fs: Add a missing permission check to do_umount

Accessing do_remount_sb should require global CAP_SYS_ADMIN, but
only one of the two call sites was appropriately protected.

Fixes CVE-2014-7975.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
kernel: add support for gcc 5

We're missing include/linux/compiler-gcc5.h which is required now
because gcc branched off to v5 in trunk.

Just copy the relevant bits out of include/linux/compiler-gcc4.h,
no new code is added as of now.

This fixes a build error when using gcc 5.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
msm: qdsp6v2: Allow 320K AAC encoding

 * DSP supports this swimmingly.

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
power: Avoids bogus error messages for the suspend aborts.

Avoids printing bogus error message "tasks refusing to freeze", in cases
where pending wakeup source caused the suspend abort.

Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
futex: Ensure get_futex_key_refs() always implies a barrier

Commit b0c29f79ecea (futexes: Avoid taking the hb->lock if there's
nothing to wake up) changes the futex code to avoid taking a lock when
there are no waiters. This code has been subsequently fixed in commit
11d4616bd07f (futex: revert back to the explicit waiter counting code).
Both the original commit and the fix-up rely on get_futex_key_refs() to
always imply a barrier.

However, for private futexes, none of the cases in the switch statement
of get_futex_key_refs() would be hit and the function completes without
a memory barrier as required before checking the "waiters" in
futex_wake() -> hb_waiters_pending(). The consequence is a race with a
thread waiting on a futex on another CPU, allowing the waker thread to
read "waiters == 0" while the waiter thread to have read "futex_val ==
locked" (in kernel).

Without this fix, the problem (user space deadlocks) can be seen with
Android bionic's mutex implementation on an arm64 multi-cluster system.

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Matteo Franchin <Matteo.Franchin@arm.com>
Fixes: b0c29f79ecea (futexes: Avoid taking the hb->lock if there's nothing to wake up)
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Tested-by: Mike Galbraith <umgwanakikbuti@gmail.com>
Cc: <stable@vger.kernel.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
selinux: fix inode security list corruption

sb_finish_set_opts() can race with inode_free_security()
when initializing inode security structures for inodes
created prior to initial policy load or by the filesystem
during ->mount().   This appears to have always been
a possible race, but commit 3dc91d4 ("SELinux:  Fix possible
NULL pointer dereference in selinux_inode_permission()")
made it more evident by immediately reusing the unioned
list/rcu element  of the inode security structure for call_rcu()
upon an inode_free_security().  But the underlying issue
was already present before that commit as a possible use-after-free
of isec.

Shivnandan Kumar reported the list corruption and proposed
a patch to split the list and rcu elements out of the union
as separate fields of the inode_security_struct so that setting
the rcu element would not affect the list element.  However,
this would merely hide the issue and not truly fix the code.

This patch instead moves up the deletion of the list entry
prior to dropping the sbsec->isec_lock initially.  Then,
if the inode is dropped subsequently, there will be no further
references to the isec.

Reported-by: Shivnandan Kumar <shivnandan.k@samsung.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
ASoC: Compress: Check and set pcm_new driver op

Check and set if pcm_new driver op is initialized by the driver.
This allows the compress offload drivers to register mixer
controls.

Change-Id: If54fa36cf19cbca7239d6e3e30455472e9a173d8
Signed-off-by: Ravi Kumar Alamanda <ralama@codeaurora.org>
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
ASoC: qdsp6: Add support for custom topology

Update ASM driver to send commands to DSP to enable
custom topology for enabling audio post processing
effects in POPP.

Change-Id: Ic222b5045820ebabb79148c8e51f5fd90fcd1410
Signed-off-by: Subhash Chandra Bose Naripeddy <snariped@codeaurora.org>
Signed-off-by: Ravi Kumar Alamanda <ralama@codeaurora.org>
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
ASoC: msm: Handle RESET_EVENTS in compress driver

Listen for RESET_EVENTS message in the q6asm callback and move
compress driver to an error state. All ops except free() are rejected
in this state.

Change-Id: Id12dba9e3a40b01f02e516857cb32af8f9e4cb60
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
Signed-off-by: Ravi Kumar Alamanda <ralama@codeaurora.org>
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
ASoC: msm: Do not allow commands during gapless transition

During gapless playback if flush is sent to the driver before EOS
acknowledgement from DSP, the playback is switched to stream one.
On EOS ack the stream one is closed resulting in no audio. The fix
is to not allow pause/resume/flush commands during transition from
one clip to other during gapless playback. Playback should move to
the second stream if the playback enters transition period.

CRs-Fixed: 588353
Change-Id: I1be30956cce677e153ef5b8a362de303fec7620a
Signed-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
ASoC: msm: Condition change to feed buffer on resume

Feed data to the DSP on a CMD_RUN ack by looking at the number
of bytes sent to the DSP and not the number of bytes consumed

Change-Id: I5eb3c04b84ffe9c6cea76515557d6d9be85ea11a
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
ASoC: msm: qdsp6v2: Wait for stream to be available in gapless playback

Compressed driver operates on two streams in gapless mode and switches
between the two streams. If compressed playback operates on larger
buffers and the clip being played is small enough to fit in one
buffer, the driver could run into a scenario where three streams
need to be handled. Three streams results in no audio because stream
switching logic is corrupted. Fix is to block the next track call if
stream one has not completed playback.

CRs-Fixed: 594977
Change-Id: I6c83e859fa38f177ec7f4fa4ea92937d34df933a
Signed-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
ASoC: msm: Check accessing session private data

The compressed session needs to be active to set volume to dsp.
Ensure the check to see valid session exist before accessing
private data, else results in kernel panic.

CRs-Fixed: 638817

(subset of)
Change-Id: Ifdce543aa55df420960e9eeff0564f18d9410060

Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
msm: kgsl: Add CMA memory feature to support NOMMU for GPU

Reserves CMA memory for kgsl driver early during bootup and then
uses dma_alloc_coherent() to allocate physically contiguous memory
instead of using the MMU

Change-Id: Ica9b244fe9b9d8a902d670293a0bec2edf81bd5d
Signed-off-by: Shrenuj Bansal <shrenujb@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
msm: kgsl: Use a constant mask for the memops vmflags

We don't need to define a function to return a constant.  Save
ourselves some source code and some .text space too.

Change-Id: Ic0dedbadc72c2fdd473cd4369ed772c84a923a15
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
msm: kgsl: Don't set VM_IO on mmap()ed GPU memory objects

VM_IO prevents mapped memory from being peeked by ptrace(). That
kind of protection isn't really needed for nominal GPU buffers.
A process given itself up to ptrace() already expects to be
examined so there is no additional risk to let the parent examine
GPU buffers too.  This is done universally now, but there is no
reason why we wouldn't let the process choose which buffers to
keep private in the future.

That said; there is more of a concern about including GPU buffers
in a core dump since that is a more permanent and less secure
record of the memory so add VM_DONTDUMP for all GPU buffers to
protect against that.

CRs-Fixed: 654751
Change-Id: Ic0dedbade91a2ec458bcb27eff3312d4ec6e4389
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
msm: kgsl: Mark mmapped objects with VM_DONTCOPY

Add VM_DONTCOPY to the default set of mmap flags to keep VM objects
from being copied on fork() and causing issues.  KGSL file descriptors
copied to a child are not expected to be usable.

Change-Id: Ic0dedbad85c07118a931ccb9f7a6fd0507da3e5a
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
msm: kgsl: Add a flag to mark user mapped GPU buffers

Add a flag in /sys/kernel/debug/kgsl/kgsl-3do/proc/<pid>/mem
file to indicate for each GPU buffer if it is mapped to userspace
in <pid> or not.

CRs-fixed: 634962
Change-Id: I8abda74ef5656aca6b1c0315af8deb77460fa5a9
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>

Conflicts:
	drivers/gpu/msm/kgsl_debugfs.c

Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
msm: kgsl: Clear the memstore while destroying the context

When creating a context, we add the event group much before
initializing the memstore for that context. Between these events,
its possible that events are registered and retired and the
timestamp read in retire_events() gets us the last timestamp of
the last destroyed context. This results in the processed
timestamp to be greater than the actual retired timestamp in the
memstore which is very problematic for us.

CRs-Fixed: 640550
Change-Id: I2ace6d99e2ce417ba38f6bbbeeb787478eb4e372
Signed-off-by: Shrenuj Bansal <shrenujb@codeaurora.org>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>
Enable setting security contexts on rootfs inodes.

rootfs (ramfs) can support setting of security contexts
by userspace due to the vfs fallback behavior of calling
the security module to set the in-core inode state
for security.* attributes when the filesystem does not
provide an xattr handler.  No xattr handler required
as the inodes are pinned in memory and have no backing
store.

This is useful in allowing early userspace to label individual
files within a rootfs while still providing a policy-defined
default via genfs.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Stefanescu Cristian <howerkraft@gmail.com>