ALSA: core: Fix crash by avoiding appl_ptr crossing 32-bit boundary

Incase of A2DP usecase using proxy driver, appl_ptr has
boundary value as 0x60000000 frames in sw_params for stereo(2 channels).
When this value crosses 0x40000000, then userspace calculating
appl_ptr at bytes results in crossing 32-bit value 0x100000000,
and points to 0x0 offset which can result in crash or pop.
To avoid above scenario, set the sw_params appl_ptr boundary value
within 0x40000000. Added proper check at sw_params update
to set this value correctly within 32-bit boundary(frames).

Change-Id: I537a04156699d90549a0a468ae19539ecd552d3b
CRs-Fixed: 483203
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
qseecom: Add NULL pointer check in qseecom_ioctl

NULL pointer check is added to the qseecom driver in qseecom_ioctl,
which is required to validate the data pointer before executing any
other code from ioctl's.

Change-Id: I6fecf13769b4d7e94eebd4dc075a5ece79b18e1b
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
qseecom: fix memory leak in qseecom_start_app()

Fixes the incorrect reurn path in qseecom_start_app() function with
proper clean-up. With out this patch, there are lot of memory leaks.

Change-Id: Ib9f7b08dd86952c1b0a1572d9a7d81517c3b2189
CRs-fixed: 509111
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
qseecom: Fix error handling path in receive_req()

This patch fixes the error handling path in receive_req() function
called from userspace. Issue seen if user is calling the receive_req
function without calling the listener registration. qseecom_find_svc()
should return NULL if there are no services found.

Change-Id: Id51d8f48d7266b5acbc845f7b9ac0068d16b1ede
CRs-fixed: 496927
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
qseecom: Fix QSEECOM_IOCTL_UNLOAD_EXTERNAL_ELF_REQ kernel crash

Fixes the kernel crash occuring with IOCTL_UNLOAD_EXTERNAL_ELF_REQ
ioctl by adding unavailable client type to qseecom_client_handle_type
enum, which is required in the driver during qseecom_release().

Change-Id: I73b817255149ffc4a808852feb2954a0ba3c317f
CRs-fixed: 508253
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
mmc: core: remove the polling for BKOPS completion

The original intention of polling for BKOPS completion was to give
the card enough time to perform the BKOPS before it is runtime suspended.
But as the BKOPS completion polling was happening in a different
context, it may race with card runtime/platform suspend which is quite
difficult to fix. So instead of BKOPS polling, let the runtime suspend
get deferred if the BKOPS is running on the card. Also if BKOPS is running
when platform suspend is triggered, stop the BKOPS before suspending the
card.

CRs-Fixed: 489523

Change-Id: Ib95c45ba2556b30d706f8d393f6f21fcc20e23f3
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
mmc: core: expose HPI capability to SWITCH commands

Some of the time consuming operations such as BKOPS, SANITIZE, CACHE
flush/off use the SWITCH command (CMD6) but as these operations don't
have card specification defined timeout for completion, we may see
timeout errors if card doesn't complete the operation within the SW
defined timeout. If SW defined timeout is hit, above operations are
considered to be failed and no real recovery mechanism is implemented
after timeout.

Most of the above operations (BKOPS/SANITIZE/CACHE flush/off) can be
interrupted by sending the HPI (High Priority Interrupt) command to card
if they taking longer than expected. This change adds the base support
which will these operations to be HPIed after timeout.

Change-Id: I67e889e94df1aa4f06a7e4030c97d543dfff7307
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
mmc: msm_sdcc: change the bkops_busy flag check to ignore_timeout

MMC core layer have made the "bkops_busy" flag in the mmc_command
structure absolute, use "ignore_timeout" instead.

Change-Id: I340aeb3193b43aa32034a3583e15be8261207525
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
mmc: core: remove bkops_busy flag from the mmc_command structure

As "bkops_busy" flag is no longer used, remove it from the mmc_command
structure.

Change-Id: I739030e90d37ce40a484a072e604a0e398b2872e
Signed-off-by: Subhash Jadavani <subhashj@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
mmc: core: handle flush requests timeout

According to the eMMC 4.5 spec "Flushing a large amount of cached data may
take very unpredictably long time". Therefore the timeout for FLUSH should
be increased to prevent timeouts.

In case the timeout occurs HPI issued.

CRs-Fixed: 500874

Change-Id: I7a9195056481e6a8756c2c804ee20739bd461734
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>
msm-camera: Added the  NULL check in gemini driver.

Adding NULL check for ionhandle and y_off in gemini driver files.

CRs-Fixed: 504159

Change-Id: I6d20298183bec0c3c2c16088a936ac6f7d307da4
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm: camera: prevent invalid access through mmap

Disable access to invalid addresses through mmap.
Add appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

Change-Id: Ie053d9d8efe951b88f28b020dd9c2356e54723a7
CRs-Fixed: 475794
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
ASoC: wcd9310: Fix DMIC current leakage after disable

Observed after disabling DMIC path, some DMICs observe
power leakage of around 2mA and affecting power numbers.
This happens due to the DMIC clock runs off MCLK. 2 Stage
of Dividers are used to  generate various DMIC Clock Freq.
Since the SW Enable/Disabling is async to MCLK, the divider
will either hold the last stage 0 or 1.
Manually force the digital mic clock pin to GPIO mode from
functional mode through the TLMM mux option and force the value
of DMIC voltage to 0V. This will avoid any current leakage.

CRs-Fixed: 504468
Change-Id: I720fadda77b59454feb1a64d0c4951a6c09de66c
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Merge "msm: camera: prevent invalid access through mmap"
msm: kgsl: Configure FT behaviour from sysfs instead of debugfs

FT behaviour is changed to be configured from sysfs
instead of debugfs. Sysfs control gives us the advantage
of configuring FT at bootup and also across bootups.
Persistant configuration across bootups helps
testing by configuring FT once and testing the FT
config across bootups.

Conflicts:

	drivers/gpu/msm/adreno.h
	drivers/gpu/msm/adreno_debugfs.c

Change-Id: Ia3378f214371a6a4b9f205f9f884976f58585971
Signed-off-by: Tarun Karra <tkarra@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
sock_diag: Fix out-of-bounds access to sock_diag_handlers[]

Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.

CRs-fixed: 519050
Change-Id: I1466c4f56f3f4df90cf8a1ae17afa80c89b813e8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit: 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS

The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.

This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.

[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]

CRs-Fixed: 504011
Change-Id: I3818045a136fcdf72deb1371b132e090fd7ed643
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 8404663f81d212918ff85f493649a7991209fa04
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Merge "msm-camera: Added the  NULL check in gemini driver."
msm: kgsl: Do not try to resume the device from INIT state

If the device is still in INIT state there are no open instances
of it running.  Resume calls should be no-ops.  Do not attempt
to start the device at this point.

Change-Id: I1cb6d60581b0b5b0a2ab1b13418adc4ae3983c5e
Signed-off-by: Lucille Sylvester <lsylvest@codeaurora.org>
Merge "ALSA: core: Fix crash by avoiding appl_ptr crossing 32-bit boundary"