crypto: msm: Check destination buffer write access

Use VERIFY_WRITE to check write access to destination buffers
before writing to them.

Change-Id: If9708695e85659bb25e13762c54dd50abd9577c7
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
crypto: msm: Verify source and destination data lengths

Check to confirm the sum of length of the source
and destination segments is equal to the total length
sent by client.

Change-Id: Ib10b8f792591631060135022d81f1f08c424ee66
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
crypto: msm: Validate total data length

Verify sum of all data segments equals the total data length.

Change-Id: I0fb9d856281d52c58536e77512f8cae75544d1bc
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
crypto: msm: Ensure sha_init is called for HASH operation

Validate that the sha_ctx is initialized before any SHA operation
(update, final) requests is issued by client.

Change-Id: I83ac2000d860dfef5532910a2a73cd927b68e95f
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: mdss: Account for null ctl passed to line count

Line count could be passed a null ctl structure,
which would cause a kernel panic. To prevent this,
line count will just return 0 if a null parameter
is passed.

Change-Id: I2b52533e6b67b842542de5b81be5b43fccc364dc
CRs-Fixed: 551701
Signed-off-by: Casey Piper <cpiper@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: mdss: Validate mixer/ctl are not null

mdss_mdp_wb_mixer_destroy could theoretically be
called with null mixer or ctl, which would cause
a null pointer dereference. Adding a check to
prevent this from happening.

Change-Id: I376c449daf05c8ca4ebb789d402575598ee59d86
CRs-Fixed: 551787
Signed-off-by: Casey Piper <cpiper@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: camera: To prevent the unbounded copy

To prevent the unbounded copy in EEPROM driver
to avoid kernel memory disclosure

Change-Id: Ib7f8719351ff72720c55394fdd0fcd5e876e2c09
CRs-fixed: 553389
Signed-off-by: Cherian Deepak <dcheri@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: audio: initialize the structure before sending to user space

If uninitialzied structure is passed from kernel to user space, it
may contain sensitive information that will be leaked.

Change-Id: Ie7c4568c78df8cbd1efeff559848058c2163b0b8
Signed-off-by: Fred Oh <fred@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: mdss: set writeback RGBX8888 output alpha to opaque

Even though the alpha channel on RGBX format should be ignored, even if
the pixel is picked up it should still have full alpha value so that
all pixels are shown. For this reason set the alpha value to 0xFF.

Change-Id: I2db531b1f6fb3035831195546645d58718cff87a
Signed-off-by: Adrian Salido-Moreno <adrianm@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: kgsl: fix race condition setting the event->handle

A race condition existed for setting the event->handle since the
async event can signal at any time after it has been registered.
When the event signals the reference count for the synclist and
the async callback are decremented causing the event to be freed.
The kgsl_cmdbatch_add_sync_fence function needs to take another
reference to ensure that the handle can be set before the event
is freed.

Change-Id: I0d8a02246e42dce014661d6f14c685415f1704cd
Signed-off-by: Jeff Boody <jboody@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
iommu: msm: Add timeouts for some operations

Under normal operations, accesses from the SMMU to DDR should
complete in timely manner. There may be some cases due to misconfiguration
where access to DDR will not error out but simply hang forever. This
will result in certain IOMMU accesses (hardware tablewalk and tlb
syncing) never being marked as complete. Avoid looping forever by
adding a timeout to these operations and noting when the timeout is
hit.

Change-Id: Ic0a4f04b7d0f14fc89b41e1e670d0501331fe8ad
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Ajay Dudani <adudani@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: vidc: set ctrl to request sequence header for encoder

The encoder depended on a debug variable i.e. ftb_count, to
request firmware to send sequence header. Remove this
dependency and make the request only when the encoder
client requests using the provided set ctrl.

b/11051201

Change-Id: Iac4104c33eef62da553066c736b7adc87834d2ac
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: camera2: Add support to propagate frame drop

Send ISP event in case of frame drop.

Bug: 11293776
Signed-off-by: Nagesh Subba Reddy <nageshsreddy@codeaurora.org>
Signed-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Revert "net: wireless: bcmdhd: add debug code to print packet statistics"

Change-Id: I23aefb0eecd9ca45363b91eca707c78a12d99591

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Revert "ion: add free list size to heap debug files"

This reverts commit cd462cd3b80e6264e15d5045471e9301d2b1cb3f.