cpufreq: ondemand: Fix kernel warning in cpufreq_governor_dbs

GOV_STOP event destroys the timer_mutex and is not initialized back
upon GOV_START event.
The Kernel complains at mutex_lock(during GOV_LIMITS event) after
mutex_destroy.

[<c0014918>] (unwind_backtrace+0x0/0x11c)
[<c007c004>] (warn_slowpath_common+0x4c/0x64)
[<c007c034>] (warn_slowpath_null+0x18/0x1c)
[<c079eef8>] (__mutex_lock_slowpath+0x130/0x3c4)
[<c079f1ac>] (mutex_lock+0x20/0x3c) from [<c0540900>]
[<c0540900>] (cpufreq_governor_dbs+0x3c8/0x468)
[<c053d500>] (__cpufreq_governor+0x90/0xe0)
[<c053d774>] (__cpufreq_set_policy+0x224/0x258)
[<c053da58>] (cpufreq_add_dev_interface+0x2b0/0x308)
[<c053e784>] (cpufreq_add_dev+0x500/0x56c)
[<c079247c>] (cpufreq_cpu_callback+0x88/0x9c)
[<c07a2ca8>] (notifier_call_chain+0x38/0x68)
[<c007ded0>] (__cpu_notify+0x28/0x40)
[<c0790024>] (_cpu_up+0xe4/0x118)
[<c0790024>] (cpu_up+0x64/0x80)
[<c0765840>] (store_online+0x48/0x78)
[<c038d0c8>] (dev_attr_store+0x18/0x24)
[<c017be40>] (sysfs_write_file+0x108/0x13c)
[<c012cdfc>] (vfs_write+0xb0/0x128)
[<c012d034>](sys_write+0x38/0x64)

Change-Id: Ie2a796b17209243de731ccf2ab04b7f9e7048df8
CRs-fixed: 576272
Signed-off-by: Anji Jonnala <anjir@codeaurora.org>
cpufreq: ondemand: Fix locking issue in store_powersave_bias

store_powersave_bias takes timer_mutex before calling dbs_timer_exit
which tries to cancel the delayed work do_dbs_timer which in turn
tries to take the same lock. This can cause a lock recursion under
the race condition where can cancel_delayed_work_sync is called
when the work has already started executing.

This can be avoided by taking that lock after calling
dbs_timer_exit.

Change-Id: I7f862286e66f1ddc1e13e4eeee369dd188fc10d5
CRs-fixed: 576272
Signed-off-by: Rohit Gupta <rohgup@codeaurora.org>
cpufreq: ondemand:Fix NULL check for dbs_info->cur_policy

dbs_info->cur_policy can go NULL when processing
CPUFREQ_GOV_LIMITS, NULL check is required
before processing it

Change-Id: Iba99b563e230835dfcd24573335065d68ad25821
CRs-fixed: 576272
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
cpufreq: ondemand: Fix store_powersave_bias() race with hotplug

store_powersave_bias() assumes that CPUs will not be taken offline or
brought online while executing its for_each_online_cpu() loops. Fix
this race by blocking hotplug while executing in these loop.

CRs-Fixed: 576272
Change-Id: I0d5520444ec21a8d9b12fb73c06ac8442449fa85
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
cpufreq: ondemand: Fix locking in store_powersave_bias

store_powersave_bias() assumes that dbs_info->cur_policy will
not change while it is executing. If it does, memory corruption
can potentially result. Fix this by acquiring the dbs_lock.

Most noticeably, this resolves timer-related list corruptions
encountered when queue_delayed_work_on() is called from within
store_powersave_bias() while a CPU is being hotplugged in and
out.

CRs-Fixed: 576272
Change-Id: I0fd5cbef6834545274cad9481e574ec50b37b871
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
crypto: msm: check potential integer overflow on AEAD req length

According to the specification of AEAD, AEAD request cryptlen is
not a Fixed maximum and assoclen is also same. This could lead to
potential integer overflow, thus allocating less memory. So we
need to check potential integer overflow on AEAD request length.

Change-Id: I58a0c5e1a6e890bad30f7865e96b7db46337158c
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: Change __copy_from_user to copy_from_user

__copy_from_user does not do address check, so use
copy_from_user instead.

Change-Id: I575c0f3c44b55a521c0d42828988c518c0640a29
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Ensure incoming "app_name" does not corrupt the kernel stack

Printing a string with that does not have null terminated character,
would lead to overflow, as the print continues until it finds a null
terminated character.
Avoid this issue by explicitly assigning a string with null termination.

Change-Id: I9528db2ba046c514d829097d08c09540588bb1a2
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Validate the incoming length from user space

Check if there is no integer overflow before using req_len and
resp_len (received from user space). If an overflow is detected
then exit the operation.

Change-Id: I0459a6992bb3b280db42be63a275c55fa6105b1c
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
crypto: msm: Check destination buffer write access

Use VERIFY_WRITE to check write access to destination buffers
before writing to them.

Change-Id: If9708695e85659bb25e13762c54dd50abd9577c7
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
crypto: msm: Check for invalid byte offset field

There is potential for HEAP corruption when the
byte offset field is set to a huge value.

Change-Id: Idd851cf3ec57627aba7d8250914cd18ccdd697ec
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
qseecom: Fix issues with qssecom_remove/exit APIs

Clean-up the qseecom_remove() function by removing the null pointer
dereference. Change the logic by removing the unnecessary code and
also modified the qseecom_exit() function with proper calls.

Change-Id: Ibcca1b3c2c37024661505de2550e202b507703aa
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
crypto: msm: Fix issues related to non-zero byteoffset input

Fix buffer overflow for a non-zero byteoffset value.

Also fixes memory leak issue by adding data_len check in check_params.
One of the scenarios data_len can be less than byteoffset which results
in memory leak with huge data length, which might cause the kernel panic.

Change-Id: I3f773673219f45dad4f17499b1ee0feda2aff1f7
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
crypto: msm: Fix null pointer exception in qcrypto_count_sg()

Fixes null pointer exception in count scatter gather function. Scatter
gather list pointer become NULL if the sg pointer reaches last but one
node, which results in NULL pointer exception.

Change-Id: I634baf30074e6e53ffa22635565da54e9ae43150
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
qseecom:  Validate inputs from user space

Validate send_cmd, send_modfd_cmd and send_mdfd_resp
input parameters: cmd and response pointers and buffer
lengths and offsets  issued to modify data.

Change-Id: I381836d08aaa48357486fbdc6a122eb5b42bfa0b
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
msm: vidc: Set input buffer size dynamically

This change supports overriding of default input
buffer size using a set parameter call from the
client.

Change-Id: I5225ec53ba16b68aeedd4c30897bd291e81b4b09
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
qseecom:  Check for case where listener service is not found

When listerner service is not in the list of registered listeners,
the resulting ptr will a NULL. Check for this case of NULL ptr
to indicate missing listener service.

Change-Id: I0d2c7b01143c40711f71bf434493ac5301314cf2
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: Remove debug  messages

Remove unnecessary debug  messages.

Change-Id: Ida80fbc1376f15753f8329c44550b14d8f4de163
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
crypto: msm: Ensure sha_init is called for HASH operation

Validate that the sha_ctx is initialized before any SHA operation
(update, final) requests is issued by client.

Change-Id: I83ac2000d860dfef5532910a2a73cd927b68e95f
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>