Revert "mdp4_overlay: Fix glitches caused by ion_iommu_map() failure for (2,2)"

This reverts commit a226f95352bd960838da94e88086a905a2d4e61b.
gpu: ion: Introduce ion_map_iommu_by_force()

This does the same thing as ion_map_iommu(), but if the handle that is attempting to be mapped is already mapped then it will be unmapped first, ensuring success. This should be used in areas where hard-to-debug memory leaks are expected and where the success of ion_map_iommu() is crucial.

Signed-off-by: Sultanxda <sultanxda@gmail.com>
msm_fb: display: Fix iommu memory leak

Sometimes the handle attempting to be mapped here is already mapped, resulting ion_map_iommu() failure and subsequent display artifacts. Use ion_map_iommu_by_force() instead to ensure success even in memory-leak conditions.

Signed-off-by: Sultanxda <sultanxda@gmail.com>
splice: fix racy pipe->buffers uses

commit 047fe3605235888f3ebcda0c728cb31937eadfe6 upstream.

Dave Jones reported a kernel BUG at mm/slub.c:3474! triggered
by splice_shrink_spd() called from vmsplice_to_pipe()

commit 35f3d14dbbc5 (pipe: add support for shrinking and growing pipes)
added capability to adjust pipe->buffers.

Problem is some paths don't hold pipe mutex and assume pipe->buffers
doesn't change for their duration.

Fix this by adding nr_pages_max field in struct splice_pipe_desc, and
use it in place of pipe->buffers where appropriate.

splice_shrink_spd() loses its struct pipe_inode_info argument.

Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Tom Herbert <therbert@google.com>
Cc: stable <stable@vger.kernel.org> # 2.6.35
Tested-by: Dave Jones <davej@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>