MAX_IDR_MASK is another weirdness in the idr interface.  As idr covers
whole positive integer range, it's defined as 0x7fffffff or INT_MAX.

Its usage in idr_find(), idr_replace() and idr_remove() is bizarre.
They basically mask off the sign bit and operate on the rest, so if
the caller, by accident, passes in a negative number, the sign bit
will be masked off and the remaining part will be used as if that was
the input, which is worse than crashing.

The constant is visible in idr.h and there are several users in the
kernel.

* drivers/i2c/i2c-core.c:i2c_add_numbered_adapter()

  Basically used to test if adap->nr is a negative number which isn't
  -1 and returns -EINVAL if so.  idr_alloc() already has negative
  @start checking (w/ WARN_ON_ONCE), so this can go away.

* drivers/infiniband/core/cm.c:cm_alloc_id()
  drivers/infiniband/hw/mlx4/cm.c:id_map_alloc()

  Used to wrap cyclic @start.  Can be replaced with max(next, 0).
  Note that this type of cyclic allocation using idr is buggy.  These
  are prone to spurious -ENOSPC failure after the first wraparound.

* fs/super.c:get_anon_bdev()

  The ID allocated from ida is masked off before being tested whether
  it's inside valid range.  ida allocated ID can never be a negative
  number and the masking is unnecessary.

Update idr_*() functions to fail with -EINVAL when negative @id is
specified and update other MAX_IDR_MASK users as described above.

This leaves MAX_IDR_MASK without any user, remove it and relocate
other MAX_IDR_* constants to lib/idr.c.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Jean Delvare <khali@linux-fr.org>
Cc: Roland Dreier <roland@kernel.org>
Cc: Sean Hefty <sean.hefty@intel.com>
Cc: Hal Rosenstock <hal.rosenstock@gmail.com>
Cc: "Marciniszyn, Mike" <mike.marciniszyn@intel.com>
Cc: Jack Morgenstein <jackm@dev.mellanox.co.il>
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Wolfram Sang <wolfram@the-dreams.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Convert to the much saner new idr interface.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Jean Delvare <khali@linux-fr.org>
Cc: Wolfram Sang <wolfram@the-dreams.de>
Tested-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull vfs pile (part one) from Al Viro:
 "Assorted stuff - cleaning namei.c up a bit, fixing ->d_name/->d_parent
  locking violations, etc.

  The most visible changes here are death of FS_REVAL_DOT (replaced with
  "has ->d_weak_revalidate()") and a new helper getting from struct file
  to inode.  Some bits of preparation to xattr method interface changes.

  Misc patches by various people sent this cycle *and* ocfs2 fixes from
  several cycles ago that should've been upstream right then.

  PS: the next vfs pile will be xattr stuff."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (46 commits)
  saner proc_get_inode() calling conventions
  proc: avoid extra pde_put() in proc_fill_super()
  fs: change return values from -EACCES to -EPERM
  fs/exec.c: make bprm_mm_init() static
  ocfs2/dlm: use GFP_ATOMIC inside a spin_lock
  ocfs2: fix possible use-after-free with AIO
  ocfs2: Fix oops in ocfs2_fast_symlink_readpage() code path
  get_empty_filp()/alloc_file() leave both ->f_pos and ->f_version zero
  target: writev() on single-element vector is pointless
  export kernel_write(), convert open-coded instances
  fs: encode_fh: return FILEID_INVALID if invalid fid_type
  kill f_vfsmnt
  vfs: kill FS_REVAL_DOT by adding a d_weak_revalidate dentry op
  nfsd: handle vfs_getattr errors in acl protocol
  switch vfs_getattr() to struct path
  default SET_PERSONALITY() in linux/elf.h
  ceph: prepopulate inodes only when request is aborted
  d_hash_and_lookup(): export, switch open-coded instances
  9p: switch v9fs_set_create_acl() to inode+fid, do it before d_instantiate()
  9p: split dropping the acls from v9fs_set_create_acl()
  ...

Pull i2c updates from Wolfram Sang:
 "Highlights:

   - new drivers for Intel ismt & Broadcom bcm2835
   - a number of drivers got support for more variants and mostly got
     cleaned up on the way (sis630, i801, at91, tegra, designware)
   - i2c got rid of all *_set_drvdata(..., NULL) on remove/probe failure
   - removed the i2c_smbus_process_call from the core since there are no
     users
   - mxs can now switch between PIO and DMA depending on the message
     size and the bus speed can now be arbitrary

  In addition, there is the usual bunch of fixes, cleanups, devm_*
  conversions, etc"

Fixed conflict (and buggy devm_* conversion) in i2c-s3c2410.c

* 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (39 commits)
  i2c: Remove unneeded xxx_set_drvdata(..., NULL) calls
  i2c: pxa: remove incorrect __exit annotations
  i2c: ocores: Fix pointer to integer cast warning
  i2c: tegra: remove warning dump if timeout happen in transfer
  i2c: fix i2c-ismt.c printk format warning
  i2c: i801: Add Device IDs for Intel Wellsburg PCH
  i2c: add bcm2835 driver
  i2c: ismt: Add Seth and Myself as maintainers
  i2c: sis630: checkpatch cleanup
  i2c: sis630: display unsigned hex
  i2c: sis630: use hex to constants for SMBus commands
  i2c: sis630: fix behavior after collision
  i2c: sis630: clear sticky bits
  i2c: sis630: Add SIS964 support
  i2c: isch: Add module parameter for backbone clock rate if divider is unset
  i2c: at91: fix unsed variable warning when building with !CONFIG_OF
  i2c: Adding support for Intel iSMT SMBus 2.0 host controller
  i2c: sh_mobile: don't send a stop condition by default inside transfers
  i2c: sh_mobile: eliminate an open-coded "goto" loop
  i2c: sh_mobile: fix timeout error handling
  ...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Pull ARM SoC-specific updates from Arnd Bergmann:
 "This is a larger set of new functionality for the existing SoC
  families, including:

   - vt8500 gains support for new CPU cores, notably the Cortex-A9 based
     wm8850

   - prima2 gains support for the "marco" SoC family, its SMP based
     cousin

   - tegra gains support for the new Tegra4 (Tegra114) family

   - socfpga now supports a newer version of the hardware including SMP

   - i.mx31 and bcm2835 are now using DT probing for their clocks

   - lots of updates for sh-mobile

   - OMAP updates for clocks, power management and USB

   - i.mx6q and tegra now support cpuidle

   - kirkwood now supports PCIe hot plugging

   - tegra clock support is updated

   - tegra USB PHY probing gets implemented diffently"

* tag 'soc' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (148 commits)
  ARM: prima2: remove duplicate v7_invalidate_l1
  ARM: shmobile: r8a7779: Correct TMU clock support again
  ARM: prima2: fix __init section for cpu hotplug
  ARM: OMAP: Consolidate OMAP USB-HS platform data (part 3/3)
  ARM: OMAP: Consolidate OMAP USB-HS platform data (part 1/3)
  arm: socfpga: Add SMP support for actual socfpga harware
  arm: Add v7_invalidate_l1 to cache-v7.S
  arm: socfpga: Add entries to enable make dtbs socfpga
  arm: socfpga: Add new device tree source for actual socfpga HW
  ARM: tegra: sort Kconfig selects for Tegra114
  ARM: tegra: enable ARCH_REQUIRE_GPIOLIB for Tegra114
  ARM: tegra: Fix build error w/ ARCH_TEGRA_114_SOC w/o ARCH_TEGRA_3x_SOC
  ARM: tegra: Fix build error for gic update
  ARM: tegra: remove empty tegra_smp_init_cpus()
  ARM: shmobile: Register ARM architected timer
  ARM: MARCO: fix the build issue due to gic-vic-to-irqchip move
  ARM: shmobile: r8a7779: Correct TMU clock support
  ARM: mxs_defconfig: Select CONFIG_DEVTMPFS_MOUNT
  ARM: mxs: decrease mxs_clockevent_device.min_delta_ns to 2 clock cycles
  ARM: mxs: use apbx bus clock to drive the timers on timrotv2
  ...

There is simply no reason to be manually setting the private driver
data to NULL in the remove/fail to probe cases.  This is just extra
cruft code that can be removed.

A few notes:
* Nothing relies on drvdata being set to NULL.
* The __device_release_driver() function eventually calls
  dev_set_drvdata(dev, NULL) anyway, so there's no need to do it
  twice.
* I verified that there were no cases where xxx_get_drvdata() was
  being called in these drivers and checking for / relying on the NULL
  return value.

This could be cleaned up kernel-wide but for now just take the baby
step and remove from the i2c subsystem.

Reported-by: Wolfram Sang <wsa@the-dreams.de>
Reported-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Doug Anderson <dianders@chromium.org>
Reviewed-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Peter Korsgaard <jacmet@sunsite.dk>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Marek Vasut <marex@denx.de>
Signed-off-by: Wolfram Sang <wolfram@the-dreams.de>

The remove() methods should not be marked __exit unless we are using
platform_driver_probe() which disables unbinding device from driver
via sysfs.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Wolfram Sang <wolfram@the-dreams.de>

Pull tty/serial patches from Greg Kroah-Hartman:
 "Here's the big tty/serial driver patches for 3.9-rc1.

  More tty port rework and fixes from Jiri here, as well as lots of
  individual serial driver updates and fixes.

  All of these have been in the linux-next tree for a while."

* tag 'tty-3.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (140 commits)
  tty: mxser: improve error handling in mxser_probe() and mxser_module_init()
  serial: imx: fix uninitialized variable warning
  serial: tegra: assume CONFIG_OF
  TTY: do not update atime/mtime on read/write
  lguest: select CONFIG_TTY to build properly.
  ARM defconfigs: add missing inclusions of linux/platform_device.h
  fb/exynos: include platform_device.h
  ARM: sa1100/assabet: include platform_device.h directly
  serial: imx: Fix recursive locking bug
  pps: Fix build breakage from decoupling pps from tty
  tty: Remove ancient hardpps()
  pps: Additional cleanups in uart_handle_dcd_change
  pps: Move timestamp read into PPS code proper
  pps: Don't crash the machine when exiting will do
  pps: Fix a use-after free bug when unregistering a source.
  pps: Use pps_lookup_dev to reduce ldisc coupling
  pps: Add pps_lookup_dev() function
  tty: serial: uartlite: Support uartlite on big and little endian systems
  tty: serial: uartlite: Fix sparse and checkpatch warnings
  serial/arc-uart: Miscll DT related updates (Grant's review comments)
  ...

Fix up trivial conflicts, mostly just due to the TTY config option
clashing with the EXPERIMENTAL removal.

Pull driver core patches from Greg Kroah-Hartman:
 "Here is the big driver core merge for 3.9-rc1

  There are two major series here, both of which touch lots of drivers
  all over the kernel, and will cause you some merge conflicts:

   - add a new function called devm_ioremap_resource() to properly be
     able to check return values.

   - remove CONFIG_EXPERIMENTAL

  Other than those patches, there's not much here, some minor fixes and
  updates"

Fix up trivial conflicts

* tag 'driver-core-3.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (221 commits)
  base: memory: fix soft/hard_offline_page permissions
  drivercore: Fix ordering between deferred_probe and exiting initcalls
  backlight: fix class_find_device() arguments
  TTY: mark tty_get_device call with the proper const values
  driver-core: constify data for class_find_device()
  firmware: Ignore abort check when no user-helper is used
  firmware: Reduce ifdef CONFIG_FW_LOADER_USER_HELPER
  firmware: Make user-mode helper optional
  firmware: Refactoring for splitting user-mode helper code
  Driver core: treat unregistered bus_types as having no devices
  watchdog: Convert to devm_ioremap_resource()
  thermal: Convert to devm_ioremap_resource()
  spi: Convert to devm_ioremap_resource()
  power: Convert to devm_ioremap_resource()
  mtd: Convert to devm_ioremap_resource()
  mmc: Convert to devm_ioremap_resource()
  mfd: Convert to devm_ioremap_resource()
  media: Convert to devm_ioremap_resource()
  iommu: Convert to devm_ioremap_resource()
  drm: Convert to devm_ioremap_resource()
  ...