Merge branches 'upstream' and 'upstream-fixes' into for-linus

diff --combined drivers/hid/hidraw.c
index 1018f380de357557688f75a288198dd330dcd0e2,8ecd775251039c32ddffb23cb489f55846c0c73f..c40f0403edafe1390d5fecb66604e095c8f70057
--- 1/drivers/hid/hidraw.c
--- 2/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@@ -105,7 -105,6 +105,7 @@@ out
  static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
  {
        unsigned int minor = iminor(file->f_path.dentry->d_inode);
 +      /* FIXME: What stops hidraw_table going NULL */
        struct hid_device *dev = hidraw_table[minor]->hid;
        __u8 *buf;
        int ret = 0;
@@@ -212,41 -211,40 +212,43 @@@ static int hidraw_release(struct inode 
                        kfree(list->hidraw);
        }
  
+       kfree(list);
+ 
        return 0;
  }
  
 -static int hidraw_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
 +static long hidraw_ioctl(struct file *file, unsigned int cmd,
 +                                                      unsigned long arg)
  {
 +      struct inode *inode = file->f_path.dentry->d_inode;
        unsigned int minor = iminor(inode);
 +      long ret = 0;
 +      /* FIXME: What stops hidraw_table going NULL */
        struct hidraw *dev = hidraw_table[minor];
        void __user *user_arg = (void __user*) arg;
  
 +      lock_kernel();
        switch (cmd) {
                case HIDIOCGRDESCSIZE:
                        if (put_user(dev->hid->rsize, (int __user *)arg))
 -                              return -EFAULT;
 -                      return 0;
 +                              ret = -EFAULT;
 +                      break;
  
                case HIDIOCGRDESC:
                        {
                                __u32 len;
  
                                if (get_user(len, (int __user *)arg))
 -                                      return -EFAULT;
 -
 -                              if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
 -                                      return -EINVAL;
 -
 -                              if (copy_to_user(user_arg + offsetof(
 -                                                              struct hidraw_report_descriptor,
 -                                                              value[0]),
 -                                                      dev->hid->rdesc,
 -                                                      min(dev->hid->rsize, len)))
 -                                              return -EFAULT;
 -                              return 0;
 +                                      ret = -EFAULT;
 +                              else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
 +                                      ret = -EINVAL;
 +                              else if (copy_to_user(user_arg + offsetof(
 +                                      struct hidraw_report_descriptor,
 +                                      value[0]),
 +                                      dev->hid->rdesc,
 +                                      min(dev->hid->rsize, len)))
 +                                      ret = -EFAULT;
 +                              break;
                        }
                case HIDIOCGRAWINFO:
                        {
@@@ -256,13 -254,15 +258,13 @@@
                                dinfo.vendor = dev->hid->vendor;
                                dinfo.product = dev->hid->product;
                                if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
 -                                      return -EFAULT;
 -
 -                              return 0;
 +                                      ret = -EFAULT;
 +                              break;
                        }
                default:
 -                      printk(KERN_EMERG "hidraw: unsupported ioctl() %x\n",
 -                                      cmd);
 +                      ret = -ENOTTY;
        }
 -      return -EINVAL;
 +      return ret;
  }
  
  static const struct file_operations hidraw_ops = {
@@@ -272,7 -272,7 +274,7 @@@
        .poll =         hidraw_poll,
        .open =         hidraw_open,
        .release =      hidraw_release,
 -      .ioctl =        hidraw_ioctl,
 +      .unlocked_ioctl = hidraw_ioctl,
  };
  
  void hidraw_report_event(struct hid_device *hid, u8 *data, int len)