msm: audio: qdsp6v2:  Check return code from audio_aio_open()

When audio_aio_open() is triggered in blocking fashion, it  frees audio
resouces and returns error code. In the current implementation,  callers
did not check the error code which can lead to dereference to freed
resources and cause system crash.  Update the callers to check return
code and then return error back to application to avoid the issue. In
the meanwhile, update the audio_aio_open not to free memory for caller
and leave the caller to free the memory in error condition.

CRs-fixed: 436653
Change-Id: If4dda158cb988c5837517817b1afa0572c30696e
Signed-off-by: Kuirong Wang <kuirongw@codeaurora.org>

Conflicts:

	arch/arm/mach-msm/qdsp6v2/audio_aac.c
	arch/arm/mach-msm/qdsp6v2/audio_amrnb.c
	arch/arm/mach-msm/qdsp6v2/audio_amrwb.c
	arch/arm/mach-msm/qdsp6v2/audio_evrc.c
	arch/arm/mach-msm/qdsp6v2/audio_mp3.c
	arch/arm/mach-msm/qdsp6v2/audio_multi_aac.c
	arch/arm/mach-msm/qdsp6v2/audio_qcelp.c
	arch/arm/mach-msm/qdsp6v2/audio_utils_aio.c
	arch/arm/mach-msm/qdsp6v2/audio_wma.c
	arch/arm/mach-msm/qdsp6v2/audio_wmapro.c
msm: audio: qdsp6v2: Add NULL checking for input parameters

Add checking for NULL. Two parameters shouldn't be NULL.

Change-Id: Ied9e9e6238f6498305844bf3a08370c7cf751fc7
Signed-off-by: Fred Oh <fred@codeaurora.org>
msm: audio: qdsp6v2: Fix for kernel crash during stability

- Userspace calling AYSN_READ during flush, READ_DONE ack for
  this is coming after FLUSH_DONE which is hitting BUG_ON as
  buffers are removed from in_queue/out_queue during flush.
- Fix is to avoid sending READ requests to DSP until flush
  is complete.

CRs-Fixed: 485288
Change-Id: Ia2a64471a3507b3f5565b695c40cc6dd9081930d
Signed-off-by: Deepa Madiregama <dmadireg@codeaurora.org>
msm: audio: qdsp6v2: Fix voice RTAC.

There was data type mismatch which caused the corruption during
memory copy. It leads to the voice RTAC failure.

CRs-Fixed: 391392
Signed-off-by: Jayasena Sangaraboina <jsanga@codeaurora.org>
(cherry picked from commit 823fd65d9eef2f728b343fe0e891122f226b887e)

Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
(cherry picked from commit 0ce787caa67c0c215edde3be28b578c183a6f337)

Change-Id: I19c000d2c5bc3e08a57be6e4e4036b37140badbf
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
msm: audio: qdsp6v2: Add support to configure ISO and ARIB coefficients

Add support for configuring ISO or ARIB stereo mixing coefficients.
This change introduces an IOCTL through which the user space can
configure ISO or ARIB coefficients.

Change-Id: Id08c859ce8bc18d7d0e41ce1ecb6a08f0794e067
Signed-off-by: Amal Paul <amal@codeaurora.org>
ASoC: msm: qdsp6: Add support to configure ISO and ARIB coefficients

Add support for configuring ISO or ARIB stereo mixing
coefficients. This change introduces a function with whichi,
AAC multi-channel driver can configure ISO or ARIB coefficients
according to configuration done by the client.

Change-Id: I72b74033532a276fa3bc1d305a04720ff6767409
Signed-off-by: Amal Paul <amal@codeaurora.org>

Conflicts:

	include/sound/apr_audio.h
	include/sound/q6asm-v2.h
	sound/soc/msm/qdsp6v2/q6asm.c
libceph: Fix NULL pointer dereference in auth client code

commit 2cb33cac622afde897aa02d3dcd9fbba8bae839e upstream.

A malicious monitor can craft an auth reply message that could cause a
NULL function pointer dereference in the client's kernel.

To prevent this, the auth_none protocol handler needs an empty
ceph_auth_client_ops->build_request() function.

CVE-2013-1059

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Chanam Park <chanam.park@hkpco.kr>
Reviewed-by: Seth Arnold <seth.arnold@canonical.com>
Reviewed-by: Sage Weil <sage@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/cdrom/cdrom.c: use kzalloc() for failing hardware

commit 542db01579fbb7ea7d1f7bb9ddcef1559df660b2 upstream.

In drivers/cdrom/cdrom.c mmc_ioctl_cdrom_read_data() allocates a memory
area with kmalloc in line 2885.

  2885         cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
  2886         if (cgc->buffer == NULL)
  2887                 return -ENOMEM;

In line 2908 we can find the copy_to_user function:

  2908         if (!ret && copy_to_user(arg, cgc->buffer, blocksize))

The cgc->buffer is never cleaned and initialized before this function.
If ret = 0 with the previous basic block, it's possible to display some
memory bytes in kernel space from userspace.

When we read a block from the disk it normally fills the ->buffer but if
the drive is malfunctioning there is a chance that it would only be
partially filled.  The result is an leak information to userspace.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jonathan Salwan <jonathan.salwan@gmail.com>
Cc: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
hpfs: better test for errors

commit 3ebacb05044f82c5f0bb456a894eb9dc57d0ed90 upstream.

The test if bitmap access is out of bound could errorneously pass if the
device size is divisible by 16384 sectors and we are asking for one bitmap
after the end.

Check for invalid size in the superblock. Invalid size could cause integer
overflows in the rest of the code.

Signed-off-by: Mikulas Patocka <mpatocka@artax.karlin.mff.cuni.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
block: do not pass disk names as format strings

commit ffc8b30866879ed9ba62bd0a86fecdbd51cd3d19 upstream.

Disk names may contain arbitrary strings, so they must not be
interpreted as format strings.  It seems that only md allows arbitrary
strings to be used for disk names, but this could allow for a local
memory corruption from uid 0 into ring 0.

CVE-2013-2851

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
crypto: sanitize argument for format string

commit 1c8fca1d92e14859159a82b8a380d220139b7344 upstream.

The template lookup interface does not provide a way to use format
strings, so make sure that the interface cannot be abused accidentally.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
MAINTAINERS: add stable_kernel_rules.txt to stable maintainer information

commit 7b175c46720f8e6b92801bb634c93d1016f80c62 upstream.

This hopefully will help point developers to the proper way that patches
should be submitted for inclusion in the stable kernel releases.

Reported-by: David Howells <dhowells@redhat.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nfsd4: fix decoding of compounds across page boundaries

commit 247500820ebd02ad87525db5d9b199e5b66f6636 upstream.

A freebsd NFSv4.0 client was getting rare IO errors expanding a tarball.
A network trace showed the server returning BAD_XDR on the final getattr
of a getattr+write+getattr compound.  The final getattr started on a
page boundary.

I believe the Linux client ignores errors on the post-write getattr, and
that that's why we haven't seen this before.

Reported-by: Rick Macklem <rmacklem@uoguelph.ca>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
SCSI: sd: Fix parsing of 'temporary ' cache mode prefix

commit 2ee3e26c673e75c05ef8b914f54fadee3d7b9c88 upstream.

Commit 39c60a0948cc '[SCSI] sd: fix array cache flushing bug causing
performance problems' added temp as a pointer to "temporary " and used
sizeof(temp) - 1 as its length.  But sizeof(temp) is the size of the
pointer, not the size of the string constant.  Change temp to a static
array so that sizeof() does what was intended.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 3.0.86
Merge tag 'v3.0.86' into cm-10.1

This is the 3.0.86 stable release
Merge branch 'cm-10.1' of https://github.com/razrqcom-dev-team/android_kernel_motorola_msm8960-common into cm-10.1_mod