ASoC: msm: qdsp6v2: Copy frame data based on frame length

Copying data based on count will result in copying
uninitialized data to userspace which can potentially
disclose sensitive data. Fix by copying data based on
frame instead.

CRs-Fixed: 552528, 552531
Change-Id: I307b285ef2aefe00b953cf650582e9ff7e03ceb1
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver

Userspace registers calibration data with acdb driver
through ioctls. Voice driver registers the calibration
data with CVD by querying acdb data from acdb driver and
copies the calibration data in apr message.

The size of the calibration data can be controlled by userspace
and can result in buffer overflow if the calibration size is
greater than the destination buffer size.
Reject acdb data if the size is greater than the size of
destination buffer.

Change-Id: I1b495390d67907afc608ed8233bf916777d38e11
CRs-fixed: 548872
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
Merge "ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver"
Merge "ASoC: msm: qdsp6v2: Copy frame data based on frame length"
msm: audio: qdsp6v2: Zero the cfg stack var

Write zeroes into the stack variable cfg to ensure
no previously written stack data is sent to
user-space.

Change-Id: Iea124d2528ed56d93e2a000027ff8bc30414d3fd
CRs-Fixed: 551574
Signed-off-by: Kenneth Westfield <kwestfie@codeaurora.org>
msm: msm_fb: Do not use ION_IOMMU_UNMAP_DELAYED flag.

Since iommu buffers will be unmapped after two newer commits
had passed, there is no need to request iommu driver to further
delay unmapping an iommu buffer.

Change-Id: I44099054114403fa7ac6a5e3c71a43d6b932f4a3
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
msm: cpufreq: Unable to handle kernel NULL pointer

In the function cpufreq_governor_dbs,( case CPUFREQ_GOV_START )
sysfs creation is under the critical section where as
(case CPUFREQ_GOV_STOP) sysfs removal is not under critical section.
If a START/STOP done frequently from user space then there is chance
of hitting the race condition with sysfs interface creation and removal.
Hence the removal of sysfs entry should happen in the criticalpath.

Change-Id: I3b0dd475e8e306b633b282ff23bd1c8195b5f45f
CRs-fixed: 564850
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
usb: gadget: u_bam: Enable zero length packet for tx transfers

Avoid packet re-transmission/drop by sending zero length packet
when usb transfer is multiple of usb endpoint max packet size.

CRs-Fixed: 494184
Change-Id: I01c9f9be41d3b64760e9bc08ec82ef8b6cc1a80f
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
msm: audio: qdsp6v2: memeset msm_audio_stats to zero

memeset msm_audio_stats to zero before copying to user space.

Change-Id: I5f47bf85e36d46f726dddae68962a3d1cd06213b
CRs-fixed: 549307
Signed-off-by: Kiran Kandi <kkandi@codeaurora.org>
Merge "msm: cpufreq: Unable to handle kernel NULL pointer"
Merge "msm: msm_fb: Do not use ION_IOMMU_UNMAP_DELAYED flag."
netfilter: xt_qtaguid: Allow tracking loopback

In the past it would always ignore interfaces with loopback addresses.
Now we just treat them like any other.
This also helps with writing tests that check for the presence
of the qtaguid module.

Change-Id: Ib54f7fcfa94e9913ab926ea78b4a99b78cb3b7b1
Signed-off-by: JP Abgrall <jpa@google.com>
Git-commit: af4d7c85bc8629c63360d5729cba0754b62c4345
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
msm: vidc: Validate userspace buffer count before using it

Validate the number of buffers count variable before
using it to avoid structure overflow error.

Change-Id: I61582c93e0f26ec6842e437134fb8a42bdbc36ff
CRs-fixed: 563654
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
msm: vidc: Validate userspace buffer count

Makesure the number of buffers count is less than
the maximum limit to avoid structure overflow errors.

Change-Id: Icf3850de36325637ae43ac95f1c8f0f63e201d31
CRs-fixed: 563694
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
Merge "netfilter: xt_qtaguid: Allow tracking loopback"
Merge "msm: vidc: Validate userspace buffer count before using it"
Merge "msm: vidc: Validate userspace buffer count"
radio: iris: Checking if driver's buffer is large enough.

Checking if driver's buffer is large enough to copy
the data from user space.

Change-Id: I7b4eed81cf77ce2973669ce18ccd95a5df397d82
CRs-fixed: 552329
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
Merge "msm: audio: qdsp6v2: Zero the cfg stack var"
msm: board: Set the max voltage level for LDO3 to 3.3V

Currently min/max voltage level for LD03 was set to 3.075V.
But some Full speed USB headsets requires higher cross over voltage.
The cross over voltage is directly proportional to the phy 3.3V
rail voltage. So modify the max voltage level of LD03 to 3.3V.

CRs-Fixed: 563496
Change-Id: I535d8d6382e708aa3bf17ed8dae832d00c52d88b
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>