Driver is setting notify request pointer to NULL in order
to prevent re-queueing of notification request until it is
completed. This results into NULL ptr dereference if ioctl
happens before driver unbind tries to free the request buffer.
Fix this issue by introduce a flag q_again to prevent re-queuing
of same request instead of setting notify request pointer to NULL.
Also add NULL check in usb_cser_free_req() and set the request
pointer to NULL after freeing it.
Change-Id: Id431f911d3bdebfeedd0a5c1e36218ce7467ba67
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
The overlay zorder values copied from user space are used
as index in left_lm_zo_cnt and right_lm_zo_cnt. This fix
will validate the overlay zorder value copied from user
space to not go beyond MDSS_MDP_MAX_STAGE, thus preventing
any arbitrary increments in kernel memory.
CRs-Fixed: 1049232
Change-Id: Ie8e65ce9f58cb357204bfa4c6a6e0fccec82d5ba
Signed-off-by: Shalini Krishnamoorthi <shakri@codeaurora.org>
Store the avr vtotal information computed from the initial timing
information and use it to restore the register values to avoid
flickering issues during suspend/resume usecase.
CRs-Fixed: 1056610
Change-Id: I8c7d27a062b90a3f200904f0ba20fbdb0bb32d70
Signed-off-by: Ramkumar Radhakrishnan <ramkumar@codeaurora.org>
RFC 6864 states that the IPv4 ID field MUST NOT be used for purposes other
than fragmentation and reassembly. Currently we are looking at this field
as a way of identifying what frames can be aggregated and which cannot for
GRO. While this is valid for frames that do not have DF set, it is invalid
to do so if the bit is set.
In addition we were generating IPv4 ID collisions when 2 or more flows were
interleaved over the same tunnel. To prevent that we store the result of
all IP ID checks via a "|=" instead of overwriting previous values.
With this patch we support two different approaches for the IP ID field.
The first is a non-incrementing IP ID with DF bit set. In such a case we
simply won't write to the flush_id field in the GRO context block. The
other option is the legacy option in which the IP ID must increment by 1
for every packet we aggregate.
In the case of the non-incrementing IP ID we will end up losing the data
that the IP ID is fixed. However as per RFC 6864 we should be able to
write any value into the IP ID when the DF bit is set so this should cause
minimal harm.
v2: Updated patch so that we now only support one of two options. Either
the IP ID is fixed with DF bit set, or the IP ID is incrementing. That
allows us to support the fixed ID case as occurs with IPv6 to IPv4
header translation and what is likely already out there for some
devices with tunnel headers.
CRs-Fixed: 1017614
Change-Id: I01065135889697dd8512ced09b8e1939e0fb645b
Signed-off-by: Alexander Duyck <aduyck@mirantis.com>
Patch-mainline: netdev @ April 4, 2016, 4:31 p.m
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
This reverts commit 9d6fd2c3e9 ("Merge remote-tracking branch
'msm-4.4/tmp-510d0a3f' into msm-4.4"), because it breaks the
dump parsing tools due to kernel can be loaded anywhere in the memory
now and not fixed at linear mapping.
Change-Id: Id416f0a249d803442847d09ac47781147b0d0ee6
Signed-off-by: Trilok Soni <tsoni@codeaurora.org>
Add support for adjusting volume when DSD (Direct Stream
Digital) audio playback is in progress.
Change-Id: Ica51d40911d16059e8af21c60794b35c68bb695d
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
