msm: kgsl: Add event tracepoints

Add tracepoints for tracking the lifespan of GPU events.

Conflicts:

	drivers/gpu/msm/kgsl_events.c

Change-Id: Ic0dedbadf99b1efcb650608c6ac664d3c4ddafd5
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
libceph: Fix NULL pointer dereference in auth client code

commit 2cb33cac622afde897aa02d3dcd9fbba8bae839e upstream.

A malicious monitor can craft an auth reply message that could cause a
NULL function pointer dereference in the client's kernel.

To prevent this, the auth_none protocol handler needs an empty
ceph_auth_client_ops->build_request() function.

CVE-2013-1059

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Chanam Park <chanam.park@hkpco.kr>
Reviewed-by: Seth Arnold <seth.arnold@canonical.com>
Reviewed-by: Sage Weil <sage@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/cdrom/cdrom.c: use kzalloc() for failing hardware

commit 542db01579fbb7ea7d1f7bb9ddcef1559df660b2 upstream.

In drivers/cdrom/cdrom.c mmc_ioctl_cdrom_read_data() allocates a memory
area with kmalloc in line 2885.

  2885         cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
  2886         if (cgc->buffer == NULL)
  2887                 return -ENOMEM;

In line 2908 we can find the copy_to_user function:

  2908         if (!ret && copy_to_user(arg, cgc->buffer, blocksize))

The cgc->buffer is never cleaned and initialized before this function.
If ret = 0 with the previous basic block, it's possible to display some
memory bytes in kernel space from userspace.

When we read a block from the disk it normally fills the ->buffer but if
the drive is malfunctioning there is a chance that it would only be
partially filled.  The result is an leak information to userspace.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Jonathan Salwan <jonathan.salwan@gmail.com>
Cc: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
hpfs: better test for errors

commit 3ebacb05044f82c5f0bb456a894eb9dc57d0ed90 upstream.

The test if bitmap access is out of bound could errorneously pass if the
device size is divisible by 16384 sectors and we are asking for one bitmap
after the end.

Check for invalid size in the superblock. Invalid size could cause integer
overflows in the rest of the code.

Signed-off-by: Mikulas Patocka <mpatocka@artax.karlin.mff.cuni.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
block: do not pass disk names as format strings

commit ffc8b30866879ed9ba62bd0a86fecdbd51cd3d19 upstream.

Disk names may contain arbitrary strings, so they must not be
interpreted as format strings.  It seems that only md allows arbitrary
strings to be used for disk names, but this could allow for a local
memory corruption from uid 0 into ring 0.

CVE-2013-2851

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
crypto: sanitize argument for format string

commit 1c8fca1d92e14859159a82b8a380d220139b7344 upstream.

The template lookup interface does not provide a way to use format
strings, so make sure that the interface cannot be abused accidentally.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
MAINTAINERS: add stable_kernel_rules.txt to stable maintainer information

commit 7b175c46720f8e6b92801bb634c93d1016f80c62 upstream.

This hopefully will help point developers to the proper way that patches
should be submitted for inclusion in the stable kernel releases.

Reported-by: David Howells <dhowells@redhat.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
nfsd4: fix decoding of compounds across page boundaries

commit 247500820ebd02ad87525db5d9b199e5b66f6636 upstream.

A freebsd NFSv4.0 client was getting rare IO errors expanding a tarball.
A network trace showed the server returning BAD_XDR on the final getattr
of a getattr+write+getattr compound.  The final getattr started on a
page boundary.

I believe the Linux client ignores errors on the post-write getattr, and
that that's why we haven't seen this before.

Reported-by: Rick Macklem <rmacklem@uoguelph.ca>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
SCSI: sd: Fix parsing of 'temporary ' cache mode prefix

commit 2ee3e26c673e75c05ef8b914f54fadee3d7b9c88 upstream.

Commit 39c60a0948cc '[SCSI] sd: fix array cache flushing bug causing
performance problems' added temp as a pointer to "temporary " and used
sizeof(temp) - 1 as its length.  But sizeof(temp) is the size of the
pointer, not the size of the string constant.  Change temp to a static
array so that sizeof() does what was intended.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 3.0.86
msm_fb: HDMI: Correct order for BKSV read operation

During HDCP authentication, the BKSV read operation
should be issued after writing AKSV as per the HDCP
specification. This change fixes this issue.

Change-Id: If5de484fe19dd3e949107d5b0d72f9594ee2e76f
CRs-Fixed: 327845
Signed-off-by: Aravind Venkateswaran <aravindh@codeaurora.org>
msm_fb: hdmi: CEC Message queue flush

CEC message queue should be flushed when CEC
function is enabled. If there are residue CEC
message, they might cause collision at message
queue.

CRs-fixed: 338811
Change-Id: I6268528417d660fab48818ae67e94e169abbb217
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
msm_fb: hdmi: CEC re-transmission improvements.

Adding some improvements to HDMI CEC code flow to
reduce the risk of system crash and compliance
failure by proper CEC resiters settings and positions
in code flow.

CRs-fixed: 336541
Change-Id: I8fb3510190e5c4ff83b3785c51bade139f20692c
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
msm_fb: HDMI: Reset HDCP reauth flag when powering off

The software flag used for storing the HDCP reauthentication state
needs to be reset whenever the HDMI device is powered off. This is
needed to avoid a potential reauthentication attempt upon a
subsequent connection which could lead to device hang as a result
of incorrect sequence of register accesses.

CRs-Fixed: 444312
Change-Id: I6b5b08394dd96ccbc08c4ca72b6dc4b2c4dbf6be
Signed-off-by: Aravind Venkateswaran <aravindh@codeaurora.org>
msm_fb: hdmi: update data on resolution change

On changing resolution, all information related to display
needs to be updated which helps in calculating the right mdp
clock for each resolution.

CRs-Fixed: 436151
Change-Id: I1ab6e5859491936a7fa8c62247da9ef5a0ff45ef
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
msm_fb: hdmi: hdmi 3d length check

This change fixes a case where the length of 3d data is not
properly used which could have resulted in wrong 3d data parsing.

CRs-Fixed: 445505
Change-Id: Id285204bdb8c2d881becaa5b07b973eba4240d93
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
msm_fb: hdmi: change sysfs node permissions

Change the write permissions of sysfs nodes from UGO to USR + GRP

Change-Id: Ided5351669eb0f3cdf9ae1a0c1607ef6e76f6852
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
msm_fb: hdmi: Check for stale HDCP variables

Check for stale HDCP variables like An from previous authentication
failure. In case of stale data, wait for some time to make sure HDCP
has has fresh data.

Change-Id: I37685a0246f3b60c383e3bf8d024c2b13fb3e5f6
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
msm_fb: hdmi: Return proper clock get error code

This change returns the proper error code while in probe and trying
to get the required clock and fails. This is required for probe deferral
support.

Change-Id: Ief91b1f634c06d3679157313506b56e5948aa79c
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
msm_fb: display: Fix compilation error for non-HDMI builds

HDMI dependent functions need to be guarded under HDMI panel
macro to avoid non HDMI builds complilation errors.

CRs-Fixed: 366864
Change-Id: Ib2a9f6db4eb511b2a170fcc7ac979f6c41046baf
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>