msm: vidc: Check validity of userspace address

Before writing to a userspace address, verification
of the validity of user space address is required.

Change-Id: I9141e44a6c11aaf3f4d57c08bb0dd26a7b214f34
CRs-fixed: 556356
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
Merge "msm: vidc: Check validity of userspace address" into cm-11.0
msm: vidc: Validate userspace buffer count before using it

Validate the number of buffers count variable before
using it to avoid structure overflow error.

Change-Id: I61582c93e0f26ec6842e437134fb8a42bdbc36ff
CRs-fixed: 563654
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
msm: vidc: Validate userspace buffer count

Makesure the number of buffers count is less than
the maximum limit to avoid structure overflow errors.

Change-Id: Icf3850de36325637ae43ac95f1c8f0f63e201d31
CRs-fixed: 563694
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
fs: Add exFAT file system

Change-Id: I7b611a7290e13b382597b34e68f05c78e19c4895
Input: Propagate hardware event timestamp to evdev.

Convey hardware timestamp associated with the current event packet.
The use of these event codes by hardware drivers is optional.
Used to reduce jitter and improve velocity tracking in ABS_MT devices.

Change-Id: I89f3a958944f6a2979964ee372e61bad448061b6
Signed-off-by: Sasha Levitskiy <sanek@google.com>
net-fixes: flow_dissector: prevent an infinite loop (CVE-2013-4348)

Jason Wang found that a malicious packet could make skb_flow_dissect()
loop forever. We must check that IP header has a valid ihl to avoid
this loop. It involves IPIP encapsulation and ihl = 0 to trigger.

Given this bug is critical, I cooked a patch before having
a fix in upstream kernel.

Tested:

 Compiled/booted
 Ran some tests on bnx2x and explicitely disabled hardware provided rxhash
 ethtool -K eth1 rxhash off
 ethtool -K eth2 rxhash off

Google-Bug-Id: 11465355
Effort: net-fixes
Change-Id: I813e4dc48cecb05f8edfa218304e1f13fd764323
Soc: msm: Synchronize access to LPA stream

-Synchronize hw_ptr, appl_ptr access between the LPA
  driver and event handler and the ALSA core framework.

 -ported change from compressed driver
  change id I118bfdf4a866cde05d9ebcd21f756da209b69cc5

CRs-Fixed: 511481

Signed-off-by: Preetam Singh Ranawat <apranawat@codeaurora.org>
Change-Id: I0fe63d8fa4a5372b6c231a5ee44532140cce1301
msm: Remove all references to CONFIG_ANDROID_PMEM

CONFIG_ANDROID_PMEM is completely deprecated. Remove all
references to it.

Change-Id: Ie1f2b08094fffdf308025d43bf4c8c164e52340b
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
video: msm: Increase video encoding output buffer size

When bistream buffer size is half of YUV buffer size, video core
may be put into a bad state where output buffers are not returned
back to user space. Increasing the output buffer size solves the issue.

Change-Id: Ie30ec084a764717526c74fc3f89d2684c7020f09
Signed-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>
sync: Fix a race condition between release_obj and print_obj

Before this change, a timeline would only be removed from the timeline
list *after* the sync driver had its release_obj() called. However, the
driver's release_obj() may free resources needed by print_obj().

Although the timeline list is locked when print_obj() is called, it is
not locked when release_obj() is called. If one CPU was in print_obj()
when another was in release_obj(), the print_obj() may make unsafe
accesses.

It is not actually necessary to hold the timeline list lock when calling
release_obj() if the call is made after the timeline is unlinked from
the list, since there is no possibility another thread could be in --
or enter -- print_obj() for that timeline.

This change moves the release_obj() call to after the timeline is
unlinked, preventing the above race from occurring.

Signed-off-by: Alistair Strachan <alistair.strachan@imgtec.com>
Change-Id: I42953704c7a32382fb8529304499088665dbbd33
msm: vidc: Check validity of userspace address

Before writing to a userspace address, verification
of the validity of user space address is required.

Change-Id: I9141e44a6c11aaf3f4d57c08bb0dd26a7b214f34
CRs-fixed: 556356
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: vidc: Validate userspace buffer count before using it

Validate the number of buffers count variable before
using it to avoid structure overflow error.

Change-Id: I61582c93e0f26ec6842e437134fb8a42bdbc36ff
CRs-fixed: 563654
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
Merge remote-tracking branch 'cm/cm-11.0' into cm-11.0