msm-camera: Fix to prevent kernel heap buffer overflow in actuator

Fix to prevent kernel heap buffer overflow allows user
controlled data to be written to the heap via the
msm_camera actuator IOCTLs

Change-Id: I5d511e8c1aa2f76f4209a6712a58d8757bc53367
CRs-Fixed: 545979
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm:camera: Bounds and validity check for params

Check the range and validity of parameters before accessing.

CRs-fixed: 550607, 554434, 554436

Change-Id: I2d6aec4f9cb9385789c0df6a2c4abefe9e87539f
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
msm:camera: Initialize a structure before usage

Initialize a structure using memset such that it is
populated properly before returning to userspace.

CRs-fixed: 550567
Change-Id: I2b3c78cd2b309de13acf2811fcc16b8bc04fa052
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
msm-camera: fix to prevent untrusted pointer to lead DoS in Actuator

fix to prevent untrusted userspace pointer in actuator kernel
driver to lead DoS in actuator driver

Change-Id: If9dcba3d4871ca98f78542f8bfb1623a02032f0d
CRs-Fixed: 547231
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm:camera: Initialize the structure before to pass userspace.

Initialize the structure by memset so that value will pass to
proper to usersapce.

CRs-fixed: 554845
Change-Id: I4adf4bf1bb6e45e16f5fd2e26a74232e6ee7f8bd
Signed-off-by:Vivek Singh<vising@codeaurora.org>
msm: msm_fb: Map RGB layers to the max possible size.

IOMMU Page Faults are observed on RGB layers during stability
because MDP is trying to fetch out of mapped area of the buffer.
This patch avoids the issue by overmapping the RGB layers to the
max possible RGB buffer size.

Change-Id: Idc7ac9acad70e351acac5dba2ae43b8731e84d35
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
Signed-off-by: Sangani Suryanarayana Raju <csuryan@codeaurora.org>
Merge "msm: msm_fb: Map RGB layers to the max possible size."
msm:camera: Copy data from user to kernel space before access

This would avoid any invalid access of data.

CRs-fixed: 550608
Change-Id: I30993a9bc731227e72f3be34874505f01357f04d
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm-camera : Fix for Unbounded copy in msm_camera_v4l2_private_control

Fix for the Unbounded copy in msm_camera_v4l2_private_control function

CRs-Fixed: 545962
Change-Id: I36b3cb3193610a090f3fc87273bc71317e7029bd
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
Merge "msm:camera: Initialize the structure before to pass userspace."
Merge "msm-camera: Fix to prevent kernel heap buffer overflow in actuator"
Merge "msm:camera: Bounds and validity check for params"
Merge "msm-camera : Fix for Unbounded copy in msm_camera_v4l2_private_control"
Merge "msm:camera: Copy data from user to kernel space before access"
Merge "msm:camera: Initialize a structure before usage"
Merge "msm-camera: fix to prevent untrusted pointer to lead DoS in Actuator"
msm: Qdsp5v2: audio: Migrate to ION.

PMEM is deprecated, switch to ION.

Change-Id: Ia15c444e26961d8aa40bd5db3ece1fd9368e02ef
Signed-off-by: Kalyani polepeddy <kpolep@codeaurora.org>
audio: msm: qdsp5v2: Switch hostPCM driver to ION.

HostPCM to switch from PMEM to ION to allocate memory.

Change-Id: Ic4f0aa839628ca415702b22005802661674b1fb6
Signed-off-by: Kalyani polepeddy <kpolep@codeaurora.org>
Initial commit for ION compilation errors

Change-Id: Ic003609426ac2fde1e3c506839f31716e708df25
Signed-off-by: Kalyani polepeddy <kpolep@codeaurora.org>
msm: Kconfig: Select ARM_HAS_SG_CHAIN for 7630/8x55

ION allocations in SYSTEM_HEAP now uses alloc_pages() and not
vmalloc(). This will add one entry into sg_table for each page
of allocation. With this, sg_table may over-cross the limit
of fitting into one page for bigger sized allocations. So,
accommodate extended sg_table entries by chaining more pages.

ARCH_HAS_SG_CHAIN will enable this chain of pages. Enable
ARM_HAS_SG_CHAIN to select ARCH_HAS_SG_CHAIN.

(cherry picked from commit 62a2f7c52ab959868f5350695897932846099784)

(cherry picked from commit 9ca7a19f891b4eecb2fa93ac0a428bedd5a197d9)

Change-Id: If627a56be47100342ea7f62f6ca8387ab6bc17a9
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
Signed-off-by: Gopal Goberu <ggober@codeaurora.org>