GitLab

Signed-off-by: Robert Rozic <r.rozic97@gmail.com>

Signed-off-by: Robert Rozic <r.rozic97@gmail.com>

There is no bound check for arguments passed
from user space to kernel space. This may cause
fatal exceptions.

Change-Id: I944e8e5d6e3b12b75df4e6cee7887075237b4411
CRs-Fixed: 546081
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>

Dereferencing a NULL pointer may cause kernel crash,
Check for NULL pointer before dereferencing

Change-Id: Ic3368d619d23c76702d95e0f69e41394e423a296
CRs-Fixed: 548404
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>

Not allowing task to be interrupted can cause
delay in response to upper layer. Allow task pending
to be interrupted when corresponding command's status
is received.

Change-Id: Ibb84673dfa92458c1ef45da12e63dd041abd0c39
CRs-Fixed: 569318
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>

Add a flag to platform private data to enable/disable gapless
playback. The platform data is updated by mixer control.
If gapless playback is disabled ignore next track and handle
partial drain as full drain. The stream is opened in gapless
mode based on the paltform data.

Change-Id: I36cea976bcb53f50069653aec4f0f8cc869f491a
Signed-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>

Conflicts:

	sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c

Every __cpufreq_set_policy starts with checking the new policy min/max has
some overlap with the current policy min/max. This works out fine until we
end up with the policy min/max being set to a range that doesn't overlap
with the user policy min/max. Once we get into this situation, the check at
the start of __cpufreq_set_policy fails and prevents us from getting out of
this state.

This only happens when one of the CPUFREQ_ADJUST/CPUFREQ_INCOMPATIBLE
notifiers called inside __cpufreq_set_policy pick a min/max outside the
range of user policy min/max.

The real intent of the check at the start of __cpufreq_set_policy is to
make sure userspace can't set user policy min > user policy max. Since
__cpufreq_set_policy always gets called only with current user policy
min/max except when the actual user space policy min/max is changed, we can
fix the issue by simply checking the new policy min/max against current
user policy min/max.

Change-Id: Iaac805825e64d7985c41fb9052bd96baacdf3d6f
Signed-off-by: Saravana Kannan <skannan@codeaurora.org>

At certain point in diag driver there can be integer underflow
thus can lead to memory leak. Added a safeguard for that.

Change-Id: I2a0304f5b9888fe12ca9ef5fbaa9a68ee4ab9c15
Crs-fixed: 556860
Signed-off-by: Katish Paran <kparan@codeaurora.org>

In mmc_block_test, the debug_fs based read function handlers write to an
arbitrary buffer which is given by any user. We add an access_ok check
to verify that the address pointed by *buffer is not in kernel space.
Only if the buffer is valid, do we continue the read handler.

Change-Id: I1413f71be13509a3b4e56b919cfbcbd9fcc9d2bd
Signed-off-by: Lee Susman <lsusman@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>

Change variable data type from signed int to unsigned int.

CRs-fixed: 556055
Change-Id: I6bb363b31d4fab26d84f89e775101c6051fe9e10
Signed-off-by: Anil kumar mamidala <amami@codeaurora.org>

Flushes the entire tlb when calling mmu_unmap to make sure there
is no race condition between unmapping and freeing the pages.

Change-Id: I911f8479a3aef2006f9df40a3419284423937542
Signed-off-by: Shrenuj Bansal <shrenujb@codeaurora.org>

If we take the 2nd retry path in ext4_expand_extra_isize_ea, we
potentionally return from the function without having freed these
allocations.  If we don't do the return, we over-write the previous
allocation pointers, so we leak either way.

Spotted with Coverity.

[ Fixed by tytso to set is and bs to NULL after freeing these
  pointers, in case in the retry loop we later end up triggering an
  error causing a jump to cleanup, at which point we could have a double
  free bug. -- Ted ]

Change-Id: I49b8ca41a6c6d44b563eb23306870258a3affd3b
Signed-off-by: Dave Jones <davej@fedoraproject.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Cc: stable@vger.kernel.org
Git-commit: 6e4ea8e33b2057b85d75175dd89b93f5e26de3bc
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>

When jbd2_journal_dirty_metadata() returns error,
__ext4_handle_dirty_metadata() stops the handle. However callers of this
function do not count with that fact and still happily used now freed
handle. This use after free can result in various issues but very likely
we oops soon.

The motivation of adding __ext4_journal_stop() into
__ext4_handle_dirty_metadata() in commit 9ea7a0df

 seems to be only to
improve error reporting. So replace __ext4_journal_stop() with
ext4_journal_abort_handle() which was there before that commit and add
WARN_ON_ONCE() to dump stack to provide useful information.

Change-Id: Ibfd59e399f4a11abc378a237e10b3741bef2a15e
Reported-by: Sage Weil <sage@inktank.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org	# 3.2+
Git-commit: 91aa11fae1cf8c2fd67be0609692ea9741cdcc43
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>

After we transfer set the EXT4_ERROR_FS bit in the file system
superblock, it's not enough to call jbd2_journal_clear_err() to clear
the error indication from journal superblock --- we need to call
jbd2_journal_update_sb_errno() as well.  Otherwise, when the root file
system is mounted read-only, the journal is replayed, and the error
indicator is transferred to the superblock --- but the s_errno field
in the jbd2 superblock is left set (since although we cleared it in
memory, we never flushed it out to disk).

This can end up confusing e2fsck.  We should make e2fsck more robust
in this case, but the kernel shouldn't be leaving things in this
confused state, either.

Change-Id: I7a7cd58880209fbd54f4ded5f2b62de492cae9e0
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@kernel.org
Git-commit: d796c52ef0b71a988364f6109aeb63d79c5b116b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>

- Client is getting unsupported codec error for set format
  sometimes after opening the video driver because driver
  was not updated with supported codecs information from
  video hardware.
- The same issue can be fixed by waiting for the driver state
  changed to CORE_INIT_DONE, which ensures the supported codecs
  information will be updated in video driver, before checking
  the supported codecs information.

CRs-fixed: 590158
Change-Id: Ia9132fdc01e4fa53533a3c9d14069d49501fa7d7
Signed-off-by: Maheshwar Ajja <majja@codeaurora.org>

Clean-up the msm camera generic buff queue when all
client closes the handle and also provide init-deinit
ioctl for cpp to open-close the buff mngr handle.

Change-Id: Ie484174e0ffaee02e85c9c9cda8ac26103aaddd0
CRs-Fixed: 582261
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>

Bus updates should be ignored if the bus is already off.  The bus
will wake at the default frequency for the active power level.

Change-Id: I63b8d1aacfe45971929f21f7c63bdd8ba16536e1
CRs-fixed: 589899
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>

The delays in the CPU_DYING notication path could result in the core
initiating the hotplug to send out CPU_DEAD notifications after
msm_pm_wait_cpu_shutdown() times out. This could result in a unknown
resets when regulator/clocks are disabled in the CPU_DEAD path. To
prevent unknown resets, wait infinitely to enter power collapse but
throw a warning after the 1ms mark.

The platform_cpu_kill() path is also executed in the reboot path when a
core tries to stop secondary cores. In these cases, platform_cpu_kill
shouldn't wait infinitely for the secondary cores to power collapse. To
circumvent this scenario, track dying cpus as a part of the hotplug
notification and skip waiting for the core to power collpase during
reboot path.

Change-Id: I6a7fbeeea0d50b5f1fc76a02a39f161b40a67b6c
Signed-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>

Recent characterization data has indicated that the ldo-delta
value should be 12.5mV for apq8084 and msm8974pro.

Set the ldo-delta to 12.5mV for them.

Change-Id: Ic300940fd253e7b1a5e9effe222a94a26b1675ca
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>

Update 2.5GHz and 2.3GHz RC1 tables to latest voltage plan.
Added PVS config version property.

Change-Id: I7344e81485246191c518f7d644c401ca1934e800
Signed-off-by: Junjie Wu <junjiew@codeaurora.org>

The driver was assuming the color format and resolution
of the overlay to be the same as frame buffer.  This
causes page fault and corruption if the client is using
a different color format or resolution.   The change is
to re-configure the dma pipe if the overlay configuration
is different from the default.

Change-Id: Ic7558811a3015a416b2428fb0d626bf13663e528
Signed-off-by: Xiaoming Zhou <zhoux@codeaurora.org>