uio: msm_sharedmem: Add new device driver for sharedmemory access

Add new device driver to provide a standard interface for its
clients (like RemoteFS and RFSA) to be able to memory map their
respective allotted shared memory address in the client's address space.
The shared memory (a transport buffer) address is unique for each
individual client and is made available to the driver via device tree.

This driver uses the existing UIO framework to facilitate the clients
mmap requirements. Each individual client will be able to use a unique
UIO device for this purpose.

CRs-Fixed: 477427
Change-Id: If07b88086b5f1b87845962818094644575629fcf
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
ARM: dts: msm: Add new 'sharedmem' devices

Add new devices which need to maintain the shared memory
address for RemoteFS and RFSA

CRs-Fixed: 477427
Change-Id: Id5f3ea2a827d5a30b06d872d7a72468f1fd7718f
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
defconfig: Enable msm_sharedmem UIO driver

Enable msm_sharedmem UIO driver on targets which use RemoteFS
(over QMI) and RFSA.

CRs-Fixed: 477427
Change-Id: I63d95aa0fcbbdc17d64fb7749ed50c3890551dce
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
crypto: msm: Ensure sha_init is called for HASH operation

Validate that the sha_ctx is initialized before any SHA operation
(update, final) requests is issued by client.

Change-Id: I83ac2000d860dfef5532910a2a73cd927b68e95f
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
csdio: Remove the driver

The driver is a legacy driver that is not used any longer
and its implementation is neither correct nor compiles.

Change-Id: I9862c0f93ccad6079a616f6997987d4e187a137c
Signed-off-by: Hamad Kadmany <hkadmany@codeaurora.org>
mmc: core : fix arbitrary read/write to user space

In the MMC card debug_fs the read and write handlers use the strlcat
and sscanf, without checking the pointer given.
Since the pointer is not checked it is possible to write
everywhere (ring 0 or 3).
In order to fix it, an access_ok function is being used to verify
the buffer's pointer supplied by user is valid.

CRs-fixed: 545716

Change-Id: I13ca736337fefe29ff9b0df6a318e7d92240f8b2
Signed-off-by: Raviv Shvili <rshvili@codeaurora.org>
qseecom: Fix error handling path in receive_req()

This patch fixes the error handling path in receive_req() function
called from userspace. Issue seen if user is calling the receive_req
function without calling the listener registration. qseecom_find_svc()
should return NULL if there are no services found.

Change-Id: Id51d8f48d7266b5acbc845f7b9ac0068d16b1ede
CRs-fixed: 496927
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
msm: kgsl: Restrict the maximum memory entries for bulk cache sync

Restrict the maximum number of memory entries that can be specified
to a single bulk cache sync call to PAGE_SIZE / sizeof(unsigned int)
so that the allocation can always fit within one page.

CRs-fixed: 578062
Change-Id: Ic0dedbad07e1986cd6ccc5b260ffef82b5adb6d3
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Add check for NULL value from dev_get_drvdata

Check to see if dev_get_drvdata returns NULL and handle it.

CRs-Fixed: 552580
Change-Id: Ic0dedbad426dbbe15896608213067ee7337f3b34
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: ipc: Possible memory corruption due to Sign Conversion

msm_ipc_router_skb_to_buf() takes an unsigned argument and assigns the
same to a signed local variable. This might cause issues when the value
of the argument is too high.

Change the datatype of the local variable to unsigned.

CRs-Fixed: 550606
Change-Id: I257a095681dd82fba05367fd6faf25820e95c719
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
diag: dci: Safeguard to prevent Integer Underflow and Memory Leak

At certain point in diag driver there can be integer underflow
thus can lead to memory leak. Added a safeguard for that.

Change-Id: I2a0304f5b9888fe12ca9ef5fbaa9a68ee4ab9c15
Crs-fixed: 556860
Signed-off-by: Katish Paran <kparan@codeaurora.org>
tspp: Protect against buffer overflow

Change filter->priority to unsigned int. Since it was defined as integer,
it may have had negative value and cause accessing an array outside
of its region

CRs-Fixed: 561802, 561825
Change-Id: Ie72aa09b07e79b0b67081b74e3b2057de30f03d0
Signed-off-by: Hamad Kadmany <hkadmany@codeaurora.org>
qseecom: Change __copy_from_user to copy_from_user

__copy_from_user does not do address check, so use
copy_from_user instead.

Change-Id: I575c0f3c44b55a521c0d42828988c518c0640a29
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Ensure incoming "app_name" does not corrupt the kernel stack

Printing a string with that does not have null terminated character,
would lead to overflow, as the print continues until it finds a null
terminated character.
Avoid this issue by explicitly assigning a string with null termination.

Change-Id: I9528db2ba046c514d829097d08c09540588bb1a2
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
crypto: msm: Check destination buffer write access

Use VERIFY_WRITE to check write access to destination buffers
before writing to them.

Change-Id: If9708695e85659bb25e13762c54dd50abd9577c7
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
mmc: card: fix arbitrary write via read handler in mmc_block_test

In mmc_block_test, the debug_fs based read function handlers write to an
arbitrary buffer which is given by any user. We add an access_ok check
to verify that the address pointed by *buffer is not in kernel space.
Only if the buffer is valid, do we continue the read handler.

Change-Id: I35fe9bb70df8de92cb4d3b15c851aa9131a0e8d9
Signed-off-by: Lee Susman <lsusman@codeaurora.org>
msm: kgsl: Protect against a potential overflow in kgsl_sg_alloc

Avoid allocating a scatterlist so large that it overflows the size
passed to the memory allocators.

CRs-fixed: 564448
Change-Id: Ic0dedbad2ab421ddec8f3be38d61c9bdf9ae5bd4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: avoid zero length scatterlist allocation

During sglist allocation we calculate sglen as
per below

sglen_alloc = PAGE_ALIGN(size) >> PAGE_SHIFT;

sglen_alloc can be zero if size falls within the
last page. For example, when size = 0xFFFF_FF7B,
PAGE_ALIGN(0xFFFF_FF7B) will be 0, considering
0x1000 (4kb) PAGE_SIZE. if kzalloc() with
zero size, it will return ZERO_SIZE_PTR which is
not NULL and we always do NULL check. Dereferencing
ZERO_SIZE_PTR will lead to a distinct access fault.

Conflicts:
	drivers/gpu/msm/kgsl_sharedmem.h

Change-Id: Ibcc6198438c13b5111be0faa736328db92511597
CRs-Fixed: 563106
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
diag: dci: Safeguard to prevent integer overflow

At certain point in diag driver there can be integer overflow
thus can lead to memory leak. Added a safegaurd for it.

Change-Id: I9347405d8f1f95ed42fe0abf35cbf4c362281bdf
CRs-fixed: 565160
Signed-off-by: Katish Paran <kparan@codeaurora.org>
defconfig: remove support for /dev/mem and /dev/kmem on perf builds

Keeping /dev/mem and /dev/kmem exposed to userspace allows userspace
to peek/poke to these areas and is a security risk. Remove support for
/dev/mem and /dev/kmem on perf builds.

Change-Id: Ibceabb7697bc220761aa55e028f0245037c7cc0c
CRs-Fixed: 530719
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>