radio: tavarua: Added NULL checks for input arguments.

Added NULL checks for input arguments.

Change-Id: Ie39c2b3254c95925723735423c81b99da59ee6ad
CRs-fixed: 548405
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
msm: rpm-smd: use data type correctly for a variable

Change variable data type from signed int to unsigned int.

CRs-fixed: 556055
Change-Id: I6bb363b31d4fab26d84f89e775101c6051fe9e10
Signed-off-by: Anil kumar mamidala <amami@codeaurora.org>
USB: gadget: f_uac1.c: Fix bug in accessing freed buffer pointer

Current driver is accessing the buffer pointer after it is freed.
This results in target crash. Hence fix the bug by setting pointer
variable to NULL before it is freed.

CRs-Fixed: 564289
Change-Id: I4df7513748f4378f6adce682102c8ddd3811ead8
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
ASoC: msm: Add Buffer overflow check

The overflow check is required to ensure that user space data
in kernel may not go beyond buffer boundary.

Change-Id: I7d94a209c0b8818bfb9c65f8c13a5f5e36c49e2d
CRs-Fixed: 563086
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
msm: camera: Bound check num_cid from userspace in csid driver

Upper and lower bound checks are enforced for num_cid
which is passed from userspace with lower as 1 and
max of 16.

Change-Id: Ic5456289cb2f2b4ea17610a7672eb2c5225b7954
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: kgsl: Handle failure of find_process_private()

Handle the case of NULL return from find_process_private() upon
its failure by failing from get_process_private().

Change-Id: Id42ae795d140bd67d8a36496f840387858e5f779
Signed-off-by: Harsh Vardhan Dwivedi <hdwivedi@codeaurora.org>
uio: provide vm access to UIO_MEM_PHYS maps

This makes it possible to let gdb access mappings of the process that is
being debugged.

uio_mmap_logical was moved and uio_vm_ops renamed to group related code
and differentiate to new stuff.

CRs-Fixed: 570735
Change-Id: I8a5ff343727cc58fedfeb73f3466cc9a7f153e84
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 7294151d0592e0ff48c61fca9fd7c93d613134da
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
fbmem: Check failure of FBIOPUTCMAP ioctl

On FBIOPUTCMAP ioctl failure deallocate
fb cmap. Put null check for cmap red, green,
blue component.

Change-Id: I10468ee30d0e76c256cf3d7a6ffe14db7fd4511b
Signed-off-by: Pawan Kumar <pavaku@codeaurora.org>
Fix a few incorrectly checked [io_]remap_pfn_range() calls

Nico Golde reports a few straggling uses of [io_]remap_pfn_range() that
really should use the vm_iomap_memory() helper.  This trivially converts
two of them to the helper, and comments about why the third one really
needs to continue to use remap_pfn_range(), and adds the missing size
check.

CRs-Fixed: 570735
Change-Id: I927a67ea80fea5ed706749ead9defb1e72633952
Reported-by: Nico Golde <nico@ngolde.de>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org.
Git-commit: 7314e613d5ff9f0934f7a0f74ed7973b903315d1
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
[pratibha@codeaurora.org:resolve trivial merge conflicts]
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
msm: qdsp6v2: memset stack buffer allocation.

This is needed to avoid garbage data in uninitialized variables.

Change-Id: I20e56ee32d3b9d1eecc4fa7761ff164a210fbbde
CRs-Fixed: 561611
CRs-Fixed: 561615
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
radio: tavarua: Fixes for memory leaks.

Freeing memory allocated in case of failures.

Change-Id: I323b9c414d725d6b9dc0698e2ed03ef9c2450e5f
CRs-fixed: 557048
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
radio: tavarua: Fix buffer overflow.

Removed improper typecasting to fix buffer overflow.

CRs-fixed: 554963

Change-Id: Ie3ae5a502f060c13eba7cb5c28a1af389b772af2
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
msm: camera: Checking an enum value greater than zero

An enum value cci_i2c_master is not checked to be greater than 0.
Add the check.

Change-Id: Ibe75ab7155def45d81b8127c5eda3fa2ed570bce
Signed-off-by: Xu Han <hanxu@codeaurora.org>
mmc: block: check for NULL pointer before dereferencing

mmc block data can be NULL. Hence, check for NULL before
dereferencing md.

CRs-Fixed: 562259
Change-Id: I0182c216ec73347cdd2ea464f593839fffd242a9
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
diag: Safeguard for bound checks and integer underflow

At certain point in diag driver there can be integer underflow
and thus can lead to memory leak. Bound checks are placed to
ensure correct behavior of condition statements.

Change-Id: I47e02f764c2c7412db6f90fd42192fee32a761d3
CRs-fixed: 549470
Signed-off-by: Katish Paran <kparan@codeaurora.org>
crypto: msm: ota: fix possible buffer overflow issue

This patch replaces snprintf with scnprintf to prevent
possible buffer overflow issues

CRs-Fixed: 562347

Change-Id: I56aebd24557dccc547ff86cb8853ace0602b6e50
Acked-by: Radhakrishna Popuri <c_rpopur@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
misc: qfpfuse: Fix overflow condition

Fix potential integer overflow for ioctl command to avoid incorrect
buffer allocation. Use the stack for data buffering to avoid the
small buffer allocation for improved performance. Increase the fuse
blow timeout in the driver to cover all QFPROM implementations.

CRs-Fixed: 550574,550575

Change-Id: Iee3cc1d38aa5dbf8ef693a43a0ca716fc8724c62
Acked-by: Radhakrishna Popuri <c_rpopur@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
ASoC: msm: Add check for both offset and index variable

-The offset and index variable may leads to array out of
boundary exception.
-Added offset and index overflow check.

Change-Id: I1f71ee595944573e85d77d2001f656bd8ba53806
CRs-fixed: 583931
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
[media] media: Init the reserved fields of struct media_link_desc

struct media_link_desc is copy_to_user'ed as the return value of
MEDIA_IOC_ENUM_LINKS. When copying, the driver is omitting to initialise
the reserved fields.  This commit fixes that by initialising the
reserved fields to 0.

CRs-Fixed: 570757
Change-Id: I230e2666c0845cc36399518a0f2c94db664382d1
Signed-off-by: Rajeshwar Kurapaty <rkurapat@codeaurora.org>
Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>
radio: iris: Checking if driver's buffer is large enough

Checking if driver's buffer is large enough to copy
the data from user space.

Change-Id: I7b4eed81cf77ce2973669ce18ccd95a5df397d82
CRs-fixed: 552329
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
Signed-off-by: Akhila Musunuri <makhila@codeaurora.org>