msm: camera: Fix crash in ispif release.

There is a BUG_ON in ispif release function for
ispif base address. but in case of just open and close
of ispif subdevice leads to ispif base NULL.

BUG_ON is removed and proper error is added in ispif
release function to fix the issue.

Change-Id: I0cc12d52aff9db0d9bb8844473f9bd6547270e27
CRs-Fixed: 642603
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
Signed-off-by: Venkata Aravind <venkata@codeaurora.org>
[PATCH] Staging: android: binder: More offset validation.

Make sure offsets don't point to overlapping flat_binder_object
structs.

Change-Id: I425ab0c46fbe2b00ed679c5becf9e8140395eb40
Signed-off-by: Arve HjÃ¸nnevÃ¥g <arve@android.com>
[media] v4l2-ioctl.c: handle PREPARE_BUF like QUERYBUF

The core code for PREPARE_BUF didn't take the multiplanar case into
account, which might cause page faults. Handle PREPARE_BUF just like
QUERYBUF and QBUF/DQBUF.

Change-Id: Ida7f712edec32568a8c2651d54b160121009a9c4
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Srinu Gorle <sgorle@codeaurora.org>
CRs-Fixed: 637365
Merge "[media] v4l2-ioctl.c: handle PREPARE_BUF like QUERYBUF"
arm: mach-msm: Remove the unused rmt_storage code.

The rmt_storage module is no longer used.
Remove the unused module and cleanup the makefile and kconfig.

CRs-Fixed: 549951
Change-Id: Ie9ebaa2209ea9fa0df05dc892504fcb882f00f29
Signed-off-by: Nikhilesh Reddy <reddyn@codeaurora.org>
IPA: patch for debugfs to use pr_info

Fix debugfs to use pr_info to print out
routing, filtering rules in  IPA hardware

Change-Id: I29754e0f05fb5d854a7fedc209a01d443dac7eac
Signed-off-by: Ravinder Konka <rkonka@codeaurora.org>
Merge "[PATCH] Staging: android: binder: More offset validation."
Merge "msm: camera: Fix crash in ispif release."
Merge "IPA: patch for debugfs to use pr_info"
n_tty: Fix n_tty_write crash when echoing in raw mode.

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
          A                             B
   __tty_buffer_request_room
                                  __tty_buffer_request_room
   memcpy(buf(tb->used), ...)
   tb->used += space;
                                 memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes. This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15
Git-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>
Signed-off-by: Venkata Aravind <venkata@codeaurora.org>
Merge "arm: mach-msm: Remove the unused rmt_storage code."
Merge "n_tty: Fix n_tty_write crash when echoing in raw mode."