Merge "mm/page_alloc.c: fix watermark check in __zone_watermark_ok()"
sync: signal pt before sync_timeline object gets destroyed

There is a race condition

Assume we have *one* sync_fence object, with *one* sync_pt
which belongs to *one* sync_timeline, given this condition,
sync_timeline->kref will have two counts, one for sync_timeline
(implicit) and another for sync_pt.

Assume following is the situation on CPU

Theead-1 : (Thread which calls sync_timeline_destroy())
  -> (some function calls)
   -> sync_timeline_destory()
    -> sync_timeline_signal() (CPU is inside this
function after putting reference to sync_timeline)

At this time Thread-2 comes and does following

Thread-2 : (fclose on fence fd)
> sync_fence_release() -> because of fclose() on fence object
 -> sync_fence_free()
  -> sync_pt_free()
   -> kref_put(&pt->parent->kref, sync_timeline_free);
    -> sync_timeline_free() (CPU is inside this because
this time kref will be zero after _put)

Thread-2 will free sync_timeline object before Thread-1
has finished its work inside sync_timeline_signal.

With this change we signals all sync_pt before putting
reference to sync_timeline object.

Change-Id: I66d7359cc5dca0352fda49f81953028e98b95993
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm_fb:hdmi:Fix for sysfs Entry Information Leaks

These sysfs entries leak logical and physical addresses
within the kernel and may be read by any user.
The read permissions for the sysfs entries changed
to S_IRUSR from S_IRUGO.

Change-Id: Idfc58c3b639ea4dfa105ff146467a1c4f01edb6e
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
msm: mhl: 8334: Initialize return value

Initialize the variable holding the return code to
appropriate error value so that an incorrect return
code isn't sent  to the caller.

Change-Id: I38192e5503750113de62494f3bd512819d7d8b76
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm: msm_fb: validating backlight level and scale value

Validating the value of backlight to be not more than the
max value and also ensuring that the backlight scale value
is not more than 1024, thereby ensuring that backlight
scaling factor is not more than 1

Change-Id: I6a6f4f0f0a8c272edcac5078276fb406ddee3e90
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
ALSA: pcm: check for integer overflow during multiplication

Channel info data structure is parsed from userspace and if
user does not set the no. of channels correctly, it could lead
to security vulnerability if we don't check for overflow when the
no. of channels is multiplied with pcm bit width. Add a condition
to check for overflow during multiplication.

CRs-fixed: 537818
Change-Id: Ia3c31406dd8b7627ea704c076643c0348582da28
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
msm: fb: Null check mfd data

Add appropriate null check for mfd data
structure before accessing it's members.
This prevents null pointer accesses in
the driver.

Change-Id: I5aae937f839e4f6ed8d5c5a4b54ab45f0ff07332
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
Merge "msm: kgsl: Hold driver process mutex till sysfs entries deleted"
Merge "msm: kgsl: Get an active count before snapshotting GPU"
Merge "msm: kgsl: Remove drawctxt_active from setstate default"
msm: fb: Copy unsigned int for notify update

Change to correct signature of msmfb_notify_update
from the ioctl declaration.

Change-Id: Ia7bdfd3dbe8494a641ffd46d484794b4bec7d27c
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm_fb:hdmi:Security check for EDID 3D data parse

While parsing EDID received from TV for 3D data and other,
proper buffer overflow check is done to avoid
data overflow or overwrite.
Also, replace snprintf with scnprintf for better memory copy results.

Change-Id: I4100226a6e5ae0740478f5d85e5b70c9fa20188e
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
Merge "netfilter: Enable TOS matching in the kernel"
Merge "arm: Move the secondary_startup to __CPUINIT section."
msm: msm_fb: Remove Warnings when required BW exceeds Max Bandwidth.

When required BW exceeds max bandwidth, warnings are printed on the
console which are causing performance degradation. This Patch fixes
the issue.

Change-Id: I769f55dd76a3f28639b848bd5461e2ff3abae3f5
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
msm-camera: Fix to prevent kernel heap buffer overflow in actuator

Fix to prevent kernel heap buffer overflow allows user
controlled data to be written to the heap via the
msm_camera actuator IOCTLs

Change-Id: I5d511e8c1aa2f76f4209a6712a58d8757bc53367
CRs-Fixed: 545979
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm-camera: fix to prevent untrusted pointer to lead DoS in Actuator

fix to prevent untrusted userspace pointer in actuator kernel
driver to lead DoS in actuator driver

Change-Id: If9dcba3d4871ca98f78542f8bfb1623a02032f0d
CRs-Fixed: 547231
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm: kgsl: enable CPU IRQ while suspending context

Make sure that CPU interrupt is enabled before calling adreno
suspend_context when moving from NAP/SLEEP to SLUMBER state.
We send commands to GPU in adreno_drawctxt_switch() which will generate
GPU interrupt. Since CPU interrupt is not enabled, adreno_idle() will
fail because pending interrupt will not be served by CPU this causes
false GPU hang.

CRs-Fixed: 547813

Change-Id: Ia4b730b8f8cda1e820f571ffb7ddb00336ca1a8c
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
Merge "msm: msm_fb: Remove Warnings when required BW exceeds Max Bandwidth."
msm:camera: Initialize a structure before usage

Initialize a structure using memset such that it is
populated properly before returning to userspace.

CRs-fixed: 550567
Change-Id: I2b3c78cd2b309de13acf2811fcc16b8bc04fa052
Signed-off-by: Alok Kediya <kediya@codeaurora.org>