net: flow_dissector: fail on evil iph->ihl

We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
is evil (less than 5).

This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
(rps: support IPIP encapsulation).

Cc: Eric Dumazet <edumazet@google.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ASoC: msm: Null dereference check added

In asm_read function we should check buffer pointer
before it is dererferenced.

CRs-Fixed: 612682
Change-Id: I1968c038e1d35381bf174000287d542441e41092
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
ASoC: msm: qdsp6v2: Fix ion_import failure

When ion_import_legacy api fails,we should not
destory the client instead just bail out.

CRs-Fixed: 620370
Change-Id: Icbcf4dadd5f00e1cf4d7a356ee1c0f5835dcb4c4
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
msm: mdss:Sanitize post processing inputs.

Sanitize the inputs to histogram, assertive display, and calibration buffer
so that invalid values cannot be used as feature configuration.

CRs-Fixed: 516710
Change-Id: Ifb585174b1baadbac628f53fe67f3c3b3ae61a54
Signed-off-by: Carl Vanderlip <carlv@codeaurora.org>
Signed-off-by: Venkata Aravind <venkata@codeaurora.org>
msm: mdss: Sanitize read of panel properties.

Check panel property's values properly before operating on
them.

CRs-Fixed: 562887
Change-Id: I26ce51e8b3a8e9328e7b6370b9c56d67fcdd1901
Signed-off-by: Mayank Chopra <makchopra@codeaurora.org>
Signed-off-by: Yogesh Lal <ylal@codeaurora.org>
msm: vidc: add input parameter checks to exported functions

Check for invalid null parameter passed to functions

CRs-Fixed: 606467
Change-Id: I860ca3d69d8705c7b3d6f27f9504b567be5aeea3
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: qdsp6v2: Increase max ports in APR

Increase the maximum ports in APR. Some Apps may support
multiple clients which exceeds the number of clients
supported in APR. This change increases number of ports
used in APR upto 8 sessions.

Change-Id: I06624330845681b4414dd470ab7aed669d690ba0
Signed-off-by: Aravind Kumar <akumark@codeaurora.org>
lib/scatterlist: error handling in __sg_alloc_table()

I was reviewing code which I suspected might allocate a zero size SG
table.  That will cause memory corruption.  Also we can't return before
doing the memset or we could end up using uninitialized memory in the
cleanup path.

Change-Id: Icee6be8ea22644d7f16264d9d2a0887c7145996b
CRs-Fixed: 611562
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
msm: vidc: add input check for hfi q6 function

The input parameters may be null. This change adds input checks at
function q6_hfi_iface_eventq_read.

CRs-Fixed: 606516
Change-Id: I801a9d3249e9b97fa218fc29bc3a2a0e7a0d4d3f
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
[media] v4l2-ioctl.c: handle PREPARE_BUF like QUERYBUF

The core code for PREPARE_BUF didn't take the multiplanar case into
account, which might cause page faults. Handle PREPARE_BUF just like
QUERYBUF and QBUF/DQBUF.

Change-Id: Ida7f712edec32568a8c2651d54b160121009a9c4
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Srinu Gorle <sgorle@codeaurora.org>
CRs-Fixed: 637365
soc: qcom: smd: Validate read and write addresses

The address from which data has to be read and the address to which the
SMD data has to be written is calculated based on the head and tail
indices for that SMD FIFO. If the indices are corrupted, then the
calculated pointer may be outside of the FIFO and may even be outside of
the range of SMEM.

Validate the read and write addresses to be with in the limits of
receive and send FIFO limits respectively.

CRs-Fixed: 550527
Change-Id: Ie5578f6aee73ea2b1435fea7c2a0a6dda14bff82
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
msm: vidc: rewrite v4l2 cluster construction

V4L2 framework has limitation of not supporting
same control in multiple clusters. Overcome this
limitation by grouping all controls into one
super cluster.

Change-Id: I974199e1388a1b33ae5e56edd4b0af712eb9babf
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: Venkata Aravind <venkata@codeaurora.org>
msm: vidc: fix a race condition in cluster construction

At start of video session, when the super cluster is
constructed, it refers to a global static variable.
If we have multiple instances running simultaneously,
there exists a race condition, causing the instance
to register wrong cluster. Later on when a control
gets set in encoder, if the control is not found in
the cluster, we hit a BUG_ON, crashing the device.

Change-Id: Ib4ee64d684d903bb4f22310a1b34619728405649
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: Venkata Aravind <venkata@codeaurora.org>
msm: kgsl: don't use sscanf()

Friends do not let friends use sscanf().

CRs-Fixed: 563605
Change-Id: Ic0dedbad56af5bbee4fc833701d8bc93b118efa9
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Merge "ASoC: msm: qdsp6v2: Fix ion_import failure"
Merge "soc: qcom: smd: Validate read and write addresses"
Merge "msm: mdss: Sanitize read of panel properties."
Merge "ASoC: msm: Null dereference check added"
Merge "lib/scatterlist: error handling in __sg_alloc_table()"
Merge "msm: kgsl: don't use sscanf()"