ALSA: usb-audio: Fix the mixer control range limiting issue

- mixer_ctl_set() function is limiting the volume level
  to particular range. This results in incorrect initial
  volume setting for that device.
- In USB mixer while calculating the dBmin/dBmax values
  resolution factor is hardcoded to 256 which results in
  populating the wrong values for dBmin/dBmax.
- Fix is to use appropriate resolution factor while
  calculating the dBmin/dBmax values.

CRs-Fixed: 515012
Prev-Change-Id: I502355af66f850bb65380c27333c3341fa43a947
Signed-off-by: Deepa Madiregama <dmadireg@codeaurora.org>

Change-Id: I79c14014ad6828a802f6978b796d8a4a91c87e46
ASoC: msm: qdsp6: Fix pop noise seen with touch tone during playback

Issue: When a session is opened for playback of the touch tone and
	routed through the COPP, the PBE and IIR params are being
	reconfigured in the COPP every time a session is open.

Rootcause:Configuring the PBE/IIR in the COPP every time a session
           is open.
Fix: Configuring the PBE and IIR param in the COPP one time a session
      is open

CRs-Fixed: 541722
Prev-Change-Id: If0d1a8c6893a94186e1c6c2a75432d2f4a89f842
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>

Change-Id: If51d472b554e358f2eada257b7cebb97682683b0
ALSA: pcm: check for integer overflow during multiplication

Channel info data structure is parsed from userspace and if
user does not set the no. of channels correctly, it could lead
to security vulnerability if we don't check for overflow when the
no. of channels is multiplied with pcm bit width. Add a condition
to check for overflow during multiplication.

CRs-fixed: 537818
Prev-Change-Id: Ia3c31406dd8b7627ea704c076643c0348582da28
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>

Change-Id: I577e28017baae43f0ca49141916381c7e791a281
ASoC: msm: qdsp6v2: Copy frame data based on frame length

Copying data based on count will result in copying
uninitialized data to userspace which can potentially
disclose sensitive data. Fix by copying data based on
frame instead.

CRs-Fixed: 552528, 552531
Prev-Change-Id: I307b285ef2aefe00b953cf650582e9ff7e03ceb1
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>

Conflicts:

	sound/soc/msm/qdsp6v2/msm-pcm-voip-v2.c

Change-Id: Ie468d0ccdbd6e253af9bbc7731559856fa302e6e
ALSA: core: Fix crash by avoiding appl_ptr crossing 32-bit boundary

Incase of A2DP usecase using proxy driver, appl_ptr has
boundary value as 0x60000000 frames in sw_params for stereo(2 channels).
When this value crosses 0x40000000, then userspace calculating
appl_ptr at bytes results in crossing 32-bit value 0x100000000,
and points to 0x0 offset which can result in crash or pop.
To avoid above scenario, set the sw_params appl_ptr boundary value
within 0x40000000. Added proper check at sw_params update
to set this value correctly within 32-bit boundary(frames).

Prev-Change-Id: I537a04156699d90549a0a468ae19539ecd552d3b
CRs-Fixed: 483203
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>

Change-Id: Ife1e9debfce7cc62c88ca9587006f0e4e44a7a64
ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver

Userspace registers calibration data with acdb driver
through ioctls. Voice driver registers the calibration
data with CVD by querying acdb data from acdb driver and
copies the calibration data in apr message.

The size of the calibration data can be controlled by userspace
and can result in buffer overflow if the calibration size is
greater than the destination buffer size.
Reject acdb data if the size is greater than the size of
destination buffer.

Prev-Change-Id: I1b495390d67907afc608ed8233bf916777d38e11
CRs-fixed: 548872
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>

Conflicts:

	sound/soc/msm/qdsp6v2/q6voice.c

Change-Id: Ic50d948134a72ab416be1a46ba59e33beb04827d
add extra free kbytes tunable

Add a userspace visible knob to tell the VM to keep an extra amount
of memory free, by increasing the gap between each zone's min and
low watermarks.

This is useful for realtime applications that call system
calls and have a bound on the number of allocations that happen
in any short time period.  In this application, extra_free_kbytes
would be left at an amount equal to or larger than than the
maximum number of allocations that happen in any burst.

It may also be useful to reduce the memory use of virtual
machines (temporarily?), in a way that does not cause memory
fragmentation like ballooning does.

[ccross]
Revived for use on old kernels where no other solution exists.
The tunable will be removed on kernels that do better at avoiding
direct reclaim.

Prev-Change-Id: I765a42be8e964bfd3e2886d1ca85a29d60c3bb3e
Signed-off-by: Rik van Riel<riel@redhat.com>
Signed-off-by: Colin Cross <ccross@android.com>

Conflicts:

	mm/page_alloc.c

Change-Id: I23d3e46647605898fe34f9af27d722cb249f3353
msm: vidc: Initialize kernel space stack variables

This change initializes kernel space stack variables
that are passed between kernel space and user space
using ioctls.
Non initialization of these variables may lead to
leakage of memory values from the kernel stack to
user space.

Change-Id: Icb195470545ee48b55671ac09798610178e833e1
CRs-fixed: 556771,563420
Signed-off-by: Deepak Verma <dverma@codeaurora.org>

Conflicts:
	drivers/video/msm/vidc/common/enc/venc.c
vidc: Modify shift value for extended PAR width.

Currently extended pixel aspect ratio register shift
value for width is 15. Due to this the actual width
value returned by core is getting doubled while
sending to user space. Now correct values are returned
by modifying the shift value to 16.

CRs-fixed: 362985
Change-Id: I996bfc79b327492a791017fd5b33638f82240d76
Signed-off-by: Rajeshwar Kurapaty <rkurapat@codeaurora.org>
msm: vidc: Validate input data before processing

User controlled data needs to be validated before
processing, otherwise it may corrupt existing data
and other programming variables which may further
lead to crash in kernel space.
This change validates user specified buffer's data,
such as offset and data length, before performing
any operations in kernel.

Change-Id: Idb2a5c4c270cdbb55adfc0c22b9296b7dd359de9
CRs-fixed: 547695
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
Merge branch 'cm-11.0' into martincz