block: Squashed update of BFQ-v5r1 to BFQ-v6
printk: fix buffer overflow when calling log_prefix function from call_console_drivers

This patch corrects a buffer overflow in kernels from 3.0 to 3.4 when calling
log_prefix() function from call_console_drivers().

This bug existed in previous releases but has been revealed with commit
162a7e7500f9664636e649ba59defe541b7c2c60 (2.6.39 => 3.0) that made changes
about how to allocate memory for early printk buffer (use of memblock_alloc).
It disappears with commit 7ff9554bb578ba02166071d2d487b7fc7d860d62 (3.4 => 3.5)
that does a refactoring of printk buffer management.

In log_prefix(), the access to "p[0]", "p[1]", "p[2]" or
"simple_strtoul(&p[1], &endp, 10)" may cause a buffer overflow as this
function is called from call_console_drivers by passing "&LOG_BUF(cur_index)"
where the index must be masked to do not exceed the buffer's boundary.

The trick is to prepare in call_console_drivers() a buffer with the necessary
data (PRI field of syslog message) to be safely evaluated in log_prefix().

This patch can be applied to stable kernel branches 3.0.y, 3.2.y and 3.4.y.

Without this patch, one can freeze a server running this loop from shell :
  $ export DUMMY=`cat /dev/urandom | tr -dc '12345AZERTYUIOPQSDFGHJKLMWXCVBNazertyuiopqsdfghjklmwxcvbn' | head -c255`
  $ while true do ; echo $DUMMY > /dev/kmsg ; done

The "server freeze" depends on where memblock_alloc does allocate printk buffer :
if the buffer overflow is inside another kernel allocation the problem may not
be revealed, else the server may hangs up.

Signed-off-by: Alexandre SIMON <Alexandre.Simon@univ-lorraine.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
3.0.66
kernel/sys.c: fix stack memory content leak via UNAME26

Calling uname() with the UNAME26 personality set allows a leak of kernel
stack contents.  This fixes it by defensively calculating the length of
copy_to_user() call, making the len argument unsigned, and initializing
the stack buffer to zero (now technically unneeded, but hey, overkill).

CVE-2012-0957

Reported-by: PaX Team <pageexec@freemail.hu>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Brad Spengler <spender@grsecurity.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Conflicts:
	kernel/sys.c
slub: fix a possible memory leak

Memory allocated by kstrdup should be freed,
when kmalloc(kmem_size, GFP_KERNEL) is failed.

Change-Id: Ic15409e7025cc5e69772f06d19dfa99aeae80a04
Acked-by: Christoph Lameter <cl@linux.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Joonsoo Kim <js1304@gmail.com>
Signed-off-by: Pekka Enberg <penberg@kernel.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Correcting copyright markings

Change-Id: I07bcb719de8912f9e4d4a25c7f5a9e75312f49c7
Signed-off-by: Shruthi Krishna <skrish@codeaurora.org>
msm: vidc: Add ioctls for getting separate meta buffers status

Add ioctl for getting separate meta buffers status

Change-Id: Ib0cc347b5538ad6a0703f9b463dbcdd91f31dd54
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: vidc: Allow client to request sps/pps per IDR frame

Expose SET_SPS_PPS_FOR_IDR to allow client request sps/pps per IDR
frame.

Change-Id: Ifc58b89e5bb11f09ee8ce7cce206e8b71d5ef9a0
Signed-off-by: Srinu Gorle <sgorle@codeaurora.org>
video: msm: Allow completion timeout for LCDC driver

Change-Id: I3705253b01e72fc1080b24f174af4398decaf521
video: msm: Configure blend before DMA for LCDC panel too

 * Needed to avoid display glitching in BLT mode

Change-Id: Ic9b81621794df10f0ebb98d42a04443fc4fc002f
video: msm: Commit MDP baselayer pipe on LCDC

 * Commit a6ab3c058834b42ab3869d358bef6491b8d2db18 introduced this for
   everything except for LCDC.
 * We need to commit the pipe or pipes are not unstaged.

Change-Id: I285b8e12a5df22079a0f17807bff2b1e0f3fe0ec