video: tegra: avoid null deref on nvdps read

When reading nvdps sysfs file, check mode to avoid a null dereference.

Bug 1032235
Bug 1283024

Change-Id: I19b3b5b3de6743cdcc9e3a846a4ba102de681ad3
Signed-off-by: Haley Teng <hteng@nvidia.com>
Merge remote-tracking branch 'github/cm-10.1' into cm-10.2-merge

Conflicts:
	arch/arm/configs/cyanogenmod_grouper_defconfig

Change-Id: Ie8c48690e32a332ea3b767ca51bcc1acc319470e

Conflicts:
	arch/arm/configs/tegra_p1852_android_defconfig
	arch/arm/mach-tegra/board-grouper-panel.c
block: Switch from BFQ-v5 for 3.1.0 to BFQ-v5r1 for 3.1.0.

Improvements:

- BUG FIX: Fixed stall occurring when the active queue is moved to
  a different group while idling (this caused the idling timer to be
  cancelled and hence no new queue to be selected, and no new
  request to be dispatched).
- BUG FIX: Fixed wrong assignment of too high budgets to queues during
  the first few seconds after initialization.
- BUG FIX: Added proper locking to the function handling the "weights"
  tunable.

Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
Signed-off-by: Mauro Andreolini <mauro.andreolini@unimore.it>
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
block: Switch from BFQ-v5r1 for 3.1.0 to BFQ-v6 for 3.1.0.

Improvements:

- Replacement of the cooperating-queue merging mechanism borrowed from
  CFQ with Early Queue Merge (EQM), a unified mechanism to get a
  sequential read pattern, and hence a high throughput with any set of
  processes performing interleaved I/O.
  The  main idea  is checking newly arrived requests against the next
  request of the active queue both in case of actual request insert and
  in case of request merge. EQM  also preserves the typical low-latency
  properties of  BFQ, by properly restoring the weight-raising state of
  a queue when it gets back to a non-merged state (see
  http://algo.ing.unimo.it/people/paolo/disk_sched/description.php for
  more details). The code for detecting whether two queues have to be
  merged is a slightly modified version of the CFQ code for detecting
  whether two queues belong to cooperating processes and whether the
  service of a queue should be preempted to boost the throughput.
- Fix a bug that caused the peak rate of a disk to be computed as zero
  in case of multiple I/O errors. Subsequent estimations of the weight
  raising duration caused a division-by-zero error.

Signed-off-by: Mauro Andreolini <mauro.andreolini@unimore.it>
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
Reviewed-by: Paolo Valente <paolo.valente@unimore.it>
block: Switch from BFQ-v6 for 3.1.0 to BFQ-v6r1 for 3.1.0.

Improvements:
- Introduce an eqm_lock to protect EQM-related data.
- Fix use-after-free of queues in __bfq_bfqq_expire(). It may happen that
  a call to bfq_del_bfqq_busy() puts the last reference taken on a queue
  and frees it. Subsequent accesses to that same queue would result in a
  use-after-free. Make sure that a queue that has just been deleted from
  busy is no more touched.
- Use the uninitialized_var() macro when needed. It may happen that a
  variable is initialized in a function that is called by the function
  that defined it. Use the uninitialized_var() macro in these cases.

Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
block: Switch from BFQ-v6r1 for 3.1.0 to BFQ-v6r2 for 3.1.0.

Improvements:

- Fairness fix: the case of queue expiration for budget timeout is
  now correctly handled also for sync queues, thus allowing also
  the processes corresponding to these queues to be guaranteed their
  reserved share of the disk throughput.
- Fixed a bug that prevented group weights from being correctly
  set via the sysfs interface.
- Fixed a bug that cleared a previously-set group weight if the
  same value was re-inserted via the sysfs interface.
- Fixed an EQM bug that allowed a newly-started process to skip
  its initial weight-raising period if its queue was merged before
  its first request was inserted.
- Fixed a bug that preserved already-started weight-raising periods
  even if the low_latency tunable was disabled.
- The raising_max_time tunable now shows, more user-friendly, the
  maximum raising time in milliseconds.

Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
net: ipv6: add missing lock in ping_v6_sendmsg

[net-next commit a1bdc45580fc19e968b32ad27cd7e476a4aa58f6]

Bug: 9469865
Change-Id: I7ae28d29c645c535e570eb8d12f45e8eafd9c70b
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Conflicts:
	net/ipv6/ping.c
net: ipv6: fix wrong ping_v6_sendmsg return value

[net-next commit fbfe80c890a1dc521d0b629b870e32fcffff0da5]

ping_v6_sendmsg currently returns 0 on success. It should return
the number of bytes written instead.

Bug: 9469865
Change-Id: I86eb936e06bf8582975d59597e48e2bcc53b958d
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ARM: 7301/1: Rename the T() macro to TUSER() to avoid namespace conflicts

This macro is used to generate unprivileged accesses (LDRT/STRT) to user
space.

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS

The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.

This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.

[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]

Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Add in BFQ IO, make CFQ IO default.
ptrace: introduce signal_wake_up_state() and ptrace_signal_wake_up()

Cleanup and preparation for the next change.

signal_wake_up(resume => true) is overused. None of ptrace/jctl callers
actually want to wakeup a TASK_WAKEKILL task, but they can't specify the
necessary mask.

Turn signal_wake_up() into signal_wake_up_state(state), reintroduce
signal_wake_up() as a trivial helper, and add ptrace_signal_wake_up()
which adds __TASK_TRACED.

This way ptrace_signal_wake_up() can work "inside" ptrace_request()
even if the tracee doesn't have the TASK_WAKEKILL bit set.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ed Tam <etam@google.com>

Conflicts:
	kernel/ptrace.c
ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL

putreg() assumes that the tracee is not running and pt_regs_access() can
safely play with its stack.  However a killed tracee can return from
ptrace_stop() to the low-level asm code and do RESTORE_REST, this means
that debugger can actually read/modify the kernel stack until the tracee
does SAVE_REST again.

set_task_blockstep() can race with SIGKILL too and in some sense this
race is even worse, the very fact the tracee can be woken up breaks the
logic.

As Linus suggested we can clear TASK_WAKEKILL around the arch_ptrace()
call, this ensures that nobody can ever wakeup the tracee while the
debugger looks at it.  Not only this fixes the mentioned problems, we
can do some cleanups/simplifications in arch_ptrace() paths.

Probably ptrace_unfreeze_traced() needs more callers, for example it
makes sense to make the tracee killable for oom-killer before
access_process_vm().

While at it, add the comment into may_ptrace_stop() to explain why
ptrace_stop() still can't rely on SIGKILL and signal_pending_state().

Reported-by: Salman Qazi <sqazi@google.com>
Reported-by: Suleiman Souhlal <suleiman@google.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ed Tam <etam@google.com>

Conflicts:
	kernel/ptrace.c
wake_up_process() should be never used to wakeup a TASK_STOPPED/TRACED task

wake_up_process() should never wakeup a TASK_STOPPED/TRACED task.
Change it to use TASK_NORMAL and add the WARN_ON().

TASK_ALL has no other users, probably can be killed.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ed Tam <etam@google.com>
Add permission checking for binder IPC.

Signed-off-by: Ed Tam <etam@google.com>
Fix security_binder_transfer_binder hook.

Drop the owning task argument to security_binder_transfer_binder
since ref->node->proc can be NULL (dead owner?).
Revise the SELinux checking to apply a single transfer check between
the source and destination tasks.  Owning task is no longer relevant.
Drop the receive permission definition as it is no longer used.

This makes the transfer permission similar to the call permission; it is only
useful if you want to allow a binder IPC between two tasks (call permission)
but deny passing of binder references between them (transfer permission).

Signed-off-by: Ed Tam <etam@google.com>
netfilter: xt_qtaguid: fix error exit that would keep a spinlock.

qtudev_open() could return with a uid_tag_data_tree_lock held
when an kzalloc(..., GFP_ATOMIC) would fail.
Very unlikely to get triggered AND survive the mayhem of running out of mem.

Signed-off-by: JP Abgrall <jpa@google.com>
netfilter: qtaguid: Don't BUG_ON if create_if_tag_stat fails

If create_if_tag_stat fails to allocate memory (GFP_ATOMIC) the
following will happen:

qtaguid: iface_stat: tag stat alloc failed
...
kernel BUG at xt_qtaguid.c:1482!

Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>