n_tty: Fix n_tty_write crash when echoing in raw mode

commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Change-Id: Ie345f2a593f2500c01fe30a3c5548f3ad296e29c
References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Andy Seah <dntc46@motorola.com>
Reviewed-on: http://gerrit.mot.com/641969
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Joel Voss <jvoss@motorola.com>
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
net: ipv4: current group_info should be put after using.

Plug a group_info refcount leak in ping_init.
group_info is only needed during initialization and
the code failed to release the reference on exit.
While here move grabbing the reference to a place
where it is actually needed.

Change-Id: I538db93b358ffec60f7400939e37f23f1b9d7670
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andy Seah <dntc46@motorola.com>
Reviewed-on: http://gerrit.mot.com/641970
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
mmc: throttle back the bus on CRC errors

Some host platforms have marginal bus timings.  While many cards
are immune to this, some are not.  This is a particular problem
with reads, since driver strength support is optional for some
UHS card types.

If a card exhibits CRC errors, throttle back the bus speed and try
again.  This version implements bus throttling for UHS SD cards and
will drop the bus speed as far as SDR12.

Change-Id: Ia31a14be773d86ae59e5a7e65b77e9efccd2c9af
Signed-off-by: Russ Knize <Russ.Knize@motorola.com>
Reviewed-on: http://gerrit.mot.com/629212
SLTApproved: Slta Waiver <sltawvr@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Christopher Fries <c.fries@motorola.com>
Reviewed-by: Igor Kovalenko <igork@motorola.com>
Submit-Approved: Jira Key <jirakey@motorola.com>
Reviewed-by: Andrey Gostev <fga022c@motorola.com>
(cherry picked from commit 5722ed20a33bad6ab1dc10f14101b7be221bbd2a)
Reviewed-on: http://gerrit.mot.com/645233
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
Submit-Approved: Sergio Silva Vilela <sergiov@motorola.com>
Tested-by: Sergio Silva Vilela <sergiov@motorola.com>
mmc: only extend the detect wakeup source once

If the card has been removed or has gone bad, we hold a timed wakeup
source to make sure that userspace handles the event before the system
suspends.  Only extend it once and make sure we release the runtime PM
hold in the bad card case.

Change-Id: I0ccb630c376b1c6edf354c4ff446fd2aab04c97f
Signed-off-by: Russ Knize <Russ.Knize@motorola.com>
Reviewed-on: http://gerrit.mot.com/639898
SLTApproved: Christopher Fries <cfries@motorola.com>
Submit-Approved: Christopher Fries <cfries@motorola.com>
Tested-by: Christopher Fries <cfries@motorola.com>
Reviewed-by: Igor Kovalenko <igork@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-on: http://gerrit.mot.com/645240
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
Submit-Approved: Sergio Silva Vilela <sergiov@motorola.com>
Tested-by: Sergio Silva Vilela <sergiov@motorola.com>
mmc: throttle back high voltage cards too

Throttle back high speed legacy cards if they experience CRC errors.
Also, throttle back on CRC errors on the command bus as well.  This
handles the case where a lower speed is actually less stable than the
speed we are coming from so that we can take the next step down more
quickly (typically SDR104->DDR50->SDR25).

Change-Id: Ie03166853f1bd0b977719b656a72d498a3fdd218
Signed-off-by: Russ Knize <Russ.Knize@motorola.com>
Reviewed-on: http://gerrit.mot.com/641997
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Igor Kovalenko <igork@motorola.com>
Submit-Approved: Jira Key <jirakey@motorola.com>
SLTApproved: Christopher Fries <cfries@motorola.com>
(cherry picked from commit 0fae660133dbb791bfafcbaf887f5e4acd5091fb)
Reviewed-on: http://gerrit.mot.com/645244
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
Submit-Approved: Sergio Silva Vilela <sergiov@motorola.com>
Tested-by: Sergio Silva Vilela <sergiov@motorola.com>
mmc: sdhci: don't spew on CRC errors

Register dumps for CRC errors are not very useful and they spam
the logs.

Change-Id: I057ba45e6a9b0ae34d997f0f9e465e9ad63f3f62
Signed-off-by: Russ Knize <Russ.Knize@motorola.com>
Reviewed-on: http://gerrit.mot.com/629213
SLTApproved: Slta Waiver <sltawvr@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Igor Kovalenko <igork@motorola.com>
Submit-Approved: Jira Key <jirakey@motorola.com>
(cherry picked from commit 54aa1b35bd4ad0f6a6fabdcb8dc486f8fdd887b5)
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Change-Id: I621e8f99eef6de58a73ac9f8ebbdac62312c4c96
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Andy Seah <dntc46@motorola.com>
Reviewed-on: http://gerrit.mot.com/644952
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Joel Voss <jvoss@motorola.com>
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
arm/dt: 8x26: Set min. CPU voltage to 1.14V

Set CPU floor voltage to 1.14V on all 8x26 devices.

Change-Id: Ic7383c958e77f5ee14bf53d73e0d324047323ede
Signed-off-by: Ravi Chebolu <arc095@motorola.com>
Reviewed-on: http://gerrit.mot.com/644498
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Jiang-Li Yuan <jlyuan@motorola.com>
Reviewed-by: Connie Zhao <czhao1@motorola.com>
SLTApproved: Connie Zhao <czhao1@motorola.com>
Reviewed-by: Jeffrey Carlyle <jeff.carlyle@motorola.com>
Submit-Approved: Jira Key <jirakey@motorola.com>
Reviewed-by: Guo-Jian Chen <a21757@motorola.com>
(cherry picked from commit 0cfdbc045215b468841cbe6cf41530b662f1a8aa)
ct406: Fix Prox sensor enable.

Fix a race condition when prox and als sensors are enabled at the
same time. This can cause the prox state to not be reported.

Change-Id: Ic553ccd17cd42c9a1a65e6456527942e604e6ded
Signed-off-by: Robert Wiegand <qa2113@motorola.com>
Reviewed-on: http://gerrit.mot.com/646158
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Jeffrey Carlyle <jeff.carlyle@motorola.com>
Reviewed-by: Jagatkumar Shah <jagat@motorola.com>
Reviewed-by: Manasa Guntaka <mguntaka@motorola.com>
SLTApproved: Robert Neely <wrn002@motorola.com>
Submit-Approved: Jira Key <jirakey@motorola.com>
(cherry picked from commit 811356bcd83e1328f9e5f5e1a4ef65935f3d9b60)
Merge branch 'kitkat-mr3-rel-falcon' into mr10