usb: adb: Don't set rx_done on every set_alt to fix USBCV failure

ADB driver maintains rx_done to keep a track of whether RX
usb_request is already queued to hardware or not.
Commit 26444ce5 "usb: adb: Don't dequeue request during system
suspend" adds a regression where this flag may mistakenly get
set if host sends explicit SET_INTERFACE after SET_CONFIGURATION.
This results in ADB set_alt getting called back to back without
adb_disable. This behavior is not seen with hosts normally, but
USBCV compliance tester sends these requests.
Setting rx_done in set_alt results in adb_read to mistakenly
assume that RX request got completed with 0 length and it retries
queuing the RX request (which is already with hardware). This
results in usb_ep_queue failure and returning -EIO from adb_read
causes USB re-enumeration. USBCV compliance tests fail due to device
disconnect during test.

Change-Id: Ia5d922712d7805f8f8a3485cecd589871d234adf
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
msm: sps: Add integer wrap check for debugfs buffer

When converting debugfs buffer size to kilobytes value
there is a possible integer overflow and it may result
into negative value.

Fix the issue by adding integer wrap check for buffer
size just before conversion.

CRs-fixed: 564177
Change-Id: If4615561ea6a1c58e8be8c1b72f7881c068d8520
Signed-off-by: Dipen Parmar <dipenp@codeaurora.org>
usb: gadget: ECM: Check if data interface is UP while bus_suspend

CDC ECM requires DATA interface to support two alternate settings.
Bulk (IO) endpoints must be supported only in 1st alternate setting,
not in the default one. Alternate setting is chosen by host using
SET_INTERFACE command after SET_CONFIGURATION. SET_CONFIG results
in set_alt(0) followed by set_alt(1) when SET_INTERFACE is sent.
There is a possibility of USB bus getting suspended between this
window of SET_CONFIG and SET_INTERFACE. This currently results in
a crash in bus_suspend routine of ECM which assumes that by this
time DATA interface would be up. Fix this by adding a check in
ECM bus_suspend/resume routines to bail out if set_alt(1) is not
yet received by device.

CRs-fixed: 614120
Change-Id: Ic002b75f20d2d4f23f6a5dd7b4df365c25f20e0f
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Merge "msm: sps: Add integer wrap check for debugfs buffer"
msm: msm_fb: remove mmio access through mmap

Disable access to mm io and add
appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

CRs-Fixed: 474706
Change-Id: If25166f2732433ef967e99c716440030b567aae9
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
msm: audio: qdsp6v2: memeset msm_audio_stats to zero

memeset msm_audio_stats to zero before copying to user space.

Change-Id: I5f47bf85e36d46f726dddae68962a3d1cd06213b
CRs-fixed: 549307
Signed-off-by: Kiran Kandi <kkandi@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
msm: reap unused audio files

Removing this file as it is not used in this branch.

CRs-Fixed: 553769
Change-Id: I63cdbf75fc8b96fb8f3ad8de4a6eef7c91523e59
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Merge "msm: reap unused audio files"
ASoc: msm: qdsp6v2: Fix for NULL check

- Required check added for NULL pointer

CRs-fixed: 583939
Change-Id: I8b079c42ef06af9a817dc830c5f2d3c785232aa7
Signed-off-by: Mingming Yin <mingming@codeaurora.org>
Merge "ASoc: msm: qdsp6v2: Fix for NULL check"
msm: ipa: rm: add add_dependency_sync API

Adding a new blocking API for adding dependency on RM
which will return when the dependent resource is granted or timeout
occurs.

Change-Id: Ib5511b9ef91632551be3ccf28c9ddb1faf2db125
Acked-by: Yaniv Hasbani <yhasbani@qti.qualcomm.com>
Signed-off-by: Gidon Studinski <gidons@codeaurora.org>
Merge "msm: msm_fb: remove mmio access through mmap"
Merge "msm: audio: qdsp6v2: memeset msm_audio_stats to zero"
diag: Fix for diag debugfs buffer overflow

Diag debugfs buffer has potential buffer overflow scenario which can cause
memory corruption. Added safeguard to prevent this.
Change-Id: Ie1f099bb4bb626adff99ae225966aef70c1bc15e
Crs-fixed: 585147
Signed-off-by: Katish Paran <kparan@codeaurora.org>
mmc: block: check for NULL pointer before dereferencing

mmc block data can be NULL. Hence, check for NULL before
dereferencing md.

CRs-Fixed: 562259
Change-Id: I0182c216ec73347cdd2ea464f593839fffd242a9
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
msm: Fix NULL pointer dereference in sensors ADSP driver

Memory is allocated on the heap via kzalloc for temp variable.
Then it is passed through error checking. Error checking is
incorrect however, because instead of immediately returning -ENOMEM,
the function continues without returning. temp could be potentially
NULL when passed in to memcpy, causing a NULL dereference and writing
to that location.

Change-Id: Ib9faef2a542d1d8da35e1b3f7292596c9bddadba
CRs-fixed: 563553
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
Signed-off-by: Gopal G Goberu <ggober@codeaurora.org>
Merge "diag: Fix for diag debugfs buffer overflow"
defconfig: msm9625: Enable printk oops log buffer

Enable printk oops log buffer to be able to preserve kernel oops
message.

CRs-fixed: 561659
Change-Id: I6067eca30d32b74293b6c4cdf32ddddde36bd3f4
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
Merge "defconfig: msm9625: Enable printk oops log buffer"
printk: convert byte-buffer to variable-length record buffer

- Record-based stream instead of the traditional byte stream
  buffer. All records carry a 64 bit timestamp, the syslog facility
  and priority in the record header.

- Records consume almost the same amount, sometimes less memory than
  the traditional byte stream buffer (if printk_time is enabled). The record
  header is 16 bytes long, plus some padding bytes at the end if needed.
  The byte-stream buffer needed 3 chars for the syslog prefix, 15 char for
  the timestamp and a newline.

- Buffer management is based on message sequence numbers. When records
  need to be discarded, the reading heads move on to the next full
  record. Unlike the byte-stream buffer, no old logged lines get
  truncated or partly overwritten by new ones. Sequence numbers also
  allow consumers of the log stream to get notified if any message in
  the stream they are about to read gets discarded during the time
  of reading.

- Better buffered IO support for KERN_CONT continuation lines, when printk()
  is called multiple times for a single line. The use of KERN_CONT is now
  mandatory to use continuation; a few places in the kernel need trivial fixes
  here. The buffering could possibly be extended to per-cpu variables to allow
  better thread-safety for multiple printk() invocations for a single line.

- Full-featured syslog facility value support. Different facilities
  can tag their messages. All userspace-injected messages enforce a
  facility value > 0 now, to be able to reliably distinguish them from
  the kernel-generated messages. Independent subsystems like a
  baseband processor running its own firmware, or a kernel-related
  userspace process can use their own unique facility values. Multiple
  independent log streams can co-exist that way in the same
  buffer. All share the same global sequence number counter to ensure
  proper ordering (and interleaving) and to allow the consumers of the
  log to reliably correlate the events from different facilities.

CRs-fixed: 561659
Change-Id: I8fd2cdfe1b9a675f3f707cbd7b180a9c30e58f73
Tested-by: William Douglas <william.douglas@intel.com>
Signed-off-by: Kay Sievers <kay@vrfy.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
Git-commit: 7ff9554bb578ba02166071d2d487b7fc7d860d62
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git