ngd_slim: Decouple clock pause from power down/up

NGD slimbus driver itself can never send out clock pause sequence
for slimbus protocol on the HW lines since it can only be sent by
a manager device (which is controlled by ADSP when NGD driver is
instantiated from apps side).
Previously, clock pause of slimbus framework was coupled with power
down/up. That is not correct, since manager device may or may not
decide to send clock-pause on the HW lines. (e.g. if apps is inactive,
but some client on ADSP is active, clock-pause sequence won't be sent
over the bus.
Decouple power-on/off from clock pause to avoid giving incorrect
impression to clients on apps side about clock-pause state. Mark
clock-pause as unsupported by setting wakup function pointer to NULL
instead since this controller on apps cannot send it on HW lines.

CRs-Fixed: 667165
Change-Id: I382bca153deb2fed1d0f0672adaebde1e122dc68
Signed-off-by: Sagar Dharia <sdharia@codeaurora.org>
msm_bam_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Merge "ngd_slim: Decouple clock pause from power down/up"
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: I9ee5c8a87cc43c7b1e1dc2796949e7c20c74ddf4
Git-commit: e9c243a5a6de0be8e584c604d353412584b592f8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
Merge "n_tty: Fix n_tty_write crash when echoing in raw mode"
Merge "futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)"
net: ipv4: current group_info should be put after using.

Plug a group_info refcount leak in ping_init.
group_info is only needed during initialization and
the code failed to release the reference on exit.
While here move grabbing the reference to a place
where it is actually needed.

Change-Id: I38d476f49e7ae300bc1168bc4b2c1b67274a51ca
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit:b04c46190219a4f845e46a459e3102137b7f6cac
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
Merge "net: ipv4: current group_info should be put after using."
Merge "msm_bam_rmnet: Fix potential memory corruption"
net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

memset() the structure ethtool_wolinfo that has padded bytes
but the padded bytes have not been zeroed out.

Change-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
Merge "net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()"
Merge 6a583677ecad6c386346d8cd04435da8b9f36964 on remote branch

Change-Id: I59c8753fbc81e38c83922a733955764a29b40833
Merge "Merge 6a583677ecad6c386346d8cd04435da8b9f36964 on remote branch"
ASoC: msm: qdsp6v2: adding volume per dev-id

Add volume mixer control per device id for pcm use case.

Change-Id: Ieab721541a5cdf494b7fad78abc06d4f667b4baf
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
crypto: msm: add suspend/resume callback for qcedev driver

Make chanegs to add suspend/resume callback for qcedev driver, and
disable ce clocks when entering suspend and re-enable clocks in resume.

Change-Id: Ibeab1e7cb531af79ae973d7ff0d0ed2d776f6d6f
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: William Clark <wclark@codeaurora.org>
msm: Create shadow files under /sys/kernel/ipv4

The TCP delayed ack parameters can be configured from user space
application which runs with non-root credentials and does not have
direct write access to /proc entries. This commit creates shadow
files under /sys/kernel/ipv4 which maps to /proc/sys/net/ipv4.

CRs-Fixed: 628139
Change-Id: Ib7242aaae930dbc02133e44c04e182ebc52bc89f
Signed-off-by: Ravi Joshi <ravij@codeaurora.org>
msm: mdss: set default value of panel mode gpio to -EINVAL

Default value of panel mode gpio is set to 0 which is still a
valid gpio and preventing access to legitimate owners when not
provided explicitly in device tree file. This patch addresses
the issue by changing default value to -EINVAL.

Change-Id: Ifc34513d21323af9843f6bbc85a3afca79891357
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
arm/dt: msm8974: Add support for voice svc driver

Add a new device that can be used by the voice svc
driver to allow userspace clients to send IOCTL
commands

CRs-fixed: 662362
Change-Id: I02c7113d0e3b50e68b89e76d60d5f807cb140971
Signed-off-by: Vicky Sehrawat <vickys@codeaurora.org>
Signed-off-by: Karthik Reddy Katta <a_katta@codeaurora.org>
ASoC: msm8974: Add VoWLAN dia link

Add VoWLAN dai link to the machine driver
to enable Voice over WLAN.

CRs-fixed: 662362
Change-Id: I3ada1f10436e5724670052901b648f46885d3bf6
Signed-off-by: Vicky Sehrawat <vickys@codeaurora.org>
Signed-off-by: Karthik Reddy Katta <a_katta@codeaurora.org>