commit 72bb99cfe9c57d2044445fb34bbc95b4c0bae6f2 upstream.

In the situation that a writer fails to copy data from userspace it will reset
the write offset to the value it had before it went to sleep. This discarding
any messages written while aquiring the mutex.

Therefore the reset offset needs to be retrieved after acquiring the mutex.

Cc: Android Kernel Team <kernel-team@android.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 69acbaac303e8cb948801a9ddd0ac24e86cc4a1b upstream.

Comedi devices can do blocking read() or write() (or poll()) if an
asynchronous command has been set up, blocking for data (for read()) or
buffer space (for write()).  Various events associated with the
asynchronous command will wake up the blocked reader or writer (or
poller).  It is also possible to force the asynchronous command to
terminate by issuing a `COMEDI_CANCEL` ioctl.  That shuts down the
asynchronous command, but does not currently wake up the blocked reader
or writer (or poller).  If the blocked task could be woken up, it would
see that the command is no longer active and return.  The caller of the
`COMEDI_CANCEL` ioctl could attempt to wake up the blocked task by
sending a signal, but that's a nasty workaround.

Change `do_cancel_ioctl()` to wake up the wait queue after it returns
from `do_cancel()`.  `do_cancel()` can propagate an error return value
from the low-level comedi driver's cancel routine, but it always shuts
the command down regardless, so `do_cancel_ioctl()` can wake up he wait
queue regardless of the return value from `do_cancel()`.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4b18f08be01a7b3c7b6df497137b6e3cb28adaa3 upstream.

`do_cmd_ioctl()` is called with the comedi device's mutex locked to
process the `COMEDI_CMD` ioctl to set up comedi's asynchronous command
handling on a comedi subdevice.  `comedi_read()` and `comedi_write()`
are the `read` and `write` handlers for the comedi device, but do not
lock the mutex (for performance reasons, as some things can hold the
mutex for quite a long time).

There is a race condition if `comedi_read()` or `comedi_write()` is
running at the same time and for the same file object and comedi
subdevice as `do_cmd_ioctl()`.  `do_cmd_ioctl()` sets the subdevice's
`busy` pointer to the file object way before it sets the `SRF_RUNNING` flag
in the subdevice's `runflags` member.  `comedi_read() and
`comedi_write()` check the subdevice's `busy` pointer is pointing to the
current file object, then if the `SRF_RUNNING` flag is not set, will call
`do_become_nonbusy()` to shut down the asyncronous command.  Bad things
can happen if the asynchronous command is being shutdown and set up at
the same time.

To prevent the race, don't set the `busy` pointer until
after the `SRF_RUNNING` flag has been set.  Also, make sure the mutex is
held in `comedi_read()` and `comedi_write()` while calling
`do_become_nonbusy()` in order to avoid moving the race condition to a
point within that function.

Change some error handling `goto cleanup` statements in `do_cmd_ioctl()`
to simple `return -ERRFOO` statements as a result of changing when the
`busy` pointer is set.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 86f0b5b86d142b9323432fef078a6cf0fb5dda74 upstream.

snd_pcm_stop() must be called in the PCM substream lock context.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull media fixes from Mauro Carvalho Chehab:
 "Series of fixes for 3.10.  There are some usual driver fixes (mostly
  on s5p/exynos playform drivers), plus some fixes at V4L2 core"

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (40 commits)
  [media] soc_camera: error dev remove and v4l2 call
  [media] sh_veu: fix the buffer size calculation
  [media] sh_veu: keep power supply until the m2m context is released
  [media] sh_veu: invoke v4l2_m2m_job_finish() even if a job has been aborted
  [media] v4l2-ioctl: don't print the clips list
  [media] v4l2-ctrls: V4L2_CTRL_CLASS_FM_RX controls are also valid radio controls
  [media] cx88: fix NULL pointer dereference
  [media] DocBook/media/v4l: update version number
  [media] exynos4-is: Remove "sysreg" clock handling
  [media] exynos4-is: Fix reported colorspace at FIMC-IS-ISP subdev
  [media] exynos4-is: Ensure fimc-is clocks are not enabled until properly configured
  [media] exynos4-is: Prevent NULL pointer dereference when firmware isn't loaded
  [media] s5p-mfc: Add NULL check for allocated buffer
  [media] s5p-mfc: added missing end-of-lines in debug messages
  [media] s5p-mfc: v4l2 controls setup routine moved to initialization code
  [media] s5p-mfc: separate encoder parameters for h264 and mpeg4
  [media] s5p-mfc: Remove special clock usage in driver
  [media] s5p-mfc: Remove unused s5p_mfc_get_decoded_status_v6() function
  [media] v4l2: mem2mem: save irq flags correctly
  [media] coda: v4l2-compliance fix: add VIDIOC_CREATE_BUFS support
  ...

Pull staging driver fixes from Greg Kroah-Hartman:
 "Here are some staging and IIO driver fixes for the 3.10-rc5 release.

  All of them are tiny, and fix a number of reported issues (build and
  runtime)"

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

* tag 'staging-3.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  iio:inkern: Fix typo/bug in convert raw to processed.
  iio: frequency: ad4350: Fix bug / typo in mask
  inkern: iio_device_put after incorrect return/goto
  staging: alarm-dev: information leak in alarm_compat_ioctl()
  iio:callback buffer: free the scan_mask
  staging: alarm-dev: information leak in alarm_ioctl()
  drivers: staging: zcache: fix compile error
  staging: dwc2: fix value of dma_mask

If we pass an invalid clock type then "ts" is never set.  We need to
check for errors earlier, otherwise we end up passing uninitialized
stack data to userspace.

Reported-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Smatch complains that if we pass an invalid clock type then "ts" is
never set.  We need to check for errors earlier, otherwise we end up
passing uninitialized stack data to userspace.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix below compile error:
drivers/built-in.o: In function `zcache_pampd_free':
>> zcache-main.c:(.text+0xb1c8a): undefined reference to `ramster_pampd_free'
>> zcache-main.c:(.text+0xb1cbc): undefined reference to `ramster_count_foreign_pages'
drivers/built-in.o: In function `zcache_pampd_get_data_and_free':
>> zcache-main.c:(.text+0xb1f05): undefined reference to `ramster_count_foreign_pages'
drivers/built-in.o: In function `zcache_cpu_notifier':
>> zcache-main.c:(.text+0xb228d): undefined reference to `ramster_cpu_up'
>> zcache-main.c:(.text+0xb2339): undefined reference to `ramster_cpu_down'
drivers/built-in.o: In function `zcache_pampd_create':
>> (.text+0xb26ce): undefined reference to `ramster_count_foreign_pages'
drivers/built-in.o: In function `zcache_pampd_create':
>> (.text+0xb27ef): undefined reference to `ramster_count_foreign_pages'
drivers/built-in.o: In function `zcache_put_page':
>> (.text+0xb299f): undefined reference to `ramster_do_preload_flnode'
drivers/built-in.o: In function `zcache_flush_page':
>> (.text+0xb2ea3): undefined reference to `ramster_do_preload_flnode'
drivers/built-in.o: In function `zcache_flush_object':
>> (.text+0xb307c): undefined reference to `ramster_do_preload_flnode'
drivers/built-in.o: In function `zcache_init':
>> zcache-main.c:(.text+0xb3629): undefined reference to `ramster_register_pamops'
>> zcache-main.c:(.text+0xb3868): undefined reference to `ramster_init'
>> drivers/built-in.o:(.rodata+0x15058): undefined reference to `ramster_foreign_eph_pages'
>> drivers/built-in.o:(.rodata+0x15078): undefined reference to `ramster_foreign_pers_pages'

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Bob Liu <bob.liu@oracle.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Passing the value DMA_BIT_MASK(31) to dma_set_mask() causes the
dwc2-pci driver to sometimes fail (cannot enumerate the connected
device). Change it to DMA_BIT_MASK(32) instead, which is a more
sensible value anyway.

Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>