msm: msm_bus: Prevent BKE swtich from overwriting other fields

Incorrect bit mask could lead to other register fields getting
overwritten when doing a BKE bit switch.

Change-Id: I2cd7717eca48166dcc8cdb7ad855cc87e04c233b
Signed-off-by: Girish Mahadevan <girishm@codeaurora.org>
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
net/l2tp: don't fall back on UDP [get|set]sockopt

The l2tp [get|set]sockopt() code has fallen back to the UDP functions
for socket option levels != SOL_PPPOL2TP since day one, but that has
never actually worked, since the l2tp socket isn't an inet socket.

As David Miller points out:

  "If we wanted this to work, it'd have to look up the tunnel and then
   use tunnel->sk, but I wonder how useful that would be"

Since this can never have worked so nobody could possibly have depended
on that functionality, just remove the broken code and return -EINVAL.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: James Chapman <jchapman@katalix.com>
Acked-by: David Miller <davem@davemloft.net>
Cc: Phil Turnbull <phil.turnbull@oracle.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
vsprintf: ignore %n again

This ignores %n in printf again, as was originally documented.
Implementing %n poses a greater security risk than utility, so it should
stay ignored.  To help anyone attempting to use %n, a warning will be
emitted if it is encountered.

Based on an earlier patch by Joe Perches.

Because %n was designed to write to pointers on the stack, it has been
frequently used as an attack vector when bugs are found that leak
user-controlled strings into functions that ultimately process format
strings.  While this class of bug can still be turned into an
information leak, removing %n eliminates the common method of elevating
such a bug into an arbitrary kernel memory writing primitive,
significantly reducing the danger of this class of bug.

For seq_file users that need to know the length of a written string for
padding, please see seq_setwidth() and seq_pad() instead.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David Brown <davidb@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
seq_file: introduce seq_setwidth() and seq_pad()

There are several users who want to know bytes written by seq_*() for
alignment purpose.  Currently they are using %n format for knowing it
because seq_*() returns 0 on success.

This patch introduces seq_setwidth() and seq_pad() for allowing them to
align without using %n format.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David Brown <davidb@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: vidc: handle dynamic buffers in pendingq during flush

In dynamic buffer mode, if flush was received before
stream-on, driver would have incremented the ref count
for output buffers, but not yet sent to firmware. So,
after flush done, there would be no fbd from firmware
and the reference to these buffers would not be removed.
So when the buffers are dequeued, driver fails to
unmap and free the output buffers.
Subsequently, after flush done, when client queues
the same output buffers again to driver, the ref
count is increased and becomes 2. This results in
the driver holding the buffers with itself, thereby
entering in to a deadlock situation and starving the
firmware of output buffers. This results in a video
freeze.

Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ASoC: wcd9xxx-mbhc: Avoid flipping current source setting

In some cases, the current source switch on codec is disabled and
enabled again where it could have been left in enabled state. This
flipping of current source setting is causing a pop on the headphones.
Add fix to avoid this unnecessary flipping of current source switch.

Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ASoC: wcd9xxx-mbhc: Disable micbias for impedance detection

If micbias is enabled during impedance detection, it can result into pop
noise on headphone left and right channels. Since micbias is not really
used for impedance detection measurements, it is safe to disable the
micbias during impedance measurements.

Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ASoC: qdsp6v2: update sanity check

Pointers should be checked for sanity before accessing them.
Change ensures that the sanity of the pointer is checked before
accessing it.

Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
mmc: queue: do not clean current request when urgent in progress

As a result of following fix: "mmc: core: do not reinsert prepeared
FUA and FLUSH requests in stop flow" REQ_FUA and REQ_FLUSH requests
are not reinserted back into i/o scheduler, but instead started request
execution.

This change will prevent cleaning current request pointer for such
requests.

Change-Id: I25f8706954fb538be62182c87d5fb20354696b7a
CRs-fixed: 600127
Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>

Conflicts:
	drivers/mmc/core/core.c
mmc: block: Fix an invalid use of req->cmd_flag in DISCARD operation

When handling a DISCARD operation, the MMC request data structure may be
freed in memory. Therefore, it can't be used to retrieve the cmd_flags
for checking if MMC_REQ_NOREINSERT_MASK is set:
(!(mq->mqrq_cur->req->cmd_flags & MMC_REQ_NOREINSERT_MASK)))).

To prevent the issue we should use the local variable of cmd_flags.

Change-Id: I3b25a0e734325355c50d4d5f5b38e9631ae41dd9
CRs-Fixed: 683957
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>
mmc: block: check for NULL pointer before dereferencing

mmc block data can be NULL. Hence, check for NULL before
dereferencing md.

CRs-Fixed: 562259
Change-Id: I0182c216ec73347cdd2ea464f593839fffd242a9
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
mmc: core: add deferred resume support

This patch enables the deferred resume support which would
prevent initialization of the card each time the system resumes.
With this change, the resume process would only be initiated if
a request is received.

Following scenario can occur:
1. device runtime suspended, system suspend is triggered
   When resumed, the device would not be resumed until a
   request is received.
2. device is runtime active, system suspend is triggered
   When resumed, the device would be marked as BUS_NEEDS_RESUME
   and actual resume would happen, when a request is received.
   At this point, the device may also enter runtime-suspend or
   system suspend may also occur. In both the cases, since the
   device has not been resumed, it won't be suspended again.
   However, the platform device would be runtime suspended
   and resumed as before.
   It can so happen that the card is removed even before a
   request is received. In this case the device would be
   resumed and card would be removed from core layer and
   upper layers would be notified.
In case of SDIO cards, this change would not have any effect
since manual resume would be enabled for devices supporting
a block read/write commands.

CRs-Fixed: 561382
Change-Id: Id39befea109ee24864dfde0898395b972d0a1b3a
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
mmc: block: stop bkops during shutdown

[   42.885198] SysRq : Emergency Remount R/O
[   43.003988] mmc0: mmc_bus_shutdown: invoked ###
[   43.033289] mmc0: mmc_bus_shutdown: done ###
[   43.118486] mmc0: sdhci_request: sending cmd8 after bus shutdown !!!
[   43.147955] [<c0659ca4>] (sdhci_request+0x4c/0x260) from
				[<c063ee24>] (mmc_start_request+0x27c/0x2b0)
[   43.157152] [<c063ee24>] (mmc_start_request+0x27c/0x2b0) from
				[<c063eec4>] (mmc_wait_for_req+0x6c/0x13c)
[   43.166618] [<c063eec4>] (mmc_wait_for_req+0x6c/0x13c) from
				[<c0645ed4>] (mmc_send_cxd_data+0xe0/0x114)
[   43.175991] [<c0645ed4>] (mmc_send_cxd_data+0xe0/0x114) from
				[<c0645f24>] (mmc_send_ext_csd+0x1c/0x20)
[   43.185277] [<c0645f24>] (mmc_send_ext_csd+0x1c/0x20) from
				[<c063df28>] (mmc_read_bkops_status+0x98/0xdc)
[   43.194823] [<c063df28>] (mmc_read_bkops_status+0x98/0xdc) from
				[<c06417ac>] (mmc_start_bkops+0x168/0x324)
[   43.204461] [<c06417ac>] (mmc_start_bkops+0x168/0x324) from
				[<c01a9584>] (process_one_work+0x200/0x400)
[   43.213835] [<c01a9584>] (process_one_work+0x200/0x400) from
				[<c01a9934>] (worker_thread+0x184/0x2a4)
[   43.223039] [<c01a9934>] (worker_thread+0x184/0x2a4) from
				[<c01ae010>] (kthread+0x80/0x90)
[   43.231286] [<c01ae010>] (kthread+0x80/0x90) from
				[<c0106c4c>] (kernel_thread_exit+0x0/0x8)
[   45.648206] wcnss crash shutdown 0
[   45.650599] Rebooting in 5 seconds..

In the above log, it is seen that the bkops thread runs after
mmc_bus_shutdown is completed and sends CMD8. Hence, cancel
bkops work during shutdown to prevent sending commands after
mmc bus is shutdown.

CRs-fixed: 593813
Change-Id: I3e8e9eb228bd03603d04561eb478d60664f50aaa
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
mmc: queue: scale down the max_segs if memory allocation fails

In low memory conditions at runtime, allocation of max_segs may
fail. Retry with a scaled down max_segs until allocation succeeds.

CRs-fixed: 583267
Change-Id: I072724afa44854dacc58654e6329531c1bb11120
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
mmc: core: add wakeup functionality to sdio cards

This patch initializes wakeup source if the detected card
is a sdio card and enables the wakeup capability.

Platform drivers would have to invoke:
 * pm_wakeup_event on this card device to signal a wakeup
 * corresponding pm_relax have to be invoked

CRs-Fixed: 585481
Change-Id: Ic8d5c98073e8ed3f676eb42fc0ce1f13a11cb40f
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
mmc: core: Hold host resume status while card rescan is in progress

In case if a removable card is hot-plugged when the card and host
are runtime suspended then the mmc_rescan() tries to detect the card
status and removes the bus_ops. During card removal the Linux device
model calls pm_runtime_remove() of the corresponding "card" device,
which not only marks the device as suspended but also notifies the
parent so that it can be suspended if there are no children that are
holding resume. In case if the runtime suspend work of host is scheduled
before bus_ops are marked NULL in mmc_rescan(), the runtime suspend
of host fails with -ENOMEDIUM error. This error makes runtime PM framework
to permanently mark the host device in error and further runtime PM
operations are disallowed even when the card is re-inserted.

CRs-Fixed: 593475
Change-Id: Ie5e09f05ef26098c561b0c64b3954962d9d4c039
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
mmc: core : fix arbitrary read/write to user space

In the MMC card debug_fs the read and write handlers use the strlcat
and sscanf, without checking the pointer given.
Since the pointer is not checked it is possible to write
everywhere (ring 0 or 3).
In order to fix it, an access_ok function is being used to verify
the buffer's pointer supplied by user is valid.

CRs-fixed: 545716
Change-Id: Ia710b6af5a95974fc930ca902e8ff18afa4e17ba
Signed-off-by: Raviv Shvili <rshvili@codeaurora.org>
mmc: core : fix arbitrary read/write to user space

In the MMC card debug_fs the read and write handlers use the strlcat
and sscanf, without checking the pointer given.
Since the pointer is not checked it is possible to write
everywhere (ring 0 or 3).
In order to fix it, an access_ok function is being used to verify
the buffer's pointer supplied by user is valid.

CRs-fixed: 545716

Change-Id: I13ca736337fefe29ff9b0df6a318e7d92240f8b2
Signed-off-by: Raviv Shvili <rshvili@codeaurora.org>
mmc: quirks: enable clock gating for AR6004 card

This patch whitelists the AR6004 card for clock-gating.
The controller supports asynchronous interrupt functionality
which enables to receive interrupts from the card when clocks
are off. Hence, clocks can be turned off when idle.

This patch whitelists the card, to let the clock-gating
framework gate the clock during idle time.

CRs-Fixed: 585481
Change-Id: I651f86e42595cc82f99093c06ee220a1d0ec95a9
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
mmc: core: Issue with voltage switch sequence

When a broken UHS-I card is inserted, the voltage switch sequence
fails as expected but the controller is left in bad state due to
which software request timeouts are observed for further commands.
Add mmc_power_cycle() for any failure in voltage switch so it will
also help reset the controller in addition to card.

CRs-fixed: 608192
Change-Id: I332c0717b9310692799b9a4ba6570df67fcf3b6e
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>