ashmem: avoid deadlock between read and mmap calls

Avoid holding ashmem_mutex across code that can page fault.  Page faults
grab the mmap_sem for the process, which are also held by mmap calls
prior to calling ashmem_mmap, which locks ashmem_mutex.  The reversed
order of locking between the two can deadlock.

The calls that can page fault are read() and the ASHMEM_SET_NAME and
ASHMEM_GET_NAME ioctls.  Move the code that accesses userspace pages
outside the ashmem_mutex.

Bug: 9261835
Change-Id: If1322e981d29c889a56cdc9dfcbc6df2729a45e9
Signed-off-by: Todd Poynor <toddpoynor@google.com>
msm: kgsl: Detect and avoid malformed ioctl codes

Because we were using _IO_NR, one could construct a malformed ioctl
code that would avoid allocating memory yet go to a function that
expected that memory. Still use _IO_NR to index the array of ioctls,
but check that the full values match before jumping to the helper
function.

CRs-fixed: 385592
Orig-Change-Id: Ic0dedbaded469035bd0a2bb0f20fecb2a3045ca5
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

CVE-2012-4222:
Several integer overflows in the processing of DIAG ioctl system call
parameters allow a locally installed application to conduct denial of
service (DoS) attacks or possibly execute arbitrary code in kernel
context.
https://www.codeaurora.org/projects/security-advisories/multiple-issues-diagkgsl-system-call-handling-cve-2012-4220-cve-2012

Change-Id: Ida8c46a7fd400e7756c785d268e76a4344462a98
Merge "msm: kgsl: Detect and avoid malformed ioctl codes" into cm-11.0
Merge "ashmem: avoid deadlock between read and mmap calls" into cm-11.0