wcnss: Add support to configure the Wlan MAC addr

This change introduces a sysfs entry to allow userspace to
configure the wlan MAC addr and exports an API which allows
WLAN and other wireless technologies to query the wlan MAC
addr

Change-Id: I751b2cf2db1321926e8e16ef1baaa4fa3d8d06cf
CRs-Fixed: 583465
Signed-off-by:  <hkpatel@codeaurora.org>
msm: ipa: teth_bridge: bug fix in get_aggr_capabilities ioctl

Incorrect input validation may cause a kernel memory disclosure to user
space. This fix adds the correct input validation.

Change-Id: Ia0a3f6bae3c9efc48136bad9974516929e76f4fb
CRs-Fixed: 555453
Signed-off-by: Gidon Studinski <gidons@codeaurora.org>
msm: kgsl: Add check for NULL value from dev_get_drvdata

Check to see if dev_get_drvdata returns NULL and handle it.

CRs-Fixed: 552580
Change-Id: Ic0dedbad426dbbe15896608213067ee7337f3b34
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Restrict the maximum memory entries for bulk cache sync

Restrict the maximum number of memory entries that can be specified
to a single bulk cache sync call to PAGE_SIZE / sizeof(unsigned int)
so that the allocation can always fit within one page.

CRs-fixed: 578062
Change-Id: Ic0dedbad07e1986cd6ccc5b260ffef82b5adb6d3
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: acpuclock-cortex: Fix off by one error for large frequency tables

If a frequency table was greater than a certain size, data will be written
past the end of an array. Fix the loop conditions to prevent this.

CRs-fixed: 561651
Change-Id: If7bafcf79c044877f4a29c2437c139d23aa1fb32
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
ARM: dts: msm: add non wake up capable interrupts to bypass list for 8x10 v2

Add non wake up capable interrupts to bypass list for 8x10 v2.
Some of the interrupts are not capable of waking up the system
from LPM modes but these interrupts can prevent the system not
to enter into deep power states i.e XO and Vdd min when these
are not added to bypass list.

CRs-fixed: 584863
Change-Id: I35dce3a8e833b11940afa975e49db0f6dc731bdb
Signed-off-by: Anil kumar mamidala <amami@codeaurora.org>
defconfig: remove support for /dev/mem and /dev/kmem on perf builds

Keeping /dev/mem and /dev/kmem exposed to userspace allows userspace
to peek/poke to these areas and is a security risk. Remove support for
/dev/mem and /dev/kmem on perf builds.

Change-Id: Icaed922d80e271670fb0571852833d452771376c
CRs-Fixed: 530719
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
mmc: core : fix arbitrary read/write to user space

In the MMC card debug_fs the read and write handlers use the strlcat
and sscanf, without checking the pointer given.
Since the pointer is not checked it is possible to write
everywhere (ring 0 or 3).
In order to fix it, an access_ok function is being used to verify
the buffer's pointer supplied by user is valid.

CRs-fixed: 545716
Change-Id: Ia710b6af5a95974fc930ca902e8ff18afa4e17ba
Signed-off-by: Raviv Shvili <rshvili@codeaurora.org>
mmc: core : fix arbitrary read/write to user space

In the MMC card debug_fs the read and write handlers use the strlcat
and sscanf, without checking the pointer given.
Since the pointer is not checked it is possible to write
everywhere (ring 0 or 3).
In order to fix it, an access_ok function is being used to verify
the buffer's pointer supplied by user is valid.

CRs-fixed: 545716

Change-Id: I13ca736337fefe29ff9b0df6a318e7d92240f8b2
Signed-off-by: Raviv Shvili <rshvili@codeaurora.org>
radio: tavarua: Added NULL checks for input arguments.

Added NULL checks for input arguments.

Change-Id: Ie39c2b3254c95925723735423c81b99da59ee6ad
CRs-fixed: 548405
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
Bluetooth: Replace sprintf with snprintf

Change will replace sprintf with snprintf, since sprintf is a
banned function.

CRs-FIxed: 548220
Change-Id: I32f5ab1f3707e5bbe43c31a7ad4611b67557b267
Signed-off-by: Juffin Alex Varghese <jalex@codeaurora.org>
msm: kgsl: Verify the user address before reading a perfcounter group

In adreno_perfcounter_read_group some user input verification is
occuring on a user pointer before copy_from_user is called
resulting in a possible segmentation fault if called with improper
input data.

CRs-fixed: 553314
Change-Id: Ic0dedbad4c5e4b2610368d51ff591d1f716712f4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
diag: dci: Safeguard to prevent Integer Underflow and Memory Leak

At certain point in diag driver there can be integer underflow
thus can lead to memory leak. Added a safeguard for that.

Change-Id: I2a0304f5b9888fe12ca9ef5fbaa9a68ee4ab9c15
Crs-fixed: 556860
Signed-off-by: Katish Paran <kparan@codeaurora.org>
msm: vidc: add sleep of 100us before clock disable

ARM9 execute following sequence when venus is idle
1. Disable ARM9 watchdog
2. Set bit 30 of A_VENUS_CPU_CS_SCIACMDARG0 register
   to indicate venus is idle
3. Write HFI_MSG_SYS_IDLE to message queue
4. Raise interrupt to host
5. ARM9 execute wait for interrupt instruction to go
   into low power state. This will internally drain the
   ARM9 write buffer which can generate bus transaction.
6. ARM9 in idle

Host clock gate venus based on following sequence
1. Host receive HFI_MSG_SYS_IDLE from the msg queue
2. Host check both cmd / msg queue are empty by
   comparing the queue read/write pointers.
3. Host check bit 30 of A_VENUS_CPU_CS_SCIACMDARG0
   register to confirm it indicate idle
4. Host clock gate whole venus

As the host clock gate venus in step 4, ARM9 is still
in step 5&6. The sleep will ensure that step 5 and 6
are completed before host clock gates venus.

CRs-Fixed: 589417
CRs-Fixed: 595251
Change-Id: Idf1f788718adea2dacceca97afa4ba4fe4562ddd
Signed-off-by: Vikash Garodia <vgarodia@codeaurora.org>
msm: usbaudio: Add check for NULL before dereferencing

kzalloc() and usb_ifnum_to_if() both APIs can return NULL. Current
code is not checking return value and derefencing which may crash
device if it is set to NULL. Fix this by checking return value
against NULL and handling the same.

CRs-Fixed: 562273
Change-Id: Idfae0baf5fdedd658a8bb04e5ad95ff5fb4472d1
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
Merge "msm: ipa: teth_bridge: bug fix in get_aggr_capabilities ioctl"
Merge "Bluetooth: Replace sprintf with snprintf"
ASoC: msm: DTS parameter validation

Validate the modelIdLength before proceeding and copying
the user data.

Change-Id: I659d83376cc893340851d6889019a82d169b2134
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
radio: iris: Avoid memory leak and NULL pointer dereferencing

 - Avoid memory leak by freeing allocated memory
 - Do not derefer NULL pointer

CRs-Fixed: 537955
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
Change-Id: I7624d73e5c25233e9d03c67e4204c611b9a8fff6
radio: iris: Avoid inconsistent free

There is a chance to of memory leak if we exit
from function early. Ensure to use free before
exiting from function.

Change-Id: I17dbecffc5713d95c66ecec0bffb5ed3c8660fe8
CRs-Fixed: 540334
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>