msm_seial_hs:Removing call to Spin unlock twice

During Clock_on() spin_unlock() is called twice.
This patch makes sure that spin_unlock is not
called twice

CRs Fixed: 546205
Change-Id: Id2cf3d52f94d3773de9206d22bcfa9075615902b
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
msm: audio: qdsp6v2: Zero the cfg stack var

Write zeroes into the stack variable cfg to ensure
no previously written stack data is sent to
user-space.

Change-Id: Iea124d2528ed56d93e2a000027ff8bc30414d3fd
CRs-Fixed: 551574
Signed-off-by: Kenneth Westfield <kwestfie@codeaurora.org>
msm: vidc: Use min_dpb from resource tracker in smooth streaming mode

Get min_dpb from resource tracker always if smooth streaming
mode is enabled to handle number of output buffers properly.

Change-Id: Ic46f76061f3895fda44e1d8e94198f898e5edf9b
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
radio: iris: Checking if driver's buffer is large enough.

Checking if driver's buffer is large enough to copy
the data from user space.

Change-Id: I7b4eed81cf77ce2973669ce18ccd95a5df397d82
CRs-fixed: 552329
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
msm: vidc: Initialize kernel space stack variables

This change initializes kernel space stack variables
that are passed between kernel space and user space
using ioctls.
Non initialization of these variables may lead to
leakage of memory values from the kernel stack to
user space.

Change-Id: Icb195470545ee48b55671ac09798610178e833e1
CRs-fixed: 556771,563420
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: msm_fb: Do not use ION_IOMMU_UNMAP_DELAYED flag.

Since iommu buffers will be unmapped after two newer commits
had passed, there is no need to request iommu driver to further
delay unmapping an iommu buffer.

Change-Id: I44099054114403fa7ac6a5e3c71a43d6b932f4a3
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
netfilter: xt_qtaguid: Allow tracking loopback

In the past it would always ignore interfaces with loopback addresses.
Now we just treat them like any other.
This also helps with writing tests that check for the presence
of the qtaguid module.

Change-Id: Ib54f7fcfa94e9913ab926ea78b4a99b78cb3b7b1
Signed-off-by: JP Abgrall <jpa@google.com>
Git-commit: af4d7c85bc8629c63360d5729cba0754b62c4345
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
msm: audio: qdsp6v2: memeset msm_audio_stats to zero

memeset msm_audio_stats to zero before copying to user space.

Change-Id: I5f47bf85e36d46f726dddae68962a3d1cd06213b
CRs-fixed: 549307
Signed-off-by: Kiran Kandi <kkandi@codeaurora.org>
msm: cpufreq: Unable to handle kernel NULL pointer

In the function cpufreq_governor_dbs,( case CPUFREQ_GOV_START )
sysfs creation is under the critical section where as
(case CPUFREQ_GOV_STOP) sysfs removal is not under critical section.
If a START/STOP done frequently from user space then there is chance
of hitting the race condition with sysfs interface creation and removal.
Hence the removal of sysfs entry should happen in the criticalpath.

Change-Id: I3b0dd475e8e306b633b282ff23bd1c8195b5f45f
CRs-fixed: 564850
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
Merge "msm: cpufreq: Unable to handle kernel NULL pointer"
Merge "msm: audio: qdsp6v2: Zero the cfg stack var"
Merge "msm: msm_fb: Do not use ION_IOMMU_UNMAP_DELAYED flag."
qseecom: Ensure incoming "app_name" does not corrupt the kernel stack

Printing a string with that does not have null terminated character,
would lead to overflow, as the print continues until it finds a null
terminated character.
Avoid this issue by explicitly assigning a string with null termination.

Change-Id: I9528db2ba046c514d829097d08c09540588bb1a2
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
crypto: msm: Check destination buffer write access

Use VERIFY_WRITE to check write access to destination buffers
before writing to them.

Change-Id: If9708695e85659bb25e13762c54dd50abd9577c7
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
usb: gadget: u_bam: Enable zero length packet for tx transfers

Avoid packet re-transmission/drop by sending zero length packet
when usb transfer is multiple of usb endpoint max packet size.

CRs-Fixed: 494184
Change-Id: I01c9f9be41d3b64760e9bc08ec82ef8b6cc1a80f
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
USB: OTG: Fix Full speed USB Headset issue

Some Full speed USB headsets requires higher cross over voltage. The
cross over voltage is directly proportional to the phy 3.3 rail voltage.
The current code uses [3.07 - 3.3] range for this regulator and it is
supplied with 3.075V.  To get 3.3V supply, use [3.3 - 3.3] range in
the host mode.

CRs-Fixed: 563496
Change-Id: I3d1705fd346212ecf42c4943995e43964ad14dc5
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
msm: vidc: Validate userspace buffer count before using it

Validate the number of buffers count variable before
using it to avoid structure overflow error.

Change-Id: I61582c93e0f26ec6842e437134fb8a42bdbc36ff
CRs-fixed: 563654
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
msm: vidc: Validate userspace buffer count

Makesure the number of buffers count is less than
the maximum limit to avoid structure overflow errors.

Change-Id: Icf3850de36325637ae43ac95f1c8f0f63e201d31
CRs-fixed: 563694
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
msm_serial_hs: Vote for Clocks

Using msm_hs_clock_vote and msm_hs_clock_unvote APIs
to enable/disable the clocks
Client can explicitly turn off the clocks while BT
is in progress without notifying to tty layer,then
TTY layer tries to access UART resulting in
un-clocked register access.As there is no notification
to TTY layer UART implicitly turns Clock ON

CRs-Fixed: 546219
Change-Id: I7a7a20992e66c562fdc1a130ced0b0973dd4dec5
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
qseecom: Validate the incoming length from user space

Check if there is no integer overflow before using req_len and
resp_len (received from user space). If an overflow is detected
then exit the operation.

Change-Id: I0459a6992bb3b280db42be63a275c55fa6105b1c
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>