sysfs: fix race between readdir and lseek Date Wed, 20 Mar 2013 23:25:24 +0800

While readdir() is running, lseek() may set filp->f_pos as zero,
then may leave filp->private_data pointing to one sysfs_dirent
object without holding its reference counter, so the sysfs_dirent
object may be used after free in next readdir().

This patch holds inode->i_mutex to avoid the problem since
the lock is always held in readdir path.

Reported-by: Dave Jones <davej@redhat.com>
Tested-by: Sasha Levin <levinsasha928@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
modified for Mako Hybrid kernel from LKML reference

Signed-off-by: faux123 <reioux@gmail.com>
sysfs: handle failure path correctly for readdir() Date Wed, 20 Mar 2013 23:25:25 +0800

In case of 'if (filp->f_pos ==  0 or 1)' of sysfs_readdir(),
the failure from filldir() isn't handled, and the reference counter
of the sysfs_dirent object pointed by filp->private_data will be
released without clearing filp->private_data, so use after free
bug will be triggered later.
This patch returns immeadiately under the situation for fixing the bug,
and it is reasonable to return from readdir() when filldir() fails.

Reported-by: Dave Jones <davej@redhat.com>
Tested-by: Sasha Levin <levinsasha928@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
staging: android: ashmem: get_name,set_name not to hold ashmem_mutex Date Wed, 20 Feb 2013 23:41:26 +0530

Problem:
There exists a path in ashmem driver that could lead to acquistion
of mm->mmap_sem, ashmem_mutex in reverse order. This could lead
to deadlock in the system.
For Example, assume that mmap is called on a ashmem region
in the context of a thread say T1.
 sys_mmap_pgoff (1. acquires mm->mmap_sem)
  |
   --> mmap_region
 	|
         ----> ashmem_mmap (2. acquires asmem_mutex)
 Now if there is a context switch after 1 and before 2,
 and if another thread T2 (that shares the mm struct) invokes an
 ioctl say ASHMEM_GET_NAME, this can lead to the following path
ashmem_ioctl
  |
  -->get_name (3. acquires ashmem_mutex)
	|
	---> copy_to_user (4. acquires the mm->mmap_sem)
Note that the copy_to_user could lead to a valid fault if no
physical page is allocated yet for the user address passed.
Now T1 has mmap_sem and is waiting for ashmem_mutex.
and T2 has the ashmem_mutex and is waiting for mmap_sem
Thus leading to deadlock.
Solution:
Do not call copy_to_user or copy_from_user while holding the
ahsmem_mutex. Instead copy this to a local buffer that lives
in the stack while holding this lock. This will maintain data
integrity as well never reverse the lock order.

Testing:
Created a unit test case to reproduce the problem.
Used the same to test this fix on kernel version 3.4.0
Ported the same patch to 3.8

Signed-off-by: Shankar Brahadeeswaran <shankoo77@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
cpufreq: intellidemand: Set MIN_LATENCY_MULTIPLIER to 20

Currently MIN_LATENCY_MULTIPLIER is set defined as 100 and so on a system with
transition latency of 1 ms, the minimum sampling time comes to be around 100 ms.
That is quite big if you want to get better performance for your system.

Redefine MIN_LATENCY_MULTIPLIER to 20 so that we can support 20ms sampling rate
for such platforms.

Signed-off-by: faux123 <reioux@gmail.com>
usb: ks_bridge: Check for received data upon unlinking the urb

There is a possibility of runtime suspend in the middle of
data transfer on the rx data path of driver. This results in
the completion of data transfer on bulk IN endpoint with short
packet or integral multiple of 512 bytes. Hence for -ENOENT
transfer status check for non-zero data length and pass it to
the consumer in the userspace. Also, replace printk with
DBG-level message in driver suspend function and in rx
callback function for -EPROTO urb status.

Change-Id: Id7f9602e61e98f5bbd38c2f2f8121616b5661591
CRs-Fixed: 394954
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
usb: ks_bridge: Fix bug in partial read on data buffer

If driver copies only partial data buffer to user space
it does not update the buffer pointer. In this case
buffer pointer is still pointing to the already read
buffer and will be copied again in next read request
from user space. This corrupts the contents of the
efs file or ram dump files. Hence update data buffer
pointer with length of memory read completed by user
space.

(cherry picked from commit b48f4737ac62a5c26b59eea59322186179c06ab0)

Change-Id: Ibc2a248394b1fd3ece7cef6a94e99e27dc4f9575
CRs-Fixed: 403250
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
usb: ks_bridge: Fix memory leak in tx data path.

ks bridge is allocating urb to transmit data to mdm.
This urb is not getting freed after transmit completes.
Hence call usb_free_urb() after urb gets submitted
successfully. Urb will eventually be freed after tx
completion.

CRs-Fixed: 401536
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
(cherry picked from commit 1432f6f448bb2231499ef989f9e1ec314e9817d9)

Change-Id: I0ec244b6bff35aa1e59b39735ec867be39c4d221
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
usb: ks_bridge: Limit write size to 16KB

The user space application writes in 1MB chunks while loading MDM
images.  The current code allocate as many bytes as user space
passed to write system call.  These allocations are failing under
memory fragmentation scenario.  Hence limit write size to 16KB.

CRs-Fixed: 434638
(cherry picked from commit 7fcc7799af7ace4c4eda229b0eac6448f98d6637)

Conflicts:

	drivers/usb/misc/ks_bridge.c

Change-Id: I224cf201d724642f99e29874c4c5366ad773131e
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: ks_bridge: Avoid allocating large buffers in atomic context

The current code allocates a new Rx buffer in Rx completion handler.
Rx buffers are freed after user space consumes them.  This results in
allocating larger buffers in atomic context which may fail some times.
Don't queue the Rx buffer immediately. Defer it till user space consumes
it and reuse the same buffer.  The test results indicate no throughput
degradation.  The Rx buffers will be freed when interface is suspended
or disconnected.

CRs-Fixed: 430595
Change-Id: I8e69e27df2e11b38497e0384a8edd87ecedcb24b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
(cherry picked from commit 5c915c1949b79bc59d2b222bfcce02cd429619b2)
USB: ks_bridge: Fix PM usage counter mismatch

The runtime PM is disabled for a device during suspend.  It is
enabled again just before resuming  the device.  The resume method
of USB interface drivers are called while resuming a USB device.  As
USB device is the parent of an interface, the interface resume is
blocked till USB device resume is completed.  If interface driver
call any runtime PM API before interface runtime PM is enabled, it
fails with -EACCESS error.

The USB runtime wrapper usb_autopm_get_interface() decrements PM usage
counter when get_sync() is failed.  The current code is decrementing
the PM usage counter even when an error code is returned from
usb_autopm_get_interface().  Due to this double decrementing, the KS
bridge interface PM usage counter is becoming negative after several
suspend and resume cycles.  Once the PM usage counter becomes negative,
the interface runtime PM state will never become active.  That means,
USB device suspend can happen even when a Tx URB is pending from ks
bridge driver.

The fix is trivial.  Don't decrement PM usage counter when error code
is returned from usb_autopm_get_interface().

(cherry picked from commit 361d9af92470ebeeb0a42f73e6eb457ab279b282)

Conflicts:

	drivers/usb/misc/ks_bridge.c

CRs-Fixed: 437214
Change-Id: I96c9e1797c137cd158c424ebf6342f607cee6d78
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: ks_bridge: Fix memory leaks in the driver.

This change addresses two memory leaks:-
1) misc device is not getting deregistered during device
disconnect. Hence call misc_deregister() in disconnect.

2) Driver returns without freeing previous instances of
the driver data structure if memory allocation fails. Hence
free up memory allocated for ks_bridge structure.

Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
(cherry picked from commit da86bd2faa9cfbf065c7a1f0adba124d7e8335e0)

Conflicts:

	drivers/usb/misc/ks_bridge.c

Change-Id: I5e1c357fa29b455bae5f3dc71b4d65d5cc216bb3
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
usb: ks_bridge: Add support for autosuspend
usb: ks_bridge: Add support for multiple instance of driver

ks bridver needs to get loaded for two mdm9x15 device enumeration
to support flashless boot and efs sync.

Change-Id: Iabeab32f05592032b13ec6ab28da67093cc23531
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Shashank Mittal <mittals@codeaurora.org>
usb: ks_bridge: Free up stale buffers in probe

Driver can add data buffer to the link list of rx/tx
buffers after emptying the list during disconnect.
These stale buffers can confuse efs sync server when
mdm device connects back. Hence free up the rx/tx
buffers again during probe. Avoid further addition of
tx buffers after disconnect by checking device
connection status in write API. Also, move
misc_deregister() after cancelling the work in order
to remove device node early during disconnect to avoid
any write call further.

CRs-Fixed: 448142
Change-Id: Ifff58d2adc113257809eb80b7f91c1a0f4a0adeb
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: ks_bridge: Synchronize disconnect with ongoing IO

Following scenarios possible for interface disconnect racing
with ongoing IO:-

1) Interface disconnect setting interface pointer to NULL and
rx work is executing on other core dereferencing interface
pointer, causing kernel panic. Cancel a work and wait for it
to finish during disconnect.

2) Interface disconnect setting interface pointer to NULL and
tx completion running on other core dereferencing interface
pointer while calling usb_autopm_put_interface_async() API.
Check for USB_DEV_CONNECTED flag(cleared at the time of
disconnect) before dereferencing the interface pointer.

3) Interface unbound and driver is accessing already freed
interface pointer in tx completion or usb device pointer to
re-submit rx urb in rx completion. Add rx and tx urb pending
counters and wait for them to become zero (or timeout) during
disconnect.

CRs-Fixed: 448142
Change-Id: I50341173b94200bcfa60715b4b26b2117fc37c2c
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ks_bridge: Prevent freeing buffers while copy is in progress

The completed read buffers are added to to_ks_list in Rx URB
completion handler.  The buffer is deleted from this list by
reader process after copying to user space buffer.  If disconnect
happens during this copy, the buffer is freed from disconnect
context.  Hence detach the buffer from to_ks_list before copying
to user space buffer.

CRs-Fixed: 448142
Change-Id: Ia4484b2709065162b0d32782a30e2b2fd36f5fda
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ks_bridge: Enable autosuspend only for remote wakeup capable devices

USB core marks a device wakeup capable if it supports remote wakeup.
Check this wakeup capable flag before enabling autosuspend.

CRs-Fixed: 449100
Change-Id: I055bf5801859e4d83782916c71e0245c455becbf
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ks_bridge: Abort suspend when data is received during unlink

All the submitted URBs are unlinked during suspend.  Abort suspend
if data is received during unlink.  This avoids unnecessary suspend
and resume of remaining interfaces.

CRs-Fixed: 449097
Change-Id: Ia4009775ec29df0222b475581649c3a9f4f1899f
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
msm: rotator: Support Fast YUV for 8960, 8064 and 8x30 targets.

Add Fast YUV support in rotator for 8960, 8064 and 8x30 based
targets to improve performance for YUV 420P and 420PP inputs.

CRs-fixed: 415246
Change-Id: Ib4cbbd0fd45a82b8d409e7f52ae8bf8420b2c4eb
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
(cherry picked from commit 27147a768fc84d8819a83445fd5bb9f5c0d0627b)

Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>
wireless: add VHT (802.11ac) definitions

Add the VHT definitions to be used by drivers supporting it.

Signed-off-by: Mahesh Palivela <maheshp@posedge.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: ce0e169529a2db1cd910d2d45a5713fcdc29f6e1
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: Iccbc9c8c1f0182c93d2476fd520d6d8070c5acdf
Signed-off-by: Jeff Johnson <jjohnson@codeaurora.org>