check for skb headroom for packets out rmnet/bam interfaces

When packets destined out a rmnet/bam interface are sourced via the tun
interface, the skb has no headroom. This change checks for the no-headroom case
and uses skb_realloc_headroom

Without this patch, you get (panic+reboot):
[ 1522.386601] skb_under_panic: text:c0124e98 len:88 put:8 head:e077d800 data:e077d7f8 tail:0xe077d850 end:0xe077d880 dev:rmnet0
[ 1522.404028]I[0:          clatd: 7740] kernel BUG at /home/jenkins/android/workspace/android/jellybean/kernel/samsung/d2/net/core/skbuff.c:147!
...
[ 1524.974454]I[0:          clatd: 7740] Rebooting in 5 seconds..
[ 1529.990507]I[0:          clatd: 7740] Going down for restart now
msm: display: fb blend setting via MSMFB_METADATA_SET ioctl

MSMFB_METADATA_SET ioctl is added for the fb user to pass
in additional infomation rather than using reserved
fields.
User can set pre-multiplied alpha for the frame buffer via this
ioctl, overlay blend setting will take this into account.

Change-Id: Ic2f6236d84691fb03174ec479874c6928489ea30
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
msm_fb: display: check pipes queued before enter wait_for_completion

Timing generator will not be turned on if there are no pipes queued.
Therefore wait_for_completion may never be completed if there have
no pipes queued.

Change-Id: Iafba086e4ba20b31470c9fd385c4f5c474ecadcf
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Signed-off-by: Mayank Goyal <goyalm@codeaurora.org>
msm_fb: display: free borderfill pipe when ref_cnt reach 0

Borderfill pipe need to be kept as baselayer which is not
suppose to be freed at suspend. It only be freed when
ref_cnt reach 0 by "adb stop".

CRs-fixed: 429196
Change-Id: Ibffe7960cc194162d1ba71e8dc8636393938483f
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
msm_fb: Fix blending logic for formats with per-pixel alpha

Currently if a layer with per-pixel alpha (eg. RGBA) is fed
for composition with z-order as zero (FG), per-pixel alpha
blending is applied along with the BG frame present on frame
buffer and hence we see the previous frame on the panel. Hence,
apply constant alpha blending if these formats are fed as FG.

CRs-fixed: 405802
CRs-fixed: 435800
Change-Id: I4e00743e7f13189b1830d4d0e655f186ffa590cd
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
Revert "Revert "msm_fb: Clear real pipe attributes in the pipe free""

This reverts commit 06a5cd870e8b0ac6080a20aa4ac8da2599020662.
video: msm: Fix bus bandwidth calculation for Samsung's panel

 * The panel device on D2 requires significantly larger MDP bandwidth in
   order for underrun not to occur. Raise the factor by 3x in order to
   get rid of flickering.
 * Thanks to noobnl for finding the root cause.

Change-Id: Iad68e7dae5896467340bbe9cc53901cf365b14d0
video: msm: Remove logspam

Change-Id: I02df48181ece375c7f24223c0a2cbe3aa8594003
Merge "check for skb headroom for packets out rmnet/bam interfaces" into cm-10.1
cpufreq: interactive: don't handle transition notification if not enabled

If multiple governors are in use then avoid processing frequency transition
notifications for CPUs on which the interactive governor is not enabled.

Change-Id: Ibd75255b921d887501a64774a8c4f62302f2d4e4
Reported-by: Francisco Franco <francisco.franco@cloudcar.com>
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: fix deadlock on spinlock in timer

Need to use irqsave/restore spinlock calls to avoid a deadlock in calls
from the timer.

Change-Id: I15b6b590045ba1447e34ca7b5ff342723e53a605
Signed-off-by: Todd Poynor <toddpoynor@google.com>
cpufreq: interactive: fix race on governor start/stop

There is race condition when both two cpu do CPUFREQ_GOV_STOP and one cpu
do CPUFREQ_GOV_START soon. The sysfs_remove_group is not done yet on one
cpu, but sysfs_create_group is called on another cpu, which cause governor
start failed and then kernel panic in timer callback because the policy and
cpu mask are all kfree in cpufreq driver.

Replace atomic with mutex to lock the whole START/STOP sequence.

Change-Id: I3762b3d44315ae021b8275aca84f5ea9147cc540
Signed-off-by: Lianwei Wang <a22439@motorola.com>
bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices.

[ Upstream commit 0e376bd0b791ac6ac6bdb051492df0769c840848 ]

Patch sets the lowest gso_max_size and gso_max_segs values of the slave devices during enslave and detach.

Signed-off-by: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
bonding: fix race condition in bonding_store_slaves_active

[ Upstream commit e196c0e579902f42cf72414461fb034e5a1ffbf7 ]

Race between bonding_store_slaves_active() and slave manipulation
 functions. The bond_for_each_slave use in bonding_store_slaves_active()
 is not protected by any synchronization mechanism.
 NULL pointer dereference is easy to reach.
 Fixed by acquiring the bond->lock for the slave walk.

 v2: Make description text < 75 columns

Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails

[ Upstream commit be364c8c0f17a3dd42707b5a090b318028538eb9 ]

Trinity (the syscall fuzzer) discovered a memory leak in SCTP,
reproducible e.g. with the sendto() syscall by passing invalid
user space pointer in the second argument:

 #include <string.h>
 #include <arpa/inet.h>
 #include <sys/socket.h>

 int main(void)
 {
         int fd;
         struct sockaddr_in sa;

         fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/);
         if (fd < 0)
                 return 1;

         memset(&sa, 0, sizeof(sa));
         sa.sin_family = AF_INET;
         sa.sin_addr.s_addr = inet_addr("127.0.0.1");
         sa.sin_port = htons(11111);

         sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa));

         return 0;
 }

As far as I can tell, the leak has been around since ~2003.

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall

[ Upstream commit 6e51fe7572590d8d86e93b547fab6693d305fd0d ]

Consider the following program, that sets the second argument to the
sendto() syscall incorrectly:

 #include <string.h>
 #include <arpa/inet.h>
 #include <sys/socket.h>

 int main(void)
 {
         int fd;
         struct sockaddr_in sa;

         fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/);
         if (fd < 0)
                 return 1;

         memset(&sa, 0, sizeof(sa));
         sa.sin_family = AF_INET;
         sa.sin_addr.s_addr = inet_addr("127.0.0.1");
         sa.sin_port = htons(11111);

         sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa));

         return 0;
 }

We get -ENOMEM:

 $ strace -e sendto ./demo
 sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 ENOMEM (Cannot allocate memory)

Propagate the error code from sctp_user_addto_chunk(), so that we will
tell user space what actually went wrong:

 $ strace -e sendto ./demo
 sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EFAULT (Bad address)

Noticed while running Trinity (the syscall fuzzer).

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ne2000: add the right platform device

[ Upstream commit da9da01d9199b5bb15289d0859053c9aa3a34ac0 ]

Without this udev doesn't have a way to key the ne device to the platform
device.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
irda: sir_dev: Fix copy/paste typo

[ Upstream commit 2355a62bcbdcc4b567425bab036bfab6ade87eed ]

Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb/ipheth: Add iPhone 5 support

[ Upstream commit af1b85e49089f945deb46258b0fc4bc9910afb22 ]

I noticed that the iPhone ethernet driver did not support
iPhone 5. I quickly added support to it in my kernel, here's
a patch.

Signed-off-by: Jay Purohit <jspurohit@velocitylimitless.com>
Acked-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
Signed-off-by: Jan Ceuleers <jan.ceuleers@computer.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
pnpacpi: fix incorrect TEST_ALPHA() test

commit cdc87c5a30f407ed1ce43d8a22261116873d5ef1 upstream.

TEST_ALPHA() is broken and always returns 0.

[akpm@linux-foundation.org: return false for '@' as well, per Bjorn]
Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>