msm: hdmi-cec: bounds check cec frame size

Ensure that the frame size for the HDMI-CEC message
frame size doesn't exceed the maximum size when
reading message from userspace through sysfs interface.
This avoids potential overflow in cec send msg routine.

Change-Id: I09eb8f7a6dee64be2b504c6448b49e1da902aa47
CRs-Fixed: 520140
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
msm-camera: fix to prevent untrusted pointer to lead DoS in Actuator

fix to prevent untrusted userspace pointer in actuator kernel
driver to lead DoS in actuator driver

Change-Id: If9dcba3d4871ca98f78542f8bfb1623a02032f0d
CRs-Fixed: 547231
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm:camera: Initialize a structure before usage

Initialize a structure using memset such that it is
populated properly before returning to userspace.

CRs-fixed: 550567
Change-Id: I2b3c78cd2b309de13acf2811fcc16b8bc04fa052
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
msm-camera: Fix to prevent kernel heap buffer overflow in actuator

Fix to prevent kernel heap buffer overflow allows user
controlled data to be written to the heap via the
msm_camera actuator IOCTLs
Change-Id: I5d511e8c1aa2f76f4209a6712a58d8757bc53367
CRs-Fixed: 545979
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>

Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm:camera: Bounds and validity check for params

Check the range and validity of parameters before accessing.

CRs-fixed: 550607, 554434, 554436

Change-Id: I2d6aec4f9cb9385789c0df6a2c4abefe9e87539f
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
msm:camera: Initialize the structure before to pass userspace.

Initialize the structure by memset so that value will pass to
proper to usersapce.

CRs-fixed: 554845
Change-Id: I4adf4bf1bb6e45e16f5fd2e26a74232e6ee7f8bd
Signed-off-by:Vivek Singh<vising@codeaurora.org>
msm-camera : Fix for Unbounded copy in msm_camera_v4l2_private_control

Fix for the Unbounded copy in msm_camera_v4l2_private_control function

CRs-Fixed: 545962
Change-Id: I36b3cb3193610a090f3fc87273bc71317e7029bd
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm:camera: Copy data from user to kernel space before access

This would avoid any invalid access of data.

CRs-fixed: 550608
Change-Id: I30993a9bc731227e72f3be34874505f01357f04d
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
Merge "msm:camera: Initialize the structure before to pass userspace."
Merge "msm: hdmi-cec: bounds check cec frame size"
Merge "msm:camera: Copy data from user to kernel space before access"
Merge "msm-camera : Fix for Unbounded copy in msm_camera_v4l2_private_control"
Merge "msm-camera: Fix to prevent kernel heap buffer overflow in actuator"
Merge "msm:camera: Bounds and validity check for params"
Merge "msm:camera: Initialize a structure before usage"
Merge "msm-camera: fix to prevent untrusted pointer to lead DoS in Actuator"