printk: fix buffer overflow when calling log_prefix function from call_console_drivers

This patch corrects a buffer overflow in kernels from 3.0 to 3.4 when calling
log_prefix() function from call_console_drivers().

This bug existed in previous releases but has been revealed with commit
162a7e7500f9664636e649ba59defe541b7c2c60 (2.6.39 => 3.0) that made changes
about how to allocate memory for early printk buffer (use of memblock_alloc).
It disappears with commit 7ff9554bb578ba02166071d2d487b7fc7d860d62 (3.4 => 3.5)
that does a refactoring of printk buffer management.

In log_prefix(), the access to "p[0]", "p[1]", "p[2]" or
"simple_strtoul(&p[1], &endp, 10)" may cause a buffer overflow as this
function is called from call_console_drivers by passing "&LOG_BUF(cur_index)"
where the index must be masked to do not exceed the buffer's boundary.

The trick is to prepare in call_console_drivers() a buffer with the necessary
data (PRI field of syslog message) to be safely evaluated in log_prefix().

This patch can be applied to stable kernel branches 3.0.y, 3.2.y and 3.4.y.

Without this patch, one can freeze a server running this loop from shell :
  $ export DUMMY=`cat /dev/urandom | tr -dc '12345AZERTYUIOPQSDFGHJKLMWXCVBNazertyuiopqsdfghjklmwxcvbn' | head -c255`
  $ while true do ; echo $DUMMY > /dev/kmsg ; done

The "server freeze" depends on where memblock_alloc does allocate printk buffer :
if the buffer overflow is inside another kernel allocation the problem may not
be revealed, else the server may hangs up.

Signed-off-by: Alexandre SIMON <Alexandre.Simon@univ-lorraine.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
3.0.66
msm: rotator: clear rotator bus scale handler

rotator bus client will be not registered again without handler reset.

Change-Id: Id35c4e5ad481d0a4401bdb3ee4628ffa9a891467
Signed-off-by: Huaibin Yang <huaibiny@codeaurora.org>
Disable mDNS completely due to excessive wakelock: from madmack
Make the unicast filter work with IPv6: from madmack
Filter out all packets except unicast and mDNS
video: msm: Cleanup a bad merge

Change-Id: I02269a7a02880b3b8eadb47d441ef961d5a6cbde
crypto: Fix HMAC failure

Incorrect HMAC values are generated in following scenarios.

- In case of a single transfer with a packet shorter than the
block size, the HMAC generated is incorrect. This is due to
the "FIRST" bit in AUTH_CFG register not being set.  When calling
HMAC_final for a transfer with a single packet (with no prior HMAC
updates), the "FIRST" and "LAST" bit in AUTH_CFG register needs to
be set. Currently FIRST bit is being cleared incorrectly for all
scenarios.

- In a scenario of a mac key input larger than block size, the key
needs to be hashed. The key hashing operation is crashing. This is
due to a NULL, unintialized pointer to the device handle. This is
fixed by intializing the pointer correctly. Further more, key size
is uninitialized, resulting in corruption of buffer.

Change-Id: Iec736f2130e509fcaf631a2c71c5483514666617
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
ext4: prevent kernel panic in case of uninitialized jinode

In some cases the kernel crash occurs during system suspend/resume:

[ 4095.041351] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 4095.050689] pgd = c0004000
[ 4095.053985] [00000000] *pgd=00000000
[ 4095.058807] Internal error: Oops: 5 [#1] PREEMPT SMP
[ 4095.064483] Modules linked in: wl12xx mac80211 pvrsrvkm_sgx540_120 cfg80211 compat [last unloaded: wl12xx_sdio]
[ 4095.064575] CPU: 1    Tainted: G    B        (3.0.31-01807-gfac16a0 #1)
[ 4095.064605] PC is at jbd2_journal_file_inode+0x38/0x118
[ 4095.064666] LR is at mpage_da_map_and_submit+0x48c/0x618
[ 4095.064697] pc : [<c01da5a8>]    lr : [<c01aeac0>]    psr: 60000013
[ 4095.064697] sp : c6e07c80  ip : c6e07ca0  fp : c6e07c9c
[ 4095.064727] r10: 00000001  r9 : c6e06000  r8 : 00000179
[ 4095.064758] r7 : c6e07ca0  r6 : c73b8400  r5 : 00000000  r4 : c59a7d80
[ 4095.064758] r3 : 00000038  r2 : 00000800  r1 : 00000000  r0 : c7754fc0
[ 4095.064788] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
[ 4095.064819] Control: 10c5387d  Table: 86cc804a  DAC: 00000015
[ 4095.064849]
[ 4095.064849] PC: 0xc01da528:
[ 4095.064880] a528  0a000003 e3a05000 e1a00005 e24bd020 e89da9f0 e5951010 e3e06000 e14b22dc
.....
[ 4095.070373] 7fe0: c00a48ac 00000013 00000000 c6e07ff8 c00a48ac c00c0a94 84752f09 60772177
[ 4095.070404] Backtrace:
[ 4095.070465] [<c01da570>] (jbd2_journal_file_inode+0x0/0x118) from [<c01aeac0>] (mpage_da_map_and_submit+0x48c/0x618)
[ 4095.070495]  r7:c6e07ca0 r6:c6e07d00 r5:c6e07d90 r4:c7754fc0
[ 4095.070556] [<c01ae634>] (mpage_da_map_and_submit+0x0/0x618) from [<c01af40c>] (ext4_da_writepages+0x2a4/0x5c8)
[ 4095.070617] [<c01af168>] (ext4_da_writepages+0x0/0x5c8) from [<c0112af4>] (do_writepages+0x34/0x40)
[ 4095.070678] [<c0112ac0>] (do_writepages+0x0/0x40) from [<c01645a4>] (writeback_single_inode+0xd4/0x288)
[ 4095.070709] [<c01644d0>] (writeback_single_inode+0x0/0x288) from [<c0164ed4>] (writeback_sb_inodes+0xb4/0x184)
[ 4095.070770] [<c0164e20>] (writeback_sb_inodes+0x0/0x184) from [<c01655a0>] (writeback_inodes_wb+0xc4/0x13c)
[ 4095.070831] [<c01654dc>] (writeback_inodes_wb+0x0/0x13c) from [<c01658f0>] (wb_writeback+0x2d8/0x464)
[ 4095.070861] [<c0165618>] (wb_writeback+0x0/0x464) from [<c0165cb8>] (wb_do_writeback+0x23c/0x2c4)
[ 4095.070922] [<c0165a7c>] (wb_do_writeback+0x0/0x2c4) from [<c0165df4>] (bdi_writeback_thread+0xb4/0x2dc)
[ 4095.070953] [<c0165d40>] (bdi_writeback_thread+0x0/0x2dc) from [<c00c0b18>] (kthread+0x90/0x98)
[ 4095.071014] [<c00c0a88>] (kthread+0x0/0x98) from [<c00a48ac>] (do_exit+0x0/0x72c)
[ 4095.071044]  r7:00000013 r6:c00a48ac r5:c00c0a88 r4:c78c7ec4
[ 4095.071105] Code: e89da8f0 e5963000 e3130002 1afffffa (e5913000)
[ 4095.071166] ---[ end trace 7fe9f9b727e5cf78 ]---
[ 4095.071197] Kernel panic - not syncing: Fatal exception

The probably reason of such behaviour is an inode opened in READ mode
has been marked as 'dirty' somehow and written back by ext4_da_writepages.
Cause jinode == NULL it could lead to the kernel panic.

The patch prevents kernel panic and helps to investigate the problem
providing an inode number.

Change-Id: I1d77a011b580db682b8e2d122ef3d5e44e0ce5c7
Signed-off-by: Volodymyr Mieshkov <volodymyr.mieshkov@ti.com>
msm_serial_hs_lite: Write NCF when initializing the console

The console TX path does not write NCF until after TX_READY
is asserted, meaning that the wait_for_xmitr path could be
polling on a ready bit dictated by the last NCF value set
by the bootloader.

Change-Id: I6d7c9c2610e67d5d84dd2e9b84ee29f94ba4d180
Signed-off-by: Stepan Moskovchenko <stepanm@codeaurora.org>
msm: usbaudio: Add support for USB headset detection

 - During bootup, create a file system storing the
   information about usb device state and name, and
   broadcast the message to userspace whenever the
   device is plugged or unplugged.

 - Register the device at USB sound card initialization
   for creating file system and toggle the state in that
   filesystem when USB is plugged/unplugged. This will
   also send a message to user space informing it about
   state change.

Change-Id: Icd78273bb765a26bbc70725afebe8955de8f7315
Signed-off-by: Harmandeep Singh <hsingh@codeaurora.org>
msm: usbaudio: Fix memory allocation for USB audio module init

Fix memory allocation issue in snd_usb_audio_init()
use sizeof(struct) insead of sizeof(pointer)

Change-Id: I270bbd7111e97dd4e0e92378f61d5025e16f5fca
Signed-off-by: Alex Fradkin <afradkin@codeaurora.org>
qseecom: Fix kernel panic

When qseecom_unload_app() is invoked, wait_event_freezable() is called
in an atomic context (within a spinlock).  wait_event_freezable() allows
sleep and should not  be called in an atomic context where sleep is not
allowed.

Change-Id: I8c9c6d28f9e492fbbf2ac74a5ee3d1067c7733ad
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>

Conflicts:

	drivers/misc/qseecom.c
qseecom:  Fix failure to release qseecom handle

qseecom_release() returns a failure, if it is unable to find
app_id of zero, associated with the handle in the app list.

There exists scenarios where the handle may not have the
app_id initialized and remain to be 0.  In these scenarios,
once the uninitialized zero app_id is not found in the list,
it returns a failure.

Fix to this is look for non-zero valid app_id in the app_list when
releasing the handle.

Change-Id: I7b6489526da57cd2106f4aae9fdc0547e7a5fe86
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
msm: rotator: Support Fast YUV for 8960, 8064 and 8x30 targets.

Add Fast YUV support in rotator for 8960, 8064 and 8x30 based
targets to improve performance for YUV 420P and 420PP inputs.

CRs-fixed: 415246
Change-Id: Ib4cbbd0fd45a82b8d409e7f52ae8bf8420b2c4eb
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
Revert "msm_fb: display: blt always enabled for 720p,1080p, secure buf"

This reverts commit cb76956b1bdde5475914eb57fd2fe0c952609c10.
msm_fb: display: clean pipes from commit queue at suspend

There has possibility that pipes pending at queue and suspend
comes without commit executed. At resume, pipes pending at queue
will be committed with new pipes just added which may cause iommu
page fault due to pipes may had been move to other mixer. This
patch remove pipes from pending queue at suspend.

CRs-fixed: 440254
Change-Id: If6a142d4c55453c0ceacc677399f58570abe47b8
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Merge tag 'v3.0.66' into jb-mr1

This is the 3.0.66 stable release

* tag 'v3.0.66':
  3.0.66
  printk: fix buffer overflow when calling log_prefix function from call_console_drivers