msm: camera: make sure num_buf is not out of bound.

V4L2 only allow 32 buffers. Check the num_buf to make sure that
user space passed value is not out of bound.

CRs-Fixed: 514698
Change-Id: I662ec1eb998ed8bfb2a7f188e645410aa78c83b0
Signed-off-by: Ankit Premrajka <ankitp@codeaurora.org>
Signed-off-by: Raghu DP <dp.raghu@codeaurora.org>
Signed-off-by: Venkata Aravind <venkata@codeaurora.org>
[media] media: info leak in __media_device_enum_links()

These structs have holes and reserved struct members which aren't
cleared.  I've added a memset() so we don't leak stack information.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

Change-Id: Ia22c66d36c0a7bcaee60e65a7db406a40f973006
Git-commit: c88e739b1fad662240e99ecbd0bdaac871717987
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Signed-off-by: Venkata Aravind <venkata@codeaurora.org>
seq_file: remove "%n" usage from seq_file users

All seq_printf() users are using "%n" for calculating padding size,
convert them to use seq_setwidth() / seq_pad() pair.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Joe Perches <joe@perches.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 652586df95e5d76b37d07a11839126dcfede1621
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[rsiddoji@codeaurora.org: Resolve merge conflicts with ipv4/6 ping
 changes in upstream]
CRs-fixed: 665291
Change-Id: Ia0416c9dbe3d80ff35f24f9c93c3543d1200a327
Signed-off-by: Ravi Kumar <rsiddoji@codeaurora.org>
USB: ci13xxx_udc:  Add support for UI interrupts counting

Add counting of UI or USB transfers completion interrupts
so that it can be used to determine USB transfers or
BUS usage. This is a simple approach which gives
reasonable accuracy to avoid counting actual bytes
that got transferred over USB.

Change-Id: I1ee3c6997e40ee5db1da26af1e68fced06ea2de4
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
dwc3: gadget: Add support for transfer complete events counting

Add counting of USB transfers completion events/interrupts
so that it can be used to determine USB transfers or BUS usage.
This is a simple approach which gives reasonable accuracy to
avoid counting actual bytes that got transferred over USB.

CRs-fixed: 687220
Change-Id: Ib06e916ef1b3a7dbf0b3c720d306e922043a7f33
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
USB: ANDROID: Implement dynamic pm_qos voting based on USB activity

Currently USB android driver maintains only two states for DMA
latency voting with pm_qos i.e. USB connect and disconnect/suspend.
This doesn't take into consideration when USB is completely IDLE
or very minimal USB transfers are happening resulting in high
power consumption. Even though USB is used for battery charging
but not allowing CPU to enter lower power states may result in high
charging time or even device getting hot.
Driver now monitors USB traffic using UI interrupts count and based
on that takes decision to vote appropriate DMA latency. If interrupts
during a sample time are less than threshold then it allows transition
from WFI to IDLE_PC and further to IDLE_PC_RPM if no interrupts are
seen for a while.
All these thresholds and sample times (note below) are configurable and
should be defined such that we ramp up fast to WFI (up_sample_sec)
but slow down shift to IDLE_PC (down_sample_sec). User configurable
parameters are:
1. Parameters to control WFI to L2 IDLE_PC transition:
  * down_pm_qos_sample_sec: Interrupts sampling time
  * down_pm_qos_threshold: If interrupts during a sample are less than
         this threshold then allow L2 IDLE_PC.
2. Parameters to control IDLE_PC to IDLE_PC_RPM transition:
  * idle_pc_rpm_no_int_secs: If no interrupts are seen for this much
         time then allow L2 IDLE_PC_RPM.
3. Parameters to control transition to WFI:
  * up_pm_qos_sample_sec: Interrupts sampling time
  * up_pm_qos_threshold: If interrupts during a sample are more than
         this threshold then allow only WFI.

Change-Id: I945dfca84e56005e8d5940f3dc31ed2c1197cde1
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Merge "dwc3: gadget: Add support for transfer complete events counting"
Merge "USB: ci13xxx_udc:  Add support for UI interrupts counting"
Merge "USB: ANDROID: Implement dynamic pm_qos voting based on USB activity"
Merge "msm: camera: make sure num_buf is not out of bound."
Merge "[media] media: info leak in __media_device_enum_links()"
Merge "seq_file: remove "%n" usage from seq_file users"
msm: cpp: Validate frame message before manipulating it

CPP frame message is used to send all frame data
to Microcontroller. It is sent every frame. CPP kernel
driver has to add information to it before transfer it.
The message has to be validated before manipulations.
If it is not valid the message and corresponding frame
are discarded.
Change-Id: Ib5b9b5d2e1886d3d671966b693ce212d58e34041
Signed-off-by: Manish Poddar <mpoddar@codeaurora.org>
Merge "msm: cpp: Validate frame message before manipulating it"
target/rd: Refactor rd_build_device_space + rd_release_device_space

This patch refactors rd_build_device_space() + rd_release_device_space()
into rd_allocate_sgl_table() + rd_release_device_space() so that they
may be used seperatly for setup + release of protection information
scatterlists.

Also add explicit memset of pages within rd_allocate_sgl_table() based
upon passed 'init_payload' value.

v2 changes:
  - Drop unused sg_table from rd_release_device_space (Wei)

Change-Id: I0d42113c0e2d703fe7567a804003b034fd4fa0b7
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Git-commit:4442dc8a92b8f9ad8ee9e7f8438f4c04c03a22dc
Git-repo:https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
[ggober@codeaurora.org:resolve trivial merge conflicts in target_core_rd.c]
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
netlink: fix possible spoofing from non-root processes

Non-root user-space processes can send Netlink messages to other
processes that are well-known for being subscribed to Netlink
asynchronous notifications. This allows ilegitimate non-root
process to send forged messages to Netlink subscribers.

The userspace process usually verifies the legitimate origin in
two ways:

a) Socket credentials. If UID != 0, then the message comes from
   some ilegitimate process and the message needs to be dropped.

b) Netlink portID. In general, portID == 0 means that the origin
   of the messages comes from the kernel. Thus, discarding any
   message not coming from the kernel.

However, ctnetlink sets the portID in event messages that has
been triggered by some user-space process, eg. conntrack utility.
So other processes subscribed to ctnetlink events, eg. conntrackd,
know that the event was triggered by some user-space action.

Neither of the two ways to discard ilegitimate messages coming
from non-root processes can help for ctnetlink.

This patch adds capability validation in case that dst_pid is set
in netlink_sendmsg(). This approach is aggressive since existing
applications using any Netlink bus to deliver messages between
two user-space processes will break. Note that the exception is
NETLINK_USERSOCK, since it is reserved for netlink-to-netlink
userspace communication.

Still, if anyone wants that his Netlink bus allows netlink-to-netlink
userspace, then they can set NL_NONROOT_SEND. However, by default,
I don't think it makes sense to allow to use NETLINK_ROUTE to
communicate two processes that are sending no matter what information
that is not related to link/neighbouring/routing. They should be using
NETLINK_USERSOCK instead for that.

Change-Id: I6382c2ecf3dc9ada1f6b7298ebb8bd08453d3a28
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Merge "netlink: fix possible spoofing from non-root processes"
Merge "target/rd: Refactor rd_build_device_space + rd_release_device_space"
net/l2tp: don't fall back on UDP [get|set]sockopt

The l2tp [get|set]sockopt() code has fallen back to the UDP functions
for socket option levels != SOL_PPPOL2TP since day one, but that has
never actually worked, since the l2tp socket isn't an inet socket.

As David Miller points out:

  "If we wanted this to work, it'd have to look up the tunnel and then
   use tunnel->sk, but I wonder how useful that would be"

Since this can never have worked so nobody could possibly have depended
on that functionality, just remove the broken code and return -EINVAL.

Change-Id: I1f5b81e6af9062731d5e8198e42e1fc7f3423afc
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: James Chapman <jchapman@katalix.com>
Acked-by: David Miller <davem@davemloft.net>
Cc: Phil Turnbull <phil.turnbull@oracle.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
ASoC: msm: Fix ADM GET PARAM callback

Add size check on inband get param call and do
not process inband if RTAC is active.

Change-Id: I2c099f5ea254a214f224dda556773a7fe6754fe5
CRs-fixed: 548397
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>