commit a87fa1d81a9fb5e9adca9820e16008c40ad09f33 upstream.

The string property read helpers will run off the end of the buffer if
it is handed a malformed string property. Rework the parsers to make
sure that doesn't happen. At the same time add new test cases to make
sure the functions behave themselves.

The original implementations of of_property_read_string_index() and
of_property_count_strings() both open-coded the same block of parsing
code, each with it's own subtly different bugs. The fix here merges
functions into a single helper and makes the original functions static
inline wrappers around the helper.

One non-bugfix aspect of this patch is the addition of a new wrapper,
of_property_read_string_array(). The new wrapper is needed by the
device_properties feature that Rafael is working on and planning to
merge for v3.19. The implementation is identical both with and without
the new static inline wrapper, so it just got left in to reduce the
churn on the header file.

Signed-off-by: Grant Likely <grant.likely@linaro.org>
Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Darren Hart <darren.hart@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0640332e073be9207f0784df43595c0c39716e42 upstream.

Any calls to dt_alloc() need to be zeroed. This is a temporary fix, but
the allocation function itself needs to zero memory before returning
it. This is a follow up to patch 9e4012752, "of: fdt: fix memory
initialization for expanded DT" which fixed one call site but missed
another.

Signed-off-by: Grant Likely <grant.likely@linaro.org>
Acked-by: Wladislav Wiebe <wladislav.kw@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The OF code uses irqsafe locks everywhere except in a handful of functions
for no obvious reasons. Since the conversion from the old rwlocks, this
now triggers lockdep warnings when used at interrupt time. At least one
driver (ibmvscsi) seems to be doing that from softirq context.

This converts the few non-irqsafe locks into irqsafe ones, making them
consistent with the rest of the code.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

Pull device tree fixes from Grant Likely:
 "Device tree bug fixes and documentation updates for v3.10

  Nothing earth shattering here.  A build failure fix, and fix for
  releasing nodes and some documenation updates."

* tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux:
  Documentation/devicetree: make semantic of initrd-end more explicit
  of/base: release the node correctly in of_parse_phandle_with_args()
  of/documentation: move video device bindings to a common place
  <linux/of_platform.h>: fix compilation warnings with DT disabled

Pull ARM SoC driver changes from Olof Johansson:
 "This is a rather large set of patches for device drivers that for one
  reason or another the subsystem maintainer preferred to get merged
  through the arm-soc tree.  There are both new drivers as well as
  existing drivers that are getting converted from platform-specific
  code into standalone drivers using the appropriate subsystem specific
  interfaces.

  In particular, we can now have pinctrl, clk, clksource and irqchip
  drivers in one file per driver, without the need to call into platform
  specific interface, or to get called from platform specific code, as
  long as all information about the hardware is provided through a
  device tree.

  Most of the drivers we touch this time are for clocksource.  Since now
  most of them are part of drivers/clocksource, I expect that we won't
  have to touch these again from arm-soc and can let the clocksource
  maintainers take care of these in the future.

  Another larger part of this series is specific to the exynos platform,
  which is seeing some significant effort in upstreaming and
  modernization of its device drivers this time around, which
  unfortunately is also the cause for the churn and a lot of the merge
  conflicts.

  There is one new subsystem that gets merged as part of this series:
  the reset controller interface, which is a very simple interface for
  taking devices on the SoC out of reset or back into reset.  Patches to
  use this interface on i.MX follow later in this merge window, and we
  are going to have other platforms (at least tegra and sirf) get
  converted in 3.11.  This will let us get rid of platform specific
  callbacks in a number of platform independent device drivers."

* tag 'drivers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (256 commits)
  irqchip: s3c24xx: add missing __init annotations
  ARM: dts: Disable the RTC by default on exynos5
  clk: exynos5250: Fix parent clock for sclk_mmc{0,1,2,3}
  ARM: exynos: restore mach/regs-clock.h for exynos5
  clocksource: exynos_mct: fix build error on non-DT
  pinctrl: vt8500: wmt: Fix checking return value of pinctrl_register()
  irqchip: vt8500: Convert arch-vt8500 to new irqchip infrastructure
  reset: NULL deref on allocation failure
  reset: Add reset controller API
  dt: describe base reset signal binding
  ARM: EXYNOS: Add arm-pmu DT binding for exynos421x
  ARM: EXYNOS: Add arm-pmu DT binding for exynos5250
  ARM: EXYNOS: Enable PMUs for exynos4
  irqchip: exynos-combiner: Correct combined IRQs for exynos4
  irqchip: exynos-combiner: Add set_irq_affinity function for combiner_irq
  ARM: EXYNOS: fix compilation error introduced due to common clock migration
  clk: exynos5250: Fix divider values for sclk_mmc{0,1,2,3}
  clk: exynos4: export clocks required for fimc-is
  clk: samsung: Fix compilation error
  clk: tegra: fix enum tegra114_clk to match binding
  ...

Pull VFS updates from Al Viro,

Misc cleanups all over the place, mainly wrt /proc interfaces (switch
create_proc_entry to proc_create(), get rid of the deprecated
create_proc_read_entry() in favor of using proc_create_data() and
seq_file etc).

7kloc removed.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (204 commits)
  don't bother with deferred freeing of fdtables
  proc: Move non-public stuff from linux/proc_fs.h to fs/proc/internal.h
  proc: Make the PROC_I() and PDE() macros internal to procfs
  proc: Supply a function to remove a proc entry by PDE
  take cgroup_open() and cpuset_open() to fs/proc/base.c
  ppc: Clean up scanlog
  ppc: Clean up rtas_flash driver somewhat
  hostap: proc: Use remove_proc_subtree()
  drm: proc: Use remove_proc_subtree()
  drm: proc: Use minor->index to label things, not PDE->name
  drm: Constify drm_proc_list[]
  zoran: Don't print proc_dir_entry data in debug
  reiserfs: Don't access the proc_dir_entry in r_open(), r_start() r_show()
  proc: Supply an accessor for getting the data from a PDE's parent
  airo: Use remove_proc_subtree()
  rtl8192u: Don't need to save device proc dir PDE
  rtl8187se: Use a dir under /proc/net/r8180/
  proc: Add proc_mkdir_data()
  proc: Move some bits from linux/proc_fs.h to linux/{of.h,signal.h,tty.h}
  proc: Move PDE_NET() to fs/proc/proc_net.c
  ...

Supply a function (proc_remove()) to remove a proc entry (and any subtree
rooted there) by proc_dir_entry pointer rather than by name and (optionally)
root dir entry pointer.  This allows us to eliminate all remaining pde->name
accesses outside of procfs.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Grant Likely <grant.likely@linaro.or>
cc: linux-acpi@vger.kernel.org
cc: openipmi-developer@lists.sourceforge.net
cc: devicetree-discuss@lists.ozlabs.org
cc: linux-pci@vger.kernel.org
cc: netdev@vger.kernel.org
cc: netfilter-devel@vger.kernel.org
cc: alsa-devel@alsa-project.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Currently modular V4L2 build with enabled OF is broken dur to the
of_get_next_parent() function being unavailable to modules. Export it to
fix the build.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: Grant Likely <grant.likely@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

Call of_node_put() only when the out_args is NULL on success,
or the node's reference count will not be correct because the caller
will call of_node_put() again.

Signed-off-by: Tang Yuantian <Yuantian.Tang@freescale.com>
[grant.likely: tightened up the patch]
Signed-off-by: Grant Likely <grant.likely@linaro.org>

Several functions in of/base.c have the same code duplicated for
finding and validating a property and value.

struct property *prop = of_find_property(np, propname, NULL);
if (!prop)
	return -EINVAL;
if (!prop->value)
	return -ENODATA;
if (<some length> > prop->length)
	return -EOVERFLOW;

This patch adds of_find_property_value_of_size() which performs the
equivalent of the above code and removes the instances where it was
duplicated in several functions.

Reported-by: Rob Herring <robherring2@gmail.com>
Signed-off-by: Tony Prisk <linux@prisktech.co.nz>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Rob Herring <rob.herring@calxeda.com>