qseecom: Validate the pointer returned by ion_import_dma_buf

Do a "IS_ERR_OR_NULL" check for the return value of
ion_import_dma_buf.

Change-Id: Iaac8b59b1f076d002430e0e6aba055bd88c83ed7
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
ASoC: msm: Add check for both offset and index variable

-The offset and index variable may leads to array out of
boundary exception.
-Added offset and index overflow check.

Change-Id: I1f71ee595944573e85d77d2001f656bd8ba53806
CRs-fixed: 583931
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
msm: camera: Cleanup msm_generic_buff list while close

Cleanup the camera msm generic buffer manager list
when all v4l2 nodes are closed.

Change-Id: I27636533621d3329bcc5dffba8c003d2cdc252c2
CRs-Fixed: 599983
Signed-off-by: Azam Sadiq Pasha Kapatrala Syed <akapatra@codeaurora.org>
msm: kgsl: Remove sscanf() from kgsl_pwrctrl.c

Replace sscanf() in kgsl_pwrctrl.c with a generic function to safely
convert 32 bit unsigned ints.

CRs-fixed: 563585
Change-Id: Ic0dedbad10e2264ec8fccab622d094d123b49b77
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
ASoC: msm: Null dereference check added

In asm_read function we should check buffer pointer
before it is dererferenced.

CRs-Fixed: 612682
Change-Id: I1968c038e1d35381bf174000287d542441e41092
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
Merge "msm: camera: Cleanup msm_generic_buff list while close"
Merge "ASoC: msm: Null dereference check added"
msm: camera: Fix various small issues in Actuator driver

Bound check and validate userspace parameters direction,
number of steps and direction sign. Also fix possible
memory leak in certain error cases.

CRs-Fixed: 511349
Change-Id: Icaa324468574494fb40f2de78e522090806744cb
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
Merge "msm: camera: Fix various small issues in Actuator driver"
arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw

Added error checks for upper limit of param.num in DFE ioctls
for register array r/w

Change-Id: I62d2eac38024c6c64f8d2d0f6d65f409569b2a76
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Merge "arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw"
msm: ipa: fix potential heap overflow in intf property queries.

Number of TX/RX/EXT properties to be read is supplied by
user-space and if these values are maliciously set too large,
heap overflow and memory corruption can result. This commit
caps the max allowed interface properties.

Change-Id: I9f5bf8b5e9a1b3b47b0741c0b00d5fafc77b28e2
Signed-off-by: Ravi Gummadidala <rgummadi@codeaurora.org>
Signed-off-by: Venkata Aravind <venkata@codeaurora.org>
Merge "msm: ipa: fix potential heap overflow in intf property queries."
Merge "ASoC: msm: Add check for both offset and index variable"
misc: qfpfuse: validate ioctl input parameters

validate input parameters for ioctl command request

CRs-Fixed: 550574,550575
Change-Id: I87c3818b3bacc43c679aa555d79cc6ed127c6ef8
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
Merge "misc: qfpfuse: validate ioctl input parameters"
qseecom: Add basic suspend resume functionality

If ce clock is not disabled in suspend state, memory may be corrupted and
device can not wake up. Thus, if clock is enabled, we disable it in qseecom
suspend function and re-enable it again in resume function.

Change-Id: I70349ad3070c340add1f3fbe392a4bec2b8af9bf
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: update clock ref count when bus scaling timer is running

when there are multiple enable/dislable clock operations, ce clock
ref count is not updated correctly when the timer to disable clock
is running. Specifically, the ref count is not decreased when the
old operation is finished and then we reset clock for the new enable
clock. Thus, the ce clock is not disabled after all operation are
completed due to incorrect clk ref count. We make a change to
decrease clock reference count before reset timer, when the timer
is running, then clock is disabled when all ce clock operations
finish and the timer expires.

Change-Id: If71fd526acd9a74bf21731841fae0b98e76a89b5
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: change qseecom bus scaling timer operation

To ensure ce clock is not disabled before tz operation is completed,
we delete the old timer when tz side operation begins, and then add
a new timer after tz operation is completed.

Change-Id: I4bc8fe3d9305cc1ed5db8e6490832fcc791ef3d7
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: Ensure CE clk is managed properly

Clk access ref count is not updated correctly when issuing a
request that requires enabling clk. this results in leaving the
clk on during regular operation resulting in failure of the
device to go into low power mode.

Change-Id: I80232433ff09277fe83d78142dcec75e7493d96e
Signed-off-by: Zhen Kong <zkong@codeaurora.org>