msm: mdss: Adding lcd notifier 1

https://github.com/anarkia1976/AK-OnePone/commit/653f8a27bd8cc41473aba87b2311246338936dd3
msm: mdss: Adding lcd notifier 2

https://github.com/anarkia1976/AK-OnePone/commit/653f8a27bd8cc41473aba87b2311246338936dd3
msm: mdss: Adding lcd notifier 3

https://github.com/anarkia1976/AK-OnePone/commit/653f8a27bd8cc41473aba87b2311246338936dd3#diff-b1849be67a9ddc86c6eb2f52fd062a81R1111
msm: mdss: Adding lcd notifier 4

https://github.com/anarkia1976/AK-OnePone/commit/653f8a27bd8cc41473aba87b2311246338936dd3#diff-b1849be67a9ddc86c6eb2f52fd062a81R1097
Update smd_rpc_sym.c
Update Kconfig
Update Makefile
msm: mdss: lcd notifier Only pass display state to lcd_notifer_call_c… …hain 1

https://github.com/anarkia1976/AK-OnePone/commit/c17d4304590b94aa4b52371ad970bf549031b837#diff-1
msm: mdss: lcd notifier Only pass display state to lcd_notifer_call_c… …hain 2

https://github.com/anarkia1976/AK-OnePone/commit/c17d4304590b94aa4b52371ad970bf549031b837#diff-b1849be67a9ddc86c6eb2f52fd062a81R1111
msm: mdss: lcd notifier Only pass display state to lcd_notifer_call_c… …hain 3

https://github.com/anarkia1976/AK-OnePone/commit/c17d4304590b94aa4b52371ad970bf549031b837#diff-2
Update ska_defconfig
Revert "Delete cpu-boost.c"

This reverts commit ca4dd050af5fba22954306ed947142f740c75680.
Revert "Update cpufreq.c"

This reverts commit b52df16e86400186588119ce704778ff32356733.
Update cpufreq_intellimm.c
Revert "cpufreq: export the cpu load across cores to the policy struct. On Pe… …rformance governor let's emulate a constant 100% load (in this Kernel's case it will make all cores online, which is kinda the purpose of a performance governor isn't it?). 3"

This reverts commit e7efaf9cfa53af694e4a4a752dc05e2d2a38b95d.
net: fix info leak in compat dev_ifconf()

The implementation of dev_ifconf() for the compat ioctl interface uses
an intermediate ifc structure allocated in userland for the duration of
the syscall. Though, it fails to initialize the padding bytes inserted
for alignment and that for leaks four bytes of kernel stack. Add an
explicit memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
af_key: fix info leaks in notify messages

key_notify_sa_flush() and key_notify_policy_flush() miss to initialize
the sadb_msg_reserved member of the broadcasted message and thereby
leak 2 bytes of heap memory to listeners. Fix that.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ipc/msg: fix race around refcount

In older kernels (before v3.10) ipc_rcu_hdr->refcount was non-atomic int.
There was possuble double-free bug: do_msgsnd() calls ipc_rcu_putref() under
msq->q_perm->lock and RCU, while freequeue() calls it while it holds only
'rw_mutex', so there is no sinchronization between them. Two function
decrements '2' non-atomically, they both can get '0' as result.

do_msgsnd()					freequeue()

msq = msg_lock_check(ns, msqid);
...
ipc_rcu_getref(msq);
msg_unlock(msq);
schedule();
						(caller locks spinlock)
						expunge_all(msq, -EIDRM);
						ss_wakeup(&msq->q_senders, 1);
						msg_rmid(ns, msq);
						msg_unlock(msq);
ipc_lock_by_ptr(&msq->q_perm);
ipc_rcu_putref(msq);				ipc_rcu_putref(msq);
< both may get get --(...)->refcount == 0 >

This patch locks ipc_lock and RCU around ipc_rcu_putref in freequeue.
( RCU protects memory for spin_unlock() )

Similar bugs might be in other users of ipc_rcu_putref().

In the mainline this has been fixed in v3.10 indirectly in commmit
6062a8dc0517bce23e3c2f7d2fea5e22411269a3
("ipc,sem: fine grained locking for semtimedop") by Rik van Riel.
That commit optimized locking and converted refcount into atomic.

I'm not sure that anybody should care about this bug: it's very-very unlikely
and no longer exists in actual mainline. I've found this just by looking into
the code, probably this never happens in real life.

Signed-off-by: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
of: fdt: fix memory initialization for expanded DT

Already existing property flags are filled wrong for properties created from
initial FDT. This could cause problems if this DYNAMIC device-tree functions
are used later, i.e. properties are attached/detached/replaced. Simply dumping
flags from the running system show, that some initial static (not allocated via
kzmalloc()) nodes are marked as dynamic.

I putted some debug extensions to property_proc_show(..) :
..
+       if (OF_IS_DYNAMIC(pp))
+               pr_err("DEBUG: xxx : OF_IS_DYNAMIC\n");
+       if (OF_IS_DETACHED(pp))
+               pr_err("DEBUG: xxx : OF_IS_DETACHED\n");

when you operate on the nodes (e.g.: ~$ cat /proc/device-tree/*some_node*) you
will see that those flags are filled wrong, basically in most cases it will dump
a DYNAMIC or DETACHED status, which is in not true.
(BTW. this OF_IS_DETACHED is a own define for debug purposes which which just
make a test_bit(OF_DETACHED, &x->_flags)

If nodes are dynamic kernel is allowed to kfree() them. But it will crash
attempting to do so on the nodes from FDT -- they are not allocated via
kzmalloc().

Signed-off-by: Wladislav Wiebe <wladislav.kw@gmail.com>
Acked-by: Alexander Sverdlin <alexander.sverdlin@nsn.com>
Signed-off-by: Rob Herring <rob.herring@calxeda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
of: Fix missing memory initialization on FDT unflattening

Any calls to dt_alloc() need to be zeroed. This is a temporary fix, but
the allocation function itself needs to zero memory before returning
it. This is a follow up to patch 9e4012752, "of: fdt: fix memory
initialization for expanded DT" which fixed one call site but missed
another.

Signed-off-by: Grant Likely <grant.likely@linaro.org>
Acked-by: Wladislav Wiebe <wladislav.kw@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>