Add permission checking for binder IPC.

Do not apply permission checks to private files.

Fix security_binder_transfer_binder hook.

Drop the owning task argument to security_binder_transfer_binder
since ref->node->proc can be NULL (dead owner?).
Revise the SELinux checking to apply a single transfer check between
the source and destination tasks.  Owning task is no longer relevant.
Drop the receive permission definition as it is no longer used.

This makes the transfer permission similar to the call permission; it is only
useful if you want to allow a binder IPC between two tasks (call permission)
but deny passing of binder references between them (transfer permission).

Change-Id: I51e7a9a6662e826073b35e4f70a57f9ec73e472e
Signed-off-by: William Roberts <w.roberts@sta.samsung.com>
perf: Treat attr.config as u64 in perf_swevent_init()

Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Link: http://lkml.kernel.org/r/1365882554-30259-1-git-send-email-tt.rantala@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
net: wireless: bcmdhd: Fix sched scan processing

Change-Id: I24eebe2723478b902ed4fb2e1f518994f41297f8
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
netfilter: qtaguid: rate limit some of the printks

Some of the printks are in the packet handling path.
We now ratelimit the very unlikely errors to avoid
kmsg spamming.

Signed-off-by: JP Abgrall <jpa@google.com>
sync: allow async waits to be canceled

In order to allow drivers to cleanly handled teardown we need to allow them
to cancel pending async waits.  To do this cleanly, we move allocation of
sync_fence_waiter to the driver calling sync_async_wait().

Change-Id: Ifcd95648be6ec07026d67f810070a4310f099989
Signed-off-by: Erik Gilling <konkers@android.com>
sync: export sync API symbols

This is needed to allow modules to link against the sync subsystem

Change-Id: I15c1818de329f24e4113ef1d0923413b22fd0eff
Signed-off-by: Erik Gilling <konkers@android.com>
sw_sync: export sw_sync API

Needed to let modules link against sw_sync.

Change-Id: I71d3e52677ef21b6e1ecdb84f831491be1f4fbe6
Signed-off-by: Erik Gilling <konkers@android.com>
sync: reorder sync_fence_release

Previously fence's pts were freed before the were the fence was removed from the
global fence list.  This led to a race with the debugfs support where it would
iterate over sync_pts that had been freed.

Change-Id: Ia3ddbf77de42ca593fc2dc353b5d04e42ddf3946
Signed-off-by: Erik Gilling <konkers@android.com>
sync: optimize fence merges

If the two fences being merged contain sync_pts from the same timeline,
those two pts will be collapsed into a single pt representing the latter
of the two.

Change-Id: Iced7ebb7e5a17a0c8b1a2969ba3388a4edb9ecaf
Signed-off-by: Erik Gilling <konkers@android.com>
sync: add internal refcounting to fences

If a fence is released while a timeline that one of it's pts is on is being
signaled, it is possible for that fence to be deleted before it is signaled.
This patch adds a refcount for internal references such as signaled pt
processing.

Change-Id: Ie8605e6fd2ac026c207220a03d84e1c1078ec719
Signed-off-by: Erik Gilling <konkers@android.com>
sync: add reference counting to timelines

If a timeline is destroyed while fences still hold pts on it, the reworked
fence release handler can cause the timeline to be freed before all it's points
are freed.

Change-Id: I1cd8ddb638eded7db9db446ff6b37f3dd165d6c4
Signed-off-by: Erik Gilling <konkers@android.com>
sync: Fix error paths

Check the return value of get_unused_fd to make sure a valid
file descriptor is returned.

Make sure to call put_unused_fd even if an error occurs before
the fd can be used.

Change-Id: I0fe8f78d9e30ecfc4d271c5d875424543dae2d0f
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
sw_sync: Fix error paths

Check the return value of get_unused_fd to make sure a valid
file descriptor is returned.

Make sure to call put_unused_fd even if an error occurs before
the fd can be used.

Change-Id: Ibbf55caebc2f8ee6a03f298eb0ae0189c7d10b5c
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
sync: change wait timeout to mirror poll semantics

Change-Id: Ib38e6d339d41885a33027752690d65a52b6897f6
Signed-off-by: Erik Gilling <konkers@android.com>
sync: fix erase-o in sync_fence_wait

Change-Id: I189707cf658a9f1f2943515c891b43961994e774
Signed-off-by: Erik Gilling <konkers@android.com>
sync: clean up compiler warnings

Change-Id: I8a2ec5db652c61fd04571402067b37273b91e78f
Signed-off-by: Erik Gilling <konkers@android.com>
sync: dump sync state to console on timeout

Change-Id: I74bca6b4a2afa7ed5b1f5233c5165d2edddf269a
Signed-off-by: Erik Gilling <konkers@android.com>
sync: use correct signed type when handling SYNC_IOC_WAIT

Change-Id: Ic7d5adf9b145765e52b23186b8c3c793ccf29be7
Signed-off-by: Erik Gilling <konkers@android.com>
sync: improve timeout dumps

Change-Id: I3b378d63c324c7b5862dd214f380b5e91131cc2a
Signed-off-by: Erik Gilling <konkers@android.com>
sync: dump sync state of fence errors

Change-Id: I297a43aadf83504993040ea875c7f22d988628f1
Signed-off-by: Erik Gilling <konkers@android.com>