msm: kgsl: Fix mem leak when page allocation fails

Page allocation may fail during OOM condition. Update
sglen and size to correct value (allocated) so that
they get freed in kgsl_sharedmem_free().

Change-Id: I1aa0ca77bb767523dfcf0f6cc3a21eac2b6b80e4
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
radio: iris: Avoid inconsistent free

There is a chance to of memory leak if we exit
from function early. Ensure to use free before
exiting from function.

Change-Id: I17dbecffc5713d95c66ecec0bffb5ed3c8660fe8
CRs-Fixed: 540334
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
msm: camera_v2: cci: check for NULL pointer

in function "msm_cci_subdev_g_chip_ident"
check for NULL pointer and return error
instead of assert

Change-Id: Ia27751c4d6f3d5ead1749e396ffa5c2773f1582b
Signed-off-by: Georgi Hristov <ghristov@codeaurora.org>
msm: sps: Add integer wrap check for debugfs buffer

When converting debugfs buffer size to kilobytes value
there is a possible integer overflow and it may result
into negative value.

Fix the issue by adding integer wrap check for buffer
size just before conversion.

CRs-fixed: 564177
Change-Id: If4615561ea6a1c58e8be8c1b72f7881c068d8520
Signed-off-by: Dipen Parmar <dipenp@codeaurora.org>
msm: reap unused audio files

Removing this file as it is not used in this branch.

Change-Id: Ibff0dbeca0cdae5447d3fd8857ffad296edfdd55
Signed-off-by: anish kumar <kanish@codeaurora.org>
msm: ultrasound: add verifications of some input parameters

Some security vulnerabilities were found.
To fix them, additional verifications of some input parameters
are required.

CRs-Fixed: 554575, 554560, 555030
Change-Id: Ie87a433bcda89c3e462cfd511c168e8306056020
Signed-off-by: Baruch Eruchimovitch <baruche@codeaurora.org>
wcnss: Fix Integer overflow

Integer overflow can lead to buffer
overflow in wcnss_wlan_write

Change-Id: I9e6f3439e1c8509bdb9c8c14b9aefe5611de8b03
CRs-Fixed: 547969
Signed-off-by: Arif Hussain <arifhussain@codeaurora.org>
msm: buspm: Correct size type in buspm_xfer_req

Variable size inside buspm_xfer_req
can be negative and thus would be a
large positive number resulting in arbitary
Kernel read. This patch corrects this value.

CRs-Fixed: 563529
Change-Id: I877db6960530d6c7d1486da9cfdc15a43e57e152
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
diag: dci: Preventing unitialized stack memcpy operation

At certain point in diag driver there can be memcpy operation
for the unintialized stack. Due to uninitilization of memory
user can obatin valuable information on accessing this stack
in userspace. This patch fixes that issue.

Change-Id: I4bfcf156300132dc426dcadce325e0c76c1d0357
CRs-fixed: 565808
Signed-off-by: Katish Paran <kparan@codeaurora.org>
msm: mdss: Prevent NULL pointer access

Current code has scope of dereferencing an already
NULL variable. Implementing proper error handling
for NULL variable.

Change-Id: Iba46e676ce42adc286f907e72300786d3391a9a9
Signed-off-by: Shalabh Jain <shalabhj@codeaurora.org>
uio: msm_sharedmem: Add new device driver for sharedmemory access

Add new device driver to provide a standard interface for its
clients (like RemoteFS and RFSA) to be able to memory map their
respective allotted shared memory address in the client's address space.
The shared memory (a transport buffer) address is unique for each
individual client and is made available to the driver via device tree.

This driver uses the existing UIO framework to facilitate the clients
mmap requirements. Each individual client will be able to use a unique
UIO device for this purpose.

CRs-Fixed: 477427
Change-Id: If07b88086b5f1b87845962818094644575629fcf
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
ARM: dts: msm: Add new 'sharedmem' devices

Add new devices which need to maintain the shared memory
address for RemoteFS and RFSA

CRs-Fixed: 477427
Change-Id: Id5f3ea2a827d5a30b06d872d7a72468f1fd7718f
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
defconfig: Enable msm_sharedmem UIO driver

Enable msm_sharedmem UIO driver on targets which use RemoteFS
(over QMI) and RFSA.

CRs-Fixed: 477427
Change-Id: I63d95aa0fcbbdc17d64fb7749ed50c3890551dce
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
qseecom: Fix error handling path in receive_req()

This patch fixes the error handling path in receive_req() function
called from userspace. Issue seen if user is calling the receive_req
function without calling the listener registration. qseecom_find_svc()
should return NULL if there are no services found.

Change-Id: Id51d8f48d7266b5acbc845f7b9ac0068d16b1ede
CRs-fixed: 496927
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
mdss: dsi: Resolving memory leak in parse dsi commands

Free buf variable before exiting function in error cases
in order to avoid possible memory leaks.

Change-Id: I8ebc3f0f3f40be85e312f9646374a074f1414bdb
Signed-off-by: Krishna Chaitanya Parimi <cparimi@codeaurora.org>
crypto: msm: check potential integer overflow on AEAD req length

According to the specification of AEAD, AEAD request cryptlen is
not a Fixed maximum and assoclen is also same. This could lead to
potential integer overflow, thus allocating less memory. So we
need to check potential integer overflow on AEAD request length.

Change-Id: I58a0c5e1a6e890bad30f7865e96b7db46337158c
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
mmc: card: fix arbitrary write via read handler in mmc_block_test

In mmc_block_test, the debug_fs based read function handlers write to an
arbitrary buffer which is given by any user. We add an access_ok check
to verify that the address pointed by *buffer is not in kernel space.
Only if the buffer is valid, do we continue the read handler.

Change-Id: I35fe9bb70df8de92cb4d3b15c851aa9131a0e8d9
Signed-off-by: Lee Susman <lsusman@codeaurora.org>
msm: Remove old unused sdio related code

Cleanup mach-msm by removing unused sdio related code.

Change-Id: I485deb7d6499771294b494f5542ba510c10255cb
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
csdio: Remove the driver

The driver is a legacy driver that is not used any longer
and its implementation is neither correct nor compiles.

Change-Id: I9862c0f93ccad6079a616f6997987d4e187a137c
Signed-off-by: Hamad Kadmany <hkadmany@codeaurora.org>
msm: qdsp6v2: Deleting kernel driver from arch/arm/mach-msm/qdsp6v2

Driver is registering under misc driver but exists under arch/arm/mach

Change-Id: I0930d3f56767569edefa1af3c7d45a724a219ce3
CRs-Fixed: 548017
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>