HID: input: generic hidinput_input_event handler

The hidinput_input_event() callback converts input events written from
userspace into HID reports and sends them to the device. We currently
implement this in every HID transport driver, even though most of them do
the same.

This provides a generic hidinput_input_event() implementation which is
mostly copied from usbhid. It uses a delayed worker to allow multiple LED
events to be collected into a single output event.
We use the custom ->request() transport driver callback to allow drivers
to adjust the outgoing report and handle the request asynchronously. If no
custom ->request() callback is available, we fall back to the generic raw
output report handler (which is synchronous).

Drivers can still provide custom hidinput_input_event() handlers (see
logitech-dj) if the generic implementation doesn't fit their needs.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Michael Wright <michaelwr@google.com>

Conflicts:
	drivers/hid/hid-input.c

Bug: 13350426
Change-Id: I5bdf6c9c5c0523071248b210c41927ab8d3b0059
HID: validate HID report id size

commit 43622021d2e2b82ea03d883926605bdd0525e1d1 upstream.

The "Report ID" field of a HID report is used to build indexes of
reports. The kernel's index of these is limited to 256 entries, so any
malicious device that sets a Report ID greater than 255 will trigger
memory corruption on the host:

[ 1347.156239] BUG: unable to handle kernel paging request at ffff88094958a878
[ 1347.156261] IP: [<ffffffff813e4da0>] hid_register_report+0x2a/0x8b

CVE-2013-2888

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
HID: provide a helper for validating hid reports

commit 331415ff16a12147d57d5c953f3a961b7ede348b upstream.

Many drivers need to validate the characteristics of their HID report
during initialization to avoid misusing the reports. This adds a common
helper to perform validation of the report exisitng, the field existing,
and the expected number of values within the field.

Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
HID: zeroplus: validate output report details

commit 78214e81a1bf43740ce89bb5efda78eac2f8ef83 upstream.

The zeroplus HID driver was not checking the size of allocated values
in fields it used. A HID device could send a malicious output report
that would cause the driver to write beyond the output report allocation
during initialization, causing a heap overflow:

[ 1442.728680] usb 1-1: New USB device found, idVendor=0c12, idProduct=0005
...
[ 1466.243173] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2889

Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
HID: pantherlord: validate output report details

commit 412f30105ec6735224535791eed5cdc02888ecb4 upstream.

A HID device could send a malicious output report that would cause the
pantherlord HID driver to write beyond the output report allocation
during initialization, causing a heap overflow:

[  310.939483] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0003
...
[  315.980774] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2892

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
HID: LG: validate HID output report details

commit 0fb6bd06e06792469acc15bbe427361b56ada528 upstream.

A HID device could send a malicious output report that would cause the
lg, lg3, and lg4 HID drivers to write beyond the output report allocation
during an event, causing a heap overflow:

[  325.245240] usb 1-1: New USB device found, idVendor=046d, idProduct=c287
...
[  414.518960] BUG kmalloc-4096 (Not tainted): Redzone overwritten

Additionally, while lg2 did correctly validate the report details, it was
cleaned up and shortened.

CVE-2013-2893

Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
HID: check for NULL field when setting values

commit be67b68d52fa28b9b721c47bb42068f0c1214855 upstream.

Defensively check that the field to be worked on is not NULL.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
HID: ntrig: validate feature report details

commit 875b4e3763dbc941f15143dd1a18d10bb0be303b upstream.

A HID device could send a malicious feature report that would cause the
ntrig HID driver to trigger a NULL dereference during initialization:

[57383.031190] usb 3-1: New USB device found, idVendor=1b96, idProduct=0001
...
[57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[57383.315308] IP: [<ffffffffa08102de>] ntrig_probe+0x25e/0x420 [hid_ntrig]

CVE-2013-2896

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Rafi Rubin <rafi@seas.upenn.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net: wireless: bcmdhd: Disable OOB interrupt when WLAN is off

17446901 New error on resume in L on N5

Signed-off-by: Ritter Yeh <ryeh@broadcom.com>
HID: add missing hid usages mappings

Integrate several new definitions (not code) that
add additional hid mappings from the HID HUT 1.12
and approved additional requests.

Additions are taken from the commits in the
linux-input upstream: f362e69, 2a4d815, 3b5a7ab,
358f247, 701ba53, d09bbfd, af8036d, 5820e4d, a443255

Change-Id: Iff1be1e9fe251badec56cd22a4ec831489cbbe64
Signed-off-by: Mathieu Meisser <mmeisser@logitech.com>
Signed-off-by: Olivier Gay <ogay@logitech.com>
Signed-off-by: Michael Wright <michaelwr@google.com>

Conflicts:
	include/linux/input.h
usb: dwc3: Set the max speed

Set the gadget's max speed coressponding to the core's max speed.

Change-Id: I4800ab716bf2d4797ad77169d99fc253d581d8f9
Signed-off-by: Devin Kim <dojip.kim@lge.com>
arm/dt: hammerhead: Set the usb max speed to high

Hammerhead supports the high speed for USB maximum speed.

Change-Id: Ifd92a5880672ab845d5ec91d6fdb963f80e66d2d
Signed-off-by: Devin Kim <dojip.kim@lge.com>
lowmemorykiller: Account for highmem during kswapd reclaim

Currently most memory reclaim is done through kswapd.
Since kswapd uses a gfp mask of GFP_KERNEL, and because
the lowmemorykiller is zone aware, the lowmemorykiller will
ignore highmem most of the time.
This results in the lowmemorykiller being overly aggressive.

The fix to this issue is to allow the lowmemorykiller to
count highmem when being called by the kswapd if the lowmem
watermarks are satisfied.

Bug: 17626969
Change-Id: I938644584f374763d10d429d835e74daa4854a38
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Signed-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>
mm: Increase number of GFP masks

The __GFP_CMA mask is now placed after all available GFP masks.
With this we need to increase the total number of GFP flags.
Do so accordingly.

Bug: 17626969
CRs-Fixed: 648978
Change-Id: I53f5f064ac16a50ee10c84ff2bb50fdb7e085bd0
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>
msm: vidc: handle dynamic buffers in pendingq during flush

In dynamic buffer mode, if flush was received before
stream-on, driver would have incremented the ref count
for output buffers, but not yet sent to firmware. So,
after flush done, there would be no fbd from firmware
and the reference to these buffers would not be removed.
So when the buffers are dequeued, driver fails to
unmap and free the output buffers.
Subsequently, after flush done, when client queues
the same output buffers again to driver, the ref
count is increased and becomes 2. This results in
the driver holding the buffers with itself, thereby
entering in to a deadlock situation and starving the
firmware of output buffers. This results in a video
freeze.

b/17647776

Change-Id: I0c3d13124bd48b900e56e14666eaed2f0e7ee9d6
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
cpufreq: Always allow update of user policy

In the cases where the system boots up in a constraint with policy min and
max lower than cpuinfo min/max, and user tries to set a higher user
policy min, the value would be overridden during the verifying the
limits.

Once user initiates the sysfs write the previous user policy is
maintained in policy min and max thus changing the limits for verification
of the current policy. Once the verification is completed restore the
current user policy min/max with the updated values if any. This would take
care of cases uwhere user policy min/max input is higher/lesser than the
current min and max.

Bug: 17889870
Change-Id: I5ad92ba05162cb5c32c3ba3fdae21d2e505493d3
Signed-off-by: Taniya Das <tdas@codeaurora.org>
Signed-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>
sync: Limit logging to particular fence on timeout and error

Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
sync: Add a "details" callback for sync points

Allow drivers to add a callback for expanded details about a sync
point.  This provides for a much richer debug experience than can
be provided by the simpler callbacks.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
sync: Only print details for active fences

Only call the pt_log callback for active fences.

Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Lynus Vaz <lvaz@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
i2c-qup: don't ignore the last byte of a message

Ignoring the last byte of the I2C write message when
the I2C transfer has the multiple messages with
write and read from different slave addresses. This
leads to i2c master pulls the clock line low and
also client misses one byte of data from the
write message.

This patch allows the last byte of the write message
in this particular case also.

Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>