arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw

Added error checks for upper limit of param.num in DFE ioctls
for register array r/w

Change-Id: I62d2eac38024c6c64f8d2d0f6d65f409569b2a76
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
ASoC: msm: qdsp6v2: Fix ion_import failure

When ion_import_legacy api fails,we should not
destory the client instead just bail out.

CRs-Fixed: 620370
Change-Id: Icbcf4dadd5f00e1cf4d7a356ee1c0f5835dcb4c4
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
msm: ipa: fix potential heap overflow in intf property queries.

Number of TX/RX/EXT properties to be read is supplied by
user-space and if these values are maliciously set too large,
heap overflow and memory corruption can result. This commit
caps the max allowed interface properties.

Change-Id: I9f5bf8b5e9a1b3b47b0741c0b00d5fafc77b28e2
Signed-off-by: Ravi Gummadidala <rgummadi@codeaurora.org>
Signed-off-by: Venkata Aravind <venkata@codeaurora.org>
Merge "arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw" into jb_3.2.1.1
Merge "msm: ipa: fix potential heap overflow in intf property queries." into jb_3.2.1.1
qseecom: Add basic suspend resume functionality

If ce clock is not disabled in suspend state, memory may be corrupted and
device can not wake up. Thus, if clock is enabled, we disable it in qseecom
suspend function and re-enable it again in resume function.

Change-Id: I70349ad3070c340add1f3fbe392a4bec2b8af9bf
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: update clock ref count when bus scaling timer is running

when there are multiple enable/dislable clock operations, ce clock
ref count is not updated correctly when the timer to disable clock
is running. Specifically, the ref count is not decreased when the
old operation is finished and then we reset clock for the new enable
clock. Thus, the ce clock is not disabled after all operation are
completed due to incorrect clk ref count. We make a change to
decrease clock reference count before reset timer, when the timer
is running, then clock is disabled when all ce clock operations
finish and the timer expires.

Change-Id: If71fd526acd9a74bf21731841fae0b98e76a89b5
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: change qseecom bus scaling timer operation

To ensure ce clock is not disabled before tz operation is completed,
we delete the old timer when tz side operation begins, and then add
a new timer after tz operation is completed.

Change-Id: I4bc8fe3d9305cc1ed5db8e6490832fcc791ef3d7
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: Ensure CE clk is managed properly

Clk access ref count is not updated correctly when issuing a
request that requires enabling clk. this results in leaving the
clk on during regular operation resulting in failure of the
device to go into low power mode.

Change-Id: I80232433ff09277fe83d78142dcec75e7493d96e
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: Validate the pointer returned by ion_import_dma_buf

Do a "IS_ERR_OR_NULL" check for the return value of
ion_import_dma_buf.

Change-Id: Iaac8b59b1f076d002430e0e6aba055bd88c83ed7
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
msm: qdsp6v2: Increase max ports in APR

Increase the maximum ports in APR. Some Apps may support
multiple clients which exceeds the number of clients
supported in APR. This change increases number of ports
used in APR upto 8 sessions.

Change-Id: I06624330845681b4414dd470ab7aed669d690ba0
Signed-off-by: Aravind Kumar <akumark@codeaurora.org>
msm: vidc: add input parameter checks to exported functions

Check for invalid null parameter passed to functions

CRs-Fixed: 606467
Change-Id: I860ca3d69d8705c7b3d6f27f9504b567be5aeea3
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
ASoC: msm: Add check for both offset and index variable

-The offset and index variable may leads to array out of
boundary exception.
-Added offset and index overflow check.

Change-Id: I1f71ee595944573e85d77d2001f656bd8ba53806
CRs-fixed: 583931
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>
msm: kgsl: don't use sscanf()

Friends do not let friends use sscanf().

CRs-Fixed: 563605
Change-Id: Ic0dedbad56af5bbee4fc833701d8bc93b118efa9
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
qseecom: Validate pointer offset in qseecom_send_modfd_cmd

Validate cmd_req_buf pointer offset in qseecom_send_modfy_cmd, and
make sure cmd buffer address to be within shared bufffer.

Change-Id: I431511a92ab2cccbc2daebc0cf76cc3872689a97
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
nl80211: nl80211hdr_put() doesn't return an ERR_PTR.

There are a few places which check nl80211hdr_put() for an ERR_PTR
but actually it returns NULL on error and never error values.  In
nl80211_testmode_dump() the return wasn't checked at all so I have
added one.

Conflicts:
	net/wireless/nl80211.c

Change-Id: I5da1aafea35110a1ce606d402b1b96859d34b869
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggopal@qti.qualcomm.com>
lib/scatterlist: error handling in __sg_alloc_table()

I was reviewing code which I suspected might allocate a zero size SG
table.  That will cause memory corruption.  Also we can't return before
doing the memset or we could end up using uninitialized memory in the
cleanup path.

Change-Id: Icee6be8ea22644d7f16264d9d2a0887c7145996b
CRs-Fixed: 611562
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
msm: vidc: add kzalloc success check for new HAL session

Memory allocation must be verified before proceeding.

CRs-Fixed: 606527
Change-Id: Ic340bf9926f84507294c576997948ddbe61dd62f
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
msm: vidc: add kzalloc success check for new q6 HAL session

Memory allocation must be verified before proceeding.

CRs-Fixed: 606522
Change-Id: I809acc21dcd5e680827feb5d0fa8f45814bf4773
Signed-off-by: Jorge Solano Altamirano <jsolano@codeaurora.org>
ASoC: msm: qdsp6v2: fix possible integer overflow.

Check integer overflow before multiplying struct size. If that happens
should return immediately. In addition if param length is greater than
MAX size from spec, better return error.

CRs-fixed: 605273
Conflicts:
	sound/soc/msm/qdsp6v2/msm-compr-q6-v2.c

Change-Id: Iaad5f6059f02db4899f2f1762891711b2be3d15b
Signed-off-by: Fred Oh <fred@codeaurora.org>
Signed-off-by: Abhishek Ranjan <aranja@codeaurora.org>