msm: ipc: Possible memory corruption due to Sign Conversion

msm_ipc_router_skb_to_buf() takes an unsigned argument and assigns the
same to a signed local variable. This might cause issues when the value
of the argument is too high.

Change the datatype of the local variable to unsigned.

Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Clean-up code redundancy

The receive message operation for the socket interface and the kernel
interface has redundant code.

Clean-up redundant code.

Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Initialize unused elements of control message to 0

Initialize the entire control message to 0, so that unused elements of
a control message are initialized to 0. This will prevent any uninitialized
elements from leaking information to the remote subsystems.

Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Send Resume_Tx from the client/server context

Resume_tx is passed by IPC Router as soon as it detects confirm_rx
field being set in received message. In a scenario where the local port
towards which the confirm_rx is directed is not in a state of accepting
messages, this behavior of IPC Router makes the remote port send more
data towards the local port. In addition, in a multi-hop scenario the
resume_tx message holds the destination node_id as the value of the
neighbouring node_id which is incorrect.

Pass Resume_Tx from the context of the thread to which the local port is
associated. Pass the right node_id as destination node_id in the
Resume_Tx message.

Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Fix memory leak

When IPC Router detects a data packet from an unknown remote port,
the router creates a remote port. In case of failure while creating the
remote port, router doesn't free the memory allocated to the data packet.
This leads to memory leak beacuse once the above mentioned failure
occurs, the data packet never gets used.

Fix the memory leak in case of failure while creating the remote port.

Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Cleanup a routing table entry under subsystem restart

Currently when a remote subsystem restarts, the routing table entry
corresponding to that remote subsystem is recycled. This causes some
subsystems to be not reachable if the system's network topology is
not meshed.

Remove the routing table entry for a restarting subsystem so that
it gets added again either through HELLO message from that subsystem or
through first NEW_SERVER message from that subsystem.

Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Pass the local service events to local clients

When a service gets registered or unregistered locally, the concerned
events are sent only to the remote subsystems.

Pass the local service events to local clients so that clients and
services can be started in any order.

Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Serialize SMD XPRT CLOSE and OPEN events

When a remote subsystem resets, IPC Router's SMD XPRT Layer queues a CLOSE
event. When the concerned subsytem powers up and the channel is reopened,
SMD XPRT Layer queues a OPEN event. When the remote subsytem resets and
powers up quickly, the following race condition exists:
a) IPC Router is scheduled out while handling the CLOSE event, leaving a
   stale XPRT
b) IPC Router's SMD XPRT Layer queues a OPEN event
c) IPC Router's SMD XPRT Layer reads a HELLO message, finds a stale
   XPRT and queues a DATA event on the stale XPRT
This race condition causes a kernel panic.

Fix this race condition, by not handling any other SMD XPRT event until
the CLOSE event is complete.

Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Add support to handle version 2 header

IPC Router Message header is 32 bytes in size since each element uses
4 bytes in size regardless of the data range being represented.

Add a version 2 header format that compacts the header into 16 bytes.

Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Return the error codes without modification

The user-space modules perform decisions regarding retransmission etc.
based on the error codes returned by the IPC Router.

So return the error codes as is without any modification to the
user-space.

Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Fix SKB ownership for failure case

When a client writes to IPC Router and if the write fails, then in
certain scenarios both the client and IPC Router take up the ownership
of the SKB. These failure scenarios lead to a double-free and
segmentation fault.

Fix these scenarios by resolving the ownership issue. If the write to
IPC Router is successful, then IPC Router will keep the ownership of the
SKBs and free the packets. If the write fails, then the client will keep
the ownership of the SKBs and free the packets.

Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Set unsupported protocol operations to default operations

Some of the socket system calls do not check the validity of the
operations supported by the protocol. This in turn leads to NULL
pointer dereference.

Set the operations that are not supported by IPC Router to default
operations.

Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Migrate to wakeup sources from wake locks

Wakelock usage has been deprected. Update IPC Router to use wakeup
sources.

Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: ipc: Remove incorrect use of smd_private.h

smd_private.h is an internal header file used to share private internal
details of the SMD driver to related components for the purposes of
debugging, segregating functionality, etc.  Nothing in smd_private.h
is intended to be exposed for client use, and including it in a file
should be a special exception, not a normal usecase.

The IPC framework is using smd_private.h as a means to access the SMSM
public API.  Substitute the SMSM public api headers for the uses of
smd_private.h.

Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
media: media-device: fix infoleak in ioctl media_enum_entities()

This fixes CVE-2014-1739.

Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
media: v4l: Reset subdev v4l2_dev field to NULL if registration fails

When subdev registration fails the subdev v4l2_dev field is left to a
non-NULL value. Later calls to v4l2_device_unregister_subdev() will
consider the subdev as registered and will module_put() the subdev
module without any matching module_get().
Fix this by setting the subdev v4l2_dev field to NULL in
v4l2_device_register_subdev() when the function fails.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
[bwh: Backported to 3.2: adjust context, filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Jianguo Wu <wujianguo@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>

Signed-off-by: engstk <eng.stk@sapo.pt>
v4l2-ioctl.c: handle PREPARE_BUF like QUERYBUF

The core code for PREPARE_BUF didn't take the multiplanar case into account,
which might cause page faults. Handle PREPARE_BUF just like QUERYBUF and
QBUF/DQBUF.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Vinay Kalia <vkalia@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
Revert "[media] videobuf2-core: Use current->mm_active when locking USERPTR"

Reverting commit 705d2156b85febeb47509e9d955052790b9025e0 because using
mm_active seems too unreliable. When current is a kthread, there's no
guarantee that there will not be a context switch between down_read and
up_read, which causes panic due to mismatched up/down_reads.

Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
videobuf2-core: Avoid locking userpages if no current->mm

If vb2_qbuf is called within the context of a kthread with no "user
memory map", current->mm will be NULL causing a fault when attempt to
lock the non-existent pages.

As such, perform a cursory check for a non-NULL current->mm before
locking the userspace pages.

Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
Revert "[media] v4l2: vb2: one more fix for REQBUFS()"

Queue should be reinitialized on each REQBUFS() call even if the memory
access method and buffer count have not been changed. The user might have
changed the format and if we go the short path introduced in that commit,
the memory buffer will not be reallocated to fit with new format.

The previous patch was just over-engineered optimization, which just
introduced a bug to videobuf2.

Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
CC: Pawel Osciak <pawel@osciak.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Pushkaraj Patil <ppatil@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>