msm: msm_fb: remove mmio access through mmap

Disable access to mm io and add
appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

CRs-Fixed: 474706
Change-Id: If25166f2732433ef967e99c716440030b567aae9
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>

Integer overflow in range check when mapping framebuffer memory (CVE-2013-2596).
https://www.codeaurora.org/projects/security-advisories/integer-overflow-range-check-when-mapping-framebuffer-memory-cve-2013-2596
msm: kgsl: Detect and avoid malformed ioctl codes

Because we were using _IO_NR, one could construct a malformed ioctl
code that would avoid allocating memory yet go to a function that
expected that memory. Still use _IO_NR to index the array of ioctls,
but check that the full values match before jumping to the helper
function.

CRs-fixed: 385592
Change-Id: Ic0dedbaded469035bd0a2bb0f20fecb2a3045ca5
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

CVE-2012-4222:
Several integer overflows in the processing of DIAG ioctl system call
parameters allow a locally installed application to conduct denial of
service (DoS) attacks or possibly execute arbitrary code in kernel
context.
https://www.codeaurora.org/projects/security-advisories/multiple-issues-diagkgsl-system-call-handling-cve-2012-4220-cve-2012
diag: Fix various issues with IOCTLs

DIAG kernel driver interacts with user space processes using
IOCTLS. Some issues, such as potential integer over/underflow,
incorrect buffer copy etc were identified in these functions.
This change fixes them.

Change-Id: Ic1e815051ae9544c911c9a5bd0c9218c1225f6d5
CRs-Fixed: 385352, 385349
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>

Multiple issues in DIAG system call handling (CVE-2012-4220, CVE-2012-4221)
https://www.codeaurora.org/projects/security-advisories/multiple-issues-diagkgsl-system-call-handling-cve-2012-4220-cve-2012