msm: camera: Cleanup msm generic buf queue handling

Clean-up the msm camera generic buff queue when all
client closes the handle and also provide init-deinit
ioctl for cpp to open-close the buff mngr handle.

Change-Id: Ie484174e0ffaee02e85c9c9cda8ac26103aaddd0
CRs-Fixed: 582261
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: camera2: cpp: Release vb2 buffer in cpp driver on error

When duplicate output is enabled, there is potential issue if
error is encountered in second output buffer. Under error condition
related to second output buffer is hit, the first output buffer is
not released properly.

Change-Id: I56f375a5783c54c450f5673818d15b393f469ef1
Signed-off-by: Rajakumar Govindaram <rajakuma@codeaurora.org>
msm: Remove old unused sdio related code

Cleanup mach-msm by removing unused sdio related code.

Change-Id: I485deb7d6499771294b494f5542ba510c10255cb
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
mmc: card: fix arbitrary write via read handler in mmc_block_test

In mmc_block_test, the debug_fs based read function handlers write to an
arbitrary buffer which is given by any user. We add an access_ok check
to verify that the address pointed by *buffer is not in kernel space.
Only if the buffer is valid, do we continue the read handler.

Change-Id: I35fe9bb70df8de92cb4d3b15c851aa9131a0e8d9
Signed-off-by: Lee Susman <lsusman@codeaurora.org>
mmc: card: fix arbitrary write via read handler in mmc_block_test

In mmc_block_test, the debug_fs based read function handlers write to an
arbitrary buffer which is given by any user. We add an access_ok check
to verify that the address pointed by *buffer is not in kernel space.
Only if the buffer is valid, do we continue the read handler.

Change-Id: I35fe9bb70df8de92cb4d3b15c851aa9131a0e8d9
Signed-off-by: Lee Susman <lsusman@codeaurora.org>
msm: ipc: Possible memory corruption due to Sign Conversion

msm_ipc_router_skb_to_buf() takes an unsigned argument and assigns the
same to a signed local variable. This might cause issues when the value
of the argument is too high.

Change the datatype of the local variable to unsigned.

CRs-Fixed: 550606
Change-Id: I257a095681dd82fba05367fd6faf25820e95c719
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
radio: iris: Removed reference to user provided pointer.

Removed reference to user provided capability structure
pointer.

Change-Id: If372f0069a90549ab0f53759ea85e171a1265e21
CRs-fixed: 539042
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
radio: iris: Prevent probable overflow

casting a unsigned int into an integer, integer to
unsigned int may cause buffer overflow.

Change-Id: I54be4d4c5470616a59a772c587fe6d5f32575c32
CRs-Fixed: 539008
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
radio: iris: Use kernel API to copy data from user space

Use copy_from_user kernel api to copy any data from user space
to kernel space.

Change-Id: Ia3b7bb0f98180bd8792c1c18e930cb5609b8dc82
CRs-Fixed: 540320
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
msm: qdsp6v2: NULL pointer check on userspace data argument in kernel

The null pointer check is required to ensure that userspace data
in kernalspace is not null.

Change-Id: I9e522c393ae643626a4bae03731a73f5d6db6458
CRs-Fixed: 563752
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
msm: qdsp6v2: NULL pointer check on userspace data argument in kernel

The null pointer check is required to ensure that userspace data
in kernalspace is not null.

Change-Id: I9e522c393ae643626a4bae03731a73f5d6db6458
CRs-Fixed: 563752
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
msm: rpm-smd: use data type correctly for a variable

Change variable data type from signed int to unsigned int.

CRs-fixed: 556055
Change-Id: I6bb363b31d4fab26d84f89e775101c6051fe9e10
Signed-off-by: Anil kumar mamidala <amami@codeaurora.org>
msm: rpm-smd: use data type correctly for a variable

Change variable data type from signed int to unsigned int.

CRs-fixed: 556055
Change-Id: I6bb363b31d4fab26d84f89e775101c6051fe9e10
Signed-off-by: Anil kumar mamidala <amami@codeaurora.org>
radio: iris: Allow task to be interrupted

Not allowing task to be interrupted can cause
delay in response to upper layer. Allow task pending
to be interrupted when corresponding command's status
is received.

Change-Id: I1ff383327b646042b1f1e66547eda6900186710b
CRs-Fixed: 569318
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
ARM: dts: msm: fix ssd2080m pixel corruption issue

There's pixel corruption issue on the right corner of
ssd2080m with current panel setting, vendor suggests to
update porch and gate setting to address this issue.

CRs-fixed: 591272
Change-Id: Ibff3312b4dd89867ca2b4b882d62315b39dd4ec7
Signed-off-by: Ray Zhang <rayz@codeaurora.org>
msm: Remove files no longer buildable under arch/arm/mach-msm

Removed the files to reduce efforts as we move driver code out of mach-msm

Change-Id: Ibe2107ae91cb282d0c9f3e7f564f50b6f7f8694f
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
Merge "ARM: dts: msm: fix ssd2080m pixel corruption issue"
msm: camera: Fix possible NULL pointer dereference.

The result of memory allocation in msm_isp_get_buf is not checked for
success before use. This can lead to NULL pointer dereference.

Change-Id: I83cb56bbcd5e7526bf57a6de1077a30f9a2b5349
Signed-off-by: Petar Sivenov <psiven@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
msm: camera: Fix possible NULL pointer dereference.

The result of memory allocation in msm_isp_get_buf is not checked for
success before use. This can lead to NULL pointer dereference.

Change-Id: I83cb56bbcd5e7526bf57a6de1077a30f9a2b5349
Signed-off-by: Petar Sivenov <psiven@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
Bluetooth: Replace sprintf with snprintf

Change will replace sprintf with snprintf, since sprintf is a
banned function.

CRs-FIxed: 548220
Change-Id: I32f5ab1f3707e5bbe43c31a7ad4611b67557b267
Signed-off-by: Juffin Alex Varghese <jalex@codeaurora.org>