n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
remove unused defconfigs and add build script

Signed-off-by: Willi Ye <williye97@gmail.com>

Conflicts:
	arch/arm/configs/cyanogen_serrano_defconfig
	arch/arm/configs/msm8930_baffinvetd_defconfig
	arch/arm/configs/msm8930_biscotto_defconfig
	arch/arm/configs/msm8930_biscotto_eng_defconfig
	arch/arm/configs/msm8930_cane_defconfig
	arch/arm/configs/msm8930_crater_00_defconfig
	arch/arm/configs/msm8930_cratertd_defconfig
	arch/arm/configs/msm8930_express2_defconfig
	arch/arm/configs/msm8930_express_defconfig
	arch/arm/configs/msm8930_golden_att_defconfig
	arch/arm/configs/msm8930_golden_defconfig
	arch/arm/configs/msm8930_golden_eng_defconfig
	arch/arm/configs/msm8930_golden_vzw_defconfig
	arch/arm/configs/msm8930_higgs_defconfig
	arch/arm/configs/msm8930_higgs_eng_defconfig
	arch/arm/configs/msm8930_jasper2_defconfig
	arch/arm/configs/msm8930_jasper2_eng_defconfig
	arch/arm/configs/msm8930_jasper2_vzw_defconfig
	arch/arm/configs/msm8930_jasper2_vzw_rev02_defconfig
	arch/arm/configs/msm8930_ks02_defconfig
	arch/arm/configs/msm8930_ks02_skt_defconfig
	arch/arm/configs/msm8930_lt02-chn_defconfig
	arch/arm/configs/msm8930_lt02_att_defconfig
	arch/arm/configs/msm8930_lt02_chnctc_defconfig
	arch/arm/configs/msm8930_lt02_defconfig
	arch/arm/configs/msm8930_lt02_eng_defconfig
	arch/arm/configs/msm8930_lt02_spr_defconfig
	arch/arm/configs/msm8930_melius_00_defconfig
	arch/arm/configs/msm8930_melius_01_defconfig
	arch/arm/configs/msm8930_melius_att_defconfig
	arch/arm/configs/msm8930_melius_chncmcc_3g_defconfig
	arch/arm/configs/msm8930_melius_chnctc_3g_defconfig
	arch/arm/configs/msm8930_melius_chnopen_3g_defconfig
	arch/arm/configs/msm8930_melius_eng_defconfig
	arch/arm/configs/msm8930_melius_ktt_defconfig
	arch/arm/configs/msm8930_melius_lgt_defconfig
	arch/arm/configs/msm8930_melius_skt_defconfig
	arch/arm/configs/msm8930_melius_spr_defconfig
	arch/arm/configs/msm8930_melius_tmo_defconfig
	arch/arm/configs/msm8930_melius_usc_defconfig
	arch/arm/configs/msm8930_melius_vzw_defconfig
	arch/arm/configs/msm8930_melius_zh_lte_defconfig
	arch/arm/configs/msm8930_serrano_att_defconfig
	arch/arm/configs/msm8930_serrano_defconfig
	arch/arm/configs/msm8930_serrano_eng_defconfig
	arch/arm/configs/msm8930_serrano_spr_defconfig
	arch/arm/configs/msm8930_serrano_tmo_defconfig
	arch/arm/configs/msm8930_serrano_usa_defconfig
	arch/arm/configs/msm8930_serrano_usc_defconfig
	arch/arm/configs/msm8930_serrano_vzw_defconfig
	arch/arm/configs/msm8960-perf_defconfig
	arch/arm/configs/msm8960_defconfig
	build-all.py
fix gitignore in ramdisk

Signed-off-by: Willi Ye <williye97@gmail.com>
fix flashing

Signed-off-by: Willi Ye <williye97@gmail.com>
config dump

Signed-off-by: Willi Ye <williye97@gmail.com>
remove anykernel format (does not boot)

Signed-off-by: Willi Ye <williye97@gmail.com>
Never append '+' symbol to kernel version string.
Added optimized ARM RWSEM algorithm.

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
Signed-off-by: Francisco Franco <franciscofranco.1990@gmail.com>
Voltage Control: initial voltage control for MSM S4-Pro SOC

Signed-off-by: faux123 <reioux@gmail.com>

Change-Id: If1893429a3a25e5f2e3b02ba1bd0b9d3c60dc682
Signed-off-by: Willi Ye <williye97@gmail.com>

Conflicts:
	arch/arm/configs/gk_melius_defconfig
	arch/arm/mach-msm/acpuclock-krait.c
Voltage Control: add sysfs interface

Signed-off-by: faux123 <reioux@gmail.com>

Change-Id: I182b70ab26e63b5d01f67a73d1a2f01ccd8cac50
Voltage Control: allow for lower minimums

this allows the low CPU frequencies to take advantage of UV control

Signed-off-by: faux123 <reioux@gmail.com>

Change-Id: I36d3250d8d156d4e16a8e7b37b195a251cd525d7
Signed-off-by: Willi Ye <williye97@gmail.com>

Conflicts:
	arch/arm/mach-msm/acpuclock-krait.c
Squashed: Sound Control

Sound Control: Sound control for WCD93xx codec

Fully GPL'ed version.

Signed-off-by: faux123 <reioux@gmail.com>
Change-Id: Ifdb52388de4bf30f03c290de82da344ad81ddcc6

Sound Control: Updated for HTC One (m7)

Signed-off-by: Paul Reioux <reioux@gmail.com>

Sound Control: Added headphone poweramp controls

bump version to 2.1 to reflec this new addition

Signed-off-by: Paul Reioux <reioux@gmail.com>

sound control: modified for Samsung Galaxy S4 (GT-9505 variants)

Change-Id: I68896d867991ca2148675a7ea8393a2defda91db
Signed-off-by: faux123 <reioux@gmail.com>
Signed-off-by: Willi Ye <williye97@gmail.com>

Conflicts:
	arch/arm/configs/gk_melius_defconfig
	sound/soc/codecs/Kconfig
config dump

Signed-off-by: Willi Ye <williye97@gmail.com>
clean up ramdisk path

Signed-off-by: Willi Ye <williye97@gmail.com>
ignore boot.img

Signed-off-by: Willi Ye <williye97@gmail.com>
random: squashed commits

random: create add_device_randomness() interface

Add a new interface, add_device_randomness() for adding data to the
random pool that is likely to differ between two devices (or possibly
even per boot).  This would be things like MAC addresses or serial
numbers, or the read-out of the RTC. This does *not* add any actual
entropy to the pool, but it initializes the pool to different values
for devices that might otherwise be identical and have very little
entropy available to them (particularly common in the embedded world).

[ Modified by tytso to mix in a timestamp, since there may be some
  variability caused by the time needed to detect/configure the hardware
  in question. ]

Change-Id: I417154fbaac639a32bc282842207cd918ca18120
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org

hwrng: add randomness to system from rng sources

When bringing a new RNG source online, it seems like it would make sense
to use some of its bytes to make the system entropy pool more random,
as done with all sorts of other devices that contain per-device or
per-boot differences.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Paul Reioux <reioux@gmail.com>

Change-Id: Ia4ecd75a9a8a07129d12e268025551e017d86598

random: fix up sparse warnings

Add extern and static declarations to suppress sparse warnings

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

Change-Id: Iad1cc04ef44107f63dce306f022c75385db779de

random: make 'add_interrupt_randomness()' do something sane

We've been moving away from add_interrupt_randomness() for various
reasons: it's too expensive to do on every interrupt, and flooding the
CPU with interrupts could theoretically cause bogus floods of entropy
from a somewhat externally controllable source.

This solves both problems by limiting the actual randomness addition
to just once a second or after 64 interrupts, whicever comes first.
During that time, the interrupt cycle data is buffered up in a per-cpu
pool.  Also, we make sure the the nonblocking pool used by urandom is
initialized before we start feeding the normal input pool.  This
assures that /dev/urandom is returning unpredictable data as soon as
possible.

(Based on an original patch by Linus, but significantly modified by
tytso.)

Tested-by: Eric Wustrow <ewust@umich.edu>
Reported-by: Eric Wustrow <ewust@umich.edu>
Reported-by: Nadia Heninger <nadiah@cs.ucsd.edu>
Reported-by: Zakir Durumeric <zakir@umich.edu>
Reported-by: J. Alex Halderman <jhalderm@umich.edu>.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org

Change-Id: Ie19d85d5966d245528a47785ee531b2e9e9c4d9e

random: use lockless techniques in the interrupt path

The real-time Linux folks don't like add_interrupt_randomness() taking
a spinlock since it is called in the low-level interrupt routine.
This also allows us to reduce the overhead in the fast path, for the
random driver, which is the interrupt collection path.

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org

Change-Id: I460357c25849dc0cf2ecbc532db6b24bb3c21df6

random: use the arch-specific rng in xfer_secondary_pool

If the CPU supports a hardware random number generator, use it in
xfer_secondary_pool(), where it will significantly improve things and
where we can afford it.

Also, remove the use of the arch-specific rng in
add_timer_randomness(), since the call is significantly slower than
get_cycles(), and we're much better off using it in
xfer_secondary_pool() anyway.

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org

Change-Id: I210abac0a8f6e8fb23108de768a068d9477db797
fast charge
add cpu overclock up to 2052 MHz

Signed-off-by: Willi Ye <williye97@gmail.com>
config dump

Signed-off-by: Willi Ye <williye97@gmail.com>
sched: LOAD_FREQ (4*HZ+122) avoids loadavg Moire

From http://ripke.com/loadavg/moire but corrected for 200HZ.