radio: tavarua: Fixes for memory leaks.

Freeing memory allocated in case of failures.

Change-Id: I323b9c414d725d6b9dc0698e2ed03ef9c2450e5f
CRs-fixed: 557048
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
(cherry picked from commit 4a0b1ccbd28a432106bb84f3d79c22f304640535)
msm: camera: Cleanup msm generic buf queue on userspace crash

Clean-up the msm camera generic buff queue on userspace
crash to avoid invalid memory access in next session
which might lead to corruption in other modules
and system stability issues and also avoid memory leak.

Change-Id: Icd989cf9ef944c01e1193fead105963f745bcbc4
CRs-Fixed: 522939
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
(cherry picked from commit 0a11c0bfe811b9e5bc12b5b121cd7fb7fbb212b3)
mmc: core: disable runtime-pm if MMC_CAP2_CORE_RUNTIME_PM is not defined

There is currently no mechanism to disable the runtime-pm
of eMMC/SD card. This patch adds the mechanism to disable
runtime-pm of eMMC/SD if MMC_CAP2_CORE_RUNTIME_PM is not
defined.

It sets the platform, class and card device as RPM_ACTIVE
irrespective of the capability but doesn't enable it.
The card is never runtime-suspended and hence the
corresponding mmc_host and platform device are not
runtime-suspended as well.

A capability MMC_CAP2_CORE_PM is used to select the use
of core power-management framework.

CRs-Fixed: 490021
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Change-Id: I394a81a889ab7d4f0f0e6fe4b932630e30fc16c9
(cherry picked from commit 4bc81249023ac3714bfc96098ecb9cc22984c8e2)
mmc: sdhci-msm: add USE_CORE_PM capability

Defining this capability would invoke the suspend/resume
routines defined for mmc_host device by the PM framework.

CRs-Fixed: 490021
Change-Id: I6fde407ed91f0a7249923bb156482378e2bb727c
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
(cherry picked from commit 41c3521b2d0b6d63e97a21319e69dc8388ba8f1e)
mmc: sdhci: Turn on controller clocks and card power at MMC_POWER_UP

Currently, the clock to the card is enabled prior to enabling
the power to card. Specification requires that the power be
supplied first and then a delay of 10ms and then clock be
provided to the card.

In this, during MMC_POWER_UP mode, the controller clocks would be
ON and the power would be supplied to the card. In the MMC_POWER_ON
mode, the clocks to the card would be enabled and the rate set.
A callback has been provided to facilitate the enabling of
controller clocks.

CRs-Fixed: 567658
Change-Id: I2d66eae1581b9b136faaba4cafc330aeb6a3f364
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
(cherry picked from commit d02c09a838a980d8a1ab171b293d4ea0955cbcc5)
mmc: sdhci-msm: enable controller clocks at MMC_POWER_UP

A callback to turn-on the controller clocks is implemented.
This callback would ensure that the pclk and mclk are enabled
but the output clock to the card is disabled.

CRs-Fixed: 567658
Change-Id: Ic97e600a6388fb64f1267a097b201f31d114a1fb
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
(cherry picked from commit 6c0804b4c42eb85684fde585ea4d90b9171d67ff)
qseecom: Check input buffer from IOCTL

IOCTL messages come with pointers to buffer, check these
buffer pointers prior to accessing it.

Change-Id: Ibd724a35682a6f8e4f6900c8404854a8b55c0c9a
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
(cherry picked from commit 0e67489c6ab00a6af7f8e3ab8f5cd8cb12c8acb5)
ext4: fix the free blocks calculation for ext3 file systems w/ uninit_bg

Ext3 filesystems that are converted to use as many ext4 file system
features as possible will enable uninit_bg to speed up e2fsck times.
These file systems will have a native ext3 layout of inode tables and
block allocation bitmaps (as opposed to ext4's flex_bg layout).
Unfortunately, in these cases, when first allocating a block in an
uninitialized block group, ext4 would incorrectly calculate the number
of free blocks in that block group, and then errorneously report that
the file system was corrupt:

EXT4-fs error (device vdd): ext4_mb_generate_buddy:741: group 30, 32254 clusters in bitmap, 32258 in gd

This problem can be reproduced via:

    mke2fs -q -t ext4 -O ^flex_bg /dev/vdd 5g
    mount -t ext4 /dev/vdd /mnt
    fallocate -l 4600m /mnt/test

The problem was caused by a bone headed mistake in the check to see if a
particular metadata block was part of the block group.

Many thanks to Kees Cook for finding and bisecting the buggy commit
which introduced this bug (commit fd034a84e1, present since v3.2).

Change-Id: I122951d5528178c8af75e3f7425b5eae9ccdb036
Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
Reported-by: Kees Cook <keescook@chromium.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Tested-by: Kees Cook <keescook@chromium.org>
Cc: stable@kernel.org
CRs-Fixed: 576063
Git-commit: b0dd6b70f0fda17ae9762fbb72d98e40a4f66556
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
Signed-off-by: Divya Sharma <c_shard@codeaurora.org>
(cherry picked from commit ea30c33200000b6a8aac1e675f72f64d6144b537)
msm: clock: Add 63.16 MHz rate to UART clocks

The 4MBps UART baud rate requires a frequency of 63.16
MHz on the UART clocks. Add this frequency.

CRs-Fixed: 573462
Change-Id: I2481d7e0b7177ed884c3124fb6c56ac98385e31a
Signed-off-by: Vikram Mulukutla <markivx@codeaurora.org>
(cherry picked from commit 0caccf921a77d1fc1ad5bdbec47c9f0a37c17cff)
radio: tavarua: Fix buffer overflow.

Removed improper typecasting to fix buffer overflow.

CRs-fixed: 554963

Change-Id: Ie3ae5a502f060c13eba7cb5c28a1af389b772af2
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
(cherry picked from commit 78e6eff04b7114b72f8534583e52ca9d7908f8b9)
radio: iris: Checking if driver's buffer is large enough.

Checking if driver's buffer is large enough to copy
the data from user space.

Change-Id: I7b4eed81cf77ce2973669ce18ccd95a5df397d82
CRs-fixed: 552329
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
(cherry picked from commit 3a4ebaac557a9e3fbcbab4561650abac8298a4d9)
ASoC: msm: q6: check upper bounds when copy ac3 params

Although AC3 maximum param size is fixed, better check upper bounds
when copy user data. It might cause overflow, possibly cause memory
corruption.

Change-Id: Iaded762f774c608e48e685d92204fc7516aa3063
Signed-off-by: Fred Oh <fred@codeaurora.org>
(cherry picked from commit 588b3416ba26e03c1f0680fc2d55dbeb69e13482)
ASoc: msm: qdsp6v2: add vm page offset validation

Lack of range validation can lead wrong mapping or expose arbitrary
memory page to userspace

Change-Id: I8c6eb1b7255d444bffd9d3748ca4815b11bdf16a
Signed-off-by: Fred Oh <fred@codeaurora.org>
(cherry picked from commit 0b5f49b360afdebf8ef55df1e48ec141b3629621)
input: synaptics_i2c_rmi4: Add check to avoid memory leak

Add conditions to check if fhandler already exists in the list
or not. If exists, then free the memory allocated to the new
fhandler. Otherwise add the fhandler to the list.
Change the location of INIT_LIST_HEAD() call to avoid
memory leak.

CRs-fixed: 575094
Signed-off-by: Shantanu Jain <shjain@codeaurora.org>
Change-Id: Iaf1429b911baffa53f968c0ca986fec190100ded
(cherry picked from commit 419bfc05e1aef0292f15385ec4419b3f09f361e9)
qseecom:  Check for case where listener service is not found

When listerner service is not in the list of registered listeners,
the resulting ptr will a NULL. Check for this case of NULL ptr
to indicate missing listener service.

Change-Id: I0d2c7b01143c40711f71bf434493ac5301314cf2
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
(cherry picked from commit 72aad6196ab9a3c993821430746c7598b2d7dc24)
qseecom: Remove debug  messages

Remove unnecessary debug  messages.

Change-Id: Ida80fbc1376f15753f8329c44550b14d8f4de163
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
(cherry picked from commit 667c0a9dba310670aa7e5df132a3568e2ee2af3b)
gpu: ion: use a list instead of a tree for heap debug memory map

Currently we use an rb tree to store information about the memory map
which gets passed to the heap print_debug functions. The reason for
using a tree instead of a simple list is to maintain sortedness as we
build the memory map. However, it can be necessary to store multiple
entries for the same address in the memory map since there can be
multiple clients with handles to the same buffer. This information is
interesting and useful but we currently can't store and display it since
the rb tree requires that the key used for sorting (the physical address
in this case) be unique. Fix this by replacing the rb tree with a linked
list. In order to maintain sorted output of the print_debug functions,
sort the list by physical address after fully building the list.

This also has the positive side-effect of simplifying the code and
making future print_debug methods less error-prone.

CRs-Fixed: 571918
Change-Id: I5b129fd809fb53c66042eab10d096238a34c2b20
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
(cherry picked from commit 0c2b6ffc91e8992485433161a43ced8df56f0386)
gpu: ion: fix locking issues in debug code

There are a few places in Ion where we are iterating over volatile rb
trees without proper locking. In some places the proper locking cannot
be added since it would require us to take locks in a different order
than they are taken in other places in Ion. Fix this by re-working some
of the debug code so that we can take locks in an allowed order.

One side-effect of the re-work is that the memory maps will now show
every client that has a handle to a particular region of memory, rather
than just showing the first one that we encounter. This will allow for
more accurate accounting and will give better insight as to who is
actually using the memory.

CRs-Fixed: 571918
Change-Id: Ia43e4dbc412cd480c828173f8c20b5095d87d858
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
(cherry picked from commit c0e75c877ed5873cf3de939e8b8f84148ae07dea)
gpu: ion: add locking to traversal of volatile rb tree

In ion_debug_heap_show we're iterating over an rb tree (dev->clients)
that could change while we're iterating. Fix this by taking the lock
that is used to control access to this tree.

CRs-Fixed: 571918
Change-Id: I6832e1e98e2d2a69fc653451d3752d43ec3ef269
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
(cherry picked from commit 4b9e86c03416fe8fe6d3b581966b98e26aafe3c2)
lib: spinlock_debug: increase spin dump timeout to one second

Increase spin dump timeout so that it is back in sync with the
upstream value.

Change-Id: I4b8896b69dadd66196090d86e40da89766b048e6
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
(cherry picked from commit 8717fa380711dd89e2a7dbe0a1a7669b33362499)