Merge tag 'char-misc-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh...

Pull char/misc driver fixes from Greg KH:
 "Here are some small char/misc and other driver fixes for 6.0-rc4.

  Included in here are:

   - binder fixes for previous fixes, and a few more fixes uncovered by
     them.

   - iio driver fixes

   - soundwire driver fixes

   - fastrpc driver fixes for memory corruption on some hardware

   - peci driver fix

   - mhi driver fix

  All of these have been in linux-next with no reported problems"

* tag 'char-misc-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  binder: fix alloc->vma_vm_mm null-ptr dereference
  misc: fastrpc: increase maximum session count
  misc: fastrpc: fix memory corruption on open
  misc: fastrpc: fix memory corruption on probe
  soundwire: qcom: fix device status array range
  bus: mhi: host: Fix up null pointer access in mhi_irq_handler
  soundwire: qcom: remove duplicate reset control get
  iio: light: cm32181: make cm32181_pm_ops static
  iio: ad7292: Prevent regulator double disable
  dt-bindings: iio: gyroscope: bosch,bmg160: correct number of pins
  iio: adc: mcp3911: use correct formula for AD conversion
  iio: adc: mcp3911: correct "microchip,device-addr" property
  Revert "binder_alloc: Add missing mmap_lock calls when using the VMA"
  binder_alloc: Add missing mmap_lock calls when using the VMA
  binder: fix UAF of ref->proc caused by race condition
  iio: light: cm3605: Fix an error handling path in cm3605_probe()
  iio: adc: mcp3911: make use of the sign bit
  peci: cpu: Fix use-after-free in adev_release()
  peci: aspeed: fix error check return value of platform_get_irq()

diff --combined drivers/android/binder_alloc.c
index 51f4e1c5cd0199bbd34d886dd3e08c4f6664507e,a61df6e1103a14ec613a84acc58dcc34d5cf6c60..9b1778c006103f28695e918f32819b7e884e38ef
--- 1/drivers/android/binder_alloc.c
--- 2/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@@ -322,7 -322,6 +322,6 @@@ static inline void binder_alloc_set_vma
         */
        if (vma) {
                vm_start = vma->vm_start;
-               alloc->vma_vm_mm = vma->vm_mm;
                mmap_assert_write_locked(alloc->vma_vm_mm);
        } else {
                mmap_assert_locked(alloc->vma_vm_mm);
@@@ -402,15 -401,12 +401,15 @@@ static struct binder_buffer *binder_all
        size_t size, data_offsets_size;
        int ret;
  
 +      mmap_read_lock(alloc->vma_vm_mm);
        if (!binder_alloc_get_vma(alloc)) {
 +              mmap_read_unlock(alloc->vma_vm_mm);
                binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
                                   "%d: binder_alloc_buf, no vma\n",
                                   alloc->pid);
                return ERR_PTR(-ESRCH);
        }
 +      mmap_read_unlock(alloc->vma_vm_mm);
  
        data_offsets_size = ALIGN(data_size, sizeof(void *)) +
                ALIGN(offsets_size, sizeof(void *));
@@@ -795,7 -791,6 +794,6 @@@ int binder_alloc_mmap_handler(struct bi
        binder_insert_free_buffer(alloc, buffer);
        alloc->free_async_space = alloc->buffer_size / 2;
        binder_alloc_set_vma(alloc, vma);
-       mmgrab(alloc->vma_vm_mm);
  
        return 0;
  
@@@ -932,25 -927,17 +930,25 @@@ void binder_alloc_print_pages(struct se
         * Make sure the binder_alloc is fully initialized, otherwise we might
         * read inconsistent state.
         */
 -      if (binder_alloc_get_vma(alloc) != NULL) {
 -              for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
 -                      page = &alloc->pages[i];
 -                      if (!page->page_ptr)
 -                              free++;
 -                      else if (list_empty(&page->lru))
 -                              active++;
 -                      else
 -                              lru++;
 -              }
 +
 +      mmap_read_lock(alloc->vma_vm_mm);
 +      if (binder_alloc_get_vma(alloc) == NULL) {
 +              mmap_read_unlock(alloc->vma_vm_mm);
 +              goto uninitialized;
        }
 +
 +      mmap_read_unlock(alloc->vma_vm_mm);
 +      for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
 +              page = &alloc->pages[i];
 +              if (!page->page_ptr)
 +                      free++;
 +              else if (list_empty(&page->lru))
 +                      active++;
 +              else
 +                      lru++;
 +      }
 +
 +uninitialized:
        mutex_unlock(&alloc->mutex);
        seq_printf(m, "  pages: %d:%d:%d\n", active, lru, free);
        seq_printf(m, "  pages high watermark: %zu\n", alloc->pages_high);
@@@ -1091,6 -1078,8 +1089,8 @@@ static struct shrinker binder_shrinker 
  void binder_alloc_init(struct binder_alloc *alloc)
  {
        alloc->pid = current->group_leader->pid;
+       alloc->vma_vm_mm = current->mm;
+       mmgrab(alloc->vma_vm_mm);
        mutex_init(&alloc->mutex);
        INIT_LIST_HEAD(&alloc->buffers);
  }