Merge branch 'android-3.18' of https://android.googlesource.com/kernel/commontracking-linaro-android-llct-llct-20150806.0

* aosp/android-3.18:
  usb: gadget: fix NULL ptr derefer while symlinking PTP func
  uid_cputime: Iterates over all the threads instead of processes.

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

Conflicts:
	drivers/misc/uid_cputime.c
	==> Refactor AOSP commit dfa582e676a0 "uid_cputime:
	Iterates over all the threads instead of processes.",
	since we already dropped AOSP's cpufreq_stats patches
	for "power/current stat per cpufreq" in mega-merge
	commit af97441aa205.

4 files changed, 26 insertions, 5 deletions

diff --git a/drivers/misc/uid_cputime.c b/drivers/misc/uid_cputime.c
index c07977913f9c..d9171d0a243e 100644
--- a/drivers/misc/uid_cputime.c
+++ b/drivers/misc/uid_cputime.c
@@ -73,7 +73,7 @@ static struct uid_entry *find_or_register_uid(uid_t uid)
 static int uid_stat_show(struct seq_file *m, void *v)
 {
 	struct uid_entry *uid_entry;
-	struct task_struct *task;
+	struct task_struct *task, *temp;
 	cputime_t utime;
 	cputime_t stime;
 	unsigned long bkt;
@@ -86,7 +86,7 @@ static int uid_stat_show(struct seq_file *m, void *v)
 	}
 
 	read_lock(&tasklist_lock);
-	for_each_process(task) {
+	do_each_thread(temp, task) {
 		uid_entry = find_or_register_uid(from_kuid_munged(
 			current_user_ns(), task_uid(task)));
 		if (!uid_entry) {
@@ -100,7 +100,7 @@ static int uid_stat_show(struct seq_file *m, void *v)
 		task_cputime_adjusted(task, &utime, &stime);
 		uid_entry->active_utime += utime;
 		uid_entry->active_stime += stime;
-	}
+	} while_each_thread(temp, task);
 	read_unlock(&tasklist_lock);
 
 	hash_for_each(hash_table, bkt, uid_entry, hash) {
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 860c30eced91..00a0fb5321a0 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -436,6 +436,11 @@ static int config_usb_cfg_link(
 	}
 
 	f = usb_get_function(fi);
+	if (f == NULL) {
+		/* Are we trying to symlink PTP without MTP function? */
+		ret = -EINVAL; /* Invalid Configuration */
+		goto out;
+	}
 	if (IS_ERR(f)) {
 		ret = PTR_ERR(f);
 		goto out;
diff --git a/drivers/usb/gadget/function/f_mtp.c b/drivers/usb/gadget/function/f_mtp.c
index 82f6b2ebaebb..03a61f8b9d48 100644
--- a/drivers/usb/gadget/function/f_mtp.c
+++ b/drivers/usb/gadget/function/f_mtp.c
@@ -1426,8 +1426,24 @@ struct usb_function *function_alloc_mtp_ptp(struct usb_function_instance *fi,
 					bool mtp_config)
 {
 	struct mtp_instance *fi_mtp = to_fi_mtp(fi);
-	struct mtp_dev *dev = fi_mtp->dev;
+	struct mtp_dev *dev;
+
+	/*
+	 * PTP piggybacks on MTP function so make sure we have
+	 * created MTP function before we associate this PTP
+	 * function with a gadget configuration.
+	 */
+	if (fi_mtp->dev == NULL) {
+		pr_err("Error: Create MTP function before linking"
+				" PTP function with a gadget configuration\n");
+		pr_err("\t1: Delete existing PTP function if any\n");
+		pr_err("\t2: Create MTP function\n");
+		pr_err("\t3: Create and symlink PTP function"
+				" with a gadget configuration\n");
+		return NULL;
+	}
 
+	dev = fi_mtp->dev;
 	dev->function.name = DRIVER_NAME;
 	dev->function.strings = mtp_strings;
 	if (mtp_config) {
diff --git a/drivers/usb/gadget/functions.c b/drivers/usb/gadget/functions.c
index b13f839e7368..389c1f3d0fee 100644
--- a/drivers/usb/gadget/functions.c
+++ b/drivers/usb/gadget/functions.c
@@ -58,7 +58,7 @@ struct usb_function *usb_get_function(struct usb_function_instance *fi)
 	struct usb_function *f;
 
 	f = fi->fd->alloc_func(fi);
-	if (IS_ERR(f))
+	if ((f == NULL) || IS_ERR(f))
 		return f;
 	f->fi = fi;
 	return f;