binder_poll() passes the thread->wait waitqueue that
can be slept on for work. When a thread that uses
epoll explicitly exits using BINDER_THREAD_EXIT,
the waitqueue is freed, but it is never removed
from the corresponding epoll data structure. When
the process subsequently exits, the epoll cleanup
code tries to access the waitlist, which results in
a use-after-free.

Prevent this by using POLLFREE when the thread exits.
Signed-off-by: Martijn Coenen <maco@android.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: stable <stable@vger.kernel.org> # 4.14
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

->dev_state can't be both MEI_DEV_RESETTING and MEI_DEV_POWER_DOWN at
the same time.  && was clearing intended here.

Fixes: 8d52af67 ("mei: speed up the power down flow")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Coding style fixup
Signed-off-by: Elad Wexler <elad.wexler@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The Elapsed Time Counter (ETC) registers are not buffered for reading.
If a 250ms tick occurs while data is being read out, the result can be
a combination of old and new values. This can occur at the byte level
(giving a time in the future) or the individual bit level (giving a
time in the past). We catch both these cases by reading until we get
two equal or consecutive values. After five unsuccessful attempts we
give up.
Signed-off-by: Thomas VanSelus <tvanselus@xes-inc.com>
Signed-off-by: Aaron Sierra <asierra@xes-inc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch leverages the fact that all DS1682 registers are unsigned to
merge two return paths into one. It also introduces val_le as used in
ds1682_store() to merge two endianness conversions into one.
Signed-off-by: Aaron Sierra <asierra@xes-inc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Resolved missing a blank line after declarations checkpatch
warnings. Issue found by checkpatch.
Signed-off-by: Tejas Upadhyay <tejas.upadhyay@softnautics.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

SoundWire bus needs to select the regmap support. So, add it
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

pm_runtime_get_sync will return negative values for error
and 0 or 1 for success. Update the error check accordingly.
Signed-off-by: Shreyas NC <shreyas.nc@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 9d715fa0: ("soundwire: Add IO transfer")
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pierre was MIPI chair for SoundWire spec and we could use his help in
code reviews, so add him as a reviewer.
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Below build failure was reported on UML,
ERROR: "devm_ioremap_resource" [drivers/slimbus/slim-qcom-ctrl.ko] undefined!
ERROR: "__ioread32_copy" [drivers/slimbus/slim-qcom-ctrl.ko] undefined!
ERROR: "__iowrite32_copy" [drivers/slimbus/slim-qcom-ctrl.ko] undefined!
ERROR: "devm_ioremap" [drivers/slimbus/slim-qcom-ctrl.ko] undefined!

This patch fixes it by making qcom slimbus depend on HAS_IOMEM, as
these are only defined when HAS_IOMEM is selected.
Reported-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

In case of error, the function devm_ioremap_resource() returns ERR_PTR()
and never returns NULL. The NULL test in the return value check should
be replaced with IS_ERR().
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Add the missing unlock before return from function slim_msg_response()
in the error handling case.
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

A spin lock is taken here so we should use GFP_ATOMIC.
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The functions slim_ack_txn and slim_alloc_txbuf are local to the
source and do not need to be in global scope, so make them static.

Cleans up sparse warnings:
symbol 'slim_ack_txn' was not declared. Should it be static?
symbol 'slim_alloc_txbuf' was not declared. Should it be static?
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently the check for too many retries fails because retries is actually
-1 when the retry loop terminates if no pbuf can be allocated because of
the post decrement on retries.  Fix this by not comparing retries with zero
but instead check if it is negative.

Detected by CoverityScan, CID#1463143 ("Logically dead code") and
CID#1463144 ("Dereference after null check")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The pointer msg is checked to see if it is null at the start of
the function and jumps to the error exit label reterr that then
dereferences msg when it prints a dev_err error message. Avoid
this potential null pointer dereference by only printing the
error message if msg is not null.

Detected by CoverityScan, CID#1463141 ("Dereference after null check")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove all free-text license texts.

This is done on a quest to remove the 700+ different ways that files in
the kernel describe the GPL license text.

No copyright headers or other non-license-description text was removed.
Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com>
Acked-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix the typo, 'status' should be instead of 'status2'.

Fixes: b0a9c37b ("soundwire: Add slave status handling")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently the return status ret is being checked but it has not been
updated since the previous check on ret. It appears that assignment of
ret from return status of the call to sdw_cdns_enable_interrupt was
accidentally ommited.  Fix this.

Detected by CoverityScan, CID#1463148 ("Logically dead code")

Fixes: 71bb8a1b ("soundwire: intel: Add Intel Master driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The buf[2] left shift by 24 bits is promoted to int (32 bit signed)
and then signed-extended to unsigned long long. Hence if the upper
bit to buf[2] is set then all the upper bits of addr end up as 1.
Fix this by casting it to u64 before shifting it. Also replace the
unsigned long long casts to u64 casts to match the same type of
addr.

Detected by CoverityScan, CID#1463147 ("Unintended sign extension")

Fixes: d52d7a1b ("soundwire: Add Slave status handling helpers")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge tag 'extcon-next-for-4.16' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon into char-misc-next

Chanwoo writes:

Update extcon for 4.16

Detailed description for this pull request:
1. Add support to notify USB connector for "ChromeOS Embedded Controller".
- extcon-usbc-cros-ec driver detects the EXTCON_USB and EXTCON_USB_HOST
  connector type and then notify the state/properties to the consumer device.

2. Update the detection on probe time and clean-up code for "X-Power AXP288".
- Detect the state of connector after a couple of seconds after probe()
  becasue extcon-axp288.c driver depends on other device driver like mux.
  In order to guarantee the correct state, the extcon-axp288.c uses the
  delayed_work.
- Set EXTCON_CHG_USB_SDP type as the safe default type if unknown connector
  is attached because the data sheet of axp288 doesn't handle
  the all exception cases.
- Remove unused code

3. Fix the minor issue of extcon driver
- Fix platform get_irq's error checking for extcon-adc-jack.
- Delete unneeded initialization for extcon-max8997/max77693.

According to the data sheets all the values not handled in the
switch-case are "reserved". Update the dev_warn message to reflect
this and set the cable-type to EXTCON_CHG_USB_SDP (so max 500mA
current draw) as safe default.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

The axp288 extcon code depends on other drivers to do things like mux the
data lines, enable/disable vbus based on the id-pin, etc.

Sometimes the BIOS has not set these things up correctly resulting in the
initial charger cable type detection giving a wrong result and we end up
not charging or charging at only 0.5A.

This commit starts a second charger-detection cycle a couple of seconds
after the first one finishes, giving the other drivers time to load and
do their thing.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

This is not used / set anywhere in the tree.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
Acked-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

Remove the unused extcon_nb struct member.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

platform_get_irq() can fail here and we must check its return value.
Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>

i7300_idle.h is not being called by any source file and contains calls to
pci_get_bus_and_slot() that we are trying to deprecate. Remove unused file.
Signed-off-by: Sinan Kaya <okaya@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The current expression using the || operator is always true because
dev->dev_state cannot be equal to two different values at the same time.
Fix this by replacing the || with &&.

Detected by CoverityScan, CID#1463042 ("Constant expression result")

Fixes: 8d52af67 ("mei: speed up the power down flow")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

>From the pci power documentation:
"The driver itself should not call pm_runtime_allow(), though. Instead,
it should let user space or some platform-specific code do that (user space
can do it via sysfs as stated above)..."

However, the S0ix residency cannot be reached without MEI device getting
into low power state. Hence, for mei devices that support D0i3, it's better
to make runtime power management mandatory and not rely on the system
integration such as udev rules.
This policy cannot be applied globally as some older platforms
were found to have broken power management.

Cc: <stable@vger.kernel.org> v4.13+
Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Reviewed-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The previous patch addressed a warning but not the cause:

drivers/slimbus/qcom-ctrl.c: In function 'qcom_slim_probe':
drivers/slimbus/qcom-ctrl.c:584:9: error: passing argument 3 of 'dmam_alloc_coherent' from incompatible pointer type [-Werror=incompatible-pointer-types]

There are two things wrong here:

- The naming is very confusing, we now have a member named 'phys'
  that doesn't refer to a phys_addr_t but a dma_addr_t. If we needed
  a dma address, it should be named 'dma' to avoid confusion, and
  to make it less likely that someone passes it into a function that
  expects a physical address.

- The dma address is not used at all at this point. It may have been
  designed to support DMA in the future, but today it doesn't, so
  the only effect right now is to make transfers artificially slower
  by using uncached memory instead of cached memory for a temporary
  buffer.

This removes the unused structure member and instead changes the code
to call devm_kcalloc(), which matches the usage of the 'base' pointer
as an array of temporary buffers.

Fixes: db809859 ("slimbus: qcom: fix incompatible pointer warning")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

We want the fixes in here as well.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull x86 fixes from Thomas Gleixner:
 "A couple of fixlets for x86:

   - Fix the ESPFIX double fault handling for 5-level pagetables

   - Fix the commandline parsing for 'apic=' on 32bit systems and update
     documentation

   - Make zombie stack traces reliable

   - Fix kexec with stack canary

   - Fix the delivery mode for APICs which was missed when the x86
     vector management was converted to single target delivery. Caused a
     regression due to the broken hardware which ignores affinity
     settings in lowest prio delivery mode.

   - Unbreak modules when AMD memory encryption is enabled

   - Remove an unused parameter of prepare_switch_to"

* 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/apic: Switch all APICs to Fixed delivery mode
  x86/apic: Update the 'apic=' description of setting APIC driver
  x86/apic: Avoid wrong warning when parsing 'apic=' in X86-32 case
  x86-32: Fix kexec with stack canary (CONFIG_CC_STACKPROTECTOR)
  x86: Remove unused parameter of prepare_switch_to
  x86/stacktrace: Make zombie stack traces reliable
  x86/mm: Unbreak modules that use the DMA API
  x86/build: Make isoimage work on Debian
  x86/espfix/64: Fix espfix double-fault handling on 5-level systems

Pull x86 page table isolation fixes from Thomas Gleixner:
 "Four patches addressing the PTI fallout as discussed and debugged
  yesterday:

   - Remove stale and pointless TLB flush invocations from the hotplug
     code

   - Remove stale preempt_disable/enable from __native_flush_tlb()

   - Plug the memory leak in the write_ldt() error path"

* 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/ldt: Make LDT pgtable free conditional
  x86/ldt: Plug memory leak in error path
  x86/mm: Remove preempt_disable/enable() from __native_flush_tlb()
  x86/smpboot: Remove stale TLB flush invocations

Pull timer fixes from Thomas Gleixner:
 "A pile of fixes for long standing issues with the timer wheel and the
  NOHZ code:

   - Prevent timer base confusion accross the nohz switch, which can
     cause unlocked access and data corruption

   - Reinitialize the stale base clock on cpu hotplug to prevent subtle
     side effects including rollovers on 32bit

   - Prevent an interrupt storm when the timer softirq is already
     pending caused by tick_nohz_stop_sched_tick()

   - Move the timer start tracepoint to a place where it actually makes
     sense

   - Add documentation to timerqueue functions as they caused confusion
     several times now"

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  timerqueue: Document return values of timerqueue_add/del()
  timers: Invoke timer_start_debug() where it makes sense
  nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick()
  timers: Reinitialize per cpu bases on hotplug
  timers: Use deferrable base independent of base::nohz_active

Pull smp fixlet from Thomas Gleixner:
 "A trivial build warning fix for newer compilers"

* 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  cpu/hotplug: Move inline keyword at the beginning of declaration

Pull scheduler fixes from Thomas Gleixner:
 "Three patches addressing the fallout of the CPU_ISOLATION changes
  especially with NO_HZ_FULL plus documentation of boot parameter
  dependency"

* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/isolation: Document boot parameters dependency on CONFIG_CPU_ISOLATION=y
  sched/isolation: Enable CONFIG_CPU_ISOLATION=y by default
  sched/isolation: Make CONFIG_NO_HZ_FULL select CONFIG_CPU_ISOLATION

Pull perf fixes from Thomas Gleixner:

 - plug a memory leak in the intel pmu init code

 - clang fixes

 - tooling fix to avoid including kernel headers

 - a fix for jvmti to generate correct debug information for inlined
   code

 - replace backtick with a regular shell function

 - fix the build in hardened environments

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86/intel: Plug memory leak in intel_pmu_init()
  x86/asm: Allow again using asm.h when building for the 'bpf' clang target
  tools arch s390: Do not include header files from the kernel sources
  perf jvmti: Generate correct debug information for inlined code
  perf tools: Fix up build in hardened environments
  perf tools: Use shell function for perl cflags retrieval

Pull irq fixes from Thomas Gleixner:
 "A rather large update after the kaisered maintainer finally found time
  to handle regression reports.

   - The larger part addresses a regression caused by the x86 vector
     management rework.

     The reservation based model does not work reliably for MSI
     interrupts, if they cannot be masked (yes, yet another hw
     engineering trainwreck). The reason is that the reservation mode
     assigns a dummy vector when the interrupt is allocated and switches
     to a real vector when the interrupt is requested.

     If the MSI entry cannot be masked then the initialization might
     raise an interrupt before the interrupt is requested, which ends up
     as spurious interrupt and causes device malfunction and worse. The
     fix is to exclude MSI interrupts which do not support masking from
     reservation mode and assign a real vector right away.

   - Extend the extra lockdep class setup for nested interrupts with a
     class for the recently added irq_desc::request_mutex so lockdep can
     differeniate and does not emit false positive warnings.

   - A ratelimit guard for the bad irq printout so in case a bad irq
     comes back immediately the system does not drown in dmesg spam"

* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  genirq/msi, x86/vector: Prevent reservation mode for non maskable MSI
  genirq/irqdomain: Rename early argument of irq_domain_activate_irq()
  x86/vector: Use IRQD_CAN_RESERVE flag
  genirq: Introduce IRQD_CAN_RESERVE flag
  genirq/msi: Handle reactivation only on success
  gpio: brcmstb: Make really use of the new lockdep class
  genirq: Guard handle_bad_irq log messages
  kernel/irq: Extend lockdep class for request mutex