msm: ipc: Add check to avoid integer & buffer overflow

In IPC Router service lookup operation, add check to avoid an integer
overflow and hence a buffer overflow.

CRs-Fixed: 457402
Change-Id: Ibe949fe20aad88b15679bdc96ebc505e4395ac3b
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
crypto: msm: Ensure sha_init is called for HASH operation

Validate that the sha_ctx is initialized before any SHA operation
(update, final) requests is issued by client.

Change-Id: I83ac2000d860dfef5532910a2a73cd927b68e95f
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
msm: qdsp6v2: memset stack buffer allocation.

This is needed to avoid garbage data in uninitialized variables.

Change-Id: I2db09c4bbaa651c0af41c5c50ba77d22c00b70bc
CRs-Fixed: 553304
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
msm: audio: qdsp6v2: memeset msm_audio_stats to zero

memeset msm_audio_stats to zero before copying to user space.

Change-Id: I5f47bf85e36d46f726dddae68962a3d1cd06213b
CRs-fixed: 549307
Signed-off-by: Kiran Kandi <kkandi@codeaurora.org>
ASoC: msm: Add Buffer overflow check

The overflow check is required to ensure that user space data
in kernel may not go beyond buffer boundary.

Change-Id: I7d94a209c0b8818bfb9c65f8c13a5f5e36c49e2d
CRs-Fixed: 563086
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
ASoc: msm: qdsp6v2: Fix for NULL check

- Required check added for NULL pointer

Change-Id: I204dddb37048ba410381e46c0e906d0390951dd9
CRs-fixed: 583939
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
msm: qdsp6v2: Deleting kernel driver from arch/arm/mach-msm/qdsp6v2

Driver is registering under misc driver but exists under arch/arm/mach

Change-Id: Iee6a0ab50a173e70290d8f8d112d7c91dcddba5a
CRs-Fixed: 548017
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
uio: provide vm access to UIO_MEM_PHYS maps

This makes it possible to let gdb access mappings of the process that is
being debugged.

uio_mmap_logical was moved and uio_vm_ops renamed to group related code
and differentiate to new stuff.

CRs-Fixed: 570735
Change-Id: I8a5ff343727cc58fedfeb73f3466cc9a7f153e84
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 7294151d0592e0ff48c61fca9fd7c93d613134da
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
msm: audio: initialize the structure before sending to user space

If uninitialzied structure is passed from kernel to user space, it
may contain contain sensitive information that will be leaked.

CRs-fixed: 550054
Change-Id: I2e93ed20898e0dc804aa1ffe6791f0cfddfba288
Signed-off-by: Fred Oh <fred@codeaurora.org>
Fix a few incorrectly checked [io_]remap_pfn_range() calls

Nico Golde reports a few straggling uses of [io_]remap_pfn_range() that
really should use the vm_iomap_memory() helper.  This trivially converts
two of them to the helper, and comments about why the third one really
needs to continue to use remap_pfn_range(), and adds the missing size
check.

CRs-Fixed: 570735
Change-Id: I927a67ea80fea5ed706749ead9defb1e72633952
Reported-by: Nico Golde <nico@ngolde.de>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org.
Git-commit: 7314e613d5ff9f0934f7a0f74ed7973b903315d1
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
[pratibha@codeaurora.org:resolve trivial merge conflicts]
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw

Added error checks for upper limit of param.num in DFE ioctls
for register array r/w

Change-Id: I62d2eac38024c6c64f8d2d0f6d65f409569b2a76
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
arm: mach-msm: fix integer overflow in DFE_IOCTL_COMMAND

Added error checks for upper limit of param.num in
DFE_IOCTL_COMMAND

Change-Id: I0143813d38ec7a5dfa7a8307b075daf7d4a4d101
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
radio: tavarua: Fix buffer overflow.

Removed improper typecasting to fix buffer overflow.

CRs-fixed: 554963

Change-Id: Ie3ae5a502f060c13eba7cb5c28a1af389b772af2
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
radio: tavarua: Fixes for memory leaks.

Freeing memory allocated in case of failures.

Change-Id: I323b9c414d725d6b9dc0698e2ed03ef9c2450e5f
CRs-fixed: 557048
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
[media] media: Init the reserved fields of struct media_link_desc

struct media_link_desc is copy_to_user'ed as the return value of
MEDIA_IOC_ENUM_LINKS. When copying, the driver is omitting to initialise
the reserved fields.  This commit fixes that by initialising the
reserved fields to 0.

CRs-Fixed: 570757
Change-Id: I230e2666c0845cc36399518a0f2c94db664382d1
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
ASoC: msm: qdsp6v2: Copy frame data based on frame length

Copying data based on count will result in copying
uninitialized data to userspace which can potentially
disclose sensitive data. Fix by copying data based on
frame instead.

CRs-Fixed: 552528, 552531
Change-Id: I307b285ef2aefe00b953cf650582e9ff7e03ceb1
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
Signed-off-by: Aviral Gupta <aviralg@codeaurora.org>
qseecom:  Validate inputs from user space

Validate send_cmd, send_modfd_cmd and send_mdfd_resp
input parameters: cmd and response pointers and buffer
lengths and offsets  issued to modify data.

Change-Id: I381836d08aaa48357486fbdc6a122eb5b42bfa0b
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
diag: dci: Index DCI client table by client id

Diag driver maintains a table of all DCI clients. This table
is currently indexed by the PID of the clients. Make changes
to index the table base on an unique client id.

Change-Id: Icb68883092f5c8a455e7bb2d0be7567602c94f9c
CRs-fixed: 590721
Signed-off-by: Katish Paran <kparan@codeaurora.org>
msm: ADSPRPC: Add checks for erroneous values

Check for invalid parameters passed in user invocation
and validate the return values using appropriate macros.

Change-Id: If529873d025ac0c13725efbedda5a58fae327722
Acked-by: Sathish Ambley <sambley@qti.qualcomm.com>
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Signed-off-by: Prados Das <prados@codeaurora.org>
ASoC: msm: Upadte the default format on HDMI to LPCM

During the playback of silence the format field was not specified.
This leads to compr data being routed on the LPCM device
which seems to messing the TV state and later adio loss was observed

Default the audio format to LPCM while playing the silence.

Change-Id: I6a827fafb6b291215fb2519b09622d75cd0dfdd0
Signed-off-by: Aviral Gupta <aviralg@codeaurora.org>