radio: iris: Avoid inconsistent free

There is memory leak chance if we exit
from function early. Ensure to use free before
exiting from function.

Change-Id: I17dbecffc5713d95c66ecec0bffb5ed3c8660fe8
CRs-Fixed: 540334
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Prevent probable overflow

casting a unsigned int into an integer, integer to
unsigned int may cause buffer overflow.

Change-Id: I54be4d4c5470616a59a772c587fe6d5f32575c32
CRs-Fixed: 539008
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
msm: ehci-hsic: Add support to disable internal clock gating

EHCI cores on latest MSMs have internal clock gating enabled
by default. Stability issues (random enumeration failures)
have been observed with some CORES where clock gating feature
doesn't work as expected. Hence add support to disable clock
gating in hardware.

Change-Id: I5209a68409ad04cba53c14c0e813aa0b925cf98e
CRs-Fixed: 538509
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
msm: rpm: do not disable the interupt during suspend

If an edge wake up interrupt happens during suspend path,
the flow handler will mask it and set as pending. This
lead to suspend sequence abort when the check for all
pending edge interrupt happens. Do not disable the
interrupt (wake up interrupt to CPU0 in krait SS, #54)
during suspend.

CRs-fixed: 583318
Change-Id: I3a5afec98d445da2dfc1f16fc20d9f3e96acc17f
Signed-off-by: Murali Nalajala <mnalajal@codeaurora.org>
msm: kgsl: Add a missing refcount put for kgsl_context

Fix a potential memory leak by putting in the missing
kgsl_context_put() in ft detect for kgsl_context

Change-Id: I2673cdcc5a8ab9caf4d9adbfd9b3aa528348d945
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
radio: iris: Prevent loss of data

Down casting a variable may lead to loss
of data, other various kind of subtle errors.

Change-Id: If1f8a8c463333a5283c5ba66f099e33d66dc21e4
CRs-Fixed: 569313
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Use kernel API to copy data from user space

Use copy_from_user kernel api to copy any data from user space
to kernel space.

Change-Id: Ia3b7bb0f98180bd8792c1c18e930cb5609b8dc82
CRs-Fixed: 540320
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
workqueue: Added null check and warning

If work item is already in queue get_work_cwq() will return null.
so null check is added to avoid crash in delayed_work_timer_on()

CRs-Fixed: 586162

Change-Id: I5c885142fd72781cea90d6c9b3456ecc7f0778b6
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Asoc:msm:Added Buffer overflow check

The overflow check is required to ensure that user space data
in kernel may not go beyond buffer boundary.

Change-Id: I79b7e5f875fadcaeceb05f9163ae3666d4b6b7e1
CRs-Fixed: 563086
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
defconfig: remove support for /dev/mem and /dev/kmem on perf builds

Keeping /dev/mem and /dev/kmem exposed to userspace allows userspace
to peek/poke to these areas and is a security risk. Remove support for
/dev/mem and /dev/kmem on perf builds.

Change-Id: I630101c40c806cc6682573d070964d79ca36bd57
CRs-Fixed: 530719
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
cfg80211: export regulatory_hint_user() API

This is to help the hardware configured in world
roaming mode to save power when not connected to
any AP.

CRs-Fixed: 542802
Change-Id: Ia643d0e9848dcd486832973bd6dd186edd7bd4ea
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
msm: wlan: Add VHT80 support on db.txt

Adding support for VHT80 on db.txt

Git-commit: 342e794bf4130b624939504e97169c6d41bec011
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-regdb.git
Author: Luis R. Rodriguez <mcgrof@do-not-panic.com>
Date: 2013-07-17 02:18:42 (GMT)

CRs-Fixed: 557666
Change-Id: I91ed6f4d52a7b7bea93047f14455cc11b9f203ea
Acked-by: Tushnim Bhattacharyya <tushnimb@codeaurora.org>
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
cfg80211: fix set_regdom() to cancel requests with same alpha2

Use a different error code if the regdomain is same and then
set the request processed so that it doesn't block new
requests.

Git-commit: 959085352b7c44ff9bae4d8a4d76146193260e4c
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
Author: Kalle Valo <kvalo@qca.qualcomm.com>
Date: Thu Jul 12 15:33:58 2012 +0300

Change-Id: I8cbcf80bb43d983c72cf9037f30e11ae8d329b06
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
msm: wlan: update  db.txt with information from compliance team

Update the db.txt with new information from regulatory compliance
team.

Change-Id: I22d123c28becb87228f96116456fd2b969440fd3
Signed-off-by: Arif Hussain <arifhussain@codeaurora.org>
CRs-Fixed: 571151
radio: tavarua: Added NULL checks for input arguments.

Added NULL checks for input arguments.

Change-Id: Ie39c2b3254c95925723735423c81b99da59ee6ad
CRs-fixed: 548405
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
Merge "radio: iris: Avoid inconsistent free"
Merge "radio: iris: Use kernel API to copy data from user space"
Merge "radio: iris: Prevent loss of data"
ASoC:wcd9304:Modified code to acquire codec_resource_lock only once.

POP noise is heard as DAC is enabled during fast insertion/removal of
headset, due to wrong handling of codec_resource_lock. There is no need
to acquire the lock separately for HPHL and HPHR channel, hence modified
such that lock is acquired only once for both HPHL and HPHR PA's.

Change-Id: Ibceced072a9b19f0ecd0b156057973520f241a4f
CRs-Fixed: 580366
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
idr: fix a subtle bug in idr_get_next()

The iteration logic of idr_get_next() is borrowed mostly verbatim from
idr_for_each().  It walks down the tree looking for the slot matching
the current ID.  If the matching slot is not found, the ID is
incremented by the distance of single slot at the given level and
repeats.

The implementation assumes that during the whole iteration id is aligned
to the layer boundaries of the level closest to the leaf, which is true
for all iterations starting from zero or an existing element and thus is
fine for idr_for_each().

However, idr_get_next() may be given any point and if the starting id
hits in the middle of a non-existent layer, increment to the next layer
will end up skipping the same offset into it.  For example, an IDR with
IDs filled between [64, 127] would look like the following.

          [  0  64 ... ]
       /----/   |
       |        |
      NULL    [ 64 ... 127 ]

If idr_get_next() is called with 63 as the starting point, it will try
to follow down the pointer from 0.  As it is NULL, it will then try to
proceed to the next slot in the same level by adding the slot distance
at that level which is 64 - making the next try 127.  It goes around the
loop and finds and returns 127 skipping [64, 126].

Note that this bug also triggers in idr_for_each_entry() loop which
deletes during iteration as deletions can make layers go away leaving
the iteration with unaligned ID into missing layers.

Fix it by ensuring proceeding to the next slot doesn't carry over the
unaligned offset - ie.  use round_up(id + 1, slot_distance) instead of
id += slot_distance.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: David Teigland <teigland@redhat.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: Ifb6d64747e7f08e2f5d7609bd66a48405f0c9b95
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>