radio: iris: Prevent loss of data

Down casting a variable may lead to loss
of data, other various kind of subtle errors.

Change-Id: If1f8a8c463333a5283c5ba66f099e33d66dc21e4
CRs-Fixed: 569313
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Use kernel API to copy data from user space

Use copy_from_user kernel api to copy any data from user space
to kernel space.

Change-Id: Ia3b7bb0f98180bd8792c1c18e930cb5609b8dc82
CRs-Fixed: 540320
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
workqueue: Added null check and warning

If work item is already in queue get_work_cwq() will return null.
so null check is added to avoid crash in delayed_work_timer_on()

CRs-Fixed: 586162

Change-Id: I5c885142fd72781cea90d6c9b3456ecc7f0778b6
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Asoc:msm:Added Buffer overflow check

The overflow check is required to ensure that user space data
in kernel may not go beyond buffer boundary.

Change-Id: I79b7e5f875fadcaeceb05f9163ae3666d4b6b7e1
CRs-Fixed: 563086
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
radio: tavarua: Added NULL checks for input arguments.

Added NULL checks for input arguments.

Change-Id: Ie39c2b3254c95925723735423c81b99da59ee6ad
CRs-fixed: 548405
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
Update on Program TILE video frame size in dma ISR.

Earlier DMAP interrupt was enabled for each pipe,
which caused exessive logs.
Now DMAP interrupt is called for each frame.

Change-Id: Iceba4d6d781d81eb60a7b87936ef49d01eaaad78
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
csdio: Remove the driver

The driver is a legacy driver that is not used any longer
and its implementation is neither correct nor compiles.

Change-Id: I9862c0f93ccad6079a616f6997987d4e187a137c
Signed-off-by: Hamad Kadmany <hkadmany@codeaurora.org>
netfilter: x_tables: fix ordering of jumpstack allocation and table update

During kernel stability testing on an SMP ARMv7 system, Yalin Wang
reported the following panic from the netfilter code:

  1fe0: 0000001c 5e2d3b10 4007e779 4009e110 60000010 00000032 ff565656 ff545454
  [<c06c48dc>] (ipt_do_table+0x448/0x584) from [<c0655ef0>] (nf_iterate+0x48/0x7c)
  [<c0655ef0>] (nf_iterate+0x48/0x7c) from [<c0655f7c>] (nf_hook_slow+0x58/0x104)
  [<c0655f7c>] (nf_hook_slow+0x58/0x104) from [<c0683bbc>] (ip_local_deliver+0x88/0xa8)
  [<c0683bbc>] (ip_local_deliver+0x88/0xa8) from [<c0683718>] (ip_rcv_finish+0x418/0x43c)
  [<c0683718>] (ip_rcv_finish+0x418/0x43c) from [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598)
  [<c062b1c4>] (__netif_receive_skb+0x4cc/0x598) from [<c062b314>] (process_backlog+0x84/0x158)
  [<c062b314>] (process_backlog+0x84/0x158) from [<c062de84>] (net_rx_action+0x70/0x1dc)
  [<c062de84>] (net_rx_action+0x70/0x1dc) from [<c0088230>] (__do_softirq+0x11c/0x27c)
  [<c0088230>] (__do_softirq+0x11c/0x27c) from [<c008857c>] (do_softirq+0x44/0x50)
  [<c008857c>] (do_softirq+0x44/0x50) from [<c0088614>] (local_bh_enable_ip+0x8c/0xd0)
  [<c0088614>] (local_bh_enable_ip+0x8c/0xd0) from [<c06b0330>] (inet_stream_connect+0x164/0x298)
  [<c06b0330>] (inet_stream_connect+0x164/0x298) from [<c061d68c>] (sys_connect+0x88/0xc8)
  [<c061d68c>] (sys_connect+0x88/0xc8) from [<c000e340>] (ret_fast_syscall+0x0/0x30)
  Code: 2a000021 e59d2028 e59de01c e59f011c (e7824103)
  ---[ end trace da227214a82491bd ]---
  Kernel panic - not syncing: Fatal exception in interrupt

This comes about because CPU1 is executing xt_replace_table in response
to a setsockopt syscall, resulting in:

	ret = xt_jumpstack_alloc(newinfo);
		--> newinfo->jumpstack = kzalloc(size, GFP_KERNEL);

	[...]

	table->private = newinfo;
	newinfo->initial_entries = private->initial_entries;

Meanwhile, CPU0 is handling the network receive path and ends up in
ipt_do_table, resulting in:

	private = table->private;

	[...]

	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];

On weakly ordered memory architectures, the writes to table->private
and newinfo->jumpstack from CPU1 can be observed out of order by CPU0.
Furthermore, on architectures which don't respect ordering of address
dependencies (i.e. Alpha), the reads from CPU0 can also be re-ordered.

This patch adds an smp_wmb() before the assignment to table->private
(which is essentially publishing newinfo) to ensure that all writes to
newinfo will be observed before plugging it into the table structure.
A dependent-read barrier is also added on the consumer sides, to ensure
the same ordering requirements are also respected there.

CRs-Fixed: 591149

Change-Id: Ica3ec69cd6e2f77945a1a7303f92887feecf42e9
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reported-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Tested-by: Wang, Yalin <Yalin.Wang@sonymobile.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Git-commit: b416c144f46af1a30ddfa4e4319a8f077381ad63
Git-repo: https://www.codeaurora.org/cgit/quic/la/kernel/msm/common/
Signed-off-by: Vijaya Kumar T M <vtmuni@codeaurora.org>
Revert "Update on Program TILE video frame size in dma ISR."

This reverts commit 88ac781cec1034301882099f1f11984b73831d92.

Change-Id: Idecc76ededc625d77ae3c8fd3f9e0da512b4848f
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
Revert "msm_fb: display: update video tile framesize register"

This reverts commit 80f8dfbbbb20adde0fc0c164c19bd5ea50c2ddf1.

Change-Id: I1270e0296808a53e5a2559c19526cec67b5dbc33
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
Revert "msm_fb: display: Program TILE video frame size in dma ISR"

This reverts commit 472d090f0b745f09d515b81961291971996b6fd3.

Change-Id: Ic38c8d634cec7200df58dcf108b4f37b4fe06f70
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>