ALSA: pcm: check for integer overflow during multiplication

Channel info data structure is parsed from userspace and if
user does not set the no. of channels correctly, it could lead
to security vulnerability if we don't check for overflow when the
no. of channels is multiplied with pcm bit width. Add a condition
to check for overflow during multiplication.

CRs-fixed: 537818
Change-Id: Ia3c31406dd8b7627ea704c076643c0348582da28
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
msm-camera: Fix to prevent kernel heap buffer overflow in actuator

Fix to prevent kernel heap buffer overflow allows user
controlled data to be written to the heap via the
msm_camera actuator IOCTLs

Change-Id: I5d511e8c1aa2f76f4209a6712a58d8757bc53367
CRs-Fixed: 545979
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm: kgsl: enable CPU IRQ while suspending context

Make sure that CPU interrupt is enabled before calling adreno
suspend_context when moving from NAP/SLEEP to SLUMBER state.
We send commands to GPU in adreno_drawctxt_switch() which will generate
GPU interrupt. Since CPU interrupt is not enabled, adreno_idle() will
fail because pending interrupt will not be served by CPU this causes
false GPU hang.

CRs-Fixed: 547813

Change-Id: Ia4b730b8f8cda1e820f571ffb7ddb00336ca1a8c
Signed-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>
msm:camera: Initialize a structure before usage

Initialize a structure using memset such that it is
populated properly before returning to userspace.

CRs-fixed: 550567
Change-Id: I2b3c78cd2b309de13acf2811fcc16b8bc04fa052
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
EHCI: HSIC: improve port resume handling

This patch does the following to ensure that port is resumed
properly and SOF are sent with in 3 msec after the port resume
completion.

1. Use relaxed variants of readl and writel functions to access
registers in the resume critical path to avoid any delays introduced
by barriers.

2. Use ktime based checks to see if controller is started with in 3
msec after port resume is completed. These checks will catch the
cases where there is some delay between port resume and GPT timers
programming.

3. There is no good in polling for PORT_RESUME bit to be cleared.
Controller clears it after ~21 msec. Give 22 msec delay after port
resume and start the controller. Also add a ktime basec check to see
if controller is started with in 3 msec after port resume is completed.
If this timing is not met, perform the tight loop sequence again at
most 3 times.

CRs-Fixed: 553845
Change-Id: I29eab2fa0f684d91e1ac52d14faaffde1113b79b
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
msm: kgsl: Use msecs_to_jiffies for ADRENO_IDLE_TIMEOUT

This change is about to cherrypick of missing code part
from Change-Id: Ic0dedbad33630706d909931bf616bd69399f7ff1

Change-Id: I6c9766be0651e99251e1cb280f92e06e47875b4f
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
msm-camera : Fix for Unbounded copy in msm_camera_v4l2_private_control

Fix for the Unbounded copy in msm_camera_v4l2_private_control function

CRs-Fixed: 545962

Change-Id: I36b3cb3193610a090f3fc87273bc71317e7029bd
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
wlan: MC/BC Filter cleanup

Removing hdd_dynamic_mcbcfilter_t and introducing a new variable inside
hdd context configuredMcastBcastFilter which contains the current
value of MC/BC filter. By default initialized with INI value and changed
accordingly whenever MC/BC filter is set using IOCTL or ARPOffload is
being set.

Change-Id: I66e0479b40fc908ea098978a8a7f53370b1b7219
CRs-fixed: 490232
wlan: Host Offload Cleanup

Adding a central funtion to control all the offloads supported in our
driver. It can enable/disable all the offloads when called with
respective flag. Currently added ARPOffload and GTKOffload with NSOffload
pending.

Change-Id: Ia0946fc17c3cd61c178289bb2647e888a441fa9a
CRs-fixed: 490232
wlan: Add NSOffload INI Param and issue NSOffload request to FW

Addition of configure FW with NSOffload feature if driver contains IPv6
address. Issues Offload requests to FW for every IPv6 address assigned
to the interface and introduces new INI param for controlling NSOffload

Change-Id: Id9648275e5863664fdc49b0aba2bae710655e361
CRs-fixed: 490232
wlan: Enable WLAN_NS_OFFLOAD feature flag in Kbuild

Enable WLAN_NS_OFFLOAD feature flag in Kbuild

Change-Id: I3a9ee4af7fab0b35fbb59610a1b9d7010fbfb6ef
CRs-fixed: 518320
wlan: restore filter setting on resume

During suspend, the setting pHddCtx->configuredMcastBcastFilter is changed
to reflect the setting done by the sme_ConfigureSuspendInd call. If the
setting is not restored during resume, the next suspend won't configure the
right setting. Therfore restore the setting on resume.

Change-Id: Ie473ae53032a499600a8bf8d1d9ba66625a94cc0
CRs-fixed: 499812
wlan: Add more debug log for NS offload feature

Add more debug log for NS offload feature

Change-Id: Ia8094ecea443e19022ecb6b6e595f180acecaa11
CRs-fixed: 532917
wlan: Fix for Multicast filtering failure when NSoffload is enabled

Pass Multicast filter enable flag along with offload enable flag so
FW can filter out other multicast packet otherthen NS packet

Change-Id: I506b0ad7aeb80920b0f25975ee9bdbab5dc6fdae
CRs-Fixed: 540627
msm:camera: Copy data from user to kernel space before access

This would avoid any invalid access of data.

CRs-fixed: 550608

Change-Id: I30993a9bc731227e72f3be34874505f01357f04d
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
wlan : Revision 3.2.6.120

Revision 3.2.6.120

Change-Id: I1222d00763fe414bb47b888c5b6ac7100d3b42aa
wlan : wmm : Add support to clear WMM status with adapter

With implicit QoS enabled, in certain race conditions
the STA is not responding with any Tx data due to
which AP deauthentciates the STA. The reason for this
is that the WMM status with the adapter for the ACs is
not being cleared upon a previous STA initiated disconnection.
Change is made to clear the same upon application initaited
disconnection at STA end.

Change-Id: Ic5e21791d1112480ef91ddb31c00ac09cf379b93
CRs-fixed: 523041
Merge "msm:camera: Initialize a structure before usage"
Merge "msm: kgsl: Use msecs_to_jiffies for ADRENO_IDLE_TIMEOUT"
net: rmnet_usb: don't access unet after freeing

When mux is enabled, unet is accessed after freeing it in
rmnet_usb_disconnect(). Fix it by caching the variables that
are required to retrieve unet from unet_list array before
freeing the unet.

CRs-Fixed: 562671
Change-Id: Id21a99db6b3f5da05e89e17f04c01202ea996d06
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>