msm: kgsl: Protect against a potential overflow in kgsl_sg_alloc

Avoid allocating a scatterlist so large that it overflows the size
passed to the memory allocators.

CRs-fixed: 564448
Change-Id: Ic0dedbad2ab421ddec8f3be38d61c9bdf9ae5bd4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: audio: initialize the structure before sending to user space

If uninitialzied structure is passed from kernel to user space, it
may contain contain sensitive information that will be leaked.

CRs-fixed: 550054
Change-Id: I2e93ed20898e0dc804aa1ffe6791f0cfddfba288
Signed-off-by: Fred Oh <fred@codeaurora.org>
arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw

Added error checks for upper limit of param.num in DFE ioctls
for register array r/w

Change-Id: I62d2eac38024c6c64f8d2d0f6d65f409569b2a76
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
arm: mach-msm: fix integer overflow in DFE_IOCTL_COMMAND

Added error checks for upper limit of param.num in
DFE_IOCTL_COMMAND

Change-Id: I0143813d38ec7a5dfa7a8307b075daf7d4a4d101
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
diag: Safeguard for bound checks and integer underflow

At certain point in diag driver there can be integer underflow
and thus can lead to memory leak. Bound checks are placed to
ensure correct behavior of condition statements.

Change-Id: I47e02f764c2c7412db6f90fd42192fee32a761d3
CRs-fixed: 549470
Signed-off-by: Katish Paran <kparan@codeaurora.org>
msm: camera: Clear frame stucture before use

Clear frame structure before use and avoid unnecessary side
effects

CRs-Fixed: 563447

Change-Id: I9acd436f30c65c01fa366328f7227a2045f42657
Signed-off-by: Ashok Raj Deenadayalan <adeena@codeaurora.org>
Merge "msm: camera: Clear frame stucture before use"
Merge "msm: audio: initialize the structure before sending to user space"
hsic_sysmon_test: Add check for userspace buffer size count

hsic_sysmon_test local buffer size limit is 4096 bytes. If user space
tries to write data with size greater than 4096 bytes, memory corruption
would happen. Hence, add check for userspace buffer size count before
writing data from userspace buffer to hsic_sysmon_test local buffer.

CRs-Fixed: 547489
Change-Id: I25de15b2abea44ff4cecac827d86b2da8a57c40e
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
USB: gadget: f_audio.c: Fix bug in accessing freed buffer pointer

Current driver is accessing the buffer pointer after it is freed.
This results in target crash. Hence fix the bug by setting pointer
variable to NULL before it is freed.

Change-Id: I8c01d7c6999cb145c9153383bf47ae240725748a
CRs-Fixed: 564289
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: Ido Shayevitz <idos@codeaurora.org>
Merge "hsic_sysmon_test: Add check for userspace buffer size count"
msm: sps: Add integer wrap check for debugfs buffer

When converting debugfs buffer size to kilobytes value
there is a possible integer overflow and it may result
into negative value.

Fix the issue by adding integer wrap check for buffer
size just before conversion.

CRs-fixed: 564177
Change-Id: If4615561ea6a1c58e8be8c1b72f7881c068d8520
Signed-off-by: Dipen Parmar <dipenp@codeaurora.org>
(cherry picked from commit 921d0f3097da0421f75c74adf2da46faf726ecd1)
msm: reap unused audio files

Removing this file as it is not used in this branch.

Change-Id: Ibff0dbeca0cdae5447d3fd8857ffad296edfdd55
Signed-off-by: anish kumar <kanish@codeaurora.org>
(cherry picked from commit f62b9634d863c7770df21f24b7498597f3cbaa46)
qseecom: Fix error handling path in receive_req()

This patch fixes the error handling path in receive_req() function
called from userspace. Issue seen if user is calling the receive_req
function without calling the listener registration. qseecom_find_svc()
should return NULL if there are no services found.

Change-Id: Id51d8f48d7266b5acbc845f7b9ac0068d16b1ede
CRs-fixed: 496927
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
(cherry picked from commit ad2893b71e0adc553766a6cc9b998e653b13700a)
fbmem: Check failure of FBIOPUTCMAP ioctl

On FBIOPUTCMAP ioctl failure deallocate
fb cmap. Put null check for cmap red, green,
blue component.

Change-Id: I10468ee30d0e76c256cf3d7a6ffe14db7fd4511b
Signed-off-by: Pawan Kumar <pavaku@codeaurora.org>
(cherry picked from commit 03b1b6bfef5c25bd4ed35826d7f238292692e7be)
radio: tavarua: Fixes for memory leaks.

Freeing memory allocated in case of failures.

Change-Id: I323b9c414d725d6b9dc0698e2ed03ef9c2450e5f
CRs-fixed: 557048
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
(cherry picked from commit 4a0b1ccbd28a432106bb84f3d79c22f304640535)
radio: tavarua: Fix buffer overflow.

Removed improper typecasting to fix buffer overflow.

CRs-fixed: 554963

Change-Id: Ie3ae5a502f060c13eba7cb5c28a1af389b772af2
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
(cherry picked from commit 78e6eff04b7114b72f8534583e52ca9d7908f8b9)
radio: iris: Checking if driver's buffer is large enough.

Checking if driver's buffer is large enough to copy
the data from user space.

Change-Id: I7b4eed81cf77ce2973669ce18ccd95a5df397d82
CRs-fixed: 552329
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
(cherry picked from commit 3a4ebaac557a9e3fbcbab4561650abac8298a4d9)
msm: audio: qdsp6v2: Zero the cfg stack var

Write zeroes into the stack variable cfg to ensure
no previously written stack data is sent to
user-space.

Change-Id: Ie571949e3613c9e5a916b23e1dc19605496d9dbf
CRs-Fixed: 551574
Signed-off-by: Kenneth Westfield <kwestfie@codeaurora.org>
(cherry picked from commit c2b632814b50f3441692563bbf469fabe0596d05)
msm: usbaudio: Add check for NULL before dereferencing and fix allocation

kzalloc() and usb_ifnum_to_if() both APIs can return NULL. Current
code is not checking return value and derefencing which may crash
device if it is set to NULL. Fix this by checking return value
against NULL and handling the same.
Fix memory allocation issue in snd_usb_audio_init() to use sizeof(struct)
insead of sizeof(pointer)

CRs-Fixed: 562273
Change-Id: I0d2c910f43321e94fc447b19ae3e3207727e24f3
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>