msm:camera: Bound check the num_planes variable

Bound check the num_planes variable, otherwise for loop
can execute forever

Change-Id: I554b988e048b9bf64e92a157eb7459d270e54721
Signed-off-by: Lakshmi Narayana Kalavala <lkalaval@codeaurora.org>
msm: camera: Prevent double free of memory if post event fails

In camera_v4l2_s_fmt_vid_cap_mplane(), if msm_post_event() fails, then
sp->vb2_q.drv_priv pointer will get kzfree()'d for a second time within
camera_v4l2_vb2_q_release(). So prevent this double free by setting
sp->vb2_q.drv_priv to NULL after it is kzfree()'d the first time.

CRs-fixed: 507075
Change-Id: I07532b98be795601aa543898f7ae6bc714d8a643
Signed-off-by: Seemanta Dutta <seemanta@codeaurora.org>
msm: camera_v2: Use stream cnt for unique stream id

Add new atomic counter for keeping track of stream counts.
The exisitng open_cnt counter is not full-proff since there could
be multiple streams with the stream id in the folowing
scenario:
a) Create stream 1, 2, and 3
b) Destroy stream 2
c) Add new stream; will result in another stream with id 3.

CRs-fixed: 493632
Change-Id: Icfa3cb2fd2c34c6da7e5f09d016fef4577331264
Signed-off-by: Ankit Premrajka <ankitp@codeaurora.org>
msm: camera: Maintain buffer queue in isp buf manager

we encountered a problem where we are trying to free one
of buffers from previous ion session and this is resulting
in a BUG_ON because of mismatch of ion_handles.

Inorder to avoid this we are now maintaining a queue for
all the buffers during prepare buf and we unprepare only
if the buffer is present in this queue.

Change-Id: Ifd526ec0e4dc9d83a7c1a095af97a833a8b82a57
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
camera_v1/v2: Fix multiple JPEG integer overflow issues

Fixes multiple issues in the gemini and jpeg 1.0 cores when parsing
hw commands:

1. Fixes integer overflow issue when calculating the length of the
command buffer.
2. Fixes signedness issue with the command count.

CRs-fixed: 504640
Signed-off-by: Kamen Kirov <kkirov@codeaurora.org>
Change-Id: I0a701c67b93cc97af119b31639db699e5ae58489
kernel-msm: camera: KW Changes in camera_v2

Make sure isp functions to return appropiate values from all control paths.

Change-Id: I3ceaee662bcabb33fcc348fd370f13cc1f8d35c4
Signed-off-by: RamaKrishna Nallamothu <rnallamo@codeaurora.org>
msm: camera: Fix various small issues in vpe driver

Upper and lower bound checks are enforced for num_buff
which is passed from userspace and memset inst_info
to zero to avoid unwanted data passed to userspace

CRs-fixed: 547927
Change-Id: I0d589ef26e57bb26dc006b5927461edcc95e593e
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm:cpp: Check number of buffers before allocate stream_info

Number of buffers used by cpp is defined by user space. In
case this number is ZERO the allocated memory space will be
pointed by ZERO_SIZE_PTR. Referencing ZERO_SIZE_PTR, causes
same type of behavior as referencing the NULL pointer

Change-Id: I42665225c7d055cda6749198c35e94c1442c6d3e
Signed-off-by: Iliya Varadzhakov <ivarad@codeaurora.org>
msm: camera: Add fix to avoid array index out of bound in cpp

  The parameter for number of buffers passed from user space
may be very large. While allocating memory, this could result
in integer overflow. As a result lesser memory will be allocated
then expected. This inturn may result in array index out of bound
error when the pointer is used to access memory.

  The fix is to limit the maximum requested buffers per stream. If
request is greater than the maximum value, error is returned back
to user space.

CRs-Fixed: 489273
Change-Id: I3d316f439610609cd36615eea3e68d0e8a0be0d7
Signed-off-by: Nishant Pandit <npandit@codeaurora.org>
(cherry picked from commit b7126cdd15b764bad8fe9fafe3dbd6ee3e8d44ec)