USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared

USB controller may access the dTD one more time after clearing the active
bit in token field.  There is a possibility of software freeing it in this
window.  When this happens, USB controller may access incorrect memory and
leads to system level issues.

dTDs are freed when requests are freed by function drivers during
disconnect or unbind.  The above race condition will come into effect only
for zero length packets.  dTDs are dynamically created for sending zero
length packets on IN endpoints.  These dTDs are immediately freed after
active bit is cleared.  Defer this to next dTD completion.  It is safe to
assume that hardware will no longer access the previous dTD when the next
dTD is completed.

Don't allocate/free setup status phase and GET_STATUS data phase requests
dynamically.  Use  one request for both cases and allocate it during bind.

CRs-Fixed: 474557
Change-Id: I5d41c310e1bb35d93b5af7d90a24ce5aab24f5f9
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Merge "USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared"
signal: always clear sa_restorer on execve

When the new signal handlers are set up, the location of sa_restorer is
not cleared, leaking a parent process's address space location to
children.  This allows for a potential bypass of the parent's ASLR by
examining the sa_restorer value returned when calling sigaction().

Based on what should be considered "secret" about addresses, it only
matters across the exec not the fork (since the VMAs haven't changed
until the exec).  But since exec sets SIG_DFL and keeps sa_restorer,
this is where it should be fixed.

Given the few uses of sa_restorer, a "set" function was not written
since this would be the only use.  Instead, we use
__ARCH_HAS_SA_RESTORER, as already done in other places.

Example of the leak before applying this patch:

  $ cat /proc/$$/maps
  ...
  7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  $ ./leak
  ...
  7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  1 0 (nil) 0x7fb9f30b94a0
  2 4000000 (nil) 0x7f278bcaa4a0
  3 4000000 (nil) 0x7f278bcaa4a0
  4 0 (nil) 0x7fb9f30b94a0
  ...

[akpm@linux-foundation.org: use SA_RESTORER for backportability]
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Emese Revfy <re.emese@gmail.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Julien Tinnes <jln@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: I7ae396ee90c2339c86f7b773d15f5571f8fd54c5
Signed-off-by: Goberu Gopal <ggober@codeaurora.org>
Merge "signal: always clear sa_restorer on execve"
msm: audio: qdsp6v2: Add size safety check to ACDB driver

Check that the size sent by userspace is not larger
then the internal amount allowed. This protects
against overflowing the stack due to an invalid size.

Change-Id: I8230fdb00a7b57d398929e8ab0eb6587476f3db1
CRs-fixed: 470222
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
crypto: Fix HMAC failure

Incorrect HMAC values are generated in following scenarios.

- In case of a single transfer with a packet shorter than the
block size, the HMAC generated is incorrect. This is due to
the "FIRST" bit in AUTH_CFG register not being set.  When calling
HMAC_final for a transfer with a single packet (with no prior HMAC
updates), the "FIRST" and "LAST" bit in AUTH_CFG register needs to
be set. Currently FIRST bit is being cleared incorrectly for all
scenarios.

- In a scenario of a mac key input larger than block size, the key
needs to be hashed. The key hashing operation is crashing. This is
due to a NULL, unintialized pointer to the device handle. This is
fixed by intializing the pointer correctly. Further more, key size
is uninitialized, resulting in corruption of buffer.

Change-Id: Iec736f2130e509fcaf631a2c71c5483514666617
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
crypto: Add wait states for hash/hmac operations

Currently, hash (SHA1/256/hmac) operation occasionally results
in an incorrect hash value. This is due to the premature reading
of the AUTH_IV register done before the last SHA block is processed.
There needs to be enough delay (wait states) before the AUTH_IV
register is read to extract the hash value.

The current implementation has 2 wait states. Adding 2 more wait states
for hash operations, resolves the issue.

The wait states are calculated based on the inputs from the hardware
team with regards to the time taken to process the last block of 16
bytes of the data packet.

Change-Id: I4f9e784fbfca62d6636d87dc44c1bf9992e3b3e4
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Merge "crypto: Fix HMAC failure"
Merge "crypto: Add wait states for hash/hmac operations"
crypto: Fix potential crash due to unbound array & null pointer access.

Fix the null pointer errors and valid index checking for arrays to
fix potential kernel crash.

Change-Id: Iabf7f73dcfe5a544e3fe83f1e67ec1161f989fac
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>

Conflicts:

	drivers/crypto/msm/qcedev.c

Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>

Conflicts:

	drivers/crypto/msm/qcedev.c

Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>
Merge "crypto: Fix potential crash due to unbound array & null pointer access."
android/lowmemorykiller: Check all tasks for death pending

The lowmemorykiller uses the TIF_MEMDIE flag to help ensure it doesn't
kill another task until the memory from the previously killed task has
been returned to the system.

However the lowmemorykiller does not currently look at tasks who do not
have a tasks->mm, but just because a process doesn't have a tasks->mm
does not mean that the task's memory has been fully returned to the
system yet.

In order to prevent the lowmemorykiller from unnecessarily killing
multiple applications in a row the lowmemorykiller has been changed to
ensure that previous killed tasks are no longer in the process list
before attempting to kill another task.

Change-Id: I147257d31f32d817e10eac01ea6943f1c4a8a70d
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Signed-off-by: Susheel Khiani <skhiani@codeaurora.org>
android/lowmemorykiller: Wait for memory to be freed

The memory reclaim code needs to give time to the system to
return the memory from a killed process otherwise the memory
reclaim code could run continuously, in multiple threads,
which could starve both the watchdog thread and the thread
which is responsible for returning the memory from the
killed process.

Change-Id: I7687a16a1ba7f97259eda976548c810c97e742cc
CRs-fixed: 484900
Signed-off-by: Liam Mark <lmark@codeaurora.org>
[To remove merge conflict]
Signed-off-by: Susheel Khiani <skhiani@codeaurora.org>
android/lowmemorykiller: Ignore tasks with freed mm

A killed task can stay in the task list long after its
memory has been returned to the system, therefore
ignore any tasks whose mm struct has been freed.

Change-Id: Ib7bb857bd717e150221952b13349adc15e5bafd1
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Signed-off-by: Susheel Khiani <skhiani@codeaurora.org>
Merge "android/lowmemorykiller: Check all tasks for death pending"
Merge "android/lowmemorykiller: Wait for memory to be freed"
Merge "android/lowmemorykiller: Ignore tasks with freed mm"
usb: gadget: u_bam: Enable zero length packet for tx transfers

Avoid packet re-transmission/drop by sending zero length packet
when usb transfer is multiple of usb endpoint max packet size.

CRs-Fixed: 494184
Change-Id: I01c9f9be41d3b64760e9bc08ec82ef8b6cc1a80f
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
Merge "usb: gadget: u_bam: Enable zero length packet for tx transfers"
Merge "msm: audio: qdsp6v2: Add size safety check to ACDB driver"