msm: Fix warning in sensors ADSP driver with GCC 4.7 toolchain.

Fixes below warning - could be potentially a bug as well.

arch/arm/mach-msm/sensors_adsp.c:877:39: warning: argument to 'sizeof' \
in 'memcpy' call is the same expression as the source; did you mean to \
dereference it? [-Wsizeof-pointer-memaccess]

Change-Id: I8e624b44120719d7359416a36912d0ef56f49982
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
msm: Fix NULL pointer dereference in sensors ADSP driver.

Memory is allocated on the heap via kzalloc for temp variable.
Then it is passed through error checking. Error checking is
incorrect however, because instead of immediately returning -ENOMEM,
the function continues without returning. temp could be potentially
NULL when passed in to memcpy, causing a NULL dereference and writing
to that location.

Change-Id: Ib9faef2a542d1d8da35e1b3f7292596c9bddadba
CRs-fixed: 563553
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
leds: leds-qpnp: Correctly terminate of_device_id array

Correctly terminate of_device_id array to avoid of_device_lookup()
incorrectly probe an additional instance of leds-qpnp device.

Change-Id: Ie6c61b4500a5fbe792e3154a761c235573c7e6bf
CRs-Fixed: 582141
Signed-off-by: Himanshu Aggarwal <haggarwa@codeaurora.org>
hwmon: epm_adc: Add debug logs

Add Version and firmware debug logs during initialization.

Change-Id: I3ded6b8a141a1b20b155309df5cac42fd76b9471
Signed-off-by: Siddartha Mohanadoss <smohanad@codeaurora.org>
USB: u_serial: Don't free usb_requests in gs_close and reuse them

Commit: 950a3a3 "USB: Gadget: u_serial: Freeing usb requests as a
part of gs_close" results in freeing requests and flushing the EP
on every port close even if USB connection is present. These requests
are allocated again on port open. Also, EP flush call may result in
unclocked access of USB hardware if USB BUS state was suspended at
the time of port_close. This patch fixes that and also addresses the
original issue of gs_open allocating usb requests on every port_open
by adding a condition to allocate USB requests in port open only if
they are not already allocated.

CRs-fixed: 591617
Change-Id: If2ab31fa1d36ea6119dc0ced13ade5ed93d85d86
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
msm: mdss: fix overlay set issue on 8x10

The driver was assuming the color format and resolution
of the overlay to be the same as frame buffer.  This
causes page fault and corruption if the client is using
a different color format or resolution.   The change is
to re-configure the dma pipe if the overlay configuration
is different from the default.

Change-Id: Ic7558811a3015a416b2428fb0d626bf13663e528
Signed-off-by: Xiaoming Zhou <zhoux@codeaurora.org>
msm: vidc: Fix unsupported codec error from video driver

- Client is getting unsupported codec error for set format
  sometimes after opening the video driver because driver
  was not updated with supported codecs information from
  video hardware.
- The same issue can be fixed by waiting for the driver state
  changed to CORE_INIT_DONE, which ensures the supported codecs
  information will be updated in video driver, before checking
  the supported codecs information.

CRs-fixed: 590158
Change-Id: Ia9132fdc01e4fa53533a3c9d14069d49501fa7d7
Signed-off-by: Maheshwar Ajja <majja@codeaurora.org>
ext4: make sure the journal sb is written in ext4_clear_journal_err()

After we transfer set the EXT4_ERROR_FS bit in the file system
superblock, it's not enough to call jbd2_journal_clear_err() to clear
the error indication from journal superblock --- we need to call
jbd2_journal_update_sb_errno() as well.  Otherwise, when the root file
system is mounted read-only, the journal is replayed, and the error
indicator is transferred to the superblock --- but the s_errno field
in the jbd2 superblock is left set (since although we cleared it in
memory, we never flushed it out to disk).

This can end up confusing e2fsck.  We should make e2fsck more robust
in this case, but the kernel shouldn't be leaving things in this
confused state, either.

Change-Id: I7a7cd58880209fbd54f4ded5f2b62de492cae9e0
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@kernel.org
Git-commit: d796c52ef0b71a988364f6109aeb63d79c5b116b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
jbd2: Fix use after free after error in jbd2_journal_dirty_metadata()

When jbd2_journal_dirty_metadata() returns error,
__ext4_handle_dirty_metadata() stops the handle. However callers of this
function do not count with that fact and still happily used now freed
handle. This use after free can result in various issues but very likely
we oops soon.

The motivation of adding __ext4_journal_stop() into
__ext4_handle_dirty_metadata() in commit 9ea7a0df seems to be only to
improve error reporting. So replace __ext4_journal_stop() with
ext4_journal_abort_handle() which was there before that commit and add
WARN_ON_ONCE() to dump stack to provide useful information.

Change-Id: Ibfd59e399f4a11abc378a237e10b3741bef2a15e
Reported-by: Sage Weil <sage@inktank.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org	# 3.2+
Git-commit: 91aa11fae1cf8c2fd67be0609692ea9741cdcc43
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
ext4: fix memory leak in xattr

If we take the 2nd retry path in ext4_expand_extra_isize_ea, we
potentionally return from the function without having freed these
allocations.  If we don't do the return, we over-write the previous
allocation pointers, so we leak either way.

Spotted with Coverity.

[ Fixed by tytso to set is and bs to NULL after freeing these
  pointers, in case in the retry loop we later end up triggering an
  error causing a jump to cleanup, at which point we could have a double
  free bug. -- Ted ]

Change-Id: I49b8ca41a6c6d44b563eb23306870258a3affd3b
Signed-off-by: Dave Jones <davej@fedoraproject.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Cc: stable@vger.kernel.org
Git-commit: 6e4ea8e33b2057b85d75175dd89b93f5e26de3bc
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
diag: dci: Safeguard to prevent Integer Underflow and Memory Leak

At certain point in diag driver there can be integer underflow
thus can lead to memory leak. Added a safeguard for that.

Change-Id: I2a0304f5b9888fe12ca9ef5fbaa9a68ee4ab9c15
Crs-fixed: 556860
Signed-off-by: Katish Paran <kparan@codeaurora.org>
cpufreq: Fix policy getting stuck when user & kernel min/max don't overlap

Every __cpufreq_set_policy starts with checking the new policy min/max has
some overlap with the current policy min/max. This works out fine until we
end up with the policy min/max being set to a range that doesn't overlap
with the user policy min/max. Once we get into this situation, the check at
the start of __cpufreq_set_policy fails and prevents us from getting out of
this state.

This only happens when one of the CPUFREQ_ADJUST/CPUFREQ_INCOMPATIBLE
notifiers called inside __cpufreq_set_policy pick a min/max outside the
range of user policy min/max.

The real intent of the check at the start of __cpufreq_set_policy is to
make sure userspace can't set user policy min > user policy max. Since
__cpufreq_set_policy always gets called only with current user policy
min/max except when the actual user space policy min/max is changed, we can
fix the issue by simply checking the new policy min/max against current
user policy min/max.

Change-Id: Iaac805825e64d7985c41fb9052bd96baacdf3d6f
Signed-off-by: Saravana Kannan <skannan@codeaurora.org>
ASoC: msm: Disable gapless offload playback by default

Add a flag to platform private data to enable/disable gapless
playback. The platform data is updated by mixer control.
If gapless playback is disabled ignore next track and handle
partial drain as full drain. The stream is opened in gapless
mode based on the paltform data.

Change-Id: I36cea976bcb53f50069653aec4f0f8cc869f491a
Signed-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>

Conflicts:

	sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c
radio: iris: Allow task to be interrupted

Not allowing task to be interrupted can cause
delay in response to upper layer. Allow task pending
to be interrupted when corresponding command's status
is received.

Change-Id: Ibb84673dfa92458c1ef45da12e63dd041abd0c39
CRs-Fixed: 569318
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Add NULL pointer check

Dereferencing a NULL pointer may cause kernel crash,
Check for NULL pointer before dereferencing

Change-Id: Ic3368d619d23c76702d95e0f69e41394e423a296
CRs-Fixed: 548404
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Bound check user space values

There is no bound check for arguments passed
from user space to kernel space. This may cause
fatal exceptions.

Change-Id: I944e8e5d6e3b12b75df4e6cee7887075237b4411
CRs-Fixed: 546081
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>