msm_bam_rmnet: Check for sufficient headroom

Check for sufficient headroom before attempting transmit. Prevent
crash when skb_push() with insufficient headroom. Added module parameter
to track number of times packet expansion required.

CRs-Fixed: 538716
Change-Id: I09126f885b38a47a3ebc2556b5458343acd19d03
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: hdmi-cec: bounds check cec frame size

Ensure that the frame size for the HDMI-CEC message
frame size doesn't exceed the maximum size when
reading message from userspace through sysfs interface.
This avoids potential overflow in cec send msg routine.

Change-Id: I891f23ed70ed5a6c0e3af1f47869effa079ffac8
CRs-Fixed: 520140
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
mmc: sdhci: propagate execute_tuning error to the caller

Propagate error from host operation execute_tuning to the
caller so that necessary action can be taken accordingly.

Change-Id: I66cf12d974ac1cff914bd866183d0beca66a4cdd
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
spi_qsd: set device's runtime PM status to 'suspended'

Sometimes system suspend is initiated before runtime
PM's auto-suspend delay expires and causing devices to
not suspended runtime. As part of system suspend if
device is not suspended runtime then clocks and gpios
are manages by system suspend.

If spi client does initiate transaction request immediately
after system resume then spi doesn't resume run-time
immediately as spi controller's device state is not in
'suspended state'.

Keep device's runtime PM status to suspended during
system suspend.

CRs-Fixed: 512718
Change-Id: I5c0cb39c0b91782d8686c1b3da81125169ccf9be
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: hdmi: Proper HDMI feature check

Checks for the proper HDMI feature before providing the
corresponding feature data to avoid invalid memory access.

CRs-Fixed: 542785
Change-Id: I943bee9e843e0504effdfddfaf2dea82c22388f6
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: hdmi: Security check for EDID 3D data parsing

While parsing EDID (Extended display identification data) received
from TV for 3D data and other, proper buffer overflow check is done
to avoid data overflow or overwrite.
Also, replace snprintf with scnprintf for better memory copy results.

CRs-Fixed: 542823
Change-Id: I2603beea6eb88a92b013a1a45d960a4c3ba6c09b
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: qdsp6v2: memset stack buffer allocation.

This is needed to avoid garbage data in uninitialized variables.

Change-Id: Ic4b4d7481644c2add187a9122a4e7cfe7255b379
CRs-Fixed: 553304
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: qdsp: memset stack buffer allocation.

This is needed to avoid garbage data in uninitialized variables.

Change-Id: I456be431ee2e22fa5cd5fd2951d7079e177e3646
CRs-Fixed: 553262
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
msm: mdss: hdmi: Proper permissions for CEC logical address

Do not give universal access to CEC (Consumer Electronics Control)
sysfs nodes for logical and physical addresses to avoid unauthorized
access.

CRs-Fixed: 547968
Change-Id: I2ba57f050cc92a361586064dfd5e5659ab07c2f7
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Revert "ARM: msm: hammerhead: Update wlan locale translation table"

This reverts commit 2063faa0a2a2f0b1cd57091a79e1f586cd2592a7.
ARM: msm: hammerhead: Remove DFS channels in default locale

Change-Id: Ic61e5c029d9a7043c0e60401db8f91c784e73cd3
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
msm: camera: Add support for RAW streams in camera

Add suport for raw streams in ISP driver.

Change-Id: I5121981f63d656d08a72f362a6a9621031226dab
Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
Signed-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>
msm: camera2: cpp: Append frame buffers to the list

In case of late buffer allocation, allocated buffers
have to be appended to the existing queues.

Change-Id: Ie14f00038e86b9d7c8caa01587a2ed1aee7d80e8
Signed-off-by: Iliya Varadzhakov <ivarad@codeaurora.org>
Signed-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>
msm: camera: Fix buffer index mismatch for HAL buffer

AXI irq could arrive before EOF irq. Because of this,
folowing changes are made:

1. Set request_frame flag during IOCTL instead of waiting
until EOF, and
2. Set AXI skip flag during SOF instead of EOF.

Bug: 13887745
Signed-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>
Change-Id: I25a238e2cfae0e3a792a3689e00e16bc46dcb9d0
net/ipv6/addrconf: fix wdog_bark caused by infinite spinning on a deadlock

A synchronization issue may occur while addrconf_ifdown(),
when it updates inet6_addr_lst[] with already destroyed *ifp
by ipv6_add/del_addr(), using the same addrconf_hash_lock.

[core 0]                                        [core 1]
   |                                               |
   |->ipv6_add_addr                                |->addrconf_ifdown
       |                                               |
       |                                               |-> spin_lock(&addrconf_hash_lock);
       |                                               |-> remove ifa->addr_lst from inet6_addr_lst
       |                                               |-> spin_unlock(&addrconf_hash_lock);
       |-> spin_lock(&addrconf_hash_lock);             |
       |-> add ifa->addr_lst to inet6_addr_lst[hash]   |
       |-> spin_unlock(&addrconf_hash_lock);           |
       |-> write_lock(&idev-lock);                     |
       |-> add ifa->if_list to idev->addr_list         |
       |-> write_unlock(&idev->lock);                  |
       |                                               |-> write_lock(&idev->lock);
       |                                               |-> remove ifa->if_list from idev->addr_list
       |                                               |-> write_unlock(&idev->lock);

[28055.378524] ------------[ cut here ]------------
[28055.378591] WARNING: at net/ipv6/addrconf.c:546 inet6_ifa_finish_destroy+0x98/0xc8()
[28055.378691] [<c010de1c>] (unwind_backtrace+0x0/0x144) from [<c09fd08c>] (dump_stack+0x20/0x24)
[28055.378747] [<c09fd08c>] (dump_stack+0x20/0x24) from [<c0192adc>] (warn_slowpath_common+0x58/0x70)
[28055.378840] [<c0192adc>] (warn_slowpath_common+0x58/0x70) from [<c0192bec>] (warn_slowpath_null+0x2c/0x34)
[28055.378931] [<c0192bec>] (warn_slowpath_null+0x2c/0x34) from [<c0911a90>] (inet6_ifa_finish_destroy+0x98/0xc8)
[28055.379026] [<c0911a90>] (inet6_ifa_finish_destroy+0x98/0xc8) from [<c091498c>] (addrconf_ifdown+0x2e4/0x430)
[28055.379120] [<c091498c>] (addrconf_ifdown+0x2e4/0x430) from [<c0915b70>] (addrconf_notify+0xe4/0x3ac)
[28055.379209] [<c0915b70>] (addrconf_notify+0xe4/0x3ac) from [<c01b9df0>] (notifier_call_chain+0x54/0x94)
[28055.379321] [<c01b9df0>] (notifier_call_chain+0x54/0x94) from [<c01ba3ac>] (__raw_notifier_call_chain+0x24/0x2c)
[28055.379379] [<c01ba3ac>] (__raw_notifier_call_chain+0x24/0x2c) from [<c01ba3dc>] (raw_notifier_call_chain+0x28/0x30)
[28055.379475] [<c01ba3dc>] (raw_notifier_call_chain+0x28/0x30) from [<c0840ea4>] (call_netdevice_notifiers+0x38/0x60)
[28055.379568] [<c0840ea4>] (call_netdevice_notifiers+0x38/0x60) from [<c0844d5c>] (__dev_notify_flags+0x3c/0x6c)
[28055.379657] [<c0844d5c>] (__dev_notify_flags+0x3c/0x6c) from [<c0844dcc>] (dev_change_flags+0x40/0x58)
[28055.379747] [<c0844dcc>] (dev_change_flags+0x40/0x58) from [<c08d2834>] (devinet_ioctl+0x79c/0x8bc)
[28055.379837] [<c08d2834>] (devinet_ioctl+0x79c/0x8bc) from [<c08d3488>] (inet_ioctl+0x1c0/0x1d0)
[28055.379928] [<c08d3488>] (inet_ioctl+0x1c0/0x1d0) from [<c082d7f0>] (sock_ioctl+0x80/0x248)
[28055.379982] [<c082d7f0>] (sock_ioctl+0x80/0x248) from [<c0275364>] (do_vfs_ioctl+0x94/0x5bc)
[28055.380071] [<c0275364>] (do_vfs_ioctl+0x94/0x5bc) from [<c0275908>] (sys_ioctl+0x7c/0x8c)
[28055.380164] [<c0275908>] (sys_ioctl+0x7c/0x8c) from [<c0107300>] (ret_fast_syscall+0x0/0x30)
[28055.380252] ---[ end trace 920b8b321354f066 ]---
[28061.735021] Watchdog bark! Now = 28061.735014
[28061.735106] Watchdog last pet at 28050.179294
[28061.735245] cpu alive mask from last pet 0-3
[28061.735321] Causing a watchdog bite!

The addrconf_hash_lock should cover both modification of inet6_addr_list and idev->addr_list
to resolve any possible synchronization issue between addrconf_ifdown() and ipv6_add/del_addr().

Bug: 11293746
Signed-off-by: David C. Park <davidc.park@lge.com>
netlink: fix possible spoofing from non-root processes

[ Upstream commit 20e1db19db5d6b9e4e83021595eab0dc8f107bef ]

Non-root user-space processes can send Netlink messages to other
processes that are well-known for being subscribed to Netlink
asynchronous notifications. This allows ilegitimate non-root
process to send forged messages to Netlink subscribers.

The userspace process usually verifies the legitimate origin in
two ways:

a) Socket credentials. If UID != 0, then the message comes from
   some ilegitimate process and the message needs to be dropped.

b) Netlink portID. In general, portID == 0 means that the origin
   of the messages comes from the kernel. Thus, discarding any
   message not coming from the kernel.

However, ctnetlink sets the portID in event messages that has
been triggered by some user-space process, eg. conntrack utility.
So other processes subscribed to ctnetlink events, eg. conntrackd,
know that the event was triggered by some user-space action.

Neither of the two ways to discard ilegitimate messages coming
from non-root processes can help for ctnetlink.

This patch adds capability validation in case that dst_pid is set
in netlink_sendmsg(). This approach is aggressive since existing
applications using any Netlink bus to deliver messages between
two user-space processes will break. Note that the exception is
NETLINK_USERSOCK, since it is reserved for netlink-to-netlink
userspace communication.

Still, if anyone wants that his Netlink bus allows netlink-to-netlink
userspace, then they can set NL_NONROOT_SEND. However, by default,
I don't think it makes sense to allow to use NETLINK_ROUTE to
communicate two processes that are sending no matter what information
that is not related to link/neighbouring/routing. They should be using
NETLINK_USERSOCK instead for that.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
prctl: adds PR_SET_TIMERSLACK_PID for setting timer slack of an arbitrary thread.

Second argument is similar to PR_SET_TIMERSLACK, if non-zero then the
slack is set to that value otherwise sets it to the default for the thread.

Takes PID of the thread as the third argument.

This allows power/performance management software to set timer slack for
other threads according to its policy for the thread (such as when the
thread is designated foreground vs. background activity)

Change-Id: I744d451ff4e60dae69f38f53948ff36c51c14a3f
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
input: SynaImage_ds5: Firmware E079 (ORISE)

- Improved noise peak filter (increase from 60 to 70)
- Increased IM threshold of switching into 60Hz
- Increased software filter delay
- Less frequency shifting in noisy state
- Improved low temperature environment

Change-Id: I58a79c034ee1600cc7a2b79c48bf2ef2594efecb
Signed-off-by: Jongrak Kwon <jongrak.kwon@lge.com>
net: Fix "ip rule delete table 256"

[ Upstream commit 13eb2ab2d33c57ebddc57437a7d341995fc9138c ]

When trying to delete a table >= 256 using iproute2 the local table
will be deleted.
The table id is specified as a netlink attribute when it needs more then
8 bits and iproute2 then sets the table field to RT_TABLE_UNSPEC (0).
Preconditions to matching the table id in the rule delete code
doesn't seem to take the "table id in netlink attribute" into condition
so the frh_get_table helper function never gets to do its job when
matching against current rule.
Use the helper function twice instead of peaking at the table value directly.

Originally reported at: http://bugs.debian.org/724783

Reported-by: Nicolas HICHER <nhicher@avencall.com>
Signed-off-by: Andreas Henriksson <andreas@fatal.se>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reduce min capture period size from 320 to 64

Change-Id: I8d6ed9d06e49561e9a9db51940b997f321a1ae87