sock_diag: Fix out-of-bounds access to sock_diag_handlers[]

Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.

CRs-fixed: 519050
Change-Id: I1466c4f56f3f4df90cf8a1ae17afa80c89b813e8
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit: 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
msm: msm_fb: remove mmio access through mmap

Disable access to mm io and add
appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

CRs-Fixed: 474706
Change-Id: If25166f2732433ef967e99c716440030b567aae9
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
 msm:camera: Fix overflow issue in ioctl_hw_cmds function

    'len' is of type signed int 32bit,but the assigned value
    may exceed maximum unsigned int32 range.Add overflow check
    and graceful exit if 'm'exceeds UINT32_MAX value.

Change-Id: I38f0d10a0cb44d08d0054f91044fc891c246ebd1
CRs-Fixed: 493314
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
mm-camera: Changes to remove unused code for security issue reported

Changes to remove MSM_CAM_IOCTL_SET_MEM_MAP_INFO Ioctl support.
This will avoid physical memory mapping to userspace.

Change-Id: If014e6d152786b508c8e7ee6c53631913cd4cfcf
Signed-off-by: Guruprasad Gaonkar <ggaonk@codeaurora.org>
msm_fb:hdmi:Security check for EDID 3D data parse

While parsing EDID received from TV for 3D data and other,
proper buffer overflow check is done to avoid
data overflow or overwrite.
Also, replace snprintf with scnprintf for better memory copy results.

Change-Id: Idee7b8e3e1391955998640cc64c6950dd5f99eed
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
Merge "sock_diag: Fix out-of-bounds access to sock_diag_handlers[]"
Merge "mm-camera: Changes to remove unused code for security issue reported"
Merge "msm: msm_fb: remove mmio access through mmap"
Merge " msm:camera: Fix overflow issue in ioctl_hw_cmds function"
Merge "msm_fb:hdmi:Security check for EDID 3D data parse"
apq8064: Adding a retry mechanism for apq8064 dma

Added a retry mechanism so that if there are more than
10 INTERRUPT IN URB failures,the device should disconnecte.

Change-Id: Ieb58058f193b5e89309530eb1e32e45a498c6857
Signed-off-by: Vikas Das <vdas@codeaurora.org>
Merge "apq8064: Adding a retry mechanism for apq8064 dma"