net-fixes: flow_dissector: prevent an infinite loop (CVE-2013-4348)

Jason Wang found that a malicious packet could make skb_flow_dissect()
loop forever. We must check that IP header has a valid ihl to avoid
this loop. It involves IPIP encapsulation and ihl = 0 to trigger.

Given this bug is critical, I cooked a patch before having
a fix in upstream kernel.

Tested:

 Compiled/booted
 Ran some tests on bnx2x and explicitely disabled hardware provided rxhash
 ethtool -K eth1 rxhash off
 ethtool -K eth2 rxhash off

Google-Bug-Id: 11465355
Effort: net-fixes
Change-Id: I813e4dc48cecb05f8edfa218304e1f13fd764323
netfilter: Enable TOS matching in the kernel

This patch enabled kernel config CONFIG_NETFILTER_XT_MATCH_DSCP.
This adds a netfilter kernel configuration for matching TOS
packets for IPV4 packets. This will be required in certain QOS
filtering scenarios when the filter match is based on TOS.

CRs-Fixed: 542806
Change-Id: I59f311709daba8859db317cc152f96bc09f345b1
Acked-by: Sudharsan Coimbatore Premkumar <supremku@qti.qualcomm.com>
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
KBuild: Export msm_rmnet.h to user space

Exposing msm_rmnet.h to user space using standard mechanism such that
user space applications do not have to use relative paths in include
list.

CRs-Fixed: 548664
Change-Id: I807f9854de1d0bf9961607c9ed54dd5ecef782dc
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
kernel: Prevent unnecessary rfkill event generation.

Prevent unnecessary rfkill event generation when the state has
not actually changed. These events have to be delivered to
relevant userspace processes, causing these processes to wake
up and do something while they could as well have slept. This
obviously results in more CPU usage, longer time-to-sleep-again
and therefore higher power consumption.

Change-Id: I3ac4e141fbdf1315b74d3bad6aa96f34b00c3f92
CRs-fixed: 398283
Signed-off-by: Vitaly Wool <vitalywool@gmail.com>
Signed-off-by: Mykyta Iziumtsev <nikita.izyumtsev@gmail.com>
Signed-off-by: Deepthi Gowri <deepthi@codeaurora.org>
Patch-mainline: v3.7
Git-commit: eab48345c2b2d791159aaac4a77000baa8dbc1ae
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Bluetooth: Remove wake_locks added for BT idle timer

Wakelocks were used to address the issue related to timer
which was not triggered when device was put into suspend
mode.This does not impact the usecases as the link would
be put into sniff mode immediately after the device comes
out of suspend mode.

Change-Id: I648acf32c6ce9bd0d3415ac0e9dcd2250d3fb68d
Signed-off-by: Sumit Bajpai <sbajpai@codeaurora.org>
Bluetooth : Recover BT, if hardware error event is received from the SOC

If Hardware Error event is received from the SOC, then BT SOC is in bad
state. As per spec, Hardware Error event is handled in HCI. Upper layer
gets informed by HCI to reset everything. & recover BT state machine & BT
SOC.

Change-Id: Iefdf8511ad51f88ff8a24ab9e075eb8dbc0a0a67
Signed-off-by: Nitin Shivpure <nshivpur@codeaurora.org>
qdsp5: fix build

Change-Id: I1e97d8cd143639e6cf8cae6f36f5676700926359
msm: Remove files no longer buildable under arch/arm/mach-msm

Removed the files to reduce efforts as we move driver code out of mach-msm

Change-Id: Ic926ede69a7f4bb6ed0fbdffa7d551892886936a
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
qdsp5: memset stack buffer allocation.

This is needed to avoid garbage data in uninitialized variables.

Change-Id: I3a043a4ce4e14d8e0c24b434181dff484eddac72
CRs-Fixed: 551548
CRs-Fixed: 551542
CRs-Fixed: 551555
CRs-Fixed: 551563
CRs-Fixed: 551566
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
ALSA: pcm: check for integer overflow during multiplication

Channel info data structure is parsed from userspace and if
user does not set the no. of channels correctly, it could lead
to security vulnerability if we don't check for overflow when the
no. of channels is multiplied with pcm bit width. Add a condition
to check for overflow during multiplication.

CRs-fixed: 537818
Change-Id: Ia3c31406dd8b7627ea704c076643c0348582da28
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
ASoC: core: Update ALSA core  to issue restart in underrun.

When compressed and pcm session is started the buffer pull will
Be from the DSP, in mmap mode for the scenario Hardware pointer
Is same as application pointer implies application has not filled the
Buffer to be send to DSP, and platform driver has to break and restart
The de queue process when the application has sufficient buffers.

When hardware pointer is same as application pointer it is an under run
Scenario where the ALSA framework has to trigger the under run and in HAL
The session has to re-prepare and re-triggered. based on the stop
Threshold, but in our system the stop threshold is INT_MAX which
Indicates that under run is not triggered in practical cases.

We have a brodcast usecase in which the mentioned under run case
Is hit mulitple times, and every time re-prepare and re-trigger will be
Expensive

Update the ASoC core framework to restart de queue process stopped
By platform Driver when the under run is hit, based on the available
Buffer and render flag, so the System will recover from the hang state.

To restart de queue process the ASoC core will be calling the restart
Callback registered by platform driver and this callback will be running in
Atomic context.

Change-Id: Ic9ea05a0dc6246346e9913493232882e2f5447d1
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
ALSA: include: Add new ioctl for metadata mode

Add a new ioctl to support metadata mode in lpa driver. This ioctl
allows lpa driver to work in default alsa compliant mode and also
metadata mode.

CRs-Fixed: 458904
Change-Id: I8111e8652bbfb6dd93bdbda69bd16f53b45cb756
Signed-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>
ALSA: PCM: volume API implementation

Introduced a new helper function snd_pcm_add_volume_ctls() to
create control elements representing the volume for each PCM
(sub)stream.

Change-Id: Id483257c4fe84a909e7a4af3a5aa3e4f0d5d9ea5
Signed-off-by: Damir Didjusto <damird@codeaurora.org>
ALSA: core: Fix crash by avoiding appl_ptr crossing 32-bit boundary

Incase of A2DP usecase using proxy driver, appl_ptr has
boundary value as 0x60000000 frames in sw_params for stereo(2 channels).
When this value crosses 0x40000000, then userspace calculating
appl_ptr at bytes results in crossing 32-bit value 0x100000000,
and points to 0x0 offset which can result in crash or pop.
To avoid above scenario, set the sw_params appl_ptr boundary value
within 0x40000000. Added proper check at sw_params update
to set this value correctly within 32-bit boundary(frames).

Change-Id: I537a04156699d90549a0a468ae19539ecd552d3b
CRs-Fixed: 483203
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
sync: Fix a race condition between release_obj and print_obj

Before this change, a timeline would only be removed from the timeline
list *after* the sync driver had its release_obj() called. However, the
driver's release_obj() may free resources needed by print_obj().

Although the timeline list is locked when print_obj() is called, it is
not locked when release_obj() is called. If one CPU was in print_obj()
when another was in release_obj(), the print_obj() may make unsafe
accesses.

It is not actually necessary to hold the timeline list lock when calling
release_obj() if the call is made after the timeline is unlinked from
the list, since there is no possibility another thread could be in --
or enter -- print_obj() for that timeline.

This change moves the release_obj() call to after the timeline is
unlinked, preventing the above race from occurring.

Signed-off-by: Alistair Strachan <alistair.strachan@imgtec.com>
memcg: add memory.pressure_level events

With this patch userland applications that want to maintain the
interactivity/memory allocation cost can use the pressure level
notifications.  The levels are defined like this:

The "low" level means that the system is reclaiming memory for new
allocations.  Monitoring this reclaiming activity might be useful for
maintaining cache level.  Upon notification, the program (typically
"Activity Manager") might analyze vmstat and act in advance (i.e.
prematurely shutdown unimportant services).

The "medium" level means that the system is experiencing medium memory
pressure, the system might be making swap, paging out active file
caches, etc.  Upon this event applications may decide to further analyze
vmstat/zoneinfo/memcg or internal memory usage statistics and free any
resources that can be easily reconstructed or re-read from a disk.

The "critical" level means that the system is actively thrashing, it is
about to out of memory (OOM) or even the in-kernel OOM killer is on its
way to trigger.  Applications should do whatever they can to help the
system.  It might be too late to consult with vmstat or any other
statistics, so it's advisable to take an immediate action.

The events are propagated upward until the event is handled, i.e.  the
events are not pass-through.  Here is what this means: for example you
have three cgroups: A->B->C.  Now you set up an event listener on
cgroups A, B and C, and suppose group C experiences some pressure.  In
this situation, only group C will receive the notification, i.e.  groups
A and B will not receive it.  This is done to avoid excessive
"broadcasting" of messages, which disturbs the system and which is
especially bad if we are low on memory or thrashing.  So, organize the
cgroups wisely, or propagate the events manually (or, ask us to
implement the pass-through events, explaining why would you need them.)

Performance wise, the memory pressure notifications feature itself is
lightweight and does not require much of bookkeeping, in contrast to the
rest of memcg features.  Unfortunately, as of current memcg
implementation, pages accounting is an inseparable part and cannot be
turned off.  The good news is that there are some efforts[1] to improve
the situation; plus, implementing the same, fully API-compatible[2]
interface for CONFIG_CGROUP_MEM_RES_CTLR=n case (e.g.  embedded) is also
a viable option, so it will not require any changes on the userland
side.

[1] http://permalink.gmane.org/gmane.linux.kernel.cgroups/6291
[2] http://lkml.org/lkml/2013/2/21/454

Change-Id: Ib7b9f7986008d423b84152e2781d0402a560c95e
[akpm@linux-foundation.org: coding-style fixes]
[akpm@linux-foundation.org: fix CONFIG_CGROPUPS=n warnings]
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
Acked-by: Kirill A. Shutemov <kirill@shutemov.name>
Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Glauber Costa <glommer@parallels.com>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Luiz Capitulino <lcapitulino@redhat.com>
Cc: Greg Thelen <gthelen@google.com>
Cc: Leonid Moiseichuk <leonid.moiseichuk@nokia.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@gmail.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: John Stultz <john.stultz@linaro.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
add extra free kbytes tunable

Add a userspace visible knob to tell the VM to keep an extra amount
of memory free, by increasing the gap between each zone's min and
low watermarks.

This is useful for realtime applications that call system
calls and have a bound on the number of allocations that happen
in any short time period.  In this application, extra_free_kbytes
would be left at an amount equal to or larger than than the
maximum number of allocations that happen in any burst.

It may also be useful to reduce the memory use of virtual
machines (temporarily?), in a way that does not cause memory
fragmentation like ballooning does.

[ccross]
Revived for use on old kernels where no other solution exists.
The tunable will be removed on kernels that do better at avoiding
direct reclaim.

Change-Id: I765a42be8e964bfd3e2886d1ca85a29d60c3bb3e
Signed-off-by: Rik van Riel<riel@redhat.com>
Signed-off-by: Colin Cross <ccross@android.com>
base: genlock: Zero a structure before sending it to user space

In the handler for GENLOCK_IOC_EXPORT zero the entire genlock_lock
structure before passing it to the user.

CRs-fixed: 552303
Change-Id: Ic0dedbad257bf0a448d0bf67a14a3932b7925bfc
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: fb: Null check mfd data

Add appropriate null check for mfd data structure before
accessing it's members. This prevents null pointer accesses
in the driver.

Change-Id: I5aae937f839e4f6ed8d5c5a4b54ab45f0ff07332
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
Signed-off-by: Neti, Ravi Kumar <ravineti@codeaurora.org>
msm: fb: Copy unsigned int for notify update

Change to correct signature of msmfb_notify_update
from the ioctl declaration.

Change-Id: Ia7bdfd3dbe8494a641ffd46d484794b4bec7d27c
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>