msm:camera: Initialize a structure before usage

Initialize a structure using memset such that it is
populated properly before returning to userspace.

CRs-fixed: 550567
Change-Id: I2b3c78cd2b309de13acf2811fcc16b8bc04fa052
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
msm:camera: Initialize the structure before to pass userspace.

Initialize the structure by memset so that value will pass to
proper to usersapce.

CRs-fixed: 554845
Change-Id: I4adf4bf1bb6e45e16f5fd2e26a74232e6ee7f8bd
Signed-off-by:Vivek Singh<vising@codeaurora.org>
msm:camera: Bounds and validity check for params

Check the range and validity of parameters before accessing.
CRs-fixed: 550607, 554434, 554436
Change-Id: I2d6aec4f9cb9385789c0df6a2c4abefe9e87539f
Signed-off-by: Alok Kediya <kediya@codeaurora.org>

Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm-camera: Fix buffer overflow issue

Tainted length value is used to copy data
which can result in a heap-based buffer overflow

Change-Id: I9f1fa1bd52a78ed48356b9122d8e17b8c74110b3
CRs-Fixed: 547934
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>
msm-camera: Fix to prevent kernel heap buffer overflow in actuator

Fix to prevent kernel heap buffer overflow allows user
controlled data to be written to the heap via the
msm_camera actuator IOCTLs

Change-Id: I5d511e8c1aa2f76f4209a6712a58d8757bc53367
CRs-Fixed: 545979
Signed-off-by: Katta Santhisindhu <kattas@codeaurora.org>

Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm:camera: Copy data from user to kernel space before access

This would avoid any invalid access of data.

CRs-fixed: 550608
Change-Id: I30993a9bc731227e72f3be34874505f01357f04d
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
Signed-off-by: Monika Alekhya <malekh@codeaurora.org>
msm: camera: prevent invalid access through mmap

Disable access to invalid addresses through mmap.
Add appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

Change-Id: Ie053d9d8efe951b88f28b020dd9c2356e54723a7
CRs-Fixed: 475794
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
ASoC:msm:qdsp5: Checks to avoid buffer overflow.

This is needed to avoid buffer over flow, when userspace data in
kernel may go beyond buffer boundary.

Change-Id: Ib23fdc5b30a10a2c24d89816b457641583544f52
CRs-Fixed: 550177
CRs-Fixed: 550181
CRs-Fixed: 550196
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
net-fixes: flow_dissector: prevent an infinite loop (CVE-2013-4348)

Jason Wang found that a malicious packet could make skb_flow_dissect()
loop forever. We must check that IP header has a valid ihl to avoid
this loop. It involves IPIP encapsulation and ihl = 0 to trigger.

Given this bug is critical, I cooked a patch before having
a fix in upstream kernel.

Tested:

 Compiled/booted
 Ran some tests on bnx2x and explicitely disabled hardware provided rxhash
 ethtool -K eth1 rxhash off
 ethtool -K eth2 rxhash off

Google-Bug-Id: 11465355
Effort: net-fixes
Change-Id: I813e4dc48cecb05f8edfa218304e1f13fd764323
KBuild: Export msm_rmnet.h to user space

Exposing msm_rmnet.h to user space using standard mechanism such that
user space applications do not have to use relative paths in include
list.

CRs-Fixed: 548664
Change-Id: I807f9854de1d0bf9961607c9ed54dd5ecef782dc
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
kernel: Prevent unnecessary rfkill event generation.

Prevent unnecessary rfkill event generation when the state has
not actually changed. These events have to be delivered to
relevant userspace processes, causing these processes to wake
up and do something while they could as well have slept. This
obviously results in more CPU usage, longer time-to-sleep-again
and therefore higher power consumption.

Change-Id: I3ac4e141fbdf1315b74d3bad6aa96f34b00c3f92
CRs-fixed: 398283
Signed-off-by: Vitaly Wool <vitalywool@gmail.com>
Signed-off-by: Mykyta Iziumtsev <nikita.izyumtsev@gmail.com>
Signed-off-by: Deepthi Gowri <deepthi@codeaurora.org>
Patch-mainline: v3.7
Git-commit: eab48345c2b2d791159aaac4a77000baa8dbc1ae
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
qdsp5: fix build

Change-Id: I1e97d8cd143639e6cf8cae6f36f5676700926359