futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing
from a non-pi futex to a pi futex with this call. If we attempt this,
then dangling pointers may be left for rt_waiter resulting in an
exploitable condition.

This change brings futex_requeue() into line with
futex_wait_requeue_pi() which performs the same check as per commit
6f7b0a2a5 (futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi())

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
futex: Validate atomic acquisition in futex_lock_pi_atomic()

We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state. If
it has, return -EINVAL. The state is corrupted already, so no point in
cleaning it up. Subsequent calls will fail as well. Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
  	restoring the already corrupted user space state. ]

Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
futex: Always cleanup owner tid in unlock_pi

If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex. So the owner TID of the current owner
(the unlocker) persists. That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
futex: Make lookup_pi_state more robust

The current implementation of lookup_pi_state has ambigous handling of
the TID value 0 in the user space futex. We can get into the kernel
even if the TID value is 0, because either there is a stale waiters
bit or the owner died bit is set or we are called from the requeue_pi
path or from user space just for fun.

The current code avoids an explicit sanity check for pid = 0 in case
that kernel internal state (waiters) are found for the user space
address. This can lead to state leakage and worse under some
circumstances.

Handle the cases explicit:

     Waiter | pi_state | pi->owner | uTID      | uODIED | ?

[1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
[2]  NULL   | ---      | ---       | >0        | 0/1    | Valid

[3]  Found  | NULL     | --        | Any       | 0/1    | Invalid

[4]  Found  | Found    | NULL      | 0         | 1      | Valid
[5]  Found  | Found    | NULL      | >0        | 1      | Invalid

[6]  Found  | Found    | task      | 0         | 1      | Valid

[7]  Found  | Found    | NULL      | Any       | 0      | Invalid

[8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
[9]  Found  | Found    | task      | 0         | 0      | Invalid
[10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid

[1]  Indicates that the kernel can acquire the futex atomically. We
     came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

[2]  Valid, if TID does not belong to a kernel thread. If no matching
     thread is found then it indicates that the owner TID has died.

[3]  Invalid. The waiter is queued on a non PI futex

[4]  Valid state after exit_robust_list(), which sets the user space
     value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

[5]  The user space value got manipulated between exit_robust_list()
     and exit_pi_state_list()

[6]  Valid state after exit_pi_state_list() which sets the new owner in
     the pi_state but cannot access the user space value.

[7]  pi_state->owner can only be NULL when the OWNER_DIED bit is set.

[8]  Owner and user space value match

[9]  There is no transient state which sets the user space TID to 0
     except exit_robust_list(), but this is indicated by the
     FUTEX_OWNER_DIED bit. See [4]

[10] There is no transient state which leaves owner and user space
     TID out of sync.

Backport to 3.13
  conflicts: kernel/futex.c

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
USB: dwc3: otg: Always draw GADGET_VBUS_DRAW from SDP charger

* When DWC3 is in peripheral mode it relies on the gadget driver to
  signal how much power to draw. Since we are Android we know we will
  max at GADGET_VBUS_DRAW, so set that up by default. This should be
  harmless since the Android composite gadget should be able to
  reconfigure this when changing it's own mode.

Change-Id: Id32854725f71ac823327828c8214affce3b9ce17
misc: Update kernel from SVN8016 140603

Change-Id: If86dc03d0734a6c817a80918a2169c24c4e7adff
bacon: Split off a0001 specific sound entries

* Also clean up duplicate camera entry

Change-Id: I0422fa9d30e598c064b56276cbece1b870aa64ef
Revert "msm: vidc: Remove artificial cap of VP8 at 1080p"

This reverts commit ee09f4e68aa0c6dbcea5a212f1b08fb3a70d20b4.
msm: vidc: Query deblocker parameters from cluster

Various fields of h264_db_control were left uninitialised before being
sent to the firmware.  As a result, due to poor luck, the resulting
encoded bitstreams were invalid as the alpha and beta were not in the
acceptable range of [-6, 6].  This commit fills the uninitialised values
with values obtained by querying the cluster.

Change-Id: Ic217d007239bc059302bdcdf2aebad1c9ca88244
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm-vidc: Modify Q6 HFI not to alter VP8 max supported width

Modify Q6 HFI not to alter the core returned max supported
width and height. Whereas venus HFI will alter the the max
supported width and height to 1080p.

Change-Id: I901862e8fc98a1a6d80e62e7ab2d6477de5f07a4
Signed-off-by: Ravi Kiran Vonteddu <rvontedd@codeaurora.org>
msm: vidc: Update vb2q buffer sizes

Currenttly is updating vb2q buffer size on CAPTURE port.
only.This change will update the buffer size on OUTPORT port
along with CAPTURE port.

Change-Id: Ieb0a898ae5b012f3bf1a1073d2ddf5ce72647252
CRs-Fixed: 621134
Signed-off-by: Prasad Nallani <pnalla@codeaurora.org>
msm: vidc: Fix race condition during concurrent sessions

The core->instances list structure is guarded by
mutex core->lock, whenever a new video instance is added
or deleted from the list. However this list was accessed
from certain functions without acquiring the lock, which
resulted in race condition, causing the device to crash.
Also clean up the core locking mechanism.

Change-Id: I6f431bc381d54948611783e19fac853c83a87203
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: vidc: Validate userspace buffer count

Makesure the number of buffers count is less than
the maximum limit to avoid structure overflow errors.

Change-Id: Icf3850de36325637ae43ac95f1c8f0f63e201d31
CRs-fixed: 563694
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
msm: vidc: rewrite v4l2 cluster construction

V4L2 framework has limitation of not supporting
same control in multiple clusters. Overcome this
limitation by grouping all controls in to one
super cluster.

Change-Id: I974199e1388a1b33ae5e56edd4b0af712eb9babf
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: vidc: fix a race condition in cluster construction

At start of video session, when the super cluster is
constructed, it refers to a global static variable.
If we have multiple instances running simultaneously,
there exists a race condition, causing the instance
to register wrong cluster. Later on when a control
gets set in encoder, if the control is not found in
the cluster, we hit a BUG_ON, crashing the device.

Change-Id: Ib4ee64d684d903bb4f22310a1b34619728405649
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: vidc: Validate userspace buffer count before using it

Validate the number of buffers count variable before
using it to avoid structure overflow error.

Change-Id: I61582c93e0f26ec6842e437134fb8a42bdbc36ff
CRs-fixed: 563654
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
msm: wfd: Modify enc_avg_latency to only measure the encode latency

Previously enc_avg_latency measured the time Video code took took to
encode a frame and the latency of the userspace client in picking up the
buffer.  Change the meaning just to measure encoder busy time.

CRs-Fixed: 647538
Change-Id: Ib7c30e51a267a0a2926096f13a933cdc94656453
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: vidc: Free memory allocated to keep track of buffer ownership

Memory for free_output_indices and free_input_indices was never freed.
This commit kfrees the memory as part of venc_close().

CRs-Fixed: 631998
Change-Id: Iae28a1266bdf78445c1a936721d9901c9fa0f285
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
msm: mdss: fix asynchronous rotation of layer bigger than line buffer

If MDSS HW has more than 2 rotators and if the layer width is greater
than line buffer width then layer is divided into two and each half
can be rotated independently and asynchronously. Current implementation
sets up the configuration of both halves independently but the rotation
of second half is triggered only after first half is finished. Fix this
issue by making writeback_kickoff unblocking call and wait for the
rotation completion after all the rotations in the current session are
queued.

Change-Id: I90ff7feab7979037e596a3b8d8c9e6c138574e94
Signed-off-by: Ujwal Patel <ujwalp@codeaurora.org>
msm: mdss: use default cosite as default chroma site for all dst formats

When BWC is enabled and format is H1V2, downscaling hangs
with a particular cosite configuration. This workaround
avoids the particular configuration

Change-Id: Ib9cd979958cd080f3747732c14e737f0e90fbb3d
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>