12 files changed, 43 insertions, 39 deletions

diff --git a/drivers/char/apm-emulation.c b/drivers/char/apm-emulation.c
index aaca40283be9..4f568cb9af3f 100644
--- a/drivers/char/apm-emulation.c
+++ b/drivers/char/apm-emulation.c
@@ -393,7 +393,7 @@ static int apm_open(struct inode * inode, struct file * filp)
         return as ? 0 : -ENOMEM;
 }
 
-static struct file_operations apm_bios_fops = {
+static const struct file_operations apm_bios_fops = {
         .owner          = THIS_MODULE,
         .read           = apm_read,
         .poll           = apm_poll,
diff --git a/drivers/char/bfin-otp.c b/drivers/char/bfin-otp.c
index e3dd24bff514..836d4f0a876f 100644
--- a/drivers/char/bfin-otp.c
+++ b/drivers/char/bfin-otp.c
@@ -217,7 +217,7 @@ static long bfin_otp_ioctl(struct file *filp, unsigned cmd, unsigned long arg)
 # define bfin_otp_ioctl NULL
 #endif
 
-static struct file_operations bfin_otp_fops = {
+static const struct file_operations bfin_otp_fops = {
         .owner          = THIS_MODULE,
         .unlocked_ioctl = bfin_otp_ioctl,
         .read           = bfin_otp_read,
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index df5038bbcbc2..4254457d3911 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -3354,7 +3354,7 @@ static int __init cy_detect_isa(void)
                         continue;
                 }
 #ifdef MODULE
-                if (isparam && irq[i])
+                if (isparam && i < NR_CARDS && irq[i])
                         cy_isa_irq = irq[i];
                 else
 #endif
diff --git a/drivers/char/dtlk.c b/drivers/char/dtlk.c
index 52e06589821d..045c930e6320 100644
--- a/drivers/char/dtlk.c
+++ b/drivers/char/dtlk.c
@@ -56,6 +56,7 @@
 #include <linux/errno.h>        /* for -EBUSY */
 #include <linux/ioport.h>       /* for request_region */
 #include <linux/delay.h>        /* for loops_per_jiffy */
+#include <linux/sched.h>
 #include <linux/smp_lock.h>     /* cycle_kernel_lock() */
 #include <asm/io.h>             /* for inb_p, outb_p, inb, outb, etc. */
 #include <asm/uaccess.h>        /* for get_user, etc. */
diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
index 00dd3de1be51..06aad0831c73 100644
--- a/drivers/char/hw_random/omap-rng.c
+++ b/drivers/char/hw_random/omap-rng.c
@@ -116,7 +116,7 @@ static int __devinit omap_rng_probe(struct platform_device *pdev)
         if (!res)
                 return -ENOENT;
 
-        mem = request_mem_region(res->start, res->end - res->start + 1,
+        mem = request_mem_region(res->start, resource_size(res),
                                  pdev->name);
         if (mem == NULL) {
                 ret = -EBUSY;
@@ -124,7 +124,7 @@ static int __devinit omap_rng_probe(struct platform_device *pdev)
         }
 
         dev_set_drvdata(&pdev->dev, mem);
-        rng_base = ioremap(res->start, res->end - res->start + 1);
+        rng_base = ioremap(res->start, resource_size(res));
         if (!rng_base) {
                 ret = -ENOMEM;
                 goto err_ioremap;
diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
index 41fc11dc921c..65545de3dbf4 100644
--- a/drivers/char/ipmi/ipmi_devintf.c
+++ b/drivers/char/ipmi/ipmi_devintf.c
@@ -36,6 +36,7 @@
 #include <linux/errno.h>
 #include <asm/system.h>
 #include <linux/poll.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
 #include <linux/ipmi.h>
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 09050797c76a..ec5e3f8df648 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -35,6 +35,7 @@
 #include <linux/errno.h>
 #include <asm/system.h>
 #include <linux/poll.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
 #include <linux/slab.h>
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 53761cefa915..e066c4fdf81b 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -261,6 +261,9 @@ done:
         return 0;
 }
 
+/* Traditional BSD devices */
+#ifdef CONFIG_LEGACY_PTYS
+
 static int pty_install(struct tty_driver *driver, struct tty_struct *tty)
 {
         struct tty_struct *o_tty;
@@ -310,24 +313,6 @@ free_mem_out:
         return -ENOMEM;
 }
 
-
-static const struct tty_operations pty_ops = {
-        .install = pty_install,
-        .open = pty_open,
-        .close = pty_close,
-        .write = pty_write,
-        .write_room = pty_write_room,
-        .flush_buffer = pty_flush_buffer,
-        .chars_in_buffer = pty_chars_in_buffer,
-        .unthrottle = pty_unthrottle,
-        .set_termios = pty_set_termios,
-        .resize = pty_resize
-};
-
-/* Traditional BSD devices */
-#ifdef CONFIG_LEGACY_PTYS
-static struct tty_driver *pty_driver, *pty_slave_driver;
-
 static int pty_bsd_ioctl(struct tty_struct *tty, struct file *file,
                          unsigned int cmd, unsigned long arg)
 {
@@ -341,7 +326,12 @@ static int pty_bsd_ioctl(struct tty_struct *tty, struct file *file,
 static int legacy_count = CONFIG_LEGACY_PTY_COUNT;
 module_param(legacy_count, int, 0);
 
-static const struct tty_operations pty_ops_bsd = {
+/*
+ * The master side of a pty can do TIOCSPTLCK and thus
+ * has pty_bsd_ioctl.
+ */
+static const struct tty_operations master_pty_ops_bsd = {
+        .install = pty_install,
         .open = pty_open,
         .close = pty_close,
         .write = pty_write,
@@ -354,8 +344,23 @@ static const struct tty_operations pty_ops_bsd = {
         .resize = pty_resize
 };
 
+static const struct tty_operations slave_pty_ops_bsd = {
+        .install = pty_install,
+        .open = pty_open,
+        .close = pty_close,
+        .write = pty_write,
+        .write_room = pty_write_room,
+        .flush_buffer = pty_flush_buffer,
+        .chars_in_buffer = pty_chars_in_buffer,
+        .unthrottle = pty_unthrottle,
+        .set_termios = pty_set_termios,
+        .resize = pty_resize
+};
+
 static void __init legacy_pty_init(void)
 {
+        struct tty_driver *pty_driver, *pty_slave_driver;
+
         if (legacy_count <= 0)
                 return;
 
@@ -383,7 +388,7 @@ static void __init legacy_pty_init(void)
         pty_driver->init_termios.c_ospeed = 38400;
         pty_driver->flags = TTY_DRIVER_RESET_TERMIOS | TTY_DRIVER_REAL_RAW;
         pty_driver->other = pty_slave_driver;
-        tty_set_operations(pty_driver, &pty_ops);
+        tty_set_operations(pty_driver, &master_pty_ops_bsd);
 
         pty_slave_driver->owner = THIS_MODULE;
         pty_slave_driver->driver_name = "pty_slave";
@@ -399,7 +404,7 @@ static void __init legacy_pty_init(void)
         pty_slave_driver->flags = TTY_DRIVER_RESET_TERMIOS |
                                         TTY_DRIVER_REAL_RAW;
         pty_slave_driver->other = pty_driver;
-        tty_set_operations(pty_slave_driver, &pty_ops);
+        tty_set_operations(pty_slave_driver, &slave_pty_ops_bsd);
 
         if (tty_register_driver(pty_driver))
                 panic("Couldn't register pty driver");
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index 5942a9d674c0..452370af95de 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -220,8 +220,7 @@ static inline int serial_paranoia_check(struct cyclades_port *info, char *name,
                 return 1;
         }
 
-        if ((long)info < (long)(&cy_port[0])
-            || (long)(&cy_port[NR_PORTS]) < (long)info) {
+        if (info < &cy_port[0] || info >= &cy_port[NR_PORTS]) {
                 printk("Warning: cyclades_port out of range for (%s) in %s\n",
                                 name, routine);
                 return 1;
@@ -520,15 +519,13 @@ static irqreturn_t cd2401_tx_interrupt(int irq, void *dev_id)
                 panic("TxInt on debug port!!!");
         }
 #endif
-
-        info = &cy_port[channel];
-
         /* validate the port number (as configured and open) */
         if ((channel < 0) || (NR_PORTS <= channel)) {
                 base_addr[CyIER] &= ~(CyTxMpty | CyTxRdy);
                 base_addr[CyTEOIR] = CyNOTRANS;
                 return IRQ_HANDLED;
         }
+        info = &cy_port[channel];
         info->last_active = jiffies;
         if (info->tty == 0) {
                 base_addr[CyIER] &= ~(CyTxMpty | CyTxRdy);
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index aafdbaebc16a..feb55075819b 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -518,7 +518,7 @@ static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
 static int tty_ldisc_halt(struct tty_struct *tty)
 {
         clear_bit(TTY_LDISC, &tty->flags);
-        return cancel_delayed_work(&tty->buf.work);
+        return cancel_delayed_work_sync(&tty->buf.work);
 }
 
 /**
@@ -756,12 +756,9 @@ void tty_ldisc_hangup(struct tty_struct *tty)
          * N_TTY.
          */
         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
-                /* Make sure the old ldisc is quiescent */
-                tty_ldisc_halt(tty);
-                flush_scheduled_work();
-
                 /* Avoid racing set_ldisc or tty_ldisc_release */
                 mutex_lock(&tty->ldisc_mutex);
+                tty_ldisc_halt(tty);
                 if (tty->ldisc) {       /* Not yet closed */
                         /* Switch back to N_TTY */
                         tty_ldisc_reinit(tty);
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 29c651ab0d78..6b36ee56e6fe 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -981,8 +981,10 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                         goto eperm;
 
                 if (copy_from_user(&vsa, (struct vt_setactivate __user *)arg,
-                                                sizeof(struct vt_setactivate)))
-                        return -EFAULT;
+                                        sizeof(struct vt_setactivate))) {
+                        ret = -EFAULT;
+                        goto out;
+                }
                 if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
                         ret = -ENXIO;
                 else {
diff --git a/drivers/char/xilinx_hwicap/xilinx_hwicap.c b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
index f40ab699860f..4846d50199f3 100644
--- a/drivers/char/xilinx_hwicap/xilinx_hwicap.c
+++ b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
@@ -559,7 +559,7 @@ static int hwicap_release(struct inode *inode, struct file *file)
         return status;
 }
 
-static struct file_operations hwicap_fops = {
+static const struct file_operations hwicap_fops = {
         .owner = THIS_MODULE,
         .write = hwicap_write,
         .read = hwicap_read,