futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing
from a non-pi futex to a pi futex with this call. If we attempt this,
then dangling pointers may be left for rt_waiter resulting in an
exploitable condition.

This change brings futex_requeue() into line with
futex_wait_requeue_pi() which performs the same check as per commit
6f7b0a2a5 (futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi())

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Change-Id: I6bfa0943ee54d6331e6faa7779d621f9cf19fe52
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
futex: Validate atomic acquisition in futex_lock_pi_atomic()

We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state. If
it has, return -EINVAL. The state is corrupted already, so no point in
cleaning it up. Subsequent calls will fail as well. Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
  	restoring the already corrupted user space state. ]

Change-Id: Ifca31cf91f32a408171a01b8db1e49c14411a776
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
futex: Always cleanup owner tid in unlock_pi

If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex. So the owner TID of the current owner
(the unlocker) persists. That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Change-Id: I8708a8c38c82ac4565634421fce8f916a6da873b
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
futex: Make lookup_pi_state more robust

The current implementation of lookup_pi_state has ambigous handling of
the TID value 0 in the user space futex. We can get into the kernel
even if the TID value is 0, because either there is a stale waiters
bit or the owner died bit is set or we are called from the requeue_pi
path or from user space just for fun.

The current code avoids an explicit sanity check for pid = 0 in case
that kernel internal state (waiters) are found for the user space
address. This can lead to state leakage and worse under some
circumstances.

Handle the cases explicit:

     Waiter | pi_state | pi->owner | uTID      | uODIED | ?

[1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
[2]  NULL   | ---      | ---       | >0        | 0/1    | Valid

[3]  Found  | NULL     | --        | Any       | 0/1    | Invalid

[4]  Found  | Found    | NULL      | 0         | 1      | Valid
[5]  Found  | Found    | NULL      | >0        | 1      | Invalid

[6]  Found  | Found    | task      | 0         | 1      | Valid

[7]  Found  | Found    | NULL      | Any       | 0      | Invalid

[8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
[9]  Found  | Found    | task      | 0         | 0      | Invalid
[10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid

[1]  Indicates that the kernel can acquire the futex atomically. We
     came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

[2]  Valid, if TID does not belong to a kernel thread. If no matching
     thread is found then it indicates that the owner TID has died.

[3]  Invalid. The waiter is queued on a non PI futex

[4]  Valid state after exit_robust_list(), which sets the user space
     value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

[5]  The user space value got manipulated between exit_robust_list()
     and exit_pi_state_list()

[6]  Valid state after exit_pi_state_list() which sets the new owner in
     the pi_state but cannot access the user space value.

[7]  pi_state->owner can only be NULL when the OWNER_DIED bit is set.

[8]  Owner and user space value match

[9]  There is no transient state which sets the user space TID to 0
     except exit_robust_list(), but this is indicated by the
     FUTEX_OWNER_DIED bit. See [4]

[10] There is no transient state which leaves owner and user space
     TID out of sync.

Backport to 3.13
  conflicts: kernel/futex.c

Change-Id: Ibec82fe154f4ed702332d2d259ec88317b6fede1
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
sec-battery: Standardize the output of the "online" property

Return "0" when no power supply is present

Change-Id: Ic873705c20468cb5e7898fa2ddff5828cd5928cf
stereo call recording support

Patch that allows for call recording in
stereo (left channel: TX; right channel:
RX). Tested on Nexus 5 (MSM8974). Likely
works on other recent MSM chipsets as
well.

Change-Id: I3d8a99c21caf0205b7558148437a431e87bc0a85
msm: display: Add pipe type selection in overlay request

Allow user to specify the type when requesting an overlay pipe.
If field is set the pipe type indication in the flags will be
ignored.
Change-Id: Iee51d24b96c7a2a987dc70a439342e6548dfc8fa
Signed-off-by: Vineet Bajaj <vbajaj@codeaurora.org>
ASoC: DPCM: Remove redundant code introduced during framework update

There is redundant code introduced during ALSA DPCM update to add
support for compressed audio, which calls the soc_pcm_prepare()
twice. Update to remove the reduandant code.

Change-Id: I5b3b7bc005816141537434be47ec743c7c02b274
CRs-fixed: 672001
Signed-off-by: Kuirong Wang <kuirongw@codeaurora.org>
ASoC: compr: timestamp fix for non-gapless mode

Cache last known playback timestamp before resetting the
in use session in preparation for possible re-use of the
same session.

Change-Id: Id422f5654960818c159f9f07d5af3c497192bae2
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
Signed-off-by: Dhananjay Kumar <dhakumar@codeaurora.org>
ASoC: msm: propagate the error code from the compr driver

Propagate the error code to the upper layers to avoid the
unwanted sequence of the commands to DSP.

CRs-Fixed: 671241
Change-Id: I72b4700f01f6953c13e64878acf5bed882eb41a5
Signed-off-by: Aviral Gupta <aviralg@codeaurora.org>
ASoC: compr: Disable soft-pause for compress playback

Soft-pause (i.e pause ack after a timeout) adversely affects
audio/video sync during pause/resume use cases leading to some
frame drops. Disable this feature for compress playback.

Change-Id: I3ce444dadf1e4b94c1e8d6f017a1c639b082285f
Signed-off-by: Haynes Mathew George <hgeorge@codeaurora.org>
CRs-Fixed: 636328
ASoC: msm: Configure correct gain on set Volume command

Output channel gain is product of per channel gain and master gain.
Hence if only per channel gain is set and master gain is set to 0
then no audio is heard at the output.
Ensure that if we change per channel gain then we set master gain
to unity and vice versa. This enables only one gain to be effective.

Change-Id: I4cc2990efbb3e86edcc3d4328761cb64ed8fa775
Signed-off-by: Ashish Jain <ashishj@codeaurora.org>
ASoC: msm: set the master gain to 0 on DSP while configuring

- Mute media volume and play any music clip then reboot
  the phone. Play music again noise comes. This noise
  is introduced in DSP/LPASS.

- DSP suggestion is to mute master volume gain while
  configuring ASM session to avoid such noise at
  begining of asm playback.

Change-Id: I2aa2846d6e3e9a85c459534e9108e6fe7aebb962
Signed-off-by: Ramjee Singh <ramjee@codeaurora.org>
Merge branch 'cm-11.0' into stable/cm-11.0