arm: Kconfig: Disable CONFIG_OABI_COMPAT feature on SMP targets

When this option is enabled to support Old ABI, it introduces
a race condition in swap-out code on SMP, such that
instruction is available to the instruction stream (SWI
instruction) but not the data stream.

CPU0		CPU1
clears pte
		executes instruction from page,
		already has I-TLB but no D-TLB entry,
		takes SWI exception
		tries to load instruction, data abort
tlb flush

Therefore, disable this feature on SMP targets.

Change-Id: I4cc4e6924cfcffad391fe2e68d5aa62eee613b0e
Signed-off-by: Jay Chokshi <jchokshi@codeaurora.org>
ipv4: fix the rcu race between free_fib_info and ip_route_output_slow

We hit a kernel OOPS.

<3>[23898.789643] BUG: sleeping function called from invalid context at
/data/buildbot/workdir/ics/hardware/intel/linux-2.6/arch/x86/mm/fault.c:1103
<3>[23898.862215] in_atomic(): 0, irqs_disabled(): 0, pid: 10526, name:
Thread-6683
<4>[23898.967805] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
to suspend...
<4>[23899.258526] Pid: 10526, comm: Thread-6683 Tainted: G        W
3.0.8-137685-ge7742f9 #1
<4>[23899.357404] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
to suspend...
<4>[23899.904225] Call Trace:
<4>[23899.989209]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.000416]  [<c1238c2a>] __might_sleep+0x10a/0x110
<4>[23900.007357]  [<c1228021>] do_page_fault+0xd1/0x3c0
<4>[23900.013764]  [<c18e9ba9>] ? restore_all+0xf/0xf
<4>[23900.024024]  [<c17c007b>] ? napi_complete+0x8b/0x690
<4>[23900.029297]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.123739]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.128955]  [<c18ea0c3>] error_code+0x5f/0x64
<4>[23900.133466]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.138450]  [<c17f6298>] ? __ip_route_output_key+0x698/0x7c0
<4>[23900.144312]  [<c17f5f8d>] ? __ip_route_output_key+0x38d/0x7c0
<4>[23900.150730]  [<c17f63df>] ip_route_output_flow+0x1f/0x60
<4>[23900.156261]  [<c181de58>] ip4_datagram_connect+0x188/0x2b0
<4>[23900.161960]  [<c18e981f>] ? _raw_spin_unlock_bh+0x1f/0x30
<4>[23900.167834]  [<c18298d6>] inet_dgram_connect+0x36/0x80
<4>[23900.173224]  [<c14f9e88>] ? _copy_from_user+0x48/0x140
<4>[23900.178817]  [<c17ab9da>] sys_connect+0x9a/0xd0
<4>[23900.183538]  [<c132e93c>] ? alloc_file+0xdc/0x240
<4>[23900.189111]  [<c123925d>] ? sub_preempt_count+0x3d/0x50

Function free_fib_info resets nexthop_nh->nh_dev to NULL before releasing
fi. Other cpu might be accessing fi. Fixing it by delaying the releasing.

With the patch, we ran MTBF testing on Android mobile for 12 hours
and didn't trigger the issue.

Thank Eric for very detailed review/checking the issue.

CRs-fixed: 430941
Change-Id: I14480ff9085a8e13fe43ea14bfa53fb7b77384b3
Signed-off-by: Yanmin Zhang <yanmin_zhang@linux.intel.com>
Signed-off-by: Kun Jiang <kunx.jiang@intel.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: e49cc0da7283088c5e03d475ffe2fdcb24a6d5b1
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Jay Chokshi <jchokshi@codeaurora.org>
sock_diag: Fix out-of-bounds access to sock_diag_handlers[]

Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.

CRs-fixed: 519050
Change-Id: I1466c4f56f3f4df90cf8a1ae17afa80c89b813e8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit: 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
ARM: DMA: Fix struct page iterator in dma_cache_maint() to work with sparsemem

Subhash Jadavani reported this partial backtrace:
  Now consider this call stack from MMC block driver (this is on the ARMv7
  based board):

  [<c001b50c>] (v7_dma_inv_range+0x30/0x48) from [<c0017b8c>] (dma_cache_maint_page+0x1c4/0x24c)
  [<c0017b8c>] (dma_cache_maint_page+0x1c4/0x24c) from [<c0017c28>] (___dma_page_cpu_to_dev+0x14/0x1c)
  [<c0017c28>] (___dma_page_cpu_to_dev+0x14/0x1c) from [<c0017ff8>] (dma_map_sg+0x3c/0x114)

This is caused by incrementing the struct page pointer, and running off
the end of the sparsemem page array.  Fix this by incrementing by pfn
instead, and convert the pfn to a struct page.

Change-Id: I52966616d710420aa28529ba650e9177dcb0e731
Cc: <stable@vger.kernel.org>
Suggested-by: James Bottomley <JBottomley@Parallels.com>
Tested-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Bluetooth: Validate hci conn validity before refering wakelock.

Found in a rare case there is possibility that remote device
sent disconnect on a connection and DUT is trying send data
on the same. In that case accessing some released wakelock
is causing issue. The current changes are to use locking
mechanism to validate the connection before acting on the
wake lock.

CRs-Fixed: 394651
Change-Id: I6a4188a7d0d05a8cfbe66d3680473d549157917a
Signed-off-by: Srinivas Krovvidi <skrovvid@codeaurora.org>
gpu: ion: Request highmem pages for IOMMU heap

When allocating pages for IOMMU heap it is advantageous
to try to allocate pages from highmem in addition to
lowmem since clients using the IOMMU heap can use
either highmem or lowmem.

CRs-fixed: 430457
Change-Id: Ifc794fc344c67dd53d8f7cebf86536ab9d44ed6c
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
netlink: fix possible spoofing from non-root processes

[ Upstream commit 20e1db19db5d6b9e4e83021595eab0dc8f107bef ]

Non-root user-space processes can send Netlink messages to other
processes that are well-known for being subscribed to Netlink
asynchronous notifications. This allows ilegitimate non-root
process to send forged messages to Netlink subscribers.

The userspace process usually verifies the legitimate origin in
two ways:

a) Socket credentials. If UID != 0, then the message comes from
   some ilegitimate process and the message needs to be dropped.

b) Netlink portID. In general, portID == 0 means that the origin
   of the messages comes from the kernel. Thus, discarding any
   message not coming from the kernel.

However, ctnetlink sets the portID in event messages that has
been triggered by some user-space process, eg. conntrack utility.
So other processes subscribed to ctnetlink events, eg. conntrackd,
know that the event was triggered by some user-space action.

Neither of the two ways to discard ilegitimate messages coming
from non-root processes can help for ctnetlink.

This patch adds capability validation in case that dst_pid is set
in netlink_sendmsg(). This approach is aggressive since existing
applications using any Netlink bus to deliver messages between
two user-space processes will break. Note that the exception is
NETLINK_USERSOCK, since it is reserved for netlink-to-netlink
userspace communication.

Still, if anyone wants that his Netlink bus allows netlink-to-netlink
userspace, then they can set NL_NONROOT_SEND. However, by default,
I don't think it makes sense to allow to use NETLINK_ROUTE to
communicate two processes that are sending no matter what information
that is not related to link/neighbouring/routing. They should be using
NETLINK_USERSOCK instead for that.

Change-Id: I6ee58fe1322f72c31fd0dbb4ad13a4d994e5d637
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
netlink: add reference of module in netlink_dump_start

[ Upstream commit 6dc878a8ca39e93f70c42f3dd7260bde10c1e0f1 ]

I get a panic when I use ss -a and rmmod inet_diag at the
same time.

It's because netlink_dump uses inet_diag_dump which belongs to module
inet_diag.

I search the codes and find many modules have the same problem.  We
need to add a reference to the module which the cb->dump belongs to.

Thanks for all help from Stephen,Jan,Eric,Steffen and Pablo.

Change From v3:
change netlink_dump_start to inline,suggestion from Pablo and
Eric.

Change From v2:
delete netlink_dump_done,and call module_put in netlink_dump
and netlink_sock_destruct.

Change-Id: Ib109f12c7c0c7e36e6e882e4a47604c45a48d7d5
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ext4: add missing save_error_info() to ext4_error()

commit f3fc0210c0fc91900766c995f089c39170e68305 upstream.

The ext4_error() function is missing a call to save_error_info().
Since this is the function which marks the file system as containing
an error, this oversight (which was introduced in 2.6.36) is quite
significant, and should be backported to older stable kernels with
high urgency.

Change-Id: I06d62deac9599a614dc2fefb6eb276e0fd10d0b5
Reported-by: Ken Sumrall <ksumrall@google.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: ksumrall@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
vidc: Handle descriptor buffer error as warning

Driver will consider descriptor buffer empty error
as warning and will continue to decode next frame.

Change-Id: Ia89ea520131f9b3e1bbe68727c34fb72685d5af9
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
bluetooth: Check for hcon during during sock_close

It is possible that during BT OFF operation the hcon
could be released from a tasklet context while we are
trying to send the l2cap disconnect req. Make sure
that hcon is valid before dereferencing it during
l2cap disconnect req.

CRs-fixed: 383345
Change-Id: Icb12c62560013b5ebb047c1c5d4bfe04b3a793ef
Signed-off-by: Sunny Kapdi <sunnyk@codeaurora.org>
arm: Fix compilation error with gcc 4.5.2

Fix warning with the LDM/STM instructions. The instructions dont
have a register offset so set the offset to 0.

Change-Id: I2c988373c88e280015faa43076139650747d7ff3
Acked-by: Kaushik Sikdar <ksikdar@qualcomm.com>
Signed-off-by: Rohit Vaswani <rvaswani@codeaurora.org>
msm: display: fb blend setting via MSMFB_METADATA_SET ioctl

MSMFB_METADATA_SET ioctl is added for the fb user to pass
in additional infomation rather than using reserved
fields.
User can set pre-multiplied alpha for the frame buffer via this
ioctl, overlay blend setting will take this into account.

Change-Id: Ic2f6236d84691fb03174ec479874c6928489ea30
Signed-off-by: Ken Zhang <kenz@codeaurora.org>
msm_fb: Fix adb shell start/stop issue when bypass enabled

Currently when 2/3/4 layer bypass is enabled, doing a adb shell
stop/start is failing overlay and composition happens through
GPU. Fix this issue by proper overlay configuration during this
scenario.

Change-Id: Ia04f1839bf80ed552671e48445af63a4dcd6bdfd
Signed-off-by: Padmanabhan Komanduru <pkomandu@codeaurora.org>
kernel: Includes initial Pantech's structure

Change-Id: Icc607209d403017b986b3072bedbaf0fbe53152a
kernel: Mod to replace original source with our own model.

This modification allows to replace some files in the kernel with our own model.
And add modifications without "interfering" in the original source.

Based on Samsung's kernel msm8660.

Change-Id: Ib20772af9cf57c86f74a973ad163bf784163baff
kernel: Add initial support for Pantech oscar.

Only includes the duplicates of the original files, based in the branch: caf/jb_rel_rb4.2.

Change-Id: I8eaa838fd968296a1940e78411b09335351712ba
oscar: correct path in #include"" to common msm files

Change-Id: Iad5cdeaba64e4f8741920105ca9a8b3df1ec5d36
kernel: Add initial support for Pantech magnus.

Only includes the duplicates of the original files, based in the branch: caf/jb_rel_rb4.2.

Change-Id: I3bc02ef2c15f61e8eca2d931b6392a7766870a31
magnus: correct path in #include"" to common msm files

Change-Id: Iad5cdeaba64e4f8741920105ca9a8b3df1ec5d36