sync: signal pt before sync_timeline object gets destroyed

There is a race condition

Assume we have *one* sync_fence object, with *one* sync_pt
which belongs to *one* sync_timeline, given this condition,
sync_timeline->kref will have two counts, one for sync_timeline
(implicit) and another for sync_pt.

Assume following is the situation on CPU

Theead-1 : (Thread which calls sync_timeline_destroy())
  -> (some function calls)
   -> sync_timeline_destory()
    -> sync_timeline_signal() (CPU is inside this
function after putting reference to sync_timeline)

At this time Thread-2 comes and does following

Thread-2 : (fclose on fence fd)
> sync_fence_release() -> because of fclose() on fence object
 -> sync_fence_free()
  -> sync_pt_free()
   -> kref_put(&pt->parent->kref, sync_timeline_free);
    -> sync_timeline_free() (CPU is inside this because
this time kref will be zero after _put)

Thread-2 will free sync_timeline object before Thread-1
has finished its work inside sync_timeline_signal.

With this change we signals all sync_pt before putting
reference to sync_timeline object.

Change-Id: I66d7359cc5dca0352fda49f81953028e98b95993
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
ASoC: msm:Initialize local variable output_meta_data.

The local variable output_meta_data is not initialized if
prtd->meta_data_mode is false. It can lead unexpected behavior

Change-Id: I64f87342b02a3fb7b5c09c376f72ef7e0ca1efd6
CRs-Fixed:548200
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>
msm_fb:hdmi:Security checks for EDID block read.

Ensure data is read from within limits of buffer
for data block collection/video data block in EDID.
This prevents EDID data from being read past the end
of data block collection offset.
Ensure the 3D formats are only read from the proper
buffer region for vendor specific data block. This
prevents illegal data being read from the EDID data.

Change-Id: Id411f7e93aaf9293341a87cb4ca5431005e2bb18
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
Signed-off-by: Neti, Ravi Kumar <ravineti@codeaurora.org>
msm-camera: Fix to prevent kernel heap buffer overflow in actuator

Fix to prevent kernel heap buffer overflow allows user
controlled data to be written to the heap via the
msm_camera actuator IOCTLs

Change-Id: I5d511e8c1aa2f76f4209a6712a58d8757bc53367
CRs-Fixed: 545979
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm:camera: Bounds and validity check for params

Check the range and validity of parameters before accessing.

CRs-fixed: 550607, 554434, 554436

Change-Id: I2d6aec4f9cb9385789c0df6a2c4abefe9e87539f
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
msm:camera: Initialize a structure before usage

Initialize a structure using memset such that it is
populated properly before returning to userspace.

CRs-fixed: 550567
Change-Id: I2b3c78cd2b309de13acf2811fcc16b8bc04fa052
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
Merge "ASoC: msm:Initialize local variable output_meta_data."
msm-camera: fix to prevent untrusted pointer to lead DoS in Actuator

fix to prevent untrusted userspace pointer in actuator kernel
driver to lead DoS in actuator driver

Change-Id: If9dcba3d4871ca98f78542f8bfb1623a02032f0d
CRs-Fixed: 547231
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
Merge "sync: signal pt before sync_timeline object gets destroyed"
Merge "msm_fb:hdmi:Security checks for EDID block read."
msm:camera: Initialize the structure before to pass userspace.

Initialize the structure by memset so that value will pass to
proper to usersapce.

CRs-fixed: 554845
Change-Id: I4adf4bf1bb6e45e16f5fd2e26a74232e6ee7f8bd
Signed-off-by:Vivek Singh<vising@codeaurora.org>
msm: msm_fb: Map RGB layers to the max possible size.

IOMMU Page Faults are observed on RGB layers during stability
because MDP is trying to fetch out of mapped area of the buffer.
This patch avoids the issue by overmapping the RGB layers to the
max possible RGB buffer size.

Change-Id: Idc7ac9acad70e351acac5dba2ae43b8731e84d35
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
Signed-off-by: Sangani Suryanarayana Raju <csuryan@codeaurora.org>
Merge "msm: msm_fb: Map RGB layers to the max possible size."
msm:camera: Copy data from user to kernel space before access

This would avoid any invalid access of data.

CRs-fixed: 550608
Change-Id: I30993a9bc731227e72f3be34874505f01357f04d
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm-camera : Fix for Unbounded copy in msm_camera_v4l2_private_control

Fix for the Unbounded copy in msm_camera_v4l2_private_control function

CRs-Fixed: 545962
Change-Id: I36b3cb3193610a090f3fc87273bc71317e7029bd
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
Merge "msm:camera: Initialize the structure before to pass userspace."
Merge "msm-camera: Fix to prevent kernel heap buffer overflow in actuator"
Merge "msm:camera: Bounds and validity check for params"
Merge "msm-camera : Fix for Unbounded copy in msm_camera_v4l2_private_control"
Merge "msm:camera: Copy data from user to kernel space before access"