rpmsg: omx: return actual user-provided bytes written in write

rpmsg: omx: return actual user-provided bytes written in write

The 'write' system call is expected to return the number of bytes
written back to userspace. The rpmsg omx driver adds a small packet
header when sending a message to the remote processor, and is
currently returning this header length as well in the driver's write
fop function. This results in the write call always returning more
bytes than what the user has requested. The header length is now
left out of the bytes returned back.

Change-Id: I7132001fbc6fb34d01913bb3c30f455626c91658
Signed-off-by: Suman Anna <s-anna@ti.com>
rpmsg: omx: copy_from_user() errors should return -EFAULT

rpmsg: omx: copy_from_user() errors should return -EFAULT

Change-Id: Ib4a2d92dd3b8afa18e60019871cfea2e6b446a4d
Signed-off-by: David Schleef <ds@ti.com>
rpmsg: omx: return ENXIO in rpmsg_omx_write

rpmsg: omx: return ENXIO in rpmsg_omx_write

The error code, ENXIO is used in rpmsg_omx driver to indicate
a terminal error on the remote processor side. This status is
maintained during the recovery of the remote processor, while
the cdev gets reinitialized/recreated.

The rpmsg_omx's write file operation is currently not returning
this error. This has been added now to have it behave in the
same way as the read file operation.

Change-Id: I61d6e6c07aa39208d913da622ed32d809c51d409
Signed-off-by: Vidhoon Viswanathan <vidhoon@ti.com>
Signed-off-by: Suman Anna <s-anna@ti.com>
rpmsg: omx: send disconnect only if omx state is connected

rpmsg: omx: send disconnect only if omx state is connected

The rpmsg_omx driver sends a disconnect message automatically when the
driver's .release is called. This should be done only if a connection
has been established, otherwise just destroy the local end point.

Change-Id: I21b84aa6d91ae0d456f49cbe958f8e64caf691d5
Signed-off-by: Miguel Vadillo <vadillo@ti.com>
rpmsg: omx: add return values to the pa to da convert function

This patch adds return values to the pa to da conversion function.
This will help in propagation of proper error codes to the calling
functions.

Change-Id: Ie547f7b7e7c51eff4b7998cbd336a61663995708
Signed-off-by: Subramaniam C.A <subramaniam.ca@ti.com>
Signed-off-by: Suman Anna <s-anna@ti.com>
rpmsg: omx: re-work buffer lookup to support contiguous NV12

SGX544 requires Y and UV to be contiguous in SGX virtual address space. This
is done by using single FD for two ion handles.

Change-Id: I33ced876905d74e6293a2c32df0612f01a23d13f
Signed-off-by: Hemant Hariyani <hemanthariyani@ti.com>
Signed-off-by: Subramaniam C.A <subramaniam.ca@ti.com>
rpmsg-omx: tiler_virt2phys called for 1D buffers

While migrating to the new PVR APIs, the changes caused
a the tiler_virt2phys to be bypassed in case it is not
a PVR buffer. This patches fixes the issue

Change-Id: I9a3353053d58a7bc0ef89012de46534fad5f4b88
Signed-off-by: Subramaniam C.A <subramaniam.ca@ti.com>
Signed-off-by: Tate Hornbeck <tate.hornbeck@ti.com>
rpmsg-omx: Use ion abstraction to get handle from PVR fd

PVRExportFDToIONHandles was being called directly by rpmsg-omx.
This is now abstracted by ion and drivers should use
omap_ion_fd_to_handles instead.

Change-Id: I2f750887a048eb3d9cd28cdc9c4b08eb3e83e31b
Signed-off-by: Hemant Hariyani <hemanthariyani@ti.com>

Conflicts:
	drivers/rpmsg/rpmsg_omx.c
rpmsg: omx: implement separate register ioctl for sgx buffers

rpmsg: omx: implement separate register ioctl for sgx buffers

This implements a new register ioctl specifically meant for sgx
buffers. rpmsg_omx clients are expected to call register ioctl
for the specific buffer type (ion or sgx) before sending a buffer
to .write for mapping. The registration allows the rpmsg_omx
driver to hold a reference to the ion buffers making up the sgx
buffer, thereby preventing the buffer(s) to be freed up from
under the remote processor.

The individual imported ion handles are expected to be passed
into the .write call.

When a client no longer expects remote processor to use the buffer,
client should call unregister ioctl. A separate unregister ioctl
for pvr buffers is not created, and the same ion unregister ioctl
is expected to be used for all the ion handles a sgx buffer is
comprised of.

Change-Id: Ib36aab90136627899e98717aeb29bfa637ec09fd
Signed-off-by: Tyler Luu <tluu@ti.com>
Signed-off-by: Suman Anna <s-anna@ti.com>

Conflicts:
	drivers/rpmsg/rpmsg_omx.c
usb: ehci: fix the host wakeup state machine.

usb: ehci: fix the host wakeup state machine.

Current code enables host clocks and disables immediately
which can have side effects if port status change is not propagated
and clocks are cut, so enable clocks if ports are suspended
in all wakeup paths either from io-pad wakeup or through
bus resume in suspend path.

Change-Id: I5a03fcf46160176289d41cda6574c0c261a13e94
Signed-off-by: Govindraj.R <govindraj.raja@ti.com>
Signed-off-by: Ruchika Kharwar <ruchika@ti.com>
Revert "rpmsg: omx: implement separate register ioctl for sgx buffers"

This reverts commit f00cc519c0d65854d0cce26e71b7b6d6fa399a08.
Revert "rpmsg-omx: Use ion abstraction to get handle from PVR fd"

This reverts commit d88a93c88541d939830ec58a02482d7cb888c581.
ext4: fix use-after-free in ext4_mb_new_blocks

commit 4e8d2139802ce4f41936a687f06c560b12115247 upstream.

ext4_mb_put_pa should hold pa->pa_lock before accessing pa->pa_count.
While ext4_mb_use_preallocated checks pa->pa_deleted first and then
increments pa->count later, ext4_mb_put_pa decrements pa->pa_count
before holding pa->pa_lock and then sets pa->pa_deleted.

* Free sequence
ext4_mb_put_pa (1):		atomic_dec_and_test pa->pa_count
ext4_mb_put_pa (2):		lock pa->pa_lock
ext4_mb_put_pa (3):			check pa->pa_deleted
ext4_mb_put_pa (4):			set pa->pa_deleted=1
ext4_mb_put_pa (5):		unlock pa->pa_lock
ext4_mb_put_pa (6):		remove pa from a list
ext4_mb_pa_callback:		free pa

* Use sequence
ext4_mb_use_preallocated (1):	iterate over preallocation
ext4_mb_use_preallocated (2):	lock pa->pa_lock
ext4_mb_use_preallocated (3):		check pa->pa_deleted
ext4_mb_use_preallocated (4):		increase pa->pa_count
ext4_mb_use_preallocated (5):	unlock pa->pa_lock
ext4_mb_release_context:	access pa

* Use-after-free sequence
[initial status]		<pa->pa_deleted = 0, pa_count = 1>
ext4_mb_use_preallocated (1):	iterate over preallocation
ext4_mb_use_preallocated (2):	lock pa->pa_lock
ext4_mb_use_preallocated (3):		check pa->pa_deleted
ext4_mb_put_pa (1):		atomic_dec_and_test pa->pa_count
[pa_count decremented]		<pa->pa_deleted = 0, pa_count = 0>
ext4_mb_use_preallocated (4):		increase pa->pa_count
[pa_count incremented]		<pa->pa_deleted = 0, pa_count = 1>
ext4_mb_use_preallocated (5):	unlock pa->pa_lock
ext4_mb_put_pa (2):		lock pa->pa_lock
ext4_mb_put_pa (3):			check pa->pa_deleted
ext4_mb_put_pa (4):			set pa->pa_deleted=1
[race condition!]		<pa->pa_deleted = 1, pa_count = 1>
ext4_mb_put_pa (5):		unlock pa->pa_lock
ext4_mb_put_pa (6):		remove pa from a list
ext4_mb_pa_callback:		free pa
ext4_mb_release_context:	access pa

AddressSanitizer has detected use-after-free in ext4_mb_new_blocks
Bug report: http://goo.gl/rG1On3

Signed-off-by: Junho Ryu <jayr@google.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ext4: check for overlapping extents in ext4_valid_extent_entries()

commit 5946d089379a35dda0e531710b48fca05446a196 upstream.

A corrupted ext4 may have out of order leaf extents, i.e.

extent: lblk 0--1023, len 1024, pblk 9217, flags: LEAF UNINIT
extent: lblk 1000--2047, len 1024, pblk 10241, flags: LEAF UNINIT
             ^^^^ overlap with previous extent

Reading such extent could hit BUG_ON() in ext4_es_cache_extent().

	BUG_ON(end < lblk);

The problem is that __read_extent_tree_block() tries to cache holes as
well but assumes 'lblk' is greater than 'prev' and passes underflowed
length to ext4_es_cache_extent(). Fix it by checking for overlapping
extents in ext4_valid_extent_entries().

I hit this when fuzz testing ext4, and am able to reproduce it by
modifying the on-disk extent by hand.

Also add the check for (ee_block + len - 1) in ext4_valid_extent() to
make sure the value is not overflow.

Ran xfstests on patched ext4 and no regression.

Cc: Lukáš Czerner <lczerner@redhat.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>