mali: Don't trust length of dma_buf sg list

dma_buf returns a size of 4005 pages, but the sg list returned for it
has 4096 pages.

This isn't detected in kbase_jd_umm_map which happily overwrites it's
physical pages array, in this case scribbling 364 bytes beyond the end
of the buffer, possibly corrupting someones else's allocation.

Change-Id: Ia364dcbe001eb4b0aa30fd39ff2cd6d17d5ff7e0
net-fixes: flow_dissector: prevent an infinite loop (CVE-2013-4348)

Jason Wang found that a malicious packet could make skb_flow_dissect()
loop forever. We must check that IP header has a valid ihl to avoid
this loop. It involves IPIP encapsulation and ihl = 0 to trigger.

Given this bug is critical, I cooked a patch before having
a fix in upstream kernel.

Tested:

 Compiled/booted
 Ran some tests on bnx2x and explicitely disabled hardware provided rxhash
 ethtool -K eth1 rxhash off
 ethtool -K eth2 rxhash off

Google-Bug-Id: 11465355
Effort: net-fixes
Change-Id: I813e4dc48cecb05f8edfa218304e1f13fd764323
net: wireless: bcmdhd: Fix country checking

Bug: 11319610

Change-Id: I5c52ed594614d8039f167de3c98bd9f802b521df
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
net: wireless: bcmdhd: fixed power consumption issue of P2P.

	solution : add wake_lock not to go to suspend during removing P2P GO
	interface in wl_cfg80211.c.
	Description of this issue :
	if device goes to suspend during removing the interface,
	we will fail to remove P2P GO virtual
	interface(p2p-p2p0-0).
	This will causes P2P GO still alive in firmware
	Bugnizer case id : 10874302
	This issue is reported by LG team.
Signed-off-by: Ecco Park <eccopark@broadcom.com>
net: wireless: bcmdhd: Fixed a problem of buganizer issue (11190960)

	Problem : if PNO scan occurs in Driver after p2p scan,
		  we failed to do PNO scan
	Root cause : In the wl_run_escan function, we still goes into
	p2p scan code even though current scan is PNO which is kind of
	legacy scan.

	Solution : we need to clear the staus of P2P scan before doing
	PNO SCAN.

Signed-off-by: Ecco Park <eccopark@broadcom.com>
net: wireless: bcmdhd: reduced the wakelock time of RX packet

	Reduce time : 1secs -> 500ms
	Problem : [Issue 11512235] 34% battery eaten overnight
		  [Issue 11374623] OS + Wifi used 41% of battery,
		  wlan_rx_wake
Signed-off-by: Ecco Park <eccopark@broadcom.com>
net: wireless: bcmdhd: cancel current PNO if connection will happen

	Issue : Manta: Lack of WLS causes PNO problem
	Problem : we found that race condition happens
		between connection and PNO sometimes.
		Connection is failed due to this race condition.
	Solution: we need to cancel PNO explicitly if the connection
	request start in DHD driver.
	Bug : 11174374
Signed-off-by: Ecco Park <eccopark@broadcom.com>

Change-Id: I7bf81d127901a74e9f47d6cc4ee7b265c6936dc3
net: wireless: bcmdhd: Change DTIM skip policy in suspend

	issue : WiFi continuously disconnects
	Root cause :
	Sometimes we got link down event due to beacon
	lost when device goes to suspend.
	This problem sometimes happens in case that DTIM is 3 and beacon
	100ms because we wake up on 900ms (100ms * 3 * 3) during
	suspend.
	This value(900ms) is too big to STA for sync up with AP time.
	This causes STA out of sync for time with the AP.
	Eventually STA got lost of beacon during long time (4secs).

	Solution :
	If the total dtim skip interval (beacon_interval *
	DTIM * 3) is greater than 300ms, we will not extend DTIM to DTIM
	* 3.
	Instead of that, we will use original value (DTIM) for wake up
	in suspend.
	Bug : 1343127 WiFi continuously disconnects

Signed-off-by: Ecco Park <eccopark@broadcom.com>

Change-Id: I6d89bd1c56127befe4d9606869396ee25b7911ef
mali: Fix waiting_soft_jobs list corruption during zap context.

Bug: 8700991
Change-Id: Iee677a32f16926f3802c65e2b13881fc211efb02
net: wireless: bcmdhd: enable TDLS_auto_mode

	Requirement :
	1. enable auto mode for SETUP request
	2. disable auto mode for TEARDOWN request
	bug : 11632025 TDLS hybrid mode support

Change-Id: Idc0cb60e65a45bb32b8beb2bb3daf72c9112eab6
Signed-off-by: Ecco Park <eccopark@broadcom.com>
Enable CONFIG_NETFILTER_XT_TARGET_TCPMSS

Bug: 11579326
Change-Id: I22ad7ea859cff5191b41c7a6b83d547881fbe024