Add support for USB Device Rosewill RNX-N150NUB.
VendorID: 0x0bda, ProductID: 0xffef

Signed-off-by: Charles Milette <charles.milette@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The previous fix removed the equal to zero comparisons by the strcmps and
now the function always returns true. Revert this change to restore the
original correctly functioning code.

Detected by CoverityScan, CID#1452267 ("Constant expression result")

This reverts commit b93ad9a067e1515af42da7d56bc61f1a25075f94.

Fixes: b93ad9a067e1 ("staging: fsl-mc: be consistent when checking strcmp() return")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull staging/iio fixes from Greg KH:
 "Here are some Staging and IIO driver fixes for 4.13-rc5.

  Nothing major, just a number of small fixes for reported issues. All
  of these have been in linux-next for a while now with no reported
  issues. Full details are in the shortlog"

* tag 'staging-4.13-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: comedi: comedi_fops: do not call blocking ops when !TASK_RUNNING
  iio: aspeed-adc: wait for initial sequence.
  iio: accel: bmc150: Always restore device to normal mode after suspend-resume
  staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read
  iio: adc: axp288: Fix the GPADC pin reading often wrongly returning 0
  iio: adc: vf610_adc: Fix VALT selection value for REFSEL bits
  iio: accel: st_accel: add SPI-3wire support
  iio: adc: Revert "axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications"
  iio: adc: sun4i-gpadc-iio: fix unbalanced irq enable/disable
  iio: pressure: st_pressure_core: disable multiread by default for LPS22HB
  iio: light: tsl2563: use correct event code

Pull media fixes from Mauro Carvalho Chehab:
 "This series is larger than I would like to submit for -rc4. My
  original intent were to sent it to either -rc2 or -rc3. Unfortunately,
  due to my vacations, I got a lot of pending stuff after my return, and
  had to do some biz trips, with prevented me to send this earlier.

  Several fixes:

   - some fixes at atomisp staging driver

   - several gcc 7 warning fixes

   - cleanup media SVG files, in order to fix PDF build on some distros

   - fix random Kconfig build of venus driver

   - some fixes for the venus driver

   - some changes from semaphone to mutex in ngene's driver

   - some locking fixes at dib0700 driver

   - several fixes on ngene's driver and frontends to make it properly
     support some new boards added on Kernel 4.13

   - some fixes to CEC drivers

   - omap_vout: vrfb: convert to dmaengine

   - docs-rst: document EBUSY for VIDIOC_S_FMT

  Please notice that the big diffstat changes here are at the SVG files.

  Visually, the images look the same, but the file size is now a lot
  smaller than before, and they don't use some XML tags that would cause
  them to be badly parsed by some ImageMagick versions, or to require a
  lot of memory by TeTex, with would break PDF output on some
  distributions"

* tag 'media/v4.13-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (68 commits)
  media: atomisp2: array underflow in imx_enum_frame_size()
  media: atomisp2: array underflow in ap1302_enum_frame_size()
  media: atomisp2: Array underflow in atomisp_enum_input()
  media: platform: davinci: drop VPFE_CMD_S_CCDC_RAW_PARAMS
  media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl
  media: venus: don't abuse dma_alloc for non-DMA allocations
  media: venus: hfi: fix error handling in hfi_sys_init_done()
  media: venus: fix compile-test build on non-qcom ARM platform
  media: venus: mark PM functions as __maybe_unused
  media: cec-notifier: small improvements
  media: pulse8-cec: persistent_config should be off by default
  media: cec: cec_transmit_attempt_done: ignore CEC_TX_STATUS_MAX_RETRIES
  media: staging: atomisp: array underflow in ioctl
  media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds
  media: svg: avoid too long lines
  media: svg files: simplify files
  media: selection.svg: simplify the SVG file
  media: vimc: set id_table for platform drivers
  media: staging: atomisp: disable warnings with cc-disable-warning
  media: davinci: variable 'common' set but not used
  ...

Comedi's read and write file operation handlers (`comedi_read()` and
`comedi_write()`) currently call `copy_to_user()` or `copy_from_user()`
whilst in the `TASK_INTERRUPTIBLE` state, which falls foul of the
`might_fault()` checks when enabled.  Fix it by setting the current task
state back to `TASK_RUNNING` a bit earlier before calling these
functions.

Reported-by: Piotr Gregor <piotrgregor@rsyncme.org>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Cc: <stable@vger.kernel.org> # 4.5+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The code looks in imx_enum_frame_size() looks like this:

  2066          int index = fse->index;
  2067          struct imx_device *dev = to_imx_sensor(sd);
  2068
  2069          mutex_lock(&dev->input_lock);
  2070          if (index >= dev->entries_curr_table) {
  2071                  mutex_unlock(&dev->input_lock);
  2072                  return -EINVAL;
  2073          }
  2074
  2075          fse->min_width = dev->curr_res_table[index].width;

"fse->index" is a u32 that comes from the user.  We want negative values
of "index" to be -EINVAL so we don't read before the start of the
dev->curr_res_table[] array.  I've made "entries_curr_table" unsigned
long to fix this.  I thought about making it unsigned int, but because
of struct alignment, it doesn't use more memory either way.

Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The problem is this code from ap1302_enum_frame_size():

   738          int index = fse->index;
   739
   740          mutex_lock(&dev->input_lock);
   741          context = ap1302_get_context(sd);
   742          if (index >= dev->cntx_res[context].res_num) {
   743                  mutex_unlock(&dev->input_lock);
   744                  return -EINVAL;
   745          }
   746
   747          res_table = dev->cntx_res[context].res_table;
   748          fse->min_width = res_table[index].width;

"fse->index" is a u32 that come from the user.  We want negative values
of "index" to be treated as -EINVAL but they're not so we can read from
before the start of the res_table[] array.

I've fixed this by making "res_num" a u32.  I made "cur_res" a u32 as
well, just for consistency.

Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The problem here is this code from atomisp_enum_input():

   581          int index = input->index;
   582
   583          if (index >= isp->input_cnt)
   584                  return -EINVAL;
   585
   586          if (!isp->inputs[index].camera)
   587                  return -EINVAL;

"input->index" is a u32 which comes from the ioctl.  We want negative
values of "index" to be counted as -EINVAL but they aren't.  I've fixed
this by changing the type of "isp->input_cnt" to unsigned int.

Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

I noticed an array underflow in ov5693_enum_frame_size().  The code
looks like this:

	int index = fse->index;

	if (index >= N_RES)
		retur -EINVAL;

fse->index is a u32 that comes from the user.  We want negative values
to be counted as -EINVAL but they aren't.  There are several ways to fix
this but I feel like the best fix for future proofing is to change the
type of N_RES from int to unsigned long to make it the same as if we
were comparing against ARRAY_SIZE().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Jonathan writes:

First set of IIO fixes for the 4.13 cycle.

* ad2s1210
  - Fix negative angular velocity reads (identified by a gcc 7 warning)
* aspeed-adc
  - Wait for initialization sequence to finish before enabling channels.
  Without it no channels work.
* axp288
  - Revert a patch that dropped some bogus register mods.  No one is entirely
  sure why but it breaks charging on some devices.
  - Fix GPADC pin read returning 0. Turns out a small sleep is needed.
* bmc150
  - Make sure device is restored to normal state after suspend / resume
  cycle.  Otherwise, simple sysfs reads are broken.
* tsl2563
  - fix wrong event code.
* st-accel
  - add spi 3-wire support. Needed to fix the lsm303agr accelerometer
  which only had 3 wires in all cases.  Side effect is to enable optional
  3-wire support for other devices.
* st-pressure
  - disable multiread by default for LPS22HB (only effects SPI)
* sun4i-gpadc-iio
  - fix unbalanced irq enable / disable
* vf610
  - Fix VALT slection for REFSEL bits - ensures we are using the
  right reference pins.