msm_seial_hs:Removing call to Spin unlock twice

During Clock_on() spin_unlock() is called twice.
This patch makes sure that spin_unlock is not
called twice

CRs Fixed: 546205
Change-Id: Id2cf3d52f94d3773de9206d22bcfa9075615902b
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
ASoC: wcd9304:Fix RX voice in handset call distort after reboot the device

Issue:The RX voice in handset call will distorted from handset after
      reboot the device
Root cause:This happens due enable override gain in cp_static register.

Fix:Configure the cp_static override gain as Half gain.

Change-Id: I9addb8650fad5a1169bf1afb8e63f1eac4163514
CRs-Fixed: 532155
Signed-off-by: Satish Kamuju <skamuj@codeaurora.org>
msm: mhl: 8334: Initialize return value

Initialize the variable holding the return code to
appropriate error value so that an incorrect return
code isn't sent  to the caller.

Change-Id: I38192e5503750113de62494f3bd512819d7d8b76
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
msm: audio: qdsp6v2: Zero the cfg stack var

Write zeroes into the stack variable cfg to ensure
no previously written stack data is sent to
user-space.

Change-Id: Iea124d2528ed56d93e2a000027ff8bc30414d3fd
CRs-Fixed: 551574
Signed-off-by: Kenneth Westfield <kwestfie@codeaurora.org>
msm: audio: qdsp6v2: Change acdb_mmap size variable to unsigned

The acdb_mmap fuction does a size calculation but
stores the result in an int which makes negitive
numbers possible. Changing the variable to unsigned
ensures that the size used is never out of bounds.

Change-Id: I78714044594310a4411db1f50456e1294cf6ffce
CRs-fixed: 548145
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
ASoC: msm: qdsp6v2: Copy frame data based on frame length

Copying data based on count will result in copying
uninitialized data to userspace which can potentially
disclose sensitive data. Fix by copying data based on
frame instead.

CRs-Fixed: 552528, 552531
Change-Id: I307b285ef2aefe00b953cf650582e9ff7e03ceb1
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
ASoC: msm: qdsp6v2: Fix buffer overflow in voice driver

Userspace registers calibration data with acdb driver
through ioctls. Voice driver registers the calibration
data with CVD by querying acdb data from acdb driver and
copies the calibration data in apr message.

The size of the calibration data can be controlled by userspace
and can result in buffer overflow if the calibration size is
greater than the destination buffer size.
Reject acdb data if the size is greater than the size of
destination buffer.

Change-Id: I1b495390d67907afc608ed8233bf916777d38e11
CRs-fixed: 548872
Signed-off-by: Shiv Maliyappanahalli <smaliyap@codeaurora.org>
msm: vidc: Use min_dpb from resource tracker in smooth streaming mode

Get min_dpb from resource tracker always if smooth streaming
mode is enabled to handle number of output buffers properly.

Change-Id: Ic46f76061f3895fda44e1d8e94198f898e5edf9b
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
Revert "msm_fb: display: delay commit video tile frame size register"

This reverts commit 7a71e5fdabb38c2bdfc3da56ea30b38450414714.

Change-Id: I90024840845cc508ea2feace2a5e84e6f9f32e89
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
radio: iris: Checking if driver's buffer is large enough.

Checking if driver's buffer is large enough to copy
the data from user space.

Change-Id: I7b4eed81cf77ce2973669ce18ccd95a5df397d82
CRs-fixed: 552329
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
msm: vidc: Initialize kernel space stack variables

This change initializes kernel space stack variables
that are passed between kernel space and user space
using ioctls.
Non initialization of these variables may lead to
leakage of memory values from the kernel stack to
user space.

Change-Id: Icb195470545ee48b55671ac09798610178e833e1
CRs-fixed: 556771,563420
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: msm_fb: Fix Regressions because of overmap changes.

Previous MDP overmap change is causing issues with HDMI because of
assumptions about overmap. This patch fixes all such issues.

Change-Id: Ifd2f8a0596d9df08538464bdcdd5946cf84db4d9
Signed-off-by: Vishnuvardhan Prodduturi <vproddut@codeaurora.org>
msm: vidc: Check validity of userspace address

Before writing to a userspace address, verification
of the validity of user space address is required.

Change-Id: I9141e44a6c11aaf3f4d57c08bb0dd26a7b214f34
CRs-fixed: 556356
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm_fb:hdmi:Fix for audio not routed to HDMI issue

Due to recent security fixes, in HDMI VSD block
parsing is failing which is causing driver to
consider the HDTV connected as DVI and hence no
audio is routed to TV. So removing the incorrect
length check in hdmi_edid_extract_ieee_reg_id function

Change-Id: Iea4a0969710ee1f4411b14973e7d1678f81183cc
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
Merge "msm: msm_fb: Fix Regressions because of overmap changes."
Merge "msm: mhl: 8334: Initialize return value"
Merge "msm: vidc: Check validity of userspace address"
ARM: 7809/1: perf: fix event validation for software group leaders

It is possible to construct an event group with a software event as a
group leader and then subsequently add a hardware event to the group.
This results in the event group being validated by adding all members
of the group to a fake PMU and attempting to allocate each event on
their respective PMU.

Unfortunately, for software events wthout a corresponding arm_pmu, this
results in a kernel crash attempting to dereference the ->get_event_idx
function pointer.

This patch fixes the problem by checking explicitly for software events
and ignoring those in event validation (since they can always be
scheduled). We will probably want to revisit this for 3.12, since the
validation checks don't appear to work correctly when dealing with
multiple hardware PMUs anyway.

Change-Id: Ic1722ba7463c9836f1ff595d7e8da1d0fc0e32b0
Cc: <stable@vger.kernel.org>
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Tested-by: Vince Weaver <vincent.weaver@maine.edu>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: c95eb3184ea1a3a2551df57190c81da695e2144b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[joonwoop@codeaurora.org: fixed merge conflict]
CRs-fixed: 529735
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
ARM: 7810/1: perf: Fix array out of bounds access in armpmu_map_hw_event()

Vince Weaver reports an oops in the ARM perf event code while
running his perf_fuzzer tool on a pandaboard running v3.11-rc4.

Unable to handle kernel paging request at virtual address 73fd14cc
pgd = eca6c000
[73fd14cc] *pgd=00000000
Internal error: Oops: 5 [#1] SMP ARM
Modules linked in: snd_soc_omap_hdmi omapdss snd_soc_omap_abe_twl6040 snd_soc_twl6040 snd_soc_omap snd_soc_omap_hdmi_card snd_soc_omap_mcpdm snd_soc_omap_mcbsp snd_soc_core snd_compress regmap_spi snd_pcm snd_page_alloc snd_timer snd soundcore
CPU: 1 PID: 2790 Comm: perf_fuzzer Not tainted 3.11.0-rc4 #6
task: eddcab80 ti: ed892000 task.ti: ed892000
PC is at armpmu_map_event+0x20/0x88
LR is at armpmu_event_init+0x38/0x280
pc : [<c001c3e4>]    lr : [<c001c17c>]    psr: 60000013
sp : ed893e40  ip : ecececec  fp : edfaec00
r10: 00000000  r9 : 00000000  r8 : ed8c3ac0
r7 : ed8c3b5c  r6 : edfaec00  r5 : 00000000  r4 : 00000000
r3 : 000000ff  r2 : c0496144  r1 : c049611c  r0 : edfaec00
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: aca6c04a  DAC: 00000015
Process perf_fuzzer (pid: 2790, stack limit = 0xed892240)
Stack: (0xed893e40 to 0xed894000)
3e40: 00000800 c001c17c 00000002 c008a748 00000001 00000000 00000000 c00bf078
3e60: 00000000 edfaee50 00000000 00000000 00000000 edfaec00 ed8c3ac0 edfaec00
3e80: 00000000 c073ffac ed893f20 c00bf180 00000001 00000000 c00bf078 ed893f20
3ea0: 00000000 ed8c3ac0 00000000 00000000 00000000 c0cb0818 eddcab80 c00bf440
3ec0: ed893f20 00000000 eddcab80 eca76800 00000000 eca76800 00000000 00000000
3ee0: 00000000 ec984c80 eddcab80 c00bfe68 00000000 00000000 00000000 00000080
3f00: 00000000 ed892000 00000000 ed892030 00000004 ecc7e3c8 ecc7e3c8 00000000
3f20: 00000000 00000048 ecececec 00000000 00000000 00000000 00000000 00000000
3f40: 00000000 00000000 00297810 00000000 00000000 00000000 00000000 00000000
3f60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
3f80: 00000002 00000002 000103a4 00000002 0000016c c00128e8 ed892000 00000000
3fa0: 00090998 c0012700 00000002 000103a4 00090ab8 00000000 00000000 0000000f
3fc0: 00000002 000103a4 00000002 0000016c 00090ab0 00090ab8 000107a0 00090998
3fe0: bed92be0 bed92bd0 0000b785 b6e8f6d0 40000010 00090ab8 00000000 00000000
[<c001c3e4>] (armpmu_map_event+0x20/0x88) from [<c001c17c>] (armpmu_event_init+0x38/0x280)
[<c001c17c>] (armpmu_event_init+0x38/0x280) from [<c00bf180>] (perf_init_event+0x108/0x180)
[<c00bf180>] (perf_init_event+0x108/0x180) from [<c00bf440>] (perf_event_alloc+0x248/0x40c)
[<c00bf440>] (perf_event_alloc+0x248/0x40c) from [<c00bfe68>] (SyS_perf_event_open+0x4f4/0x8fc)
[<c00bfe68>] (SyS_perf_event_open+0x4f4/0x8fc) from [<c0012700>] (ret_fast_syscall+0x0/0x48)
Code: 0a000005 e3540004 0a000016 e3540000 (0791010c)

This is because event->attr.config in armpmu_event_init()
contains a very large number copied directly from userspace and
is never checked against the size of the array indexed in
armpmu_map_hw_event(). Fix the problem by checking the value of
config before indexing the array and rejecting invalid config
values.

Change-Id: I77c21164fc0f57f8a44dd0bcc7d00b51998669f6
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Tested-by: Vince Weaver <vincent.weaver@maine.edu>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: d9f966357b14e356dbd83b8f4a197a287ab4ff83
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
CRs-fixed: 561044
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
msm_fb:hdmi:Fix for CTS failure.

The audio_caps sysfs node has write permission
as S_IWOTH which is not allowed as per CTS test case.
So change the permission to S_IWUSR.

Change-Id: Ia1ff6801ecf42b50932194e344f92159a3690a50
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>