futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: I9ee5c8a87cc43c7b1e1dc2796949e7c20c74ddf4
Git-commit: e9c243a5a6de0be8e584c604d353412584b592f8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
Merge "futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)"
power: qpnp-charger: Add VCHG_LOOP_DBC_BYPASS property

Add a property VCHG_LOOP_DBC_BYPASS in battery power supply. It is used
for enabling/disabling the buck VCHG_LOOP debouncer timer.

Change-Id: If3f1ecb56abe2319e9defb6ef03a83b972632ef4
Signed-off-by: Fenglin Wu <fenglinw@codeaurora.org>
ASoC: msm: Fix ADM GET PARAM callback.

Add size check on inband get param call and do
not process inband if RTAC is active.

Change-Id: I2c099f5ea254a214f224dda556773a7fe6754fe5
CRs-fixed: 548397
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
Signed-off-by: mohammed thasleem <mthasl@codeaurora.org>
Merge "ASoC: msm: Fix ADM GET PARAM callback."
crypto: msm: check potential integer overflow

According to the specification of AEAD, AEAD request crypt length is
not a fixed maximum and associated length is also same. This could
lead to potential integer overflow, thus allocating less memory. So
we need to check potential integer overflow on AEAD request length.

CRs-Fixed: 726872
Change-Id: Ie7708000bfd8c57e2fba8e02230a7ce9cdc9634c
Signed-off-by: William Clark <wclark@codeaurora.org>
Merge "crypto: msm: check potential integer overflow"
qseecom: Check if ce clock is enabled before sending cmd to TZ

Make change to check if ce clock is enabled before sending command
to TZ, then to prevent data aborting if clock is not enabled for
TZ crypto operation.

CRs-Fixed: 726840
Change-Id: I55b5b10ad80e741c39f8cf411f67e6b83887f3bb
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: Enable/disable clock for client if bus scaling is not enabled

To avoid the service failure on a target where bus scaling flag is not
enabled in target device tree file by mistake, make a change to enable/
disable crypto clocks when the client calls to scale up bus bandwidth
and send command even if bus scaling feature is not enabled.

CRs-Fixed: 726840
Change-Id: Ib33a535051b68561bde5ab6a23ad0f02dc27ab13
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Merge "qseecom: Check if ce clock is enabled before sending cmd to TZ"
Merge "qseecom: Enable/disable clock for client if bus scaling is not enabled"
mdss: mdp3: Remove scaling by 1 for ppp composition

Scaling by 1 logic was complicated. After trying to understand
what use cases we were preventing with this check, we verified that
ppp is actually able to handle scaling by 1 with hw team. There
is no need for this check.

Change-Id: I9f3cda5e61740fffdbda92dc768a98796b9a8238
Signed-off-by: Terence Hampson <thampson@codeaurora.org>
Merge "mdss: mdp3: Remove scaling by 1 for ppp composition"
Merge "power: qpnp-charger: Add VCHG_LOOP_DBC_BYPASS property"