kdbus.h: fix wrong ioctl read/write declarations (ABI break)
connection: remove locking from kdbus_conn_reply_finish()

There's no obvious reason to hold the connection's lock at this point.
connection: nullify queue->reply in kdbus_conn_recv_msg()

To make sure we don't finish the same reply block more than once.
connection: do not finish replies in __kdbus_conn_free(),

... just free them. The replies in the list are the ones the connection
which is going away is waiting for, so there's no need to finish
anything.
connection: rework sync logic

Avoid real queueing and dequeueing in sync cases. To achive this,

* parts of kdbus_conn_recv_msg() are moved into kdbus_conn_msg_install()
* pass around a struct kdbus_conn_reply rather than an offset
connection: kill kdbus_conn_reply.expect_reply

That's redundant information.
connection: kill kdbus_conn_queue.sync

Use conn_waiting to signal sync reply entries.
connection: avoid NULL pointer dereference
connection: cosmetic cleanup
connection: add comments
connection: clean up queue even if kdbus_conn_msg_install() fails
connection: fix comment
connection: fix locking in sync message delivery
connection: clean up code nesting in kdbus_conn_kmsg_send

also, closes a lock gap
connection: pass return code from kdbus_conn_queue_alloc() to sync waiter
connection: use del_timer_sync()

and check for disconnected connection in the worker.
connection: hold lock for kdbus_conn_reply_finish()
Revert "connection: hold lock for kdbus_conn_reply_finish()"

This reverts commit 1d3a6d1db374ca57c4c8402de12409cc5440b50c.
x86, x32: Correct invalid use of user timespec in the kernel

The x32 case for the recvmsg() timout handling is broken:

  asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
                                      unsigned int vlen, unsigned int flags,
                                      struct compat_timespec __user *timeout)
  {
          int datagrams;
          struct timespec ktspec;

          if (flags & MSG_CMSG_COMPAT)
                  return -EINVAL;

          if (COMPAT_USE_64BIT_TIME)
                  return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                        flags | MSG_CMSG_COMPAT,
                                        (struct timespec *) timeout);
          ...

The timeout pointer parameter is provided by userland (hence the __user
annotation) but for x32 syscalls it's simply cast to a kernel pointer
and is passed to __sys_recvmmsg which will eventually directly
dereference it for both reading and writing.  Other callers to
__sys_recvmmsg properly copy from userland to the kernel first.

The bug was introduced by commit ee4fa23c4bfc ("compat: Use
COMPAT_USE_64BIT_TIME in net/compat.c") and should affect all kernels
since 3.4 (and perhaps vendor kernels if they backported x32 support
along with this code).

Note that CONFIG_X86_X32_ABI gets enabled at build time and only if
CONFIG_X86_X32 is enabled and ld can build x32 executables.

Other uses of COMPAT_USE_64BIT_TIME seem fine.

This addresses CVE-2014-0038.

Signed-off-by: PaX Team <pageexec@freemail.hu>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: <stable@vger.kernel.org> # v3.4+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
block: cgroups, kconfig, build bits for BFQ-v7-3.13

Update Kconfig.iosched and do the related Makefile changes to include
kernel configuration options for BFQ. Also add the bfqio controller
to the cgroups subsystem.

Signed-off-by: Paolo Valente <paolo.valente@unimore.it>
Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>