msm_fb: Make sure MDP clock is ON during register access

Change to make sure that MDP clock is ON while accessing
MDP fixed arbitration read and write selection
registers. This avoids target freeze due to unclocked
register access.

CRs-fixed: 505154
Change-Id: I1d2e654c7b97ca51e42611a5bd3aefd65421bcf4
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
msm: camera: Fix for kernel panic

check if buffer instance handle is zero while
getting pcam instance based on instance handle
in msm_mctl_reserve_free_buf function

Change-Id: Id3861c4f29fb4f7fd62ad6de6597e65c7c4f656b
Signed-off-by: manish gotefode <mgote@codeaurora.org>
input: touchscreen: Change the file system permission of synaptic driver

Some of the sysfs files of synaptic driver has "write"
permissions. Change them to "read" only.

Change-Id: I1454e30f06532f324707d0140ed990551259a3ea
Signed-off-by: Shantanu Jain <shjain@codeaurora.org>
radio: iris: Fix 64th character in  RDS RT field is missing

FM driver sends only upto 63 characters as Radio Text data
to upper layer.

Pass upto 64 characters as Radio Text

Change-Id: I3d49d85eb0c6e91ef0ea5660e572734a38281d62
CRs-Fixed: 505062
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
net: rmnet_usb: silence URB submission errors during disconnect

URB submissions will fail with -ENODEV while the device is being
disconnected.  The current code prints error message for an URB
submission failure.  If too many URBs are submitted during the
disconnect window, then target is crashing due to excessive
console logging.

CRs-Fixed: 507556
Change-Id: I287c5021bacb2238b62bf78a8ddf887f588b6f16
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Merge "radio: iris: Fix 64th character in  RDS RT field is missing"
msm-camera: Removing MSM_GMN_IOCTL_TEST_DUMP_REGION ioctl

Removing the MSM_GMN_IOCTL_TEST_DUMP_REGION call because this
is not used.

CRs-Fixed: 496905
Depends-on: 372524

Change-Id: I91147bbf67055351a115687a18a1172a649d5d6a
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm_fb: Avoid MDP mixer reset from ISR context

During DSI error interrupt handling, we currently try to do
MDP mixer reset. Avoid this since MDP clock control happens
in mixer reset which is not correct in ISR context. Schedule
a workqueue instead to call mixer reset as a separate thread.

CRs-fixed: 508882
Change-Id: Ie5471a01d79b4d8b67d8bb78647c407c35acae65
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
Merge "input: touchscreen: Change the file system permission of synaptic driver"
Merge "msm: camera: Fix for kernel panic"
Merge "msm-camera: Removing MSM_GMN_IOCTL_TEST_DUMP_REGION ioctl"
Merge "msm_fb: Avoid MDP mixer reset from ISR context"
power: pm8921-bms: Fix SOC fluctuations at 100%

It is observed that the SOC can oscillate between 100-99-100
based on OCV updates after EOC (it is possible that there are
multiple varying OCV updates as the battery settles down).
Prevent this by avoiding the SOC to increase if it has dropped
and not charging.

While handling this scenario make sure that we do not scale
when soc = 100 and charging.

CRs-Fixed: 505132
Change-Id: Ie20c02d6df9407717c31e958b6b6f3e736325660
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
Merge "net: rmnet_usb: silence URB submission errors during disconnect"
Merge "msm_fb: Make sure MDP clock is ON during register access"
Merge "power: pm8921-bms: Fix SOC fluctuations at 100%"
libceph: Fix NULL pointer dereference in auth client code

commit 2cb33cac622afde897aa02d3dcd9fbba8bae839e upstream.

A malicious monitor can craft an auth reply message that could cause a
NULL function pointer dereference in the client's kernel.

To prevent this, the auth_none protocol handler needs an empty
ceph_auth_client_ops->build_request() function.

CVE-2013-1059

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Chanam Park <chanam.park@hkpco.kr>
Reviewed-by: Seth Arnold <seth.arnold@canonical.com>
Reviewed-by: Sage Weil <sage@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/cdrom/cdrom.c: use kzalloc() for failing hardware

commit 542db01579fbb7ea7d1f7bb9ddcef1559df660b2 upstream.

In drivers/cdrom/cdrom.c mmc_ioctl_cdrom_read_data() allocates a memory
area with kmalloc in line 2885.

  2885         cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
  2886         if (cgc->buffer == NULL)
  2887                 return -ENOMEM;

In line 2908 we can find the copy_to_user function:

  2908         if (!ret && copy_to_user(arg, cgc->buffer, blocksize))

The cgc->buffer is never cleaned and initialized before this function.
If ret = 0 with the previous basic block, it's possible to display some
memory bytes in kernel space from userspace.

When we read a block from the disk it normally fills the ->buffer but if
the drive is malfunctioning there is a chance that it would only be
partially filled.  The result is an leak information to userspace.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jonathan Salwan <jonathan.salwan@gmail.com>
Cc: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
charger-manager: Ensure event is not used as format string

commit 3594f4c0d7bc51e3a7e6d73c44e368ae079e42f3 upstream.

The exposed interface for cm_notify_event() could result in the event msg
string being parsed as a format string. Make sure it is only used as a
literal string.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Anton Vorontsov <cbou@mail.ru>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Anton Vorontsov <anton@enomsg.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
hpfs: better test for errors

commit 3ebacb05044f82c5f0bb456a894eb9dc57d0ed90 upstream.

The test if bitmap access is out of bound could errorneously pass if the
device size is divisible by 16384 sectors and we are asking for one bitmap
after the end.

Check for invalid size in the superblock. Invalid size could cause integer
overflows in the rest of the code.

Signed-off-by: Mikulas Patocka <mpatocka@artax.karlin.mff.cuni.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>