sock_diag: Fix out-of-bounds access to sock_diag_handlers[]

Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.

CRs-fixed: 519050
Change-Id: I1466c4f56f3f4df90cf8a1ae17afa80c89b813e8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit: 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
msm: hdmi-cec: bounds check cec frame size

Ensure that the frame size for the HDMI-CEC message
frame size doesn't exceed the maximum size when
reading message from userspace through sysfs interface.
This avoids potential overflow in cec send msg routine.

Change-Id: I09eb8f7a6dee64be2b504c6448b49e1da902aa47
CRs-Fixed: 520140
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
msm: audio: qdsp6v2:  Check return code from audio_aio_open()

When audio_aio_open() is triggered in blocking fashion, it  frees audio
resouces and returns error code. In the current implementation,  callers
did not check the error code which can lead to dereference to freed
resources and cause system crash.  Update the callers to check return
code and then return error back to application to avoid the issue. In
the meanwhile, update the audio_aio_open not to free memory for caller
and leave the caller to free the memory in error condition.

Change-Id: If3bc82f1704ff7cfa0814072eba871d8deb0fd54
CRs-fixed: 436653
Signed-off-by: Kuirong Wang <kuirongw@codeaurora.org>
perf: Treat attr.config as u64 in perf_swevent_init()

Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Patch-mainline: linux-kernel @ 04/13/13, 19:49
Signed-off-by: Deepak Katragadda <dkatraga@codeaurora.com>
Merge "msm: audio: qdsp6v2:  Check return code from audio_aio_open()"
Merge "perf: Treat attr.config as u64 in perf_swevent_init()"
msm-camera: Bound check num_cid from userspace in csid driver

Upper and lower bound checks are enforced for num_cid
which is passed from userspace with lower as 1 and
max of 16.

Change-Id: I69a405995d2f53c3a0b0a72b50460bebfdf38442
CRs-Fixed:511358
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm: vidc: Amend error check conditions on ION APIs

Amend error check conditions appropriately to return
properly from video applications in case of ION API
failures.

Change-Id: I7256ebe6abb0b8d4c5bc1707eff88b6b4e2d35ef
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
Merge "msm: vidc: Amend error check conditions on ION APIs"
Merge "msm: hdmi-cec: bounds check cec frame size"
msm-camera: Fix various small issues in Actuator driver

Bound check and validate userspace parameters direction,
number of steps and direction sign. Also fix possible
memory leak in certain error cases.

Change-Id: I05a3f63583845851df36b122f2079d345657cb99
CRs-Fixed: 511349
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
Merge "msm-camera: Bound check num_cid from userspace in csid driver"
Merge "msm-camera: Fix various small issues in Actuator driver"
msm: vidc: Validate input data before processing

User controlled data needs to be validated before
processing, otherwise it may corrupt existing data
and other programming variables which may further
lead to crash in kernel space.
This change validates user specified buffer's data,
such as offset and data length, before performing
any operations in kernel.

Change-Id: I841cacd79368046964eec311750b09286e01af98
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
Merge "msm: vidc: Validate input data before processing"
arm: Move the secondary_startup to __CPUINIT section.

Because of addition 1MB alignment after head.txt section,
the secondary_startup needs to move to 1MB aligned section.

CRs-Fixed: 513919
Change-Id: I332d1e4ec95c877406c6ad3318e5f9a3c85cc10f
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
msm: Make CONFIG_STRICT_MEMORY_RWX even stricter

If CONFIG_STRICT_MEMORY_RWX was set, the first section (containing
the kernel page table and the initial code) and the section
containing the init code were both given RWX permission, which is
a potential security hole.

Pad the first section after the initial code (which will never
be executed when the MMU is on) to make the rest of the kernel
text start in the second section and make the first section RW.

Move some data which had ended up in the "init text"
section into the "init data" one, as this is RW, not RX.
Make the "init text" RX.

We will not free the section containing the "init text",
because if we do, the kernel will allocate memory for RW data there.

Change-Id: I6ca5f4e07342c374246f04a3fee18042fd47c33b
CRs-fixed: 513919
Signed-off-by: Larry Bassel <lbassel@codeaurora.org>
Merge "sock_diag: Fix out-of-bounds access to sock_diag_handlers[]"
Merge "arm: Move the secondary_startup to __CPUINIT section."
Merge "msm: Make CONFIG_STRICT_MEMORY_RWX even stricter"