msm_bam_rmnet: Fix packet corruption due to QoS

Remove the QoS header added at the beginning of the
SKB (If QoS is enabled) in case of a failure to send
a packet to bam_dmux in order to avoid a possible loop
that adds QoS headers on each failure which will cause
a packet corruption.

CRs-Fixed: 599456
Change-Id: I5cda4db1f49638b37998d2502ff07b1e82518db1
Acked-by: David Arinzon <darinzon@qti.qualcomm.com>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
msm_bam_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
net: flow_dissector: fail on evil iph->ihl

We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
is evil (less than 5).

CRs-Fixed: 589913
Change-Id: Ifd7be75d153d7504704e7ff9d8f63fe3767326d2
Acked-by: David Arinzon <darinzon@qti.qualcomm.com>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
genalloc: Correct nbytes calculation on long boundary

In existing code we calculate nbytes based on the byte
boundary, but genalloc uses bitmap for maintaining the
memory allocation aligned to long. So while calculating
nbytes we end up getting wrong nbytes.
example: lets say nbytes comes to 9 bytes for 70 bits when
bytes aligned,but if long aligned we will have 3 long words
i.e 12 bytes. This difference may lead to choosing the
wrong api for freeing the memory i.e Between kfree() and
vfree().
Fix was inspired by an upstream commit
eedce141cd2dad8d0cefc5468ef41898949a7031, bringing same fix
into the gen_pool_detroy path.

Change-Id: I942caf59e25515c780896b328b912604df9e10bf
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
TTY: msm_smd_tty: Fix simultaneous open/close race condition

smd_tty_close currently has a variable that depends on a race
condition with tty_port_open. This causes a null-pointer dereference
when the same port is simultaneously being opened/closed.

Use data from a static array instead of the variable to eliminate
the race condition.

CRs-Fixed: 624398
Change-Id: Ie55d37feaadd3a15f64e18501cd3af19145dbc8e
Signed-off-by: Steven Cahail <scahail@codeaurora.org>
freezer: replace msleep with usleep_delay for sleep time of <20mS

usleep_delay() works more accurately for sleep time of <20mS.
All tasks can easily be frozen in under 10 ms, switch to using
an initial 1 ms sleep followed by exponential backoff until 8 ms.

Change-Id: Id932d7dbefe9c59eded33aa87cdb3cb8b581efa2
Signed-off-by: Sravan Kumar Ambapuram <asravan@codeaurora.org>
ARM: smp: BUG() if smp_send_reschedule() is called for an offline cpu

Sending an IPI_RESCHEDULE to an offline CPU is incorrect and potentially
bad for both power and stability. On some sub-architectures such as MSM,
if a power-collapsed CPU is unexpectedly woken up by an IPI, it will be
begin executing without the preparations that would normally happen as
part of CPU_UP_PREPARE. If clocks, voltage regulators, or other hardware
configuration are not performed, the booting CPU may cause general
instability or (at best) poor power performance since the CPU would be
powered up but not utilized.

One common cause for such issues is misuse of add_timer_on() or APIs
such as queue_work_on() which call it. If proper precautions are not
taken to block hotplug while these APIs are called then a race may
result in IPIs being sent to CPUs that are already offline.

This same argument could be applied to other IPIs (with the exception
of IPI_WAKEUP), but the others are already restricted to only online
CPUs by existing mechanisms, so an explicit assertion is not useful.

Change-Id: I437db112e7e2fa7c0635e4e97e265692621944f1
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
msm: smd_tty: Fix client notification issue in suspend state

SMD_TTY driver holds a wakeup source for 500ms to provide enough time
to notify the user client waiting for data. However, when system is in
suspend state the 500ms timer may not be sufficient to notify the
user clients because in some cases system resume of devices and tasks
is taking more time and this causes delay in client notification.

Register for PM_SUSPEND_PREPARE and PM_POST_SUSPEND events to track
system suspend and resume state and then notify the clients after system
resume completes.

CRs-Fixed: 613589
Change-Id: Iffb2ecb1c58f46e0c4a745cdcce2fb717ea2ece8
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
ion: Add missing unlock on error path

A mutex_unlock was missing for the alloc_lock on an error
path. Add it.

Change-Id: If88b72fbc2fd18504347b784d5daa2bc9170c55f
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
(cherry picked from commit 76d17e36bbb9f1a3acde26e02cfa4ee20903f4f5)
Fix sizeof-pointer-memaccess warning with gcc 4.8

This patch fixes wrong memcpy size when copying ltk value to
HCI_OP_LE_LTK_REPLY command.

Change-Id: I44e5e3da15369d4b424581720ccd3bac820ef2e0