msm: camera: Fix various small issues in Actuator driver

Bound check and validate userspace parameters direction,
number of steps and direction sign. Also fix possible
memory leak in certain error cases.

CRs-Fixed: 511349
Change-Id: Icaa324468574494fb40f2de78e522090806744cb
Signed-off-by: Yiduo Wang <yiduow@codeaurora.org>
msm: mdss: Move histogram completion initialization to pp_init

The histogram completion structure only needs to be initialized fully
once, and this can be done when the pp resource structure is created.
Otherwise, when enabling the histograms, it is sufficient to use the
reusable INIT_COMPLETION, in order to avoid any wait_queue errors.

Change-Id: Id4bfb19c91bd5ab07c01a5eb347ba50621fe8a97
Signed-off-by: Benet Clark <benetc@codeaurora.org>
Merge "msm: mdss: Move histogram completion initialization to pp_init"
msm: camera: Fix crash in ispif release

There is a BUG_ON in ispif release function for
ispif base address. but in case of just open and close
of ispif subdevice leads to ispif base NULL.

BUG_ON is removed and proper error is added in ispif
release function to fix the issue.

Change-Id: I0cc12d52aff9db0d9bb8844473f9bd6547270e27
CRs-Fixed: 642603
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
Merge "msm: camera: Fix crash in ispif release"
msm: kgsl: Mark the IOMMU setstate memory as read only

Mark the IOMMU setstate memory as read only in the pagetable.

Change-Id: Ic0dedbadb19e499c749cd744c3e89be3bcb4c2a2
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
msm: kgsl: Protect CP_STATE_DEBUG_INDEX

Put CP_STATE_DEBUG_INDEX and CP_STATE_DEBUG_DATA under protection
to keep it from being written from an IB1. Doing so however opens
up a subtle "feature" in the microcode: memory read opcodes turn off
protected mode in the microcode to do the read and then turns it
back on regardless of the initial state. This is a problem if the
memory read happens while protected mode is turned off and then we
try to access a protected register which then complains and goes boom.

To account for this irregularity explicitly turn back off protected
mode in all the places where we know this will be a problem.

Change-Id: Ic0dedbad1397ca9b80132241ac006560a615e042
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Merge "msm: camera: Fix various small issues in Actuator driver"
Merge "msm: kgsl: Mark the IOMMU setstate memory as read only"
Merge "msm: kgsl: Protect CP_STATE_DEBUG_INDEX"
unix: fix a race condition in unix_release()

As reported by Jan, and others over the past few years, there is a
race condition caused by unix_release setting the sock->sk pointer
to NULL before properly marking the socket as dead/orphaned.  This
can cause a problem with the LSM hook security_unix_may_send() if
there is another socket attempting to write to this partially
released socket in between when sock->sk is set to NULL and it is
marked as dead/orphaned.  This patch fixes this by only setting
sock->sk to NULL after the socket has been marked as dead; I also
take the opportunity to make unix_release_sock() a void function
as it only ever returned 0/success.

Dave, I think this one should go on the -stable pile.

Special thanks to Jan for coming up with a reproducer for this
problem.

CRs-Fixed: 660580
Change-Id: I0e39b84464cf3f4c9daf8677bba444d0d6d94825
Reported-by: Jan Stancek <jan.stancek@gmail.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: ded34e0fe8fe8c2d595bfa30626654e4b87621e0
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/
Signed-off-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
Merge "unix: fix a race condition in unix_release()"