,
-                .channel2 = IIO_NO_MOD,
                 .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
                 .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_OFFSET) |
                 BIT(IIO_CHAN_INFO_SCALE) |
@@ -253,7 +251,6 @@ static int hid_prox_probe(struct platform_device *pdev)
         struct iio_dev *indio_dev;
         struct prox_state *prox_state;
         struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data;
-        struct iio_chan_spec *channels;
 
         indio_dev = devm_iio_device_alloc(&pdev->dev,
                                 sizeof(struct prox_state));
@@ -272,20 +269,21 @@ static int hid_prox_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        channels = kmemdup(prox_channels, sizeof(prox_channels), GFP_KERNEL);
-        if (!channels) {
+        indio_dev->channels = kmemdup(prox_channels, sizeof(prox_channels),
+                                      GFP_KERNEL);
+        if (!indio_dev->channels) {
                 dev_err(&pdev->dev, "failed to duplicate channels\n");
                 return -ENOMEM;
         }
 
-        ret = prox_parse_report(pdev, hsdev, channels,
+        ret = prox_parse_report(pdev, hsdev,
+                                (struct iio_chan_spec *)indio_dev->channels,
                                 HID_USAGE_SENSOR_PROX, prox_state);
         if (ret) {
                 dev_err(&pdev->dev, "failed to setup attributes\n");
                 goto error_free_dev_mem;
         }
 
-        indio_dev->channels = channels;
         indio_dev->num_channels =
                                 ARRAY_SIZE(prox_channels);
         indio_dev->dev.parent = &pdev->dev;
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index 8ade473f99fe..2e56f812a644 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -369,6 +369,7 @@ int st_magn_common_probe(struct iio_dev *indio_dev)
 
         indio_dev->modes = INDIO_DIRECT_MODE;
         indio_dev->info = &magn_info;
+        mutex_init(&mdata->tb.buf_lock);
 
         st_sensors_power_enable(indio_dev);
 
diff --git a/drivers/iio/pressure/bmp280.c b/drivers/iio/pressure/bmp280.c
index 7c623e2bd633..a2602d8dd6d5 100644
--- a/drivers/iio/pressure/bmp280.c
+++ b/drivers/iio/pressure/bmp280.c
@@ -172,6 +172,7 @@ static s32 bmp280_compensate_temp(struct bmp280_data *data,
         var2 = (((((adc_temp >> 4) - ((s32)le16_to_cpu(buf[T1]))) *
                   ((adc_temp >> 4) - ((s32)le16_to_cpu(buf[T1])))) >> 12) *
                 ((s32)(s16)le16_to_cpu(buf[T3]))) >> 14;
+        data->t_fine = var1 + var2;
 
         return (data->t_fine * 5 + 128) >> 8;
 }
diff --git a/drivers/iio/pressure/hid-sensor-press.c b/drivers/iio/pressure/hid-sensor-press.c
index 7bb8d4c1f7df..3cf0bd67d24c 100644
--- a/drivers/iio/pressure/hid-sensor-press.c
+++ b/drivers/iio/pressure/hid-sensor-press.c
@@ -47,8 +47,6 @@ struct press_state {
 static const struct iio_chan_spec press_channels[] = {
         {
                 .type = IIO_PRESSURE,
-                .modified = 1,
-                .channel2 = IIO_NO_MOD,
                 .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
                 .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_OFFSET) |
                 BIT(IIO_CHAN_INFO_SCALE) |
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index 97baf40d424b..e881fa6291e9 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -417,6 +417,7 @@ int st_press_common_probe(struct iio_dev *indio_dev)
 
         indio_dev->modes = INDIO_DIRECT_MODE;
         indio_dev->info = &press_info;
+        mutex_init(&press_data->tb.buf_lock);
 
         st_sensors_power_enable(indio_dev);
 
diff --git a/drivers/staging/gdm724x/gdm_mux.c b/drivers/staging/gdm724x/gdm_mux.c
index 8199b0a697bb..1cf24e4edf25 100644
--- a/drivers/staging/gdm724x/gdm_mux.c
+++ b/drivers/staging/gdm724x/gdm_mux.c
@@ -158,7 +158,7 @@ static int up_to_host(struct mux_rx *r)
         unsigned int start_flag;
         unsigned int payload_size;
         unsigned short packet_type;
-        int dummy_cnt;
+        int total_len;
         u32 packet_size_sum = r->offset;
         int index;
         int ret = TO_HOST_INVALID_PACKET;
@@ -176,10 +176,10 @@ static int up_to_host(struct mux_rx *r)
                         break;
                 }
 
-                dummy_cnt = ALIGN(MUX_HEADER_SIZE + payload_size, 4);
+                total_len = ALIGN(MUX_HEADER_SIZE + payload_size, 4);
 
                 if (len - packet_size_sum <
-                        MUX_HEADER_SIZE + payload_size + dummy_cnt) {
+                        total_len) {
                         pr_err("invalid payload : %d %d %04x\n",
                                payload_size, len, packet_type);
                         break;
@@ -202,7 +202,7 @@ static int up_to_host(struct mux_rx *r)
                         break;
                 }
 
-                packet_size_sum += MUX_HEADER_SIZE + payload_size + dummy_cnt;
+                packet_size_sum += total_len;
                 if (len - packet_size_sum <= MUX_HEADER_SIZE + 2) {
                         ret = r->callback(NULL,
                                         0,
@@ -361,7 +361,6 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index,
         struct mux_pkt_header *mux_header;
         struct mux_tx *t = NULL;
         static u32 seq_num = 1;
-        int dummy_cnt;
         int total_len;
         int ret;
         unsigned long flags;
@@ -374,9 +373,7 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index,
 
         spin_lock_irqsave(&mux_dev->write_lock, flags);
 
-        dummy_cnt = ALIGN(MUX_HEADER_SIZE + len, 4);
-
-        total_len = len + MUX_HEADER_SIZE + dummy_cnt;
+        total_len = ALIGN(MUX_HEADER_SIZE + len, 4);
 
         t = alloc_mux_tx(total_len);
         if (!t) {
@@ -392,7 +389,8 @@ static int gdm_mux_send(void *priv_dev, void *data, int len, int tty_index,
         mux_header->packet_type = __cpu_to_le16(packet_type[tty_index]);
 
         memcpy(t->buf+MUX_HEADER_SIZE, data, len);
-        memset(t->buf+MUX_HEADER_SIZE+len, 0, dummy_cnt);
+        memset(t->buf+MUX_HEADER_SIZE+len, 0, total_len - MUX_HEADER_SIZE -
+               len);
 
         t->len = total_len;
         t->callback = cb;
diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
index 42fba3f5b593..cb0b6387789f 100644
--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
@@ -1900,23 +1900,20 @@ static int r871x_mp_ioctl_hdl(struct net_device *dev,
         struct mp_ioctl_handler *phandler;
         struct mp_ioctl_param *poidparam;
         unsigned long BytesRead, BytesWritten, BytesNeeded;
-        u8 *pparmbuf = NULL, bset;
+        u8 *pparmbuf, bset;
         u16 len;
         uint status;
         int ret = 0;
 
-        if ((!p->length) || (!p->pointer)) {
-                ret = -EINVAL;
-                goto _r871x_mp_ioctl_hdl_exit;
-        }
+        if ((!p->length) || (!p->pointer))
+                return -EINVAL;
+
         bset = (u8)(p->flags & 0xFFFF);
         len = p->length;
-        pparmbuf = NULL;
         pparmbuf = memdup_user(p->pointer, len);
-        if (IS_ERR(pparmbuf)) {
-                ret = PTR_ERR(pparmbuf);
-                goto _r871x_mp_ioctl_hdl_exit;
-        }
+        if (IS_ERR(pparmbuf))
+                return PTR_ERR(pparmbuf);
+
         poidparam = (struct mp_ioctl_param *)pparmbuf;
         if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
                 ret = -EINVAL;
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 3c7ea95dd9f9..dbbb2f879a29 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -1250,7 +1250,7 @@ err_enable:
         return -ENODEV;
 }
 
-static void __exit lynxfb_pci_remove(struct pci_dev *pdev)
+static void lynxfb_pci_remove(struct pci_dev *pdev)
 {
         struct fb_info *info;
         struct lynx_share *share;
diff --git a/drivers/staging/vt6655/card.c b/drivers/staging/vt6655/card.c
index 1cdcf49b2445..e00c0605d154 100644
--- a/drivers/staging/vt6655/card.c
+++ b/drivers/staging/vt6655/card.c
@@ -362,12 +362,16 @@ bool CARDbSetPhyParameter(struct vnt_private *pDevice, u8 bb_type)
  * Return Value: none
  */
 bool CARDbUpdateTSF(struct vnt_private *pDevice, unsigned char byRxRate,
-                    u64 qwBSSTimestamp, u64 qwLocalTSF)
+                    u64 qwBSSTimestamp)
 {
+        u64 local_tsf;
         u64 qwTSFOffset = 0;
 
-        if (qwBSSTimestamp != qwLocalTSF) {
-                qwTSFOffset = CARDqGetTSFOffset(byRxRate, qwBSSTimestamp, qwLocalTSF);
+        CARDbGetCurrentTSF(pDevice, &local_tsf);
+
+        if (qwBSSTimestamp != local_tsf) {
+                qwTSFOffset = CARDqGetTSFOffset(byRxRate, qwBSSTimestamp,
+                                                local_tsf);
                 /* adjust TSF, HW's TSF add TSF Offset reg */
                 VNSvOutPortD(pDevice->PortOffset + MAC_REG_TSFOFST, (u32)qwTSFOffset);
                 VNSvOutPortD(pDevice->PortOffset + MAC_REG_TSFOFST + 4, (u32)(qwTSFOffset >> 32));
diff --git a/drivers/staging/vt6655/card.h b/drivers/staging/vt6655/card.h
index 2dfc41952271..16cca49e680a 100644
--- a/drivers/staging/vt6655/card.h
+++ b/drivers/staging/vt6655/card.h
@@ -83,7 +83,7 @@ bool CARDbRadioPowerOff(struct vnt_private *);
 bool CARDbRadioPowerOn(struct vnt_private *);
 bool CARDbSetPhyParameter(struct vnt_private *, u8);
 bool CARDbUpdateTSF(struct vnt_private *, unsigned char byRxRate,
-                    u64 qwBSSTimestamp, u64 qwLocalTSF);
+                    u64 qwBSSTimestamp);
 bool CARDbSetBeaconPeriod(struct vnt_private *, unsigned short wBeaconInterval);
 
 #endif /* __CARD_H__ */
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index 4bb4f8ee4132..0343ae386f03 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -912,7 +912,11 @@ static int vnt_int_report_rate(struct vnt_private *priv,
 
         if (!(tsr1 & TSR1_TERR)) {
                 info->status.rates[0].idx = idx;
-                info->flags |= IEEE80211_TX_STAT_ACK;
+
+                if (info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
+                else
+                        info->flags |= IEEE80211_TX_STAT_ACK;
         }
 
         return 0;
@@ -937,9 +941,6 @@ static int device_tx_srv(struct vnt_private *pDevice, unsigned int uIdx)
                 /* Only the status of first TD in the chain is correct */
                 if (pTD->m_td1TD1.byTCR & TCR_STP) {
                         if ((pTD->pTDInfo->byFlags & TD_FLAGS_NETIF_SKB) != 0) {
-
-                                vnt_int_report_rate(pDevice, pTD->pTDInfo, byTsr0, byTsr1);
-
                                 if (!(byTsr1 & TSR1_TERR)) {
                                         if (byTsr0 != 0) {
                                                 pr_debug(" Tx[%d] OK but has error. tsr1[%02X] tsr0[%02X]\n",
@@ -958,6 +959,9 @@ static int device_tx_srv(struct vnt_private *pDevice, unsigned int uIdx)
                                                  (int)uIdx, byTsr1, byTsr0);
                                 }
                         }
+
+                        vnt_int_report_rate(pDevice, pTD->pTDInfo, byTsr0, byTsr1);
+
                         device_free_tx_buf(pDevice, pTD);
                         pDevice->iTDUsed[uIdx]--;
                 }
@@ -989,10 +993,8 @@ static void device_free_tx_buf(struct vnt_private *pDevice, PSTxDesc pDesc)
                                  skb->len, DMA_TO_DEVICE);
         }
 
-        if (pTDInfo->byFlags & TD_FLAGS_NETIF_SKB)
+        if (skb)
                 ieee80211_tx_status_irqsafe(pDevice->hw, skb);
-        else
-                dev_kfree_skb_irq(skb);
 
         pTDInfo->skb_dma = 0;
         pTDInfo->skb = NULL;
@@ -1204,14 +1206,6 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
         if (dma_idx == TYPE_AC0DMA)
                 head_td->pTDInfo->byFlags = TD_FLAGS_NETIF_SKB;
 
-        priv->iTDUsed[dma_idx]++;
-
-        /* Take ownership */
-        wmb();
-        head_td->m_td0TD0.f1Owner = OWNED_BY_NIC;
-
-        /* get Next */
-        wmb();
         priv->apCurrTD[dma_idx] = head_td->next;
 
         spin_unlock_irqrestore(&priv->lock, flags);
@@ -1232,11 +1226,18 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
 
         head_td->buff_addr = cpu_to_le32(head_td->pTDInfo->skb_dma);
 
+        /* Poll Transmit the adapter */
+        wmb();
+        head_td->m_td0TD0.f1Owner = OWNED_BY_NIC;
+        wmb(); /* second memory barrier */
+
         if (head_td->pTDInfo->byFlags & TD_FLAGS_NETIF_SKB)
                 MACvTransmitAC0(priv->PortOffset);
         else
                 MACvTransmit0(priv->PortOffset);
 
+        priv->iTDUsed[dma_idx]++;
+
         spin_unlock_irqrestore(&priv->lock, flags);
 
         return 0;
@@ -1416,9 +1417,16 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
 
         priv->current_aid = conf->aid;
 
-        if (changed & BSS_CHANGED_BSSID)
+        if (changed & BSS_CHANGED_BSSID) {
+                unsigned long flags;
+
+                spin_lock_irqsave(&priv->lock, flags);
+
                 MACvWriteBSSIDAddress(priv->PortOffset, (u8 *)conf->bssid);
 
+                spin_unlock_irqrestore(&priv->lock, flags);
+        }
+
         if (changed & BSS_CHANGED_BASIC_RATES) {
                 priv->basic_rates = conf->basic_rates;
 
@@ -1477,7 +1485,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
         if (changed & BSS_CHANGED_ASSOC && priv->op_mode != NL80211_IFTYPE_AP) {
                 if (conf->assoc) {
                         CARDbUpdateTSF(priv, conf->beacon_rate->hw_value,
-                                       conf->sync_device_ts, conf->sync_tsf);
+                                       conf->sync_tsf);
 
                         CARDbSetBeaconPeriod(priv, conf->beacon_int);
 
diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
index f6c2cf8590c4..5c589962a1e8 100644
--- a/drivers/staging/vt6656/rxtx.c
+++ b/drivers/staging/vt6656/rxtx.c
@@ -805,10 +805,18 @@ int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
                 vnt_schedule_command(priv, WLAN_CMD_SETPOWER);
         }
 
-        if (current_rate > RATE_11M)
-                pkt_type = priv->packet_type;
-        else
+        if (current_rate > RATE_11M) {
+                if (info->band == IEEE80211_BAND_5GHZ) {
+                        pkt_type = PK_TYPE_11A;
+                } else {
+                        if (tx_rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
+                                pkt_type = PK_TYPE_11GB;
+                        else
+                                pkt_type = PK_TYPE_11GA;
+                }
+        } else {
                 pkt_type = PK_TYPE_11B;
+        }
 
         spin_lock_irqsave(&priv->lock, flags);