Config-8960: Disable Bluez dependant modules

Since MR2 comes with Bluedroid stack, disable Bluez dependant
modules from kernel.

CRs-Fixed: 542077
Change-Id: Ie2e1ef786c45d31b6705ddf1dd02eecfff2ba365
Signed-off-by: Juffin Alex Varghese <jalex@codeaurora.org>
ASoC: wcd9304:Fix RX voice in handset call distort after reboot the device

Issue:The RX voice in handset call will distorted from handset after
      reboot the device
Root cause:This happens due enable override gain in cp_static register.

Fix:Configure the cp_static override gain as Half gain.

Change-Id: I9addb8650fad5a1169bf1afb8e63f1eac4163514
CRs-Fixed: 532155
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>
msm: mhl: 8334: Initialize return value

Initialize the variable holding the return code to
appropriate error value so that an incorrect return
code isn't sent  to the caller.

Change-Id: I38192e5503750113de62494f3bd512819d7d8b76
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
ALSA: pcm: check for integer overflow during multiplication

Channel info data structure is parsed from userspace and if
user does not set the no. of channels correctly, it could lead
to security vulnerability if we don't check for overflow when the
no. of channels is multiplied with pcm bit width. Add a condition
to check for overflow during multiplication.

CRs-fixed: 537818
Change-Id: Ia3c31406dd8b7627ea704c076643c0348582da28
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
msm-camera: Fix to prevent kernel heap buffer overflow in actuator

Fix to prevent kernel heap buffer overflow allows user
controlled data to be written to the heap via the
msm_camera actuator IOCTLs

Change-Id: I5d511e8c1aa2f76f4209a6712a58d8757bc53367
CRs-Fixed: 545979
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm-camera: fix to prevent untrusted pointer to lead DoS in Actuator

fix to prevent untrusted userspace pointer in actuator kernel
driver to lead DoS in actuator driver

Change-Id: If9dcba3d4871ca98f78542f8bfb1623a02032f0d
CRs-Fixed: 547231
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm: kgsl: enable CPU IRQ while suspending context

Make sure that CPU interrupt is enabled before calling adreno
suspend_context when moving from NAP/SLEEP to SLUMBER state.
We send commands to GPU in adreno_drawctxt_switch() which will generate
GPU interrupt. Since CPU interrupt is not enabled, adreno_idle() will
fail because pending interrupt will not be served by CPU this causes
false GPU hang.

CRs-Fixed: 547813

Change-Id: Ia4b730b8f8cda1e820f571ffb7ddb00336ca1a8c
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
msm:camera: Initialize a structure before usage

Initialize a structure using memset such that it is
populated properly before returning to userspace.

CRs-fixed: 550567
Change-Id: I2b3c78cd2b309de13acf2811fcc16b8bc04fa052
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
msm: audio: qdsp6v2: Change acdb_mmap size variable to unsigned

The acdb_mmap fuction does a size calculation but
stores the result in an int which makes negitive
numbers possible. Changing the variable to unsigned
ensures that the size used is never out of bounds.

Change-Id: I78714044594310a4411db1f50456e1294cf6ffce
CRs-fixed: 548145
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
ASoC: msm: qdsp6v2: Copy frame data based on frame length

Copying data based on count will result in copying
uninitialized data to userspace which can potentially
disclose sensitive data. Fix by copying data based on
frame instead.

CRs-Fixed: 552528, 552531
Change-Id: I307b285ef2aefe00b953cf650582e9ff7e03ceb1
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
EHCI: HSIC: improve port resume handling

This patch does the following to ensure that port is resumed
properly and SOF are sent with in 3 msec after the port resume
completion.

1. Use relaxed variants of readl and writel functions to access
registers in the resume critical path to avoid any delays introduced
by barriers.

2. Use ktime based checks to see if controller is started with in 3
msec after port resume is completed. These checks will catch the
cases where there is some delay between port resume and GPT timers
programming.

3. There is no good in polling for PORT_RESUME bit to be cleared.
Controller clears it after ~21 msec. Give 22 msec delay after port
resume and start the controller. Also add a ktime basec check to see
if controller is started with in 3 msec after port resume is completed.
If this timing is not met, perform the tight loop sequence again at
most 3 times.

CRs-Fixed: 553845
Change-Id: I29eab2fa0f684d91e1ac52d14faaffde1113b79b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
msm: kgsl: Use msecs_to_jiffies for ADRENO_IDLE_TIMEOUT

This change is about to cherrypick of missing code part
from Change-Id: Ic0dedbad33630706d909931bf616bd69399f7ff1

Change-Id: I6c9766be0651e99251e1cb280f92e06e47875b4f
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver

Userspace registers calibration data with acdb driver
through ioctls. Voice driver registers the calibration
data with CVD by querying acdb data from acdb driver and
copies the calibration data in apr message.

The size of the calibration data can be controlled by userspace
and can result in buffer overflow if the calibration size is
greater than the destination buffer size.
Reject acdb data if the size is greater than the size of
destination buffer.

Change-Id: I1b495390d67907afc608ed8233bf916777d38e11
CRs-fixed: 548872
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
msm-camera : Fix for Unbounded copy in msm_camera_v4l2_private_control

Fix for the Unbounded copy in msm_camera_v4l2_private_control function

CRs-Fixed: 545962

Change-Id: I36b3cb3193610a090f3fc87273bc71317e7029bd
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm:camera: Copy data from user to kernel space before access

This would avoid any invalid access of data.

CRs-fixed: 550608

Change-Id: I30993a9bc731227e72f3be34874505f01357f04d
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
Merge "msm:camera: Initialize a structure before usage"
Merge "msm: kgsl: Use msecs_to_jiffies for ADRENO_IDLE_TIMEOUT"
net: rmnet_usb: don't access unet after freeing

When mux is enabled, unet is accessed after freeing it in
rmnet_usb_disconnect(). Fix it by caching the variables that
are required to retrieve unet from unet_list array before
freeing the unet.

CRs-Fixed: 562671
Change-Id: Id21a99db6b3f5da05e89e17f04c01202ea996d06
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Merge "msm-camera : Fix for Unbounded copy in msm_camera_v4l2_private_control"
Merge "msm:camera: Copy data from user to kernel space before access"