n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
block: bfq: Squashed update from BFQ-v7r2 to BFQ-v7r3

Change-Id: Id0ef3399d83bf4fd407eff64e695a7a3ec059646
video: msm: Add NT35582 WVGA panel.

Notes:
* No initialization sequence to recover from deep standby (hard reset).
power_supply: Add bq2415x charger driver

The bq2415x charger driver is needed for example on Nokia N900 for
charging battery. Driver is part of open source project to replace
proprietary battery management.

Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
bq2415x_charger: Add Kconfig/Makefile entries

This commit adds Kconfig and Makefile entries so that we could actually
build the driver.

Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>
bq2415x_charger: Fix style issues

I hate doing these style fixups myself, but I also hate inconsitent code.
Normally I just ask to resubmit the patch with the issues fixed, but N900
is special: I have a selfish interest in it. :)

Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>
bq2415x_charger: Remove unneeded version.h inclusion

<linux/version.h> is not required here.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Anton Vorontsov <anton@enomsg.org>
bq2415x_charger: Use module_i2c_driver

module_i2c_driver() makes the code simpler by eliminating module_init and
module_exit calls.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Anton Vorontsov <anton@enomsg.org>
bq2415x_charger: Use devm_kzalloc()

devm_kzalloc is device managed and makes error handling and code cleanup a
bit simpler.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Anton Vorontsov <anton@enomsg.org>
bq2415x_charger: Add support for offline and 100mA mode

* Renamed mode BQ2415X_MODE_NONE to BQ2415X_MODE_OFF because this mode
  turning chaging completly off

* Added new mode BQ2415X_MODE_NONE which enable charging with maximal
  current limit 100mA (this is minimal safe value for bq2415x chips)

Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Anton Vorontsov <anton@enomsg.org>
bq2415x_charger: Fix max battery regulation voltage

As per the datasheets, maximum battery regulation voltage is 4440mV.

The formula is (voltage - offset) / step, so the maximum value is:
(4440 - 3500) / 20 = 47

Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Thanks-to: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Anton Vorontsov <anton@enomsg.org>
bq2415x_charger: Add shutdown handler.

Reset bq2415x_charger upon shutdown of the host.
bq2415x_charger: Add I2C retry mechanism.

The I2C may fail reading/writing, so implement a retry mechanism.
bq2415x_charger: Implement status changed functions for platform.
bq2415x_charger: Allow to automatically configure current/mode.

Changes:
 * Instead of sending private data, only send the callbacks pointer.
 * Enable high impedance mode on OFF.
 * Remove manual mode sysfs nodes.
 * Mode modifies only the mode, not the current.
bq2415x_charger: Always reschedule timer.

When fault condition happens, it can recover, but since timer is not
rescheduled, charging can not continue.
bq2415x_charger: Only reset safety timer when needed.

The charger is in high impedance mode when it's not charging, there's no need
to keep monitoring the status/fault & reset the safety timer in this mode.
bq2415x_charger: Never enable charger by itself.

Charger must be always enabled by hook functions.
bq2415x_charger: Reset battery min/max voltage on current/mode setting.

Seems like sometimes the battery min/max voltage gets corrupted, ensure the
correct registers are set.

Also, never ever return from a macro!
bq2415x_charger: Store new values if set.

Makes setting default values easier, when the chip is reset for example.