msm: camera: Fix camera crash in msm_open_config

Add proper check before accessing mctl handle to
avoid camera crash.

Change-Id: I1413f086ab7d94fe223a814bb16867d1dcc0a4bf
CRs-Fixed: 481757
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
msm: camera: Fix camera crash when ctrl_q is empty

Add proper error condition if the list is empty and
return error value to upper layers instead of BUG_ON.

Change-Id: I89237e7a27d5fb1e1fd5f1a8a2dfd7ea9a1afff5
CRs-Fixed: 481759
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
signal: always clear sa_restorer on execve

When the new signal handlers are set up, the location of sa_restorer is
not cleared, leaking a parent process's address space location to
children.  This allows for a potential bypass of the parent's ASLR by
examining the sa_restorer value returned when calling sigaction().

Based on what should be considered "secret" about addresses, it only
matters across the exec not the fork (since the VMAs haven't changed
until the exec).  But since exec sets SIG_DFL and keeps sa_restorer,
this is where it should be fixed.

Given the few uses of sa_restorer, a "set" function was not written
since this would be the only use.  Instead, we use
__ARCH_HAS_SA_RESTORER, as already done in other places.

Example of the leak before applying this patch:

  $ cat /proc/$$/maps
  ...
  7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  $ ./leak
  ...
  7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  1 0 (nil) 0x7fb9f30b94a0
  2 4000000 (nil) 0x7f278bcaa4a0
  3 4000000 (nil) 0x7f278bcaa4a0
  4 0 (nil) 0x7fb9f30b94a0
  ...

[akpm@linux-foundation.org: use SA_RESTORER for backportability]
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Emese Revfy <re.emese@gmail.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Julien Tinnes <jln@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: I7ae396ee90c2339c86f7b773d15f5571f8fd54c5
Signed-off-by: Akhila Musunuri <makhila@codeaurora.org>
msm_fb: display: fix iommu page fault when iommu buffer freed

There has possibility that pipe commit come very close to next vsync.
This may cause two consecutive pipe_commits happen within same vsync
period which cause iommu page fault when previous iommu buffer is
freed since mdp stil fetching it. Set ION_IOMMU_UNMAP_DELAYED flag
at ion_map_iommu() to add delay un mapping iommu buffer to fix this problem.
Otherwise four buffer mechanism is needed to avoid this problem..
Also ion_unmap_iommu() may take long time to free an ion buffer. Move
mdp4_overlay_iommu_unmap_freelist(mixer) called after stage_commit()
to increase chance to have pipe_commit (up to stage_commit) is completed
within same vsync period
This patch also fix an potential race condition at wait_for_completion
between show_event thread and wait4vsync thread.

Change-Id: I673b0e368bbcd3120bc26569fe7a7bb82931daaa
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
(cherry picked from commit ada63be0fd32e729e4b91aeeea2a5cfe0830148c)
(cherry picked from commit 799796f15e0b78ffe47975db1cf7f3791cb98129)
Merge "msm: camera: Fix camera crash in msm_open_config"
Merge "msm: camera: Fix camera crash when ctrl_q is empty"
Merge "signal: always clear sa_restorer on execve"
Merge "msm_fb: display: fix iommu page fault when iommu buffer freed"