msm: ipc: Possible memory corruption due to Sign Conversion

msm_ipc_router_skb_to_buf() takes an unsigned argument and assigns the
same to a signed local variable. This might cause issues when the value
of the argument is too high.

Change the datatype of the local variable to unsigned.

CRs-Fixed: 550606
Change-Id: I257a095681dd82fba05367fd6faf25820e95c719
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
msm: kgsl: Change an overflow check to be "smart" compiler proof

In its infinite wisdom, GCC will optimize out this overflow check:

   if ((gpuaddr + size) < gpuaddr)

Which might totally make sense for the compiler but it doesn't do us
a bit of good. Replace the existing overflow check with something
that GCC can't ignore.

CRs-fixed: 544025
Change-Id: Ic0dedbad921545a01d5fe80a20c3f2f4f86ef641
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Bluetooth: Replace sprintf with snprintf

Change will replace sprintf with snprintf, since sprintf is a
banned function.

CRs-FIxed: 548220
Change-Id: I32f5ab1f3707e5bbe43c31a7ad4611b67557b267
Signed-off-by: Juffin Alex Varghese <jalex@codeaurora.org>
msm: kgsl: Fix overflow check in mmap_range_valid

A eager compiler might optimize out the overflow check in
mmap_range_valid.  Add a check against ULONG_MAX to ensure
that the check is performed.

CRs-fixed: 546373
Change-Id: Ic0dedbad478cc3bd65a00a7b31d2039095c005d6
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Merge "wcnss: Add new device interface for user control messages"
kernel/msm: Add qrngp header file

Add qrngp header file, required for external/qrngd project.

Change-Id: Iac27ff57df91efe370ec749451142942289b23a8
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
msm:camera: Disable/enable VFE write masters properly during overflow

Disable write masters during VFE reset and enable them when recovery
is in progress. This would avoid unnecessary page faults.

Change-Id: If894aa6298440673b9d6dc4aa0b5a791fa0fe661

Signed-off-by: Alok Kediya <kediya@codeaurora.org>
msm-camera: Add mutex unlock during get event payload ioctl.

Adding mutex unlock in get event pay load ioctl when index
parameters are outof bounds.

CRs-Fixed: 598557
Change-Id: If1a549edc393105578c13340dab486d576786d76
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
Rotator getting stuck leading to fence timeout

Even though cancel_delayed_work should cancel the worker thread
in some race condition it can fail and get scheduled.
To avoid this situation use cancel_delayed_work_sync.
Also rotator_lock mutex need not be unlocked while waiting for isr
as isr does not aquire this mutex for doing its operations.
It is after this unlock of mutex sometimes in race condition rotator
clock is getting disabled via the msm_rotator_rot_clk_work_f

Change-Id: I574aec489fe51ec0e5f7c215c9aba9bb0ec66ffa
Signed-off-by: Justin Philip <jphili@codeaurora.org>
Merge "msm:camera: Disable/enable VFE write masters properly during overflow"
Merge "msm-camera: Add mutex unlock during get event payload ioctl."
wcnss: Add support to configure the Wlan MAC addr

This change introduces a sysfs entry to allow userspace to
configure the wlan MAC addr and exports an API which allows
WLAN and other wireless technologies to query the wlan MAC
addr

Change-Id: I751b2cf2db1321926e8e16ef1baaa4fa3d8d06cf
CRs-Fixed: 583465
Signed-off-by:  <hkpatel@codeaurora.org>
Merge "radio: iris: Fixed an issue with search stations list."
Merge "Bluetooth: Replace sprintf with snprintf"
Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.028 on remote branch

Change-Id: Ie7de3497bf0ee756df71e821f95c646553bc2bc7
Merge "msm: kgsl: Change an overflow check to be "smart" compiler proof"
Merge "wcnss: Add support to configure the Wlan MAC addr"
Merge "msm: kgsl: Fix overflow check in mmap_range_valid"
net: usb: Do not modify usbnet device context upon rx complete

Upon rx completion, the driver parses the mux header to identify
the actual net device the IP packet is intended for. At this point
the driver also modifies the usbnet device context to a new usbnet
device, which is derived from the associated IP mux header. This
causes the rx skb queue list corruption when skb is moved
incorrectly from new usbnet device's rx skb queue. Hence do not
overwrite the original usbnet device instance which is required
to move skb from rx skb queue to done queue.

CRs-Fixed: 598321
Change-Id: I642f877dd2f758ddbb868de986dd223bad10eee9
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Merge "Merge AU_LINUX_ANDROID_KK_2.7_RB1.04.04.02.007.028 on remote branch"