n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

References: CVE-2014-0196

Thanks to:
Jiri Slaby <jslaby@suse.cz>
Peter Hurley <peter@hurleysoftware.com>
Jiri Slaby <jslaby@suse.cz>
Linus Torvalds <torvalds@linux-foundation.org>
Alan Cox <alan@lxorguk.ukuu.org.uk>
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Ben Hutchings <ben@decadent.org.uk>)

Change-Id: I43020c78fe482ff734ec4d630e131f2f0557175d
aries | p1: create sysfs link for all luns

Change-Id: If7641f702c4544c9b05794ad18b9922f2c187d49
p1: sound: codec: bring back vsuite recognition

Change-Id: Ia6f1bb8a62806f7d923d336f0e224251bdfba9c8
Signed-off-by: Humberto Borba <humberos@gmail.com>
net: Fix "ip rule delete table 256"

[ Upstream commit 13eb2ab2d33c57ebddc57437a7d341995fc9138c ]

When trying to delete a table >= 256 using iproute2 the local table
will be deleted.
The table id is specified as a netlink attribute when it needs more then
8 bits and iproute2 then sets the table field to RT_TABLE_UNSPEC (0).
Preconditions to matching the table id in the rule delete code
doesn't seem to take the "table id in netlink attribute" into condition
so the frh_get_table helper function never gets to do its job when
matching against current rule.
Use the helper function twice instead of peaking at the table value directly.

Originally reported at: http://bugs.debian.org/724783

Reported-by: Nicolas HICHER <nhicher@avencall.com>
Signed-off-by: Andreas Henriksson <andreas@fatal.se>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Change-Id: Ief48416cda18efb6ab7e7e591527422ed0bad495
Merge "p1: sound: codec: bring back vsuite recognition" into android-4.4
aries | p1: remove unstable cpu frequencies

some users related random reboots

Signed-off-by: Humberto Borba <humberos@gmail.com>
Change-Id: I16ca15b124472fd124bba46fcdc61280ff1875d1
aries: use uncompressed ramdisk

The kernel already performs LZMA compression on the whole ramdisk,
so compressing it once using gzip increases the size. Using
uncompressed ramdisk reduced the size from 7.4 MB to 5.4 MB.

Requires: https://gerrit.omnirom.org/7915

Build process warning
WARNING:  boot size (7475656) is 95.06% of limit (7864320)

Signed-off-by: Humberto Borba <humberos@gmail.com>
Change-Id: Iea3e3c991985718b1b30940ba4391bb425fc4281
Revert "p1: drivers: input: update gpio keys driver"

This reverts commit 02e9967bf407c6f3c0fb76b920f86a6b0bcff18b.

Revert "Input: Propagate hardware event timestamp to evdev."

This reverts commit ba35ed28b253852797c3c7ea1fd00979d1fc882e.

Revert "Input: force feedback - potential integer wrap in input_ff_create()"

This reverts commit 461a21ba150ea15e62b0f2607ba00ac16ccabd1a.

Revert "Input: polldev - immediately poll device upon opening"

This reverts commit f25843b9bf7b1d4dd9b18af4b7775a6b3d8707f5.

Revert "input: keyreset: add support for reset after timeout"

This reverts commit 80d6004fb741bd191bfd133ae945a9d3d369d53f.

Revert "input: keyreset: move init to subsys to be ready early"

This reverts commit d7303af3148048a06b86eb6f338af54e44315ef4.

Revert "input: keyreset: process pressed keys at init"

This reverts commit 4c69e9b15461a36d0ea27cd91f1a11234822c88d.

Revert "Input: evdev - fix variable initialisation"

This reverts commit fc803242ad1e04080185c755b20cf5f3fb11d317.

Revert "Input: add infrastructure for selecting clockid for event time stamps"

This reverts commit 7f9681307b24e4734c6b533d49cc5e0e169f2140.

Revert "Input: Add EVIOC mechanism for MT slots"

This reverts commit b7d3f1808bc4b5c51d283fbad6b10d7b2f2b7057.

Revert "Input: Set users to 0 when an input device is disabled though sysfs"

This reverts commit f8b3bf41ad660490245df53f5c60d2665053ead5.

Revert "Input: Add enabled device attribute"

This reverts commit f70bd7311b97c722e41bdf2a4c5d696c7de4dfed.

Revert "Input: Use accessor for MT values"

This reverts commit ba50f0c7fb5a529fa913f3ed5117f4bcfc178e83.

Change-Id: I80918193506b2ee6073f49ab83b546d726be88e3
p1: drivers: misc: tspdrv: fix gcc warning

Change-Id: I588f4a264b85f22636243dbb71efd1bc3ef6a177
p1: drivers: misc: replace samsung sec-jack driver

reduce differences between aries devices
and fix p1 wired headset

requires: https://gerrit.omnirom.org/7985

Signed-off-by: Humberto Borba <humberos@gmail.com>
Change-Id: I9e8a72e40890a6ff84b319b6d8e8ac4a5fb46b24
p1: driver: misc: 30pin: handling audio usb

enable/disable audio usb accordingly with 30pin connector

Change-Id: I41436afdda2f687ad24354653585f31d86ae92b6
p1: arm: s5pv210: add sec_switch driver

Some users related issues when charging
so, bring back p1 sec-switch driver

Signed-off-by: Humberto Borba <humberos@gmail.com>
Change-Id: I8d659099cc943466d74bad95792b73d51c1e6277
Revert "p1: driver: misc: 30pin: handling audio usb"

This reverts commit 4ae3c677555fb221786d2202f24988b80bd50825.

Change-Id: I262ec1a81451760284eb57d13da8617e533ad506
Merge pull request #2 from omnirom/android-4.4

to update my environement