msm: mdss: Check null-pointer dereferencing and buffer overflows

Add checks before possible null-pointer dereferencing. Add checks to
prevent buffer out-of-bounds access.

Signed-off-by: Mathew Karimpanal <kjmathew@codeaurora.org>
Signed-off-by: Beeresh Gopal <gbeeresh@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: mdss: Wait for vsync before iommu attach during cont splash

During first borderfill commit in splash cleanup, wait for vsync
before iommu attach to prevent IOMMU page faults during bootup.

Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
Signed-off-by: Vineet Bajaj <vbajaj@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: mdss: ensure retire fences are signaled during panel off

When turning off command mode panel, if retire fences are still active
and suspend sequence goes through some fences may remain active.
If fences remain active command panel off sequence would stop signaling
vsyncs and would throw off the timeline. To fix this clear the retire
timeline when turning panel off.

Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: mdss: Make sure clocks are on during kickoff

Avoid a race during kickoff when DCS commands are sent.
Keep clocks on until our irq is enabled and the start
bit is finally written.

neo: Also include some cleanup.

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: mdss: dsi: Share panel alignment restrictions through sysfs node

Read panel alignment restrictions on left, top, width and height values of
the updating ROI from the dtsi file and share through sysfs node.
Framework needs these details for configuring MDP for certain
features (e.g. Partial frame update).

Signed-off-by: Jeykumar Sankaran <jsanka@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: mdss: Share minimum width and height limitations on panel ROI

Add panel ROI limitations on minimum width and height values
to the panel info sys_fs node.

Signed-off-by: Jeykumar Sankaran <jsanka@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: krait-l2-accessors: Remove set_get_l2_indirect_reg() API

There are no remaining users of this API, which writes to an indirect
register and reads back the new value. To simplify the future addition
of RTB logging for L2 indirect CP15 accesses, remove the unused API.

set_l2_indirect_reg() and get_l2_indirect_reg() can be individually
called to accomplish the same purpose that set_get_l2_indirect_reg()
served, with a negligible performance difference for common usecases.

Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
seq_file: remove "%n" usage from seq_file users

All seq_printf() users are using "%n" for calculating padding size,
convert them to use seq_setwidth() / seq_pad() pair.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ravi Kumar <rsiddoji@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
seq_file: introduce seq_setwidth() and seq_pad()

There are several users who want to know bytes written by seq_*() for
alignment purpose.  Currently they are using %n format for knowing it
because seq_*() returns 0 on success.

This patch introduces seq_setwidth() and seq_pad() for allowing them to
align without using %n format.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ASoC: msm: Update compress device name

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
sync: don't block the flusher thread waiting on IO

When sync does it's WB_SYNC_ALL writeback, it issues data Io and
then immediately waits for IO completion. This is done in the
context of the flusher thread, and hence completely ties up the
flusher thread for the backing device until all the dirty inodes
have been synced. On filesystems that are dirtying inodes constantly
and quickly, this means the flusher thread can be tied up for
minutes per sync call and hence badly affect system level write IO
performance as the page cache cannot be cleaned quickly.

We already have a wait loop for IO completion for sync(2), so cut
this out of the flusher thread and delegate it to wait_sb_inodes().
Hence we can do rapid IO submission, and then wait for it all to
complete.

Effect of sync on fsmark before the patch:

FSUse%        Count         Size    Files/sec     App Overhead
.....
     0       640000         4096      35154.6          1026984
     0       720000         4096      36740.3          1023844
     0       800000         4096      36184.6           916599
     0       880000         4096       1282.7          1054367
     0       960000         4096       3951.3           918773
     0      1040000         4096      40646.2           996448
     0      1120000         4096      43610.1           895647
     0      1200000         4096      40333.1           921048

And a single sync pass took:

  real    0m52.407s
  user    0m0.000s
  sys     0m0.090s

After the patch, there is no impact on fsmark results, and each
individual sync(2) operation run concurrently with the same fsmark
workload takes roughly 7s:

  real    0m6.930s
  user    0m0.000s
  sys     0m0.039s

IOWs, sync is 7-8x faster on a busy filesystem and does not have an
adverse impact on ongoing async data write operations.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
vsprintf: ignore %n again

This ignores %n in printf again, as was originally documented.
Implementing %n poses a greater security risk than utility, so it should
stay ignored.  To help anyone attempting to use %n, a warning will be
emitted if it is encountered.

Based on an earlier patch by Joe Perches.

Because %n was designed to write to pointers on the stack, it has been
frequently used as an attack vector when bugs are found that leak
user-controlled strings into functions that ultimately process format
strings.  While this class of bug can still be turned into an
information leak, removing %n eliminates the common method of elevating
such a bug into an arbitrary kernel memory writing primitive,
significantly reducing the danger of this class of bug.

For seq_file users that need to know the length of a written string for
padding, please see seq_setwidth() and seq_pad() instead.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David Brown <davidb@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Linux 3.4.101

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: vidc: handle dynamic buffers in pendingq during flush

In dynamic buffer mode, if flush was received before
stream-on, driver would have incremented the ref count
for output buffers, but not yet sent to firmware. So,
after flush done, there would be no fbd from firmware
and the reference to these buffers would not be removed.
So when the buffers are dequeued, driver fails to
unmap and free the output buffers.
Subsequently, after flush done, when client queues
the same output buffers again to driver, the ref
count is increased and becomes 2. This results in
the driver holding the buffers with itself, thereby
entering in to a deadlock situation and starving the
firmware of output buffers. This results in a video
freeze.

Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ASoC: wcd9xxx-mbhc: Avoid flipping current source setting

In some cases, the current source switch on codec is disabled and
enabled again where it could have been left in enabled state. This
flipping of current source setting is causing a pop on the headphones.
Add fix to avoid this unnecessary flipping of current source switch.

Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ASoC: wcd9xxx-mbhc: Disable micbias for impedance detection

If micbias is enabled during impedance detection, it can result into pop
noise on headphone left and right channels. Since micbias is not really
used for impedance detection measurements, it is safe to disable the
micbias during impedance measurements.

Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ASoC: qdsp6v2: update sanity check

Pointers should be checked for sanity before accessing them.
Change ensures that the sanity of the pointer is checked before
accessing it.

Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: msm_bus: Prevent BKE swtich from overwriting other fields

Incorrect bit mask could lead to other register fields getting
overwritten when doing a BKE bit switch.

Signed-off-by: Girish Mahadevan <girishm@codeaurora.org>
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: display: kickoff lock release centralization

Centralize kickoff lock releasing, use notify event to trigger
in display commit thread.

Signed-off-by: Ken Zhang <kenz@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>