fbcmap: prevent memory overflow

Add bounds check before copying data to prevent
buffer overflow.

Change-Id: I47b9685b1ab13c4863fb6db62bbb9497a00b36da
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>
msm: platform: qpnp-clkdiv: fix potential null pointer dereference

Add a return statement in the spmi resource null check in
qpnp_clkdiv_probe().  This is needed in order to avoid
dereferencing a null pointer in a subsequent statement.

Change-Id: Iaf5d5797016c96a136e93c8e5837f7f8f31d1e47
CRs-Fixed: 563655
Signed-off-by: David Collins <collinsd@codeaurora.org>
thermal: qpnp-adc-tm: Fix format specifier in snprintf

Add format specifier in snprintf to avoid security
vulnerability issues.

CRs-fixed: 562261
Change-Id: I6ea67633348341267e0646912a6b428709410c78
Signed-off-by: Dipen Parmar <dipenp@codeaurora.org>
idr: fix a subtle bug in idr_get_next()

The iteration logic of idr_get_next() is borrowed mostly verbatim from
idr_for_each().  It walks down the tree looking for the slot matching
the current ID.  If the matching slot is not found, the ID is
incremented by the distance of single slot at the given level and
repeats.

The implementation assumes that during the whole iteration id is aligned
to the layer boundaries of the level closest to the leaf, which is true
for all iterations starting from zero or an existing element and thus is
fine for idr_for_each().

However, idr_get_next() may be given any point and if the starting id
hits in the middle of a non-existent layer, increment to the next layer
will end up skipping the same offset into it.  For example, an IDR with
IDs filled between [64, 127] would look like the following.

          [  0  64 ... ]
       /----/   |
       |        |
      NULL    [ 64 ... 127 ]

If idr_get_next() is called with 63 as the starting point, it will try
to follow down the pointer from 0.  As it is NULL, it will then try to
proceed to the next slot in the same level by adding the slot distance
at that level which is 64 - making the next try 127.  It goes around the
loop and finds and returns 127 skipping [64, 126].

Note that this bug also triggers in idr_for_each_entry() loop which
deletes during iteration as deletions can make layers go away leaving
the iteration with unaligned ID into missing layers.

Fix it by ensuring proceeding to the next slot doesn't carry over the
unaligned offset - ie.  use round_up(id + 1, slot_distance) instead of
id += slot_distance.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: David Teigland <teigland@redhat.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: Ifb6d64747e7f08e2f5d7609bd66a48405f0c9b95
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Merge "idr: fix a subtle bug in idr_get_next()"
qseecom: Copy userspace buffer into kernel space before dereferencing

ION memory is used for user space to kernel space data passing.
This is directly accessible in kernel. But, if the IOCTL is called
from user space without using User space library, then data might
be pointing to some other memory location, in which case, it would
not be possible to dereference this location in kernel & hence it
would be accessing invalid memory.

Change-Id: Ic50c76ee8b2a696dbb786fce3a68cdc782e15268
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
msm_serial_hs: Fix the wrong register offset Macro usage

In the msm_hs_tx_empty() API, accessing wrong register offset
macro UARTDM_SR_ADDR.This leading to the unexpected issues
The right register offset macro is UART_DM_SR.
Also the msm_hs_request_clock_off() API is accessing wrong
register macro UARTDM_IMR instead of UART_DM_IMR.

This patch places the right macros at respective points.

CRs-Fixed: 583426
Change-Id: I0eb966adedc44b8e611da318b6d8f4a9279e95a7
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
Merge "fbcmap: prevent memory overflow"
Merge "msm: platform: qpnp-clkdiv: fix potential null pointer dereference"
Merge "thermal: qpnp-adc-tm: Fix format specifier in snprintf"
Merge "msm_serial_hs: Fix the wrong register offset Macro usage"
Merge "qseecom: Copy userspace buffer into kernel space before dereferencing"