msm: camera: Cleanup msm_generic_buff list while close

Cleanup the camera msm generic buffer manager list
when all v4l2 nodes are closed.

Change-Id: I27636533621d3329bcc5dffba8c003d2cdc252c2
CRs-Fixed: 599983
Signed-off-by: Azam Sadiq Pasha Kapatrala Syed <akapatra@codeaurora.org>
radio: iris: Fixed an issue with search stations list.

RDS search, search station list were getting excluded
while checking bounds for allowed search types. Fixed
check to include them.

CRs-fixed: 597996
Change-Id: Ia2d7cc8a1bbf8e861a0e23dfc8ca56181b42b810
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
ASoC: msm: Null dereference check added

In asm_read function we should check buffer pointer
before it is dererferenced.

CRs-Fixed: 612682
Change-Id: I1968c038e1d35381bf174000287d542441e41092
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
Merge "ASoC: msm: Null dereference check added"
Merge "radio: iris: Fixed an issue with search stations list."
arm: mach-msm: fix integer overflow in DFE_IOCTL_COMMAND

Added error checks for upper limit of param.num in
DFE_IOCTL_COMMAND

Change-Id: I0143813d38ec7a5dfa7a8307b075daf7d4a4d101
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Merge "arm: mach-msm: fix integer overflow in DFE_IOCTL_COMMAND"
arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw

Added error checks for upper limit of param.num in DFE ioctls
for register array r/w

Change-Id: I62d2eac38024c6c64f8d2d0f6d65f409569b2a76
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Merge "arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw"
msm: camera: Fix various small issues in Actuator driver

Bound check and validate userspace parameters direction,
number of steps and direction sign. Also fix possible
memory leak in certain error cases.

CRs-Fixed: 511349
Change-Id: Icaa324468574494fb40f2de78e522090806744cb
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
Merge "msm: camera: Fix various small issues in Actuator driver"
msm: mdss: Vote for axi bandwidth for dsi cmd trasmission

Sending dsi commands while there is no voting on bus could result
in bus hang. Vote for bw before sending dcs commands to ensure
axi bw is available

Change-Id: I362b90a490550e1d3789c7225f8f16e6570afe1b
Signed-off-by: Shivaraj Shetty <shivaraj@codeaurora.org>
qseecom: Validate the pointer returned by ion_import_dma_buf

Do a "IS_ERR_OR_NULL" check for the return value of
ion_import_dma_buf.

Change-Id: Iaac8b59b1f076d002430e0e6aba055bd88c83ed7
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
msm: ipa: fix potential heap overflow in intf property queries.

Number of TX/RX/EXT properties to be read is supplied by
user-space and if these values are maliciously set too large,
heap overflow and memory corruption can result. This commit
caps the max allowed interface properties.

Change-Id: I9f5bf8b5e9a1b3b47b0741c0b00d5fafc77b28e2
Signed-off-by: Ravi Gummadidala <rgummadi@codeaurora.org>
Signed-off-by: Venkata Aravind <venkata@codeaurora.org>
rtc: alarm: Proper handling of spinlock

In alarm_shutdown hook, taking interruptible mutex
lock in interrupt disabled context. This patch fixes
alarm_shutdown function to call rtc_read_time and
rtc_set_alarm APIs in interrupt enabled context.

Change-Id: I9392d8908c19365993dccc22504f4b6f83ae8f72
CRs-Fixed: 619657
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
misc: qfpfuse: Fix overflow condition

Fix potential integer overflow for ioctl command to avoid incorrect
buffer allocation. Use the stack for data buffering to avoid the
small buffer allocation for improved performance. Increase the fuse
blow timeout in the driver to cover all QFPROM implementations.

CRs-Fixed: 550574,550575

Change-Id: Iee3cc1d38aa5dbf8ef693a43a0ca716fc8724c62
Acked-by: Radhakrishna Popuri <c_rpopur@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Merge "msm: ipa: fix potential heap overflow in intf property queries."
Merge "msm: camera: Cleanup msm_generic_buff list while close"
qseecom: Add basic suspend resume functionality

If ce clock is not disabled in suspend state, memory may be corrupted and
device can not wake up. Thus, if clock is enabled, we disable it in qseecom
suspend function and re-enable it again in resume function.

Change-Id: I70349ad3070c340add1f3fbe392a4bec2b8af9bf
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: update clock ref count when bus scaling timer is running

when there are multiple enable/dislable clock operations, ce clock
ref count is not updated correctly when the timer to disable clock
is running. Specifically, the ref count is not decreased when the
old operation is finished and then we reset clock for the new enable
clock. Thus, the ce clock is not disabled after all operation are
completed due to incorrect clk ref count. We make a change to
decrease clock reference count before reset timer, when the timer
is running, then clock is disabled when all ce clock operations
finish and the timer expires.

Change-Id: If71fd526acd9a74bf21731841fae0b98e76a89b5
Signed-off-by: Zhen Kong <zkong@codeaurora.org>