sync: signal pt before sync_timeline object gets destroyed

There is a race condition

Assume we have *one* sync_fence object, with *one* sync_pt
which belongs to *one* sync_timeline, given this condition,
sync_timeline->kref will have two counts, one for sync_timeline
(implicit) and another for sync_pt.

Assume following is the situation on CPU

Theead-1 : (Thread which calls sync_timeline_destroy())
  -> (some function calls)
   -> sync_timeline_destory()
    -> sync_timeline_signal() (CPU is inside this
function after putting reference to sync_timeline)

At this time Thread-2 comes and does following

Thread-2 : (fclose on fence fd)
> sync_fence_release() -> because of fclose() on fence object
 -> sync_fence_free()
  -> sync_pt_free()
   -> kref_put(&pt->parent->kref, sync_timeline_free);
    -> sync_timeline_free() (CPU is inside this because
this time kref will be zero after _put)

Thread-2 will free sync_timeline object before Thread-1
has finished its work inside sync_timeline_signal.

With this change we signals all sync_pt before putting
reference to sync_timeline object.

Change-Id: I66d7359cc5dca0352fda49f81953028e98b95993
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm_fb:hdmi:Security checks for EDID block read.

Ensure data is read from within limits of buffer
for data block collection/video data block in EDID.
This prevents EDID data from being read past the end
of data block collection offset.
Ensure the 3D formats are only read from the proper
buffer region for vendor specific data block. This
prevents illegal data being read from the EDID data.

Change-Id: Id411f7e93aaf9293341a87cb4ca5431005e2bb18
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
Signed-off-by: Neti, Ravi Kumar <ravineti@codeaurora.org>
Merge "sync: signal pt before sync_timeline object gets destroyed"
Merge "msm_fb:hdmi:Security checks for EDID block read."