msm-camera: Bound check num_cid from userspace in csid driver

Upper and lower bound checks are enforced for num_cid
which is passed from userspace with lower as 1 and
max of 16.

Change-Id: I69a405995d2f53c3a0b0a72b50460bebfdf38442
CRs-Fixed: 511358
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm: msm_fb: Replace wait for DMA_P with VSYNC in Pan_display Path.

This is a follow up change on gerrit 442946. Wait for DMA_P has to be
replaced with VSYNC even in Pan Display Path.

Change-Id: I8d600022cfa63f54d5b72ea5f64fc55315079b3a
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
msm: camera: Add debugfs support for VFE.

Add debugfs support in VFE driver and enable user to perform the
following actions at runtime thorugh debugfs:
- dump the VFE registers.
- print the VFE configuration.

Change-Id: Ib8641b3dde6a7b41c4d63631b6b8ed1bac374317
Signed-off-by: Kiran Kumar H N <hurlisal@codeaurora.org>
msm: kgsl: Fix the KGSL driver to compile when CONFIG_DEBUG_FS=n

Fix a compilation error when CONFIG_DEBUG_FS is disabled. Add an
initialization flag to the process struct rather than rely on a
pointer to the debugfs node which will always be NULL if debugfs
is not available.

CRs-fixed: 542231
Change-Id: Ic0dedbadf0241fd476e56d6e116a811697b38190
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Increase ION MMHeap from 56MB to 72MB

Increase ION MMHeap size from 56MB to 72MB to support
1080p widevine playback over 720p WFD session.
The Heap size is made a multiple of 4MB due to
CMA Alignment requirement.

Change-Id: I3dfed71a535c392441673f940bccfb6e87872958
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
msm: ipc: Fix SKB ownership for failure case

When a client writes to IPC Router and if the write fails, then in
certain scenarios both the client and IPC Router take up the ownership
of the SKB. These failure scenarios lead to a double-free and
segmentation fault.

Fix these scenarios by resolving the ownership issue. If the write to
IPC Router is successful, then IPC Router will keep the ownership of the
SKBs and free the packets. If the write fails, then the client will keep
the ownership of the SKBs and free the packets.

CRs-Fixed: 530180
Change-Id: Iaba47f5da377cdf0a6b16ae02d99eab91a9a6221
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
ASoC: msm:Initialize local variable output_meta_data.

The local variable output_meta_data is not initialized if
prtd->meta_data_mode is false. It can lead unexpected behavior

Change-Id: I64f87342b02a3fb7b5c09c376f72ef7e0ca1efd6
CRs-Fixed:548200
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>
msm: ipc: Append alignment bytes to loopback packet

When messages are looped back to the local port, the sender does not
append the alignment bytes while the receiver is discarding the
alignment bytes. This leads to receiver receiving an incomplete message.

Fix this issue by appending the alignment bytes in the loopback path.

Change-Id: Ie340e5311e15e39558a8fe9c95a54da686df4371
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
msm: ipc: Update the check for minimum packet size

IPC Router checks for the minimum packet size of the incoming message to
be at least 32 bytes. With IPC Router version 2 header, this check is
invalid for some packets.

Update the check for the minimum incoming packet size based on the
transport on which the packet is received.

Change-Id: Iacebfe876db2e5c3513d18fcfae425ea9bd6a7cd
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
msm-camera: Bound check for step position value in Actuator driver.

Bound check of curr_step_pos value of step_position_table in
Actuator driver.

Change-Id: I9462e197d46cde5b31ea4e80c22a836851128093
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
ASoC: msm: qdsp6: Fix pop noise seen with touch tone during playback

Issue: When a session is opened for playback of the touch tone and
	routed through the COPP, the PBE and IIR params are being
	reconfigured in the COPP every time a session is open.

Rootcause:Configuring the PBE/IIR in the COPP every time a session
           is open.
Fix: Configuring the PBE and IIR param in the COPP one time a session
      is open

CRs-Fixed: 541722
Change-Id: If0d1a8c6893a94186e1c6c2a75432d2f4a89f842
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>
ASoC: wcd9304:Fix RX voice in handset call distort after reboot the device

Issue:The RX voice in handset call will distorted from handset after
      reboot the device
Root cause:This happens due enable override gain in cp_static register.

Fix:Configure the cp_static override gain as Half gain.

Change-Id: I9addb8650fad5a1169bf1afb8e63f1eac4163514
CRs-Fixed: 532155
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>
mm/page_alloc.c: fix watermark check in __zone_watermark_ok()

The watermark check consists of two sub-checks.  The first one is:

	if (free_pages <= min + lowmem_reserve)
		return false;

The check assures that there is minimal amount of RAM in the zone.  If
CMA is used then the free_pages is reduced by the number of free pages
in CMA prior to the over-mentioned check.

	if (!(alloc_flags & ALLOC_CMA))
		free_pages -= zone_page_state(z, NR_FREE_CMA_PAGES);

This prevents the zone from being drained from pages available for
non-movable allocations.

The second check prevents the zone from getting too fragmented.

	for (o = 0; o < order; o++) {
		free_pages -= z->free_area[o].nr_free << o;
		min >>= 1;
		if (free_pages <= min)
			return false;
	}

The field z->free_area[o].nr_free is equal to the number of free pages
including free CMA pages.  Therefore the CMA pages are subtracted twice.
This may cause a false positive fail of __zone_watermark_ok() if the CMA
area gets strongly fragmented.  In such a case there are many 0-order
free pages located in CMA.  Those pages are subtracted twice therefore
they will quickly drain free_pages during the check against
fragmentation.  The test fails even though there are many free non-cma
pages in the zone.

This patch fixes this issue by subtracting CMA pages only for a purpose of
(free_pages <= min + lowmem_reserve) check.

Laura said:

  We were observing allocation failures of higher order pages (order 5 =
  128K typically) under tight memory conditions resulting in driver
  failure.  The output from the page allocation failure showed plenty of
  free pages of the appropriate order/type/zone and mostly CMA pages in
  the lower orders.

  For full disclosure, we still observed some page allocation failures
  even after applying the patch but the number was drastically reduced and
  those failures were attributed to fragmentation/other system issues.

Change-Id: Ic2c0c233993c41c630e24d71df5e12aa614588e5
CRs-Fixed:549847
Signed-off-by: Tomasz Stanislawski <t.stanislaws@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Tested-by: Laura Abbott <lauraa@codeaurora.org>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Acked-by: Minchan Kim <minchan@kernel.org>
Cc: Mel Gorman <mel@csn.ul.ie>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: <stable@vger.kernel.org>	[3.7+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 026b08147923142e925a7d0aaa39038055ae0156
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
arm: Move the secondary_startup to __CPUINIT section.

Because of addition 1MB alignment after head.txt section,
the secondary_startup needs to move to 1MB aligned section.

CRs-Fixed: 513919
Change-Id: I332d1e4ec95c877406c6ad3318e5f9a3c85cc10f
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
msm_fb:hdmi:Fix for sysfs Entry Information Leaks

These sysfs entries leak logical and physical addresses
within the kernel and may be read by any user.
The read permissions for the sysfs entries changed
to S_IRUSR from S_IRUGO.

Change-Id: Idfc58c3b639ea4dfa105ff146467a1c4f01edb6e
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
ALSA: pcm: check for integer overflow during multiplication

Channel info data structure is parsed from userspace and if
user does not set the no. of channels correctly, it could lead
to security vulnerability if we don't check for overflow when the
no. of channels is multiplied with pcm bit width. Add a condition
to check for overflow during multiplication.

CRs-fixed: 537818
Change-Id: Ia3c31406dd8b7627ea704c076643c0348582da28
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
msm: fb: Null check mfd data

Add appropriate null check for mfd data
structure before accessing it's members.
This prevents null pointer accesses in
the driver.

Change-Id: I5aae937f839e4f6ed8d5c5a4b54ab45f0ff07332
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm: fb: Copy unsigned int for notify update

Change to correct signature of msmfb_notify_update
from the ioctl declaration.

Change-Id: Ia7bdfd3dbe8494a641ffd46d484794b4bec7d27c
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm_fb:hdmi:Security check for EDID 3D data parse

While parsing EDID received from TV for 3D data and other,
proper buffer overflow check is done to avoid
data overflow or overwrite.
Also, replace snprintf with scnprintf for better memory copy results.

Change-Id: I4100226a6e5ae0740478f5d85e5b70c9fa20188e
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
msm-camera: Fix to prevent kernel heap buffer overflow in actuator

Fix to prevent kernel heap buffer overflow allows user
controlled data to be written to the heap via the
msm_camera actuator IOCTLs

Change-Id: I5d511e8c1aa2f76f4209a6712a58d8757bc53367
CRs-Fixed: 545979
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>