7 files changed, 27 insertions, 12 deletions

diff --git a/drivers/misc/cb710/sgbuf2.c b/drivers/misc/cb710/sgbuf2.c
index d019746551f3..2a40d0efdff5 100644
--- a/drivers/misc/cb710/sgbuf2.c
+++ b/drivers/misc/cb710/sgbuf2.c
@@ -47,7 +47,7 @@ static uint32_t sg_dwiter_read_buffer(struct sg_mapping_iter *miter)
 
 static inline bool needs_unaligned_copy(const void *ptr)
 {
-#ifdef HAVE_EFFICIENT_UNALIGNED_ACCESS
+#ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
         return false;
 #else
         return ((ptr - NULL) & 3) != 0;
diff --git a/drivers/misc/ioc4.c b/drivers/misc/ioc4.c
index 668d41e594a9..df03dd3bd0e2 100644
--- a/drivers/misc/ioc4.c
+++ b/drivers/misc/ioc4.c
@@ -270,7 +270,7 @@ ioc4_variant(struct ioc4_driver_data *idd)
         return IOC4_VARIANT_PCI_RT;
 }
 
-static void __devinit
+static void
 ioc4_load_modules(struct work_struct *work)
 {
         request_module("sgiioc4");
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 81d7fa4ec0db..150cd7061b80 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -120,6 +120,7 @@ static int recur_count = REC_NUM_DEFAULT;
 static enum cname cpoint = CN_INVALID;
 static enum ctype cptype = CT_NONE;
 static int count = DEFAULT_COUNT;
+static DEFINE_SPINLOCK(count_lock);
 
 module_param(recur_count, int, 0644);
 MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
@@ -230,11 +231,14 @@ static const char *cp_name_to_str(enum cname name)
 static int lkdtm_parse_commandline(void)
 {
         int i;
+        unsigned long flags;
 
         if (cpoint_count < 1 || recur_count < 1)
                 return -EINVAL;
 
+        spin_lock_irqsave(&count_lock, flags);
         count = cpoint_count;
+        spin_unlock_irqrestore(&count_lock, flags);
 
         /* No special parameters */
         if (!cpoint_type && !cpoint_name)
@@ -349,6 +353,9 @@ static void lkdtm_do_action(enum ctype which)
 
 static void lkdtm_handler(void)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&count_lock, flags);
         count--;
         printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
                         cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
@@ -357,6 +364,7 @@ static void lkdtm_handler(void)
                 lkdtm_do_action(cptype);
                 count = cpoint_count;
         }
+        spin_unlock_irqrestore(&count_lock, flags);
 }
 
 static int lkdtm_register_cpoint(enum cname which)
diff --git a/drivers/misc/pti.c b/drivers/misc/pti.c
index bb6f9255c17c..374dfcfccd07 100644
--- a/drivers/misc/pti.c
+++ b/drivers/misc/pti.c
@@ -317,7 +317,8 @@ EXPORT_SYMBOL_GPL(pti_request_masterchannel);
  *                              a master, channel ID address
  *                              used to write to PTI HW.
  *
- * @mc: master, channel apeture ID address to be released.
+ * @mc: master, channel apeture ID address to be released.  This
+ *      will de-allocate the structure via kfree().
  */
 void pti_release_masterchannel(struct pti_masterchannel *mc)
 {
@@ -475,8 +476,10 @@ static int pti_tty_install(struct tty_driver *driver, struct tty_struct *tty)
                 else
                         pti_tty_data->mc = pti_request_masterchannel(2);
 
-                if (pti_tty_data->mc == NULL)
+                if (pti_tty_data->mc == NULL) {
+                        kfree(pti_tty_data);
                         return -ENXIO;
+                }
                 tty->driver_data = pti_tty_data;
         }
 
@@ -495,7 +498,7 @@ static void pti_tty_cleanup(struct tty_struct *tty)
         if (pti_tty_data == NULL)
                 return;
         pti_release_masterchannel(pti_tty_data->mc);
-        kfree(tty->driver_data);
+        kfree(pti_tty_data);
         tty->driver_data = NULL;
 }
 
@@ -581,7 +584,7 @@ static int pti_char_open(struct inode *inode, struct file *filp)
 static int pti_char_release(struct inode *inode, struct file *filp)
 {
         pti_release_masterchannel(filp->private_data);
-        kfree(filp->private_data);
+        filp->private_data = NULL;
         return 0;
 }
 
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index ee5109a3cd98..42f067347bc7 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -495,14 +495,14 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
         }
 
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
+
         if (atomic_dec_return(&queued_msg->use_count) == 0) {
                 dev_kfree_skb(skb);
                 kfree(queued_msg);
         }
 
-        dev->stats.tx_packets++;
-        dev->stats.tx_bytes += skb->len;
-
         return NETDEV_TX_OK;
 }
 
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index f91f82eabda7..54c91ffe4a91 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -605,7 +605,7 @@ long st_unregister(struct st_proto_s *proto)
         pr_debug("%s: %d ", __func__, proto->chnl_id);
 
         st_kim_ref(&st_gdata, 0);
-        if (proto->chnl_id >= ST_MAX_CHANNELS) {
+        if (!st_gdata || proto->chnl_id >= ST_MAX_CHANNELS) {
                 pr_err(" chnl_id %d not supported", proto->chnl_id);
                 return -EPROTONOSUPPORT;
         }
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index 5da93ee6f6be..38fd2f04c07e 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -245,9 +245,9 @@ void skip_change_remote_baud(unsigned char **ptr, long *len)
                 pr_err("invalid action after change remote baud command");
         } else {
                 *ptr = *ptr + sizeof(struct bts_action) +
-                        ((struct bts_action *)nxt_action)->size;
+                        ((struct bts_action *)cur_action)->size;
                 *len = *len - (sizeof(struct bts_action) +
-                                ((struct bts_action *)nxt_action)->size);
+                                ((struct bts_action *)cur_action)->size);
                 /* warn user on not commenting these in firmware */
                 pr_warn("skipping the wait event of change remote baud");
         }
@@ -604,6 +604,10 @@ void st_kim_ref(struct st_data_s **core_data, int id)
         struct kim_data_s       *kim_gdata;
         /* get kim_gdata reference from platform device */
         pdev = st_get_plat_device(id);
+        if (!pdev) {
+                *core_data = NULL;
+                return;
+        }
         kim_gdata = dev_get_drvdata(&pdev->dev);
         *core_data = kim_gdata->core_data;
 }