msm: camera: To prevent the unbounded copy

To prevent the unbounded copy in EEPROM driver
to avoid kernel memory disclosure

Change-Id: Ib7f8719351ff72720c55394fdd0fcd5e876e2c09
CRs-fixed: 553389
Signed-off-by: Cherian Deepak <dcheri@codeaurora.org>
msm: camera: prevent invalid access through mmap

Disable access to invalid addresses through mmap.
Add appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

Change-Id: Ie053d9d8efe951b88f28b020dd9c2356e54723a7
CRs-Fixed: 475794
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
msm: cci: fix for invalid error handle

fix for invalid error handle in msm cci

Change-Id: I2610b08f4eceedfbb8bd07d8027310f43b9ee6bf
Signed-off-by: Vasko Kalanoski <vaskok@codeaurora.org>
msm: actuator: fix to prevent untrusted pointer to lead DoS

fix to prevent untrusted userspace pointer in actuator kernel
driver to lead DoS

Change-Id: I1b64270deb494530d268539e7b420be5ec79b658
Signed-off-by: Vasko Kalanoski <vaskok@codeaurora.org>
msm: camera: changed imx135 sensor clock

sensor clock changed to 24MHZ to get expected frame rate

Change-Id: If52f410d08595dda0b5cca8bebcc39f9d9e51ff5
Signed-off-by: Xu Han <hanxu@quicinc.com>
Signed-off-by: Xu Han <hanxu@codeaurora.org>
msm: cpp: Attach/detach iommu device on open/close node

Change the iommu device attachement to happen on
cpp_open_node and detachment in cpp_close_node.
It decrease the power consumption when Camera is not
working.

Change-Id: I7f8d65e14af2949d9512191459d313ac4d3fff9c
Signed-off-by: Iliya Varadzhakov <ivarad@codeaurora.org>
msm: camera: Handling get buf properly when buffer queue is empty

There can be a possibility that the buffer queue is empty and
we ask for a buffer. In that case the address holding the buffer queue
structure data is not NULL but the entries of the structure are
NULL.

In such a case in addition to checking if bufq address is NULL,
when we request for a buffer, we also make sure that handle is
not NULL.

CRs-Fixed: 533384

Change-Id: I78acdc0455cd187e709722a36d9943af0444eaee
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
msm: camera: Exit gracefully while camera daemon crashes

Add camera daemon shutdown handling in all camera
sub devices to exit camera gracefully and it helps
to restart camera.

Change-Id: I39643a16f100b873275efe3a0c6184fe54e52830
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
msm: camera: increase the length of property array

Increase the length of property array as the pageen property may
be longer than 12.

Change-Id: I1b85e9b9eb01af991dd628a08ca5e334c0fdbc82
Signed-off-by: Wang Wenbin <wenbinw@codeaurora.org>
msm: camera: solve twice request MCLK GPIO for camera

In 8x26 MTP/QRD design, main/front camera sensor shares
the same MCLK GPIO, the poweron may fails in some cases
Change the process to output a error message for driver
bringup state to make sure other gpio are handled properly.

Change-Id: I48ee01f32ae5d7e02d3efe8578a747f23a6d8a71
Signed-off-by: Su Liu <suliu@codeaurora.org>
msm: camera: Fix various small issues in Actuator driver

Bound check and validate userspace parameters direction,
number of steps and direction sign. Also fix possible
memory leak in certain error cases.

CRs-Fixed: 511349
Change-Id: Icaa324468574494fb40f2de78e522090806744cb
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: camera: Fix various small issues in sensor driver

Add size check for zero the userspace arguments
before passing to kzalloc. Upper bound will be
max to uint16_t as these changes between different
sensors.

CRs-fixed: 507874
Change-Id: I13fb5740ab83c5719244d012a27d50abb26083d0
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: camera: make sure num_buf is not out of bound

V4L2 only allow 32 buffers. Check the num_buf to make sure that
user space passed value is not out of bound.

Change-Id: I662ec1eb998ed8bfb2a7f188e645410aa78c83b0
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: camera_v2: CCI release resources in case of timeout

Turn off the CCI clocks and release gpio if reset timeout error is
received in function_msm_cci_init()

Change-Id: Ib4387ce08635e0b4e6458f225bd3013557d6b5fa
Signed-off-by: Evgeniy Borisov <eborisov@codeaurora.org>
Signed-off-by: Sunil Joseph <jsunil@codeaurora.org>
msm: camera: Release session lock mutex in error case

Unlock the session lock mutex in the ack cmd delete
sequence if fails to find a cmd ack queue.

Change-Id: Ib08c4a259acbea4624fd91f4fb468de37c353b7d
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: mdss: access copy of userspace buf only

Copy buffer data from userspace and access only the
pointer to buffer in kernel memory. Copy back this data
back to user space memory once the operation is completed.
This prevents accessing user space virtual address from
driver.

Change-Id: I319bf08055cdf914803c4a35c5a607f92017d9a0
CRs-Fixed: 520129
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
msm: mdss: Make wait_for_complete calls uninterruptible

The wait_for_complete calls in the MDSS driver are associated
with an acceptable timeout value which would remove the need for
making them interruptible. Also, this prevents unwanted signal
interrupts before the call is finished.

Change-Id: If4013b0d74bc9f717c4a63d961f2a34753320e87
Signed-off-by: Sree Sesha Aravind Vadrevu <svadrevu@codeaurora.org>
mdss: Remove lock from vsync control

The lock protecting the vsync control ioctl is not needed since
the vsync control should take effect immediately and be
asynchronous to the display updates.

Change-Id: I5068246488b7fefec9e11e8422bacbe7489c827f
Signed-off-by: Naseer Ahmed <naseer@codeaurora.org>
msm: mdss: hdmi-cec: bounds check cec frame size

Ensure that the frame size for the HDMI-CEC message
frame size doesn't exceed the maximum size when
reading message from userspace through sysfs interface.
This avoids potential overflow in cec send msg routine.

Change-Id: I891f23ed70ed5a6c0e3af1f47869effa079ffac8
CRs-Fixed: 520140
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
msm: mdss: Return standard errno for error conditions

Replace ENOTSUPP with standard lib error EOPNOTSUPP in order
to update errno. Return EPERM error when VSYNC_ENABLED called
in suspend state in order to reflect the actual state of the
device. if no error returned applications would assume vsync
events are being generated when this is not true.

Change-Id: I72a7347ebecc71376884cf21b7e757f75ba9b40e
Signed-off-by: Ramkumar Radhakrishnan <ramkumar@codeaurora.org>