mm: make fixup_user_fault() check the vma access rights too

fixup_user_fault() is used by the futex code when the direct user access
fails, and the futex code wants it to either map in the page in a usable
form or return an error.  It relied on handle_mm_fault() to map the
page, and correctly checked the error return from that, but while that
does map the page, it doesn't actually guarantee that the page will be
mapped with sufficient permissions to be then accessed.

So do the appropriate tests of the vma access rights by hand.

[ Side note: arguably handle_mm_fault() could just do that itself, but
  we have traditionally done it in the caller, because some callers -
  notably get_user_pages() - have been able to access pages even when
  they are mapped with PROT_NONE.  Maybe we should re-visit that design
  decision, but in the meantime this is the minimal patch. ]

Found by Dave Jones running his trinity tool.

Reported-by: Dave Jones <davej@redhat.com>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
locks: allow __break_lease to sleep even when break_time is 0

A fl->fl_break_time of 0 has a special meaning to the lease break code
that basically means "never break the lease". knfsd uses this to ensure
that leases don't disappear out from under it.

Unfortunately, the code in __break_lease can end up passing this value
to wait_event_interruptible as a timeout, which prevents it from going
to sleep at all. This causes __break_lease to spin in a tight loop and
causes soft lockups.

Fix this by ensuring that we pass a minimum value of 1 as a timeout
instead.

Cc: <stable@vger.kernel.org>
Cc: J. Bruce Fields <bfields@fieldses.org>
Reported-by: Terry Barnaby <terry1@beam.ltd.uk>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
ext4: use i_size_read in ext4_unaligned_aio()

We haven't taken i_mutex yet, so we need to use i_size_read().

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org
msm: camera: sensor: Update CCI WR comamnd buffer size to 11 bytes

I2C command length is of 11 bytes, it includes 10 bytes of data and
one byte of WR command. Use 11 bytes char array to create command.

Change-Id: Idf330fef6b8da79c6b7f5a2839d88a68e10a96f9
Signed-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>
mmc: core: Fix clock frequency transitions during invalid states

eMMC and SD card specifications restrict the usage of a class of
commands while commands in other class are in progress. For example,
during erase operations the SD/eMMC spec. allows only CMD35, CMD36,
CMD38. If clock scaling is enabled and decide to scale up the clocks
it may be possible that CMD19/21 tuning commands are sent in between
erase commands, which is illegal as per specification.

Fix such illegal transactions to the card and also make clock scaling
statistics accountable only for read/write commands instead of time
consuming commands, like CMD38 erase, where transactions are independent
of bus frequency.

Change-Id: Iffba175787837e7f95bde8970f19d0f0f9d7d67d
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
ARM: Improve vmalloc address checking in show_data()

There is an unhandled corner case with the current check
which has recently been hit. The nbytes argument may be
large enough for the range being dumped to cross a
boundary between page-table mappings, and dump addresses
which are vmalloc'd in the neighboring mapping.

Check every address being dumped to see if its vmalloc'd,
not just the address passed to show_data().

CRs-Fixed: 625442
Change-Id: I255b093808177321f5202dcacea337ee333bfc63
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
ARM: Don't dump vmalloc addresses with show_data()

Memory-mapped IO address spaces cannot be safely dumped at will.
Some addresses may not be available (clocked, powered) at all times,
and may result in hangs or bus decode errors if accessed. Other
registers that are accessible may have read side-effects, and dumping
them may have adverse affects on stability or the functionality of
the affected peripheral.

Be safe, and skip dumping such addresses altogether.

CRs-Fixed: 625442
Change-Id: I4cfa75f027ededf841a0240715af0db385857cbe
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
Signed-off-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
mmc: sdhci: finish the request if sdhc is in bad state.

In the current code, if sdhci_check_state returns true a tasklet is
scheduled which doesn't complete the request if host->mrq is NULL,
which is the case, if sdhci is in bad state. This would make the
mmcqd thread wait for completion infinitely.
Hence, complete the request if sdhci_check_state returns true instead
of scheduling the tasklet.

CRs-Fixed: 615537
Change-Id: I8e2950c3999ac3806f9d631c52d86f0dc13b992f
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
(cherry picked from commit 94a1536c5c909afb210c66c64d7d52aa7d1271fb)
cfg80211: unblock user hint when cfg80211_regdom is intersected

If the driver is loaded when cfg80211_regdom is intersected then
user hint will fail for the first time since cfg80211 does not
have a check to see if cfg80211_regdom is intersected. Add
a check to see if cf80211_regdom is intersected and allow the
user hint to be processed.

Change-Id: Iba9cdd32470e29d35d3bb35012eb404b7c78d601
CRs-Fixed: 639538
Signed-off-by: Mihir Shete <smihir@codeaurora.org>