msm: vidc: Send ABORT in FLUSH command from the Client

When session error is sent to the client, client issues FLUSH
and release buffers commands. But as instance state is INVALID,
these commands are never sent to the firmware, instead FLUSH
DONE and Release buffer done are sent back to client even
though firmware might be working on these buffers which may
result into page faults.
This change fixes the issue by sending ABORT command to the
firmware at the time when driver receives FLUSH command. Then
firmware will release all buffers, clean up session and send
ABORT_DONE back to the driver.

CRs-fixed: 592920
Change-Id: Ie4c79a312d2336c68b858f5f5e2a85331cf55f7b
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: mdss: hdmi: Security check for EDID 3D data parsing

While parsing EDID (Extended display identification data) received
from TV for 3D data and other, proper buffer overflow check is done
to avoid data overflow or overwrite.
Also, replace snprintf with scnprintf for better memory copy results.

CRs-Fixed: 542823
Change-Id: I2603beea6eb88a92b013a1a45d960a4c3ba6c09b
Signed-off-by: Ajay Singh Parmar <aparmar@codeaurora.org>
ARM: dts: msm: Add NFC device for 8226-qrd devices

Add nfc-nci device to the device tree for 8226-qrd devices.

Change-Id: I7876fa95d30e55e2c0d2cb8a2010b06dc9c472da
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
ASoC: msm: Add DSP support for SRS on A2DP

- Enabling or disabling SRS effects on music playback on
  A2DP doesn't have any effect.
- Cause for this is, parameters for SRS effects were not send
  if the device is A2DP.
- Fix is to add a new kcontrol for A2DP and use the new kcontrol
  to send SRS parameters for A2DP case.

CRs-Fixed: 536895, 596010

Change-Id: Ia0c338cc0b6505ce518b76287b392e5e8011ae1b
Signed-off-by: Sharad Sangle <assangle@codeaurora.org>
msm: ultrasound: add verifications of some input parameters

Some security vulnerabilities were found.
To fix them, additional verifications of some input parameters
are required.

CRs-Fixed: 554575, 554560, 555030
Change-Id: Ie87a433bcda89c3e462cfd511c168e8306056020
Signed-off-by: Baruch Eruchimovitch <baruche@codeaurora.org>
msm: mdss: Avoid variable overloading

A particular variable is overloaded and used in 2 different
contexts. This causes overwriting of original value and leads
to incorrect error handling. This code adds a new variable to
avoid such condition.

Change-Id: Ibd040e6b4ce95759cc0011304940365c70e6c12a
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>
ASoc: msm: qdsp6v2: Fix for NULL check

- Required check added for NULL pointer

CRs-fixed: 583939
Change-Id: I8b079c42ef06af9a817dc830c5f2d3c785232aa7
Signed-off-by: Mingming Yin <mingming@codeaurora.org>
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
msm: msm_fb: remove mmio access through mmap

Disable access to mm io and add
appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

CRs-Fixed: 474706
Change-Id: If25166f2732433ef967e99c716440030b567aae9
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>
sched,cgroup: Fix up task_groups list

With multiple instances of task_groups, for_each_rt_rq() is a noop,
no task groups having been added to the rt.c list instance.  This
renders __enable/disable_runtime() and print_rt_stats() noop, the
user (non) visible effect being that rt task groups are missing in
/proc/sched_debug.

Change-Id: Ib337ebda0e752f838d787c03fe1b0a8f03ea0551
Signed-off-by: Mike Galbraith <efault@gmx.de>
Cc: stable@kernel.org # v3.3+
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/1344308413.6846.7.camel@marge.simpson.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Git-commit: 35cf4e50b16331def6cfcbee11e49270b6db07f5
Git-repo: git://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git
Signed-off-by: Syed Rameez Mustafa <rameezmustafa@codeaurora.org>
ARM: dts: msm: Add nfc device for msm8226 cdp

Add nfc nci device to the device tree for msm8226 cdp and nfcc
is dependant on I2C BLSP1 QUP3. The data is represented in
device tree format and pass by the driver using of framework API.

Change-Id: Ife9fb7ff485e3a896ea64893b794838003d1efd7
Acked-by: Umesh Jagga <ujagga@qti.qualcomm.com>
Signed-off-by: Houston Hoffman <hhoffman@codeaurora.org>
mm: fix calculation of dirtyable memory

The system uses global_dirtyable_memory() to calculate number of
dirtyable pages/pages that can be allocated to the page cache.  A bug
causes an underflow thus making the page count look like a big unsigned
number.  This in turn confuses the dirty writeback throttling to
aggressively write back pages as they become dirty (usually 1 page at a
time).  This generally only affects systems with highmem because the
underflowed count gets subtracted from the global count of dirtyable
memory.

The problem was introduced with v3.2-4896-gab8fabd

Fix is to ensure we don't get an underflowed total of either highmem or
global dirtyable memory.

Change-Id: Ib0c4a8f99870edc5ded863b88a472f2836c690d2
Signed-off-by: Sonny Rao <sonnyrao@chromium.org>
Signed-off-by: Puneet Kumar <puneetster@chromium.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Tested-by: Damien Wyart <damien.wyart@free.fr>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: c8b74c2f6604923de91f8aa6539f8bb934736754
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
msm: kgsl: avoid zero length scatterlist allocation

During sglist allocation we calculate sglen as
per below

sglen_alloc = PAGE_ALIGN(size) >> PAGE_SHIFT;

sglen_alloc can be zero if size falls within the
last page. For example, when size = 0xFFFF_FF7B,
PAGE_ALIGN(0xFFFF_FF7B) will be 0, considering
0x1000 (4kb) PAGE_SIZE. if kzalloc() with
zero size, it will return ZERO_SIZE_PTR which is
not NULL and we always do NULL check. Dereferencing
ZERO_SIZE_PTR will lead to a distinct access fault.

Conflicts:
	drivers/gpu/msm/kgsl_sharedmem.h

Change-Id: Ibcc6198438c13b5111be0faa736328db92511597
CRs-Fixed: 563106
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Merge "qdsp5: memset stack buffer allocation."
msm: mdss: fix display time out when taking ESD test

Currently, Command engine will be blocked when sending
display off command in ESD test. Root cause is
panel BTA will affect DSI status. Reset dsi driver
when command engine is blocked.

Change-Id: I729b079d2becfad60630fc941d36199f95618eab
Signed-off-by: Shuo Yan <shuoy@codeaurora.org>
diag: Fix for diag debugfs buffer overflow

Diag debugfs buffer has potential buffer overflow scenario which can cause
memory corruption. Added safeguard to prevent this.

Crs-fixed: 585147
Change-Id: Ie1f099bb4bb626adff99ae225966aef70c1bc15e
Signed-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>
Merge "msm: kgsl: avoid zero length scatterlist allocation"
Merge "msm: camera: Remove unused code used to map userspace buffers."
Merge "msm: ultrasound: add verifications of some input parameters"
Merge "msm: mdss: Avoid variable overloading"
Merge "msm: msm_fb: remove mmio access through mmap"