n_tty: Fix n_tty_write crash when echoing in raw mode

commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Change-Id: Ie345f2a593f2500c01fe30a3c5548f3ad296e29c
References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Andy Seah <dntc46@motorola.com>
Reviewed-on: http://gerrit.mot.com/641969
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Joel Voss <jvoss@motorola.com>
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
net: ipv4: current group_info should be put after using.

Plug a group_info refcount leak in ping_init.
group_info is only needed during initialization and
the code failed to release the reference on exit.
While here move grabbing the reference to a place
where it is actually needed.

Change-Id: I538db93b358ffec60f7400939e37f23f1b9d7670
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andy Seah <dntc46@motorola.com>
Reviewed-on: http://gerrit.mot.com/641970
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
mmc: throttle back the bus on CRC errors

Some host platforms have marginal bus timings.  While many cards
are immune to this, some are not.  This is a particular problem
with reads, since driver strength support is optional for some
UHS card types.

If a card exhibits CRC errors, throttle back the bus speed and try
again.  This version implements bus throttling for UHS SD cards and
will drop the bus speed as far as SDR12.

Change-Id: Ia31a14be773d86ae59e5a7e65b77e9efccd2c9af
Signed-off-by: Russ Knize <Russ.Knize@motorola.com>
Reviewed-on: http://gerrit.mot.com/629212
SLTApproved: Slta Waiver <sltawvr@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Christopher Fries <c.fries@motorola.com>
Reviewed-by: Igor Kovalenko <igork@motorola.com>
Submit-Approved: Jira Key <jirakey@motorola.com>
Reviewed-by: Andrey Gostev <fga022c@motorola.com>
(cherry picked from commit 5722ed20a33bad6ab1dc10f14101b7be221bbd2a)
Reviewed-on: http://gerrit.mot.com/645233
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
Submit-Approved: Sergio Silva Vilela <sergiov@motorola.com>
Tested-by: Sergio Silva Vilela <sergiov@motorola.com>
mmc: only extend the detect wakeup source once

If the card has been removed or has gone bad, we hold a timed wakeup
source to make sure that userspace handles the event before the system
suspends.  Only extend it once and make sure we release the runtime PM
hold in the bad card case.

Change-Id: I0ccb630c376b1c6edf354c4ff446fd2aab04c97f
Signed-off-by: Russ Knize <Russ.Knize@motorola.com>
Reviewed-on: http://gerrit.mot.com/639898
SLTApproved: Christopher Fries <cfries@motorola.com>
Submit-Approved: Christopher Fries <cfries@motorola.com>
Tested-by: Christopher Fries <cfries@motorola.com>
Reviewed-by: Igor Kovalenko <igork@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-on: http://gerrit.mot.com/645240
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
Submit-Approved: Sergio Silva Vilela <sergiov@motorola.com>
Tested-by: Sergio Silva Vilela <sergiov@motorola.com>
mmc: throttle back high voltage cards too

Throttle back high speed legacy cards if they experience CRC errors.
Also, throttle back on CRC errors on the command bus as well.  This
handles the case where a lower speed is actually less stable than the
speed we are coming from so that we can take the next step down more
quickly (typically SDR104->DDR50->SDR25).

Change-Id: Ie03166853f1bd0b977719b656a72d498a3fdd218
Signed-off-by: Russ Knize <Russ.Knize@motorola.com>
Reviewed-on: http://gerrit.mot.com/641997
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Igor Kovalenko <igork@motorola.com>
Submit-Approved: Jira Key <jirakey@motorola.com>
SLTApproved: Christopher Fries <cfries@motorola.com>
(cherry picked from commit 0fae660133dbb791bfafcbaf887f5e4acd5091fb)
Reviewed-on: http://gerrit.mot.com/645244
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
Submit-Approved: Sergio Silva Vilela <sergiov@motorola.com>
Tested-by: Sergio Silva Vilela <sergiov@motorola.com>
mmc: sdhci: don't spew on CRC errors

Register dumps for CRC errors are not very useful and they spam
the logs.

Change-Id: I057ba45e6a9b0ae34d997f0f9e465e9ad63f3f62
Signed-off-by: Russ Knize <Russ.Knize@motorola.com>
Reviewed-on: http://gerrit.mot.com/629213
SLTApproved: Slta Waiver <sltawvr@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Igor Kovalenko <igork@motorola.com>
Submit-Approved: Jira Key <jirakey@motorola.com>
(cherry picked from commit 54aa1b35bd4ad0f6a6fabdcb8dc486f8fdd887b5)
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Change-Id: I621e8f99eef6de58a73ac9f8ebbdac62312c4c96
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Andy Seah <dntc46@motorola.com>
Reviewed-on: http://gerrit.mot.com/644952
Submit-Approved: Jira Key <jirakey@motorola.com>
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Joel Voss <jvoss@motorola.com>
Reviewed-by: Sergio Silva Vilela <sergiov@motorola.com>
SLTApproved: Sergio Silva Vilela <sergiov@motorola.com>
arm/dt: 8x26: Set min. CPU voltage to 1.14V

Set CPU floor voltage to 1.14V on all 8x26 devices.

Change-Id: Ic7383c958e77f5ee14bf53d73e0d324047323ede
Signed-off-by: Ravi Chebolu <arc095@motorola.com>
Reviewed-on: http://gerrit.mot.com/644498
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Jiang-Li Yuan <jlyuan@motorola.com>
Reviewed-by: Connie Zhao <czhao1@motorola.com>
SLTApproved: Connie Zhao <czhao1@motorola.com>
Reviewed-by: Jeffrey Carlyle <jeff.carlyle@motorola.com>
Submit-Approved: Jira Key <jirakey@motorola.com>
Reviewed-by: Guo-Jian Chen <a21757@motorola.com>
(cherry picked from commit 0cfdbc045215b468841cbe6cf41530b662f1a8aa)
ct406: Fix Prox sensor enable.

Fix a race condition when prox and als sensors are enabled at the
same time. This can cause the prox state to not be reported.

Change-Id: Ic553ccd17cd42c9a1a65e6456527942e604e6ded
Signed-off-by: Robert Wiegand <qa2113@motorola.com>
Reviewed-on: http://gerrit.mot.com/646158
Tested-by: Jira Key <jirakey@motorola.com>
Reviewed-by: Jeffrey Carlyle <jeff.carlyle@motorola.com>
Reviewed-by: Jagatkumar Shah <jagat@motorola.com>
Reviewed-by: Manasa Guntaka <mguntaka@motorola.com>
SLTApproved: Robert Neely <wrn002@motorola.com>
Submit-Approved: Jira Key <jirakey@motorola.com>
(cherry picked from commit 811356bcd83e1328f9e5f5e1a4ef65935f3d9b60)
Merge Motorola vendor-qcom-opensource-wlan-prima driver

* Motorola package version: MM-KXB21.14-L1.32

Change-Id: I99a479522f2e5754e2d6ca84124e4918dee4bd01
prima: Add make entries for prima

Change-Id: I2bb5444c37fb66f7bd92ae70c3aa5baa5dcd2dbb
falcon: Add fully generated defconfig

* Motorola package version: MM-KXB21.14-L1.32

Change-Id: I8a8bb312b80b32afe43ed5dc08842c4e332303cd
falcon: Enable XZ compression

Change-Id: I222f208bacc3621d43ac035a7dc1eae5d73275e1
falcon: Disable modules whitelist

Change-Id: I8c975d2fe7e58ea54245f395d08d3d965b8fcabe
falcon: Update defconfig

Change-Id: I1c0a81f44c52a0266ccff2fdeaba0ccb306f5c4e
msm: smd: fix in-tree compilation

In-tree compilation for arch/arm/mach-msm/smd_init_dt.c was hitting this
error:

arch/arm/mach-msm/smd_init_dt.c:24:25: fatal error: smd_private.h: No such
file or directory
 #include <smd_private.h>

This was due to using <> instead of "" style include.

Change-Id: I462d259410377244cd551db910df9e15521544ed
Signed-off-by: Kumar Gala <galak@codeaurora.org>
ASoC: msm: fix in-tree compilation for RTAC

In-tree compilation for sound/soc/msm/qdsp6v2/rtac.c was hitting this
error:

sound/soc/msm/qdsp6v2/rtac.c:27:21: fatal error: q6voice.h: No such file
or directory
 #include <q6voice.h>

This was due to using <> instead of "" style include.

Change-Id: Ie96cc91bd29e44c55b9fb0cbc36e25786d6f8823
Signed-off-by: Kumar Gala <galak@codeaurora.org>
msm: Fix compiling kernel in place

A number of files incorrectly used system include notation <> for header
files that are local.  Fix thoses cases to now be #include "FILE.h" instead
of #include <FILE.h>

Change-Id: I1467268b10b33b6fd29bc36b2312378a0b1dde32
Signed-off-by: Kumar Gala <galak@codeaurora.org>
ALSA: Export audio effects header

Export audio_effects.h for userland to use

Change-Id: Ib4b040a87bcf89542d8c9dfb363fcd5f9a1bfc76
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing
from a non-pi futex to a pi futex with this call. If we attempt this,
then dangling pointers may be left for rt_waiter resulting in an
exploitable condition.

This change brings futex_requeue() into line with
futex_wait_requeue_pi() which performs the same check as per commit
6f7b0a2a5 (futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi())

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Git-commit: 5b3bbe42f5874081123fa3aa4dd85d5e5c806f54
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Ian Maund <imaund@codeaurora.org>