Merge tag 'char-misc-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver updates from Greg KH:
 "Here is the big set of new char/misc driver drivers and features for
  4.12-rc1.

  There's lots of new drivers added this time around, new firmware
  drivers from Google, more auxdisplay drivers, extcon drivers, fpga
  drivers, and a bunch of other driver updates. Nothing major, except if
  you happen to have the hardware for these drivers, and then you will
  be happy :)

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (136 commits)
  firmware: google memconsole: Fix return value check in platform_memconsole_init()
  firmware: Google VPD: Fix return value check in vpd_platform_init()
  goldfish_pipe: fix build warning about using too much stack.
  goldfish_pipe: An implementation of more parallel pipe
  fpga fr br: update supported version numbers
  fpga: region: release FPGA region reference in error path
  fpga altera-hps2fpga: disable/unprepare clock on error in alt_fpga_bridge_probe()
  mei: drop the TODO from samples
  firmware: Google VPD sysfs driver
  firmware: Google VPD: import lib_vpd source files
  misc: lkdtm: Add volatile to intentional NULL pointer reference
  eeprom: idt_89hpesx: Add OF device ID table
  misc: ds1682: Add OF device ID table
  misc: tsl2550: Add OF device ID table
  w1: Remove unneeded use of assert() and remove w1_log.h
  w1: Use kernel common min() implementation
  uio_mf624: Align memory regions to page size and set correct offsets
  uio_mf624: Refactor memory info initialization
  uio: Allow handling of non page-aligned memory regions
  hangcheck-timer: Fix typo in comment
  ...

1 files changed, 15 insertions, 5 deletions

diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
index f66b45b235b0..fbfa5b4cc567 100644
--- a/drivers/auxdisplay/ht16k33.c
+++ b/drivers/auxdisplay/ht16k33.c
@@ -254,18 +254,22 @@ static bool ht16k33_keypad_scan(struct ht16k33_keypad *keypad)
 {
 	const unsigned short *keycodes = keypad->dev->keycode;
 	u16 new_state[HT16K33_MATRIX_KEYPAD_MAX_COLS];
-	u8 data[HT16K33_MATRIX_KEYPAD_MAX_COLS * 2];
+	__le16 data[HT16K33_MATRIX_KEYPAD_MAX_COLS];
 	unsigned long bits_changed;
 	int row, col, code;
+	int rc;
 	bool pressed = false;
 
-	if (i2c_smbus_read_i2c_block_data(keypad->client, 0x40, 6, data) != 6) {
-		dev_err(&keypad->client->dev, "Failed to read key data\n");
+	rc = i2c_smbus_read_i2c_block_data(keypad->client, 0x40,
+					   sizeof(data), (u8 *)data);
+	if (rc != sizeof(data)) {
+		dev_err(&keypad->client->dev,
+			"Failed to read key data, rc=%d\n", rc);
 		return false;
 	}
 
 	for (col = 0; col < keypad->cols; col++) {
-		new_state[col] = (data[col * 2 + 1] << 8) | data[col * 2];
+		new_state[col] = le16_to_cpu(data[col]);
 		if (new_state[col])
 			pressed = true;
 		bits_changed = keypad->last_key_state[col] ^ new_state[col];
@@ -278,7 +282,7 @@ static bool ht16k33_keypad_scan(struct ht16k33_keypad *keypad)
 		}
 	}
 	input_sync(keypad->dev);
-	memcpy(keypad->last_key_state, new_state, sizeof(new_state));
+	memcpy(keypad->last_key_state, new_state, sizeof(u16) * keypad->cols);
 
 	return pressed;
 }
@@ -353,6 +357,12 @@ static int ht16k33_keypad_probe(struct i2c_client *client,
 	err = matrix_keypad_parse_of_params(&client->dev, &rows, &cols);
 	if (err)
 		return err;
+	if (rows > HT16K33_MATRIX_KEYPAD_MAX_ROWS ||
+	    cols > HT16K33_MATRIX_KEYPAD_MAX_COLS) {
+		dev_err(&client->dev, "%u rows or %u cols out of range in DT\n",
+			rows, cols);
+		return -ERANGE;
+	}
 
 	keypad->rows = rows;
 	keypad->cols = cols;