v4l2: vb2: replace VIDEO_MAX_FRAME with VB2_MAX_FRAME

- vb2 drivers to rely on VB2_MAX_FRAME.

- VB2_MAX_FRAME bumps the value to 64 from current 32

Change-Id: I3d7998898df43553486166c44b54524aac449deb
Signed-off-by: Balamurugan Alagarsamy <balaga@codeaurora.org>
msm: vidc: Increase max buffers to VB2_MAX_FRAME (i.e. 64)

It's an arbitrary limit anyway.  Increase it to satisfy some clients
that'd like more buffers.

Change-Id: Ia1e0afd09089b6303b6590de804ea509b01626f4
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Signed-off-by: Balamurugan Alagarsamy <balaga@codeaurora.org>
wlan: Correct db.txt for a set of countries.

Correct the channel list and tx power values for countries
with alpha2 IL, MX, ZA and TW.

Change-Id: I735a153ef1e87c1022f175ac360d675071d1ec2a
CRs-Fixed: 640859
Signed-off-by: Amar Singhal <asinghal@codeaurora.org>
Signed-off-by: Agarwal Ashish <ashishka@codeaurora.org>
rtc: alarm: set power_on_alarm again when calling alarm_resume

The power_on alarm might be replaced or cleared during alarm
suspend and resume process.So restore the power_on alarm into RTC
during alarm resume.

Change-Id: I1eefb082f9dfbd78517f3da1cc60a989853555fd
Signed-off-by: Mao Jinlong <c_jmao@codeaurora.org>
qseecom: change the number of bytes to compare app names

keymaster app has two names with different length: "keymaster" and
"keymaste". To compare the app names correctly, the shorter name
length is choosen for memcmp in __qseecom_send_cmd.

Change-Id: I5f0dff7f9756362be40cc64985b65bc2268d734f
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: William Clark <wclark@codeaurora.org>
diag: dci: Mutex protect the list while traversal and node deletion

On receiving the response from peripherals for the sent command
DCI traverses and deletes from the list. The list is not lock
protected while traversal or deletion. This patch resolves the
same.

Change-Id: Ie93f3e035b35c4d39f1e19f9c42a48f4147fe145
CRs-Fixed: 715663
Signed-off-by: Katish Paran <kparan@codeaurora.org>
mmc: core: Avoid infinite retries of failed mmc command

With some bad SD cards, it is possible that the error recovery
procedure goes into a state where it retries the failed command
infinitely leading to CPU hog.

Fix inifinite retries when the bad SD card isn't responding to
a command even when the SD card reset mechanism is successful.

CRs-Fixed: 671153
Change-Id: Ic6db66b571aa425aec32c82d52789c68fe0cb0e9
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
msm: kgsl: enable CPU IRQ while suspending context

Make sure that CPU interrupt is enabled before calling adreno
suspend_context when moving from NAP/SLEEP to SLUMBER state.
We send commands to GPU in adreno_drawctxt_switch() which will generate
GPU interrupt. Since CPU interrupt is not enabled, adreno_idle() will
fail because pending interrupt will not be served by CPU this causes
false GPU hang.

CRs-Fixed: 547813

Change-Id: Ia4b730b8f8cda1e820f571ffb7ddb00336ca1a8c
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
msm: kgsl: Fix memory entry leak when calling adreno_convertaddr

When adreno_convertaddr is called the memory searched in this function
may have a memory entry associated with it if this allocation belongs
to user space. A reference to this memory entry is taken when
this function is called which should be returned when the caller is
done using the memory. Made changes to return a reference to the
entry when calling this function which is returned when caller is
done using the memory.

Change-Id: I610553fd4b119d3c47cbfcec970d50046dbb2863
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
msm: kgsl: Keep track of kernel space mappings to memory

Add a counter to count number of times a memory descriptor is
mapped in the kernel and unmap the kernel mapping only when the
count reaches 0. There can be multiple threads using the kernel
mapping at the same time hence a counter is used to make sure
that we do not unmap the mapping before the last thread has
finished using it.

Change-Id: I9c53deb6af12fb1f6ed30e46b386e1cd60dafdda
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
diag: Mode reset command has to be handled on APPS proc

Mode reset command is handled by APPS proc. If the apps process
has not registered with diag for handling the mode reset command,
diag has to send error response code back. This patch fixes
that issue.

Change-Id: Id4d99f0e909fa3a78e8682825984a99042021bad
Signed-off-by: Katish Paran <kparan@codeaurora.org>
Revert "Add missing list_add_tail_rcu in kernel/fork.c Thanks @neobuddy89"

This reverts commit 32ae4232dc4e12dcff76fb6fc600ef9bb4de040e.

Need to do it right!
Revert "introduce for_each_thread() to replace the buggy while_each_thread()"

This reverts commit 49f81c32756b14b74a15644acfa95b3feab164a4.

Need to merge full commit!
kernel/fork.c:copy_process(): unify CLONE_THREAD-or-thread_group_leader code

Cleanup and preparation for the next changes.

Move the "if (clone_flags & CLONE_THREAD)" code down under "if
(likely(p->pid))" and turn it into into the "else" branch.  This makes the
process/thread initialization more symmetrical and removes one check.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Sergey Dyasly <dserrg@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
introduce for_each_thread() to replace the buggy while_each_thread()

while_each_thread() and next_thread() should die, almost every lockless
usage is wrong.

1. Unless g == current, the lockless while_each_thread() is not safe.

   while_each_thread(g, t) can loop forever if g exits, next_thread()
   can't reach the unhashed thread in this case. Note that this can
   happen even if g is the group leader, it can exec.

2. Even if while_each_thread() itself was correct, people often use
   it wrongly.

   It was never safe to just take rcu_read_lock() and loop unless
   you verify that pid_alive(g) == T, even the first next_thread()
   can point to the already freed/reused memory.

This patch adds signal_struct->thread_head and task->thread_node to
create the normal rcu-safe list with the stable head.  The new
for_each_thread(g, t) helper is always safe under rcu_read_lock() as
long as this task_struct can't go away.

Note: of course it is ugly to have both task_struct->thread_node and the
old task_struct->thread_group, we will kill it later, after we change
the users of while_each_thread() to use for_each_thread().

Perhaps we can kill it even before we convert all users, we can
reimplement next_thread(t) using the new thread_head/thread_node.  But
we can't do this right now because this will lead to subtle behavioural
changes.  For example, do/while_each_thread() always sees at least one
task, while for_each_thread() can do nothing if the whole thread group
has died.  Or thread_group_empty(), currently its semantics is not clear
unless thread_group_leader(p) and we need to audit the callers before we
can change it.

So this patch adds the new interface which has to coexist with the old
one for some time, hopefully the next changes will be more or less
straightforward and the old one will go away soon.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Sergey Dyasly <dserrg@gmail.com>
Tested-by: Sergey Dyasly <dserrg@gmail.com>
Reviewed-by: Sameer Nanda <snanda@chromium.org>
Acked-by: David Rientjes <rientjes@google.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Mandeep Singh Baines <msb@chromium.org>
Cc: "Ma, Xindong" <xindong.ma@intel.com>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: "Tu, Xiaobing" <xiaobing.tu@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
net/compat.c,linux/filter.h: share compat_sock_fprog

Any other users of bpf_*_filter that take a struct sock_fprog from
userspace will need to be able to also accept a compat_sock_fprog
if the arch supports compat calls.  This change allows the existing
compat_sock_fprog be shared.

Signed-off-by: Will Drewry <wad@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Eric Paris <eparis@redhat.com>

v18: tasered by the apostrophe police
v14: rebase/nochanges
v13: rebase on to 88ebdda6159ffc15699f204c33feb3e431bf9bdc
v12: rebase on to linux-next
v11: introduction
Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs

With this change, calling
  prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)
disables privilege granting operations at execve-time.  For example, a
process will not be able to execute a setuid binary to change their uid
or gid if this bit is set.  The same is true for file capabilities.

Additionally, LSM_UNSAFE_NO_NEW_PRIVS is defined to ensure that
LSMs respect the requested behavior.

To determine if the NO_NEW_PRIVS bit is set, a task may call
  prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
It returns 1 if set and 0 if it is not set. If any of the arguments are
non-zero, it will return -1 and set errno to -EINVAL.
(PR_SET_NO_NEW_PRIVS behaves similarly.)

This functionality is desired for the proposed seccomp filter patch
series.  By using PR_SET_NO_NEW_PRIVS, it allows a task to modify the
system call behavior for itself and its child tasks without being
able to impact the behavior of a more privileged task.

Another potential use is making certain privileged operations
unprivileged.  For example, chroot may be considered "safe" if it cannot
affect privileged tasks.

Note, this patch causes execve to fail when PR_SET_NO_NEW_PRIVS is
set and AppArmor is in use.  It is fixed in a subsequent patch.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Will Drewry <wad@chromium.org>
Acked-by: Eric Paris <eparis@redhat.com>

v18: updated change desc
v17: using new define values as per 3.4
CHROMIUM: ARM: arch/arm: allow a scno of -1 to not cause a SIGILL

On tracehook-friendly platforms, a system call number of -1 falls
through without running much code or taking much action.

ARM is different.  This adds a lightweight check to arm_syscall()
to make sure that ARM behaves the same way.

Signed-off-by: Will Drewry <wad@chromium.org>
TEST=building on tegra2 now. Will live test with seccomp testsuite. It was through SIGILL.
BUG=chromium-os:27878

Change-Id: Ie3896b54e9bfa21c22e0df456a47ad03c8d0aa3f
Reviewed-on: https://gerrit.chromium.org/gerrit/21251
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Will Drewry <wad@chromium.org>
Tested-by: Will Drewry <wad@chromium.org>
Signed-off-by: Sasha Levitskiy <sanek@google.com>