msm: camera: Cleanup msm generic buf queue on userspace crash

Clean-up the msm camera generic buff queue on userspace
crash to avoid invalid memory access in next session
which might lead to corruption in other modules
and system stability issues and also avoid memory leak.

Change-Id: Icd989cf9ef944c01e1193fead105963f745bcbc4
CRs-Fixed: 522939
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
Merge "msm: camera: Cleanup msm generic buf queue on userspace crash"
mm: vmscan: fix do_try_to_free_pages() livelock

This patch is based on KOSAKI's work and I add a little more description,
please refer https://lkml.org/lkml/2012/6/14/74.

Currently, I found system can enter a state that there are lots of free
pages in a zone but only order-0 and order-1 pages which means the zone is
heavily fragmented, then high order allocation could make direct reclaim
path's long stall(ex, 60 seconds) especially in no swap and no compaciton
enviroment.  This problem happened on v3.4, but it seems issue still lives
in current tree, the reason is do_try_to_free_pages enter live lock:

kswapd will go to sleep if the zones have been fully scanned and are still
not balanced.  As kswapd thinks there's little point trying all over again
to avoid infinite loop.  Instead it changes order from high-order to
0-order because kswapd think order-0 is the most important.  Look at
73ce02e9 in detail.  If watermarks are ok, kswapd will go back to sleep
and may leave zone->all_unreclaimable =3D 0.  It assume high-order users
can still perform direct reclaim if they wish.

Direct reclaim continue to reclaim for a high order which is not a
COSTLY_ORDER without oom-killer until kswapd turn on
zone->all_unreclaimble= .  This is because to avoid too early oom-kill.
So it means direct_reclaim depends on kswapd to break this loop.

In worst case, direct-reclaim may continue to page reclaim forever when
kswapd sleeps forever until someone like watchdog detect and finally kill
the process.  As described in:
http://thread.gmane.org/gmane.linux.kernel.mm/103737

We can't turn on zone->all_unreclaimable from direct reclaim path because
direct reclaim path don't take any lock and this way is racy.  Thus this
patch removes zone->all_unreclaimable field completely and recalculates
zone reclaimable state every time.

Note: we can't take the idea that direct-reclaim see zone->pages_scanned
directly and kswapd continue to use zone->all_unreclaimable.  Because, it
is racy.  commit 929bea7c71 (vmscan: all_unreclaimable() use
zone->all_unreclaimable as a name) describes the detail.

Change-Id: I49970a0fa751cf33af293fd1ee784e36422785b1
[akpm@linux-foundation.org: uninline zone_reclaimable_pages() and zone_reclaimable()]
Cc: Aaditya Kumar <aaditya.kumar.30@gmail.com>
Cc: Ying Han <yinghan@google.com>
Cc: Nick Piggin <npiggin@gmail.com>
Acked-by: Rik van Riel <riel@redhat.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Bob Liu <lliubbo@gmail.com>
Cc: Neil Zhang <zhangwm@marvell.com>
Cc: Russell King - ARM Linux <linux@arm.linux.org.uk>
Reviewed-by: Michal Hocko <mhocko@suse.cz>
Acked-by: Minchan Kim <minchan@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Lisa Du <cldu@marvell.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit: 6e543d5780e36ff5ee56c44d7e2e30db3457a7ed
[lauraa@codeaurora.org: Some context fixups and variable name changes due
to backporting. Dropped parts that don't apply to older kernels]
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
(cherry picked from commit e0935219e1e0a087d1f7fad356f89e4eb96debae)
swap: add per-partition lock for swapfile

swap_lock is heavily contended when I test swap to 3 fast SSD (even
slightly slower than swap to 2 such SSD).  The main contention comes
from swap_info_get().  This patch tries to fix the gap with adding a new
per-partition lock.

Global data like nr_swapfiles, total_swap_pages, least_priority and
swap_list are still protected by swap_lock.

nr_swap_pages is an atomic now, it can be changed without swap_lock.  In
theory, it's possible get_swap_page() finds no swap pages but actually
there are free swap pages.  But sounds not a big problem.

Accessing partition specific data (like scan_swap_map and so on) is only
protected by swap_info_struct.lock.

Changing swap_info_struct.flags need hold swap_lock and
swap_info_struct.lock, because scan_scan_map() will check it.  read the
flags is ok with either the locks hold.

If both swap_lock and swap_info_struct.lock must be hold, we always hold
the former first to avoid deadlock.

swap_entry_free() can change swap_list.  To delete that code, we add a
new highest_priority_index.  Whenever get_swap_page() is called, we
check it.  If it's valid, we use it.

It's a pity get_swap_page() still holds swap_lock().  But in practice,
swap_lock() isn't heavily contended in my test with this patch (or I can
say there are other much more heavier bottlenecks like TLB flush).  And
BTW, looks get_swap_page() doesn't really need the lock.  We never free
swap_info[] and we check SWAP_WRITEOK flag.  The only risk without the
lock is we could swapout to some low priority swap, but we can quickly
recover after several rounds of swap, so sounds not a big deal to me.
But I'd prefer to fix this if it's a real problem.

"swap: make each swap partition have one address_space" improved the
swapout speed from 1.7G/s to 2G/s.  This patch further improves the
speed to 2.3G/s, so around 15% improvement.  It's a multi-process test,
so TLB flush isn't the biggest bottleneck before the patches.

Change-Id: Ic8d600653479c0e6767f04462c3f057b0fe94332
[arnd@arndb.de: fix it for nommu]
[hughd@google.com: add missing unlock]
[minchan@kernel.org: get rid of lockdep whinge on sys_swapon]
Signed-off-by: Shaohua Li <shli@fusionio.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Minchan Kim <minchan.kim@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Seth Jennings <sjenning@linux.vnet.ibm.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
Cc: Dan Magenheimer <dan.magenheimer@oracle.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: ec8acf20afb8534ed511f6613dd2226b9e301010
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[lauraa@codeaurora.org: Various context fixups due to backport]
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
(cherry picked from commit 1abbca70464a8b7fcd0c76ba3e86aea373ef77e4)
msm: mdss: fb: Copy & send unsigned value for notify update

Copy unsigned long from userspace and modify the data fields
before copying back unsigned long data to userspace. This
keeps the datatypes of all operands homogeneous without
data leaks from kernel to user space.

CRs-Fixed: 526286
Change-Id: Ie4673563170c3459019dd6a5f1f55376f6e560c7
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
(cherry picked from commit 7825145e1906c347bf15ed676c7ec87746418078)
msm: mdss: fb: null check mfd data

Add appropriate null check for mfd data structure
before accessing it's members. This prevents null
pointer accesses in the driver.

Change-Id: Id301d4a90c9a52049944c7e3b31aa1a34ad292d7
CRs-Fixed: 526286
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
(cherry picked from commit cc32748aaecae0b0fdf5f6501d730dfa3db77ef7)
ASoC: msm: q6: check upper bounds when copy ac3 params

Although AC3 maximum param size is fixed, better check upper bounds
when copy user data. It might cause overflow, possibly cause memory
corruption.

Change-Id: I2f7cec8edd9e013de1433ea06480b963ec307196
Signed-off-by: Fred Oh <fred@codeaurora.org>
(cherry picked from commit b79fd20ed8b6c14dc27d270c96144d06522b5349)
ASoC: msm: q6: check upper bounds when copy ac3 params

Although AC3 maximum param size is fixed, better check upper bounds
when copy user data. It might cause overflow, possibly cause memory
corruption.

Change-Id: Iaded762f774c608e48e685d92204fc7516aa3063
Signed-off-by: Fred Oh <fred@codeaurora.org>
(cherry picked from commit 588b3416ba26e03c1f0680fc2d55dbeb69e13482)
ASoC: msm: Fix for passing correct data to userspace

The Copy_to_user function copies the whole frame structure
to the userspace. Only len bytes should be copied.
As the whole frame is being copied
(HPCM_MAX_VOC_PKT_SIZE bytes) the uninitialized bytes
in the buffer will be disclosed to the calling
user-space process.

CRs-fixed: 552524

Change-Id: I7d7f58d358aaf56d91a79cfe95c04d937b48da53
Signed-off-by: Vicky Sehrawat <vickys@codeaurora.org>
(cherry picked from commit ed97e22a054b2eb515bafa6a809000d7efb3ce60)
qseecom: Check input buffer from IOCTL

IOCTL messages come with pointers to buffer, check these
buffer pointers prior to accessing it.

Change-Id: Ibd724a35682a6f8e4f6900c8404854a8b55c0c9a
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
(cherry picked from commit 0e67489c6ab00a6af7f8e3ab8f5cd8cb12c8acb5)
ASoc: msm: qdsp6v2: add vm page offset validation

Lack of range validation can lead wrong mapping or expose arbitrary
memory page to userspace

Change-Id: I8c6eb1b7255d444bffd9d3748ca4815b11bdf16a
Signed-off-by: Fred Oh <fred@codeaurora.org>
(cherry picked from commit 0b5f49b360afdebf8ef55df1e48ec141b3629621)
Merge "mm: vmscan: fix do_try_to_free_pages() livelock"
Merge "swap: add per-partition lock for swapfile"
Merge "msm: mdss: fb: Copy & send unsigned value for notify update"
Merge "msm: mdss: fb: null check mfd data"
Merge "ASoC: msm: q6: check upper bounds when copy ac3 params"
Merge "ASoC: msm: q6: check upper bounds when copy ac3 params"
Merge "ASoC: msm: Fix for passing correct data to userspace"
Merge "qseecom: Check input buffer from IOCTL"
Merge "ASoc: msm: qdsp6v2: add vm page offset validation"