msm: mdss: On sharing dma pipe increment pipe ref_cnt

When DMA pipe is being shared and if mdss_mdp_pipe_map is called,
there could be a race condition when the pipe being shared
is unmapped, will lead to map failure as map is used for operations
on pipe which are already having positive ref_cnt.
This can result in potential map failure and attempt to free of
unmapped pipe resulting in crash.

Hence in this scenario of shared pipe usage atomic_inc should
be used instead of mdss_mdp_pipe_map.

CRs-Fixed: 590736
Change-Id: Ibaba20ac96662b5cd8aba3585f10d9cfe6e72d22
Signed-off-by: Justin Philip <jphili@codeaurora.org>
Revert "mdss: use a nonthreaded interrupt"

This reverts commit 0a1f6b2fc7ab80b8d0daf1ed77779c2d2b62e414.
mm: fix anon vma naming

Fix two bugs caused by merging anon vma_naming, a typo in
mempolicy.c and a bad merge in sys.c.

Change-Id: Ia4ced447d50573e68195e95ea2f2b4d9456b8a90
Signed-off-by: Colin Cross <ccross@android.com>
gpu: ion: system_heap: add support for 2MB allocations

Enable 2MB (order 9) allocations from the system heap. This improves the
performance of some heavyweight use cases. The benefit is especially
large for use cases where the buffer is mapped into an IOMMU since we
can leverage the 2MB IOMMU page table mappings.

Change-Id: I869733089b9ccba8090bbca80aac7b5f248b335e
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
ion: use iounmap instead of __arm_iounmap

The API iounmap() is more generic and portable
than __arm_iounmap().

Change-Id: If9601e9266bec56442686d3f2bdb1d475cd7bead
Signed-off-by: Larry Bassel <lbassel@codeaurora.org>
ion: use PAGE_KERNEL instead of pgprot_kernel

The ion code uses PAGE_KERNEL (which is more generic than
pgprot_kernel) everywhere except in one place (so fix it).

Change-Id: I38fa1c682a3e04e9c8cb3cd25678094862fe8c9c
Signed-off-by: Larry Bassel <lbassel@codeaurora.org>
Merge pull request #18 from CyanogenMod/cm-11.0

Update
build: update script
build: exe
build: remove unused
build: update
build: fix script
build: fix 2
build: fix 3
out: fix
PM / hibernate: Avoid overflow in hibernate_preallocate_memory()

commit fd432b9f8c7c88428a4635b9f5a9c6e174df6e36 upstream.

When system has a lot of highmem (e.g. 16GiB using a 32 bits kernel),
the code to calculate how much memory we need to preallocate in
normal zone may cause overflow. As Leon has analysed:

 It looks that during computing 'alloc' variable there is overflow:
 alloc = (3943404 - 1970542) - 1978280 = -5418 (signed)
 And this function goes to err_out.

Fix this by avoiding that overflow.

References: https://bugzilla.kernel.org/show_bug.cgi?id=60817
Reported-and-tested-by: Leon Drugi <eyak@wp.pl>
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
qeth: avoid buffer overflow in snmp ioctl

commit 6fb392b1a63ae36c31f62bc3fc8630b49d602b62 upstream.

Check user-defined length in snmp ioctl request and allow request
only if it fits into a qeth command buffer.

Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Reviewed-by: Heiko Carstens <heicars2@linux.vnet.ibm.com>
Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
dm: allocate buffer for messages with small number of arguments using GFP_NOIO

commit f36afb3957353d2529cb2b00f78fdccd14fc5e9c upstream.

dm-mpath and dm-thin must process messages even if some device is
suspended, so we allocate argv buffer with GFP_NOIO. These messages have
a small fixed number of arguments.

On the other hand, dm-switch needs to process bulk data using messages
so excessive use of GFP_NOIO could cause trouble.

The patch also lowers the default number of arguments from 64 to 8, so
that there is smaller load on GFP_NOIO allocations.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ext4: avoid hang when mounting non-journal filesystems with orphan list

commit 0e9a9a1ad619e7e987815d20262d36a2f95717ca upstream.

When trying to mount a file system which does not contain a journal,
but which does have a orphan list containing an inode which needs to
be truncated, the mount call with hang forever in
ext4_orphan_cleanup() because ext4_orphan_del() will return
immediately without removing the inode from the orphan list, leading
to an uninterruptible loop in kernel code which will busy out one of
the CPU's on the system.

This can be trivially reproduced by trying to mount the file system
found in tests/f_orphan_extents_inode/image.gz from the e2fsprogs
source tree.  If a malicious user were to put this on a USB stick, and
mount it on a Linux desktop which has automatic mounts enabled, this
could be considered a potential denial of service attack.  (Not a big
deal in practice, but professional paranoids worry about such things,
and have even been known to allocate CVE numbers for such problems.)

-js: This is a fix for CVE-2013-2015.

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Zheng Liu <wenqing.lz@taobao.com>
Acked-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: comedi: ni_65xx: (bug fix) confine insn_bits to one subdevice

commit 677a31565692d596ef42ea589b53ba289abf4713 upstream.

The `insn_bits` handler `ni_65xx_dio_insn_bits()` has a `for` loop that
currently writes (optionally) and reads back up to 5 "ports" consisting
of 8 channels each.  It reads up to 32 1-bit channels but can only read
and write a whole port at once - it needs to handle up to 5 ports as the
first channel it reads might not be aligned on a port boundary.  It
breaks out of the loop early if the next port it handles is beyond the
final port on the card.  It also breaks out early on the 5th port in the
loop if the first channel was aligned.  Unfortunately, it doesn't check
that the current port it is dealing with belongs to the comedi subdevice
the `insn_bits` handler is acting on.  That's a bug.

Redo the `for` loop to terminate after the final port belonging to the
subdevice, changing the loop variable in the process to simplify things
a bit.  The `for` loop could now try and handle more than 5 ports if the
subdevice has more than 40 channels, but the test `if (bitshift >= 32)`
ensures it will break out early after 4 or 5 ports (depending on whether
the first channel is aligned on a port boundary).  (`bitshift` will be
between -7 and 7 inclusive on the first iteration, increasing by 8 for
each subsequent operation.)

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>