msm: audio: qdsp6v2: Add size safety check to ACDB driver

Check that the size sent by userspace is not larger
then the internal amount allowed. This protects
against overflowing the stack due to an invalid size.

Change-Id: I8230fdb00a7b57d398929e8ab0eb6587476f3db1
CRs-fixed: 470222
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
ALSA: pcm: check for integer overflow during multiplication

Channel info data structure is parsed from userspace and if
user does not set the no. of channels correctly, it could lead
to security vulnerability if we don't check for overflow when the
no. of channels is multiplied with pcm bit width. Add a condition
to check for overflow during multiplication.

CRs-fixed: 537818
Change-Id: Ia3c31406dd8b7627ea704c076643c0348582da28
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
msm: mhl: 8334: Initialize return value

Initialize the variable holding the return code to
appropriate error value so that an incorrect return
code isn't sent  to the caller.

Change-Id: I38192e5503750113de62494f3bd512819d7d8b76
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm: Remove files no longer buildable under arch/arm/mach-msm

Removed the files to reduce efforts as we move driver code out of mach-msm

Change-Id: Ic926ede69a7f4bb6ed0fbdffa7d551892886936a
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
ASoC: msm: qdsp6v2: Copy frame data based on frame length

Copying data based on count will result in copying
uninitialized data to userspace which can potentially
disclose sensitive data. Fix by copying data based on
frame instead.

CRs-Fixed: 552528, 552531
Change-Id: I307b285ef2aefe00b953cf650582e9ff7e03ceb1
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
Merge "ASoC: msm: qdsp6v2: Copy frame data based on frame length"
Merge "ALSA: pcm: check for integer overflow during multiplication"
Merge "msm: mhl: 8334: Initialize return value"
Merge "msm: Remove files no longer buildable under arch/arm/mach-msm"
msm: audio: qdsp6v2: Change acdb_mmap size variable to unsigned

The acdb_mmap fuction does a size calculation but
stores the result in an int which makes negitive
numbers possible. Changing the variable to unsigned
ensures that the size used is never out of bounds.

Change-Id: I78714044594310a4411db1f50456e1294cf6ffce
CRs-fixed: 548145
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver

Userspace registers calibration data with acdb driver
through ioctls. Voice driver registers the calibration
data with CVD by querying acdb data from acdb driver and
copies the calibration data in apr message.

The size of the calibration data can be controlled by userspace
and can result in buffer overflow if the calibration size is
greater than the destination buffer size.
Reject acdb data if the size is greater than the size of
destination buffer.

Change-Id: I1b495390d67907afc608ed8233bf916777d38e11
CRs-fixed: 548872
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
Merge "msm: audio: qdsp6v2: Change acdb_mmap size variable to unsigned"
Merge "ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver"
Merge "msm: audio: qdsp6v2: Add size safety check to ACDB driver"