ALSA: core: Fix crash by avoiding appl_ptr crossing 32-bit boundary

Incase of A2DP usecase using proxy driver, appl_ptr has
boundary value as 0x60000000 frames in sw_params for stereo(2 channels).
When this value crosses 0x40000000, then userspace calculating
appl_ptr at bytes results in crossing 32-bit value 0x100000000,
and points to 0x0 offset which can result in crash or pop.
To avoid above scenario, set the sw_params appl_ptr boundary value
within 0x40000000. Added proper check at sw_params update
to set this value correctly within 32-bit boundary(frames).

Change-Id: I537a04156699d90549a0a468ae19539ecd552d3b
CRs-Fixed: 483203
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
msm: kgsl: Don't refer the NULL context

This fix ensure the BIRT test case will not
cause any device crash.

Change-Id: Ibbcdca293f4da05b21d16674f605aac729905959
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: display: Handle mixer stage commit for wfd correctly

If no dequeue buffer is present, do not return early as commit
call still needs to take care of  mixer staging and stage commit.
Early return of commit, results in pipe still staged errors since,
mixer stage and commit gets bypass.

Change-Id: I1aa7dc9e95d183b22739daae123cf7818afbeadd
CRs-Fixed:523959
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
sock_diag: Fix out-of-bounds access to sock_diag_handlers[]

Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.

CRs-fixed: 519050
Change-Id: I1466c4f56f3f4df90cf8a1ae17afa80c89b813e8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit: 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS

The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.

This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.

[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]

CRs-Fixed: 504011
Change-Id: I3818045a136fcdf72deb1371b132e090fd7ed643
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 8404663f81d212918ff85f493649a7991209fa04
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
input: touchscreen: Change the file system permission of synaptic driver

The following sysfs files of synaptic driver has "write"
permissions : forceflash, doreflash and full_pm_cycle
Change them to "read" only.

CRs-Fixed: 523129
Change-Id: I2bd46434d92bc0a935256ef258fbfb5750914fd2
Signed-off-by: Ajay Raghothama <ajayr@codeaurora.org>
seq_file: Allocate memory using vmalloc when kmalloc failed

When dumpstate access /proc/xxx/binder, this binder include lots of info,
it will use seq_read in kernel, in this function, it will trigger
high order memory alloc, when read binder info or other large file,
this will cause memory presure when system don't have contious high order
memory, it will lead to high kswap workload to reclaim the page. so change
kmalloc to vmalloc, it can avoid contiously high order memory allocating.

CRs-fixed: 514982

Change-Id: I463d5f72c24b7bb298e14b0da49c5fc96091ecc1
Patch-mainline: linux-arm-kernel(lkml) @ Thu, 31 Jan 2013 14:11:32 +0800
Link : https://lkml.org/lkml/2013/1/31/20
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
defconfig: enable selinux
cpufreq: used input mediator also for ondemand and interactive
cpufreq: smartmax: calculate load only for current cpu

We are changing frequencies for every cpu separate on their load
so why calculated the load for all cpus everytime?
smartmax: disable input boost on suspend
cpuquiet: disable input boost on suspend
msm: kgsl: Always Signal event time timeline for every event type

Fence sync seems to react badly when it gets a unexpected timestamp
on a timeline.  When a event expires always send the expected timestamp
even if the event expired because the context was destroyed.

Change-Id: Id1bc18220223c665012df1db21eea78af78d9288
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
mm: Don't use CMA page for file cache

Despite the best efforts of redirection, the file system may still
allocate CMA pages with references held for long periods of time.
If a CMA page ends up being allocated, free it and get a non-CMA page.

Change-Id: I2001151a2936a6d0780d223dda85a87c04ddb8c6
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
msm: kgsl: Configure FT behaviour from sysfs instead of debugfs

FT behaviour is changed to be configured from sysfs
instead of debugfs. Sysfs control gives us the advantage
of configuring FT at bootup and also across bootups.
Persistant configuration across bootups helps
testing by configuring FT once and testing the FT
config across bootups.

Conflicts:

	drivers/gpu/msm/adreno.h
	drivers/gpu/msm/adreno_debugfs.c

Change-Id: Ia3378f214371a6a4b9f205f9f884976f58585971
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Allocate space in ringbuffer for EOF commands

When userspace passes end of frame (EOF) flag, ringbuffer is
inserted with EOF marker commands. Allocate ringbuffer space
for EOF marker commands.

CRs-Fixed: 469807
Change-Id: I7de8d1b81d358a8d8753ac84fbdceddad27bb17d
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
input: atmel_mxt_ts: disable/enable IRQ on suspend/resume.

Disable IRQ in suspend and enable IRQ in resume function
to remove the appearance of old touch data after suspend
and to fix the sticky touch problem.

CRs-Fixed: 526552
Change-Id: Ia6e7823a4a5615b2bc5209e8b3425b52827161de
Signed-off-by: Sarada Prasanna Garnayak <c_sgarna@codeaurora.org>
Slim_msm: Wait for reconfig sequence to complete

Wait for current reconfiguration to complete during
reconfigure_now sequnce. Earlier we are not waiting
for reconfiguration done interrupt after sending the
reconfiguration message to the slimus hardware. This
may lead to hardware synchronization issues in lower
slimbus clock frequencies.

In this patch we are waiting for the reconfiguration
done interrupt from slimbus hardware.

CRs-Fixed: 490022
Change-Id: If0126dac9a1ad2d931e9a0e345d19559fe36f67a
Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>
usb: gadget: Register RMNET SMD control channel only on protocol connect

The RMNET USB function driver uses SMD channel for transmitting control
messages to the modem processor. Move the registration of the platform
driver which handle the SMD channel to the stage in which the RMNET
function driver is actually got activated by the host which selected
the configuration which contain the RMNET function driver.

This fix is required to prevent cases in which other protocols, as
MBIM for example, which exists in other USB configuration, may need
the same SMD channel which is occupied by the RMNET, since the RMNET
grab the channel on initialization of the function driver rather than
upon activating it.

CRs-Fixed: 435979
Change-Id: I40667c83ca6ff6402a8d6f69a62f1dc42bd265d0
Signed-off-by: Ido Shayevitz <idos@codeaurora.org>
Signed-off-by: Tarun Gupta <tarung@codeaurora.org>
msm: hdmi: NUL-terminate spd data

NUL-terminate SPD Vendor name and SPD
Product description data stored in the
control structure of hdmi driver. This
avoids overflows in print messages and info
frames.

Change-Id: Ib3fcf35c6e82af18089ebea213e20b0bc0182661
CRs-Fixed: 520148
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>