usb: gadget: Fix response available notify count usage

The outstanding responses are purged and notify count is reset
during bus suspend. But the notify interrupt endpoint is not flushed.
If a request is pending with the controller, It gets finished during
resume and the notify count is decremented in the completion handler.
As the notify count is reset during the suspend its become negative now.
As the counter is not zero, interrupt notifications are queued even
though there are no responses. This is leading to watchdog bark due to
an error print messages.

Flush the notify endpoint before resetting the notify counter during
suspend. As we are modifying notify counter under spin lock, atomic
variable is not required. Ensure that notify counter never
becomes negative.

CRs-Fixed: 624896
Change-Id: I78cb7a585c1c2b527ca6b46bc99e7db8067ee21a
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
msm: kgsl: don't use sscanf()

Friends do not let friends use sscanf().

CRs-Fixed: 563605
Change-Id: Ic0dedbad56af5bbee4fc833701d8bc93b118efa9
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Ananta Kishore K <akollipa@codeaurora.org>
ASoC: msm: Null dereference check added

In asm_read function we should check buffer pointer
before it is dererferenced.

CRs-Fixed: 612682
Change-Id: I1968c038e1d35381bf174000287d542441e41092
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
Merge "usb: gadget: Fix response available notify count usage"
Merge "ASoC: msm: Null dereference check added"
misc: qfpfuse: validate ioctl input parameters

validate input parameters for ioctl command request

Conflicts:
	drivers/misc/qfp_fuse.c

CRs-Fixed: 550574,550575
Change-Id: I87c3818b3bacc43c679aa555d79cc6ed127c6ef8
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
Signed-off-by: Vignesh Veeramani <quicvignes@codeaurora.org>
Merge "misc: qfpfuse: validate ioctl input parameters"
USB: ci13xxx_udc:  Retire pending requests while flushing an endpoint

Rmnet and dun function drivers are designed to start fresh upon MODEM
restart.  The current code is flushing endpoints without freeing
requests.  New requests are allocated again after MODEM is powered up.
All accumulated requests are freed only upon cable disconnect.  If
MODEM is restarted multiple times without disconnecting the cable, we
are running low memory issues.

A pending request can not be freed without dequeuing it.  Dequeuing
all requests in a loop is a heavy operation and involves changing
multiple function drivers.  All pending requests are retired upon
disabling an endpoint.  But an endpoint can not be disabled in
configured state.  Hence retire pending requests while flushing an
endpoint.

CRs-Fixed: 489047
Change-Id: I3440a204ad8c4beb043b1068cb1d3965be96e9b7
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: RMNET: smd_ctrl: Don't drop ctrl pkts if channel not open

RMNET control packets are dropped if SMD channel is not yet open.
Host would not be notified of the same and may recover only after
some timeout or retry mechanism. Fix this by queuing the control
packets when channel is not open and send them once is gets opened.

CRs-fixed: 627287
Change-Id: Ieb803c0ed6c5b1cd17178a59e7dcc6ae0c24b215
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
msm: kgsl: Remove sscanf() from kgsl_pwrctrl.c

Replace sscanf() in kgsl_pwrctrl.c with a generic function to safely
convert 32 bit unsigned ints.

Conflicts:
	drivers/gpu/msm/kgsl_pwrctrl.c

CRs-fixed: 563585
Change-Id: Ic0dedbad10e2264ec8fccab622d094d123b49b77
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Vignesh Veeramani <quicvignes@codeaurora.org>
Merge "USB: ci13xxx_udc:  Retire pending requests while flushing an endpoint"
misc: qfpfuse: Fix overflow condition

Fix potential integer overflow for ioctl command to avoid incorrect
buffer allocation. Use the stack for data buffering to avoid the
small buffer allocation for improved performance. Increase the fuse
blow timeout in the driver to cover all QFPROM implementations

CRs-Fixed: 550574,550575

Conflicts:
        drivers/misc/qfp_fuse.c

Change-Id: Iee3cc1d38aa5dbf8ef693a43a0ca716fc8724c62
Acked-by: Radhakrishna Popuri <c_rpopur@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Signed-off-by: Prados Das <prados@codeaurora.org>
Merge "misc: qfpfuse: Fix overflow condition"
Merge "msm: kgsl: Remove sscanf() from kgsl_pwrctrl.c"
ASoc: msm: qdsp6v2: Fix for NULL check

- Required check added for NULL pointer

Change-Id: I204dddb37048ba410381e46c0e906d0390951dd9
CRs-fixed: 583939
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
msm: qdsp6v2: Increase max ports in APR

Increase the maximum ports in APR. Some Apps may support
multiple clients which exceeds the number of clients
supported in APR. This change increases number of ports
used in APR upto 8 sessions.

Conflicts:
	arch/arm/mach-msm/include/mach/qdsp6v2/apr.h

Change-Id: I06624330845681b4414dd470ab7aed669d690ba0
Signed-off-by: Aravind Kumar <akumark@codeaurora.org>
Signed-off-by: Vignesh Veeramani <quicvignes@codeaurora.org>
lib/scatterlist: error handling in __sg_alloc_table()

I was reviewing code which I suspected might allocate a zero size SG
table.  That will cause memory corruption.  Also we can't return before
doing the memset or we could end up using uninitialized memory in the
cleanup path.

Change-Id: Icee6be8ea22644d7f16264d9d2a0887c7145996b
CRs-Fixed: 611562
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
ASoC: msm: Add check for both offset and index variable

-The offset and index variable may leads to array out of
boundary exception.
-Added offset and index overflow check.

Conflicts:
	sound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c

CRs-fixed: 583931
Change-Id: I1f71ee595944573e85d77d2001f656bd8ba53806
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
Signed-off-by: Vignesh Veeramani <quicvignes@codeaurora.org>
Merge "USB: RMNET: smd_ctrl: Don't drop ctrl pkts if channel not open"
Merge "lib/scatterlist: error handling in __sg_alloc_table()"