msm: audio: qdsp6v2: Zero the cfg stack var

Write zeroes into the stack variable cfg to ensure
no previously written stack data is sent to
user-space.

Change-Id: Iea124d2528ed56d93e2a000027ff8bc30414d3fd
CRs-Fixed: 551574
Signed-off-by: Kenneth Westfield <kwestfie@codeaurora.org>
ASoC: msm: qdsp6v2: Copy frame data based on frame length

Copying data based on count will result in copying
uninitialized data to userspace which can potentially
disclose sensitive data. Fix by copying data based on
frame instead.

CRs-Fixed: 552528, 552531
Change-Id: I307b285ef2aefe00b953cf650582e9ff7e03ceb1
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver

Userspace registers calibration data with acdb driver
through ioctls. Voice driver registers the calibration
data with CVD by querying acdb data from acdb driver and
copies the calibration data in apr message.

The size of the calibration data can be controlled by userspace
and can result in buffer overflow if the calibration size is
greater than the destination buffer size.
Reject acdb data if the size is greater than the size of
destination buffer.

Change-Id: I1b495390d67907afc608ed8233bf916777d38e11
CRs-fixed: 548872
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
radio: iris: Checking if driver's buffer is large enough.

Checking if driver's buffer is large enough to copy
the data from user space.

Change-Id: I7b4eed81cf77ce2973669ce18ccd95a5df397d82
CRs-fixed: 552329
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
msm: vidc: Initialize kernel space stack variables

This change initializes kernel space stack variables
that are passed between kernel space and user space
using ioctls.
Non initialization of these variables may lead to
leakage of memory values from the kernel stack to
user space.

Change-Id: Icb195470545ee48b55671ac09798610178e833e1
CRs-fixed: 556771,563420
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: msm_fb: Do not use ION_IOMMU_UNMAP_DELAYED flag.

Since iommu buffers will be unmapped after two newer commits
had passed, there is no need to request iommu driver to further
delay unmapping an iommu buffer.

Change-Id: I44099054114403fa7ac6a5e3c71a43d6b932f4a3
Signed-off-by: raghavendra ambadas <rambad@codeaurora.org>
netfilter: xt_qtaguid: Allow tracking loopback

In the past it would always ignore interfaces with loopback addresses.
Now we just treat them like any other.
This also helps with writing tests that check for the presence
of the qtaguid module.

Change-Id: Ib54f7fcfa94e9913ab926ea78b4a99b78cb3b7b1
Signed-off-by: JP Abgrall <jpa@google.com>
Git-commit: af4d7c85bc8629c63360d5729cba0754b62c4345
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Merge "ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver"
Merge "ASoC: msm: qdsp6v2: Copy frame data based on frame length"
msm: cpufreq: Unable to handle kernel NULL pointer

In the function cpufreq_governor_dbs,( case CPUFREQ_GOV_START )
sysfs creation is under the critical section where as
(case CPUFREQ_GOV_STOP) sysfs removal is not under critical section.
If a START/STOP done frequently from user space then there is chance
of hitting the race condition with sysfs interface creation and removal.
Hence the removal of sysfs entry should happen in the criticalpath.

Change-Id: I3b0dd475e8e306b633b282ff23bd1c8195b5f45f
CRs-fixed: 564850
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
Merge "msm: cpufreq: Unable to handle kernel NULL pointer"
Merge "msm: audio: qdsp6v2: Zero the cfg stack var"
Merge "msm: msm_fb: Do not use ION_IOMMU_UNMAP_DELAYED flag."
usb: gadget: u_bam: Enable zero length packet for tx transfers

Avoid packet re-transmission/drop by sending zero length packet
when usb transfer is multiple of usb endpoint max packet size.

CRs-Fixed: 494184
Change-Id: I01c9f9be41d3b64760e9bc08ec82ef8b6cc1a80f
Signed-off-by: Rajkumar Raghupathy <raghup@codeaurora.org>
USB: OTG: Fix Full speed USB Headset issue

Some Full speed USB headsets requires higher cross over voltage. The
cross over voltage is directly proportional to the phy 3.3 rail voltage.
The current code uses [3.07 - 3.3] range for this regulator and it is
supplied with 3.075V.  To get 3.3V supply, use [3.3 - 3.3] range in
the host mode.

CRs-Fixed: 563496
Change-Id: I3d1705fd346212ecf42c4943995e43964ad14dc5
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
msm: vidc: Validate userspace buffer count before using it

Validate the number of buffers count variable before
using it to avoid structure overflow error.

Change-Id: I61582c93e0f26ec6842e437134fb8a42bdbc36ff
CRs-fixed: 563654
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
msm: vidc: Validate userspace buffer count

Makesure the number of buffers count is less than
the maximum limit to avoid structure overflow errors.

Change-Id: Icf3850de36325637ae43ac95f1c8f0f63e201d31
CRs-fixed: 563694
Signed-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>
Merge "netfilter: xt_qtaguid: Allow tracking loopback"
msm: board: Set the max voltage level for LDO3 to 3.3V

Currently min/max voltage level for LD03 was set to 3.075V.
But some Full speed USB headsets requires higher cross over voltage.
The cross over voltage is directly proportional to the phy 3.3V
rail voltage. So modify the max voltage level of LD03 to 3.3V.

CRs-Fixed: 563496
Change-Id: I535d8d6382e708aa3bf17ed8dae832d00c52d88b
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Merge "radio: iris: Checking if driver's buffer is large enough."