msm: display: Validate backlight and histogram data passed in

Data passed in from userspace is validated to be within
the appropriate ranges.

Change-Id: Ia8d2af2b2949e9757c50d5a6b22fcb0ef25f4a90
Signed-off-by: Sangani Suryanarayana Raju <csuryan@codeaurora.org>
msm: vidc: Initialize kernel space stack variables

This change initializes kernel space stack variables
that are passed between kernel space and user space
using ioctls.
Non initialization of these variables may lead to
leakage of memory values from the kernel stack to
user space.

Change-Id: Icb195470545ee48b55671ac09798610178e833e1
CRs-fixed: 556771,563420
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm_seial_hs:Removing call to Spin unlock twice

During Clock_on() spin_unlock() is called twice.
This patch makes sure that spin_unlock is not
called twice

CRs-Fixed: 546205
Change-Id: Id2cf3d52f94d3773de9206d22bcfa9075615902b
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
msm_serial_hs: Vote for Clocks

Using msm_hs_clock_vote and msm_hs_clock_unvote APIs
to enable/disable the clocks
Client can explicitly turn off the clocks while BT
is in progress without notifying to tty layer,then
TTY layer tries to access UART resulting in
un-clocked register access.As there is no notification
to TTY layer UART implicitly turns Clock ON

CRs-Fixed: 546219
Change-Id: Ic1f97a757305e817411e8664ea0b4604eff3c5ca
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
crypto: msm: check potential integer overflow on AEAD req length

According to the specification of AEAD, AEAD request cryptlen is
not a Fixed maximum and assoclen is also same. This could lead to
potential integer overflow, thus allocating less memory. So we
need to check potential integer overflow on AEAD request length.

Change-Id: I58a0c5e1a6e890bad30f7865e96b7db46337158c
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom:  Validate inputs from user space

Validate send_cmd, send_modfd_cmd and send_mdfd_resp
input parameters: cmd and response pointers and buffer
lengths and offsets  issued to modify data.

Change-Id: I381836d08aaa48357486fbdc6a122eb5b42bfa0b
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
crypto: msm: Check destination buffer write access

Use VERIFY_WRITE to check write access to destination buffers
before writing to them.

Change-Id: If9708695e85659bb25e13762c54dd50abd9577c7
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
qseecom: Validate the incoming length from user space

Check if there is no integer overflow before using req_len and
resp_len (received from user space). If an overflow is detected
then exit the operation.

Change-Id: I0459a6992bb3b280db42be63a275c55fa6105b1c
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Change __copy_from_user to copy_from_user

__copy_from_user does not do address check, so use
copy_from_user instead.

Change-Id: I575c0f3c44b55a521c0d42828988c518c0640a29
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Ensure incoming "app_name" does not corrupt the kernel stack

Printing a string with that does not have null terminated character,
would lead to overflow, as the print continues until it finds a null
terminated character.
Avoid this issue by explicitly assigning a string with null termination.

Change-Id: I9528db2ba046c514d829097d08c09540588bb1a2
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
crypto: msm: Check for invalid byte offset field

There is potential for HEAP corruption when the
byte offset field is set to a huge value.

Change-Id: Idd851cf3ec57627aba7d8250914cd18ccdd697ec
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
crypto: msm: Fix issues related to non-zero byteoffset input

Fix buffer overflow for a non-zero byteoffset value.

Also fixes memory leak issue by adding data_len check in check_params.
One of the scenarios data_len can be less than byteoffset which results
in memory leak with huge data length, which might cause the kernel panic.

Change-Id: I3f773673219f45dad4f17499b1ee0feda2aff1f7
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
crypto: msm: Fix null pointer exception in qcrypto_count_sg()

Fixes null pointer exception in count scatter gather function. Scatter
gather list pointer become NULL if the sg pointer reaches last but one
node, which results in NULL pointer exception.

Change-Id: I634baf30074e6e53ffa22635565da54e9ae43150
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
crypto: msm: Use scnprintf() instead of snprintf()

snprintf can return more than the size of buffer, which is not
expected here, obviously. Use scnprintf instead.

Change-Id: I3b97a016df910728dfef5a0914ab8ad67c68e39c
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
Merge "crypto: msm: check potential integer overflow on AEAD req length"
Merge "qseecom:  Validate inputs from user space"
Merge "crypto: msm: Check destination buffer write access"
Merge "qseecom: Validate the incoming length from user space"
Merge "qseecom: Change __copy_from_user to copy_from_user"
Merge "qseecom: Ensure incoming "app_name" does not corrupt the kernel stack"