fix apparmor dereferencing potentially freed dentry, sanitize __d_path() API

commit 02125a826459a6ad142f8d91c5b6357562f96615 upstream.

__d_path() API is asking for trouble and in case of apparmor d_namespace_path()
getting just that.  The root cause is that when __d_path() misses the root
it had been told to look for, it stores the location of the most remote ancestor
in *root.  Without grabbing references.  Sure, at the moment of call it had
been pinned down by what we have in *path.  And if we raced with umount -l, we
could have very well stopped at vfsmount/dentry that got freed as soon as
prepend_path() dropped vfsmount_lock.

It is safe to compare these pointers with pre-existing (and known to be still
alive) vfsmount and dentry, as long as all we are asking is "is it the same
address?".  Dereferencing is not safe and apparmor ended up stepping into
that.  d_namespace_path() really wants to examine the place where we stopped,
even if it's not connected to our namespace.  As the result, it looked
at ->d_sb->s_magic of a dentry that might've been already freed by that point.
All other callers had been careful enough to avoid that, but it's really
a bad interface - it invites that kind of trouble.

The fix is fairly straightforward, even though it's bigger than I'd like:
	* prepend_path() root argument becomes const.
	* __d_path() is never called with NULL/NULL root.  It was a kludge
to start with.  Instead, we have an explicit function - d_absolute_root().
Same as __d_path(), except that it doesn't get root passed and stops where
it stops.  apparmor and tomoyo are using it.
	* __d_path() returns NULL on path outside of root.  The main
caller is show_mountinfo() and that's precisely what we pass root for - to
skip those outside chroot jail.  Those who don't want that can (and do)
use d_path().
	* __d_path() root argument becomes const.  Everyone agrees, I hope.
	* apparmor does *NOT* try to use __d_path() or any of its variants
when it sees that path->mnt is an internal vfsmount.  In that case it's
definitely not mounted anywhere and dentry_path() is exactly what we want
there.  Handling of sysctl()-triggered weirdness is moved to that place.
	* if apparmor is asked to do pathname relative to chroot jail
and __d_path() tells it we it's not in that jail, the sucker just calls
d_absolute_path() instead.  That's the other remaining caller of __d_path(),
BTW.
        * seq_path_root() does _NOT_ return -ENAMETOOLONG (it's stupid anyway -
the normal seq_file logics will take care of growing the buffer and redoing
the call of ->show() just fine).  However, if it gets path not reachable
from root, it returns SEQ_SKIP.  The only caller adjusted (i.e. stopped
ignoring the return value as it used to do).

Change-Id: I93428409c1da936d15f5bc41c477f51974077014
Reviewed-by: John Johansen <john.johansen@canonical.com>
ACKed-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
d2: add xz compression support

fix compile on d2 kernel and enable in defconfig

From: "Imre Kaloz" <kaloz@openwrt.org>
Subject: Wire up support for the XZ decompressor

Wire up support for the XZ decompressor

Signed-off-by: Imre Kaloz <kaloz@openwrt.org>

Change-Id: I86d7cfa26edc433291ba5e9372b20e65e95fc970
ARM: 7467/1: mutex: use generic xchg-based implementation for ARMv6+

The open-coded mutex implementation for ARMv6+ cores suffers from a
severe lack of barriers, so in the uncontended case we don't actually
protect any accesses performed during the critical section.

Furthermore, the code is largely a duplication of the ARMv6+ atomic_dec
code but optimised to remove a branch instruction, as the mutex fastpath
was previously inlined. Now that this is executed out-of-line, we can
reuse the atomic access code for the locking (in fact, we use the xchg
code as this produces shorter critical sections).

This patch uses the generic xchg based implementation for mutexes on
ARMv6+, which introduces barriers to the lock/unlock operations and also
has the benefit of removing a fair amount of inline assembly code.

Change-Id: I6ec1a724cfc6dcf228c0bae7f0b867c6435a92f1
Cc: <stable@vger.kernel.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Nicolas Pitre <nico@linaro.org>
Reported-by: Shan Kang <kangshan0910@gmail.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: Fix deadlock scenario with smp_send_stop()

If one process calls sys_reboot and that process then stops other
CPUs while those CPUs are within a spin_lock() region we can
potentially encounter a deadlock scenario like below.

CPU 0                   CPU 1
-----                   -----
                        spin_lock(my_lock)
smp_send_stop()
 send_IPI               handle_IPI()
                         disable_preemption/irqs
                          while(1);
 <PREEMPT>
spin_lock(my_lock) <--- Waits forever

We shouldn't attempt to run any other tasks after we send a stop
IPI to a CPU so disable preemption so that this task runs to
completion.

Change-Id: I528af0b4448433bd9d6ca12d6a0e2c422a55d4be
CRs-Fixed: 396169
Reported-by: Sundarajan Srinivasan <sundaraj@codeaurora.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
ARM: local timers: introduce a new registration interface

In order to switch to a runtime selectable local timer,
add a registration interface that timer drivers can use to
register to the core.

local_timer_setup() and local_timer_stop() are made weak symbols
in order not to break existing setups.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sathish Ambley <sambley@codeaurora.org>
base: genlock: handle error while creating lock/handle inode

A lock/handle inode is required in order to successfully create a
new lock/handle. Failure to report the lock/handle inode error can
result in errors for subsequent function calls.

Change-Id: I622af24e695f4781c4dbf46363931a7da09df677
Signed-off-by: Jeff Boody <jboody@codeaurora.org>
fmem: interact properly with DMM

On a system with both FMEM and DMM, FMEM must veto
memory hotremove of section(s) FMEM occupies when
in C-state and allow it (after cleaning up metadata)
in T-state (and then change to O-state).

It must also change back to T-state when all sections
FMEM uses have been powered on.

Change-Id: I9766a07305d1e3e2c6ff48e1cbf6933765b751f8
Signed-off-by: Larry Bassel <lbassel@codeaurora.org>
fmem: hotplug notifier should do nothing if fmem is inactive

If fmem discovers it has no memory to manage, it will
stay in an uninitialized state. However, this is
not discovered until long after the hotplug notifier
is set up (which must be in the fmem_init function).

Since fmem has not been initialized, the hotplug notifier
runs and incorrectly causes memory hotremove to fail, as
it bases its decision on uninitialized data.

The fix is for the hotplug notifier to just return
immediately if fmem is in the uninitialized state.

Change-Id: Ia647470d64fe1926be404af419f5f516e6b59c05
Signed-off-by: Larry Bassel <lbassel@codeaurora.org>
FMEM: allocate non-fixed FMEM from memory pool

On platforms whose FMEM is not at a fixed place
and which don't have DMM (such as 7x27a), FMEM
and the EBI memory pool would incorrectly overlap,
and the same memory would be used both as FMEM
and as memory allocated by allocate_contiguous_memory()
at the same time leading to crashes and strange behavior.

There are some unsolved problems related to
allocating FMEM from unstable memory, so we have
decided not to do this any longer. This decision allows
us to simply allocate non-fixed FMEM from the
EBI memory pool (this will prevent FMEM's memory
from being used by another allocator at the same time).
In this case FMEM will appear to "overlap" with
the memory pool, but this now OK as FMEM is allocated
from it.

This also re-enables FMEM on 7x27a and 8625, which
had been disabled due to the above-mentioned bug.

CRs-Fixed: 354254
Change-Id: I8e0bba332c7ddcac1d280de9642078fdfe61bbcc
Signed-off-by: Larry Bassel <lbassel@codeaurora.org>

Conflicts:

	arch/arm/mach-msm/board-8960.c
	arch/arm/mach-msm/board-msm7x27a.c
	arch/arm/mach-msm/memory.c
fmem: Use alignment property from platform data

Change-Id: I5d3e5f2c022937cd721befdd67a9d2f8f927608e
drivers: qcache: Port various fixes from zcache

 * Fix various lockups to improve stability

Change-Id: Ifeec71a934aa5f08b1b0b57bb05e22d0d7bf84e6
tty: hold lock across tty buffer finding and buffer filling

tty_buffer_request_room is well protected, but while after it returns,
 it releases the port->lock. tty->buf.tail might be modified
by either irq handler or other threads. The patch adds more protection
by holding the lock across tty buffer finding and buffer filling.

Signed-off-by: Alek Du <alek.du@intel.com>
Signed-off-by: Xiaobing Tu <xiaobing.tu@intel.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CRs-Fixed: 387308
Signed-off-by: Vamsi Krishna <vskrishn@codeaurora.org>
(cherry picked from commit 09236b0fbea5268bce3568d974654f8d9ddb83ec)

Change-Id: If383e12d6e65cfde1e2df2e65df8c3a4c30385ed
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
bdi: use deferable timer for sync_supers task

sync_supers task currently wakes up periodically for superblock
writeback. This hurts power on battery driven devices. This patch
turns this housekeeping timer into a deferable timer so that it
does not fire when system is really idle.

CRs-Fixed: 353700
Signed-off-by: Yong Wang <yong.y.wang@intel.com>
Signed-off-by: Xia Wu <xia.wu@intel.com>
Signed-off-by: Krishna Vanka <kvanka@codeaurora.org>
(cherry picked from commit f398f30d1f34632d3c96758b5b19e65b056af072)

Change-Id: I6ec6310d66c0d014adf0f41e75cd4c48c233f83d
Signed-off-by: Sridhar Gujje <sgujje@codeaurora.org>
Revert "msm_fb: dsiplay: fix frame buffer f_count leak"

This reverts commit 9943e52a60113dc08434c685b249254cb19edcf3.
Revert "msm_fb: display: add fput_light to frame buffer"

This reverts commit bb8834b870d4d5e277255486ca67908f3a6aa31e.
Revert "Revert "msm_fb: display: add fput_light to frame buffer""

This reverts commit c645a3495b8c1af7d1c514c2d7785c32eee7cc68.
Revert "msm_fb: display: Make sysfs read request interruptible"

This reverts commit cbdf290afc4b55db70d78d574216f911dd67c8cf.
msm_fb: dsiplay: fix frame buffer f_count leak

Frame buffer maintains a reference count (f_count) which increased
by fget() and decreased by fput(). overlay play will apply
fget() to frame buffer if it was the soruce buffer and fput()
will be applied to it after pipe commit done. However there has
extra fput() apply to frame buffer at the time pipe is freed.
This patch fix the problem by  clear MDP_MEMORY_ID_TYPE_FB from
pipe's flags to avoid extra fput() applying to frame buffer.

CRs-fixed: 411394
Change-Id: Ib2b72e6277480b5ace23cda554be485d9d477b3d
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>