Fix CVE-2014-3153

futex-prevent-requeue-pi-on-same-futex.patch futex:
Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Change-Id: Ibe6195215657c86bf2e39305656fdacf7230389d
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/cpufreq: Zzmoove v0.9_beta2

Changelog:

- support for setting a default settings profile at governor start without the need of using the tuneable 'profile_number'
  a default profile can be set with the already available macro 'DEF_PROFILE_NUMBER' check zzmoove_profiles.h for details about
  which profile numbers are possible. this functionality was only half baken in previous versions, now any given profile will be really
  applied when the governor starts. the value '0' (=profile name 'none') in 'DEF_PROFILE_NUMBER' disables this profile hardcoding and
  that's also the default in the source. u still can (with or without enabling a default profile in the macro) as usual use the tuneable
  'profile_number' to switch to a desired profile via sysfs at any later time after governor has started
- added 'blocking' of sysfs in all tuneables during apply of a settings profile to avoid a possible and unwanted overwriting/double
  setting of tuneables mostly in combination with tuning apps where the tuneable apply order isn't influenceable
- added tuneable 'profile_list' for printing out a list of all profiles which are available in the profile header file
- fixed non setting of 'scaling_block_force_down' tuneable when applying profiles
- some documentation added and a little bit of source cleaning
bcmdhd: Enable wifi mac address changing
SAMSUNG OSRC SEA KK N7100XXUFND4 HID KK Update PART 2
Touchwake: disable unwanted logging
SAMSUNG OSRC SEA KK N7100XXUFND4 KK Update additional stuff
Revert "Implement some linaro optimisations"

This reverts commit 76524b96f3456c0d9a544b81c59bb863dd659f84.
Added v3.8.3 defconfigs
WiFi bcmdhd: Update from v1.141.15 to v1.141.44 [SCH-I605 NA OSRC KK Update]
update v3.8.3 defconfigs
MALI: r3p2 rel3 -> r3p2 rel4 (JustArchi)
earysuspend: speedup late resume (faster wakeup of the device)

Thanx to _2bad4u_ for the hint and dsc-team's repo I got the code from (https://github.com/dsc-team/dsc-team-kernel-project)
update v3.8.3 defconfigs
Boeffla-Sound: Engine 1.6.6

- allow minimum volume of 0 for both speaker and headphones
intelliactive: backport to Linux 3.0.x / Linux 3.1.x kernels
cpufreq: intelliactive: initial coding and introduction!

intelliactive is based on Latest Google Interactive cpufreq governor from
Google.  The original Interactive provides smooth UI operations but suffers
slight battery drain due to its aggressive policies.  Intelliactive is an
improvement built on top of it.

It has the following enhancements added:
1. self-boost capability from input drivers (no need for PowerHAL assist)
2. two phase scheduling (idle/busy phases to prevent from jumping directly to
   max freq
3. Checks for offline cpus and short circuits some unnecessary checks to
   improve code execution paths
4. removed trace calls

All credits to Faux123

intelliactive: fix race condition when unregistering input handlers

Signed-off-by: Paul Reioux <reioux@gmail.com>
Implement Update BFQ v6r2 -> v7r2 I/O sched for 3.0
sched_fair: Reduce latencies
f2fs: set errno when f2fs_iget failed in recover_dentry

We should set the error number correctly when we fail in recover_dentry(), so
the recover flow could stop for the reason as error number shows instead of
continuing.

Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>
f2fs: readahead multi pages of directory for performance

We have no so such readahead mechanism in ->iterate() path as the one in
->read() path, it cause low performance when we read large directory.
This patch add readahead in f2fs_readdir() for better performance.

Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com> (reverted from commit 5fbe88183791e6f95748b016bfbef337bfa40b14)
f2fs: fix to truncate inline data in inode page when setattr

Previous we do not truncate inline data in inode page when setattr, so following
case could still read the inline data which has already truncated:

1.write inline data
2.ftruncate size to 0
3.ftruncate size to max inline data size
4.read from offset 0

This patch introduces truncate_inline_data() to fix this problem.

change log from v1:
 o fix a bug and do not truncate first page data after truncate inline data.

Signed-off-by: Chao Yu <chao2.yu@samsung.com>
Signed-off-by: Jaegeuk Kim <jaegeuk.kim@samsung.com>