net: flow_dissector: fail on evil iph->ihl

We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
is evil (less than 5).

This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
(rps: support IPIP encapsulation).

Cc: Eric Dumazet <edumazet@google.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ondemand: add sysfs entry for down_diff_multi_core

This change adds sysfs entry for the ondemand governor's attribute
down_differential_multi_core. This is required to be able to program
this knob to attain better perf/power for use cases like camcorder.

CRs-fixed: 561456
Change-Id: Ib7c1223215c6b714c286c231ed37f3abfae741c6
Signed-off-by: Krishna Vanka <kvanka@codeaurora.org>
msm: mdp3: underflow color adjust support on 8x10

This adds the underflow color adjustment support on
8x10. Customer can order underflow color by modifying
the parameter in panel device tree.

Change-Id: I0660f35e3a0052e5a995256978f354cf30e76161
Signed-off-by: Shuo Yan <shuoy@codeaurora.org>
lib/scatterlist: error handling in __sg_alloc_table()

I was reviewing code which I suspected might allocate a zero size SG
table.  That will cause memory corruption.  Also we can't return before
doing the memset or we could end up using uninitialized memory in the
cleanup path.

Change-Id: Icee6be8ea22644d7f16264d9d2a0887c7145996b
CRs-Fixed: 611562
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Merge "lib/scatterlist: error handling in __sg_alloc_table()"
Merge "msm: mdp3: underflow color adjust support on 8x10"
mmc: core: fix block request queue hang during data crc errors

When data CRC errors occur during write transactions, mmc
block layer queries the card for successful writes. If the card
reports bytes requested as bytes successfully written, the mmc
block layer will end the request with blk_end_request(). If there
is a following async request pending for execution, the request
is thrown away while handling CRC errors leading to hang in
request queue. The hang is visible when user issues a sync()
system call.

The sequence of events are as follows -

mmcqd -> fetch a request -> send it to host driver -> fetch another
request -> wait for previous request to complete -> previous request
is in error -> skip sending current request to host driver and
do error handling for previous request in error.

During the last step, after error handling is completed the mmc
block layer does not requeue the current request which is skipped
and hence the request is infinitely stuck in the driver.

Change-Id: I9528fbe3ccb5b723fcd0793f86cca43906c4c29c
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
ASoC: msm: qdsp6v2: fix possible integer overflow

Check integer overflow before multiplying struct size. If that happens
should return immediately. In addition if param length is greater than
MAX size from spec, better return error.

Change-Id: Ib96cb419ade042d21a1213f6d8c2ff339f5d1c56
CRs-fixed: 605273
Signed-off-by: Fred Oh <fred@codeaurora.org>
ARM: dma-mapping: don't allow DMA mappings to be marked executable

DMA mapping permissions were being derived from pgprot_kernel directly
without using PAGE_KERNEL.  This causes them to be marked with executable
permission, which is not what we want.  Fix this.

Change-Id: Ib40f59f3c569f82409943cf8f9a86a9869d922cc
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 0ea1ec713f04bdfac343c9702b21cd3a7c711826
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[lauraa@codeaurora.org: dropped functions not in older builds]
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
ARM: fix executability of CMA mappings

The CMA region was being marked executable:

0xdc04e000-0xdc050000           8K     RW x      MEM/CACHED/WBRA
0xdc060000-0xdc100000         640K     RW x      MEM/CACHED/WBRA
0xdc4f5000-0xdc500000          44K     RW x      MEM/CACHED/WBRA
0xdcce9000-0xe0000000       52316K     RW x      MEM/CACHED/WBRA

This is mainly due to the badly worded MT_MEMORY_DMA_READY symbol, but
there are also a few other places in dma-mapping which should be
corrected to use the right constant.  Fix all these places:

0xdc04e000-0xdc050000           8K     RW NX     MEM/CACHED/WBRA
0xdc060000-0xdc100000         640K     RW NX     MEM/CACHED/WBRA
0xdc280000-0xdc300000         512K     RW NX     MEM/CACHED/WBRA
0xdc6fc000-0xe0000000       58384K     RW NX     MEM/CACHED/WBRA

Change-Id: I044360a8f08b1a4ae3e3e9e623fb77af2b427c51
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 71b55663c5d0a6f8473045db1c8b376803780191
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[lauraa@codeaurora.org: Context fixups due to __dma_remap signature change]
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
soc: qcom: smd: Validate read and write addresses

The address from which data has to be read and the address to which the
SMD data has to be written is calculated based on the head and tail
indices for that SMD FIFO. If the indices are corrupted, then the
calculated pointer may be outside of the FIFO and may even be outside of
the range of SMEM.

Validate the read and write addresses to be with in the limits of
receive and send FIFO limits respectively.

CRs-Fixed: 550527
Change-Id: Ie5578f6aee73ea2b1435fea7c2a0a6dda14bff82
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
Merge "ASoC: msm: qdsp6v2: fix possible integer overflow"
Merge "ARM: dma-mapping: don't allow DMA mappings to be marked executable"
Merge "ARM: fix executability of CMA mappings"
Merge "mmc: core: fix block request queue hang during data crc errors"
ASoC: msm: qdsp6v2: fix possible integer overflow

Check integer overflow before multiplying struct size. If that happens
should return immediately. In addition if param length is greater than
MAX size from spec, better return error.

Change-Id: Ib96cb419ade042d21a1213f6d8c2ff339f5d1c56
CRs-fixed: 605273
Signed-off-by: Fred Oh <fred@codeaurora.org>
Merge "ASoC: msm: qdsp6v2: fix possible integer overflow"
Merge "soc: qcom: smd: Validate read and write addresses"
net: flow_dissector: fail on evil iph->ihl

We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
is evil (less than 5).

This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
(rps: support IPIP encapsulation).

Cc: Eric Dumazet <edumazet@google.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Merge "net: flow_dissector: fail on evil iph->ihl"