Merge tag 'char-misc-4.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH:
 "Here are some small char and misc driver fixes for 4.17-rc3

  A variety of small things that have fallen out after 4.17-rc1 was out.
  Some vboxguest fixes for systems with lots of memory, amba bus fixes,
  some MAINTAINERS updates, uio_hv_generic driver fixes, and a few other
  minor things that resolve problems that people reported.

  The amba bus fixes took twice to get right, the first time I messed up
  applying the patches in the wrong order, hence the revert and later
  addition again with the correct fix, sorry about that.

  All of these have been in linux-next with no reported issues"

* tag 'char-misc-4.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  ARM: amba: Fix race condition with driver_override
  ARM: amba: Make driver_override output consistent with other buses
  Revert "ARM: amba: Fix race condition with driver_override"
  ARM: amba: Don't read past the end of sysfs "driver_override" buffer
  ARM: amba: Fix race condition with driver_override
  virt: vbox: Log an error when we fail to get the host version
  virt: vbox: Use __get_free_pages instead of kmalloc for DMA32 memory
  virt: vbox: Add vbg_req_free() helper function
  virt: vbox: Move declarations of vboxguest private functions to private header
  slimbus: Fix out-of-bounds access in slim_slicesize()
  MAINTAINERS: add dri-devel&linaro-mm for Android ION
  fpga-manager: altera-ps-spi: preserve nCONFIG state
  MAINTAINERS: update my email address
  uio_hv_generic: fix subchannel ring mmap
  uio_hv_generic: use correct channel in isr
  uio_hv_generic: make ring buffer attribute for primary channel
  uio_hv_generic: set size of ring buffer attribute
  ANDROID: binder: prevent transactions into own process.

11 files changed, 124 insertions, 121 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 1901ef510b43..3e41e12a88a4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -905,6 +905,8 @@ ANDROID ION DRIVER
 M:      Laura Abbott <labbott@redhat.com>
 M:      Sumit Semwal <sumit.semwal@linaro.org>
 L:      devel@driverdev.osuosl.org
+L:      dri-devel@lists.freedesktop.org
+L:      linaro-mm-sig@lists.linaro.org (moderated for non-subscribers)
 S:      Supported
 F:      drivers/staging/android/ion
 F:      drivers/staging/android/uapi/ion.h
@@ -13953,7 +13955,7 @@ THUNDERBOLT DRIVER
 M:      Andreas Noever <andreas.noever@gmail.com>
 M:      Michael Jamet <michael.jamet@intel.com>
 M:      Mika Westerberg <mika.westerberg@linux.intel.com>
-M:      Yehezkel Bernat <yehezkel.bernat@intel.com>
+M:      Yehezkel Bernat <YehezkelShB@gmail.com>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt.git
 S:      Maintained
 F:      Documentation/admin-guide/thunderbolt.rst
@@ -13963,7 +13965,7 @@ F:	include/linux/thunderbolt.h
 THUNDERBOLT NETWORK DRIVER
 M:      Michael Jamet <michael.jamet@intel.com>
 M:      Mika Westerberg <mika.westerberg@linux.intel.com>
-M:      Yehezkel Bernat <yehezkel.bernat@intel.com>
+M:      Yehezkel Bernat <YehezkelShB@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/thunderbolt.c
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 594c228d2f02..4a3ac31c07d0 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -69,11 +69,12 @@ static ssize_t driver_override_show(struct device *_dev,
                                     struct device_attribute *attr, char *buf)
 {
         struct amba_device *dev = to_amba_device(_dev);
+        ssize_t len;
 
-        if (!dev->driver_override)
-                return 0;
-
-        return sprintf(buf, "%s\n", dev->driver_override);
+        device_lock(_dev);
+        len = sprintf(buf, "%s\n", dev->driver_override);
+        device_unlock(_dev);
+        return len;
 }
 
 static ssize_t driver_override_store(struct device *_dev,
@@ -81,9 +82,10 @@ static ssize_t driver_override_store(struct device *_dev,
                                      const char *buf, size_t count)
 {
         struct amba_device *dev = to_amba_device(_dev);
-        char *driver_override, *old = dev->driver_override, *cp;
+        char *driver_override, *old, *cp;
 
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                 return -EINVAL;
 
         driver_override = kstrndup(buf, count, GFP_KERNEL);
@@ -94,12 +96,15 @@ static ssize_t driver_override_store(struct device *_dev,
         if (cp)
                 *cp = '\0';
 
+        device_lock(_dev);
+        old = dev->driver_override;
         if (strlen(driver_override)) {
                 dev->driver_override = driver_override;
         } else {
                kfree(driver_override);
                dev->driver_override = NULL;
         }
+        device_unlock(_dev);
 
         kfree(old);
 
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 764b63a5aade..e578eee31589 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2839,6 +2839,14 @@ static void binder_transaction(struct binder_proc *proc,
                         else
                                 return_error = BR_DEAD_REPLY;
                         mutex_unlock(&context->context_mgr_node_lock);
+                        if (target_node && target_proc == proc) {
+                                binder_user_error("%d:%d got transaction to context manager from process owning it\n",
+                                                  proc->pid, thread->pid);
+                                return_error = BR_FAILED_REPLY;
+                                return_error_param = -EINVAL;
+                                return_error_line = __LINE__;
+                                goto err_invalid_target_handle;
+                        }
                 }
                 if (!target_node) {
                         /*
diff --git a/drivers/fpga/altera-ps-spi.c b/drivers/fpga/altera-ps-spi.c
index 14f14efdf0d5..06d212a3d49d 100644
--- a/drivers/fpga/altera-ps-spi.c
+++ b/drivers/fpga/altera-ps-spi.c
@@ -249,7 +249,7 @@ static int altera_ps_probe(struct spi_device *spi)
 
         conf->data = of_id->data;
         conf->spi = spi;
-        conf->config = devm_gpiod_get(&spi->dev, "nconfig", GPIOD_OUT_HIGH);
+        conf->config = devm_gpiod_get(&spi->dev, "nconfig", GPIOD_OUT_LOW);
         if (IS_ERR(conf->config)) {
                 dev_err(&spi->dev, "Failed to get config gpio: %ld\n",
                         PTR_ERR(conf->config));
diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
index 884419c37e84..457ea1f8db30 100644
--- a/drivers/slimbus/messaging.c
+++ b/drivers/slimbus/messaging.c
@@ -183,7 +183,7 @@ static u16 slim_slicesize(int code)
                 0, 1, 2, 3, 3, 4, 4, 5, 5, 5, 5, 6, 6, 6, 6, 7
         };
 
-        clamp(code, 1, (int)ARRAY_SIZE(sizetocode));
+        code = clamp(code, 1, (int)ARRAY_SIZE(sizetocode));
 
         return sizetocode[code - 1];
 }
diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c
index f695a7e8c314..c690d100adcd 100644
--- a/drivers/uio/uio_hv_generic.c
+++ b/drivers/uio/uio_hv_generic.c
@@ -19,7 +19,7 @@
  * # echo -n "ed963694-e847-4b2a-85af-bc9cfc11d6f3" \
  *    > /sys/bus/vmbus/drivers/uio_hv_generic/bind
  */
-
+#define DEBUG 1
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/device.h>
@@ -94,10 +94,11 @@ hv_uio_irqcontrol(struct uio_info *info, s32 irq_state)
  */
 static void hv_uio_channel_cb(void *context)
 {
-        struct hv_uio_private_data *pdata = context;
-        struct hv_device *dev = pdata->device;
+        struct vmbus_channel *chan = context;
+        struct hv_device *hv_dev = chan->device_obj;
+        struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev);
 
-        dev->channel->inbound.ring_buffer->interrupt_mask = 1;
+        chan->inbound.ring_buffer->interrupt_mask = 1;
         virt_mb();
 
         uio_event_notify(&pdata->info);
@@ -121,78 +122,46 @@ static void hv_uio_rescind(struct vmbus_channel *channel)
         uio_event_notify(&pdata->info);
 }
 
-/*
- * Handle fault when looking for sub channel ring buffer
- * Subchannel ring buffer is same as resource 0 which is main ring buffer
- * This is derived from uio_vma_fault
+/* Sysfs API to allow mmap of the ring buffers
+ * The ring buffer is allocated as contiguous memory by vmbus_open
  */
-static int hv_uio_vma_fault(struct vm_fault *vmf)