gpu: ion: Add dummy msm_ion header file

The msm specific parts of ion.h are being moved into a new header
file. For now, add a dummy header file to get clients transitioned
over.

Change-Id: Iac039678e1c3f15d87e67aa667f7e9883ca16669
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
msm_fb: display: Fix double entry in clean pipes.

Caused by the double entry of this commit: "e256961d379c264e2fde3665dfd32fe6ce9ce9d9"

Change-Id: I5a1c4ed7b71c8ef2d0ee2e997303df78f37fc7e1
gpu: ion: Add dummy msm_ion header file

The msm specific parts of ion.h are being moved into a new header
file. For now, add a dummy header file to get clients transitioned
over.

Change-Id: Iac039678e1c3f15d87e67aa667f7e9883ca16669
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
msm8660: fix panic when calculated clock is too high

  * pr_err() in this case was missing an argument which caused printk()
    to dereference a null string.
  * This fixes the hard crash seen when playing a landscape 1080p video
    in portrait orientation or a portrait video in landscape.

Change-Id: I19cf72951d5ce3bd8f321f9f30c39ae9bce3d785
msm8660: fix panic when calculated clock is too high

  * pr_err() in this case was missing an argument which caused printk()
    to dereference a null string.
  * This fixes the hard crash seen when playing a landscape 1080p video
    in portrait orientation or a portrait video in landscape.

Change-Id: I19cf72951d5ce3bd8f321f9f30c39ae9bce3d785
(cherry picked from commit 6cac08d7500d72d70e0daa4ef4e46eed5b32a3a1)
exhilarate: add defconfig updates

Change-Id: I4803949b74a254cb4087fa9f583269f8e01a7b62
t769: update defconfig

Change-Id: Icdc1f4e140811876cf42fe1065f4f47420714ba5
defconfig: enable uhid for all cm supported devices

Change-Id: If2308495ca51ab5536477d332aa147191adbcfe8
defconfig: enable uhid for all cm supported devices

Change-Id: If2308495ca51ab5536477d332aa147191adbcfe8
(cherry picked from commit b57497555b392871bec0de8890e0dee8ded72489)
Merge "t769: update defconfig" into next
hercules: update config

Change-Id: I9b76e610402f5ea2c0a4d428418aea31ebed95ca
Merge "msm_fb: display: Fix double entry in clean pipes." into next
quincyatt: update defconfig

Change-Id: I22c57cc38e37e327b3b72e3c3d6c9cb6d08c843d
quincydcm: update defconfig

Change-Id: I0b1eb01cc11da041816127afa8ed7932e961c597
quincytmo: update defconfig

Change-Id: I14384c57ff494f36289a8f40eeadb16c5190186d
msm: mpd: Fix writeback merge conficts.

Resolves conflicts generated by the following commits:
- e256961d379c264e2fde3665dfd32fe6ce9ce9d9
- 3a7b8793f84ad3f79a52674cabb3fc69097970b8

Change-Id: I11871cb59b39b4f5445cb6c58a672fbc85488d9f
Merge remote-tracking branch 'github/next' into cm-11.0
Avoid to create duplicate filename for misc devices.

There has two bugs.
1. For example, the 'psaux' device will use '1' as minor number to
register misc device, but misc deriver doesn't set the '1' as used.
It's the root casue for duplicate filename.
2. From warning message, minor number '1' is the one of duplicate
fileanme, it meanes the number of dynamic minor is not enough.

The symptom of creating duplicate filename:
------------[ cut here ]------------
     WARNING: at fs/sysfs/dir.c:508 sysfs_add_one+0x7c/0x9c()
     sysfs: cannot create duplicate filename '/dev/char/10:1'
[<c00148b8>] (unwind_backtrace+0x0/0x11c) from
[<c007f828>] (warn_slowpath_common+0x48/0x60)
[<c007f898>] (warn_slowpath_fmt+0x2c/0x3c)
[<c018696c>] (sysfs_add_one+0x7c/0x9c)
[<c01874b4>] (sysfs_do_create_link+0x10c/0x1f8)
[<c03bd6c0>] (device_add+0x1ac/0x5e4)
[<c03be24c>] (device_create_vargs+0x8c/0xd0)
[<c03be2ac>] (device_create+0x1c/0x24)
[<c037c7a4>] (misc_register+0xb4/0x118)
[<c0e30c1c>] (init_log+0x10/0x4c)
[<c0e009d8>] (do_one_initcall+0x90/0x160)
[<c0e00b94>] (kernel_init+0xec/0x1a8)
[<c000f468>] (kernel_thread_exit+0x0/0x8)
---[ end trace da227214a82491b9 ]---

BUG 8889112

Change-Id: I186a945a56fc831f59e19509365a0ae8a481bb2d
Signed-off-by: singhome_lee <singhome_lee@asus.com>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Change-Id: I7f5d6d28ff8bcfea9d1cdf9e628d4c5e32d2afe8
References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Merge remote-tracking branch 'cm/cm-11.0' into HEAD