msm: kgsl: Verify the user address before reading a perfcounter group

In adreno_perfcounter_read_group some user input verification is
occuring on a user pointer before copy_from_user is called
resulting in a possible segmentation fault if called with improper
input data.

CRs-fixed: 553314
Change-Id: Ic0dedbad4c5e4b2610368d51ff591d1f716712f4
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: bam_dmux: Revert "msm: bam_dmux: Reverts commit causing crash after data enable"

Fail to access the BAM register while BAM HW reset causing drivers
to enter unknow state and crash the system after enabling the data call.

This reverts commit a1ece5a22d0403581910e8ceb78f63cd1b8be832 to re-apply
all CR fixes and avoid the BAM HW reset while BAM DMUX disconnect.

Change-Id: Ib97ce3bb01aa39c0703be6e2466c84ab0083b6fb
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
msm: Remove old unused sdio related code

Cleanup mach-msm by removing unused sdio related code.

Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
wcnss: Fix Integer overflow

Integer overflow can lead to buffer
overflow in wcnss_wlan_write

Change-Id: I9e6f3439e1c8509bdb9c8c14b9aefe5611de8b03
CRs-Fixed: 547969
Signed-off-by: Arif Hussain <arifhussain@codeaurora.org>
 ASoC: Fix for incorrect removal detection of headphone

 - Resume of FM playback takes about 5 seconds after end
  of voice call.Since the mic voltage is greater than
  the max headset voltage, a removal interrupt is triggered.
 - Increased the max voltage to fix this issue.

CRs-Fixed: 583301

Change-Id: Ic2381baecf48c9942b6c952bae60dfaa10c03425
Signed-off-by: Shreyas Nagasandra Chandrasekhar <snagas@codeaurora.org>
msm-camera: Validate VFE command id

Validating VFE command id to avoid memory related corruptions.

Change-Id: I35ce2ed8514e0112b996ce05be6e6f505cdb6e60
CRs-Fixed: 563542
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>

Conflicts:
	drivers/media/video/msm/vfe/msm_vfe32.c
msm: audio: initialize the structure before sending to user space

If uninitialzied structure is passed from kernel to user space, it
may contain contain sensitive information that will be leaked.

CRs-fixed: 550054
Change-Id: I2e93ed20898e0dc804aa1ffe6791f0cfddfba288
Signed-off-by: Fred Oh <fred@codeaurora.org>
ASoc: msm: qdsp6v2: Fix for NULL check

- Required check added for NULL pointer

Change-Id: I204dddb37048ba410381e46c0e906d0390951dd9
CRs-fixed: 583939
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
diag: dci: Preventing unitialized stack memcpy operation

At certain point in diag driver there can be memcpy operation
for the unintialized stack. Due to uninitilization of memory
user can obatin valuable information on accessing this stack
in userspace. This patch fixes that issue.

Change-Id: I4bfcf156300132dc426dcadce325e0c76c1d0357
CRs-fixed: 565808
Signed-off-by: Katish Paran <kparan@codeaurora.org>
wcnss: Trigger WCNSS driver on first open.

WCNSS driver requires a trigger followed by an open, this is to support
the trigger from an external script. However, startup scripts are no
more supported; and wcnss service should always trigger this driver. So
the first open to this driver (that is from wcnss service), should also
trigger the driver.

Change-Id: I843c044d4fa452ca541a62255bbcb33b9d7f6eb0
CRs-fixed: 611763
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
Signed-off-by: Hardik Kantilal Patel <hkpatel@codeaurora.org>
msm: Make CONFIG_STRICT_MEMORY_RWX even stricter

If CONFIG_STRICT_MEMORY_RWX was set, the first section (containing
the kernel page table and the initial code) and the section
containing the init code were both given RWX permission, which is
a potential security hole.

Pad the first section after the initial code (which will never
be executed when the MMU is on) to make the rest of the kernel
text start in the second section and make the first section RW.

Move some data which had ended up in the "init text"
section into the "init data" one, as this is RW, not RX.
Make the "init text" RX.

We will not free the section containing the "init text",
because if we do, the kernel will allocate memory for RW data there.

Change-Id: I6ca5f4e07342c374246f04a3fee18042fd47c33b
CRs-fixed: 513919
Signed-off-by: Larry Bassel <lbassel@codeaurora.org>

Conflicts:
	arch/arm/mm/init.c
msm: qdsp6v2: Deleting kernel driver from arch/arm/mach-msm/qdsp6v2

Driver is registering under misc driver but exists under arch/arm/mach

Change-Id: I1c8cff14a48550d1089593b28de7023160184cf0
CRs-Fixed: 548017
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
uio: provide vm access to UIO_MEM_PHYS maps

This makes it possible to let gdb access mappings of the process that is
being debugged.

uio_mmap_logical was moved and uio_vm_ops renamed to group related code
and differentiate to new stuff.

CRs-Fixed: 570735
Change-Id: I8a5ff343727cc58fedfeb73f3466cc9a7f153e84
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 7294151d0592e0ff48c61fca9fd7c93d613134da
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
Fix a few incorrectly checked [io_]remap_pfn_range() calls

Nico Golde reports a few straggling uses of [io_]remap_pfn_range() that
really should use the vm_iomap_memory() helper.  This trivially converts
two of them to the helper, and comments about why the third one really
needs to continue to use remap_pfn_range(), and adds the missing size
check.

CRs-Fixed: 570735
Change-Id: I927a67ea80fea5ed706749ead9defb1e72633952
Reported-by: Nico Golde <nico@ngolde.de>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org.
Git-commit: 7314e613d5ff9f0934f7a0f74ed7973b903315d1
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
[pratibha@codeaurora.org:resolve trivial merge conflicts]
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>

Conflicts:
	drivers/uio/uio.c
	drivers/video/au1100fb.c
	drivers/video/au1200fb.c
diag: dci: Index DCI client table by client id

Diag driver maintains a table of all DCI clients. This table
is currently indexed by the PID of the clients. Make changes
to index the table base on an unique client id.

Change-Id: I57bfab9eae1381882b8eb6270d7ac212e0aaf271
CRs-fixed: 590721
Signed-off-by: Katish Paran <kparan@codeaurora.org>
diag: dci: Safeguard to prevent integer overflow

At certain point in diag driver there can be integer overflow
thus can lead to memory leak. Added a safegaurd for it.

Change-Id: I9347405d8f1f95ed42fe0abf35cbf4c362281bdf
CRs-fixed: 565160
Signed-off-by: Katish Paran <kparan@codeaurora.org>
diag: Safeguard for bound checks and integer underflow

At certain point in diag driver there can be integer underflow
and thus can lead to memory leak. Bound checks are placed to
ensure correct behavior of condition statements.

Change-Id: I47e02f764c2c7412db6f90fd42192fee32a761d3
CRs-fixed: 549470
Signed-off-by: Katish Paran <kparan@codeaurora.org>
diag: dci: Safeguard to prevent Integer Underflow and Memory Leak

At certain point in diag driver there can be integer underflow
thus can lead to memory leak. Added a safeguard for that.

Change-Id: I2a0304f5b9888fe12ca9ef5fbaa9a68ee4ab9c15
Crs-fixed: 556860
Signed-off-by: Katish Paran <kparan@codeaurora.org>
diag: Fix for diag debugfs buffer overflow

Diag debugfs buffer has potential buffer overflow scenario which can cause
memory corruption. Added safeguard to prevent this.

Crs-fixed: 585147
Change-Id: Ie1f099bb4bb626adff99ae225966aef70c1bc15e
Signed-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>
WLAN subsystem: Sysctl support for key TCP/IP parameters

It has been observed that default values for some of key tcp/ip
parameters are affecting the tput/performance of the system. Hence
extending configuration capabilities to TCP/Ip stack through
sysctl interface.

Change-Id: I0c99d5b50cbe0d6496e40d391eacc12b0c62dbed
CRs-Fixed: 507581
Signed-off-by: Mahesh A Saptasagar <msapta@codeaurora.org>