msm8960: htc: jewel: update sensors.

*Support RUU 3.16 blobs*
*fixes incorrect compass reporting*
*source from jewelcl-jb-crc-3.4.10-19136fe*

Change-Id: I9cc02b11fa9843c6d0f318aee6f20a89b9c37483
qup_i2c: Allow i2c bus to share UART

Original change from HTC.

Change-Id: Ie8533fa1ff773ff042f24faa6116b408bb01fc21
msm: HTC: enable share_uart_flag for GSBI8

Change-Id: Ib173d08f71323225378e32e8bc7dbf925cd31644
msm_fb: hdmi: Import HTC SII9234 driver

HTC kernel version: jewelcl-jb-crc-3.4.10-19136fe

Change-Id: I29e2109f3d0222bdb90f33927b44c128867ff5f5
msm: HTC: elite: Update board files for MHL output

Code imported from evitaul-jb-crc-3.4.10-240d4d5

Change-Id: I5b0a89981744a9e34e3dc3cd8bb5e33ec1cbd325
msm: HTC: jet: Update board files for MHL support

Code imported from jewelcl-jb-crc-3.4.10-19136fe

Change-Id: I927bb65a0e8127668abd928584f4513300158e1e
msm: HTC: ville: Update board files for MHL support

Code imported from villeu-jb-crc-3.4.10-c156855

Change-Id: I8add9bc7bb0fa437045617766b68fba222d6bddf
msm: HTC: disable board panel power on function

Change-Id: Ieb86aaa76cf232d58babdc091d543e21b1fcd635
msm_fb: hdmi: Import HTC hdmi stack

Use HTC version of external_common.c hdmi_msm.c
Original code from jewelcl-jb-crc-3.4.10-cl124461-6

Change-Id: Ib9f7113ab43ed9eab3cb379ef876555d8284bb4a
msm: HTC: fighter: re-enable sleeps during display power-on

Change-Id: I304b0a08f4ae5d33b08e10481570a08b7c1459e4
msm: HTC: fighter: panel cleanup and formatting

mdp clk rate tables are not used anymore

Change-Id: I3ff10d3e8314558d3b973e2f3f1228ef9630b84f
msm: HTC: ville: enable SELINUX

Change-Id: I4dbfeb892c4eb1f198a7e1c00c290b35af03f0ab
msm: HTC: elite: enable SELINUX

Change-Id: I0bbdb972563be535ade6c876880bba3bfd94bdb5
msm: HTC: jet: enable SELINUX

Change-Id: Ib0419a0e3ff6c6113cf9235f2d6200fc8d6e7f94
msm: HTC: fighter: enable SELINUX

Change-Id: I280616ac33c7a7faf94372de53dc5449f15951ab
libceph: Fix NULL pointer dereference in auth client code

commit 2cb33cac622afde897aa02d3dcd9fbba8bae839e upstream.

A malicious monitor can craft an auth reply message that could cause a
NULL function pointer dereference in the client's kernel.

To prevent this, the auth_none protocol handler needs an empty
ceph_auth_client_ops->build_request() function.

CVE-2013-1059

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Chanam Park <chanam.park@hkpco.kr>
Reviewed-by: Seth Arnold <seth.arnold@canonical.com>
Reviewed-by: Sage Weil <sage@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/cdrom/cdrom.c: use kzalloc() for failing hardware

commit 542db01579fbb7ea7d1f7bb9ddcef1559df660b2 upstream.

In drivers/cdrom/cdrom.c mmc_ioctl_cdrom_read_data() allocates a memory
area with kmalloc in line 2885.

  2885         cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
  2886         if (cgc->buffer == NULL)
  2887                 return -ENOMEM;

In line 2908 we can find the copy_to_user function:

  2908         if (!ret && copy_to_user(arg, cgc->buffer, blocksize))

The cgc->buffer is never cleaned and initialized before this function.
If ret = 0 with the previous basic block, it's possible to display some
memory bytes in kernel space from userspace.

When we read a block from the disk it normally fills the ->buffer but if
the drive is malfunctioning there is a chance that it would only be
partially filled.  The result is an leak information to userspace.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jonathan Salwan <jonathan.salwan@gmail.com>
Cc: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
charger-manager: Ensure event is not used as format string

commit 3594f4c0d7bc51e3a7e6d73c44e368ae079e42f3 upstream.

The exposed interface for cm_notify_event() could result in the event msg
string being parsed as a format string. Make sure it is only used as a
literal string.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Anton Vorontsov <cbou@mail.ru>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Anton Vorontsov <anton@enomsg.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
hpfs: better test for errors

commit 3ebacb05044f82c5f0bb456a894eb9dc57d0ed90 upstream.

The test if bitmap access is out of bound could errorneously pass if the
device size is divisible by 16384 sectors and we are asking for one bitmap
after the end.

Check for invalid size in the superblock. Invalid size could cause integer
overflows in the rest of the code.

Signed-off-by: Mikulas Patocka <mpatocka@artax.karlin.mff.cuni.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
block: do not pass disk names as format strings

commit ffc8b30866879ed9ba62bd0a86fecdbd51cd3d19 upstream.

Disk names may contain arbitrary strings, so they must not be
interpreted as format strings.  It seems that only md allows arbitrary
strings to be used for disk names, but this could allow for a local
memory corruption from uid 0 into ring 0.

CVE-2013-2851

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>