n_tty: Fix n_tty_write crash when echoing in raw mode

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
qseecom: Validate pointer offset in qseecom_send_modfd_cmd

Validate cmd_req_buf pointer offset in qseecom_send_modfy_cmd, and
make sure cmd buffer address to be within shared bufffer.

Signed-off-by: Zhen Kong <zkong@codeaurora.org>

Change-Id: I431511a92ab2cccbc2daebc0cf76cc3872689a97
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: Vignesh Veeramani <quicvignes@codeaurora.org>
msm: Create shadow files under /sys/kernel/ipv4

The TCP delayed ack parameters can be configured from user space
application which runs with non-root credentials and does not have
direct write access to /proc entries. This commit creates shadow
files under /sys/kernel/ipv4 which maps to /proc/sys/net/ipv4.

CRs-Fixed: 628139
Change-Id: If9f5e8f1f5f31c39090555b7b0c40efcdf6ccd08
Signed-off-by: Ravi Joshi <ravij@codeaurora.org>
audio: Change to set the USB switch state correctly

 - Changes to set the USB switch after the stream is added and
the card is registered with the sound core.

Change-Id: I5ee4df25408f809051ac49c25662cebf283902b3
Signed-off-by: Shreyas Nagasandra Chandrasekhar <snagas@codeaurora.org>
msm: msm_fb: Handle out of order msm_fb ioctls

Handle two cases when ioctls are received when they are not expected.
 - Writeback ioctls received when writeback (FB2) is not active.
 - Writeback ioctls received in random sequence when writeback (FB2)
   is active.

Change-Id: I54982e1aef09fd9c7df9354a139ac34219017951
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
wlan: prima: Sync with kk_2.7-stable

Change-Id: Ide1bcd7655b0648b9b32c9f9048f74c3c1da823d
ksm: Provide support to use deferred timers for scanner thread

KSM thread to scan pages is getting schedule on definite timeout.
That wakes up CPU from idle state and hence may affect the power
consumption. Provide an optional support to use deferred timer
which suites low-power use-cases.

To enable deferred timers,
$ echo 1 > /sys/kernel/mm/ksm/deferred_timer

Change-Id: I07fe199f97fe1f72f9a9e1b0b757a3ac533719e8
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
wcnss: Log debug registers when receives certain notification

If powering on a subsystem during restart fails, SSR framework will send
a "powerup failure" notification to the subsystem. Add support that
WCNSS platform driver will register to listen the notifications and if
receives "powerup failure" notification, it will log the debug registers.

Change-Id: I0ae8a5ee96122d71c7a86711044f6b07e400b62c
Signed-off-by: Yue Ma <yuem@codeaurora.org>
[smihir@codeaurora.org: removed powerup failure notification for riva]
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
wcnss: add API to check if wcnss is undergoing an SSR

Wlan driver should not read registers from wcnss or
try to communicate with the chip when it is undergoing
a subsystem-restart. Added an API with the wcnss platform
driver to check if ssr is in progress, this API will be
used by the wlan driver to protect register access and
other prohibited operations.

Change-Id: Ia0d93e774af126d84dbaabf5c36a2c90fdbd58be
CRs-Fixed: 621974
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
cfg80211: fix possible circular lock on reg_regdb_search()

When call_crda() is called we kick off a witch hunt search
for the same regulatory domain on our internal regulatory
database and that work gets kicked off on a workqueue, this
is done while the cfg80211_mutex is held. If that workqueue
kicks off it will first lock reg_regdb_search_mutex and
later cfg80211_mutex but to ensure two CPUs will not contend
against cfg80211_mutex the right thing to do is to have the
reg_regdb_search() wait until the cfg80211_mutex is let go.

Change-Id: Ibb44a5325876d77f1549d3938d56d8fbd051b9ba
CRs-Fixed: 655287
Signed-off-by: Santhosh Kumar Padma <skpadma@codeaurora.org>
msm: kgsl: Setup a3xx protection in its start function

Setup the protection registers for a3xx towards the end of its
start function instead of doing it in generic ringbuffer start

Conflicts:
	drivers/gpu/msm/adreno_ringbuffer.c

Change-Id: I66df496afa5d1fdf7dea790306f5358c2098674d
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Enable protected register mode for A3XX

Turn on protected register mode for the A3XX GPU family and add 0x63
(RBBM_INT_0_MASK) to the list of protected registers.

Conflicts:
	drivers/gpu/msm/adreno.h
	drivers/gpu/msm/adreno_a3xx.c
	drivers/gpu/msm/adreno_ringbuffer.c

Change-Id: Ic0dedbad10ebfa6eb6d3d815b5aa9b6b6f0e8e35
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Protect SMMU registers from being written by the GPU

Put the SMMU register range in protected mode to shield them from
IB1/IB2 writes from userspace.

CRs-Fixed: 599971
Change-Id: Ic0dedbad8c03fc1c54ff73221231e2440d3c34dd
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Print the register that causes a protected mode error

When we get a protected mode error print out the register information
that caused the exception.

Change-Id: Ic0dedbad4f586c5715669226619b51665ef9681f
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Protect CP_STATE_DEBUG_INDEX

Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
to keep it from being written from an IB1. Doing so however opens
up a subtle "feature" in the microcode: memory read opcodes turn off
protected mode in the microcode to do the read and then turns it
back on regardless of the initial state. This is a problem if the
memory read happens while protected mode is turned off and then we
try to access a protected register which then complains and goes boom.

To account for this irregularity explicitly turn back off protected
mode in all the places where we know this will be a problem.

Conflicts:
	drivers/gpu/msm/adreno.c
	drivers/gpu/msm/adreno_a3xx.c

Change-Id: Ic0dedbad1397ca9b80132241ac006560a615e042
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Mark the IOMMU setstate memory as read only

Mark the IOMMU setstate memory as read only in the pagetable.

Change-Id: Ic0dedbadb19e499c749cd744c3e89be3bcb4c2a2
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: kgsl: Enable protected register mode for A2XX

Turn on protected register mode for the A2XX GPU family.

Change-Id: Iecf88d648c9f86faef4fa53e90c2ce81101c58fa
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm: msm_fb: set dma pan info when continuous splash is enabled.

Enable vsync_enable flag when continous splash is present. This is
needed to program Tearcheck params for command mode panels.

Change-Id: Ia704b9076628e20a308fbac6f202fa7d20f5f966
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
ASoC: qdsp6v2: fix the audio record failure

When the number of buffers are configured dynamically then
the bufcount can be different to FRAME_NUM.
Fix by modifying the check for the buffer count greater than
the FRAME_NUM.

CRs-Fixed: 653473
Change-Id: Ic0da57fd517a285880ae490e99ba632cb898bd51
Signed-off-by: Aviral Gupta <aviralg@codeaurora.org>
wlan: prima: Sync with kk_2.7-stable

Change-Id: I54ec24fe5ed4d6cb405aa6525a6afacb35a88d2a