29 files changed, 261 insertions, 111 deletions

diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 14ef6ab69790..3d7c9f67b6d7 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -743,6 +743,14 @@ config HID_WIIMOTE
         To compile this driver as a module, choose M here: the
         module will be called hid-wiimote.
 
+config HID_XINMO
+        tristate "Xin-Mo non-fully compliant devices"
+        depends on HID
+        ---help---
+        Support for Xin-Mo devices that are not fully compliant with the HID
+        standard. Currently only supports the Xin-Mo Dual Arcade. Say Y here
+        if you have a Xin-Mo Dual Arcade controller.
+
 config HID_ZEROPLUS
         tristate "Zeroplus based game controller support"
         depends on HID
diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index 6f687287e212..a959f4aecaf5 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile
@@ -110,6 +110,7 @@ obj-$(CONFIG_HID_TIVO)		+= hid-tivo.o
 obj-$(CONFIG_HID_TOPSEED)       += hid-topseed.o
 obj-$(CONFIG_HID_TWINHAN)       += hid-twinhan.o
 obj-$(CONFIG_HID_UCLOGIC)       += hid-uclogic.o
+obj-$(CONFIG_HID_XINMO)         += hid-xinmo.o
 obj-$(CONFIG_HID_ZEROPLUS)      += hid-zpff.o
 obj-$(CONFIG_HID_ZYDACRON)      += hid-zydacron.o
 obj-$(CONFIG_HID_WACOM)         += hid-wacom.o
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 5ea7d51e45b9..2ac13ca6edaa 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -454,7 +454,7 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item)
                         }
                         parser->local.delimiter_depth--;
                 }
-                return 1;
+                return 0;
 
         case HID_LOCAL_ITEM_TAG_USAGE:
 
@@ -1132,7 +1132,8 @@ static void hid_output_field(const struct hid_device *hid,
 }
 
 /*
- * Create a report.
+ * Create a report. 'data' has to be allocated using
+ * hid_alloc_report_buf() so that it has proper size.
  */
 
 void hid_output_report(struct hid_report *report, __u8 *data)
@@ -1149,6 +1150,22 @@ void hid_output_report(struct hid_report *report, __u8 *data)
 EXPORT_SYMBOL_GPL(hid_output_report);
 
 /*
+ * Allocator for buffer that is going to be passed to hid_output_report()
+ */
+u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags)
+{
+        /*
+         * 7 extra bytes are necessary to achieve proper functionality
+         * of implement() working on 8 byte chunks
+         */
+
+        int len = ((report->size - 1) >> 3) + 1 + (report->id > 0) + 7;
+
+        return kmalloc(len, flags);
+}
+EXPORT_SYMBOL_GPL(hid_alloc_report_buf);
+
+/*
  * Set a field value. The report this field belongs to has to be
  * created and transferred to the device, to set this value in the
  * device.
@@ -1156,7 +1173,12 @@ EXPORT_SYMBOL_GPL(hid_output_report);
 
 int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
 {
-        unsigned size = field->report_size;
+        unsigned size;
+
+        if (!field)
+                return -1;
+
+        size = field->report_size;
 
         hid_dump_input(field->report->device, field->usage + offset, value);
 
@@ -1601,6 +1623,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
@@ -1683,6 +1706,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ISKU) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEPLUS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEPURE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEPURE_OPTICAL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KOVAPLUS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_LUA) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_PYRA_WIRED) },
@@ -1740,6 +1764,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET) },
         { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZYDACRON, USB_DEVICE_ID_ZYDACRON_REMOTE_CONTROL) },
diff --git a/drivers/hid/hid-holtekff.c b/drivers/hid/hid-holtekff.c
index 9a8f05124525..9325545fc3ae 100644
--- a/drivers/hid/hid-holtekff.c
+++ b/drivers/hid/hid-holtekff.c
@@ -98,7 +98,7 @@ static void holtekff_send(struct holtekff_device *holtekff,
                 holtekff->field->value[i] = data[i];
         }
 
-        dbg_hid("sending %*ph\n", 7, data);
+        dbg_hid("sending %7ph\n", data);
 
         hid_hw_request(hid, holtekff->field->report, HID_REQ_SET_REPORT);
 }
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index ffe4c7ae3340..e60e8d530697 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -135,9 +135,9 @@
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI  0x0255
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO   0x0256
-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI    0x0291
-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO     0x0292
-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS     0x0293
+#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI    0x0290
+#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO     0x0291
+#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS     0x0292
 #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY    0x030a
 #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY     0x030b
 #define USB_DEVICE_ID_APPLE_IRCONTROL   0x8240
@@ -482,6 +482,7 @@
 #define USB_VENDOR_ID_KYE               0x0458
 #define USB_DEVICE_ID_KYE_ERGO_525V     0x0087
 #define USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE  0x0138
+#define USB_DEVICE_ID_GENIUS_GX_IMPERATOR       0x4018
 #define USB_DEVICE_ID_KYE_GPEN_560      0x5003
 #define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010
 #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X        0x5011
@@ -658,6 +659,7 @@
 #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16   0x0012
 #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17   0x0013
 #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18   0x0014
+#define USB_DEVICE_ID_NTRIG_DUOSENSE 0x1500
 
 #define USB_VENDOR_ID_ONTRAK            0x0a07
 #define USB_DEVICE_ID_ONTRAK_ADU100     0x0064
@@ -716,6 +718,7 @@
 #define USB_DEVICE_ID_ROCCAT_KONE       0x2ced
 #define USB_DEVICE_ID_ROCCAT_KONEPLUS   0x2d51
 #define USB_DEVICE_ID_ROCCAT_KONEPURE   0x2dbe
+#define USB_DEVICE_ID_ROCCAT_KONEPURE_OPTICAL   0x2db4
 #define USB_DEVICE_ID_ROCCAT_KONEXTD    0x2e22
 #define USB_DEVICE_ID_ROCCAT_KOVAPLUS   0x2d50
 #define USB_DEVICE_ID_ROCCAT_LUA        0x2c2e
@@ -887,6 +890,9 @@
 #define USB_VENDOR_ID_XAT       0x2505
 #define USB_DEVICE_ID_XAT_CSR   0x0220
 
+#define USB_VENDOR_ID_XIN_MO                    0x16c0
+#define USB_DEVICE_ID_XIN_MO_DUAL_ARCADE        0x05e1
+
 #define USB_VENDOR_ID_XIROKU            0x1477
 #define USB_DEVICE_ID_XIROKU_SPX        0x1006
 #define USB_DEVICE_ID_XIROKU_MPX        0x1007
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 7480799e535c..3fc4034a4367 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -340,7 +340,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
 {
         struct hid_device *dev = container_of(psy, struct hid_device, battery);
         int ret = 0;
-        __u8 buf[2] = {};
+        __u8 *buf;
 
         switch (prop) {
         case POWER_SUPPLY_PROP_PRESENT:
@@ -349,12 +349,19 @@ static int hidinput_get_battery_property(struct power_supply *psy,
                 break;
 
         case POWER_SUPPLY_PROP_CAPACITY:
+
+                buf = kmalloc(2 * sizeof(__u8), GFP_KERNEL);
+                if (!buf) {
+                        ret = -ENOMEM;
+                        break;
+                }
                 ret = dev->hid_get_raw_report(dev, dev->battery_report_id,
-                                              buf, sizeof(buf),
+                                              buf, 2,
                                               dev->battery_report_type);
 
                 if (ret != 2) {
                         ret = -ENODATA;
+                        kfree(buf);
                         break;
                 }
                 ret = 0;
@@ -364,6 +371,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
                     buf[1] <= dev->battery_max)
                         val->intval = (100 * (buf[1] - dev->battery_min)) /
                                 (dev->battery_max - dev->battery_min);
+                kfree(buf);
                 break;
 
         case POWER_SUPPLY_PROP_MODEL_NAME:
diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
index 1e2ee2aa84a0..73845120295e 100644
--- a/drivers/hid/hid-kye.c
+++ b/drivers/hid/hid-kye.c
@@ -268,6 +268,26 @@ static __u8 easypen_m610x_rdesc_fixed[] = {
         0xC0                          /*  End Collection                  */
 };
 
+static __u8 *kye_consumer_control_fixup(struct hid_device *hdev, __u8 *rdesc,
+                unsigned int *rsize, int offset, const char *device_name) {
+        /*
+         * the fixup that need to be done:
+         *   - change Usage Maximum in the Comsumer Control
+         *     (report ID 3) to a reasonable value
+         */
+        if (*rsize >= offset + 31 &&
+            /* Usage Page (Consumer Devices) */
+            rdesc[offset] == 0x05 && rdesc[offset + 1] == 0x0c &&
+            /* Usage (Consumer Control) */
+            rdesc[offset + 2] == 0x09 && rdesc[offset + 3] == 0x01 &&
+            /*   Usage Maximum > 12287 */
+            rdesc[offset + 10] == 0x2a && rdesc[offset + 12] > 0x2f) {
+                hid_info(hdev, "fixing up %s report descriptor\n", device_name);
+                rdesc[offset + 12] = 0x2f;
+        }
+        return rdesc;
+}
+
 static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 unsigned int *rsize)
 {
@@ -315,23 +335,12 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 }
                 break;
         case USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE:
-                /*
-                 * the fixup that need to be done:
-                 *   - change Usage Maximum in the Comsumer Control
-                 *     (report ID 3) to a reasonable value
-                 */
-                if (*rsize >= 135 &&
-                        /* Usage Page (Consumer Devices) */
-                        rdesc[104] == 0x05 && rdesc[105] == 0x0c &&
-                        /* Usage (Consumer Control) */
-                        rdesc[106] == 0x09 && rdesc[107] == 0x01 &&
-                        /*   Usage Maximum > 12287 */
-                        rdesc[114] == 0x2a && rdesc[116] > 0x2f) {
-                        hid_info(hdev,
-                                 "fixing up Genius Gila Gaming Mouse "
-                                 "report descriptor\n");
-                        rdesc[116] = 0x2f;
-                }
+                rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 104,
+                                        "Genius Gila Gaming Mouse");
+                break;
+        case USB_DEVICE_ID_GENIUS_GX_IMPERATOR:
+                rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 83,
+                                        "Genius Gx Imperator Keyboard");
                 break;
         }
         return rdesc;
@@ -428,6 +437,8 @@ static const struct hid_device_id kye_devices[] = {
                                 USB_DEVICE_ID_KYE_EASYPEN_M610X) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
                                 USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+                                USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, kye_devices);
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index cd33084c7860..d0e5963c1ba1 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -619,7 +619,7 @@ static int logi_dj_ll_input_event(struct input_dev *dev, unsigned int type,
 
         struct hid_field *field;
         struct hid_report *report;
-        unsigned char data[8];
+        unsigned char *data;
         int offset;
 
         dbg_hid("%s: %s, type:%d | code:%d | value:%d\n",
@@ -635,6 +635,13 @@ static int logi_dj_ll_input_event(struct input_dev *dev, unsigned int type,
                 return -1;
         }
         hid_set_field(field, offset, value);
+
+        data = hid_alloc_report_buf(field->report, GFP_ATOMIC);
+        if (!data) {
+                dev_warn(&dev->dev, "failed to allocate report buf memory\n");
+                return -1;
+        }
+
         hid_output_report(field->report, &data[0]);
 
         output_report_enum = &dj_rcv_hiddev->report_enum[HID_OUTPUT_REPORT];
@@ -645,8 +652,9 @@ static int logi_dj_ll_input_event(struct input_dev *dev, unsigned int type,
 
         hid_hw_request(dj_rcv_hiddev, report, HID_REQ_SET_REPORT);
 
-        return 0;
+        kfree(data);
 
+        return 0;
 }
 
 static int logi_dj_ll_start(struct hid_device *hid)
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 5bc37343eb22..a32f5a24b27c 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -36,7 +36,7 @@ MODULE_PARM_DESC(emulate_scroll_wheel, "Emulate a scroll wheel");
 static unsigned int scroll_speed = 32;
 static int param_set_scroll_speed(const char *val, struct kernel_param *kp) {
         unsigned long speed;
-        if (!val || strict_strtoul(val, 0, &speed) || speed > 63)
+        if (!val || kstrtoul(val, 0, &speed) || speed > 63)
                 return -EINVAL;
         scroll_speed = speed;
         return 0;
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index ef95102515e4..600f2075512f 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
         struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
                                     report_id_hash[0x0d];
 
-        if (!report)
+        if (!report || report->maxfield < 1 ||
+            report->field[0]->report_count < 1)
                 return -EINVAL;
 
         hid_hw_request(hdev, report, HID_REQ_GET_REPORT);
@@ -237,7 +238,7 @@ static ssize_t set_min_width(struct device *dev,
 
         unsigned long val;
 
-        if (strict_strtoul(buf, 0, &val))
+        if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
         if (val > nd->sensor_physical_width)
@@ -272,7 +273,7 @@ static ssize_t set_min_height(struct device *dev,
 
         unsigned long val;
 
-        if (strict_strtoul(buf, 0, &val))
+        if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
         if (val > nd->sensor_physical_height)
@@ -306,7 +307,7 @@ static ssize_t set_activate_slack(struct device *dev,
 
         unsigned long val;
 
-        if (strict_strtoul(buf, 0, &val))
+        if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
         if (val > 0x7f)
@@ -341,7 +342,7 @@ static ssize_t set_activation_width(struct device *dev,
 
         unsigned long val;
 
-        if (strict_strtoul(buf, 0, &val))
+        if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
         if (val > nd->sensor_physical_width)
@@ -377,7 +378,7 @@ static ssize_t set_activation_height(struct device *dev,
 
         unsigned long val;
 
-        if (strict_strtoul(buf, 0, &val))
+        if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
         if (val > nd->sensor_physical_height)
@@ -411,7 +412,7 @@ static ssize_t set_deactivate_slack(struct device *dev,
 
         unsigned long val;
 
-        if (strict_strtoul(buf, 0, &val))
+        if (kstrtoul(buf, 0, &val))
                 return -EINVAL;
 
         /*
diff --git a/drivers/hid/hid-picolcd_cir.c b/drivers/hid/hid-picolcd_cir.c
index e346038f0f11..59d5eb1e742c 100644
--- a/drivers/hid/hid-picolcd_cir.c
+++ b/drivers/hid/hid-picolcd_cir.c
@@ -145,6 +145,7 @@ void picolcd_exit_cir(struct picolcd_data *data)
         struct rc_dev *rdev = data->rc_dev;
 
         data->rc_dev = NULL;
-        rc_unregister_device(rdev);
+        if (rdev)
+                rc_unregister_device(rdev);
 }
 
diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
index b48092d0e139..acbb021065ec 100644
--- a/drivers/hid/hid-picolcd_core.c
+++ b/drivers/hid/hid-picolcd_core.c
@@ -290,7 +290,7 @@ static ssize_t picolcd_operation_mode_store(struct device *dev,
                 buf += 10;
                 cnt -= 10;
         }
-        if (!report)
+        if (!report || report->maxfield != 1)
                 return -EINVAL;
 
         while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
diff --git a/drivers/hid/hid-picolcd_debugfs.c b/drivers/hid/hid-picolcd_debugfs.c
index 59ab8e157e6b..024cdf3c2297 100644
--- a/drivers/hid/hid-picolcd_debugfs.c
+++ b/drivers/hid/hid-picolcd_debugfs.c
@@ -394,7 +394,7 @@ static void dump_buff_as_hex(char *dst, size_t dst_sz, const u8 *data,
 void picolcd_debug_out_report(struct picolcd_data *data,
                 struct hid_device *hdev, struct hid_report *report)
 {
-        u8 raw_data[70];
+        u8 *raw_data;
         int raw_size = (report->size >> 3) + 1;
         char *buff;
 #define BUFF_SZ 256
@@ -407,20 +407,20 @@ void picolcd_debug_out_report(struct picolcd_data *data,
         if (!buff)
                 return;
 
-        snprintf(buff, BUFF_SZ, "\nout report %d (size %d) =  ",
-                        report->id, raw_size);
-        hid_debug_event(hdev, buff);
-        if (raw_size + 5 > sizeof(raw_data)) {
+        raw_data = hid_alloc_report_buf(report, GFP_ATOMIC);
+        if (!raw_data) {
                 kfree(buff);
-                hid_debug_event(hdev, " TOO BIG\n");
                 return;
-        } else {
-                raw_data[0] = report->id;
-                hid_output_report(report, raw_data);
-                dump_buff_as_hex(buff, BUFF_SZ, raw_data, raw_size);
-                hid_debug_event(hdev, buff);
         }
 
+        snprintf(buff, BUFF_SZ, "\nout report %d (size %d) =  ",
+                        report->id, raw_size);
+        hid_debug_event(hdev, buff);
+        raw_data[0] = report->id;
+        hid_output_report(report, raw_data);
+        dump_buff_as_hex(buff, BUFF_SZ, raw_data, raw_size);
+        hid_debug_event(hdev, buff);
+
         switch (report->id) {
         case REPORT_LED_STATE:
                 /* 1 data byte with GPO state */
@@ -644,6 +644,7 @@ void picolcd_debug_out_report(struct picolcd_data *data,
                 break;
         }
         wake_up_interruptible(&hdev->debug_wait);
+        kfree(raw_data);
         kfree(buff);
 }
 
diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
index 591f6b22aa94..c930ab8554ea 100644
--- a/drivers/hid/hid-picolcd_fb.c
+++ b/drivers/hid/hid-picolcd_fb.c
@@ -593,10 +593,14 @@ err_nomem:
 void picolcd_exit_framebuffer(struct picolcd_data *data)
 {
         struct fb_info *info = data->fb_info;
-        struct picolcd_fb_data *fbdata = info->par;
+        struct picolcd_fb_data *fbdata;
         unsigned long flags;
 
+        if (!info)
+                return;
+
         device_remove_file(&data->hdev->dev, &dev_attr_fb_update_rate);
+        fbdata = info->par;
 
         /* disconnect framebuffer from HID dev */
         spin_lock_irqsave(&fbdata->lock, flags);
diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
index d29112fa5cd5..2dcd7d98dbd6 100644
--- a/drivers/hid/hid-pl.c
+++ b/drivers/hid/hid-pl.c
@@ -132,8 +132,14 @@ static int plff_init(struct hid_device *hid)
                         strong = &report->field[0]->value[2];
                         weak = &report->field[0]->value[3];
                         debug("detected single-field device");
-                } else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
-                                report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
+                } else if (report->field[0]->maxusage == 1 &&
+                           report->field[0]->usage[0].hid ==
+                                (HID_UP_LED | 0x43) &&
+                           report->maxfield >= 4 &&
+                           report->field[0]->report_count >= 1 &&
+                           report->field[1]->report_count >= 1 &&
+                           report->field[2]->report_count >= 1 &&
+                           report->field[3]->report_count >= 1) {
                         report->field[0]->value[0] = 0x00;
                         report->field[1]->value[0] = 0x00;
                         strong = &report->field[2]->value[0];
diff --git a/drivers/hid/hid-roccat-arvo.c b/drivers/hid/hid-roccat-arvo.c
index 327f9b8ed1f4..071ee9e2fd9f 100644
--- a/drivers/hid/hid-roccat-arvo.c
+++ b/drivers/hid/hid-roccat-arvo.c
@@ -59,7 +59,7 @@ static ssize_t arvo_sysfs_set_mode_key(struct device *dev,
         unsigned long state;
         int retval;
 
-        retval = strict_strtoul(buf, 10, &state);
+        retval = kstrtoul(buf, 10, &state);
         if (retval)
                 return retval;
 
@@ -107,7 +107,7 @@ static ssize_t arvo_sysfs_set_key_mask(struct device *dev,
         unsigned long key_mask;
         int retval;
 
-        retval = strict_strtoul(buf, 10, &key_mask);
+        retval = kstrtoul(buf, 10, &key_mask);
         if (retval)
                 return retval;
 
@@ -159,7 +159,7 @@ static ssize_t arvo_sysfs_set_actual_profile(struct device *dev,
         unsigned long profile;
         int retval;
 
-        retval = strict_strtoul(buf, 10, &profile);
+        retval = kstrtoul(buf, 10, &profile);
         if (retval)
                 return retval;
 
diff --git a/drivers/hid/hid-roccat-isku.c b/drivers/hid/hid-roccat-isku.c
index 8023751d5257..5dd0ea4eb4f7 100644
--- a/drivers/hid/hid-roccat-isku.c
+++ b/drivers/hid/hid-roccat-isku.c
@@ -82,7 +82,7 @@ static ssize_t isku_sysfs_set_actual_profile(struct device *dev,
         isku = hid_get_drvdata(dev_get_drvdata(dev));
         usb_dev = interface_to_usbdev(to_usb_interface(dev));
 
-        retval = strict_strtoul(buf, 10, &profile);
+        retval = kstrtoul(buf, 10, &profile);
         if (retval)
                 return retval;
 
diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
index 7fae070788fa..00ab287f7384 100644
--- a/drivers/hid/hid-roccat-kone.c
+++ b/drivers/hid/hid-roccat-kone.c
@@ -456,7 +456,7 @@ static ssize_t kone_sysfs_set_tcu(struct device *dev,
         kone = hid_get_drvdata(dev_get_drvdata(dev));
         usb_dev = interface_to_usbdev(to_usb_interface(dev));
 
-        retval = strict_strtoul(buf, 10, &state);
+        retval = kstrtoul(buf, 10, &state);
         if (retval)
                 return retval;
 
@@ -545,7 +545,7 @@ static ssize_t kone_sysfs_set_startup_profile(struct device *dev,
         kone = hid_get_drvdata(dev_get_drvdata(dev));
         usb_dev = interface_to_usbdev(to_usb_interface(dev));
 
-        retval = strict_strtoul(buf, 10, &new_startup_profile);
+        retval = kstrtoul(buf, 10, &new_startup_profile);
         if (retval)
                 return retval;
 
diff --git a/drivers/hid/hid-roccat-koneplus.c b/drivers/hid/hid-roccat-koneplus.c
index 6a48fa3c7da9..26b9663ddf47 100644
--- a/drivers/hid/hid-roccat-koneplus.c
+++ b/drivers/hid/hid-roccat-koneplus.c
@@ -246,7 +246,7 @@ static ssize_t koneplus_sysfs_set_actual_profile(struct device *dev,
         koneplus = hid_get_drvdata(dev_get_drvdata(dev));
         usb_dev = interface_to_usbdev(to_usb_interface(dev));
 
-        retval = strict_strtoul(buf, 10, &profile);
+        retval = kstrtoul(buf, 10, &profile);
         if (retval)
                 return retval;
 
diff --git a/drivers/hid/hid-roccat-konepure.c b/drivers/hid/hid-roccat-konepure.c
index c79d0b06c143..5850959d48f5 100644
--- a/drivers/hid/hid-roccat-konepure.c
+++ b/drivers/hid/hid-roccat-konepure.c
@@ -262,6 +262,7 @@ static int konepure_raw_event(struct hid_device *hdev,
 
 static const struct hid_device_id konepure_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEPURE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KONEPURE_OPTICAL) },
         { }
 };
 
@@ -300,5 +301,5 @@ module_init(konepure_init);
 module_exit(konepure_exit);
 
 MODULE_AUTHOR("Stefan Achatz");
-MODULE_DESCRIPTION("USB Roccat KonePure driver");
+MODULE_DESCRIPTION("USB Roccat KonePure/Optical driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
index b8b37789b864..c2a17e45c99c 100644
--- a/drivers/hid/hid-roccat-kovaplus.c
+++ b/drivers/hid/hid-roccat-kovaplus.c
@@ -282,7 +282,7 @@ static ssize_t kovaplus_sysfs_set_actual_profile(struct device *dev,
         kovaplus = hid_get_drvdata(dev_get_drvdata(dev));
         usb_dev = interface_to_usbdev(to_usb_interface(dev));
 
-        retval = strict_strtoul(buf, 10, &profile);
+        retval = kstrtoul(buf, 10, &profile);
         if (retval)
                 return retval;
 
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index ca7498107327..6fca30eb377d 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -221,7 +221,8 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
 
         mutex_lock(&data->mutex);
         report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
-        if (!report || (field_index >=  report->maxfield)) {
+        if (!report || (field_index >=  report->maxfield) ||
+            report->field[field_index]->report_count < 1) {
                 ret = -EINVAL;
                 goto done_proc;
         }
@@ -416,7 +417,7 @@ static int sensor_hub_raw_event(struct hid_device *hdev,
                 return 1;
 
         ptr = raw_data;
-        ptr++; /*Skip report id*/
+        ptr++; /* Skip report id */
 
         spin_lock_irqsave(&pdata->lock, flags);
 
diff --git a/drivers/hid/hid-speedlink.c b/drivers/hid/hid-speedlink.c
index a2f587d004e1..7112f3e832ee 100644
--- a/drivers/hid/hid-speedlink.c
+++ b/drivers/hid/hid-speedlink.c
@@ -3,7 +3,7 @@
  *  Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from
  *  the HID descriptor.
  *
- *  Copyright (c) 2011 Stefan Kriwanek <mail@stefankriwanek.de>
+ *  Copyright (c) 2011, 2013 Stefan Kriwanek <dev@stefankriwanek.de>
  */
 
 /*
@@ -46,8 +46,13 @@ static int speedlink_event(struct hid_device *hdev, struct hid_field *field,
                 struct hid_usage *usage, __s32 value)
 {
         /* No other conditions due to usage_table. */
-        /* Fix "jumpy" cursor (invalid events sent by device). */
-        if (value == 256)
+
+        /* This fixes the "jumpy" cursor occuring due to invalid events sent
+         * by the device. Some devices only send them with value==+256, others
+         * don't. However, catching abs(value)>=256 is restrictive enough not
+         * to interfere with devices that were bug-free (has been tested).
+         */
+        if (abs(value) >= 256)
                 return 1;
         /* Drop useless distance 0 events (on button clicks etc.) as well */
         if (value == 0)
diff --git a/drivers/hid/hid-xinmo.c b/drivers/hid/hid-xinmo.c
new file mode 100644
index 000000000000..7df5227a7e61
--- /dev/null
+++ b/drivers/hid/hid-xinmo.c
@@ -0,0 +1,61 @@
+/*
+ *  HID driver for Xin-Mo devices, currently only the Dual Arcade controller.
+ *  Fixes the negative axis event values (the devices sends -2) to match the
+ *  logical axis minimum of the HID report descriptor (the report announces
+ *  -1). It is needed because hid-input discards out of bounds values.
+ *  (This module is based on "hid-saitek" and "hid-lg".)
+ *
+ *  Copyright (c) 2013 Olivier Scherler
+ */
+
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+#include <linux/device.h>
+#include <linux/hid.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include "hid-ids.h"
+
+/*
+ * Fix negative events that are out of bounds.
+ */
+static int xinmo_event(struct hid_device *hdev, struct hid_field *field,
+                struct hid_usage *usage, __s32 value)
+{
+        switch (usage->code) {
+        case ABS_X:
+        case ABS_Y:
+        case ABS_Z:
+        case ABS_RX:
+                if (value < -1) {
+                        input_event(field->hidinput->input, usage->type,
+                                usage->code, -1);
+                        return 1;
+                }
+                break;
+        }
+
+        return 0;
+}
+
+static const struct hid_device_id xinmo_devices[] = {
+        { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) },
+        { }
+};
+
+MODULE_DEVICE_TABLE(hid, xinmo_devices);
+
+static struct hid_driver xinmo_driver = {
+        .name = "xinmo",
+        .id_table = xinmo_devices,
+        .event = xinmo_event
+};
+
+module_hid_driver(xinmo_driver);
+MODULE_LICENSE("GPL");
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 6f1feb2c2e97..8918dd12bb69 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -113,7 +113,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
         __u8 *buf;
         int ret = 0;
 
-        if (!hidraw_table[minor]) {
+        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
                 ret = -ENODEV;
                 goto out;
         }
@@ -253,6 +253,7 @@ static int hidraw_open(struct inode *inode, struct file *file)
         unsigned int minor = iminor(inode);
         struct hidraw *dev;
         struct hidraw_list *list;
+        unsigned long flags;
         int err = 0;
 
         if (!(list = kzalloc(sizeof(struct hidraw_list), GFP_KERNEL))) {
@@ -261,16 +262,11 @@ static int hidraw_open(struct inode *inode, struct file *file)
         }
 
         mutex_lock(&minors_lock);
-        if (!hidraw_table[minor]) {
+        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
                 err = -ENODEV;
                 goto out_unlock;
         }
 
-        list->hidraw = hidraw_table[minor];
-        mutex_init(&list->read_mutex);
-        list_add_tail(&list->node, &hidraw_table[minor]->list);
-        file->private_data = list;
-
         dev = hidraw_table[minor];
         if (!dev->open++) {
                 err = hid_hw_power(dev->hid, PM_HINT_FULLON);
@@ -283,9 +279,16 @@ static int hidraw_open(struct inode *inode, struct file *file)
                 if (err < 0) {
                         hid_hw_power(dev->hid, PM_HINT_NORMAL);
                         dev->open--;
+                        goto out_unlock;
                 }
         }
 
+        list->hidraw = hidraw_table[minor];
+        mutex_init(&list->read_mutex);
+        spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
+        list_add_tail(&list->node, &hidraw_table[minor]->list);
+        spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
+        file->private_data = list;
 out_unlock:
         mutex_unlock(&minors_lock);
 out:
@@ -302,39 +305,41 @@ static int hidraw_fasync(int fd, struct file *file, int on)
         return fasync_helper(fd, file, on, &list->fasync);
 }
 
+static void drop_ref(struct hidraw *hidraw, int exists_bit)
+{
+        if (exists_bit) {
+                hid_hw_close(hidraw->hid);
+                hidraw->exist = 0;
+                if (hidraw->open)
+                        wake_up_interruptible(&hidraw->wait);
+        } else {
+                --hidraw->open;
+        }
+
+        if (!hidraw->open && !hidraw->exist) {
+                device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+                hidraw_table[hidraw->minor] = NULL;
+                kfree(hidraw);
+        }
+}
+
 static int hidraw_release(struct inode * inode, struct file * file)
 {
         unsigned int minor = iminor(inode);
-        struct hidraw *dev;
         struct hidraw_list *list = file->private_data;
-        int ret;
-        int i;
+        unsigned long flags;
 
         mutex_lock(&minors_lock);
-        if (!hidraw_table[minor]) {
-                ret = -ENODEV;
-                goto unlock;
-        }
 
+        spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
         list_del(&list->node);
-        dev = hidraw_table[minor];
-        if (!--dev->open) {
-                if (list->hidraw->exist) {
-                        hid_hw_power(dev->hid, PM_HINT_NORMAL);
-                        hid_hw_close(dev->hid);
-                } else {
-                        kfree(list->hidraw);
-                }
-        }
-
-        for (i = 0; i < HIDRAW_BUFFER_SIZE; ++i)
-                kfree(list->buffer[i].value);
+        spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
         kfree(list);
-        ret = 0;
-unlock:
-        mutex_unlock(&minors_lock);
 
-        return ret;
+        drop_ref(hidraw_table[minor], 0);
+
+        mutex_unlock(&minors_lock);
+        return 0;
 }
 
 static long hidraw_ioctl(struct file *file, unsigned int cmd,
@@ -457,7 +462,9 @@ int hidraw_report_event(struct hid_device *hid, u8 *data, int len)
         struct hidraw *dev = hid->hidraw;
         struct hidraw_list *list;
         int ret = 0;
+        unsigned long flags;
 
+        spin_lock_irqsave(&dev->list_lock, flags);
         list_for_each_entry(list, &dev->list, node) {
                 int new_head = (list->head + 1) & (HIDRAW_BUFFER_SIZE - 1);
 
@@ -472,6 +479,7 @@ int hidraw_report_event(struct hid_device *hid, u8 *data, int len)
                 list->head = new_head;
                 kill_fasync(&list->fasync, SIGIO, POLL_IN);
         }
+        spin_unlock_irqrestore(&dev->list_lock, flags);
 
         wake_up_interruptible(&dev->wait);
         return ret;
@@ -519,6 +527,7 @@ int hidraw_connect(struct hid_device *hid)
         }
 
         init_waitqueue_head(&dev->wait);
+        spin_lock_init(&dev->list_lock);
         INIT_LIST_HEAD(&dev->list);
 
         dev->hid = hid;
@@ -539,18 +548,9 @@ void hidraw_disconnect(struct hid_device *hid)
         struct hidraw *hidraw = hid->hidraw;
 
         mutex_lock(&minors_lock);
-        hidraw->exist = 0;
 
-        device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
+        drop_ref(hidraw, 1);
 
-        hidraw_table[hidraw->minor] = NULL;
-
-        if (hidraw->open) {
-                hid_hw_close(hid);
-                wake_up_interruptible(&hidraw->wait);
-        } else {
-                kfree(hidraw);
-        }
         mutex_unlock(&minors_lock);
 }
 EXPORT_SYMBOL_GPL(hidraw_disconnect);
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 879b0ed701a3..3cb7d966da9e 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -824,8 +824,8 @@ static int i2c_hid_fetch_hid_descriptor(struct i2c_hid *ihid)
          * bytes 2-3 -> bcdVersion (has to be 1.00) */
         ret = i2c_hid_command(client, &hid_descr_cmd, ihid->hdesc_buffer, 4);
 
-        i2c_hid_dbg(ihid, "%s, ihid->hdesc_buffer: %*ph\n",
-                        __func__, 4, ihid->hdesc_buffer);
+        i2c_hid_dbg(ihid, "%s, ihid->hdesc_buffer: %4ph\n", __func__,
+                        ihid->hdesc_buffer);
 
         if (ret) {
                 dev_err(&client->dev,
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index fc307e0422af..9ab7dfc6c72c 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -659,3 +659,4 @@ module_exit(uhid_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
+MODULE_ALIAS("devname:" UHID_NAME);
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 99418285222c..ada164e1b3a1 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -535,7 +535,6 @@ static void __usbhid_submit_report(struct hid_device *hid, struct hid_report *re
 {
         int head;
         struct usbhid_device *usbhid = hid->driver_data;
-        int len = ((report->size - 1) >> 3) + 1 + (report->id > 0);
 
         if ((hid->quirks & HID_QUIRK_NOGET) && dir == USB_DIR_IN)
                 return;
@@ -546,7 +545,7 @@ static void __usbhid_submit_report(struct hid_device *hid, struct hid_report *re
                         return;
                 }
 
-                usbhid->out[usbhid->outhead].raw_report = kmalloc(len, GFP_ATOMIC);
+                usbhid->out[usbhid->outhead].raw_report = hid_alloc_report_buf(report, GFP_ATOMIC);
                 if (!usbhid->out[usbhid->outhead].raw_report) {
                         hid_warn(hid, "output queueing failed\n");
                         return;
@@ -595,7 +594,7 @@ static void __usbhid_submit_report(struct hid_device *hid, struct hid_report *re
         }
 
         if (dir == USB_DIR_OUT) {
-                usbhid->ctrl[usbhid->ctrlhead].raw_report = kmalloc(len, GFP_ATOMIC);
+                usbhid->ctrl[usbhid->ctrlhead].raw_report = hid_alloc_report_buf(report, GFP_ATOMIC);
                 if (!usbhid->ctrl[usbhid->ctrlhead].raw_report) {
                         hid_warn(hid, "control queueing failed\n");
                         return;
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 19b8360f2330..07345521f421 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -109,6 +109,8 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
+
         { 0, 0 }
 };