synaptics_s7301: add disabling keypad

Change-Id: I5af258d2245024918f08a1a7c93c6efcc4d177b3
smdk4412: cypress-touchkey - add keydisabler

Change-Id: I85efd4c5b2d6a7283c430f5eca2a730ef6b03d18
smdk4412: update sound soc and codecs

Includes updated kernel source from i9305

Change-Id: I91ae18b30d02de037701250c46a457d035da56e1
Merge branch 'cm-11.0' of github.com:CyanogenMod/android_kernel_samsung_smdk4412 into cm-11.0
mc1n2: Allow swapping of microphone ADC channels

The SGH-I777 libaudio has the configuration for
ADC0[0] and ADC0[1] swapped.

When using GT-I9100 libaudio, this results in
the microphones being improperly swapped between
the main mic and the NR mic near the earpiece.

This patch allows the mic channels to be swapped
within the driver to deal with incompatible libaudio.

It is configurable via
CONFIG_SND_SOC_MC1N2_MIC_ADC_SWAP in the defconfig
in case the SGH-I777 libaudio becomes available.

Change-Id: Id5738369f3614c6ccf710ac02ae96ee65eb4398b
Merge branch 'cm-11.0' of https://github.com/CyanogenMod/android_kernel_samsung_smdk4412 into cm-11.0
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.4: output_lock is a member of struct tty_struct]

Change-Id: I11d1685056e18f107c970fbe2cab5176ca3a91c4
Merge branch 'cm-11.0' of https://github.com/CyanogenMod/android_kernel_samsung_smdk4412 into cm-11.0
Merge "smdk4412: cypress-touchkey - add keydisabler" into cm-11.0
Merge "synaptics_s7301: add disabling keypad" into cm-11.0
Merge branch 'cm-11.0' of https://github.com/CyanogenMod/android_kernel_samsung_smdk4412 into cm-11.0

Conflicts:
	include/linux/i2c/touchkey_i2c.h

Change-Id: Id8365ab4d751244e9543604db5837984bdf27f29
Fix CVE-2014-3153

futex-prevent-requeue-pi-on-same-futex.patch futex:
Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing from
a non-pi futex to a pi futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter resulting in an exploitable
condition.

This change brings futex_requeue() in line with futex_wait_requeue_pi()
which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Change-Id: Ibe6195215657c86bf2e39305656fdacf7230389d
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Merge branch 'cm-11.0' of https://github.com/CyanogenMod/android_kernel_samsung_smdk4412 into cm-11.0
Merge remote-tracking branch 'kbc/kbc-cyanogen-cm-11.0' into atr-mk-11.0

Conflicts:
	include/linux/i2c/touchkey_i2c.h