3 files changed, 10 insertions, 4 deletions

diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
index 0735de3a6468..1cb1da294419 100644
--- a/drivers/input/misc/adxl34x.c
+++ b/drivers/input/misc/adxl34x.c
@@ -158,7 +158,7 @@
 
 /* ORIENT ADXL346 only */
 #define ADXL346_2D_VALID                (1 << 6)
-#define ADXL346_2D_ORIENT(x)            (((x) & 0x3) >> 4)
+#define ADXL346_2D_ORIENT(x)            (((x) & 0x30) >> 4)
 #define ADXL346_3D_VALID                (1 << 3)
 #define ADXL346_3D_ORIENT(x)            ((x) & 0x7)
 #define ADXL346_2D_PORTRAIT_POS         0       /* +X */
diff --git a/drivers/input/misc/hp_sdc_rtc.c b/drivers/input/misc/hp_sdc_rtc.c
index 86b822806e95..45e0e3e55de2 100644
--- a/drivers/input/misc/hp_sdc_rtc.c
+++ b/drivers/input/misc/hp_sdc_rtc.c
@@ -180,7 +180,10 @@ static int64_t hp_sdc_rtc_read_i8042timer (uint8_t loadcmd, int numreg)
         if (WARN_ON(down_interruptible(&i8042tregs)))
                 return -1;
 
-        if (hp_sdc_enqueue_transaction(&t)) return -1;
+        if (hp_sdc_enqueue_transaction(&t)) {
+                up(&i8042tregs);
+                return -1;
+        }
         
         /* Sleep until results come back. */
         if (WARN_ON(down_interruptible(&i8042tregs)))
diff --git a/drivers/input/misc/pcf8574_keypad.c b/drivers/input/misc/pcf8574_keypad.c
index e37392976fdd..0deca5a3c87f 100644
--- a/drivers/input/misc/pcf8574_keypad.c
+++ b/drivers/input/misc/pcf8574_keypad.c
@@ -113,9 +113,12 @@ static int pcf8574_kp_probe(struct i2c_client *client, const struct i2c_device_i
         idev->keycodemax = ARRAY_SIZE(lp->btncode);
 
         for (i = 0; i < ARRAY_SIZE(pcf8574_kp_btncode); i++) {
-                lp->btncode[i] = pcf8574_kp_btncode[i];
-                __set_bit(lp->btncode[i] & KEY_MAX, idev->keybit);
+                if (lp->btncode[i] <= KEY_MAX) {
+                        lp->btncode[i] = pcf8574_kp_btncode[i];
+                        __set_bit(lp->btncode[i], idev->keybit);
+                }
         }
+        __clear_bit(KEY_RESERVED, idev->keybit);
 
         sprintf(lp->name, DRV_NAME);
         sprintf(lp->phys, "kp_data/input0");