netfilter: nf_ct_sip: don't drop packets with offsets pointing outside the packet

Some Cisco phones create huge messages that are spread over multiple packets.
After calculating the offset of the SIP body, it is validated to be within
the packet and the packet is dropped otherwise. This breaks operation of
these phones. Since connection tracking is supposed to be passive, just let
those packets pass unmodified and untracked.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Conflicts:
	net/netfilter/nf_conntrack_sip.c

This commit appears in the 3.8 and 3.9 branches of the Linux kernel
and according to feanor3 on xda-developers:

The "Cisco Jabber" app lets you use your cell phone as a SIP
endpoint with your work number on a Cisco phone system. The
registration packets that Cisco uses are apparently larger
than normal. With your kernel, the registration does not complete.
With your kernel and line 1421 changed to NF_ACCEPT, the registration
complete

Change-Id: If0c4eff68fa10af43767ad49808394910cae4309
smdk4412: fix mag cover turning screen off

when charger is plugged in or disconnected while cover is closed
and then opened.

Change-Id: Ifa74d3d0689e1a5c84a4683c2fe24918bc5ab87a
filter multicast packages while suspended.

in some crowded WLANs, with a lot of multicast packages circulating,
the device would not enter deep sleep.
this will allow the device to enter deep sleep.

Change-Id: I72cfefe89af64a7152e644d5095a57823ef04f4e
Merge "smdk4412: fix mag cover turning screen off" into cm-11.0
Merge "filter multicast packages while suspended." into cm-11.0
Fix light sensors for GT-N5100

Change-Id: Ifd1bd76ec2ebf8014107747474145d0bfc9a3281
Fix proximity sensor for GT-N5100

Change-Id: Ic5542259e9ff91ba20216844cf8a65f4a252c111
Merge "netfilter: nf_ct_sip: don't drop packets with offsets pointing outside the packet" into cm-11.0
Merge "Fix proximity sensor for GT-N5100" into cm-11.0
smdk4412: initial support for n5120

Change-Id: I21144c9f3146c9043b137f180c064627ebeed71e
smdk4412: update fimc_capture and sr130pc20 cam driver

-updates are from i605 4.3 kernel source
-updates + small hack fixes front cam on kona

Change-Id: If8348be6dbef50bb322a60d554d177e046eec429
synaptics_s7301: add disabling keypad

Change-Id: I5af258d2245024918f08a1a7c93c6efcc4d177b3
smdk4412: cypress-touchkey - add keydisabler

Change-Id: I85efd4c5b2d6a7283c430f5eca2a730ef6b03d18
dm: suppress endian warnings

Suppress sparse warnings about cpu_to_le32() by using __le32 types for
on-disk data etc.

Signed-off-by: Alasdair G Kergon <agk@redhat.com>
dm: ignore merge_bvec for snapshots when safe

Add a new flag DMF_MERGE_IS_OPTIONAL to struct mapped_device to indicate
whether the device can accept bios larger than the size its merge
function returns.  When set, use this to send large bios to snapshots
which can split them if necessary.  Snapshot I/O may be significantly
fragmented and this approach seems to improve peformance.

Before the patch, dm_set_device_limits restricted bio size to page size
if the underlying device had a merge function and the target didn't
provide a merge function.  After the patch, dm_set_device_limits
restricts bio size to page size if the underlying device has a merge
function, doesn't have DMF_MERGE_IS_OPTIONAL flag and the target doesn't
provide a merge function.

The snapshot target can't provide a merge function because when the merge
function is called, it is impossible to determine where the bio will be
remapped.  Previously this led us to impose a 4k limit, which we can
now remove if the snapshot store is located on a device without a merge
function.  Together with another patch for optimizing full chunk writes,
it improves performance from 29MB/s to 40MB/s when writing to the
filesystem on snapshot store.

If the snapshot store is placed on a non-dm device with a merge function
(such as md-raid), device mapper still limits all bios to page size.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
dm table: share target argument parsing functions

Move multipath target argument parsing code into dm-table so other
targets can share it.

Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
dm crypt: optionally support discard requests

Add optional parameter field to dmcrypt table and support
"allow_discards" option.

Discard requests bypass crypt queue processing. Bio is simple remapped
to underlying device.

Note that discard will be never enabled by default because of security
consequences.  It is up to the administrator to enable it for encrypted
devices.

(Note that userspace cryptsetup does not understand new optional
parameters yet.  Support for this will come later.  Until then, you
should use 'dmsetup' to enable and disable this.)

Signed-off-by: Milan Broz <mbroz@redhat.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
smdk4412: update sound soc and codecs

Includes updated kernel source from i9305

Change-Id: I91ae18b30d02de037701250c46a457d035da56e1
mc1n2: Allow swapping of microphone ADC channels

The SGH-I777 libaudio has the configuration for
ADC0[0] and ADC0[1] swapped.

When using GT-I9100 libaudio, this results in
the microphones being improperly swapped between
the main mic and the NR mic near the earpiece.

This patch allows the mic channels to be swapped
within the driver to deal with incompatible libaudio.

It is configurable via
CONFIG_SND_SOC_MC1N2_MIC_ADC_SWAP in the defconfig
in case the SGH-I777 libaudio becomes available.

Change-Id: Id5738369f3614c6ccf710ac02ae96ee65eb4398b
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.4: output_lock is a member of struct tty_struct]

Change-Id: I11d1685056e18f107c970fbe2cab5176ca3a91c4