msm: mdss: hdmi: Security check for EDID 3D data parsing

While parsing EDID (Extended display identification data) received
from TV for 3D data and other, proper buffer overflow check is done
to avoid data overflow or overwrite.
Also, replace snprintf with scnprintf for better memory copy results.

CRs-Fixed: 542823
Change-Id: I2603beea6eb88a92b013a1a45d960a4c3ba6c09b
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
msm: mdss: hdmi: Proper permissions for CEC logical address

Do not give universal access to CEC (Consumer Electronics Control)
sysfs nodes for logical and physical addresses to avoid unauthorized
access.

CRs-Fixed: 547968
Change-Id: I2ba57f050cc92a361586064dfd5e5659ab07c2f7
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
msm: camera: To prevent the unbounded copy

To prevent the unbounded copy in EEPROM driver
to avoid kernel memory disclosure

Change-Id: Ib7f8719351ff72720c55394fdd0fcd5e876e2c09
CRs-fixed: 553389
Signed-off-by: Cherian Deepak <dcheri@codeaurora.org>
msm: camera: Fix various small issues in vpe driver

Upper and lower bound checks are enforced for num_buff
which is passed from userspace and memset inst_info
to zero to avoid unwanted data passed to userspace

CRs-fixed: 547927
Change-Id: I0d589ef26e57bb26dc006b5927461edcc95e593e
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
ALSA: pcm: check for integer overflow during multiplication

Channel info data structure is parsed from userspace and if
user does not set the no. of channels correctly, it could lead
to security vulnerability if we don't check for overflow when the
no. of channels is multiplied with pcm bit width. Add a condition
to check for overflow during multiplication.

CRs-fixed: 537818
Change-Id: Ib9631b6e45d77b39be2c27343d4aee3e9244d8cc
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
ASoC: msm: Change acdb_mmap size variable to unsigned

The acdb_mmap fuction does a size calculation but
stores the result in an int which makes negitive
numbers possible. Changing the variable to unsigned
ensures that the size used is never out of bounds.

Change-Id: Ie3cf4c0a1037e7f5fef29b8301becc6c19200ed6
CRs-fixed: 548145
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
msm: audio: qdsp6v2: Change acdb_mmap size variable to unsigned

The acdb_mmap fuction does a size calculation but
stores the result in an int which makes negitive
numbers possible. Changing the variable to unsigned
ensures that the size used is never out of bounds.

Change-Id: Iffd9c1440d2f28b703a77993fdbb3ccd18f30694
CRs-fixed: 548145
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
msm: actuator: fix to prevent untrusted pointer to lead DoS

fix to prevent untrusted userspace pointer in actuator kernel
driver to lead DoS

Change-Id: I1b64270deb494530d268539e7b420be5ec79b658
Signed-off-by: Vasko Kalanoski <vaskok@codeaurora.org>
Signed-off-by: Aditya Degwekar <adityad@codeaurora.org>
msm: camera: Remove camera v1 source files

Remove camera v1 source files since its obsolete.

Change-Id: I5196b63d9730eac9ac7ff31785d0f4a0e3e68975

Signed-off-by: Deepak Cherian <dcheri@codeaurora.org>
msm: audio: qdsp6v2: Zero the cfg stack var

Write zeroes into the stack variable cfg to ensure
no previously written stack data is sent to
user-space.

Change-Id: Ie571949e3613c9e5a916b23e1dc19605496d9dbf
CRs-Fixed: 551574
Signed-off-by: Kenneth Westfield <kwestfie@codeaurora.org>
ASoC: msm: q6: check upper bounds when copy ac3 params

Although AC3 maximum param size is fixed, better check upper bounds
when copy user data. It might cause overflow, possibly cause memory
corruption.

Change-Id: I2f7cec8edd9e013de1433ea06480b963ec307196
Signed-off-by: Fred Oh <fred@codeaurora.org>
Merge "msm: audio: qdsp6v2: Change acdb_mmap size variable to unsigned"
Merge "ALSA: pcm: check for integer overflow during multiplication"
Merge "ASoC: msm: Change acdb_mmap size variable to unsigned"
msm: mhl: sii8334: initialize return value

Initialize the variable holding the return code
to appropriate error value so that an incorrect
return code isn't sent to the caller.

Change-Id: I7654523c37ac9b7a60dda1fae77dfacc196df6fa
CRs-Fixed: 524484
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
Merge "msm: audio: qdsp6v2: Zero the cfg stack var"
Merge "msm: mdss: hdmi: Proper permissions for CEC logical address"
Merge "ASoC: msm: q6: check upper bounds when copy ac3 params"
Merge "msm: actuator: fix to prevent untrusted pointer to lead DoS"
Merge "msm: camera: Remove camera v1 source files"