USB: core: hub.c: Fix bug in accessing freed memory

Current driver is accessing the buffer memory after it is freed.
This could result in getting wrong value and might could cause
memory corruption. Hence fix this issue by taking idvendor
value into a variable before freeing it.

CRs-Fixed: 550211
Change-Id: I271dbf3518e7b6e0d30c684bd05c835945de0950
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Disable CONFIG_STRICT_MEMORY_RWX

CONFIG_STRICT_MEMORY_RWX has good intentions. But it actually opens the kernel up to more vulnerabilities unless security patches are applied.

https://www.codeaurora.org/projects/security-advisories/configstrictmemoryrwx-not-strictly-enforced-cve-2013-4737

The security patch that fixes CONFIG_STRICT_MEMORY_RWX takes up 1.9 MB of kernel space and about 1 MB of user memory. The only known exploit for what it fixes is ironically only for the unpatched version of this config.

Upstream Linux, which is usually very sensitive to security issues has
not implemented this config. In fact, Ubuntu has explicitly removed it
from their MSM builds http://web.archiveorange.com/archive/v/UsR4n0n1MLugFsH52gbL

Let's save the memory and just turn it off.

Change-Id: I7ddff43bb76fb5ddb0c144d891bdf8ed2c19c9a5
cpufreq: interactive: Modifying sync_freq implementation

1. Check for up_threshold_any_cpu_freq instead of sync_freq to
   boost the frequency to sync_freq.
2. Change the load threshold name from sync_freq_load_threshold to
   up_threshold_any_cpu_load
3. Do not consider CPUs with load less than up_threshold_any_cpu_load
   while evaluating max load across CPUs

Change-Id: Ia0e537edbf38a5006c1a22f5c472daa0d086ffc9
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>
cpufreq: interactive: Fix null pointer dereference in interactive governor

For the sync_freq feature currently we check pcpu->policy->cur frequency
for each online cpu.  But for a CPU that isn't using interactive governor
or for an offline CPU, pcpu->policy can be null or an invalid value.
This patch tries to avoid that scenario by using pcpu->target_freq
instead of policy->cur to get the frequency of an online CPU.

Kernel crash without this patch:
[   20.132373] Unable to handle kernel NULL pointer dereference at virtual address 00000028
[   20.132375] pgd = c34f34c0
[   20.132377] pgd = ef6f2440
[   20.132383] [00000028] *pgd=00000000
[   20.132385]
[   20.132388] [00000028] *pgd=2e98f003, *pmd=00000000
[   20.132390] Internal error: Oops: 205 [#1] PREEMPT SMP ARM
[   20.132394] Modules linked in:
[   20.132398] CPU: 0 PID: 1560 Comm: chown Tainted: G        W    3.10.0-perf-gb12057b-00001-ga2c6c16-dirty #7
[   20.132401] task: ef9af300 ti: ee49c000 task.ti: ee49c000
[   20.132411] PC is at cpufreq_interactive_timer+0x10c/0x650
[   20.132415] LR is at cpufreq_interactive_timer+0x128/0x650
<snip>
[   20.133002] [<c07eb204>] (cpufreq_interactive_timer+0x10c/0x650) from [<c02804d8>] (call_timer_fn+0x80/0x198)
[   20.133012] [<c02804d8>] (call_timer_fn+0x80/0x198) from [<c0280acc>] (run_timer_softirq+0x1f8/0x270)
[   20.133019] [<c0280acc>] (run_timer_softirq+0x1f8/0x270) from [<c0279e20>] (__do_softirq+0x12c/0x2d4)
[   20.133025] [<c0279e20>] (__do_softirq+0x12c/0x2d4) from [<c027a2d4>] (irq_exit+0x74/0xc8)
[   20.133034] [<c027a2d4>] (irq_exit+0x74/0xc8) from [<c0206a00>] (handle_IRQ+0x68/0x8c)
[   20.133041] [<c0206a00>] (handle_IRQ+0x68/0x8c) from [<c02004b8>] (gic_handle_irq+0x3c/0x60)
[   20.133051] [<c02004b8>] (gic_handle_irq+0x3c/0x60) from [<c0ac6900>] (__irq_svc+0x40/0x70)
<snip>

Change-Id: Ie834f5d383de4d41e0fe6fbd40c8b0a0c05d82f5
Signed-off-by: Vijay Ganti <viganti@codeaurora.org>
cpufreq: interactive: Use default min_sample_time if SDF is zero

Use min_sample_time to step down from max frequencies if
sampling_down_factor is set to zero.

Change-Id: I2e89bef6220557cb95efd20d658e0c05753b4c3c
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>
cpufreq: ondemand: Remove unnecessary synchronization attempt

Commit 1ce28d6b (ondemand: updated tune for hardware coordination)
brings in an attempt to synchronize expiry of per-cpu ondemand timer
at same time across all online cpus. This is meant to help systems
where "multiple cores share P-state via Hardware Coordination".

Synchronization is achieved by having timers expire when jiffy value
would be a perfect multiple of sampling window size. While such
synchronozation attemps are unnecessary on systems where cores don't
share P-states, it can hurt on power as cpus can now work off shorter
sampling windows (when percentage utilization over short window can be
observed to be high, causing frequency to be boosted).

Remove this unnecessary attempt to synchronize expiry of ondemand
timer across online cpus. A more acceptable solution could be to have
low-level architecture specific cpufreq driver indicate the need for
synchronization.

Change-Id: I6cb1cf3472ca106f029dc01248e0df7cfbb495b8
Signed-off-by: Srivatsa Vaddagiri <vatsa@codeaurora.org>
ondemand: add sysfs entry for down_diff_multi_core

This change adds sysfs entry for the ondemand governor's attribute
down_differential_multi_core. This is required to be able to program
this knob to attain better perf/power for use cases like camcorder.

CRs-fixed: 561456
Change-Id: Ib7c1223215c6b714c286c231ed37f3abfae741c6
Signed-off-by: Krishna Vanka <kvanka@codeaurora.org>
mm: vmscan: Move pages that fail swapout to LRU active list

Move pages that fail swapout to the LRU active list to reduce
pressure on swap device when swapping out is already failing.
This helps when using a pseudo swap device such as zram which
starts failing when memory is low.

Change-Id: Ib136cd0a744378aa93d837a24b9143ee818c80b3
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
kswapd: reduce time spent in congestion_wait

By reducing the amount of time kswapd spends in
congestion_wait kswapd is able to free up more
memory in the background and therefore  reduce
the amount  of time spent in direct reclaim.

Change-Id: I46ebe577f8954d8ce9907430958fa0e53090979c
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Signed-off-by: Greg Grisco <ggrisco@codeaurora.org>
[media] media: Init the reserved fields of struct media_link_desc

struct media_link_desc is copy_to_user'ed as the return value of
MEDIA_IOC_ENUM_LINKS. When copying, the driver is omitting to initialise
the reserved fields.  This commit fixes that by initialising the
reserved fields to 0.

CRs-Fixed: 570757
Change-Id: I230e2666c0845cc36399518a0f2c94db664382d1
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
qseecom: Validate the pointer returned by ion_import_dma_buf

Do a "IS_ERR_OR_NULL" check for the return value of
ion_import_dma_buf.

Change-Id: Iaac8b59b1f076d002430e0e6aba055bd88c83ed7
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
gpio_input: convert from wakelocks to wakeup sources

And add device names to wakeup source names

Change-Id: Ia5f2723319a2e749f00d6ec7d846edff6af6d5c2
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Undo stable backports

This is a squash of a bunch of stable backport patches that we
shouldn't be holding onto in msm-3.4 because they only apply to
kernels before v3.4.

Change-Id: I20e63e7a9ca69155e3e11dbb16d5ee21c7e49574
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
msm: ADSPRPC: Add checks for erroneous values

Check for invalid parameters passed in user invocation
and validate the return values using appropriate macros.

Change-Id: If529873d025ac0c13725efbedda5a58fae327722
Acked-by: Sathish Ambley <sambley@qti.qualcomm.com>
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Signed-off-by: Prados Das <prados@codeaurora.org>
WLAN subsystem: Sysctl support for key TCP/IP parameters

It has been observed that default values for some of key tcp/ip
parameters are affecting the tput/performance of the system. Hence
extending configuration capabilities to TCP/Ip stack through
sysctl interface.

Change-Id: I0c99d5b50cbe0d6496e40d391eacc12b0c62dbed
CRs-Fixed: 507581
Signed-off-by: Mahesh A Saptasagar <msapta@codeaurora.org>
ext4: speed up truncate/unlink by not using bforget() unless needed

Do not iterate over data blocks scanning for bh's to forget as they're
never exist. This improves time taken by unlink / truncate syscall.
Tested by continuously truncating file that is being written by dd.
Another test is rm -rf of linux tree while tar unpacks it. With
ordered data mode condition unlikely(!tbh) was always met in
ext4_free_blocks. With journal data mode tbh was found only few times,
so optimisation is also possible.

Unlinking fallocated 60G file after doing sync && echo 3 >
/proc/sys/vm/drop_caches && time rm --help

X86 before (linux 3.6-rc4):
real    0m2.710s
user    0m0.000s
sys     0m1.530s

X86 after:
real    0m0.644s
user    0m0.003s
sys     0m0.060s

MIPS before (linux 2.6.37):
real    0m 4.93s
user    0m 0.00s
sys     0m 4.61s

MIPS after:
real    0m 0.16s
user    0m 0.00s
sys     0m 0.06s

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Andrey Sidorov <qrxd43@motorola.com>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>

Change-Id: Ie78a945cb82b3892eaf88701f2dc3b7726104fb5
msm: dma: Moving queue_work() function within spinlock

Currently we are adding a dma command to the staged list with in a
spinlock and then adding to workqueue using queue_work after unlocking
the spinlock. With this there is chance of executing DMA commands in out
of order in below concurrency case.

Tread1                                Thread2
__msm_dmov_enqueue_cmd_ext
   spin_lock_irqsave(..)
   list_add_tail(..)
   spin_unlock_irqrestore(..)
       --PREEMPT--
                                      __msm_dmov_enqueue_cmd_ext
                                         spin_lock_irqsave(..)
                                         list_add_tail(..)
                                         spin_unlock_irqrestore(..)
                                         queue_work()
                                         ..
   queue_work()
So adding queue_work with in spin_lock will make sure that the
work added in the work_queue is processed in the same order as they
are added in staged_commands.

CRs-Fixed: 423190
Change-Id: I2ffd1327fb5f0cd1f06db7de9c026d1c4997fe4d
Acked-by: Gopi Krishna Nedanuri <gnedanur@qti.qualcomm.com>
Signed-off-by: Utsab Bose <ubose@codeaurora.org>
ApexQ: High brightness mode for torch

Change-Id: I2358275df3605db4ca594a93045d59aa451a0032
staging: zcache: don't limit number of pools per client

Currently the amount of pools each client can use is limited to 16, this is
and arbitrary limit which isn't really required by current implementation.

This places and arbitrary limit on the number of mounted filesystems that
can use cleancache.

This patch removes that limit and uses IDR to do sparse mapping of pools
in each client.

Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: zcache: fix refcount leak

In zcache_get_pool_by_id, the refcount of zcache_host is not increased, but
it is always decreased in zcache_put_pool

Acked-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Signed-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>