msm: usbaudio: Add check for NULL before dereferencing

kzalloc() and usb_ifnum_to_if() both APIs can return NULL. Current
code is not checking return value and derefencing which may crash
device if it is set to NULL. Fix this by checking return value
against NULL and handling the same.

CRs-Fixed: 562273
Change-Id: I0d2c910f43321e94fc447b19ae3e3207727e24f3
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
diag: dci: Index DCI client table by client id

Diag driver maintains the table of all DCI clients. This table
is currently indexed by the PID of the clients. Make changes
to index the table base on an unique client id.

Change-Id: I57bfab9eae1381882b8eb6270d7ac212e0aaf271
CRs-fixed: 590721
Signed-off-by: Katish Paran <kparan@codeaurora.org>
msm: buspm: Correct size type in buspm_xfer_req

Variable size inside buspm_xfer_req
can be negative and thus would be a
large positive number resulting in arbitary
Kernel read.This patch corrects this value.

CRs-Fixed: 563529
Change-Id: I877db6960530d6c7d1486da9cfdc15a43e57e152
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
Merge "msm: buspm: Correct size type in buspm_xfer_req"
Merge "diag: dci: Index DCI client table by client id"
msm: smd: change bounds check on smd edges

Off-by-one array bounds checking could result in out-of-bounds array
access.

Correct array bounds checking.

CRs-Fixed: 561670
Change-Id: Ie20396444686a8ce203c2296ba7235514279f35d
Signed-off-by: Brent Hronik <bhronik@codeaurora.org>
Merge "msm: smd: change bounds check on smd edges"
diag: Safeguard for bound checks and integer underflow

At certain point in diag driver there can be integer underflow
and thus can lead to memory leak. Bound checks are placed to
ensure correct behavior of condition statements.

Change-Id: I47e02f764c2c7412db6f90fd42192fee32a761d3
CRs-fixed: 549470
Signed-off-by: Katish Paran <kparan@codeaurora.org>
Merge "diag: Safeguard for bound checks and integer underflow"
usb: adb: Don't set rx_done on every set_alt to fix USBCV failure

ADB driver maintains rx_done to keep a track of whether RX
usb_request is already queued to hardware or not.
Commit 26444ce5 "usb: adb: Don't dequeue request during system
suspend" adds a regression where this flag may mistakenly get
set if host sends explicit SET_INTERFACE after SET_CONFIGURATION.
This results in ADB set_alt getting called back to back without
adb_disable. This behavior is not seen with hosts normally, but
USBCV compliance tester sends these requests.
Setting rx_done in set_alt results in adb_read to mistakenly
assume that RX request got completed with 0 length and it retries
queuing the RX request (which is already with hardware). This
results in usb_ep_queue failure and returning -EIO from adb_read
causes USB re-enumeration. USBCV compliance tests fail due to device
disconnect during test.

Change-Id: Ia5d922712d7805f8f8a3485cecd589871d234adf
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
diag: dci: Safeguard to prevent integer overflow

At certain point in diag driver there can be integer overflow
thus can lead to memory leak. Added a safegaurd for it.

Change-Id: I9347405d8f1f95ed42fe0abf35cbf4c362281bdf
CRs-fixed: 565160
Signed-off-by: Katish Paran <kparan@codeaurora.org>
usb: gadget: ECM: Check if data interface is UP while bus_suspend

CDC ECM requires DATA interface to support two alternate settings.
Bulk (IO) endpoints must be supported only in 1st alternate setting,
not in the default one. Alternate setting is chosen by host using
SET_INTERFACE command after SET_CONFIGURATION. SET_CONFIG results
in set_alt(0) followed by set_alt(1) when SET_INTERFACE is sent.
There is a possibility of USB bus getting suspended between this
window of SET_CONFIG and SET_INTERFACE. This currently results in
a crash in bus_suspend routine of ECM which assumes that by this
time DATA interface would be up. Fix this by adding a check in
ECM bus_suspend/resume routines to bail out if set_alt(1) is not
yet received by device.

CRs-fixed: 614120
Change-Id: Ic002b75f20d2d4f23f6a5dd7b4df365c25f20e0f
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
msm: sps: Add integer wrap check for debugfs buffer

When converting debugfs buffer size to kilobytes value
there is a possible integer overflow and it may result
into negative value.

Fix the issue by adding integer wrap check for buffer
size just before conversion.

CRs-fixed: 564177
Change-Id: If4615561ea6a1c58e8be8c1b72f7881c068d8520
Signed-off-by: Dipen Parmar <dipenp@codeaurora.org>
Merge "diag: dci: Safeguard to prevent integer overflow"
Merge "msm: sps: Add integer wrap check for debugfs buffer"
misc: qfpfuse: Fix overflow condition

Fix potential integer overflow for ioctl command to avoid incorrect
buffer allocation. Use the stack for data buffering to avoid the
small buffer allocation for improved performance. Increase the fuse
blow timeout in the driver to cover all QFPROM implementations.

CRs-Fixed: 550574,550575

Change-Id: Iee3cc1d38aa5dbf8ef693a43a0ca716fc8724c62
Acked-by: Radhakrishna Popuri <c_rpopur@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
(cherry picked from commit 1c523da2454b2b821c71d437c4c83bc894321378)
mmc: block: check for NULL pointer before dereferencing

mmc block data can be NULL. Hence, check for NULL before
dereferencing md.

CRs-Fixed: 562259
Change-Id: I0182c216ec73347cdd2ea464f593839fffd242a9
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
(cherry picked from commit 589ea6026268a329c9e28def298cc58f927778ff)
diag: dci: Preventing unitialized stack memcpy operation

At certain point in diag driver there can be memcpy operation
for the unintialized stack. Due to uninitilization of memory
user can obatin valuable information on accessing this stack
in userspace. This patch fixes that issue.

Change-Id: I4bfcf156300132dc426dcadce325e0c76c1d0357
CRs-fixed: 565808
Signed-off-by: Katish Paran <kparan@codeaurora.org>
(cherry picked from commit 5b63346648876ea2bb3c1c556454d2f06630f66c)
msm: msm_fb: remove mmio access through mmap

Disable access to mm io and add
appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

CRs-Fixed: 474706
Change-Id: If25166f2732433ef967e99c716440030b567aae9
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>
(cherry picked from commit 578ab840c05425c139bebeb3df698f28acb613e5)
msm: camera_v2: cci: check for NULL pointer

in function "msm_cci_subdev_g_chip_ident"
check for NULL pointer and return error
instead of assert

Change-Id: Ia27751c4d6f3d5ead1749e396ffa5c2773f1582b
Signed-off-by: Georgi Hristov <ghristov@codeaurora.org>
(cherry picked from commit 630b1735dd4c45ea11bb9bebcf2e507a45f17e69)