staging: android: lowmemorykiller: Reduce debug_level to 1

Under certain circumstances, such as after the lowmemorykiller
has recently killed an application, the logs can get flooded
with "select to kill" messages.

Change-Id: I7ae1de47c77d929e04b99be3432577d4f5fd1b2d
Signed-off-by: Liam Mark <lmark@codeaurora.org>
use clamp_t in UNAME26 fix

The min/max call needed to have explicit types on some architectures
(e.g. mn10300). Use clamp_t instead to avoid the warning:

  kernel/sys.c: In function 'override_release':
  kernel/sys.c:1287:10: warning: comparison of distinct pointer types lacks a cast [enabled by default]

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Merge "use clamp_t in UNAME26 fix"
vidc: Turbo mode for multiple instances

If macroblock count per second goes beyond 1080p 30fps,
then bump the clock to turbo on supported platforms.

CRs-fixed: 455464
Change-Id: I48c34c9b6987706ea3e6b412b57791e2ae07ba52
Signed-off-by: Maheshwar Ajja <majja@codeaurora.org>
Merge "vidc: Turbo mode for multiple instances"
Merge "staging: android: lowmemorykiller: Reduce debug_level to 1"
msm: kgsl: Properly record the size of the sglist in the memdesc

It was possible to fail out of kgsl_sharedmem_alloc after a sglist was
allocated but before we saved the size of the allocation which caused
problems when the sglist was freed during cleanup.

CRs-fixed: 464289
Change-Id: Ic0dedbadd57ec4d9422b5e3a873243d0ffed51f7
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
ASoC: msm8930: properly protect external mclk control function

Both audio path and MBHC accessory detection logic need master clock
enabled along with bandgap and clock block of CODEC. Clock control
is managed by the machine driver. Calls to clock control function from
audio and MBHC detection paths can be nested. As a result, reference
counter of master clock is incremen/decrement out of order and cause
master clock not enabled when audio path is enabled. Without master clock
CODEC will not consume data and this leads to SLIMBUS overflow error.

CRs-Fixed: 469683
Change-Id: Ib3a55f5d0b36ebe9ba345e7f18162a9314500df2
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Merge "msm: kgsl: Properly record the size of the sglist in the memdesc"
Merge "ASoC: msm8930: properly protect external mclk control function"
USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared

USB controller may access the dTD one more time after clearing the active
bit in token field.  There is a possibility of software freeing it in this
window.  When this happens, USB controller may access incorrect memory and
leads to system level issues.

dTDs are freed when requests are freed by function drivers during
disconnect or unbind.  The above race condition will come into effect only
for zero length packets.  dTDs are dynamically created for sending zero
length packets on IN endpoints.  These dTDs are immediately freed after
active bit is cleared.  Defer this to next dTD completion.  It is safe to
assume that hardware will no longer access the previous dTD when the next
dTD is completed.

Don't allocate/free setup status phase and GET_STATUS data phase requests
dynamically.  Use  one request for both cases and allocate it during bind.

CRs-Fixed: 474557
Change-Id: I5d41c310e1bb35d93b5af7d90a24ce5aab24f5f9
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Merge "USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared"
signal: always clear sa_restorer on execve

When the new signal handlers are set up, the location of sa_restorer is
not cleared, leaking a parent process's address space location to
children.  This allows for a potential bypass of the parent's ASLR by
examining the sa_restorer value returned when calling sigaction().

Based on what should be considered "secret" about addresses, it only
matters across the exec not the fork (since the VMAs haven't changed
until the exec).  But since exec sets SIG_DFL and keeps sa_restorer,
this is where it should be fixed.

Given the few uses of sa_restorer, a "set" function was not written
since this would be the only use.  Instead, we use
__ARCH_HAS_SA_RESTORER, as already done in other places.

Example of the leak before applying this patch:

  $ cat /proc/$$/maps
  ...
  7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  $ ./leak
  ...
  7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  1 0 (nil) 0x7fb9f30b94a0
  2 4000000 (nil) 0x7f278bcaa4a0
  3 4000000 (nil) 0x7f278bcaa4a0
  4 0 (nil) 0x7fb9f30b94a0
  ...

[akpm@linux-foundation.org: use SA_RESTORER for backportability]
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Emese Revfy <re.emese@gmail.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Julien Tinnes <jln@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: I7ae396ee90c2339c86f7b773d15f5571f8fd54c5
Signed-off-by: Goberu Gopal <ggober@codeaurora.org>
Merge "signal: always clear sa_restorer on execve"
msm: audio: qdsp6v2: Add size safety check to ACDB driver

Check that the size sent by userspace is not larger
then the internal amount allowed. This protects
against overflowing the stack due to an invalid size.

Change-Id: I8230fdb00a7b57d398929e8ab0eb6587476f3db1
CRs-fixed: 470222
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
crypto: Fix HMAC failure

Incorrect HMAC values are generated in following scenarios.

- In case of a single transfer with a packet shorter than the
block size, the HMAC generated is incorrect. This is due to
the "FIRST" bit in AUTH_CFG register not being set.  When calling
HMAC_final for a transfer with a single packet (with no prior HMAC
updates), the "FIRST" and "LAST" bit in AUTH_CFG register needs to
be set. Currently FIRST bit is being cleared incorrectly for all
scenarios.

- In a scenario of a mac key input larger than block size, the key
needs to be hashed. The key hashing operation is crashing. This is
due to a NULL, unintialized pointer to the device handle. This is
fixed by intializing the pointer correctly. Further more, key size
is uninitialized, resulting in corruption of buffer.

Change-Id: Iec736f2130e509fcaf631a2c71c5483514666617
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
crypto: Add wait states for hash/hmac operations

Currently, hash (SHA1/256/hmac) operation occasionally results
in an incorrect hash value. This is due to the premature reading
of the AUTH_IV register done before the last SHA block is processed.
There needs to be enough delay (wait states) before the AUTH_IV
register is read to extract the hash value.

The current implementation has 2 wait states. Adding 2 more wait states
for hash operations, resolves the issue.

The wait states are calculated based on the inputs from the hardware
team with regards to the time taken to process the last block of 16
bytes of the data packet.

Change-Id: I4f9e784fbfca62d6636d87dc44c1bf9992e3b3e4
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Merge "crypto: Fix HMAC failure"
Merge "crypto: Add wait states for hash/hmac operations"
crypto: Fix potential crash due to unbound array & null pointer access.

Fix the null pointer errors and valid index checking for arrays to
fix potential kernel crash.

Change-Id: Iabf7f73dcfe5a544e3fe83f1e67ec1161f989fac
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>

Conflicts:

	drivers/crypto/msm/qcedev.c

Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>

Conflicts:

	drivers/crypto/msm/qcedev.c

Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>