arm/dt: msm8974: Add support for voice svc driver

Add a new device that can be used by the voice svc
driver to allow userspace clients to send IOCTL
commands

CRs-fixed: 662362
Change-Id: I02c7113d0e3b50e68b89e76d60d5f807cb140971
Signed-off-by: Vicky Sehrawat <vickys@codeaurora.org>
Signed-off-by: Karthik Reddy Katta <a_katta@codeaurora.org>
ASoC: msm8974: Add VoWLAN dia link

Add VoWLAN dai link to the machine driver
to enable Voice over WLAN.

CRs-fixed: 662362
Change-Id: I3ada1f10436e5724670052901b648f46885d3bf6
Signed-off-by: Vicky Sehrawat <vickys@codeaurora.org>
Signed-off-by: Karthik Reddy Katta <a_katta@codeaurora.org>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: I9ee5c8a87cc43c7b1e1dc2796949e7c20c74ddf4
Git-commit: e9c243a5a6de0be8e584c604d353412584b592f8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
Merge "n_tty: Fix n_tty_write crash when echoing in raw mode"
Merge "futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)"
net: ipv4: current group_info should be put after using.

Plug a group_info refcount leak in ping_init.
group_info is only needed during initialization and
the code failed to release the reference on exit.
While here move grabbing the reference to a place
where it is actually needed.

Change-Id: I38d476f49e7ae300bc1168bc4b2c1b67274a51ca
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit:b04c46190219a4f845e46a459e3102137b7f6cac
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
Merge "net: ipv4: current group_info should be put after using."
Merge "arm/dt: msm8974: Add support for voice svc driver"
Merge "ASoC: msm8974: Add VoWLAN dia link"
Revert "[media] videobuf2-core: Use current->mm_active when locking USERPTR" .

Reverting commit 705d2156b85febeb47509e9d955052790b9025e0 because using
mm_active seems too unreliable. When current is a kthread, there's no
guarantee that there will not be a context switch between down_read and
up_read, which causes panic due to mismatched up/down_reads.

Change-Id: Ibfb1ad81fbe30be88ccc5f38482578fee09dd83a
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
(cherry picked from commit 41034535de1a164b2ce7f418dbfe861a4209112c)
Signed-off-by: Natiq Ahmed <mnatiq@codeaurora.org>
CRs-Fixed: 623719i
videobuf2-core: Avoid locking userpages if no current->mm.

If vb2_qbuf is called within the context of a kthread with no "user
memory map", current->mm will be NULL causing a fault when attempt to
lock the non-existent pages.

As such, perform a cursory check for a non-NULL current->mm before
locking the userspace pages.

CRs-Fixed: 623719
Change-Id: I138ba4d1611fae821e723a11b01046e5fc4f9092
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Signed-off-by: Natiq Ahmed <mnatiq@codeaurora.org>
Merge "Revert "[media] videobuf2-core: Use current->mm_active when locking USERPTR" ."
Merge "videobuf2-core: Avoid locking userpages if no current->mm."
msm: kgsl: Do not return invalid power stats when the device is off

adreno_power_stats() was returning unitialized data when the device
state was not active. Leave early from the function if the device
is not active and return 0s instead.

Change-Id: Ic0dedbadf6201cadb4472327c4ce7f9d9d32b82d
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Prabhat Awasthi <pawasthi@codeaurora.org>
Merge "msm: kgsl: Do not return invalid power stats when the device is off"
net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

memset() the structure ethtool_wolinfo that has padded bytes
but the padded bytes have not been zeroed out.

Change-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
Merge "net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()"
Merge 511a674e69d0c420aebb3ea8059065ac1cb3ffed on remote branch

Change-Id: I1c4b0043304800ab13b4164ffe724e9d62142c1f
Merge "Merge 511a674e69d0c420aebb3ea8059065ac1cb3ffed on remote branch"