ping: prevent NULL pointer dereference on write to msg_name

A plain read() on a socket does set msg->msg_name to NULL. So check for
NULL pointer first.

Change-Id: I3773934fb633157ce5011d2f10900b7caef73733
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: cf970c002d270c36202bd5b9c2804d3097a52da0
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
ASoC: msm: qdsp6v2: adding volume per dev-id.

Add volume mixer control per device id for pcm use case.

Change-Id: Ieab721541a5cdf494b7fad78abc06d4f667b4baf
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
leds: leds-qpnp: provide pwm period when leds are set to LPG mode in DT

In the current design, if MPP-controlled leds or RGB leds are configured
to LPG mode in the device tree, the PWM period value is not provided.
This will result in "pwm_cfg->pwm_period_us" being assigned to zero
since no PWM period value will be read from device tree. As a result,
qpnp_pwm_init() returns error, which in turn results in failure of
qpnp_mpp_init() or qpnp_rgb_init() and finally resulting in failure of
qpnp_leds_probe().

So "qcom,pwm-us" property should be provided in DT for the above case and
the property parsing needs to be implemented in the leds-qpnp driver.

Change-Id: Ic32833ea4e685939148e38cdba078391936f8efb
CRs-Fixed: 667825
Signed-off-by: Abinaya P <abinayap@codeaurora.org>
msm: mdss: Check null-pointer dereferencing and buffer overflows

Add checks before possible null-pointer dereferencing. Add checks to
prevent buffer out-of-bounds access.

Change-Id: I17419c82654c4ad2d18c7f88e34447cf333450bb
Signed-off-by: Mathew Karimpanal <kjmathew@codeaurora.org>
Signed-off-by: Beeresh Gopal <gbeeresh@codeaurora.org>
msm: thermal: Add support for cpu temp limit recommendation for SoC

Add support in KTM to get SoC parts info by reading appropriate
efuse bits and recommend default cpu temperature limit based on
efuse value temperature map to userspace through sysfs interface
'/sys/module/msm_thermal/default_cpu_temp_limit'. Efuse data
to be read such as address, row number, starting bit number
of the row, number of bits for identifying parts etc, default core
temperature and efuse temperature value map are read from dt.
The default cpu temperature information is exported in the format
<temperature in degree celsius>.

Conflicts:
        drivers/thermal/msm_thermal.c

Change-Id: Icbf43c3fd56e95d49a886d309e613d2fe146a506
Signed-off-by: Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>
Signed-off-by: Akhila Musunuri <makhila@codeaurora.org>
spi_qsd: Initialize wait queue

Due to missing initialization of wait queue
issues reported on customer builds. This patch
adds the missing wait queue initialization code.

Change-Id: I2150d94bfec74b26842aac4fbd0e2e44af3b9943
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
net: ipv4: current group_info should be put after using.

Plug a group_info refcount leak in ping_init.
group_info is only needed during initialization and
the code failed to release the reference on exit.
While here move grabbing the reference to a place
where it is actually needed.

Change-Id: I38d476f49e7ae300bc1168bc4b2c1b67274a51ca
Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com>
Signed-off-by: xiaoming wang <xiaoming.wang@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit:b04c46190219a4f845e46a459e3102137b7f6cac
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
[rsiddoji@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>
ARM: gic: Use _no_log variants while accessing some registers

Some GIC register accesses happens more frequently flooding the
RTB logs. Since they're not that useful for debugging purposes,
use _no_log variants while accessing those registers.

Change-Id: Idfb48c668eb90a3187fa3afdd7df5cd64062559d
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
msm: mdss: fix potential deadlock with ulps work thread

Do not check if the clocks are on when sending the ULPS event from
the worker thread. This check is not needed since the work is only
scheduled after the clocks are turned off and would be cancelled
anyway when the clocks are turned on if it is pending. Removing this
unnecessary check avoids acquiring a shared lock which can potentially
lead to a deadlock.

Change-Id: Ib9760221f044dded50a38a32b59d0158c2f6b50e
Signed-off-by: Aravind Venkateswaran <aravindh@codeaurora.org>
Merge "net: ipv4: current group_info should be put after using."
Merge "n_tty: Fix n_tty_write crash when echoing in raw mode"
ARM: dts: msm: Add CX regulator Phandle to MDP node

The Phandle might change for different versions of
the msm8974 chip. Add the proper Phandle of CX regulator
to 8974pro version.

Change-Id: I6e8ab19c9765ff225a54a621cd001e8af1c7391d
Signed-off-by: Xiaoming Zhou <zhoux@codeaurora.org>
Merge "ARM: gic: Use _no_log variants while accessing some registers"
Merge "Merge "n_tty: Fix n_tty_write crash when echoing in raw mode""
Merge "Merge "ARM: gic: Use _no_log variants while accessing some registers""
ARM: Don't dump vmalloc addresses with show_data()

Memory-mapped IO address spaces cannot be safely dumped at will.
Some addresses may not be available (clocked, powered) at all times,
and may result in hangs or bus decode errors if accessed. Other
registers that are accessible may have read side-effects, and dumping
them may have adverse affects on stability or the functionality of
the affected peripheral.

Be safe, and skip dumping such addresses altogether.

CRs-Fixed: 625442
Change-Id: I4cfa75f027ededf841a0240715af0db385857cbe
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
(cherry picked from commit 23bbd49b56e4854067337c16ad2c2c95abbf7100)
ARM: Improve vmalloc address checking in show_data()

There is an unhandled corner case with the current check
which has recently been hit. The nbytes argument may be
large enough for the range being dumped to cross a
boundary between page-table mappings, and dump addresses
which are vmalloc'd in the neighboring mapping.

Check every address being dumped to see if its vmalloc'd,
not just the address passed to show_data().

CRs-Fixed: 625442
Change-Id: I255b093808177321f5202dcacea337ee333bfc63
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
(cherry picked from commit 2811c0946b2164cc3ede5350ce04dae32ce863e2)
ASoC: wcd9xxx: Don't enable micbias if headset is removed

If special headset is removed, the callback to
disable micbias will be called, as micbias is
always on with special headset. Mbhc driver
checks a flag, used to disable/enable micbias
for special headset, to make sure micbias is
not disabled by recording. If this flag is not
updated properly before the callback is called
while the headset is removed, it can cause that
micbias is left enabled.

CRs-Fixed: 687630
Change-Id: Id49a2a0ba43821deef8fc5b6fb904239b2273f69
Signed-off-by: Simmi Pateriya <simmip@codeaurora.org>
Merge "ARM: Don't dump vmalloc addresses with show_data()"