msm: ipa: fix delete dependency bug in IPA RM

Resource state was being passed instead of resource event
when notifying producer on delete_dependency. This will
cause client to ignore the "notification" and remain stuck
leading to completion timeout and BUG.

Change-Id: Idfc0e878c82de8dc86565fbbf03827acb3fb0478
Signed-off-by: Ravi Gummadidala <rgummadi@codeaurora.org>
USB: android: Handle error conditions if usb_add_config fails

When bind_config() of any function driver fails, we go ahead and do a
usb_gadget_connect() due to which remove_config is called during
next disconnect process and a crash is observed as we delete the
config->list once again.

So if the bind_config of any function driver fails, don't call
usb_gadget_connect(), instead handle the possible error conditions.

CRs-Fixed: 488052
Change-Id: I974e2838ef5c36e586f49ae783e8608150770883
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
ASoc: msm: qdsp6v2: add vm page offset validation

Lack of range validation can lead wrong mapping or expose arbitrary
memory page to userspace

Change-Id: I8c6eb1b7255d444bffd9d3748ca4815b11bdf16a
Signed-off-by: Fred Oh <fred@codeaurora.org>
wcnss: Fix Integer overflow

Integer overflow can lead to buffer
overflow in wcnss_wlan_write

Change-Id: I9e6f3439e1c8509bdb9c8c14b9aefe5611de8b03
CRs-Fixed: 547969
Signed-off-by: Arif Hussain <arifhussain@codeaurora.org>
Bluetooth: Replace sprintf with snprintf

Change will replace sprintf with snprintf, since sprintf is a
banned function.

CRs-FIxed: 548220
Change-Id: I32f5ab1f3707e5bbe43c31a7ad4611b67557b267
Signed-off-by: Juffin Alex Varghese <jalex@codeaurora.org>
msm: platform: qpnp-clkdiv: fix potential null pointer dereference

Add a return statement in the spmi resource null check in
qpnp_clkdiv_probe().  This is needed in order to avoid
dereferencing a null pointer in a subsequent statement.

Change-Id: Iaf5d5797016c96a136e93c8e5837f7f8f31d1e47
CRs-Fixed: 563655
Signed-off-by: David Collins <collinsd@codeaurora.org>
csdio: Remove the driver

The driver is a legacy driver that is not used any longer
and its implementation is neither correct nor compiles.

Change-Id: I9862c0f93ccad6079a616f6997987d4e187a137c
Signed-off-by: Hamad Kadmany <hkadmany@codeaurora.org>
defconfig: remove support for /dev/mem and /dev/kmem on perf builds

Keeping /dev/mem and /dev/kmem exposed to userspace allows userspace
to peek/poke to these areas and is a security risk. Remove support for
/dev/mem and /dev/kmem on perf builds.

Change-Id: Ibceabb7697bc220761aa55e028f0245037c7cc0c
CRs-Fixed: 530719
Signed-off-by: Sarang Joshi <spjoshi@codeaurora.org>
msm: ultrasound: add verifications of some input parameters

Some security vulnerabilities were found.
To fix them, additional verifications of some input parameters
are required.

CRs-Fixed: 554575, 554560, 555030
Change-Id: Ie87a433bcda89c3e462cfd511c168e8306056020
Signed-off-by: Baruch Eruchimovitch <baruche@codeaurora.org>
msm: ipc: Possible memory corruption due to Sign Conversion

msm_ipc_router_skb_to_buf() takes an unsigned argument and assigns the
same to a signed local variable. This might cause issues when the value
of the argument is too high.

Change the datatype of the local variable to unsigned.

CRs-Fixed: 550606
Change-Id: I257a095681dd82fba05367fd6faf25820e95c719
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
Merge "USB: android: Handle error conditions if usb_add_config fails"
USB: gadget: f_uac1.c: Fix bug in accessing freed buffer pointer

Current driver is accessing the buffer pointer after it is freed.
This results in target crash. Hence fix the bug by setting pointer
variable to NULL before it is freed.

CRs-Fixed: 564289
Change-Id: I4df7513748f4378f6adce682102c8ddd3811ead8
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
slim_ngd: Add NULL pointer check apart from error check.

Check against NULL pointer after allocating
the memory for msm_slim_ctrl structure pointer
dynamically to avoid unexpected crashes.

Earlier this pointer is checked only for error
codes. In this patch NULL pointer check is also
added.

CRs-Fixed: 562417
Change-Id: I5cd731144f88b89ee412d19f110b3df6426186f7
Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>
Signed-off-by: Vignesh Veeramani <quicvignes@codeaurora.org>
Merge "slim_ngd: Add NULL pointer check apart from error check."
Merge "msm: ipc: Possible memory corruption due to Sign Conversion"
Merge "csdio: Remove the driver"
Merge "Bluetooth: Replace sprintf with snprintf"
Merge "msm: platform: qpnp-clkdiv: fix potential null pointer dereference"
Merge "defconfig: remove support for /dev/mem and /dev/kmem on perf builds"
Merge "msm: ultrasound: add verifications of some input parameters"