Fix CVE-2014-3153

futex-prevent-requeue-pi-on-same-futex.patch futex:
Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Change-Id: Ibe6195215657c86bf2e39305656fdacf7230389d
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/cpufreq: Zzmoove v0.9_beta2

Changelog:

- support for setting a default settings profile at governor start without the need of using the tuneable 'profile_number'
  a default profile can be set with the already available macro 'DEF_PROFILE_NUMBER' check zzmoove_profiles.h for details about
  which profile numbers are possible. this functionality was only half baken in previous versions, now any given profile will be really
  applied when the governor starts. the value '0' (=profile name 'none') in 'DEF_PROFILE_NUMBER' disables this profile hardcoding and
  that's also the default in the source. u still can (with or without enabling a default profile in the macro) as usual use the tuneable
  'profile_number' to switch to a desired profile via sysfs at any later time after governor has started
- added 'blocking' of sysfs in all tuneables during apply of a settings profile to avoid a possible and unwanted overwriting/double
  setting of tuneables mostly in combination with tuning apps where the tuneable apply order isn't influenceable
- added tuneable 'profile_list' for printing out a list of all profiles which are available in the profile header file
- fixed non setting of 'scaling_block_force_down' tuneable when applying profiles
- some documentation added and a little bit of source cleaning
Touchwake: disable unwanted logging
SAMSUNG OSRC SEA KK N7100XXUFND4 KK Update additional stuff
Add v4.4 configs
WiFi bcmdhd: Update from v1.141.15 to v1.141.44 [SCH-I605 NA OSRC KK Update]
update v4.4 configs
MALI: r3p2 rel3 -> r3p2 rel4 (JustArchi)
earysuspend: speedup late resume (faster wakeup of the device)

Thanx to _2bad4u_ for the hint and dsc-team's repo I got the code from (https://github.com/dsc-team/dsc-team-kernel-project)
update v4.4 configs
Boeffla-Sound: Engine 1.6.6

- allow minimum volume of 0 for both speaker and headphones
intelliactive: backport to Linux 3.0.x / Linux 3.1.x kernels
cpufreq: intelliactive: initial coding and introduction!

intelliactive is based on Latest Google Interactive cpufreq governor from
Google.  The original Interactive provides smooth UI operations but suffers
slight battery drain due to its aggressive policies.  Intelliactive is an
improvement built on top of it.

It has the following enhancements added:
1. self-boost capability from input drivers (no need for PowerHAL assist)
2. two phase scheduling (idle/busy phases to prevent from jumping directly to
   max freq
3. Checks for offline cpus and short circuits some unnecessary checks to
   improve code execution paths
4. removed trace calls

All credits to Faux123

intelliactive: fix race condition when unregistering input handlers

Signed-off-by: Paul Reioux <reioux@gmail.com>
Implement Update BFQ v6r2 -> v7r2 I/O sched for 3.0
sched_fair: Reduce latencies
f2fs: set errno when f2fs_iget failed in recover_dentry

We should set the error number correctly when we fail in recover_dentry(), so
the recover flow could stop for the reason as error number shows instead of
continuing.

Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>
f2fs: readahead multi pages of directory for performance

We have no so such readahead mechanism in ->iterate() path as the one in
->read() path, it cause low performance when we read large directory.
This patch add readahead in f2fs_readdir() for better performance.

Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>
f2fs: fix to truncate inline data in inode page when setattr

Previous we do not truncate inline data in inode page when setattr, so following
case could still read the inline data which has already truncated:

1.write inline data
2.ftruncate size to 0
3.ftruncate size to max inline data size
4.read from offset 0

This patch introduces truncate_inline_data() to fix this problem.

change log from v1:
 o fix a bug and do not truncate first page data after truncate inline data.

Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>
f2fs: split grab_cache_page and wait_on_page_writeback for node pages

This patch splits grab_cache_page_write_begin into grab_cache_page and
wait_on_page_writeback for node pages.

This patch intends to enhance the latency to get node pages by alleviating
unnecessary wait_on_page_writeback.

Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>
f2fs: avoid grab_cache_page_write_begin for data pages

We don't need to wait on page writeback for these cases.

Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>
f2fs: no need to wait on page writebck to meta pages

This patch removes grab_cache_page_write_begin for meta pages.

Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>