msm: display: command mode panel release fence

For command mode panel, release fence should be signaled after the buffer is
sent to the panel.  For performance consideration, allow one more commit to be
queued.  Keep the second kick off as short as enough.

Change-Id: I19af075ebf480d3e81b46b1cd2ef21a2893f143e
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
Signed-off-by: Iliyan Malchev <malchev@google.com>
msm: mdp: Change msmfb kworker to kthread

This worker can be a longer running task depending on the number
of frames queued, hence change it to a thread.

Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
Change-Id: Iebf7e95d0486ac43aa6a12d70442936600c0249a
msm: mdp: Update sync pt. behaviour

Add a retire fence and clean up the existing release fence
implementation

Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
Change-Id: Iecf7e95d0786ac43aa6a12d70442936600c0249a
msm: vidc: free the recon buffers in cleanup function

- The recon buffers were not released when video recording
  was killed abruptly leading to memory leak.

- Fix provided to release the recon buffers when media
  server killed abruptly.

Change-Id: I48ac1a592719446b7e4bf87bbd707d09351d1e61
Signed-off-by: srikarri <sridur@codeaurora.org>
msm: vidc: Initialize kernel space stack variables

This change initializes kernel space stack variables
that are passed between kernel space and user space
using ioctls.
Non initialization of these variables may lead to
leakage of memory values from the kernel stack to
user space.

Change-Id: Icb195470545ee48b55671ac09798610178e833e1
CRs-fixed: 556771,563420
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: vidc: Check validity of userspace address

Before writing to a userspace address, verification
of the validity of user space address is required.

Change-Id: I9141e44a6c11aaf3f4d57c08bb0dd26a7b214f34
CRs-fixed: 556356
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: vidc: Validate userspace buffer count before using it

Validate the number of buffers count variable before
using it to avoid structure overflow error.

Change-Id: I61582c93e0f26ec6842e437134fb8a42bdbc36ff
CRs-fixed: 563654
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
msm: vidc: Validate userspace buffer count

Makesure the number of buffers count is less than
the maximum limit to avoid structure overflow errors.

Change-Id: Icf3850de36325637ae43ac95f1c8f0f63e201d31
CRs-fixed: 563694
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
huashan: enable SELinux

Change-Id: Idc9c3322f90325cec16bf2b610d89027fa9e8980
Merge changes Icf3850de,I61582c93,I9141e44a,Icb195470,I48ac1a59 into cm-11.0

* changes:
  msm: vidc: Validate userspace buffer count
  msm: vidc: Validate userspace buffer count before using it
  msm: vidc: Check validity of userspace address
  msm: vidc: Initialize kernel space stack variables
  msm: vidc: free the recon buffers in cleanup function
msm8960t: dirty gcc3.7 compile fix

till CAF is merging real patches this one fixes broken compile

Change-Id: I5ef320849974ea4efd7c186c68438c7660e232c8
msm8960t: Full update from 12.1.A.0.266 Android 4.3 kernel

* excludes prima wlan
* keeps other previous changes
* can be merged with blue platform

Change-Id: Ifb2bf24dfc0b5c261959bb68a6592dc3692a6190
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Change-Id: I9d3d7b4a3bbd719ced5192c417b4338774447993
References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>