msm: vidc: fix corruption of registered buffer list

The buffer list for output buffers is accessed from
different threads leading to race conditions. Consider
the case of firmware throwing up a fatal error, which gets
propagated to v4l2 client. The v4l2 client closes the
driver fd, which will trigger msm_vidc_release_buffers
to release all output buffers and free node from
the registered buffer list. During this time, if
firmware sends a release reference event, the buffer
node being accessed in msm_vidc_release_buffers could
be freed, triggering kernel panic.

Change-Id: I522edff06a62dbc2ab60d6cca5990babb18d5c6c
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
(cherry picked from commit 7533645e6c683cb7aa9ae61247657994383d6bec)
msm: vidc: fix memory leak issue in dynamic buffer mode

While flushing output buffers held in v4l2 video
driver, i.e, with ref count equal to 2, the driver
was freeing the binfo structure. This would leak
the mapped output buffer memory. By avoiding
freeing of the binfo structure, the driver waits
for the release reference event from the firmware
to free and unmap the output buffer. Also move
initialization of dequeued flag for buffers to be
held in driver, till the time we queue this buffer
to firmware. By not doing so, the video driver can
enter a race condition, whereby, a output buffer could
be unmapped and freed before v4l2 client has called
dequeue on the buffer.

Change-Id: Ic95f13b9f4426574012539a76c0b87bedb8e805a
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
msm: camera: Propogate return value from i2c_read/write

This makes sure ERESTARTSYS pops up to system call level
and can be triggered again.

Bug: 10577806
Signed-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>
(cherry picked from commit 6a05ee416042bf0b3565bc767ab4462a2ae14518)

Change-Id: I66abd3600bb9aae64d9af42dcdf9768531bd6166
staging: android: ashmem: Avoid deadlock with mmap/shrink

Both ashmem_mmap and ashmem_shrink take the ashmem_lock. It may
be possible for ashmem_mmap to invoke ashmem_shrink:

-000|mutex_lock(lock = 0x0)
-001|ashmem_shrink(?, sc = 0x0) <--- try to take ashmem_mutex again
-002|shrink_slab(shrink = 0xDA5F1CC0, nr_pages_scanned = 0, lru_pages
-002|=
-002|124)
-003|try_to_free_pages(zonelist = 0x0, ?, ?, ?)
-004|__alloc_pages_nodemask(gfp_mask = 21200, order = 1, zonelist =
-004|0xC11D0940,
-005|new_slab(s = 0xE4841E80, ?, node = -1)
-006|__slab_alloc.isra.43.constprop.50(s = 0xE4841E80, gfpflags =
-006|2148925462, ad
-007|kmem_cache_alloc(s = 0xE4841E80, gfpflags = 208)
-008|shmem_alloc_inode(?)
-009|alloc_inode(sb = 0xE480E800)
-010|new_inode_pseudo(?)
-011|new_inode(?)
-012|shmem_get_inode(sb = 0xE480E800, dir = 0x0, ?, dev = 0, flags =
-012|187)
-013|shmem_file_setup(?, ?, flags = 187)
-014|ashmem_mmap(?, vma = 0xC5D64210) <---- Acquire ashmem_mutex
-015|mmap_region(file = 0xDF8E2C00, addr = 1772974080, len = 233472,
-015|flags = 57,
-016|sys_mmap_pgoff(addr = 0, len = 230400, prot = 3, flags = 1, fd =
-016|157, pgoff
-017|ret_fast_syscall(asm)
-->|exception
-018|NUR:0x40097508(asm)
---|end of frame

Avoid this deadlock by using mutex_trylock in ashmem_shrink; if the mutex
is already held, do not attempt to shrink.

Change-Id: I222bbf55856d5849da813b730de0636c80966c8e
Reported-by: Matt Wagantall <mattw@codeaurora.org>
Reported-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
Reported-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
Reported-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
(cherry picked from commit 45f4598dad5b541c780d3e7305ada8c06d7858e3)
cpufreq: Fix policy getting stuck when user & kernel min/max don't overlap

Every __cpufreq_set_policy starts with checking the new policy min/max has
some overlap with the current policy min/max. This works out fine until we
end up with the policy min/max being set to a range that doesn't overlap
with the user policy min/max. Once we get into this situation, the check at
the start of __cpufreq_set_policy fails and prevents us from getting out of
this state.

This only happens when one of the CPUFREQ_ADJUST/CPUFREQ_INCOMPATIBLE
notifiers called inside __cpufreq_set_policy pick a min/max outside the
range of user policy min/max.

The real intent of the check at the start of __cpufreq_set_policy is to
make sure userspace can't set user policy min > user policy max. Since
__cpufreq_set_policy always gets called only with current user policy
min/max except when the actual user space policy min/max is changed, we can
fix the issue by simply checking the new policy min/max against current
user policy min/max.

Change-Id: Iaac805825e64d7985c41fb9052bd96baacdf3d6f
Signed-off-by: Saravana Kannan <skannan@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
(cherry picked from commit 9decaa70a478ef26bfca840febe6296493a249d9)
usb: gadget: audio: Fix problem resuming playback on alt interface change

If the alternate interface is set back to 1, we now resume playback
if still triggered.

Bug: 12549807
(cherry picked from commit 898bafb4722ac04cda46249e39b0be96ab9d2bbd)

Change-Id: I6c3eb43ebafbc8a101ae83e7864097be5b07a0f9
msm: camera: Do not ignore ERESTARTSYS return from wait function

By ignoring ERESTARTSYS return from wait function, the thread
could potentially hold up the freezing of the task for a long
time, causing battery drain.

Bug: 10577806
Signed-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>
Change-Id: I653c06c6bf41b07c811d6bab33e3c839460f45b6
(cherry picked from commit db69933cd572bb7f6fc6ede66175dc4adfdd8217)