nl80211: nl80211hdr_put() doesn't return an ERR_PTR

There are a few places which check nl80211hdr_put() for an ERR_PTR
but actually it returns NULL on error and never error values.  In
nl80211_testmode_dump() the return wasn't checked at all so I have
added one.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
[some whitespace changes]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: cb35fba360dfc3496e5d8a47e23ec5ccdfd90925
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: I5da1aafea35110a1ce606d402b1b96859d34b869
[akholaif@codeaurora.org: resolved conflicts manually]
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>

Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
nl80211: fix error path in nl80211_get_key()

Coverity pointed out that in the (practically impossible)
error case we leak the message - fix this.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 9fe271af7d4de96471c5aaee2f4d0d1576050497
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: I78c3631eabd04e86872faf65fa1e401dadb35a75
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
cfg80211: ignore supported rates for nonexistant bands on scan

Fixes wpa_supplicant p2p_find on 5GHz-only devices

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 1b09cd82d8c479700ef6185665839d1020b02519
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: Icadd03bfff17c5fd8da3e15e7b69b42a730e0ef0
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
msm: camera: Exit gracefully while camera daemon crashes

Add camera daemon shutdown handling in all camera
sub devices to exit camera gracefully and it helps
to restart camera.

Change-Id: I39643a16f100b873275efe3a0c6184fe54e52830
Signed-off-by: Suresh Vankadara <svankada@codeaurora.org>
msm:cpp: Fix for spurious interrupts from CPP hardware

When power up the CPP, it generates spurious interrupts
that can confuse microntroller and halt it. This fix
clears the interrupt requests from CPP before enable
Microcontroller at "Open Camera" event.

Change-Id: I3b75f2513efc30fb0f35dd086464f0b6c3a6ff9b
Signed-off-by: Iliya Varadzhakov <ivarad@codeaurora.org>
msm: camera: Cleanup msm generic buf queue on userspace crash

Clean-up the msm camera generic buff queue on userspace
crash to avoid invalid memory access in next session
which might lead to corruption in other modules
and system stability issues and also avoid memory leak.

Change-Id: Icd989cf9ef944c01e1193fead105963f745bcbc4
CRs-Fixed: 522939
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: camera: Fix for memory leaks and error handlers.

(a) Fix leak during error cases.
(b) Handle error cases like releasing devices in case of
    failures.

Change-Id: I9e01855e1de968cac6708aaf6a2522d277f93f7c
Signed-off-by: Azam Sadiq Pasha Kapatrala Syed <akapatra@codeaurora.org>
msm: camera: Cleanup msm generic buf queue handling

Clean-up the msm camera generic buff queue when all
client closes the handle and also provide init-deinit
ioctl for cpp to open-close the buff mngr handle.

Change-Id: Ie484174e0ffaee02e85c9c9cda8ac26103aaddd0
CRs-Fixed: 582261
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
msm: camera: Fix for invalid kernel memory access

Adjust the length of the command based on command type
to avoid invalid memory access in ISP driver.

Change-Id: Ie1c23b45426f9598dba3ad1ee91e6598e8232134
Signed-off-by: Aditya Jonnalagadda <ajonnala@codeaurora.org>
msm: camera: Fix possible NULL pointer dereference.

The result of memory allocation in msm_isp_get_buf is not checked for
success before use. This can lead to NULL pointer dereference.

Change-Id: Ia69d61d3db85cfcb1b33a789ccec28fade5ee313
Signed-off-by: Petar Sivenov <psiven@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: camera_v2: cci: check for NULL pointer

in function "msm_cci_subdev_g_chip_ident"
check for NULL pointer and return error
instead of assert

Change-Id: I76fa94e420133dfd56240f3baf4c846580123b03
Signed-off-by: Georgi Hristov <ghristov@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
msm: camera: Cleanup msm_generic_buff list while close

Cleanup the camera msm generic buffer manager list
when all v4l2 nodes are closed.

Change-Id: Ie309fcdddc3d83587a45dd5742e20a7e3fde19b8
Signed-off-by: Azam Sadiq Pasha Kapatrala Syed <akapatra@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
ARM: Improve vmalloc address checking in show_data()

There is an unhandled corner case with the current check
which has recently been hit. The nbytes argument may be
large enough for the range being dumped to cross a
boundary between page-table mappings, and dump addresses
which are vmalloc'd in the neighboring mapping.

Check every address being dumped to see if its vmalloc'd,
not just the address passed to show_data().

CRs-Fixed: 625442
Change-Id: I255b093808177321f5202dcacea337ee333bfc63
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
dma-contiguous: Retrun 'zero' pfn in case of error

When CMA allocator gets error return from the page
allocator framework, except for the -EBUSY case, it
will bail out. Caller depends on the 'pfn' for
confirming allocation successful or not. Return 0
for those error case.

CRs-Fixed: 647635
Change-Id: Ica4e04a9f9f18b1a29035ba2bae9deecfd68a5e8
Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
mmc: core: Fix clock frequency transitions during invalid states

eMMC and SD card specifications restrict the usage of a class of
commands while commands in other class are in progress. For example,
during erase operations the SD/eMMC spec. allows only CMD35, CMD36,
CMD38. If clock scaling is enabled and decide to scale up the clocks
it may be possible that CMD19/21 tuning commands are sent in between
erase commands, which is illegal as per specification.

Fix such illegal transactions to the card and also make clock scaling
statistics accountable only for read/write commands instead of time
consuming commands, like CMD38 erase, where transactions are independent
of bus frequency.

Change-Id: Iffba175787837e7f95bde8970f19d0f0f9d7d67d
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
soc: qcom: smd: Validate read and write addresses

The address from which data has to be read and the address to which the
SMD data has to be written is calculated based on the head and tail
indices for that SMD FIFO. If the indices are corrupted, then the
calculated pointer may be outside of the FIFO and may even be outside of
the range of SMEM.

Validate the read and write addresses to be with in the limits of
receive and send FIFO limits respectively.

CRs-Fixed: 550527
Change-Id: Ie5578f6aee73ea2b1435fea7c2a0a6dda14bff82
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>
msm: camera: Fix improper memory free in failure case

Remove improper drv_priv free in failure case and
add NULL pointer check to avoid kernel panic

Change-Id: If074eba245e93bf8fead505993a2611582e4398d
Signed-off-by: Yiduo Wang <yiduow@codeaurora.org>
msm: camera: Fix long overflow on the pix clk

Using unsigned long to avoid overflow because
pix clk frequencies might cause long overflow.
Fix this by using unsigned long instead of long.

Change-Id: Iaf184de26d8ae689efa297096be9f01db84faded
Signed-off-by: Peter Liu <pingchie@codeaurora.org>
msm: camera: sensor: Update CCI WR comamnd buffer size to 11 bytes

I2C command length is of 11 bytes, it includes 10 bytes of data and
one byte of WR command. Use 11 bytes char array to create command.

Change-Id: Idf330fef6b8da79c6b7f5a2839d88a68e10a96f9
Signed-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>
binder: NULL pointer reference

This fix handles a possible NULL pointer reference in
debug message.

Change-Id: Ia9044ba977cc8d43860fc8772ce595555f95c671
Signed-off-by: Paresh Nakhe <pnakhe@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>