cgroup: Fix use after free of cgrp (cgrp->css_sets)

Running a 3.4 kernel + Fedora-18 (systemd) userland on my Allwinner A10
(arm cortex a8), I'm seeing repeated, reproducable list_del list corruption
errors when build with CONFIG_DEBUG_LIST, and the backtrace always shows
free_css_set_work as the function making the problematic list_del call.

I've tracked this doen to a use after free of the cgrp struct, specifically
of the cgrp->css_sets list_head, which gets cleared by free_css_set_work.

Since free_css_set_work runs form a workqueue, it is possible for it to not be
done with clearing the list when the cgrp gets free-ed. To avoid this the code
adding the links increases cgrp->count, and the freeing code running from the
workqueue decreases cgrp->count *after* doing list_del, and then if the count
goes to 0 calls cgroup_wakeup_rmdir_waiter().

However cgroup_rmdir() is missing a check for cgrp->count != 0, causing it
to still continue with the rmdir (which leads to the free-ing of the cgrp),
before free_css_set_work is done. Sometimes the free-ed memory is re-used
before free_css_set_work gets around to unlinking link->cgrp_link_list,
triggering the list_del list corruption messages.

This patch fixes this by properly checking for cgrp->count != 0 and waiting
for the cgroup_rmdir_waitq in that case.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
cgroup: Take css_set_lock from cgroup_css_sets_empty()

As indicated in the comment above cgroup_css_sets_empty it needs the
css_set_lock. But neither of the 2 call points have it, so rather then fixing
the callers just take the lock inside cgroup_css_sets_empty().

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Revert "hammerhead: Improve persistent RAM sequencing"

This reverts commit 35da8db2a1f8f0d0732315d64139d658a79f6801.
msm: Fix for audio loss during WLAN & LTE call handover

Current APR implementation doesn't support session based
multiple service registrations. The apr_deregister()
function sets the destination and client IDs to zero, if
deregister is called for a single service instance.
Fix this by registering for dummy services in voice SVC
driver.

Signed-off-by: Karthik Reddy Katta <a_katta@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Revert "fs: Tweak mount options for all partitions"

This reverts commit 54b3d5e13aa0227d9d4ca8a307d3e510c22fcec7.
msm: mdss: Fix issues in gamma interface

Protect access to panel command struct by mutex,
this should help with ULPS stability during panel
on as well.  Also, remove the broken debug FS.

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: vidc: change concealment color

0x8080 is gray color concealment, changing it to
black color, which is 0x8010.

Signed-off-by: Manikanta Sivapala <msivap@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: vidc: flush queued work during device suspend

This change flushes any queued work related to power collapse,
once the device is power suspended.
There are applications which do not destroy video instance
on suspending the device. For such applications, if the device
is power suspended, video driver does not prepare venus for
power collapse.
Considerable power saving is observed by power collapsing
venus before the device goes in suspend state.

Signed-off-by: Vikash Garodia <vgarodia@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: vidc: fix failure to set LTR with index value

When MARKLTR/USELTR was set with a index value the value never
propagated to firmware resulting in failure to set the property.

Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: camera2: cpp: Fix to correct pointer in copy_to_user call

 Deferencing user pointer in kernel code is incorrect. This code
 can cause kernel panic for some rare cases. Use kernel pointer
 while calling copy_to_user() API.

Signed-off-by: Krupal Divvela <kdivvela@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ASoC: msm: Disable async mode for AFE proxy

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
lowmemorykiller: Account for highmem during kswapd reclaim

Currently most memory reclaim is done through kswapd.
Since kswapd uses a gfp mask of GFP_KERNEL, and because
the lowmemorykiller is zone aware, the lowmemorykiller will
ignore highmem most of the time.
This results in the lowmemorykiller being overly aggressive.

The fix to this issue is to allow the lowmemorykiller to
count highmem when being called by the kswapd if the lowmem
watermarks are satisfied.

Signed-off-by: Liam Mark <lmark@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>